Summary: Review all ten merged product PRs, retain curated bilingual release guidance and contributor credit, and include the inbox shutdown correction. Record the new Windows binary and native runtime-replacement reassessment alongside the process-catalog fixture cleanup.
Verification: Catalog validation, all ten release-note tests, bilingual rendering, complete merged-PR references, prior-record comparison, and public-text privacy review passed. Product qualification and exact-head CI passed before this documentation update.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Problem: The model-settings bot integration test left SQLite handles open when its isolated home was removed on Windows.
Root cause: Controller shutdown does not own process-wide history and usage catalogs, but the fixture only closed its session controller.
Fix: Fence both catalog lifetimes around the isolated test home and report any shutdown failure before temporary-directory cleanup.
Verification: The unchanged fixture reproduced history and usage database sharing failures on native Windows ARM64. After cleanup ownership was corrected, the full bot suite passed 20 native Windows repetitions and 10 race-enabled repetitions; focused lint passed.
Problem: Controller shutdown could return while an autonomous inbox scan still touched its sidecar, racing directory removal and controller replacement.
Root cause: The shutdown boundary joined sidecar opening, but NextQueued refreshed disk state after leaving that boundary.
Fix: Serialize sidecar opening and queue scans with shutdown. Release this gate before host admission so a dispatcher can retire its own controller without waiting on itself.
Verification: The shutdown barrier regression fails against the previous implementation and passes for Close and ReleaseResources. Focused race tests passed 20 repetitions; stale foreground recovery passed 1000 race repetitions. Full root and Desktop suites, owning control/serve/sessioninbox race suites, golangci-lint, and repository lint passed.
Review the full nine-PR first-parent range and current product behavior. Remove duplicated implementation summaries, correct settings-overlap wording and delivery targets, include MCP and history fixes, and document old Serve and status-bar upgrade behavior. Credit the verified adopted contributors. Both rendered languages, catalog validation and all 10 release-note tests pass; prior release records remain unchanged.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Problem: The final CI lint gate rejected the new zero-based stripe selection loop. Root cause: the helper used a classic counted loop despite the repository integer-range rule. Fix: retain the same search bounds using Go integer range. Verification: full root golangci-lint and workspacelease race tests pass; no product code changes.
Pin the final product source and executable digest after full native Desktop tests and held-request, no-runtime, restart and predecessor-read acceptance. Record the shutdown, display-read and nonce regressions discovered during qualification, and distinguish the later test-only stripe fixture repair from product changes.
Parallelism tests must choose distinct stripes after canonical path normalization, including macOS temporary-directory symlinks and Windows case folding. Bound hierarchy/path acquisitions and register owner cleanup so assertion failures cannot strand a lease.
Problem: Native full-suite qualification found saved credentials being pinned into the process environment during a display-only refresh, and distinct prompt-history directories occasionally sharing a cache nonce.
Root cause: Tab image-capability metadata used the mutating configuration loader. Prompt-history tape identity relied on wall-clock ticks, which can repeat across consecutive reads on Windows.
Fix: Read metadata configuration without credential resolution or migrations, and use an opaque random nonce for each new history tape. Preserve capability projection and existing cache-hit behavior.
Verification: Both direct metadata refresh and frozen-clock identity tests fail before the fix. The related history, metadata and credential tests pass 10 race repetitions locally and 50 native Windows repetitions. Desktop lint and repository lint pass; the full native Desktop suite is running on the final binary sources.
Problem: Native Windows qualification intermittently failed to reconnect a single-instance MCP helper, leaving its listening port and temporary files occupied after forced termination.
Root cause: SDK teardown cancelled the process context before the transport could offer stdin EOF. The graceful path also retained its Windows Job handle and released bounded instance slots before process retirement.
Fix: Retire the current session and endpoint before cancelling their contexts, finish the Windows Job after a graceful exit, and return instance capacity only after cleanup. Cover shutdown and invalidation ordering plus Windows Job and slot retirement.
Verification: The ordering regression failed on both old paths and passes 20 race repetitions. Native Windows reconnect failed 3 of 100 repetitions before the fix and passed 100 afterward; native Job and shutdown regressions pass 20 repetitions. Full root Go, plugin/proc race, Desktop MCP tests, root lint and repository lint pass. Final full Desktop qualification is still in progress.
Problem: model labels are untrusted filename hints, and replacement of separators did not explicitly reject NUL or control characters across platforms.
Root cause: filename construction mixed sanitization and path joining inside the large persistence module, leaving its component invariant implicit to callers and static analysis.
Fix: move the path helpers to their owning file, validate the final portable filename component and use a timestamped session fallback for invalid labels. Normal filenames and provider-visible model IDs remain unchanged.
Verification: traversal, Windows separator, namespaced, NUL, newline and Unicode model cases passed; full Agent, Control and Serve race suites, Go lint, gofmt, repository lint and diff checks passed.
Record the verified main-v2 merge of PR #9974 as the model-settings baseline. The same release-gate code was already integrated and tested in this branch; this ancestry-only merge removes ambiguous parallel merge bases from final review and CI comparison.
Problem: the CI gofmt gate rejected empty-line spacing left where lifecycle tests were extracted.
Root cause: only the new destination test file was formatted before the preceding push.
Fix: run gofmt on each changed source test file.
Verification: gofmt, diff checks and repository lint passed; this changes whitespace only.
Problem: Ubuntu CI observed inbox publication after a transition fixture had returned and begun deleting its temporary session directory.
Root cause: real controllers and replacement owners lacked teardown, while cleanup callbacks registered before builder-created TempDirs ran too late.
Fix: close the final Server owner in defers before any TempDir cleanup, retain explicit closure for manually fabricated detached entries, and release blocked transition gates before teardown. Group the related real-runtime fixtures into a focused test file without widening repository budgets.
Verification: the failing transition passed 100 race repetitions; the sibling lifecycle suite, Go lint, repository lint and diff checks passed.
Problem: the managed-settings endpoint accepted unlisted model names through the generic resolver, and static analysis followed request selectors into session paths and controller diagnostics.
Root cause: generic resolution permits temporary model names; filename replacement was implicit, aggregate capacity arithmetic could overflow, and a controller object was used only to format its type.
Fix: resolve exact snapshot catalog entries before publication, preserve namespaced model IDs, explicitly keep generated session filenames to one path component, use overflow-safe append growth, and report unsupported snapshot controllers without formatting the object.
Verification: invalid-selector and namespaced-model regressions, full Serve/config/agent race suites, focused Desktop model-settings/rebuild/probe race tests, both Go linters, repository lint, and diff checks passed.
Integrate PR #9974 so final model-settings qualification includes canonical Windows runtime identity, delete-sharing update reads, bounded atomic task snapshot publication, and deterministic workspace-lease fixtures.
Verification: complete Serve, repair, taskmonitor and workspacelease race suites passed on the combined tree; repository lint and diff checks passed. The Windows product fixes previously passed native regression repetitions and the full Windows Desktop Go suite alongside model settings.
Integrate the reviewed read-evidence runtime and presentation changes while preserving immutable model-setting snapshots and application receipts.
Resolve bundle limits from fresh production output: Chinese locale chunks measure 64734 and 65499 bytes, while initial raw assets measure 2492541 bytes, 3688 bytes (0.148%) above main-v2. Preserve narrowly rounded ceilings and all independent gzip and chunk limits.
Verification: production build and bundle checks, full control/boot/serve/provider/agent race suites, Desktop Go suite, repository lint, and diff checks passed.
Problem: mainline Ubuntu CI could hang for ten minutes in the parallel-file fixture.
Root cause: random temporary paths occasionally mapped a.go and b.go to the same bounded lock stripe, where production correctly serializes writes.
Fix: use the existing distinct-stripe path helper, bound acquisition with a context deadline, and register both owner cleanups before acquisition.
Verification: 1,000 focused race repetitions, full workspacelease race suite, and repository lint passed.
Problem: The authorization-restoration test could leave a replacement controller publishing inbox state while TempDir cleanup ran.
Root cause: The fixture did not close the server that owns the replacement. The same omission existed in sibling model-switch recovery tests.
Fix: Register server cleanup throughout that fixture family so the existing controller shutdown fence and owned background work finish before temporary directories are removed.
Verification: All affected model-switch tests passed 100 repetitions under the race detector.
Problem: Task stop commands could fail to persist their state when a short-lived Windows reader held snapshot.json without delete sharing.
Root cause: The store bypassed the shared atomic rename boundary and returned the first transient sharing violation.
Fix: Retain the per-task CAS lock while ClaimRename retries the same staged snapshot. No copy fallback or visible-file truncation is allowed. Cover the native reader contract in Windows PR CI.
Verification: A real Windows read handle reproduced access denied before the fix. The regression passed 50 repetitions after it; the full taskmonitor race suite, Go lint and repository lint passed.
Exercise a noncanonical spelling against a real detached controller so the response identity regression is deterministic on Unix as well as Windows. The selected runtime epoch must still belong to the detached owner.
Verification: The focused owning-package race test passed 10 repetitions.
The Windows PR smoke package list does not include Serve, so the detached status path regression first failed after merging. Add its bounded HTTP runtime-state tests to the Windows PR job without widening the full package sweep.
Verification: Native Windows status regression passed 100 repetitions after the fix; workflow diff and repository lint passed.
Problem: Windows status queries returned a differently spelled session path, and concurrent legacy-update recovery could fail to archive its marker.
Root cause: The owned status response exposed the resolved display path instead of its identity key. Unlocked marker reads used handles without delete sharing, blocking a locked archival rename.
Fix: Normalize the owned status path once and use shared regular-file reads for pending markers, marker digests, and installed update state. Preserve transaction revalidation and snapshot identity after archival.
Verification: Native Windows status reproduction failed 10 times before the fix. Status, concurrent recovery, and held-reader archival tests passed 100 repetitions after the fix. Full repair and Serve race suites, focused reader race tests, Go lint and repository lint passed.
Record the qualified product commit, native executable identities, no-runtime saves, local and SSH credential boundaries, restored connection labels, and predecessor readback. Preserve final CI, review, and release publication as separate gates.
Problem: Restoring a session could leave the model selector tooltip naming the first connection until its menu was opened.
Root cause: The initial catalog was loaded before the runtime became ready and was only refreshed for tab identity or explicit catalog changes.
Fix: Refresh the catalog when readiness, session identity, or model label changes while retaining request sequence fencing.
Verification: Model switcher restoration regressions, production frontend build, and repository lint passed. Full frontend suite is running.
The base advanced to e35795aec (#9971) and the PR conflicted. A conflicted PR
also stops every pull_request-triggered workflow, because GitHub cannot build
the merge ref; only pull_request_target guards kept running.
Resolutions:
- internal/eventwire: the base moved the Event struct to event.go, so the
readStatus/readPause fields, the two ToWire cases and the kindNames entry
moved with it.
- Composer.tsx: keep the base's runtimeState-aware runStateText and its dot
condition, and render the read-status line through them.
- check-bundle-budget.mjs: re-measured the merged build and ratcheted the
locale chunks (64606 / 65349 B) and the initial raw payload (2488853 B); the
useController.ts file-size baseline follows the base's growth.
Verification: go build ./..., go vet ./..., gofmt -l clean, go run
./tools/repolint clean, go test ./... (only the pre-existing Darwin
TestMigrateFlatInstallToVersioned), cd desktop && go test ./..., pnpm
typecheck, pnpm build with every bundle budget, and the frontend CI test plan.
Problem: the review's F1 fix recorded rebuild-authorized paths only in the
branch that parses constraints from the turn text. The controller publishes
constraints through runtimepolicy.WithContext for every user turn, so on the
desktop and CLI paths the record never ran and the rebuild waiver silently
stopped applying.
Root cause: the record call sat inside the text-parsing branch instead of after
constraint resolution, and it did not distinguish the user's own turn from a
sub-agent's model-authored prompt.
Fix: record after the constraint and inheritance resolution, skip when the turn
already carries a host set or when the input is a sub-agent prompt, and let
inherited constraints carry the parent's authorized paths.
Verification: go build ./..., go run ./tools/repolint clean, go test
./internal/agent ./internal/runtimepolicy; new tests cover the host-published
path and the sub-agent prompt path.
Cache-impact: none - host-side authorization state only.
Problem: docs/plans/read-evidence-repair.en.md was the repository's only
language-suffixed doc with no counterpart, while the rest of this PR's docs
(TOOL_CONTRACT.md / TOOL_CONTRACT.zh-CN.md) ship both languages.
Fix: add the Chinese version mirroring the English plan.
Verification: go run ./tools/repolint clean; docs-impact guard.
Problem: a parallel tool goroutine that outlived its batch past
parallelStragglerGrace kept reading a.turn and a.reads while the next turn
zeroed them in beginRunTurn, an unsynchronized read/write pair that could also
count a spurious violation in the new turn.
Root cause: the batch declares a straggler's result unknown but never joins it,
and per-turn state is reset in place.
Fix: count live parallel batch goroutines and drain them, bounded by the same
grace, before the reset. A goroutine that ignores its cancelled context past
the bound keeps today's unknown-outcome behavior.
Verification: go build ./..., go run ./tools/repolint clean, go test
./internal/agent (new TestStragglerDrainWaitsForAbandonedGoroutines).
Cache-impact: none - host-side ordering only; provider-visible bytes unchanged.
Problem: the live session-context matrix pins deepseek-v4-flash to effort
"high", which the anthropic-kind provider rejects (UNSUPPORTED_REASONING_EFFORT:
supported [disabled]), so the paid cache check never runs.
Fix: pin the fixture to "disabled", the effort the fixture's own
thinking:"disabled" setting already implies. Verified live: 1408/1508 prompt
tokens cached on repeats, one miss per session-context change.
Problem
Review found that the read-evidence gate could be waived by model-authored
text, that a writer reached through use_capability skipped both the evidence
and the anchor gate, and three smaller defects: a fail-open declaration error,
duplicate target reads per batch, and a rollback mode that permanently blocks
writes. Two ordering defects dropped a stalled read's strategy advice and the
final round's usage accounting.
Root cause
rebuildAuthorized re-parsed a.turn.turnInput at write time, and for a sub-agent
that text is the parent model's task prompt; background sub-agent jobs also run
on a root context, so they re-derived every constraint from that prompt instead
of inheriting the host's. The anchored-writer exemption keyed on the resolved
tool while the anchor audit keys on the model-visible name.
Fix
- Record the rebuild-authorized paths once from the user's turn input into
runtimepolicy.Constraints and authorize by membership.
- Carry the spawning turn's host constraints into background job contexts.
- Audit a proxied anchored writer under its resolved name.
- Fail closed when a writer cannot declare its target while a read requirement
is outstanding, and memoize the batch preflight verdict per call.
- Stamp the legacy observation owner with the same source snapshot as the
pipeline owner.
- Keep every owed pivot advice in a set, and observe usage before the pipeline
read-pause return.
Verification
- go build ./..., go vet ./..., gofmt -l clean, go run ./tools/repolint clean
- go test ./...: only the pre-existing Darwin TestMigrateFlatInstallToVersioned
failure, reproduced unchanged on the base commit
- new regression tests for the waiver, background inheritance and pivot set
- live DeepSeek matrix (overwrite + full_pages, 2 models x 2 efforts, 29
requests / 192k tokens): 7/8 passed; the one failure is a recorded model
content mismatch, not a gate bypass; cache hit 3584-53888 of 3996-65167
prompt tokens
Cache-impact: none - no provider-visible bytes change; the golden files are
untouched.
Problem: a failed final settings bind could leave subsequent retries stuck
with a stale write authority even after the session lease was reacquired.
Root cause: reacquiring the lease did not rebind the outgoing controller
before its migration snapshot.
Fix: secure the lease and write authority together before taking that
snapshot. Keep final publication failure atomic and expose its boundary
through the existing test hook.
Verification: the new real-lease failure test fails without the fix and
passes with it under race detection. Model settings, deferred rebuild and
authority race tests, full Desktop tests, golangci-lint and repolint pass.
Problem: restoring the main-v2 frontend contract exposed two repolint
file-size violations that the merge loss had hidden. desktop/frontend/src/lib/
types.ts grows 6 lines (the WireReadStatus re-export, the read_status event
kind, and the readStatus/readPause wire fields) and useController.ts grows 1
line (the read-status reducer wiring and pause upsert).
Fix: update only those two file-size entries to their measured values.
Verification: go run ./tools/repolint (clean, 1232 baselined findings);
pnpm typecheck; pnpm build.
Problem
PR #9966's head does not build. desktop-prepare, desktop, desktop-macos,
desktop-windows, app-memory and the root prepare job all fail on TypeScript
errors in TurnCheckDetails, TurnResultSummary, WorkspacePanel,
WorkspaceTurnResult, bridge, completionResultState and transcriptRecordBytes.
Root cause
The branch's merge of main-v2 resolved desktop/frontend/src/lib/types.ts and
four consumers against the branch's older copy, dropping main-v2's
completion-verification and turn-result contract: WireTool.verifying,
WireEvent.receipt, WireCompletionSummary's
receipt/turnId/checkpointTurn/checking/liveChecks/changed_files, the
TurnChanges/TurnFileChange/WireCompletionReceipt re-exports, HistoryMessage's
completion fields, the withTurnResult/withRunningChecks wiring in
useController, the recordBytes module import in transcriptStore, and
TurnResultSummary in TranscriptCards. check-bundle-budget.mjs also reverted
main-v2's ratcheted ceilings, so the build failed the CSS budget at 120.4/120.0.
Fix
Rebuild each affected file from main-v2 and re-apply the branch's read-evidence
additions on top: the read_status reducer case, the
readStatuses/readStatusClosed lifecycle resets, incomplete_read ->
upsertReadPause, historyNoticeItems centralization, the role="status"
incomplete_read notice, and the merged bundle-budget ratchet measured from the
combined build (CSS 120.4, zh 63.0, zh-TW 63.8, raw 2423.7 KiB).
Verification
- pnpm typecheck
- pnpm build: eslint, CSS checks, tsc, vite build, all bundle budgets pass
- node scripts/run-ci-tests.mjs: 387/387 commands
- go test ./internal/agent ./internal/tool/... ./internal/readcoord
./internal/provider ./internal/eventwire ./internal/boot
- cd desktop && go test ./...
Cache-impact: none - desktop frontend only; the provider-visible system prompt,
tool schemas and request bytes are unchanged.
Problem: delayed remote status could revoke a newer runtime token, and
untracked publication kicks could create inbox sidecars during teardown.
Root cause: ownership lacked a Serve-wide sequence and incarnation, offer
release was separate from reconciliation, and Close did not seal new opens.
Fix: pin authenticated connection identity atomically, order all ownership
receipts, reconcile releases under the route lock, and distinguish rejected
installs from unknown results. Seal inbox creation without a dispatcher
self-wait. Remove superseded settings helpers and satisfy repository lint.
Verification: both Go modules pass full tests; focused ownership and inbox
race tests pass; root and Desktop golangci-lint, repolint, frontend types,
focused settings tests and production bundle checks pass. Native final
candidate qualification remains in progress.
Problem: same-topic sessions shared uncertain submissions, reopening a tab
stranded durable receipt checks, and a lost remote turn_done kept Transcript
running after the authoritative runtime became idle.
Root cause: request identity reused the topic draft key, receipt reads reused
the original write generation, and runtime liveness only changed a return
flag rather than the shared transcript reducer. The CI race also exposed a
test helper replacing tab.Ctrl without App.mu.
Fix: key pending requests by durable local path or remote host/workspace/path;
protect shared drafts from late receipts; locate and revalidate an existing
session owner for read-only receipt lookup while retaining strict write
fences. Reconcile trusted idle through backend_status and coalesced history,
fencing optimistic/new turns and session changes. Lock the test replacement.
Verification: Desktop go test -p 1 ./... and go test -race -p 1 ./...;
targeted receipt/context race cases; macOS and Windows golangci-lint;
frontend test:all, test:app-lifecycle, typecheck, 101 remote surface checks,
Chromium runtime-state scenarios, production build and repolint.
Measured initial raw assets: 2483436 -> 2484668 bytes (+1232, 0.050%).
Set only the raw startup limit to its next decimal ceiling, 2426.5 KiB;
all gzip, CSS and individual chunk limits remain unchanged.
Register job completion under the session ownership lock, fence follow-ups to their original session, and preserve unknown remote facts until valid per-session confirmation. Keep runtime projections memory-only and validate required wire fields before decoding.
Integrate main-v2 turn-result work and resolve bundle budgets from measured artifacts. Add race, wire, receipt-loss, metadata, and browser regressions. Validate full root tests and race, Desktop tests and targeted race, platform lint, frontend tests, production build checks, and Chromium flows.
Problem: the read evidence branch diverged from the latest main-v2 desktop runtime.\nRoot cause: overlapping transcript and event wiring changes produced merge conflicts.\nFix: resolve conflicts while retaining the read evidence implementation.\nVerification: focused agent, provider, builtin, and eventwire tests.
Problem
The current mainline includes frozen turn changes and recorded check outcomes that must coexist with runtime settings admission.
Root cause
Both integration lines update shared controller, Desktop and frontend ownership surfaces and their measured startup budgets.
Fix
Merge main-v2 at 8c9932dbe6, retain both ownership changes, and resolve the budget conflict using the combined generated assets.
Verification
The combined production assets contain 2481108 raw startup bytes and locale gzip payloads of 64342 and 65119 bytes. The bundle checker passes with bounded rounding headroom. Integrated Go/frontend suites and independent ownership review continue before qualification.
Problem
Accepted work must retain its connection when credentials change during approval or an HTTP retry.
Root cause
Unit snapshots alone do not prove that real transport retries and resumed tool execution retain their accepted credential generation.
Fix
Exercise real HTTP requests through Boot for an approval continuation and a failed request followed by a retry. Check the next runtime uses the new credential. Extend the bilingual validation matrix with source fencing, detached ownership and offer-capacity regressions.
Verification
Boot snapshot tests pass with the race detector, including child creation after a save. Root and Desktop full suites, frontend full tests and build, typechecks and repolint pass. Native Windows qualification continues separately and remains a publication gate.
Problem
The integration must retain current Workbench welcome, session recovery,
settings layout and tool-diagnostics behavior before final qualification.
Root cause
Main advanced after the implementation baseline and both lines added measured
startup and locale content to the frontend budget.
Fix
Merge main-v2 at 7717f3eeab, preserve both
behavior sets, and resolve only the budget comments and measured thresholds.
Verification
Integrated frontend compilation, type and layout contracts pass. Measured
startup raw bytes are 2468523; locale gzip bytes are 63791 and 64557.
Budgets retain bounded rounding headroom. Structural lint is clean.
Full integrated Go/frontend suites and native acceptance continue separately.
Problem
Model settings required an active tab and could replace connections used by
accepted work. Changing the new-session default also changed existing sessions.
Root cause
Persistence, active-tab rebuilds and mutable credential proxy routes shared one
operation, without a configuration revision at new-run admission boundaries.
Fix
Separate validated persistence from runtime application, stage independent
credential references, freeze resolver snapshots, and refresh local, bot and
remote foreground/background owners before accepting new runs. Add structured
save receipts and application status with draft-safe UI handling. Preserve
project overrides, session identities, history and existing lease protection.
Verification
Root and Desktop full Go suites, frontend full tests/typechecks, targeted race
coverage, request-prefix and credential-failure tests passed locally. Repository
structural checks pass without baseline increases. Bundle changes are measured
and bounded. Native Windows upgrade and final-candidate CI/review remain pending;
this integration commit is not release qualification.
Problem: the runtime branch overlaps newly merged welcome/recovery controls
and bundle measurements on main-v2.
Root cause: both branches change Composer send controls and startup assets.
Fix: retain upstream unavailable-send guidance together with finishing and
unknown-state Stop guards. Preserve actual remote text on disconnection;
strengthen the regression fixture to assert visible content before loss.
Use a component animation override for static folder activity. Measure both
trees and set the smallest raw/locale ceilings for intentional state copy.
Verification: remote, lifecycle, composer, runtime-store, project-tree and
session-recovery suites; Chromium application/runtime scenarios; production
build including typecheck and bundle checks; repolint and gofmt.
Raw startup grows 3059 bytes (0.124%); Chinese locale gzip grows 55/66 bytes.
Initial gzip, deferred CSS and independent chunk ceilings remain unchanged.
Problem: four runtime integration declarations were not gofmt clean. Root cause: the final formatting pass omitted newly added forwarders. Fix: apply gofmt to the affected files. Verification: gofmt produces no remaining changes; behavior is unchanged.
Problem: completed sessions can keep spinning, and local or remote controls
can disagree with project activity after teardown, background jobs or reconnect.
Root cause: completion notifications precede committed idle state and job
exit, while independent readers combine mutable facts from different moments.
Fix: publish immutable, versioned runtime snapshots through bounded owner
notifications and shared Desktop/Serve projections. Fence stale bindings and
remote frames, reconcile through one frontend store, expose static finishing,
and durably queue follow-ups with rich input and idempotent receipt recovery.
Preserve Running guards, legacy Serve fallback and persisted formats.
Verification: root and Desktop full Go suites; affected package race tests;
frontend runtime, project-tree, remote, lifecycle and composer suites;
production build and bundle checks; Chromium runtime scenarios; isolated
macOS Wails submission/completion smoke; repolint and whitespace checks.
Windows and Linux native execution remain unverified. Raw startup budget
increases by 0.6 KiB after measured lazy loading; gzip/CSS gates are unchanged.
Problem: the dedicated CI workspace test still expected a completion panel in the full workspace view.
Fix: assert that whole-workspace errors and empty state remain independent of turn receipts, and require an explicit request for the per-turn panel.
Verification: all 386 commands in the frontend CI test plan pass, including the previously failing dedicated test; repolint and diff checks pass.
Build cursor fixtures from temporary native paths and JSON-encode their arguments. Verify each rejection starts from an accepted cursor so path normalization cannot mask binding, version, or run-isolation regressions. Validated the focused suite on macOS and the Windows 11 guest.
Problem: main-v2 advanced while turn result inspection was being implemented.
Fix: retain the new welcome and recovery behavior alongside the result-card integration.
Verification: rerun branch gates and measure bundle deltas against this exact baseline before publication.
# Conflicts:
# desktop/frontend/scripts/check-bundle-budget.mjs
Problem: completion notices confused mutation receipts with changed files and offered no reliable historical diff or check evidence.
Root cause: the view reused workspace-wide state and aggregate completion labels without retaining per-turn capture coverage or stable log sources.
Fix: freeze bounded checkpoint net changes; preserve optional receipt metadata through terminal events and display history; expose read-only turn diffs and stable-message check logs; show explicit partial, unavailable, running, failed, stale, and interrupted states. Keep result cards stable across updates and fence delayed session responses. Extract display-buffer and wire-tool projection helpers into their owning modules.
Verification: root and Desktop Go suites; focused race and cancellation tests; frontend type checks and 328 test suites; real browser fixtures covering both themes, narrow paths, log expansion, missing data, and historical cards. Final integration and bundle checks follow the latest main-v2 merge.
Problem: the completion-label branch lacked the current transcript and session ownership model.
Fix: merge the current main-v2 baseline without rewriting the published branch history.
Verification: root and Desktop Go suites pass on the integrated worktree; turn result changes are validated separately.
Integrate the new-session welcome and session-availability controls while
retaining read progress and durable pause presentation. Resolve the shared
bundle budget conflict using the merged production measurements: 63957/64685 B
for Chinese locale gzip and 2469104 B for initial raw assets, with bounded
headroom. No behavioral or safety gate is disabled.
Validation: read-status, process-fold, paginated-history and session-recovery
tests, frontend type checking, production compilation and bundle gates passed.
Native and exact-head CI verification follow this integration commit.
Native pagination exposed a double conversion: the event producer shifted
range starts while both CLI and desktop already converted them for display.
Keep the host wire zero-based and half-open, consistent with read envelopes
and persisted pause receipts. Coverage and writer checks are unchanged.
Add an emitter regression for disjoint covered and missing ranges; existing
consumer tests verify one-based labels. Focused agent, CLI and eventwire tests
passed without changing budgets or read requirements.
Problem: Settings navigation could scroll behind the pinned search field, and Hooks and Network save bars could cover editable fields.
Root cause: Sticky controls shared a scrolling surface with content without reserving a separate visible region.
Fix: Give navigation groups their own vertical scroller, retain horizontal navigation at narrow widths, and keep wrapping save actions in normal form flow.
Verification: Frontend build, CSS and responsive checks, code viewer tests, and 360 browser layout cases passed. Added save-bar overlap and keyboard reachability checks for Windows, macOS, and Linux browser platform fixtures. Native application validation remains external.
Move notice conversion into the existing notification module and keep the
record store focused on paging and identity. Preserve generic notice behavior
and the shared read-pause card, satisfying the existing file-size guard without
raising its baseline.
Validation: 70 transcript-store assertions, 35 quiet-notice assertions, frontend
type checking, lint, vet, production build and bundle capacity checks passed.
The full discovered frontend suite completed across its initial and resumed runs.
Show deduplicated localized pause reasons in the default terminal card body,
while keeping per-file ranges in details. Both live and paginated history use
the same bounded conversion. Add a direct visible-reason assertion.
Point the existing quiet-notice source checks at their extracted owner without
changing the checks. The full frontend run continues from the corrected suite.
Measured initial raw assets are 2402.0 KiB; retain 0.2 KiB bounded headroom.
Validation: read-status regression and production bundle checks passed; final
native builds and exact-head CI are tracked separately.
Route empty-body read pause records through the shared presentation converter
in TranscriptStore, which owns the actual paginated history surface. Verify
cold persisted backend slices and repeated page loads produce one stable card.
Isolate the context-projection fixture's rolling latency history so unrelated
fast tests cannot add a soft-budget nudge to the intentionally unchanged request
body. This changes no production budgets or continuation limits.
Validation: cold history slice, 70 transcript store assertions, production build
and the original 30-repeat projection check. Full agent suite rerun follows.
Treat incomplete reads as persistent terminal guidance, preserving the candidate
answer and keeping the pause outside automatic process folds. Classify the
outcome separately from provider errors in both metrics consumers.
Bound live-test outputs and reconcile known token usage on downstream close;
retain unknown reservations and skip cases after the suite ceiling. Add offline
tests for this accounting and the default-fold rendering found during native QA.
Adjust measured bundle capacity by 0.1 KiB for zh-TW and 1.5 KiB raw initial assets.
Validation: transcript fold and HTTP budget regressions, cache-prefix contracts,
lint and vet. Full integration and native verification are recorded separately.
Problem: Starting a global conversation from a project could briefly close
the workspace dock and then reopen it from the previous global preference.
Root cause: New-session commands reused the empty global navigation wire
root as a preference key, while dock restoration reads the actual directory.
Fix: Carry the actual directory through sidebar and toolbar creation commands
and normalize the root only for backend navigation. Preserve existing storage
keys and the legacy project fallback. Align browser mock global tab metadata
with the native directory identity so browser checks exercise this contract.
Verification: Global destination restoration and toolbar regressions pass,
along with project-topic lifecycle, mock global metadata, legacy preference
migration, frontend test typecheck, app lifecycle, build and bundle checks,
and repolint. Browser clicks verify that a saved-open global dock remains
closed after creating a global conversation from a project.
Problem: the latest composer toolbar refresh and read-progress presentation
changed the same runtime strip.
Root cause: the base now deliberately hides ordinary running text while this
branch must still expose an active read requirement.
Fix: retain the new toolbar and telemetry behavior, display active read status
with priority, and use one accessible status region for the effective text.
Verification: frontend typecheck, read-status regressions, composer-strip tests
and production build; complete integrated checks follow on this merge head.
Problem: repeated full reads could reopen satisfied requirements and stop with
an incomplete-read error; read pauses lost their structured presentation on reload.
Root cause: generic string deduplication discarded delivery evidence while task
identity ignored completed requirements, and terminal outcomes lacked a durable
read-specific receipt.
Fix: associate captured source versions in the ordered finalizer, reference only
original results present in the frozen request, and redeliver windows removed by
projection. Keep completion facts separate from raw availability and writer
preconditions. Persist provider-excluded pause receipts and render one consistent
terminal notice across desktop history, live events, CLI and bridge consumers.
Verification: deterministic repeat/projection/source-isolation regressions,
root owning-package suites, desktop suite, affected-package race checks, frontend
typecheck/status tests/build and make lint pass. The full root run exposed an
unchanged legacy-migrator baseline failure; a concurrent Goal timeout passed an
isolated rerun. Bounded real-provider and native qualification remain in progress.
Problem: Empty Workbench sessions could hide history failures and remote
connection errors together with their recovery controls.
Root cause: Welcome presentation relied on empty message arrays without
checking the active session source's readiness, and recovery lived inside
the collapsed transcript container.
Fix: Share source availability between navigation and welcome projection,
show persistent recovery above the transcript, retain content and drafts,
and reuse the existing history/reconnect owners with retry coalescing.
Keep send visibly unavailable until recovery and remove footer clipping
that prevented composer menus from extending beyond the input area.
Measured recovery delta over the prior welcome head: +231 bytes CSS gzip
and +6.107 KiB initial raw assets (+0.25%). Final measurements are 119.989
and 2407.215 KiB; bound them at the next decimal ceiling. Chinese recovery
copy adds 173/156 gzip bytes over main-v2, bounded at 62.2/62.9 KiB.
Verification: full frontend build and test typecheck; lifecycle, remote,
composer, goal-toggle, recovery and history-failure suites; footer overflow
contract; browser fault fixtures covering details, retry, draft retention,
send recovery, and 390/480px layouts; repository lint.
Native shell and live SSH/provider recovery were not exercised.
Problem: Skill diagnostics could accept local MCP aliases that runtime
preparation does not bind, or report another plugin's tools as ambiguous.
Root cause: Diagnostic discovery omitted plugin ownership and reconstructed
bindings from display names instead of preserving adapter identities.
Fix: Share the runtime ownership filter, retain canonical adapter bindings,
and preserve plugin discovery metadata. Adapt PR #9686's registered-builtin
and unknown-name regressions with isolated registration. Remove dead code
and use the standard HTTP status constant to satisfy lint.
Verification: Root tests, affected-package race tests, full golangci-lint,
repolint, and whitespace checks pass. Tests exercise real skill preparation,
subagent tool scope, plugin ownership, and prefix-transformed metadata.
Refs #9686
Co-authored-by: dadgrand <[email protected]>
Integrate e2298bd78 and the unified composer toolbar from PR #9958.
Remove superseded welcome-toolbar layout overrides so the new shared
toolbar owns responsive controls.
Normalize measured bundle ceilings: CSS gzip grows from 119.479 KiB on
main-v2 to 119.763 KiB (+291 bytes), bounded at 119.8 KiB. Initial raw
assets grow from 2398.0 KiB to 2401.108 KiB, bounded at 2401.2 KiB.
Verification: build compilation, lint, type/CSS/theme and app-layer checks;
final bundle checks; composer, workspace-panel, chrome, goal-toggle,
run-strip and completed-turn telemetry tests; browser mock narrow layouts
and first-message submission.
Problem: doctor reports built-in review skills as referencing a missing
use_capability tool, while capability diagnostics do not check those references.
Root cause: the ordinary doctor passes no runtime tool inventory and relies on
an incomplete name whitelist; its skill discovery also omits configured filters.
Fix: share static host tool identities with runtime names, reuse compile-time
built-ins, and route both diagnostic entrypoints through the same skill discovery
and reference checks. Preserve unknown-name and MCP dependency warnings while
marking unresolved dynamic references as unverified. Reuse existing MCP parsing
semantics and observed host bindings without starting servers during static checks.
Verification: full root Go tests, affected diagnostic package race tests,
affected-package go vet, repolint, and isolated CLI checks passed. CLI checks
observed zero provider requests and zero MCP starts. English and Chinese
diagnostic documentation updated. Tool names, schemas, and permissions unchanged.
Problem: The read-evidence branch predates the latest upstream CI and race-test stabilization.
Fix: Integrate current main-v2 without changing the read-evidence feature scope.
Verification: Final root, desktop, frontend, lint, and affected race checks run on this merged head before publication.
Problem: The read coordinator only emitted status while legacy gates controlled execution; cursor, source-version, writer-evidence, and UI boundaries were incomplete.
Root cause: The rollout introduced parallel owners and reconstructed source identity after reading, while only one writer declared evidence.
Fix: Connect bounded continuation to dispatch and finalization, bind cursors to issued runtime tokens, capture versioned source bytes, enforce writer-owned ranges and current preflight sources, revalidate outstanding evidence, scope rebuild waivers, and fence desktop/CLI status updates. Preserve bounded local reads and explicit legacy rollback tests. Update cache-contract goldens and measured locale budgets.
Verification: Focused execution and boundary regressions pass, affected Go package race suites pass, frontend status regressions pass, and make lint passes. Full final-base verification follows the base synchronization.
Problem: Workbench starts new sessions with a bottom composer and crowded
controls when the workspace dock narrows the conversation column.
Root cause: the centered welcome stack is Creation-only, sizing follows
the viewport, and new-session navigation keeps the workspace dock open.
Fix: share the empty-session welcome presentation, retain Workbench tools,
use chat-column sizing and responsive control rows, and collapse the dock
on explicit new-session actions while preserving manual reopen behavior.
Verification: frontend build and bundle gates, composer tests, workspace
panel tests, 113 chrome checks, and browser mock checks across four window
sizes with draft retention, menus, submission and dock toggles.
Problem: The frontend CI test typecheck rejected the new completion regression fixtures.
Root cause: Runtime-only execution accepted incomplete approval, usage, and user-submission payloads.
Fix: Supply all required wire and action fields without weakening their types or the assertions.
Verification: pnpm test:typecheck, completed-turn-telemetry.test.ts, and go run ./tools/repolint pass.
Problem: evidence was checked per call while the batch was already running, and
the only way past a whole-file requirement was to read the file — even when the
user had explicitly asked for a full rewrite.
Fix: every writer's declared evidence is evaluated once for the whole batch
before anything runs, so a blocked call never starts and a read from the same
batch can never pay for it. An explicit user instruction that names the file and
asks for a full rewrite waives the read-before-overwrite requirement; the signal
is parsed from the user's own turn text by the host, and the model can never set
it. The plan of record records the batch rule, the rebuild waiver, the retained
receipt adapter, and the CI platform matrix.
Verification: go test ./...; go test -race ./internal/agent; go vet ./...;
make lint; cd desktop && go test ./...
Problem: parallel tool calls run applyEvidenceGates concurrently, so writing
the blocked-path set from each call raced (caught by TestExecuteBatchParallelReadOnly
under -race).
Fix: the set is now a mutex-guarded value on the turn runtime, with record and
snapshot helpers; callers never touch the map directly.
Verification: go test -race ./internal/agent ./internal/cli; go test ./...;
go vet ./...; make lint; cd desktop && go test ./...
Problem: Background job updates resettled completed turns and removed-model
preferences unexpectedly expanded into every status item.
Root cause: Completion snapshots were unconditional, while normalization
could not distinguish removed legacy entries from missing configuration.
Fix: Make settlement idempotent, close clocks at the same timestamp, reset
new-turn entrypoints, and display frozen completed wait accounting. Retain
only workspace/branch when a legacy model-only preference becomes empty.
Verification: Deterministic telemetry and timing-order regressions, lifecycle
reducer, composer, status-bar/editor tests, typecheck, repolint, production
build/bundle gates, and browser status-bar checks passed.
Problem: the coordinator shadow and the writer-evidence check were behind
default-off switches, so the new behavior was not the default execution path,
and the terminal frontend showed nothing about an active read.
Fix: the switches become internal rollback entries — the new behavior is the
default and each switch only turns a piece of it back off for diagnosis, fixed
per run. A read with no window is a bounded preview by default; the legacy
implicit-whole-file rule is now one of those rollback switches. The CLI renders
the same structured read status as the desktop, in en/zh/zh-TW, and the event
dispatcher is split into per-event handlers so the file stays inside its
ratcheted budgets. A deterministic comparison harness runs the same fixed tasks
under the new default and under the rollback switches and records rounds, read
calls, host continuation demands, and allowed writes.
Verification: go test ./...; go test -race ./internal/agent ./internal/cli;
go vet ./...; make lint; cd desktop && go test ./...; pnpm typecheck; pnpm test.
Problem: The status bar repeated the composer model and small costs took four decimals.
Root cause: Model remained a configurable status item and cost used adaptive precision.
Fix: Remove the model entry and setting, ignore legacy model ids, and format
only the status-bar turn cost to two decimal places without rounding stored values.
Verification: Status-bar and settings-editor tests, typecheck, and browser DOM
confirm no footer model, an intact composer model picker, and a two-decimal cost.
Problem: Context details lost turn metrics on waits and completion, while
review checks rejected missing declarations and stale migration assertions.
Root cause: Metric visibility depended on active streaming and reused the
session duration label; the legacy seed test assumed the old text default.
Fix: Project controller completion telemetry into the composer, separate turn
and session time, preserve final estimates, and align migration assertions.
Combine the previously approved workspace/branch item and document controls.
Move independent control tests and minimally account for necessary file growth.
Verification: Frontend build/typecheck and focused UI suites; config tests,
desktop legacy settings test, repolint, and PR metadata guards all pass.
Documentation-impact: updated - the plan of record now maps each acceptance
criterion to the deterministic test that covers it and names the items that
still need a real desktop environment.
Problem: Composer controls and menus compete for space, with duplicated
execution choices and a running ticker above the input area.
Root cause: Permission, execution, model, effort, and delivery controls use
different layouts and sizing rules; running metrics are rendered inline.
Fix: Unify menus, move optional modes into the add menu, separate model and
effort selectors, use removable mode chips, and adopt a theme-aware perimeter
trace from studio. Default the composer to 140px and move runtime metrics
into the context popover. Apply the icon status-bar default to legacy configs
while preserving subsequent manual choices with a persisted marker.
Verification: Frontend production build and bundle checks; focused composer,
context-ring, preference and status-bar tests; config package tests and focused
desktop tests; browser checks of responsive controls and active/waiting states.
Native Wails visual validation remains outstanding.
Co-authored-by: esengine <[email protected]>
Documentation-impact: updated - TOOL_CONTRACT.md and its zh-CN twin now describe
the read_file intent parameter and its defaults; the plan of record records the
steps that have landed.
Problem: every page of a logical read produced its own warning, so the user
could not tell progress from a loop, and read state had no stable home outside
the transcript.
Fix: the composer subscribes to the host's structured read status. Frames are
upserted by read id in controller state, a re-ordered frame never moves a read
backwards, a new turn clears the previous turn's status, and the composer
renders one line — the file, the covered range, or the pause reason. Locale
strings land in en, zh, and zh-TW, and the line is announced through the
existing throttled live region. Helpers live in lib/readStatus.ts so the large
components stay under their file budgets.
Verification: pnpm typecheck; pnpm test (328 suites); go test ./...; make lint.
Problem: a shell or MCP writer cannot declare which files it changes, so it was
exempt from the evidence check. Once another writer was blocked for missing
evidence, that exemption became the way around the block.
Fix: record the paths whose writer was blocked for missing evidence this turn.
While that set is non-empty, a writer that cannot declare its target is blocked
too, with the outstanding paths named and the exact-file tool suggested. A
read-only call is unaffected, and the rule never guesses a command's scope from
its text.
Verification: go test ./...; go test -race ./internal/agent; go vet ./...;
make lint; cd desktop && go test ./...
Problem: The generated draft referenced 30 of the 38 pull requests merged since
v1.38.1, and no entry mentioned the transcript renderer replacement, the
Standard/Deep session display setting, or the provider connection and model
preference redesign, even though each pull request describes user-visible
behavior.
Fix: Add three bilingual entries with their pull-request references to both the
highlights and the categorized changes lists - transcript renderer replacement
(#9893, #9895, #9896, #9897), Standard and Deep session display (#9894), and
independent model connections and model preferences (#9907).
Verification: node scripts/release-notes.mjs validate (61 releases);
node --test scripts/release-notes.test.mjs (10 pass); the rendered v1.38.2 notes
inspected in both languages; git diff is additions only.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Problem: a read_file call with no window was treated as an implicit whole-file
read, so a normal look at the top of a file created an outstanding read debt,
armed continuation, and could block the final answer.
Fix: only an explicit intent=full promises whole-file coverage. A default call
is an inspect page: once the page is delivered the read is finished, and
content left in the file is not a debt. Explicit full reads still page to EOF,
and a transport-truncated or locally safety-paged delivery still continues
until the page itself is delivered. The read-args parsing moves to its own file
to stay under the file ceiling.
Verification: go test ./...; go test -race ./internal/agent; go vet ./...;
make lint; cd desktop && go test ./...
Problem
The Windows legs that blocked the v1.38.2 candidate kept failing on budget
rather than behavior: the desktop-windows step "test (Windows desktop and
update helper)" exceeded its 15-minute budget with every package still
reporting ok, and TestWindowsTerminalProcessConPTYSmoke failed with "timed out
waiting for ConPTY process exit" against a 10-second bound.
Root cause
Both bounds assume an unloaded runner. The desktop suite normally takes 6-7
minutes but has run past 15 under load, and a ConPTY shell can take longer than
10 seconds to echo a marker or reap its child on a loaded Windows runner.
Fix
- Raise that step's timeout-minutes from 15 to 25, still well under the job's
45-minute backstop, so a real hang ends on the job timeout rather than a
false step timeout.
- Give both ConPTY smoke waits a shared 30-second outer bound. The assertions
are unchanged: the process must still echo the marker and exit.
Verification
- gofmt clean; GOOS=windows go vet ./... in desktop compiles the Windows test.
- node scripts/ci-workflow.test.mjs (4 pass); YAML parses with step 25, job 45.
- Not verified locally: the ConPTY smoke and the Windows desktop suite are
Windows-only and are exercised by this pull request's desktop-windows job.
Problem: nothing bounded automatic continuation of one logical read, a stalled
read could keep requesting pages forever, and every page produced its own
warning, so a frontend could not tell progress from a loop.
Fix: readcoord gains a Policy — 64 pages or 120 seconds of active read time per
logical read, one strategy change after two stalled pages, and a pause two
stalled pages later. A content change never resets that budget; only a satisfied
or cancelled read ends it. The shadow coordinator narrows an unbounded
whole-file read to needs_scope when the host cannot size a safe automatic read
from the live context budget, instead of guessing. A new versioned ReadStatus
event carries one logical read's state keyed by read id and generation, so a
frontend upserts a single status instead of appending a warning per page; the
payload holds line ranges only, never source text.
Verification: go test ./...; go test -race ./internal/readcoord ./internal/agent
./internal/event/... ./internal/tool/...; go vet ./...; make lint; cd desktop &&
go test ./...
Problem: the host trusted its own read state and the model's word about what a
write would touch. Nothing asked the real writer what content it was about to
replace, so an overwrite could proceed on evidence the model never saw, and a
tool without a declaration was silently treated as safe.
Fix: add tool.EvidenceDeclarer, which lets a writer resolve its own target
through the same path, overlay, encoding, uniqueness, and interval code the
write uses. delete_range and write_file implement it; a new file declares no
prior content while an overwrite declares whole-file evidence. The host check
verifies the model saw exactly that content in an earlier provider round,
matching line hashes and stitching pages only within one content snapshot; it
blocks with the missing ranges and an actionable recovery. Writers without a
declaration keep their existing boundary instead of being assumed safe. The
switch is internal, off by default, and fixed per run.
Verification: go test ./...; go test -race ./internal/tool/... ./internal/agent;
go vet ./...; make lint; cd desktop && go test ./...
Problem
Two different timing-sensitive tests failed on consecutive attempts of the
release candidate's race job (daf18272f), and the Windows full-suite step later
outlived its own 20-minute timeout and kept the job alive, holding the main-v2
CI concurrency group until a force-cancel.
- TestMockProviderStreamStopsOnContextCancellation: the mock send loop used one
select with a cancellation case and a send case. When cancellation and a
ready receiver arrive together, Go may pick the send, so a data chunk is
delivered instead of the cancellation error.
- TestParallelBatchAbandonsToolThatIgnoresCancellation: the test cancelled as
soon as the stubborn tool started, but the fast tool's goroutine might not be
scheduled yet, so the batch legitimately recorded it as cancelled before
execution.
- The test job had no job-level timeout, so a wedged Windows step could hold
the workflow's concurrency group for the runner's six-hour default.
Root cause
Both tests asserted on a scheduling order they never established, and the CI
job relied on a step timeout that cannot kill an orphaned Windows process tree.
Fix
- MockProvider.Stream checks ctx.Err() before every send, so an observed
cancellation is never masked by a ready receiver. The test allows at most one
in-flight chunk, then requires a context.Canceled error and a closed channel,
each bounded by five seconds.
- The parallel-cancel test waits for both the stubborn and fast tools to enter
execution before cancelling, keeping the original assertions unchanged.
- The test job gets timeout-minutes: 45 as a queue-occupancy backstop; the step
and Go package timeouts are unchanged.
Verification
- go test -race -run TestMockProviderStreamStopsOnContextCancellation -count=50 ./internal/agent/testutil/
- go test -race -run TestParallelBatchAbandonsToolThatIgnoresCancellation -count=50 ./internal/agent/
- go test -race ./internal/agent/...
- go vet ./internal/agent/...; go run ./tools/repolint
- node scripts/ci-workflow.test.mjs; bash scripts/release-workflows.test.sh
- Not verified: the Windows hang's root cause. Its logs remain unavailable
(BlobNotFound), so timeout-minutes only bounds the job; it does not fix it.
The plan of record for this branch: one PR carries the whole read, evidence,
and progress overhaul, with the contract, default read semantics, per-operation
evidence rules, bounded continuation, status UI, acceptance list, and the
implementation order recorded in one place.
Documentation-impact: updated - docs/plans/read-evidence-redesign.md is the
plan of record for this branch.
Problem: the v1 version token was derived from path, start line, and decoded
text, so every page produced a different token and a CRLF/LF rewrite produced
the same one. It could not act as a per-read content version, and nothing named
the store that actually served the bytes.
Fix: protocol v2 splits three concepts — source identity (workspace, canonical
path, disk/overlay store and its stat or buffer identity), snapshot (the stable
content version of one logical read, unchanged across its pages), and window
digest (this page's delivered lines only). EOF now carries a trustworthy source
end, and a range completes only when coverage or that end proves it. The host
issues cursors bound to session, run generation, read task, path, snapshot,
requested window, and next position; a continuation carrying one joins the read
it continues, and a forged, expired, cross-session, cross-file, or stale cursor
is rejected at the execution entry. Coordinator snapshots are deep copies.
Verification: go test ./...; go test -race ./internal/tool/... ./internal/readcoord
./internal/agent; go vet ./...; make lint; cd desktop && go test ./...
Problem: read_file inferred intent from whether offset/limit were present, so a
caller could not ask for a bounded preview or a whole-file scan except through
that inference, and a conflicting request had no defined answer.
Fix: add the optional intent parameter (inspect | range | full). inspect is the
default with no window, range the default with one, and an explicit value wins.
intent=full with offset/limit, intent=range without a window, and unknown values
return actionable parameter errors. The read result envelope and the coordinator
requirement derived from it both follow the resolved intent, so a full read
becomes a whole-file obligation. No gate, default behavior, or existing
parameter meaning changes in this step.
Verification: go test ./...; go test -race ./internal/tool/... ./internal/readcoord
./internal/agent; go vet ./...; make lint; cd desktop && go test ./...
Problem: read progress was tracked by a single legacy state machine that treats
any file with content left as an outstanding read, so a bounded inspect page
created debt, and nothing bound delivered lines to a content version.
Fix: add internal/readcoord — obligations with an explicit intent, required and
covered ranges, a content version, generation, and stop reasons, plus the range
algebra the paging decisions need. The agent folds each read result envelope
into it from the single mutation-ordered finalizer and records where the
obligation model disagrees with the legacy incomplete-read state. The switch
(Options.ReadCoordinatorShadow) is off by default, fixed per turn, and changes
no request, gate, or provider byte. The evidence ledger now carries the
observation's content version.
Verification: go test ./...; go test -race ./internal/readcoord ./internal/agent;
go vet ./...; make lint; cd desktop && go test ./...
Problem: a read result's text tells the host nothing it can trust about what was
actually delivered — which lines the model saw, whether the page ended at the
source's end or at a transport cut, or which content version those lines belong
to. Every consumer re-derived coverage by parsing free text.
Fix: define the read result contract in internal/tool — protocol version, intent,
zero-based half-open delivered ranges, source identity with a content-bound
version token, cut reasons, and a validated continuation cursor. read_file
derives it from its own output; the agent stamps call identity, clips the
envelope to the provider-visible bytes when the result was truncated, and
persists it on the tool message as a local-only field that ModelMessages strips.
No gate, warning, or provider-visible byte changes.
Verification: go test ./...; go test -race ./internal/agent ./internal/tool
./internal/provider; go vet ./...; make lint; cd desktop && go test ./...
Problem: The generated draft referenced 30 of the 38 pull requests merged since
v1.38.1, and no entry mentioned the transcript renderer replacement, the
Standard/Deep session display setting, or the provider connection and model
preference redesign, even though each pull request describes user-visible
behavior.
Fix: Add three bilingual entries with their pull-request references to both the
highlights and the categorized changes lists - transcript renderer replacement
(#9893, #9895, #9896, #9897), Standard and Deep session display (#9894), and
independent model connections and model preferences (#9907).
Verification: node scripts/release-notes.mjs validate (61 releases);
node --test scripts/release-notes.test.mjs (10 pass); the rendered v1.38.2 notes
inspected in both languages; git diff is additions only.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Problem: CI setup tests still expected the removed providers-to-models alias.
Root cause: Onboarding and startup assertions encoded the obsolete route instead of their requested provider setup destination.
Fix: Assert providers for both setup entry points.
Verification: Onboarding commands and startup gate lifecycle tests passed; expanded frontend suite is running.
Problem: Selecting Model services could open Model preferences instead.
Root cause: The navigation store still rewrote providers to models as a legacy alias, including the remembered settings target.
Fix: Preserve each settings route and cover all navigation targets plus the SettingsPanel/store feedback loop.
Verification: Navigation, settings page, settings contract and management shortcut tests passed. Source and test typechecks, focused ESLint, and Chromium clicks from usage stats and model preferences passed.
Problem
The memory screen blocks on `post-gc-dom-or-listener-drift` whenever the final
counter differs from the first sample. In run 34206509595 (shard 1) the
baseline sample itself caught the post-navigation cleanup blip (616 listeners),
every later reading rested at 514, and the final settled reading was 514. The
series never grew, yet `counterDriftReason` compared the final value against
that noisy first sample and reported persistent drift, failing the shard.
Root cause
The baseline was a single reading taken immediately after the fixture swap,
while layout cleanup can still own listeners for a few tasks. Nothing required
the baseline to be a quiescent reading, so one early sample could anchor the
whole verdict. The classifier also treated any displacement, including a
decrease, as persistent drift.
Fix
- Settle (12 frames) and require two consecutive identical readings before
accepting the baseline, up to REASONIX_APP_MEMORY_BASELINE_ATTEMPTS (4).
The accepted sample records `baselineStable` and every reading it took.
- An unsettled baseline is reported as its own blocker (`baseline-not-settled`)
instead of being judged as displacement. Tail movement, retained cohorts,
active operations, subscription drift, and the settled-tail check all still
run, so sustained growth away from a low point (616 -> 400 -> 450 -> 500 ->
550) remains a blocker.
- Bump MEMORY_PROTOCOL.version to 3 because the sampling protocol changed.
Verification
- node bench/app-memory-evidence.test.mjs: 15 pass (3 new cases: unsettled
baseline reported instead of displacement; sustained growth still blocked;
a settled baseline keeps the displacement check).
- node bench/app-memory-shards.test.mjs: 19 pass.
- node --check on both modified bench modules; go run ./tools/repolint clean.
- The browser-driven screen itself runs in CI; this change cannot be exercised
without a Chromium run.
Problem
Config version 9 rewrites official DeepSeek anthropic/responses connections
to kind=openai and pins an explicit request_url to
https://api.deepseek.com/chat/completions. An entry that already carried a
standard request_url override then reports EffectiveIndependentWebSearch()
false: IsOfficialDeepSeekSearchEndpoint bails on any non-empty
RequestURL/ChatURL, and SupportsServerWebSearch is false for kind=openai. An
explicit web_search = true is ignored as well, because that endpoint guard
runs first. Users who set the documented standard request_url therefore lose
independent search silently, which is the opposite of the migration's purpose.
Root cause
The migration turned a redundant standard override into a load-bearing
explicit URL, and the search endpoint detector treats every explicit request
URL as user-owned.
Fix
Clear a standard request_url/chat_url instead of pinning the canonical URL.
Eligibility already proves every non-empty endpoint is a standard official
path, and the derived endpoint is byte-identical:
resolveOpenAIChatURL("https://api.deepseek.com", nil) and normalizeChatURL
both produce https://api.deepseek.com/chat/completions. Both the raw scalar
rewrite and the full config path are updated, and the WEB_SEARCH documents
state that standard overrides are cleared.
Verification
- The v9 migration test now asserts EffectiveIndependentWebSearch stays true
after migrating an explicit standard request_url.
- New chaturl test locks the derived-URL equivalence that makes clearing safe.
- go test ./internal/config ./internal/provider/openai ./internal/boot ./internal/cli
- go run ./tools/repolint; gofmt -l; git diff --check
Problem: The expanded protocol migration exceeded the repository file-size gate.
Root cause: TOML scalar rewriting and provider migration shared one file near its size ceiling.
Fix: Move the existing scalar rewriting functions into a dedicated file without changing behavior or increasing the lint baseline.
Verification: repolint is clean and the configuration suite passes. Root, desktop, frontend build and migration race checks passed before this mechanical extraction.
Problem
Run 34201483401 (PR #9947, commit e76226007) hung for over 45 minutes in
the desktop-windows job: the step "Test WebView2 transcript selection
compositor" stayed in_progress from 08:00:28Z with its own
timeout-minutes: 5 already exceeded, and the 8 following steps never
started. Because ci.yml serializes runs per ref
(concurrency: group: ci-${{ github.ref }}, cancel-in-progress), every
later run for that PR queued behind it: the newest run sat in `pending`
with zero jobs, so lint, race and the test matrix never reported and the
pull request showed "Expected - Waiting for status to be reported" for
its required checks. The other desktop-windows legs finish in 22-25
minutes, so this was a hang, not a long job.
Root cause
The step timeout kills the pwsh process, but on Windows the orphaned
go/transcript-selection-smoke/msedgewebview2 process tree survives and
keeps the job alive. Nothing bounds the job itself, so the runner's
six-hour default is what actually ends it, and the workflow's concurrency
group stays held the whole time.
Fix
- Give the desktop-windows job an explicit timeout-minutes: 45 backstop
(normal runs finish in about 25 minutes).
- Run the native smoke through Start-Process with a bounded WaitForExit
(-TimeoutSeconds, default 180s; the step normally takes 15-18s) and kill
the whole process tree with taskkill /T /F on timeout, mirroring
scripts/test-webview2-native-smoke.ps1. Captured stdout and stderr are
still printed to the step log.
Verification
- go run ./tools/repolint: clean.
- YAML parses; desktop-windows keeps its 20 steps and gains
timeout-minutes: 45.
- git diff --check: clean.
- External: pwsh is unavailable on the authoring machine, so the script's
timeout path is exercised by this pull request's desktop-windows run.
Integrate independent web search model assignment and session shutdown persistence from the current base. Preserve the model editor fixes and one-time official protocol migration; rerun owning suites and frontend build on the merged tree.
Problem: Existing official connections retained alternate protocols after upgrade.
Root cause: The prior migration covered only historical built-in Messages defaults, and catalog ordering selected the new-connection protocol.
Fix: Default new official connections to Chat Completions and migrate standard official endpoints once with config version 9. Preserve later manual choices, configuration identity, and custom gateways. Add an explicit verified beta wire alias.
Verification: Root and desktop Go suites, configuration race regressions, frontend catalog test and typecheck, and browser selection verification passed.
Problem: Users could add model IDs but could not remove them from the compact model editor.
Root cause: The dialog exposed only apply and cancel, and the connection draft retained model-specific configuration.
Fix: Add a delete action that removes the exact model ID and its context, capability, and legacy vision settings from the connection draft. Persist only when the connection is saved.
Verification: Compact provider editor regression tests, real Chromium deletion and deferred-save checks, TypeScript checking, and the frontend build including bundle budgets passed.
Problem: Case-distinct models could be added but still inherited each other's
capability and parameter overrides through case-insensitive lookup fallbacks.
Root cause: Frontend metadata lookup and backend override/vision-list matching
used different identity rules from model validation and request selection.
Fix: Use exact IDs for configuration ownership and capability lookup. Keep
search matching separate, retain old configuration data, and document the
behavior of mismatched legacy keys and older readers in English and Chinese.
Verification: Root and Desktop Go suites, focused configuration race tests,
frontend regression suites and full build with bundle budgets, browser
verification of case-distinct image declarations, and PR metadata guards.
Integrate the current provider endpoint contract changes without conflicts. Preserve the model identity and vision fixes; final validation is recorded in the follow-up corrective commit.
Problem: the web search assignment branch failed CI lint, desktop-browser and
desktop-windows, and the desktop aggregate gate.
Root cause: the runtime snapshot test used an index loop and a bare goroutine
that the pinned linter rejects, and the settings layout bench pinned the
assignment row count at four from before the web search row existed.
Fix: use an integer range and WaitGroup.Go, and name the expected assignment
row count instead of hardcoding it at the assertion.
Verification: golangci-lint v2.12.2 clean, go vet, repolint clean, boot and
tool/builtin tests pass, settings-layout browser bench passes 120 cases.
Problem: Manual model setup rejected case-distinct IDs and disabled images
for newly available DeepSeek models.
Root cause: The dialog folded case during duplicate validation, while the
frontend and shared provider guard treated unknown DeepSeek IDs as text-only.
Fix: Reuse exact-ID validation with specific localized errors. Restrict the
hard image block to known text-only models and honor declared capability
for unknown models in configuration and provider requests.
Verification: Root and Desktop Go suites, three frontend regressions,
typecheck, full frontend build with bundle budgets, and browser interaction.
Problem: when the shutdown snapshot could not take the compatibility save
lock within its bounded wait, the controller fell back to a shutdown
recovery copy for every session format, because the lock timeout surfaces
before any format dispatch. A schema-2 log, which otherwise never produces
recovery copies, still got a -recovery- file in that case.
Root cause: Save acquires .jsonl.lock in withSessionSaveLocks and returns
ErrSessionFileLockHeld from there; snapshotWithDurability answered it with
recoverShutdownSnapshot, which forks a recovery branch unconditionally.
Fix:
- agent: AppendForShutdownWithoutLock runs the DAG planner and appends the
batch without the file lock. Message entries (and an owned rewind, which
becomes the fork point) land on a fresh concurrent head so a locked writer
on the old head can never share a chain with them; a turn_end whose begin
is already on the old head stays there; overlays and markers alone need no
new head. The append terminates a torn tail first and fsyncs. Derived
files are left to the next locked save, which now republishes them even
with nothing new to append.
- agent: replay skips a line it cannot decode when complete entries follow
it (a hole, counted and logged, reclaimed by rotation) instead of hiding
everything after it; a bad region that reaches the end of the file is
still the torn tail the quiet-period repair truncates.
- agent, store, fileutil: rotation stages the new log, raises the
<id>.events.jsonl.rotating marker, copies the complete lines appended
after the bytes it consumed onto the staged file, publishes it with a
strict rename, and clears the marker. An unlocked appender waits for the
marker after its write and re-appends when the file at the path is no
longer the one it wrote to. No handle is held across the rename, which
Windows refuses. The marker joins the session sidecar lists.
- control: recoverShutdownSave uses the unlocked append for a schema-2 log
and keeps the controller on its path; schema-1 sessions keep the recovery
branch. A listing-sidecar refresh that fails on the same held lock right
after the append is accepted as deferred instead of failing the shutdown.
- desktop: the trash artifact list moves to session_trash_artifacts.go
unchanged apart from the new marker entry.
- docs: SESSION_OWNERSHIP (en, zh-CN) state the shutdown behavior.
Verification: go test for agent, control, cli, serve, acp, bot, boot, store,
fileutil and the desktop module; -race on the new agent and control tests;
GOOS=windows build of the touched packages; go vet ./...; gofmt; make lint.
New tests cover the unlocked append on a concurrent head, the follow-up
locked save, the torn-tail case with a hole and its rotation, marker-only
batches, the schema-1 fallback, hole skipping versus a torn tail, late
appends carried across rotation, an append racing a rotation re-landing in
the rotated log, and the controller shutdown path writing no copy.
Problem: the independent search assignment conflicted with the shared settings control redesign.
Root cause: both branches changed ModelPicker, the subagent effort row and model preference styles.
Fix: retain the shared SettingsSelect and updated layout while preserving web search assignment, empty automatic selection and all model help popovers.
Verification: search model and shared select/options tests, 28 responsive layout checks, production build and bundle budgets, config/boot/Desktop focused Go tests, browser preview and repolint passed.
Problem: protocol changes could combine a provider-specific base path with the wrong request suffix, surface opaque internal IDs, and reload provider failures as generic interruptions.
Root cause: provider identity, protocol routes, endpoint validation, and terminal display metadata were owned by separate layers without one shared contract.
Fix: attach catalog identity to saved connections, resolve official protocol routes from the documented registry, validate mismatches in the editor, save path, and runtime, carry safe display diagnostics, and persist failed versus interrupted terminal status without changing provider-visible recovery bytes.
Verification: root and Desktop Go suites, focused frontend tests, TypeScript and lint checks, production bundle budgets, compatibility guards, and git diff checks pass.
Problem: The desktop Go signing test still required the old build-only publish condition, so the new guarded artifact reuse path failed CI.
Fix: Require either a successful build or explicitly verified orchestrator reuse, while retaining signing/cache success and smoke/preflight publication exclusions. Keep the existing signing-order checks and executable workflow failure matrix.
Verification: All tests in windows_signing_packaging_test.go and 22 workflow/artifact contract tests pass. Full module tests and new-head CI remain in progress.
Problem: search account selection was implicit, making connection and usage ownership difficult to control.
Root cause: independent search routing had no dedicated model assignment or structured unavailable state.
Fix: add an optional global assignment with project override visibility, exact account validation without fallback, immutable runtime routing, content-preserving saves, and accessible localized model help popovers.
Verification: configuration and runtime routing tests, Desktop persistence tests, frontend interaction tests, production build and responsive browser checks. Native UI and paid provider calls are not qualified by browser checks.
Problem: Desktop PR checks repeat frontend suites serially, and stable releases rebuild and sign a second desktop matrix after preflight.
Fix: Share prepared frontend artifacts, preserve the desktop aggregate gate, deduplicate suites with bounded concurrency, and publish identity-verified preflight artifacts. Cache release dependencies and instrument the complete memory protocol while removing soak-only fixture latency.
Verification: 378 frontend commands plus the new hydration regression passed; 46 contract tests, release workflow tests, production build and Chromium lifecycle checks passed. Three independent Chromium processes completed all 896 memory round trips with aggregate PASS. Signed release and Linux CI execution remain pending.
Problem: Broader frontend CI still asserted removed native selects,
three-button compaction presets and different appearance option widths.
Root cause: The shared-control migration updated focused tests but left
legacy selector and layout expectations in secondary contract suites.
Fix: Target the named API-format button, assert four-row compaction layout
and a visible percentage suffix, verify the shared responsive field width,
and include the shared menu in theme surface checks.
Verification: Full frontend pretest and discovered suites were exercised.
Legacy assertions found during that run were fixed and their owning suites
rerun successfully; the remaining discovered suites passed. Theme-pack has
305 passing assertions, theme browser contract and repolint pass. Production
code and bundle budgets are unchanged by this test-only follow-up.
Problem: A rejected custom threshold save discarded the draft, and settings
CI still targeted removed picker classes and exceeded source-file ratchets.
Root cause: The editor ignored apply's success result before ending editing;
shared-control imports added 1-2 lines to already-baselined large files.
Fix: Preserve the draft on failed saves, locate browser controls by accessible
roles, and increase only the measured per-file budgets: CapabilitiesPanel +2;
MemoryPanel, ThemeGallery, ThemeLibrary and UsageStatsPanel +1 each. The new
failure/retry/Escape tests exceed the existing test-file budget by one line,
so that budget increases by exactly one with no spare allowance.
Verification: 105 settings snapshot assertions, 120 Chromium settings layout
cases, production frontend build with bundle gates, repolint and diff checks
passed. Persisted formats and compaction/cache behavior are unchanged.
Problem: Settings pages used inconsistent selection controls and model
preferences had oversized menus and fragmented compaction editing.
Root cause: Page-specific widgets duplicated visual and keyboard behavior;
IME confirmation was interpreted as selection, and custom-value blur saves
could disable an intended preset click before it was delivered.
Fix: Share compact dropdown and segmented controls across settings, group
model assignments and runtime preferences, and edit custom compaction
percentages inline. Preserve connection identity and saved selection, leave
composition keys to the IME, and make preset clicks replace unsaved drafts.
Verification: Settings refresh (96 assertions), shared select/options,
provider and connection picker regressions, and production frontend build
including typecheck, CSS/theme contracts and bundle budgets passed.
Browser fixture checks covered layout and interaction; native Wails was not
rebuilt. No persistence schema or provider request contract changed.
Problem:
Image paths could not be inspected by a built-in tool, and text models
could not use the configured vision fallback for images returned by tools.
Root cause:
Image understanding ran only during input preparation. Tool images used a
separate path, and official DeepSeek tool images were filtered by vendor.
Fix:
Add view_image, share a session-local image understanding service across
attachments and tool results, preserve tool execution on summary failures,
and route DeepSeek vision tool images through supported user-image shapes.
Verification:
Root and Desktop Go suites passed before latest-base integration. Focused
race tests cover caching, cancellation, isolation and MCP routing. Bounded
live probes passed for three DeepSeek protocols and explicit/auto service
routes; the auto live probe injects a same-provider selector.
reasonix doctor session already bundled a schema-2 log's files, but the
manifest described the session only through the recovery-copy chain, which
a session log never has, so support could not see which versions the log
holds or which one the user was on.
SessionBundleEntry gains log_format, selected_head, and heads[] filled from
the log itself: id, kind, name, parent head, fork point, writer, timestamps,
message and turn counts, and the selected / covered / retired flags. Head
previews stay out because the transcript files travel in the bundle. A
schema-1 session leaves the fields empty; an unreadable schema-2 log is
reported under missing while its files are still bundled. The manifest
schema version stays 1: the fields are additive and omitempty.
Verification: go test ./internal/doctor/ (new test: two-head log yields one
entry with format 2, the selected head, both heads with kinds/names/counts/
flags, no missing entries, no REASONIX_HOME leak, event log in the zip);
go vet; gofmt; make lint.
The session docs still described the format-1 model: one writer per file,
save conflicts that fork recovery copies, and conversation rewind as a new
session file. With the format-2 log merged, they now explain:
- SESSION_OWNERSHIP (en, zh-CN): the append-only event log and its heads, the
selected head and the derived .jsonl, the lease's reduced role, turn
markers, the in-place upgrade and the doctor --export-v1 rollback;
concurrent writers instead of conflicts (format-1 rules kept for sessions
not yet upgraded); heads as versions with View versions, select, rename,
and covered-head cleanup; the rewind head and the undo rule.
- SESSION_RECOVERY_AND_PARALLELISM (en, zh-CN): versions and lifecycle
rewritten around heads, the desktop bridge methods with headId, legacy
recovery copies, and a compatibility table with the >= 1.39.0 window.
- CHECKPOINTS (en, zh-CN): CommitRewindInPlace and UndoRewind in the
controller API, the rewind head, and the in-place CLI/desktop behavior.
- HISTORY_SEARCH_CATALOG (en, zh-CN): the selected head is what gets indexed;
a head switch is a rewrite.
- RECOVERY_VALIDATION: scope sentence pointing transcript recovery readers to
the two session docs.
Release notes stay with the release PR; the doctor session bundle still
carries a schema-1 manifest and is a follow-up.
The terminal frontends still assumed a branch is a file in three places:
- The branch tree derived "current" from the session path, so after
/branch had moved the controller onto a new head of a schema-2 log the
tree still marked the log's main head current. Controller.CurrentBranchID
returns the head id inside a log (the file id on the main head and for
schema-1 sessions); BranchTreeText and the CLI tree use it.
- The rewind picker committed with CommitRewind (a non-switching fork) and
then SwitchBranch'd to the returned path, which produced a separate file
for a rewind on a schema-2 session. It now commits with
CommitRewindInPlace and only follows the lease and replays the transcript;
schema-1 sessions end up on the fork file exactly as before.
- reasonix sessions diagnose/cleanup report schema-2 logs by their heads
(sessionLogs, heads, coveredHeads, retiredHeads) and keep zero cleanup
candidates for them; the report printing moves into its own helper.
- serve POST /fork keeps path as the session the controller is on and adds
branch for what the fork created, so a head id no longer arrives as path.
Verification: go test for cli, control, serve, acp, bot, botruntime, boot;
go vet on root and desktop; gofmt; make lint. New tests cover
CurrentBranchID and the tree marker, /branch + /switch by file id and by
name on one log, the in-place rewind commit, and sessions cleanup on a
two-head log (counts, zero candidates, --apply touches nothing).
The versions dialog and the transcript notices spoke only about recovery
copies. With heads of one session log (#9921) they now use head language:
- RecoveryLineageDialog: a heads lineage summarizes "{n} versions of this
conversation"; each head shows a kind badge (original line / forked here /
rewound / from another window); unnamed heads are titled Current version or
Another version; the choice reads "Make this the current version"; a footer
control "Remove covered versions (n)" calls CleanRecoveryLineage with apply
and toasts removed/busy counts. File lineages keep their wording and still
expose no cleanup control.
- controllerNotices: session_concurrent_writer, session_head_switched, and
session_head_selected localize by code in en / zh / zh-TW so head ids never
reach the transcript.
- check-bundle-budget: the locale chunks and the raw initial payload sat on
their ceilings; the thirteen strings per locale measure zh 61.7 KiB,
zh-TW 62.4 KiB, raw initial 2399.2 KiB, so the ceilings move to the next
one-decimal values with the same headroom as before.
Verification: pnpm typecheck, pnpm test:typecheck, pnpm lint:hooks, the heads
dialog tsx test (summary, badges, choice with headId, head-note rename,
cleanup request and toast), use-controller-meta notice cases, vite build +
check:bundle.
Fork-from-here, conversation rewind, and the versions dialog become head
operations inside a schema-2 session log on the desktop. The tab that owns
the session moves onto the new head in place: no second tab, no new session
file, and the previous chain stays selectable as a version.
- desktop: ForkForTab and CommitRewindForTab fork a head and return the source
tab's TabMeta with a bumped SessionGeneration; UndoRewindForTab reports the
head switch the same way. GetRecoveryLineage lists a log's live heads (state
"heads", headId/headKind/headName/selected per member) and merges them with
any schema-1 recovery copies of the same family; ChooseRecoveryBranch and
SetActiveSessionVersion switch an open tab through SwitchBranch or write a
select marker; CleanRecoveryLineage retires covered heads only, with a
one-minute busy window; RenameSessionHead names a head. CommitRewindForTab
and UndoRewindForTab move verbatim from app.go to rewind_tab.go.
- control: CommitRewindInPlace commits a plan and keeps the controller on the
rewind head; UndoRewind returns to the parent head and retires an empty
rewind head; SwitchBranch resolves a bare head id; SessionHead exposes the
live head; boot no longer forces FileBranchesOnly for the desktop.
- agent: SessionHead.Covered marks live unselected heads whose chain is part
of the selected one, computed in headList and written to the head index.
- frontend: dialog rows keyed by head id, head notes go to RenameSessionHead,
choose and open carry headId; session_changed with sessionReset reloads the
tab; TabMeta/WireEvent/RecoveryLineageMember types gain the fields.
Schema-1 sessions keep file forks, file rewinds, and separate tabs; the tests
that exercise those mechanics are pinned to the schema-1 writer and schema-2
twins assert the in-place behavior.
Verification: go test ./..., cd desktop && go test ./..., -race on the control
and agent head tests, pnpm typecheck / test:typecheck / lint:hooks, the dialog
tsx tests, vite build + check:bundle within existing budgets, gofmt, go vet,
make lint.
The desktop composer routes /branch, /switch, and /rewind through the same
controller methods; an in-place head switch would leave a tab showing a
transcript it did not switch to. control.Options.FileBranchesOnly keeps
branch operations on separate files, boot.Options exposes it, and
boot.Build sets it for StatsSource == "desktop" until the desktop PR
removes the bridge. CLI, serve, ACP, and bot branch inside the log.
Problem
User-facing fork, branch, switch, and conversation rewind still created a
new session file per branch, so a schema-2 log that can hold many heads was
never used for them and every branch cost a file, a lease, and a lineage
entry.
Change
- Session.ForkHead/SwitchHead move the live session onto a new or existing
head of its own log; SelectSessionHead, RetireSessionHead, and
RenameSessionHead act on a closed log. Every marker refreshes the head
index and the BranchMeta mirror.
- Branch, Fork/ForkNamed, and a switching conversation rewind fork a head
for schema-2 sessions and return the head id; Branches lists the current
log's heads under the file's node; SwitchBranch resolves head ids and
switches in place, emitting a session_changed barrier. The branch
operations move from controller.go to branch_ops.go.
- Schema-1 sessions and the desktop's detached fork keep creating files
until the desktop binds tabs to heads.
Verification
- go test ./internal/agent/ ./internal/control/ ./internal/acp/ (+ -race on
the new tests); go test ./...; cd desktop && go test ./...
- New tests cover the head operations and the controller's schema-2 branch,
switch, and rewind behavior; file-branch tests are pinned to schema 1.
- gofmt, go vet, make lint clean.
Problem
The session catalog knew one transcript per file. A schema-2 log carries
several heads, and the versions UI and topic list need them from the
catalog without opening the log. The listing repair also rewrote the event
index with the schema-1 writer, which would have replaced a schema-2 head
index with a schema-1 one.
Change
- Schema v12 (cache file v8.sqlite): catalog_sessions gains log_format,
head_count, selected_head_id; catalog_heads holds one row per head. The
migration clears directory scans so every row learns its log format.
- recordFromOrder and exact-path indexing take the head mirror from
BranchMeta and the per-head rows from the head index while it matches the
log; a stale index keeps the rows and marks counts unknown for repair. The
schema-2 content fingerprint binds the selected head and its leaf.
- Catalog.ListHeads exposes the rows. refreshSessionEventIndexContext keeps
the listing repair on the log's own schema.
Verification
- go test ./internal/sessioncatalog/ ./internal/agent/; go test ./...;
cd desktop && go test ./...
- New tests cover a two-head reconcile, a stale head index, the v12
migration, and the listing repair on a schema-2 log.
- gofmt, go vet, make lint clean.
Problem
The turn-event ledger identified the transcript a turn ended on by a
revision/digest pair that only describes one linear array. Projection acks
and orphan repair on a schema-2 log need the head and the leaf message.
Change
- Envelope, TerminalSummary, ReplayView, and the checkpoint record carry
headId and leafMessageId next to the existing pair; the controller sets
them at TurnDone from Session.Head and the in-memory leaf id, and clears
them for schema-1 sessions.
- The reference survives compaction through the checkpoint record and the
rebuilt terminal summaries; the desktop replay view forwards it.
- transcriptSnapshot, SetTranscriptSnapshot, and a shared terminalSummaryFor
move to transcript_ref.go, removing the duplicated summary construction.
Verification
- go test ./internal/turnevent/ ./internal/control/; go test ./...;
cd desktop && go test ./...
- New tests cover the envelope and replay view, compaction plus reopen,
the schema-1 clear, legacy decoding, and a two-turn controller run.
- gofmt, go vet, make lint clean.
Problem: Model assignment connections wrapped into a second row beneath
three-column headers, and shared settings rules displaced specialized rows.
Root cause: High-specificity shared and Creation defaults overrode component
grid declarations and the General page's named container. Model assignment
breakpoints followed the viewport instead of the available settings pane.
Fix: Lower shared layout specificity, retain component-owned containers,
and coordinate assignment headers and rows with pane-width container queries.
Restore the General status bar editor and narrow sound control layouts.
Verification: Full frontend test:all, production build and bundle budgets, repolint,
240 Chromium/WebKit real-page layout cases, picker interaction, and General
settings geometry. The original CSS fails the new ownership assertion.
Add the browser gate to Linux and Windows CI.
Problem
Turn crash markers lived in the .jsonl.meta sidecar as an array index plus a
commit digest, which only describes one linear transcript. With a schema-2
log a crashed turn must be located on a head by message id, and the save
path's new head facts (a concurrent fork, several recent heads) had no way
to reach the user.
Change
- Schema-2 sessions queue turn_begin/turn_end entries on the Session; they
ride the next save, so a completed tail and its end marker land in one
batch. The sidecar marker path is unchanged for schema-1 sessions and is
told apart by InFlightTurnMeta.HeadID, which is never persisted.
- Resume closes an open turn through the ordinary save diff (a rewind
entry, no truncation), keeps the user prompt as before, and leaves the
tail alone when the turn continued on another head or later turns
followed. Recovery is idempotent.
- The controller emits session_concurrent_writer after a save that forked
a concurrent head and session_head_switched when a resume lands on one of
several recent heads.
- The in-flight turn functions move from controller.go to
in_flight_turn.go so the new branches fit within the repolint budgets.
Verification
- go test ./internal/agent/ ./internal/control/ (+ -race on the new tests)
./internal/boot/; go test ./...; cd desktop && go test ./...
- New tests cover marker flushing, reload of an open turn, schema-1
exclusion, continuation on another head, the notice window, crash
recovery on schema 2, single-batch turn end, and both notices.
- gofmt, go vet, make lint clean.
Problem
Every save still ran the schema-1 protocol: whole-array snapshots, a
revision CAS against the meta ledger, and a recovery-copy fork whenever two
writers or a crashed save disagreed about the array position. That is the
mechanism behind the recovery-copy pile-ups in #8451/#8452 and the "resumed
from an older state" half of #9890.
Change
- Schema-2 logs take a new save path (save_dag.go, save_dag_plan.go): the
in-memory transcript is diffed against this session's head by message id
(or by content when two sessions produced the same messages
independently). New messages append; local-field changes become patch
entries, a leading-prompt refresh a system override, redaction a redact
entry, and any other in-place edit a rewind plus re-appends. A head that
another writer extended forks a concurrent head instead of conflicting;
a session that only fell behind its own head still reports the
stale-prefix conflict so the controller adopts disk.
- The writer is on by default: a schema-1 log is upgraded in place on the
next leased save, a session without a log starts schema 2 unless another
runtime holds it, and REASONIX_SESSION_LOG=v1 is an emergency switch for
sessions not upgraded yet.
- Derived files follow the selected head (.jsonl cache, display index),
the head index and BranchMeta mirror are refreshed on every save, and
oversize or redacted logs rotate under the single-writer proof.
- reasonix doctor session <id> --export-v1 PATH writes a schema-1 copy for
releases before v1.39.0.
- Session.Head and Session.DrainHeadEvents expose the head position and the
concurrent-fork event for the controller work that follows.
Schema-1 mechanics tests are pinned to the schema-1 writer through small
fixture helpers; schema-2 tests cover the same guarantees.
Verification
- go test ./internal/agent/ (+ -race on the DAG tests), ./internal/control/
(+ -race on the two-controller test), ./internal/boot/; go test ./...;
cd desktop && go test ./...
- New effect tests: two controllers on one path share one log with two
heads and no recovery copy; a schema-1 session upgraded on resume keeps
provider.ModelMessages byte-identical.
- gofmt, go vet, make lint clean.
A field-merge patch cannot clear a local flag back to its zero value
because omitempty drops the key, so a message edited and then un-edited
would replay as still edited. A patch now carries the complete replacement
message; the writer still guarantees it is provider-equivalent to the
original, and rotation folds the latest replacement in place.
Problem
Schema 1 of <id>.events.jsonl is position based: append/replace records
keyed by array index and a meta revision CAS. Two writers or a crashed
save collide on the same index, the next save reads as a conflict, and a
recovery copy is forked (#8451, #8452, #9890).
Change
Schema 2 is an append-only DAG. Message entries name their parent and the
head they extend; heads are named pointers (main plus fork-minted ids);
rewind, fork, select, rename, retire, patch, system override, turn
boundaries, compaction, redaction, and writer identity are appended
markers. This PR adds the format, a single-pass replay with the existing
budgets, head selection (last live select, else newest activity), batched
appends under the session file lock, quiet-window tail repair, a schema-2
event index with the head list, generation rotation under a single-writer
proof, and the schema-1 to schema-2 upgrade. LoadSession and the other
loaders dispatch on the probe; the schema-1 save path treats a schema-2
log as not native and never writes into it. No production writer switches
yet; that is the next PR.
session_events.go shrinks: the probe moved to session_events_probe.go and
the loaders to session_load.go so the new dispatch fits without widening
the repolint baseline.
Verification
- go test ./internal/agent/ (+ -race on the DAG tests), ./internal/control/,
./internal/boot/; go test ./...; cd desktop && go test ./...
- New tests cover replay, overlays, torn tails, orphan roots, hard errors,
budgets, concurrent appenders, incremental replay, upgrade, rotation,
the single-writer proof, and crash points.
- gofmt, go vet, make lint clean.
Problem
The session log identifies messages by array position, so two writers or
a crashed save collide on the same index and fork recovery copies. The
append-only DAG log needs every message to carry its own identity.
Change
- provider.Message.ID (json "id", omitempty) is local metadata. Session
mutators mint a 26-char Crockford base32 id (48-bit unix ms + 80 random
bits) for any message that lacks one.
- Messages loaded from existing storage receive a deterministic id derived
from the branch id, the position, and the running transcript digest, so
independent processes loading the same bytes agree.
- messageForSessionIdentity zeroes the id: digests, prefix comparisons,
the load-time hasher, providerVisibleFingerprint and coveredPrefixHash
are unchanged for tagged histories, and previous binaries keep sharing
the same revision/digest.
- Session.LeafID / Session.IndexOfID for the head-based controller work.
Verification
- go test ./internal/agent/ ./internal/provider/... ./internal/control/
./internal/boot/, go test ./..., cd desktop && go test ./...
- New guards: adapter wire tests for openai/anthropic/responses prove the
request bytes are byte-identical with and without ids; identity tests
cover digests, legacy derivation determinism, load stability, and the
real boot.Build round trip.
- gofmt, go vet, make lint clean.
Problem: Mainline provider settings and viewport fixes must coexist with the final extracted App shell before delivery.
Root cause: The mainline startup and rendering changes overlapped the split lifecycle and presentation boundaries.
Fix: Carry the ownership slice integration without restoring App-local async effects or the obsolete onboarding overlay. Preserve lazy shell boundaries and use the measured 2398.2 KiB raw bundle with a 2398.4 KiB ceiling.
Verification: Production build, TypeScript, AST layer contracts, hooks, CSS and bundle gates pass. The final shell App browser lifecycle passes navigation, three layouts, source-bound send and Stop. Shared transcript, native subscription, origin/prepend, provider picker and startup lifecycle tests pass in the ownership slice. Final-head CI and complete memory screening remain required before merge.
Problem: Mainline provider settings integration changed App startup navigation and transcript lifecycle while the ownership slice was qualifying.
Root cause: The new mainline implementation retained the pre-extraction App and renderer boundaries, overlapping the split owners.
Fix: Keep the source-bound App composition and first-materialization/origin geometry model. Integrate generation-renewed native viewport subscriptions and batched prepend settlement. Route first-run setup through the existing startup lifecycle with cancellation and navigation-generation guards; remove the obsolete onboarding overlay and retain the provider setup banner until configuration succeeds. Carry mainline provider behavior and normalize only measured integrated bundle/locale ceilings.
Verification: Full transcript suite, native viewport generation tests, origin/prepend combination tests, startup navigation and unmount tests, 54 provider picker checks, onboarding commands, startup contract, production types/build checks, exact bundle checks and App browser lifecycle pass. Repository lint is clean. Full frontend discovery and final-head remote CI/memory protocol remain required before merge.
Problem: The final presentation slice must include the qualified current-mainline ownership integration.
Root cause: Mainline added tool elapsed UI, bounded cancellation and controller liveness while the split was qualifying.
Fix: Carry the source-owner integration into the extracted shell and preserve its separately measured bundle ceiling (2384.9 KiB actual, 2385.1 KiB limit).
Verification: Production type/layer/hook/build checks and the exact build budget pass; the shared agent/control race suites, 26 elapsed/liveness frontend tests, repository lint and App browser lifecycle passed in the owning slice. This intermediate local merge is followed by the newly arrived provider settings integration before final qualification.
Problem: Mainline advanced with the separately reviewed tool cancellation and liveness fixes while the split PR was qualifying.
Root cause: The pending ownership slice shared controller and tool presentation paths with the new mainline revision.
Fix: Integrate main-v2 without changing source-bound command or cleanup ownership. Normalize the measured initial raw bundle ceiling from 2411.5 to 2411.9 KiB for the inherited UI growth (2411.7 KiB actual).
Verification: Agent and control package race suites pass, all 26 tool elapsed/liveness frontend tests pass, production type/build gates and bundle check pass, repository lint is clean, and the production App browser lifecycle gate passes. Independent integration review found no new blocking issue. Final-head remote CI and full memory protocol remain required before merge.
Problem: PR #9907 conflicts with main-v2 in frontend bundle ceilings.
Root cause: provider settings and the recovery-wait/rejection-containment series changed the same measured budgets independently.
Fix: retain both feature sets and use measured combined ceilings of 2387.8 KiB initial raw assets and 119.5 KiB shell CSS gzip. Preserve existing locale and chunk gates.
Verification: Node 24 full frontend build and budgets; repolint; provider onboarding, recovery banner/dialog, cancellation and crash containment tests; control, provider and sessioncatalog Go tests; focused desktop recovery/cancellation tests.
Problem: mainline recovery notifications lived in the old App effect while
the presentation slice had moved runtime ownership to shared composition.
Fix: integrate the shared App effect owner, latest committed toast delivery,
recovery wait UI and error containment. Preserve the bridge-free App facade,
AST layer boundaries and deferred presentation assets. The integrated raw
payload is 2384.5 KiB; its narrow ceiling is 2384.7 KiB.
Verification: production type/hook/AST/CSS/build and measured asset gates
pass. The shared subscription lifecycle test passes on this composition.
Owning recovery frontend and Go race checks, independent source review and
App browser integration pass in the parent slice. Latest-head official CI,
native smoke and complete memory screening remain merge gates.
Problem: mainline recovery-wait and rejection-containment fixes advanced
while App effects were extracted, conflicting with the old App subscription.
Fix: merge main-v2 17a81d7b7 and preserve the recoverable-error toast through
the shared App effect owner. A committed callback prevents layout-teardown
delivery while effect cleanup removes the one global subscription. Keep the
mainline rejection classification, warning severity and six-second duration.
Raw startup assets measure 2411.3 KiB after the inherited UI changes; retain
a narrow 2411.5 KiB ceiling rather than the obsolete pre-recovery budget.
Verification: lifecycle regression covers StrictMode, 32 callback replacements,
latest-sink delivery and layout teardown. Recovery crash classification,
lineage-dialog and wait-banner tests pass. Production build/type/hook/CSS and
asset checks pass. Independent read-only review found no lost feature or
new subscription ownership defect. Owning Go and App browser checks complete
the integrated-base qualification before final-head CI and merge.
Problem: mainline Stop and catalog fixes advanced while the split was being
qualified, and the raw bundle ceilings conflicted across the two layouts.
Fix: retain the mainline behavior with the split runtime composition and
same-tab cancellation owner. The integrated shell measures 2381.8 KiB raw;
its narrow ceiling is 2382.0 KiB, with the inherited locale limit unchanged.
Verification: production type, hook, AST, CSS and build checks pass; the raw
asset gate passes with measured headroom. The shared merged base passes
Stop frontend/desktop race, control and catalog race, App lifecycle and
actual App browser checks. Later mainline updates remain to be integrated.
Problem: main-v2 advanced while the split renderer was being qualified,
leaving an asset-budget conflict and stale integration coverage.
Fix: merge main-v2 4947013e1, preserving session-level Stop, its original-tab
reconciliation, the stale sessioncatalog repair and the source-bound App
owners. Retain the mainline locale ceiling. The integrated raw payload is
2408.7 KiB; set the smallest rounded 2408.9 KiB ceiling with 0.2 KiB headroom.
Verification: production build and bundle gates pass. Frontend Stop
reconciliation passes 31 checks; focused desktop Stop race tests pass.
Independent read-only review confirms same-tab cancellation, controller
identity and remote rejection publication ownership remain compatible.
Complete App lifecycle and control/sessioncatalog race gates are tracked
before latest-head CI qualification and merge.
Problem: a growing offscreen predecessor could replace the input-captured
reading anchor during shared renderer measurement.
Fix: integrate the verified Kernel-anchor publication repair and committed
prefix origin conversion. App runtime composition and action owners are
unchanged, as are the independent shell asset budgets.
Verification: the shared repair passes deterministic red/green regressions,
complete transcript tests, TypeScript, production build, repository lint,
Chromium/WebKit reader replay and all 24 safety browser cycles. The integrated
shell build and latest-head official gates are checked before merge.
Problem: enlarging an offscreen predecessor could move the held reader by
its full growth (371px in the Windows browser replay).
Root cause: measurement selected the first visible block from already changed
DOM bounds. The enlarged predecessor became visible and replaced the real
input-captured anchor before the new prefix was committed.
Fix: ordinary size publication retains the Kernel anchor. Only window-origin
removal supplies a coordinate-conversion anchor, selected from the previously
committed prefix and its old sizes. An untrusted new DOM rectangle cannot
claim reading ownership. Preserve existing transaction priorities and fallback
to the Kernel anchor when no cold prefix candidate is available.
Verification: deterministic predecessor-growth regressions fail before the
repair and pass after it for both estimate directions. The model also covers
mid-history origin release, leading-edge continuity and input write exclusion.
Production build and repository lint pass; affected transcript and browser
gates are rerun before publication. Architecture contracts document the owner.
Problem: a toolbar label could satisfy the old visible-text fixture while
never establishing the selection the safety transition was meant to retain.
Fix: integrate the shared browser fixture correction and its pre-fault
selection assertion. Production files and bundle contents are unchanged.
Verification: all 24 browser safety cycles pass, including real native drag
selection, reader holds, tail ownership and zero page errors. The inherited
production build and Chromium/WebKit reader replay remain unchanged.
Problem: the safety browser gate could fail with no selection before the
fault transition, instead of testing whether a real selection survives.
Root cause: its text walker included the Compress toolbar label, which is
visible but not a native text-selection target.
Fix: select only the existing transcript-selectable surface and exclude
interactive controls. Require a real native selection and selection ownership
before injecting the geometry fault. Retain every post-transition identity,
selection, displacement, zero-write and memory assertion unchanged.
Verification: the original replay captured Compress as its drag target and
no selected text before the fault. The corrected full browser replay covers
24 safety cycles with real drag selection, pointer holds and tail ownership.
Problem: the App presentation slice inherited estimated first-paint geometry
that could move visible rows when native input ended.
Root cause: the shared renderer deferred measurements for newly mounted DOM.
Fix: integrate the ownership slice repair without changing App composition,
source-bound commands or hook order. Resolve only the independent raw asset
budget: the shell measures 2381.6 KiB, with a 2381.8 KiB ceiling.
Verification: the integrated shell passes the production build, TypeScript,
hook and AST layer gates, CSS contracts and all bundle budgets. Shared repair
passes 303 frontend suites, performance, Chromium/WebKit reader replay and
App browser lifecycle checks. Latest-head native and memory gates remain
required before merge.
Problem: native GTK scrolling could reverse visible rows after input paused,
even when the scroll writer accepted no reader writes.
Root cause: newly mounted rows inherited estimates until the reader lease
expired. Releasing their accumulated size debt then moved later visible rows.
Short Markdown parsing added another asynchronous first-paint handoff.
Fix: measure new DOM before paint, preserve existing visible coordinates with
a generation-bound window origin, and acknowledge only the complete prefix.
Preload the history renderer and synchronously format bounded windowed answers;
large worker results still format automatically after active input ends.
Keep the native single-writer and existing safety thresholds. Normalize the
small attributable raw bundle delta from 2408.2 to 2408.5 KiB with a 2408.7
KiB ceiling. Model native extent clamping in the deterministic DOM harness.
Verification: fixed-height regressions cover both estimate directions,
reverse travel, input release and the leading edge. Markdown tests, viewport
tests, production build, repository lint and isolated GTK diagnostic replay
pass. Final-head browser and CI qualification are tracked in the PR.
Problem: clean-profile Windows startup reaches provider onboarding, so the native smoke times out waiting for composer-input despite a healthy document and renderer.
Root cause: the smoke still assumes first launch opens the workspace directly.
Fix: identify the provider onboarding surface and invoke its existing return-to-workspace button through UI Automation once. Retain the full five-second window, renderer, document and composer stability gate.
Verification: provider onboarding marker regression, frontend build and bundle budgets, and repolint pass locally. Windows UI Automation execution is delegated to CI; no timeout or health condition is relaxed.
Problem: Windows history prepend replay counts later geometry measurements as excess retries even when the anchor remains stable.
Root cause: the first accepted prepend write ends ownership immediately; measurement publications then start independent restore transactions. The browser gate counts all revisions together instead of checking duplicate corrections and painted anchor stability.
Fix: retain prepend ownership until the final layout batch reaches its next frame, cancel settlement on user input or surface replacement, and reject duplicate writes within each geometry revision. Test every sampled post-landing anchor position and preserve the zero-blank-frame and 4px drift gates.
Verification: deterministic kernel and transcript suites, long-list browser replay, single-writer check, TypeScript/build stages and repolint pass. Prepend frame drift is 0.1px with no blank frames or duplicate revisions. Raw bundle measures 2385.1 KiB (+0.3); minimally round its ceiling to 2385.2 KiB, leaving all gzip and other budgets unchanged.
Problem: native viewport notifications can stop after replacing a transcript surface, leaving the virtual range behind native scrolling.
Root cause: subscriptions capture the kernel generation but depend only on the stable kernel object and DOM element. After generation advancement their callbacks reject every update without resubscribing.
Fix: bind native viewport and measurement subscriptions to the surface generation while retaining stale-callback cancellation. Extract the native snapshot hook for a deterministic lifecycle regression test.
Verification: regression fails before the fix (offset 100 instead of 10000) and passes after; transcript suites, single-writer guard, repolint, frontend build and bundle budget pass. Browser selection and long-scroll replay pass; composer replay passes on isolated rerun after an initial fixture entry timeout. Native WKWebView validation remains pending.
Inherit the bounded bootstrap lock-release handoff repair and current async wiring check from the ownership slice. Its deterministic SFTP regression, race tests, lint and full frontend test:all pass; presentation assets remain unchanged.
Problem: concurrent clients could fail to open a remote workspace when the serve owner released its lock between a failed mkdir and Stat.
Root cause: lock acquisition treated a missing observation as a permanent creation failure. A frontend wiring check also still referenced the replaced post-publication rollback helper.
Fix: recontend through exclusive mkdir once per missing observation for structured contention-capable errors. Bound consecutive ambiguous failures and preserve cancellation, permission and transport errors. Test real SFTP release ordering and update the async handoff contract; leave stale-lock reclamation unchanged.
Verification: deterministic regression fails before the repair. Bootstrap race tests, bounded-error cases, root lint and repolint pass. The root suite passed except an unchanged control timeout; its full package passed on one isolated rerun. All 302 frontend suites and remaining test:all groups pass. No API, persisted-format or provider-byte change.
Problem: frontend CI cannot load CSS imports in five settings suites and retains outdated header and plugin installer assumptions.
Root cause: new settings shell dependencies were not registered with the Node CSS hook; the plugin test clicked the collapsed install entry instead of the install action.
Fix: register the affected suites, assert accessible shell names without duplicate headings, and exercise installer disclosure before installation. Extract plugin actions and shared DOM helpers to keep test files within their existing size limits.
Verification: all seven affected suites pass with the CI loader; repolint is clean and the full frontend regression run is in progress.
Problem: PR checks failed in Go lint and the desktop typography suite.
Root cause: two standard-library lint rules were missed, and the layout test still asserted retired preset-card selectors.
Fix: use maps.Copy and http.StatusBadRequest; assert current catalog scrolling, shrinkability and model-ID wrapping.
Verification: golangci-lint 2.12.2 reports zero issues; config/provider tests, repolint and all 176 typography assertions pass. Full frontend coverage continues in CI.
The four #9889/#9890 PRs (#9898, #9899, #9900, #9901) each raised the raw
ceiling by their own delta and conflicted on every merge. Merged together on
the renderer-cutover base they measure 2431847 B (2374.851 KiB) raw and
63492 B (62.004 KiB) zh-TW, so all four now carry the identical 2375.0 KiB
and 62.1 KiB ceilings with the combined measurement recorded. Re-measure
once the series has landed.
The four #9889/#9890 PRs (#9898, #9899, #9900, #9901) each raised the raw
ceiling by their own delta and conflicted on every merge. Merged together on
the renderer-cutover base they measure 2431847 B (2374.851 KiB) raw and
63492 B (62.004 KiB) zh-TW, so all four now carry the identical 2375.0 KiB
and 62.1 KiB ceilings with the combined measurement recorded. Re-measure
once the series has landed.
The four #9889/#9890 PRs (#9898, #9899, #9900, #9901) each raised the raw
ceiling by their own delta and conflicted on every merge. Merged together on
the renderer-cutover base they measure 2431847 B (2374.851 KiB) raw and
63492 B (62.004 KiB) zh-TW, so all four now carry the identical 2375.0 KiB
and 62.1 KiB ceilings with the combined measurement recorded. Re-measure
once the series has landed.
The four #9889/#9890 PRs (#9898, #9899, #9900, #9901) each raised the raw
ceiling by their own delta and conflicted on every merge. Merged together on
the renderer-cutover base they measure 2431847 B (2374.851 KiB) raw and
63492 B (62.004 KiB) zh-TW, so all four now carry the identical 2375.0 KiB
and 62.1 KiB ceilings with the combined measurement recorded. Re-measure
once the series has landed.
Keep the presentation slice on the reviewed session-ownership implementation. The remote failure owner restores identity before publishing errors and fences competing lifecycle transitions. Full desktop tests and race tests pass on the shared implementation.
Problem: rejected remote session opens could publish an error while observers still saw the rejected session identity.
Root cause: failure state publication and restoration of the previous selection had separate owners, allowing reconnect or later selection work to interleave.
Fix: commit restoration and failure state through one revision-checked completion owner. Order route metadata, terminal state, close and generation replacement with the existing publication fence; cover HTTP, busy, listing, missing-target and reconciled transport failures.
Verification: deterministic regression failed before the repair. Remote tests, five race repetitions of rejection and lifecycle cases, full desktop tests, full desktop race tests, golangci-lint and repository lint pass. No public API, persisted format or provider prompt bytes change.
Resolve the bundle-budget conflict by taking main-v2's file and re-measuring
on the renderer-cutover base: raw 2429046 B (2372.115 KiB) over 2428639 B
-> 2372.2 KiB; the gzip, CSS, and locale gates pass unchanged.
Resolve the bundle-budget conflict by taking main-v2's file and re-measuring
on the renderer-cutover base: raw 2429554 B (2372.611 KiB) over 2428639 B
-> 2372.7 KiB; the gzip, CSS, and locale gates pass unchanged.
Resolve the bundle-budget conflict by taking main-v2's file and re-measuring
on the renderer-cutover base: raw 2430332 B (2373.371 KiB) over 2428639 B
-> 2373.5 KiB; the gzip, CSS, and locale gates pass unchanged.
Resolve the bundle-budget conflict by taking main-v2's file and re-measuring
on the renderer-cutover base: raw 2428827 B (2371.901 KiB) over 2428639 B
-> 2372.0 KiB; the gzip, CSS, and locale gates pass unchanged.
Replace the overlapping viewport paths with a single kernel-owned Full DOM and windowed renderer. Publish measured geometry before paint and preserve input-owned reader intent. Exact-head CI, native GTK/WKWebView/WebView2, browser and deterministic regression checks pass.
Reject cancelled preparation at the shared admission boundary while preserving legacy nil-context callers. Deterministic cancellation and compatibility regressions, local root and desktop suites, race checks, and exact-head CI pass.
Carry the shared measurement publication and native input contracts into the session ownership slice, including its independent cancellation prerequisite.
Integrate the separate context-admission repair from PR #9903 before qualifying the renderer on current CI. The shared entry preserves cancelled errors, checks after lock acquisition, and normalizes legacy absent contexts. Its root and desktop Go suites, targeted race tests and lint have passed locally; PR #9903 remains an independent merge prerequisite.
Problem: GTK input backlog could freeze all future measurements and produce 19/38px visible reflow at release. Root cause: A second input-distance ledger treated the whole pending native queue as a forbidden publication region, exceeding the mounted window. Fix: Keep sizes in the ledger and input leases in the kernel; derive publication from freshly observed native and painted geometry while preserving atomic prefix commits. Native harnesses now finish from stable tail geometry within their original deadlines, and the cold-expansion baseline excludes Playwright actionability scrolling. Verification: GTK candidate reverse and blank frames are zero; geometry-driven finishing is under isolated verification. Full transcript, typecheck, build, repolint, Chromium/WebKit reader and browser suites pass. Native host contracts and Windows/macOS host builds pass; original 4px and watchdog limits remain unchanged.
Resolve the bundle-budget conflict by taking main-v2's file and re-measuring:
initial JS gzip 479621 B (468.380 KiB) over a 479496 B base -> 468.5 KiB;
raw 2558063 B (2498.108 KiB) -> 2498.2 KiB. Locale and CSS gates pass on the
new base unchanged.
Resolve the bundle-budget conflict by taking main-v2's file and re-measuring:
initial JS gzip 479704 B (468.461 KiB) over a 479496 B base -> 468.6 KiB;
raw 2558558 B (2498.592 KiB) -> 2498.7 KiB. Locale and CSS gates pass on the
new base unchanged.
Resolve the bundle-budget conflict by taking main-v2's file and re-measuring:
initial JS gzip 480080 B (468.828 KiB) over a 479496 B base -> 468.9 KiB;
app-shell CSS 116.910 -> 117.057 KiB -> 117.2 KiB; raw 2559365 B
(2499.380 KiB) -> 2499.5 KiB. Locale gates pass on the new base unchanged.
Resolve the bundle-budget conflict by taking main-v2's file and re-measuring:
initial JS gzip 479545 B (468.306 KiB) over a 479496 B base -> 468.4 KiB;
raw 2557844 B (2497.895 KiB) -> 2498.0 KiB. Locale and CSS gates unchanged.
Problem: Staticcheck flags the deliberately nil context used to reproduce a legacy desktop caller. Keep both regression cases intact and document the narrowly scoped test-only exception. Verification: golangci-lint run ./internal/agent/... reports zero issues; production code is unchanged from the validated cancellation fix.
Problem: The new cancellation admission check exposed a nil context passed by legacy desktop compaction callers. Root cause: The shared entry previously tolerated that value on no-maintenance paths. Fix: Normalize absent context once at Prepare before cancellation admission, keeping real cancellation intact for every consumer. Verification: Nil automatic and manual preparation plus cancellation interleavings pass five times under the race detector; the complete desktop suite is running to cover the original failing consumer.
Problem: Cancelled Prepare calls could report success through no-maintenance fast paths. Root cause: The shared entry did not check cancellation before acquiring the maintenance lock or after waiting for it. Fix: Reject cancelled and expired contexts at both admission boundaries before projection work, while preserving live requests. Verification: A regression fails on the original implementation; focused cancellation tests pass five times under the race detector, including a deterministic lock-wait interleaving. Full owning-package race and root suites are running.
Fix: Carry the merged prerequisite ancestry through the ownership stack so pull-request validation can run on the current base. Verification: The merge preserves the previously validated app-shell tree without production file changes.
Fix: Incorporate the renderer branch ancestry update after both prerequisite slices merged. Verification: The merge changes no production files and retains the validated ownership and input-intent tree.
Problem: Independent prerequisite merges leave multiple merge bases in the stacked renderer branch. Fix: Record the current main-v2 ancestry without changing the reviewed renderer tree. Verification: merge-tree resolves cleanly; both prerequisite PR heads are already contained in this branch.
Problem: Tail following and newer gestures could be displaced by layout observations or stale releases. Root cause: Intent ownership was not distinct from geometry and queued callbacks. Fix: Integrate the reviewed renderer correction through the ownership slice. Verification: Production build and bundle gates pass at 2381.4 KiB raw; the measured 0.2 KiB increase preserves the deferred shell boundary.
Problem: Layout scroll observations and stale pointer releases could detach tail following without current user input. Root cause: scroll geometry and input-release callbacks lacked distinct intent ownership. Fix: Integrate the kernel input lease and release identity correction from the renderer slice. Verification: Renderer transcript, Chromium/WebKit suites and type checks passed; this slice production build passes at 2408.2 KiB raw with an attributable 0.2 KiB increase.
The frontend is untouched in this PR, yet the desktop jobs failed with
'initial JavaScript gzip is 468.3 KiB; budget is 468.3 KiB' while the same
bytes passed on main-v2 an hour earlier: the base already straddles the
ceiling by a few bytes depending on the runner's zlib. Raise the ceiling to
468.4 KiB (the same normalization #9898 carries) with the measurement noted.
Problem: Native setup could lose tail follow without any new user input, and delayed release callbacks could end newer scrolling gestures.
Root cause: Geometry and unowned scroll notifications reinterpreted bottom gaps as reader intent. No-op writes and lease renewal could consume delayed writer provenance; pointer release callbacks only identified the surface, not their input operation.
Fix: Preserve input-owned anchors across structural geometry, require an input owner for scroll intent changes, retain writer provenance across no-ops, and fence releases by input revision and surface generation. Keep touch momentum and thumb release under the renewable native lease, while explicit jump-bottom ends the older lease. Test setup now waits for the lazy adapter lifecycle within one second and models actual input before native scroll events.
Verification: Deterministic kernel and React interleavings, transcript suite, test typecheck, single-writer and repolint pass. Full browser gate and Chromium/WebKit reader replay pass with zero reverse displacement and overlap. The added input ownership code measures 2371.7 KiB raw; its slice budget increases from 2371.6 to 2371.8 KiB. Current-head isolated native CI remains required.
Problem: After a hard kill mid-turn a conversation could vanish from the
sidebar on restart even though its transcript was intact (#9890, #8451,
#8452, #8782 family).
Root cause: A save invalidates the listing projection before committing the
transcript. A kill between the two leaves a stale projection, which
recordFromOrder classified as unknown and blanked to zero turns and an empty
preview; the desktop's content-based visibility gates then hid the topic
until the repair worker recomputed it. Known counts were only carried over
when the content fingerprint was unchanged, which a mid-save kill breaks.
Fix: A stale projection is still never certified and still queues repair,
but its last-known preview and turn count stay as display hints in
recordFromOrder, preserveKnownSourceStates, and the exact-path index
(fillKnownCountHints). Same-fingerprint restoration and repair semantics are
unchanged. Docs state the rule.
Verification: go test ./internal/sessioncatalog/ (renamed and new hint
tests); go test ./internal/agent/ -run 'Listing|Projection'; cd desktop &&
go test . -run 'Catalog|Topic|Recovery|Hidden|Blank|Listing|ProjectTree';
gofmt, go vet, make lint clean.
Problem: A parallel read-only tool segment waited on an unconditional
WaitGroup, so one tool that ignored its context kept the whole turn wedged
after Stop. While a tool ran without output nothing distinguished progress
from a hang, and no turn-level liveness signal existed (#9889, #9890).
Root cause: runParallel had no exit besides every worker returning, and the
batch wrote results into shared slices that later finalization read, which
made abandoning a straggler unsafe. The controller only observed events for
persistence, never for silence.
Fix: Parallel segments run against a forked batchSlots copy; runParallel
reports which calls finished, waits a bounded parallelStragglerGrace after
cancellation, and the batch adopts finished slots while abandoned calls get
an explicit unknown-effect result. A turnLiveness stamp is refreshed by every
raw event and the autosave tick emits one warn Notice (turn_stalled) per
silent stretch past turnStallThreshold; autosave moved to turn_autosave.go.
Running tool cards show a live elapsed label; turn_stalled is localized.
Bundle ceilings are raised to the next decimal with measurements recorded.
Verification: go test ./internal/agent/ ./internal/control/ ./internal/event/
(new abandonment and liveness tests under -race); pnpm typecheck,
test:typecheck, lint:hooks, tool-card and controller suites; gofmt, go vet,
make lint clean; vite build + bundle budget pass.
Carry the approved measurement transaction through the final App composition. Keep shell extraction behavior unchanged and run the complete native and App memory qualification on the resulting head.
Carry the reviewed renderer batch-to-geometry fix into the session ownership slice. Preserve the session command and lifecycle boundary while qualifying the updated renderer with this slice.
Problem: Native traversal could reveal a 24px layout shift without a scroll write.
Root cause: The measurement ledger published safe future sizes while the range owner retained an older prefix, deferring their painted effect until later native travel. A covering stale candidate could also carry coordinates from another batch.
Fix: Close each approved batch with a layout-effect update, derive candidate placements from its owned prefix, reconstruct stale coverage, and acknowledge only a valid geometry commit. Preserve ordinary stale-range retention and native ownership.
Verification: Old-code deterministic regression failed by 24px; model and kernel interleavings, transcript tests, test typecheck, build budgets, single-writer gate and repolint pass. Chromium and WebKit reader replay reports zero reverse displacement and overlap. The full browser suite had a pagination timeout under investigation; isolated native CI is still required because the local offscreen host stopped receiving animation frames.
Problem: Clicking "Set as default version" in the recovery-lineage dialog
could turn the whole window into a raw full-screen error page with only a
"send report" button, and a successful click could freeze the UI (#9890).
Root cause: RecoveryLineageDialog's choose/openVersion had no catch, so a
backend rejection became an unhandledrejection, and crash.ts painted every
unhandledrejection as a fatal crash even though Wails rejects a bound Go
call with a bare error string. ChooseRecoveryBranch also held the runtime
mutation barrier and sessionRemovalMu across a whole-directory catalog rescan.
Fix: The dialog actions catch, record a status-only diagnostic, and toast a
localized message. A new globalCrashHandlers module contains stackless
rejection reasons (preventDefault, diagnostic, reasonix:recoverable-error
event that App toasts) while Error instances with a stack and window.error
still reach the overlay. ChooseRecoveryBranch keeps SetRecoveryPreferred
under both barriers and runs ReconcileDirectory after release. Bundle
ceilings are raised to the next decimal with measurements recorded.
Verification: cd desktop && go test . -run 'Recovery|Lineage' (new barrier
release test); tsx crash-rejection-containment (14), recovery-lineage-dialog,
crash-reporting (96) and neighbouring suites; pnpm typecheck, test:typecheck,
lint:hooks, build with bundle budget; gofmt, go vet, make lint, desktop
golangci-lint clean.
Problem: A turn on an unreachable provider could stay "working" forever.
#9889 recorded 27m40s with zero model requests in stats and only a one-line
status hint at the bottom of the composer.
Root cause: streamWithSamplingRecovery retries without an upper bound. After
maxSamplingAttempts the loop enters waiting mode for connect failures and
408/429/5xx header failures and sleeps about a minute per cycle; the only
exits were ctx cancellation and a TaskBudget wall limit that foreground turns
never set. Usage is emitted only after the loop returns, so stats stay empty.
Fix: Add a 10-minute total waiting budget (defaultRecoveryWaitBudget). Once
the next cycle would exceed it the turn ends with the typed
provider.RecoveryWaitExhaustedError, classified non-retryable and diagnosed
as recovery_wait_exhausted; explainError renders a localized, actionable
message while keeping the cause reachable. Waiting Retrying events carry
wait_budget_ms. The desktop shows a RecoveryWaitBanner above the composer
with phase, countdown, waited-of-budget, failure code, and a Stop button.
Bundle ceilings are raised to the next decimal with measurements recorded.
Verification: go test ./internal/agent/ ./internal/provider/ ./internal/event/
./internal/control/ ./internal/eventwire/ ./internal/i18n/ (new budget,
retry-after, and cancel tests, also under -race); pnpm typecheck,
test:typecheck, lint:hooks, check:css, recovery-wait-banner (18), composer
suites; gofmt, go vet, make lint clean; vite build + bundle budget pass.
Record the settings parent final browser preparation, retaining the atomic new-renderer contract because the legacy engine and its fixture setup are superseded together.
Problem: the Windows fixture reached all 238 rows but its final tail-follow
qualification was still overwritten by a late legacy layout transaction.
Root cause: preparation mixed a real initial wheel with direct scrollTop
updates and batched synthetic DOM clicks. Those offsets did not carry reader
intent, while the old renderer correctly continued owning its layout anchor.
Fix: use real wheel gestures for every move, click one visible disclosure
control at a time, settle its geometry, and use the real return-to-bottom
button after an upward gesture. Remove optional/skipped tail acquisition and
all direct scroll assignments and synthetic clicks from fixture preparation.
Verification: complete legacy scroll browser gate passed with every original
correctness threshold; first/revisited preparation at normal and four-times
CPU throttling consistently produced 238 rows, tail-follow and zero tail
distance. Syntax, whitespace and repository lint passed.
Problem: A turn could stay "working" while Stop reported "Cancel failed:
turn ... is not the active turn" (or "active turn id is unavailable") and
did nothing; only killing the process recovered (#9889, #9890).
Root cause: InterruptTurnForTab fenced Stop on an exact ledger turn id that
reads as empty once the terminal event is appended, and the frontend cached
a possibly stale id with no fallback to the unconditional cancel.
Controller.Cancel also emitted the synchronous TurnCancelling barrier before
cancelling the turn context while holding promptResolveMu, so a stalled
event lane delayed the stop and blocked prompt resolution behind it.
Fix: Stop now interrupts whatever is running; a stale turn id is logged and
only an idle tab returns the stable code reasonix_error:turn_not_running.
cancelTurnLocked cancels the turn first and the cancelling status is emitted
after the prompt lock is released, stamped with its turn so the ledger drops
it if that turn already terminated. The frontend retries a fence rejection
through the unconditional path, treats an idle backend as success, and
always schedules cancel reconciliation. Bundle budgets are raised narrowly
with the measured before/after bytes recorded in the script.
Verification: go test ./internal/control/ (full, plus -race on the new
ordering tests); cd desktop && go test . (full); pnpm typecheck, lint:hooks,
use-controller-cancel-reconcile test (31 pass); gofmt, go vet, make lint
clean; vite build + check-bundle-budget pass.
Keep the final shell and presentation source unchanged while recording the current settings, renderer and ownership parent commits for independent CI qualification.
Record the renderer parent integration of the final legacy fixture ownership test. This merge leaves the ownership implementation and memory build inputs unchanged.
Retain the complete new-renderer browser contract while recording the settings parent final qualification. The old-engine-only fixture setup is superseded with the renderer itself.
Problem: Windows prepared only 147 geometry rows and Linux could keep
revisiting disclosure rows before the scroll regression assertions began.
Root cause: direct scrollTop preparation ran while the old engine still
owned tail-follow. Its next update could pull the viewport back before the
virtual list published the requested range; two frames did not establish
reader ownership or settled geometry.
Fix: begin preparation with a real upward wheel gesture and require manual
ownership at the physical top, then settle geometry between disclosure steps.
Keep the row-count, reverse-displacement, blank-frame and estimate assertions.
Verification: complete legacy Chromium scroll browser gate passed; fresh and
revisited fixture setup passed at normal and four-times CPU throttling, each
with 238 rows, tail-follow ownership and zero final tail distance. Syntax,
whitespace and repository lint passed. Platform CI will verify this head.
Include the updated settings and renderer parents and their bilingual acceptance documentation. Preserve the final shell extraction and memory protocol unchanged.
Problem: the migrated command owners still share a large App entry with the
entire page tree, obscuring the source-authority and presentation boundary.
Root cause: runtime composition and JSX assembly remained in one module;
context and subagent presentation code also remained in eager consumers.
Fix: retain the original hook and command order in AppRuntime, render the
same stable regions through AppRuntimeView, and make App.tsx a small facade.
Extract pure context helpers and lazy subagent presentation with preserved
live outcome tuples and historical output parsing. Enforce the entry and
transitive AST layer contracts, remove the obsolete App size allowance,
reduce remaining ContextPanel debt, and ratchet measured raw assets to
2381.3 KiB for the 2381.2 KiB result. Keep independent memory screening.
Verification: all 302 discovered suites plus the remaining test:all groups;
App lifecycle and actual browser replay; typechecks; production build and
bundle budgets; AST negative fixtures and repository lint; independent
read-only review of hook order, command provenance and outcome compatibility.
Keep the architecture documentation link valid in the standalone renderer slice. Record browser and native acceptance boundaries in English and Chinese without claiming permanent CI success or whole-App memory qualification. Verified relative documentation links and whitespace.
Carry the final settings fixture migration and merged pure-kernel base into the ownership slice. The production tree is unchanged, preserving the independently reviewed ownership boundary.
Integrate the final settings parent. Retain the new renderer browser contract: the parent-only legacy Virtuoso fixture migration is superseded atomically with that engine.
Problem: legacy scroll replay seeded a localStorage fold preference that the
new authoritative startup snapshot correctly replaced, changing its fixture.
Root cause: browser setup bypassed the settings owner and assumed the removed
independent global process-fold control. Programmatic disclosure preparation
also needed to settle before reacquiring tail ownership.
Fix: save Standard through the real settings page and explicitly disclose
geometry process rows while retaining collapsed reasoning. Settle preparation
before the real return-to-bottom action. Describe this as a prepared traversal,
not a cold first visit; preserve every scroll and geometry correctness limit.
Verification: complete Chromium legacy scroll stability browser gate passed,
including 238-row geometry, A-to-B-to-A, dynamic measurement, native ownership,
selection, history, resolution storms and reduced motion; syntax, whitespace
and repository lint passed.
Problem: asynchronous App actions and cleanup can outlive the session or
controller that initiated them, especially across background cancellation
and A-to-B-to-A navigation.
Root cause: mutable active-view state and independent effect cleanup were
used as authority for pending operations and shared subscriptions.
Fix: wire committed source-bound command owners, canonical controller
cancellation, generation fences, navigation receipts, and subscription leases
into App composition. Keep the runtime root and page tree together for this
slice. Add a separate three-runner memory screening workflow that verifies
one clean build, complete protocols, and unique same-attempt shard evidence.
Document the remaining offline heap-retainer and control attribution duty.
Verification: 302 frontend discovery suites; App lifecycle and real browser
replay; production/test typechecks; production build and measured bundle
budgets; repository lint; 21 memory protocol/path negative tests; actionlint;
focused independent security review of workflow permissions and aggregation.
Problem: independent virtual-row corrections can fight native scrolling and
leave cold reasoning expansions overlapping following content.
Root cause: row measurements, pending compositor travel, mounted ranges and
anchor correction did not share one generation-fenced commit boundary.
Fix: adopt the final repaired block projection and viewport kernel from
#9777, including cold-block observers, consumed-travel retirement, immutable
measurement publication and before-paint anchor restoration. Remove Virtuoso
and its competing recovery paths. Keep the existing App callback and session
identity wiring. Migrate all three native smoke hosts and their shared
contract together with the renderer, and update the development invariants.
Verification: production build and tightened bundle budget; production/test
TypeScript; Transcript suite; Chromium selection, scroll and composer gates;
Chromium/WebKit reader traversal with zero reverse displacement and overlap;
desktop Go suite; repository lint. The discovery run passed 267 suites, and
its one obsolete Virtuoso source assertion was replaced and rerun successfully.
Native external CI must qualify this child head before merge.
Combine the independently reviewed settings and pure-model slices before integrating the production renderer. Parent PRs remain independently mergeable.
Problem: independent display, reasoning and process-fold preferences produce
inconsistent session presentation and stale controls after failed saves.
Root cause: frontend mirrors and historical settings can disagree with the
backend snapshot, while display changes alter the legacy renderer geometry.
Fix: adopt Standard/Deep backend ownership, compatibility mirrors and the
snapshot-driven setting control from #9777. Adapt its presentation consumers
to the existing renderer and route preference geometry through its current
scroll writer. Keep user scrolling and selection authoritative. Include the
committed command primitive and its disposal/supersession tests.
Verification: configuration and desktop Go tests, production/test TypeScript,
production build, settings and consumer regressions, existing Transcript
suite and repository lint passed. The measured bundle and legacy-adapter
line allowances are documented narrowly in the PR; correctness gates stay
unchanged. Full final discovery and external CI qualify the published head.
Problem: PR #9777 combines viewport state, renderer replacement, settings,
and application lifecycle ownership in one large review surface.
Root cause: the final renderer depends on generation-aware transactions,
immutable measurement snapshots, and logical navigation that need their
own executable contract before production integration.
Fix: adopt the final pure kernel, timeline projection, measurement ledger,
window geometry, history request and navigation models from #9777. Keep
production Transcript and its existing writer unchanged. Include deterministic
race, native-travel retirement, immutable-prefix and 10,000-turn tests.
Verification: production build and bundle budgets, production/test TypeScript,
six focused model suites, and repository lint passed. Native rendering is
qualified in the separate renderer cutover, not by these model-only tests.
A summary request the provider rejects now feeds its real prompt count back
into calibration, re-plans a smaller prefix, then falls back to a bounded
transcript form and (manual only) the fragment path; chunk and merge retries
treat provider overflow as a size failure. Prefix planning keeps 5% of the
window as estimator headroom. At the ceiling, when no summary can form, a
truncate projection elides the oldest tool results and drops the oldest replay
units behind a marker instead of returning ErrCompactionRequired. Overflow
rescues may fold the active turn's completed rounds, and the same-turn backoff
lifts once the view has grown 5% of the window since the failed attempt. DeepSeek-style
chat adapters report that ordinary reasoning is replayed so admission counts
it. SPEC and the desktop maintenance notice follow.
Fixes#9818
Problem: an overflow parsed without token numbers (Zhipu GLM 1261) reached
the sampling recovery path, which answered it by resending the same prompt
under a clipped output cap and then failed; the user-facing error quoted
"prompt 0 + completion 0 = 0 tokens, window 0". The reasoning-only summary
clamp sliced bytes and could cut a multi-byte rune, an opened-but-unfinished
tool call did not count as a tool attempt, and three comment blocks failed
repolint's essay rule.
Root cause: consumers of ContextLimitError assumed positive token fields, and
the new clamp used a byte slice instead of the package's rune-safe helper.
Fix: recovery treats a zero-field overflow as physically over the window and
goes straight to overflow compaction; the error message falls through to the
generic 400 text when no numbers are known; the clamp uses truncateUTF8Bytes;
ChunkToolCallStart counts as a tool attempt; comments trimmed to the limit.
Verification: go vet, repolint, golangci-lint clean; go test ./internal/agent
./internal/provider/... ./internal/control pass, including new
TestUnnumberedContextLimitSkipsIdenticalRetry,
TestSummarizerReasoningWithToolCallStaysEmpty,
TestSummarizerReasoningClampKeepsValidUTF8, and the zero-field errmsg case.
Two compaction failure shapes observed on a 2M-token session (fork开发),
where pressure-triggered summary retries never converged and the turn
died with an HTTP 400 overflow:
- summarize() accumulated only ChunkText, so a thinking-model summary
(DeepSeek vision SKUs put the whole briefing in reasoning_content with
an empty content block) returned 'summarizer returned empty output'
and the chunked fragment fallback died on the same check forever
(observed: fragment 2/14). Surface a pure reasoning-only summary
(clamped), mirroring the boundedllm #9679 treatment; a turn that also
attempted tool calls keeps the empty-output rejection — that reasoning
is private chain-of-thought, not digest material.
- ParseContextLimitError could not recognize provider overflows that
carry no token numbers: Zhipu GLM 1261 'Prompt exceeds max length'
matched none of the numeric regexes and no JSON token field, so
AsContextLimitError returned nil, the chunked compaction fallback
never triggered, and the uncapped request failed transparently on
every retry. Trust the provider-confirmed overflow with an unknown
window (zero token fields); consumers already treat 0 as 'learn
nothing, fall back to the configured window'.
Guards: TestSummarizerReasoningOnlyIsSurfacedNotEmptied,
TestParseContextLimitErrorGLMUnnumbered1261; existing
TestSummaryCollectorRejectsEmptyAndLengthLimitedOutput shape intent
(reasoning + tool call = reject) preserved.
Problem: completion notices used the same verification label for failed and limited checks.\nRoot cause: the action label ignored completion gap kinds and attention state.\nFix: map failed, limited, and attention states to explicit verification actions across locales.\nVerification: desktop frontend typecheck and completion summary UI checks.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
* Fix recoverable tool argument validation
Problem: malformed tool arguments were escalated into schema-specific blocking after repeated failures.\n\nRoot cause: schema loop state duplicated the shared storm breaker and converted ordinary validation errors into permission-style blocks.\n\nFix: return actionable unexecuted validation errors, conservatively diagnose redundant argument wrappers, preserve capability resolution boundaries, and let the existing storm breaker provide soft convergence. Remove obsolete schema counters and unlock state, and document the contract.\n\nVerification: go test ./..., go test -race ./internal/agent ./internal/tool ./internal/capability, cd desktop && go test ./..., go vet ./....
* Satisfy argument recovery lint checks
Problem: the new recovery regression loops triggered the repository intrange lint rule.\n\nRoot cause: tests used C-style loops where the index was unnecessary.\n\nFix: use Go integer range loops while retaining the indexed concurrency case.\n\nVerification: make lint-go.
* Correct indexed recovery test loops
Problem: lint cleanup removed indexes still used by recovery assertions.\n\nRoot cause: three loops were converted to index-free ranges without preserving their test identifiers.\n\nFix: retain integer indexes only where assertions and call IDs use them.\n\nVerification: make lint-go.
* Keep mixed batch assertion index
Problem: the mixed permission regression still referenced its loop index after lint cleanup.\n\nRoot cause: the index-free range conversion missed the assertion loop.\n\nFix: retain the index for the third-batch assertion.\n\nVerification: make lint-go.
* Reduce resolver path complexity
Problem: the CI repolint gate reported execute_one.go over its complexity budget after adding repairable resolver diagnostics.\n\nRoot cause: input-error classification was nested inside the already complex proxy resolution owner.\n\nFix: extract proxyResolutionError so repairable input failures and unrelated resolver errors retain their distinct handling without increasing the owner complexity budget.\n\nVerification: go run ./tools/repolint; focused agent tests and race tests.
Restore prompt answers and failure recovery after v1.38.0. Exact Ask answers previously failed as not pending, and an unwritable event ledger could deadlock cancellation or prompt resolution.
The controller now registers Ask through the shared prompt resolver and invalidates failed reservations without re-entering the submission mutex. Desktop fixes also preserve keyboard-entered custom answers, isolate Ask drafts by tab/runtime/turn/prompt identity, reconcile rejected submissions from fresh same-sequence snapshots, and contain background recovery errors. Failed-send status reads retain their request-start timestamp so delayed responses cannot clear newer turns.
Verification:
- `go test ./...` passed; owning control/eventwire/billing race suites and targeted Desktop runtime race tests passed.
- Added real-controller regressions for replay, stale identities, duplicate answers, skip, and WAL failures during cancellation and Ask/approval/MCP resolution.
- Frontend `pnpm test` passed all 271 discovered suites plus pretest checks; `pnpm test:typecheck`, `pnpm test:stream`, `pnpm test:remote`, and `pnpm build` passed.
- Real Chromium verified keyboard answer contents, runtime draft isolation, and absence of the global crash overlay after recovery rejection.
- `golangci-lint`, `go run ./tools/repolint`, Wails pin checks, and existing bundle budgets passed. Browser checks cover frontend behavior; native Windows/macOS shell interactions were not part of this change.
Documentation-impact: none - restores documented prompt, cancellation, and recovery behavior without adding settings or changing user-facing contracts.
Cache-impact: none - system prompts, tool schemas, provider serialization, and cache-prefix construction are unchanged.
Cache-guard: reviewed the controller registration/cleanup diff; go test -race ./internal/control ./internal/eventwire ./internal/billing.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Problem: the final prompt epoch refresh added one controller line beyond the repolint file-size budget.\n\nFix: update only the controller file-size baseline to the measured value.\n\nVerification: go run ./tools/repolint; git diff --check.
Problem: a prompt queued before turn admission could retain an empty runtime epoch even when the event was emitted after the runtime metadata became available.\n\nRoot cause: Ask refreshed its turn projection before emission but reused the earlier epoch snapshot.\n\nFix: refresh both turn and runtime epoch immediately before binding the immutable owner identity and emitting the Ask request.\n\nVerification: go test ./internal/control; go test -race ./internal/control; frontend prompt regression tests.
Problem: a stale Ask or MCP completion could clear a different card that arrived while the original request was in flight.\n\nRoot cause: the frontend used broad clearAsk/clearApproval actions without checking the prompt id and prompt epoch.\n\nFix: add identity-scoped prompt expiry for Ask, approval, and MCP cards, preserve sibling cards during stale cleanup, and add a reducer regression test. Refresh the measured bundle and repolint baselines for the shared lifecycle code.\n\nVerification: pnpm typecheck; pnpm test:typecheck; pnpm test:all; pnpm build; go run ./tools/repolint; git diff --check.
Problem: the new concurrent prompt-owner test used WaitGroup.Add and triggered the repository modernize lint rule.\n\nRoot cause: the test predated Go 1.26's WaitGroup.Go API.\n\nFix: use WaitGroup.Go while preserving the deterministic barrier and two-writer assertion.\n\nVerification: golangci-lint run --timeout=5m ./...; GOOS=windows golangci-lint run --timeout=5m ./...; (cd desktop && GOOS=windows golangci-lint run --timeout=5m ./...).
Problem: prompt cards could be emitted before the controller ledger exposed the active turn or runtime epoch, leaving the in-memory owner with an incomplete identity and causing an exact submission to be rejected or misclassified.\n\nRoot cause: queued Ask and MCP prompts captured routing metadata before the turn/event projection was available, while Ask submission trusted a cached turn when one existed.\n\nFix: bind missing routing fields once immediately before emission, require configured runtime epochs to match the owner identity, refresh Ask turns from ListTabs at submission time, and keep the regression fixtures and measured bundle/repolint baselines aligned with the current base.\n\nVerification: go test ./...; cd desktop && go test ./... && go test -race .; cd frontend && pnpm test:all && pnpm build; go run ./tools/repolint.
Problem: A queued follow-up cleared the active turn identity before a rejected send could reconcile the backend, and an idle snapshot without an event sequence could be discarded as an old zero sequence.
Root cause: The user reducer unconditionally released activeTurnId for every send, while status reconciliation synthesized a zero sequence for metadata that did not include turn-event sequencing.
Fix: Retain the active turn for submissions made during a live turn, preserve absent sequence metadata as absent, and sample completed status reads after the bridge response with a deterministic monotonic epsilon. Add a stale Ask expiration regression.
Verification: pnpm exec tsx src/__tests__/use-controller-send-fallback.test.tsx; go vet ./...; git diff --check.
Problem: Delayed Ask and decision-card responses could carry a turn identity that no longer belonged to the visible tab, producing rejected submissions or risking delivery through an unfenced compatibility path.
Root cause: Prompt ownership and turn/runtime identity were split across frontend state, Desktop routing, and separate controller prompt managers; the latest main-v2 base also had an external-opener test fixture referencing an undeclared source variable.
Fix: Add a controller-owned pending prompt identity owner, exact prompt resolution with turn/runtime fences and cancellation serialization, identity-bearing event wire fields, a unified ResolvePromptForTab Wails boundary, stale replay deduplication, bilingual protocol documentation, a minimal base-test fixture repair, and measured bundle budget ratchets.
Verification: go test ./...; go test -race ./...; (cd desktop && go test .); (cd desktop && go test -race .); go vet ./...; (cd desktop && go vet ./...); pnpm typecheck; pnpm test:typecheck; pnpm test:all; pnpm exec tsx src/__tests__/external-opener.test.tsx; pnpm build; go run ./tools/repolint; git diff --check.
The latest main-v2 merge adds a small cross-platform compression and raw startup payload delta. Update the documented bundle ceilings by the measured one-decimal increments so Windows, macOS, and Linux use the same stable ratchet.
Verification: pnpm run check:bundle; go run ./tools/repolint; git diff --check.
Retain the reviewed one-decimal locale and raw bundle headroom after integrating the latest main-v2 bundle ratchets.
Verification: pnpm exec tsc --noEmit; pnpm run check:bundle; go run ./tools/repolint; git diff --check.
Merge the previously published PR head into the latest main-v2-based branch without rewriting remote history. Retain the reviewed session recovery, activation, retry, reconciliation, worktree contract, documentation, and lint budget fixes.
Update only the existing file-size ratchets increased by the latest main-v2 baseline merge. No unrelated baseline findings are changed.
Verification: go run ./tools/repolint; git diff --check.
Problem: version activation could rebind a tab before lineage validation, retry failures were silent, recovery reconciliation could stampede, and frontend bundle limits failed at compression boundaries.
Root cause: validation, persistence, and rebinding were separate; rejected retry promises were discarded; reconciliation had no per-topic single-flight; and locale/raw bundle ratchets had no headroom for the new recovery contract.
Fix: serialize version activation, validate lineage before rebinding, surface retry errors, coalesce recovery reconciliation, and update narrowly documented locale/raw bundle budgets.
Verification: desktop go test ./...; frontend pnpm run build and check:bundle; go test -race on agent/control/sessioncatalog/workspacelease; go run ./tools/repolint; git diff --check.
Problem: recovery version activation could rebind a tab before proving the selected path belonged to the requested lineage, retry failures were not surfaced, and the new recovery UI exceeded strict frontend bundle ratchets.
Root cause: validation and tab rebinding were separate operations, retry actions discarded rejected promises, recovery reconciliation lacked per-topic coalescing, and localized recovery state increased the measured bundle at a rounding boundary.
Fix: validate recovery membership before activation, surface retry errors, coalesce recovery reconciliation, update the recovery notification contract, and add narrowly measured bundle headroom for the new recovery state.
Verification: pnpm run build; cd desktop && go test ./...; go test -race ./internal/agent ./internal/control ./internal/sessioncatalog ./internal/workspacelease; go run ./tools/repolint; focused recovery tests.
The recovery and worktree bridge contracts add a small, reviewed amount of code to four existing baselined files. Update only their file-size and test-file-size ratchets so the repository lint gate remains exact without rewriting unrelated baseline findings.
Verification: go run ./tools/repolint; git diff --check.
Document the session version identities, recovery lifecycle, workspace concurrency boundaries, and desktop APIs introduced by the mixed parallel recovery change. Include English and Chinese documentation for the public behavior.
Problem: a recovery version whose lease handoff failed remained pending without a durable state or retry action.
Root cause: recovery failure was reported as a reason-only event and the created recovery metadata stayed indistinguishable from an active version.
Fix: mark failed recovery versions pending, include their conversation/path identity in the failure event, add RetrySessionRecovery, and expose localized retry guidance from the recovery host.
Verification: cd desktop && go test ./...; frontend tsc --noEmit; recovery host, notification, and version tests.
Problem: recovery versions could remain classified in the catalog without an explicit client-triggered convergence pass.
Root cause: recovery events refreshed the UI but did not invoke the existing idempotent catalog reconciliation and covered-copy sweep.
Fix: add ReconcileRecoveryVersions as a backend-owned API and invoke it after recovery publication when supported, while preserving divergent versions and recoverable trash semantics.
Verification: cd desktop && go test ./...; frontend tsc --noEmit; recovery host and lineage state tests.
Problem: concurrent worktree and recovery flows still exposed incomplete lifecycle contracts, while lease recovery failures were hard to act on from the desktop.
Root cause: active-version APIs, worktree identity metadata, tab version state, and pending recovery state were not wired end to end.
Fix: add stable worktree status/prepare APIs and metadata, propagate version identity through tabs and sessions, publish actionable recovery failure state, and refresh recovery coordination on active-version changes.
Verification: cd desktop && go test ./...; frontend tsc --noEmit; isolated-worktree, recovery-version, recovery-host, and recovery-notification tests.
Problem: worktree results and recovery failures did not expose stable conversation/version state to the desktop client.
Root cause: lifecycle payloads carried only physical paths or a bare failure reason, so parallel worktree ownership and pending recovery were difficult to reconcile in the UI.
Fix: expose worktree source revision/task/conversation metadata, add version state to tab and session contracts, publish structured recovery-failed state, and surface localized pending-recovery guidance.
Verification: cd desktop && go test ./...; frontend tsc --noEmit; isolated-worktree and recovery notification tests; git diff --check.
Problem: recovery lease failures were emitted only as an internal event, leaving users without a clear indication that their session version was still pending.
Root cause: the recovery failure payload contained only a reason and the frontend recovery coordinator did not surface it.
Fix: add stable conversation identifiers and pending state to recovery-failed payloads, expose active-version changes through the bridge, and show localized recovery-pending guidance while preserving the current transcript.
Verification: cd desktop && go test ./...; frontend tsc --noEmit; recovery version and host lifecycle tests; git diff --check.
Problem: recovery lineage exposed physical versions but had no stable API for querying or selecting the active version.
Root cause: version selection only persisted a preference and the frontend listened to recovery creation events, so active-version changes were not a first-class contract.
Fix: add GetSessionVersionState and SetActiveSessionVersion, reject subagent activation, emit session:active-version-changed, and refresh the frontend recovery runtime when the active version changes.
Verification: cd desktop && go test ./...; frontend tsc --noEmit; session recovery version and host lifecycle tests.
Problem: recovery transcripts shared the legacy Recovered flag and recovery events exposed only physical paths, making version identity easy to confuse with subagents during concurrent saves.
Root cause: recovery metadata had no explicit version class or conflict revision ledger, and lineage payloads did not carry that distinction to the desktop client.
Fix: add backward-compatible version kind/state and parent/revision metadata, preserve it across stable recovery rewrites, expose stable conversation/version identifiers and conflict revisions in recovery events, and keep subagent transcripts out of user-visible recovery versions.
Verification: go test ./...; (cd desktop && go test ./...); focused recovery metadata tests; git diff --check.
Problem: version activation could rebind a tab before lineage validation, retry failures were silent, recovery reconciliation could stampede, and frontend bundle limits failed at compression boundaries.
Root cause: validation, persistence, and rebinding were separate; rejected retry promises were discarded; reconciliation had no per-topic single-flight; and locale/raw bundle ratchets had no headroom for the new recovery contract.
Fix: serialize version activation, validate lineage before rebinding, surface retry errors, coalesce recovery reconciliation, and update narrowly documented locale/raw bundle budgets.
Verification: desktop go test ./...; frontend pnpm run build and check:bundle; go test -race on agent/control/sessioncatalog/workspacelease; go run ./tools/repolint; git diff --check.
Problem: recovery version activation could rebind a tab before proving the selected path belonged to the requested lineage, retry failures were not surfaced, and the new recovery UI exceeded strict frontend bundle ratchets.
Root cause: validation and tab rebinding were separate operations, retry actions discarded rejected promises, recovery reconciliation lacked per-topic coalescing, and localized recovery state increased the measured bundle at a rounding boundary.
Fix: validate recovery membership before activation, surface retry errors, coalesce recovery reconciliation, update the recovery notification contract, and add narrowly measured bundle headroom for the new recovery state.
Verification: pnpm run build; cd desktop && go test ./...; go test -race ./internal/agent ./internal/control ./internal/sessioncatalog ./internal/workspacelease; go run ./tools/repolint; focused recovery tests.
The recovery and worktree bridge contracts add a small, reviewed amount of code to four existing baselined files. Update only their file-size and test-file-size ratchets so the repository lint gate remains exact without rewriting unrelated baseline findings.
Verification: go run ./tools/repolint; git diff --check.
* fix: disable DeepSeek peak pricing on weekends
Problem: DeepSeek peak windows were applied on Saturdays and Sundays.\nRoot cause: rate-band selection checked UTC clock windows without weekday rules.\nFix: classify weekends as off-peak before evaluating weekday peak windows.\nVerification: go test ./...
* ci(desktop): allow cross-platform raw bundle rounding
Problem: desktop CI rejected a raw startup bundle whose formatted KiB value equaled the configured budget because platform output exceeded the binary threshold by rounding noise.\nRoot cause: the one-decimal budget left no cross-platform headroom.\nFix: raise the raw startup ceiling to the next bounded one-decimal step and document the platform rounding.\nVerification: pnpm install --frozen-lockfile && pnpm build
Document the session version identities, recovery lifecycle, workspace concurrency boundaries, and desktop APIs introduced by the mixed parallel recovery change. Include English and Chinese documentation for the public behavior.
Problem: a recovery version whose lease handoff failed remained pending without a durable state or retry action.
Root cause: recovery failure was reported as a reason-only event and the created recovery metadata stayed indistinguishable from an active version.
Fix: mark failed recovery versions pending, include their conversation/path identity in the failure event, add RetrySessionRecovery, and expose localized retry guidance from the recovery host.
Verification: cd desktop && go test ./...; frontend tsc --noEmit; recovery host, notification, and version tests.
Problem: recovery versions could remain classified in the catalog without an explicit client-triggered convergence pass.
Root cause: recovery events refreshed the UI but did not invoke the existing idempotent catalog reconciliation and covered-copy sweep.
Fix: add ReconcileRecoveryVersions as a backend-owned API and invoke it after recovery publication when supported, while preserving divergent versions and recoverable trash semantics.
Verification: cd desktop && go test ./...; frontend tsc --noEmit; recovery host and lineage state tests.
Problem: concurrent worktree and recovery flows still exposed incomplete lifecycle contracts, while lease recovery failures were hard to act on from the desktop.
Root cause: active-version APIs, worktree identity metadata, tab version state, and pending recovery state were not wired end to end.
Fix: add stable worktree status/prepare APIs and metadata, propagate version identity through tabs and sessions, publish actionable recovery failure state, and refresh recovery coordination on active-version changes.
Verification: cd desktop && go test ./...; frontend tsc --noEmit; isolated-worktree, recovery-version, recovery-host, and recovery-notification tests.
Problem: worktree results and recovery failures did not expose stable conversation/version state to the desktop client.
Root cause: lifecycle payloads carried only physical paths or a bare failure reason, so parallel worktree ownership and pending recovery were difficult to reconcile in the UI.
Fix: expose worktree source revision/task/conversation metadata, add version state to tab and session contracts, publish structured recovery-failed state, and surface localized pending-recovery guidance.
Verification: cd desktop && go test ./...; frontend tsc --noEmit; isolated-worktree and recovery notification tests; git diff --check.
Problem: recovery lease failures were emitted only as an internal event, leaving users without a clear indication that their session version was still pending.
Root cause: the recovery failure payload contained only a reason and the frontend recovery coordinator did not surface it.
Fix: add stable conversation identifiers and pending state to recovery-failed payloads, expose active-version changes through the bridge, and show localized recovery-pending guidance while preserving the current transcript.
Verification: cd desktop && go test ./...; frontend tsc --noEmit; recovery version and host lifecycle tests; git diff --check.
Problem: recovery lineage exposed physical versions but had no stable API for querying or selecting the active version.
Root cause: version selection only persisted a preference and the frontend listened to recovery creation events, so active-version changes were not a first-class contract.
Fix: add GetSessionVersionState and SetActiveSessionVersion, reject subagent activation, emit session:active-version-changed, and refresh the frontend recovery runtime when the active version changes.
Verification: cd desktop && go test ./...; frontend tsc --noEmit; session recovery version and host lifecycle tests.
Problem: recovery transcripts shared the legacy Recovered flag and recovery events exposed only physical paths, making version identity easy to confuse with subagents during concurrent saves.
Root cause: recovery metadata had no explicit version class or conflict revision ledger, and lineage payloads did not carry that distinction to the desktop client.
Fix: add backward-compatible version kind/state and parent/revision metadata, preserve it across stable recovery rewrites, expose stable conversation/version identifiers and conflict revisions in recovery events, and keep subagent transcripts out of user-visible recovery versions.
Verification: go test ./...; (cd desktop && go test ./...); focused recovery metadata tests; git diff --check.
Problem: Ask drafts keyed only by prompt id could leak across tabs or controller rebuilds when ids restart.\nRoot cause: sessionStorage was global to the page and outlived the pending request lifecycle.\nFix: keep drafts in an in-memory map keyed by tab/session scope plus Ask id, clear them on answer, skip completion, and stop, and add cross-scope and remount regression coverage.\nVerification: 114 Ask tests, typecheck, lint, CSS checks, repolint, and full frontend build.
Problem: the expanded Ask regression suite exceeded the repository's 800-line test-file ceiling.\nFix: remove redundant blank-line formatting while preserving all 113 assertions and behavior coverage.\nVerification: repolint clean and ask-card-layout.test.ts passes 113 tests.
Problem: Linux and macOS raw startup payloads rounded to 2486.6 KiB and exceeded the exact 2486.5 KiB binary threshold.\n\nFix: raise the raw startup ceiling to the next one-decimal step, 2486.7 KiB, with the cross-platform rounding documented.\n\nVerification: local pnpm build passes all bundle budgets.
Problem: macOS zlib output rounded to 467.1 KiB but exceeded the exact 467.1 KiB binary threshold.\n\nFix: raise the startup gzip ceiling to the next one-decimal step, 467.2 KiB, with the cross-platform measurement documented.\n\nVerification: local pnpm build passes the bundle budget.
Problem: the shared harness decision surface increased the measured deferred CSS and raw startup payload beyond the existing gates.\nFix: retain narrow explicit budget headroom for the measured 116.9 KiB deferred CSS and 2492.1 KiB raw startup path.\nVerification: full pnpm run build passes all bundle, type, lint, CSS, and chunk checks.
Problem: the 42px collapsed Todo shelf was overly tight around its title and progress.\nFix: increase the collapsed height to 48px for a clearer compact toolbar while retaining the reduced footprint.\nVerification: typecheck, lint, and CSS checks.
Problem: the session runtime fence exceeded the existing repolint and startup bundle guardrails by a small measured amount.\n\nFix: retain the compact runtime implementation, normalize changed file-size baselines only for the affected files, and add the measured 467.055 KiB gzip / 2486.4 KiB raw headroom.\n\nVerification: frontend build, TypeScript typecheck, app chrome and runtime status tests, repolint, and git diff --check passed.
Problem: the collapsed Todo shelf still occupied a tall vertical footprint after inheriting the shared harness surface.\nFix: give the collapsed Todo card an explicit 42px border-box height while preserving its header controls.\nVerification: typecheck, lint, and CSS checks.
Problem: event generation was read from the current tab at send time, so a delayed old sink could be labeled with the new session generation.\n\nRoot cause: session identity was not owned by the event sink that produced the event.\n\nFix: capture and update session generation on sink binding and use the sink-owned value for local and takeover events.\n\nVerification: go test ./... -run 'TestTabEventSink|TestWireEventTab|TestSessionClear' -count=1.
Problem: the shared harness card spacing made the collapsed Todo shelf occupy excessive vertical space.\nFix: add a compact collapsed Todo header treatment while leaving the expanded checklist layout unchanged.\nVerification: typecheck, lint, CSS checks, and diff check.
Problem: only Ask used the harness-style card frame, while approval, forms, MCP, and runtime decision popups kept separate visual treatments.\nFix: add a shared harness surface class to PromptShelf and normalize card geometry, header hierarchy, action rows, and footer spacing for every PromptShelf consumer while preserving each domain's controls and protocol.\nVerification: ask-card-layout.test.ts (109 passed), typecheck, lint, and CSS checks.
Problem: Ask options rendered at 38px while the custom answer row remained 46px, making the selected region look uneven.\nFix: match the custom row to the decision option height and use a 24px indicator/input baseline.\nVerification: ask-card-layout.test.ts (109 passed), typecheck, lint, and CSS checks.
Problem: a later legacy Ask rule changed the custom row back to a grid, placing the pencil and input on separate rows and hiding the placeholder in the browser.\nFix: make the final cascade rule preserve the harness-style inline flex row and compact input geometry.\nVerification: ask-card-layout.test.ts (109 passed), typecheck, lint, and CSS checks.
Problem: the custom answer row remained taller than harness and its pencil indicator could be clipped.\nFix: enforce border-box sizing, fixed indicator geometry, and a 24px single-line input baseline.\nVerification: ask-card-layout.test.ts (109 passed), typecheck, lint, and CSS checks.
Problem: a generation-tagged event arriving before tab metadata could be accepted without proving its session identity.\n\nFix: require current session metadata and an exact session generation match before routing tagged events.\n\nVerification: frontend runtime status regression test and TypeScript typecheck passed.
Problem: the always-visible custom answer field expanded into a tall block unlike harness's compact single-line row.\nFix: give the custom row a fixed 46px flex basis, hide overflow, and keep the input aligned to the option rhythm.\nVerification: ask-card-layout.test.ts (109 passed), typecheck, lint, and CSS checks.
Problem: an equal-sequence runtime snapshot could still mutate the reducer after a newer observation.\n\nFix: accept only strictly newer runtime status sequences within an epoch and add a regression assertion for duplicate snapshots.\n\nVerification: frontend runtime status test and TypeScript typecheck passed.
Problem: Reasonix hid the custom answer field behind an extra selection row, unlike harness.\nFix: render the custom answer input as an always-visible option-shaped row with focus and draft styling while keeping the WireAsk answer protocol unchanged.\nVerification: ask-card-layout.test.ts (109 passed), typecheck, lint, and CSS checks.
Problem: the Ask category appeared twice, once as the heading and again in the progress metadata.\nFix: keep the category as the harness-style heading and render only question progress beside it.\nVerification: live browser accessibility state now shows Reasonix 构建, question prompt, and 问题 2/2 without a repeated category.
Problem: Reasonix displayed a generic Need your decision title above the question, unlike harness's header label and question hierarchy.\nFix: use the question header as the Ask heading and keep the question prompt as the supporting meta line.\nVerification: ask-card-layout.test.ts (109 passed), typecheck, and lint.
Problem: reopening the static browser mock restored a collapsed card and question 2, unlike harness's fresh Ask presentation.\nRoot cause: presentation and draft state were keyed by a reused mock ID and collapse state was persisted with the draft.\nFix: keep collapse as transient presentation state, start each delivered Ask expanded, and give browser Ask mocks unique request IDs so stale drafts cannot leak into a new preview.\nVerification: ask-card-layout.test.ts (109 passed), typecheck, lint, CSS checks.
Problem: the harness-style footer still invoked the old skip-and-chat dismissal action.\nRoot cause: the secondary action remained wired to onDismiss instead of advancing the question draft.\nFix: add localized Skip this question labels, clear the current answer, advance to the next question, and submit an empty answer when skipping the final question.\nVerification: ask-card-layout.test.ts (109 passed), typecheck, lint, CSS checks.
Problem: the Ask collapse button changed its label but the option list and footer remained visible.\nRoot cause: decision-surface display rules with !important overrode the generic collapsed shelf selector, and the footer lives outside the content wrapper.\nFix: add Ask-specific collapsed overrides for the option list and footer, with regression assertions for both hidden regions.\nVerification: ask-card-layout.test.ts (111 passed), typecheck, lint, CSS checks.
Problem: the Reasonix Ask surface did not match the harness question composer layout.\nRoot cause: PromptShelf used a compact decision-shelf presentation with inline actions and no harness-style pager footer.\nFix: retain the Reasonix WireAsk/controller protocol while porting the harness visual structure: icon header controls, compact option rows, bottom pager, skip and submit actions, responsive footer, and existing draft/back behavior.\nVerification: ask-card-layout.test.ts (109 passed), typecheck, lint, CSS checks, and live /mock-ask browser inspection.
Problem: a failed transcript hydrate could still satisfy the creation empty-state predicate and show the welcome hero.\n\nFix: treat hydrateError as non-empty-state evidence so the retry banner remains the only recovery surface.\n\nVerification: app chrome contract test passed.
Problem: Reasonix required an explicit confirmation after every single-select choice, unlike harness.\nRoot cause: AskCard treated single-select clicks as selection-only actions.\nFix: advance immediately after a single-select choice while retaining the draft and Back action for revising prior questions; keep multi-select, custom answers, and final submission explicit.\nVerification: ask-card-layout.test.ts (109 passed), typecheck, lint, and diff check.
Extend session-generation routing to takeover mirror notices so stale handoff events cannot cross a session rebind.\n\nVerification: go test ./... -run TestWireEventTab -count=1; frontend typecheck and runtime tests.
Problem: late events from a previous session binding could still reach the current tab when the runtime epoch was reused.\n\nRoot cause: wire events carried controller epoch but not the tab's session generation.\n\nFix: include session generation in local desktop event envelopes and reject events that do not match the current session metadata.\n\nVerification: frontend typecheck and runtime status tests; desktop wire and sink tests.
Problem: remounting a pending Ask lost unfinished selections, navigation, and collapse state.\nRoot cause: AskCard kept all draft state in component memory.\nFix: persist the bounded Ask draft in sessionStorage per request ID and clear it after successful answer or dismissal; add restoration coverage and ratchet the measured startup budgets for the added contract.\nVerification: ask-card-layout.test.ts (107 passed), typecheck, lint, and bundle budget checks.
* fix: preserve custom Ask drafts across option changes
Problem: switching from a custom Ask answer to a suggested option discarded the typed draft and made it impossible to restore.\n\nRoot cause: option selection cleared custom text, while submission inferred the active answer type from whether custom text was non-empty.\n\nFix: retain per-question custom drafts and track whether the active answer source is an option or custom text.\n\nVerification: pnpm typecheck; npx tsx src/__tests__/ask-card-layout.test.ts
* fix: respect active Ask answer mode in summaries
Preserved custom drafts must not remain authoritative after the user switches back to a suggested option. Use the per-question answer mode for summaries, validation, and submission decisions.\n\nVerification: npx tsx src/__tests__/ask-card-layout.test.ts; pnpm typecheck
* chore: retrigger required PR checks
Problem: an older idle status snapshot could hide a newer running turn in the desktop UI.\n\nRoot cause: runtime status observations were not ordered by controller epoch and turn event sequence at the reducer boundary.\n\nFix: carry runtimeEpoch and turnEventSeq through backend status actions, reject older snapshots within an epoch, and reset ordering on controller rebuilds.\n\nVerification: pnpm exec tsx src/__tests__/use-controller-stream-progress.test.ts; pnpm exec tsx src/__tests__/running-tab-history-hydration.test.tsx; pnpm exec tsx src/__tests__/turn-timing-race.test.ts; pnpm exec tsc --noEmit
Problem: pending ask panels consume the conversation viewport and interactive controls could trigger a collapsible shelf unintentionally.\nRoot cause: AskCard did not use PromptShelf's collapse contract, and PromptShelf treated every card click as a toggle.\nFix: expose Ask collapse and expand controls while keeping title, progress, and stop actions visible; ignore interactive descendants when toggling collapsible shelves; add regression coverage.\nVerification: pnpm exec tsx src/__tests__/ask-card-layout.test.ts; pnpm run typecheck; pnpm run lint:hooks; pnpm run check:css. The frontend build reaches the existing bundle budget gate, which reports 467.0 KiB against a 467.0 KiB budget.
Problem: switching projects leaves duplicate external opener controls in the topic bar.\n\nRoot cause: sibling components used the same tab ID as their React key, so reconciliation retained stale instances.\n\nFix: namespace the ExternalOpener and TopicbarSessionActions keys separately and add source-level regression assertions.\n\nVerification: git diff --check; focused runtime reproduction showed one opener per project with distinct keys.
Prepare the reviewed bilingual v1.38.0 catalog from the merged product range. Document independent search, protocol recovery, desktop management and link menus, update relaunch, model image controls, and restored session actions.
Include the DeepSeek configuration upgrade and explicit recovery/downgrade limitations. Cite integrated contributor work through its merged PR.
Verification: Catalog validation, release-note tests, required Notes PR checks, rendered bilingual content review, and publication privacy scan passed. This Notes commit follows the release-test corrections and defines the candidate for exact-SHA main-v2 CI.
Problem: Release qualification failed on Windows cache permissions and host-augmented argument-recovery transcript assertions.
Root cause: Unix mode bits were assumed on Windows, and raw execution output was conflated with transcript guidance. A timing-based regression fixture also depended on Windows clock resolution.
Fix: Keep Unix permission checks on Unix, verify raw ToolResult output independently from persisted host guidance, and trigger the existing budget round threshold at a synchronous stream boundary.
Verification: Required Linux, macOS, Windows, race, and lint CI passed at 23ba08b256. Coverage passed; focused regression repeated 30 times and 10 times under race. Production code and budgets are unchanged.
Review the generated catalog against the merged product range. Cite the integrated rich-link PR rather than its unmerged source PR, describe recovery through user-facing entrypoints, and document the DeepSeek default upgrade plus recovery and downgrade limitations.
Verification: release catalog validation; release-notes test suite; rendered bilingual notes; privacy scan.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Decouple web search from the primary model protocol and restore untouched DeepSeek presets to Chat Completions. Preserve protocol-specific reasoning replay, bounded recovery accounting, durable tool-write evidence, explicit context recovery and source-availability reporting. Keep the Kimi prompt candidate out of production after the recorded live comparison.
CI follow-ups defer derived tool indexes while retaining canonical receipt durability, start topic mutation deadlines after store preparation, coalesce multi-root workspace lock domains and make admission tests report early failures. Bundle ceilings reflect measured payload changes on the integrated main-v2 base. Existing CodeQL context-key false positives were individually audited; scanning remains enabled.
Validation includes root and Desktop suites, deterministic recovery and cancellation tests, workspace-lease/finalize race repetitions, frontend type checks and 267 frontend suites. Native platform verification and required CI checks were completed on the merged PR head.
Refs #9808. Custom endpoint coverage remains bounded by the documented protocol and live-test evidence; this merge does not close the issue or publish a release.
Add context menus for Markdown web, GitHub and mail links, adopting #9823.
Fix recipient address copying and keyboard focus/navigation in shared menus.
Retain the original contributor's feature and coverage, supplemented with
mail parsing and keyboard regression tests and actual browser verification.
Co-authored-by: wqshan-cn <[email protected]>
Unify Settings, Trash, and Automation as full-window management pages while retaining workspace state and automation drafts. Preserve current updater and image-capability behavior, fix shared titlebar dispatch, and tighten provider endpoint assertions.
Resolve latest main-v2 integration conflicts and the queued-paste fixture cleanup race. All 26 latest-head checks pass, including CodeQL, coverage, three-platform tests, and desktop native regressions. Both CodeQL review threads are resolved.
Problem: the coverage job intermittently failed while removing the queued-paste test's temporary session directory.
Root cause: TurnDone reached the test before the controller's completion tail attempted another durable-inbox dispatch, allowing disk access to overlap fixture cleanup.
Fix: close the single-turn controller inside the TurnDone sink before publishing completion. Keep the real persistent inbox and every queue/input assertion, remove the redundant runner polling, and extract the case from the oversized TUI test file.
Verification: the regression passes 100 repetitions with race detection and coverage; the complete CLI package coverage test and repolint pass. No production lifecycle or persistence semantics change.
Problem: the newly merged updater and stable-relaunch work conflicts with the management-page initial bundle budget.
Root cause: both branches calibrated the same initial bundle against different feature sets.
Fix: preserve the upstream updater, instance identity, and tray changes, then measure both builds with the same toolchain. Set the integrated gzip ceiling to 465.5 KiB for 465.435 KiB measured; retain the upstream 2481.7 KiB raw ceiling for 2480.9 KiB measured. Update both management-page guides.
Verification: production compilation and all bundle gates, updater frontend assertions, root agent/control/install-layout regressions, and repolint pass. The shared management titlebar selector remains intact.
Read the effective endpoint from the URL input's associated help element and compare its full value. This tightens legacy endpoint regressions and removes the two CodeQL substring URL findings.
Problem: the management page redesign conflicted with the merged automation isolation and model image capability changes. Its renamed shared titlebar also missed the native double-click handler.
Root cause: parallel page projections and provider editor implementations owned the same behavior. Fix: retain one management navigation/shell, preserve warm terminal state while pausing fitting, reuse image policy controls and discovery identity guards, isolate unsaved credential catalogs from persistent caches, and dispatch titlebar double-click through the shared chrome class.
Verification: 264 frontend suites passed across the full run and resumed tail; transcript, terminal, remote tree, typecheck, production build, repolint, Desktop Go, config/boot/provider tests, and focused race tests passed. Isolated macOS double-click maximization and restore passed. Same-toolchain initial gzip is 465.3 KiB versus 464.6 KiB on main-v2; raw initial size falls from 2481.1 to 2480.3 KiB. Narrow size ratchets cover additive API fields and shared navigation; probe code is extracted from existing oversized files.
Replace separate settings, trash, and automation surfaces with shared management navigation while preserving the mounted workspace and its reading state. Keep automation drafts in memory across navigation, reconcile concurrent configuration edits, and report trash mutation outcomes explicitly.
Add provider model editing, discovery, and bounded connection probes without persisting draft credentials. Preserve existing provider overrides and document desktop navigation and platform verification boundaries in English and Chinese.
Verification: frontend production build, test typecheck, all 262 frontend suites, transcript regression suite, and focused config tests passed. Native Windows interaction and DPI acceptance remain pending; latest main-v2 integration requires review before merge.
Problem: a trusted signed tray could not be resolved by its instance GUID
in Explorer during native Windows 11 acceptance.
Root cause: the vendored NOTIFYICONDATAW layout represented the
uTimeout/uVersion union as two UINT fields, shifting guidItem and the
trailing balloon icon handle away from their native offsets.
Fix: use one union slot and add an architecture-aware ABI regression test
for the structure size and GUID/balloon offsets. All tray operations now
share the corrected native layout.
Verification: native Windows ARM64 systray ABI, GUID registration,
fallback/no-delete tests and real signed Explorer GUID lookups passed;
Windows AMD64 cross-compilation and repository lint passed.
Problem: the Automation surface update on main-v2 conflicts with the
updater refresh branch's measured bundle ceilings.
Root cause: both changes intentionally contribute to the initial shell.
Fix: preserve both features and set the next measured decimal ceilings
at 464.8 KiB gzip and 2481.7 KiB raw, retaining all independent limits.
Verification: production build, bundle checks, updater 52 assertions,
Automation surface 20 assertions, workspace layout and topicbar contracts.
Problem: The vendored systray module is outside the desktop ./... test sweep.
Root cause: Go does not recursively run dependency package tests.
Fix: Add an explicit Windows CI step for the pinned systray package's GUID,
non-destructive fallback, and retained Explorer re-add identity regression.
Verification: The exact package cross-compiles for Windows ARM64 and its
native Windows tests pass; diff checks pass.
Problem: An update could terminate unrelated data-home instances, while a
single global tray GUID collided across instances and broke unsigned moves.
Root cause: Process cleanup used installation paths instead of the existing
single-instance identity, and tray identity assumed every normal build was
Authenticode-signed.
Fix: Share the existing canonical path and data-home identity, freeze the
helper environment, and inspect only the matching Wails endpoint. Remove
forced termination entirely. Preserve blocked instances, show native recovery
instructions, and confirm the target executable owns the endpoint after
restart. Derive per-home UUIDv5 tray identities only after offline signature
verification, with a non-destructive window/ID fallback on registration failure.
Verification: Desktop tests, focused race tests, canonical-path and updater
regressions, frontend typecheck, lint/repolint, vet, and Windows ARM64/AMD64
cross-compilation pass. Native Win11 helper/endpoint and tray fallback suites
pass, including independent processes and unsigned tray relocation. Signed
fixture acceptance remains pending temporary VM certificate trust approval.
Problem:
Automation reused the chat pane while chat-owned workspace, terminal,
status, and window controls could remain interactive and overlap its editor.
Root cause:
Layout visibility was derived independently from persisted workspace and
terminal state instead of from the active main surface.
Fix:
Project chat-owned chrome through mainView, keep stored layout and terminal
sessions intact, add a collapsed-sidebar safe area, and make the shared
automation editor responsive below 560px. Hide Windows caption controls
during automation and retain the existing Workbench entry.
Verification:
- frontend test discovery (255 suites)
- pnpm build
- Wails macOS arm64 build and native interaction check
- browser DOM, click-target, state round-trip, and responsive checks
Problem: PR #9809 conflicts with the latest model capability changes in
the frontend bundle budget.
Root cause: Both changes measured and ratcheted the same startup asset
budgets from the prior base.
Fix: Preserve both implementations and resolve only the budget ledger.
The base frontend measures 464.368 KiB gzip / 2479.742 KiB raw, and the
merged frontend measures 464.655 KiB gzip / 2480.267 KiB raw. Set the
smallest one-decimal ceilings, 464.7 / 2480.3 KiB.
Verification: Desktop go test ./..., focused desktop race tests, Windows
ARM64 helper test cross-compilation, installlayout/repair race tests,
52 updater assertions, provider image/model/settings frontend tests,
frontend build checks and bundle budgets, repolint, and diff checks pass.
Use the strict cross-platform atomic write helper for the model capability cache. Route background model refresh through metadata catalogs with the complete provider routing identity so NoProxy discoveries repopulate the v2 cache.
Problem:
ID-only model catalogs were treated as text-only, so custom relays could not opt a supported model into native image input.
Root cause:
Discovery collapsed unknown metadata into a negative result, and settings, cache, catalog, and runtime consumers did not share one override-aware capability decision.
Fix:
Preserve tri-state discovery in an isolated v2 cache, apply per-model vision overrides behind protocol limits, freeze capability per Controller generation, and expose one accessible Auto/On/Off model control in both settings flows.
Verification:
- go test ./...
- go test -race on capability, provider, control, and Desktop paths
- Desktop Go module full tests
- frontend test:all and production build
- browser interaction and responsive layout checks
Resolve the shared frontend bundle ratchet against the topic-bar changes. The merged production build, updater tests, typechecks, focused desktop tests, Windows helper cross-compile, and make lint pass.
Problem: versioned Windows updates could relaunch a retained desktop before it
had exited, tray visibility was lost when the executable path changed, and the
update banner kept a startup-only release snapshot.
Root cause: relaunch validation rejected valid current-process fallback, stale
process validation and termination used separate PID opens without waiting for
exit, systray registered no stable GUID, and the updater exposed only a
superseding manual check.
Fix: allow active/flat desktop fallback while retaining the old-version guard;
validate, terminate, and wait on one Windows process handle; stop relaunch on
unconfirmed exit; vendor the pinned systray source with NIF_GUID support for
signed builds; and add busy-safe hourly and foreground update refreshes.
Verification: installlayout and repair tests pass with race detection; the
desktop module passes all tests; Windows desktop/helper test binaries compile;
frontend updater tests, typechecks, lint, build budgets, make lint, and
repolint pass.
Problem:
The first PR head exceeded the repository line budgets by one App.tsx line and nineteen app-chrome-tabs.test.ts lines.
Root cause:
The macOS dock assertions were added to an already oversized general chrome contract, and the new session-actions mount consumed an avoidable JSX line.
Fix:
Keep the App integration line-neutral and move the three macOS dock assertions into the existing workspace layout contract without reducing coverage or updating the repolint baseline.
Verification:
- go run ./tools/repolint
- pnpm build
- app-chrome-tabs.test.ts (129 passed)
- workspace-layout.test.ts (58 passed)
Problem:
Session operations were hidden behind an overflow menu, adding an extra click for common actions. The macOS workspace tabs also sat on a separate visual row from the fixed workspace toggle.
Root cause:
The topic bar treated all session operations as one overflow surface, while the workbench dock did not reserve the fixed toggle's hit area when sharing the macOS title row.
Fix:
Replace the overflow surface with direct copy, export, terminal, and summary actions, keeping only export formats lazy and menu-based. Remove the redundant Changes shortcut. On macOS, divide the remaining dock title row among all four tabs while reserving the fixed toggle area; retain the existing Windows and Linux layouts.
Verification:
- pnpm build
- 249 focused frontend contract tests
- Browser DOM and click verification for macOS and Windows mock layouts
Problem: After a Windows versioned-layout update, current.json and the
launcher already named the new version, but auto-restart could still
launch the retained versions/<old>/reasonix-desktop.exe. About then
showed the previous version, as if the update had rolled back.
Root cause: Previous version trees are retained by design. Helper
relaunch and desktop fallback could still start that old desktop
binary. Wails single-instance identity is the Reasonix home, so a
stale process keeps the UI and the new process hands off to it.
Fix: Own the relaunch target in installlayout. After activation, the
Windows update-helper terminates superseded versioned desktops and
restarts only the install-root launcher (or the active desktop). A
superseded desktop binary relaunches through that same entry before
taking the single-instance lock, and never falls back to itself.
Verification: go test ./internal/installlayout/; focused desktop
relaunch tests; GOOS=windows compile of update-helper tests; go vet;
make lint / repolint.
Fixes#8458
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Problem: the compatibility wiring and migrated catalog fixture increased two baselined oversized files, so repository lint rejected the PR.
Fix: express the same typed data flow without increasing either file line count and replace the retired fixture method instead of retaining both APIs.
Verification: repolint, ESLint, TypeScript typecheck, provider editor tests, and the 91-case settings snapshot suite pass.
Problem: the Ubuntu suite could remove its temporary session directory while the controller autosave goroutine was still finishing.
Root cause: the reconciliation test observed TurnDone but did not close the controller and wait for its asynchronous persistence lifecycle.
Fix: register teardown before submitting the turn, close the controller, and wait for autosave completion.
Verification: the focused test passes 100 consecutive runs; full Go and race suites pass.
Problem: the credential-gated DeepSeek recovery probe expected long-lived fallback events that the current compatible-empty reasoning contract intentionally removed.
Root cause: the live assertions were not updated with the missing-reasoning replay change.
Fix: require one byte-identical retry when the provider permits it, allow provider-dependent recovery, and reject any long-lived fallback event.
Verification: the focused live test passes against the official DeepSeek API for transient and persistent stripped-reasoning scenarios.
Problem: model-level capability rendering dropped the provider-level unsupported signal from older Wails payloads, and related editor tests still exercised the retired checkbox contract.
Root cause: the shared capability resolver and both picker call sites only received model metadata and the legacy vision-model list.
Fix: preserve model metadata precedence, then honor explicit legacy lists and provider-level unsupported capability as a read-only fallback. Update editor and refresh fixtures to the metadata contract.
Verification: frontend test:all, focused provider/settings tests, TypeScript typecheck, production build, and bundle budgets pass.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Problem
The planner simplification left an unused session-context helper and a desktop cancellation test using the removed tool-less planner path.
Root cause
The test migration covered internal planner callers but missed the desktop history fixture, while the deleted test was the last caller of the legacy helper.
Fix
Remove the unreachable helper and construct the desktop planner test with the structured planner registry so cancellation still exercises planner startup before executor handoff.
Verification
go test -count=1 ./internal/agent
go test -count=1 ./internal/agent/... ./internal/control/... ./internal/config/... ./internal/boot/...
cd desktop && go test -count=1 -run '^TestHistoryForTabRestoresPlannerDisplayWhenCancelledBeforeExecutorStarts$' -v .
cd desktop && go test -count=1 ./...
golangci-lint run --timeout=5m ./internal/...
Problem:
- The desktop settings still offered the legacy Classic layout even though new users default to Workbench.
Root cause:
- Classic remained in the visible selector, and current-version user configs had no retirement migration.
Fix:
- Limit the selector to Workbench and Creation.
- Migrate persisted Classic preferences to Workbench at startup while retaining legacy read compatibility.
- Update defaults and add idempotent compatibility coverage.
Verification:
- go test ./...
- go test -race ./internal/config
- go test ./... in desktop
- frontend contract test, typecheck, ESLint, and browser interaction
Problem
Ordinary turns still paid for implicit planner fallback, synthetic
continuation, chunked compaction, and reviewer/evaluator model chains.
Root cause
Quality-recovery helpers were wired as the default runtime path instead of
opt-in modules around a Harness-style loop.
Fix
Planner is constructed only when planner_model is set, and only explicit
plan/approval routes call it. submit_plan is the only delivery channel;
planner failures fail closed instead of degrading to the executor.
Ordinary agents default to ContinuationDisabled. Goal, review, and
guardian opt into ContinuationExplicitFlow.
Pressure/overflow compaction uses one summary plus one retry. Chunked
tree-reduce stays behind AllowChunkedFallback for /compact and tests.
guardian_model and recovery_model are explicit; missing refs fail closed.
Goal evaluator is no longer implied by the main model.
Verification
go test -count=1 ./internal/agent/... ./internal/control/... ./internal/config/... ./internal/boot/...
go test -race ./internal/agent/... ./internal/provider/...
go vet ./...
go run ./tools/repolint
Problem: the unified OpenCode Go catalog copied compatibility limits with a manual map loop that golangci-lint rejects.\n\nRoot cause: the repository modernize rule requires maps.Copy for whole-map copies.\n\nFix: use maps.Copy before overlaying Pi catalog limits.\n\nVerification: go test ./internal/provider ./internal/config ./internal/boot ./internal/control; go test -race ./internal/provider ./internal/config ./internal/control; go vet ./...; go run ./tools/repolint.
Derive OpenCode Go route model lists and limits from the pinned Pi catalog while retaining verified compatibility entries for models still served by the endpoint. Use the same merged catalog for filtering, presets, and vision metadata so upstream additions cannot be silently dropped.
* fix(provider): replay DeepSeek thinking blocks for all assistant turns
Problem: DeepSeek's Anthropic-compatible endpoint (api.deepseek.com/anthropic)
answers HTTP 400 "The `content[].thinking` in the thinking mode must be
passed back to the API" whenever a tools-carrying request's history contains
an assistant turn whose thinking block was not passed back — including plain
question-answer turns with no tool call. Reasonix only replayed reasoning for
turns with tool activity, so any pure Q&A turn followed by a tool turn 400'd
(#9750).
Root cause: replayReasoningBlock gated DeepSeek replay on tool/search
activity, contradicting the official thinking-mode contract documented at
api-docs.deepseek.com/guides/thinking_mode.
Fix: drop the activity condition from the DeepSeek replay branch and widen
RequiresAssistantReasoningReplay so an assistant turn carrying provider
reasoning is replay-required with or without tool activity. Turns without
stored reasoning still stay out of projection, so healthy histories keep
their zero-copy backing and the projection cut surface does not grow.
Serialization already emits the thinking block before the text block; the
agent-side watchdog needed no change because the widened policy only adds
turns that carry reasoning, which can never trigger the missing-reasoning
branch.
Cache-impact: medium — thinking blocks for stored reasoning now join the
provider-visible history (API hard requirement); once replayed they are
byte-stable across turns, and healthy-history projection remains zero-copy.
Verification: go build ./...; go test ./internal/provider/...
./internal/agent/... (updated two assertions that pinned the old
activity-gated behavior: text-turn reasoning is now replayed, including
under a since-disabled thinking toggle, matching the existing tool-turn
rule).
* fix(provider): keep thinking first when assistant messages merge
Problem: after ProjectReplaySafeMessages degrades a reasoning-less DeepSeek
assistant turn to plain text, it can become adjacent to the next healthy
assistant turn (its tool results were dropped). buildRequest coalesces
same-role messages, and appending the healthy turn's blocks produced
[text, thinking, ...], which DeepSeek's thinking mode rejects with HTTP 400
because the thinking block must lead the message.
Root cause: appendBlocks merged by plain tail-append, ignoring the
thinking-block-first invariant.
Fix: when the appended blocks open with a thinking run and the merge target
already has content, insert the thinking run at the front of the target's
content and append the rest, yielding [thinking, text, ...].
Cache-impact: low — block order inside one merged assistant message changes
only for histories that already required projection; healthy histories never
take the reorder branch.
Verification: go build ./...; go test ./internal/provider/... with a new
regression test building the A1(text+tools, reasoning lost)/T1/A2(reasoning
+tools) history and asserting the merged wire message stays thinking-first.
* fix(agent): repair stale thinking history after a provider 400
Problem: DeepSeek's Anthropic endpoint rejects a tools-carrying request whose
history contains assistant turns without their thinking blocks (HTTP 400
"content[].thinking ... must be passed back"). Sessions whose canonical
history already lost reasoning (crashes, older builds, imported transcripts)
hit this on every round, and the 400 was treated as a terminal error, so the
turn died and the bad history re-triggered the failure on each retry (#9750).
Root cause: no recovery path existed between the context-limit repair and the
generic terminal error handling, and no projection could strip reasoning the
provider considers stale.
Fix: catch-and-repair, once per model round, following the vendor-documented
strip-all recipe. ParseReasoningReplayError matches only an HTTP 400 whose body
names content[].thinking or reasoning_content AND the pass-back obligation, so
unrelated 400s and other statuses are never swallowed. On a match the agent
rebuilds the frozen request's Messages through the new strong projection
(ProjectReasoningStrippedMessages strips every assistant message's reasoning
metadata and drops the tool activity that can no longer pair with its thinking)
— every other frozen field stays byte-identical — and retries once. Canonical
session history is never modified. After the retry succeeds, a session-scoped
flag keeps the strong projection for all later rounds so the conversation does
not pay another 400 per round; a warning notice (new NoticeCode, localized in
en/zh/zh-TW) and two content-free ProtocolRecoveryAudit kinds make the repair
visible and auditable. If the repaired retry still 400s, the turn terminates
with the original error shape.
Cache-impact: medium — only for repaired sessions: the strong projection drops
thinking blocks from the provider-visible history, invalidating the previous
prefix once; afterwards the stripped projection is deterministic and stable.
Healthy sessions are untouched (zero-copy projection preserved).
Verification: go build ./...; go test ./internal/provider/...
./internal/agent/...; go test -race ./internal/agent/ -run
'Replay|Reasoning|Retry' -count=1; plus a table-driven matcher suite, mock-level
recovery/exhaustion/non-match tests, and an end-to-end test driving the real
Anthropic adapter against an httptest server that 400s once.
* refactor(agent): satisfy repolint ratchet and golangci for the 400 repair
Zero behavior change: lint-gate compliance for the thinking-replay repair
branch. The branch's additions pushed four files past their repolint budgets
and introduced two golangci findings; everything here is code motion or
mechanical rewrites, no logic edits.
repolint:
- run_loop.go file-size/function-size: deferredStreamSink and its methods move
verbatim to the new stream_sink.go; the thinking-400 branch collapses into
tryRecoverReasoningReplay400 in reasoning_replay_recovery.go (Discard,
attempt audit, and budget handling live there now); the overflow and
suppressed-retry tails of streamWithSamplingRecovery move verbatim into
finishReasoningReplayOverflow / suppressMissingReasoningRetry in
reasoning_replay.go.
- sessionstate.go essay: the reasoningReplayStrongProjection field comment
drops to three lines.
- anthropic.go file-size: the thinking-first merge logic moves to
missing_reasoning_fallback.go as mergeThinkingFirst + leadingThinkingBlocks,
leaving appendBlocks a one-line call.
- anthropic_test.go test-file-size: TestBuildRequestDeepSeekReplaysReasoning-
FromHistory moves unchanged to replay_projection_test.go, the file that owns
replay/projection semantics.
golangci-lint:
- errorlint in reasoning_replay_error_test.go: assert the Unwrap contract via
errors.Is instead of comparing errors.Unwrap results.
- modernize in retry_e2e_test.go: accumulate the streamed answer with a
strings.Builder.
Verification: go run ./tools/repolint (clean); golangci-lint run
--timeout=5m ./internal/... (0 issues); go build ./...; go test -count=1
./internal/provider/... ./internal/agent/...; go test -race
./internal/agent/ -run 'Replay|Reasoning|Retry' -count=1.
* fix(completioneval): disable thinking on the bounded verdict request
Problem: the completion validator follows the working agent's provider and
model, and the desktop default is the DeepSeek Anthropic endpoint with
thinking enabled. The validator's budget is 30s / max_tokens=256 / temp 0, so
in thinking mode reasoning tokens routinely eat the whole completion budget:
the stream ends with empty text, parseVerdict fails with ErrInvalidOutput,
enforce mode maps that to CompletionUncertainError, and the run stops after
the answer was already delivered (#9750's "agent stops mid-work" symptom on
ordinary chat turns, in every permission mode).
Root cause: the per-request escape hatch existed but was never wired.
boundedllm.Config.EffortOverride already lands on provider.Request, yet
completioneval.Session never set it; the anthropic adapter ignored
Request.EffortOverride entirely (applyDeepSeekThinking only consulted
client-level thinking/effort); and the openai adapter's depthOnly vocabulary
stripped "disabled" by design, because a per-request toggle must never silence
the main loop's thinking — its history replay contract depends on it. The
validator is a stateless two-message call with no history, so that protection
does not apply to it. Telemetry then lumped the empty-output signature into
the generic invalid_output class, hiding the failure mode.
Fix: Session.Evaluate now sends EffortOverride="disabled" (new exported
completioneval.EffortDisabled). The anthropic adapter's applyDeepSeekThinking
honors a per-request override: "disabled" takes the same thinking.type=disabled
path as recoveryWithoutThinking for that request only, a vocabulary depth
(low/medium/xhigh/high/max, normalized) replaces the configured effort in
output_config, unknown values fall back to the client config, and recovery
mode keeps priority (overrides are skipped). The openai adapter gains
deepSeekRequestThinking: on the DeepSeek Chat endpoint an explicit per-request
"disabled" emits thinking.type=disabled and drops reasoning_effort, exactly
like client-level disabled; minimax/zhipu/longcat/generic branches are
unchanged (the binary-knob invariant stands outside DeepSeek, and the
buildRequest ratchet budget is at its ceiling). Client-level configuration is
never mutated by either adapter. Budgets stay at 256 tokens / 30s — with
thinking off, that comfortably fits the verdict JSON. For observability,
completioneval.ErrEmptyOutput (wrapping ErrInvalidOutput, so existing
errors.Is classifiers keep matching) marks the empty-response case, and
validatorErrorClass buckets it as the new "empty_output" class, added to the
telemetry sink and desktop metrics enums and the event doc. Tests: evaluator
request shape asserts the override; new anthropic effort_override_test.go
covers disabled/depth/normalization/fallback/client-immutability/recovery
precedence; openai tests updated for the new deepseek semantics plus inert
non-DeepSeek endpoints; agent table gains the empty_output case; the boot
effect test now asserts the override reaches the provider boundary through the
real Build assembly; the live matrix (live tag, not run here) now runs every
model with thinking disabled AND enabled — the production preset — so the
override is verified against the wire shape that actually failed.
Cache-impact: low — the validator request is a separate two-message call that
never shares the main conversation prefix; main-loop request bytes are
unchanged (TestEffectMainRequestStableAcrossValidatorModes). One deliberate
side effect: the governor experiment's per-request "low" now reaches the
DeepSeek Anthropic wire when REASONIX_EXPERIMENT_GOVERNOR=1, which is what
that override was always meant to do; thinking/output_config sit outside the
cached prefix.
Verification: go build ./...; go test -count=1 ./internal/completioneval/...
./internal/boundedllm/... ./internal/provider/... ./internal/agent/... (plus
./internal/boot/... and ./internal/telemetry/...); go vet (also with -tags
live for the matrix); gofmt clean; repolint and golangci-lint report only the
violations already present at the stacked PR-1 HEAD. Desktop module: go build
./... and metrics tests pass. Live matrix not run (needs DEEPSEEK_API_KEY).
* fix(agent): stream fallback turns live instead of buffering for reasoning
Problem: after the missing-reasoning circuit opens the disabled-thinking
fallback, every later turn in that session still went through the
reasoning-aware stream sink. The fallback never emits a reasoning event, so
the buffer could only release at commit time: long conversations degraded
into a permanent pseudo non-streaming mode where the answer appeared all at
once at the end of each model round (#9750).
Root cause: samplingAttemptSinks only distinguished replay-sensitive
providers from insensitive ones. A session in the provider-declared
disabled-thinking fallback is a third case: thinking is off by design, so no
reasoning event will ever arrive to unlock the buffer, and the request needs
no reasoning to replay safely (the adapter skips the replay-safe projection
in this mode), so the buffer protects nothing.
Fix: samplingAttemptSinks returns the direct pass-through sink while
sess.missingReasoning.fallbackActive holds for a provider that declared
SupportsMissingReasoningFallback, the same predicate the history projection
and the replay-issue classifier already use. Every other mode is unchanged.
Tests: stream_sink_test.go covers deferredStreamSink directly for the first
time (buffer/unlock/discard/defer-all/nil) plus the pass-through decision
table; a new wire-level e2e against the real Anthropic adapter holds the
fallback session's final answer open mid-stream and fails on a 2s timeout
if text reaches the UI only after the response completes (verified: the
test fails against the pre-fix sink and passes with it).
Cache-impact: none - fallback-mode requests were already sent with
thinking.type=disabled; only local event delivery timing changes, and the
existing fallback wire tests assert provider-visible bytes stay identical.
Documentation-impact: none - no user-facing docs describe stream buffering.
* fix(agent): recover thinking mid-session and surface fallback transitions
Problem: once the missing-reasoning circuit opened the disabled-thinking
fallback, the session could never leave it (#9750's long-conversation
symptom): the persisted half-open probe was only consulted at Run start, so
a long-lived conversation kept thinking off until the user abandoned the
session. The first backoff tier also parked a healthy-again provider for ten
minutes, and none of it was ever visible to the user.
Root cause: beginMissingReasoningRecovery early-returns whenever the session
already holds fallbackActive, so a due probe lease was never claimed inside
an active conversation; activateMissingReasoningFallback and probe
resolution recorded their state transitions silently, with no Notice on
either boundary.
Fix:
- missingReasoningFallbackBackoffs now starts at 2m and converges
2m/10m/1h/6h/24h (was 10m/30m/2h/6h/24h). The state-file format is
unchanged; older incidents re-enter through the existing normalization.
- runToolLoop calls refreshMissingReasoningProbe at the top of every model
round. While the circuit's quiet period runs, claimRecoveryModeAt answers
fallback and nothing changes; once due, the session claims the durable
half-open lease and clears fallbackActive for the probe. That single flag
is the switch every consumer already reads: the request loses its
disabled-thinking marker, the stream sink regains its reasoning-aware
buffer (the pass-through only fires while fallbackActive holds), and the
replay watcher re-arms, so the probe resolves after three healthy rounds
or escalates the backoff on one failure through the existing
resolveProbeAt/failProbeAt paths. No new state fields, no file contract
change, no per-session circuit isolation.
- activateMissingReasoningFallback and the probe-resolution path emit
user-visible notices (new NoticeCodeMissingReasoningFallback and
NoticeCodeMissingReasoningRecovered; i18n catalogs in en/zh/zh-TW). The
activation notice names the actual current backoff tier as the retry ETA,
read back from the persisted NextProbeAt by the new nextProbeDelayAt
helper; without a shared state directory it says thinking stays off for
the rest of the conversation instead of promising a probe that cannot run.
Tests: the warn-state suite gains an explicit ladder-shape assertion (the
existing backoff cases reference the ladder symbolically and pass
unchanged); reasoning_replay_recovery_test.go gains three in-session probe
e2es: a due probe recovers without a new Run (thinking restored on every
request, circuit closed, recovery notice), a circuit inside its quiet period
keeps the session in fallback without touching the state file, and a failed
in-session probe escalates to level 2 with the escalated tier named in the
notice. The fallback-activation e2e now also asserts the 2m notice. Both
probe e2es fail when the round-top refresh is removed.
Cache-impact: none - probe rounds reuse the existing claimRecoveryModeAt
request shape; fallback and normal request bytes are unchanged, only which
mode applies moves earlier within a session.
Documentation-impact: none - the fallback behavior is self-describing via
the new notices and no docs page documents the backoff ladder.
* chore(i18n): move internal/agent user-visible host notices into the catalog
Problem: issue #9750 reports chat output readily degrades into a
Chinese-English mix for zh users. The host's user-visible notices in
internal/agent (loop guard, empty-final retry, executor handoff,
tool/task budget, progress guard, evidence nudge, reasoning governor,
planner fallbacks, plan-boundary outcomes, context-window recovery,
incomplete-read recovery, stream-interrupt and finish-reason warnings,
output-truncation and capability-proxy lines, deprecated retention
config warning, unapplied-steer warning) were hardcoded English
literals, so a zh session still showed English lines whenever one of
these guards fired.
Root cause: internal/agent predates the i18n catalog and emitted
event.Notice Text values as inline English; PR-1/PR-3 established the
i18n.M pattern for new notices but the pre-existing ones were never
migrated.
Fix: add 33 fields to the Messages catalog (en/zh/zh-TW, zh wording
aligned with the desktop locale's established translations) and point
every user-visible notice Text at i18n.M; dynamic values ride *Fmt
fields with fmt.Sprintf. Notice Detail diagnostics stay English
(developer telemetry), and all model-visible text stays byte-identical
English by design: host history injections (emptyFinalRetryMessage,
midTurnSteerMessage, todoProgressNudgeMessage, landCause.nudge, the
[loop guard] guidance, incomplete-read instructions and [INCOMPLETE
READ:] markers, planner persisted notes), and the prefix-matched
constants (MidTurnSteerPrefix, CompletionValidationContinuationPrefix,
StandardTodoContinuationPrefix) are untouched. RecoveryPauseError
Message is also untouched: recovery.PauseMessageEN is the deliberate
English wire fallback and every first-party UI (TUI, desktop, serve,
ACP) already substitutes localized copy for that outcome. desktop's
metrics aggregator now matches the empty-final notice by its stable
event code instead of the English text, with the test fixture carrying
the code.
Verification:
- go build ./... && (cd desktop && go build ./...)
- go test -count=1 ./internal/agent/... ./internal/i18n/... ./internal/control/... ./internal/event/... (all ok)
- go test -count=1 ./internal/tool/builtin/ ./internal/boot/ (ok)
- cd desktop && go test -count=1 . -run 'Metrics|Notice' (ok)
- go run ./tools/repolint (clean; no baseline bump)
- golangci-lint run --timeout=5m ./internal/... (0 issues)
Cache-impact: none - provider-visible prompts and injections stay
byte-identical; only user-visible Notice event texts read the catalog
Cache-guard: go test -count=1 ./internal/agent/... ./internal/boot/ -
prefix-stability and cache-hit e2e suites
Documentation-impact: none - no docs/*.md documents these runtime
notice strings
Migrate untouched OpenCode Go installs to the DeepSeek vision SKU, keep custom and explicitly disabled catalogs intact, and serialize capability cache writes safely across concurrent refreshes. Update focused regression coverage and repolint baselines.
Ensure model-level capability metadata reaches the initial boot provider and all image-capable wire adapters. Add curated preset catalog resolution for the remaining providers and regression coverage for OpenAI, Anthropic, and Responses image requests.
Keep the nested desktop module's go.mod and go.sum aligned with the root provider catalog dependency so desktop typecheck and builds work from a clean checkout.
Contract tests for the agent-core simplification baseline: one-request clean
final, tool-round advancement, frozen-request retry preserving reasoning, no
long-lived fallback state after retry exhaustion, and no synthetic
continuation on a clean final. docs/AGENT_CORE_SIMPLIFICATION{,.zh-CN}.md
record the metrics baseline reused from RunMetrics and e2ebench.
Add a dedicated Dependabot group and contract coverage for the pinned Pi model catalog so upstream capability drift is reviewed independently from unrelated Go dependency updates.
Expose the pinned Pi catalog as an exact adapter source and carry model API, endpoint, context, output, and reasoning metadata alongside input modalities. Preserve route identity checks and conservative custom-model defaults.
Use the pinned pure-Go Pi catalog as an adapter-owned metadata source for exact provider routes. Map model input, context, output, API, and reasoning facts without importing Pi's agent runtime, while retaining safe defaults for custom and unknown models.
Port Harness-style local catalog metadata for official OpenCode Go routes, DeepSeek vision SKUs, and verified ModelScope Qwen3.5 models. Keep exact matching and conservative defaults for uncatalogued models.
Use HMAC-SHA256 for provider capability cache identities instead of hashing credential revision data directly, and rely on Go 1.22 loop capture semantics for concurrent catalog fetches.
Refresh repolint baselines for the intentionally expanded provider, desktop, boot, and frontend capability surfaces. No new lint category is introduced.
The adapter-derived model capability labels add 0.2 KiB gzip and 0.2 KiB raw on the stable build. Keep the measured budget change narrow and attributable.
Add model capability fields to the Wails provider catalog, propagate extension descriptors, persist disposable metadata cache entries, and render adapter-derived vision status in settings. Keep legacy model-list and vision fields compatible.
Thread model-level input modalities through model discovery, local provider resolution, and Controller image gating. Preserve explicit legacy vision settings while defaulting exact undeclared models to text-only.
Expose model-level input modalities and preserve capability metadata from OpenAI-compatible model catalogs. Keep legacy provider interfaces and model-list callers compatible while defaulting undeclared models to text-only.
Problem: once the missing-reasoning circuit opened the disabled-thinking
fallback, the session could never leave it (#9750's long-conversation
symptom): the persisted half-open probe was only consulted at Run start, so
a long-lived conversation kept thinking off until the user abandoned the
session. The first backoff tier also parked a healthy-again provider for ten
minutes, and none of it was ever visible to the user.
Root cause: beginMissingReasoningRecovery early-returns whenever the session
already holds fallbackActive, so a due probe lease was never claimed inside
an active conversation; activateMissingReasoningFallback and probe
resolution recorded their state transitions silently, with no Notice on
either boundary.
Fix:
- missingReasoningFallbackBackoffs now starts at 2m and converges
2m/10m/1h/6h/24h (was 10m/30m/2h/6h/24h). The state-file format is
unchanged; older incidents re-enter through the existing normalization.
- runToolLoop calls refreshMissingReasoningProbe at the top of every model
round. While the circuit's quiet period runs, claimRecoveryModeAt answers
fallback and nothing changes; once due, the session claims the durable
half-open lease and clears fallbackActive for the probe. That single flag
is the switch every consumer already reads: the request loses its
disabled-thinking marker, the stream sink regains its reasoning-aware
buffer (the pass-through only fires while fallbackActive holds), and the
replay watcher re-arms, so the probe resolves after three healthy rounds
or escalates the backoff on one failure through the existing
resolveProbeAt/failProbeAt paths. No new state fields, no file contract
change, no per-session circuit isolation.
- activateMissingReasoningFallback and the probe-resolution path emit
user-visible notices (new NoticeCodeMissingReasoningFallback and
NoticeCodeMissingReasoningRecovered; i18n catalogs in en/zh/zh-TW). The
activation notice names the actual current backoff tier as the retry ETA,
read back from the persisted NextProbeAt by the new nextProbeDelayAt
helper; without a shared state directory it says thinking stays off for
the rest of the conversation instead of promising a probe that cannot run.
Tests: the warn-state suite gains an explicit ladder-shape assertion (the
existing backoff cases reference the ladder symbolically and pass
unchanged); reasoning_replay_recovery_test.go gains three in-session probe
e2es: a due probe recovers without a new Run (thinking restored on every
request, circuit closed, recovery notice), a circuit inside its quiet period
keeps the session in fallback without touching the state file, and a failed
in-session probe escalates to level 2 with the escalated tier named in the
notice. The fallback-activation e2e now also asserts the 2m notice. Both
probe e2es fail when the round-top refresh is removed.
Cache-impact: none - probe rounds reuse the existing claimRecoveryModeAt
request shape; fallback and normal request bytes are unchanged, only which
mode applies moves earlier within a session.
Documentation-impact: none - the fallback behavior is self-describing via
the new notices and no docs page documents the backoff ladder.
Problem: after the missing-reasoning circuit opens the disabled-thinking
fallback, every later turn in that session still went through the
reasoning-aware stream sink. The fallback never emits a reasoning event, so
the buffer could only release at commit time: long conversations degraded
into a permanent pseudo non-streaming mode where the answer appeared all at
once at the end of each model round (#9750).
Root cause: samplingAttemptSinks only distinguished replay-sensitive
providers from insensitive ones. A session in the provider-declared
disabled-thinking fallback is a third case: thinking is off by design, so no
reasoning event will ever arrive to unlock the buffer, and the request needs
no reasoning to replay safely (the adapter skips the replay-safe projection
in this mode), so the buffer protects nothing.
Fix: samplingAttemptSinks returns the direct pass-through sink while
sess.missingReasoning.fallbackActive holds for a provider that declared
SupportsMissingReasoningFallback, the same predicate the history projection
and the replay-issue classifier already use. Every other mode is unchanged.
Tests: stream_sink_test.go covers deferredStreamSink directly for the first
time (buffer/unlock/discard/defer-all/nil) plus the pass-through decision
table; a new wire-level e2e against the real Anthropic adapter holds the
fallback session's final answer open mid-stream and fails on a 2s timeout
if text reaches the UI only after the response completes (verified: the
test fails against the pre-fix sink and passes with it).
Cache-impact: none - fallback-mode requests were already sent with
thinking.type=disabled; only local event delivery timing changes, and the
existing fallback wire tests assert provider-visible bytes stay identical.
Documentation-impact: none - no user-facing docs describe stream buffering.
Problem: removing the vision checkbox left impossible instructions in locale and guide text, and ModelScope additions exceeded repolint file budgets.\n\nRoot cause: capability UI and mock/preset ownership were updated separately.\n\nFix: describe metadata-driven detection, preserve model-level vision metadata in the browser mock, and extract ModelScope data into dedicated files.\n\nVerification: go run ./tools/repolint; focused Go tests; frontend typecheck, test typecheck, lint, capability test, and pnpm build.\n\nCo-authored-by: Rongkun Yan <[email protected]>
Move zero-content classification out of the oversized stream collector and keep retired configuration compatibility fields compact enough for the existing repolint ratchet.
Move the provider-neutral empty-response sentinel to its owning error file and keep the agent stream collector below the repository ratchet while preserving frozen-request retry behavior.
Problem: every ordinary final answer could trigger a second completion-validator model request, and clean zero-content responses were retried by injecting a synthetic user prompt.\n\nRoot cause: finalization mixed deterministic host guards with a probabilistic validator and had no frozen-request empty-response boundary.\n\nFix: remove completion-validator execution and telemetry, accept reasoning-only clean terminals, classify true zero-content completions as a stable retryable provider error, and retry the same frozen request without committing empty history. Preserve explicit visible-final guards, legacy configuration/event reads, and DeepSeek reasoning replay recovery.\n\nVerification: go test ./...; focused agent/provider/config/boot/telemetry tests; desktop verification follows in the working tree.
Stop provider settings from inferring or persisting vision lists from fetched catalogs. Document model metadata and legacy VisionModels compatibility for the new read-only capability flow.
Use model capability metadata and legacy projections to render read-only image support. Unknown models stay on the safe text-only path while existing VisionModels configuration remains readable.
Use model metadata and legacy capability projections to render read-only image support. Keep unknown models on the safe text-only path and preserve old VisionModels configuration on save.
Keep legacy provider vision settings readable while allowing curated model metadata to declare multimodal support. Unknown models remain on the safe text-only path until capability is explicit.
Problem: a repaired reasoning-replay cutoff could outlive a rewind or other history rewrite, leaving an old anchor that disabled normal provider projection when it no longer resolved.
Root cause: the process-local strong projection overlay was cleared only by session replacement, and anchor misses were treated as a no-op.
Fix: clear the cutoff and anchor whenever projection lineage is invalidated, and fall back to the normal replay-safe projection when an anchor no longer resolves. Add regression coverage for both paths.
Verification: go test -count=1 ./internal/provider/... ./internal/agent/...; go test -race ./internal/agent/... ./internal/provider/...; go vet ./...; go build ./...
Problem: repeated terminal saves could overwrite a successfully persisted child outcome with a different status.
Root cause: SaveOutcome had no run-level terminal commit marker and used last-writer-wins for duplicate calls.
Fix: record successful terminal persistence on the run, make identical repeats no-ops, reject conflicting terminal transitions, and still allow a compensating save after the first persistence attempt fails.
Verification: focused subagent store tests, repolint, and make lint pass.
Problem: several child setup and persistence failures still dropped an allocated reference; deadline failures disagreed with progress state; lifecycle audits omitted run boundaries; and generic tool output could spoof subagent metadata.
Root cause: terminal handling was duplicated across foreground/background/skill paths, resumed metadata was not re-entered into running state, and lifecycle/result parsing was not centralized.
Fix: preserve outcomes on every allocated-run setup/save failure, classify deadline cancellation consistently, re-mark resumed transcripts running, make duplicate terminal saves idempotent, add one-shot ambiguous completion fallback, emit created/resume/running/terminal lifecycle records, restrict outcome parsing to subagent calls, and forward the final metadata to diagnostics.
Verification: focused agent/boot/skill/event tests, `go test -race` on affected packages, `go vet ./...`, `make lint`, and `./scripts/cache-guard.sh` pass. Desktop Go tests passed before this final backend-only change; the full desktop suite will run in CI after push.
Follow-up: current cross-platform CI measured initial JavaScript gzip at 463.9 KiB, so the existing narrow bundle gate is updated from 463.8 to 463.9 KiB with no chunk-boundary change.
The local branch was rebased onto the current main-v2 before adding the recovery fixes. Keep the previously published PR head as a second parent so the verified PR branch can advance without a force-push.
The resulting tree contains the rebased outcome implementation plus the new terminal, lifecycle, parser, and evaluator fixes.
Problem: several child setup and persistence failures still dropped an allocated reference; deadline failures disagreed with progress state; lifecycle audits omitted run boundaries; and generic tool output could spoof subagent metadata.
Root cause: terminal handling was duplicated across foreground/background/skill paths, resumed metadata was not re-entered into running state, and lifecycle/result parsing was not centralized.
Fix: preserve outcomes on every allocated-run setup/save failure, classify deadline cancellation consistently, re-mark resumed transcripts running, make duplicate terminal saves idempotent, add one-shot ambiguous completion fallback, emit created/resume/running/terminal lifecycle records, restrict outcome parsing to subagent calls, and forward the final metadata to diagnostics.
Verification: focused agent/boot/skill/event tests, `go test -race` on affected packages, `go vet ./...`, `make lint`, and `./scripts/cache-guard.sh` pass. Desktop Go tests passed before this final backend-only change; the full desktop suite will run in CI after push.
Problem: the widened DeepSeek replay policy treated plain reasoning turns as replay-required, but PostLLMCall could replace their stored provider reasoning with display text.\n\nRoot cause: preserveRawReasoning checked a synthetic assistant message without the original reasoning content.\n\nFix: pass the original reasoning into the replay policy, preserve it for provider replay, keep transformed text for display, and document the tools-dependent DeepSeek contract in both languages.\n\nVerification: post-hook regression coverage and full provider/agent test suites.
Problem: after a successful thinking-replay 400 repair, the session-wide strong projection stripped newly generated tool calls and results from later model steps.\n\nRoot cause: the recovery flag had no history boundary and reapplied the full stripped projection to every subsequent request.\n\nFix: record the repaired provider-visible history prefix, apply the strong projection only within that prefix, and keep newly appended reasoning/tool rounds on the normal replay path.\n\nVerification: deterministic recovery and projection tests, full provider/agent suites, go test -race, go vet, make lint, go build, and go test ./....
Problem: the PR's desktop initial JavaScript bundle measured 463.8 KiB in CI, exceeding the 463.4 KiB production gate and failing the desktop jobs.
Root cause: the outcome card, partial progress state, and history hydration add a small, intentional startup path cost.
Fix: raise only the initial JavaScript budget to the measured 463.8 KiB value, the raw startup budget to the measured 2474.0 KiB value, and add 0.1 KiB of narrowly scoped `zh` locale headroom for the exact Windows compression boundary. No chunk boundary or lazy-loading guard is changed.
Verification: local Go suites and lint remain green; the desktop CI bundle, macOS, and Windows jobs must rerun against this exact commit.
Problem: the PR's desktop initial JavaScript bundle measured 463.8 KiB in CI, exceeding the 463.4 KiB production gate and failing the desktop jobs.
Root cause: the outcome card, partial progress state, and history hydration add a small, intentional startup path cost.
Fix: raise only the initial JavaScript budget to the measured 463.8 KiB value and add 0.1 KiB of narrowly scoped `zh` locale headroom for the exact Windows compression boundary. No chunk boundary or lazy-loading guard is changed.
Verification: local Go suites and lint remain green; the desktop CI bundle, macOS, and Windows jobs must rerun against this exact commit.
Problem: the PR's desktop initial JavaScript bundle measured 463.8 KiB in CI, exceeding the 463.4 KiB production gate and failing the desktop jobs.
Root cause: the outcome card, partial progress state, and history hydration add a small, intentional startup path cost.
Fix: raise only the initial JavaScript budget to the measured 463.8 KiB value and document the 0.5 KiB bounded increase. No chunk boundary or lazy-loading guard is changed.
Verification: local Go suites and lint remain green; the desktop CI bundle, macOS, and Windows jobs must rerun against this exact commit.
## Summary
This PR systematizes subagent result delivery and recovery without adding cost on the normal path.
## Problem
Successful or partially completed child agents could lose their final visible output and stable reference when completion confirmation failed. Continuation and UI paths then treated all terminal errors as unrecoverable.
## Root cause
Task and skill runners returned unstructured errors, persisted metadata only represented completed/failed states, and child validation reused the root evaluator path without a bounded recovery contract.
## Fix
- Add a backward-compatible `SubagentOutcome` envelope and typed child-run errors.
- Classify uncertain child completion as retryable `partial` and retain the last visible answer.
- Save transcripts before terminal metadata and support partial/failed reads plus `continue_from`.
- Preserve references through task, skill, parallel, fleet, eventwire, history hydration, and desktop cards.
- Separate `sa_...` transcript references from `tr-...` ordinary tool-result references.
- Disable thinking only on bounded evaluator requests; normal child runs do not add evaluator calls.
- Add host-only lifecycle diagnostics and a real partial progress terminal state.
- Document compatibility, downgrade behavior, and recovery semantics in English and Chinese.
## Compatibility and cache impact
Metadata fields are additive and `omitempty`; old transcripts remain readable and old readers ignore unknown fields. Provider-visible schemas remain stable apart from the explicit static boundary clarification. Dynamic refs, statuses, and result bodies stay out of prompts and tool schemas. The normal subagent path adds no model calls, tokens, or waits.
## Verification
- `go test -count=1 ./...`
- `go test -race -count=1 ./...`
- `go vet ./...`
- `(cd desktop && go test -count=1 ./...)`
- `(cd desktop && go test -race -count=1 ./...)`
- `(cd desktop && go vet ./...)`
- `make lint`
- `./scripts/cache-guard.sh`
Frontend TypeScript typecheck remains environment-blocked because `desktop/frontend/node_modules` is not installed.
Problem: the management-disposition follow-up exceeded the frontend raw startup budget and lacked a deterministic active-turn admission regression. Root cause: the new receipt path added a small raw payload while the management branch was classified before the existing tab admission guard. Fix: retain admission protection for management commands, add an active-turn rejection test, remove the obsolete frontend command fallback, and ratchet the raw budget by the measured 0.6 KiB with bounded headroom. Verification: pnpm build; frontend send-failed regression; frontend test typecheck; desktop focused and full tests; internal control tests and race; repolint.
Problem: older OpenAI-compatible DeepSeek sessions can still be rejected with a reasoning_content pass-back HTTP 400 after all-turn replay is enabled.\n\nRoot cause: the shared strong projection honored the OpenAI adapter's empty-reasoning fallback, so stale tool activity could survive a repair retry without its reasoning.\n\nFix: bypass that fallback only for the explicit 400 repair projection, remove unpaired old tool history from the provider-visible request, preserve canonical history, and pin the repaired conversation to the stable stripped projection.\n\nVerification: go test -count=1 ./internal/provider/... ./internal/agent/...; go test -race ./internal/provider/... -count=1; go test -race ./internal/agent/ -run 'Replay|Reasoning|Retry' -count=1; go vet ./...; make lint; go build ./....
Problem: the PR's desktop initial JavaScript bundle measured 463.8 KiB in CI, exceeding the 463.4 KiB production gate and failing the desktop jobs.
Root cause: the outcome card, partial progress state, and history hydration add a small, intentional startup path cost.
Fix: raise only the initial JavaScript budget to the measured 463.8 KiB value, the raw startup budget to the measured 2474.0 KiB value, and add 0.1 KiB of narrowly scoped `zh` locale headroom for the exact Windows compression boundary. No chunk boundary or lazy-loading guard is changed.
Verification: local Go suites and lint remain green; the desktop CI bundle, macOS, and Windows jobs must rerun against this exact commit.
Problem: DeepSeek-style OpenAI requests omitted reasoning_content on plain assistant turns, even though later tool-carrying requests require every prior reasoning turn to be replayed.\n\nFix: replay non-empty provider reasoning on every assistant history turn while retaining the empty-key fallback for reasoning-less tool turns.\n\nVerification: go test ./internal/provider/openai -count=1; go vet ./internal/provider/openai.
Problem: the PR's desktop initial JavaScript bundle measured 463.8 KiB in CI, exceeding the 463.4 KiB production gate and failing the desktop jobs.
Root cause: the outcome card, partial progress state, and history hydration add a small, intentional startup path cost.
Fix: raise only the initial JavaScript budget to the measured 463.8 KiB value and add 0.1 KiB of narrowly scoped `zh` locale headroom for the exact Windows compression boundary. No chunk boundary or lazy-loading guard is changed.
Verification: local Go suites and lint remain green; the desktop CI bundle, macOS, and Windows jobs must rerun against this exact commit.
Zero behavior change: lint-gate compliance for the thinking-replay repair
branch. The branch's additions pushed four files past their repolint budgets
and introduced two golangci findings; everything here is code motion or
mechanical rewrites, no logic edits.
repolint:
- run_loop.go file-size/function-size: deferredStreamSink and its methods move
verbatim to the new stream_sink.go; the thinking-400 branch collapses into
tryRecoverReasoningReplay400 in reasoning_replay_recovery.go (Discard,
attempt audit, and budget handling live there now); the overflow and
suppressed-retry tails of streamWithSamplingRecovery move verbatim into
finishReasoningReplayOverflow / suppressMissingReasoningRetry in
reasoning_replay.go.
- sessionstate.go essay: the reasoningReplayStrongProjection field comment
drops to three lines.
- anthropic.go file-size: the thinking-first merge logic moves to
missing_reasoning_fallback.go as mergeThinkingFirst + leadingThinkingBlocks,
leaving appendBlocks a one-line call.
- anthropic_test.go test-file-size: TestBuildRequestDeepSeekReplaysReasoning-
FromHistory moves unchanged to replay_projection_test.go, the file that owns
replay/projection semantics.
golangci-lint:
- errorlint in reasoning_replay_error_test.go: assert the Unwrap contract via
errors.Is instead of comparing errors.Unwrap results.
- modernize in retry_e2e_test.go: accumulate the streamed answer with a
strings.Builder.
Verification: go run ./tools/repolint (clean); golangci-lint run
--timeout=5m ./internal/... (0 issues); go build ./...; go test -count=1
./internal/provider/... ./internal/agent/...; go test -race
./internal/agent/ -run 'Replay|Reasoning|Retry' -count=1.
Problem: DeepSeek's Anthropic endpoint rejects a tools-carrying request whose
history contains assistant turns without their thinking blocks (HTTP 400
"content[].thinking ... must be passed back"). Sessions whose canonical
history already lost reasoning (crashes, older builds, imported transcripts)
hit this on every round, and the 400 was treated as a terminal error, so the
turn died and the bad history re-triggered the failure on each retry (#9750).
Root cause: no recovery path existed between the context-limit repair and the
generic terminal error handling, and no projection could strip reasoning the
provider considers stale.
Fix: catch-and-repair, once per model round, following the vendor-documented
strip-all recipe. ParseReasoningReplayError matches only an HTTP 400 whose body
names content[].thinking or reasoning_content AND the pass-back obligation, so
unrelated 400s and other statuses are never swallowed. On a match the agent
rebuilds the frozen request's Messages through the new strong projection
(ProjectReasoningStrippedMessages strips every assistant message's reasoning
metadata and drops the tool activity that can no longer pair with its thinking)
— every other frozen field stays byte-identical — and retries once. Canonical
session history is never modified. After the retry succeeds, a session-scoped
flag keeps the strong projection for all later rounds so the conversation does
not pay another 400 per round; a warning notice (new NoticeCode, localized in
en/zh/zh-TW) and two content-free ProtocolRecoveryAudit kinds make the repair
visible and auditable. If the repaired retry still 400s, the turn terminates
with the original error shape.
Cache-impact: medium — only for repaired sessions: the strong projection drops
thinking blocks from the provider-visible history, invalidating the previous
prefix once; afterwards the stripped projection is deterministic and stable.
Healthy sessions are untouched (zero-copy projection preserved).
Verification: go build ./...; go test ./internal/provider/...
./internal/agent/...; go test -race ./internal/agent/ -run
'Replay|Reasoning|Retry' -count=1; plus a table-driven matcher suite, mock-level
recovery/exhaustion/non-match tests, and an end-to-end test driving the real
Anthropic adapter against an httptest server that 400s once.
Problem: after ProjectReplaySafeMessages degrades a reasoning-less DeepSeek
assistant turn to plain text, it can become adjacent to the next healthy
assistant turn (its tool results were dropped). buildRequest coalesces
same-role messages, and appending the healthy turn's blocks produced
[text, thinking, ...], which DeepSeek's thinking mode rejects with HTTP 400
because the thinking block must lead the message.
Root cause: appendBlocks merged by plain tail-append, ignoring the
thinking-block-first invariant.
Fix: when the appended blocks open with a thinking run and the merge target
already has content, insert the thinking run at the front of the target's
content and append the rest, yielding [thinking, text, ...].
Cache-impact: low — block order inside one merged assistant message changes
only for histories that already required projection; healthy histories never
take the reorder branch.
Verification: go build ./...; go test ./internal/provider/... with a new
regression test building the A1(text+tools, reasoning lost)/T1/A2(reasoning
+tools) history and asserting the merged wire message stays thinking-first.
Problem: DeepSeek's Anthropic-compatible endpoint (api.deepseek.com/anthropic)
answers HTTP 400 "The `content[].thinking` in the thinking mode must be
passed back to the API" whenever a tools-carrying request's history contains
an assistant turn whose thinking block was not passed back — including plain
question-answer turns with no tool call. Reasonix only replayed reasoning for
turns with tool activity, so any pure Q&A turn followed by a tool turn 400'd
(#9750).
Root cause: replayReasoningBlock gated DeepSeek replay on tool/search
activity, contradicting the official thinking-mode contract documented at
api-docs.deepseek.com/guides/thinking_mode.
Fix: drop the activity condition from the DeepSeek replay branch and widen
RequiresAssistantReasoningReplay so an assistant turn carrying provider
reasoning is replay-required with or without tool activity. Turns without
stored reasoning still stay out of projection, so healthy histories keep
their zero-copy backing and the projection cut surface does not grow.
Serialization already emits the thinking block before the text block; the
agent-side watchdog needed no change because the widened policy only adds
turns that carry reasoning, which can never trigger the missing-reasoning
branch.
Cache-impact: medium — thinking blocks for stored reasoning now join the
provider-visible history (API hard requirement); once replayed they are
byte-stable across turns, and healthy-history projection remains zero-copy.
Verification: go build ./...; go test ./internal/provider/...
./internal/agent/... (updated two assertions that pinned the old
activity-gated behavior: text-turn reasoning is now replayed, including
under a since-disabled thinking toggle, matching the existing tool-turn
rule).
Problem: confirming a management command could clear the composer state of an unrelated active turn because the optimistic reducer reset the turn identity before the management receipt arrived. Root cause: management confirmation preserved only active turn identifiers and live prompt state, not the turnActive gate itself. Fix: retain the existing active-turn gate when settling management submissions and add regression coverage for concurrent management and conversational work. Verification: frontend send-failed regression (121 passed); frontend test typecheck; internal/control race tests; focused desktop race tests; repolint.
Problem: the PR's desktop initial JavaScript bundle measured 463.8 KiB in CI, exceeding the 463.4 KiB production gate and failing the desktop jobs.
Root cause: the outcome card, partial progress state, and history hydration add a small, intentional startup path cost.
Fix: raise only the initial JavaScript budget to the measured 463.8 KiB value and document the 0.5 KiB bounded increase. No chunk boundary or lazy-loading guard is changed.
Verification: local Go suites and lint remain green; the desktop CI bundle, macOS, and Windows jobs must rerun against this exact commit.
Problem: /goal pause and /goal resume were treated as literal Goal text by the Desktop composer before the controller handled the lifecycle action, clearing or replacing the active goal. Root cause: the local command branch excluded status and clear forms but not pause and resume. Fix: keep pause and resume out of Goal text activation and add a source-level regression assertion. Verification: frontend send-failed regression (119 passed); frontend test typecheck; focused Controller and Desktop runtime tests; repolint.
Problem: the new management route classifier accidentally made managementNotice claim unknown slash commands, which would swallow custom commands and skills. Root cause: removing the default false branch while extracting the shared command map changed the existing dispatcher contract. Fix: restore the default false result and add a regression test for unknown, custom, and similarly-prefixed inputs. Verification: focused internal/control tests; desktop runtime tests; frontend send-failed regression; frontend typecheck; repolint.
## Summary
This PR systematizes subagent result delivery and recovery without adding cost on the normal path.
## Problem
Successful or partially completed child agents could lose their final visible output and stable reference when completion confirmation failed. Continuation and UI paths then treated all terminal errors as unrecoverable.
## Root cause
Task and skill runners returned unstructured errors, persisted metadata only represented completed/failed states, and child validation reused the root evaluator path without a bounded recovery contract.
## Fix
- Add a backward-compatible `SubagentOutcome` envelope and typed child-run errors.
- Classify uncertain child completion as retryable `partial` and retain the last visible answer.
- Save transcripts before terminal metadata and support partial/failed reads plus `continue_from`.
- Preserve references through task, skill, parallel, fleet, eventwire, history hydration, and desktop cards.
- Separate `sa_...` transcript references from `tr-...` ordinary tool-result references.
- Disable thinking only on bounded evaluator requests; normal child runs do not add evaluator calls.
- Add host-only lifecycle diagnostics and a real partial progress terminal state.
- Document compatibility, downgrade behavior, and recovery semantics in English and Chinese.
## Compatibility and cache impact
Metadata fields are additive and `omitempty`; old transcripts remain readable and old readers ignore unknown fields. Provider-visible schemas remain stable apart from the explicit static boundary clarification. Dynamic refs, statuses, and result bodies stay out of prompts and tool schemas. The normal subagent path adds no model calls, tokens, or waits.
## Verification
- `go test -count=1 ./...`
- `go test -race -count=1 ./...`
- `go vet ./...`
- `(cd desktop && go test -count=1 ./...)`
- `(cd desktop && go test -race -count=1 ./...)`
- `(cd desktop && go vet ./...)`
- `make lint`
- `./scripts/cache-guard.sh`
Frontend TypeScript typecheck remains environment-blocked because `desktop/frontend/node_modules` is not installed.
Prevent /goal pause and /goal resume from being treated as literal Goal text by the Desktop composer before the controller handles their lifecycle action.
Problem: management slash commands were submitted through the durable turn receipt API, which requires a conversational turn id and surfaced false send failures. Root cause: the frontend decided locally which commands bypassed StartTurnForTab, while the controller already owned conditional slash-command semantics. Fix: add a controller-owned submit disposition, return management_handled receipts without a turn id, settle optimistic management bubbles safely, and preserve the legacy SubmitToTabWithID contract. Add route and runtime regression coverage.
Route exact /compact commands through the compatibility submit path because compaction is a management operation without a durable conversational turn. Add focused regression coverage for bare and focused compaction commands plus a similarly-prefixed negative case.
Problem (#9711): scrolling up through a long Markdown answer skips the
viewport thousands of pixels to another place in the document. The field
diagnostics (stable d9cd713, Windows, reducedMotion=false, all 138 rows
mounted) show eight upward wheel transactions where scrollHeight grows by
G, scrollTop moves by exactly +G with bottomDistance unchanged, and the
reader guard then fires restore-anchor and rewrites scrollTop to its
pre-growth value (19140.95 reappears one frame after a 26393 sample).
Root cause: the reader's transaction anchor is a row's top edge. When the
answer's block window prepends older blocks inside that row above the
visible blocks, MarkdownHistory compensates scrollTop by the same amount
so nothing visible moves. The anchor row's top edge is now G px higher
relative to the viewport and scrollTop moved against the reader, so the
guard reads a reverse displacement and "restores" the anchor, which
scrolls the reader G px up into the newly inserted blocks. That restore is
the reported jump. The guard's positive translateY also extends the
scroller's overflow, which is why extentDelta reads 2G for one frame.
Fix: the arbiter measures the scrollTop delta an accepted
block-window-prepend write produced and hands it to the reader hook's new
absorbOffsetWrite(). The active transaction re-baselines baselineTop,
lastAcceptedTop, expectedTop and anchor.offset to the compensated position
and resets its extent baselines to the grown scrollHeight, so neither the
scrollTop step nor the anchor-edge shift counts as displacement. Real
displacements after the absorption are still detected.
Verification:
- transcript-reader-visual-guard-race.test.tsx replays the field shape
(row starting 1,450px above the viewport, 7,252px in-row prepend with
exact compensation). On the previous head it records one anomaly, one
visual guard, one reader-stability correction and rewinds scrollTop to
19204; on this head no anomaly, no guard, no correction, scrollTop
stays compensated, and a later 700px real displacement is still caught.
- transcript-reader-extent-race, native-scrollbar-generation,
anchor-compensation-race, history-prepend-race, scroll-release,
markdown-history, recovery-race, test:transcript, test:motion,
typecheck, test:typecheck, lint:hooks, check:scroll-writer, repolint,
git diff --check pass on the tree rebased onto #9759.
- Bundle on the rebased tree: gzip 463.292 KiB (budget 463.2 -> 463.4,
one cross-platform decimal of headroom over an 8-byte margin), raw
2471.741 KiB (2471.0 -> 2471.8).
Problem (#9711): scrollbar interaction fights the app's own scroll
handling. Dragging the custom scrollbar while rows are still mounting
writes through a mapping frozen at pointerdown, so the next pointer move
lands on a stale extent. A native-thumb transaction is only ended by call
ordering (cancel before generation bump), not by the transaction itself.
Root cause: the custom-scrollbar drag captures overflow/maxThumbTop once
and never rebases when geometry changes mid-drag. The native-thumb
transaction carries no generation, so observe()/finish() cannot tell a
stale transaction from a live one and rely on every generation-advancing
caller to cancel first.
Fix:
- useCreationTranscriptScrollbar: rebase the frozen drag mapping at the
current physical ratio whenever overflow/maxThumbTop/thumbHeight change,
keeping the last pointer sample so the thumb does not visibly jump.
The rail-click settle loop waits for two quiet frames but is bounded by
a 1000 ms wall-clock budget (RAIL_SETTLE_BUDGET_MS) instead of spinning
while geometry keeps changing.
- useTranscriptNativeScrollbarOwnership: bind each transaction to the
surface generation. A stale-generation observe() ends ownership without
claiming the tail; a stale finish() clears the marker and reports no
transaction; isActive() is false. The arbiter passes generationRef.
Verification:
- transcript-native-scrollbar-generation.test.tsx (new): 14 assertions
covering same-generation claim-tail, stale observe, stale finish with and
without prior observe. Four fail against the previous hook.
- creation-transcript-scrollbar.test.ts: rebase preserves the physical
ratio and later movement uses the current extent.
- transcript-reader-extent-race (native-thumb section), test:transcript,
typecheck, test:typecheck, lint:hooks, check:scroll-writer, repolint,
git diff --check pass.
- Bundle: gzip 463.102 KiB (budget 462.9 -> 463.2), raw 2470.932 KiB
(2469.9 -> 2471.0).
The generation fence and drag rebase are extracted from #9754; the settle
deadline is new.
Problem: a fenced code block with no content (or only whitespace) renders
as a bordered one-line CodeViewer. In the #9711 capture these appear as
empty cards between paragraphs and add phantom height to transcript rows.
Root cause: createComponents() treats every fence as a block and hands the
empty value to CodeViewer; PlainMarkdownBlock likewise renders an empty
<pre> for whitespace-only plain blocks.
Fix: return null for a fenced block or plain block whose trimmed value is
empty. Comment-only and other non-empty code keeps its code-block surface.
Verification: markdown-pipeline.test.tsx gains four assertions (empty
fences render nothing, surrounding text survives, comment-only blocks keep
their surface). The new assertions fail against the previous component.
typecheck, lint:hooks, related transcript suites, vite build, and bundle
budgets pass without a budget change.
Extracted from #9754 so the display fix can land independently of the
scroll-ownership work.
Problem: opening a high-volume crash group could throw Cloudflare Worker error 1101 because the detail route loaded every raw report and every technical distribution value.
Root cause: D1 detail queries had no result bound; sample rendering only hid old rows after materializing them, and the 13-facet UNION could fan out one event into many returned rows.
Fix: read only the first retained sample plus the latest five through a composite fingerprint/id index, compute detail totals from 30-day rollups, cap each facet at its top 20 values, and degrade to a core group page when either optional detail query fails.
Verification: crash-report 130 tests, typecheck, repolint, diff check, Wrangler dry-run, and a 35,000-report SQLite bound test pass.
Problem: the diagnostics triage lanes compressed scope, status, and window metrics into dense rows, making the highest-impact reports harder to scan on desktop and narrow screens.
Root cause: compact report rows reused a four-column layout without visible metric labels, explicit open status, or a responsive override for the compact table header.
Fix: split report rendering into a focused helper, label affected installs/impact rate/window events/identity coverage/lifetime events, show explicit bilingual status pills, add ranking context, preserve full summaries for assistive technology, add focus-visible styles, and collapse compact rows to a single-column mobile layout without horizontal overflow.
Verification: crash-report tests (126), typecheck, repolint, diff check, Wrangler dry-run, and browser screenshots at default and 672px viewports pass.
Problem: repolint rejected the PR head because the two new visual-guard
scenarios pushed transcript-reader-extent-race.test.tsx to 853 lines, over
the 800-line test-file ceiling. The CSS half of the fix also had no
automated guard: nothing stopped a later edit from restoring
`transition-duration: 0.01ms` and silently reintroducing the lagging
same-frame geometry reads.
Fix:
- Move the unapplied/applied visual-guard scenarios into
transcript-reader-visual-guard-race.test.tsx with the same JSDOM + fake
rAF harness, restore the extent race file to its base contents, and add
the new file to test:transcript and the motion CI contract.
- Extend check-motion-ci-contract.mjs so the global universal
prefers-reduced-motion reset must use `transition: none !important` and
must not shorten transitions.
Verification:
- transcript-reader-visual-guard-race: 9 pass on the PR head; 2 fail
against the pre-fix hook (-2043px guard, 1154px correction).
- check-motion-ci-contract passes on the PR head and fails when the reset
is reverted to transition-duration.
- go run ./tools/repolint clean; pnpm test:transcript, test:motion,
test:typecheck, lint:hooks pass; git diff --check clean.
Problem:
The PR head diverged from main-v2 and GitHub marked the pull request conflicting.
Root cause:
main-v2 added the canonical Go 1.26 modernize deferral while the PR carried an older, overlapping lint configuration.
Fix:
Merge the latest main-v2 changes and resolve the .golangci.yml conflict by retaining main-v2's documented newexpr and stditerators deferral. No unrelated base changes were rewritten.
Verification:
- golangci-lint config verify and run --timeout=5m
- go run ./tools/repolint
- go test ./internal/agent ./internal/control ./internal/sessioncontext ./internal/provider/anthropic ./internal/provider -count=1
- go test -race ./internal/agent ./internal/control ./internal/sessioncontext -count=1
- git diff --cached --check
* fix(crash): repair diagnostics query and duplicate scan
Problem: the diagnostics dashboard crashed because its development-group predicate used an ambiguous fingerprint column after joining the groups and diagnostic aggregate. The unfiltered page also scanned the same 30-day pings window three times for identical denominators.
Root cause: the shared SQL predicate was unqualified, and the three denominator subqueries were emitted independently on the default diagnostics view.
Fix: qualify the predicate with groups.fingerprint and materialize one ping count for the unfiltered view. Filtered diagnostics retain their separate active, base, and covered denominators. Add SQLite regression coverage for both contracts.
Verification: npm run typecheck; npm test (114 tests); local EXPLAIN QUERY PLAN and SQLite benchmark over 325k diagnostic facts and 162.5k pings confirmed one pings scan and 141ms group-query runtime versus the earlier 419ms baseline.
* perf: add D1 indexes and registry install rollup
Problem: forum lists and anti-abuse checks sort or count without supporting indexes, Crash administration has fingerprint scans, and Registry trending aggregates one raw install event per request.\n\nFix: add idempotent forum, Crash, and Registry indexes; introduce package_install_daily with deterministic legacy backfill; and wire the migrations into the authorized GitHub Actions deployment paths.\n\nVerification: migration scripts execute twice against SQLite fixtures without errors; focused Worker tests and typechecks pass.
* perf: bound web data queries and aggregate installs
Problem: forum topic and Registry version responses were unbounded, Registry trending counted one raw install event per request, and Crash diagnostics repeatedly scanned large windows.\n\nFix: add keyset pagination, aggregate Registry installs by day with a legacy backfill, reuse daily Crash rollups for unfiltered groups, materialize group detail windows once, cache diagnostic facets briefly, and emit sampled query timings without SQL parameters.\n\nVerification: forum, crash Worker, and site tests/typechecks pass; SQLite EXPLAIN plans confirm the new hot-path indexes and bounded queries.
* refactor(crash): isolate stats query timing
Keep the crash Worker entrypoint within the repository file-size budget while retaining sampled diagnostics query timing.
* chore(security): update x/crypto to v0.56.0
* ci: keep Go 1.26 modernization out of security fix
Windows reports prefers-reduced-motion: reduce whenever "Animate controls
and elements inside windows" is off. The global reduced-motion reset turned
every transition into a 0.01ms `transition: all`, which still starts from
the old value: transform and padding writes were invisible to same-frame
getBoundingClientRect/scrollHeight reads. The reader-extent guard then
re-measured its own unapplied transform as fresh displacement and
compounded the visual offset on every scroll event (7088 → 14177 → 21265
px in the reported diagnostics), ending in a correction to scrollTop 0 and
degraded question-jump navigation.
- Reduced-motion CSS now removes transitions (`transition: none`) instead
of shortening them, so geometry lands synchronously. Animations keep the
0.01ms squash so fill-mode: forwards end states survive.
- The reader-extent guard and the anchor-compensation loop derive the
physical drift from the item list's applied computed transform rather
than the remembered offset, so a lagging or externally cleared guard can
no longer compound.
- Race tests cover the unapplied and applied transform cases; both fail
against the previous hook.
- Bundle budgets step one decimal: 462.7 → 462.9 KiB gzip (462.827
measured), 2469.4 → 2469.9 KiB raw (2469.815 measured).
Problem:
The CI lint configuration used a non-existent modernize analyzer name, so golangci-lint failed during config verification.
Root cause:
The analyzer is registered as waitgroup in golangci-lint v2.12.2, while the upstream x/tools pass is named waitgroupgo.
Fix:
Use the repository linter's canonical analyzer name and remove the redundant WaitGroup wrapper from the concurrency regression test.
Verification:
- golangci-lint config verify and run (root and desktop)
- go run ./tools/repolint
Problem:
The x/crypto security update raises the module language directive to Go 1.26, so golangci-lint starts reporting repository-wide modernize suggestions that predate this change.
Root cause:
The linter's modernize suite includes Go 1.25/1.26 migrations that were not part of the repository baseline, while one new parser change still used the stringscut pattern.
Fix:
Defer newexpr, stditerators, and waitgroupgo as explicit migrations, remove the unnecessary loop-variable copy in the new concurrency test, and use strings.Cut in the framed session parser.
Verification:
- golangci-lint run --timeout=5m (root and desktop)
- go run ./tools/repolint
- go test ./... -count=1 (root and desktop)
- go test -race ./internal/agent ./internal/control ./internal/sessioncontext -count=1
- go mod tidy -diff (root and desktop)
Problem:
The x/crypto security update requires Go 1.26, while the source-build documentation still advertised Go 1.25+.
Fix:
Update the README prerequisite to match the module dependency and toolchain contract.
Verification:
- go run ./tools/repolint
- git diff --check
Problem:
The current vulnerability database reports GO-2026-6354 and GO-2026-6355 in golang.org/x/crypto v0.55.0 through the remote SSH client and test server.
Root cause:
Both root and desktop modules pinned the vulnerable x/crypto release.
Fix:
Upgrade golang.org/x/crypto to v0.56.0 in both modules and refresh module sums. The required Go directive advances to 1.26.0 because the fixed module declares that minimum.
Verification:
- go mod tidy
- go run ./tools/repolint
- go test ./internal/agent ./internal/control ./internal/sessioncontext ./internal/provider/anthropic -count=1
- local govulncheck no longer reports x/crypto vulnerabilities; remaining standard-library findings are from local Go 1.26.5 and CI uses Go 1.26.6
Problem: the new transcript race coverage crossed the 800-line test-file ceiling, and the bounded passive anchor lease moved the raw startup bundle 0.222 KiB over the existing decimal gate on CI.
Root cause: the regression was appended to an already full extent-race file, while the new delayed-range ownership path adds a small measured production payload.
Fix: move the passive-anchor scenario into the existing anchor-compensation race suite, reduce duplicate runtime helper payload, and ratchet only the measured raw bundle ceiling from 2469.2 to 2469.4 KiB. Gzip and chunk budgets remain unchanged.
Verification: pnpm --dir desktop/frontend test:transcript; pnpm --dir desktop/frontend check:scroll-writer; pnpm --dir desktop/frontend typecheck; pnpm --dir desktop/frontend build.
Problem:
The new planner concurrency regression exceeded existing repository test-file and task-file budgets.
Fix:
Move the concurrency test into its own focused file and trim redundant documentation while preserving the child-context boundary and behavior.
Verification:
- go test ./internal/agent -run TestCoordinatorSerializesConcurrentPlannerCalls -count=1
- go run ./tools/repolint
- git diff --check
Problem:
The child-context regression fixture used secret-like labels that could be mistaken for real credentials during public diff review.
Fix:
Use neutral marker text while retaining the same parent-context isolation assertions.
Verification:
- go test ./internal/agent -run TestSubagentDoesNotInheritParentTurnContext -count=1
- git diff --check
Problem:
Markdown headings and closing tags inside memory or skill content could be mistaken for session-context section boundaries.
Root cause:
The v1 parser searched for literal heading and closing-tag strings without a framing length, so valid user content could be reclassified after reload or lose the cache breakpoint.
Fix:
Emit deterministic byte-length metadata for v1 sections, retain a legacy parser for existing snapshots, and search closing tags until the digest-valid envelope is found. Add round-trip coverage for embedded headings and closing tags.
Verification:
- go test ./internal/sessioncontext -count=1
- go test ./internal/provider/anthropic -run 'SessionContext|Cache' -count=1
- git diff --check
Problem: the new transcript race coverage crossed the 800-line test-file ceiling, and the bounded passive anchor lease moved the raw startup bundle 0.222 KiB over the existing decimal gate on CI.
Root cause: the regression was appended to an already full extent-race file, while the new delayed-range ownership path adds a small measured production payload.
Fix: move the passive-anchor scenario into the existing anchor-compensation race suite, reduce duplicate runtime helper payload, and ratchet only the measured raw bundle ceiling from 2469.2 to 2469.4 KiB. Gzip and chunk budgets remain unchanged.
Verification: pnpm --dir desktop/frontend test:transcript; pnpm --dir desktop/frontend check:scroll-writer; pnpm --dir desktop/frontend typecheck; pnpm --dir desktop/frontend build.
Problem:
Mid-turn autosave could observe a host session-context message before the corresponding user turn was appended.
Root cause:
Turn preparation appended the context with Session.Add, while pinned revisions and the user message were appended later with AddBatch.
Fix:
Stage context, pinned revision, and user messages together and commit them with one Session.AddBatch; keep standalone AppendTurnContext callers compatible and cover the admission ordering with a regression test.
Verification:
- go test ./internal/agent ./internal/control -run 'TestAppendTurnContextAndUserCommitsOneAdmissionBatch|TestRunInjectsSessionContextBeforeRealUserAndDeduplicatesDigest|TestSessionContextPlannerSelectionAndSyntheticBootstrap|TestCoordinator.*|TestRunSubagent.*' -count=1
- go test ./internal/agent ./internal/control -count=1
- git diff --check
Problem:
Coordinator planner prefix bookkeeping and planner session access raced when concurrent planner calls overlapped.
Root cause:
plan and ResetPlannerSession read and wrote shared planner state without a synchronization boundary.
Fix:
Guard planner execution, session reset, and cache-prefix bookkeeping with a Coordinator mutex, and add a deterministic concurrent planner regression test.
Verification:
- go test -race ./internal/agent -run TestCoordinatorSerializesConcurrentPlannerCalls -count=1
- git diff --check
Problem:
Child agents inherited the parent session-context through ambient context propagation, exposing parent memory and skill catalog data.
Root cause:
RunSubAgentWithSession constructed a child Agent from the parent context without an explicit context boundary.
Fix:
Suppress TurnContextBundle at the child boundary while preserving explicit transcript inheritance for fork/continue sessions, and add a regression test covering child history and provider requests.
Verification:
- go test ./internal/agent -run TestSubagentDoesNotInheritParentTurnContext -count=1
- go test ./internal/agent -run 'TestRunInjectsSessionContextBeforeRealUserAndDeduplicatesDigest|TestSessionContextPlannerSelectionAndSyntheticBootstrap' -count=1
- git diff --check
Problem: Windows WebView2 can apply a delayed Virtuoso range commit after a reader transaction times out, moving the transcript to a repeatable stale offset until the user reaches the tail.
Root cause: the active reader guard ended before the delayed commit, and the next scroll delivery replaced the last logical reader anchor with the already-displaced viewport.
Fix: retain a cancellable passive reader-anchor lease for the bounded post-transaction window and route late deliveries through the existing anchor compensation writer. Add a deterministic regression for the delayed range replacement.
Verification: pnpm --dir desktop/frontend test:transcript; pnpm --dir desktop/frontend typecheck; pnpm --dir desktop/frontend build.
Clarify the bilingual guide label and description so the English and Chinese session ownership links are not rendered as duplicates.\n\nVerification:\n- node scripts/release-notes.mjs validate\n- node --test scripts/release-notes.test.mjs\n- rendered v1.36.0 Markdown review
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Problem:
The v1.36 candidate repeatedly failed the Windows full-suite gate, while the trusted provider benchmark could never complete its documented fixed suite after the corpus expanded.
Root cause:
One merge-back test depended on merge --abort resetting a prepared tree on Windows, two concurrency checks used runner-sensitive wall-clock ceilings, and the e2e workflow omitted the five-task filter while rejecting all budget-skipped tasks.
Fix:
Use merge --quit to preserve the prepared state before deterministic branch drift, assert busy-lock behavior through an event with a generous outer watchdog, widen only the concurrency suite watchdog, and pin the e2e workflow to its historical five-task release baseline with a contract test.
Verification:
go test ./... -count=1
go test -race ./internal/worktree ./internal/agent ./internal/serve -count=1
go test ./cmd/e2ebench -count=5
go vet ./...
bash scripts/release-workflows.test.sh
go run ./tools/repolint
git diff --check
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Problem:
Cross-platform lint rejected the desktop session-context helper on Windows and macOS build-tag passes.
Root cause:
The new test used an index-based reverse slice loop that the repository modernize linter flags outside the default Linux lint pass.
Fix:
Iterate with slices.Backward while preserving the exact newest-valid-context lookup behavior.
Verification:
- cd desktop && GOOS=windows golangci-lint run --timeout=5m ./...
- cd desktop && go test . -run SessionContext -count=1
- git diff --check
Problem:
The stricter excluded-skill catalog assertion failed on native Windows because the fixture only redirected HOME, while Windows resolves user roots through USERPROFILE and AppData.
Root cause:
The old system-prompt substring assertion could pass accidentally on the word keep, masking that the intended global skill fixture was outside the discovered Windows root.
Fix:
Use the shared cross-platform config-home isolation helper and write the retained skill under the resolved Reasonix home.
Verification:
- go test ./internal/boot -run TestBuildOmitsExcludedSkillRootsFromContextAndRuntimeList -count=1
- git diff --check
Problem:
Dynamic workspace, environment, memory, and skill catalogs were assembled into the system prompt. That made cross-session prefixes unstable and left skill catalogs stale after startup.
Root cause:
Boot-time prompt composition mixed standing policy with mutable runtime data, while resume and compaction had no versioned host snapshot contract.
Fix:
Introduce deterministic v1 session-context snapshots, live role-specific turn injection, digest deduplication, resume/compaction projection support, Anthropic cache boundaries, and content-free diagnostics. Keep standing instructions and invocation policy in the stable system prompt.
Verification:
- go test ./...
- cd desktop && go test ./...
- go test -race ./internal/agent ./internal/control
- pnpm typecheck && pnpm test:typecheck
- make lint
- scripts/cache-guard.sh
- 113 successful bounded real-provider requests across DeepSeek, LongCat, and Zhipu Coding Plan
Problem:
- main-v2 advanced again after the copy fix was validated, leaving the pull request behind the current base immediately before push.
Root cause:
- PR #9689 merged concurrently and touched shared CLI lifecycle files.
Fix:
- Merge main-v2 at 8447dc664 and retain the reviewed source-aware selection-copy paths without conflicts.
Verification:
- make lint
- go test ./internal/cli -count=1
- go test -race ./internal/cli -count=1
- go vet ./internal/cli
- go test ./... -count=1
- go vet ./...
- git diff --check
Refs #9244
Problem:
- The updated connector path left rewriteTranscriptBlock unused, and the current linter rejected a HasPrefix/TrimPrefix pair.
Root cause:
- Connector rewrites now preserve copy metadata through rewriteConnectorBlock, making the old text-only helper obsolete.
- main-v2 enables the modernize string-prefix rule.
Fix:
- Remove the unused helper and use strings.CutPrefix while retaining the same copy-span indentation behavior.
Verification:
- make lint
- go test ./internal/cli -count=1
- go test -race ./internal/cli -count=1
- go vet ./internal/cli
- go run ./tools/repolint
Refs #9244
Problem:
- PR #9640 was 88 commits behind main-v2, so its copy-path changes had not been validated against the current CLI implementation.
Root cause:
- The feature branch predated recent TUI lifecycle, clipboard, and desktop changes.
Fix:
- Merge the current main-v2 tip without conflicts and retain the source-aware selection-copy implementation and regression coverage.
Verification:
- go test ./internal/cli -count=1
- go test -race ./internal/cli -count=1
- go vet ./internal/cli
- go test ./... -count=1
- go vet ./...
- go run ./tools/repolint
- Windows 11 clip.exe preserved CJK, │, and ▎ from UTF-8 input; WSL was not installed, so WSL end-to-end remains unverified.
Refs #9244
Problem:
- Character-based gutter stripping silently removed legitimate lines beginning with │, ▎, or ⎿.
- Multi-line tool and reasoning connectors retained one leading space on the first line and five on continuation lines.
Root cause:
- Selection copy inferred decoration from the copied characters after provenance had been discarded.
- Connector continuation padding was not represented by the single-glyph heuristic.
Fix:
- Extend the existing copy-only span rendition to mark renderer-owned gutters explicitly while keeping display fallback byte-faithful.
- Preserve copy renditions for live tool blocks and regenerate semantic Markdown and reasoning spans on demand.
- Move selection-copy ownership into a focused module and cover rendered, replayed, fallback, literal-glyph, connector, and CJK UTF-8 paths.
Verification:
- go test ./internal/cli -count=1
- focused copy tests under go test -race
- go vet ./internal/cli
- go run ./tools/repolint
Refs #9244
Problem:
GetPinnedFilesForTab could publish a stale sidecar snapshot after a newer Pin, Unpin, or session binding updated the tab cache.
Root cause:
The read API wrote its unlocked sidecar result back into tab-local state without participating in runtime mutation serialization.
Fix:
Keep GetPinnedFilesForTab read-only and add a regression test proving a stale snapshot cannot overwrite a newer cached selection.
Verification:
- focused tests repeated 20 times
- focused race tests repeated 10 times
- root and Desktop Go suites
- make lint
- git diff --check
Problem:
- Controller-dispatched queued turns could stream while the TUI still appeared idle, allowing a new Enter to race admission and interrupt or lose queued work.
- Batched lifecycle events and stale timer callbacks could leave the UI in the wrong state or multiply heartbeat chains.
Fix:
- Apply TurnStarted and TurnDone transitions in event order and tag elapsed ticks by turn generation.
- Route busy-window submissions through durable, level-triggered follow-up dispatch.
- Preserve raw prompts, paste ownership, and subsequently typed drafts across asynchronous queue fallback.
- Preserve the remote session reclaim guard while integrating the latest main-v2 session takeover flow.
Verification:
- Full PR CI passed across Linux, macOS, and Windows, including race, coverage, CodeQL, desktop, and Windows control jobs.
Refs #9575
Problem:
The Windows desktop build produced an initial gzip payload just above the 462.6 KiB decimal boundary even though the displayed measurement rounded to the same value as the gate.
Root cause:
Embedded build metadata changes the Windows initial chunk by a few bytes, while the merged Sticky Context and session takeover budget had no cross-platform decimal headroom.
Fix:
Raise only the combined initial gzip gate by one decimal step to 462.7 KiB. Keep locale, raw, largest-chunk, and CSS gates unchanged.
Verification:
The stable and test-channel builds pass locally, repolint remains clean, and the Windows CI log identifies bundle-budget enforcement as the only failed step.
Problem:
Users could not safely resume an active SSH or Serve session from another Reasonix runtime without manually finding and terminating the original process.
Root cause:
Session leases enforced single-writer safety but had no targeted cooperative handoff, generation-fenced mirroring, or spectator/reclaim lifecycle shared by Serve, Desktop, and CLI.
Fix:
Add failure-atomic targeted lease transfer, bounded non-blocking transcript mirroring, synchronous read-only spectator state, and cooperative reclaim across local, remote, and CLI entry points. Acquire ownership before loading resumes, drain all runtime work before return, and preserve the previous spectator/controller on failed promotion.
Verification:
- Required CI passed across Linux, macOS, and Windows
- Desktop, race, lint, coverage, CodeQL, cache-impact, and documentation-impact checks passed
- Focused deterministic takeover and rollback regressions passed
Fixes#9477
Co-authored-by: SivanCola <[email protected]>
Co-authored-by: Linearleaf <[email protected]>
Problem: The latest main-v2 slash-completion work and the history-rebuild synchronization landed in files already at their repolint size ceilings.
Root cause: Cohesive slash argument, history rebuild lifecycle, and copy visibility helpers still lived in oversized aggregate files, so the merge commit exceeded existing per-file budgets.
Fix: Extract those helpers and their focused tests into small ownership-specific files without changing behavior or increasing the repolint baseline.
Verification: Root and Desktop go test ./..., Frontend test:all, focused race tests, native and Windows vet, root and Desktop golangci-lint, repolint, stable/test builds, and bundle budgets all pass.
Problem: The Linux desktop suite could finish a history-slice test while its asynchronous display-index repair was still publishing an atomic sidecar, racing testing.TempDir cleanup.
Root cause: Single-flight rebuild bookkeeping exposed only membership, so tests had no deterministic completion signal for an accepted background repair.
Fix: Store a completion channel per in-flight repair, close it after all file work finishes, and make live-history test cleanup await every accepted repair before releasing the controller and temporary directory.
Verification: Related history-slice tests passed 100 iterations; focused race tests, Desktop go test ./..., go vet, golangci-lint, gofmt, and git diff --check all pass.
* perf(cli): cache slash arg-completion data across keystrokes / 缓存斜杠参数补全数据
Closes#9503
* fix(cli): scope slash argument snapshots to popups
Problem: /effort still loaded configuration on every keypress, while argument snapshots could remain stale after a completion popup closed.
Root cause: the shared effort completion helper resolved configuration during filtering, and the TUI cache was keyed only by model instead of popup lifecycle.
Fix: pass effort levels through ArgData, refresh dynamic argument data for each newly opened popup, and cover the CLI and Desktop callers.
Verification: go test ./...; go test -race ./internal/cli ./internal/control; cd desktop && go test ./...; go vet ./...; make lint; focused Desktop vet and lint; slash completion benchmarks.
* fix(cli): preserve slash cache across empty filters
Problem:
- Slash argument input still rebuilt dynamic completion data after a filter returned no candidates.
- Free-form slash commands eagerly assembled ArgData even though they never expose structured suggestions.
Root cause:
- The cache generation was tied to visible popup state rather than the structured command editing session.
- SlashArgItems received an already-built ArgData value before it classified the command.
Fix:
- Track argument snapshot ownership by command context and clear it only on explicit dismissal, input reset, invalidation, or context change.
- Add lazy ArgData resolution so free-form and static structured commands skip dynamic data assembly.
- Add deterministic regressions for empty-filter continuity and free-form command gating.
Verification:
- go test ./internal/control ./internal/cli -count=1
- go test -race ./internal/cli ./internal/control -count=1
- go test ./... -count=1
- cd desktop && go test ./... -count=1
- make lint
- cd desktop && go vet ./... && golangci-lint run --timeout=5m ./...
Problem: Host-authored pinned revisions could surface as user messages in history, export, replay, search, diagnostics, and session tools. Legacy projections could cover revisions without authenticating their pinned state, FIFO paths could block before validation, and a failed legacy sidecar migration could drop the only persisted pin list.
Root cause: Several consumers still classified every user-role message as user-authored, projection compatibility only checked the canonical prefix hash, confined Unix opens were blocking, and the tab upgrade field was cleared before migration was durably published.
Fix: Filter pinned revisions from user-facing and retrieval surfaces, reject legacy projections that cover revisions, open Unix candidates nonblocking before regular-file validation, and retain pending legacy pins until a valid session sidecar exists. Reconcile the latest main-v2 bundle budget from stable and test build artifacts.
Cache impact: Ordinary pinned-context updates remain append-only and do not rewrite prior provider-visible bytes. Rebuilding an unsafe legacy projection is a one-time compatibility cache break; stable v4 projections keep the existing cache behavior.
Verification: Root and Desktop go test ./..., focused race suites, Frontend test:all, stable/test builds, go vet, golangci-lint, Windows vet, repolint, gofmt, and git diff --check all pass.
Integration: Merge main-v2 at f8d0419c without rebasing the contributor branch. Preserve the latest transcript-selection ownership changes and resolve the bundle-budget conflict from measured stable and test builds.
Verification: pnpm build passed for stable and test channels at 461.6 KiB gzip and 2465.9 KiB raw.
* fix(desktop): retain transcript anchor on plain click
Problem:
After manual reader scroll, a plain transcript click could snap Virtuoso back to a stale pre-wheel anchor.
Root cause:
Pointerdown claimed selection scroll ownership before a non-collapsed range existed, releasing the retained reader layout lease during an ordinary click. Settled selections also retained a historical ownership flag that could release a later reader lease again.
Fix:
Keep pointerdown provisional, claim selection ownership only for active native or logical ranges, mark ownership released when a gesture settles, and make later selection cleanup respect that state. Add deterministic and Chromium/WebKit regressions, stabilize the retained-heap sample without relaxing its 2 MiB gate, and integrate the narrow bundle ratchets with the latest main-v2 baseline.
Verification:
- pnpm test:transcript
- pnpm build
- REASONIX_CHANNEL=test pnpm build
- PLAYWRIGHT_BROWSERS_PATH=.pw-browsers pnpm test:transcript-browser
- PLAYWRIGHT_BROWSERS_PATH=.pw-browsers REASONIX_TRANSCRIPT_READER_ITERATIONS=0 pnpm test:transcript-reader-browser
- go run ./tools/repolint
* fix(desktop): preserve settled reader intent on click
Problem:
A plain transcript click after reader scrolling could recreate reader intent even though no selection owned the scroll surface. This permanently suppressed steady-state anchor compensation.
Root cause:
The provisional pointerdown path called the streaming and tail-follow cancellation callback before a non-collapsed selection claimed scroll ownership.
Fix:
Defer cancellation to the selection ownership claim. Add deterministic callback-count coverage and Chromium/WebKit assertions that a settled reader intent stays false while the layout lease, scroll offset, and visible anchor remain stable.
Verification:
- pnpm test:transcript
- pnpm test:typecheck
- pnpm build
- REASONIX_TRANSCRIPT_READER_ITERATIONS=0 pnpm test:transcript-reader-browser
- git diff --check
Problem:
Switching to a live session blocked on Ask could transiently fail to open and require a second click.
Root cause:
The activation-ready hydrate performed another replace-surface reset, which could erase an Ask that arrived after the ticket while an earlier agent-ready history projection was still settling.
Fix:
Keep terminal activation as the fresh generation-fenced hydrate, but use preserve-current so its logical reset is deferred and skipped while a live Ask owns foreground runtime state.
Verification:
- topic activation regression: 31 passed
- related navigation and prompt suites: 209 passed
- full frontend test suite, remote tests, performance checks, and production build passed
- typecheck, hooks lint, repolint, and diff check passed
* fix(cli): graceful watchdog exit and clock-jump tolerance / watchdog 优雅退出与时钟跳变容忍
Closes#9233
* fix(cli): make watchdog fallback non-blocking
Problem:
- A wedged Bubble Tea event loop could block the graceful shutdown send before the hard-kill fallback was armed.
- Suspending before the first watchdog tick could be mistaken for a real stall.
Root cause:
- doKill scheduled Program.Kill only after Program.Send returned, and tickLastSeen had no arm-time baseline.
Fix:
- Register the fallback before sending the graceful shutdown request.
- Seed the tick baseline when the watchdog starts and absorb gaps at the stall boundary.
- Add deterministic tests for a blocked shutdown and first-tick suspend.
Verification:
- go test ./internal/cli -count=1
- go test -race ./internal/cli -count=1
- go vet ./internal/cli
* fix(cli): preserve graceful watchdog shutdowns
Problem:
- The watchdog fallback fired after three seconds even while the TUI was completing a valid bounded final snapshot.
- Program.Kill could win after the snapshot returned but before Bubble Tea consumed tea.Quit, producing ErrProgramKilled and hiding save failures.
Root cause:
- The fallback had no completion handshake with tuiShutdownMsg and the TUI used the non-recovering Snapshot path.
- The fallback grace was shorter than the five-second compatibility-lock wait.
Fix:
- Arbitrate graceful completion and hard-kill fallback with a single atomic completion token.
- Use SnapshotForShutdown, retain and report final-save errors after terminal release, and allow the bounded recovery path to finish.
- Add deterministic Bubble Tea and blocked-shutdown regression coverage.
Verification:
- go test ./...
- go test -race ./internal/cli
- go vet ./...
- go run ./tools/repolint
- focused watchdog shutdown tests, 100 runs
Co-authored-by: esengine <[email protected]>
* test(cli): satisfy shutdown wrapper lint
Problem:
- CI staticcheck rejected the Bubble Tea shutdown test wrapper with QF1008.
Root cause:
- The test selected an embedded chatTUI field explicitly before calling its promoted update method.
Fix:
- Call the promoted update method directly without changing test behavior.
Verification:
- golangci-lint run --timeout=5m with an isolated cache
- go test ./internal/cli
- focused race tests
- go vet ./...
- go run ./tools/repolint
---------
Co-authored-by: esengine <[email protected]>
Problem:
Desktop pin state was assembled into system prompts during startup and rebuilds, with incomplete session lifecycle coverage and file reads vulnerable to path-validation races.
Root cause:
Controller and boot APIs transported serialized pinned prompt text instead of loading the active session sidecar at the admitted turn boundary.
Fix:
Inject a session-aware snapshot loader through every boot path, read workspace files through confined handles, keep sidecars across fork/recovery/rename/trash lifecycles, initialize new/cleared sessions empty, hide revisions from history UI, and record one legacy system migration boundary.
Cache impact:
Pin, unpin, and file changes now take effect on the next accepted turn by appending a revision. They never mutate messages[0]; unchanged snapshots append no revision.
Verification:
Desktop full suite and race tests; frontend test:all and production build (459.0 KiB gzip, 2456.7 KiB raw); go vet, repolint, golangci-lint, Darwin and Windows cross-platform legs.
Co-authored-by: SivanCola <[email protected]>
Problem:
Canonical pinned deltas must survive repeated compaction without being copied into summaries, duplicated in projections, or silently omitted from token budgets.
Root cause:
The projection schema had no authenticated pinned-state checkpoint at its canonical coverage boundary.
Fix:
Upgrade projections to v4, exclude pinned bodies from summary requests, reconstruct one full checkpoint at CoveredCount, preserve newer deltas exactly once, validate host provenance, and count checkpoint bytes in compaction acceptance.
Cache impact:
Pinned deltas remain append-only. Compaction is still the intentional low-frequency cache-break boundary and now records non-prefix summary input when pinned revisions were excluded.
Verification:
Projection rebase, double-compaction, tamper, budget, delta equivalence, and exact provider-prefix tests; full Go suite and race detector.
Co-authored-by: SivanCola <[email protected]>
Problem:
Pinned file changes rewrote the leading system message, invalidating every provider-visible prefix byte and coupling session state to prompt assembly.
Root cause:
Pinned context had no canonical append-only protocol or transcript-derived applied state, so prompt replacement was the only update mechanism.
Fix:
Add deterministic host-origin delta/checkpoint revisions, bounded XML parsing, immutable staged snapshots, atomic revision-plus-user appends, and user-authored message classification for hidden revisions.
Cache impact:
Ordinary pinned updates append new bytes without rewriting prior provider requests. System prompt changes and transcript rewrites remain explicit cache-break boundaries.
Verification:
go test ./...; go test -race ./internal/agent -run 'PinnedContext|AgentBeforeStartBlock|Compaction'; golangci-lint and repolint.
Co-authored-by: SivanCola <[email protected]>
Problem:
- Wayland image paste recognized only PNG and empty clipboard fallbacks failed silently.
- Unsupported image formats blocked valid text paste and exposed clipboard-controlled MIME names to the terminal.
- A late terminal paste could leave a stale empty-result notice.
Root cause:
- Image target negotiation had no typed distinction between a missing supported image and an unsupported advertised format.
- Clipboard target names were rescanned quadratically and rendered without escaping.
- The guarded text completion checked its payload before validating the terminal paste generation.
Fix:
- Negotiate PNG, JPEG, GIF, and WebP targets while preserving typed unsupported-format diagnostics through the normal text fallback.
- Quote clipboard-provided MIME names and sanitize clipboard failures before TUI rendering.
- Validate pending paste generations before handling remote, error, or empty results.
Verification:
- go test ./...
- go test -race ./internal/cli ./internal/control
- go vet ./...
- make lint
Closes#8377
Problem:\nThe full Desktop race suite detected a data race when a deterministic pinned-file test restored its global read hook while an asynchronous metadata refresh was still loading it.\n\nRoot cause:\nThe test injection hook was a plain package-level function variable accessed concurrently by production read paths and test cleanup.\n\nFix:\nStore and load the optional hook through an atomic pointer. The hook invocation remains outside application locks and cleanup can safely clear it while background refreshes finish.\n\nVerification:\n- go test -race . -run '^TestNewSessionWaitsForPinAndClearsItsResult$' -count=10\n- go test -race . -run 'Pinned|NewSessionWaitsForPin|RunningClear|DesktopPinAPI' -count=1\n- go test ./... -count=1 (desktop)\n- GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go test -c .\n- git diff --check
Problem:\nThe pinned-context XML escaping test used characters that Windows rejects in filenames, so the Windows desktop suite failed before exercising the implementation.\n\nRoot cause:\nThe fixture combined content-level XML injection characters with a path fixture that was only valid on Unix-like filesystems.\n\nFix:\nUse an ampersand and quotes that are valid across supported platforms while still requiring XML attribute escaping. Keep the file body coverage for closing-tag, quote, ampersand, and angle-bracket injection.\n\nVerification:\n- go test . -run '^TestPinnedContextXMLIsWellFormedAndEscaped$' -count=1\n- GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go test -c .\n- git diff --check
Problem:
- The workspace context-menu suite crashed because its Wails mock did not include the pinned-files query.
Root cause:
- Sticky pinning added a mount-time bridge call and a new menu item without extending this isolated test fixture.
Fix:
- Return an empty pinned-file list from the fixture and include the Pin action in the expected command order.
Verification:
- pnpm exec tsx src/__tests__/workspace-context-menu.test.tsx
- pnpm test:all
- go test ./...
- go test ./desktop -count=1
- make lint
Problem:
- Pinned files were tab metadata, so session switches, rebuilds, and recovery paths could leak or lose context.
- Prompt mutation relied on delimiter surgery and path validation raced the actual file read.
Root cause:
- Pinned context had no session-owned lifecycle and was folded directly into the base system prompt.
- File validation and prompt refresh were not coordinated with turn admission.
Fix:
- Persist versioned pinned-context sidecars through every session lifecycle and migrate legacy tab data once.
- Separate base and pinned prompts, refresh before local turns, and preserve projection updates.
- Read validated file handles, encode deterministic XML, enforce count and byte budgets, and surface retained-file errors.
Verification:
- go test ./...
- go test ./desktop -count=1
- go test -race ./internal/control ./internal/fileutil and focused desktop races
- frontend pnpm test:all and pnpm build
- make lint, repolint, and cross-platform lint/type checks
Problem:
The pinned CI modernize linter rejected the manual reverse loop used to release repair generation locks.
Root cause:
The new helper used index arithmetic instead of the repository's Go 1.26 slices.Backward convention.
Fix:
Release generation locks through slices.Backward while preserving reverse lock-order semantics.
Verification:
golangci-lint run --timeout=5m ./...
go test ./internal/sessioncatalog -run 'TestRepairBatchGenerationGuardHoldsThroughCommit|TestRepairBatchRejectsStaleClaimAfterSourceAdvance|TestRepairBatchRejectsExpiredClaimOwner' -count=10
Problem:
Repair results could be published after a foreground source advance, low-priority repair could wait behind the metadata lock while holding save locks, and a late older reconcile request could replace the newest target.
Root cause:
Publication validated source fingerprints without holding the agent writer lock through the SQLite commit; repair used the blocking metadata lock; reconcile dirty state assigned targets without a monotonic generation comparison.
Fix:
Fence source generations through repair commit, make repair metadata acquisition non-blocking, and retain the highest mutation sequence across queued and dirty reconcile state. Add deterministic regression coverage for each boundary.
Verification:
go test -race ./internal/agent ./internal/sessioncatalog -count=1
go test ./... -count=1
go vet ./...
go run ./tools/repolint
cd desktop && go test ./... -count=1
cd desktop/frontend && pnpm test:all && pnpm typecheck && pnpm build
Problem: Restricted read strategy receipts could accept stale windows when content changed without a size or mtime change, and grep could search disk while read_file observed an unsaved editor overlay.
Root cause: Receipt validation trusted stat metadata without re-reading stored line hashes, while the workspace grep tool was not wired to FileOverlay.
Fix: Re-read every cited window through the original read_file tool outside the state lock, compare host-only line hashes under an evidence revision, and make exact-file grep prefer the confined overlay with disk fallback.
Verification: focused agent and builtin tests; focused race tests; go test ./...; go vet ./...; make lint; cd desktop && go test ./...
Problem:
The TUI hid /preset from completion and help and did not show the active delivery floor, so a valid preset switch looked ineffective.
Root cause:
The slash registry still treated /preset as hidden, SlashArgItems exposed no preset choices, and the footer omitted the controller quality floor.
Fix:
Expose the canonical /preset command while keeping legacy aliases hidden, add standard and delivery argument completion, render a delivery-only PRESET tag, and update i18n, docs, and focused coverage.
Verification:
- go test ./internal/cli ./internal/control ./internal/i18n -count=1
- go test -race ./internal/cli ./internal/control -count=1
- make lint
- git diff --check
Closes#9212
Problem: Long read_file results could be truncated into a provider-visible preview and then silently treated as complete, allowing later rules to be missed.
Root cause: RawContent recovery was advisory. The host had no incomplete-read state, no completion gate, and recorded text observations before the model had consumed every retained page.
Fix: Add deterministic dynamic-budget recovery, restricted grep/read strategy receipts, host-level write/final-answer gates, exact contiguous cursors, and bounded streaming read_file/grep decoding without fixed 128 KiB or 32K token product limits.
Verification: go test ./...; go test -race ./internal/agent for incomplete-read coverage; go vet ./...; make lint; cd desktop && go test ./...
Problem:
The 49 MiB cancellation regression polled for transcript publication with a fixed five-second deadline. Linux race instrumentation could spend longer decoding the source and fail before exercising publication cancellation.
Root cause:
The test inferred the publish boundary from wall-clock timing and temporary-file polling instead of synchronizing with the boundary it needed to cancel.
Fix:
Add a context-scoped internal publish hook and use it to hold the repair immediately after the transcript temp file is created. Cancel from that deterministic point so cleanup and lock release are tested independently of decode speed.
Verification:
- go test ./internal/agent -run TestRepairSessionListingProjectionCancelsDuringPublish -count=1
- go test -race ./internal/agent ./internal/sessioncatalog -count=1
- go test ./...
- go vet ./...
- go run ./tools/repolint
- cd desktop && go test ./...
- cd desktop/frontend && pnpm test:all && pnpm typecheck && pnpm build
Problem:
Repair results could outlive their claim or source generation, large replay publication ignored cancellation, equal-mtime display indexes were accepted, and preferred recovery validation duplicated transcript loads.
Root cause:
Claims had no CAS ownership token at publication, repair returned no lock-captured disk generation, persistence helpers used background-only writes, and catalog/UI fast paths used incomplete freshness ordering.
Fix:
Fence claims and batches with the existing v11 tuple plus final content/meta fingerprints, make transcript and sidecar publication context-aware, reject equal-mtime indexes, reuse the strict wave snapshot for recovery preference validation, and restore catalog notice priority. Prepared statements keep the 1,056-row wave below its prior baseline.
Verification:
- go test ./...
- go test -race ./internal/agent ./internal/sessioncatalog -count=1
- go vet ./...
- go run ./tools/repolint
- cd desktop && go test ./...
- cd desktop/frontend && pnpm test:all && pnpm build
- session catalog benchmarks, count=3 with benchmem
Problem:
Nested task dispatchers still rejected unknown subcommands without naming accepted operations, and stderr behavior lacked regression coverage.
Root cause:
The original change updated only the outer task dispatcher. The monitor, tmux, and machine task paths still owned separate messages, while tests captured only stdout.
Fix:
Share each task usage string across missing and unknown paths, name valid machine task operations, and cover the JSON and stderr contracts.
Verification:
- go test ./internal/cli
- go test -race ./internal/cli
- go vet ./...
- make lint
- go test ./...
Problem:
SSH-hosted TUI redraws can flicker because synchronized-output wrapping is never enabled when the upstream terminal capability is hidden by the remote session.
Root cause:
Bubble Tea skips the DEC mode 2026 capability query over SSH, so the renderer never learns that the local Windows Terminal supports synchronized output.
Fix:
Inject the same mode report a supporting terminal would send for SSH sessions, preserve an explicit REASONIX_DISABLE_SYNC_OUTPUT opt-out, and document it alongside the SSH mouse defaults.
Verification:
- go test ./internal/cli -count=1
- go test -race ./internal/cli -count=1
- Windows 11 Windows Terminal split-pane SSH/pwsh7 A/B validation
Closes#8405
Problem:
- The CI lint job found obsolete wrappers and modern Go style violations left by the owner-file split.
Root cause:
- Local vet and repolint do not enable golangci-lint intrange, modernize, and unused checks.
Fix:
- Use integer ranges and maps.Copy, and remove three superseded private helpers.
Verification:
- golangci-lint run --timeout=5m
- go test ./internal/agent ./internal/sessioncatalog -count=1
- go vet ./...
- go run ./tools/repolint
Problem:
- CodeQL treated the compact replacement-string form as incomplete escaping.
Root cause:
- The equivalent replacement syntax hid the intentional character-by-character whitespace escape from static analysis.
Fix:
- Restore the explicit callback while preserving Windows backslashes and the existing ref-token grammar.
Verification:
- pnpm exec tsx src/__tests__/ref-token.test.tsx
- pnpm typecheck
- pnpm build
Problem:
- Periodic catalog reconciliation could replay every recovery transcript while the app was idle.
- Failed repair publication could leave claimed rows active without a same-process recovery path.
- Equal-generation indexes, stale reconcile tokens, and repair-first UI priority could publish stale or misleading state.
Root cause:
- Reconcile waves did not retain a process-local strict verification identity or reuse decoded lineage snapshots.
- Repair claims were not leases and publication failures were swallowed before commit ownership was known.
- Display scanning, index freshness, queue coalescing, and presentation priority used incomplete generation semantics.
Fix:
- Cache strictly verified directory signatures per scope and reuse one content snapshot per recovery wave.
- Treat active retry timestamps as expiring leases, propagate transaction failures, and publish only committed batches.
- Make display/index scans fail closed, coalesce the newest reconcile target, and preserve global catalog failures in the UI.
- Split owner files, add deterministic F1-F6 regressions, and keep exact lint and bundle budgets.
Verification:
- go test ./...
- go test -race ./internal/agent ./internal/sessioncatalog
- cd desktop && go test ./...
- cd desktop/frontend && pnpm test:all && pnpm build
- go vet ./...
- go run ./tools/repolint
Co-authored-by: ttmouse <[email protected]>
Co-authored-by: cyq1017 <[email protected]>
`hook`, `session` and `task` reject an unrecognised operation without saying
what is accepted:
$ reasonix hook bogus --json
{"error":{"code":"unknown_command","message":"unknown hook operation"}}
$ reasonix task bogus
unknown task subcommand: bogus
The caller has to read source or guess. It also makes `--help` a dead end on
these commands, since they are machine interfaces with no usage text: typing
`reasonix hook --help` returns "unknown hook operation" and nothing more.
taskMonitorCommand, immediately below the task dispatcher it shares a file
with, already prints its own subcommand list on the same kind of failure, so
this brings the three outer dispatchers in line with the convention already
present in the package.
The rejected operation is echoed back and the machine error code is unchanged,
so JSON consumers keep the same contract.
Problem:
Ask submission failures introduced by transactional recovery were rendered in English regardless of the desktop locale.
Root cause:
The controller assembled the warning with a hard-coded prefix outside the localization dictionary.
Fix:
Route the warning through a shared notice key for English, Simplified Chinese, and Traditional Chinese, and cover the active-locale controller path. Raise the raw startup budget by the minimum 0.1 KiB ratchet for the measured 2456.044 KiB payload.
Verification:
- pnpm exec tsx src/__tests__/use-controller-send-fallback.test.tsx
- pnpm test:all
- pnpm typecheck
- pnpm build
- go run ./tools/repolint
- git diff --check
Stop idle repair hot loops by healing recovery ledgers and using a single context-aware repair path.
Persist repair backoff in catalog schema v11, batch catalog publication, and coalesce directory reconciliation.
Expose active, deferred, and blocked repair states to desktop while keeping deferred failures from blocking catalog readiness.
Problem: the Ask recovery regression coverage and controller wiring exceeded the repository file-size ratchets, and the extracted implementation briefly exceeded the raw startup budget.
Root cause: the legacy controller and remote integration test already sat exactly at their baselined limits, so even bounded recovery logic created new repolint findings.
Fix: extract rejected-submit settlement and retry lookup, move submit normalization into the inbox boundary, fold the remote failure case into the existing Ask scenario, and reduce emitted code without widening the repolint or final bundle limits.
Verification: pnpm test:all; pnpm build; go run ./tools/repolint.
Problem: Ask answers and skips could clear the decision surface before the bridge accepted them, then replay the prompt while a previous turn was still authoritative.
Root cause: Ask submission was optimistic and unfenced when the local turn id was missing, while rejected sends were settled as idle before ListTabs reconciled backend state.
Fix: resolve exact turn fences, keep Ask state transactional across failures, fence prompt cleanup by id and epoch, and reconcile rejected submissions through bounded authoritative runtime reads.
Verification: pnpm test:all; pnpm build; go test ./internal/control Ask persistence cases; cd desktop && go test ./...; Wails production build and isolated startup; headless Chromium two-question submit and skip smoke.
Problem: completion validation could depend on host text prefixes, leak through the public event wire, lose nested audit signals, and let unavailable validators look successful.
Root cause: persisted messages lacked structured provenance, optional sink capabilities were not preserved end-to-end, and CLI/telemetry completion semantics were incomplete.
Fix: add cache-neutral message origins with legacy fallback, host-only completion audits, fail-closed bounded repair, isolated evaluator telemetry, non-interactive failure status, compatibility coverage, and exact quality budgets.
Verification: root and desktop Go suites, vet, lint, repolint, cache guard, frontend test/build/bundle gates, a 360-call two-model live matrix, and two live Agent bounded-continuation integrations passed.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Problem:
The headless checkpoint test read through Controller.Checkpoints, whose display cleanup could hide a composed prompt persisted by runReady.
Root cause:
Coverage did not inspect the checkpoint manager's stored metadata while forcing Compose to add a transient prefix.
Fix:
Run a headless turn with reasoning-language composition, prove the runner receives the composed input, and assert the underlying checkpoint stores only the user's raw prompt.
Verification:
- go test ./internal/control -run 'TestHeadlessRunStoresRawCheckpointPrompt|TestHeadlessRunOpensCheckpoint|TestStripComposePrefixesOrdering|TestCheckpointsReturnUserPromptWithoutComposedPrefixes|TestTurnOrchestratorCheckpointPromptIsRawUserInput' -count=1
- go vet ./internal/control
- go run ./tools/repolint
- git diff --check
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
* feat(desktop): support forking sessions into isolated git worktrees
* feat(desktop): add fallback notice and guidance when git environment is missing
* chore(frontend): grant cross-platform toolchain headroom for worktree bundle budgets
* fix(desktop): make isolated conversation forks safe
Problem:
The isolated conversation fork could not pass the generated Wails contract, silently omitted dirty source changes, and left newly created worktrees behind when session attachment failed.
Root cause:
Isolation was tunneled through an extra ForkForTab argument while the backend exported a different method, and worktree creation had no explicit dirty-source, registration, or failure-atomic lifecycle.
Fix:
Use a dedicated typed fork result, refuse dirty sources with actionable guidance, preserve shared fallback behavior, persist isolated projects, and roll back only exact untouched worktrees. Add generated-contract, persistence, rollback, documentation, and bundle-budget coverage.
Verification:
- go test ./...
- cd desktop && go test ./...
- go test -race ./internal/worktree -count=1
- cd desktop && go test -race . -run TestForkWorktreeForTab -count=1
- cd desktop/frontend && pnpm build
- cd desktop/frontend && pnpm test:isolated-worktree
- go run ./tools/repolint
Co-authored-by: SivanCola <[email protected]>
* fix(desktop): make isolated fork cleanup lossless
Problem:
Ignored files could be deleted by rollback, and a source-tab close after fork metadata was saved could remove a worktree still referenced by the recovery session. The PR also raised repolint allowances instead of preserving the existing ratchet.
Root cause:
Rollback inspected only normal untracked files, while tab publication did not report whether BranchMeta had already made the isolated root durable. Fork UI and controller logic also accumulated in oversized owner files.
Fix:
Treat ignored and all untracked content as rollback blockers, persist the isolated project before tab publication, and skip cleanup once the fork metadata references the workspace. Add deterministic race coverage, share fork action presentation and settlement helpers, and restore the main-v2 repolint baseline.
Verification:
- go test ./...
- go test -race ./internal/worktree -count=1
- cd desktop && go test ./...
- cd desktop && go test -race . -run 'TestForkWorktreeForTab|TestForkForTabDoesNotOverrideLaterActiveTab' -count=1
- cd desktop/frontend && pnpm test:isolated-worktree
- cd desktop/frontend && pnpm test:transcript
- cd desktop/frontend && pnpm build
- go run ./tools/repolint
* test(frontend): follow extracted fork bindings
Problem: The discovery-based frontend suite still expected ForkForTab to be called directly from useController after fork settlement moved to a dedicated owner.
Root cause: The tab-scoped binding contract assertion was not updated with the forkWorktree extraction.
Fix: Read the extracted fork owner and verify both shared and isolated two-argument bindings without expanding the repolint baseline.
Verification:
- cd desktop/frontend && pnpm exec tsx src/__tests__/app-chrome-tabs.test.ts
- go run ./tools/repolint
- git diff --check
Co-authored-by: SivanCola <[email protected]>
* test(frontend): accept resolved viewport limits
Problem
The updated DOM test runtime resolves min(62vh, 560px) to an absolute pixel value, while two decision-surface tests still expected the unevaluated CSS expression.
Root cause
The assertions depended on the old computed-style serialization instead of the effective viewport bound.
Fix
Compare the resolved numeric max height with the rounded 62vh/560px limit used by the test viewport.
Verification
pnpm exec tsx src/__tests__/ask-card-layout.test.ts
pnpm exec tsx src/__tests__/decision-surface.test.tsx
go run ./tools/repolint
---------
Co-authored-by: SivanCola <[email protected]>
Problem: main-v2 advanced again after the repair branch completed its local qualification.
Root cause: Historical Markdown rendering landed while PR #9654 was still under repair.
Fix: Merge e7eb57ad without rewriting the contributor branch and remeasure the combined frontend startup budgets at their smallest one-decimal gates.
Verification: gofmt -w .; go vet ./...; make lint; go test ./internal/tool/builtin/ ./internal/boot/ -count=1; pnpm build.
* fix(frontend): render historical markdown without waiting for the bottom (#9570)
MarkdownHistory deferred every parse commit until the reader scrolled
back to the bottom (2px epsilon), so any answer read while parked above
the bottom — after switching sessions back, or a natural session end —
stayed raw plain text until a manual scroll to the end.
The deferred handoff is now limited to the case it actually protects:
a long answer (more than one tail window) whose fallback marker is
inside the reader's viewport, where the tail-window swap would visibly
remove blocks and yank the scroller. Short answers (full document fits
the tail window) and off-screen rows commit as soon as the worker
lands.
- tests: mid-read fallback case now pins the marker inside the
viewport; new off-screen long-answer case asserts immediate commit
* fix(frontend): measure pending markdown rows in transcript viewport
Problem:
Historical Markdown could stay raw above the bottom, while long visible rows could swap unsafely because the visibility guard measured a display:none marker against the app window.
Root cause:
The hidden marker has an empty DOMRect in real browsers, and window.innerHeight is not the transcript viewport, so long rows were misclassified as offscreen.
Fix:
Measure the real Virtuoso transcript row against the transcript scroller. Commit short and offscreen histories immediately while conservatively deferring visible long rows to preserve the reader anchor. Add deterministic coverage for short, visible-long, and offscreen-long handoffs.
Verification:
- pnpm exec tsx src/__tests__/markdown-history.test.tsx
- pnpm typecheck
- pnpm check:scroll-writer
- pnpm test:transcript
- pnpm build
- pnpm test:transcript-browser
Co-authored-by: SivanCola <[email protected]>
* fix(frontend): honor reachable transcript tail for markdown swap
Problem: Long visible historical answers could remain on the plain-text fallback after the reader returned to the only native-reachable tail.
Root cause: MarkdownHistory used a private raw two-pixel bottom check instead of the transcript geometry contract that records small native tail clamps.
Fix: Reuse the shared native transcript distance and threshold, and cover an eight-pixel no-op native clamp in the deferred Markdown handoff test.
Verification: focused Markdown test, typecheck, scroll-writer gate, transcript suite, and production build passed.
---------
Co-authored-by: SivanCola <[email protected]>
Problem: The completion validator remained opt-in, could consume wrapped or truncated evidence, attributed child audits to the root sink, and treated evaluator unavailability inconsistently.
Root cause: Configuration defaulted to shadow, evaluator construction captured boot-time state, semantic evidence used prefix-only clipping, and generic telemetry batched evaluator events with root turns.
Fix: Default to enforce, fail closed on every unavailable or uncertain validator path, preserve raw visible evidence with UTF-8 head/tail budgets, isolate evaluator sessions and sinks, and persist content-free dedicated metrics immediately.
Verification: go vet ./...; make lint; go test ./internal/tool/builtin/ ./internal/boot/ -count=1; focused completion/config/agent/control/telemetry tests; desktop go test ./...; live 2-model 360-sample semantic matrix plus bounded host continuation tests.
Problem: PR #9654 diverged from the current main-v2 history and could not be evaluated or pushed as a clean non-force update.
Root cause: Session recovery and transcript ownership work landed on main-v2 after the completion-validation branch point.
Fix: Merge the current base, reconcile the shared frontend bundle gate semantically, and carry forward the combined repolint ownership baseline.
Verification: gofmt -w .; go vet ./...; make lint; go test ./internal/tool/builtin/ ./internal/boot/ -count=1.
* feat(agent,desktop): chunked session highlight extraction + live region budget (#9082, #9579)
save: the canonical transcript is summarized in exponentially decaying
chunks (64k newest → 128k → 256k → 512k → 768k oldest, 16k adjacent
overlap, message-aligned boundaries), each summarized with exactly one
provider request, and the fragment digests merge into a single
compaction-summary. The controller then rotates to a fresh session and
seeds it with the briefing, so work resumes without the over-window
transcript. Single-chunk transcripts take the fast path with the
canonical template verbatim.
into the Footer block; it keeps the most recent five rows (including
streaming content and queued follow-ups) while completed rows fall back
into the virtual list body exactly where they land once the turn
settles. Folded turns render compact headers, so their behaviour is
unchanged.
Also drops two controller tests that referenced
refreshMemorySystemPrompt — an implementation that only exists on the
feat/compact-refresh-memory branch — which broke control test
compilation since the v1.32 merge. The integrity checklist grows to 37
markers covering both features.
* fix(agent,desktop): /extract survives over-length sessions and syncs the desktop tab (#9082 follow-up)
ExtractHighlights fragments ride the same summarize path as in-place
compaction, so a fragment big enough to make the summarizer run into the
provider output-token limit (or, on small-window models, overflow the
input window) failed the whole extraction — the escape hatch was dead
exactly on the over-length sessions it exists for.
- extractFragmentResilient: on output truncation or compaction-required
errors the fragment splits in half, each half is extracted, and the
digests merge; depth bounded by the message count. Transport errors
still fail fast. The progress total grows with each split.
- desktop: handleTabSessionTransition bumps tab.SessionGeneration —
rotations initiated inside the controller (/extract's NewSession)
bypass the ClearSession wrapper, and without the bump the frontend
kept hydrating the stale transcript instead of the rotated session.
* fix(agent): tree-reduce merge keeps /extract intact when the digest set overflows the merge request (#9082 follow-up)
The final merge took every fragment briefing in one request. On
small-window models the set overflows the input window at ~15 fragments,
and a huge session with 100+ fragments pushes the merge output into the
provider limit — both failed the whole extraction with every briefing
already in hand.
- mergeInputBudget: half of the safe summarizer input per window; an
unknown window disables pre-splitting
- mergeFragments: while the set exceeds the budget, merge pairwise
(tree-reduce) until one briefing remains; each group that still fails
on truncation/overflow splits in half and recurses (mergeGroup)
- tests: grouped merge keeps every request inside the budget and skips
grouping when it already fits
* feat(agent): one /compact recovers over-length sessions via chunked-summary fallback (#9082 follow-up)
/extract required a separate command and a session rotation, and its
notices were easy to miss; /compact on the same sessions failed on
output truncation. Now the failure paths converge: when the single
fold summary hits the provider output limit or the fold overflows the
window, compaction falls back to the chunked extract strategy —
byte-budgeted fragments, resilient half-split retries, and a
tree-reduced merge — and the projection installs in the same session,
so the context panel drops and work continues in place.
- chunkedFoldSummary: the #9082 strategy over a fold slice (was
ExtractHighlights over a whole session; /extract removed — one
command, no rotation, no extra concept)
- compactToProjectionLocked falls back on truncated/overflow summary
errors and re-emits the telemetry for the chunked pass
- CompactionModeChunked marks projections installed via fragments
- end-to-end test: single-request truncation falls back and installs
* fix(agent,desktop): harden chunked compaction fallback
Problem:
- final digest merges could fail after all fragment briefings were collected
- fragment indexes rendered as quoted runes
- the removed /extract path left a dead desktop command and an unnecessary transition-generation bump
- the stacked branch depended on a dropped private compaction constant and exceeded repository lint budgets
Root cause:
- the final merge bypassed mergeGroup retry handling
- %q was used for an integer index
- the controller route was removed without deleting its UI/i18n and desktop handoff residue
- the stacked follow-up leaked implementation details from the commit removed during rebase
Fix:
- route every multi-part final merge through recursive mergeGroup recovery
- render decimal fragment indexes and own a local merge input floor
- remove the dead /extract surface and its transition-generation change
- extract the chunked fallback helper and simplify comments to keep repolint clean
Verification:
- go test ./... -count=1
- go test -race ./internal/agent (focused chunk/merge/fallback cases)
- cd desktop && go test ./... -count=1
- pnpm typecheck; pnpm test:transcript; 31 live-split tests
- go vet ./...; go run ./tools/repolint
Co-authored-by: Linearleaf <[email protected]>
* fix(agent): bound chunked compaction recovery
Problem:
- chunk boundaries and recursive retries could separate tool turns or retry without progress
- fallback requests discarded compact focus and underreported provider usage
- the PR also carried an unrelated fixed-row transcript experiment with known ordering flaws
Root cause:
- recovery split raw messages and recursively recompressed merge pairs without shared limits
- fallback prompts and telemetry were rebuilt independently of the original compaction request
Fix:
- split only at replay-safe tool-turn boundaries and use provider-visible input sizes
- enforce shared call, depth, and strict-progress guards across fragment and merge recovery
- preserve compaction focus on every fallback request and aggregate all fallback telemetry
- restore transcript live-row ownership to main-v2 behavior
Verification:
- go test ./... -count=1
- go test -race ./internal/agent -count=1
- go run ./tools/repolint
- bash scripts/cache-guard.sh
- desktop: go build ./... && go test ./... -count=1
- frontend: transcript tests and production build
* fix(agent): satisfy chunk recovery lint
Problem:
- CI rejected the call-budget regression loop under the Go 1.22 intrange rule.
Root cause:
- the test used a classic index loop even though it only ranged over a constant count.
Fix:
- use the integer range form required by repository lint policy.
Verification:
- go test ./internal/agent -run TestChunkedSummaryRunEnforcesCallBudget -count=1
- golangci-lint run --timeout=5m ./internal/agent/...
* fix(agent): size and budget chunked recovery
Problem:
Chunk boundaries ignored provider-specific replay payloads, while the recovery loop could spend calls after its remaining work was already impossible within the 64-call cap.
Root cause:
Fallback sizing only counted a subset of message fields, and recursive extraction/merge calls checked only the current call instead of reserving the minimum downstream plan.
Fix:
Use the shared-window replay policy for provider-visible sizing and reserve required fragment, merge, and outer-task calls before every request and merge round.
Verification:
go test ./internal/agent -count=1
go test -race ./internal/agent -count=1
go vet ./...
go test ./... -count=1
go run ./tools/repolint
bash scripts/cache-guard.sh
git diff --check
Co-authored-by: Linearleaf <[email protected]>
---------
Co-authored-by: SivanCola <[email protected]>
Co-authored-by: Linearleaf <[email protected]>
* fix(frontend): open a reveal boundary pinned to the transcript tail (#9567)
Model-takeover remounts could leave the transcript parked mid-history:
the arbiter reset at the boundary flips the tail pin, but the newly
keyed Virtuoso's first paint has no enforced tail placement, so the
newest turns ended up above the viewport. Once the incoming surface
commits its first paint, re-assert the tail-follow pin and scroll to
the bottom; the user's own scroll intent still takes over afterwards.
* fix(desktop): confirm transcript tail settle writes
Problem:
Stable builds dropped functional settle metadata, so bounded jump-bottom retries in one geometry revision were deduplicated. A first small no-op could also prematurely redefine the reachable bottom.
Root cause:
Phase and settle fields were gated by diagnostics, and clamp observation accepted a single stale virtualizer rollback.
Fix:
Keep settle phases in all channels, fence retries by settle frame, require repeated residual confirmation, and probe the theoretical physical tail through the bounded jump transaction.
Verification:
- pnpm test:transcript
- pnpm build
- transcript-scroll-stability.mjs x5
- go run ./tools/repolint
* fix(frontend): validate same-tab tail takeover ownership
Problem:
The PR's paint-ready callback only runs for App navigation tokens, so remote same-tab adoption and reconnect never entered it. It could also reclaim the tail after manual reader input.
Fix:
Keep paint completion navigation-only and exercise same-tab reveals through the existing first-items arbiter tail transaction. Verify two late Virtuoso placements converge through bounded physical-tail probes while user intent cancels delayed probes.
Verification:
- pnpm exec tsx src/__tests__/transcript-recovery-race.test.tsx
- pnpm test:transcript
- pnpm build
Co-authored-by: SivanCola <[email protected]>
* test(frontend): isolate same-tab tail takeover race
* refactor(frontend): deduplicate reader commit deadline
---------
Co-authored-by: SivanCola <[email protected]>
Problem: The latest main-v2 transcript ownership fixes make the exact session-version merge exceed the previous startup gzip and raw gates by only a few dozen bytes.
Root cause: The narrow ratchets were measured against the earlier merge base, while the current base carries additional bounded transcript settle code.
Fix: Raise only the initial gzip budget from 457.5 to 457.6 KiB and the raw startup budget from 2452.8 to 2452.9 KiB, preserving every unrelated bundle ceiling.
Verification: pnpm test; pnpm typecheck; pnpm test:typecheck; pnpm lint:hooks; pnpm build; go run ./tools/repolint; git diff --check.
Problem:
- Desktop builds reject the completion_uncertain terminal outcome, while evaluator setup can silently disable enforce mode or bind child agents to the root model.
Root cause:
- The frontend outcome union omitted completion_uncertain.
- The evaluator factory accepted no effective model and represented setup failures as a nil evaluator.
Fix:
- Resolve an independent evaluator session from each agent effective model, preserving an explicit evaluator override.
- Return a failing evaluator when setup is unavailable so enforce mode pauses fail-closed.
- Extend the Desktop wire union and apply measured, narrowly rounded bundle ratchets for the existing localized notice.
Verification:
- go test ./... -count=1
- go test -race ./internal/completioneval ./internal/agent ./internal/control ./internal/boot -count=1
- cd desktop && go test ./... -count=1
- go vet ./...
- make lint
- pnpm build
- pnpm exec tsx src/__tests__/send-failed.test.ts
- scripts/cache-guard.sh
Problem: Repeated downward reader input could reach the physical transcript bottom while ownership remained manual during a history/ref-resolution storm.
Root cause: The history-prepend geometry commit reused the reader transaction settle deadline, and every wheel extended that deadline. A covered prepend could therefore remain pending indefinitely and keep tail handoff blocked.
Fix: Track a prepend-owned wall-clock commit bound that only prepend begin/mutation activity may extend. Keep reader input on its independent settle window, add deterministic continuous-wheel coverage, and include ownership details in the browser failure probe.
Verification: pnpm test:transcript; pnpm build; transcript scroll stability browser gate 5/5.
Problem:
Stable builds dropped functional settle metadata, so bounded jump-bottom retries in one geometry revision were deduplicated. A first small no-op could also prematurely redefine the reachable bottom.
Root cause:
Phase and settle fields were gated by diagnostics, and clamp observation accepted a single stale virtualizer rollback.
Fix:
Keep settle phases in all channels, fence retries by settle frame, require repeated residual confirmation, and probe the theoretical physical tail through the bounded jump transaction.
Verification:
- pnpm test:transcript
- pnpm build
- transcript-scroll-stability.mjs x5
- go run ./tools/repolint
Problem:
Turns could succeed when the model called a context-unavailable tool and
co-streamed any non-empty answer, or when it stopped after process-only
text with no tools. Both look finished to the host but leave the request
incomplete.
Root cause:
The contextual-tool repair accepted same-turn visible text before the
host error existed, and a candidate final with any non-empty body was
treated as success without a structured completeness check.
Fix:
Repair the first unavailable-tool batch regardless of co-streamed text;
a second violation pauses recoverably. Remaining candidate success goes
through an isolated, tool-free completion evaluator. Default mode is
shadow (record only). Enforce may continue once, then pause. Main-session
prompts and tool schemas stay byte-stable; the evaluator uses its own
session and never restores a global finish tool.
Verification:
- go test ./internal/completioneval ./internal/agent ./internal/control ./internal/boot -count=1
- go test -race ./internal/completioneval ./internal/agent ./internal/control -count=1
- go test ./... -count=1
- cd desktop && go test ./... -count=1
- make lint
- scripts/cache-guard.sh
- git diff --check
Problem:
Session version notes could replace logical topic titles, notes for inactive projects could not be saved, recovery lifecycle diagnostics stopped before final classification, and locale changes could reset pending recovery events.
Root cause:
The catalog promoted CustomTitle into topic metadata, RenameSession was bound to the active directory, final outcomes depended on an optional frontend hook, and runtime subscriptions were recreated with translated callbacks.
Fix:
Keep topic and version titles independent, resolve session directories from the known project set, persist only allowlisted redacted lifecycle outcomes, retain runtime ownership across locale changes, and cover each boundary with deterministic tests.
Verification:
go test ./...; go vet ./...; desktop go test/vet; frontend test/typecheck/build; focused and full race tests; bundle budget and repolint.
Integrate the latest history-prepend ownership fixes before completing the session-version review round. Resolve the shared bundle ratchets against the newer base without rewriting the contributor branch history.
Problem:
The first cancellation fix left bundle headroom too narrow and expanded the reader hook contract.
Root cause:
Prepend cancellation belongs to the arbiter event that transfers scroll ownership, including when no reader transaction remains active.
Fix:
Clear the prepend coordinator at the explicit owner-takeover boundary and keep notified reader completion responsible only for active transaction terminals.
Verification:
- pnpm exec tsx src/__tests__/transcript-history-prepend-race.test.tsx
- pnpm test:transcript
- pnpm test:transcript-browser
- pnpm build
- go run ./tools/repolint
Problem:
Explicit scroll owners could terminate the reader while leaving a covered history-prepend lease pending.
Root cause:
Prepend cleanup was attached to the notify-gated reader onEnd callback, so silent cancellation skipped the coordinator terminal.
Fix:
Separate unconditional cancellation cleanup from natural reader completion and cover selection, resize, programmatic, and jump owners.
Verification:
- pnpm exec tsx src/__tests__/transcript-history-prepend-race.test.tsx
- pnpm test:transcript
- pnpm test:transcript-browser
- pnpm build
- go run ./tools/repolint
Problem: recovery events could resolve against the wrong physical lineage or miss their catalog revision; unique recovery-only sessions could remain pending; History search exposed version notes; and repeated same-path recoveries were absent from diagnostics.
Root cause: lineage lookups discarded the recovered path, catalog refresh was queued before pending registration, the frontend state machine lacked a one-version terminal state, search title precedence was inverted, and diagnostic deduplication ran before occurrence accounting.
Fix: bind lineage reads and preference changes to catalog path identity, emit recovery before refresh, clear unique visible versions, preserve TopicTitle precedence, and retain one bounded repeated recovery diagnostic.
Verification: go test ./...; desktop go test ./...; frontend pnpm test, typecheck, and build; go vet for root and desktop modules; race tests for control, sessioncatalog, and desktop.
Integrate the latest main-v2 catalog path-identity and mutation-ordering changes before repairing the recovery-version state machine. This keeps the PR on the current desktop/sessioncatalog ownership boundaries without rewriting its remote history.
Fence contiguous older-history pages behind one generation-bound layout lease. Preserve the visible stable-key anchor until mounted coverage and bounded geometry settling complete, then route the sole correction through the existing scroll writer.
Cancel stale leases when an explicit owner terminates the reader, expose content-free pending state for browser regression checks, and cover the 101→171→241 delayed-mount race.
Problem: Automatic compaction could deadlock on supported small context windows, and compaction.prepare replacements could expand a capped fold past the configured gateway window.
Root cause: Summary planning reserved a fixed 8192-token output budget and ordinary-turn admission added its own reserve. The final request was not revalidated after extension messages or guidance changed.
Fix: Scale shared/unknown summary output budgets with the effective window, use a summary-specific protocol reserve in admission, and fail closed when the post-extension request exceeds the same planner limit. Explicitly independent providers and below-ceiling manual compaction retain their existing behavior. Merge the latest main-v2 before publication.
Verification: focused compaction tests, focused race tests, go test ./internal/agent, go test ./... -count=1, go vet ./..., go run ./tools/repolint, and desktop go test ./... all pass.
Co-authored-by: Linearleaf <[email protected]>
Problem:
- CI golangci-lint reported an unused listTopicSessions wrapper after root-key reuse moved both callers to listTopicSessionsByRootKey.
Root cause:
- The compatibility wrapper was left behind even though it is private and has no callers.
Fix:
- Remove the dead wrapper and keep the single root-key-aware implementation.
Verification:
- golangci-lint v2.12.2 run --timeout=5m
- go test -race ./internal/sessioncatalog/...
- go test ./...
- go -C desktop test ./...
- go vet ./...
- go run ./tools/repolint
Problem:
The #9591 regression coverage proved failed tabs leave the restore snapshot but did not prove their sessions remain discoverable after restart.
Root cause:
Tab restore state and the session catalog are independent, leaving their cross-store history contract untested.
Fix:
Add a project-scoped restart regression that suppresses the failed tab, preserves the transcript, rebuilds the catalog from the persisted project registration, and finds the session in the project tree.
Verification:
- cd desktop && go test . -run ^TestTerminalStartupFailureRemainsInProjectHistoryAfterRestart$ -count=10
- cd desktop && go test -race . -run ^TestTerminalStartupFailureRemainsInProjectHistoryAfterRestart$ -count=1
- cd desktop && go test ./...
- cd desktop && go vet ./...
- go run ./tools/repolint
- git diff --check
Problem:
- A stale exact index or directory scan could erase a newer removal tombstone.
- Revision events exposed unregistered root spellings, so Desktop exact matching could miss a refresh.
- A filesystem identity remap at the same access spelling could leave raw-key rows that blocked targeted upserts.
Root cause:
- Tombstones were removed with unconditional map deletion and exact-index queue coalescing retained the oldest request.
- Storage joins used identity keys but publication roots still used mutation spellings.
- Raw-path primary keys were not cleaned when the derived identity key changed.
Fix:
- Apply generation-aware compare-and-delete at every writer boundary and retain the newest exact-index request.
- Publish registered project-root spellings and reuse one root identity per topic-list request.
- Atomically remove remapped session, directory, topic, and folded-topic projections before identity-key upserts.
Verification:
- go test -race ./internal/sessioncatalog/...
- focused ordering and identity tests repeated 20 times
- go test ./...
- go -C desktop test ./...
- go vet ./...
- go run ./tools/repolint
- Windows amd64 sessioncatalog test binary cross-compiled
- git diff --check
Problem:
PR #9582 was behind main-v2, and its automatic summary cap could override the over-ceiling manual rescue merged in #9474. Unknown-window planning also lost learned-window coverage after SetSession and reported an imprecise soft-skip reason.
Root cause:
The branches evolved the same safe-prefix contract independently, while unrestricted test providers left their independent-window policy implicit.
Fix:
Merge current main-v2, preserve safe-prefix planning for automatic and mustFree manual rescue paths, honor the effective configured-or-learned window for unknown gateways, record checkpoint rejection when no prefix fits, and make independent test-provider contracts explicit.
Verification:
- go test ./... -count=1
- go test -race ./internal/agent -run 'TestManualCompact|TestPressureSummaryCapped|TestPressureNoSafePrefix|TestOverflowSummarizesLargestAdmissibleContiguousPrefix|TestCoordinatorHandoffSurvivesPlannerCompaction|TestConcurrentPrepareRunsOneMaintenanceSequence' -count=1
- go vet ./...
- go run ./tools/repolint
Co-authored-by: SivanCola <[email protected]>
Problem:
- Ordinary users see physical recovery-copy badges, groups, paths, and cleanup controls even when the copy is fully covered.
- Session rename and topic rename semantics can be conflated, while real divergent content lacks a focused, non-blocking discovery path.
Root cause:
- Catalog lineage roles leaked directly into ordinary tree/history UI, and recovery creation events were treated as user-facing outcomes before catalog classification settled.
Fix:
- Keep one logical topic row, hide covered copies from ordinary history, and fold recoverable system data into a collapsed Trash section.
- Confirm divergence from catalog revisions before showing one non-blocking toast, and share one lazy App-level session versions dialog across toast and History entry points.
- Preserve TopicTitle and per-version CustomTitle independence, extend the additive Wails lineage view, keep branch selection non-destructive, and add redacted lifecycle diagnostics.
Compatibility:
- No authoritative JSONL or branch-meta format changes and no migration.
- Additive optional Wails fields tolerate old backends; members always encode as an array; recoveryCopyCount remains as a deprecated zero-valued compatibility field.
Bundle impact:
- Initial JavaScript gzip remains 456.4 KiB with a 456.5 KiB ratchet.
- Raw startup payload moves from 2448.0 KiB to 2448.6 KiB with a 2448.8 KiB ratchet; the coordinator and version dialog remain lazy.
Verification:
- pnpm test (243 suites)
- pnpm build
- go test ./...
- cd desktop && go test ./...
- go test -race ./internal/control/... ./internal/agent ./internal/sessioncatalog
- cd desktop && go test -race ./...
- go vet ./internal/control/... ./internal/agent ./internal/sessioncatalog ./internal/doctor
- cd desktop && go vet ./...
- go run ./tools/repolint
Problem:
- Native Windows execution exposed pagination tests that inserted raw access paths directly into the identity-keyed tombstone overlay.
Root cause:
- The fixtures bypassed the Catalog path identity boundary, which happened to work on Unix-style test paths but not after Windows drive canonicalization.
Fix:
- Store tombstones through Catalog.pathKey and inject a transformed identity in the tests so every platform verifies the intended boundary.
Verification:
- Focused pagination tests passed 20 consecutive runs.
- go test -race ./internal/sessioncatalog/...
- go test ./...
- go vet ./...
- go run ./tools/repolint
- Windows amd64 sessioncatalog test binary cross-compiled
Integration:
Refresh PR #9474 from the current main-v2 tip and carry the manual compaction rescue onto the latest agent, desktop, and dependency baseline.
Result:
The merge is conflict-free. It also brings golang.org/x/crypto v0.55.0, removing the stale-base govulncheck failure from the prior PR merge ref.
Verification:
- go test ./...
- go vet ./...
- go test -race ./internal/agent -run TestManualCompact -count=1
- go run ./tools/repolint
- gofmt and git diff checks
Problem:
The manual over-ceiling rescue condition pushed ContextManager.prepareOnce to cyclomatic complexity 31, above the repository limit of 30.
Root cause:
Trigger-specific prune policy remained inline in an already branch-heavy orchestration method.
Fix:
Move the pressure, overflow, and manual-over-ceiling decision into a focused helper without changing compaction behavior.
Verification:
- go test ./internal/agent -run TestManualCompact -count=1 -v
- go test ./internal/agent -count=1
- go run ./tools/repolint
Problem:
- Workspace roots still used raw spelling as relational identity, so registry and sidecar case variants could split one project.
- Save observers performed filesystem-aware canonicalization before enqueueing, and Windows PR CI did not execute the owning package tests.
Root cause:
- Path identity was applied to session and directory paths but not workspace joins and uniqueness.
- Queue coalescing reused the durable identity function on the synchronous persistence callback.
Fix:
- Add workspace_root_key relationships and a v10 disposable-projection rebuild migration while preserving original access spellings.
- Stage queue events lexically and resolve filesystem identity in workers/SQLite, preserving remove-versus-recreate ordering.
- Run sessioncatalog tests in the native Windows smoke leg and document the boundary.
Verification:
- go test ./...
- go test -race ./internal/sessioncatalog/...
- cd desktop && go test ./...
- go vet ./...
- go run ./tools/repolint
- Windows amd64 sessioncatalog test binary cross-compiled
- latest main-v2 merge tree passed focused root and desktop tests
Problem:
Failed startup sessions could remain in the restore snapshot, while the force archive path bypassed active-work protection and changed the Wails API surface.
Root cause:
Terminal recovery failures did not persist the filtered tab snapshot immediately, and stale write-authority errors were treated like ordinary snapshot failures.
Fix:
Centralize startup failure state, persist terminal recovery failures after unlocking, keep retryable and transient tabs restorable, and let regular archive tolerate typed authority errors only for an unchanged failed runtime while preserving active-work and removal guards.
Verification:
- go test ./...
- go test -race ./...
- go vet ./...
- golangci-lint run --timeout=5m
- pnpm --dir frontend build
- go run ./tools/repolint
Co-authored-by: SivanCola <[email protected]>
Problem:
Classifying kill_shell as fully read-only avoided workspace leases but erased its observable host-state mutation semantics and left the self-blocking lease path without regression coverage.
Root cause:
The lifecycle-control tool was added to the read-only evidence branch even though its tool contract remains mutating and runtime policy consumes StateMutation independently from WorkspaceMutation.
Fix:
Classify kill_shell as HostState so it bypasses workspace write coordination without bypassing mutation policy. Add effect-domain assertions and a deterministic agent regression that terminates a real background job while it holds a path lease.
Verification:
- go test ./internal/evidence ./internal/agent ./internal/runtimepolicy ./internal/tool/builtin -count=1
- go test -race ./internal/evidence ./internal/agent ./internal/runtimepolicy ./internal/jobs -count=1
- git diff --check
Problem:
YOLO /clear rotated the session without clearing native scrollback, while a failed confirmed clear still returned a clear-screen command. The YOLO regression test also never persisted the transcript it claimed to delete.
Root cause:
The shared clear helper did not return the Bubble Tea command, and the confirmation wrapper returned tea.ClearScreen unconditionally.
Fix:
Return tea.ClearScreen only after ClearSession succeeds and forward it through both YOLO and confirmed paths. Persist the YOLO fixture, cover failure atomicity with an active-turn regression test, merge current main-v2, and regenerate the repolint baseline.
Verification:
- go test ./internal/cli -count=1
- go test -race ./internal/cli -run TestClearCommand -count=1
- go vet ./internal/cli
- go test ./internal/control -run TestClearSession -count=1
- go run ./tools/repolint
Co-authored-by: SivanCola <[email protected]>
Move the v9 projection invalidation regression into its own focused test file so the existing catalog test file remains below the repository 800-line ceiling.
Verification:
- go test ./internal/sessioncatalog
- go run ./tools/repolint
Problem:
Case-variant spellings of the same transcript could enter the disposable catalog through Desktop, CLI, direct indexing, or background queues and create duplicate projection rows on case-insensitive filesystems.
Root cause:
Catalog storage, target deduplication, queue coalescing, tombstones, and directory locks compared access-path strings directly. The narrow Desktop-only lowercasing proposed in #9588 did not protect the other writers and would collapse distinct paths on case-sensitive filesystems.
Fix:
Store a filesystem-aware identity key separately from the original access path, route every catalog mutation and lookup boundary through it, and move the disposable catalog to the v6 generation so legacy projections rebuild from authoritative transcripts and sidecars. Preserve case-distinct files on case-sensitive volumes and fold Windows paths per governing directory.
Verification:
- go test -race ./internal/sessioncatalog
- go test ./...
- (cd desktop && go test ./...)
- Windows and Linux CGO-disabled cross-compilation of sessioncatalog tests
Co-authored-by: Linearleaf <[email protected]>
Problem: The regenerated v1.34.0 catalog includes the automation account as a contributor.
Fix: Keep the release credit list limited to human contributors.
Verification: Release catalog validation, contract tests, rendered-note review, and privacy scan.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Problem: Windows CI can count the fresh-session bootstrap update as part of the materialized-identity refresh.\n\nRoot cause: ready is published immediately before the asynchronous remote-tab metadata event, so the test baseline races that event.\n\nFix: wait for the bootstrap metadata event before measuring the identity-adoption update.\n\nVerification: focused test x100; focused race test x20; desktop go test and vet; frontend test:all.
Problem: The release test typecheck rejects Array.prototype.at because tsconfig.test.json targets ES2021.
Root cause: The transcript scroll writer regression used an ES2022-only array helper.
Fix: Read the final recorded call through an ES2021-compatible array index.
Verification: pnpm test:typecheck, pnpm test:all, and pnpm build.
Problem:\nThe regenerated v1.34.0 catalog credited the automation account because the previous notes merge is part of the first-parent range.\n\nRoot cause:\nThe generated contributor list retained github-actions[bot] as a release contributor.\n\nFix:\nRemove the automation identity while preserving the reviewed product changes and human contributor credits.\n\nVerification:\nValidated the release catalog, ran the release-note tests, rendered v1.34.0, scanned the public text, and checked the diff.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Problem:
The use_capability paired replay required a live_paired dataset and fixed performance thresholds before Stable publication.
Root cause:
The optional performance benchmark was promoted into a release-blocking command and policy even though its median helper remains useful independently.
Fix:
Remove the release-only CLI, dataset types, thresholds, and gate tests. Keep the synthetic median fixture and document paired replay as an optional diagnostic in English and Chinese.
Verification:
- go test ./internal/eval/replay/ -count=1
- go test ./... -count=1
- go vet ./...
- go run ./tools/repolint
- git diff --check
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
* fix(security): enforce serve Host allowlist, preview confinement, and gitcmd clean-filter neutralization
Problem:
Six privately reported boundary gaps were confirmed against main-v2:
1. `reasonix serve` validated neither Host nor Origin, so a DNS-rebinding
page became same-origin with the unauthenticated loopback listener and
could drive POST /bypass, POST /submit, and read GET /history past the
application/json CSRF guard.
2. write_file / edit_file / multi_edit Preview() read model-supplied
absolute paths with no confinement, leaking out-of-workspace file
contents into approval cards and session logs even though Execute
would refuse the write.
3. gitcmd diff invocations still executed repository-configured
filter.<driver>.clean commands via .gitattributes — the residual the
package itself documents (--no-ext-diff/--no-textconv do not cover it).
4. install_source's SSRF dial guard validated only the proxy address when
an HTTP/HTTPS proxy was configured; blocked IP-literal destinations
were forwarded unchecked (web_fetch already checks its proxy path).
5. The bash indirect-execution classifier missed awk/gawk/mawk/nawk, so
`awk 'BEGIN{system("...")}'` fell into the reusable-approval class.
6. The legacy read-only prefix table still listed `cargo check`/`cargo
doc` as permission readers although cargo executes build.rs for both.
Root cause:
Each was a gap in a boundary the codebase already enforces elsewhere:
no Host allowlist next to the existing CSRF/auth middleware chain,
confinePreview missing on three of five previewers, a fixed-key config
baseline that cannot express per-driver filter names, a dial-time-only
SSRF check, an interpreter allowlist missing one family, and a stale
legacy table disagreeing with the effect classifier.
Fix:
- serve: hostGuard middleware (421 for non-loopback, non-listen Host),
listen address plumbed via setListenAddr from all Run entry points;
behind_proxy and wildcard/non-loopback binds exempt; the plaintext
non-loopback startup warning now also fires loudest for auth=none.
- builtin: the three previews apply confinePreview after resolveIn,
matching delete_range/delete_symbol.
- gitcmd: diff invocations neutralize every filter driver defined in the
repository-local .git/config (clean= emptied, required forced off;
worktree-linked .git followed). gitstatus runGit passes cwd through
gitcmd's dir parameter so the lookup sees the right repository.
- installsource: ssrfRequestGuard RoundTripper rejects blocked IP-literal
destinations before any proxy forwarding, matching web_fetch's boundary.
- permission: awk-family inline programs (not -f/--file) classified as
indirect execution like python -c.
- shellsafe: cargo check/doc removed from readOnlyPrefixes (search stays).
Verification:
- go test ./internal/gitcmd ./internal/shellsafe ./internal/permission
./internal/installsource ./internal/tool/builtin ./internal/serve
./internal/cli — all pass on a clean origin/main-v2 worktree.
- New regression tests reproduce each report end-to-end: the rebind
Host is rejected before csrfGuard; confined previews error on
out-of-roots paths; a filter.pwn clean+required marker payload does
not run during diff while the diff still renders the working-tree
change; a recording proxy sees zero blocked destinations; awk
system()/getline shapes require human approval.
* refactor(serve): keep repolint budgets while adding the Host guard
Move hostGuard, hostGateState, setListenAddr, and csrfGuard into the new
internal/serve/hostguard.go and condense the added comment blocks in
gitcmd, installsource, permission, and preview so every repolint essay and
file-size budget stays at its existing baseline. serve.go ends 17 lines
smaller than main-v2. Behavior is unchanged; the moved guards keep their
tests and wiring.
Verification: go run ./tools/repolint -> clean (1257 baselined findings);
go test ./internal/serve ./internal/gitcmd ./internal/installsource
./internal/permission ./internal/tool/builtin all pass.
* fix(security): close hardening review bypasses
Problem:
Several review probes still crossed the intended Host, preview, Git filter, and reusable-shell approval boundaries.
Root cause:
The proxy Host exemption ignored auth mode; Git filter neutralization omitted process drivers and linked-worktree config; previews treated managed config as readable before approval; and awk option matching folded -F into -f.
Fix:
Require token/password auth for the proxy exemption, blank clean/process filter commands from common and worktree configs, keep previews inside write roots, and parse awk program-source options case-sensitively.
Verification:
- go test -count=1 ./...
- go test -race -count=1 ./internal/serve ./internal/gitcmd ./internal/tool/builtin ./internal/permission
- go run ./tools/repolint
- latest main-v2 merged tree: go test -count=1 ./... and repolint
* fix(mcp): harden streamable HTTP compatibility
Problem:
Stateless Streamable HTTP servers could block startup on a buffered subscriptions/listen request. Transport-level 404 and structured 4xx responses could also poison or misclassify the shared session, while failed protocol negotiation leaked an allocated server session.
Root cause:
The optional SEP-2575 subscription call remained on the synchronous connect path, and go-sdk v1.7.0 lacked request rejection, stateless subscription 404, and failed-negotiation cleanup fixes. Reasonix also relied only on the SDK session-missing sentinel.
Fix:
Run Streamable HTTP subscriptions asynchronously with session-scoped cancellation, pin the upstream SDK commit containing the three transport fixes, and narrowly classify explicit JSON-RPC session-loss errors plus sessionless endpoint 404s. Add compatibility coverage for buffered and live subscription streams, stateless 404s, per-call 4xx responses, negotiation cleanup, and legacy sessionless POST-only servers.
Verification:
- go test ./internal/plugin -count=1
- focused HTTP compatibility tests repeated 30 times
- focused go test -race repeated 5 times
- go test ./... -count=1
- go mod tidy -diff
- git diff --check
* fix(mcp): require transport proof before replay
Problem:
Application-level JSON-RPC errors containing session-loss wording could be mistaken for an expired MCP transport session, allowing a side-effecting tools/call to be replayed. The desktop nested module also retained the previous MCP SDK version and failed CI tidy checks.
Root cause:
Session recovery trusted server error text without requiring HTTP transport-rejection evidence, and the root SDK bump was not propagated through desktop's replace-based module graph.
Fix:
Require an SDK transport-rejection marker plus HTTP 404 evidence for structured session-loss recovery, scope sessionless 404 handling to Streamable HTTP, add no-replay regression coverage, and synchronize desktop go.mod/go.sum.
Verification:
- go test ./... -count=1
- cd desktop && go test ./... -count=1
- focused MCP race tests repeated 5 times
- go vet ./...
- go run ./tools/repolint
- root and desktop go mod tidy -diff
- ./scripts/cache-guard.sh
- git diff --check
* chore(mcp): document exact error-tree traversal
Problem:
CI errorlint rejected the deliberate direct inspection used to distinguish multiple wrapped JSON-RPC errors.
Root cause:
errors.As returns only the first matching RPC error, while session recovery must observe both the server error and the separate SDK transport-rejection sentinel.
Fix:
Document the invariant and scope the errorlint exception to the exact tree-walking helper.
Verification:
- golangci-lint run --timeout=5m ./...
- go run ./tools/repolint
- go test ./internal/plugin -count=1
- git diff --check
* chore(mcp): format lint directive
Problem:
The scoped errorlint directive was not gofmt-clean because its explanatory comment required a separating blank comment line.
Root cause:
The CI formatter enforces gofmt over the complete root module before running tests.
Fix:
Apply gofmt to the directive comment block.
Verification:
- root-module gofmt check
- golangci-lint run --timeout=5m ./...
- go run ./tools/repolint
- git diff --check
* fix(serve): keep the write path alive across an in-place resume / 修复 /resume 之后 /new 报写授权缺失
An in-place /resume calls leases.Rebind, whose releaseLocked strips the
controller's transition handler and clears the outgoing authority; the
loaded session got a fresh authority, but nothing re-installed the
handler. The foreground controller was therefore left authority-required
with no transition handler, and the next /new, /clear, or /fork failed
closed with "bind new session: session write authority missing" —
reproduced end-to-end and pinned by a regression test.
commitLoadedResume now re-binds the controller authority after Resume
makes the loaded session current, restoring the handler alongside a
fresh generation for the session that is actually current.
* chore(serve): satisfy resume authority lint guard
Problem:
The five-line resume authority comment exceeded repolint's essay budget, blocking the required lint check.
Root cause:
The ordering invariant was explained with two more lines than this file's zero essay budget permits.
Fix:
Condense the explanation to three lines while preserving the lease and transition-handler contract.
Verification:
- go run ./tools/repolint
- go vet ./internal/serve
- go test ./internal/serve -count=1
- go test -race ./internal/serve -count=1
- git diff --check
Co-authored-by: SivanCola <[email protected]>
---------
Co-authored-by: SivanCola <[email protected]>
* fix(desktop): keep the new-session blank row visible in remote groups / 远端项目组新会话行稳定显示
Opening a new session on a remote workspace flashed a row in the sidebar
and immediately dropped it. Two halves:
- Bootstrap only emitted the ready-only per-tab state event after a fresh
attach; the sidebar's listing never re-pulled, so the synthesized blank
row had no trigger. Bootstrap now publishes remote-tab:updated for a
fresh session, like the live-tab /new rotation already did.
- The blank row's synthesis keyed on the tab's transient reset flag,
which the status poll clears as soon as Serve names the new session —
long before the transcript reaches the serve listing. Synthesize the
row while a ready tab's current session is invisible to the listing
(reset stays the fallback for legacy /new without a path header), so
the row lives exactly as long as the session is unlisted.
* fix(desktop): fence fresh-session ready updates
Problem:
Fresh remote sessions could publish a connecting TabMeta after the tab became ready, and bootstrap read session.reset after releasing remoteTabMu. Status updates could race that read or be overwritten by the stale event.
Root cause:
Bootstrap carried mutable tab state and a pre-ready snapshot across the ready transition without the route-event serialization used by other session identity publishers.
Fix:
Capture fresh-session intent while holding remoteTabMu, validate the same ready generation before taking a post-ready snapshot, and serialize the update with route/status publishers. Extend the regression to cover status naming an unlisted session and its later materialization.
Verification:
- cd desktop && go test ./...
- cd desktop && go test -race . -run Test.*Remote -count=1
- cd desktop && go build ./...
- cd desktop && go vet ./...
- go run ./tools/repolint
- git diff --check
Co-authored-by: SivanCola <[email protected]>
---------
Co-authored-by: SivanCola <[email protected]>
* fix(desktop): keep remote project roots out of local topic state / 远端项目根不再触碰本地 Topic 元数据
A pinned remote group's root is the qualified virtual string
remote-project:<host>:<workspace>, which is not a filesystem path. Loading
its topic page built a topic-state scope from that string and read legacy
metadata under <root>/.reasonix/ — on Windows the colons are an invalid path
component, so the read failed with a user-visible 'topic metadata is
unavailable (io)' toast right after the connect wizard (deduped to once per
message). Remote groups list sessions from the serve-side catalog, so the
tree now skips them entirely and the bridge answers a remote root with an
empty page.
* fix(desktop): close remote topic-state compatibility path
Problem:
Remote project roots still reached local topic state through the one-release ListProjectTree compatibility fallback, and the initial frontend and Go guards exceeded repository lint ratchets.
Root cause:
ListProjectTree treated every project shell as local after ListProjectTopics returned an empty page. The frontend guard also added lines to a file already at its size budget, while the backend comment exceeded the essay budget.
Fix:
Skip Remote project shells before compatibility pagination and metadata fallback, add a regression that proves no virtual-root scope opens, fold the frontend guard into the existing eligibility check, and shorten the backend contract comment.
Verification:
- go test ./...
- go test -race ./...
- go vet ./...
- pnpm test:remote
- pnpm build
- go run ./tools/repolint
- git diff --check
Co-authored-by: SivanCola <[email protected]>
---------
Co-authored-by: SivanCola <[email protected]>
* feat(agent): land cache-stable use_capability speed and quality controls
Problem:
MCP discovery and review loops inflate tools/list traffic, schema bytes,
and automatic architecture review. The 1.33.0 speed-and-quality plan keeps
a fixed use_capability proxy, but host validation, parallel read-only
dispatch, stop-loss, child review budgets, and observability were incomplete.
Root cause:
The proxy schema was cache-stable, yet argument validation, scheduling class,
review triggers, child sampling caps, facts packs, and list-layer metrics
were not wired through. Architecture review fired too broadly, and the
review 2048-token cap never reached child provider sampling.
Fix:
- Validate arguments against the real target schema before MCP tools/call.
- Classify list/search/inspect and connected read-only MCP as parallel.
- Fail closed when schema generation or safety class changes after scheduling.
- Narrow auto independent review to architecture-worthy writes and cap at
one first review plus one re-review.
- Stamp review children with 8 steps / 2048 output tokens and a parent
facts pack, without copying the parent transcript.
- Record tool/phase/MCP list metrics and export three-layer list sources.
- Keep first-party Tool Search preview plumbing default-off.
Verification:
- go test ./internal/agent/ ./internal/plugin/ ./internal/taskcontract/ ./internal/cli/ ./internal/tool/ ./internal/boot/ ./internal/eval/replay/
- go test -race on parallel MCP and listChanged tests
- go vet ./internal/agent/ ./internal/plugin/ ./internal/cli/
- go run ./tools/repolint
* fix(agent): harden capability speed controls
Problem
- Capability retries, proxy classification, and loop guards could duplicate canceled work, serialize safe reads, or repeat failed decisions.
- MCP attribution, review context, native tool search, output validation, and desktop export wiring had correctness and CI gaps.
Root cause
- Wrapper layers dropped resolved metadata, per-turn state used cumulative or non-atomic accounting, and process-only metrics could not explain session behavior.
- Provider support was inferred from names, while two same-stem export modules made TypeScript resolve the wrong implementation.
Fix
- Fail closed on cancellation and dynamic classification, bound reviews and repeated failures, validate output schemas, index discovery once, and emit session-scoped MCP list observations.
- Gate native tool search by concrete first-party Responses capability, preserve host validation, and split lightweight export data from raster renderers.
- Add deterministic concurrency, decision, dedupe, Windows path, frontend contract, and wire-format coverage.
Verification
- go test ./... -count=1
- go test -race ./internal/agent ./internal/plugin -count=1
- golangci-lint run ./... (darwin, linux, windows)
- pnpm build
- node scripts/run-tests.mjs (236 suites)
* refactor(boot): preserve repository lint budgets
Problem
- The capability review wiring increased line and complexity counts in two already-baselined large files, so the repository lint gate rejected the otherwise clean change.
Root cause
- Review context preparation and observer binding were inlined at high-complexity call sites.
Fix
- Move review option preparation into the focused boot helper module and combine capability observer setup behind one call.
- Preserve behavior while returning agent.go and boot.go to their prior lint budgets.
Verification
- go run ./tools/repolint
- go test ./internal/agent ./internal/boot -count=1
- golangci-lint run ./...
* fix(boot): remove ineffectual review budget result
Problem
Linux CI reports two ineffectual assignments when review subagent options are prepared.
Root cause
The extracted helper returned the adjusted step count after it had already embedded that value in agent.Options, while callers never read the returned count again.
Fix
Narrow the helper contract to return only the rewritten task and completed options, and update both call sites.
Verification
go test ./internal/boot -count=1
go run ./tools/repolint
golangci-lint run --timeout=5m ./...
* fix(agent): close speed and quality review gaps
Problem: PR #9569 still allowed invalid proxy arguments to reach hooks or remote tools, attributed MCP list activity imprecisely, repeated equivalent decisions and outputs, and used a synthetic performance fixture as release evidence.\n\nRoot cause: Validation, dispatch telemetry, retry semantics, discovery attribution, loop guards, and release qualification were implemented at separate abstraction layers without a single resolved-tool contract.\n\nFix: Validate resolved tools before hooks and dispatch, preserve exact remote-dispatch telemetry, reject MCP application errors from transport retries, deduplicate decisions and outputs, bound inspect responses, attribute live MCP list changes to active sessions, enforce rolling soft budgets, and add a live paired-run release gate.\n\nVerification: go test ./...; targeted Go race tests; go vet ./...; golangci-lint; repolint; desktop and SDK Go tests; frontend build; all 239 frontend suites.
* test(desktop): follow composer measurement mirror
Problem: The latest main-v2 composer autosize change made the full frontend suite fail seven run-strip height assertions.
Root cause: The regression test still mocked scrollHeight on the live textarea even though production now measures an out-of-flow mirror.
Fix: Mock the measurement mirror while continuing to assert the live textarea and card geometry.
Verification: The focused composer tests and all 239 frontend suites pass; the production build and bundle budgets also pass.
* test(desktop): stabilize native tail fixture
Problem: The Windows WebView2 smoke failed before its composer assertions when the initial history already exceeded the target row count.
Root cause: The prepared multiline draft could shrink the native viewport one paint late while logical ownership remained tail-follow, leaving no jump-bottom control for fixture setup.
Fix: Normalize only the logical tail-follow setup to the physical tail, continue requiring the product control in manual-reader mode, and verify the loaded tail after recovery.
Verification: node syntax check; desktop Go tests; repolint; local native fixture passed the modified setup and reached native-event sampling.
* fix(desktop): preserve tail during hydration resize
WebView2 could keep logical tail-follow while a restored multiline draft shrank the transcript during history hydration, leaving the physical viewport 37-74px above the tail.
Route those viewport resize events through the existing tail controller only while tail-follow ownership is active. Manual readers remain untouched, and the native smoke now verifies product behavior without a fixture-owned scroll write.
Verified with the frontend build, all 239 frontend suites, transcript and composer suites, desktop Go tests, native contract syntax, repolint, and diff checks.
* fix(desktop): repair hydrating footer tail gaps
The Windows matrix confirmed the restored multiline draft changes the App footer while transcript hydration is active. The footer-height effect discarded that event, and the ResizeObserver could be recreated after the height change, leaving logical tail-follow 37px above the physical tail.
Allow footer resize repairs whenever the transcript still owns tail-follow, including during hydration, while continuing to block manual readers. Use the canonical scroll mode for the viewport fallback as well.
Verified with transcript and composer suites, frontend build, desktop Go tests, native contract syntax, repolint, and diff checks.
* test(boot): isolate provider prefix effects
* fix(desktop): pin composer footer tail before paint
* fix(desktop): settle staged native footer growth
* test(boot): fence history index cleanup
* fix(desktop): make transcript tail physically reachable
* fix(desktop): use painted WebView2 viewport extent
* fix(desktop): learn reachable WebView2 transcript tail
* fix(desktop): retain asynchronous WebView2 tail evidence
* fix(agent): preserve MCP concurrency policy at runtime
Problem:
Configured MCP serial/parallel policy disappeared when the session runtime copied plugin entries, allowing explicitly serial stateful servers to be classified and executed concurrently.
Root cause:
runtimePluginEntry retained only name, source, and auto-start metadata, while both batch classification and the execution gate read Concurrency from that reduced entry.
Fix:
Normalize and retain Concurrency in the runtime entry. Add regression coverage through both ConfigureServers and UpsertServer so initial assembly and hot updates preserve explicit serial and parallel behavior.
Verification:
- go test ./internal/agent -run MCP concurrency tests -count=1
- go test -race ./internal/agent -run MCP concurrency tests -count=1
- go test ./... -count=1
- go vet ./...
- go run ./tools/repolint
* fix(provider): align model discovery with the chat proxy policy and surface stream failures
Problem:
Custom providers on Windows could refresh their model list normally, but
the first chat turn produced no output for minutes and ended only with the
generic interrupted-turn notice (#9560).
Root cause:
Model discovery used a bare http.Client (environment proxy only) while
chat requests ride the configured netclient transport, whose default auto
mode falls back to the Windows system proxy (IE/PAC/WPAD). A broken or
half-dead system proxy therefore passes setup-time discovery and silently
stalls chat; when stream retries were exhausted the run emitted no
user-visible reason, and a user stop during the stall dropped the only
error context.
Fix:
- FetchModelsOptions gains a ProxySpec; model discovery now builds its
client through netclient.NewTransport so the probe rides the same
network policy as chat. Desktop settings probes and the CLI setup
refresh pass cfg.NetworkProxySpec() via a credential-free read-only
config load, and a no_proxy provider is probed directly even before
its entry is saved.
- When a model round ends in a stream interruption after retries, the
agent emits a warn notice naming the closed interrupt reason enum
(idle_timeout / premature_eof / connection_reset) without leaking raw
transport errors; the desktop transcript also appends the last
stream-attempt discard reason to an interrupted-turn notice.
- The provider editor exposes the existing no_proxy config as a
"connect directly, bypassing the network proxy" toggle with localized
labels and a symptom-oriented hint.
Verification:
- go test ./... at the repo root (125 packages) and cd desktop && go test ./...
- frontend npm test (235 suites) plus tsc --noEmit
- focused regressions: TestFetchModelsRoutesThroughConfiguredProxy,
TestRunNotifiesWhenStreamRetriesExhausted, TestSaveProviderPersistsNoProxy,
TestWithProbeDirectHostMirrorsProviderNoProxy,
stream-interrupt-reason.test.ts
- make lint (golangci-lint + repolint; baseline re-run for this PR's growth)
- headless e2e: custom OpenAI-compatible provider replies normally with no
proxy, hangs identically to chat when a dead proxy is configured
* test(desktop): keep proxy coverage below debt ceiling
Problem:
- the IPv6 proxy-host regression pushed settings_app_test.go above its repolint budget in CI
Root cause:
- proxy-specific tests were left in an already oversized legacy test file
Fix:
- move the proxy persistence and direct-host tests into network_proxy_app_test.go
- lower the repolint totals and restore settings_app_test.go to its main-v2 baseline
Verification:
- go test . -run TestNetworkProxySpecForRootMatchesEffectiveProjectConfig\|TestWithProbeDirectHostMirrorsProviderNoProxy\|TestSaveProviderPersistsNoProxy -count=1 (desktop)
- go run ./tools/repolint
- git diff --check
* fix(desktop): recover stranded transcript tails
Problem:
- Windows WebView2 could remain physically off-bottom after bounded tail repair while tail-follow ownership hid jump-bottom
Root cause:
- the settle controller exhausted its writer without releasing tail ownership
Fix:
- transition exhausted stranded tails to manual ownership so jump-bottom remains reachable
- preserve the bounded automatic retry and transient layout masking
- record the terminal transition in diagnostics and cover reducer and recovery races
- ratchet startup budgets to the measured recovery code
Verification:
- pnpm test:transcript
- pnpm build
* fix(desktop): preserve tail recovery ownership
Problem:
- the first stranded-tail fix released tail-follow too early during reduced-motion hydration
Fix:
- expose jump-bottom only after the bounded writer and fallback retry are exhausted
- retain tail-follow ownership so later geometry can still reconverge automatically
- distinguish progressing and repeatedly ineffective native writes in the race harness
Verification:
- pnpm test:transcript
- pnpm build
- node bench/transcript-scroll-stability.mjs
- node bench/composer-transcript-stability.mjs
Verifies TrashTopic rejects a topic with a running background job and that
TrashTopicForce relaxes the gate and archive succeeds. Reuses the existing
jobs/startNonCooperativeSessionJob fixture. NOTE: go test is blocked by the
session verification guard and could not be executed here; compile-check via
go build of the non-test package passed.
A recovery-failed session keeps its runtime lease and never passes the
active-work gate, so its project node could neither be archived (gate
rejection) and its tab re-entered the recovery-failed loop on every
focus. Two backend changes fix the loop at the source:
- tabs.go: a session that failed recovery is marked once and excluded
from the focus-driven tab retry loop
- topic_archive.go: TrashTopicForce (new Wails entry) skips the
active-work gate for such topics — the failed session is already
closed, file moves still use removal guards, so a genuinely in-use
session stays protected. trashTopic/commitTopicArchive take a force
flag; the regular TrashTopic path is unchanged.
The force-archive UI entry is a follow-up: upstream 1.32/1.33 reworked
useProjectTreeArchiveController (runProjectTreeArchiveJob), so the
frontend wiring from the fork needs re-adaptation before it can land.
kill_shell fell through to writerProfile, so terminating a background
subagent that held the write-path lock was blocked by that very lock.
Classify it alongside wait/bash_output as read-only host tooling.
Pressure-triggered compaction previously sent the summary request with
the full fold volume and no input cap whenever the safe-prefix helper
was gated behind mustFree, and the helper itself skipped capping for
unknown gateways that never admitted a request (the freshly-switched-to
provider shape). A 994,833-token summary request against a 1M shared
window then fails with 1261 on every retry, advancing generation
without ever installing a folded projection.
- run maximumSafeSummaryPrefixEnd on every automatic trigger path
(pressure included); manual compaction keeps the uncapped range
- unknown window mode falls back to the configured window instead of
skipping the cap; fits(end) keeps well-formed requests intact
- soft-skip (CompactionNoop) when no balanced prefix remains and the
fold is not mustFree, instead of an oversized request
- regression test: opaque provider, no admission, pressure trigger
* fix(desktop): stop composer input scroll jitter
Problem:
Typing or deleting in an existing multiline draft temporarily pulled a tail-following transcript upward before it snapped back.
Root cause:
Composer autosize set the live textarea height to auto on every text change. That transient in-flow collapse expanded the transcript viewport and let native clamping move scrollTop before tail follow corrected it.
Fix:
Measure synchronized plain-text content with an accessibility-hidden textarea mirror outside layout flow. Keep the live input geometry stable, add a Chromium regression for tail, wrapping, manual resize, IME, and reader-owned states, and narrowly ratchet the measured 0.472 KiB raw bundle increase.
Verification:
- pnpm test:composer
- pnpm test:transcript
- pnpm test:transcript-browser
- pnpm check:scroll-writer
- pnpm build
- go run ./tools/repolint
* test(desktop): harden Windows composer regression
Problem: The Windows transcript browser chain could leave a Vite child running, while the native WebView2 gate never exercised composer typing.
Root cause: The browser scripts killed only a shell wrapper, and the native smoke host injected wheel input but no keyboard input into the composer.
Fix: Await programmatic Vite preview shutdown across the Windows chain, restore the established gate order, and add an opt-in WebView2 composer phase with native typing and Backspace geometry assertions.
Verification: Frontend build, composer and transcript suites, Chromium/WebKit browser replays, Windows amd64 cross-compile, repolint, Win11 browser chain, WebView2 native smoke, and native state-machine self-test.
* test(desktop): isolate native composer geometry
Problem: Hosted WebView2 could start the composer probe while the initial Virtuoso history estimates were still settling, producing unrelated geometry changes in CI.\n\nRoot cause: The probe ran before the long-history fixture and only waited for a short initial stability window.\n\nFix: Run the native composer probe after loading 400+ rows and recovering a stable tail, require fonts and twelve stable painted frames, and include baseline/final geometry in failures.\n\nVerification: Passed node syntax and repolint checks, Windows amd64 cross-compilation, and the full native WebView2 transcript/composer smoke on Windows 11 (936 rows, 4822 frames, 0 reverse movement, 0 geometry changes).
* test(desktop): prepare native draft before history
Problem: The hosted WebView2 probe prepared its two-line draft after the long transcript had stabilized, so the setup resize itself moved the viewport before native key sampling.\n\nRoot cause: Draft setup and keyboard sampling were coupled in one phase, which did not represent the reported existing-draft scenario.\n\nFix: Prepare the multiline draft before loading targeted history, then establish the loaded tail and start native sampling without another composer resize.\n\nVerification: Passed node syntax and repolint checks plus the full native WebView2 transcript/composer smoke on Windows 11 (936 rows, 4556 frames, 0 reverse movement, 0 geometry changes).
* fix(desktop): preserve multi-round assistant timeline
Problem: multi-sample turns reused one live assistant row, so later reasoning overwrote earlier segments and Footer-to-history migration could expose raw Markdown.
Root cause: turn ownership and provider sampling identity shared one assistant ID, while terminal rendering did not retain a stable live-origin cache identity.
Fix: allocate turn-local assistant ordinals, settle tool boundaries, share bounded Markdown cache keys, cap and follow nested reasoning scroll, and group only consecutive successful Shell cards.
Verification: test:stream, transcript reducers and rendering suites, test:transcript, single-scroll-writer checks, typecheck, and the full frontend build all pass.
Co-authored-by: erphenheimer <[email protected]>
* refactor(desktop): keep timeline helpers within repo limits
Move assistant allocation helpers out of the already-baselined controller and compact the new terminal paths so repository line-count standards remain unchanged.
Verification: repolint, typecheck, test:stream, and the full frontend build pass.
* fix(desktop): guard reasoning follow during unmount
Keep the inner reasoning scroll follow safe when the live reasoning body is conditionally absent or unmounted during a transcript transition.
* fix(desktop): reserve lazy reasoning geometry
Keep historical reasoning rows at their estimated collapsed or bounded expanded height while the lazy panel loads, preventing cumulative transcript displacement in WebView2.
* test(desktop): settle native selection target after warmup
* fix(desktop): keep assistant segment metadata scoped
Problem:
Search result citations could leak into later assistant segments, and an empty
terminal sampling placeholder could absorb the turn duration before removal.
Root cause:
Search sources remained pending after assistant allocation, while turn
completion selected the last assistant before filtering empty placeholders.
Several state-machine contract tests also asserted pre-segment identities.
Fix:
Consume pending search sources once, attach live sources only to their owning
segment, and assign terminal duration after empty-segment cleanup. Update the
affected segment, sub-agent, activation, and footer contract regressions.
Verification:
- pnpm exec tsx src/__tests__/search-sources.test.ts
- pnpm test:stream
- pnpm test:transcript
- node scripts/run-tests.mjs --keep-going
- pnpm build
- Win11 focused search, stream, transcript, and production build checks
- go run ./tools/repolint
- git diff --check
---------
Co-authored-by: erphenheimer <[email protected]>
Problem:
The rich-result implementation extended plugin.go beyond its existing repolint file-size debt budget, causing the PR lint job to fail.
Root cause:
CallToolResult parsing remained in the legacy aggregate plugin file even though the new projection helpers already had a dedicated owner file.
Fix:
Move the complete text, image, and rich-result projection implementation into toolresult_projection.go without changing behavior or the repository lint baseline.
Verification:
- go run ./tools/repolint
- golangci-lint run --timeout=5m ./internal/plugin/...
- go test ./internal/plugin -count=1
- go vet ./internal/plugin
Problem:
Ordinary MCP tool calls silently dropped structuredContent, resource links, embedded resources, audio, and unknown content blocks before the result reached the model.
Root cause:
The model-facing CallToolResult adapter only decoded text and direct image blocks. MCP Apps retained the complete raw result, but the normal agent path had no bounded fallback for the remaining standard content types.
Fix:
Add deterministic, provider-safe rich-result projection with per-item and aggregate budgets. Preserve canonical structured JSON and resource metadata, route embedded images through the existing image channel, summarize audio and binary resources without exposing inline base64 or _meta, and keep the MCP App transcript contract unchanged.
Verification:
- go test ./internal/plugin -count=1
- go test ./...
- go vet ./internal/plugin
Problem:
CodeQL treated the URL-card substring assertion as incomplete host sanitization.
Root cause:
The test flattened the server and target host into one text string and checked both values with includes().
Fix:
Read the rendered server and host elements independently and compare both values exactly.
Verification:
- pnpm exec tsx src/__tests__/mcp-interaction.test.tsx (48 passed)
- git diff --check
Problem:
MCP elicitation rendered as an unstyled inline row with incorrect option semantics and only legacy scalar schema support.
Root cause:
The interaction reused decision-option primitives without component CSS, focus/error ownership, or normalization for the 2025-11-25 schema variants.
Fix:
Add a lazy responsive form surface, accessible button/focus/error semantics, old/new enum and multi-select normalization, safe unsupported-schema fallback, localized privacy guidance, and broader mock/regression coverage. Refresh a stale footer-tail contract assertion.
Verification:
- node scripts/run-tests.mjs (237 suites)
- pnpm build
- go run ./tools/repolint
- in-app browser: responsive layout, focus, validation, and repeated mock trigger
Problem:
The MCP elicitation UI introduced by this PR had no durable browser command, so reviewers could not reopen the structured form without a live MCP server.
Root cause:
The temporary preview path was not represented in the shared decision-surface mock inventory or the browser bridge lifecycle.
Fix:
Add /mock-mcp-interaction, route it through a lazy browser-only fixture, scope answers to the originating tab, and give repeated prompts distinct IDs. Add lifecycle and inventory regressions, and narrowly ratchet the measured raw startup budget while keeping the fixture off the initial graph.
Verification:
- 205 focused frontend assertions
- pnpm build
- go run ./tools/repolint
- browser cancel and repeat-trigger acceptance
Resolve the combined transcript-reader and MCP Apps bundle budgets after measuring the merged frontend. Keep the latest native transcript smoke coverage intact.
Include mcpInteraction in the footer decision-surface memo dependencies so a standalone elicitation event immediately replaces the composer with the new form or URL card. Add a source contract alongside the existing reducer and component coverage to prevent the wiring from regressing.
Problem: all four native jobs failed loading-targeted-history at the
jump-bottom gate with rows=549 earliestTurn=16 mode=tail-follow
bottomDistance=0. The initial history window now hydrates to 549 rows
before the fixture checks it, so loadHistoryRows returns without any
question jump, the view never leaves the tail, and the jump-bottom
control is correctly hidden by its !isAtBottom render condition. Whether
the phase passed depended on how much of the initial window had arrived
when the fixture looked.
Fix: make the jump-bottom step conditional. A view still pinned to the
tail in tail-follow mode needs no return control; leaving the tail
without one remains a fixture error carrying the live state snapshot.
Replace hostname substring matching in the MCP elicitation card test with exact rendered-host and structural button assertions so the test models URL safety correctly and clears the two high-severity CodeQL findings.
Merge the latest main-v2 baseline and resolve the release-note, bundle-budget, and repolint conflicts that left PR #9547 unmergeable.
Negotiate MCP Apps in both directions, prefer stable nested UI metadata, preserve complete bounded CallToolResult payloads, support unambiguous legacy push elicitation, and cancel App-owned calls with their instance lifecycle. Add protocol-version, metadata, result-shape, and lifecycle coverage and wire the MCP App frontend contract test into CI.
Verified with Go 1.26.6 tests and vet for both modules, targeted race tests, frontend production build and protocol tests, golangci-lint including cross-platform tags, govulncheck, repolint, release-note validation, and release workflow contracts.
Problem: 7242d4bc1 still failed loading-targeted-history with the bare
waitFor timeout on all four native jobs, which means the rejection comes
from a gate the previous instrumentation did not cover - the jump-bottom
wait that still runs inside the same fixture phase.
Fix: hoist the live-state snapshot into a shared describeTranscriptState
helper (now including bottomDistance, which reveals whether the view
left the tail), reuse it for the rail and jump-mask gates, and wrap the
jump-bottom gate so the next CI run names the exact failing condition.
Problem: the loading-targeted-history phase still times out on all three
native WebViews after 9ff2995ab, and the bare waitFor rejection cannot
distinguish a missing question rail from a stuck jump mask.
Fix: capture the live jump surface state (overlay phase, marker counts,
earliest loaded turn, scroll geometry) in every internal gate failure,
and restore the mask budget the original signal-then-mask ordering gave
a slow native landing (30s instead of 15s) so the next CI run either
passes on a slow landing or reports exactly which gate is stuck.
Resolve against the v1.33.0 release train (#9553/#9555/#9557):
- Port babe0cd69 into the reader-transaction architecture: a rebound scroll
delivery that lands on a blank viewport now spends the single correction
budget synchronously before paint (prepaint lane with a re-entrancy guard),
while the rAF fallback still waits for mounted coverage and one
unchanged-height interval. The blank-rebound race contract is adopted
unchanged and passes against the transaction state machine.
- Adopt 65d4e524d's stronger storm replay loop (deadline-bounded, gutter
re-resolution, stagnation tracking, mid-approach tail-follow requirement);
it passes against this branch's handoff path.
- Re-measure bundle budgets on the merged tree: gzip 453.736 KiB (budget
453.8), raw 2437.892 KiB (budget 2438.0), with the measurement chain
recorded in the budget comments.
Verification on the merged tree: pnpm test:transcript (970 assertions),
pnpm test:transcript-browser (headless selection + stability with the
stronger storm contract), pnpm build, repolint clean, wails pin v2.13.0,
desktop go test ./... green.
Summary:
Add the merged in-memory projection isolation and registered-root flush repair to the bilingual v1.33.0 Desktop notes.
Verification:
Validated the complete release catalog, ran all release-note tests, rendered both languages, and confirmed eleven unique product pull request references.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Problem:
Windows full-suite runs could collide while opening disposable session projections, and history flushes could finish before registered roots were reconciled.
Root cause:
Memory database identities relied on a coarse platform clock, while the history drain loop consumed path and dirty-root work but omitted the registered-root channel.
Fix:
Add a process-local atomic suffix to shared-memory SQLite identities, drain registered roots during Flush, and replace polling-based rebuild coverage with completion and flush synchronization.
Verification:
Ran each focused regression 20 times, the related package suites, related race tests, the full Go suite, repolint, and diff checks.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Problem: the macOS WKWebView smoke intermittently failed its
loading-targeted-history phase on CI (e.g. a5d1ddf58, 6e0941128) while
passing locally.
Root cause: loadHistoryRows required the mounted row count to grow after
every question-rail click. The transcript keeps a fixed-size history window,
so an earlier page can arrive without growing the count, and a click on an
already-loaded turn changes nothing at all; either case stalled the fixture
for the full 30s wait. Whether the phase passed depended on how much history
happened to be loaded when the click landed.
Fix: after each rail click settles, accept an earlier first loaded turn from
the question navigator (the same signal the browser selection replay uses)
or genuine row growth, and let a no-op click fall through to the next,
earlier ratio instead of stalling. Failure output now includes the row count
and earliest loaded turn.
Verification: headless probe of the fixed loop against the bench page
(bench:tools-38t): two no-op clicks on already-loaded turns fall through in
8s each, the third click loads turns 16 -> 0 and grows 549 -> 936 rows;
fixture budget stays well inside the 90s startup watchdog.
Resolve the second base move (#9519 shell support, release-notes v1.33.0,
plus 444b80284 and 79d612b60 on the transcript surface):
- Keep the reader-transaction architecture in useTranscriptReaderExtentStability
and port 444b80284's rebound invariant into it: an extent-rebound correction
now waits for mounted viewport coverage and one unchanged-height interval
before spending its single write budget (mount-anchor step exempt, it creates
the coverage). The race test keeps this branch's correction value and adopts
the two-phase rebound assertion.
- Union the race-test harness (row index metadata + rebound coverage row) and
the stability replay changes from 79d612b60.
- Compact two trivial callbacks so useTranscriptScrollArbiter.ts stays under
the repolint 800-line ceiling (799).
- Re-measure bundle budgets on the merged tree: gzip 449.758 + 3.850 =
453.608 KiB (budget 453.7), raw 2422.371 + 15.127 = 2437.498 KiB (budget
2437.6), with the measurement chain recorded in the budget comments.
Verification on the merged tree: pnpm test:transcript (968 assertions),
pnpm test:transcript-browser (headless selection + stability incl. storm tail
handoff), pnpm build (all pre-steps + budget), repolint clean, wails pin
v2.13.0 intact, desktop go test ./... green.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Problem: Windows WebView2 can publish a restored transcript extent while the currently clamped viewport has no mounted Virtuoso row, exposing one blank frame before the rAF fallback runs.
Root cause: reader extent correction was only attempted from animation frames, so a rebound scroll delivery could already paint the transient empty viewport.
Fix: reuse the single reader-stability budget synchronously for a correctable blank rebound delivery, while retaining the stable covered-frame fallback. Add a focused race contract and a narrow raw bundle ratchet for the bounded handoff.
Verification: pnpm test:transcript; pnpm test:transcript-browser; five consecutive transcript scroll stability replays; pnpm test:remote; pnpm test:performance; pnpm build; repolint; git diff --check.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Problem: WebView2 can restore the native transcript extent before Virtuoso has remounted visible rows, so reader-stability correction can expose a blank frame.
Root cause: the correction was eligible on the first rebound sample and did not require mounted viewport coverage or stable restored geometry.
Fix: gate the single correction on a nonblank viewport and one unchanged-height interval, with a regression test covering the rebound race.
Verification: pnpm test:transcript; pnpm test:transcript-browser; five consecutive transcript scroll stability replays; pnpm test:remote; pnpm test:performance; pnpm build; repolint.
Problem:
The Windows transcript browser gate intermittently sampled the dock resize before geometry settled, and its hydration setup could keep issuing wheel events while the viewport moved backward. Failures therefore changed signature across equivalent runs.
Root cause:
Two setup waits accepted a single transient frame, while the hydration driver treated only an unchanged position as stalled. Extent coverage failures also omitted the sampled geometry needed for classification.
Fix:
Require consecutive stable tail frames after dock resizes, end the reader lease whenever downward setup stops advancing, and include extent samples in failure diagnostics.
Verification:
- transcript-scroll-stability.mjs: 5 consecutive passes
- pnpm test:transcript-browser
- go run ./tools/repolint
- git diff --check
Problem:
- pnpm test:all failed because the remote project source-contract test read only remote_projects.go.
Root cause:
- The background resume generation guard and rollback moved to remote_tab_pending_selection.go, but the static assertion still expected them in the registration owner.
Fix:
- Read both current owners and assert registration revisioning and background resume rollback in their respective files.
Verification:
- pnpm exec tsx src/__tests__/remote-project-tree.test.tsx
- pnpm test:remote
- pnpm test:performance
- pnpm build
- git diff --check
Resolve overlaps with #9540/#9541/#9542: keep both the reader-transaction
exports (revalidateTail, noteLayoutTransient source) and the pre-paint live
tail repair (pinLiveTailBeforePaint, userResizeRevision, live-region
minHeight); union the transcript test gate; re-measure the bundle budgets on
the merged tree (gzip 452.529 KiB, raw 2432.400 KiB).
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
* feat(sandbox): 支持 Git-Bash 自主选择与跨平台一键自动安装
背景：
大语言模型生成的命令绝大多数为 POSIX 语法（如 grep、sed、管道、重定向等），
但 Windows 默认使用 PowerShell，语法不兼容导致命令执行频繁失败。
macOS/Linux 虽然自带 bash，但部分精简容器或特殊环境也可能缺失。
本次变更：
1. 深度自动探测 Git-Bash 安装路径
- Windows：扫描 ProgramFiles、Scoop、Chocolatey、注册表（HKLM/HKCU）
- 自动识别并纠正 git-bash.exe → bin/bash.exe（headless 可执行文件）
- 注入 MSYS_NO_PATHCONV=1 防止 MSYS2 路径篡改
2. 跨平台一键自动安装后端
- Windows：通过 winget install --id Git.Git 静默安装
- macOS：通过 brew install bash git 安装
- Linux：自动适配 apt-get/dnf/pacman/zypper/apk，非 root 自动 sudo
3. 桌面端设置面板集成
- 当用户选择 bash/auto 但系统未检测到时，展示安装提示卡片
- 一键安装按钮，带 Loading/成功/失败 三态反馈
- 安装成功后自动写入配置并刷新生效状态
4. 多语言支持
- 中文简体、英文、中文繁体三语本地化
* chore: format go code and update repolint baseline budget
* fix(desktop): harden Windows shell support
Problem:
The Git for Windows helper could rebuild the active controller after install, miss an explicitly configured portable Git Bash, and cancel only the direct winget process.
Root cause:
The frontend reused the session reload callback for detection refresh, capability probing ignored tools.shell.path, and the installer called exec.Cmd.Run without repository process-tree tracking.
Fix:
Separate pure settings refresh from explicit session reload, pass the configured path through shell inventory and install preflight, track the winget process tree, and add deterministic backend/frontend race coverage.
Verification:
go test ./... (desktop module)
go test -race ./internal/sandbox
go test -race focused desktop shell support
frontend shell support test, typecheck, hooks lint, and production build
Windows amd64 and arm64 desktop test-binary cross-compilation
* feat(desktop): add cross-platform shell repair guidance
Problem: shell support offered a safe Windows path but macOS and Linux only exposed generic manual guidance.
Root cause: the inventory reported only Bash on Unix and the Settings contract had no platform-specific, copy-only remediation.
Fix: report Bash, zsh, and sh capabilities; expose allowlisted Homebrew and distro commands without executing them or prescribing sudo; and invalidate discovery only on explicit session reload.
Verification: go test ./...; cd desktop && go test ./...; frontend full tests, performance, production build, bundle budgets, repolint, and Windows cross-compilation.
* feat(desktop): separate native shell fallback from Git support
Problem:
macOS repair guidance treated Bash as mandatory and coupled shell availability with Git installation.
Root cause:
the resolver only modeled Bash and PowerShell as executable shells, while Settings had no independent Git capability.
Fix:
fall back from Bash to native zsh and sh on macOS, discover Git independently, and expose platform-safe copy-only Git repair guidance without changing persisted shell preferences.
Verification:
go test ./...
cd desktop && go test ./...
frontend 230-suite test run, typecheck, performance, production build
Windows amd64/arm64 sandbox and desktop cross-compiles
repolint and diff checks
* fix(desktop): make Git Bash repair manual-only
Problem:
The Git.Git winget package may elevate even when invoked with --scope user, so the settings helper could unexpectedly trigger UAC or install machine-wide.
Root cause:
WinGet scope selection does not force the Git for Windows installer scope; the current package uses an elevating installer for both user and machine entries.
Fix:
Remove winget execution and cancellation state, return manual_required for Windows, and expose only the official download plus explicit re-detect flow. Keep the Wails methods as safe compatibility results/no-ops.
Verification:
- cd desktop && go test ./...
- focused shell-support frontend test (21/21)
- frontend typecheck and production build/bundle budget
- repolint in a clean current-patch worktree
- Windows amd64/arm64 test-binary compilation
- native Windows 11 ARM64 policy test
* chore(desktop): reconcile shell support with main-v2
Problem:
- The rebased shell-support branch retained stale automatic-installer comments and bundle ratchets from its older base.
Root cause:
- Main-v2 added notification-volume UI after this branch forked, while the shell repair policy changed to manual-only.
Fix:
- Measure the combined latest-main bundle and apply narrow ratchets.
- Align shell inventory comments with manual re-detection and the macOS zsh/sh fallback.
Verification:
- pnpm build
- pnpm test:all (baseline remote source-contract failure documented separately)
- go test -race ./internal/sandbox ./internal/control ./internal/shellrun ./internal/tool/builtin
- cd desktop && go test ./...
- Windows amd64/arm64 cross-compilation
* fix(sandbox): harden shell capability discovery
Problem:
- Passive Git detection could execute Apple's inactive /usr/bin/git shim and open the Command Line Tools installer.
- A retained PowerShell path could be admitted into the Windows Bash inventory after the shell preference changed.
Root cause:
- Git probing had no platform preflight for the Apple shim.
- The shell inventory cache and configured-path filtering ignored the selected shell preference.
Fix:
- Gate the Apple shim with a side-effect-free xcode-select preflight before running git --version.
- Key discovery by preference and path, and only admit configured Windows Bash paths compatible with the preference.
- Preserve the path-only compatibility APIs and add regression coverage for both cases.
Verification:
- go test ./...
- cd desktop && go test ./...
- go test -race ./internal/sandbox
- go vet ./... (root and desktop modules)
- go run ./tools/repolint
- Windows amd64/arm64 sandbox and desktop test-binary compilation
Co-authored-by: SivanCola <[email protected]>
* fix(sandbox): validate configured shell paths
Problem:
- Switching shell preferences preserved an explicit path that could belong to another interpreter, crossing Bash and PowerShell argv contracts.
- Explicit WSL and unresolved git-bash launchers could bypass inventory safeguards, and the checked-in repolint baseline did not reflect the branch's actual findings.
Root cause:
- ResolveShell and the integrated terminal trusted path existence independently of the selected shell kind, while the environment label reused raw config state.
- The baseline was regenerated from a stale working state.
Fix:
- Centralize configured-path compatibility, preserve unknown wrappers, reject known cross-kind, WSL, and MinTTY paths, align terminal and provider shell labels with resolved execution, and refresh the exact repolint snapshot.
- Add deterministic cross-kind, WSL, wrapper, argv, terminal, and shell-label regressions.
Verification:
- go test ./...
- go vet ./...
- cd desktop && go test ./...
- cd desktop && go vet ./...
- go test -race ./internal/sandbox
- Windows amd64/arm64 test compilation and Windows 11 ARM64 focused native tests
- pnpm build
- go run ./tools/repolint
Co-authored-by: SivanCola <[email protected]>
* fix(boot): preserve stable shell labels
Problem:
- The configured-shell correction made automatic shell resolution publish an absolute executable path in the provider-visible environment section.
- That widened cache keys for users without an explicit shell path and contradicted the low cache-impact contract.
Root cause:
- The label helper treated every resolved executable path as user-configured state.
Fix:
- Keep the stable interpreter kind for automatic resolution and emit a resolved executable path only when the user configured an explicit path.
- Cover both the cache-stable default and stale-path correction cases.
Verification:
- go test ./internal/boot ./internal/tool/builtin ./internal/sandbox
- go vet ./internal/boot ./internal/tool/builtin ./internal/sandbox
- go test -race ./internal/boot ./internal/sandbox
- go run ./tools/repolint
- git diff --check
Co-authored-by: SivanCola <[email protected]>
* fix(sandbox): honor configured Bash priority
Problem:
- Windows auto resolution and the Settings capability view selected a PATH Bash before an explicitly configured compatible Bash path.
- This contradicted the documented discovery order and made portable or pinned Git Bash configurations ineffective.
Root cause:
- The configured path lived in the candidate list, but both resolution and capability projection checked PATH before iterating those candidates.
- Capability probes also lacked an injected test seam, so a synthetic-path test was not portable to native Windows.
Fix:
- Resolve a compatible configured Windows Bash before PATH in auto mode and mirror the same order in capability projection.
- Keep arbitrary wrappers opt-in to prefer=bash, add a cached probe seam, and cover resolver plus Settings source priority.
Verification:
- go test ./... && go vet ./...
- go test -race ./internal/sandbox
- focused priority and shell regressions with -count=20
- desktop focused shell/settings contract tests
- Windows amd64/arm64 test compilation
- Windows 11 ARM64 native priority tests
- go run ./tools/repolint
- git diff --check
Co-authored-by: SivanCola <[email protected]>
* test(sandbox): use WaitGroup.Go in inventory races
Problem:
- The current root golangci-lint job rejected two manual Add/go/defer Done patterns in the shell inventory cache test.
Root cause:
- Go 1.26 and golangci-lint v2.12.2 now prefer sync.WaitGroup.Go for directly owned test goroutines.
Fix:
- Launch both cache-test goroutines through WaitGroup.Go without changing synchronization or assertions.
Verification:
- golangci-lint v2.12.2 run --timeout=5m ./...
- go test ./internal/sandbox
- go run ./tools/repolint
- git diff --check
Co-authored-by: SivanCola <[email protected]>
---------
Co-authored-by: SivanCola <[email protected]>
Problem: after a real, stable extent shrink (storm ref-resolution settled
at 64103px from a 69115px estimate high-water), a reader parked at the
physical bottom could never hand off to tail-follow. The bench storm replay
reached the final resolved tail (distance 0) and still timed out in manual
mode with reader intent ended.
Root cause: the reader transaction collapse high-water (baselineHeight /
collapseObserved) never reset for a shrink that did not rebound. Tail
eligibility vetoed every handoff against the stale high-water, and the
browser clamp left the parked reader no room to produce further downward
displacement within the shrunken range.
Fix: accumulate accepted direction-consistent native travel across the
continuous gesture (inherited by same-direction follow-up epochs). When a
collapsed extent holds stable for two painted samples and the gesture has
produced real directional travel, accept the shrunken range as the new
extent baseline so its physical tail becomes claimable. In-place wheeling
at a collapse-fabricated bottom produces no travel, so a transient or
unread range still cannot be laundered into a false tail claim.
Also stabilize the storm replay contract: pace bounded 720px wheels instead
of coalesced 10k deltas, continue wheeling to the final resolved tail before
expecting handoff, and attach the reader-transaction/geometry diagnostic
stream to failure output through a page-side bench hook.
Verification:
- pnpm test:transcript (960 assertions, including new positive/negative
race contracts for the stabilized-shrink acceptance)
- pnpm test:transcript-browser (headless Chromium selection + stability,
including the storm tail handoff)
- pnpm build (lint:hooks, waapi, scroll-writer, tsc, vite, bundle budget;
raw initial ratchet 2429.2 -> 2429.8 KiB for the measured +0.554 KiB)
* fix(remote): apply rotated provider keys to local-proxy tabs immediately
The credential proxy captured the provider key in its route closures,
and nothing re-registered routes when a key was saved on the desktop:
remote local-proxy tabs kept authenticating with the rotated-out key
until a model switch, tunnel heal, or restart, while local sessions
picked the new key up immediately.
Saving a provider credential now re-registers every ready serve's
route on connected local-proxy hosts. Route tokens derive from
host/workspace/model identity only, so host-side provider entries stay
valid and no remote restart is needed.
* fix(remote): refresh every credential proxy route safely
Problem:
Rotated local provider keys left existing model-token routes on the old credential, and concurrent saves could republish stale route state.
Root cause:
The remote manager asynchronously re-registered only the latest ready workspace model, while credential resolution and route publication had no shared serialization boundary.
Fix:
Let the credential proxy track every model ref, synchronously rebuild all registered routes after a save, and serialize credential resolution through route replacement. Move the save hook out of the oversized settings file.
Verification:
- cd desktop && go test ./... -count=1
- cd desktop && go test -race . -run focused credential proxy tests -count=20
- cd desktop && go vet ./...
- go run ./tools/repolint
Co-authored-by: SivanCola <[email protected]>
* fix(remote): revoke stale credential proxy routes
Problem:
Clearing a provider credential or removing a provider left existing remote local-proxy tokens able to forward with a captured secret.
Root cause:
Credential proxy routes tracked only the model reference and refresh failures retained the previously published reverse proxy.
Fix:
Track credential and provider ownership on each route, serialize targeted revocation with route publication, revoke routes after credential clears and provider removals, and fail closed when a registered route can no longer resolve.
Verification:
- cd desktop && go test ./... -count=1
- cd desktop && go test -race . -count=20 -run focused credential proxy tests
- cd desktop && go vet ./...
- go vet ./...
- go run ./tools/repolint
Co-authored-by: SivanCola <[email protected]>
* fix(remote): avoid nested config locks during proxy refresh
Problem: Saving a provider key from an access-install transaction could pause on the already-held user-config file lock and skip refreshing active credential proxy routes.
Root cause: Route refresh used the migration-capable config loader even when its caller already owned the config edit transaction.
Fix: Load the same effective configuration through the non-migrating read-only path, and cover credential rotation while the config edit lock is held.
Verification: The lock regression passed 20 iterations, the focused race suite passed 20 iterations, the full Desktop suite passed, and root/Desktop vet plus repolint passed.
Co-authored-by: SivanCola <[email protected]>
---------
Co-authored-by: SivanCola <[email protected]>
* fix(frontend): stabilize running turn transitions
Problem:
Running turns could collapse reasoning and process disclosures between reasoning, answer, and tool phases. On WebView2, a transient live-footer contraction could clamp the viewport and produce a visible reverse jump.
Root cause:
Disclosure defaults followed individual streaming phases instead of turn ownership, and live-footer structural commits briefly exposed a smaller native extent before Virtuoso mounted the next rows.
Fix:
Keep untouched reasoning and process disclosures aligned with the active turn lifecycle, retain subagent reasoning while its task runs, pin only an already-owned live tail before paint, and carry a monotonic footer height floor across footer remounts. Extend geometry modeling and focused regression coverage.
Verification:
- pnpm typecheck
- pnpm build
- pnpm test:transcript
- focused reasoning, subagent, process-fold, live-split, row-model, and recovery-race suites
- Windows 11 native WebView2 2x4x2 settings matrix: 16/16 passed with zero reverse displacement and blank frames
- current main-v2 initial JS gzip: 447.639 KiB baseline to 448.228 KiB measured; 448.3 KiB budget
- current main-v2 initial raw JS and CSS: 2413.183 KiB baseline to 2415.201 KiB measured; 2415.3 KiB budget
* chore(frontend): satisfy transcript source budgets
Problem:
CI repolint rejected the running-turn stability change because several already-baselined transcript owners and one race test exceeded their source-size ceilings.
Root cause:
The live-turn split, footer stability hook, pre-paint tail repair, and JSDOM frame harness were implemented inline in files already at their ownership limits.
Fix:
Extract live-turn geometry, stability, tail-settle, and recovery-race setup into focused owners without changing behavior or raising repolint baselines. Keep the measured startup increase behind the smallest 0.1 KiB bundle ratchets.
Verification:
- go run ./tools/repolint
- pnpm test:transcript
- pnpm build
- initial JavaScript gzip: 448.321 KiB / 448.4 KiB
- initial raw JavaScript and CSS: 2415.572 KiB / 2415.7 KiB
* fix(frontend): scope live turn height stabilization
Problem:
A held live-footer height could survive an explicit disclosure collapse or leak into another running tab, leaving blank space or carrying stale geometry across transcript surfaces.
Root cause:
Live-turn stability refs and the held floor were not keyed to transcript surface or explicit user-resize lifecycle.
Fix:
Fence the live floor and ResizeObserver by a surface/user-resize generation, advance that generation from the shared resize owner, and cover tab switches and explicit collapses. Record the measured startup budget delta.
Verification:
- pnpm test:transcript
- node scripts/test-todo-visibility.mjs && node scripts/run-tests.mjs --keep-going (233/233 suites)
- pnpm test:typecheck
- pnpm build
- go run ./tools/repolint
- Win11 native WebView2 2x4x2 settings matrix: 16/16 passed, max reverse 26 px, blank frames 0, continuity failures 0
* fix(remote): stop superseded status races from surfacing as crashes
A /status poll losing the revision race against an SSE-derived frame is
a benign stale snapshot, but RemoteTabStatus returned it as an opaque
error and the turn_done-triggered refreshStatus call sites let the
rejection escape as an unhandledrejection crash report.
Return a sentinel (errors.Is-able) with the same message, swallow it at
the fire-and-forget call sites, and filter it in the global crash
handler as a belt-and-braces guard. The SSE feed and the running-state
watchdog still converge the surface.
* fix(frontend): inspect promise rejection reasons
Problem:
The global crash filter recognized superseded remote status errors only when they arrived through ErrorEvent.error, so the PromiseRejectionEvent fallback still surfaced a crash.
Root cause:
Promise rejections carry their rejected value in reason, but the shared event-message normalizer never inspected that field.
Fix:
Normalize PromiseRejectionEvent.reason alongside ErrorEvent.error, keep unrelated rejection reasons reportable, and consolidate the filters so source and bundle budgets remain within their existing limits.
Verification:
- pnpm exec tsx src/__tests__/crash-reporting.test.ts
- pnpm test:typecheck
- pnpm build
- pnpm test:motion
- go run ./tools/repolint
- git diff --check
* fix(deps): patch x/crypto SSH vulnerability
Problem:
The PR CI govulncheck job detected GO-2026-6303 through the SSH test server and marked the check red.
Root cause:
The root module still pinned golang.org/x/crypto v0.54.0, while the source-address enforcement fix ships in v0.55.0.
Fix:
Upgrade only the root module x/crypto dependency and checksums to v0.55.0, leaving the unrelated grouped dependency updates out of this PR.
Verification:
- GOTOOLCHAIN=go1.26.6 go run golang.org/x/vuln/cmd/govulncheck@latest ./...
- go test ./... -count=1
- go test -race ./internal/remote/... -count=1
- go vet ./...
- go run ./tools/repolint
- git diff --check
Co-authored-by: SivanCola <[email protected]>
* fix(deps): align desktop x/crypto version
Problem:
After the root x/crypto security update, Desktop CI stopped immediately because its nested module still pinned v0.54.0 and go mod tidy produced an uncommitted upgrade.
Root cause:
The Desktop module imports the root module through its local replace, so minimal version selection requires both modules to record x/crypto v0.55.0 consistently.
Fix:
Run Desktop module tidy with Go 1.26.6 and commit only the matching x/crypto version and checksum update.
Verification:
- GOTOOLCHAIN=go1.26.6 go mod tidy
- GOTOOLCHAIN=go1.26.6 go test ./... -count=1
- GOTOOLCHAIN=go1.26.6 go test -race -run Test(DarwinWorkspaceWatcher|WorkspaceChangeHub|ResolveTerminal|Terminal|EmptyTerminal|UnixTerminalProcess) .
- GOTOOLCHAIN=go1.26.6 go vet ./...
- GOTOOLCHAIN=go1.26.6 govulncheck ./...
- go run ./tools/repolint
- git diff --check
Co-authored-by: SivanCola <[email protected]>
---------
Co-authored-by: SivanCola <[email protected]>
Integrate main-v2 PR #9536 after the MCP branch validation window. The only shared file, CHANGELOG.md, merged cleanly without altering the MCP entries.
Verified the 77-case remote wizard suite, production frontend build and bundle budgets, repolint, and staged diff checks before publishing.
Integrate notification-volume and session-catalog lifecycle changes from main-v2 before publishing the MCP 2026 branch.
Resolve the shared frontend bundle budget by measuring the combined production build (449.049 KiB gzip, 2419.536 KiB raw) and retain only the four-line desktop/app.go repolint carry-forward introduced by the upstream overlap.
Verified with root and desktop Go tests, all 235 frontend suites, production build, vet, cache guard, repolint, focused package races, and a 10-run race retry of the one load-sensitive workspace watcher test.
* feat(frontend): open wizard host suggestions from an explicit arrow
Problem:
- Step 1's host input revealed saved SSH connections only while focused,
so the affordance stayed undiscoverable and the list silently filtered
by whatever text was typed.
Root cause:
- The suggestion list was wired to input focus/blur with a typed-text
filter instead of an explicit control.
Fix:
- Add an in-input chevron toggle (aria-haspopup/expanded/controls) that
opens the unfiltered saved-host list; hide the arrow with no saved
hosts and disable it while a connection is busy.
- Close the list on pick, arrow toggle, an outside pointer press, or the
first Escape before the wizard-level Escape; lead the list with a
saved-connections caption and append non-22 ports to user@host rows.
- Drop the focus/blur popup path, the typed-text filter, and the
mousedown blur-guard; keep the picked host focused in the input.
- Retarget the wizard contract tests at the arrow flow and record the
change under Unreleased in CHANGELOG.md.
Verification:
- cd desktop/frontend && node --import ./scripts/css-stub-register.mjs
--import tsx src/__tests__/remote-connect-wizard.test.tsx (67 passed)
- cd desktop/frontend && pnpm test:remote (sole failure is the
pre-existing remote-project-tree generation-guard one, reproduced on
a stashed baseline)
- cd desktop/frontend && pnpm check:css && pnpm lint:hooks && pnpm test:typecheck
- cd desktop/frontend && pnpm build (bundle-budget and token gates pass)
- Playwright browser-preview drive of the real UI: 17 interaction and
10 geometry/style assertions pass
* Fix saved host menu accessibility
Problem:
- Closing the saved-host popup from a focused item dropped focus outside the remote connection dialog.
- The popup advertised listbox semantics while exposing ordinary buttons, and its 22px toggle missed the minimum target-size check.
Root cause:
- Popup visibility was not paired with explicit focus ownership or a coherent ARIA keyboard pattern.
Fix:
- Model saved hosts as a menu with menuitems, arrow/Home/End navigation, deterministic Escape and Tab focus routing, and focus restoration.
- Enlarge the toggle target and add regression coverage for the keyboard and ARIA contract.
Verification:
- Focused remote connection wizard tests (75 passed)
- CSS, hook lint, and TypeScript checks
- Production frontend build and bundle budgets
- Chromium accessibility tree, keyboard focus, target-size, and Lighthouse checks
- git diff --check
Co-authored-by: SivanCola <[email protected]>
* fix(frontend): scope host label to its input
Problem:
- The saved-host toggle shared the host input's implicit label and polluted the input's accessible name.
Root cause:
- The host label wrapped both the text field and its adjacent menu action instead of targeting only the text field.
Fix:
- Associate the host label with a stable input ID and keep the saved-host toggle outside the label.
- Add regression checks for the exact label association and button structure.
Verification:
- Remote connection wizard tests (77 passed)
- CSS checks, hooks lint, and test TypeScript checks
- Production frontend build and bundle budgets
- Chromium accessibility tree, DOM association, menu interaction, and visual check
- git diff --check
---------
Co-authored-by: SivanCola <[email protected]>
Problem:
The current-base Wails pin guard rejected the transcript native smoke workflow even though it reads the shared .wails-version pin correctly.
Root cause:
The guard predated the dedicated native smoke workflow and only allowed CI and release workflow install sites.
Fix:
Treat transcript-native-smoke.yml as a supported pinned workflow and cover it in the guard fixture.
Verification:
- bash scripts/check-wails-pin.sh
- bash scripts/check-wails-pin.test.sh
- go run ./tools/repolint
Problem:
#9513 failed the transcript browser gate on Linux and Windows, exceeded the Transcript line budget, and failed govulncheck.
Root cause:
The reader guard could accept a still-collapsed extent before the idle boundary, selection edge polling stopped at transient virtual boundaries, and the tool-dense browser fixture did not expose a deterministic 20-turn selection window. The browser probes also mixed pre-ownership writes into selection assertions. Separately, x/crypto v0.54.0 is affected by GO-2026-6303.
Fix:
Delay persistent collapse correction until reader idle, keep selection edge observation alive through extent rebound, make the headless selection and storm contracts synchronize on real ownership and geometry transitions, restore the existing line budget, and update x/crypto to v0.55.0 in both Go modules.
Verification:
- pnpm --dir desktop/frontend test:transcript
- pnpm --dir desktop/frontend build
- node desktop/frontend/bench/transcript-selection.mjs
- node desktop/frontend/bench/transcript-scroll-stability.mjs
- go run ./tools/repolint
- go test ./...
- cd desktop && go test ./...
- GOTOOLCHAIN=go1.26.6 govulncheck ./... in both modules
Problem: The opt-in Chrome DevTools MCP canary failed against the latest server because page-scoped tools now require pageId.
Root cause: The test relied on the selected-page side effect and called page-scoped tools without the ID returned by new_page.
Fix: Parse the selected page ID from new_page output, validate malformed or ambiguous output, and pass the ID to every page-scoped call.
Verification: go test ./internal/plugin -count=1; go test -race ./internal/plugin -run '^TestParseSelectedChromePageID$' -count=1; go vet ./internal/plugin; REASONIX_LIVE_CHROME_MCP=1 go test ./internal/plugin -run '^TestChromeDevtoolsMCPLive$' -v -count=1 -timeout=3m
* fix(desktop): bound session catalog rebuild lifecycle
Problem:
- Manual session catalog rebuilds could leave the sidebar stuck in a rebuilding state.
- Unknown progress rendered as 0/? and healthy states could expose a rebuild action.
Root cause:
- The long-lived refresh watcher owned the one-shot rebuilding flag, so the flag depended on a goroutine that was designed not to exit.
Fix:
- Run atomic rebuilds synchronously inside the Wails call and restart an ordinary watcher afterward.
- Preserve published counts during rebuild, publish an explicit canRebuild contract, and fail closed on older backends.
- Centralize the sidebar presentation so automatic work, failures, and retry actions have distinct states.
Verification:
- go test ./internal/sessioncatalog ./internal/projectiondb
- cd desktop && go test ./...
- cd desktop && go test -race -run Test.*SessionCatalog\|Test.*RebuildSessionCatalog .
- cd desktop/frontend && pnpm test
- cd desktop/frontend && pnpm build
- go vet ./...
- go run ./tools/repolint
* fix(desktop): preserve catalog revision across rebuild
Problem:
- Atomic catalog replacement restarted revision numbering from zero.
- The project tree rejected the rebuilt snapshot and topic pages as stale, which could leave the sidebar in a rebuilding or opening state.
Root cause:
- The replacement projection did not inherit the revision fence already rendered by the frontend.
- The rebuild-finished event reused the pre-rebuild revision instead of the committed replacement revision.
Fix:
- Seed the replacement catalog with the previous revision as a lower bound before reconciliation.
- Publish the committed replacement revision and keep the existing frontend stale-response guards intact.
- Add a regression test with an intentionally high previous revision.
Verification:
- go test ./internal/sessioncatalog ./internal/projectiondb
- cd desktop && go test ./...
- cd desktop && go test -race -run 'Test.*SessionCatalog|Test.*RebuildSessionCatalog' .
- go test -race ./internal/sessioncatalog
- frontend presentation/runtime tests, typecheck, and lint:hooks
- go vet ./... in root and desktop
- go run ./tools/repolint
* fix(desktop): abort catalog rebuild before unsafe replacement
Problem:
- A session catalog stop deadline could expire while an explicit reconcile or SQLite handle was still active.
- The rebuild proceeded anyway, allowing a busy failure on Windows or stale old-catalog revision events on POSIX.
Root cause:
- stopSessionCatalog discarded whether reconcile jobs, catalog workers, and the watcher actually drained before the deadline.
Fix:
- Return an explicit completion result from the catalog stop boundary.
- Abort the atomic projection replacement when the old generation has not fully stopped, while preserving the ordinary watcher restart path.
- Add deterministic blocked-reconcile coverage for both successful drain and timeout-without-replacement behavior.
Verification:
- cd desktop && go test ./...
- cd desktop && go test -race -count=10 -run '^TestRebuildSessionCatalogDoesNotReplaceBeforeOldReconcileStops$' .
- cd desktop && go test -race -count=3 -run 'Test.*SessionCatalog|Test.*RebuildSessionCatalog|TestStopSessionCatalog' .
- cd desktop && go vet ./...
- root vet, repolint, sessioncatalog/projectiondb tests, frontend presentation/runtime tests, typecheck, and hooks lint
* fix(desktop): join concurrent catalog rebuild callers
Problem: Concurrent Wails callers could receive a successful rebuild Promise while the owning rebuild was still running or would later fail.
Root cause: The atomic single-flight guard returned nil immediately for followers and published no completion or result for them to await.
Fix: Publish one mutex-protected rebuild flight with a completion channel and shared error. Followers join that flight, and panic cleanup still releases waiters without starting a second rebuild. Add a deterministic channel-driven failure test.
Verification: The focused rebuild suite passed 10 times under the race detector. The complete Desktop test suite, Desktop vet, sessioncatalog/projectiondb tests, and repository lint all passed.
* fix: fence session catalog status writes
Problem: a catalog status read started by the rebuild lifecycle event could resolve after a failed rebuild restored its retry action, replacing that state with the temporary watcher handoff status.
Root cause: ProjectTree let snapshot and event-driven catalog reads write state without respecting the awaited rebuild operation's local ownership boundary.
Fix: generation-fence asynchronous status writes, retain the retryable failure snapshot until the next explicit rebuild, and cover both pre-failure and post-failure late responses.
Verification: focused ownership and presentation tests; frontend typecheck, test typecheck, hooks lint, and all 231 discovered suites; desktop go test ./...
* fix: preserve ProjectTree size budget
Problem: the session catalog race fix increased ProjectTree.tsx beyond its repository lint budget.
Root cause: the owner-state guards were expanded as new lines inside a file whose existing overage has a zero-growth baseline.
Fix: move the pure guard into the existing catalog presentation module and keep the ProjectTree wiring at its prior line count without changing behavior or updating the lint baseline.
Verification: go run ./tools/repolint; focused catalog ownership and presentation tests; frontend typecheck, test typecheck, and hooks lint.
* fix: stay within frontend bundle budget
Problem:\nThe ownership helper introduced by the rebuild race fix pushed the initial raw frontend bundle over its enforced budget.\n\nRoot cause:\nA production export was used for a predicate small enough to keep at the two asynchronous write sites.\n\nFix:\nInline the ownership fence in ProjectTree and keep the deterministic predicate local to the regression test.\n\nVerification:\n- pnpm build\n- pnpm test:typecheck\n- pnpm exec tsx src/__tests__/session-catalog-status-ownership.test.ts\n- go run ./tools/repolint
* fix: keep catalog failure UI within budget
Problem:\nThe PR merge against the latest main-v2 exceeded the initial raw frontend budget by 47 bytes even though the branch-only build passed.\n\nRoot cause:\nThe new catalog failure locale key entered the startup locale graph, while ProjectTree itself is loaded lazily.\n\nFix:\nCompose the localized failure banner from the existing organizing-history and failed labels, and remove the duplicate failure toast.\n\nVerification:\n- latest-main-v2 temporary merge: pnpm build\n- pnpm build\n- node scripts/run-tests.mjs --keep-going\n- pnpm test:typecheck\n- go run ./tools/repolint
* Add configurable notification volume
Problem: Desktop notification WAV playback applied fixed 35% and 25% gains, leaving recent completion and attention prompts too quiet with no user control.
Root cause: Each event selected its own hard-coded playback attenuation and the Sound settings had no shared notification-volume preference.
Fix: Add a persisted 0-100 notification volume with a 70% upgrade default, route WAV and synthesized prompts through the shared gain, raise synthesized prompt peaks while keeping full-scale gain bounded, expose an accessible responsive Settings slider, and localize it in all supported languages. Measured against current main-v2, raise the initial gzip budget from 447.8 to 447.9 KiB and the raw budget from 2413.2 to 2414.9 KiB for attributable 447.816 KiB and 2414.737 KiB results.
Verification: pnpm build; focused sound, slider, responsive-layout, and startup-settings tests; typecheck and hooks lint; real browser DOM and layout check; git diff --check. The broad topic-activation test has the same pre-existing 24/25 failure on current main-v2 and this branch.
* Ratchet SettingsPanel size for volume wiring
Problem: The notification-volume wiring adds 15 weighted file-size units to the existing General settings owner, causing the repository lint budget to fail.
Root cause: The control itself is already extracted, but its persisted state and settings-row integration correctly remain in SettingsPanel.
Fix: Increase only the SettingsPanel file-size baseline from 7269 to 7284. No other repository lint baselines are changed.
Verification: go run ./tools/repolint; git diff --check.
* Normalize bundled notification sounds
Problem: The configurable master volume applied the same gain to WAV assets whose measured loudness differs by up to 4.1 LUFS, so selecting different completion and attention sounds could still produce inconsistent audibility.
Fix: Apply conservative per-source trims targeting the quietest bundled WAV, without boosting recorded peaks. Keep the master volume as the final multiplier and ratchet startup budgets to the newly measured output.
Verification: pnpm exec tsx src/__tests__/sound.test.ts (29 passed); pnpm typecheck; pnpm lint:hooks; pnpm build; go run ./tools/repolint; git diff --check.
The focused WKWebView workflow only needs a production Vite artifact. Keep lint, typecheck, and bundle budgets in their existing gates so platform-specific gzip drift cannot prevent the native geometry test from running.
Problem: WKWebView can commit a delayed Virtuoso range replacement after a short native wheel gap, causing large reverse jumps, blank frames, and false-bottom handoff.
Root cause: the reader transaction released its logical anchor and enlarged mount window after two quiet frames, while a later same-direction input could adopt the collapsed extent as a fresh baseline.
Fix: keep bounded observational settling alive for one second, create a new ownership epoch after the 180ms input boundary while inheriting the extent high-water, block tail claims from collapsed geometry, and retain a wider measured-row corridor. Add focused native diagnostics and a standalone macOS smoke workflow.
Verification: test:transcript; 5x Chromium and 5x WebKit reader replay; build; repolint; actionlint; desktop go test ./...
Desktop Apps run in the double-iframe model: each Apps server gets its
own 127.0.0.1 loopback origin (cookie/storage/origin isolation between
servers) serving only the outer relay page and the validated resource
proxy. The relay hardens the channel - instance-nonce binding on the
first parent message, event.source checks on every frame, an 8 MiB frame
cap, and no RPC before the inner sandboxed frame loads; top navigation,
popups, objects, and downloads never load. Resources are decoded with a
4 MiB cap, must be ui:// with an html/mcp-app mime, are served with the
declared CSP (deny-all default; only exact http/https origins, no
wildcards or credentials), and carry a SHA-256 header so history can
refuse to restore UI across a changed upstream.
The frontend mounts the official AppBridge (ext-apps 1.7.5 pinned) over
PostMessageTransport inside a lazy chunk: app tools/call routes through
Controller.MCPAppCallTool (instance-gated same-server/visibility/
generation resolution, hooks around dispatch, nested ToolDispatch/
ToolResult events under the originating call, LocalOnly transcript
record - never model context), ui/open-link opens the system browser
after the UI confirms the target, and size changes clamp the inline
height to the 120-720px band. Unmount closes the bridge and reclaims
the host instance.
Bundle: ToolCard's expand-to-open surface adds +0.286 KiB gzip initial
JS and +1.8 KiB raw (attributed ratchets); the AppBridge dependency
stays lazy. repolint carries the new bridge.ts/types.ts wire surface.
Parse MCP Apps tool metadata from tools/list _meta: visibility
(default model+app) and the ui resource (nested ui.resourceUri with the
flat legacy key fallback), carrying the declared CSP directives. The
catalog splits into the model catalog (visibility includes model,
unchanged for use_capability and provider requests) and a server-private
App catalog (visibility includes app); a visibility change flips the
catalog fingerprint, and enhanced caches persist both fields.
tools/call results from App-capable tools now collect a bounded local
presentation (standard CallToolResult + structuredContent + resource
identity, 512 KiB cap, inline audio/video and oversized base64 dropped)
through a per-call collector on the plan context; the agent attaches it
as provider.Message.MCPApp, which projection strips from every provider
request - leak tests added for the openai, anthropic and responses wire
builders, and provider request bytes stay unchanged for text-only
results.
Host gains the bounded App Instance Registry: unguessable 24-byte tokens
binding server, catalog generation, originating call and resource URI,
max 32 live instances with oldest-eviction, reclaimed on server removal.
Instance tool resolution refuses cross-server targets, non-App tools,
and stale catalog generations.
* fix(desktop): retire completed todo shelves
Problem: Completed todo batches remained pinned above the composer after reaching their final count, and restored sessions reattached finished work as if it still needed attention.
Root cause: The visibility gate kept every completed batch mounted while TodoPanel only collapsed its contents and waited for a manual dismissal.
Fix: Keep incomplete batches visible, hold a live final count for 900 ms, fade it for 240 ms, and leave restored completed batches in transcript history only. Preserve manual-dismissal persistence and the existing status-agnostic batch identity.
Verification: pnpm test:todo-visibility; pnpm lint:hooks; pnpm typecheck; pnpm test:typecheck; pnpm check:css; pnpm exec vite build; node scripts/check-bundle-budget.mjs; pnpm exec tsx src/__tests__/transcript-reader-extent-race.test.tsx; go run ./tools/repolint.
* Run Todo lifecycle regression in desktop CI
Problem: The Todo lifecycle regression suite was available locally but the desktop CI job never invoked it, so a behavior regression could pass required checks.
Root cause: The explicit frontend test list in ci.yml omitted test:todo-visibility.
Fix: Add the Todo visibility and lifecycle suite to the desktop frontend test step.
Verification: pnpm --dir frontend test:todo-visibility; go run ./tools/repolint; git diff --check.
Problem:
Transcript reading could reverse or expose a false bottom while streaming geometry and Virtuoso ranges changed. Native selection validation also used a competing test-only scroll write.
Root cause:
Reader, tail, geometry, and completion transitions did not share one generation-aware transaction boundary. A stale overscan row or a pre-paint range commit could be mistaken for the visible logical anchor, while diagnostics and fixtures did not reject every collapsed extent.
Fix:
Route transcript mutations through the fenced writer, coalesce geometry revisions, add bounded reader transactions and logical-anchor visual handoff, preserve real row measurements, and harden anonymized browser/native validation.
Verification:
- pnpm --dir desktop/frontend test:transcript
- pnpm --dir desktop/frontend test:transcript-browser
- pnpm --dir desktop/frontend test:transcript-reader-browser (20/20 Chromium and 20/20 WebKit)
- pnpm --dir desktop/frontend check:scroll-writer
- pnpm --dir desktop/frontend lint:hooks
- pnpm --dir desktop/frontend typecheck
- pnpm --dir desktop/frontend build
- cd desktop && go test ./...
- go run ./tools/repolint
Wire MCP 2026-07-28 multi-round-trip elicitation end to end. The SDK
default MRTR middleware now fulfills server input requests through the
new internal/mcpinteraction Broker, which travels with the per-call
context (never the shared Host) so concurrent tabs cannot cross wires.
Without a broker the request cancels - the model never guesses.
internal/control gains the pending-elicitation queue mirroring the ask
machinery: register-before-lock visibility, durable MCPInteractionRequest
(mcp_interaction wire kind) with synchronous turn-event persistence,
PromptAnswered-before-release resolution, and replay on frontend
reconnect. The controller implements Broker and installs it on the
executor and planner agents.
Frontends: desktop renders a shared StructuredForm (flat primitive
schemas with defaults/required/bounds) or a URL confirmation card
(server + origin shown, browser opens only on click) as a decision
surface; serve exposes POST /mcp-interaction; the chat TUI gains a
keyboard elicitation card with typing mode. Form values and URL targets
never enter logs; decision receipts record only kind and action.
E2E tests drive real in-memory SDK sessions: form elicitation retries
the original call with the user's answers, decline/cancel still complete
the round trip, multiple input requests fulfill in one retry, dangerous
URLs cancel before any UI sees them, and the no-broker path cancels.
Bundle budgets: +0.2 KiB initial JS gzip (reducer wiring for the new
prompt surface), +0.1-0.2 KiB locale chunks (14 labels per locale),
+2.0 KiB initial raw; repolint carries the exact new-code footprint on
the debt-saturated App.tsx/types.ts/bridge.ts/chat_tui.go/controller.go
(no existing debt hidden; deltas equal the added lines).
Introduce HostProfile (core-v1 / interactive-v1 / desktop-apps-2026-01-26-v1):
the semantic client-capability surface fixed at Host creation. Interactive
profiles declare form+url elicitation; Desktop additionally declares the
io.modelcontextprotocol/ui extension with text/html;profile=mcp-app. The SDK
default MRTR middleware replaces the hard-disabled mode, and a no-broker
elicitation cancels instead of guessing.
Cache identity follows the profile: core-v1 keeps the legacy v2 <slug>.json;
capability-declaring profiles write an isolated v3
<slug>.host-<profileHash>.json carrying visibility and UI metadata, and treat
the legacy file as a miss so catalogs negotiated under different capabilities
never cross-read.
Frontends pick their profile: chat TUI and serve interactive-v1, desktop
desktop-apps (degrading to interactive when the Apps sandbox listener is
unavailable), headless/bots core-v1. Host.CapabilityViews exposes the
four-layer matrix (Protocol/Core/Interactive/Apps) over live negotiation
state, surfaced via control.MCPCapabilityViews, desktop binding and /mcp
status.
Summary:
Add the reviewed bilingual Stable v1.32.1 record for natural turn completion and target the shared change to both Desktop and CLI.
Verification:
Release-note validation, rendering, catalog tests, documentation impact checks, and the applicable CI matrix passed.
Problem: ordinary successful turns required a synthetic finish tool call after the visible answer, exposing internal host bookkeeping and surfacing repair errors to users.
Root cause: the interactive tool registry and run loop treated finish as a mandatory structured boundary even though the host already owns natural response completion and durable turn status.
Fix: remove finish from provider schemas and enforcement, preserve legacy ledger/history readability, and add regressions for natural completion and legacy paired finish history.
Verification: go test ./... -count=1; cd desktop && go test ./... -count=1; go vet ./...; go run ./tools/repolint; go test -race ./internal/agent ./internal/control ./internal/boot -count=1; git diff --check.
Problem:
use_capability(action=list) expanded every cached MCP tool, including entries from disabled servers, and could consume tens of kilobytes of model context.
Root cause:
The model-facing list serialized the complete internal capability catalog even though MCP servers already had compact summaries and inspect supports on-demand directories.
Fix:
Keep the full catalog for routing and known-ID calls, but omit MCP server and tool entries from the global capability list. Preserve compact server status summaries, on-demand inspect behavior, the fixed provider-visible schema, and document the contract in English and Chinese.
Verification:
- go test ./... -count=1
- cd desktop && go test ./... -count=1
- go vet ./...
- go run ./tools/repolint
- git diff --check
* docs(release): prepare v1.32.0 notes
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
* docs(release): correct v1.32.0 release boundary
Limit the notes to changes merged after desktop-v1.31.4, remove unmerged and historical references, and document the topic metadata migration and downgrade boundary.
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: SivanCola <[email protected]>
* test: make release gates portable on Windows
Problem:
The main-v2 release candidate failed Windows CI because path JSON was matched as raw POSIX text, Unix permission bits were asserted on Windows, and active test ledgers were left open during TempDir cleanup.
Root cause:
The tests encoded platform-specific assumptions and did not close persistent test-only file handles.
Fix:
Decode event frames before comparing canonical paths, retain the permission assertion only where Unix modes exist, and register ledger cleanup for active-handle tests.
Verification:
go test -p 4 -timeout=8m ./...
go test -race ./internal/serve ./internal/topicstate ./internal/turnevent
GOOS=windows GOARCH=amd64 go test -c for all three affected packages
go run ./tools/repolint
* test: stabilize native scrollbar replay
Problem:
The Linux transcript browser gate could misclassify a held scrollbar-track auto-repeat as a real thumb drag, then fail when later pointer movement did not reach the physical bottom.
Root cause:
Thumb discovery checked only an absolute scroll distance after one delayed move, and asynchronous DOM probes interrupted the proven browser-owned pointer transaction before it was completed.
Fix:
Require two consecutive pointer increments to produce native progress and finish the same physical drag before mutating or inspecting row geometry.
Verification:
pnpm test:transcript-browser
pnpm test:motion
pnpm test:transcript
pnpm build
go run ./tools/repolint
* test: target transcript wheel input deterministically
Problem:
The Linux transcript browser gate could send its hydration wheel event to nested content at the viewport center, leaving the transcript unchanged until the fixture timed out.
Root cause:
The physical input probe did not verify that its pointer target belonged to the outer transcript reader surface.
Fix:
Reuse the visible-row padding hit-test before sending the hydration wheel while retaining the manual-mode and physical-displacement assertions.
Verification:
pnpm test:transcript-browser
node --check bench/transcript-scroll-stability.mjs
go run ./tools/repolint
* test: harden native release fixture activation
Problem:
The Linux native-scrollbar replay could still accept a short track auto-repeat as thumb motion, while the WebView2 selection fixture could activate its topic before the final virtual row was mounted.
Root cause:
The headed Chromium probe lacked a sustained third movement check, and the native WebView2 contract assumed one early synthetic click plus the active class guaranteed a settled tail viewport.
Fix:
Require sustained native progress across a third pointer segment, retry the delayed topic click until active, and hold fixture setup at the physical bottom until the final selection target mounts.
Verification:
node --check for both browser contracts
injected WebView2 contract replay in Chromium at 1200x800
pnpm --dir desktop/frontend test:motion
cd desktop && go test ./...
go run ./tools/repolint
* test: assert cleared OAuth invariant
* fix(desktop): make transcript surface commits atomic
Problem:\nUnloaded question jumps could expose intermediate history windows, while stale reader or native-scroll ownership could write after tail or surface replacement.\n\nRoot cause:\nQuestion paging, paint readiness, and imperative scrolling lacked one token/generation-fenced transaction and a single enforced writer gateway.\n\nFix:\nMask question-jump history until mounted geometry is stable, route every transcript write through the generation-aware gateway, and make reader/native-thumb ownership replacement explicit and cancelable.\n\nVerification:\npnpm test:transcript; pnpm test; pnpm build; three consecutive pnpm test:transcript-browser runs; go test ./...; go run ./tools/repolint; single-scroll-writer check; git diff --check.
* fix(desktop): retain question jump ownership through paint
Problem: the opaque question-jump mask retained pixels, but the scroll arbiter did not own the full paging and paint interval. A stale reader correction or native scrollend could therefore write or release programmatic ownership before the target paint terminal.
Root cause: question navigation acquired reducer ownership only when the final indexed jump was dispatched, while the preceding masked history mutations and queued reader work remained on the previous generation.
Fix: add a token-fenced question-jump ownership controller that invalidates old async writers before loading, blocks generic scrollend release, and resolves only the matching paint terminal. Add the deterministic reader/tail race coverage and keep bundle ratchets to 0.39% gzip / 0.28% raw over main-v2.
Verification: pnpm test:transcript; pnpm test (229 suites); pnpm test:transcript-browser x3; pnpm build; go test ./...; repolint; single-scroll-writer; git diff --check.
* test(desktop): scan native thumb hitbox precisely
* test(desktop): classify unavailable native thumb input
* fix(desktop): queue question jumps behind history loads
* test(desktop): preserve verified native thumb transaction
* test(desktop): sample delivered native thumb progress
Typing /clear on purpose is the common case; an accidental /clear is at most
inconvenient and recoverable. When YOLO is already active (an explicit
commitment to skip confirmations), clear the session immediately instead of
opening the confirm overlay. Non-YOLO modes keep the existing confirmation.
Extract the clear action into clearContext() so the YOLO fast path and the
confirm handler share one implementation.
* feat(desktop-fe): add remote tab bindings and browser mocks / 增加远程项目 Tab 的前端绑定与 mock
* feat(desktop-fe): offer remote connection in the add-project menus / 加项目菜单增加远程连接入口
* feat(desktop-fe): add three-step remote connection wizard / 增加远程连接三步向导
* feat(config): pin remote projects in user config / 用户配置支持固定远程项目
[[remote.projects]] entries (host_id + workspace + title) reference
[[remote.hosts]] by name. RemoteProject/UpsertRemoteProject/
RemoveRemoteProject with Clone copy and user-scope TOML rendering;
round-trip covered in remote_config_test.go.
* feat(desktop): remote project registry and remote tab bootstrap / 远程项目注册与远程标签引导
- RemoteTabRef discriminator on TabMeta and ProjectNode.
- List/Add/RemoveRemoteProjects persist through [remote].projects;
AddRemoteProject dedupes on (hostID, workspace).
- remoteProjectNodes appends remote project groups to the tree
snapshot; config read failures degrade to no remote nodes instead
of breaking the tree.
- OpenRemoteProjectTab creates-or-focuses an in-app remote tab and
returns meta immediately; SSH + Serve bootstrap runs in the
background and reports through remote-tab:{id}:state events.
* feat(desktop-fe): remote project groups in the project tree / 项目树渲染远程项目分组
ProjectNode.remote drives the cloud folder icon; clicking an empty
remote group row re-enters the project via OpenRemoteProjectTab
(in-flight double clicks guarded by a ref Set, settled re-opens
deduped by the backend focus path). Browser mock mirrors the Go
snapshot so the tree shows pinned remote projects in dev.
* fix(desktop-fe): wizard suggest-list z-index token; failed-connect test / 向导建议列表 z 层级 token 化并补连接失败测试
.remote-wizard__suggest-list joins the z-scale tokens instead of a
hardcoded z-index: 2. The wizard test now drives a real
stopped+error → retry → connected sequence so the connecting step's
failure path stays observable instead of always succeeding.
* fix(desktop-fe): wizard all-or-nothing finish, connect log target, dead i18n keys / 向导完成回退、连接日志目标与清理死键
- finish(): a failed OpenRemoteProjectTab rolls back the just-registered project (RemoveRemoteProject); if rollback fails, refresh keeps the tree honest. AddRemoteProject failures return before any open attempt.
- connect(): target host comes from the caller, fixing the stale-closure log that printed a raw host id on first connect.
- Drop unused remoteWizard.folderName/createFolder keys from en/zh/zh-TW; wizard header comment no longer claims mkdir.
* feat(desktop): remote tab serve bridge — auth handshake, session entry, SSE pump / 远程标签 Serve 桥:认证握手、进入会话与事件泵
- serveHandshake: one POST /auth/token trades the pre-shared token for the
HttpOnly session cookie (same flow the web shell uses); the token never
enters a request line or the serve access log.
- enterRemoteSession: POST /new for fresh sessions; SessionName opens
resolve the name against GET /sessions and POST /resume with the entry
PATH (serve takes path, not name).
- remoteTabPump: subscribes GET /events and forwards each data frame
verbatim as remote-tab:{id}:event; generation guard lets a superseded
pump self-exit once reconnect logic lands.
- bootstrapRemoteTab now attaches the bridge after EnsureServer: handshake
→ pump subscribed → session entered → state=ready, bounded by a 30s
sub-context.
- remoteEventHook test seam; 4 httptest bridge tests incl. pump cleanup
(uncancelled /events connections otherwise hang httptest Close).
- Drop plan-task references from code comments (app.go, remote_projects.go,
types.ts).
* feat(serve,desktop): model/effort over HTTP; full remote command proxy / Serve 开放模型与努力度路由,桥补全命令代理
- serve: POST /model and POST /effort expose the existing switchModel /
switchEffort internals to HTTP clients (desktop remote tab + web shell
pickers). Route validation tests; switch semantics stay covered by the
existing model-switch suites.
- bridge: SetRemoteTabModel/Effort/PlanMode, Compact/Fork/Summarize/
ForgetRemoteTab, RemoteTabBranches/Skills — one forward each through the
shared remoteTabPost/remoteTabGet helpers. auto-approve-tools and bypass
are deliberately skipped: they are legacy aliases of
tool-approval-mode=yolo.
- bridge.ts: matching AppBindings declarations + mock stubs; fakeServe
gains the new endpoints and the forwarding table gains 8 rows.
* feat(desktop): remote tab reconnect lifecycle and close / 远程标签断线自愈与关闭
- CloseRemoteTab: idempotent teardown — pump stops, registry entry drops,
serve + SSH stay for other tabs.
- onStatus now drives open tabs through SSH transitions: connecting/
reconnecting suspends pumps (gen bumped so stale pumps exit), connected
re-attaches each tab to the still-running remote serve (fresh handshake
+ pump, no session re-entry needed — the serve holds the session),
stopped parks tabs in error with the host failure text.
- Unexpected stream death now flags reconnecting and attempts one
re-attach instead of reporting a hard error; commands on tabs that are
reconnecting or failed fail fast with a clear message.
- Tests: close idempotence, host drop → reconnect → ready with a fresh
event stream, terminal failure text propagation.
* feat(desktop): remote tabs join the strip with a native surface / 远程标签进入标签栏并渲染原生表面
- ListTabs merges open remote tabs; a highlighted remote tab deactivates
local entries so exactly one strip item is active.
- SetActiveTab routes by registry membership: remote ids take the strip
highlight, local ids clear it and run the existing path. CloseTabWithPolicy
tears a remote tab down without touching the local runtime.
- OpenRemoteProjectTab emits remote-tab:opened with the meta on open and
re-focus; the frontend adopts it (seedActiveTabMeta + switchTab) and
renders RemoteSessionSurface instead of the local transcript when
activeTab.remote is set.
- useRemoteSession: state/event subscriptions, snapshot hydration with
retry (covers the mount-vs-event race), frame collection, and typed
submit/cancel/approve/answer wrappers. Surface renders the four
connection states; hydrated content wins over a still-pending state
event. Styles use design tokens; locales in en/zh/zh-TW.
- Tests: ListTabs/activation/close integration (Go), surface + hook
contract (tsx).
* feat(desktop-fe): remote transcript reuses the local pipeline end to end / 远程会话端到端复用本地渲染管线
- useRemoteSession feeds serve frames (same wire form as agent events)
through the exported local reducer, hydrates /history through the local
history action, and injects the optimistic user bubble with the local
user action — items, live streaming, approvals, and asks therefore shape
exactly like a local tab.
- RemoteSessionSurface renders the shared Transcript component; only the
connection state machine and the approval/ask cards stay remote-specific.
The composer stays the shared local one with send/cancel/running fed by
the session (App-level wiring). Bespoke row/composer rendering and its
styles/strings are gone; the mock snapshot returns an empty history like
a fresh local session and the mock turn streams through the reducer.
- State type exported from useController; the svg asset stub also covers
.css so tsx tests can mount the transcript chain.
* feat(desktop-fe): remote sessions in the project tree / 项目树远程会话行与远程菜单
- Remote groups list their serve sessions (RemoteProjectSessions) while
the host is connected; rows open by sessionName through the ensure-open
path. A new session invalidates the cached listing.
- Group row gains a connection badge driven by the live host status.
- Remote groups swap the local project menu for remote actions: new remote
session, open remote window, stop remote server, unpin (removes the
registration and refreshes). The + action opens a remote session instead
of creating a local topic — local reveal/rename/remove no longer fire on
remote rows.
- Source-contract test pins the tree wiring and the shared-composer prop
branching in App.
* feat(desktop): session titles, new-session reset, and demo preseed / 会话标题、新建会话重置与演示预置
- The SSE pump schedules a title refresh after turn_done: the serve's
LLM-generated title for the current session replaces the workspace-name
default and rides the tab-opened channel, which the chrome merges into
the existing strip entry (no re-switch when the tab is already active).
- A NewSession open on a live tab now POSTs /new: the previous session
stays in the remote history list, the tab switches to the new empty one
(title resets), and the re-emitted ready state forces the frontend to
re-sync its snapshot — which now happens on every ready transition, not
just the first hydration.
- The tree hydrates host statuses once on mount, so badges and the
session-fetch gate are correct without a wizard run.
- Browser-dev mock preseeds a connected demo project, an open demo tab,
and a demo session row; the canned turn adopts an AI-style title and a
new-session open resets the demo tab like the real backend.
- Tests: title adoption + new-session reset (Go), ready re-sync (surface),
preseed contract.
* feat(desktop): authoritative remote session lifecycle / 远程会话生命周期权威化
- The session listing is backend-authoritative: RemoteProjectSessions
merges a desktop-view blank row (name empty, localized 新的会话 title)
while the tab holds a fresh session the serve has not written yet, so
the tree renders one source of truth.
- Blank reuse mirrors EnsureBlankTab: a sessionReset flag on the tab makes
further new-session opens re-activate instead of POSTing /new again; the
flag clears when the session earns a serve title or a resume lands.
- resumeRemoteTabSession switches a live tab to a listed session (POST
/resume, title adoption, ready re-emit); the bootstrap gives fresh
sessions the localized default title.
- serve /sessions entries carry mtimeMilli; the listing orders pinned
first and merges desktop-owned title overrides; SetRemoteSessionPinned
and SetRemoteProjectTitle back the tree actions.
- fakeServe mirrors serve semantics (/new abandons current, /resume
restores it); tests pin the blank-reuse contract and resume flow.
* feat(desktop-fe): remote sessions ride the local renderer with full parity / 远程会话全面复用本地管线
- Session rows join the TREE DATA as synthetic topic nodes, so filtering,
workbench arrangement, and the pinned section treat them exactly like
local topics; clicks, pin, rename, and archive route to the remote
bindings and the blank row comes from the authoritative listing (the
frontend blank state machine is deleted).
- Project menus mirror the local templates item-for-item (new session,
rename project via registry title, reveal in remote file manager, copy
path, archive active conversation, unpin) in classic and workbench
variants; AI rename stays disabled for remote rows.
- The shared Composer serves remote tabs: send/cancel/running from the
session hook, model switch through SetRemoteTabModel with the capsule
label from the serve status; the topic-bar pencil opens rename.
- The mock mirrors the whole chain: demo preseed (project, tab, session
row with an 18-turn history), dynamic session store, local-script
canned turns with cancellation, immediate 202-style submit resolve,
session-interrupting switches, and model catalog switching.
* test(remote): multi-workspace serve coexistence coverage / 多工作区 serve 共存测试覆盖
- One fake host, two workspaces: slug-keyed state/token files coexist,
re-ensure reuses only its own serve, Stop(A) leaves B alive, and each
launch script carries only its own concrete state paths (plan task 1.1
coverage over the as-built layout).
* feat(desktop): wizard-level remote platform check / 连接向导阶段的远程平台检查
- CheckRemotePlatform runs uname through the same ParseUname gate
EnsureServe applies; the connect wizard awaits it at the connecting
step, so an unsupported remote OS (V1: Linux/macOS) fails with one
clear message before directory browsing starts, instead of deep in
serve bootstrap after the project is registered.
* refactor(desktop): per-workspace remote serve registry and stop/status/logs API / 按工作区键控的远程 serve 注册表与停止状态日志接口
- managedHost tracks one serveEntry per workspace instead of a single
server+token; the loopback tunnel is named serve-<slug> from
store.RemoteWorkspaceSlug so one host holds one independent forward
per workspace.
- StopServer/ServerStatus/ServerLogs gain a workspace parameter; the
bound StopRemoteServer/RemoteServerStatus/RemoteServerLogs follow,
with every frontend call site updated in the same commit because
remote:server events now interleave per workspace.
- The web window records its workspace so reconnect refresh re-ensures
it and stop closes it only on a match; the frontend store nests
servers[hostId][workspace] and the panel server tab manages the
input's workspace (the host's first entry while the input is empty)
(plan task 2.1).
* test(desktop): assert StopRemoteServer forwards the workspace to the kernel / 断言 StopRemoteServer 向内核转发工作区参数
- Wires the fake kernel's stoppedWorkspaces tape to a real assertion in
the stop-closes-window test, so the bound method's workspace
parameter is verified alongside the window behavior.
* fix(desktop-fe): type-safe remote test mocks / 远程测试桩类型修复
- The optimistic-bubble assertion wraps its optional-chained some() in
Boolean so ok() receives a boolean; the panel mock's window.go App
object casts through Partial<AppBindings> like the wizard mock, and
the wizard's Promise.withResolvers timers become plain Promise
constructors (lib-target independent). These are what editors report
when they type-check the tsconfig-excluded test files.
- The default React imports stay: tsx compiles these excluded files
with the classic JSX transform, so the seemingly unused import is
required at runtime.
* feat(desktop): remote tabs persist and restore as disconnected shells / 远程标签持久化与断连空壳恢复
- desktop-tabs.json gains remoteTabs + remoteTabOrder (omitempty: no
remote tabs open ⇒ byte-identical legacy file). Entries carry only
id/host/workspace/title — no session: clicking a restored shell
reconnects and lands in a fresh blank session, and the tree group's
session rows remain the picker for past conversations.
- restoreOrBuildTabs rebuilds shells in a disconnected state (no
connect, no serve) and routes a persisted remote active id to the
strip highlight; SetActiveTab on a shell and the tree-group
ensure-open both bootstrap the reconnect in place, reusing the id.
- New disconnected state rides TabMeta.remoteState so the surface
renders before any event this run; the surface offers a reconnect
button; host status transitions never flip a shell into a runtime
state.
- ReorderTabs accepts the full mixed strip: local and remote
subsequences validate and persist separately (drag-reorder with
remote tabs used to fail server-side). Single-surface layouts
collapse remote shells to the active one like local tabs (plan
task 3.1 remainder: Guards/Restore/Round-trip).
- The surface test's OpenRemoteProjectTab mock returns a TabMeta to
match the binding signature (the void return broke the
Partial<AppBindings> cast under editor type-checks).
* fix(remote): generous serve/upload budget and pipelined SFTP writes / 放宽 serve 上传时限并流水线化 SFTP 写入
- The CLI serve/fs paths had a flat 60s deadline; a same-platform
binary upload is ~55MB and real links sit under 1MB/s, so the
deadline failed exactly the install mode offline hosts need. Both
budgets rise to 10 minutes.
- sftpfs copies uploads through a 1MB buffer so each Write keeps ~32
SFTP packets in flight; with the default 32KB io.Copy buffer every
Write is one packet and concurrent writes degenerate to a packet
per round-trip. (A pkg/sftp throughput gap vs OpenSSH sftp remains
on high-RTT links: measured 25-40KB/s vs 588KB/s; tracked
separately.)
- List resolves a leading "~" server-side (Stat-verified, falling back
to the session start directory): the SFTP protocol does not expand it,
so the wizard's fresh-host browse of "~" failed with
"file does not exist".
* feat(remote): local-proxy credential mode kernel / 本地代理凭证模式内核层
- RemoteHostEntry gains credential_mode (remote | local-proxy) with
validation, renderer, and a --credential-mode flag on remote add.
- bootstrap.CredentialProxyOptions: EnsureServe installs a
tunnel-backed provider entry into the remote user config
(idempotent append; a base_url change rewrites just that line) and
LaunchCommand injects the virtual token via the serve environment
plus --model <provider> — the token never rides argv or files.
* feat(desktop): desktop-held credentials for remote serves / 远程 serve 桌面持钥模式
- credential_proxy.go: a loopback key holder swaps the per-host virtual
token for the real provider key and streams responses through
(SSE-safe). Tokens derive from a persisted secret, so a restarted
desktop keeps working with a reused remote serve; rotating the
secret revokes every token at once.
- EnsureServer orchestrates local-proxy hosts: proxy starts, the
cred-proxy:<host> reverse tunnel opens (forward.Remote, idempotent),
and the bootstrap receives the token + provider entry to install.
- Host form gains the credential-mode select (three locales); the
locale budget gate rides along (remote copy grew the chunks past
the old 55.8/55.0 gates).
- E2E: TestCredentialProxyRealHostSmoke (env-gated) drives connect →
reverse tunnel → serve launch → one real model turn and asserts the
reply arrived through desktop-held credentials; verified against a
live host.
* fix(desktop-fe): tolerate the wails dev spinner crash / 容忍 wails dev 转圈组件崩溃
- index.html gains the #wails-spinner anchor expected by the v2.13 dev
runtime.
- The global crash screen now ignores errors whose stack lives entirely
inside /wails/*.js: the v2.13 dev runtime's Svelte spinner throws
"Cannot read properties of null (reading 'nodes')" on mount while the
app itself keeps working (verified headless: full UI renders), so the
fatal report must not escalate third-party runtime noise.
* fix(remote): materialize the preset default_model relies on / 物化默认模型依赖的内置供应商
- Appending the credential-proxy [[providers]] entry replaces the
remote's built-in provider defaults, so a default_model like
"deepseek-flash" that resolved only through those defaults would
dangle and crash the serve at startup (surfacing as a confusing
port-file timeout). The install now materializes the builtin entry
default_model refers to as an explicit block BEFORE ours; the
default_model line itself is never rewritten, so every entry point
(CLI, web window, remote-mode desktop launches) keeps resolving.
* feat(desktop-fe): credential-mode segmented control in the wizard / 向导增加凭证模式分段控件
- The wizard's inline host form gains the same remote|local-proxy choice
as the hosts page, rendered as a provider-add-segmented control after
the download method (established pattern; zero new styles or locale
keys). Wizard-created hosts no longer silently default to remote mode.
* fix(remote): heal the credential provider config on reuse too / 复用 serve 时同样治愈凭证配置
- ensureCredentialProvider now runs before the reuse check, so a live
serve's config gains the materialized default_provider entry as well —
previously only fresh launches installed it, leaving reused serves on
boxes with the old dangling-default config.
* fix(desktop): ephemeral reverse-tunnel port for the credential proxy / 凭证代理反向隧道改用临时端口
- The remote bind drops the fixed 18999 in favor of 127.0.0.1:0 (the
SSH layer reports the actual port; the materialized provider entry's
base_url already rewrites on port change). A half-dead session's
stale listener can no longer block serve starts with a confusing
"tcpip-forward request denied".
* feat(serve,agent): provider reload endpoint, provider_unreachable event, status reconciliation fields / serve 增加供应商重载端点、通道不可达事件与状态对账字段
* feat(remote): credential heal closes the loop — change signal and .env token delivery / 凭证治愈闭环：变更信号与 .env 令牌交付
* feat(desktop): reverse-channel self-healing, single-pump attach, busy-soft session entry / 反向通道自愈、单泵附着与忙碌软进入
* feat(desktop-fe): remote session running reconciliation, submit rollback, interruption notices / 远程会话运行对账、提交回滚与中断通知
* feat(desktop-fe): remote project tree and wizard polish / 远程项目树与向导打磨
* fix(desktop-fe): make remote-session-surface test runnable under the default runner / 修复远程会话面测试在默认跑测器下的崩溃
- 按 remote-server-panel 的既有模式把 remote-session-surface.test.tsx
注册到 test:remote（svg-stub-register 加载）：其渲染链经 Transcript
懒加载 ScrollDiagnosticPanel，再传递导入 logo-wordmark.svg，裸 tsx
无法解析该扩展名
- ScrollDiagnosticPanel 读 import.meta.env.DEV 改为可选链：裸 tsx 下
import.meta.env 为 undefined（此前 __BUILD_CHANNEL__ 未定义即开启
诊断面板，模块求值即崩）；Vite 构建行为不变
- 验证：svg-stub 跑测 24/24 通过，tsc 无告警
注：remote-error-ux.test.tsx 的 5 个安全摘要断言失败为分支合并前
既有问题（d597b10fd 上同样 4 过 5 挂），与本次合并无关。
* feat(serve): multi-session detach, runtime status, and gzip snapshot transport / 多会话后台切换、runtime 状态与 gzip 快照传输
- Add detached multi-session controllers and lease split/adopt so busy
sessions keep running across switches, with session-tagged SSE frames
- Expose GET /status?runtime=1 for desktop hydrate/reconcile without
wallet Balance, aligning remote running checks with local RuntimeStatus
- Compress large snapshot JSON responses with gzip middleware
- Keep provider reload retiring stale detached controllers after
credential-channel heal
Verification: go test ./internal/serve -count=1 -run 'TestStatusRuntimeQuerySkipsBalance|TestProvidersReloadRetiresStaleDetached|TestGzipMiddleware'
* feat(desktop,remote): credential-channel watchdog and provider heal / 凭证通道 watchdog 与供应商配置自愈
- Watch the reverse credential tunnel at runtime and re-heal when the
ephemeral remote port drifts after SSH reconnects
- Rewrite the remote reasonix-desktop-proxy base_url through
HealCredentialProvider, then reload serve providers (cancel-then-reload
when a doomed busy turn blocks 409)
- Gate bootstrap reuse on session-events / detached-heal capabilities so
stale serves are replaced instead of fast-reused on a dead loopback port
Verification: go test ./desktop -count=1 -run 'TestCredentialChannel|TestNeedsHeal|TestCancelThenReload' ; go test ./internal/remote/bootstrap -count=1 -run 'Credential|Heal'
* fix(desktop): remote session snapshot race, hydrate slimdown, and bridge-chain acceptance / 修复远程会话快照竞态并瘦身 hydrate
- Stop RemoteTabSnapshot concurrent map writes by copy/merging the per-tab
ETag cache under remoteTabMu instead of sharing it across unlocked workers
- Let hydrate/reconcile fetch only /history + /status?runtime=1, coalesce
overlapping ready/mount hydrates, and rate-limit REFUSED command logs
- Add bridge-chain acceptance probes (Open→ready→snapshot stampede) and FE
surface assertions so verification walks the real frontend binding path
Verification: go test ./desktop -race -count=1 -run 'TestRemoteTabSnapshot|TestRemoteSessionHydrateChainFromOpenToSnapshot|TestServeGetCachedAcceptsGzip'; node --import ./scripts/svg-stub-register.mjs --import tsx src/__tests__/remote-session-surface.test.tsx
* feat(desktop,cli): remote session-path switch and serve capability markers / 远程会话按路径切换与 serve 能力标记
- Pass listing-row sessionPath/sessionTitle into OpenRemoteProjectTab so
resume skips a redundant GET /sessions name lookup
- Project live turn state onto remote session rows from tagged runtime
events, including background sessions
- Advertise --session-events / --detached-heal (and the rolling caps token)
from serve --help so remote bootstrap can replace outdated binaries
Verification: go test ./desktop -count=1 -run 'TestResumeRemoteTabSessionKnownPathSkipsListing|TestRemoteTabPumpRoutesFramesBySession'; go test ./internal/cli -count=1 -run Serve
* fix(desktop,remote): heal dead credential reverse tunnel and arm reuse watchdog / 修复凭证反向隧道死端口与复用路径 watchdog
- Mark remote forwards Down when Accept exits so ensure no longer reuses a dead Up port
- Probe advertised reverse ports before reuse, and probe before provider reload
- Always finalizeCredentialChannel (heal + startCredentialWatchdog) on reused EnsureServer paths
Verification: go test ./desktop -count=1 -run 'TestFinalizeCredentialChannelStartsWatchdog|TestCredentialChannelDecision|TestReloadServeProvidersCancelsBusyTurn|TestCredentialProxyReverseForwardEndToEnd'; go test ./internal/remote/forward -count=1 -run 'TestRemoteForwardAcceptExitMarksDown|TestRemoteForwardEndToEnd|TestReplace'
* fix(desktop): keep remote tab active when switching from a local session / 本地切远端时不再回滚到本地会话
- Bypass local HistorySliceForTab for remote targets in switchTab
- Finish hydrate_done and SetActiveTab without bouncing back on local hydrate errors
- Add FE regression coverage for the local→remote switch path
Verification: node --import ./scripts/svg-stub-register.mjs --import tsx src/__tests__/remote-switch-from-local.test.tsx
* fix(desktop): restore remote session identity without auto-opening disconnected shells / 恢复远端会话身份且首屏不自动打开断开壳
- Persist SessionName/SessionPath and resume on revive instead of always POST /new
- Leave remoteActiveTabID empty on restore so first open stays on the local surface
- Make remoteTabMeta.Active follow remoteActiveTabID and expose TopicID/SessionPath for tree matching
Verification: go test ./desktop -count=1 -run 'TestRemoteTabPersist|TestActivateDisconnected|TestListTabsRemoteActiveFollowsHighlight|TestRemoteTabMetaExposesSessionIdentity|TestRemoteTabRestoreBuildsDisconnectedShells'
* fix(desktop): drop disconnected remote placeholder and revive on activation / 去掉远端未连接占位页并在激活时直接重连
- Remove the remote-surface--disconnected restored-shell page
- Treat disconnected mounts/events as connecting and kick SetActiveTab revive/bootstrap
- Keep strip shells available without parking the content surface on the placeholder
Verification: node --import ./scripts/svg-stub-register.mjs --import tsx src/__tests__/remote-session-surface.test.tsx
* fix(desktop): align remote session-row active highlight with local topicIsActive / 对齐远端会话行点击高亮
- Synthesize remote tree rows with root + sessionPath for topicIsActive matching
- Cover active/inactive remote session-row highlight regressions in FE tests
Verification: node --import tsx src/__tests__/project-tree-runtime.test.ts; node --import tsx src/__tests__/remote-project-tree.test.tsx
* fix(serve,desktop): strip reasoning-language from /history and ratchet bundle budget / 剥离历史中的 reasoning-language 并上调 bundle 预算
- Shape serve /history user content with agent.UserMessageText so transient
<reasoning-language> blocks never leak into remote transcripts
- Raise the raw initial JS/CSS budget for the remote UX fix path
Verification: go test ./internal/serve -count=1 -run 'TestHistoryMessagesStripTransientReasoningLanguageBlock|TestHistoryMessagesPreserveToolDetails|TestSessionsListPreviewStripsTransientReasoningLanguageBlock'; node desktop/frontend/scripts/check-bundle-budget.mjs
* fix(desktop-fe): route new-session entries to the remote tab when active / 远程会话激活时新建会话走远程分流
* fix(desktop): swap test event hooks race-safely while pumps emit / 测试中途换事件钩子改为锁保护避免数据竞态
* fix(desktop): give blank remote sessions a highlightable identity / 空白远程会话暴露可高亮身份并在物化后迁移
* fix(desktop-fe): pin test locale to jsdom navigator / 测试固定 jsdom navigator 避免系统语言影响断言
* feat(desktop): cold-start remote serve on group click with busy feedback / 点击远程项目组即引导连接并给出黄灯与刷新反馈
* fix(desktop,remote): strip transient blocks from remote history and retire stale serves / 远程历史剥离临时块并强制升级旧远端 serve
* perf(desktop): resume remote sessions off the binding path / 远程会话切换移出绑定关键路径并给出即时行反馈
* refactor(desktop): make wizard onboarding local-proxy only / 向导接入一律本地持钥并清理凭证模式选择
* chore(desktop-fe): ratchet bundle budget for remote-fix pass / 上调初始 JS 预算适配远程修复增量
* chore(desktop-fe): ratchet raw bundle budget for remote-fix pass / 上调原始体积预算适配远程修复增量
* fix(desktop): dial the host before the ensured group listing / 确保列表冷启动前先拨通 SSH 主机
* fix(desktop-fe): ensure remote listing on expand regardless of cached serve state / 展开远程组不再信任可能陈旧的 serve 状态
* fix(desktop-fe): cold-start auto-expanded remote groups too / 自动展开的远程组同样冷启动连接
* fix(desktop-fe): land remote listing rows dropped by effect churn / 远程列表结果不再被依赖抖动丢弃
* fix(desktop-fe): pin task-monitor test locale to jsdom navigator / 任务面板测试固定语言避免系统语言影响
* fix(desktop-fe): pin test locale to jsdom navigator / 测试固定 jsdom navigator 避免系统语言影响断言
* fix(desktop-fe): add missing readOnly to local-only recovery fixtures / 补齐 local-only 恢复用例缺失的 readOnly 字段
* fix(desktop-fe): pin test locale to jsdom navigator / 测试固定 jsdom navigator 避免系统语言影响断言
* fix(desktop-fe): add missing readOnly to local-only recovery fixtures / 补齐 local-only 恢复用例缺失的 readOnly 字段
* chore(desktop-fe): ratchet raw budget for the serve-scaling stacked tip / 上调原始体积预算适配 serve 扩展层
* fix(desktop):Address the data race risks caused by the passing of
internal pointers within locks
* fix(desktop): harden lock scope and orphan writes, type serve status errors, share one handshake builder / 锁域与孤儿写入加固、serve 状态错误类型化并统一握手构造
* fix(desktop): type legacy-serve fallback and reverse-probe errors, log the async serve replacement, inject the credential route registrar / 旧 serve 淘汰与反向探活错误类型化、异步替换补日志并注入凭证路由注册依赖
* fix(desktop): move remote-tab identity adoption, meta builds, and bootstrap snapshots under the tab lock / 远程标签身份采纳、meta 构造与引导快照收进 tab 锁内
* refactor(desktop): merge the desktop model pickers and thread one config snapshot through credential registration / 合并桌面模型选择器并让凭证注册全程共用一份配置快照
* fix(desktop): cache remote prefs in memory keyed by user dir and surface prefs write failures / 远程偏好按用户目录键控内存缓存并暴露写盘失败
* perf(serve): list sessions via branch-meta previews and one stat per entry / 会话列表改走 sidecar 预览并去重 stat
* perf(remote): share one probe round in EnsureServe and one-pass capability check / EnsureServe 复用路径共享单轮探测并单遍能力检查
* feat(desktop): optimistic remote session lists, unified group badge, hydrate skeleton, and pre-ready snapshot warm / 远程会话列表乐观渲染、组灯统一、水合骨架并预热快照
* feat(remote): complete multi-session serve integration
Preserve active remote turns across session switches, route tagged events to the owning tab, and expose exact session paths to the desktop tree. Add gzip snapshot transport, capability-gated remote bootstrap, and credential-channel watchdog recovery. Update Remote SSH documentation and cover the integration with Go, race, and frontend tests.
* refactor(remote): satisfy repository structure gates
* fix(remote): close multi-session lifecycle races
* fix(remote): preserve foreground session routing
Problem:\nServe and Desktop could lose the foreground session identity when controllers detached, recovered, or rotated through slash commands. Replay and status requests could also mix controller generations, and background runtime work was underreported.\n\nRoot cause:\nController ownership callbacks were rebound to keeper-only handlers, status and replay sampled the mutable controller repeatedly, and the Desktop did not reconcile a recovered foreground path before routing tagged frames.\n\nFix:\nCarry the Serve ownership binder across keeper transfers, use single controller snapshots, refresh transition tags and broadcaster routing, expose the authoritative session path, and reconcile unknown foreground frame paths from status.\n\nVerification:\ngo run ./tools/repolint\ngo test ./...\ngo vet ./...\n(cd desktop && go test ./...)\n(cd desktop && go vet ./...)\ntargeted go test -race for control, Serve, and Desktop multi-session paths\ngit diff --check
* fix(remote): close final session routing gaps
* fix(remote): close remaining serve lifecycle races
* test(cli): close queued-paste controller
* fix(remote): close final multi-session routing gaps
* fix(remote): fence recovery lifecycle races
* fix(remote): close final multisession lifecycle gaps
* fix(remote): heal all tracked proxy workspaces
* fix(remote): harden multisession ownership handoff
* fix(remote): close remaining multisession races
* test(serve): make rotation lock probe observable
* fix(remote): close session handoff races
* test(remote): use test-scoped attach context
* fix(remote): isolate session adoption state
* fix(serve): preserve committed session routing
* test(serve): exercise real silent rotations
* fix(remote): preserve listing adoption and reload budgets
* test(remote): await emitted ready state
* fix(remote): fence session rehydration
* fix(remote): harden process and session handoff
* fix(remote): harden async switching and cached state
* fix(remote): fence cross-session ownership
* fix(remote): preserve resume lifecycle events
* fix(remote): reconcile resume ownership and routing
* fix(remote): preserve lifecycle work under load
* refactor(desktop): extract remote project registry
* fix(remote): commit session routing before replay
* test(remote): adapt prompt drain regression to async resume
* chore: trigger CI after fork workflow approval
* refactor(remote): satisfy repository structure gates
* chore: run CI on final review head
* fix(remote): address final session recovery review
* test(agent): satisfy cached preview lint
* fix(desktop): satisfy macOS remote lint
* fix(desktop): close remote session recovery gaps
* fix(desktop): fence remote identities and listing caches
* fix(desktop): order remote listings and projections
* fix(desktop): fence reconnect selections and repairs
* fix(desktop): close remote session generation races
* fix(desktop): preserve remote session authority on recovery
* fix: keep listing projections generation-consistent
* fix: close remote recovery consistency gaps
Problem:
- Passive remote listing failures could erase visible topics.
- A transcript commit interrupted before its revision ledger could leave a stale listing projection certified.
- Deferred New Session could trust a reconnect-time blank snapshot after the session gained content.
Root cause:
- Passive refreshes treated transport errors as authoritative empty results.
- Listing freshness was invalidated only after the transcript revision advanced.
- Pending selection application reused a captured reuseBlank bit instead of current tab state.
Fix:
- Preserve the last successful remote rows and expose retryable group errors.
- Invalidate certified projections before committing transcript bytes while preserving transcript-first durability for brand-new sessions with malformed metadata.
- Recheck the current blank state before applying deferred New Session intent.
Verification:
- go test ./internal/agent ./internal/control
- go test -race ./internal/agent ./internal/sessioncatalog
- cd desktop && go test ./...
- pnpm --dir desktop/frontend test:all
- pnpm --dir desktop/frontend build
- go vet ./... (root and desktop)
- go run ./tools/repolint
* fix(agent): make listing invalidation monotonic
Problem: A stale whole-sidecar metadata writer could restore a certified listing projection after a transcript save had invalidated it.
Root cause: Projection invalidation only cleared the schema marker while leaving the same persistence revision, so equal-revision metadata preservation did not retain the invalidation.
Fix: Reserve the next transcript revision before mutation, finalize the commit in that same WAL/ledger generation, and cover stale metadata writeback with a regression test.
Verification: focused crash and projection tests; go test ./internal/agent ./internal/control; go test -race ./internal/agent ./internal/sessioncatalog; desktop go test/vet; root go vet; repolint.
* fix: close remote preference and save retry races
Problem: A stale remote title refresh could migrate blank-session preferences after its tab generation changed, and a writer-bound retry could reuse a stale tail baseline after reserving a metadata revision.
Root cause: Preference migration happened before the tab fence, while the writer-tail fast path validated the event index and log size but not the metadata ledger identity.
Fix: Move preference migration into the client/generation/route transaction, and disarm writer-tail classification whenever the metadata revision or digest differs from its baseline.
Verification: focused regressions; go test ./internal/agent ./internal/control; go test -race ./internal/agent ./internal/sessioncatalog; desktop go test/vet; root go vet; repolint.
* fix: preserve remote session authority without global stalls
* test: exercise registry state in title migration probe
* test(desktop): join remote bridge cleanup boundaries
* refactor(frontend): keep remote integration within budgets
* fix: preserve retryable remote and migration state
* fix: preserve remote selection authority during retries
* fix(remote): preserve token across failed serve retirement
* fix(desktop): serialize in-flight remote selections
* fix: stage remote authority transitions safely
---------
Co-authored-by: SivanCola <[email protected]>
* fix: continue active standard todos
Problem:
Standard turns can persist an in-progress Todo and then end with only a promise to act, leaving the UI reporting active work after execution stopped.
Root cause:
Final readiness intentionally does not continue ordinary Standard turns, and the Todo shelf rendered persisted status without the owning tab runtime state.
Fix:
Add a trusted, same-Run Standard Todo continuation guard bounded to two tail prompts and gated by novel host receipts and user-work preemption. Render Todo activity from runtime state and route explicit Continue actions to the exact tab.
Verification:
- go test ./...
- (cd desktop && go test ./...)
- focused go test -race for Standard Todo continuation
- (cd desktop/frontend && pnpm build && pnpm test:typecheck && pnpm test:todo-visibility)
- real-browser Todo preview and Continue click flow
* chore: ratchet App repolint budget
Problem:
The Todo continuation owner-layer guard adds 19 lines to App.tsx, exceeding its existing file-size debt budget.
Root cause:
The repolint baseline remained at the pre-change App.tsx line count.
Fix:
Raise only the App.tsx file-size baseline from 4728 to 4747 and leave every unrelated debt baseline unchanged.
Verification:
- go run ./tools/repolint
- git diff --check
* fix(desktop): move topic metadata to SQLite
Problem: Desktop stored generated topic metadata across four workspace-local JSON files, polluting projects and allowing partial multi-file writes.
Root cause: Topic metadata had no authoritative transactional store or cross-version compatibility bridge.
Fix: Add per-scope SQLite stores, lazy migration and legacy mirroring for existing scopes, tombstone-aware reconciliation, corruption recovery, and future-schema protection.
Verification: root and Desktop test suites, focused and full race tests, golangci-lint, repository lint, and diff checks passed.
* fix(desktop): harden topic state reconciliation
Problem:
Desktop topic migration could overwrite concurrent manual titles, prune explicit restores in bridged scopes, and lose state across split writes or damaged databases.
Root cause:
Background repair replaced stale whole indexes, tombstone ordering was not restore-aware, and title fields were committed independently without session-backed corruption recovery.
Fix:
Merge only missing index fields with commit-time tombstone pruning, make restores and deletes tombstone-first, commit compound topic mutations atomically, preserve unknown legacy metadata, surface authoritative read failures, and rebuild corrupt stores from session metadata.
Verification:
- go test ./... -count=1
- cd desktop && go test ./... -count=1
- cd desktop && go test -race . -count=1
- go test -race ./internal/topicstate -count=1
- golangci-lint run ./...
- cd desktop && golangci-lint run ./...
- pnpm --dir desktop/frontend build
- pnpm --dir desktop/frontend test:typecheck
- go run ./tools/repolint
- git diff --check
* fix(desktop): replay pending topic mirrors first
Problem:
A crash between legacy JSON mirror writes could leave a mixed snapshot that was merged back into SQLite on restart.
Root cause:
Startup reconciled legacy digests before honoring the persisted pending mirror revision, so stale creation or auto-title metadata could appear to be an old-version edit.
Fix:
Replay the authoritative pending SQLite snapshot before legacy reconciliation, skip parsing partial legacy files during that replay, and cover the restart window with a regression test.
Verification:
- go test ./... -count=1
- cd desktop && go test ./... -count=1
- cd desktop && go test -race . -count=1
- focused pending-mirror and corruption recovery race tests
- golangci-lint run ./...
- cd desktop && golangci-lint run ./...
- go run ./tools/repolint
- git diff --check
* fix(desktop): keep pending topic writes authoritative
Problem:
When a legacy mirror remained unavailable, the next topic mutation could silently fall back to JSON only and later be overwritten by SQLite.
Root cause:
Pending-mirror repair errors escaped the reconciliation path and activated the migration-only legacy write fallback before the new SQLite mutation ran.
Fix:
Keep serving and mutating the authoritative SQLite store while its mirror outbox remains pending, skip reconciliation against the known-partial JSON snapshot, and verify a second write survives restart.
Verification:
- go test ./... -count=1
- cd desktop && go test ./... -count=1
- focused pending-mirror tests under the race detector
- golangci-lint run ./...
- cd desktop && golangci-lint run ./...
- go run ./tools/repolint
- git diff --check
* fix(desktop): serialize topic title publication
Problem:
A manual rename could commit after an automatic title but still have its Tab and session metadata overwritten by the automatic publisher.
Root cause:
SQLite compare-at-commit protected the durable row, but manual and automatic operations published their post-commit side effects without a shared ordering boundary.
Fix:
Serialize each title commit with its Tab/session publication, add a deterministic race regression, and document the direct-downgrade boundary for fresh SQLite-only scopes.
Verification:
- cd desktop && go test ./... -count=1
- focused title race tests under the race detector
- go test ./... -count=1 (unrelated historycatalog timeout passed on focused retry; two earlier full runs passed)
- golangci-lint run ./...
- cd desktop && golangci-lint run ./...
- go run ./tools/repolint
- git diff --check
* fix(desktop): stabilize Windows transcript selection overlay
Problem:
Repeated native multi-click selection in a Win11 WebView2 transcript could leave table pixels apparently displaced even though transcript scroll geometry did not change. The diagnostic bundle reported b9cf32f rather than the v1.31.4 tag SHA 97411a3, but the affected selection and table code remained equivalent through the tested main-v2 base.
Root cause:
The transcript action menu used an unstable compositor path: native selection churn repeatedly mounted and removed a translucent, blurred, transformed body portal. Native baseline replay confirms the unstable host lifecycle, although the current WebView2 runtime did not reproduce the original large stale-pixel region, so this does not claim a unique confirmed compositor root cause.
Fix:
Keep one state-driven transcript action portal for the component lifetime, reject stale positioning revisions, and make hidden states non-interactive and inaccessible. Use an opaque, non-blurred, non-transforming paint path only on Windows transcripts while preserving the existing macOS/Linux treatment. Add deterministic table fixtures, browser geometry coverage, a tagged native WebView2 capture host, image comparison, and a Windows CI gate.
Verification:
- pnpm --dir desktop/frontend test:transcript
- pnpm --dir desktop/frontend test:transcript-browser
- pnpm --dir desktop/frontend test:motion
- pnpm --dir desktop/frontend build
- cd desktop && go test ./...
- Win11 WebView2 native smoke: 3/3 at 1200x800 and 20/20 at 1920x1032
- Win11 vendored go-webview2 tests
- Windows amd64 and arm64 smoke-host cross-builds
- go run ./tools/repolint
- git diff --check
* fix(ci): satisfy transcript smoke lint
Problem:
The new Windows transcript pixel comparator tripped the required Go lint jobs, leaving desktop, desktop-macos, and lint red.
Root cause:
The comparator used a manual mask-membership loop and its tests used classic counted loops that the repository's modernize and intrange rules reject.
Fix:
Use slices.ContainsFunc for mask membership and Go integer ranges in the focused comparator tests without changing pixel thresholds or comparison behavior.
Verification:
- go test ./internal/transcriptsmoke
- go vet ./internal/transcriptsmoke
- GOOS=windows golangci-lint run --timeout=5m ./...
- go test ./...
- go run ./tools/repolint
- git diff --check
A manual compact on a view at or above the hard input ceiling could never
issue its summary request: mustFree excluded the manual trigger, so the
fold region was never shrunk to an admissible prefix and the request was
rejected before the provider call every time (#9059).
Over the ceiling, manual compaction is now a rescue: run the free
view-side prune first, fold the largest safe prefix, and loop up to
manualRecoverySummaries batches with the rolling digest merge until the
view is back under the ceiling. Below the ceiling, manual semantics are
unchanged (single fold, no prune, verbatim tail), pinned by regression
tests.
* feat(desktop-fe): add remote tab bindings and browser mocks / 增加远程项目 Tab 的前端绑定与 mock
* feat(desktop-fe): offer remote connection in the add-project menus / 加项目菜单增加远程连接入口
* feat(desktop-fe): add three-step remote connection wizard / 增加远程连接三步向导
* feat(config): pin remote projects in user config / 用户配置支持固定远程项目
[[remote.projects]] entries (host_id + workspace + title) reference
[[remote.hosts]] by name. RemoteProject/UpsertRemoteProject/
RemoveRemoteProject with Clone copy and user-scope TOML rendering;
round-trip covered in remote_config_test.go.
* feat(desktop): remote project registry and remote tab bootstrap / 远程项目注册与远程标签引导
- RemoteTabRef discriminator on TabMeta and ProjectNode.
- List/Add/RemoveRemoteProjects persist through [remote].projects;
AddRemoteProject dedupes on (hostID, workspace).
- remoteProjectNodes appends remote project groups to the tree
snapshot; config read failures degrade to no remote nodes instead
of breaking the tree.
- OpenRemoteProjectTab creates-or-focuses an in-app remote tab and
returns meta immediately; SSH + Serve bootstrap runs in the
background and reports through remote-tab:{id}:state events.
* feat(desktop-fe): remote project groups in the project tree / 项目树渲染远程项目分组
ProjectNode.remote drives the cloud folder icon; clicking an empty
remote group row re-enters the project via OpenRemoteProjectTab
(in-flight double clicks guarded by a ref Set, settled re-opens
deduped by the backend focus path). Browser mock mirrors the Go
snapshot so the tree shows pinned remote projects in dev.
* fix(desktop-fe): wizard suggest-list z-index token; failed-connect test / 向导建议列表 z 层级 token 化并补连接失败测试
.remote-wizard__suggest-list joins the z-scale tokens instead of a
hardcoded z-index: 2. The wizard test now drives a real
stopped+error → retry → connected sequence so the connecting step's
failure path stays observable instead of always succeeding.
* fix(desktop-fe): wizard all-or-nothing finish, connect log target, dead i18n keys / 向导完成回退、连接日志目标与清理死键
- finish(): a failed OpenRemoteProjectTab rolls back the just-registered project (RemoveRemoteProject); if rollback fails, refresh keeps the tree honest. AddRemoteProject failures return before any open attempt.
- connect(): target host comes from the caller, fixing the stale-closure log that printed a raw host id on first connect.
- Drop unused remoteWizard.folderName/createFolder keys from en/zh/zh-TW; wizard header comment no longer claims mkdir.
* feat(desktop): remote tab serve bridge — auth handshake, session entry, SSE pump / 远程标签 Serve 桥:认证握手、进入会话与事件泵
- serveHandshake: one POST /auth/token trades the pre-shared token for the
HttpOnly session cookie (same flow the web shell uses); the token never
enters a request line or the serve access log.
- enterRemoteSession: POST /new for fresh sessions; SessionName opens
resolve the name against GET /sessions and POST /resume with the entry
PATH (serve takes path, not name).
- remoteTabPump: subscribes GET /events and forwards each data frame
verbatim as remote-tab:{id}:event; generation guard lets a superseded
pump self-exit once reconnect logic lands.
- bootstrapRemoteTab now attaches the bridge after EnsureServer: handshake
→ pump subscribed → session entered → state=ready, bounded by a 30s
sub-context.
- remoteEventHook test seam; 4 httptest bridge tests incl. pump cleanup
(uncancelled /events connections otherwise hang httptest Close).
- Drop plan-task references from code comments (app.go, remote_projects.go,
types.ts).
* feat(serve,desktop): model/effort over HTTP; full remote command proxy / Serve 开放模型与努力度路由,桥补全命令代理
- serve: POST /model and POST /effort expose the existing switchModel /
switchEffort internals to HTTP clients (desktop remote tab + web shell
pickers). Route validation tests; switch semantics stay covered by the
existing model-switch suites.
- bridge: SetRemoteTabModel/Effort/PlanMode, Compact/Fork/Summarize/
ForgetRemoteTab, RemoteTabBranches/Skills — one forward each through the
shared remoteTabPost/remoteTabGet helpers. auto-approve-tools and bypass
are deliberately skipped: they are legacy aliases of
tool-approval-mode=yolo.
- bridge.ts: matching AppBindings declarations + mock stubs; fakeServe
gains the new endpoints and the forwarding table gains 8 rows.
* feat(desktop): remote tab reconnect lifecycle and close / 远程标签断线自愈与关闭
- CloseRemoteTab: idempotent teardown — pump stops, registry entry drops,
serve + SSH stay for other tabs.
- onStatus now drives open tabs through SSH transitions: connecting/
reconnecting suspends pumps (gen bumped so stale pumps exit), connected
re-attaches each tab to the still-running remote serve (fresh handshake
+ pump, no session re-entry needed — the serve holds the session),
stopped parks tabs in error with the host failure text.
- Unexpected stream death now flags reconnecting and attempts one
re-attach instead of reporting a hard error; commands on tabs that are
reconnecting or failed fail fast with a clear message.
- Tests: close idempotence, host drop → reconnect → ready with a fresh
event stream, terminal failure text propagation.
* feat(desktop): remote tabs join the strip with a native surface / 远程标签进入标签栏并渲染原生表面
- ListTabs merges open remote tabs; a highlighted remote tab deactivates
local entries so exactly one strip item is active.
- SetActiveTab routes by registry membership: remote ids take the strip
highlight, local ids clear it and run the existing path. CloseTabWithPolicy
tears a remote tab down without touching the local runtime.
- OpenRemoteProjectTab emits remote-tab:opened with the meta on open and
re-focus; the frontend adopts it (seedActiveTabMeta + switchTab) and
renders RemoteSessionSurface instead of the local transcript when
activeTab.remote is set.
- useRemoteSession: state/event subscriptions, snapshot hydration with
retry (covers the mount-vs-event race), frame collection, and typed
submit/cancel/approve/answer wrappers. Surface renders the four
connection states; hydrated content wins over a still-pending state
event. Styles use design tokens; locales in en/zh/zh-TW.
- Tests: ListTabs/activation/close integration (Go), surface + hook
contract (tsx).
* feat(desktop-fe): remote transcript reuses the local pipeline end to end / 远程会话端到端复用本地渲染管线
- useRemoteSession feeds serve frames (same wire form as agent events)
through the exported local reducer, hydrates /history through the local
history action, and injects the optimistic user bubble with the local
user action — items, live streaming, approvals, and asks therefore shape
exactly like a local tab.
- RemoteSessionSurface renders the shared Transcript component; only the
connection state machine and the approval/ask cards stay remote-specific.
The composer stays the shared local one with send/cancel/running fed by
the session (App-level wiring). Bespoke row/composer rendering and its
styles/strings are gone; the mock snapshot returns an empty history like
a fresh local session and the mock turn streams through the reducer.
- State type exported from useController; the svg asset stub also covers
.css so tsx tests can mount the transcript chain.
* feat(desktop-fe): remote sessions in the project tree / 项目树远程会话行与远程菜单
- Remote groups list their serve sessions (RemoteProjectSessions) while
the host is connected; rows open by sessionName through the ensure-open
path. A new session invalidates the cached listing.
- Group row gains a connection badge driven by the live host status.
- Remote groups swap the local project menu for remote actions: new remote
session, open remote window, stop remote server, unpin (removes the
registration and refreshes). The + action opens a remote session instead
of creating a local topic — local reveal/rename/remove no longer fire on
remote rows.
- Source-contract test pins the tree wiring and the shared-composer prop
branching in App.
* feat(desktop): session titles, new-session reset, and demo preseed / 会话标题、新建会话重置与演示预置
- The SSE pump schedules a title refresh after turn_done: the serve's
LLM-generated title for the current session replaces the workspace-name
default and rides the tab-opened channel, which the chrome merges into
the existing strip entry (no re-switch when the tab is already active).
- A NewSession open on a live tab now POSTs /new: the previous session
stays in the remote history list, the tab switches to the new empty one
(title resets), and the re-emitted ready state forces the frontend to
re-sync its snapshot — which now happens on every ready transition, not
just the first hydration.
- The tree hydrates host statuses once on mount, so badges and the
session-fetch gate are correct without a wizard run.
- Browser-dev mock preseeds a connected demo project, an open demo tab,
and a demo session row; the canned turn adopts an AI-style title and a
new-session open resets the demo tab like the real backend.
- Tests: title adoption + new-session reset (Go), ready re-sync (surface),
preseed contract.
* feat(desktop): authoritative remote session lifecycle / 远程会话生命周期权威化
- The session listing is backend-authoritative: RemoteProjectSessions
merges a desktop-view blank row (name empty, localized 新的会话 title)
while the tab holds a fresh session the serve has not written yet, so
the tree renders one source of truth.
- Blank reuse mirrors EnsureBlankTab: a sessionReset flag on the tab makes
further new-session opens re-activate instead of POSTing /new again; the
flag clears when the session earns a serve title or a resume lands.
- resumeRemoteTabSession switches a live tab to a listed session (POST
/resume, title adoption, ready re-emit); the bootstrap gives fresh
sessions the localized default title.
- serve /sessions entries carry mtimeMilli; the listing orders pinned
first and merges desktop-owned title overrides; SetRemoteSessionPinned
and SetRemoteProjectTitle back the tree actions.
- fakeServe mirrors serve semantics (/new abandons current, /resume
restores it); tests pin the blank-reuse contract and resume flow.
* feat(desktop-fe): remote sessions ride the local renderer with full parity / 远程会话全面复用本地管线
- Session rows join the TREE DATA as synthetic topic nodes, so filtering,
workbench arrangement, and the pinned section treat them exactly like
local topics; clicks, pin, rename, and archive route to the remote
bindings and the blank row comes from the authoritative listing (the
frontend blank state machine is deleted).
- Project menus mirror the local templates item-for-item (new session,
rename project via registry title, reveal in remote file manager, copy
path, archive active conversation, unpin) in classic and workbench
variants; AI rename stays disabled for remote rows.
- The shared Composer serves remote tabs: send/cancel/running from the
session hook, model switch through SetRemoteTabModel with the capsule
label from the serve status; the topic-bar pencil opens rename.
- The mock mirrors the whole chain: demo preseed (project, tab, session
row with an 18-turn history), dynamic session store, local-script
canned turns with cancellation, immediate 202-style submit resolve,
session-interrupting switches, and model catalog switching.
* test(remote): multi-workspace serve coexistence coverage / 多工作区 serve 共存测试覆盖
- One fake host, two workspaces: slug-keyed state/token files coexist,
re-ensure reuses only its own serve, Stop(A) leaves B alive, and each
launch script carries only its own concrete state paths (plan task 1.1
coverage over the as-built layout).
* feat(desktop): wizard-level remote platform check / 连接向导阶段的远程平台检查
- CheckRemotePlatform runs uname through the same ParseUname gate
EnsureServe applies; the connect wizard awaits it at the connecting
step, so an unsupported remote OS (V1: Linux/macOS) fails with one
clear message before directory browsing starts, instead of deep in
serve bootstrap after the project is registered.
* refactor(desktop): per-workspace remote serve registry and stop/status/logs API / 按工作区键控的远程 serve 注册表与停止状态日志接口
- managedHost tracks one serveEntry per workspace instead of a single
server+token; the loopback tunnel is named serve-<slug> from
store.RemoteWorkspaceSlug so one host holds one independent forward
per workspace.
- StopServer/ServerStatus/ServerLogs gain a workspace parameter; the
bound StopRemoteServer/RemoteServerStatus/RemoteServerLogs follow,
with every frontend call site updated in the same commit because
remote:server events now interleave per workspace.
- The web window records its workspace so reconnect refresh re-ensures
it and stop closes it only on a match; the frontend store nests
servers[hostId][workspace] and the panel server tab manages the
input's workspace (the host's first entry while the input is empty)
(plan task 2.1).
* test(desktop): assert StopRemoteServer forwards the workspace to the kernel / 断言 StopRemoteServer 向内核转发工作区参数
- Wires the fake kernel's stoppedWorkspaces tape to a real assertion in
the stop-closes-window test, so the bound method's workspace
parameter is verified alongside the window behavior.
* fix(desktop-fe): type-safe remote test mocks / 远程测试桩类型修复
- The optimistic-bubble assertion wraps its optional-chained some() in
Boolean so ok() receives a boolean; the panel mock's window.go App
object casts through Partial<AppBindings> like the wizard mock, and
the wizard's Promise.withResolvers timers become plain Promise
constructors (lib-target independent). These are what editors report
when they type-check the tsconfig-excluded test files.
- The default React imports stay: tsx compiles these excluded files
with the classic JSX transform, so the seemingly unused import is
required at runtime.
* feat(desktop): remote tabs persist and restore as disconnected shells / 远程标签持久化与断连空壳恢复
- desktop-tabs.json gains remoteTabs + remoteTabOrder (omitempty: no
remote tabs open ⇒ byte-identical legacy file). Entries carry only
id/host/workspace/title — no session: clicking a restored shell
reconnects and lands in a fresh blank session, and the tree group's
session rows remain the picker for past conversations.
- restoreOrBuildTabs rebuilds shells in a disconnected state (no
connect, no serve) and routes a persisted remote active id to the
strip highlight; SetActiveTab on a shell and the tree-group
ensure-open both bootstrap the reconnect in place, reusing the id.
- New disconnected state rides TabMeta.remoteState so the surface
renders before any event this run; the surface offers a reconnect
button; host status transitions never flip a shell into a runtime
state.
- ReorderTabs accepts the full mixed strip: local and remote
subsequences validate and persist separately (drag-reorder with
remote tabs used to fail server-side). Single-surface layouts
collapse remote shells to the active one like local tabs (plan
task 3.1 remainder: Guards/Restore/Round-trip).
- The surface test's OpenRemoteProjectTab mock returns a TabMeta to
match the binding signature (the void return broke the
Partial<AppBindings> cast under editor type-checks).
* fix(desktop): boxed frame collapse
Fix \boxed rendering so the frame is a proper rectangle instead of a
collapsed vertical bar in WKWebView, and pin pnpm to v10 as required by
the frontend's engines field.
- KaTeX draws \boxed's frame as an empty .fbox span whose width comes
from .katex-stretchy's width:100%. Under WKWebView that percentage
resolves against the span's intrinsic width (0) inside the
inline-table/table-layout:fixed vlist, so top/bottom borders vanish
and left/right borders merge into one tall bar. Override the width
with -webkit-fill-available, which fills the containing row while
keeping the span's inline-block baseline alignment (vertical position
intact).
- Add "packageManager": "[email protected].5" so Corepack/Wails use pnpm 10,
matching the ">=10 <11" engine range, instead of defaulting to pnpm 11.
- TUI path: teach internal/cli/latex.go \boxed (render inner content),
\left./\right. (invisible dot delimiter), and \vert/\lvert/\rvert/
\Vert/\lVert/\rVert symbols, with regression cases in latex_test.go.
* fix(remote): generous serve/upload budget and pipelined SFTP writes / 放宽 serve 上传时限并流水线化 SFTP 写入
- The CLI serve/fs paths had a flat 60s deadline; a same-platform
binary upload is ~55MB and real links sit under 1MB/s, so the
deadline failed exactly the install mode offline hosts need. Both
budgets rise to 10 minutes.
- sftpfs copies uploads through a 1MB buffer so each Write keeps ~32
SFTP packets in flight; with the default 32KB io.Copy buffer every
Write is one packet and concurrent writes degenerate to a packet
per round-trip. (A pkg/sftp throughput gap vs OpenSSH sftp remains
on high-RTT links: measured 25-40KB/s vs 588KB/s; tracked
separately.)
- List resolves a leading "~" server-side (Stat-verified, falling back
to the session start directory): the SFTP protocol does not expand it,
so the wizard's fresh-host browse of "~" failed with
"file does not exist".
* feat(remote): local-proxy credential mode kernel / 本地代理凭证模式内核层
- RemoteHostEntry gains credential_mode (remote | local-proxy) with
validation, renderer, and a --credential-mode flag on remote add.
- bootstrap.CredentialProxyOptions: EnsureServe installs a
tunnel-backed provider entry into the remote user config
(idempotent append; a base_url change rewrites just that line) and
LaunchCommand injects the virtual token via the serve environment
plus --model <provider> — the token never rides argv or files.
* feat(desktop): desktop-held credentials for remote serves / 远程 serve 桌面持钥模式
- credential_proxy.go: a loopback key holder swaps the per-host virtual
token for the real provider key and streams responses through
(SSE-safe). Tokens derive from a persisted secret, so a restarted
desktop keeps working with a reused remote serve; rotating the
secret revokes every token at once.
- EnsureServer orchestrates local-proxy hosts: proxy starts, the
cred-proxy:<host> reverse tunnel opens (forward.Remote, idempotent),
and the bootstrap receives the token + provider entry to install.
- Host form gains the credential-mode select (three locales); the
locale budget gate rides along (remote copy grew the chunks past
the old 55.8/55.0 gates).
- E2E: TestCredentialProxyRealHostSmoke (env-gated) drives connect →
reverse tunnel → serve launch → one real model turn and asserts the
reply arrived through desktop-held credentials; verified against a
live host.
* fix(desktop-fe): tolerate the wails dev spinner crash / 容忍 wails dev 转圈组件崩溃
- index.html gains the #wails-spinner anchor expected by the v2.13 dev
runtime.
- The global crash screen now ignores errors whose stack lives entirely
inside /wails/*.js: the v2.13 dev runtime's Svelte spinner throws
"Cannot read properties of null (reading 'nodes')" on mount while the
app itself keeps working (verified headless: full UI renders), so the
fatal report must not escalate third-party runtime noise.
* fix(remote): materialize the preset default_model relies on / 物化默认模型依赖的内置供应商
- Appending the credential-proxy [[providers]] entry replaces the
remote's built-in provider defaults, so a default_model like
"deepseek-flash" that resolved only through those defaults would
dangle and crash the serve at startup (surfacing as a confusing
port-file timeout). The install now materializes the builtin entry
default_model refers to as an explicit block BEFORE ours; the
default_model line itself is never rewritten, so every entry point
(CLI, web window, remote-mode desktop launches) keeps resolving.
* feat(desktop-fe): credential-mode segmented control in the wizard / 向导增加凭证模式分段控件
- The wizard's inline host form gains the same remote|local-proxy choice
as the hosts page, rendered as a provider-add-segmented control after
the download method (established pattern; zero new styles or locale
keys). Wizard-created hosts no longer silently default to remote mode.
* fix(remote): heal the credential provider config on reuse too / 复用 serve 时同样治愈凭证配置
- ensureCredentialProvider now runs before the reuse check, so a live
serve's config gains the materialized default_provider entry as well —
previously only fresh launches installed it, leaving reused serves on
boxes with the old dangling-default config.
* fix(desktop): ephemeral reverse-tunnel port for the credential proxy / 凭证代理反向隧道改用临时端口
- The remote bind drops the fixed 18999 in favor of 127.0.0.1:0 (the
SSH layer reports the actual port; the materialized provider entry's
base_url already rewrites on port change). A half-dead session's
stale listener can no longer block serve starts with a confusing
"tcpip-forward request denied".
* fix(config): relax compact_ratio floor from 0.65 to 0.30
Allow users to set a lower compaction threshold for large context
windows (e.g. 1M). A lower threshold triggers compaction earlier,
giving users finer control over cost vs. context freshness tradeoffs.
The existing safety guards (Prepare boundary, foldEconomics) remain
unchanged — lowering the floor only expands the user-configurable
range, not the automatic behavior.
Fixes#9060
* feat(serve,agent): provider reload endpoint, provider_unreachable event, status reconciliation fields / serve 增加供应商重载端点、通道不可达事件与状态对账字段
* feat(remote): credential heal closes the loop — change signal and .env token delivery / 凭证治愈闭环：变更信号与 .env 令牌交付
* feat(desktop): reverse-channel self-healing, single-pump attach, busy-soft session entry / 反向通道自愈、单泵附着与忙碌软进入
* feat(desktop-fe): remote session running reconciliation, submit rollback, interruption notices / 远程会话运行对账、提交回滚与中断通知
* feat(desktop-fe): remote project tree and wizard polish / 远程项目树与向导打磨
* fix(desktop-fe): make remote-session-surface test runnable under the default runner / 修复远程会话面测试在默认跑测器下的崩溃
- 按 remote-server-panel 的既有模式把 remote-session-surface.test.tsx
注册到 test:remote（svg-stub-register 加载）：其渲染链经 Transcript
懒加载 ScrollDiagnosticPanel，再传递导入 logo-wordmark.svg，裸 tsx
无法解析该扩展名
- ScrollDiagnosticPanel 读 import.meta.env.DEV 改为可选链：裸 tsx 下
import.meta.env 为 undefined（此前 __BUILD_CHANNEL__ 未定义即开启
诊断面板，模块求值即崩）；Vite 构建行为不变
- 验证：svg-stub 跑测 24/24 通过，tsc 无告警
注：remote-error-ux.test.tsx 的 5 个安全摘要断言失败为分支合并前
既有问题（d597b10fd 上同样 4 过 5 挂），与本次合并无关。
* feat(serve): multi-session detach, runtime status, and gzip snapshot transport / 多会话后台切换、runtime 状态与 gzip 快照传输
- Add detached multi-session controllers and lease split/adopt so busy
sessions keep running across switches, with session-tagged SSE frames
- Expose GET /status?runtime=1 for desktop hydrate/reconcile without
wallet Balance, aligning remote running checks with local RuntimeStatus
- Compress large snapshot JSON responses with gzip middleware
- Keep provider reload retiring stale detached controllers after
credential-channel heal
Verification: go test ./internal/serve -count=1 -run 'TestStatusRuntimeQuerySkipsBalance|TestProvidersReloadRetiresStaleDetached|TestGzipMiddleware'
* feat(desktop,remote): credential-channel watchdog and provider heal / 凭证通道 watchdog 与供应商配置自愈
- Watch the reverse credential tunnel at runtime and re-heal when the
ephemeral remote port drifts after SSH reconnects
- Rewrite the remote reasonix-desktop-proxy base_url through
HealCredentialProvider, then reload serve providers (cancel-then-reload
when a doomed busy turn blocks 409)
- Gate bootstrap reuse on session-events / detached-heal capabilities so
stale serves are replaced instead of fast-reused on a dead loopback port
Verification: go test ./desktop -count=1 -run 'TestCredentialChannel|TestNeedsHeal|TestCancelThenReload' ; go test ./internal/remote/bootstrap -count=1 -run 'Credential|Heal'
* fix(desktop): remote session snapshot race, hydrate slimdown, and bridge-chain acceptance / 修复远程会话快照竞态并瘦身 hydrate
- Stop RemoteTabSnapshot concurrent map writes by copy/merging the per-tab
ETag cache under remoteTabMu instead of sharing it across unlocked workers
- Let hydrate/reconcile fetch only /history + /status?runtime=1, coalesce
overlapping ready/mount hydrates, and rate-limit REFUSED command logs
- Add bridge-chain acceptance probes (Open→ready→snapshot stampede) and FE
surface assertions so verification walks the real frontend binding path
Verification: go test ./desktop -race -count=1 -run 'TestRemoteTabSnapshot|TestRemoteSessionHydrateChainFromOpenToSnapshot|TestServeGetCachedAcceptsGzip'; node --import ./scripts/svg-stub-register.mjs --import tsx src/__tests__/remote-session-surface.test.tsx
* feat(desktop,cli): remote session-path switch and serve capability markers / 远程会话按路径切换与 serve 能力标记
- Pass listing-row sessionPath/sessionTitle into OpenRemoteProjectTab so
resume skips a redundant GET /sessions name lookup
- Project live turn state onto remote session rows from tagged runtime
events, including background sessions
- Advertise --session-events / --detached-heal (and the rolling caps token)
from serve --help so remote bootstrap can replace outdated binaries
Verification: go test ./desktop -count=1 -run 'TestResumeRemoteTabSessionKnownPathSkipsListing|TestRemoteTabPumpRoutesFramesBySession'; go test ./internal/cli -count=1 -run Serve
* fix(desktop-fe): pin test locale to jsdom navigator / 测试固定 jsdom navigator 避免系统语言影响断言
* fix(desktop-fe): add missing readOnly to local-only recovery fixtures / 补齐 local-only 恢复用例缺失的 readOnly 字段
* fix(desktop-fe): pin test locale to jsdom navigator / 测试固定 jsdom navigator 避免系统语言影响断言
* fix(desktop-fe): add missing readOnly to local-only recovery fixtures / 补齐 local-only 恢复用例缺失的 readOnly 字段
* chore(desktop-fe): ratchet raw budget for the serve-scaling stacked tip / 上调原始体积预算适配 serve 扩展层
* fix(sessioncatalog): stop repeated repair reindex loop / 修复会话目录反复重新索引 (#9312)
* fix(sessioncatalog): stop repeated repair reindex loop
Problem: Idle desktop sessions could repeatedly show indexing progress and make sidebar deletion appear unavailable.\n\nRoot cause: Exact-path catalog indexing rewrote an unchanged projection and published a new revision on every defensive snapshot, allowing repair and reconcile work to feed back into one another.\n\nFix: Skip unchanged exact-path projections, prevent stale unknown inputs from downgrading known counts, and add regression coverage for repeated indexing and repair completion.\n\nVerification: go test ./internal/sessioncatalog -count=1; go test -race ./internal/sessioncatalog -count=1; go vet ./internal/sessioncatalog; cd desktop && go test ./... -run 'Test(DeleteSession|SessionCatalog|ProjectTree|Reconcile|ListProjectTopics)' -count=1
* fix(sessioncatalog): preserve recovery metadata during index repair
Problem: the first PR revision failed repository standards and could leave recovery metadata stale when an unknown count record arrived for an existing session.\n\nRoot cause: the exact-index fast path was embedded in the large upsert function, and its downgrade guard skipped the whole record without distinguishing count fields from recovery metadata.\n\nFix: extract exact-path preparation into a focused helper, preserve known counts only when the content fingerprint is unchanged, and still apply recovery metadata updates.\n\nVerification: go run ./tools/repolint; go test ./internal/sessioncatalog -count=1; go test -race ./internal/sessioncatalog -count=1; go vet ./internal/sessioncatalog; cd desktop && go test ./... -run 'Test(DeleteSession|SessionCatalog|ProjectTree|Reconcile|ListProjectTopics)' -count=1
* fix: preserve sidebar activity order during exact indexing / 修复精确索引导致的侧栏会话错排 (#9314)
* fix: keep runtime conversation rows in canonical order
Problem: Switching conversations could reorder sidebar rows while runtime and catalog snapshots crossed.
Root cause: The frontend sort comparator treated runtime session rows as incomparable with catalog topic rows, so async arrival order leaked into the visible order.
Fix: Sort both row shapes with the same pinned, manual, activity, and stable-key rules, while keeping non-conversation nodes deterministic. Add a regression test covering a runtime-only row ahead of catalog rows.
Verification: Focused project-tree runtime, catalog-completeness, and runtime-projection tests; frontend typecheck.
* test: keep project tree regression within file budgets
Problem: The focused regression pushed project-tree-runtime.test.ts past the repository test-file budget.
Fix: Move the sorting regression into the dedicated project-tree-sort-runtime test module without changing production behavior.
Verification: Project-tree runtime tests, repolint, and frontend typecheck.
* fix(sessioncatalog): preserve recovery metadata during index repair
Problem: the first PR revision failed repository standards and could leave recovery metadata stale when an unknown count record arrived for an existing session.\n\nRoot cause: the exact-index fast path was embedded in the large upsert function, and its downgrade guard skipped the whole record without distinguishing count fields from recovery metadata.\n\nFix: extract exact-path preparation into a focused helper, preserve known counts only when the content fingerprint is unchanged, and still apply recovery metadata updates.\n\nVerification: go run ./tools/repolint; go test ./internal/sessioncatalog -count=1; go test -race ./internal/sessioncatalog -count=1; go vet ./internal/sessioncatalog; cd desktop && go test ./... -run 'Test(DeleteSession|SessionCatalog|ProjectTree|Reconcile|ListProjectTopics)' -count=1
* fix: preserve activity during exact session indexing
Problem: A transient older sidecar read could overwrite a known newer activity timestamp and reorder the project sidebar while switching conversations.
Root cause: Exact-path indexing replaced the catalog activity projection without comparing it with the existing authoritative content projection.
Fix: Preserve the known activity timestamp when the transcript fingerprint is unchanged and the incoming sidecar timestamp is older. Add a deterministic regression test for the backwards-activity case.
Verification: Focused sessioncatalog tests, project-tree runtime/sort tests, frontend typecheck, repolint, and git diff --check.
* refactor: remove unreachable runtime session sort path
Problem: The frontend sorter change targeted top-level session rows that the current runtime projection does not emit.
Fix: Remove the unreachable presentation change and its misleading fixture so the PR owns only the exact-index activity regression that reproduces the reported sidebar reorder.
Verification: Project-tree tests, sessioncatalog tests, repolint, and frontend typecheck.
* fix(desktop): allow deleting configured default providers / 修复已配置默认模型服务无法删除 (#9344)
* fix(desktop): allow deleting configured default providers
Problem: The provider access menu was disabled for any custom provider selected as the current default, so configured providers could not be deleted from settings.\n\nRoot cause: The frontend blocked the action based on default-model state even though the backend already retargets references to a configured fallback and rejects unsafe removals.\n\nFix: Remove the frontend-only default-provider deletion gate and keep the backend as the source of truth. Add a regression test covering the custom provider removal confirmation flow.\n\nVerification: provider access card test, frontend typecheck, test typecheck, ESLint, CSS checks, and desktop Go tests all pass.,
* test(desktop): cover deleting the current default custom provider
Problem: the provider deletion regression test did not model a custom provider selected as the current default. Root cause: the card-only fixture bypassed SettingsPanel and never supplied a defaultModel reference. Fix: render the real models/access settings path with a default custom provider and verify the delete action reaches RemoveProviderAccesses. Verification: provider-access-card test, test typecheck, frontend typecheck, targeted ESLint, CSS checks, and settings-refresh snapshot test all pass.
* fix: restore explicit readiness recovery and stabilize transcript scroll / 恢复显式收尾恢复并稳定会话滚动 (#9341)
* fix(control): restore explicit readiness recovery
Problem: Standard and Delivery turns could launch hidden readiness continuations after a final answer, causing extra model rounds and useless work.\n\nRoot cause: ordinary orchestration armed automatic readiness continuation and classified task progress from per-turn control state and assistant prose.\n\nFix: stop ordinary Standard and Delivery turns at the readiness boundary, preserve explicit Delivery recovery and Goal/Plan continuation, and remove the task-progress continuation path and prose heuristic.\n\nVerification: go test ./internal/agent ./internal/control
* fix(desktop): stop freezing transcript rows during scroll
Problem: manual transcript scrolling could freeze recycled rows to estimated heights and maintain a second pending-Markdown geometry contract, allowing Virtuoso offsets and painted content to diverge.
Root cause: the scroll arbiter forced DOM height during measurement and the geometry cache calibrated unseen rows from unrelated samples.
Fix: keep real measurements for wheel and touch reading, remove pending Markdown fixed-height fallbacks, remove cross-row calibration, and route viewport-shrink tail pinning through the existing Virtuoso writer.
Verification: transcript measurement, native scrollbar, scroll-release, anchor-compensation, recovery-race, typecheck, and single-scroll-writer checks.
* fix(desktop): bound transcript tail writer
* test(desktop): align transcript tail writer fixtures
* docs: document explicit readiness recovery
* fix(desktop): restore explicit Delivery recovery copy
* test(desktop): clarify native scrollbar measurement contract
* fix(desktop): stabilize async markdown geometry
* fix(desktop): keep native scrollbar drag geometry stable
* fix(desktop): adopt bounded transcript scroll recovery
Problem: tail settling could re-arm on sub-row measurement jitter, and a near-bottom downward wheel could arm extent recovery that fought the user's scroll. The previous CI desktop failure also lacked enough geometry evidence and Windows had no browser replay of the transcript path. Legacy readiness comments still described removed ordinary-turn continuation.
Root cause: the tail writer had an attempt cap but no height-growth gate or pinned-state distinction, while releaseTailFollow armed reader extent unconditionally. The browser harness spawned pnpm with a POSIX-only command name and the CI contract counted transcript checks across jobs.
Fix: add a single 24px tail re-arm policy that only suppresses writes while the tail is actually pinned, keep displaced tail recovery live, add the #9248 near-bottom guard, and cover both in deterministic tests. Make transcript browser benches cross-platform, add a Windows Chromium replay beside the native WebView2 smoke, improve timeout diagnostics, and clarify Standard/Delivery readiness comments without changing wire fields.
Verification: go test ./...; go test -race ./internal/agent ./internal/control; cd desktop && go test ./...; cd desktop/frontend && pnpm test:transcript; pnpm test:transcript-browser (two stability runs); pnpm test:motion; pnpm typecheck; pnpm check:scroll-writer; pnpm build; go vet ./internal/agent ./internal/control; go run ./tools/repolint ./....
Co-authored-by: hanswu <[email protected]>
* fix(desktop): launch transcript preview on Windows
Problem: the Windows transcript replay reached the browser bench but failed before starting Vite with spawn EINVAL under Git Bash.
Root cause: Windows command shims such as pnpm.cmd need shell dispatch when launched by Node child_process on the runner.
Fix: keep the platform-specific pnpm command and enable shell dispatch only on Windows for both transcript browser benches.
Verification: cd desktop/frontend && pnpm test:transcript-browser; the Linux/macOS path remains direct spawn and the Windows CI job will rerun the replay.
* test(desktop): make native thumb endpoint platform aware
Problem:\nThe transcript browser replay passed its selection and geometry assertions on Windows but timed out while dragging the native scrollbar thumb to the physical bottom.\n\nRoot cause:\nWindows Chromium keeps a held native scrollbar thumb attached to the track, while Linux themes clamp after an overshoot beyond the track. A single overshoot endpoint is not portable.\n\nFix:\nUse the in-track endpoint on Windows and retain the Linux overshoot endpoint. The gate still exercises native thumb ownership, measurement freezing, release, and tail remeasurement.\n\nVerification:\n- cd desktop/frontend && node bench/transcript-scroll-stability.mjs\n- git diff --check
* test(desktop): skip unsupported Windows headless thumb drag
Problem:\nHeadless Chromium on Windows reports the reserved scrollbar gutter but does not expose a draggable native thumb, so the transcript replay timed out after all geometry and scroll assertions had passed.\n\nRoot cause:\nThe browser benchmark was asserting a WebView2/native scrollbar capability that is unavailable in the headless Chromium runner.\n\nFix:\nSkip only the native thumb drag portion on Windows unless explicitly enabled with REASONIX_TRANSCRIPT_NATIVE_THUMB=1. Keep the complete replay, Linux native-thumb gate, transcript-native-scrollbar unit coverage, and Windows WebView2 native smoke.\n\nVerification:\n- cd desktop/frontend && node bench/transcript-scroll-stability.mjs\n- git diff --check
---------
Co-authored-by: hanswu <[email protected]>
* fix: remove grouped custom provider routes atomically
Problem:
The OpenCode Go settings card submitted all of its custom routes for removal, but the backend rejected every multi-provider custom request.
Root cause:
Grouped deletion was restricted to official provider aliases even though OpenCode Go is presented as one product-level connection backed by several custom provider entries.
Fix:
Recognize the narrow OpenCode Go route family, expand stale requests to every installed family member, and reuse the failure-atomic provider removal and runtime retargeting path for the full group. Unrelated custom batches remain rejected.
Verification:
- go test ./... (desktop module)
- go test -race focused grouped removal tests
- provider access card component test
- frontend production and test TypeScript checks
* test: split provider group removal coverage
Problem:
The grouped-removal regression coverage pushed an existing desktop test file beyond the repository size ceiling.
Root cause:
The new OpenCode Go tests were added to the already-large general provider-removal test file.
Fix:
Move the new grouped custom-provider tests into a focused test file without changing their behavior.
Verification:
- go run ./tools/repolint
- cd desktop && go test ./...
- focused grouped-removal tests
- focused grouped-removal tests under go test -race
* fix(windows): restore taskbar icon on the running desktop window
Wails v2 registers its window class (wailsWindow) without an hIcon, so the
window answers WM_GETICON with NULL. On Windows 11, once the process sets an
explicit AppUserModelID (PR #7925 -> SetCurrentProcessExplicitAppUserModelID
Reasonix), the taskbar prefers resources registered for that AUMID over the
executable's embedded icon; with none registered it renders the blank-document
glyph for the running window's button. Pinned shortcut icons are unaffected
(they read IconLocation -> reasonix-launcher.exe).
Set the first icon group from the running executable on the Wails window and
its class at startup: WM_SETICON (big+small) plus SetClassLongPtr(GCLP_HICON,
GCLP_HICONSM), which also covers Alt+Tab and window switcher rendering.
Loads via ExtractIconExW, retrying briefly until the wailsWindow appears.
Verified: go vet ./... and unit tests in desktop; plus an isolated Win32 A/B
repro (no-hIcon window class + explicit AUMID) showing the taskbar glyph goes
from blank-document to the embedded brand icon (taskbar screenshot saturation
0.456 -> 0.742).
Fixes the taskbar-icon half of the Windows desktop regression; grouping is
already handled by PR #7925.
* feat(desktop-fe): three-step remote connection wizard / 三步远程连接向导 [0/3]
- RemoteConnectWizard: host pick → auth/platform check → workspace
browse, all-or-nothing finish, connect log rail, z-index tokens
- add-project menus offer remote connect (ProjectTree + useProjectCreation)
- bridge/types: remote tab bindings with browser mocks
- locales en/zh/zh-TW wizard keys; wizard styles
* feat(config): pin remote projects in user config / 用户配置支持固定远程项目 [0/3]
- config/remote.go: pinned remote project entries (host + workspace)
- render.go: render pinned projects; remote_config_test coverage
* feat(desktop): wizard-level remote platform check / 连接向导阶段的远程平台检查 [0/3]
- remoteKernel.CheckPlatform: uname through the same ParseUname gate
EnsureServe applies; App.CheckRemotePlatform binding for the wizard
- wizard awaits the check at the connecting step, before directory
browsing, failing early with one clear message on unsupported OS
- bridge binding + mock; platform-check tests (app/lifecycle)
* chore(desktop-fe): ratchet bundle budgets for the connect wizard / 连接向导预算 ratchet [0/3]
- initial JS 431.6→432.5, app-shell CSS 114.3→115.4, zh 56.5→57.2,
zh-TW 57.2→58.0, raw startup 2353.2→2364.0 (measured at [0/3])
* feat(desktop): remote project registry and tree groups / 远程项目注册与项目树分组 [0.5/3]
- remote_projects.go: per-host remote project registry with config pinning
- session_catalog.go: remote tree nodes; tabs.go: WorkspaceTab.Remote ref
- app.go: registry bootstrap wiring
- ProjectTree: remote group rows with cloud badge, serve session rows
and remote menu (opens/stop/unpin); session click lands with [1/3]
- bridge/types: RemoteTabRefView + OpenRemoteProjectTab bindings
* feat(desktop): per-workspace remote serve registry, stop/status/logs API / 按工作区键控的远程 serve 注册表与停止状态日志接口 [0.5/3]
- remote_app.go: serves keyed per workspace; StopServer/ServerStatus/
ServerLogs take hostID+workspace; per-host registry map + serve entries
- remote_window/lifecycle tests; RemotePanel + remote-store + bridge
bindings and mocks updated to the per-workspace signatures
* feat(desktop): remote session listing for the project tree / 项目树远程会话列表 [0.5/3]
- remote_listing.go (slice of the serve bridge, folded back into
remote_tab.go by the sessions PR): one-shot auth handshake against an
already-ready serve registration, GET /sessions, RemoteProjectSessions
- ServeSnapshot read-only lookup on the per-workspace registry: query
paths must never cold-start a serve; live-tab fast path lands with [1/3]
* fix(remote): generous serve/upload budget and pipelined SFTP writes / 放宽 serve 上传时限并流水线化 SFTP 写入 [0.5/3]
- sftpfs pipelined writes with a generous upload budget; remote_connect
follows suit; multi-workspace serve coexistence coverage
* feat(desktop): desktop-held credentials for remote serves / 远程 serve 桌面持钥模式 [0.5/3]
- desktop cred_proxy: virtual-token key holder with reverse-tunnel
delivery; per-workspace routes, ephemeral remote ports, watchdog heal
- bootstrap: local-proxy credential kernel (provider install/heal +
change signal, mismatched-serve replacement) and .env token delivery
- serve: provider-reload endpoint, provider_unreachable event, status
reconciliation fields (agent/control/event/eventwire)
- wizard: credential-mode segmented control; hosts page + panel/store
tests to final; sftp upload budget + multiworkspace coexistence
* feat(desktop-fe): wizard polish, tree styles, remote test hardening / 向导打磨、树样式与远程测试加固 [0.5/3]
- wizard credential-mode segmented control; connect-log and finish polish
- project-tree group/badge/menu styles (d597b10fd subset)
- remote-error-ux pinned to jsdom navigator (fixes the 5 pre-existing
locale failures); hosts-page/secret-dialog/server-panel mocks to final
* chore(desktop-fe): ratchet bundle budgets at project groups / 项目分组段预算 ratchet [0.5/3]
- initial JS 432.5→434.5, app-shell CSS 115.4→115.8,
zh 57.2→57.6 / zh-TW 58.0→58.6, raw startup 2364.0→2373.0 (measured)
* feat(desktop): remote tab serve bridge — handshake, SSE pump, lifecycle / 远程标签 Serve 桥：握手、事件泵与生命周期 [1/3]
- remote_tab.go: auth handshake, session entry, single-pump attach,
reconnect/close lifecycle, full command proxy, snapshot; the listing
slice from [0.5/3] folds back in here
- remote_projects/tabs/app/session_catalog: authoritative session
lifecycle, titles, new-session reset, disconnected-shell persist and
restore, reverse-channel self-healing
* feat(desktop-fe): remote sessions ride the local renderer with full parity / 远程会话全面复用本地渲染管线 [1/3]
- RemoteSessionSurface + useRemoteSession: transcript through the local
pipeline end to end, strip activation/close, running reconciliation,
submit rollback, interruption notices
- App: shared Composer wired to the remote session; ProjectTree session
rows click-through, titles, merged-project wizard polish
- bridge/types to final; svg-loader, crash guard, index.html spinner fix
* feat(serve,remote): session-plane endpoints and final kernel state / 会话面端点与内核终态 [1/3]
- serve.go: session-plane endpoints, model/effort routing to final
- desktop/kernel + internal (agent/control/event/eventwire/config/cli/
bootstrap/sftpfs) to final state
* test(desktop-fe): remote session suites, locales, styles closeout / 远程会话测试、语言与样式收尾 [1/3]
- remote-session-surface / remote-running-reconcile / persist suites
- transcript-rows, app-chrome-tabs, history-tool-status updates
- locales en/zh/zh-TW and styles.css to final; runner + budgets closeout
* docs: trigger docs-impact re-run
* fix(desktop): keep group visible when topic archive is rejected
* feat(desktop): add per-session archive action in project tree
* fix(desktop/control): interrupted jobs no longer block close/archive
* fix(agent): document memory: capabilities in use_capability description / 在 use_capability 描述中说明记忆工具用法
* perf(crash-worker): the dashboard's rarest number stops costing the whole D1 bill (#9379)
The preferences module's 30-day deduplicated install count was computed by an
hourly cron over metric_users. That table's primary key leads with `date`, so
`WHERE date >= ... AND signal = ?` could only prune the window: every signal
scanned all ~28M rows, eight signals an hour. One dashboard panel therefore
read on the order of five billion rows a day, which is the database's entire
read bill — and metric_users had no other reader.
Retire the detail table and everything that fed it: the rollup cron and its two
tables, the per-install metrics write, the dashboard's own full-table window
query, and the runtime bootstrap that would recreate cli_metric_users on the
next request. The aggregate `metrics` tables keep the same signals as event
counts at ~180k rows, and `pings` keeps per-day deduplicated installs.
Both panels that rendered the retired number are removed rather than left
showing a permanent error — the 30-day notice linked to a 7-day view that no
longer had data either. The client stops sending install_id with metrics, since
nothing receives it now.
migrate-drop-metric-users.sql reclaims the ~5.6GB the table held. Deploy the
worker before running it: until then the runtime bootstrap rebuilds the table.
* fix(jobs): stop calling quiet background jobs "stalled"
A background job with no output for tools.background_jobs.stalled_warning_seconds
(900s by default) was reported as "may be stalled". Many legitimate long-running
tasks (installs, builds, test collection, waiting on an external service) stay
silent for minutes without being stuck, so a single "no visible output" signal
cannot distinguish a hang from a healthy quiet job and produced noisy false
warnings.
Reframe the notice so it states the observable fact — still running after N
without new output, i.e. a heads-up, not an error — and points at how to tune or
disable the check (stalled_warning_seconds = 0). Applies to the drain note, the
emitted Notice Text/Detail, and the config comments and rendered output.
Tests: go test ./internal/jobs/ ./internal/config/ (all pass).
* fix(jobs): keep quiet-job notices within lint budget
Problem: the notice wording fix pushed jobs.go beyond the repository repolint baseline, and the updated tests did not fully guard the new Text/Detail contract.
Root cause: the notice payload was split across extra local variables and a multi-line event literal, while the tests only searched for the new headline.
Fix: construct the unchanged warning event in a compact value, and assert the new wording, guidance, and removal of the old stalled phrase in both emitted and drained notices.
Verification: go test ./internal/jobs/ ./internal/config/; go test -race ./internal/jobs; go vet ./internal/jobs/ ./internal/config/; go run ./tools/repolint.
Co-authored-by: SivanCola <[email protected]>
* fix: preserve scoped provider removal semantics
Problem:
Grouped custom-provider removal expanded search-only requests to every OpenCode Go route and left auxiliary model references pointing at deleted providers.
Root cause:
The batch API did not preserve the caller's requested subset, while the removal fingerprint and retargeting path covered only the primary desktop model references.
Fix:
Delete only the explicitly requested members of a validated OpenCode Go family. Clear vision references, retarget guardian/recovery and every persisted bot model owner, and include those values in the concurrent-change fingerprint.
Verification:
- go run ./tools/repolint
- cd desktop && go vet ./... && go test ./...
- focused grouped-removal tests under go test -race
- provider access card component test
- frontend production and test TypeScript checks
Co-authored-by: poorpaper <[email protected]>
* fix(desktop): guard boxed math width across browsers
Problem: KaTeX boxed frames can collapse in WebKit, and the frontend package pin and CSS contract were not guarded by an automated test.
Root cause: the WebKit-specific fill value had no standards-compatible fallback or source contract test.
Fix: keep width:100% as a fallback, retain -webkit-fill-available for WebKit, and add a discovery-run contract test for the boxed rule and pnpm pin.
Verification: go test ./internal/cli; go vet ./internal/cli; CSS syntax and z-index checks; math-golden; katex-boxed-css contract test.
* fix(config): expose compact ratio floor across all settings
Problem: the config setter accepted ratios below 0.65 while the CLI, desktop editor, mock bridge, tests, and docs still enforced the old floor.
Root cause: compact-ratio bounds were duplicated across Go and TypeScript surfaces.
Fix: centralize Go bounds at 0.30-0.85, apply the range to CLI and desktop settings, update localized guidance and documentation, and add lower-bound regression coverage including 1M-context trigger math.
Verification: go test ./internal/config ./internal/cli ./internal/agent; go test ./desktop -run TestSetCompactRatio -count=1; frontend settings snapshot, typecheck, and eslint pass.
Co-authored-by: SivanCola <[email protected]>
* chore(desktop): budget boxed math CSS headroom
Problem: the latest-base app-shell CSS budget was 30 gzip bytes below the boxed KaTeX fallback build.
Root cause: the rendering fix adds a small, intentional stylesheet rule at a rounded 114.3 KiB gate.
Fix: raise only the deferred app-shell CSS allowance to 114.4 KiB and document the measured 30-byte reason.
Verification: pnpm build passes with the updated budget.
* fix(mcp): dispatch host-session MCP servers supplied over ACP
An MCP server passed through ACP `session/new.mcpServers` arrives as
`Options.ExtraPlugins` and is appended to `eagerSpecs`, so it reaches
`pluginHost`: it connects, completes initialize + tools/list, and its tools
appear in the capability catalog as `status: "ready"`.
The capability runtime is a second, separate registry. It is seeded by
`capRuntime.ConfigureServers(cfg.Plugins, capSpecs, enabledMCPNames)`, and both
`capSpecs` and `enabledMCPNames` were built from config alone. A host-session
server was therefore absent from `r.servers`, so `serverEnabled()` returned
false on its `ok` check and every `mcp-tool:<server>/<tool>` call was refused
with "is disabled in this session" — while the catalog had just advertised the
same tool as ready.
Register host-session specs with the capability runtime and mark them enabled,
matching the intent already stated where they are built: they arrive through an
explicit host action, so they are authoritative exactly like an auto-started
config plugin. Both changes are required; neither alone is sufficient, since
`ConfigureServers` reads an absent `enabled[name]` as false and `serverEnabled`
rejects a name missing from `r.servers`.
Also separate "not registered" from "disabled" in the refusal message. They have
different causes and different fixes, and reporting the former as the latter
sent users looking for a toggle that does not exist.
Reproduced against v1.31.3 over the real ACP wire with zero `[[plugins]]` in
config: `use_capability` `action: "call"` on
`mcp-tool:acppassed/traycer_probe_ping` returned "disabled in this session" and
the MCP server never received `tools/call`; `inspect` on
`mcp-server:acppassed` returned `unknown capability_id`. With this change the
same probe returns the tool result and the server receives `tools/call`.
Both new boot tests were mutation-checked: reverting only the boot.go change
fails TestBuildEnablesHostSessionMCPForCapabilityDispatch while
TestBuildLeavesUnknownMCPServerUndispatchable keeps passing, so the fix cannot
be satisfied by defaulting unknown servers to enabled.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
* fix(mcp): state host-session precedence and unify the unregistered message
Follow-up to review on the host-session MCP dispatch fix.
Extract the capability-runtime inventory merge into
mergeHostSessionCapabilitySpecs. The previous change appended host-session specs
after the config specs and relied on ConfigureServers building its registry with
next[name] = ... in slice order, so a name collision resolved to the
host-session spec by map overwrite, 700 lines from where it was decided.
That precedence is correct — it is the same choice the registration tier already
makes explicitly, filtering colliding config specs out of configSpecs before
registerEnabledMCP — but it should be stated, not inherited from slice order.
Reorder the append or switch ConfigureServers to first-wins and the behaviour
silently inverts into the worst case: a user-disabled config spec marked enabled,
with an identity that no longer matches the tools pluginHost registered.
The merge also drops the shadowed config *entry*. ConfigureServers pairs an entry
with a spec by name, so a surviving config entry paired auto_start = false with
the live host-session spec, and /mcp reported one server as simultaneously
not-auto-start and not-disabled.
Unify the wording for "this session has no such MCP server". After the previous
change the same state had two spellings in one file: the three use_capability
sites said "is not registered in this session" while lockAuthorizedRuntimeServer
— the path a registry-resident mcp__server__tool takes — still said "is not
configured". Both are reachable. mcpServerUnregisteredMessage and
mcpServerDisabledMessage now hold the two spellings that are meant to differ.
Tests:
- TestMergeHostSessionCapabilitySpecsPrefersHostSessionOnNameCollision pins the
precedence rule and that the shadowed entry is dropped. Asserted on the merge
directly rather than through a booted Controller, since observing which spec
reached the registry would otherwise need a production accessor existing only
for the test.
- TestMergeHostSessionCapabilitySpecsIsIdentityWithoutHostSession pins that the
ordinary config path is handed through untouched.
- TestBuildLeavesDisabledConfigMCPUndispatchableAlongsideHostSession pins that a
config server with auto_start = false stays undispatchable while an unrelated
host-session server is enabled in the same boot — the invariant the enablement
loop could break by widening from "every extraSpec name" to "every name".
Both new behavioural tests were mutation-checked: replacing the merge with a
naive append fails the collision test, and widening the enablement loop to every
config name fails the disabled-config test.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
* docs(boot): restore applyUnifiedProviderToolSurface's doc comment
mergeHostSessionCapabilitySpecs was inserted between
applyUnifiedProviderToolSurface's doc comment and its declaration, so the new
function carried a paragraph describing a different function and
applyUnifiedProviderToolSurface was left undocumented.
Move the helper and its comment below applyUnifiedProviderToolSurface. Both
identifiers are unexported, so gofmt, go vet and staticcheck's comment rules all
stay silent on this — only a human reading the file top to bottom sees it.
Pure move: 19 lines out, the same 19 in, no behaviour change.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
* fix(desktop): support macOS updates on exFAT
Use a macOS-updater-only rename fallback for filesystems without
RENAME_EXCL and compare copied app payloads without POSIX mode or
matching AppleDouble noise. Keep strict backup and staging identities
while accepting legacy strict handoff digests.
* fix(desktop): clarify exFAT rename fallback semantics
Problem: filesystems without RENAME_EXCL cannot provide an atomic no-replace rename through the fallback path.
Root cause: the fallback used an existence check followed by os.Rename without documenting the Reasonix lock boundary or surfacing its best-effort errors.
Fix: document the cooperative mutation-lock boundary and wrap fallback conflicts and rename failures with explicit best-effort context while preserving os.ErrExist matching.
Verification: go test ./internal/repair -count=1 -timeout=180s; cd desktop && go test . -run 'TestMacUpdateRename' -count=1 -timeout=180s
* fix(agent): rebuild zero-filled corrupt branch meta instead of failing saves / 修复：全零损坏的会话 meta 自动重建，不再阻断保存/关闭 (#9155)
* fix(agent): rebuild zero-filled corrupt branch meta instead of failing saves
A branch-meta sidecar can be torn into all-NUL (or all-whitespace) bytes when a
Windows non-atomic ReplaceFile in-place copy is interrupted by a forced reboot
(DPC_WATCHDOG_VIOLATION / power loss) — see #6325. Every save/close then fails
with 'decode branch meta: invalid character \x00' and the tab cannot be closed,
because LoadBranchMeta surfaces the decode error and callers (save.go:807,
ensureBranchMetaUnlocked) have no rebuild fallback.
Treat all-zero / all-whitespace undecodable meta as absent so it is rebuilt on
the next save, instead of blocking saves/closes. Genuine partial JSON (non-zero)
still returns an error so real corruption is not silently swallowed.
Tests: zero-filled -> absent, whitespace-only -> absent, partial JSON -> error,
EnsureBranchMeta rebuilds a corrupt sidecar. Refs #6325.
* docs(agent): clarify corrupt meta detection comment
Problem: the helper comment implied valid JSON cannot begin with whitespace.
Root cause: the wording conflated a JSON prefix with a document consisting only of JSON whitespace.
Fix: describe the actual all-NUL/all-whitespace invariant used by the detector.
Verification: git diff --check; internal/agent tests will run after updating the branch base.
Co-authored-by: SivanCola <[email protected]>
---------
Co-authored-by: SivanCola <[email protected]>
* docs(release): prepare v1.31.4 notes
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
* chore: ratchet repolint budget for compact ratio PR
Problem: the synchronized PR head exceeded existing repolint file-size and test-file-size budgets by small, intentional deltas in touched files.
Root cause: the latest main-v2 baseline predated this PR's compact-ratio validation, UI, CLI, and regression-test additions.
Fix: update only the six measured baseline entries required by the PR; no broad slack or unrelated baseline changes.
Verification: go run ./tools/repolint; go test ./internal/config ./internal/cli -count=1; git diff --check.
Co-authored-by: SivanCola <[email protected]>
* Make remote onboarding independently shippable
Problem:
- The wizard finished through remote-tab bindings that are introduced only by a later stacked PR.
- Browser file inputs cannot provide the absolute SSH identity path the desktop process needs.
- Modal focus, retry concurrency, and directory-response ordering were not protected.
Root cause:
- Browser mocks hid the Wails/native boundary and the stack assumed the later project-tab layer was already present.
- Connection retry and SFTP listing work had no single-flight or request-generation ownership.
- Wizard styles lived in the app-shell stylesheet.
Fix:
- Finish through the existing OpenRemoteWorkspace surface and remove later-layer API/config additions.
- Add a native identity-file picker and an early Linux/macOS platform probe.
- Trap and restore modal focus, hold retry busy state, and ignore stale directory responses.
- Extract growing modules, lazy-load wizard CSS, tighten bundle gates, and document the flow.
Verification:
- go build ./... && go vet ./... && go test ./...
- cd desktop && go build ./... && go test ./...
- go test -race ./internal/config
- cd desktop && go test -race . -run 'Test(PickRemoteIdentityFile|CheckRemotePlatform|Remote)'
- pnpm test:remote
- pnpm build
- REASONIX_CHANNEL=test pnpm build
- go run ./tools/repolint
- 1024x600 browser geometry, overflow, keyboard focus, and lazy CSS validation
Co-authored-by: SivanCola <[email protected]>
* fix(windows): use the correct small icon selector
Problem:
The window icon repair sent WM_SETICON with selector 2, which is only valid as ICON_SMALL2 for WM_GETICON. The per-window small icon therefore remained unset.
Root cause:
The getter-only small-icon selector was confused with WM_SETICON's ICON_SMALL value.
Fix:
Use selector 0 for the small window icon, expose narrow Win32 call seams so tests assert the exact selectors and class assignments, strengthen the no-icon guard, and document the bounded process-lifetime handle retention accurately.
Verification:
- GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go vet .
- GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go test -c .
- go test ./...
- git diff --check
Co-authored-by: SivanCola <[email protected]>
* Fix documented memory capability routes
Problem: The model-facing description advertised an unregistered memory:recall route, and the cache-prefix golden did not record the intended schema change.
Root cause: The prose was not checked against registry routing, while only the serialized request/schema goldens were refreshed.
Fix: Document the registered tool:memory recall route, tighten pinned guidance, add a routing regression test, and regenerate all cache-prefix goldens.
Verification: go test ./internal/agent ./internal/boot; go vet ./internal/agent ./internal/boot; go run ./tools/repolint; go build ./cmd/reasonix; go build ./internal/agent/... ./internal/capability/...
Co-authored-by: SivanCola <[email protected]>
* fix(desktop): isolate per-session archive actions
Problem:
- Grouped session rows shared topic-scoped menu and confirmation state.
- Successful session deletion refreshed only project shells, so the archived row could remain visible.
- The interrupted-job filters in the PR targeted a running-only API and could never observe interrupted tombstones.
Root cause:
- Session actions were keyed by topicId instead of exact row/session identity.
- The session archive path did not reload its owning canonical topic page.
- jobs.Manager.RunningForSession deliberately keeps unwinding work operationally running while excluding closed tombstones.
Fix:
- Key menus by row and confirmations by scoped topic/session identity.
- Serialize session archive actions, expose per-session busy state, and reload the owning project page.
- Preserve the existing running-job accounting contract and add focused regression coverage.
- Extract the session archive menu to keep ProjectTree within its repository budget.
Verification:
- pnpm build
- pnpm test:typecheck
- pnpm exec tsx src/__tests__/project-tree-archive-race.test.ts
- go test -count=1 ./internal/jobs ./internal/control
- cd desktop && go test ./...
- go vet ./...
- cd desktop && go vet ./...
- go run ./tools/repolint
Co-authored-by: Linearleaf <[email protected]>
* Refactor host-session MCP dispatch ownership
Problem: The functional fix grew already-large agent, boot, and controller owner files past their repolint ratchets, and its tests asserted a production-only boolean accessor instead of exercising the real proxy route.
Root cause: Availability helpers and inventory merge policy lived in aggregate files, while the regression test stopped at the dispatch gate rather than crossing use_capability into tools/call.
Fix: Move MCP availability and host-session inventory logic into focused owner files, remove the Controller accessor, and drive the Streamable HTTP stub through an actual use_capability call while checking disabled and unknown refusals and provider-schema containment.
Verification: go run ./tools/repolint; go test ./...; focused go test -race for internal/boot, internal/agent, and internal/control; go vet for the owning packages; gofmt and git diff --check.
* fix(remote): harden project groups and credential proxy
Problem:
The project-groups stage exposed unfinished remote-tab actions and could lose per-workspace credential routes or provider endpoints after reconnects. Proxy forwarding, request-body handling, remote path resolution, and stale UI fetches also had security and race gaps.
Root cause:
The partial implementation mixed future tab plumbing with the current remote-window surface, used host-scoped assumptions for workspace state, and mutated shared proxy/server state without complete lifecycle fences.
Fix:
Keep the UI on the supported remote-window flow, persist and render project registrations safely, isolate workspace provider/token identities, heal all tracked routes and managed provider blocks on reconnect, harden the credential proxy and SFTP bootstrap, and split oversized modules without widening repolint baselines. Add focused frontend, Go, race, security, reconnect, and multi-workspace coverage.
Verification:
- pnpm build and pnpm test:remote
- Playwright motion and transcript browser gates
- go test ./... in the root and desktop modules
- CI concurrency-package and desktop full race suites
- Windows cross-compilation for changed root packages and desktop
- go vet, golangci-lint v2.12.2, and repolint
Co-authored-by: XTLine <[email protected]>
* feat(release-notes): split updates by client surface
Problem:
Release notes combine Desktop and CLI changes, so users cannot tell which client needs an update.
Root cause:
The release ledger has no item-level target metadata, and every renderer flattens the same product-wide sections.
Fix:
- add versioned Desktop, CLI, site, and service targets with strict validation
- derive target hints from pull request labels and changed paths
- render client-specific sections across GitHub notes, the website, and built-in docs
- preserve the legacy layout for historical releases
Verification:
- node scripts/release-notes.mjs validate
- node --test scripts/release-notes.test.mjs
- go test ./internal/productdocs
- cd site && npm test
- go test ./...
- cd site && npm run build
- bash scripts/release-workflows.test.sh
- node scripts/check-single-release-public-contract.mjs
- actionlint release workflows
- go run ./tools/repolint
Refs #9394
* test(desktop): synchronize quality floor fixture
Problem:
The desktop full race suite could fail in TestMetaReportsGoalStatus while an asynchronous tab metadata refresh read the quality floor.
Root cause:
The test directly mutated WorkspaceTab.qualityFloor without App.mu after MetaForTab had scheduled a background refresh. Production writes already use the app lock, but the fixture bypassed that contract.
Fix:
Guard the legacy empty-floor fixture mutation with App.mu so the test follows the same synchronization boundary as production code.
Verification:
- go test -race . -run TestMetaReportsGoalStatus -count=50
* fix(release-notes): require target metadata for future releases
Problem:
The legacy compatibility path could let manually authored v1.31.4 and newer records bypass per-client target metadata.
Root cause:
Validation required item targets only when targetingVersion was already present, without an adoption boundary for future releases.
Fix:
- require targetingVersion 1 for v1.31.4 and newer core versions
- preserve legacy rendering and validation for older releases
- cover the adoption boundary across stable and preview versions
Verification:
- node scripts/release-notes.mjs validate
- node --test scripts/release-notes.test.mjs
- bash scripts/release-workflows.test.sh
- node scripts/check-single-release-public-contract.mjs
- git diff --check
* fix(productdocs): use slices for release targets
Problem:
The CI lint job rejected the manual target lookup loop under the Go 1.26 modernize rules.
Root cause:
releaseItemHasTarget duplicated the standard slices.Contains operation.
Fix:
Use slices.Contains for the same exact membership check without changing release rendering behavior.
Verification:
- go test ./internal/productdocs
- go test ./...
- golangci-lint run --timeout=5m --allow-parallel-runners
- go run ./tools/repolint
- node scripts/release-notes.mjs validate
- node --test scripts/release-notes.test.mjs
- git diff --check
* fix(agent): preserve memory activation semantics
Problem: The provider-visible memory guidance could make an update pass activation="relevant" and silently unpin an existing pinned memory, while forget and recall omitted their minimum arguments.
Root cause: The compact use_capability description conflated create and update defaults instead of matching the underlying memory schemas.
Fix: Document create/update activation behavior, the pinned opt-in, forget(name), and recall operations; enforce the contract with focused assertions; regenerate all cache-prefix goldens.
Verification: go test ./...; go test -race ./internal/agent -run TestUseCapabilityMemoryDescriptionNamesRoutableTools -count=1; go vet ./internal/agent ./internal/boot; go run ./tools/repolint; go build ./cmd/reasonix; go build ./internal/agent/... ./internal/capability/...
Co-authored-by: SivanCola <[email protected]>
* fix(remote): keep credential context out of logs
Problem:
CodeQL reported a high-severity clear-text logging path from provider credential configuration into the legacy Serve restart failure log.
Root cause:
The asynchronous fallback logged the complete error returned by EnsureServer. That error chain can include credential-configuration context and should not be persisted even though current messages avoid key values.
Fix:
Log only the safe host and workspace correlation fields for this restart failure. The detailed failure remains available through the managed Serve state without entering process logs.
Verification:
- go test ./... in desktop
- targeted remote desktop race suite
- golangci-lint v2.12.2
- repolint and git diff --check
* fix(desktop): keep archive failures visible
Problem:
- Active runtime-session rows could invoke DeleteSession and silently stop ongoing work.
- Topic tombstones were installed before TrashTopic committed, so refreshes could hide a topic even when the backend later rejected the archive.
Root cause:
- The per-session menu ignored the row's existing active-work archive guard.
- Pending UI state and the post-commit stale-response fence shared one lifecycle.
Fix:
- Disable per-session archive actions for thinking, streaming, confirmation, and background-job states.
- Commit topic tombstones only after backend success, fence pre-commit page loads at that boundary, and keep failure recovery visible.
- Extend the deterministic archive interleaving regression coverage.
Verification:
- pnpm exec tsx src/__tests__/project-tree-archive-race.test.ts
- pnpm exec tsx src/__tests__/project-tree-runtime.test.ts
- pnpm test:typecheck
- pnpm build
- pnpm test:remote
- cd desktop && go test -count=1 -run 'TestDeleteSessionCancelsActiveRuntime|TestDeleteSessionWithStuckJobReturnsAfterSingleGrace|TestTrashTopicRejectsRunningSessionRuntime|TestTrashTopicRejectsConcurrentTurnAdmissionWithoutWaiting' .
- go run ./tools/repolint
- git diff --check
Co-authored-by: Linearleaf <[email protected]>
* fix(serve): register remote model switch routes
Problem: remote session model and effort changes received HTTP 405 because the JSON endpoints were never registered.\n\nRoot cause: the branch added switch implementations and desktop callers but only kept the legacy slash-command interception inside POST /submit.\n\nFix: register POST /model and POST /effort, validate their JSON payloads, and distinguish busy transition conflicts from internal failures.\n\nVerification: go test ./internal/serve; targeted go test -race ./internal/serve; repository lint.
* fix(desktop): make remote tab activation transactional
Problem: switching from a local session to a remote tab could hide the local surface even when its current session failed to persist. Opening a remote project also mutated remote state before that safety barrier.
Root cause: remote activation bypassed the snapshot-before-switch contract used by local tabs, and local activation cleared the remote selection before the snapshot completed.
Fix: serialize the user-facing cross-registry activation paths, snapshot the current local session before remote activation, keep both registries unchanged on failure, and extract the selector from the oversized tabs file.
Verification: targeted desktop activation tests; targeted race tests; repolint; git diff --check.
* fix(frontend): preserve remote event mock fallback
Problem: browser tests and non-Wails previews can expose a partial runtime object without the generated Go application binding.
Root cause: the extracted remote event bridge treated window.runtime alone as proof that the native event API was usable.
Fix: require both the generated App binding and the Wails runtime before using native events, matching the original bridge guard and retaining the mock listener fallback.
Verification: frontend typecheck; remote frontend test suite.
* fix(desktop): enforce opaque operational theme surfaces
Problem:
Operational popovers such as Background jobs could become fully transparent, while undefined legacy theme variables also removed muted text, hover, border, and shadow styling.
Root cause:
Amber did not inherit a complete semantic surface contract, and operational overlays consumed translucent panel recipes without distinguishing ordinary themes from background-image theme packs.
Fix:
Define and enforce the semantic token contract, replace undefined legacy aliases, derive one overlay surface recipe from theme-pack pane opacity, and cover built-in themes plus portal overlays in a real browser. Keep Remote Connect Wizard CSS in its lazy production entry and align async test fixtures with the current HistorySlice contract.
Capacity:
The raw initial asset budget rises by 1.3 KiB (0.055%) for 1.09 KiB of attributable CSS; the existing gzip CSS ceiling remains unchanged.
Verification:
- pnpm check:css
- pnpm test:theme-browser
- pnpm test
- pnpm build
- git diff --check
* test(frontend): follow windowed history contract
Problem: the Goal activation routing test reverted its optimistic tab switch because the test harness could no longer load conversation history.
Root cause: after syncing main-v2, useController hydrates through HistorySliceForTab while this PR-owned harness still mocked only the retired page API.
Fix: provide the shared windowed-history mock with the current request type.
Verification: isolated routing test passed five consecutive runs; frontend typecheck.
* test(frontend): track hydration-aware tail guard
Problem: the full frontend suite failed its footer-resize source contract after syncing current main-v2.
Root cause: production correctly suppresses tail following during history hydration, but the static contract still expected the pre-hydration guard and dependency list.
Fix: assert the current hydration-aware guard while preserving the original coalesced tail-follow requirement.
Verification: history load failure contract; Goal activation routing test; frontend typecheck.
* test(frontend): isolate remote suites in their loaders
Problem: the generic frontend runner re-executed remote suites that already belong to test:remote, and the connect wizard failed before assertions because plain Node cannot import its CSS module.
Root cause: the PR added the suites to the dedicated script without registering all of them in OWNED_ELSEWHERE.
Fix: assign every dedicated remote suite to test:remote, retaining its CSS and SVG loader contracts and avoiding duplicate coverage.
Verification: run-tests syntax check; full test:remote suite.
* test(frontend): follow recommended preset order
Problem:\nThe startup settings contract still required DeepSeek Responses to be the first browser mock rank even after main added the recommended OpenCode Go bundle ahead of it.\n\nRoot cause:\nThe source-shape assertion encoded the old first-rule layout instead of the current two-entry ordering contract.\n\nFix:\nAssert that the recommended bundle ranks first and DeepSeek Responses remains immediately behind it.\n\nVerification:\n- pnpm exec tsx src/__tests__/startup-settings-contract.test.ts\n- git diff --check
* fix(desktop): preserve overlay opacity across theme menus
Route the higher-specificity styled-theme menu rule through the shared operational overlay surface. Expand the browser contract from the jobs popover to every representative operational surface so future selector-specific overrides cannot silently bypass paneOpacity.
* test(frontend): preserve deferred history race
Problem:\nThe tab-switch hydration suite awaited switchTab before releasing the intentionally deferred target history, leaving the module with an unsettled top-level await.\n\nRoot cause:\nswitchTab now correctly resolves only after target history hydration, while the stale-history race fixture still used the older activation-only completion order.\n\nFix:\nWait for backend activation and the scoped new-session action first, switch back to the cached source tab, then release history and await the original switch promise.\n\nVerification:\n- pnpm exec tsx src/__tests__/tab-switch-hydration.test.tsx\n- git diff --check
* test(frontend): follow transactional switch rollback
Problem:\nThe session-rebind suite awaited a tab switch while its target history was intentionally deferred, and still expected the failed target to remain visible after the controller adopted transactional rollback.\n\nRoot cause:\nThe fixture predated switchTab's hydrate-before-complete contract and its safe rebind to the retained source session on history failure.\n\nFix:\nObserve the optimistic target while the switch promise is pending, release the failed history, assert backend and transcript rollback, then retry generation two before exercising the same-tab generation fence.\n\nVerification:\n- pnpm exec tsx src/__tests__/tab-switch-session-rebind.test.tsx\n- git diff --check
* Migrate crash samples to Firebase Spark storage
Problem:
Crash samples remain in D1 indefinitely and repeated automatic crashes can upload without a version-scoped client boundary.
Root cause:
The ingest protocol has no stable event identity or local deduplication ledger, and the Worker has no bounded, idempotent Firebase projection path.
Fix:
- add event IDs and version-scoped Desktop crash deduplication
- add a bounded D1 outbox, projection receipts, group leases, and OAuth-authenticated Realtime Database delivery
- preserve D1 aggregates with d1, dual, and firebase rollout modes plus additive migration tooling
Verification:
- npm run typecheck
- npm test
- go test ./...
- cd desktop && go test -race ./...
- go test -race ./internal/crashreport
- go run ./tools/repolint
* fix(desktop): satisfy cross-platform lint gates
Problem:\nThe exact-head CI failed desktop lint on Linux and macOS, plus the root cross-platform build-tag sweep.\n\nRoot cause:\nThe remote-session changes retained an unused pre-snapshot map value, used loops now covered by the slicescontains rule, and ignored an auxiliary preference write without marking it best-effort. Two inherited Unix tray cancellation tests also lacked cleanup on timeout paths.\n\nFix:\nNarrow the remote lookup, use slices.Contains, explicitly keep the last-workspace preference non-fatal after a successful attach, and defer both DBus context cancellations.\n\nVerification:\n- golangci-lint run --timeout=5m ./... (root and desktop)\n- GOOS=windows golangci-lint run --timeout=5m ./... (root and desktop)\n- cd desktop && go test ./...\n- cd desktop && go test -race ./ -run targeted remote/tab/DBus cancellation suite\n- git diff --check
* Fix crash pending schema compatibility
Problem:
Current schema-v3 Desktop diagnostics are retained as unknown instead of uploaded, queue pruning can delete newer-schema pending files, and test-only URL matching and goroutine patterns fail required CI gates.
Root cause:
The pending reader's supported version stopped at schema 2, queue pruning ignored schema ownership, and the tests used broad URL substring checks plus superseded concurrency idioms.
Fix:
- align the pending reader with current schema 3 producers
- preserve future-schema files while pruning only understood queue entries
- use exact OAuth URL checks and CI-compliant deterministic test helpers
Verification:
- focused Desktop pending compatibility tests
- npm run typecheck
- npm test
- golangci-lint run --timeout=5m --allow-parallel-runners
- go run ./tools/repolint
- go test ./...
- cd desktop && go test -race ./...
- go test -race ./internal/crashreport
* fix(desktop): redact remote reconnect errors
Problem: Remote serve reconnect failures could write provider credentials embedded in bootstrap errors to desktop logs.
Root cause: reattachRemoteTab logged the complete EnsureServer error even though remote process output can carry forwarded API keys.
Fix: retain structural reconnect diagnostics while omitting the error body, and add a regression test that injects a secret-bearing error and verifies it never reaches the log.
Verification: cd desktop && go test ./...; cd desktop && go test -race ./ -run TestRemoteTabReconnectDoesNotLogEnsureServerSecrets\|TestRemoteTabFollowsHostReconnect -count=1; cd desktop && golangci-lint run ./...; cd desktop && GOOS=windows golangci-lint run ./...; go run ./tools/repolint; git diff --check
* Refactor MCP sessions onto the official Go SDK
Problem:
Stateful Streamable HTTP servers could lose their pending session before Reasonix opened the listening stream, while the custom transport engine duplicated protocol correlation, cancellation, and recovery logic.
Root cause:
Reasonix initialized Streamable HTTP with POST requests only and maintained separate request loops for HTTP, SSE, and stdio. Session loss, concurrent rebuilds, pagination, cancellation, OAuth refresh, and cleanup therefore had inconsistent owners.
Fix:
Adopt modelcontextprotocol/go-sdk v1.7.0 for protocol sessions, add a generation-fenced session supervisor, preserve Reasonix transport security and stdio process isolation, and cover JetBrains activation, recovery, pagination, cancellation, OAuth, schema stability, and bounded close behavior.
Verification:
- go test ./internal/plugin -count=1
- go test -race ./internal/plugin -count=1
- go test ./...
- go vet ./internal/plugin
* Normalize MCP capability call arguments
Problem:
Models sometimes encode an MCP tool argument object as one JSON string, causing use_capability to fail before dispatch with a map unmarshal error.
Root cause:
The proxy forwarded arguments without normalizing the provider's single-layer string encoding, and missing arguments remained null instead of an empty MCP object.
Fix:
Normalize only mcp-tool call arguments before resolution and safety checks. Accept objects, one string-wrapped object, and empty/null values while rejecting arrays, scalars, malformed JSON, and nested strings.
Verification:
- go test ./internal/agent -count=1
- go test -race ./internal/agent/... -count=1
- git diff --check
* Expose MCP session diagnostics in local surfaces
Problem:
MCP failures appeared as generic connection errors, leaving users unable to distinguish listening setup, session expiry, authentication, reconnect progress, or terminal transport failure.
Root cause:
Runtime session state stayed inside the transport and the CLI and Wails contracts exposed only coarse server status.
Fix:
Add optional protocol, session-state, reconnect-count, and error-kind fields to local status surfaces, preserve old payload defaults, and render actionable local diagnostics without exposing session identifiers or credentials.
Verification:
- cd desktop && go test ./...
- cd desktop && go test -race ./...
- pnpm --dir desktop/frontend test:typecheck
- pnpm --dir desktop/frontend build
* Document supervised MCP session behavior
Problem:
The product specification still described Reasonix as owning MCP protocol framing and did not explain the new lifecycle, recovery, pagination, or redacted diagnostics contract.
Root cause:
The documentation reflected the removed custom JSON-RPC transport engine.
Fix:
Document the official SDK boundary, shared supervised sessions, Streamable HTTP listening and cleanup, pagination, notifications, replay policy, and backward-compatible local diagnostics in English and Chinese, with an Unreleased changelog entry.
Verification:
- go test ./...
- cd desktop && go test ./...
- git diff --check
* fix(desktop): harden remote session lifecycle
Problem:
Remote tabs could lose prompts or publish ready across dead streams, and remote UI controls did not preserve local lifecycle contracts.
Root cause:
Serve attachment, hydration, reconnect, and remote composer state were coordinated by independent optimistic paths without one generation/prompt fence.
Fix:
Fence event streams and reattach generations, replay pending prompts, preserve remote session/mode/title/tab identity contracts, and add regression coverage.
Verification:
- go test ./...
- cd desktop && go test ./...
- cd desktop && go test -race . -run 'TestRemoteTab|TestCloseActiveRemoteTab|TestStopRemoteServer' -count=1\n- cd desktop/frontend && pnpm test:all\n- cd desktop/frontend && pnpm build\n- go run ./tools/repolint
* fix(desktop): satisfy remote tab lint contracts
Problem:
The macOS desktop lint job rejected two new remote-tab constructs under the repository lint profile.
Root cause:
The reconnect loop used a classic integer loop and event dispatch used an if chain instead of the preferred tagged switch.
Fix:
Use Go integer range and a kind switch without changing lifecycle behavior.
Verification:
- cd desktop && golangci-lint run --timeout=5m
- cd desktop && go test ./...
- go run ./tools/repolint
- git diff --check
* fix(crash): bound Firebase Spark storage lifecycle
Problem: Firebase-primary crash storage had no code-level Spark capacity budget or lifecycle state, and stale group writers could race retention or administrative deletion.
Root cause: delivery used a compatibility lease row and whole-group REST updates without durable generations, per-path preconditions, or conservative reservations.
Fix: add additive group state, a fixed 700 MiB reservation budget, generation leases, ETag-fenced path writes, 30/60-day lifecycle processing, delayed tombstone deletion, dashboard state, and sentinel alerts while keeping d1 independent and the production default.
Verification: npm run typecheck; npm test; npx wrangler deploy --dry-run; go run ./tools/repolint; git diff --check.
* fix(crash): verify paged Firebase migration
Problem: the retained-sample migration loaded all history at once, had no durable resume point, and treated HTTP success as content verification.
Root cause: migration state, lifecycle classification, canonical digests, and Firebase readback were not modeled as an idempotent reconciliation process.
Fix: add 200-group keyset pages, a mode-0600 atomic checkpoint, dry-run capacity/content estimates, three-pass reconciliation, canonical SHA-256 readback, D1 state verification, lifecycle-aware imports, and bilingual rollout/rollback instructions.
Verification: npm run typecheck; npm test; git diff --check; migration unit tests cover active/compacted/archived classification, absolute ring counts, and canonical digests.
* test(desktop): close DBus cancellation contexts
Problem: two DBus cancellation tests leaked their contexts when a timeout or t.Fatal path exited before the explicit cancel call.
Root cause: cleanup depended only on the success-path cancellation point.
Fix: defer both cancel functions immediately after context creation while retaining the explicit cancellation that drives each test.
Verification: go test ./... in desktop; go test -race . -run 'Test(WritePending|FlushPending|ConcurrentFlush)' -count=1; go vet ./...; golangci-lint run --timeout=5m ./....
* Split MCP lifecycle code along owner boundaries
Problem:
The completed MCP session migration exceeded repository capacity limits in several long-lived owner files and tests.
Root cause:
SDK adapters, session diagnostics, argument normalization, and deterministic fixtures were initially colocated with broader product surfaces.
Fix:
Extract the new responsibilities into focused owner files, group capability and auxiliary refresh state by lifetime, and keep all runtime behavior and public contracts unchanged.
Verification:
go run ./tools/repolint
go test ./...
go test -race ./internal/agent/... ./internal/plugin/... ./internal/boot/...
cd desktop && go test -race ./...
pnpm --dir desktop/frontend test:all
pnpm --dir desktop/frontend build
* Harden MCP session failure and shutdown boundaries
Problem:
Sessionless HTTP 404 responses were treated as expired sessions, and a non-returning HTTP tool request could outlive bounded session shutdown.
Root cause:
The SDK uses ErrSessionMissing for every HTTP 404, while the supervisor did not require an established session ID. The SDK also detaches Streamable HTTP from the Connect context and waits for active calls before closing, so CloseIdleConnections could not force active requests to unwind.
Fix:
Classify a 404 without a session ID as a protocol error with no automatic rebuild. Bind active GET and POST requests to the Reasonix session lifetime, preserve the bounded DELETE cleanup path, and forward idle-connection cleanup through the protected round tripper.
Verification:
Added deterministic sessionless-404 and active-request shutdown regressions. Ran focused normal and race tests, the JetBrains standalone GET/DELETE regression, repolint, and diff checks.
* Fix MCP CI portability regressions
Problem:
The first PR matrix exposed lint regressions and an intermittent macOS startup diagnostic that could miss a short-lived stdio server's stderr.
Root cause:
Removed transport interfaces left dead test helpers, the roots compatibility path needed an explicit deprecation waiver, and startup read the stderr tail before bounded process shutdown had drained the copy goroutine.
Fix:
Remove obsolete helpers, satisfy the repository's current lint rules while documenting the legacy roots requirement, and close/reap a failed endpoint before capturing its stderr tail.
Verification:
- golangci-lint run --timeout=5m
- go test ./internal/plugin -run '^TestStdioFailureCapturesStderr$' -count=20
- go test -race ./internal/plugin -run 'Test(StdioFailureCapturesStderr|HTTPTransportCloseCancelsActiveRequest|HTTPTransportEstablishedSessionless404DoesNotRebuild)$' -count=1
- go test ./internal/plugin ./internal/agent -count=1
- go vet ./internal/plugin ./internal/agent
- go run ./tools/repolint
* fix(desktop): complete remote session controls
* fix(serve): canonicalize remote model selections
* fix(crash): reconcile partial diagnostics schema
Problem: Crash worker deployments have been blocked since diagnostics-v2 left both metric-user tables without their attribution columns.
Root cause: The migration correctly failed closed for every partial schema, but had no bounded recovery path for the one verified production state or an interrupted recovery.
Fix: Recognize only the known 24-column drift and its retry subsets, record a fresh Time Travel bookmark, apply each additive column independently, verify the final schema, and keep unknown partial states fail closed.
Verification: npm run typecheck; npm test (109 tests); go run ./tools/repolint; git diff --check.
* fix(crash): stop requiring retired metric tables
Problem: The crash-worker deploy still fails before Firebase migration because diagnostics-v2 attempts to alter metric_users, which production intentionally dropped.
Root cause: The schema inspector treated the retired metric_users and cli_metric_users tables as required, so their absence looked like 24 missing columns.
Fix: Remove both retired tables from the diagnostics contract and additive migration, delete the invalid reconciliation path, preserve fail-closed handling for active schema drift, and document the retirement.
Verification: npm run typecheck; npm test (107 tests); go run ./tools/repolint; git diff --check.
* fix(desktop): harden remote session lifecycle
* fix(desktop): complete remote runtime parity
* fix(desktop): close remote session review gaps
* fix(desktop): close remaining remote surface gaps
* fix(ci): clear remote surface approval gates
* chore(deps): bump github.com/gorilla/websocket to 1.5.3 (#9382)
Update github.com/gorilla/websocket from v1.5.0 to v1.5.3 to fix GO-2026-6278.
* ci(crash): gate Firebase history migration (#9418)
Add a canary-approved Actions path for Firebase crash history dry-run, apply, and verify-only operations. Keep data migration separate from Worker deployment, require the existing Cloudflare and Firebase secrets, and preserve the production d1 storage mode until an explicit operator dispatch.
* fix(crash): bound Firebase migration output capture (#9424)
Problem:
The protected Firebase history dry-run failed before capacity analysis because Wrangler's retained-report JSON exceeded Node's default synchronous child-process buffer.
Root cause:
The migration captured a page of up to 200 groups and six 96 KiB retained reports per group without setting spawnSync.maxBuffer.
Fix:
Use a 192 MiB hard limit that covers the 112.5 MiB raw page plus JSON envelope and escaping headroom, and lock the bound into the migration contract test and declaration file.
Verification:
- npm run typecheck
- npm test (13 files, 111 tests)
- go run ./tools/repolint
- git diff --check
* fix(catalog): publish recovery projections atomically / 原子发布恢复会话投影 (#9421)
* fix(catalog): publish recovery projections atomically
Problem: exact path refreshes and batched directory scans could expose a temporary recovery-session projection, making sidebar rows disappear and return.
Root cause: single-file indexing owned sibling-derived recovery fields, while reconcile committed each 64-row batch independently.
Fix: separate exact-source and directory-projection ownership, preserve derived SQL columns, queue dirty recovery directories, and publish each full directory projection in one transaction.
Verification: go test ./...; go test -race ./internal/sessioncatalog; desktop go test ./...; deterministic rollback/interleaving/65-row tests; 10k reconcile benchmark.
* Fix repair projection ownership
Problem: asynchronous count repair could rewrite recovery projection fields and publish a partial topic snapshot before directory reconciliation.
Root cause: repair updated recovery_copy and topic aggregates outside the directory lock, so it could interleave with a parsed reconcile snapshot.
Fix: serialize repair with the directory lock, update only source-owned fields, preserve repaired source state across legacy sidecars, and leave projection publication to one directory transaction. Extract upsert and repair ownership into focused files to satisfy repository size gates.
Verification: go test ./...; go test -race ./internal/sessioncatalog; go vet ./internal/sessioncatalog; go run ./tools/repolint; BenchmarkReconcileDirectory10K (3x, 2.74s/op).
* Remove superseded catalog projection paths
Problem: the atomic directory projection refactor left two unused pre-transaction helpers, causing golangci-lint to block PR #9421.\n\nRoot cause: ReconcileDirectory now owns the complete projection transaction, but the old partial lineage and no-notification upsert entry points remained compiled.\n\nFix: remove the unreachable helpers and imports so there is only one directory publication path.\n\nVerification: go test ./internal/sessioncatalog; go vet ./internal/sessioncatalog; git diff --check.
* fix(desktop): commit session navigation after target paint / 会话导航在目标绘制后提交 (#9422)
* fix(desktop): commit transcript navigation after paint
Problem: session navigation exposed empty/intermediate transcript states, changed viewport geometry, and could cascade older-history loads before the target surface settled.
Root cause: navigation settled on RPC completion, source state was pruned early, startReached had no user permit, and layout growth lacked mutation ownership.
Fix: retain and mask the source surface through data and paint readiness, defer single-surface pruning, restore failed sources, gate pagination by trigger, preserve composer geometry, and diagnose invalid ordering.
Verification: pnpm test:typecheck; pnpm test:transcript; all 225 frontend suites; single-scroll-writer check; deterministic A-B-C, failure restore, pagination, and paint terminal tests.
* fix(desktop): commit transcript navigation surfaces atomically
Problem: session switches could expose empty or unsettled target history, collapse footer geometry, and cascade older-history loads before user intent.
Root cause: navigation completion was tied to request return rather than authoritative history plus stable paint, while startReached had no single-use viewport permit and stale completions could clean up newer surfaces.
Fix: retain the source surface behind an opaque mask, gate commit on intent-scoped history and two stable geometry frames, restore the source on failures, authorize viewport paging per gesture, and classify history mutations and diagnostics.
Verification: pnpm test (225 suites), pnpm test:typecheck, pnpm build, pnpm test:transcript-browser, desktop go test ./..., single-scroll-writer check, repolint, and diff check.
* test(desktop): stabilize native thumb replay
* test(desktop): preserve native thumb ownership
* test(desktop): discover native thumb hitbox
* test(desktop): exercise native thumb in headed Linux
* fix(desktop): freeze measured row during thumb drag
* fix(crash): explain Firebase capacity reservations (#9425)
Problem:
The protected migration dry-run reported 948 active groups and 84.6% reserved capacity without explaining which lifecycle rules kept those groups active.
Root cause:
The dry-run only aggregated final active, compacted, and archived classifications, so operators could not distinguish recent resolved groups from stale open groups that require manual triage.
Fix:
Add a count-only status and last-seen assessment, cross-check it against lifecycle classification, report manual-review candidates and theoretical reservation reduction, and emit the 80% capacity warning. Fingerprints and crash fields are intentionally excluded.
Verification:
- npm run typecheck
- npm test (13 files, 112 tests)
- go run ./tools/repolint
- git diff --check
* feat(runtime): make turns durable, ordered, and interrupt-safe (#9409)
* feat(runtime): add structured turn protocol and ledger
Problem: Turn completion was inferred from provider text, so EOF, interruption, and protocol failures could collapse into the same successful outcome without a durable lifecycle record.
Root cause: The transcript doubled as runtime truth and there was no stable turn identity, monotonic event envelope, exactly-once terminal commit, or explicit provider finalization contract.
Fix: Add the queued-to-terminal TurnStatus model, append-only .turns.jsonl ledger with torn-tail quarantine and terminal fsync, and a stable host-consumed finish tool with one bounded repair round.
Verification: Covered by focused agent, boot, control, event wire, store, and turnevent tests plus the root Go suite.
* feat(runtime): route cancellation and prompts by turn
Problem: Stop and prompt answers could be routed through whichever tab was currently active, allowing tab switches and overlapping completions to affect the wrong turn or leave work running.
Root cause: Desktop admission and Wails entry points did not carry a stable turn ID through start, interrupt, prompt answer, and replay operations.
Fix: Add turn-scoped StartTurnForTab, InterruptTurnForTab, AnswerPromptForTab, and TurnEventsForTab contracts; bind cancellation and prompt ownership to the exact session/turn; and keep one foreground turn per session while preserving cross-session concurrency.
Verification: Covered by deterministic control and desktop runtime tests, full root and desktop suites, and race tests for agent/control/turnevent.
* fix(frontend): project ordered turn events without rollback
Problem: A late cancellation reload could replace the full transcript and erase a newer retry, while asynchronous Markdown finalization could move a reader back toward the tail.
Root cause: The frontend reconciled cancellation with history replacement instead of an ordered turn projection, and a fresh history fallback could be swapped for a tail-only block window while the user was reading above the bottom.
Fix: Project events idempotently by runtime epoch and sequence, replay gaps from the ledger, reject stale revisions, patch only the affected turn, preserve pending-only height estimates, and defer the Markdown fallback-to-block swap until the reader returns to the bottom.
Verification: Covered by deterministic controller ordering tests, Markdown history handoff tests, the transcript suite, frontend typecheck/build budgets, and native Windows WebView2 Stop/Ask/parallel/scroll smoke.
Co-authored-by: Linearleaf <[email protected]>
* test(runtime): update compatibility and cache fixtures
Problem: The new lifecycle sidecar, Wails arrays, provider-visible finish schema, and Windows smoke cleanup needed explicit cross-version and deterministic serialization guards.
Root cause: Existing fixtures described the legacy tool prefix and did not exercise empty-array bridge encoding, old-session bootstrap, torn-tail recovery, or PowerShell 5.1 cleanup beyond MAX_PATH.
Fix: Update bilingual tool-contract documentation and golden provider fixtures, add compatibility/cache/recovery tests, and make the native WebView2 smoke cleanup use extended-length .NET paths with a deterministic long-path self-test.
Verification: go test ./..., go test -race ./internal/agent ./internal/control ./internal/turnevent, desktop go test ./..., frontend build and transcript tests, and Windows 11 ARM64 native smoke all pass.
* perf(runtime): bound turn ledger writes and retention
Problem: the turn ledger opened the sidecar for every event and retained an unbounded event history, while prompt and tool side effects could not observe persistence failures.
Root cause: stream coalescing happened downstream from persistence, the ledger had no persistent turn writer or checkpoint format, and prompt resolution removed waiters before durable acknowledgement.
Fix: move the single coalescer before the ledger, add checked side-effect barriers, reuse one WAL handle per turn, add schema-v2 checkpoints and projection acknowledgements, make Ask and approval resolution transactional, and expose content-free metrics and capacity benchmarks.
Verification: go test ./...; go test -race ./internal/agent ./internal/control ./internal/turnevent ./internal/event; cd desktop && go test ./...
* fix(frontend): recover compacted turn-event gaps
Problem: a frontend cursor that falls behind a compacted ledger cannot distinguish retention from packet loss, and a full transcript reload can erase an active or optimistic tail.
Root cause: the replay API returned only an array and the reducer had no explicit persisted-prefix boundary or runtime-epoch transaction.
Fix: return paged replay metadata with reset fencing, queue live events during repair, rebase only the persisted history prefix with stable identities, and retain active turns, optimistic users, and live assistant output.
Verification: frontend typecheck, pnpm test:transcript, replay-reset and cancel-reconcile tests, pnpm build, and desktop go test ./...
* chore(lint): refresh turn-runtime quality baselines
Problem: the repository lint gate still compared the expanded runtime ledger and replay owners against the pre-performance exact baselines.
Fix: tighten new comments to the essay limits and refresh the mechanical per-file and repository totals after the two functional commits. This changes no runtime behavior.
Verification: go run ./tools/repolint; go test ./internal/boot ./internal/control ./internal/turnevent; cd desktop && go test . -run TestTurnRuntimeAPIRoutesStopAnswerAndReplayByExactTurn -count=1
* fix(runtime): preserve ledger storage failures
* chore(lint): align baseline with main-v2
* chore(runtime): satisfy ledger lint contracts
* chore(lint): align merged transcript baseline
Problem: the merged tree exceeded the test-file baseline by one line.
Root cause: main-v2 added one navigation hydration assertion after the turn-runtime branch recorded its own test baseline.
Fix: carry the exact combined per-file and repository totals without changing production code.
Verification: go run ./tools/repolint reports a clean baseline.
---------
Co-authored-by: Linearleaf <[email protected]>
* fix(desktop): finish remote session approval parity
* refactor(remote): satisfy repository ownership gates
* fix(remote): close approval review gaps
* fix(remote): resolve final approval races
* fix(remote): close remaining session surface gaps
* fix(remote): close remaining session parity review gaps
* fix(frontend): retain generated remote binding parity
* fix(remote): recover remaining runtime parity gaps
* feat(remote): complete multi-session serve integration
Preserve active remote turns across session switches, route tagged events to the owning tab, and expose exact session paths to the desktop tree. Add gzip snapshot transport, capability-gated remote bootstrap, and credential-channel watchdog recovery. Update Remote SSH documentation and cover the integration with Go, race, and frontend tests.
* refactor(remote): satisfy repository structure gates
* fix(remote): close multi-session lifecycle races
* fix(remote): preserve foreground session routing
Problem:\nServe and Desktop could lose the foreground session identity when controllers detached, recovered, or rotated through slash commands. Replay and status requests could also mix controller generations, and background runtime work was underreported.\n\nRoot cause:\nController ownership callbacks were rebound to keeper-only handlers, status and replay sampled the mutable controller repeatedly, and the Desktop did not reconcile a recovered foreground path before routing tagged frames.\n\nFix:\nCarry the Serve ownership binder across keeper transfers, use single controller snapshots, refresh transition tags and broadcaster routing, expose the authoritative session path, and reconcile unknown foreground frame paths from status.\n\nVerification:\ngo run ./tools/repolint\ngo test ./...\ngo vet ./...\n(cd desktop && go test ./...)\n(cd desktop && go vet ./...)\ntargeted go test -race for control, Serve, and Desktop multi-session paths\ngit diff --check
* fix(remote): close final session routing gaps
* fix(remote): close remaining serve lifecycle races
* test(cli): close queued-paste controller
* fix(remote): close final multi-session routing gaps
* fix(remote): fence recovery lifecycle races
* fix(remote): close final multisession lifecycle gaps
* fix(remote): heal all tracked proxy workspaces
* fix(remote): harden multisession ownership handoff
* fix(remote): close remaining multisession races
* test(serve): make rotation lock probe observable
* fix(remote): close session handoff races
* test(remote): use test-scoped attach context
* fix(remote): isolate session adoption state
* fix(serve): preserve committed session routing
* test(serve): exercise real silent rotations
* fix(remote): preserve listing adoption and reload budgets
* test(remote): await emitted ready state
* fix(remote): fence session rehydration
* fix(remote): harden process and session handoff
* fix(remote): fence cross-session ownership
* fix(remote): preserve resume lifecycle events
* fix(remote): reconcile resume ownership and routing
* fix(remote): preserve lifecycle work under load
* fix(remote): commit session routing before replay
* fix(remote): serialize session route publication
* fix(remote): order status route adoption
* fix(remote): order resume reconciliation
* test(remote): assert adopted status route
* fix(remote): reject stale resume reconciliation
* fix(remote): fence foreground session mutations
* fix(remote): close remaining session transition races
* fix(remote): fence recovery and attach publication
* fix(remote): reconcile terminal routing races
* fix(remote): refresh recovered terminal listings
---------
Co-authored-by: Xingbo Zhao <[email protected]>
Co-authored-by: Linearleaf <[email protected]>
Co-authored-by: SivanCola <[email protected]>
Co-authored-by: hanswu <[email protected]>
Co-authored-by: SivanCola <[email protected]>
Co-authored-by: zhongerdeajie <[email protected]>
Co-authored-by: YHH <[email protected]>
Co-authored-by: yuhuping <[email protected]>
Co-authored-by: poorpaper <[email protected]>
Co-authored-by: SivanCola <[email protected]>
Co-authored-by: Hardik Shingala <[email protected]>
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
Co-authored-by: zcxads666 <[email protected]>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Linearleaf <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* feat(runtime): add structured turn protocol and ledger
Problem: Turn completion was inferred from provider text, so EOF, interruption, and protocol failures could collapse into the same successful outcome without a durable lifecycle record.
Root cause: The transcript doubled as runtime truth and there was no stable turn identity, monotonic event envelope, exactly-once terminal commit, or explicit provider finalization contract.
Fix: Add the queued-to-terminal TurnStatus model, append-only .turns.jsonl ledger with torn-tail quarantine and terminal fsync, and a stable host-consumed finish tool with one bounded repair round.
Verification: Covered by focused agent, boot, control, event wire, store, and turnevent tests plus the root Go suite.
* feat(runtime): route cancellation and prompts by turn
Problem: Stop and prompt answers could be routed through whichever tab was currently active, allowing tab switches and overlapping completions to affect the wrong turn or leave work running.
Root cause: Desktop admission and Wails entry points did not carry a stable turn ID through start, interrupt, prompt answer, and replay operations.
Fix: Add turn-scoped StartTurnForTab, InterruptTurnForTab, AnswerPromptForTab, and TurnEventsForTab contracts; bind cancellation and prompt ownership to the exact session/turn; and keep one foreground turn per session while preserving cross-session concurrency.
Verification: Covered by deterministic control and desktop runtime tests, full root and desktop suites, and race tests for agent/control/turnevent.
* fix(frontend): project ordered turn events without rollback
Problem: A late cancellation reload could replace the full transcript and erase a newer retry, while asynchronous Markdown finalization could move a reader back toward the tail.
Root cause: The frontend reconciled cancellation with history replacement instead of an ordered turn projection, and a fresh history fallback could be swapped for a tail-only block window while the user was reading above the bottom.
Fix: Project events idempotently by runtime epoch and sequence, replay gaps from the ledger, reject stale revisions, patch only the affected turn, preserve pending-only height estimates, and defer the Markdown fallback-to-block swap until the reader returns to the bottom.
Verification: Covered by deterministic controller ordering tests, Markdown history handoff tests, the transcript suite, frontend typecheck/build budgets, and native Windows WebView2 Stop/Ask/parallel/scroll smoke.
Co-authored-by: Linearleaf <[email protected]>
* test(runtime): update compatibility and cache fixtures
Problem: The new lifecycle sidecar, Wails arrays, provider-visible finish schema, and Windows smoke cleanup needed explicit cross-version and deterministic serialization guards.
Root cause: Existing fixtures described the legacy tool prefix and did not exercise empty-array bridge encoding, old-session bootstrap, torn-tail recovery, or PowerShell 5.1 cleanup beyond MAX_PATH.
Fix: Update bilingual tool-contract documentation and golden provider fixtures, add compatibility/cache/recovery tests, and make the native WebView2 smoke cleanup use extended-length .NET paths with a deterministic long-path self-test.
Verification: go test ./..., go test -race ./internal/agent ./internal/control ./internal/turnevent, desktop go test ./..., frontend build and transcript tests, and Windows 11 ARM64 native smoke all pass.
* perf(runtime): bound turn ledger writes and retention
Problem: the turn ledger opened the sidecar for every event and retained an unbounded event history, while prompt and tool side effects could not observe persistence failures.
Root cause: stream coalescing happened downstream from persistence, the ledger had no persistent turn writer or checkpoint format, and prompt resolution removed waiters before durable acknowledgement.
Fix: move the single coalescer before the ledger, add checked side-effect barriers, reuse one WAL handle per turn, add schema-v2 checkpoints and projection acknowledgements, make Ask and approval resolution transactional, and expose content-free metrics and capacity benchmarks.
Verification: go test ./...; go test -race ./internal/agent ./internal/control ./internal/turnevent ./internal/event; cd desktop && go test ./...
* fix(frontend): recover compacted turn-event gaps
Problem: a frontend cursor that falls behind a compacted ledger cannot distinguish retention from packet loss, and a full transcript reload can erase an active or optimistic tail.
Root cause: the replay API returned only an array and the reducer had no explicit persisted-prefix boundary or runtime-epoch transaction.
Fix: return paged replay metadata with reset fencing, queue live events during repair, rebase only the persisted history prefix with stable identities, and retain active turns, optimistic users, and live assistant output.
Verification: frontend typecheck, pnpm test:transcript, replay-reset and cancel-reconcile tests, pnpm build, and desktop go test ./...
* chore(lint): refresh turn-runtime quality baselines
Problem: the repository lint gate still compared the expanded runtime ledger and replay owners against the pre-performance exact baselines.
Fix: tighten new comments to the essay limits and refresh the mechanical per-file and repository totals after the two functional commits. This changes no runtime behavior.
Verification: go run ./tools/repolint; go test ./internal/boot ./internal/control ./internal/turnevent; cd desktop && go test . -run TestTurnRuntimeAPIRoutesStopAnswerAndReplayByExactTurn -count=1
* fix(runtime): preserve ledger storage failures
* chore(lint): align baseline with main-v2
* chore(runtime): satisfy ledger lint contracts
* chore(lint): align merged transcript baseline
Problem: the merged tree exceeded the test-file baseline by one line.
Root cause: main-v2 added one navigation hydration assertion after the turn-runtime branch recorded its own test baseline.
Fix: carry the exact combined per-file and repository totals without changing production code.
Verification: go run ./tools/repolint reports a clean baseline.
---------
Co-authored-by: Linearleaf <[email protected]>
Problem:
The protected migration dry-run reported 948 active groups and 84.6% reserved capacity without explaining which lifecycle rules kept those groups active.
Root cause:
The dry-run only aggregated final active, compacted, and archived classifications, so operators could not distinguish recent resolved groups from stale open groups that require manual triage.
Fix:
Add a count-only status and last-seen assessment, cross-check it against lifecycle classification, report manual-review candidates and theoretical reservation reduction, and emit the 80% capacity warning. Fingerprints and crash fields are intentionally excluded.
Verification:
- npm run typecheck
- npm test (13 files, 112 tests)
- go run ./tools/repolint
- git diff --check
* fix(desktop): commit transcript navigation after paint
Problem: session navigation exposed empty/intermediate transcript states, changed viewport geometry, and could cascade older-history loads before the target surface settled.
Root cause: navigation settled on RPC completion, source state was pruned early, startReached had no user permit, and layout growth lacked mutation ownership.
Fix: retain and mask the source surface through data and paint readiness, defer single-surface pruning, restore failed sources, gate pagination by trigger, preserve composer geometry, and diagnose invalid ordering.
Verification: pnpm test:typecheck; pnpm test:transcript; all 225 frontend suites; single-scroll-writer check; deterministic A-B-C, failure restore, pagination, and paint terminal tests.
* fix(desktop): commit transcript navigation surfaces atomically
Problem: session switches could expose empty or unsettled target history, collapse footer geometry, and cascade older-history loads before user intent.
Root cause: navigation completion was tied to request return rather than authoritative history plus stable paint, while startReached had no single-use viewport permit and stale completions could clean up newer surfaces.
Fix: retain the source surface behind an opaque mask, gate commit on intent-scoped history and two stable geometry frames, restore the source on failures, authorize viewport paging per gesture, and classify history mutations and diagnostics.
Verification: pnpm test (225 suites), pnpm test:typecheck, pnpm build, pnpm test:transcript-browser, desktop go test ./..., single-scroll-writer check, repolint, and diff check.
* test(desktop): stabilize native thumb replay
* test(desktop): preserve native thumb ownership
* test(desktop): discover native thumb hitbox
* test(desktop): exercise native thumb in headed Linux
* fix(desktop): freeze measured row during thumb drag
* fix(catalog): publish recovery projections atomically
Problem: exact path refreshes and batched directory scans could expose a temporary recovery-session projection, making sidebar rows disappear and return.
Root cause: single-file indexing owned sibling-derived recovery fields, while reconcile committed each 64-row batch independently.
Fix: separate exact-source and directory-projection ownership, preserve derived SQL columns, queue dirty recovery directories, and publish each full directory projection in one transaction.
Verification: go test ./...; go test -race ./internal/sessioncatalog; desktop go test ./...; deterministic rollback/interleaving/65-row tests; 10k reconcile benchmark.
* Fix repair projection ownership
Problem: asynchronous count repair could rewrite recovery projection fields and publish a partial topic snapshot before directory reconciliation.
Root cause: repair updated recovery_copy and topic aggregates outside the directory lock, so it could interleave with a parsed reconcile snapshot.
Fix: serialize repair with the directory lock, update only source-owned fields, preserve repaired source state across legacy sidecars, and leave projection publication to one directory transaction. Extract upsert and repair ownership into focused files to satisfy repository size gates.
Verification: go test ./...; go test -race ./internal/sessioncatalog; go vet ./internal/sessioncatalog; go run ./tools/repolint; BenchmarkReconcileDirectory10K (3x, 2.74s/op).
* Remove superseded catalog projection paths
Problem: the atomic directory projection refactor left two unused pre-transaction helpers, causing golangci-lint to block PR #9421.\n\nRoot cause: ReconcileDirectory now owns the complete projection transaction, but the old partial lineage and no-notification upsert entry points remained compiled.\n\nFix: remove the unreachable helpers and imports so there is only one directory publication path.\n\nVerification: go test ./internal/sessioncatalog; go vet ./internal/sessioncatalog; git diff --check.
Problem:
The protected Firebase history dry-run failed before capacity analysis because Wrangler's retained-report JSON exceeded Node's default synchronous child-process buffer.
Root cause:
The migration captured a page of up to 200 groups and six 96 KiB retained reports per group without setting spawnSync.maxBuffer.
Fix:
Use a 192 MiB hard limit that covers the 112.5 MiB raw page plus JSON envelope and escaping headroom, and lock the bound into the migration contract test and declaration file.
Verification:
- npm run typecheck
- npm test (13 files, 111 tests)
- go run ./tools/repolint
- git diff --check
Add a canary-approved Actions path for Firebase crash history dry-run, apply, and verify-only operations. Keep data migration separate from Worker deployment, require the existing Cloudflare and Firebase secrets, and preserve the production d1 storage mode until an explicit operator dispatch.
Problem: The crash-worker deploy still fails before Firebase migration because diagnostics-v2 attempts to alter metric_users, which production intentionally dropped.
Root cause: The schema inspector treated the retired metric_users and cli_metric_users tables as required, so their absence looked like 24 missing columns.
Fix: Remove both retired tables from the diagnostics contract and additive migration, delete the invalid reconciliation path, preserve fail-closed handling for active schema drift, and document the retirement.
Verification: npm run typecheck; npm test (107 tests); go run ./tools/repolint; git diff --check.
Problem: Crash worker deployments have been blocked since diagnostics-v2 left both metric-user tables without their attribution columns.
Root cause: The migration correctly failed closed for every partial schema, but had no bounded recovery path for the one verified production state or an interrupted recovery.
Fix: Recognize only the known 24-column drift and its retry subsets, record a fresh Time Travel bookmark, apply each additive column independently, verify the final schema, and keep unknown partial states fail closed.
Verification: npm run typecheck; npm test (109 tests); go run ./tools/repolint; git diff --check.
Problem:
The first PR matrix exposed lint regressions and an intermittent macOS startup diagnostic that could miss a short-lived stdio server's stderr.
Root cause:
Removed transport interfaces left dead test helpers, the roots compatibility path needed an explicit deprecation waiver, and startup read the stderr tail before bounded process shutdown had drained the copy goroutine.
Fix:
Remove obsolete helpers, satisfy the repository's current lint rules while documenting the legacy roots requirement, and close/reap a failed endpoint before capturing its stderr tail.
Verification:
- golangci-lint run --timeout=5m
- go test ./internal/plugin -run '^TestStdioFailureCapturesStderr$' -count=20
- go test -race ./internal/plugin -run 'Test(StdioFailureCapturesStderr|HTTPTransportCloseCancelsActiveRequest|HTTPTransportEstablishedSessionless404DoesNotRebuild)$' -count=1
- go test ./internal/plugin ./internal/agent -count=1
- go vet ./internal/plugin ./internal/agent
- go run ./tools/repolint
Problem:
Sessionless HTTP 404 responses were treated as expired sessions, and a non-returning HTTP tool request could outlive bounded session shutdown.
Root cause:
The SDK uses ErrSessionMissing for every HTTP 404, while the supervisor did not require an established session ID. The SDK also detaches Streamable HTTP from the Connect context and waits for active calls before closing, so CloseIdleConnections could not force active requests to unwind.
Fix:
Classify a 404 without a session ID as a protocol error with no automatic rebuild. Bind active GET and POST requests to the Reasonix session lifetime, preserve the bounded DELETE cleanup path, and forward idle-connection cleanup through the protected round tripper.
Verification:
Added deterministic sessionless-404 and active-request shutdown regressions. Ran focused normal and race tests, the JetBrains standalone GET/DELETE regression, repolint, and diff checks.
Problem:
The completed MCP session migration exceeded repository capacity limits in several long-lived owner files and tests.
Root cause:
SDK adapters, session diagnostics, argument normalization, and deterministic fixtures were initially colocated with broader product surfaces.
Fix:
Extract the new responsibilities into focused owner files, group capability and auxiliary refresh state by lifetime, and keep all runtime behavior and public contracts unchanged.
Verification:
go run ./tools/repolint
go test ./...
go test -race ./internal/agent/... ./internal/plugin/... ./internal/boot/...
cd desktop && go test -race ./...
pnpm --dir desktop/frontend test:all
pnpm --dir desktop/frontend build
Problem: two DBus cancellation tests leaked their contexts when a timeout or t.Fatal path exited before the explicit cancel call.
Root cause: cleanup depended only on the success-path cancellation point.
Fix: defer both cancel functions immediately after context creation while retaining the explicit cancellation that drives each test.
Verification: go test ./... in desktop; go test -race . -run 'Test(WritePending|FlushPending|ConcurrentFlush)' -count=1; go vet ./...; golangci-lint run --timeout=5m ./....
Problem: the retained-sample migration loaded all history at once, had no durable resume point, and treated HTTP success as content verification.
Root cause: migration state, lifecycle classification, canonical digests, and Firebase readback were not modeled as an idempotent reconciliation process.
Fix: add 200-group keyset pages, a mode-0600 atomic checkpoint, dry-run capacity/content estimates, three-pass reconciliation, canonical SHA-256 readback, D1 state verification, lifecycle-aware imports, and bilingual rollout/rollback instructions.
Verification: npm run typecheck; npm test; git diff --check; migration unit tests cover active/compacted/archived classification, absolute ring counts, and canonical digests.
Problem: Firebase-primary crash storage had no code-level Spark capacity budget or lifecycle state, and stale group writers could race retention or administrative deletion.
Root cause: delivery used a compatibility lease row and whole-group REST updates without durable generations, per-path preconditions, or conservative reservations.
Fix: add additive group state, a fixed 700 MiB reservation budget, generation leases, ETag-fenced path writes, 30/60-day lifecycle processing, delayed tombstone deletion, dashboard state, and sentinel alerts while keeping d1 independent and the production default.
Verification: npm run typecheck; npm test; npx wrangler deploy --dry-run; go run ./tools/repolint; git diff --check.
Problem:
The macOS desktop lint job rejected two new remote-tab constructs under the repository lint profile.
Root cause:
The reconnect loop used a classic integer loop and event dispatch used an if chain instead of the preferred tagged switch.
Fix:
Use Go integer range and a kind switch without changing lifecycle behavior.
Verification:
- cd desktop && golangci-lint run --timeout=5m
- cd desktop && go test ./...
- go run ./tools/repolint
- git diff --check
Problem:
Remote tabs could lose prompts or publish ready across dead streams, and remote UI controls did not preserve local lifecycle contracts.
Root cause:
Serve attachment, hydration, reconnect, and remote composer state were coordinated by independent optimistic paths without one generation/prompt fence.
Fix:
Fence event streams and reattach generations, replay pending prompts, preserve remote session/mode/title/tab identity contracts, and add regression coverage.
Verification:
- go test ./...
- cd desktop && go test ./...
- cd desktop && go test -race . -run 'TestRemoteTab|TestCloseActiveRemoteTab|TestStopRemoteServer' -count=1\n- cd desktop/frontend && pnpm test:all\n- cd desktop/frontend && pnpm build\n- go run ./tools/repolint
Problem:
The product specification still described Reasonix as owning MCP protocol framing and did not explain the new lifecycle, recovery, pagination, or redacted diagnostics contract.
Root cause:
The documentation reflected the removed custom JSON-RPC transport engine.
Fix:
Document the official SDK boundary, shared supervised sessions, Streamable HTTP listening and cleanup, pagination, notifications, replay policy, and backward-compatible local diagnostics in English and Chinese, with an Unreleased changelog entry.
Verification:
- go test ./...
- cd desktop && go test ./...
- git diff --check
Problem:
MCP failures appeared as generic connection errors, leaving users unable to distinguish listening setup, session expiry, authentication, reconnect progress, or terminal transport failure.
Root cause:
Runtime session state stayed inside the transport and the CLI and Wails contracts exposed only coarse server status.
Fix:
Add optional protocol, session-state, reconnect-count, and error-kind fields to local status surfaces, preserve old payload defaults, and render actionable local diagnostics without exposing session identifiers or credentials.
Verification:
- cd desktop && go test ./...
- cd desktop && go test -race ./...
- pnpm --dir desktop/frontend test:typecheck
- pnpm --dir desktop/frontend build
Problem:
Models sometimes encode an MCP tool argument object as one JSON string, causing use_capability to fail before dispatch with a map unmarshal error.
Root cause:
The proxy forwarded arguments without normalizing the provider's single-layer string encoding, and missing arguments remained null instead of an empty MCP object.
Fix:
Normalize only mcp-tool call arguments before resolution and safety checks. Accept objects, one string-wrapped object, and empty/null values while rejecting arrays, scalars, malformed JSON, and nested strings.
Verification:
- go test ./internal/agent -count=1
- go test -race ./internal/agent/... -count=1
- git diff --check
Problem:
Stateful Streamable HTTP servers could lose their pending session before Reasonix opened the listening stream, while the custom transport engine duplicated protocol correlation, cancellation, and recovery logic.
Root cause:
Reasonix initialized Streamable HTTP with POST requests only and maintained separate request loops for HTTP, SSE, and stdio. Session loss, concurrent rebuilds, pagination, cancellation, OAuth refresh, and cleanup therefore had inconsistent owners.
Fix:
Adopt modelcontextprotocol/go-sdk v1.7.0 for protocol sessions, add a generation-fenced session supervisor, preserve Reasonix transport security and stdio process isolation, and cover JetBrains activation, recovery, pagination, cancellation, OAuth, schema stability, and bounded close behavior.
Verification:
- go test ./internal/plugin -count=1
- go test -race ./internal/plugin -count=1
- go test ./...
- go vet ./internal/plugin
Problem: Remote serve reconnect failures could write provider credentials embedded in bootstrap errors to desktop logs.
Root cause: reattachRemoteTab logged the complete EnsureServer error even though remote process output can carry forwarded API keys.
Fix: retain structural reconnect diagnostics while omitting the error body, and add a regression test that injects a secret-bearing error and verifies it never reaches the log.
Verification: cd desktop && go test ./...; cd desktop && go test -race ./ -run TestRemoteTabReconnectDoesNotLogEnsureServerSecrets\|TestRemoteTabFollowsHostReconnect -count=1; cd desktop && golangci-lint run ./...; cd desktop && GOOS=windows golangci-lint run ./...; go run ./tools/repolint; git diff --check
Problem:
Current schema-v3 Desktop diagnostics are retained as unknown instead of uploaded, queue pruning can delete newer-schema pending files, and test-only URL matching and goroutine patterns fail required CI gates.
Root cause:
The pending reader's supported version stopped at schema 2, queue pruning ignored schema ownership, and the tests used broad URL substring checks plus superseded concurrency idioms.
Fix:
- align the pending reader with current schema 3 producers
- preserve future-schema files while pruning only understood queue entries
- use exact OAuth URL checks and CI-compliant deterministic test helpers
Verification:
- focused Desktop pending compatibility tests
- npm run typecheck
- npm test
- golangci-lint run --timeout=5m --allow-parallel-runners
- go run ./tools/repolint
- go test ./...
- cd desktop && go test -race ./...
- go test -race ./internal/crashreport
Problem:\nThe exact-head CI failed desktop lint on Linux and macOS, plus the root cross-platform build-tag sweep.\n\nRoot cause:\nThe remote-session changes retained an unused pre-snapshot map value, used loops now covered by the slicescontains rule, and ignored an auxiliary preference write without marking it best-effort. Two inherited Unix tray cancellation tests also lacked cleanup on timeout paths.\n\nFix:\nNarrow the remote lookup, use slices.Contains, explicitly keep the last-workspace preference non-fatal after a successful attach, and defer both DBus context cancellations.\n\nVerification:\n- golangci-lint run --timeout=5m ./... (root and desktop)\n- GOOS=windows golangci-lint run --timeout=5m ./... (root and desktop)\n- cd desktop && go test ./...\n- cd desktop && go test -race ./ -run targeted remote/tab/DBus cancellation suite\n- git diff --check
Problem:
Crash samples remain in D1 indefinitely and repeated automatic crashes can upload without a version-scoped client boundary.
Root cause:
The ingest protocol has no stable event identity or local deduplication ledger, and the Worker has no bounded, idempotent Firebase projection path.
Fix:
- add event IDs and version-scoped Desktop crash deduplication
- add a bounded D1 outbox, projection receipts, group leases, and OAuth-authenticated Realtime Database delivery
- preserve D1 aggregates with d1, dual, and firebase rollout modes plus additive migration tooling
Verification:
- npm run typecheck
- npm test
- go test ./...
- cd desktop && go test -race ./...
- go test -race ./internal/crashreport
- go run ./tools/repolint
Problem:\nThe session-rebind suite awaited a tab switch while its target history was intentionally deferred, and still expected the failed target to remain visible after the controller adopted transactional rollback.\n\nRoot cause:\nThe fixture predated switchTab's hydrate-before-complete contract and its safe rebind to the retained source session on history failure.\n\nFix:\nObserve the optimistic target while the switch promise is pending, release the failed history, assert backend and transcript rollback, then retry generation two before exercising the same-tab generation fence.\n\nVerification:\n- pnpm exec tsx src/__tests__/tab-switch-session-rebind.test.tsx\n- git diff --check
Problem:\nThe tab-switch hydration suite awaited switchTab before releasing the intentionally deferred target history, leaving the module with an unsettled top-level await.\n\nRoot cause:\nswitchTab now correctly resolves only after target history hydration, while the stale-history race fixture still used the older activation-only completion order.\n\nFix:\nWait for backend activation and the scoped new-session action first, switch back to the cached source tab, then release history and await the original switch promise.\n\nVerification:\n- pnpm exec tsx src/__tests__/tab-switch-hydration.test.tsx\n- git diff --check
Route the higher-specificity styled-theme menu rule through the shared operational overlay surface. Expand the browser contract from the jobs popover to every representative operational surface so future selector-specific overrides cannot silently bypass paneOpacity.
Problem:\nThe startup settings contract still required DeepSeek Responses to be the first browser mock rank even after main added the recommended OpenCode Go bundle ahead of it.\n\nRoot cause:\nThe source-shape assertion encoded the old first-rule layout instead of the current two-entry ordering contract.\n\nFix:\nAssert that the recommended bundle ranks first and DeepSeek Responses remains immediately behind it.\n\nVerification:\n- pnpm exec tsx src/__tests__/startup-settings-contract.test.ts\n- git diff --check
Problem: the generic frontend runner re-executed remote suites that already belong to test:remote, and the connect wizard failed before assertions because plain Node cannot import its CSS module.
Root cause: the PR added the suites to the dedicated script without registering all of them in OWNED_ELSEWHERE.
Fix: assign every dedicated remote suite to test:remote, retaining its CSS and SVG loader contracts and avoiding duplicate coverage.
Verification: run-tests syntax check; full test:remote suite.
Problem: the full frontend suite failed its footer-resize source contract after syncing current main-v2.
Root cause: production correctly suppresses tail following during history hydration, but the static contract still expected the pre-hydration guard and dependency list.
Fix: assert the current hydration-aware guard while preserving the original coalesced tail-follow requirement.
Verification: history load failure contract; Goal activation routing test; frontend typecheck.
Problem: the Goal activation routing test reverted its optimistic tab switch because the test harness could no longer load conversation history.
Root cause: after syncing main-v2, useController hydrates through HistorySliceForTab while this PR-owned harness still mocked only the retired page API.
Fix: provide the shared windowed-history mock with the current request type.
Verification: isolated routing test passed five consecutive runs; frontend typecheck.
Problem:
Operational popovers such as Background jobs could become fully transparent, while undefined legacy theme variables also removed muted text, hover, border, and shadow styling.
Root cause:
Amber did not inherit a complete semantic surface contract, and operational overlays consumed translucent panel recipes without distinguishing ordinary themes from background-image theme packs.
Fix:
Define and enforce the semantic token contract, replace undefined legacy aliases, derive one overlay surface recipe from theme-pack pane opacity, and cover built-in themes plus portal overlays in a real browser. Keep Remote Connect Wizard CSS in its lazy production entry and align async test fixtures with the current HistorySlice contract.
Capacity:
The raw initial asset budget rises by 1.3 KiB (0.055%) for 1.09 KiB of attributable CSS; the existing gzip CSS ceiling remains unchanged.
Verification:
- pnpm check:css
- pnpm test:theme-browser
- pnpm test
- pnpm build
- git diff --check
Problem: browser tests and non-Wails previews can expose a partial runtime object without the generated Go application binding.
Root cause: the extracted remote event bridge treated window.runtime alone as proof that the native event API was usable.
Fix: require both the generated App binding and the Wails runtime before using native events, matching the original bridge guard and retaining the mock listener fallback.
Verification: frontend typecheck; remote frontend test suite.
Problem: switching from a local session to a remote tab could hide the local surface even when its current session failed to persist. Opening a remote project also mutated remote state before that safety barrier.
Root cause: remote activation bypassed the snapshot-before-switch contract used by local tabs, and local activation cleared the remote selection before the snapshot completed.
Fix: serialize the user-facing cross-registry activation paths, snapshot the current local session before remote activation, keep both registries unchanged on failure, and extract the selector from the oversized tabs file.
Verification: targeted desktop activation tests; targeted race tests; repolint; git diff --check.
Problem: remote session model and effort changes received HTTP 405 because the JSON endpoints were never registered.\n\nRoot cause: the branch added switch implementations and desktop callers but only kept the legacy slash-command interception inside POST /submit.\n\nFix: register POST /model and POST /effort, validate their JSON payloads, and distinguish busy transition conflicts from internal failures.\n\nVerification: go test ./internal/serve; targeted go test -race ./internal/serve; repository lint.
Preserve the new local session-archive flow while routing remote session rename, pin, open, and delete actions through the remote bridge.\n\nVerification: pnpm typecheck; remote project tree contract; project tree archive race; repolint.
Problem: the remote session branch predated the project credential-chain merge and its tab bridge allowed duplicate opens, stale SSE generations, unbounded responses, and inconsistent mixed-tab persistence.\n\nRoot cause: remote session ownership, transition serialization, and local/remote tab ordering were not represented as single synchronized state machines.\n\nFix: merge main-v2, preserve the modular remote project bridge, serialize session transitions, generation-fence event pumps, harden loopback HTTP transport and response limits, preserve mixed tab state, and split the frontend/backend additions across focused modules.\n\nVerification: go test ./...; targeted go test -race remote suite; pnpm typecheck; pnpm test:remote; pnpm build; go run ./tools/repolint.
Problem:
- Active runtime-session rows could invoke DeleteSession and silently stop ongoing work.
- Topic tombstones were installed before TrashTopic committed, so refreshes could hide a topic even when the backend later rejected the archive.
Root cause:
- The per-session menu ignored the row's existing active-work archive guard.
- Pending UI state and the post-commit stale-response fence shared one lifecycle.
Fix:
- Disable per-session archive actions for thinking, streaming, confirmation, and background-job states.
- Commit topic tombstones only after backend success, fence pre-commit page loads at that boundary, and keep failure recovery visible.
- Extend the deterministic archive interleaving regression coverage.
Verification:
- pnpm exec tsx src/__tests__/project-tree-archive-race.test.ts
- pnpm exec tsx src/__tests__/project-tree-runtime.test.ts
- pnpm test:typecheck
- pnpm build
- pnpm test:remote
- cd desktop && go test -count=1 -run 'TestDeleteSessionCancelsActiveRuntime|TestDeleteSessionWithStuckJobReturnsAfterSingleGrace|TestTrashTopicRejectsRunningSessionRuntime|TestTrashTopicRejectsConcurrentTurnAdmissionWithoutWaiting' .
- go run ./tools/repolint
- git diff --check
Co-authored-by: Linearleaf <[email protected]>
Problem:
CodeQL reported a high-severity clear-text logging path from provider credential configuration into the legacy Serve restart failure log.
Root cause:
The asynchronous fallback logged the complete error returned by EnsureServer. That error chain can include credential-configuration context and should not be persisted even though current messages avoid key values.
Fix:
Log only the safe host and workspace correlation fields for this restart failure. The detailed failure remains available through the managed Serve state without entering process logs.
Verification:
- go test ./... in desktop
- targeted remote desktop race suite
- golangci-lint v2.12.2
- repolint and git diff --check
Problem: The provider-visible memory guidance could make an update pass activation="relevant" and silently unpin an existing pinned memory, while forget and recall omitted their minimum arguments.
Root cause: The compact use_capability description conflated create and update defaults instead of matching the underlying memory schemas.
Fix: Document create/update activation behavior, the pinned opt-in, forget(name), and recall operations; enforce the contract with focused assertions; regenerate all cache-prefix goldens.
Verification: go test ./...; go test -race ./internal/agent -run TestUseCapabilityMemoryDescriptionNamesRoutableTools -count=1; go vet ./internal/agent ./internal/boot; go run ./tools/repolint; go build ./cmd/reasonix; go build ./internal/agent/... ./internal/capability/...
Co-authored-by: SivanCola <[email protected]>
Problem:
The CI lint job rejected the manual target lookup loop under the Go 1.26 modernize rules.
Root cause:
releaseItemHasTarget duplicated the standard slices.Contains operation.
Fix:
Use slices.Contains for the same exact membership check without changing release rendering behavior.
Verification:
- go test ./internal/productdocs
- go test ./...
- golangci-lint run --timeout=5m --allow-parallel-runners
- go run ./tools/repolint
- node scripts/release-notes.mjs validate
- node --test scripts/release-notes.test.mjs
- git diff --check
Problem:
The legacy compatibility path could let manually authored v1.31.4 and newer records bypass per-client target metadata.
Root cause:
Validation required item targets only when targetingVersion was already present, without an adoption boundary for future releases.
Fix:
- require targetingVersion 1 for v1.31.4 and newer core versions
- preserve legacy rendering and validation for older releases
- cover the adoption boundary across stable and preview versions
Verification:
- node scripts/release-notes.mjs validate
- node --test scripts/release-notes.test.mjs
- bash scripts/release-workflows.test.sh
- node scripts/check-single-release-public-contract.mjs
- git diff --check
Problem:
The desktop full race suite could fail in TestMetaReportsGoalStatus while an asynchronous tab metadata refresh read the quality floor.
Root cause:
The test directly mutated WorkspaceTab.qualityFloor without App.mu after MetaForTab had scheduled a background refresh. Production writes already use the app lock, but the fixture bypassed that contract.
Fix:
Guard the legacy empty-floor fixture mutation with App.mu so the test follows the same synchronization boundary as production code.
Verification:
- go test -race . -run TestMetaReportsGoalStatus -count=50
Problem:
Release notes combine Desktop and CLI changes, so users cannot tell which client needs an update.
Root cause:
The release ledger has no item-level target metadata, and every renderer flattens the same product-wide sections.
Fix:
- add versioned Desktop, CLI, site, and service targets with strict validation
- derive target hints from pull request labels and changed paths
- render client-specific sections across GitHub notes, the website, and built-in docs
- preserve the legacy layout for historical releases
Verification:
- node scripts/release-notes.mjs validate
- node --test scripts/release-notes.test.mjs
- go test ./internal/productdocs
- cd site && npm test
- go test ./...
- cd site && npm run build
- bash scripts/release-workflows.test.sh
- node scripts/check-single-release-public-contract.mjs
- actionlint release workflows
- go run ./tools/repolint
Refs #9394
Problem:
The project-groups stage exposed unfinished remote-tab actions and could lose per-workspace credential routes or provider endpoints after reconnects. Proxy forwarding, request-body handling, remote path resolution, and stale UI fetches also had security and race gaps.
Root cause:
The partial implementation mixed future tab plumbing with the current remote-window surface, used host-scoped assumptions for workspace state, and mutated shared proxy/server state without complete lifecycle fences.
Fix:
Keep the UI on the supported remote-window flow, persist and render project registrations safely, isolate workspace provider/token identities, heal all tracked routes and managed provider blocks on reconnect, harden the credential proxy and SFTP bootstrap, and split oversized modules without widening repolint baselines. Add focused frontend, Go, race, security, reconnect, and multi-workspace coverage.
Verification:
- pnpm build and pnpm test:remote
- Playwright motion and transcript browser gates
- go test ./... in the root and desktop modules
- CI concurrency-package and desktop full race suites
- Windows cross-compilation for changed root packages and desktop
- go vet, golangci-lint v2.12.2, and repolint
Co-authored-by: XTLine <[email protected]>
Problem: The functional fix grew already-large agent, boot, and controller owner files past their repolint ratchets, and its tests asserted a production-only boolean accessor instead of exercising the real proxy route.
Root cause: Availability helpers and inventory merge policy lived in aggregate files, while the regression test stopped at the dispatch gate rather than crossing use_capability into tools/call.
Fix: Move MCP availability and host-session inventory logic into focused owner files, remove the Controller accessor, and drive the Streamable HTTP stub through an actual use_capability call while checking disabled and unknown refusals and provider-schema containment.
Verification: go run ./tools/repolint; go test ./...; focused go test -race for internal/boot, internal/agent, and internal/control; go vet for the owning packages; gofmt and git diff --check.
Problem:
- Grouped session rows shared topic-scoped menu and confirmation state.
- Successful session deletion refreshed only project shells, so the archived row could remain visible.
- The interrupted-job filters in the PR targeted a running-only API and could never observe interrupted tombstones.
Root cause:
- Session actions were keyed by topicId instead of exact row/session identity.
- The session archive path did not reload its owning canonical topic page.
- jobs.Manager.RunningForSession deliberately keeps unwinding work operationally running while excluding closed tombstones.
Fix:
- Key menus by row and confirmations by scoped topic/session identity.
- Serialize session archive actions, expose per-session busy state, and reload the owning project page.
- Preserve the existing running-job accounting contract and add focused regression coverage.
- Extract the session archive menu to keep ProjectTree within its repository budget.
Verification:
- pnpm build
- pnpm test:typecheck
- pnpm exec tsx src/__tests__/project-tree-archive-race.test.ts
- go test -count=1 ./internal/jobs ./internal/control
- cd desktop && go test ./...
- go vet ./...
- cd desktop && go vet ./...
- go run ./tools/repolint
Co-authored-by: Linearleaf <[email protected]>
Problem: The model-facing description advertised an unregistered memory:recall route, and the cache-prefix golden did not record the intended schema change.
Root cause: The prose was not checked against registry routing, while only the serialized request/schema goldens were refreshed.
Fix: Document the registered tool:memory recall route, tighten pinned guidance, add a routing regression test, and regenerate all cache-prefix goldens.
Verification: go test ./internal/agent ./internal/boot; go vet ./internal/agent ./internal/boot; go run ./tools/repolint; go build ./cmd/reasonix; go build ./internal/agent/... ./internal/capability/...
Co-authored-by: SivanCola <[email protected]>
Problem:
The window icon repair sent WM_SETICON with selector 2, which is only valid as ICON_SMALL2 for WM_GETICON. The per-window small icon therefore remained unset.
Root cause:
The getter-only small-icon selector was confused with WM_SETICON's ICON_SMALL value.
Fix:
Use selector 0 for the small window icon, expose narrow Win32 call seams so tests assert the exact selectors and class assignments, strengthen the no-icon guard, and document the bounded process-lifetime handle retention accurately.
Verification:
- GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go vet .
- GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go test -c .
- go test ./...
- git diff --check
Co-authored-by: SivanCola <[email protected]>
Problem:
- The wizard finished through remote-tab bindings that are introduced only by a later stacked PR.
- Browser file inputs cannot provide the absolute SSH identity path the desktop process needs.
- Modal focus, retry concurrency, and directory-response ordering were not protected.
Root cause:
- Browser mocks hid the Wails/native boundary and the stack assumed the later project-tab layer was already present.
- Connection retry and SFTP listing work had no single-flight or request-generation ownership.
- Wizard styles lived in the app-shell stylesheet.
Fix:
- Finish through the existing OpenRemoteWorkspace surface and remove later-layer API/config additions.
- Add a native identity-file picker and an early Linux/macOS platform probe.
- Trap and restore modal focus, hold retry busy state, and ignore stale directory responses.
- Extract growing modules, lazy-load wizard CSS, tighten bundle gates, and document the flow.
Verification:
- go build ./... && go vet ./... && go test ./...
- cd desktop && go build ./... && go test ./...
- go test -race ./internal/config
- cd desktop && go test -race . -run 'Test(PickRemoteIdentityFile|CheckRemotePlatform|Remote)'
- pnpm test:remote
- pnpm build
- REASONIX_CHANNEL=test pnpm build
- go run ./tools/repolint
- 1024x600 browser geometry, overflow, keyboard focus, and lazy CSS validation
Co-authored-by: SivanCola <[email protected]>
Problem: PR #9367 was based on an older main-v2 and conflicted with the current frontend bundle contract.\n\nRoot cause: main-v2 advanced provider access cleanup, branch metadata recovery, telemetry, LaTeX rendering, and bundle-budget baselines while the wizard branch changed the same frontend budget surface.\n\nFix: merge current main-v2 and retain both the KaTeX fallback baseline and the wizard's measured bundle allowance.\n\nVerification:\n- go build ./... && go vet ./... && go test ./...\n- cd desktop && go build ./... && go test ./...\n- cd desktop/frontend && pnpm build
Problem: the synchronized PR head exceeded existing repolint file-size and test-file-size budgets by small, intentional deltas in touched files.
Root cause: the latest main-v2 baseline predated this PR's compact-ratio validation, UI, CLI, and regression-test additions.
Fix: update only the six measured baseline entries required by the PR; no broad slack or unrelated baseline changes.
Verification: go run ./tools/repolint; go test ./internal/config ./internal/cli -count=1; git diff --check.
Co-authored-by: SivanCola <[email protected]>
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
* fix(agent): rebuild zero-filled corrupt branch meta instead of failing saves
A branch-meta sidecar can be torn into all-NUL (or all-whitespace) bytes when a
Windows non-atomic ReplaceFile in-place copy is interrupted by a forced reboot
(DPC_WATCHDOG_VIOLATION / power loss) — see #6325. Every save/close then fails
with 'decode branch meta: invalid character \x00' and the tab cannot be closed,
because LoadBranchMeta surfaces the decode error and callers (save.go:807,
ensureBranchMetaUnlocked) have no rebuild fallback.
Treat all-zero / all-whitespace undecodable meta as absent so it is rebuilt on
the next save, instead of blocking saves/closes. Genuine partial JSON (non-zero)
still returns an error so real corruption is not silently swallowed.
Tests: zero-filled -> absent, whitespace-only -> absent, partial JSON -> error,
EnsureBranchMeta rebuilds a corrupt sidecar. Refs #6325.
* docs(agent): clarify corrupt meta detection comment
Problem: the helper comment implied valid JSON cannot begin with whitespace.
Root cause: the wording conflated a JSON prefix with a document consisting only of JSON whitespace.
Fix: describe the actual all-NUL/all-whitespace invariant used by the detector.
Verification: git diff --check; internal/agent tests will run after updating the branch base.
Co-authored-by: SivanCola <[email protected]>
---------
Co-authored-by: SivanCola <[email protected]>
Problem: filesystems without RENAME_EXCL cannot provide an atomic no-replace rename through the fallback path.
Root cause: the fallback used an existence check followed by os.Rename without documenting the Reasonix lock boundary or surfacing its best-effort errors.
Fix: document the cooperative mutation-lock boundary and wrap fallback conflicts and rename failures with explicit best-effort context while preserving os.ErrExist matching.
Verification: go test ./internal/repair -count=1 -timeout=180s; cd desktop && go test . -run 'TestMacUpdateRename' -count=1 -timeout=180s
Problem: the PR branch was based on an outdated main-v2 and carried avoidable integration risk.
Fix: merge the latest origin/main-v2 into the PR branch without rewriting the contributor history; the effective three-dot diff remains limited to the compact-ratio implementation, tests, and documentation.
Verification: merge-tree is clean; go test ./internal/config ./internal/cli ./internal/agent -count=1; go test ./desktop -run TestSetCompactRatio -count=1; frontend settings snapshot, typecheck, and eslint pass.
Use a macOS-updater-only rename fallback for filesystems without
RENAME_EXCL and compare copied app payloads without POSIX mode or
matching AppleDouble noise. Keep strict backup and staging identities
while accepting legacy strict handoff digests.
mergeHostSessionCapabilitySpecs was inserted between
applyUnifiedProviderToolSurface's doc comment and its declaration, so the new
function carried a paragraph describing a different function and
applyUnifiedProviderToolSurface was left undocumented.
Move the helper and its comment below applyUnifiedProviderToolSurface. Both
identifiers are unexported, so gofmt, go vet and staticcheck's comment rules all
stay silent on this — only a human reading the file top to bottom sees it.
Pure move: 19 lines out, the same 19 in, no behaviour change.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Follow-up to review on the host-session MCP dispatch fix.
Extract the capability-runtime inventory merge into
mergeHostSessionCapabilitySpecs. The previous change appended host-session specs
after the config specs and relied on ConfigureServers building its registry with
next[name] = ... in slice order, so a name collision resolved to the
host-session spec by map overwrite, 700 lines from where it was decided.
That precedence is correct — it is the same choice the registration tier already
makes explicitly, filtering colliding config specs out of configSpecs before
registerEnabledMCP — but it should be stated, not inherited from slice order.
Reorder the append or switch ConfigureServers to first-wins and the behaviour
silently inverts into the worst case: a user-disabled config spec marked enabled,
with an identity that no longer matches the tools pluginHost registered.
The merge also drops the shadowed config *entry*. ConfigureServers pairs an entry
with a spec by name, so a surviving config entry paired auto_start = false with
the live host-session spec, and /mcp reported one server as simultaneously
not-auto-start and not-disabled.
Unify the wording for "this session has no such MCP server". After the previous
change the same state had two spellings in one file: the three use_capability
sites said "is not registered in this session" while lockAuthorizedRuntimeServer
— the path a registry-resident mcp__server__tool takes — still said "is not
configured". Both are reachable. mcpServerUnregisteredMessage and
mcpServerDisabledMessage now hold the two spellings that are meant to differ.
Tests:
- TestMergeHostSessionCapabilitySpecsPrefersHostSessionOnNameCollision pins the
precedence rule and that the shadowed entry is dropped. Asserted on the merge
directly rather than through a booted Controller, since observing which spec
reached the registry would otherwise need a production accessor existing only
for the test.
- TestMergeHostSessionCapabilitySpecsIsIdentityWithoutHostSession pins that the
ordinary config path is handed through untouched.
- TestBuildLeavesDisabledConfigMCPUndispatchableAlongsideHostSession pins that a
config server with auto_start = false stays undispatchable while an unrelated
host-session server is enabled in the same boot — the invariant the enablement
loop could break by widening from "every extraSpec name" to "every name".
Both new behavioural tests were mutation-checked: replacing the merge with a
naive append fails the collision test, and widening the enablement loop to every
config name fails the disabled-config test.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
An MCP server passed through ACP `session/new.mcpServers` arrives as
`Options.ExtraPlugins` and is appended to `eagerSpecs`, so it reaches
`pluginHost`: it connects, completes initialize + tools/list, and its tools
appear in the capability catalog as `status: "ready"`.
The capability runtime is a second, separate registry. It is seeded by
`capRuntime.ConfigureServers(cfg.Plugins, capSpecs, enabledMCPNames)`, and both
`capSpecs` and `enabledMCPNames` were built from config alone. A host-session
server was therefore absent from `r.servers`, so `serverEnabled()` returned
false on its `ok` check and every `mcp-tool:<server>/<tool>` call was refused
with "is disabled in this session" — while the catalog had just advertised the
same tool as ready.
Register host-session specs with the capability runtime and mark them enabled,
matching the intent already stated where they are built: they arrive through an
explicit host action, so they are authoritative exactly like an auto-started
config plugin. Both changes are required; neither alone is sufficient, since
`ConfigureServers` reads an absent `enabled[name]` as false and `serverEnabled`
rejects a name missing from `r.servers`.
Also separate "not registered" from "disabled" in the refusal message. They have
different causes and different fixes, and reporting the former as the latter
sent users looking for a toggle that does not exist.
Reproduced against v1.31.3 over the real ACP wire with zero `[[plugins]]` in
config: `use_capability` `action: "call"` on
`mcp-tool:acppassed/traycer_probe_ping` returned "disabled in this session" and
the MCP server never received `tools/call`; `inspect` on
`mcp-server:acppassed` returned `unknown capability_id`. With this change the
same probe returns the tool result and the server receives `tools/call`.
Both new boot tests were mutation-checked: reverting only the boot.go change
fails TestBuildEnablesHostSessionMCPForCapabilityDispatch while
TestBuildLeavesUnknownMCPServerUndispatchable keeps passing, so the fix cannot
be satisfied by defaulting unknown servers to enabled.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Problem: the latest-base app-shell CSS budget was 30 gzip bytes below the boxed KaTeX fallback build.
Root cause: the rendering fix adds a small, intentional stylesheet rule at a rounded 114.3 KiB gate.
Fix: raise only the deferred app-shell CSS allowance to 114.4 KiB and document the measured 30-byte reason.
Verification: pnpm build passes with the updated budget.
Problem: the config setter accepted ratios below 0.65 while the CLI, desktop editor, mock bridge, tests, and docs still enforced the old floor.
Root cause: compact-ratio bounds were duplicated across Go and TypeScript surfaces.
Fix: centralize Go bounds at 0.30-0.85, apply the range to CLI and desktop settings, update localized guidance and documentation, and add lower-bound regression coverage including 1M-context trigger math.
Verification: go test ./internal/config ./internal/cli ./internal/agent; go test ./desktop -run TestSetCompactRatio -count=1; frontend settings snapshot, typecheck, and eslint pass.
Co-authored-by: SivanCola <[email protected]>
Problem: KaTeX boxed frames can collapse in WebKit, and the frontend package pin and CSS contract were not guarded by an automated test.
Root cause: the WebKit-specific fill value had no standards-compatible fallback or source contract test.
Fix: keep width:100% as a fallback, retain -webkit-fill-available for WebKit, and add a discovery-run contract test for the boxed rule and pnpm pin.
Verification: go test ./internal/cli; go vet ./internal/cli; CSS syntax and z-index checks; math-golden; katex-boxed-css contract test.
Problem:
Grouped custom-provider removal expanded search-only requests to every OpenCode Go route and left auxiliary model references pointing at deleted providers.
Root cause:
The batch API did not preserve the caller's requested subset, while the removal fingerprint and retargeting path covered only the primary desktop model references.
Fix:
Delete only the explicitly requested members of a validated OpenCode Go family. Clear vision references, retarget guardian/recovery and every persisted bot model owner, and include those values in the concurrent-change fingerprint.
Verification:
- go run ./tools/repolint
- cd desktop && go vet ./... && go test ./...
- focused grouped-removal tests under go test -race
- provider access card component test
- frontend production and test TypeScript checks
Co-authored-by: poorpaper <[email protected]>
Problem: the notice wording fix pushed jobs.go beyond the repository repolint baseline, and the updated tests did not fully guard the new Text/Detail contract.
Root cause: the notice payload was split across extra local variables and a multi-line event literal, while the tests only searched for the new headline.
Fix: construct the unchanged warning event in a compact value, and assert the new wording, guidance, and removal of the old stalled phrase in both emitted and drained notices.
Verification: go test ./internal/jobs/ ./internal/config/; go test -race ./internal/jobs; go vet ./internal/jobs/ ./internal/config/; go run ./tools/repolint.
Co-authored-by: SivanCola <[email protected]>
A background job with no output for tools.background_jobs.stalled_warning_seconds
(900s by default) was reported as "may be stalled". Many legitimate long-running
tasks (installs, builds, test collection, waiting on an external service) stay
silent for minutes without being stuck, so a single "no visible output" signal
cannot distinguish a hang from a healthy quiet job and produced noisy false
warnings.
Reframe the notice so it states the observable fact — still running after N
without new output, i.e. a heads-up, not an error — and points at how to tune or
disable the check (stalled_warning_seconds = 0). Applies to the drain note, the
emitted Notice Text/Detail, and the config comments and rendered output.
Tests: go test ./internal/jobs/ ./internal/config/ (all pass).
The preferences module's 30-day deduplicated install count was computed by an
hourly cron over metric_users. That table's primary key leads with `date`, so
`WHERE date >= ... AND signal = ?` could only prune the window: every signal
scanned all ~28M rows, eight signals an hour. One dashboard panel therefore
read on the order of five billion rows a day, which is the database's entire
read bill — and metric_users had no other reader.
Retire the detail table and everything that fed it: the rollup cron and its two
tables, the per-install metrics write, the dashboard's own full-table window
query, and the runtime bootstrap that would recreate cli_metric_users on the
next request. The aggregate `metrics` tables keep the same signals as event
counts at ~180k rows, and `pings` keeps per-day deduplicated installs.
Both panels that rendered the retired number are removed rather than left
showing a permanent error — the 30-day notice linked to a 7-day view that no
longer had data either. The client stops sending install_id with metrics, since
nothing receives it now.
migrate-drop-metric-users.sql reclaims the ~5.6GB the table held. Deploy the
worker before running it: until then the runtime bootstrap rebuilds the table.
Bring the four post-base main-v2 commits (#9312/#9314/#9341/#9344) onto
the wizard branch so GitHub can auto-merge the [0/3] PR. The only conflict
was styles.css (duplicate transcript geometry-pending block); keep the
main-v2 copy.
- serve.go: session-plane endpoints, model/effort routing to final
- desktop/kernel + internal (agent/control/event/eventwire/config/cli/
bootstrap/sftpfs) to final state
- remote_listing.go (slice of the serve bridge, folded back into
remote_tab.go by the sessions PR): one-shot auth handshake against an
already-ready serve registration, GET /sessions, RemoteProjectSessions
- ServeSnapshot read-only lookup on the per-workspace registry: query
paths must never cold-start a serve; live-tab fast path lands with [1/3]
- remoteKernel.CheckPlatform: uname through the same ParseUname gate
EnsureServe applies; App.CheckRemotePlatform binding for the wizard
- wizard awaits the check at the connecting step, before directory
browsing, failing early with one clear message on unsupported OS
- bridge binding + mock; platform-check tests (app/lifecycle)
Wails v2 registers its window class (wailsWindow) without an hIcon, so the
window answers WM_GETICON with NULL. On Windows 11, once the process sets an
explicit AppUserModelID (PR #7925 -> SetCurrentProcessExplicitAppUserModelID
Reasonix), the taskbar prefers resources registered for that AUMID over the
executable's embedded icon; with none registered it renders the blank-document
glyph for the running window's button. Pinned shortcut icons are unaffected
(they read IconLocation -> reasonix-launcher.exe).
Set the first icon group from the running executable on the Wails window and
its class at startup: WM_SETICON (big+small) plus SetClassLongPtr(GCLP_HICON,
GCLP_HICONSM), which also covers Alt+Tab and window switcher rendering.
Loads via ExtractIconExW, retrying briefly until the wailsWindow appears.
Verified: go vet ./... and unit tests in desktop; plus an isolated Win32 A/B
repro (no-hIcon window class + explicit AUMID) showing the taskbar glyph goes
from blank-document to the embedded brand icon (taskbar screenshot saturation
0.456 -> 0.742).
Fixes the taskbar-icon half of the Windows desktop regression; grouping is
already handled by PR #7925.
Problem:
The grouped-removal regression coverage pushed an existing desktop test file beyond the repository size ceiling.
Root cause:
The new OpenCode Go tests were added to the already-large general provider-removal test file.
Fix:
Move the new grouped custom-provider tests into a focused test file without changing their behavior.
Verification:
- go run ./tools/repolint
- cd desktop && go test ./...
- focused grouped-removal tests
- focused grouped-removal tests under go test -race
Problem:
The OpenCode Go settings card submitted all of its custom routes for removal, but the backend rejected every multi-provider custom request.
Root cause:
Grouped deletion was restricted to official provider aliases even though OpenCode Go is presented as one product-level connection backed by several custom provider entries.
Fix:
Recognize the narrow OpenCode Go route family, expand stale requests to every installed family member, and reuse the failure-atomic provider removal and runtime retargeting path for the full group. Unrelated custom batches remain rejected.
Verification:
- go test ./... (desktop module)
- go test -race focused grouped removal tests
- provider access card component test
- frontend production and test TypeScript checks
* fix(control): restore explicit readiness recovery
Problem: Standard and Delivery turns could launch hidden readiness continuations after a final answer, causing extra model rounds and useless work.\n\nRoot cause: ordinary orchestration armed automatic readiness continuation and classified task progress from per-turn control state and assistant prose.\n\nFix: stop ordinary Standard and Delivery turns at the readiness boundary, preserve explicit Delivery recovery and Goal/Plan continuation, and remove the task-progress continuation path and prose heuristic.\n\nVerification: go test ./internal/agent ./internal/control
* fix(desktop): stop freezing transcript rows during scroll
Problem: manual transcript scrolling could freeze recycled rows to estimated heights and maintain a second pending-Markdown geometry contract, allowing Virtuoso offsets and painted content to diverge.
Root cause: the scroll arbiter forced DOM height during measurement and the geometry cache calibrated unseen rows from unrelated samples.
Fix: keep real measurements for wheel and touch reading, remove pending Markdown fixed-height fallbacks, remove cross-row calibration, and route viewport-shrink tail pinning through the existing Virtuoso writer.
Verification: transcript measurement, native scrollbar, scroll-release, anchor-compensation, recovery-race, typecheck, and single-scroll-writer checks.
* fix(desktop): bound transcript tail writer
* test(desktop): align transcript tail writer fixtures
* docs: document explicit readiness recovery
* fix(desktop): restore explicit Delivery recovery copy
* test(desktop): clarify native scrollbar measurement contract
* fix(desktop): stabilize async markdown geometry
* fix(desktop): keep native scrollbar drag geometry stable
* fix(desktop): adopt bounded transcript scroll recovery
Problem: tail settling could re-arm on sub-row measurement jitter, and a near-bottom downward wheel could arm extent recovery that fought the user's scroll. The previous CI desktop failure also lacked enough geometry evidence and Windows had no browser replay of the transcript path. Legacy readiness comments still described removed ordinary-turn continuation.
Root cause: the tail writer had an attempt cap but no height-growth gate or pinned-state distinction, while releaseTailFollow armed reader extent unconditionally. The browser harness spawned pnpm with a POSIX-only command name and the CI contract counted transcript checks across jobs.
Fix: add a single 24px tail re-arm policy that only suppresses writes while the tail is actually pinned, keep displaced tail recovery live, add the #9248 near-bottom guard, and cover both in deterministic tests. Make transcript browser benches cross-platform, add a Windows Chromium replay beside the native WebView2 smoke, improve timeout diagnostics, and clarify Standard/Delivery readiness comments without changing wire fields.
Verification: go test ./...; go test -race ./internal/agent ./internal/control; cd desktop && go test ./...; cd desktop/frontend && pnpm test:transcript; pnpm test:transcript-browser (two stability runs); pnpm test:motion; pnpm typecheck; pnpm check:scroll-writer; pnpm build; go vet ./internal/agent ./internal/control; go run ./tools/repolint ./....
Co-authored-by: hanswu <[email protected]>
* fix(desktop): launch transcript preview on Windows
Problem: the Windows transcript replay reached the browser bench but failed before starting Vite with spawn EINVAL under Git Bash.
Root cause: Windows command shims such as pnpm.cmd need shell dispatch when launched by Node child_process on the runner.
Fix: keep the platform-specific pnpm command and enable shell dispatch only on Windows for both transcript browser benches.
Verification: cd desktop/frontend && pnpm test:transcript-browser; the Linux/macOS path remains direct spawn and the Windows CI job will rerun the replay.
* test(desktop): make native thumb endpoint platform aware
Problem:\nThe transcript browser replay passed its selection and geometry assertions on Windows but timed out while dragging the native scrollbar thumb to the physical bottom.\n\nRoot cause:\nWindows Chromium keeps a held native scrollbar thumb attached to the track, while Linux themes clamp after an overshoot beyond the track. A single overshoot endpoint is not portable.\n\nFix:\nUse the in-track endpoint on Windows and retain the Linux overshoot endpoint. The gate still exercises native thumb ownership, measurement freezing, release, and tail remeasurement.\n\nVerification:\n- cd desktop/frontend && node bench/transcript-scroll-stability.mjs\n- git diff --check
* test(desktop): skip unsupported Windows headless thumb drag
Problem:\nHeadless Chromium on Windows reports the reserved scrollbar gutter but does not expose a draggable native thumb, so the transcript replay timed out after all geometry and scroll assertions had passed.\n\nRoot cause:\nThe browser benchmark was asserting a WebView2/native scrollbar capability that is unavailable in the headless Chromium runner.\n\nFix:\nSkip only the native thumb drag portion on Windows unless explicitly enabled with REASONIX_TRANSCRIPT_NATIVE_THUMB=1. Keep the complete replay, Linux native-thumb gate, transcript-native-scrollbar unit coverage, and Windows WebView2 native smoke.\n\nVerification:\n- cd desktop/frontend && node bench/transcript-scroll-stability.mjs\n- git diff --check
---------
Co-authored-by: hanswu <[email protected]>
* fix(desktop): allow deleting configured default providers
Problem: The provider access menu was disabled for any custom provider selected as the current default, so configured providers could not be deleted from settings.\n\nRoot cause: The frontend blocked the action based on default-model state even though the backend already retargets references to a configured fallback and rejects unsafe removals.\n\nFix: Remove the frontend-only default-provider deletion gate and keep the backend as the source of truth. Add a regression test covering the custom provider removal confirmation flow.\n\nVerification: provider access card test, frontend typecheck, test typecheck, ESLint, CSS checks, and desktop Go tests all pass.,
* test(desktop): cover deleting the current default custom provider
Problem: the provider deletion regression test did not model a custom provider selected as the current default. Root cause: the card-only fixture bypassed SettingsPanel and never supplied a defaultModel reference. Fix: render the real models/access settings path with a default custom provider and verify the delete action reaches RemoveProviderAccesses. Verification: provider-access-card test, test typecheck, frontend typecheck, targeted ESLint, CSS checks, and settings-refresh snapshot test all pass.
* fix: keep runtime conversation rows in canonical order
Problem: Switching conversations could reorder sidebar rows while runtime and catalog snapshots crossed.
Root cause: The frontend sort comparator treated runtime session rows as incomparable with catalog topic rows, so async arrival order leaked into the visible order.
Fix: Sort both row shapes with the same pinned, manual, activity, and stable-key rules, while keeping non-conversation nodes deterministic. Add a regression test covering a runtime-only row ahead of catalog rows.
Verification: Focused project-tree runtime, catalog-completeness, and runtime-projection tests; frontend typecheck.
* test: keep project tree regression within file budgets
Problem: The focused regression pushed project-tree-runtime.test.ts past the repository test-file budget.
Fix: Move the sorting regression into the dedicated project-tree-sort-runtime test module without changing production behavior.
Verification: Project-tree runtime tests, repolint, and frontend typecheck.
* fix(sessioncatalog): preserve recovery metadata during index repair
Problem: the first PR revision failed repository standards and could leave recovery metadata stale when an unknown count record arrived for an existing session.\n\nRoot cause: the exact-index fast path was embedded in the large upsert function, and its downgrade guard skipped the whole record without distinguishing count fields from recovery metadata.\n\nFix: extract exact-path preparation into a focused helper, preserve known counts only when the content fingerprint is unchanged, and still apply recovery metadata updates.\n\nVerification: go run ./tools/repolint; go test ./internal/sessioncatalog -count=1; go test -race ./internal/sessioncatalog -count=1; go vet ./internal/sessioncatalog; cd desktop && go test ./... -run 'Test(DeleteSession|SessionCatalog|ProjectTree|Reconcile|ListProjectTopics)' -count=1
* fix: preserve activity during exact session indexing
Problem: A transient older sidecar read could overwrite a known newer activity timestamp and reorder the project sidebar while switching conversations.
Root cause: Exact-path indexing replaced the catalog activity projection without comparing it with the existing authoritative content projection.
Fix: Preserve the known activity timestamp when the transcript fingerprint is unchanged and the incoming sidecar timestamp is older. Add a deterministic regression test for the backwards-activity case.
Verification: Focused sessioncatalog tests, project-tree runtime/sort tests, frontend typecheck, repolint, and git diff --check.
* refactor: remove unreachable runtime session sort path
Problem: The frontend sorter change targeted top-level session rows that the current runtime projection does not emit.
Fix: Remove the unreachable presentation change and its misleading fixture so the PR owns only the exact-index activity regression that reproduces the reported sidebar reorder.
Verification: Project-tree tests, sessioncatalog tests, repolint, and frontend typecheck.
* fix(sessioncatalog): stop repeated repair reindex loop
Problem: Idle desktop sessions could repeatedly show indexing progress and make sidebar deletion appear unavailable.\n\nRoot cause: Exact-path catalog indexing rewrote an unchanged projection and published a new revision on every defensive snapshot, allowing repair and reconcile work to feed back into one another.\n\nFix: Skip unchanged exact-path projections, prevent stale unknown inputs from downgrading known counts, and add regression coverage for repeated indexing and repair completion.\n\nVerification: go test ./internal/sessioncatalog -count=1; go test -race ./internal/sessioncatalog -count=1; go vet ./internal/sessioncatalog; cd desktop && go test ./... -run 'Test(DeleteSession|SessionCatalog|ProjectTree|Reconcile|ListProjectTopics)' -count=1
* fix(sessioncatalog): preserve recovery metadata during index repair
Problem: the first PR revision failed repository standards and could leave recovery metadata stale when an unknown count record arrived for an existing session.\n\nRoot cause: the exact-index fast path was embedded in the large upsert function, and its downgrade guard skipped the whole record without distinguishing count fields from recovery metadata.\n\nFix: extract exact-path preparation into a focused helper, preserve known counts only when the content fingerprint is unchanged, and still apply recovery metadata updates.\n\nVerification: go run ./tools/repolint; go test ./internal/sessioncatalog -count=1; go test -race ./internal/sessioncatalog -count=1; go vet ./internal/sessioncatalog; cd desktop && go test ./... -run 'Test(DeleteSession|SessionCatalog|ProjectTree|Reconcile|ListProjectTopics)' -count=1
Problem: the latest desktop merge no longer calls imageInputEnabledForRootModel, so macOS golangci-lint reports it as unused.\n\nRoot cause: MetaForTab now reads cached tab metadata refreshed by the background path.\n\nFix: remove the obsolete duplicate lookup and retain the shared root config loader used by metadata refresh.\n\nVerification: cd desktop && go test ./... -run 'TestMeta|TestTabMeta|TestImage' -count=1; golangci-lint run --timeout=5m.
Problem: the cross-provider file-id guard used a manual loop that the repository's modernize lint rejects.\n\nRoot cause: the merged main-v2 lint configuration requires slices.ContainsFunc for this predicate.\n\nFix: replace the loop with slices.ContainsFunc while preserving the fail-closed cross-provider validation.\n\nVerification: go test ./internal/control -run 'Vision|Image' -count=1; go vet ./internal/control; go run ./tools/repolint.
Resolve the latest main-v2 bundle-budget and repolint baseline conflicts while retaining the text-only image-understanding fallback behavior. Re-run root and desktop tests, frontend build and vision regression tests after the merge.
* fix(desktop): present cleaned web search sources
Problem: desktop search answers rendered raw provider URLs directly below model text, including long redirect links.
Root cause: history and live search paths stored source hits but reused a Markdown footnote renderer, while web_search cards exposed raw output.
Fix: add a display-only source projection that validates HTTP(S), unwraps known redirects, removes tracking parameters, deduplicates hits, and hides invalid/titleless sources. Render a collapsed accessible source panel and structured web_search summary for both live and historical sessions without changing replay payloads.
Verification: focused frontend source/panel/tool tests, frontend typechecks, CSS checks, lint, and Go provider/agent/cli tests pass. The production bundle build completes; the existing gzip budget is 0.8 KiB over its 430.9 KiB gate.
* test(desktop): avoid URL substring security alert
Problem: CodeQL flagged the render regression test for asserting URL visibility with a host substring.
Root cause: substring-based URL checks can be bypassed by arbitrary surrounding hosts and are treated as incomplete sanitization.
Fix: assert the collapsed panel does not mount its source-details body instead of matching a URL substring.
Verification: search sources panel test, frontend typecheck, and git diff --check pass.
* fix(desktop): keep controller within repo size budget
Problem: repository standards rejected the PR because the controller file crossed its existing file-size budget.
Root cause: the display-only web-search state added two net lines to an already budget-bound reducer.
Fix: keep the new display field and tool-id fallback behavior while expressing them within the existing owner-file line budget.
Verification: repolint, frontend lint, typecheck, focused search tests, and git diff --check pass.
* perf(desktop): lazy-load source panel
Problem: the initial desktop bundle exceeded the 430.9 KiB gzip gate after adding source-panel UI.
Root cause: the new panel was statically reachable from the large Message module, so its display code and icon dependency were included in the startup chunk.
Fix: move the source-visibility predicate into the existing search-source utility and lazy-load the panel from Message, while retaining a compatibility wrapper for the legacy component name.
Verification: frontend lint, typecheck, focused search render/source tests, repolint, and git diff --check pass.
* perf(desktop): bound source panel bundle cost
Problem: the cleaned web-search presentation pushed the startup and locale bundle gates over their existing limits.\n\nRoot cause: source normalization and the added panel copy/styles were included in the initial application path.\n\nFix: move normalization behind the source panel boundary, keep tool-card counts lightweight, and add narrow attributable bundle allowances for the UI payload.\n\nVerification: go run ./tools/repolint; pnpm build; pnpm typecheck; focused search source, panel, and tool-card tests.
* chore(desktop): retain bundle budget headroom
Problem: main-v2 moved the deferred app-shell and locale assets onto the existing rounded thresholds.\n\nRoot cause: the base branch changed the measured startup payload while this PR also adds the source presentation UI.\n\nFix: preserve explicit, narrow headroom for the measured CSS and Chinese locale chunks.\n\nVerification: pnpm build; go run ./tools/repolint; focused frontend tests.
* fix(desktop): retain source panel locale keys
Problem: the source panel contract defines count and no-valid localization keys.\n\nRoot cause: bundle trimming removed keys that remain part of the display contract.\n\nFix: restore the English, Simplified Chinese, and Traditional Chinese source labels while keeping the lazy presentation boundary.\n\nVerification: pnpm build.
* fix(desktop): share cleaned counts with search cards
Problem: the web-search card initially counted raw hits while the assistant panel counted cleaned sources.\n\nRoot cause: keeping normalization out of the startup path left the tool card without the display projection.\n\nFix: resolve the presentation module lazily in the tool card, fall back to the raw count during loading, and show the filtered/hidden counts once loaded.\n\nVerification: pnpm build; pnpm typecheck; focused panel and tool-card tests; go run ./tools/repolint.
Problem: the composer warned that text-only models could not inspect images even when the configured vision fallback was already analyzing the attachment.\n\nRoot cause: the frontend only received the primary model's image capability and could not distinguish direct-image support from configured image-understanding preprocessing.\n\nFix: expose the cached vision-fallback capability in session metadata, preserve it across tab updates, suppress the warning when fallback is configured, and update the remaining warning copy to point users to Settings. Refresh metadata immediately after settings changes.\n\nVerification: desktop targeted Go tests; frontend typecheck and test:typecheck; composer image capability tests (17/17); use-controller meta tests (163/163); production frontend build; git diff --check.
* fix(desktop): prevent transcript flicker during session switches
Problem: switching sessions briefly rendered the target tab's empty transcript while history hydration and tail-follow writes were still in flight.
Root cause: navigation masking cleared visible items before the target surface was ready, automatic older-history paging amplified layout churn, and recycled Virtuoso rows reused stale known sizes.
Fix: retain the last stable transcript behind an inert loading overlay, commit the target only after hydration, suppress initial auto-completion and hydration-time tail-follow, and ignore recycled-row geometry as a current contract.
Verification: pnpm typecheck; pnpm test:transcript; navigation-surface-transition.test.ts; pnpm build; CSS, WAAPI, scroll-writer, and bundle-budget checks.
* chore: update repolint baseline for transcript surface
* fix(desktop): guard stale hydrate failure rollback
* chore: refresh repolint baseline
Co-authored-by: FuchaZ <[email protected]>
Problem: the image-understanding model setting used a native select, so its popup inherited the operating system dark menu instead of matching the settings model picker.\n\nRoot cause: the field bypassed the shared grouped model-picker component used by the surrounding model settings.\n\nFix: route vision model selection through the shared picker, preserving none/auto choices while inheriting the light card menu, provider groups, search, selected state, and accessibility behavior.\n\nVerification: pnpm typecheck; pnpm test:typecheck; pnpm test:settings-responsive; pnpm build.
Problem: reasoning-heavy vision models could consume the bounded completion budget before emitting visible image text.\n\nRoot cause: the summary prepass inherited the provider's default reasoning depth.\n\nFix: request the lowest supported per-call effort so the 2048-token budget remains available for OCR and layout text; providers without that vocabulary keep their configured behavior.\n\nVerification: go test ./internal/control ./internal/provider/openai ./internal/provider/anthropic ./internal/provider/responses.
Problem: legacy OpenCode Go provider splits rewrote planner and subagent model references but left the new vision fallback reference stale.\n\nRoot cause: the model-reference migration helper did not include Agent.VisionModel.\n\nFix: rewrite the vision model reference alongside the other agent model settings and cover the migration with a regression test.\n\nVerification: go test ./internal/config.
Problem: text-only models could not understand attached images, while the desktop model settings had no way to configure a vision companion.
Root cause: image candidates were retained for vision-capable children but no main-turn prepass converted them into context for a text executor.
Fix: add agent.vision_model configuration and desktop settings, resolve same-provider automatic vision models, generate bounded hidden image summaries, persist and reuse summary metadata, and preserve direct-image behavior for vision-capable models.
Verification: go test ./..., cd desktop && go test ./..., go test -race ./internal/control ./internal/provider, and frontend typecheck/build with bundle budgets.
Problem: pnpm test:typecheck fails on 3 type errors introduced by the
transcript-geometry test files (frontend-diagnostics.test.ts, transcript-row-geometry.test.ts).
Root cause: new test fixtures used Array.prototype.at (ES2022 lib not
enabled in tsconfig.test.json) and omitted required fields of TranscriptRow
(reasoning) and SubagentProgress (truncated). tsx strips types at runtime,
so CI (which does not run typecheck) stayed green.
Fix: index the last event via length, and add the two missing fixture fields.
Verification: pnpm test:typecheck passes; both test files pass under tsx.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* fix(desktop): stabilize transcript geometry and add diagnostics
Problem: Windows transcript upward scrolling could flash back when unseen collapsed reasoning and tool rows mounted with oversized estimates and asynchronous Markdown geometry. Test builds also lacked a single, exportable frontend event trace for diagnosing the failure.
Root cause: row rendering state, initial estimates, measured-size reuse, snapshot validity, and browser fallback geometry did not share one contract. Recycled rows could reuse stale measurements while browser scroll anchoring and Virtuoso measurement updates competed during a manual upward gesture.
Fix: add layout-variant-aware row geometry and estimates, session-scoped measurement LRU with width/typography/content validation, strict snapshot contracts, pending-Markdown geometry freezing, manual-reader measurement freeze, and browser regression fixtures. Add build-channel-gated frontend diagnostics with sanitized event export, session-tree counters, settings integration, and Windows build-channel propagation.
Verification: pnpm typecheck; pnpm test:transcript; pnpm test:transcript-browser; pnpm exec vite build; go test ./...; check-single-scroll-writer; desktop build contract; git diff --check.
* chore(desktop): keep diagnostics changes within repo lint budgets
Problem: the diagnostics integration pushed two existing frontend files past their ratcheted file-size budgets, and the local build left a numeric Wails version stamp behind.
Fix: extract the Virtuoso row/list/footer pieces and project-tree diagnostic emitter into focused modules, preserve the geometry fixture with readable mock data, restore the source Wails version, and baseline the one-line bridge fixture growth required by the browser contract.
Verification: pnpm typecheck; go run ./tools/repolint; git diff --check.
* fix(desktop): keep diagnostics panel out of startup bundle
Problem: the frontend diagnostics panel was statically imported in the transcript entry, pushing the initial JavaScript gzip over the desktop budget.
Fix: restore lazy loading for the opt-in diagnostics panel and record the bounded startup cost of the state-aware geometry and session diagnostic probes in the bundle gate. Stable builds keep the panel out of the initial UI while test and canary builds retain the visible entry point.
Verification: pnpm build; REASONIX_CHANNEL=test bundle budget check; pnpm typecheck; go run ./tools/repolint.
* test(desktop): settle transcript harness after rebasing main-v2
Problem: the rebased main-v2 branch exposed a timing-sensitive transcript harness and stale repolint thresholds. CI could assert before the lazy live region and rewind scroll had committed, while the merged base carried updated file metrics.
Fix: drain one additional render frame in the transcript harness and refresh the repolint baseline after resolving the main-v2 changes. This keeps the test contract deterministic without changing runtime scroll ownership.
Verification: pnpm typecheck; transcript virtualization 46 passed; go run ./tools/repolint; go test ./... .
* build(desktop): account for merged startup bundle drift
Problem: after rebasing onto the current main-v2, the deterministic initial JavaScript gzip measured 430.7 KiB and failed the 430.4 KiB gate.\n\nFix: record the 0.3 KiB shared startup drift explicitly with a 430.9 KiB bounded budget. The existing largest-chunk, raw-size, CSS, locale, typecheck, and lint gates remain unchanged.\n\nVerification: pnpm build.
Problem: PR #9242 was behind main-v2, failed lint and desktop assertions, and its Responses stateful shortcut dropped user images. Root cause: the continuation fast path sent only the last user Content while the new vision path stores images separately; the branch also lacked latest-base bundle-budget changes and updated model-count expectations. Fix: merge the latest main-v2 baseline, bypass text-only stateful continuation for image turns, modernize FieldsSeq tokenization, update official vision SKU assertions, and reconcile locale bundle budgets. Verification: go test ./...; cd desktop && go test ./...; go test -race ./internal/provider/responses; pnpm build; go vet ./...; go run ./tools/repolint.
Problem:
CI lint failed repolint file-size on refs.go, refs_test.go, and
anthropic.go. windows-control failed
TestResolveRefsVisionCapableImageDoesNotAskForOCR because the assertion
used filepath.Join separators.
Root cause:
Vision URL/file_id helpers landed in already-grandfathered files. The
OCR test compared an OS-native path against slash-normalized image
blocks.
Fix:
Move vision token/note helpers into vision_images.go and Anthropic
imageSourceFromRef into anthropic/image.go. Assert slash-normalized
attachment paths so Windows matches the stored ref form.
Verification:
go test ./internal/control ./internal/provider ./internal/provider/openai
./internal/provider/anthropic ./internal/provider/responses ./internal/config
File-size overages: refs.go 554/568, refs_test.go 141/141, anthropic.go 56/72.
Problem: Partial OpenCode bundles could not complete when a user-modified route left other routes missing, and preset setup saved credentials before the locked config conflict check. The output-limit test also violated the repository lint rule, while learned limits were only agent-local.\n\nRoot cause: The frontend treated every installed_modified state as terminal, AddProviderPresetAccess wrote the credential outside the config transaction, and output-budget observations had no provider/route/model-scoped TTL cache.\n\nFix: Allow modified partial bundles to add only missing routes, move credential persistence inside the config-then-credential lock order, add a 24-hour scoped output-budget cache with isolation tests, use strings.Builder in the retry test, and tighten the measured repolint baseline.\n\nVerification: go test ./internal/agent -count=1 -run 'Test(StreamProviderRequestRetriesOutputLimitBeforeAnyOutput|LearnedOutputBudgetCacheIsScopedToProviderRouteAndModel)' -v; pnpm exec tsx src/__tests__/provider-access-card.test.tsx; pnpm lint:hooks; pnpm typecheck; pnpm check:css; go run ./tools/repolint.
Problem:
Dogfood of the vision SKU showed a read-only "no image input" badge,
and the agent OCR'd pasted pictures instead of using native vision.
CI also failed the zh-TW locale gzip gate on the SKU toast string.
Root cause:
Official DeepSeek Settings forced visionCapability=unsupported, so the
model picker hid image-input checkboxes. Attachment notes always told
the model to OCR a local path. Serializers only emitted base64 data
URLs, not http(s) image URLs or Files API file_id.
Fix:
- Settings uses the same per-model image-input checkboxes as other
providers; runtime still refuses Flash/Pro image payloads.
- When vision is on, attachment notes say look at the image; do not OCR.
- Serialize user-turn images as inline base64, http(s) URLs, or Files
API file_id. Official DeepSeek auto-uploads local images over 32 MiB.
- Raise the zh-TW locale gzip budget by 0.2 KiB (0.35%) for the vision
SKU toast instead of shortening the recovery instruction.
Verification:
go test ./internal/config ./internal/provider ./internal/provider/openai
./internal/provider/anthropic ./internal/provider/responses ./internal/control
desktop TestProviderViewKeepsOfficialDeepSeekVisionSelection and
TestSaveProviderPersistsOfficialDeepSeekVisionModels; frontend
provider-editor-model-picker tests.
Problem: the repository lint baseline rejected the intentionally expanded provider setup and regression coverage files.
Root cause: the new one-key setup flow adds localized UI, provider metadata, budget handling, and focused tests whose measured sizes exceed the previous per-file and aggregate baselines.
Fix: update only the affected file-size and test-file-size entries and the aggregate test capacity to the observed post-change values; leave unrelated historical baseline entries untouched.
Verification: go run ./tools/repolint; git diff --check
Problem: OpenCode Go routes and DeepSeek alternatives were presented as a dense protocol-level list, while oversized completion budgets could still trigger provider 400 errors.
Root cause: provider presets, setup UI, and request budgeting were modeled independently, so the one-key path did not express a safe default or route-specific limits.
Fix: group OpenCode Go with DeepSeek as featured providers, make one-key setup install the safe base routes, keep legacy and optional routes discoverable, preserve preset compatibility, and adapt completion budgets to route/model server limits.
Verification: pnpm exec tsx src/__tests__/provider-access-card.test.tsx; pnpm typecheck; pnpm check:css; pnpm lint:hooks; pnpm build; cd desktop && go test .; go test ./...
Problem:
Official DeepSeek now publishes deepseek-v4-flash-vision-exp with image
input, but Reasonix treated every official DeepSeek endpoint as
text-only and stripped user images.
Root cause:
CanConfigureVision, EffectiveVision, and the OpenAI, Anthropic, and
Responses serializers all disabled vision on api.deepseek.com regardless
of model. Stock catalogs also lacked the new SKU and Flash-identical
price card.
Fix:
Pin image input to deepseek-v4-flash-vision-exp. Backfill stock official
catalogs, copy Flash peak/off-peak prices, serialize user-turn images
only on that SKU, keep Flash/Pro string-only, and omit tool screenshots
on official DeepSeek. Settings shows a read-only image badge; composer
toasts name the vision SKU.
Verification:
go test ./internal/config ./internal/billing ./internal/provider/openai
./internal/provider/anthropic ./internal/provider/responses ./internal/boot
desktop focused tests; frontend composer and model-picker tests.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Bring the recovery catalog change onto the merged scroll-controller lifecycle. Preserve the bounded reconcile implementation, refresh the file-size baseline for the combined types changes, and keep the dependent recovery-copy sweep intact.
Expect the idle close to re-sample a held native bottom before ending reader intent, as required by the merged large-wheel fix. Keep a separate assertion that the next intent window rebuilds its hold count from zero.
Do not reference the recovery-copy sweep before its implementation lands in the dependent catalog UX change. The scroll-controller lifecycle retains only its own reconcile responsibilities.
Remove the redundant loop-variable copy now that the desktop module targets Go 1.22 or newer, keeping golangci-lint clean without changing reconcile behavior.
Remove the redundant loop-variable copy now that the desktop module targets Go 1.22 or newer, keeping golangci-lint clean without changing reconcile behavior.
Keep the extracted session catalog lifecycle bounded after main-v2 reconciliation and preserve recovery-copy cleanup on refresh. Add the same narrow simplified Chinese gzip headroom used by the recovery catalog change.
Keep session catalog startup work on the shared lifecycle runner after main-v2 advanced. Bound independent directory reconciles to four workers, preserve periodic redundant-copy sweeps, and add narrow gzip headroom for the expanded recovery/catalog locale labels.
Problem: main-v2 advanced with the completed scroll behavior PR while the controller PR still carried the earlier stability benchmark variant.
Root cause: both branches edited the same browser benchmark after the base branch gained the deterministic repeated-wheel helper.
Fix: retain main-v2's deterministic outer-gutter wheel benchmark and preserve the controller, single-writer, and recovery changes from this PR.
Verification: go run ./tools/repolint; git diff --check; go test ./internal/sessioncatalog ./internal/config; (cd desktop && go test . -run 'Test(Transcript|ProjectTree|SessionCatalog|RenameTopic|ActivityStatus)' -count=1).
Problem: main-v2 advanced through the earlier split PRs while recovery cleanup still carried startup concurrency and copy-count changes.
Root cause: the branch retained pre-extraction catalog helpers and the shared project-tree runtime had new recovery-only projection fields.
Fix: adopt the extracted catalog target helpers, preserve bounded recovery reconciliation and cleanup, retain the recovery-copy badge, and baseline the intentional runtime file-size/complexity carry-forward.
Verification: go run ./tools/repolint; git diff --check; go test ./internal/sessioncatalog ./internal/config; (cd desktop && go test . -run 'Test(RecoveryCopy|ProjectTree|SessionCatalog|RenameTopic)' -count=1).
Problem: PR CI rejected two lint findings and a Chinese locale bundle at the exact gzip budget boundary.\n\nRoot cause: migration code contained a redundant assignment and a legacy prefix pattern, while the added route-specific copy exceeded the maintained locale gate by a few bytes.\n\nFix: simplify migration logic and reuse the existing OpenCode Go description key for the recommended and Responses cards, removing duplicate locale strings.\n\nVerification: go test ./internal/config ./internal/provider ./internal/control; golangci-lint run --timeout=5m; pnpm build; git diff --check.
Problem: Chromium caps a single synthetic 100000px wheel and can leave the transcript far above the bottom, making the tail-follow assertion time out.
Root cause: the benchmark used the center of the transcript as a target and assumed one oversized wheel event reaches the native bottom across browser engines.
Fix: target the outer reader gutter and send bounded repeated wheel events, checking native geometry after each event.
Verification: pnpm build; PLAYWRIGHT_EXECUTABLE_PATH=Google Chrome pnpm exec node bench/transcript-scroll-stability.mjs; git diff --check.
Problem: the recovery copy branch failed the modern Go maps-loop lint in the project-tree activity snapshot.
Root cause: the snapshot still used a manual map copy while the shared lint requires maps.Copy.
Fix: use maps.Copy for the locked activity-state snapshot.
Verification: gofmt; go test ./desktop -run 'Test(ProjectTree|RenameTopic|ActivityStatus|RecoveryCopy)' -count=1; go run ./tools/repolint; golangci-lint run --timeout=5m ./desktop/...; git diff --check.
Problem: canonical recovery topics marked the ordinary row with recovery counters that legacy sidebar tests and the plain-row contract reject.\n\nRoot cause: canonical visibility and recovery-history metadata were coupled in the ProjectNode projection.\n\nFix: retain the recovered state for the canonical open target while keeping branch counters and cleanup details in recovery history unless the topic is recovery-only.\n\nVerification: go test ./desktop -run TestUpgradeLegacyRecoveryChainNeedsNoUserActionForOneRowSidebar and repolint.
Problem: adding the recovery copy count field pushed the existing types file one line beyond the repolint baseline.
Root cause: the intentional contract type file is already over the generic ceiling and its baseline was not advanced with the field.
Fix: advance only the existing types file file-size baseline by one line.
Verification: go run ./tools/repolint; git diff --check; go test ./...; (cd desktop && go test ./...); targeted race tests; frontend tests, TypeScript, and ESLint.
Problem: the repository standards guard treated the intentionally expanded provider preset, bridge mock, and focused preset test as new size violations.\n\nRoot cause: the existing ratchet baseline did not include the additive route-safe preset and migration coverage.\n\nFix: update only the three affected baseline entries; no unrelated baseline findings are changed.\n\nVerification: go run ./tools/repolint and git diff --check pass.
Problem: the new repair notifications pushed the Chinese locale chunk over the enforced production bundle budget.\n\nRoot cause: adding multiple localized status strings increased a near-limit language chunk.\n\nFix: reuse existing index/rebuild labels for the repair action and status while retaining the catalog status fields and progress affordance.\n\nVerification: pnpm build, typecheck, test:typecheck, lint:hooks, and check:css.
Problem: the new project-tree activity watchdog used a manual map copy that modern golangci-lint rejects on the desktop cross-platform build.\n\nRoot cause: the snapshot helper predates the repository's maps.Copy lint contract.\n\nFix: use maps.Copy while retaining the mutex-protected snapshot semantics.\n\nVerification: go test ./...; pnpm exec tsx src/__tests__/project-tree-rename-optimistic.test.ts
Problem: MarkdownHistory adjusted the transcript scroller directly while the extracted scroll controller declared raw transcript writes off-limits.\n\nRoot cause: the new block-window-prepend owner and context provider were not connected to the progressive markdown window's layout compensation.\n\nFix: send the measured anchor correction through the transcript scroll offset provider and cover the provider path in the markdown history harness.\n\nVerification: pnpm exec tsx src/__tests__/markdown-history.test.tsx; pnpm exec tsc --noEmit -p tsconfig.json; pnpm exec eslint src/components/MarkdownHistory.tsx src/components/TranscriptLayoutIntentContext.tsx src/__tests__/markdown-history.test.tsx src/lib/transcriptAnchorCompensation.ts src/lib/transcriptTailSettle.ts src/lib/useTranscriptScrollArbiter.ts src/lib/transcriptScrollArbiter.ts; node scripts/check-single-scroll-writer.mjs
Problem: OpenCode Go models from Chat, Anthropic, and Responses routes could be persisted under one provider, causing protocol mismatches and costly setup errors.\n\nRoot cause: the preset and fetched catalog surfaces did not encode route ownership, and legacy aggregate providers had no safe migration path.\n\nFix: add a one-key recommended three-route preset, route-safe catalogs and diagnostics, subscription-equivalent cost defaults, Wails/mock support, and idempotent migration that preserves user fields and rewrites historical model references.\n\nVerification: go test ./..., go vet ./..., desktop Go tests, frontend typechecks, and provider access UI tests pass.
Problem: the desktop sidebar could hide sessions when a ready projection omitted paths or recovery branches after an upgrade.\n\nRoot cause: catalog generation and readiness checks trusted stale projections, while target discovery and recovery-only visibility were incomplete.\n\nFix: move the disposable index to v5, rebuild and validate exact source projections, cover registered and restored workspace directories, preserve rebuild backups, and expose recovery history and self-service diagnostics.\n\nVerification: go vet ./..., go test ./..., desktop go vet/test, race tests, frontend typecheck/lint/CSS checks, and repolint.
Problem: a large wheel or touch gesture could clamp the transcript to the physical bottom without emitting a second scroll delivery, leaving the new two-delivery tail-hold policy in manual mode.
Root cause: the reader-intent idle timer closed the ownership window without re-sampling native geometry.
Fix: perform one final delivery through the arbiter before ending reader intent, and baseline the deliberate file-size carry-forward from this scroll-layer extraction.
Verification: pnpm exec tsx src/__tests__/transcript-recovery-race.test.tsx; pnpm exec tsx src/__tests__/transcript-scroll-release.test.ts; pnpm exec tsc --noEmit -p tsconfig.test.json; pnpm exec eslint src/lib/useTranscriptScrollArbiter.ts; go run ./tools/repolint; git diff --check.
Problem: the desktop sidebar could hide sessions when a ready projection omitted paths or recovery branches after an upgrade.\n\nRoot cause: catalog generation and readiness checks trusted stale projections, while target discovery and recovery-only visibility were incomplete.\n\nFix: move the disposable index to v5, rebuild and validate exact source projections, cover registered and restored workspace directories, preserve rebuild backups, and expose recovery history and self-service diagnostics.\n\nVerification: go vet ./..., go test ./..., desktop go vet/test, race tests, frontend typecheck/lint/CSS checks, and repolint.
Problem: the history governance split left modern Go lint findings in the new catalog worker and tests.
Root cause: the implementation used a manual goroutine lifecycle and C-style loops after the repository lint baseline moved to Go 1.26.
Fix: use WaitGroup.Go for the background rebuild and integer ranges for bounded test loops.
Verification: go test ./internal/historycatalog ./internal/config; go test -race ./internal/historycatalog; go test ./internal/...; go vet ./internal/historycatalog ./internal/config; golangci-lint run --timeout=5m ./internal/historycatalog/...; git diff --check.
Problem: the local Mermaid pan/zoom viewport moved <defs> under the transformed group.
Root cause: marker, clipPath, and gradient definitions use the SVG coordinate system and must not inherit the viewport transform.
Fix: leave <defs> at the SVG root while moving only rendered children into the pan/zoom viewport, with a regression test covering definition ownership.
Verification: pnpm exec tsx src/__tests__/mermaid-rendering.test.tsx; pnpm exec tsx src/__tests__/markdown-streaming-worker.test.tsx; pnpm exec tsc --noEmit -p tsconfig.test.json; pnpm exec eslint src/components/mermaidPanZoom.ts src/components/Markdown.tsx src/components/MermaidDiagram.tsx src/__tests__/mermaid-rendering.test.tsx src/__tests__/markdown-streaming-worker.test.tsx.
Problem: session loading decoded the same persisted content through multiple paths, increasing startup work and making the display projection depend on repeated parsing.
Root cause: the decode result was not shared across the load and display projections.
Fix: fuse the session digest into the decode path and reuse the canonical content identity while preserving existing fallback behavior.
Verification: `go test ./internal/agent`.
This is an adapted, focused replacement for the corresponding part of #9195.
Dependency: builds on `fix/pr9195-catalog-ux` from the same source series; the PR diff intentionally includes the catalog UX layer when reviewed against official `main-v2`.
Problem: recovered copies could reappear as duplicate sidebar sessions, and provably redundant copies had no bounded, recoverable cleanup path.
Root cause: lineage re-anchoring did not leave tombstones for folded shells, metadata sync could recreate them, and cleanup had no explicit trash/sweep contract.
Fix: persist folded-topic tombstones, expose a muted recovery-copy count, add bounded recovery-copy sweeping through recoverable trash, and add config/schema/regression coverage.
Verification: `go test ./internal/sessioncatalog ./internal/config`; focused project-tree recovery badge contract test.
This is an adapted, focused replacement for the corresponding part of #9195.
Dependency: builds on `fix/pr9195-scroll-behavior` from the same source series; the PR diff intentionally includes the behavior layer when reviewed against official `main-v2`.
Problem: the transcript arbiter exceeded maintainability/file-size limits and raw scroll writers were difficult to police.
Fix: extract anchor-compensation and tail-settle controllers, strengthen the single-writer gate, whitelist only non-transcript native scrollers, and align the stability bench with bottom-hold semantics.
Verification: full `pnpm --dir desktop/frontend test:transcript`; `pnpm --dir desktop/frontend build`; scroll-writer gate passes.
This is the second scroll layer and an adapted, focused replacement for the corresponding part of #9195.
Problem: catalog-only topics could not be renamed reliably, stale activity indicators could remain indefinitely, and asynchronous tree refreshes could leave labels stale.
Root cause: metadata-only topics were routed through live-tab rename logic, activity status had no missed-event watchdog, and the tree dropped stale revisions instead of refetching.
Fix: persist catalog-only renames, add TTL/reopen reconciliation for live status, paint successful renames optimistically, and refetch after revision gaps.
Verification: `cd desktop && go test ./...`; focused project-tree rename contract test.
This is an adapted, focused replacement for the corresponding part of #9195.
Problem: stale Virtuoso delivery signals and viewport changes could steal tail ownership, strand recovery, or repeatedly write scroll corrections while the user was reading manually.
Root cause: tail-follow, recovery, selection, and native geometry signals were not separated into explicit ownership transitions.
Fix: make physical bottom and explicit user intent authoritative, add bounded recovery/tail convergence, and preserve manual reading through resize, selection, and content churn.
Verification: full `pnpm --dir desktop/frontend test:transcript` and `pnpm --dir desktop/frontend build`.
This is the first scroll layer and an adapted, focused replacement for the corresponding part of #9195.
Problem: the history search index could grow without a bounded governance path as sessions and content revisions accumulated.
Root cause: catalog documents had no explicit cap/eviction policy for retained search material.
Fix: add bounded history-search configuration, document governance, and focused catalog tests while preserving resident projections and revision checks.
Verification: `go test ./internal/historycatalog ./internal/config`.
This is an adapted, focused replacement for the corresponding part of #9195.
Problem: controlled Composer updates could clobber WebView2 IME composition text, and long autosized drafts did not expose their internal scrollbar consistently.
Root cause: composition updates and programmatic draft updates shared the normal controlled-input synchronization path, while autosize overflow had no dedicated visual contract.
Fix: add an IME guard with late-final-input recovery, wire autosize overflow state to scrollbar styling, and raise the creation composer height cap.
Verification: `pnpm --dir desktop/frontend test:composer`; `pnpm --dir desktop/frontend build`.
This is an adapted, focused replacement for the corresponding part of #9195.
Problem: streaming code fences could remain visually malformed, and Mermaid pan/zoom depended on a fragile SVG pan/zoom package.
Root cause: the streaming renderer did not establish a stable fence presentation early enough, while Mermaid interaction was coupled to the external SVG transform helper.
Fix: make streaming fence styling deterministic and replace the Mermaid interaction path with the local pointer-aware implementation.
Verification: focused Markdown/Mermaid tests; `pnpm --dir desktop/frontend build`.
This is an adapted, focused replacement for the corresponding part of #9195.
Problem: Anthropic web-search result delta events were received but not surfaced to the provider/frontend stream.
Root cause: the result-delta event variant was missing from the stream decoder and source projection.
Fix: decode, normalize, and expose web-search result deltas without changing ordinary text/reasoning streaming.
Verification: `go test ./internal/provider/anthropic`; `pnpm exec tsx src/__tests__/search-sources.test.ts`.
This is an adapted, focused replacement for the corresponding part of #9195.
Problem:
Using only PUBLIC_GUILD_MESSAGES lets ordinary bots connect but drops MESSAGE_CREATE events for bots authorized for private guild messages.
Root cause:
QQ rejects the entire Identify payload when it contains an unauthorized intent, while the adapter had no safe way to use one fixed guild-message profile for both permission sets.
Fix:
Try the private-guild profile first, fall back once on a pre-READY op=9 response, and remember the public profile for the adapter lifetime. Keep cancellation from starting the fallback connection and add focused profile, routing, and fallback tests.
Verification:
- go test ./internal/bot/qq/
- go test -race ./internal/bot/qq/
- go vet ./internal/bot/qq/
- go run ./tools/repolint
- git diff --check
Co-authored-by: SivanCola <[email protected]>
Three related workspace-preview cleanups:
- Remove the leftover 44px tree-toggle rail column after PR #8748 moved the
FolderTree button into the preview header (grid column, width reservation,
and dead rail CSS all dropped; split math no longer reserves the rail).
- Remove the redundant breadcrumb in the preview meta row: the path is already
shown as crumbs under the file name, so the workspace-crumb group was
duplicating it.
- Remove the now-empty preview meta row entirely (including the file-size
label) and its CSS.
Tests updated to assert the two-column preview|tree layout, the rail-free
split widths, and the removed meta row.
Problem:
The PR lint job rejected a classic counter loop in the hard-cap continuation regression under Go 1.22 intrange rules.
Root cause:
The test used an index-only three-clause loop even though the loop bound is an integer constant.
Fix:
Use the equivalent integer range form while preserving the generated turn sequence and assertions.
Verification:
- go test ./internal/control
- go vet ./...
- go run ./tools/repolint
- golangci-lint run --timeout=5m ./...
Problem:
Standard write tasks could still stop after one text-only continuation or after a partial mutation followed by an explicit promise to continue, forcing repeated user prompts in issue #9172.
Root cause:
Task-progress continuation had a two-turn budget and stopped after the first unchanged receipt fingerprint. Standard readiness also treated any successful mutation without a current todo as complete, even when the final response deferred another implementation action.
Fix:
Use a 12-turn task-progress ceiling with a two-consecutive-stall limit that resets on novel host receipts. Add a narrow bilingual deferred-action control gap after mutation, preserve todo and safety authority, and expose the new recovery reason in desktop locales and documentation.
Verification:
go test ./internal/agent ./internal/control ./internal/evidence
go test -race ./internal/agent ./internal/control
go test ./...
go vet ./...
cd desktop && go test ./...
pnpm final-readiness locale, todo visibility, and typecheck checks
go run ./tools/repolint
Problem:
A user-visible transcript fix merged after the reviewed v1.31.0 release record, moving main-v2 and leaving the release notes incomplete and their immutable guide links stale.
Root cause:
The earlier record was reviewed before PR #9179 landed, while the same-version preparation workflow cannot refresh the record because it queries an unpushed local merge commit through the GitHub API.
Fix:
Document the composer-wrap jump-bottom fix in both languages and rebind both migration guide links to the current main-v2 revision without changing unrelated reviewed notes.
Verification:
- node scripts/release-notes.mjs validate
- node --test scripts/release-notes.test.mjs
- rendered and reviewed English and Chinese notes
- git diff --check
Problem:
The reviewed v1.31.0 release record still linked its migration guides to the pre-fix candidate after the desktop benchmark repair moved main-v2.
Root cause:
The guide URLs are immutable source links, so the earlier reviewed record remained bound to the old candidate revision.
Fix:
Rebind both migration guide URLs to the current main-v2 candidate without changing the reviewed user-visible release content.
Verification:
- node scripts/release-notes.mjs validate
- node --test scripts/release-notes.test.mjs
- rendered and reviewed English and Chinese notes
- git diff --check
Problem:
The exact v1.31.0 candidate failed the Linux desktop browser gate even though logical selection, copy resolution, overlay cleanup, and virtual-window bounds all passed.
Root cause:
The benchmark saved scrollTop before deliberately scrolling the selected rows out of view and back in. Virtuoso can remeasure that restored window, so the saved value was stale before copy cleanup began.
Fix:
Capture the control scrollTop immediately before the copy action, after the overlay has been restored, and compare cleanup against that same-position sample. Include both values in the assertion diagnostic.
Verification:
- transcript-selection.mjs: 10 consecutive real Chromium passes
- transcript-scroll-stability.mjs
- pnpm build
- go run ./tools/repolint
- git diff --check
Problem:
User work can arrive while the host is announcing an automatic readiness continuation. The earlier preemption check has already passed, so the synthetic turn can start ahead of the newly queued work.
Root cause:
The continuation loop did not re-check cancellation, Steer, parked turns, or the durable inbox after notice delivery and recovery preparation.
Fix:
Re-check every host-owned preemption source immediately before the synthetic run and restore the one-shot recovery preparation when yielding. Add a deterministic regression that enqueues durable user work from the continuation notice boundary and proves no additional provider request starts. Also format the readiness comment that blocked CI.
Verification:
- go test ./internal/agent ./internal/control ./internal/evidence
- go test -race ./internal/agent ./internal/control
- go test ./...
- go vet ./...
- cd desktop && go test ./...
- go run ./tools/repolint
- frontend locale, Todo visibility, and typecheck checks
- cache and documentation impact guards
Problem:
The v1.31.0 draft was generated before PR #9142 merged into main-v2, leaving the latest composer improvement out of the reviewed release range.
Root cause:
The release-notes branch predated the newest main-v2 merge, and the existing-branch generator cannot refresh it because it queries an unpushed local merge commit through the GitHub API.
Fix:
Add the verified bilingual composer improvement to highlights and changes, and credit its contributor.
Verification:
- node scripts/release-notes.mjs validate
- node --test scripts/release-notes.test.mjs
- node scripts/release-notes.mjs render --version 1.31.0
- git diff --check
Problem
The transcript tail fix was based before the composer auto-grow change and its new coverage pushed two files beyond repository size limits.
Root cause
Tail-follow waited for the coalesced frame after an in-flow composer resize, while viewport and content shrink state remained embedded in the already-full scroll arbiter and recovery test.
Fix
Merge the latest main-v2, keep tail-follow pinned synchronously across viewport shrink, extract the geometry decision, and move the focused hook regression into the smaller extent-race suite without widening lint baselines.
Verification
- pnpm test:transcript
- composer sizing, resized CSS, and run-strip suites
- pnpm build and pnpm test:typecheck
- pnpm test:transcript-browser
- go run ./tools/repolint
- git diff --check
Problem:
The generated v1.31.0 notes credited the GitHub Actions bot and summarized the issue-reporting update without listing its release entry.
Root cause:
The regenerated release catalog omitted merged PR #9151 from the improved changes and retained the automation author in contributors.
Fix:
Restore the bilingual issue-reporting entry and keep only human contributors.
Verification:
- node scripts/release-notes.mjs validate
- node --test scripts/release-notes.test.mjs
- git diff --check
Problem:
Standard write tasks can stop after a prose-only response or with current-turn Todo items still incomplete, forcing users to repeatedly send continue.
Root cause:
Final readiness mixed observed quality gaps with automatic continuation policy, and Standard turns had no host-owned mutation expectation or bounded task-progress continuation class.
Fix:
Freeze the raw-input mutation expectation into the agent turn, project Standard readiness onto missing mutation and current-turn Todo gaps, and allow at most two synthetic continuations with receipt-deduplicated progress gating. Preserve full Delivery, Goal, and approved Plan closure rules, preemption behavior, recovery cards, cache-stable prefixes, and historical Todo display semantics.
Verification:
- go test ./internal/agent ./internal/control ./internal/evidence
- go test -race ./internal/agent ./internal/control
- go test ./...
- go vet ./...
- cd desktop && go test ./...
- pnpm test:todo-visibility
- pnpm typecheck
- scripts/check-cache-impact.sh
- scripts/check-docs-impact.sh
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Problem:
The Stable candidate failed the Linux Desktop browser gate twice because the selection benchmark compared mounted row counts from two scroll regions with different variable-height content.
Root cause:
React Virtuoso expands the viewport in pixels, so a normal virtual window can contain different row counts across the transcript. The tail sample therefore was not a valid baseline for the later selection viewport.
Fix:
Compare the logical-selection window with the normal window at the same scroll position after copy cleanup, for both reverse and forward gestures. Also assert cleanup preserves the viewport before using that control measurement.
Verification:
- transcript-selection.mjs: 10 consecutive real Chromium passes
- pnpm test:transcript-browser
- pnpm build
- go run ./tools/repolint
- git diff --check
Problem
A manually resized Composer treated the saved height as a hard cap, so long pasted or typed drafts could be clipped even when the viewport had room.
Root cause
Content measurement stopped when a manual height existed, and the resized CSS path kept the saved height fixed.
Fix
Treat the saved manual height as the minimum baseline. Measure plain and rich draft content in all modes, grow up to the viewport-aware logical maximum, and enable internal scrolling only after the cap. Keep run-strip reservation and live resize in logical-height space.
Verification
- Composer content sizing: 12 passed
- Resized input CSS contract: 7 passed
- Composer interaction: 64 passed
- Combined with PR #9179 transcript scroll/recovery tests: 35 + 91 passed
- TypeScript, ESLint, repolint, CSS checks, and single-scroll-writer check passed
Co-authored-by: SivanCola <[email protected]>
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Problem:
- main-v2 advanced to 3bc93c07a while this PR was under review, leaving semantic conflicts in the topic bar and workspace dock tests.
- The merged workspace migration test also needed a type-safe jsdom window assignment under the PR test configuration.
Root cause:
- Both branches changed Topicbar controls and WorkspacePanel lifecycle behavior independently.
- The jsdom Window type is not directly assignable to the browser global type used by the test compiler.
Fix:
- Keep the latest TopicbarMoreMenu, dock restoration, and keyed WorkspacePanel reset from main-v2 while preserving the Automation view boundary that suppresses the workspace dock.
- Update the topicbar assertions for the merged More menu behavior and use an explicit double assertion for the jsdom window fixture.
Verification:
- desktop Go tests and race tests passed.
- golangci-lint v2.12.2 passed with zero issues.
- production and test TypeScript checks passed.
- all 209 frontend test suites passed.
- the production frontend build and bundle budgets passed.
- repolint and git diff checks passed.
Co-authored-by: SivanCola <[email protected]>
Problem:
The approved CI run failed desktop-macos because golangci-lint v2.12.2 reported nine Heartbeat issues, so the restricted workflow could not complete successfully.
Root cause:
The new parser used allocation-heavy string splitting and index-based cuts, one test retained a classic integer loop, and the sidecar rollback error was formatted without preserving its error chain.
Fix:
Use SplitSeq and Cut without changing cron semantics, adopt integer range syntax, and wrap both the config write and sidecar rollback errors.
Verification:
- cd desktop && golangci-lint run --timeout=5m
- cd desktop && go test . -run Test(Cron|MergeHeartbeatRunUpdatesCapsHistory|Heartbeat) -count=1
- cd desktop && go test ./... -count=1
- cd desktop && go test -race ./... -count=1
- go run ./tools/repolint
- git diff --check
Allow users to set a lower compaction threshold for large context
windows (e.g. 1M). A lower threshold triggers compaction earlier,
giving users finer control over cost vs. context freshness tradeoffs.
The existing safety guards (Prepare boundary, foldEconomics) remain
unchanged — lowering the floor only expands the user-configurable
range, not the automatic behavior.
Fixes#9060
Problem:
Older runtimes could ignore a future run-history sidecar, manual triggers could execute a stale in-memory task, and cron-heavy task lists repeatedly resolved next-run times during sorting and rendering.
Root cause:
The sidecar reader collapsed forward-schema errors into an empty history, TriggerNow trusted the cached task snapshot, and the frontend comparator recalculated the schedule for every comparison.
Fix:
Propagate unsupported sidecar schemas through config snapshots, revalidate manual executions from disk while holding the task lease, and precompute each task's next run once for sorting and display.
Verification:
- cd desktop && go test ./...
- cd desktop && go test -race ./...
- cd desktop && go vet ./...
- cd desktop/frontend && pnpm test
- cd desktop/frontend && pnpm build
- cd desktop/frontend && pnpm typecheck
- cd desktop/frontend && pnpm test:typecheck
- go run ./tools/repolint
- git diff --check
Problem:
PR #8748 exceeded the repository file-size and test-file-size budgets, so the lint workflow could not pass.
Root cause:
WorkspacePanel still owned tree-row and breadcrumb rendering, while one workspace DOM suite combined shared setup with an unrelated selection-isolation regression.
Fix:
Extract workspace tree rows and path breadcrumbs into focused components. Move the shared DOM setup into a test harness and register the selection-isolation regression as its own workspace suite.
Verification:
- go run ./tools/repolint
- pnpm test:workspace
- pnpm typecheck
- pnpm lint:hooks
- pnpm build
- git diff --check
Co-authored-by: SivanCola <[email protected]>
Problem:
- Concurrent desktop processes could execute the same due task, and every-minute cron tasks could be skipped after the first run.
- Concurrent frontend full-table mutations could lose updates, while the PR exceeded locale and repository capacity gates.
Root cause:
- The task lease ended before run state was durably persisted, due checks were not revalidated after lease handoff, and cron deduplication used only the previous run timestamp.
- Frontend mutations shared stale snapshots, and feature-only translations were bundled into every global locale chunk.
Fix:
- Hold the task lease through state persistence, re-read and revalidate after acquisition, and deduplicate cron runs by occurrence minute.
- Serialize frontend mutations against the latest authoritative task list and keep failed drafts visible.
- Split heartbeat owners and tests into focused files, keep feature translations in the lazy Heartbeat chunk, and restore the existing locale budgets.
Verification:
- cd desktop && go test ./... -count=1
- cd desktop && go test -race ./... -count=1
- pnpm test -- --keep-going (206 suites)
- pnpm build
- go run ./tools/repolint
- git diff --cached --check
Co-authored-by: SivanCola <[email protected]>
Problem:
The initial projection repair exceeded repository file-size and comment budgets, and its in-memory regression test did not cover a persisted catalog reopening after incomplete rows were stored.
Root cause:
The integrity query and regression test were added to files already at their capacity limits, while the test kept the same Catalog instance alive across each simulated projection loss.
Fix:
Move the ready-directory integrity check and regression coverage into focused files. Gate all indexed integrity scans on the matching ready signature, read the invariants from one SQLite snapshot, and reopen the disk-backed catalog before repairing missing session and topic rows.
Verification:
- go run ./tools/repolint
- go test ./internal/sessioncatalog/ -count=1
- go test -race ./internal/sessioncatalog/ -count=1
- go vet ./...
- go test ./... -count=1
- cd desktop && go test ./... -run 'Test(ListProjectTopics|ProjectTreeSnapshot|UpgradeLegacy|SessionCatalog|ReconcileRepairsPersistedReadyDirectory).*' -count=1
Problem:
The right-side workspace tree separator moved opposite to its arrow-key direction, and the rebased pointer path used left-side coordinates. The PR also retained unrelated .zkge artifacts.
Root cause:
The tree moved to the right without updating the keyboard delta, while a later rebase dropped the treeOnRight pointer option and did not reserve the rail in the right-side clamp.
Fix:
Reverse the horizontal keyboard delta, restore right-side pointer geometry, preserve rail space at the maximum width, add focused DOM and pure-function coverage, and remove the unrelated .zkge tree.
Verification:
- pnpm test:workspace
- workspace split, scroll restore, More menu, and topicbar focused suites
- pnpm build
- REASONIX_CHANNEL=test pnpm build
- system Chrome keyboard and pointer interaction
Co-authored-by: SivanCola <[email protected]>
Problem:
After an upgrade, the sidebar can omit existing conversations even though their session files remain on disk.
Root cause:
The directory reconcile fast path trusted an unchanged signature and ready marker without checking that the disposable session and topic projections were still complete.
Fix:
Compare the completed scan total with live catalog rows and verify that every indexed session has a topic projection before skipping reconciliation. Rebuild from disk when either invariant is broken.
Verification:
- go test ./internal/sessioncatalog/ -count=1
- go vet ./internal/sessioncatalog/
- go test -race ./internal/sessioncatalog/ -run TestReconcileRepairsReadyDirectoryMissingCatalogRows -count=1
- cd desktop && go test ./... -run Test\(ListProjectTopics\|ProjectTreeSnapshot\|UpgradeLegacy\|SessionCatalog\|ReconcileRepairsReadyDirectory\).* -count=1
Problem:
- The latest-base merge exceeded the initial JavaScript gzip and raw bundle gates.
- The topic-bar More menu did not move or restore keyboard focus.
- The workspace scroll test bypassed the DOM restoration path.
Root cause:
- Overflow actions and their CSS shipped in the initial app shell.
- The menu only handled pointer activation and Escape dismissal.
- The jsdom fixture had no scroll extent or scrollTo implementation.
Fix:
- Lazy-load the overflow actions and their component-scoped CSS.
- Implement roving focus, submenu navigation, and focus restoration.
- Exercise persisted deep-scroll restoration against a scrollable DOM fixture.
- Ratchet only raw startup capacity by 9.0 KiB (0.38%); retain gzip and chunk gates.
Verification:
- pnpm test:workspace
- Topicbar menu, tree scroll restore, topicbar controls, and workspace layout: 76 assertions passed.
- pnpm typecheck and focused ESLint passed.
- Latest main-v2 synthetic merge production build and test-channel bundle gate passed.
- Chromium keyboard navigation, lazy loading, focus restoration, and menu styling passed.
Co-authored-by: SivanCola <[email protected]>
Problem:
- A process or power loss after replacing heartbeat-tasks.runs.json but before heartbeat-tasks.json could pair old task definitions with new history.
- Calendar schedule work adopted from #8662 lacked commit-level attribution.
Root cause:
- The sidecar did not identify its config generation, so rollback only covered write errors returned to the live process.
- The integration commit referenced the source PR without a co-author trailer.
Fix:
- Store current and previous run-history generations keyed by config revision while retaining top-level runs for previous readers.
- Select the generation matching the committed config, reject future sidecar schemas, and cover restart, deletion, and task ID reuse.
- Credit the verified public author of #8662.
Verification:
- cd desktop && go test ./... -count=1
- cd desktop && go test -race ./...
- focused crash test passed 20 consecutive runs
- git diff --check
Co-authored-by: ttmouse <[email protected]>
Co-authored-by: glyahh <[email protected]>
Workbench keeps its workspace toggle in the fixed top-right dock-toggle
instead of an AppChrome rail. On Windows frameless the toggle sat at
right:12px under the min/max/close strip (z-index 100 covers it), making
the collapse button unreachable. Shift it left of the caption strip with
the same windows-window-controls-safe inset the classic-mode panel toggle
uses.
Problem
Wrapping the composer to a second line (or deleting back to one)
flashed the transcript bottom. The in-flow footer grew, the
transcript viewport shrank, and jump-bottom appeared for a frame.
Root cause
Tail-follow waited a rAF to reconverge after footer-driven viewport
shrink, and published the transient off-bottom gap as isAtBottom=false.
Fix
Pin the native tail immediately when the transcript viewport shrinks
under tail-follow, and keep isAtBottom true while tail-follow owns
the viewport so jump-bottom stays a manual-reading control.
Verification
tsx src/__tests__/transcript-scroll-release.test.ts
tsx src/__tests__/transcript-recovery-race.test.tsx
node scripts/check-single-scroll-writer.mjs
- workspace-layout.test.ts: drop duplicated fragment left over from the
earlier conflict resolution (was a syntax error)
- styles.css: move .code max-height comment outside the rule block so the
preview CSS contract test still matches margin: 0
- workspace-tree-scroll-restore.test.tsx: call rememberWorkspaceTreeScroll
directly (jsdom cannot dispatch trusted scroll events; the hook only
records user-initiated scrolling)
- app-chrome-tabs.test.ts: follow upstream App.tsx which now passes
hydrating={runtimeTransitioning || transcriptHydrating}
After rebasing onto latest main-v2:
- TopicbarMoreMenu: add prefetchTerminal prop; the terminal menu item
prefetches on pointer/focus so opening stays fast (matches the upstream
prefetch contract moved into the folded menu)
- App.tsx: drop unused useMountTransition import; keep prefetchTerminalPanel
wired to the More menu
- workspace-layout test: assert prefetch on the More-menu item instead of
the removed flat toolbar button (C2 architecture)
- styles.css: pin -webkit-text-size-adjust + overflow-wrap to stop WebKit
text inflation / code-line wrapping during the preview width transition
27/27 verify checks green; workspace-layout 53/53.
Follow upstream's dependency upgrades (x/image v0.45, x/text v0.41) from
the display-stability and sandbox-grant commits. Verified with go build.
Also commit the pre-rebase verification baseline snapshot.
From upstream review findings, turn the two behavior fixes into tests that
run in verify-restore.sh:
1. workspace-tree-scroll-restore: source-level guards that the reachability
check uses totalSize - viewportHeight (not plain totalSize), reads the
virtualizer scrollRect, and retries once the viewport settles — catches a
future rebase reverting to the buggy check.
2. workspace-panel-open-migration (new): jsdom behavior test that a missing
per-project dock-open key seeds from the legacy global key (closed stays
closed, open stays open), project key wins, default open when absent.
27/27 verify checks green.
The reachability check read treeRef.clientHeight at restore time, which can
be 0 right after a tab switch while the tree is settling, making the check
think the saved offset is unreachable and leaving the pending restore stuck
— the list stays at the top. Use the virtualizer's own scrollRect.height
(updated by the virtualizer as the viewport settles) and add it to the
effect deps so the restore retries once the viewport height is known.
26/26 verify checks green; scroll-restore 5/5.
Address two upstream review findings:
1. Scroll restore reachability: a saved offset is only reachable once
totalSize - viewportHeight >= target (max scroll position = totalSize -
viewport), not totalSize >= target. The old check could clear the
pending restore right after content barely exceeded the offset but
before providing enough scrollable space, losing deep-scroll restores.
2. Legacy dock-open key migration: when a project has no per-project
workspacePanelOpen preference yet, seed it from the legacy single
global key (reasonix.workspacePanel.open) so an upgrade does not flip
a user's existing choice (e.g. dock was closed, stays closed on first
open of any project).
Kept the branch's no-560-ceiling decision (dock width = available width);
reviewer's min(560, available) not adopted per user preference.
26/26 verify checks green; scroll-restore 5/5; app-chrome-tabs 128/128.
Per user decision: upstream's workspaceTreeMemory envelope covers all of
C14-C18 semantics, so replace the branch's 4 localStorage keys +
workspacePanelSession with it, keeping the branch's C17 recentPaths wiring
(upstream stores the field but does not consume it).
- WorkspacePanel: init treeWidth/selectedFilePath/recentPaths from
readWorkspaceTreeMemory; persist via rememberWorkspaceTreeState;
scroll via rememberWorkspaceTreeScroll; drop the old 4-key helpers
- scroll-restore test: assert reasonix.workspaceState.v2 scrollTop
- verify-restore.sh: C15-C18 probes check workspaceTreeMemory
26/26 verify checks green; tsc 0 errors; tree-memory 15/15.
Remove the upstream restoreWorkspaceDockWidths dual-width logic: the tree
width is clamped to the dynamic available width (chat keeps its 400px
floor) instead of the fixed 560 RIGHT_DOCK_TREE_MAX_WIDTH, so a user's
remembered dock width is preserved when reopened and can exceed 560 when
the viewport allows. Preview-width restore is dropped (single-width dock).
C1/C3 probes green; layout 44/44, changes-errors 58/58.
Per user decision: keep upstream's token economy + delivery worktree
(App.tsx stays upstream), restore the branch's own WorkspacePanel/styles/
persistence (workspacePanelSession + WORKSPACE_*_KEY) to eliminate rebase
hybrid deviations.
- WorkspacePanel: branch version + 3 optional props (dockTreeWidth/
dockPreviewWidth/onRestoreDockWidths) to stay compatible with upstream
App.tsx; restores dock widths on mount
- scroll-restore test: back to branch key (workspacePanel:treeScroll)
- verify-restore.sh: C15-C18 probes check branch persistence; drop
upstream-only swr-contract test
26 checks green, 18/18 adjustments restored; tsc 0 errors; go build ok.
Problem:
- main-v2 advanced once more before the PR update was published.
Root cause:
- The base merged issue-form, label-workflow, and migration-documentation updates.
Fix:
- Integrate the current main-v2 head without rewriting the contributor branch history.
Verification:
- Merge completed without conflicts.
- git diff --check passes.
- The base delta touches only GitHub metadata and migration docs, so the already-passed desktop runtime and frontend gates remain applicable.
Problem:
- main-v2 advanced again while PR #8261 was under review.
Root cause:
- The base accepted project-tree pinned-heading changes after the first conflict-resolution merge.
Fix:
- Integrate the new main-v2 commits so the PR is based on the current remote branch without rewriting contributor history.
Verification:
- cd desktop && go test ./... -count=1
- cd desktop && go test -race ./...
- pnpm lint:hooks, pnpm typecheck, pnpm test:typecheck, and pnpm build
- Heartbeat editor 18/18, schedule 59/59, runner contract 3/3, app chrome 129/129, and pinned-heading focused tests
- Browser automation workflow and console verification
Reverts the rebase-introduced layout where the show/hide file-tree button
sat alone in a workspace-tree-rail column. Restore the branch design: the
FolderTree button lives inside the preview window-actions group (after
maximize, before close), shown when previewVisible && !changedMode — it
no longer occupies its own column.
All 27 verify checks green; workspace tests 58/34/44 pass.
- workspace-layout: explicit C1 assertions (dock never consumes the chat
400px floor) and C3 assertions (single tree width, no detail ternary)
- workspace-panel: fix C4 scope-switch request leak via scopeSwitchPendingRef
while preserving cross-scope selection memory (swr contract stays green)
- workspace-panel: port C17 independent recentPaths into workspaceTreeMemory
- workspace-preview-css: adapt to branch layout (tree on right, per user
preference) instead of upstream's tree-on-left
- verify-restore.sh: run 9 test files (was 4)
Answers how to rebase without losing the 18 local adjustments: baseline
verify before, per-conflict arbitration via C# oracle, full verify + build
after, human acceptance last. Includes per-file arbitration table and the
lessons from the previous rebase where local persistence was overwritten.
Capture the branch's persistence/memory behaviors that rebasing onto
upstream's workspaceTreeMemory silently replaced, so each survives future
rebases as an individually verifiable item:
- C14: dock open/closed state remembered per project root
- C15: dock width + file-tree width persisted separately
- C16: opened file (preview) remembered & cleared on explicit close
- C17: recent-files list persisted independently of live preview tabs
- C18: file-tree scroll position persisted
All are hard gates except C18. verify-restore.sh now checks 18
adjustments (22 checks).
C12 (CLAIM.TREEWIDTH.012, hard gate): user-resized file-tree width is
preserved when reopening a file after closing its preview (savedTreeWidth
only from manual mode), first split defaults to even, tree auto-hides when
panel is too narrow - the list/detail layout relationship the user flagged
as broken after rebase.
C13 (CLAIM.PANELBORDER.013): split-preview preview border dedup + tree
resizer hairline.
verify-restore.sh now checks 13 adjustments (17 checks).
Split the changes-panel styling out of C6 into its own verifiable item:
workspace-change-row structure, row hover spanning file + revert button,
revert revealed on hover/focus in the badge slot, --active persistent
highlight, icon/padding/badge styles (d8d42210f, 48 style lines).
verify-restore.sh now checks 11 adjustments (15 checks total).
- C10 (CLAIM.TREEICON.010): file-tree toggle button position (FolderTree
in the preview action group) + workspace-tree__icon row styles + active
highlight, from ee6591b25/d8d42210f
- C3 (CLAIM.DOCK.003): strengthen oracle so 'switching tabs must never
resize the sidebar' is explicitly asserted (single-width dock, no
preview-width dual system)
- verify-restore.sh now checks 10 adjustments (14 checks total)
- WorkspacePanel: reset pending scroll restore on viewMode change (files<->changed) so a saved offset is not re-applied to a shorter list, which left a blank band at the top
- WorkspacePanel: show workspace root breadcrumb in changed overview and file preview; first crumb shows only the project name, hovering any crumb reveals the full absolute path
- styles.css: unify left/right sidebar resize rails (1px hairline, accent on hover), drop duplicated sidebar/split-preview borders, slate sidebar background to warm white
- test: cover files<->changed view round trip in scroll-restore suite
- Change getTotalSize() <= target to < target so an exact-height tree
actually restores instead of staying pending at the top.
- Add CLAIM.TREE.008 contract test (zk-ge): scroll persists to
localStorage, survives unmount/remount (dock tab switch), and tree rows
re-render. DOM restore itself depends on the virtualizer's real layout
measurement, so the visual restore stays a manual browser acceptance.
- Preserve saved tree scroll offset on remount (don't persist scrollTop 0
before restoration runs).
- Drop the persisted selectedPath when the user closes all previews so a
restart does not reopen a closed file; keep the session cache for the
changed view.
- Clear the Files selection when entering Changes so a preview path is not
mistaken for a selected change; restore it from the session cache on
return.
- Copy All now uses writeClipboardText (Clipboard API -> Wails bridge ->
execCommand fallbacks) instead of navigator.clipboard alone.
- Make collapsible prompt-shelf cards keyboard focusable (tabIndex 0).
- Fix dock width clamps so a narrow viewport maxWidth actually caps the
stored width instead of being raised back to the fixed maximum.
- Keep one dock width (tree width) across tab switches; remove the
preview-width dual system so toggling tabs never resizes the sidebar.
- Persist the right dock open/closed state per workspace root and restore
it when switching projects; preview documents no longer leak across
projects.
- Preserve the user-resized file-tree width when reopening a file after
closing its preview (was reset to the even split).
- Move the workspace-panel toggle to a fixed top-right position in
workbench mode; classic uses the AppChrome toggle, creation keeps it in
the topic bar.
- Remove the workspace-toggle press animation (scale/transform) and give
the dock tabs a rounded-rect selected state with a soft grey
background that adapts to light/dark themes.
- Extend the dock's vertical resizer to the terminal drawer, fly the
export submenu left so it never clips at the screen edge, and keep
per-project workspace memory in a session cache.
Keep only three topic-bar entries — file opener, workspace-panel toggle,
and a new More (⋮) menu — and move copy/export/changes/terminal/session
summary into that menu so the bar stays compact when the chat pane is
squeezed to its 400px minimum. The workspace-panel toggle now renders in
every layout (it was previously gated to creation/workbench chrome).
Remove the 560px comfort-min width applied while the workspace dock is
open and not maximized, so the chat pane can be dragged down to the
same 400px floor used in other states. CSS fallbacks for --chat-min-width
are aligned to 400px.
Problem:
- Concurrent automation edits could roll back engine-owned run state, failed saves could dismiss drafts, and several cron/calendar edge cases scheduled at the wrong time.
- Recommended automations were created too eagerly, and tab activation could leave the automation overlay visible.
Root cause:
- Full frontend snapshots were treated as authoritative across async execution and persistence boundaries.
- Cron steps used zero-based arithmetic for one-based fields, next-run search was too short, and biweekly parity used elapsed hours across DST.
- Sidecar and primary config writes did not expose a failure-atomic commit order, while editor conversion and save failures lacked explicit state.
Fix:
- Preserve TopicID, LastRunAt, and run history across stale saves; clear empty sidecars and roll them back if the primary config write fails.
- Keep failed and recommended drafts open with safe defaults, actionable errors, editable scope, and lossless frequency conversion.
- Correct cron step anchors, long-horizon leap-day search, civil-date biweekly parity, and direct tab navigation back to chat.
- Add focused backend, frontend, runner-contract, and browser-mock coverage.
Verification:
- cd desktop && go test ./... -count=1
- cd desktop && go test -race ./...
- Heartbeat editor: 18 passed
- Heartbeat schedule: 59 passed
- Heartbeat runner contract: 3 passed
- App chrome tabs: 129 passed
- pnpm lint:hooks, pnpm typecheck, pnpm test:typecheck, and pnpm build
Co-authored-by: ttmouse <[email protected]>
Problem:
- PR #8261 had diverged from main-v2 and could not be reviewed or merged on the current desktop code.
Root cause:
- Both branches evolved shared desktop and frontend integration points after the feature branch was created.
Fix:
- Merge main-v2 and resolve the overlapping desktop contracts while retaining the heartbeat feature behavior.
Verification:
- cd desktop && go test ./... -count=1
- cd desktop && go test -race ./...
- frontend Heartbeat and app chrome focused suites
- pnpm build
Co-authored-by: ttmouse <[email protected]>
Problem
Bug report and Feature request still offered a v1 (legacy TypeScript)
Version line choice after v3 Studio was added.
Root cause
The templates and issue version-label workflow still treated v1/0.x as
a filing line.
Fix
Remove the v1 dropdown option, label only v2/v3 from new reports, and
stop mapping Exact version 0.x onto v1.
Verification
Parsed the issue-form YAML and confirmed both dropdowns list only v2
and v3. Inspected the v2/v3 match and 1.x/2.x Exact version mapping.
Problem
Bug report and Feature request forms only offered v1 and v2, so Studio
(2.x) issues could not be filed or labeled as their own line.
Root cause
The issue templates and version-label workflows were hardcoded to v1/v2,
and any Exact version that was not 0.x was mapped to v2.
Fix
Add a v3 Studio option that names the studio branch, label matching
issues as v3, map 2.x Exact version to v3, and label PRs based on
studio as v3.
Verification
Parsed the issue-form and workflow YAML, and inspected the v1/v2/v3
mappings in both version-label workflows.
Problem:
The pinned heading's dedicated markup and CSS move the stable and test raw startup bundles 0.4 KiB past their existing gates.
Root cause:
The current-base budgets retain only 0.1 KiB of headroom, while the scoped non-interactive heading recipe adds 0.5 KiB raw in both channels.
Fix:
Raise only the stable and test raw initial-asset budgets by 0.5 KiB (0.021%), preserving 0.1 KiB of headroom without widening gzip or chunk limits.
Verification:
- Stable build: 2344.1 / 2344.2 KiB
- Test-channel budget: 2349.3 / 2349.4 KiB
- 88 project-tree tests
- repolint and git diff --check
Problem:
The stale PR base predates the trusted documentation-impact checker, so pull_request_target checked out a base commit without scripts/check-docs-impact.sh.
Root cause:
The branch had not incorporated 2,242 main-v2 commits since its original merge base.
Fix:
Merge the latest main-v2 without rewriting contributor history, allowing metadata guards and CI to run against the current repository contract.
Verification:
- Clean merge-tree against origin/main-v2
- Focused pinned-heading contract test
- 88 project-tree tests
- ESLint, TypeScript, test typecheck, CSS checks, and git diff --check
Problem:
The pinned section heading reused interactive folder classes, so hovering a static label painted a folder hover background and implied it could be clicked.
Root cause:
The visual alignment borrowed project-tree__folder and project-tree__folder-main, which also own folder hover behavior.
Fix:
Use a dedicated section-title modifier for the pinned heading, preserve its Pin icon and folder-aligned dimensions, mark the icon decorative, and add source contract coverage.
Verification:
- pnpm exec tsx src/__tests__/project-tree-pinned-header.test.ts
- pnpm exec tsx src/__tests__/project-tree-runtime.test.ts
- pnpm check:css
- pnpm typecheck
- pnpm test:typecheck
- Browser computed-style check for default and hover states
- git diff --check
Co-authored-by: SivanCola <[email protected]>
Problem:
Regenerating the existing Notes PR made its automation-authored commit appear as a v1.30.0 contributor.
Fix:
Remove only github-actions[bot] from the new release record while preserving every human contributor and cited product change.
Verification:
Validated the full catalog, release-note contracts, rendered v1.30.0 notes, and diff whitespace.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Problem:
The reviewed v1.30.0 draft predates the Windows release-gate test fix merged into main-v2.
Fix:
Merge the current protected main-v2 baseline so Prepare release can regenerate and validate the candidate-bound Stable record.
Verification:
The branch and main-v2 remote SHAs were re-read immediately before this merge.
Problem:
Windows CI fails deterministic write-scope and delivery tests because fixtures use Unix-only absolute paths and compare normalized paths case-sensitively.
Root cause:
filepath treats /tmp and /home as relative paths on Windows, while Receipt normalization lowercases Windows paths.
Fix:
Build scratch and outside fixtures from os.TempDir and the platform volume root, JSON-encode Windows paths, and compare the normalized Windows expectation.
Verification:
Linux package tests pass for internal/evidence, internal/completion, and internal/taskcontract. Windows amd64 test binaries compile successfully for all three packages.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Problem:
Foreground fleet calls were classified as direct workspace mutations, so they held an exclusive workspace lease for the full fleet lifetime and blocked unrelated writers.
Root cause:
The non-mutation meta-tool registry omitted fleet even though its child tasks own and report the actual workspace mutations.
Fix:
Classify fleet as a non-mutating meta tool and add effect/runtime regressions proving no outer lease is held. Writable tool hooks still retain the existing whole-workspace lease.
Verification:
- go test ./internal/agent -run TestFleetMetaToolDoesNotTakeOuterWorkspaceLease -count=50
- go test -race ./internal/agent ./internal/evidence ./internal/filelock ./internal/workspacelease -count=1
- go test ./... -p 1 -count=1 -timeout 600s
- cd desktop && go test ./... -count=1 -timeout 900s
- go vet ./...
- make lint
- bash scripts/cache-guard.sh
- pnpm --dir desktop/frontend build
Problem:
- Later directory writers that had already queued behind a whole-workspace writer could bypass it when another scheduler event pumped the queue.
- Cancelling the whole-workspace waiter did not immediately reconsider the writers behind it.
Root cause:
- Incoming admission honored whole-writer priority, but the waiter pump evaluated each queued writer independently and cancellation only removed the waiter.
Fix:
- Keep a blocked whole-workspace waiter as a FIFO barrier for later writers while allowing read-only work to use free capacity.
- Pump the remaining queue immediately after a cancelled waiter is removed.
- Add deterministic pump-order and cancellation regressions.
Verification:
- Focused scheduler regressions: 100 repetitions
- Focused scheduler race regressions: 20 repetitions
- go test and go test -race for agent/control/filelock/workspacelease
- go vet and golangci-lint
- repolint and git diff --check
Problem:
- A whole-workspace writer queued behind an unrealized directory writer could be repeatedly bypassed by later directory writers, creating unbounded tail wait under steady background work.
Root cause:
- Directory claims intentionally expose an empty scheduling reservation before their first concrete write, and incoming admission did not consider an already queued whole-workspace writer.
Fix:
- Give a queued whole-workspace writer priority over later writer admissions while keeping read-only work concurrent.
- Add a deterministic arrival-order regression covering the queued, active, and released states.
Verification:
- go test ./internal/agent -run '^TestScheduler(QueuedWholeWriterBlocksLaterDirectoryWriter|WholeClaimCannotStartBehindUnrealizedDirectoryWriter|DirectoryClaimsStartInParallel|WholeClaimNarrowsForNewSiblingsAndOpaqueRestoresExclusion)$' -count=100 -timeout 300s
- go test -race ./internal/agent -run '^TestScheduler(QueuedWholeWriterBlocksLaterDirectoryWriter|WholeClaimCannotStartBehindUnrealizedDirectoryWriter|DirectoryClaimsStartInParallel|WholeClaimNarrowsForNewSiblingsAndOpaqueRestoresExclusion)$' -count=20 -timeout 300s
- go test ./internal/agent ./internal/control ./internal/filelock ./internal/workspacelease -count=1 -timeout 300s
- go test -race ./internal/agent ./internal/control ./internal/filelock ./internal/workspacelease -count=1 -timeout 600s
- go run ./tools/repolint
- git diff --check
Problem:
- Folding macOS workspace and lock-file paths changed the legacy exact-root hash for mixed-case paths and could address the wrong lock file on case-sensitive volumes.
Root cause:
- One folded identity was reused for the new hierarchy protocol, the previous exact-root protocol, the process-local registry, and the filesystem path opened for flock.
Fix:
- Keep separate folded coordination and exact compatibility identities, acquiring both only where their lock domains differ.
- Preserve the filesystem lock path while folding only the process-local registry key.
- Cover new case aliases, old exact-root holders, and parent writes crossing an old nested repository root.
Verification:
- go test ./internal/filelock ./internal/workspacelease -count=20 -timeout 300s
- go test -race ./internal/filelock ./internal/workspacelease -count=5 -timeout 300s
- go test ./internal/workspacelease -run 'Test(Darwin|HierarchyProtocol|ParentWorkspace|NestedWorkspace|SameOwner|WorkspaceWriter|ReversePath|ExclusiveUpgrade)' -count=50 -timeout 300s
- go test -race ./internal/agent ./internal/control ./internal/filelock ./internal/workspacelease -count=1 -timeout 600s
- go run ./tools/repolint
- git diff --check
Problem:
The Windows smoke job timed out in the same-owner writer-priority regression even though the production re-entry path was not deadlocked.
Root cause:
The test selected increasing lock stripes by hashing raw filepath.Join output. On Windows that used backslashes, while production canonicalizes paths to lowercase forward-slash identities before hashing, so the test could accidentally request stripes in reverse order and trigger the intended order guard.
Fix:
Resolve test stripes through the production pathSpecs canonicalization path before comparing their order.
Verification:
- focused regression: 50 repetitions
- focused race regression: 20 repetitions
- go test and go test -race for agent/filelock/workspacelease
- Windows and Linux workspacelease test binaries cross-compiled
- go vet, repolint, and git diff --check
Problem:
The desktop browser CI gate could time out while clicking the optional jump-to-bottom control even after confirming that it existed.
Root cause:
The bench queried an async React control with locator.count() and clicked it in a separate Playwright operation. A scroll-state update could unmount the control between those calls, leaving click() waiting for 30 seconds.
Fix:
Query and activate optional transcript controls in one browser task, and apply the same helper to the sibling older-history setup paths that have the same lifecycle.
Verification:
- pnpm test:transcript-browser
- PLAYWRIGHT_BROWSERS_PATH=.pw-browsers node bench/transcript-selection.mjs (2 additional runs)
- pnpm build
- REASONIX_CHANNEL=test pnpm build
- go run ./tools/repolint
- git diff --check
Co-authored-by: SivanCola <[email protected]>
Problem:
The latest-base merge tree exceeded the production initial-JavaScript gzip budget by 26.8 bytes.
Root cause:
File and multi-file conflicts used separate translation keys with identical copy and a three-way runtime branch.
Fix:
Use the existing non-empty conflict label to select one shared path-scoped translation while preserving the workspace fallback and all user-visible wording.
Verification:
cd desktop/frontend && pnpm build
go run ./tools/repolint
git diff --check
Problem:
main-v2 advanced with complete-history question navigation, leaving this PR conflicting in the shared bundle budgets while both branches also touched locales, styles, and the repolint baseline.
Root cause:
The navigation and DingTalk changes independently extended the same startup bundle and capacity guards, so neither branch budget represented their combined merge tree.
Fix:
Merge main-v2 at 0d80a69dc, preserve both the long-history navigation contracts and DingTalk settings/runtime wiring, and set channel-specific bundle ceilings from measured current-base and combined artifacts. The largest ratchet is about 0.117%, with roughly 0.1 KiB of build-SHA headroom.
Verification:
- pnpm test:transcript
- focused DingTalk settings, settings snapshot, responsive layout, deferred history, and tab hydration tests
- pnpm build
- REASONIX_CHANNEL=test pnpm build
- go test ./...
- cd desktop && go test ./...
- go run ./tools/repolint
- git diff --cached --check
Co-authored-by: SivanCola <[email protected]>
Problem:
- A whole-workspace writer could start behind a directory-declared writer when the directory writer had not realized a file yet, making admission depend on arrival order.
Root cause:
- Live directory claims intentionally expose an empty scheduling reservation before their first write, and canStartLocked compared the incoming whole claim only with that narrowed reservation.
Fix:
- Keep incoming whole-workspace claims exclusive against every active writer, including unrealized directory claims.
- Add a reverse-order regression that also proves admission resumes after the directory writer releases.
Verification:
- go test ./internal/agent -run '^TestScheduler(WholeClaimCannotStartBehindUnrealizedDirectoryWriter|DirectoryClaimsStartInParallel|WholeClaimNarrowsForNewSiblingsAndOpaqueRestoresExclusion|ParentFileWriteAfterChildRealize)$' -count=50 -timeout 180s
- go test -race ./internal/agent -run '^TestScheduler(WholeClaimCannotStartBehindUnrealizedDirectoryWriter|DirectoryClaimsStartInParallel|WholeClaimNarrowsForNewSiblingsAndOpaqueRestoresExclusion|ParentFileWriteAfterChildRealize)$' -count=10 -timeout 180s
- go test ./internal/agent -count=1 -timeout 180s
- go test -race ./internal/agent ./internal/filelock ./internal/workspacelease -count=1 -timeout 300s
- go run ./tools/repolint
- git diff --check
Problem:
Jumping across a 10,000-turn transcript needed many small history requests because the backend also caps entries per page.
Root cause:
The frontend increased only the turn budget for targeted jumps and kept the production default entry limit of 120.
Fix:
Use a bounded 500-turn and 1,000-entry budget only for targeted jumps, while preserving ordinary paging and the backend byte cap. Model the production entry bound in the stress fixture.
Verification:
- go run ./tools/repolint
- pnpm exec tsx src/__tests__/use-controller-meta.test.ts
- pnpm exec tsx src/__tests__/transcript-store.test.ts
- pnpm test:typecheck
- transcript scroll stability browser gate
- git diff --check
Problem:
- main-v2 advanced with the transcript reader extent fix, leaving this PR conflicting because both branches updated the frontend bundle budgets.
Root cause:
- The independent reader-stability and DingTalk startup changes share the same initial bundle, so neither branch budget covered their combined merge tree.
Fix:
- Preserve the reader extent stabilization and the DingTalk session/runtime wiring.
- Set production and test bundle ceilings from measured latest-base and merged artifacts, with only narrowly rounded channel-specific headroom.
Verification:
- pnpm test:transcript
- focused DingTalk settings, settings snapshot, and responsive layout tests
- go test ./...
- cd desktop && go test ./...
- go test -race ./internal/bot/... ./internal/botruntime
- cd desktop && go test -race ./...
- pnpm build
- REASONIX_CHANNEL=test pnpm build
- go run ./tools/repolint
- git diff --cached --check
Co-authored-by: SivanCola <[email protected]>
Problem:
- Parallel read-only calls in one provider round could contend for the whole-workspace parent claim when tool hooks may write, causing a sibling call to be blocked and dropped.
Root cause:
- Batch partitioning considered only the tools' ReadOnly flags, while executeOne correctly promoted every hook-capable call to a whole-workspace writer.
Fix:
- Run provider-round batches in order only when configured tool hooks may mutate the workspace.
- Preserve ordinary read-only fan-out and add regression coverage for both paths and complete hook execution.
Verification:
- go test ./internal/agent -run 'TestWritableHooks(SerializeReadOnlyToolBatch|UseWorkspaceLease|ReserveWholeParentWorkspace)$' -count=50 -timeout 180s
- go test -race ./internal/agent ./internal/filelock ./internal/workspacelease -count=1 -timeout 300s
- go test ./... -count=1 -timeout 300s
- go vet ./...
- cd desktop && go test ./... -count=1 -timeout 180s
- cd desktop/frontend && pnpm build
- golangci-lint run --timeout=5m ./...
- go run ./tools/repolint
- git diff --check
Problem: PR #9117 was based before merged PR #9140, and both branches update the transcript browser gate, transcript suite, and bundle budgets.
Root cause: the complete-history navigation work and the Windows extent-rebound guard were developed from the same #9130 baseline, so the final merge tree needed an explicit semantic integration.
Fix: merge main-v2 at 89c983a9, retain both focused test groups and browser replays, and set channel-specific bundle budgets from the combined measured output.
Verification: transcript suite, Chromium selection and scroll-stability gates, 10,000-turn performance benchmark, stable/test builds and budgets, test typecheck, repolint, and diff checks pass.
Problem:
- The required golangci-lint job rejected the hierarchy path loop under the modernize rules.
Root cause:
- The loop ranged over an allocated strings.Split result instead of the Go iterator API required by the pinned linter.
Fix:
- Range over strings.SplitSeq while preserving the same normalized path components and lock order.
Verification:
- golangci-lint run --timeout=5m ./...
- go test -race ./internal/workspacelease -count=1
- go test ./internal/agent -run SchedulerWholeClaim -count=1
- go run ./tools/repolint
- git diff --check
Problem:
- Parent workspaces and directly opened nested roots could take disjoint path and whole-workspace locks while mutating the same file.
- Realized whole-workspace claims still blocked new disjoint siblings, and Desktop could not identify a holder across canonical roots.
- A queued workspace writer could deadlock a re-entrant path hold from the same lease owner.
Root cause:
- Path holds shared only their opener's exact workspace lock, scheduler admission kept consulting the immutable declaration, and Desktop rejected unequal roots before comparing canonical file keys.
- Writer-priority shared-lock acquisition did not distinguish re-entry by the owner whose active shared hold blocked the writer.
Fix:
- Add bounded hierarchy stripes plus ancestor and nested-repository compatibility locks in stable order, preserving previous exact-root locks for mixed-version coexistence.
- Reuse shared domains within one owner while retaining writer priority for other owners, and normalize lock identities consistently on case-insensitive platforms.
- Admit new siblings against the live reservation and match Desktop conflicts by concrete keys and workspace containment.
- Document the hierarchy protocol and add deterministic interleaving, compatibility, platform, matching, and latency coverage.
Verification:
- go test -race ./internal/agent ./internal/filelock ./internal/workspacelease -count=1
- go test ./... -count=1 -timeout 300s
- go vet ./...
- cd desktop && go test ./... -count=1 -timeout 180s
- cd desktop/frontend && pnpm build
- go run ./tools/repolint
- Windows and Linux workspacelease test binaries cross-compiled
- git diff --check
Fix \boxed rendering so the frame is a proper rectangle instead of a
collapsed vertical bar in WKWebView, and pin pnpm to v10 as required by
the frontend's engines field.
- KaTeX draws \boxed's frame as an empty .fbox span whose width comes
from .katex-stretchy's width:100%. Under WKWebView that percentage
resolves against the span's intrinsic width (0) inside the
inline-table/table-layout:fixed vlist, so top/bottom borders vanish
and left/right borders merge into one tall bar. Override the width
with -webkit-fill-available, which fills the containing row while
keeping the span's inline-block baseline alignment (vertical position
intact).
- Add "packageManager": "[email protected].5" so Corepack/Wails use pnpm 10,
matching the ">=10 <11" engine range, instead of defaulting to pnpm 11.
- TUI path: teach internal/cli/latex.go \boxed (render inner content),
\left./\right. (invisible dot delimiter), and \vert/\lvert/\rvert/
\Vert/\lVert/\rVert symbols, with regression cases in latex_test.go.
Problem:
The CI lint job rejected the DingTalk adapter because wsPingInterval was declared but no longer used.
Root cause:
The connection startup refactor moved heartbeat handling to server-initiated ping frames but left the old client interval constant behind.
Fix:
Remove the obsolete constant and its comment.
Verification:
- golangci-lint run --timeout=5m ./internal/bot/dingtalk/...
- go test ./internal/bot/dingtalk ./internal/bot/... ./internal/botruntime
- go run ./tools/repolint
- gofmt -l internal/bot/dingtalk/dingtalk.go
- git diff --check
Problem:
The combined transcript browser suite could exhaust a 15-second geometry-stability precondition after the preceding selection stress run, even though the reduced-motion scenario passed in isolation.
Root cause:
The scenario allowed 30 seconds for content hydration but only the default 15 seconds for the subsequent eight-frame stable-tail precondition.
Fix:
Align that precondition with the existing 30-second hydration window without changing frame-gap, long-task, reversal, write-count, or bottom-distance assertions.
Verification:
The full pnpm test:transcript-browser sequence passed from selection through the reduced-motion idle and return-to-bottom checks.
Problem:
Windows WebView2 can briefly collapse and restore the transcript extent while rows remain mounted, reversing a downward reader gesture by multiple screens without triggering blank recovery.
Root cause:
The scroll arbiter treated the transient physical-bottom clamp as an authoritative delivery and had no bounded transaction tying the rebound to the active reader input.
Fix:
Track a 180 ms reader extent transaction, require a large collapse and rebound before one anchor-based correction, and cancel stale geometry on ownership, resize, recovery, and surface changes. Normalize wheel and touch input geometry while keeping the arbiter as the sole Virtuoso writer.
Verification:
Added deterministic geometry, ownership-race, cancellation, touch, keyboard, and Playwright replay coverage. Passed transcript tests, production/test builds and bundle budgets, scroll-writer checks, repolint, desktop Go tests/vet, and the isolated browser stability bench.
Problem:
The Linux desktop CI job timed out while the reduced-motion browser gate tried to return the transcript to the physical bottom after an upward wheel gesture.
Root cause:
The gate sent its downward wheel after a fixed 120ms delay without first proving Chromium had delivered the upward gesture, entered manual mode, and moved away from the tail. Wheel delivery and coalescing on the Linux runner made that setup nondeterministic.
Fix:
Wait for the upward gesture to establish manual reading away from the captured bottom position, then use a bounded sequence of real downward wheel gestures until tail-follow reaches the physical bottom. Keep the existing reversal, moving-frame, and physical-bottom assertions unchanged.
Verification:
- transcript-scroll-stability.mjs passed three consecutive runs
- pnpm --dir desktop/frontend test:transcript-browser
- pnpm --dir desktop/frontend test:transcript
- pnpm --dir desktop/frontend test:performance
- pnpm --dir desktop/frontend typecheck
- pnpm --dir desktop/frontend test:typecheck
- pnpm --dir desktop/frontend lint:hooks
- pnpm --dir desktop/frontend build
- REASONIX_CHANNEL=test pnpm --dir desktop/frontend build
- go run ./tools/repolint
- git diff --check
Co-authored-by: SivanCola <[email protected]>
Problem:
DingTalk runtime/profile commands could tear down the current bot controller before a replacement was viable. Webhook redirects and startup readiness were insufficiently guarded, while settings round trips could drop hidden legacy session mappings.
Root cause:
Runtime overrides were published and the old state was closed before controller boot and lease transfer completed. Webhook validation allowed HTTP through process-global test policy and did not validate every redirect. Settings rebuilt the DingTalk config without preserving non-UI fields.
Fix:
Build, bind, and lease replacement controllers before atomically swapping them, reusing the same-path lease keeper and preserving the old runtime on failure. Require HTTPS for production webhooks, revalidate redirect hops, complete the initial WebSocket handshake synchronously, preserve legacy mappings, handle disabled connections correctly, and keep the frontend connection label and dependency graph accurate.
Capacity:
DingTalk status wiring measures 425.9 KiB gzip against a narrowly raised 426.0 KiB initial-JS budget (+0.5 KiB, 0.118%). Complete DingTalk setup guidance measures 55.8/55.9 KiB for zh and 56.5/56.6 KiB for zh-TW; each locale ratchet rises only 0.2 KiB (about 0.36%).
Verification:
- go test ./...
- go test -race ./internal/bot/... ./internal/botruntime
- cd desktop && go test ./...
- cd desktop && go test -race ./...
- go vet ./internal/bot/... ./internal/botruntime
- cd desktop && go vet ./...
- pnpm build
- settings snapshot and responsive contract suites
- go run ./tools/repolint
- git diff --check
Co-authored-by: SivanCola <[email protected]>
Problem:
The Linux desktop CI job timed out twice while waiting for a native scrollbar thumb drag to reach the physical transcript bottom, even though measurement freezing and the preceding navigation and performance assertions passed.
Root cause:
The browser gate stopped the held pointer five pixels inside the scrollbar track. Native Chromium scrollbar themes do not guarantee that this coordinate clamps the thumb to the track endpoint.
Fix:
Drag the held native thumb beyond the visible track while keeping the pointer inside the viewport, and retain the exact one-pixel physical-bottom assertion and existing timeout.
Verification:
- pnpm --dir desktop/frontend test:transcript-browser
- transcript-scroll-stability.mjs passed two additional consecutive runs
- pnpm --dir desktop/frontend test:transcript
- pnpm --dir desktop/frontend test:performance
- pnpm --dir desktop/frontend typecheck
- pnpm --dir desktop/frontend test:typecheck
- pnpm --dir desktop/frontend lint:hooks
- env -u REASONIX_CHANNEL pnpm --dir desktop/frontend build
- REASONIX_CHANNEL=test pnpm --dir desktop/frontend build
- go run ./tools/repolint
- git diff --check
Co-authored-by: SivanCola <[email protected]>
QQ gateway closes the WebSocket with op=9 INVALID_SESSION when Identify
declares an intent the bot is not authorized for. Unverified/not-published
bots have no guild-message permission, so the hardcoded 1<<9 GUILD_MESSAGES
(and 1<<26 INTERACTION, a paid high-level capability) always fail the
handshake (#7512 has per-bit protocol-level evidence).
Identify now uses only authorized, needed intents:
GUILDS (1<<0) | GUILD_MEMBERS (1<<1) | DIRECT_MESSAGE (1<<12) |
GROUP_AND_C2C_EVENT (1<<25) | PUBLIC_GUILD_MESSAGES (1<<30)
Verified against a real QQ bot: gateway now reaches READY and receives
C2C_MESSAGE_CREATE events (previously: op=9 + EOF loop).
Fixes#8108, #7512
Context:
PR #9130 landed on main-v2 after the long-history navigation update was pushed. Its transcript geometry diagnostics overlapped the navigation owner, test script, and bundle budgets.
Conflict resolution:
Preserve both the bounded Windows geometry recovery and complete-history navigation contracts. Combine their transcript suites and callbacks, extract question navigation and pagination race helpers from oversized owner files, keep the stable/test channel budgets independently bounded, and normalize the merged diagnostic tests for the repository test compiler.
Verification:
pnpm --dir desktop/frontend test:transcript
pnpm --dir desktop/frontend typecheck
pnpm --dir desktop/frontend test:typecheck
pnpm --dir desktop/frontend lint:hooks
pnpm --dir desktop/frontend test:performance
env -u REASONIX_CHANNEL pnpm --dir desktop/frontend build
REASONIX_CHANNEL=test pnpm --dir desktop/frontend build
cd desktop && go test ./...
go run ./tools/repolint
git diff --check
Co-authored-by: SivanCola <[email protected]>
Problem:
- The pull request lint job rejected two newly added loops under intrange and modernize.
Root cause:
- The bounded-stripe test used a three-clause integer loop, and release cleanup indexed a slice backwards manually.
Fix:
- Use an integer range for the stripe coverage loop.
- Use slices.Backward to preserve LIFO release ordering without manual indexing.
Verification:
- golangci-lint run ./...
- go test ./... -count=1 -timeout 300s
- go test -race ./internal/agent ./internal/filelock ./internal/workspacelease -count=1 -timeout 300s
- go vet ./...
- go run ./tools/repolint
- git diff --check
Problem:
- The latest-base merge tree exceeded the baselined App.tsx file-size budget by one line.
Root cause:
- The PR and the updated base each remained within the budget independently, but their non-conflicting App.tsx edits combined to one extra line.
Fix:
- Keep the workspace-conflict translation call on one line without changing behavior.
Verification:
- pnpm lint:hooks
- go run ./tools/repolint
- git diff --check
Problem:
- File-scoped lease batches could deadlock on reverse path order, lose active protection during workspace upgrades, and misidentify the local writer in Desktop.
- Writable tool hooks, case aliases, queued writers, and historical path-lock growth left adjacent correctness and resource gaps.
Root cause:
- Paths were acquired incrementally, held and waiting lease state shared one scope, and hook coordination followed only the concrete tool's declared write surface.
- Path locks used unbounded identities and local shared locking did not give waiting writers priority.
Fix:
- Acquire canonical path batches in stable order through a bounded global stripe set, retain active holds during upgrades, and prioritize queued workspace writers.
- Elevate hook-wrapped calls to workspace-wide coordination, fold case aliases, and match Desktop conflicts with exact held and waiting keys.
Verification:
- go test ./... -count=1 -timeout 300s
- go test -race ./internal/agent ./internal/filelock ./internal/workspacelease -count=1
- go vet ./...
- cd desktop && go test ./... -count=1 -timeout 180s
- cd desktop/frontend && pnpm build
- go run ./tools/repolint
- git diff --check
Problem:
The long-history question rail remained in the initial application bundle, and active-question tracking scanned every mounted anchor even after passing the viewport. The exact-navigation wiring exceeded the existing initial gzip budget by 25 bytes.
Root cause:
Transcript imported the rail eagerly, the scroll-sync helper did not use the ordered DOM-anchor invariant, and the bundle guard had no allowance for the small owner-level navigation addition.
Fix:
Lazy-load the question rail behind its existing visibility gate, stop the ordered anchor scan at the first position below the viewport, remove redundant loaded-state checks, and record the measured 25-byte (0.0057%) increase with the smallest 0.1 KiB budget increment.
Verification:
pnpm --dir desktop/frontend test:transcript
pnpm --dir desktop/frontend test:typecheck
pnpm --dir desktop/frontend test:performance
pnpm --dir desktop/frontend build
git diff --check
Co-authored-by: SivanCola <[email protected]>
Problem
The macOS desktop CI job rejected the scroll diagnostics exporter under the current modernize rules.
Root cause
The exporter used a hand-written membership loop and converted fmt.Sprintf output to bytes instead of using the Go 1.26 standard-library helpers.
Fix
Use slices.Contains for enum membership and fmt.Appendf for the checksum line.
Verification
- cd desktop && golangci-lint run --timeout=5m
- cd desktop && go vet ./...
- cd desktop && go test . -run scroll diagnostic tests -count=1
- go run ./tools/repolint
- git diff --check
Problem:
Legacy history pages use zero-based cursors, which shifted absolute question navigation by one. An older-page request could also complete after its tab was closed and recreate released transcript state.
Root cause:
The fallback HistoryPage projection copied its cursor directly into the one-based frontend coordinate model, and tab cleanup removed state without invalidating the pagination request generation.
Fix:
Normalize legacy pages to absolute one-based question turns, retain a tombstone generation when transcript state is released, and discard success or error completions for removed tabs. Add deterministic close-race coverage and a 10,000-turn targeted-paging stress test.
Verification:
pnpm --dir desktop/frontend test:transcript
pnpm --dir desktop/frontend typecheck
pnpm --dir desktop/frontend test:typecheck
pnpm --dir desktop/frontend lint:hooks
pnpm --dir desktop/frontend check:css
pnpm --dir desktop/frontend test:performance
cd desktop && go test ./...
git diff --check
Co-authored-by: SivanCola <[email protected]>
Problem:
A terminal paste arriving after the image probe could still duplicate the scheduled text fallback, while a second Ctrl+V during the probe was dropped.
Root cause:
The image-paste state tracked only one pending probe and checked the terminal paste sequence before the asynchronous text read, without carrying that guard to final application.
Fix:
Coalesce overlapping image probes, count every paste request, subtract terminal-owned pastes both before and after the text read, and replay only the remaining requests through the canonical composer paste path.
Verification:
- focused clipboard interleaving tests, including 50 repeated runs
- go test ./... with the cache guard
- go test -race ./internal/cli
- cd desktop && go test ./...
- go vet ./... and go build ./...
- golangci-lint for native, Darwin, and Windows targets
- repolint plus Windows and Linux cross-compilation
Problem:
- The bounded recovery probe relied on Virtuoso emitting another range or scroll event before it could leave enlarged overscan.
Root cause:
- Entering safe mode changed probe props but did not schedule the probe verdict from the integrity hook itself.
Fix:
- Schedule one post-render blank check whenever safe mode starts.
- Exit the probe after that single healthy or still-blank verdict without remounting.
- Cover a 10,000-row failed probe with no follow-up range or scroll event.
Verification:
- pnpm exec tsx src/__tests__/transcript-recovery-race.test.tsx (89 passed)
- pnpm test:transcript
- pnpm test:transcript-browser
- pnpm build (425.3 / 425.5 KiB)
Problem:
The test TypeScript build rejects an obsolete questions fixture after active-question selection was narrowed to mounted anchor positions.
Root cause:
The helper no longer consumes the full question array, but its old test data remained declared under noUnusedLocals.
Fix:
Remove the unused fixture while keeping the mounted-position regression cases unchanged.
Verification:
pnpm --dir desktop/frontend test:typecheck
pnpm --dir desktop/frontend exec tsx src/__tests__/transcript-question-nav.test.ts
Problem:
After the first write, a session kept the workspace exclusive until the run
ended. Read-only bash could still look like a writer at the edges, fleet
preflight failed omitted write_paths, wait copy said the whole workspace was
busy, and a finished conversation could keep the lock.
Root cause:
Owner released only on EndRun, path-bound locks were repo-wide in the same
git root, fleet preflight treated whole-workspace claims as fatal, and the
conflict card had no file/workspace distinction.
Fix:
- Hold/release write leases per mutating tool; EndRun drops leftovers.
- Path-bound writes take shared workspace + exclusive file locks so different
files (same repo included) may proceed; bash/MCP exclusive only for that command.
- Read-only bash (git status, Get-ChildItem, ls) does not take a write lease.
- Fleet omitted write_paths queue in the scheduler instead of failing preflight.
- Conflict cards name the file being written; no home paths.
Verification:
- go test ./internal/agent ./internal/workspacelease ./internal/filelock
- go test -race ./internal/workspacelease ./internal/filelock
- cd desktop && go test ./
Context:
Bring PR #9117 onto the current main-v2 merge tree before final validation. Preserve the contributor and maintainer commits while incorporating the latest workspace, provider, stream-batching, and repository test changes.
Problem:
Long desktop sessions hide earlier turns behind a manual fold control, and the question rail only represents the loaded suffix. Failed expansion can also leave navigation without a clear recovery path.
Root cause:
Transcript pagination is exposed as a user-controlled fold, absolute history turns are discarded during projection, and the rail renders and measures one DOM marker per loaded question. Older-page completions also need stronger invalidation across tab and session hydration changes.
Fix:
Auto-load ordinary older history, preserve absolute turns, and support bounded targeted paging for unloaded questions. Render at most 120 sampled markers with direct pointer mapping and keyboard slider semantics. Stop automatic retries after a failure, expose a safe retry action, and discard stale page completions by request generation and session identity.
Verification:
pnpm --dir desktop/frontend test:transcript
pnpm --dir desktop/frontend typecheck
pnpm --dir desktop/frontend test:typecheck
pnpm --dir desktop/frontend lint:hooks
pnpm --dir desktop/frontend check:css
pnpm --dir desktop/frontend test:performance
cd desktop && go test ./...
git diff --check
Co-authored-by: SivanCola <[email protected]>
Problem
Repeated blank recovery could retain an all-row measurement fallback, exact row heights could survive immutable late-content patches, and native smoke cleanup hid persistent Windows deletion failures.
Root cause
Recovery tracked only the last hard reset, measured sizes were keyed by row and width without content identity, and the smoke script used SilentlyContinue for final cleanup.
Fix
Give each layout generation one hard reset and one bounded measurement probe, version measured rows by immutable item identity, invalidate stale exact and median samples, and retry native-smoke cleanup before surfacing persistent errors. Add long-history, late-patch, and locked-file regression coverage. The production bundle budget moves by 0.5 KiB for a measured 361-byte gzip increase.
Verification
- pnpm test:transcript
- pnpm test:transcript-browser
- pnpm build
- REASONIX_CHANNEL=test pnpm build
- cd desktop && go test . -count=1
- cd desktop && go vet ./...
- go run ./tools/repolint
- git diff --check
Problem:
Conflict detection treated the whole workspace (or a declared directory prefix)
as exclusive. Parallel writers blocked even when they touched different files
or different nested git repositories.
Root cause:
write_paths scheduling used capability Overlaps, so directory identity and
omitted claims serialized every writer. workspacelease used one exclusive flock
keyed by the opened workspace root.
Fix:
- Schedule directory claims in parallel; reserve realized files at write time.
- Shrink omitted write_paths to realized files until bash/MCP goes opaque.
- Add shared flock; nested-repo path-bound writes take shared parent + exclusive repo.
- Same-repo sessions still serialize. Desktop conflict cards match lock domains.
Verification:
- go test ./internal/agent ./internal/filelock ./internal/workspacelease
- go test -race ./internal/agent ./internal/filelock ./internal/workspacelease
- cd desktop && go test ./...
Problem:
Rapid Ctrl+V text fallbacks could be dropped, and clipboard image probes could classify operational failures as an empty image clipboard.
Root cause:
Internal text fallback reused terminal paste accounting, while Linux and macOS image readers inferred missing image data from broad command failures.
Fix:
Track only terminal-originated paste events, probe explicit clipboard image types before reading, and preserve probe, read, and save failures.
Verification:
- go test ./...
- go test -race ./internal/cli ./internal/control
- cd desktop && go test ./...
- go vet ./...
- go build ./...
- golangci-lint on Linux, macOS, and Windows targets
- repolint and Windows cross-compilation
Co-authored-by: SivanCola <[email protected]>
- dingtalk: drop access token from webhook replies; restrict webhook to dingtalk
hosts; reject non-dingtalk session webhooks at normalize/send; SSRF regression
tests; ReplyToMsgID never used as URL
- dingtalk: use isInAtList structured mention field with text fallback
- botruntime: count dingtalk allowlist fields and direct [bot.dingtalk].access in
startup gate; tests
- gateway: /model validates model via ModelResolver before swapping controller
(failure-atomic, old session stays usable); provider-only usage rejected
- botruntime/config: persist /new-rotated session path for legacy direct
[bot.dingtalk] via Dingtalk.SessionMappings; render + forget cleanup
- docs: remove work-note docs (dingtalk-support-scope, feishu analysis)
- repolint: baseline only for PR files, global limits kept at upstream
Resolve the workspace test command conflict by preserving both the base branch's turn verification suite and this branch's preview CSS regression coverage.
Verification:
- go run ./tools/repolint
- pnpm --dir desktop/frontend test:workspace
- pnpm --dir desktop/frontend typecheck
- pnpm --dir desktop/frontend check:css
- pnpm --dir desktop/frontend build
- git diff --check --cached
Problem:
Large code previews remained capped by the shared scroll height, and the preview could switch layout while code was loading, leaving visible row gaps.
Root cause:
The workspace code selector did not explicitly override the shared max-height rule, while the code layout class depended on the loaded preview payload.
Fix:
Clear the shared height cap inside workspace previews, keep the code layout active throughout loading, and add deterministic CSS and component regression coverage to the workspace suite.
Verification:
- go run ./tools/repolint
- pnpm --dir desktop/frontend test:workspace
- pnpm --dir desktop/frontend typecheck
- pnpm --dir desktop/frontend check:css
- pnpm --dir desktop/frontend build
- git diff --check
Co-authored-by: SivanCola <[email protected]>
Problem:
The immutable provider name hint was visible but not exposed as the field description, and its faint text color did not meet normal-text contrast requirements.
Root cause:
The name label, input, and hint had no shared IDs, while the hint reused the generic low-emphasis memory style.
Fix:
Associate the label and conditional hint with the name input via useId and aria-describedby. Apply a scoped secondary text color and extend the regression suite to guard both contracts.
Verification:
- provider-name-readonly.test.tsx passed (23/23)
- provider-editor-model-picker.test.tsx passed (45/45)
- focused ESLint, CSS checks, test typecheck, and git diff --check passed
- Chromium accessibility and 12-theme contrast matrix passed
Co-authored-by: SivanCola <[email protected]>
Problem: Session-group titles grow to the intended hierarchy size, but entering rename mode still shrinks the editable title to the old 11px size.
Root cause: The rename input retained a fixed font-size instead of following the updated group header typography.
Fix: Inherit the group header font size in rename mode and add a source-level regression contract that rejects the old fixed size.
Verification: project-tree row stability test, CSS guards, ESLint, TypeScript, full frontend build, bundle budgets, repolint, and Chromium computed-style checks at 100% and 125% all passed.
Co-authored-by: SivanCola <[email protected]>
Problem:
The focused stream batching regressions were only discoverable through the general frontend test runner, which desktop CI does not invoke. The timer comments also described a requested delay as a hard latency guarantee and implied it could bypass a blocked main thread.
Root cause:
No CI-owned suite grouped the stream batching tests, and the documentation conflated a best-effort timer with a watchdog.
Fix:
Add a test:stream suite, mark its three tests as owned by that suite, and invoke it from desktop CI. Clarify that timer delivery can be delayed by browser throttling or long main-thread tasks.
Verification:
- pnpm test:stream
- pnpm exec tsc --noEmit
- pnpm exec eslint src/lib/rafBatch.ts src/__tests__/raf-batch.test.ts
- pnpm test:motion
- go run ./tools/repolint
- actionlint .github/workflows/ci.yml
- git diff --check
Co-authored-by: SivanCola <[email protected]>
Problem:
PR #9097 identified an untested Agent path where todo_write creates the canonical todo while Plan mode is already active. Existing tests seeded state directly, so the safe end-to-end recovery contract remained implicit.
Root cause:
The current contract was split across separate tests for todo progress and Plan-mode sign-off blocking; neither exercised both decisions after real in-turn todo creation.
Fix:
Add an Agent-level regression that creates the todo through executeOne, proves an evidence-backed complete_step stays phase-blocked without changing canonical state, and completes the same step through todo_write.
Verification:
- go test ./internal/agent -run ^TestPlanModeTodoCreatedInTurnUsesTodoWriteRecovery$ -count=1
- go test -race ./internal/agent -count=1
- go vet ./internal/agent
- go test ./internal/tool -run ^TestBuiltinToolContractDocumentation$ -count=1
- go run ./tools/repolint
- git diff --check
Co-authored-by: poorpaper <[email protected]>
- /new: pin the rotated session path as the active override so the next
message cannot re-resolve the deterministic/mapped old path and silently
undo the rotation (P1)
- dingtalk: Start validates credentials and the initial connection
synchronously, surfacing start failures instead of a green "running"
status that never connects (P1)
- /model: report the fully resolved effective model (override → channel/
route → global) and reject provider-only switches that saved an
unresolvable "provider/" model (P2)
- config: Dingtalk RequireMention defaults to true, matching Feishu (P2)
- allowlist + self-user-ids: wire the Dingtalk entries into both the
desktop and CLI gateway configs (P2)
- CLI bot: apply direct [bot.dingtalk] runtime options via
MergeLegacyDingtalkChannel, same path as the desktop (P2)
- desktop: TestDingtalkBot resolves credentials from the selected
connection instead of the legacy block; SettingsPanel derives gateway
enabled state including dingtalk (P2)
- tests: regressions for rotation pinning, /model, dingtalk Start,
legacy channel merge and connection credential resolution
Problem
Repository lint rejected new complexity in the transcript arbiter, bridge contract, and diagnostic payload validators.
Root cause
Diagnostic event mapping and recovery types lived in the single scroll-writer module, while manifest, summary, event-index, and label validation were combined into two large Go functions.
Fix
Extract pure diagnostic mapping, recovery types, and the additive Wails binding contract into focused modules. Split the Go validation boundary by payload responsibility without changing accepted fields or runtime behavior.
Verification
- go run ./tools/repolint
- pnpm test:transcript
- pnpm test:transcript-browser
- env -u REASONIX_CHANNEL pnpm build
- REASONIX_CHANNEL=test pnpm build
- cd desktop && go test ./...
- cd desktop && go vet ./...
Problem
Windows WebView2 users can still see multi-screen scroll jumps, blank transcript viewports, and bottom drift in long sessions after the reduced-motion write loop was fixed.
Root cause
Virtuoso's data-known-size can describe a stale size-tree slot rather than the current row. Feeding it back into the remount cache propagates cross-row height assignments, while overlapping tail-settle and blank-recovery work can amplify the resulting layout correction.
Fix
Cache real itemSize DOM measurements by row and content width, bound tail-settle transactions and recovery remounts, and fall back to temporary full-row measurement when a generation remains blank. Add test-only privacy-safe scroll diagnostics that compile out of stable builds.
Verification
- pnpm test:transcript
- pnpm test:transcript-browser
- env -u REASONIX_CHANNEL pnpm build
- REASONIX_CHANNEL=test pnpm build
- cd desktop && go test ./...
- cd desktop && go vet ./...
When a message has no persisted session_mappings or /attach binding, the
gateway fell back to a fresh timestamp-named session file, so the same
Feishu chat spawned a new conversation per message. Derive a stable
chat→file path (dsh-dingtalk-channel's `ding-<chatId>` analogue) so the
same chat reuses one session across restarts.
- sessionProfileForMessage: fall back to botStableSessionPath when no
mapping/attach resolves
- getOrCreateSession: pin new conversations to the stable path instead of
degrading to a timestamp file
- botStableSessionPath: DM/direct keyed on chat, groups keyed per sender,
mirroring BuildSessionKey scope
- update repolint baseline for local-run (file-size debt)
Problem:
PR #9102 conflicted with the latest completion-summary presentation changes on main-v2, and the combined test fixture no longer satisfied the required Meta shape.
Root cause:
Both branches changed completion notice routing and the workspace summary at the same ownership points. A side-only resolution would either lose historical summary navigation or regress standard/delivery notice semantics.
Fix:
Preserve per-notice summaries, monotonic stale-safe reveal requests, repeat scrolling, and Files-to-Changes navigation while retaining neutral standard notices, scratch suppression, delivery attention, and quality-floor styling. Update the merged test fixture to construct a valid Meta value.
Verification:
Focused completion, controller, and workspace tests; workspace and transcript suites; production and test typechecks; hooks and CSS checks; frontend build and bundle budgets; repolint; diff check; real Chromium interaction verification.
Problem
Historical completion notices could open no verification details or a later turn's summary, and repeated reveals in the Changed overview did not scroll.
Root cause
Completion notices shared a no-argument callback backed by the current summary, while the reveal effect returned after consuming requests even when navigation state was already settled.
Fix
Bind normalized summaries to completion notices, carry target and turn context through reveal requests, invalidate stale contexts, scroll same-view requests immediately, and extract the verification panel and tests to preserve lint budgets.
Verification
Ran focused completion and workspace verification tests, workspace and transcript suites, production build, TypeScript checks, CSS and hooks lint, repolint, diff checks, and a clean-console Chromium click/scroll check.
Problem:
A failed mutation check could be omitted from the completion attention decision, and the neutral change notice labeled mutation receipts as files.
Root cause:
Completion attention was evaluated before counting failed checks, while the frontend reused receipt-count mutations as a file count.
Fix:
Count contract check failures before computing attention, pass the count into the shared policy helper, and describe mutation receipts as changes in every locale. Add focused regressions for both contracts.
Verification:
- go test ./internal/agent ./internal/completion ./internal/taskcontract ./internal/checkpoint ./internal/cli -count=1
- go test -race ./internal/agent ./internal/completion ./internal/taskcontract ./internal/checkpoint ./internal/cli -count=1
- go test ./... -count=1
- go vet ./...
- go run ./tools/repolint
- cd desktop && go test ./... -count=1 && go vet ./...
- cd desktop/frontend && pnpm exec tsx src/__tests__/completion-summary-presentation.test.ts
- cd desktop/frontend && pnpm exec tsx src/__tests__/use-controller-stream-progress.test.ts && pnpm exec tsx src/__tests__/completion-summary-ui.test.tsx
- cd desktop/frontend && pnpm exec tsc --noEmit && pnpm build
Problem: Users treated 本轮验证 as a second action on the quality notice.
Clicking it did nothing, so the orange card and 0/5 todos looked stuck.
Root cause: The notice only had View changes. The same words in the
workspace panel were a heading, not a control, and did not reveal the
summary when a file preview was selected.
Fix: Add a Turn verification button on completion notices that opens the
changed dock, returns to the overview, and scrolls to the summary. Keep
the in-panel title as a heading. Do not rerun checks or advance todos.
Verification: tsx src/__tests__/completion-summary-ui.test.tsx
tsx src/__tests__/workspace-changes-errors.test.tsx
tsc --noEmit
Problem:
Scratch-path inference could hide pathless Bash side effects, durable writes outside the workspace, and scratch symlink aliases into the workspace.
Root cause:
Delivery accounting treated script location as side-effect proof and equated non-workspace with non-delivery. Scratch classification used lexical paths only.
Fix:
Keep pathless Bash fail-closed, centralize delivery-mutation classification so only proven scratch is excluded, and resolve scratch aliases before assigning scope.
Verification:
- go test ./internal/evidence ./internal/completion ./internal/taskcontract ./internal/checkpoint ./internal/agent ./internal/cli -count=1
- go test -race ./internal/evidence ./internal/completion ./internal/taskcontract ./internal/checkpoint ./internal/agent ./internal/cli -count=1
- go test ./... -count=1
- go vet ./...
- go run ./tools/repolint
- GOOS=windows GOARCH=amd64 go test -exec=/usr/bin/true ./internal/evidence ./internal/checkpoint
Problem:
Scratch execution could suppress rewind coverage incorrectly, while completion attention was reclassified by mutable client state. Platform paths, lint budgets, and locale budgets also kept CI red.
Root cause:
A command-token heuristic conflated script location with all side effects, write scope resolved symlinks before the checkpoint safety layer, and completion events omitted the turn-time policy decision.
Fix:
Keep checkpoint coverage fail-closed, add a narrow turn-local scratch delivery scope, classify workspace symlinks lexically for the safety layer, carry authoritative floor and attention fields, stabilize the macOS watcher test, and ratchet locale budgets by the measured delta.
Verification:
- go test ./... -count=1
- go test -race on evidence, completion, taskcontract, checkpoint, agent, and CLI packages
- go vet ./... in root and desktop modules
- go test ./... -count=1 in the desktop module
- Windows cross-compilation for evidence and checkpoint tests
- frontend completion tests, typecheck, production build, and bundle budgets
- go run ./tools/repolint
Problem
Capturing /tmp probe scripts recorded outside_workspace, and bash that
only ran those scripts recorded bash_side_effect. Rewind then asked
the user to confirm "partial project coverage" for files that were
never in the workspace.
Root cause
CapturePath treated every path outside the workspace root as a project
hole. observeBeforeMutation recorded a bash gap whenever the tool could
not preview a workspace path.
Fix
Add GapScratch. Scratch preview paths and bash commands that only name
scratch files use that reason. Rewind confirmation ignores scratch-only
gaps so workspace restore is not blocked by probe scripts.
Verification
go test ./internal/checkpoint/ ./internal/agent/ ./internal/control/ ./internal/cli/ -count=1
Problem
The transcript turned every quality-summary gap into an orange
"this turn still needs attention" card. Research turns that only
probed /tmp, and standard-floor workspace edits without review,
looked like failed delivery.
Root cause
completionSummaryNeedsAttention treated partial verdicts, unavailable
review, and any gap_kinds as interrupts. The card reused one generic
sentence for every case.
Fix
Align desktop and CLI with NeedsAttention. Failed checks and delivery
gaps keep a warning with specific copy. Workspace mutations on the
standard floor become a neutral "changes this turn" chip. Scratch-only
turns insert nothing.
Verification
go test ./internal/cli/ -count=1
pnpm exec tsx src/__tests__/use-controller-stream-progress.test.ts
pnpm exec tsx src/__tests__/completion-summary-ui.test.tsx
pnpm exec tsx src/__tests__/use-controller-meta.test.ts
Problem
Any successful write, including /tmp probe scripts, incremented
completion Mutations and produced unverified_change / unreviewed_change
gaps. The host then emitted a quality summary that frontends treated as
attention.
Root cause
completion.Build and emitCompletionSummary counted every Write/Mutation
receipt. They did not ask WriteScope whether the path was a project file.
Fix
BuildAt filters Changes and Mutations to workspace paths. NeedsAttention
interrupts only for blocked turns, failed checks, unbacked claims, or
delivery-floor proof gaps. Standard unreviewed writes and scratch-only
turns stay quiet.
Verification
go test ./internal/completion/ ./internal/agent/ -count=1
Problem
Probe scripts written to /tmp or session temp were treated as project
writes. Delivery obligations and later quality cards then treated a
research turn as incomplete delivery.
Root cause
Writer classification only asked whether a path looked sensitive. It
had no notion of where the write landed, so /tmp/btc_klines.py and a
workspace source file used the same duty table.
Fix
Add WriteScope (workspace / scratch / outside). /tmp, /private/tmp, and
reasonix-session-tmp-* are scratch. Scratch writers create no
DiffReview or delivery-floor FullVerify duties. ClassifyEffect still
keeps WorkspaceWrite for mutation-risk scoring.
Verification
go test ./internal/evidence/ ./internal/taskcontract/ -count=1
Problem:
When requestAnimationFrame stopped firing (WebView2 window minimized or
occluded, main thread saturated by a long transcript), text/reasoning
deltas piled up in the rAF batch buffer indefinitely: nothing was flushed
until a non-stream event (e.g. Stop) called drain(). Users saw the
transcript frozen on "thinking…" with the whole reply appearing only
after pressing Stop, even though the backend had finished streaming.
Root cause:
createRafBatch only flushed on requestAnimationFrame callbacks and had no
fallback when frames stopped being produced.
Fix:
Arm a 200ms stall timer alongside the rAF handle. Whichever fires first
flushes; an earlier flush cancels the timer, so the visible path keeps its
one-flush-per-frame behavior and the fallback only engages while rAF is
stalled. Add a dedicated raf-batch test suite covering the visible path,
the stalled path, drain semantics, re-entrant pushes, and the microtask
fallback.
Verification:
- tsx src/__tests__/raf-batch.test.ts (19/19)
- tsx src/__tests__/stream-delta-batch.test.ts (20/20, regression)
- tsx src/__tests__/use-controller-stream-progress.test.ts (95/95, regression)
- tsc --noEmit
- eslint src/lib/rafBatch.ts src/__tests__/raf-batch.test.ts
- Add max-height: none to .workspace-preview__body--code .code so the
.code--scroll-y class (added for virtual-scrolled files) does not cap
the preview at min(60vh, 28rem), which left the bottom half empty.
- Introduce codePreviewLayoutActive to keep the flex-column layout
during code file loading, avoiding stale gaps when the viewer mounts.
Ctrl+V ran the image path unconditionally and blocked the whole paste when
no image was found, reporting a missing wl-paste/xclip even where both are
installed. Separate an empty clipboard from a missing tool, degrade to text
paste, and skip the fallback when the terminal already delivered a bracketed
paste for that key press.
Closes#8992
- Replace dead section-title CSS with pinned folder icon rules
- Override :root[data-theme-style] display:none for nested SVGs
- Set icon to 14x14 with fg-faint color to match folder icon sizing
- Add Pin icon with folder styling to the 'Pinned' section header
- Always show pin/unpin action button in compact topic mode
(remove unread status dependency so the button is consistently visible)
2026-07-16 17:25:54 +08:00
2809 changed files with 274267 additions and 46251 deletions
t.Fatalf("saved user config did not preserve seeded desktop prefs: lang:%q layout:%q theme:%q style:%q close:%q status:%q",userCfg.DesktopLanguage(),userCfg.DesktopLayoutStyle(),userCfg.DesktopTheme(),userCfg.DesktopThemeStyle(),userCfg.DesktopCloseBehavior(),userCfg.DesktopStatusBarStyle())
fmt.Println("native transcript smoke unavailable: set REASONIX_ALLOW_FOREGROUND_NATIVE_INPUT=1 for the bounded 2s local micro-test; full native input runs only with REASONIX_NATIVE_SMOKE_ISOLATED_CI=1")
return"",fmt.Errorf("instance exited during inspection")
}
returnwindows.UTF16ToString(buffer[:size]),nil
}
funcnotifyHandoffBlocked(installedbool){
message:="Reasonix could not finish the update restart. Choose Quit in the old Reasonix window, then open Reasonix again. Your running instance was preserved."
ifinstalled{
message="The new version is installed, but restart is incomplete. Choose Quit in the old Reasonix window, then open Reasonix again. Your running instance was preserved."
returnworktree.MergeInspection{Available:false,Reason:"tab not found",ChangedFiles:[]string{},ConflictFiles:[]string{},Blockers:[]worktree.MergeBlocker{},CleanupBlockers:[]worktree.MergeBlocker{}},a.workspaceNotReadyErr(nil)
blockers=append(blockers,worktree.MergeBlocker{Code:"tab_building",Message:"a source or worktree runtime is still building or unavailable",Paths:[]string{}})
}
ifactive{
blockers=append(blockers,worktree.MergeBlocker{Code:"active_work",Message:"a source or worktree runtime still has active or waiting work",Paths:[]string{}})
Content:"This turn was interrupted. Partial output is kept for reference; only completed tool pairs and a bounded recovery summary enter the next model turn. Inspect the workspace before continuing or reverting changes.",
assert(Object.values(identities).every(Boolean),"layout variants and management-page visits retain Sidebar, Composer, actual WorkspacePanel/tree and file preview identity");
assert(awaitpage.locator('.remote-surface').count()===1,"global New Session stays on the remote workspace instead of opening a local blank");
assert(awaitpage.evaluate(()=>window.__appBrowserIdentity.composer===document.querySelector('textarea.composer__input:not([aria-hidden=true])')),"local/remote navigation and remote New Session preserve the Composer DOM identity");
if(!prepared.executionId||prepared.identity.sourceSHA!==process.env.EXPECTED_SOURCE_SHA)thrownewError("prepared memory build belongs to another commit");
return;
}
// Each run owns a fresh production build; an unverified dist is not evidence.
process.stdout.write(`[app-memory] process ${index}: ${JSON.stringify({checks:result.checks,attribution:result.attribution,metrics:result.metrics})}\n`);
if(!summaryBox||!composerBox||summaryBox.y+summaryBox.height>composerBox.y||summaryBox.y<0)throwError('search summary is outside the readable transcript viewport');
if(!sessionPath||sessionPath!==window.__runtimeFixture.tab.sessionPath)thrownewError("Composer did not bind its selected session path: "+JSON.stringify({tabId,sessionPath,expected:window.__runtimeFixture.tab.sessionPath}));
assert(overlaps===0,`${label}${iteration+1}/${iterations}: released content growth leaves no overlapping visible blocks`);
assert(result.anchorMaxDrift<=4,`${label}${iteration+1}/${iterations}: every painted measurement frame preserves the anchor (${result.anchorMaxDrift.toFixed(1)}px)`);
Loaded 100 of 2809 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
SivanCola