Replace the server and UI client pins with the npm beta dist-tag and regenerate both supported lockfiles from the current published channel. Update migration and architecture documentation so no specific beta build or obsolete next-channel wording is treated as CodeNomad's target.
Resolve the CLI beta dist-tag from the npm registry before calculating update availability, while invoking package managers with @opencode-ai/cli@beta. Verify the installed CLI against the observed concrete version and accept a newer build when the channel advances during installation.
Adapt UI event types to the current generated SessionStatusUpdated declaration. Cover channel-based commands, registry failures, stale installs, concurrent updates, and mid-update channel advancement; validate server/UI/Electron typechecks, server and UI suites, and the UI production build.
Embed Google OAuth client secrets so Gemini and Antigravity refresh
without extra env vars and merge retrieveUserQuota buckets with
fetchAvailableModels. The window now correctly picks daily vs 5h,
matching openchamber's vscode quotaProviders.
Add the providers openchamber already serves but CodeNomad missed:
command-code (whoami + billing/credits), crof, deepseek, neuralwatt,
github-copilot-addon (premium-only) and claude via the same OAuth
plugin openchamber uses (api.anthropic.com/api/oauth/usage with
retry-after cooldown 5m-1h). All read from the OpenCode auth file
and stay behind the same provider registry and cache.
Update the provider registry test to cover the new ids and flip the
claude assertion from NotConfigured to the plugin.
Read xAI usage from the provider API and keep OAuth quota refresh from inventing a selected model. The usage panel maps credits_balance onto the existing credits row.
The combobox used to seed and auto-select from leftover input. Search is now a plain field, so opening the picker no longer changes the current model.
The agent shortcut opens the list instead of submitting Enter. Provider auth calls go through the active catalog location.
Home and Fin now fetch oldest or latest and swap the visible page. Older and newer pages do the same. Live events only land on the latest window so history stays still.
A restored history cursor that returns no messages no longer marks the session loaded. Open retries latest, which was why transcripts went black after refresh.
Stale Solid reads during that load are ignored. Tests cover window planning, replace-on-failure, and the empty-cursor retry.
A successful reply or cancel is now local authority. Sync and SSE cannot requeue that prompt unless the server still lists it. Failed mutations resync instead of leaving the queue stuck.
Poll liveness every 30s while a session is working or a prompt is open, and include session plus form locations in the pending-request scan.
Keyed Show on session and message objects threw during batch updates, which cancelled the switch and left the transcript empty. Gate those branches on ids or booleans, unmount hidden session views, and keep assistant model metadata optional.
Selecting a child with no resolved root now falls back to the session itself so the list click still activates.
Revalidate cached shared-service connections periodically and invalidate them after proxy authentication or network failures so a restarted daemon is rediscovered without relaunching one process per workspace. Validate instance routes before daemon discovery and keep the shared authorization lifecycle synchronized with the proxy.
Add single-flight worktree discovery with a longer bounded cache and invalidate it after worktree mutations. Extend coverage for connection revalidation, explicit invalidation, and proxy 401 handling.
Validation: server typecheck; full server test suite 298 passed, 2 skipped; targeted proxy and shared-service tests 40 passed. Real CodeNomad load reached 10 active parents and 71 active children before the shared OpenCode daemon restarted, so the 10x80 overlap remains an upstream load-limit finding rather than a passing result.
Keep the four MiB display cap without retaining split UTF-16 surrogates or partial ANSI CSI, OSC, DCS, APC, and PM control strings. Handle ESC-backslash terminators and CAN/SUB cancellation so visible output is preserved.
Validated with four shell-store tests, including Unicode and ANSI boundary probes, plus the UI typecheck.
Track admitted proxy mutations through upstream response completion and key deletion fencing by the canonical physical worktree root. Nested paths, duplicate logical workspaces, symlink and junction aliases, WSL paths, and stale missing descendants now converge on the same identity while unresolved reparse points fail closed.
Evacuate every session belonging to that identity before removal, refresh stale worktree caches, and bound mutation draining so deletion cannot hang indefinitely or overtake active upstream work.
Document OpenCode's confirmed one-process architecture. Validated with all 299 server tests (297 passed, 2 skipped), focused Windows junction and WSL probes, server typecheck, and diff check.
Advance the retained output boundary past split UTF-16 surrogates and partial ANSI CSI sequences. Truncated shell output no longer begins with malformed Unicode or a literal escape fragment.
Validated with four shell-store tests and the UI TypeScript check.
Keep restart serialized with shutdown while limiting the CLI stop phase to two seconds. A slow restart now fails without respawning and leaves the Windows session-end path time to flush renderer and native state.
Validated with cargo fmt and all 121 Tauri tests on Windows.
Reopen the serialized CLI lifecycle and restart the embedded server when client-state ownership release fails after shutdown. Restored windows remain functional while the next quit retries the dirty state drain.
Validated with 73 client-state, lifecycle, and process-stop tests plus the Electron TypeScript check.
Release admitted worktree mutations only when reply-from receives the upstream response or error, so downstream disconnects cannot let deletion overtake an OpenCode mutation. Deletion waits fail closed after a bounded timeout.
Canonicalize workspace directories through the resolved Git worktree and use that identity while inventorying sessions, preventing dot, duplicate-separator, symlink, and junction aliases from bypassing the fence.
Validated with 61 manager, proxy, route, and evacuation tests including delayed upstream, alias, rollback, and timeout cases, plus the server TypeScript check.
Track admitted workspace mutations by normalized directory and hold deletion until their proxy responses finish. Once deletion is queued, later mutations targeting either the host or service worktree path are rejected atomically.
This closes the remaining window where a create or move admitted just before the deletion fence could complete after final session inventory.
Validated with 30 worktree evacuation, route, and proxy tests plus the server TypeScript check.
Run the complete CLI stop/start restart while holding the shutdown coordinator authority. Shutdown now waits for an admitted restart, while restart requests arriving after shutdown begins fail without spawning another process.
This prevents final cleanup from racing a restart that could recreate the embedded server immediately before application exit.
Validated with cargo fmt and all 121 Tauri tests on Windows.
Keep only the newest four MiB in the shell output dialog and skip ANSI reparsing when a poll returns no new bytes. The native output file remains unchanged and the existing truncation notice is shown when the display cap is reached.
This prevents long-running verbose shells from growing renderer memory without bound or repeatedly reparsing unchanged output.
Validated with the shell store test and UI TypeScript check.
Serialize deletion attempts per worktree and mark both host and service directories blocked from enqueue through completion. Workspace proxy mutations targeting a blocked directory now fail before reaching OpenCode.
This prevents concurrent deletes from rolling sessions back into an already removed worktree and closes CodeNomad's session create or move window between final inventory and Git removal.
Validated with 29 worktree evacuation, route, and instance-proxy tests plus the server TypeScript check.
Keep client-state ownership and reopen persistence when a shutdown drain rejects. A later renderer flush can now persist dirty state before a successful retry releases process and cross-host ownership.
This prevents a failed late write from turning every subsequent normal quit into a non-primary no-op followed by forced state loss.
Validated with 46 Electron client-state and lifecycle tests plus the Electron TypeScript check.
Expose native OpenCode shell output from the Status panel, keep shell records visible when removal fails, and render distinct process cards with explicit output and removal actions. Cover terminal timeout and killed states in every supported locale.
Parse canonical reasoning headings separately from their detail so the heading is not duplicated in expanded output, and disable expansion when no detail exists.
Validated with all 518 UI tests and the UI TypeScript check.
Fence renderer access across queued reloads and cross-origin navigation, preserve remote-window authority through overlapping loads, and route shutdown through serialized lifecycle ownership before rotating client-state tokens.
Keep the Tauri CLI control channel attached on Windows, enforce identity-aware bounded process-tree cleanup, and expose only the native permissions required by local windows.
Validated with 170 Electron native tests, Electron typecheck, and all 121 Tauri Rust tests.
Keep one pinned OpenCode V2 background service, validate every proxied workspace location and cursor, and route host and WSL service discovery through bounded authenticated lifecycle adapters.
Evacuate every paginated worktree session before Git deletion, roll moves back when removal fails, and reconcile UI worktree state only after the server confirms deletion. Native session and shell ownership remains scoped without creating or stopping a daemon per workspace.
Validated with the complete server suite (284 passed, 2 skipped), server typecheck, and the UI worktree deletion authority test.
Serialize validation and eviction authority for duplicate workspaces, keep timed-out cleanup attached to the old owner, and remove failed unpublished launch records even when their best-effort OpenCode location eviction also fails.
This prevents invisible failed records from suppressing later final eviction while preserving shared-daemon ownership and avoiding per-workspace service shutdown.
Validated with all 27 workspace manager lifecycle tests, including concurrent deletion, timeout, shutdown, header failure, and replacement-owner scenarios.
Propagate renderer client-state flush failures through interactive local close and normal application shutdown. A failed close now retains the persisted window record, while a failed quit restores hidden windows instead of destroying the renderer's only dirty snapshot.
Windows OS session-end remains the explicit bounded fail-open path so logout and machine shutdown cannot be vetoed indefinitely.
Validated with 15 lifecycle and renderer-flush tests, including oversized-snapshot failure simulations for local close and global quit.
Treat a repeated drain as complete once the first drain's finally block has already released primary ownership. The first drain for secondary clients still runs so process registration markers are not leaked.
This lets a user retry application shutdown after a queued persistence failure instead of reusing the permanently rejected release promise on every subsequent attempt.
Validated with all 33 Electron client-state tests, including a new failed-write and repeated-drain regression case.
Publish native root session pages before descendant inventory enrichment, preserve native cursor authority across refresh and history pagination, and reconcile complete message snapshots without racing newer runtime state.
Hydrate restored session branches concurrently by ancestry level and gate initial session/message work only on project identity rather than supplemental MCP and plugin metadata. This keeps saved selections and transcripts responsive across multiple restored workspaces while retaining authoritative cleanup.
Validated with 43 targeted UI tests covering session request authority, message pagination, metadata replacement, and message-store restoration, plus the UI TypeScript check.
Use indexed access in the host OpenCode service fixture so the server test sources compile under the repository's current TypeScript library target during Tauri packaging.
Validated with the focused host service tests, server typecheck, and git diff checks.
Preserve native V2 session and message cursor semantics while keeping restored history, concurrent roots, drafts, and interruption state authoritative across reconnects and client replacement. Historical scroll restoration and conversation search now load older pages safely with bounded, retryable progress, and partition commits reject snapshots above the native 256 MiB budget.
Serialize workspace location eviction against creation, release failed initial daemon identities, and translate WSL certificate paths under one deadline. Electron and Tauri now retain window persistence through failed shutdown or close operations, fence navigation generations, bound CLI cleanup, and keep remote-window origin and TLS authority isolated across concurrent reuse.
Refresh the architecture guide for the current Forms-based V2 client and strict Electron/Tauri parity. Coverage includes 277 server tests, 333 UI tests, 163 Electron tests, 117 Tauri tests, all TypeScript typechecks, Rust formatting, and complete Windows Electron ZIP and Tauri NSIS builds.
Document the reviewed CodeNomad and OpenCode Desktop V2 baselines, incremental methodology, existing parity, and every defect closed by the accompanying implementation changes.
Separate remaining work into active-location correctness, undo/redo, release signing, coordinated runtime upgrade, and optional PTY, export, reference, and MCP-resource features. Record rejected false positives and the validated Ponytail reduction.
Link the comparison from the migration guide and documentation index so future V2 upgrades can resume from an explicit commit baseline instead of repeating the full audit.
Delete unused client-connection notifications, spawn classifications, WSL metadata, workspace creation fields, one-element event sets, and renderer helpers left behind by the V2 restructuring.
Remove obsolete Shell rename translations and test-only fixtures or captures that had no production caller. Preserve shared-daemon ownership, WSL launch behavior, restore state, pagination, and multi-window lifecycle semantics.
The cleanup removes 257 lines while adding 23 lines of direct replacements. Focused server and UI suites, all native host suites, typechecks, the UI build, and independent diff review passed.
Load continuation message pages with the native cursor alone, hide deprecated models, and tolerate failed plugin records that do not carry an ID.
Match official Desktop URL handling by limiting native external openers to web and mail schemes. Connect wildcard-bound shared services through loopback while preserving strict authentication and non-loopback rejection.
Remove the inactive unrestricted Tauri asset scope and add focused regression coverage for cursor requests, model/plugin projection, URL schemes, and wildcard service discovery.
Validated with focused UI/server tests, all 158 Electron native tests, all 104 Tauri tests, package typechecks, the UI production build, Rust formatting, and diff checks.
Rewrite the migration guide around the architecture now present on DEV-v2. Inventory the removed V1 plugin, runtime, background-process, Question, delta, and native Tauri event layers; describe their native V2 replacements and the shared-service ownership model.
Document duplicate-folder instances, per-window tabs, native cursor authority, reconnect reconciliation, worktree evacuation, proxy security, multi-window persistence, restore fencing, UI performance work, current automated validation, and the remaining interactive smoke gate. Remove stale claims about private OpenCode storage, daemon shutdown, canonical workspace deduplication, projection resets, and pending CI.
Validated with stale-claim searches and git diff --check.
Delete the unused ClientStateLifecycle implementation and its isolated tests now that every production window routes through MultiwindowLifecycle. Remove the deleted test file from the native test command without changing multi-window close, persistence, or shutdown behavior.
Validated with all 158 Electron native tests and the Electron TypeScript typecheck.
Remove the one-caller workspace identity module now that logical workspace deduplication no longer exists. Keep realpath canonicalization directly at the launch boundary and cover it through duplicate alias creation behavior.
This removes another 22 net lines and one source file. Focused manager tests and the server typecheck pass.
Create a fresh logical workspace for each normal folder launch so repeated opens produce separate tabs again. The explicit Open action still selects an existing instance without creating one.
Keep the shared OpenCode location alive until its final logical workspace closes. Remove canonical deduplication, multi-owner launch bookkeeping, inode identity state, and the tests that only supported that behavior.
Validated with the full server suite, restore ownership tests, server typecheck, and focused concurrent launch and location eviction coverage.
Show the initial loading state while the native session cursor is still unresolved, including the metadata hydration window before the list request starts.
Remove the misleading load-more label from the pagination sentinel because the shared fetch flag tracks initial and refresh requests rather than cursor requests. Native cursor handling remains authoritative, including terminal empty pages.
Validated with UI typecheck, focused pagination and request-authority tests, and the production UI build.
Coalesce concurrent provider and agent catalog requests per OpenCode location while preserving one trailing refresh after reconnect, authentication, or catalog invalidation. Fence stale responses with monotonic request generations and cancel removed-instance flights so reused workspace IDs cannot install obsolete providers, agents, models, or commands.
Load only the selected session transcript instead of eagerly requesting every descendant. Keep thread cost and token totals complete from native session aggregates, including newly paginated descendants, while retaining cursor-based transcript history loading.
Strip upstream WWW-Authenticate and Proxy-Authenticate challenges alongside response cookies so OpenCode authentication cannot trigger the browser's native Basic Auth dialog. Coverage exercises coalescing, invalidation, location switches, instance-ID reuse, lazy transcripts, native totals, and real 401 proxy responses.
Preserve the OpenCode data controller across reconnects, require the native server.connected handshake, restore native cursor pagination for sessions and messages, and route global Forms through their validated worktree locations.
Make partitioned client state tolerate corrupt inactive leaves and store unsent attachment payloads as bounded content-addressed chunks without silently rewriting drafts. Align Electron and Tauri commit limits and shutdown-generation fencing.
Tighten SSE CORS, proxy ownership checks, remote-window navigation, process exit classification, and pre-navigation renderer flushing. Ordinary backend shutdown now detaches local workspaces without evicting shared OpenCode locations.
Coverage includes server proxy/event/lifecycle tests, UI pagination and restoration tests, Electron native lifecycle/security tests, and the full Tauri Rust suite.
Replace Array.prototype.at() in the new OpenCode service tests with equivalent indexed access so the Tauri prebuild compiles under the server workspace's existing TypeScript library target on macOS ARM64.
Validated with the full server production build and the focused host/WSL service test suite (14 passing).
Use the official host and WSL OpenCode service lifecycle instead of private daemon ownership. Workspace deletion now evicts only the selected location while shared sessions, agents, messages, and executions remain available to other windows.
Add profile-scoped singleton multi-window support for Electron and Tauri, isolate local window UI state in a durable partition graph, and preserve migration, fencing, bounded persistence, and cross-host ownership semantics. New Window and New Instance are exposed together in the native Window menu.
Harden renderer authority, remote profiles, SSE identity, idle attention, git-status concurrency, SideCar sandboxing, shutdown, generated Tauri ACLs, documentation, and CI coverage.
Validated with server, UI, Electron, and Tauri test matrices; TypeScript checks; cargo fmt; production Electron/server/Tauri builds; diff checks; and a packaged Windows smoke covering singleton focus, --new-window, one shared backend, menu placement, and slot hash verification.
Migrate the Status panel from interactive PTYs to the location-scoped shell API, refresh shell state after lifecycle events and reconnects, and route locationless shell events by their owned working directory.
Allowlist shell routes explicitly and verify ShellInfo.cwd before every ID-scoped request, including trailing-slash aliases, while preserving native output cursor parameters. Keep PTYs separate for interactive terminal use.
Load project metadata before the first session inventory, preserve native projected message order, invalidate inactive transcripts instead of reloading every transcript after reconnect, and keep native shutdown terminal without latching ordinary navigation flushes.
Update V2 documentation and CI test paths. Validated with UI and server typechecks, 15 focused UI tests, 35 focused server tests, and git diff --check.
Use the inbox identifier returned by OpenCode as the authoritative message identity instead of assuming every compatible CLI preserves the client-provided optimistic ID. This prevents the optimistic and admitted prompts from remaining as duplicate bubbles when their IDs differ.
Delete the replaced store record through a Solid produce update so the old key is actually removed. Covered by the optimistic send lifecycle suite and validated with the UI typecheck.
Stop comparing the selected OpenCode CLI version with the generated client package and stop constraining shared-service discovery to that exact string. Runtime releases can now update independently while existing health, location, API decoding, and launch-signature checks continue to fail closed on actual incompatibility.
Update migration and architecture guidance so the strict gate is not reintroduced. Validated server typecheck, 32 focused manager/service/identity tests with one platform skip, Tauri release build, NSIS installer hash, and diff cleanliness.
Disable native select required validation once a non-option custom value is present, so required long-option forms can submit through the existing schema validation.
Validated with UI typecheck, focused form protocol tests, and git diff --check.
Render the floating Form fallback whenever its inline tool target is unresolved, and allow required custom select answers to pass native validity checks. This prevents native Forms from leaving sessions permanently blocked.
Recheck affected session activity before each evacuation move and immediately before Git removal so execution starting after preflight aborts and rolls the transaction back. Validated with root typechecks, focused Form and projection tests, evacuation tests, and server typecheck.
Confirm same-ID user messages when createData exposes their native projected parts. This removes the client-only optimistic parts before applying the server representation, preventing every submitted prompt from rendering twice inside one message.
Add a regression that starts with an optimistic text part, applies the native inbox event, and asserts only the projected prompt remains. Validated with UI typecheck and 17 focused projection, send lifecycle, and request authority tests.
Scope global Form actions to the logical workspace location without hydrating a synthetic global session. Keep successfully loaded message sessions eligible for later reconnect retries and traverse project descendants independently of parent worktree subpaths.
Treat native session moves as asynchronous operations, block active worktree sessions, verify complete project inventory before Git removal, and roll all accepted moves back if verification or Git deletion fails.
Validated with server and UI typechecks, 255 passing server tests plus 3 platform skips, 31 affected UI tests, and git diff --check.
Merge live createData projections into REST history and reset their event cache for every internal stream generation. Load sessions by validated project scope across all descendant depths and apply native active state to later root pages.
Pin the updater and standalone server lockfile to the startup-compatible client version. Decode and authorize native session cursors, permit global Form actions, and prevent the WSL stop path from invoking the client's host PID fallback.
Make worktree deletion server-authoritative by inventorying the complete native project, moving affected session families with verification and rollback, and failing direct delete calls closed when evacuation cannot complete.
Validated with server and UI typechecks, 254 server tests plus 3 platform skips, 247 UI CI-partition tests, 122 Electron native tests, server/UI/Electron production builds, standalone server lockfile installation, Tauri cargo check --locked, and git diff --check.
Pin the server and UI client to the installed beta runtime and reject mismatched CLI versions before shared-service startup. Delegate proven shared-service shutdown to Service.stop while retaining CodeNomad lease, peer, registration, endpoint, and process-identity checks.
Adopt native Forms and the client/solid data reducer for live messages, tools, permissions, and input forms. Propagate internal stream generations into authoritative reconnect reconciliation and replace directory-wide session scans with native project cursor pagination.
Fail worktree deletion when session evacuation fails and deduplicate canonical workspace folders instead of exposing non-isolated duplicate instances. Update migration notes and CI coverage for the reviewed contract.
Validated with server/UI/Electron typechecks, 244 UI partition tests, 122 Electron native tests, 248 server tests plus 3 platform skips (the sole Windows cleanup race passed in isolation), UI/server/Electron builds, Tauri cargo check --locked, and git diff --check.
