## Highlights
- **A unified Files workspace**: Browse Workspace, Changes and Commits
in one panel, open central file/diff previews, edit text with Save or
Ctrl/Cmd+S, and inspect historical image changes without checking out
another revision.
- **Better mobile and narrow-window layouts**: Conversation controls
stay compact, the composer follows the visible conversation height, and
desktop minimum sizes respect application zoom. Mobile browser-preview
templates now use native touch emulation when available.
- **Questions and permissions above the composer**: Answer native
requests in a dedicated dock without losing your draft. Completed
questions retain selected-option descriptions and free text, and
permission decisions remain available as durable receipts.
- **Native skills and web search**: Attach Location skills through `@`,
view structured search results and provider-consent requests, and
configure global or project web-search defaults in Preferences.
- **Provider account controls**: Select, rename and remove native
provider accounts, with optional Codex account rotation based on fresh
quotas. Usage stays stable across catalog refreshes and repeated
connection events.
- **Fewer responsiveness stalls**: Event routing no longer waits behind
worktree discovery, compaction-related discovery is deferred safely, and
supported pending-request recovery avoids loading historical Locations.
## Files and conversation workflow
- Workspace, staged/unstaged Changes and paginated Commits share
file-row preview controls. Selecting a row no longer opens a preview
implicitly.
- Stage or unstage files with explicit actions or drag-and-drop; commit
actions remain at the top of the staged section.
- Workspace text and Markdown source stay editable in the central
reader. Unsaved drafts survive closing or switching readers, and saving
checks for external changes before overwriting.
- Git image previews use the actual compared revisions rather than
substituting the current file. Historical diffs remain read-only.
- File trees, Git status and history serve cached snapshots and
revalidate lazily; Monaco tokenizers ship locally for offline
highlighting.
- Question and permission queues retain stable selection and request
drafts across refreshes and session navigation. Multiple requests use
bounded previous/next navigation.
- Full-history search fills result pages correctly and avoids redundant
counting work.
- Enter in a composer picker no longer accidentally submits a draft;
model favorites mode persists independently of the active model.
- Preview and persistent utility windows expose a close action in their
existing toolbar.
## Providers, skills and native tools
- Preferences separates model providers and web-search providers,
including a global search default and project override.
- Search results and provider-consent Forms use dedicated native
presentation, with raw output retained for unrecognized responses.
- `@` skill selection attaches removable badges and sends explicit
native skill IDs with the prompt.
- Code Mode output displays native tool-call metadata alongside the
existing image/output surface.
- Native provider account ordering determines the active account;
environment-based connections remain read-only.
- Codex quota reads follow the selected native account. Optional account
rotation is opt-in, checked before prompt/command admission, and never
replays a failed prompt.
- Usage panels preserve quota values during provider catalog refreshes
and duplicate connection notifications, and explain feature-local
runtime limitations.
## Mobile, desktop and reliability
- Composer context selectors and actions stay on one row; narrow
conversation headers use their overflow menu and hide the timeline below
420 CSS pixels without changing the saved preference.
- Manually resized composer heights are stored proportionally and adapt
to visible-viewport changes, including the mobile keyboard. Long drafts
remain scrollable.
- Electron and Tauri desktop minimum sizes follow application zoom.
Native mobile browser previews automatically apply touch emulation;
iframe fallback changes dimensions only.
- Tauri on macOS avoids startup geometry-event feedback; Electron avoids
accessing destroyed windows during close.
- OpenCode installation shows sustained progress and can recover
interrupted Windows installations.
- Local TLS certificates use positive serial numbers, with repair of
affected local certificates.
- Server information distinguishes the server platform from the client
environment.
- Event ownership checks use registered worktrees without joining slow
discovery scans. Pending queues remain intact on incomplete coverage or
recovery errors.
- Missing-session errors remain identifiable for orphaned subsessions,
and parent-session creation is fenced against invalid lifecycle
transitions.
## Runtime and upgrading
- **OpenCode 2.0.22 is the recommended and qualified runtime for this
release.** The technical minimum remains **2.0.7**; feature-local API
requirements do not raise the global minimum.
- Codex quota reads require the native credential API introduced in
**2.0.20**. Older services show feature-local unavailability rather than
blocking the application.
- Loaded-only pending-request recovery uses a connection-negotiated
capability qualified with **2.0.22**. Older services retain their
discovery behavior; updating CodeNomad alone does not give them this
recovery optimization.
- **Upgrade remote CodeNomad servers to 0.20.1 for the published UI.**
Its manifest requires the matching backend for the new routes.
- Installing or updating the OpenCode CLI does not silently restart an
already-running shared service. Restart remains an explicit action.
**Full Changelog**:
https://github.com/NeuralNomadsAI/CodeNomad/compare/v0.20.0...v0.20.1
## Summary
Prepare stable CodeNomad 0.20.1 on top of `dev@8ce70ec4`, the source of the latest requested prerelease, before publishing through `dev -> main`.
- Align root, server, UI, Electron and Tauri npm versions and workspace lock metadata to `0.20.1`.
- Align the native Tauri configuration, Cargo manifest and application lock entry.
- Require CodeNomad server `0.20.1` in the remote UI manifest, so the updated Files, provider settings and pending-request surfaces use the matching backend routes.
- Leave the dependency graph unchanged.
This preparation PR targets `dev`; only the subsequent push to `main` publishes the stable release.
## Validation
- Clean locked dependency installation in an isolated release worktree.
- Version consistency assertions across npm/lock metadata, Cargo and Tauri; dependency graph comparison against the parent commit.
- `npm run sync:version --workspace @codenomad/tauri-app` confirms all native versions are aligned.
- UI, server and Electron typechecks pass.
- Full server production build, including the UI and bundled plugins, passes.
- Remote UI selection and dev-release channel tests pass (3 tests).
- `git diff --check` passes.
Native installers and the cross-platform release matrix have not been rebuilt locally. Existing local work and suspended worktrees are untouched. CI is not being waited on or monitored as requested.
Recover pending Forms and Permissions through a fixed presence-owned RPC in
the existing bundled plugin, without warming historical native Locations.
Validate established execution-host origin, complete coverage, directory/Git
ownership, WSL aliases and every placement before admitting capability.
Keep generic RPC forwarding closed and preserve non-authoritative failures.
Observe native compaction before event ownership routing and defer expensive
legacy discovery before inventory reads and at forwarding. Preserve concurrent
holds, bounded missed-end probes, exact settlement reconciliation grants,
per-kind mutation fences, global/idle Forms and settled-request tombstones.
Never replay ambiguous mutations. Share presence observations, not registrations
or execution authority.
Integrate current dev receipt and event-ownership changes. Reassert the native
connection after permission receipt preparation and before granting settlement
reconciliation or dispatching mutations. Reject overflowing raw JSON numbers,
including unknown metadata, without altering native numeric codec strings.
Use eight-directory UI batches with the unchanged request deadline and URL
budget rather than weakening ownership checks or extending timeouts.
Add scoped broker, reader, presence, proxy, compaction and UI lifecycle
regressions plus an opt-in isolated native reader fixture. Independent
Gatekeeper reviews are published on the PR; R1's numeric overflow finding is
fixed and rechecked on the final head before merge.
The private reader is qualified for native 2.0.22 / Effect rc.112 only. The
global minimum and already-recommended 2.0.22 remain unchanged. Unsupported
runtimes retain guarded legacy recovery. This mitigates CodeNomad's load
amplification, not the upstream Bus issue or previously retained Locations;
installed-application freeze resolution, deployment and daemon restart are
not claimed. Preserve bootstrap-warming and bounded-scan limitations.
## Summary
- Continue sparse history scans until a bounded result page is filled,
publishing matches progressively across sessions.
- Remove the automatic count traversal. Show page-local results and
messages scanned directly from search responses, with no scan when
opening an empty search.
- Project text-only content in SQLite, reduce bounded RPC round trips,
and share identical location checks only inside a request.
## Validation
- UI/server typechecks and targeted server/store tests passed.
- Chromium regression covers progressive results, pagination, workspace
scope, technical toggle, empty results and absence of statistics
requests.
- Isolated native OpenCode 2.0.22 fixture passed, including all 242
workspace matches across two sessions and pruning/ownership regressions.
- Synthetic benchmark: text search materializes 9.6 KB instead of 145
MB; CPU gain is modest because SQLite still parses stored JSON. See
dev-docs/SESSION_HISTORY_QUERIES.md.
## Review
Independent gatekeeper review and post-rebase validation in progress;
findings will be addressed before administrator merge.
## Summary
- Persist all permission decisions: allowed once, always allowed and
rejected, with request context and known reasons. Distinguish CodeNomad,
automatic Yolo and native settlements.
- Keep receipts visible alongside transcript messages even with hidden
tools; provide paginated source-less session receipts. Ownership-checked
bounded reads, atomic profile storage, deletion cleanup and stale-read
fencing.
- Enrich completed native question receipts with selected-option
descriptions, verbatim custom answers and a disclosure for other
choices. Translate labels in all ten locales.
## Validation
- Locked dependencies installed; server and UI TypeScript checks pass;
production UI build passes.
- 126 targeted server regressions during implementation, then 26
receipt/replier/service checks against the pinned client passed.
- 20 receipt/dock browser tests and 21 history navigation tests pass; 5
question decoding/copy tests pass.
- Rendered captures inspected at 393/1100px in light/dark, including
long text and pagination.
## Persistence boundaries
Native permission events are ephemeral: past lost decisions cannot be
reconstructed. Receipts are CodeNomad annotations outside native
search/copy/export. Storage namespaces follow execution host, native
root and authenticated channel; credential rotation starts a new
namespace. Bounded text excludes metadata/diffs.
## Review
Autonomous independent gatekeeper review will be published and repeated
until zero findings before the user-requested admin merge.
## Maintenance
Existing oversized files touched: server/http-server.ts (~2415),
server/api-types.ts (~717), server/index.ts (~707),
ui/message-section.tsx (~1566), ui/lib/api-client.ts (~650).
## Summary
Follow-up to merged #835: fix the demonstrated dependency behind real
`Instance event relay routing timed out` disconnects, not duplicate
connection notifications.
Existing diagnostics captured relay ownership blocked in `getWorktrees
-> WorktreeInventory -> POST /api/worktree/refresh`, including a refresh
pending beyond 150 seconds and a separate ~220-second completed call.
That exceeds the unchanged 60-second relay job deadline, so the shared
relay reconnects and Usage correctly clears for all projects.
Event authorization now uses a separate **registered-only** native
worktree inventory and never starts or joins native strategy discovery.
Native project/checkout checks, physical Git membership, clone
exclusion, configured roots, nested-folder and WSL projection remain in
the shared catalogue implementation. Native/local invalidation and
workspace disposal fence both inventories and their distinct
directory-cache namespaces. Ordinary request authorization and explicit
worktree discovery retain refresh and read-your-writes behavior.
Full-location checks receive the connection attempt's abort signal.
No timeout increase, swallowed reconnect, stale authorization fallback
or quota-specific workaround. FIFO lanes, ownership retries,
generation/workspace fences and retained-work budgets are unchanged.
## Validation
- Baseline-red production-manager + relay reproduction: hold discovery
unresolved and require the linked-worktree event to route before
releasing it.
- All **248 workspace tests pass**, including event order/reconnect,
ownership, no-Git, WSL, configured Git roots and inventory invalidation.
- Server TypeScript check passes.
- Isolated OpenCode **2.0.22** location/worktree/event fixture passes,
including real pre-refresh native registration and ordered real session
events during a held fixture-manager discovery request.
- Isolated no-Git native prompt/recovery fixture passes.
- `git diff --check` passes.
## Scope / limitations
The native refresh's internal delay is not claimed fixed; the relay no
longer depends on that unnecessary discovery operation. Actual transport
failures and other stuck native reads still trigger bounded
reconnect/reconciliation. Compaction and window-resize jank are not
established causes or fixed by this PR.
The installed application, shared daemon, user settings and independent
#824 worktree are untouched. This conversation remains attached to
`D:\CodeNomad`.
Existing oversized source touched:
`packages/server/src/workspaces/manager.ts`, approximately 1,260 lines.
No unrelated size-only refactor.
Independent Gatekeeper review will be published against the exact PR
head, with findings resolved and fresh passes until zero findings before
the requested administrator merge.
## Summary
- Keep pending questions in the composer-adjacent dock and native
answers in the transcript after completion; remove redundant navigation
links.
- Separate collapse from bounded request navigation and hide navigation
for one request. Preserve the selected draft across incoming permissions
and session changes.
- Add accented window chrome, fixed action footers, readable dark
receipts and visible scrolling. Preserve permission diff-review gates
and disable form editing during submission.
## Validation
- UI TypeScript and production build passed.
- 16 Form/settlement/diff-review unit-store tests passed.
- 10 dock browser tests, 1 cross-session selection test, 5
permission/Form browser regressions, 21 history-navigation tests and 1
session-search regression passed.
- Rendered captures inspected at 393 and 1100 CSS pixels in light/dark;
mobile permission actions validated.
## Review
Independent UX and interaction reviews informed the implementation.
Autonomous final gatekeeper review in progress before requested admin
merge.
## Maintenance note
Existing large components touched: message-block.tsx (~1965 lines),
message-section.tsx (~1561), tool-call.tsx (~991).
## Summary
- Ignore repeated browser transport statuses and identical
instance/status/native-generation snapshots instead of clearing
validated provider quotas and restarting reads.
- Keep genuine reconnects, changed native generations (including a
missed disconnect), account/configuration changes, native
`server.connected`, source changes and failed-read revocation unchanged.
- Add real Solid/browser dispatcher regressions covering quota DOM
stability, in-flight refreshes, compaction independence and
stale-response fencing.
## Scope and evidence
The regression test fails before the fix: 40 duplicate connected
notifications produce 40 additional quota reads and replace the quota
display with Loading. After the fix, the same bar DOM and request cycle
remain intact. Quotas still use the native credential API and provider
HTTP endpoint; no log-based or host-credential fallback is added.
This fixes a demonstrated flicker trigger, not every live disappearance.
Initial passive captures did not reproduce a disconnect. A later capture
did confirm a real relay failure: `Instance event relay routing timed
out` at native generation 52, followed by connecting/connected at
generation 53, affecting both opened projects. This PR deliberately
continues to revoke quotas on that real boundary; it does **not** fix
the relay timeout itself. The installed desktop application and shared
daemon are unchanged.
## Validation
- 17 UI state/component/browser tests passed.
- 12 native usage/route tests passed.
- UI typecheck and production build passed.
- Before-fix regression failure confirmed; rendered fixture capture
inspected.
Independent Gatekeeper review will be published against the exact PR
head before administrator merge.
Generate positive, nonzero and canonical DER certificate serial numbers for both the local CA and server. node-forge encodes the supplied hex bytes as a signed ASN.1 INTEGER, so a random high bit previously produced a negative serial rejected by Go/Caddy. Normalize leading zero octets, add sign padding only where needed and handle the all-zero draw while keeping random 128-bit serial draws within the RFC 5280 size bound.
Renew existing negative/zero generated server certificates at HTTPS initialization while preserving a valid CA and existing client trust. If the generated CA itself must be replaced, also reissue the leaf and warn that clients must import the replacement CA. Keep valid generated credentials unchanged and leave explicitly supplied certificates untouched. Document startup repair and reverse-proxy trust implications.
Seventeen TLS tests pass on Node 24.20.0, including deterministic edge draws, actual DER encoding, signature/SAN checks, invalid serial migration, verified loopback HTTPS requests, CA replacement, reuse and provided/disabled behavior. The full server suite passes with 825 passed, six existing skips and zero failures; server typecheck and diff checks pass. No installed app, shared daemon or user certificates are changed. The reporter's physical macOS/Caddy setup was not directly tested.
Fixes#832.
Expose the approved active-account dropdown with persistent credential-keyed drafts and always-visible add/rename/remove actions. Enrich only native fallback labels with a sanitized Codex login while keeping all credential values server-side. Persist opt-in automatic selection for supported OpenAI OAuth accounts and admit one fresh-quota-verified native activation before the next prompt/custom command, with local manual/policy fences, ownership and deletion admission, no model changes, and no prompt or mutation replay. Preserve dev's Missions revert and document service-wide selection and external-client compare-and-set limitations. Validated both package typechecks, the UI build, 812 server tests, 865 CI-selected UI unit tests, isolated native 2.0.22 synthetic-account/YAML fixtures, and focused Chromium/native bridge regressions. Final admin merge explicitly requested by the user; platform/runtime/native checks are green while the general tests job is still in progress.
## Outcome
Reverts the accidentally authorized merge of #673
(`c118478805`) relative to its first
parent. The user explicitly requested this revert and immediate admin
merge.
- Removes the published Missions plugin, routes, UI, playbooks and
packaging references.
- Preserves later PRs #792 (web search settings), #829
(questions/permissions dock) and #830 (OpenCode 2.0.22 and
parent-session fence).
- Removes only #829's dependency on the now-removed Mission reader,
including its dedicated fixture scenario; retains the dock and other
navigation/answer tests.
- Does not rewrite history, delete native mission/session data, restart
the app/daemon, or touch the separate local durable-refactor work.
## Validation
- Git revert applied without conflicts; the original merge affected 139
paths and all 139 were reversed. Three later interruption-dock files
require the minimal removed-reader adaptation above.
- Server and UI `tsc --noEmit` pass using existing local dependencies
(no installation). This is not native 2.0.22 qualification.
- 18 automation/plugin lifecycle/desktop resource tests passed; staged
diff whitespace check passed.
- Full hosted CI/browser/native suites were not rerun for this immediate
admin revert.
## File-size notes
Existing oversized modified sources remain:
`packages/server/src/server/http-server.ts` (~2362 lines),
`packages/server/src/api-types.ts` (~692),
`packages/server/src/index.ts` (~694),
`packages/server/src/opencode/automation-plugin.ts` (~583),
`packages/ui/src/components/session/session-view.tsx` (~710),
`packages/ui/src/lib/api-client.ts` (~636). No size-only refactor
included.
Revert merge c118478805 relative to its first parent after the user confirmed the merge was requested in the wrong conversation. Remove the published Missions plugin, control routes, UI, playbooks and packaging references; do not rewrite dev history or touch durable-refactor work in the separate missions-v2 checkout.
Preserve subsequent PRs #792, #829 and #830. Remove only #829's now-invalid Mission reader import, dismissal hook and dedicated reader scenario, retaining the native questions/permissions dock, file-preview navigation and its other tests. Keep the 2.0.22 package pin and parent-session creation fence.
Validation: revert applied without conflicts; all 139 original merge paths reversed; later-only paths retained except the three minimal interruption-dock integration adaptations. Server and UI TypeScript checks and 18 automation/plugin lifecycle/desktop resource tests pass using existing local dependencies. Staged diff checks are clean. Full hosted CI, browser suites and native 2.0.22 qualification were not rerun for this immediate user-authorized admin revert.
## Summary
Qualify **OpenCode 2.0.22**, align server/UI client and plugin pins, and
recommend this release. Keep the demonstrated **2.0.7** global minimum
and **2.0.20** Codex Usage feature-local requirement.
Block the new native `parentID` create variant in the workspace proxy:
upstream ignores the supplied location and inherits the parent's
directory. Require inspectable JSON objects to close opaque-body
bypasses. Root creation and the existing authorized fork route remain
available.
Started at `dev@0983db3c` (#828 Windows test harness), then integrated
`dev@97c361c3` (#789 Code Mode presentation). Conversation remains
attached to `D:\CodeNomad`; all work and tests use explicit separate
paths and synthetic data.
## Upstream audit: 2.0.21 → 2.0.22
- Authenticated native OpenAPI retains **116 paths**, with **11 schema
differences**: session creation gains optional `parentID`,
parent-not-found response/description; provider settings gain optional
`headerTimeout` and `chunkTimeout=false`; configured model capability
overrides become partial. No new proxy route or consumed mandatory API.
- Published declarations: **4/30 client, 2/60 plugin, 3/36 protocol,
4/102 schema** files change. Plugin session domains expose `remove` and
`compact`; CodeNomad does not add calls to them. Identifier namespace
export is additive.
- An isolated native fixture proves parent creation inherits the parent
location despite a different supplied directory. Mock and
production-proxy fixtures reject owned/foreign parents; malformed values
and opaque content types are covered before any native request. Owned
root creation stays available.
- Runtime changes include HTTP header/chunk/whole-response timeout
handling and bounded timeout retries, provider cache/error/tool-history
fixes, model capability defaults, and legacy MCP shutdown cleanup.
- Lock changes are limited to six `@opencode` packages and two workspace
entries. Integrity/dependency metadata matches independently installed
published packages; clean `npm ci --ignore-scripts` passes. Optional
OpenTUI peers are not installed by CodeNomad.
## Isolated local qualification
**Windows / Node 24.20.0**, isolated profiles, databases, services and
synthetic providers/credentials. No shared-daemon or personal-history
mutations.
- Previous **2.0.21 dependencies + runtime 2.0.22**: native
pruning/history/proxy acceptance passes.
- New **2.0.22 dependencies + runtimes 2.0.7 and 2.0.22**: seven suites
pass (automation, pruning/history/navigation, per-send environment,
inclusive forks, idle/busy side questions, blank-session cleanup,
Git-degraded recovery), plus explicit native proxy suites.
- Native/UI pruning acceptance passes through the committed parent
runner, with completion and actual child exit verified. This uses #828's
early dependency-import workaround, not the old late-import order. No
claim that underlying Windows heap corruption is repaired.
- Current compaction-isolation acceptance passes: session B progresses
while session A's provider response is held; bounded outline reads
retain daemon heartbeats. Fixture runtime selection is extended to
include 2.0.22; its assertions are unchanged. This supplemental fixture
was not qualified on 2.0.7 (explicit runtime selector rejects it).
- Native Codex Usage passes on 2.0.22 with synthetic OAuth/key
credentials and mocked quota HTTP; not a live-account/WSL test.
- Native migrations **2.0.3 → 2.0.22** and **beta-19271 → 2.0.22**
preserve full history/forks/inbox/provider selection.
- Packed standalone pruning plugin installed outside the repository
passes native acceptance.
- Native npm upgrade **2.0.15 → 2.0.22** passes; authenticated daemon
remains **2.0.15 / PID 43876** before and after.
- Full server run: **794 passed / 6 skipped / 0 failed**. Final guard
revision separately passes **68 focused server tests** and native proxy
suites on minimum/current. Aggregate runs use `--test-force-exit`.
- Targeted client/store/reducer/usage UI: **63/63** with
`--conditions=browser`, `--test-force-exit`, bounded timeout. Initial
broad UI run used the wrong Node conditions and hung at
`prioritized-read.test.ts`; only its owned processes were stopped. That
incomplete run is **not green**. The same prioritized-read tests pass
under the browser condition used by CI. No production fix is inferred
from this launch correction.
- **41 browser scenarios** pass: setup/install, auth recovery, tool
images, rendered Codex Usage and compaction responsiveness. Browser
tests do not use forced exit.
- Server/UI/Electron typechecks and production server/UI/plugin builds
pass. Revalidation after #789 integration and independent gatekeeper are
reported separately below.
Local results do not certify all real providers, Linux/macOS/WSL, or
installed Electron/Tauri hosts. Historical Windows import and Git
cleanup failures remain limitations, not repaired by this upgrade.
Remote CI is not continuously monitored and no global CI-green claim is
made.
Size note: existing `packages/server/src/server/http-server.ts` is
~2,359 lines;
`packages/server/src/server/__tests__/instance-proxy.test.ts` is ~1,139
lines. Changes are narrowly scoped; no unrelated size-driven refactor.
## Independent gatekeeper
Review launched on exact head `0a7615476034eabbff54967aacc8a93ab0e6ab12`
against `dev@97c361c33f6fa7de30be5dde31c0e26e12bab574`; verdict will be
published before any admin merge. Findings will be corrected and
reviewed again until zero actionable findings.
## Summary
- Answer native Forms and permissions in a persistent composer-adjacent
dock with queue navigation and source-session labels.
- Target requests from badges and inline tools; reveal off-window source
messages through bounded history navigation, closing file previews and
exposing hidden source tools.
- Render durable native question answers in the transcript and preserve
partial request/composer drafts.
- Replace the former permission modal and retain native global Form
routing and full permission-diff review.
## Gatekeeper
- Pass 1: two actionable P2 findings.
- Corrected both in fb7ed772 with regression tests reproducing failures
before the fixes.
- Independent pass 2 at fb7ed772: zero actionable findings.
## Validation
- UI TypeScript and production build passed after rebase.
- 30 focused browser and 17 native-store/unit regressions passed after
rebase.
- All six interruption-dock tests and TypeScript passed after
corrections.
- Independent final review: nine browser tests, 20 unit/store tests and
TypeScript passed.
- Final GitHub CI in progress.
See dev-docs/NATIVE_INTERRUPTION_UX.md for ownership and validation
details.
## Behavior
Global/Project websearch choice, inherited/default, disabled and
automatic/provider selection. Display effective native configuration.
Optional global API keys use native integration/credential endpoints;
environment credentials remain read-only. Scoped failures reconcile
without mutation replay, and late results are fenced.
## Contract adjustment
OpenChamber's /api/config/websearch is its backend route. OpenCode
2.0.18 has no equivalent native config write API. Reuse CodeNomad's
authorized plugin-control configuration targets, JSONC conflict-safe
edits, WSL filesystem adapter and connection/deletion fences. Preserve
unrelated fields and comments; use native watching, never implicit
location.reload.
## Validation
Server/UI typechecks pass. 51 focused server/config regression tests
pass; four real-WSL cases skipped. Real Chromium fixture passes scoped
writes, failure reconciliation, API-key clearing and late mutation
fencing; narrow capture inspected. Isolated native fixtures pass on
2.0.7 and 2.0.18 (global watching, project document persistence/reset,
foreign-directory rejection). Project discovery is disabled in native
fixtures to exclude user ancestor config; deterministic server tests
cover precedence. No shared daemon or personal data used.
## Stack/review
Depends on #791, zero findings at ea3b4ef6. Independent gatekeeper
pending; fix/re-review until zero. User requires all PRs remain
unmerged.
Size notes: existing http-server.ts (~2300), api-types.ts (~1200),
plugin-controls.ts (~810), api-client.ts (~1000) and locale settings
files exceed guidance; focused changes only.
## User-feedback correction
Clarify which search provider agents use, automatic saves, the default
across projects and the current-project override. Move API keys into a
separate collapsed section explaining that credentials are shared
service-wide and saving a key does not change the selected provider.
Environment credentials are explicitly read-only. Updated in all ten
locales; narrow Chromium lifecycle/failure test and UI typecheck pass.
Alpha in fixture captures is synthetic test data.
## Summary
- add a durable, project-local Missions control plane on top of native
OpenCode V2 root sessions
- expose live Mission Control navigation, task state, actor state,
reports, and evidence in the right panel
- provide bounded Pocock bug-fixing and Wayfinder exploration playbooks
without introducing a generic workflow DSL
- keep Developer Mode automation separate from mission orchestration
## Architecture
Missions uses native OpenCode V2 primitives rather than a parallel
runtime:
- root sessions are mission actors
- `queue` and `steer` are the durable actor inbox
- session metadata carries mission, task, role, and coordinator
correlation
- plugin hooks inject role context
- project-local plugin storage persists an append-only mission journal
and materialized map
- topology mutations are coordinator-only and remain scoped to one
project
The agent surface is deliberately limited to `mission.inspect`,
`mission.delegate`, and `mission.report`. The CodeNomad broker exposes
only the typed `codenomad.missions.snapshot` RPC; change events are
invalidations that trigger authoritative reconciliation.
## User-visible behavior
Mission Control shows the active mission's status, frontier, tasks, root
actors, correlated reports, and expandable evidence. It updates live,
survives reconnects, preserves the last durable map through transient
failures, and can navigate to an actor session without becoming a second
workflow executor.
All new UI strings are available in the existing 10 locales. The panel
uses the shared token, utility, and square-corner window conventions.
## Playbooks and safety bounds
- Pocock remains evidence-driven and dynamically sequences
implementation, independent reviews, resolution, and fresh validation.
- Wayfinder preserves destination, map, frontier, claims, and fog-of-war
while allowing bounded parallel research.
- Admission and resume paths are idempotent.
- Limits: 8 actors, 96 tasks, 2,000 events, and 20 missions per project.
- A green completion requires every task to be completed.
## Validation
- [x] Rebased directly on `dev` after #647
- [x] OpenCode plugin contract typecheck
- [x] Server typecheck
- [x] UI typecheck
- [x] Mission server tests: 18 passing
- [x] Mission UI/i18n tests: 4 passing
- [x] Full server, UI, Electron, and Tauri suites/builds completed
during implementation
- [x] Private runtime spike verified activation, typed RPC, restart
persistence, root-session delegation, queue/resume, correlation,
idempotence, invalidations, broker allowlisting, and checkout/worktree
storage sharing
- [x] Pocock and Wayfinder runtime demonstrations completed
- [x] Windows Tauri Mission Control validated live from active mission
through completed status, including actor navigation and expandable
evidence
## Known runtime note
A daemon that was already running before the project-local plugin
existed may fail to hot-add that plugin on Windows. Fresh daemon
activation is verified and works correctly; CodeNomad does not restart
or take ownership of a foreign/shared daemon.
## Tester feedback phase
This PR intentionally remains in draft while the session mesh receives
broader real-world use. Please exercise:
- custom missions with both idle and busy actor sessions
- Pocock implementation, independent review, resolution, and fresh
validation loops
- Wayfinder exploration with parallel frontier tasks and unresolved fog
- restart/reconnect recovery before and after delegation and reporting
- actor navigation and evidence expansion from Mission Control
- project, checkout, and worktree boundaries, including expected
authorization failures
Useful reports include the desktop host, workflow/template, exact point
of friction, expected versus observed behavior, and whether the durable
map recovered after reopening. Do not include secrets or private prompt
contents.
The unrelated automation-registry CI fix is tracked separately in #675
and is not part of this branch. After that fix lands on `dev`, this
branch can be rebased and its validation rerun before any decision to
mark it ready.
## Behavior
Attach/remove skills in the composer using the current session
directory's native catalog. IDs are sent through prompt.skills; OpenCode
expands the instructions. Historical and optimistic messages show skill
labels. Queued edits restore removable skill attachments without
resurrecting removals.
## Lifecycle
Visible demand only, skill/config native updates, reconnect refresh,
coalesced trailing reads and view/session response fencing. Ten locales.
Native startup registers plugins progressively, covered by fixture and
catalog updates.
## Validation
UI typecheck passed; 53 session-action regressions passed; three focused
skill tests passed; Chromium
selection/deduplication/location/stale/coalesced/inactive scenario
passed and narrow capture inspected. Isolated native fixture passed on
2.0.7 and 2.0.18 (synthetic provider, private home/database/process; no
shared daemon). No runtime-minimum change.
## Stack and gatekeeper
Depends on #790, whose independent gatekeeper has zero findings.
Independent review of this PR pending; corrections/re-reviews continue
until zero. User requested no merges.
Size notes: prompt-input.tsx (~1120), session-actions.ts (~1000),
session-view.tsx (~720), session-actions.test.ts (~1040), and locale
messaging files exceed guidance; focused additions only.
## Behavior
Dedicated websearch source cards with safe links, publication metadata,
literal snippets and raw-output fallback. Recognized native provider
consent receives a localized heading and stacked options through the
existing Form validation/reply path. Ten locales.
## Stack
Depends on #789 (zero-finding gatekeeper at aaee7d5a). This PR contains
only step 2. All eight PRs are to remain unmerged at the user's request.
## Contracts and validation
Tagged native 2.0.7 and 2.0.18 tool/plugin/websearch.ts contracts
verified. No new API or minimum-version dependency. UI typecheck passed;
five focused parser, shape and browser tests passed, including hidden
Forms regression. Narrow rendered capture inspected. Raw results retain
copy/search via shared renderer. Existing tool-call.css exceeds
source-size guidance; change is one import.
Independent gatekeeper review pending; findings will be corrected and
re-reviewed until zero. Do not merge.
## Increment over existing execute display
Execute already renders as a tool card through the generic renderer.
This PR adds a specialized presentation of its script and native
nested-call metadata (names, inputs, statuses), plus truncation
information. It reuses the existing aggregate output and image surfaces.
It does not introduce Code Mode execution or mission orchestration
(#673).
## Purpose
First PR in the V2 product integration series. Present execute scripts,
nested tool calls and progress, failure and native truncation
information. Preserve shared native output/image rendering and copying.
## Contract and implementation
Verified upstream Code Mode contracts at tags 2.0.7 and 2.0.18: code
input, metadata.toolCalls (tool/status/input), metadata.error. No API
calls or runtime minimum changes. Small dedicated parser and renderer,
scoped CSS, nine locales. Subsequent PRs will stack on this branch.
## Local validation
- UI typecheck passed.
- Four isolated Chromium scenarios passed: native events, history
reload, nested errors, images, collapse and narrow layout.
- Rendered capture inspected at 380px.
- git diff --check passed.
## Gatekeeper
Independent review pending; findings will be fixed and re-reviewed until
zero. User requested all PRs remain unmerged. Do not merge.
Size note: existing tool-call.css is above the source warning threshold;
changed only by adding the scoped import.
Stabilize the Windows pruning/UI CI harness by loading its unchanged UI dependencies before the long native/SQLite preamble. The late-import baseline reproduced locally under CI's Node 24.20.0 with native status 0xC0000374. This is a qualified import-order workaround, not attribution or repair of the underlying heap corruption; no assertions, dependencies, test skips or retries change.
Retain actual child exit status/signal, stdout/stderr, durable stages and synthetic fixture logs through a parent runner. Require explicit completion as well as exit zero, and upload parent/fixture diagnostics on failure. Preserve the original UI scenario exception if diagnostic capture fails.
Trigger artifact announcements from validation completion rather than bounded polling. Failed validation stays red in its own workflow. Run only trusted default-branch helper code, verify the originating workflow and current authorized PR head, use GitHub commit association when needed and update only bot-owned marker comments. Artifact names remain escaped display text, never executed contents.
Fifteen focused tests pass under Node 24.20.0. Two coordinator-run and one independent full Windows native/UI scenarios complete naturally with all original assertions, restart persistence and presence cleanup. YAML and diff checks pass. The published independent gatekeeper review of this exact head has zero findings.
Admin merge is explicitly requested without waiting for CI. GitHub workflow_run delivery needs post-merge confirmation; no universal CI reliability, underlying heap repair, Linux/macOS native rerun, installed app replacement or shared daemon restart is claimed.
## Summary
close#824. This collects the confirmed responsiveness and isolation
fixes from the issue-824 mission, including independently reviewed
corrections recovered from the previous general audit. **It does not
claim that the original persistent Electron Linux Ôö£├ÂÔö£├æÔö£├Ñ
Windows HTTP freeze is resolved.**
- Aggregate native compaction text before the OpenCode/Solid reducer
instead of only throttling the visible projection. Advance revision/read
fences immediately, preserve exact terminal text and SDK snapshot
boundaries, and discard obsolete buffers across lifecycle changes.
- Retain keyed nested task-tool shells without losing authoritative
membership changes. Keep the existing bounded structural scan and
full-copy behavior.
- Isolate SSE subscriber exceptions, distinguish decoding from dispatch
errors, and prevent a subscriber-local abort/return/throw from
invalidating the healthy shared native client.
- Observe HTTP disconnects before admission/preflight, propagate
cancellation to supported reads, and fence late continuations without
replaying or interrupting already-admitted native mutations.
- Use asynchronous scrypt for HTTP authentication, serialize password
changes, and reject an old login verification that crosses a password
change. Preserve hash format and constant-time comparison.
- Yield cooperatively during structural-index reads and projection,
without changing the response/digest protocol, ownership or snapshot
semantics.
- Add isolated regression fixtures, native qualification scripts,
source-fingerprint evidence; independent reviews are published in the PR
discussion. Synchronize the Git focus test with its asynchronous
contract and correct the opt-in browser trace serialization defect
introduced during this mission.
## Validation Ôö£├ÂÔö£├ºÔö£├é draft, not all green
Product/tests/scripts/config/lock inputs were fingerprinted across 1,696
tracked and untracked executable paths. The complete frozen-source runs
and their unsuccessful attempts are recorded separately; targeted
retries are never substituted for a successful full suite.
| Gate | Recorded result |
| --- | --- |
| Full server replay | 799 total / 793 pass / 6 skip / 0 fail, natural
exit 0. Initial Windows cleanup `EPERM` retained; isolated Git and full
replays pass, underlying OS cause unqualified. |
| UI/server/Electron typechecks and UI/server/bundled-plugin builds |
Pass. UI typecheck also passes after the final trace correction. |
| Private native fixture | Pass on Windows/OpenCode 2.0.21, including
compaction isolation and 2/8/32 MiB provider payload checks. No user
daemon/database used. |
| Stores | 141 assertions pass with force-exit. The 11-case compaction
natural-exit attempt prints passes but times out; lifecycle cleanup is
not qualified. |
| First frozen full browser | 360 total / 356 pass / 3 fail / 1 skip,
natural exit 1. Targeted 3/3 and neighboring 104/104 pass, not an
all-green replacement. |
| Previous full browser (before trace correction) | **360 total / 358
pass / 1 fail / 1 skip**, natural exit 1 in 20 min 10 s, zero source
drift. The remaining failure is the opt-in trace's `ReferenceError:
__name is not defined`; prior functional assertions, including focus,
pass. |
| Trace correction after that full gate | Exact tsx callback
serialization reproduces the missing helper on a minimal Chromium page.
Explicit self-contained JS is verified with no pageerror and all
observation kinds retained after saturating the 200-entry buffer. **The
fresh cycle-1 full browser now passes Git/trace, but remains red on a
different case; see below.** |
| Renderer A/B on final product postimage | 30 samples/variant, median
main-thread fixture duration **324.57 Ôö£├ÂÔö£├æÔö£├Ñ 16.94 ms**. Not
desktop FPS or universal responsiveness. |
Compaction gates assert exact counts/content rather than flaky timing:
128 active fragments reduce to one interval emission, modest staggered
delivery also coalesces, and never-loaded inactive sessions do not
materialize the payload. Structural-index stress observations reduce
event-loop gaps from 522Ôö£├ÂÔö£├ºÔö£Ôöñ755 ms to 13Ôö£├ÂÔö£├ºÔö£Ôöñ14
ms on the documented synthetic corpus, not total CPU or remote paint
time.
## Remaining acceptance work / limitations
- Cycle-1 corrected full browser: **360 total / 358 pass / 1 fail / 1
skip / 0 cancelled**, natural exit 1 in 21 minutes, zero drift on 1,696
inputs. Git/trace passes; the PageUp-named case loses its original error
because its failure snapshot itself throws. Correct diagnostic error
preservation; do not relabel this run green.
- The earlier MCP bootstrap and HTML-cache timeouts remain causally
unattributed, although both pass in the latest full run. A separate
Monaco overlay detachment is retained as a distinct fixture failure.
- Qualify Electron Linux Ôö£├ÂÔö£├æÔö£├Ñ backend Windows LAN/HTTP and
OpenCode 2.0.19. Current real HTTP/1 checks are Chromium Windows
Ôö£├ÂÔö£├æÔö£├Ñ Fastify Windows loopback; private native checks use
2.0.21. Neither establishes the reporter's exact cause.
- Natural store lifecycle is still pending correction: the referenced
reconnect timer of the import-started browser singleton retains Node
without `window`; a constructor-only private counterfactual yields 11
passes and natural exit 0. This is causal diagnosis, not a corrected
product gate. Coalescing remains limited by interleaved read/event
boundaries, has no explicit byte/event cap, and is not a universal
four-flushes-per-second/memory guarantee.
- A single SQLite step remains synchronous. Shared libuv CPU resources,
task clones/reloads and revision-stable activation catch-up remain
documented limits.
The user has now authorized scoped corrections, independent re-review
until zero open findings, and then an administrative merge attempt after
final green acceptance. No merge has occurred. Installation, deployment,
shared-daemon restart and user-session cleanup remain unauthorized.
## Current gatekeeper / evidence
**All reported actionable findings are closed; final acceptance is still
pending.** Server/native review has zero findings. Scoped independent
re-reviews close UI-R1-1 (ghost task membership), accept the
browser-singleton lifecycle correction, and close UI-R2-1 (diagnostic
cleanup masking). The eight reviewed paths are committed and pushed in
`1795cce6aa`; there are no investigation
reports in the diff. The final immutable UI/stores/build/full-browser
validation task is dispatched on that HEAD; CI run 36944418417 is in
progress. No merge has occurred and no new general audit is being
restarted.
CI run 36937989224 at `f6a18d00` fails only the native pruning Windows
job; build is skipped. Installed-plugin/native/installation checks pass
before the `--ui` invocation exits during the Vite-loading boundary
without an initial error stack. Cause is under investigation, not
waived.
- [Server/native gatekeeper review ├ö├ç├ zero
findings](https://github.com/NeuralNomadsAI/CodeNomad/pull/825#pullrequestreview-5386630798)
- [UI gatekeeper review ├ö├ç├ UI-R1-1
open](https://github.com/NeuralNomadsAI/CodeNomad/pull/825#pullrequestreview-5386702249)
- [Scoped UI re-review ÔÇö UI-R1-1 closed, lifecycle accepted, UI-R2-1
open](https://github.com/NeuralNomadsAI/CodeNomad/pull/825#pullrequestreview-5386919578)
- [Natural store lifecycle qualification ÔÇö 141/141
pass](https://github.com/NeuralNomadsAI/CodeNomad/pull/825#issuecomment-5942780410)
- [Confirmed store lifecycle attribution ÔÇö historical
diagnosis](https://github.com/NeuralNomadsAI/CodeNomad/pull/825#issuecomment-5942533916)
- [Cycle-1 terminal browser/CI results, source identities and
limitations](https://github.com/NeuralNomadsAI/CodeNomad/pull/825#issuecomment-5942677312)
At the user's request, investigation reports are not part of the
repository diff. Commit `acac9be2` untracks the 21 reports while
preserving their local working copies; executable inputs are unchanged
by that commit. Future working reports remain local and untracked.
Review verdicts/results are published in this description and
discussion. These are transparent independent AI-agent reviews posted
through the coordinator's PR-author account, not independent human
GitHub approvals. Raw private logs remain on the validation host, not
publicly downloadable uploads.
Size signals retained without size-only refactoring: `http-server.ts`
~2,346 lines, `workspaces/manager.ts` ~1,240, `instances.ts` ~2,093,
`opencode-data.ts` ~828, `task.tsx` ~569.
Remove the mention picker's no-selection submission fallback, which dispatched drafts on Enter during empty or pending searches even when submit-on-Enter was disabled. Reserve Enter for an open picker and swallow Ctrl/Cmd submission or queue shortcuts instead of sending.
Fence document-level Solid key delegation on both sides: the picker ignores modified Enter, and the composer never submits an already-consumed Enter whose selection handler closed the popup during dispatch. Preserve Tab completion, directory and arrow navigation, Shift+Enter path-only insertion, Escape draft preservation and explicit submission after dismissal. Clipboard production behavior and both desktop hosts use the unchanged shared paths.
Add seven real composer browser regressions using held search responses, intercepted native prompt requests and trusted clipboard paste, plus three keyboard-controller regressions. The two pending-search browser regressions fail before the fix in both submission modes. Seven controller tests, twenty-eight composer/attachment/search browser tests, UI typecheck and production build pass. Publish an independent gatekeeper review of the exact head before merging.
Admin merge without waiting for CI is explicitly requested. No live session or shared daemon is mutated; installed Tauri validation and reproduction of Ctrl+V alone causing a send are not claimed. Addresses #826 without closing the report before user confirmation.
Target the requested native scrollbar ratio relative to the actual press point rather than an estimated future thumb centre. This retains the selected grab offset at the top and bottom of the track without changing production timeline behavior, assertions, gesture timing, movement steps or settling delays.
Independent review accepted the exact helper-only change with zero findings. Real Chromium endpoint and neutral-position contracts check actual mouse target arguments, and both existing native thumb scenarios pass naturally. Windows outcomes do not reproduce or explain the historical Linux CI failure, whose grab-offset versus final-input-delivery mechanism remains unknown; fresh full qualification and remote CI are still required.
Install composer page observations before navigation and record synchronous bootstrap phases without moving imports, mocks, awaits or fixture publication. Capture bounded console, module/API status and navigation events so a future readiness failure can be inspected rather than reduced to an unexplained timeout.
Use the accepted diagnostic and cleanup boundary for failure-only structural snapshots with a two-second reporting deadline. Preserve original error identity and stack when observation or cleanup fails, detach listeners and clear timers, and keep cleanup failures after successful assertions visible. Original 30-second readiness and all layout/draft assertions remain unchanged; native fixture and cache policy are untouched.
Add five real Chromium contracts covering failed entry modules, bounded event rings and URL labels, destroyed and pending snapshot contexts, listener cleanup and primary-error preservation. Author and independent review each pass ten contracts and the actual 320px composer case with natural process exit; independent scope review reports zero findings. This repairs only the observation gap, not the unknown historical R3 cause. Final full-browser and fresh remote CI qualification follow on this commit.
Provide the minimal web-renderer window before importing the real ServerEvents singleton, after installing the existing network mock. The accepted lifecycle guard intentionally leaves Node imports passive; the reconnect test must explicitly supply its intended browser context.
Preserve reconnect and hidden-cache assertions, require initial constructor auto-connect through the mocked transport, and restore the exact previous global descriptor while closing mock sources. No production networking behavior is changed.
Confirmed the original natural-exit failure and the corrected test pass. The 71-file CI UI workload passes 480/480 with force-exit removed; lifecycle 2/2, compaction 11/11, neighboring stores 141/141 and UI typecheck pass. Independent delta review found no findings and verified cleanup for absent, data and accessor descriptors. Full-browser and remote CI qualification follow on this commit; historical failures remain recorded.
Clear nested-task membership and truncation when native deletion empties the resident child snapshot, while preserving keyed shells during ordinary invalidation and rereads. Cover the real batched native event with unchanged parent metadata, bounded counts and legacy fallback.
Do not start the browser event singleton outside a window environment. Require actual module imports and compaction store tests to finish naturally in private subprocesses rather than using force-exit, while retaining normal browser auto-connect and reconnect behavior.
Preserve original test errors and stacks when snapshot capture or page cleanup also fails. Share a narrow diagnostic/cleanup helper with durable tests, including falsy primary errors and cleanup failures after successful runs. No browser assertions, timings, clicks or skips are relaxed.
Independent scoped reviews close UI-R1-1 and UI-R2-1. Causal prepatch failures, 25 renderer/copy/image tests, 141 naturally exiting store tests and focused lifecycle/diagnostic tests are green; final immutable full-browser and native Windows CI qualification remain separate gates. Investigation reports remain local and are not tracked.
Remove the 21 mission reports from the tracked change set at the user's request. Keep their working copies and private evidence locally, and publish review findings, measurements and acceptance limitations through the pull request description and discussion instead of permanent repository documents.
No production, test, fixture, build or runtime input is changed by this commit. The completed browser cycle remains red and the existing independent reviews keep their original source HEAD attribution; this documentation-only cleanup does not constitute acceptance or resolve issue 824.
Aggregate compaction fragments before reactive SDK reduction while advancing
revision fences immediately and preserving native terminal and snapshot
authority. Keep task-tool shells keyed across payload updates and rescan bounded
membership so removals and replacements cannot leave phantom tools.
Isolate SSE callbacks and decode/dispatch diagnostics. Subscriber-local teardown
no longer destroys the healthy shared native client. Install HTTP cancellation
before preflight and fence late continuations without replaying or interrupting
already-admitted mutations. Preserve ownership and environment admission checks.
Move HTTP password derivation to async scrypt with serialized password changes
and login-authority fencing. Yield cooperatively in both structural-index phases
without changing snapshot/digest protocols; an individual SQLite step stays sync.
Add isolated red/green regressions, bounded browser/native qualification scripts,
independent reviews, source fingerprints and performance evidence for issue #824.
Synchronize the Git focus assertion with its async contract and make the opt-in
trace self-contained instead of serializing a tsx helper into the browser.
Validation includes 793 passing server tests and 6 skips after replay, UI/server/
Electron typechecks, UI/server/plugin builds, and private Windows native 2.0.21
fixtures. Renderer fixture median main-thread cost is 324.57 to 16.94 ms.
The latest full browser run remains 358 pass, 1 fail, 1 skip: its trace failure
was subsequently reproduced and corrected with a minimal Chromium check, but
the full suite has not been rerun. Store assertions use force-exit; natural
cleanup and Linux Electron to Windows LAN/HTTP with 2.0.19 remain unqualified.
Publish as a draft for review, not a universal resolution or issue-closing fix.
Refs #824.
Integrate current dev while preserving the mission routes, durable execution controls and specialist cleanup. Retain native usage route dependencies and align local plugin dependencies and architecture guidance with OpenCode 2.0.21.
Combine the workspace file reader with the mission reader in the central session surface. Explicit reader selection dismisses the competing preview without losing stored editor drafts or the composer. Extend the real-session browser regression to cover switching between both readers.
Validate server and UI typechecks and all ten mission browser/i18n tests. Preserve the upstream Tao patch unchanged, including its original whitespace and provenance.
Complete the earlier Usage flicker fix after reproducing eleven Loading flashes in twenty seconds in the installed Tauri app. Same-location provider catalogue events now revalidate quotas in place, unrelated native locations do not trigger reads, and window-label keys preserve quota rows during value changes.
Share one current-generation in-flight read and coalesce trailing refresh demand. Credential, integration, configuration, reconnect and source changes still clear old quotas immediately, fence late responses and discard obsolete trailing work. Failures revoke quotas rather than retain possibly different account data. Hidden panels remain inactive; no global browser quota cache, native API fallback or shared OpenCode lifecycle change is introduced.
Add controller and real Solid browser regressions for event bursts, location isolation, stable DOM, account changes during passive reads, removed windows and failures, and document the refresh policy. New burst/boundary tests fail before the fix; fourteen targeted tests, UI typecheck and production build pass. An independent published gatekeeper review of this exact head found zero findings and independently repeated these validations.
Admin merge without waiting for CI was explicitly requested. The installed application has not been replaced, and rebuilt installed Tauri or live account-switch validation is not claimed.
## Summary
I separated the connected CodeNomad server's environment from the client
information shown in Settings and diagnostic exports.
- The existing metadata endpoint now reports the backend process OS and
Node runtime architecture, independently of the browser's user agent or
OpenCode host.
- Server OS and architecture appear in the server information card.
Client runtime, platform and OS are explicitly labeled as client
information in all ten locales.
- Copied and downloaded diagnostics contain both environments. Older or
unreachable servers never fall back to the client's OS.
## Validation
- 761 server tests passed, with six platform skips.
- 14 targeted UI tests passed, including four real-component browser
scenarios for web, Tauri and Electron runtime fixtures, copy/download
exports, metadata refresh and older/unreachable servers.
- Both typechecks, all ten locale index checks, the server/UI build and
diff checks passed.
- I have not validated a physical remote Debian host or a native macOS
desktop build.
Existing oversized files touched: `packages/server/src/api-types.ts`
(~680 lines) and `packages/ui/src/lib/i18n/messages/*/settings.ts`
(~660–680 lines).
Backport the exact read-only macOS maximize getter from Tao #1182 into the existing 0.34.6 vendor override, preserving the Windows input backport. The original borderless getter changed AppKit style masks and generated geometry events whose persistence capture called the getter again, starving startup independently of OpenCode readiness. Window chrome, persistence policy and shared OpenCode lifecycle remain unchanged.
Add a bounded native AppKit regression with isolated original-crate negative-control artifacts, repeated warm-cache runs, getter-phase capture evidence, maximize/restore and fixed-size/decorated cases. Reject unrelated watchdog timeouts and validate runner results with platform-independent tests. Run the native regression in macOS ARM64 CI.
Validation includes the macOS Intel VM reproduction and rebuilt Tauri startup, second-window quit/relaunch with isolated OpenCode 2.0.21, 181 macOS and 188 Windows Tauri tests, Windows input negative controls, 44 targeted Electron regressions, successful ARM64 CI tests and a published ARM64 test artifact. Both independent gatekeeper findings were fixed and re-reviewed to zero findings. All test jobs passed; remaining platform builds were still running at the explicitly requested admin merge.
Fixes#819.
Flatten Mission Control into compact top-level rows with two-line objectives, semantic state colors, direct readers and coordinator navigation. Put Work first, collapse secondary sections by default, and retain per-window reader and disclosure state.
Create UI missions in a prepared state and use one Play button for start/resume alongside Pause and terminal Stop. Persist explicit control intents and per-target receipts, serialize them with mission admissions, and use the authenticated desktop bridge for native root-session interruption and environment-fenced resumption. Park report notifications while paused, cancel mission-owned queued inputs on Stop, and prevent stale retries from reopening terminal missions. Native descendant suspension remains outside these root-actor controls.
Add opt-in deletion of mission-created specialist conversations. Persist cleanup targets and receipts, reserve journal capacity, and validate ownership through a narrow cleanup authority RPC before native HTTP removal. Preserve coordinators, reused/shared/moved sessions and roots with children; partial failures keep stable explicit retry identities.
Validate with 88 focused server tests, 10 browser/i18n tests, server and UI typechecks, the full build and an isolated OpenCode 2.0.21 fixture covering Play/Pause/Resume/terminal Stop, cleanup and transcript preservation. Inspect rendered controls and document the lifecycle, cleanup and styling conventions.
## Summary
Follow-up to #813.
- Scale main local/remote Electron and Tauri content minimums with
application zoom: 390 × 600 CSS px, rounded up in native logical units
and capped to the monitor work area.
- Restore local window dimensions against their saved zoom; keep native
frame offsets and monitor DPI separate.
- Reserve 390 CSS px for conversations before side panels overlay.
- Force conversation-header actions into overflow below 420 CSS px,
matching timeline hiding, while preserving measured expansion and
filter/focus behavior.
- Leave Preferences, native preview guests, existing profiles and the
shared OpenCode daemon untouched.
## Validation
- 32 targeted browser tests, including real isolated Electron
framed/frameless zoom at 80/100/125/150%, menu/keyboard input and reload
persistence.
- 220 Electron native tests passed; 4 platform skips.
- 182 Windows Tauri tests passed.
- UI/Electron typechecks and UI/server/Electron builds passed.
- Rendered native captures inspected.
## Review and delivery
Independent Gatekeeper review reports will be published as GitHub
reviews. Findings will be corrected and re-reviewed until zero findings
before the requested administrator squash merge.
Keep the Usage panel mounted when streaming session metadata replaces the active session object. Deduplicate equal request identities without suppressing revalidation of actual instance, session, native directory, provider or model changes. This removes the repeated loading/unavailable flashes and quota reads while retaining native account, reconnect and late-response fences.
Expose only a sanitized feature-local reason for a missing native credential-list endpoint and translate the actionable service-version message in all locales. The global OpenCode minimum stays at 2.0.7; Codex Usage alone requires 2.0.20. Authentication/other errors remain generic, no legacy credentials are substituted, and service restart remains explicit.
Validation includes generated-client and HTTP route status regressions, real Solid panel lifecycles for available/unavailable usage, session identity transitions, 760 passing server tests with six platform skips, neighboring UI and desktop-resource checks, server/UI typechecks and build, and an isolated native OpenCode 2.0.20 fixture using synthetic credentials and mocked quota HTTP.
An independent published gatekeeper review of the exact head found zero actionable findings. The reviewer independently passed 71 targeted tests, exercised extra scope/lifecycle browser probes and checked all ten locales. No native desktop or live account/quota validation is claimed.
## Summary
Unify the right-panel Git and file surfaces as **Files**, with a compact
**Workspace / Changes / Commits** switch and a shared central preview
above the
conversation composer.
- Workspace: lazy, keyboard-accessible directory tree; read-only source,
Markdown and image previews; bounded binary-file fallback.
- Changes: indexed/working-tree files and central diffs, with existing
Git
mutations kept in a collapsed actions section.
- Commits: paginated history of the browsed worktree, commit
details/files and
first-parent diffs, including root commits, renames, deletions and
gitlinks.
- Preserve drafts and mode navigation; fence late responses across
session and
worktree changes. Migrate previous tab customization and retain
diff/wrap
preferences. Bundle Monaco tokenizers locally for offline highlighting.
- Worktree browsing does not move a conversation or check out a branch.
## Implementation
The common Solid UI is used by Electron and Tauri. New file previews
reuse the
directory ownership boundary and bounded filesystem reader. Historical
reads use
worker Git commands with full-hash validation, authoritative file
membership,
bounded command output/time and snapshot-based paging. The old sidebar
editor
and split viewer are retired. See `dev-docs/FILES_PANEL.md`.
## Validation
Before rebasing onto current dev:
- Server, UI and Electron typechecks passed.
- Server/UI and Electron builds passed.
- 20 focused unit/route tests passed, including real isolated root and
linked
repositories, preview bounds and directory ownership.
- 12 distinct browser scenarios passed: 5 Files flows (including real
SessionView/composer, Markdown/images/source and RTL keyboard
navigation) and
7 existing Git lifecycle regressions.
Post-rebase validation, independent gatekeeper reviews and the Windows
Tauri
test build will be recorded below as they complete. This PR is intended
for
interactive validation before merge.
## Summary
I confirmed #812: the proxy removes the native missing-session tag
during ownership preflight, so the existing frontend cannot skip an
unavailable parent.
I preserved the sanitized `SessionNotFoundError` response (`_tag`,
requested `sessionID`, `message`) and HTTP 404. No UI behavior change,
parent rewrite, session deletion, ownership bypass or raw upstream error
forwarding is needed.
## Validation
- The proxy regression fails on the original generic response and passes
with the fix; it covers direct/nested reads, deletion admission,
generated-client decoding and unrelated errors.
- The real UI session-list store reproduces failure with the old
response, recovers valid families beside an orphan on repeated
refreshes, and still surfaces authorization failures.
- Full server suite: 754 passed, six platform skips, no failures.
Focused UI tests: 27 passed. Both typechecks and diff checks passed.
- These are isolated synthetic fixtures, not a reproduction on the
reporter's Linux/Tauri installation. No shared daemon or user history
was accessed.
Closes#812.
Maintenance note: existing `packages/server/src/server/http-server.ts`
(~2,319 lines) and
`packages/server/src/server/__tests__/instance-proxy.test.ts` (~1,117
lines) exceed the repository size guidelines; no unrelated refactor is
included.
## Summary
Qualify **OpenCode 2.0.21** and synchronize the server/UI client, plugin
and recommended runtime. Keep the demonstrated **2.0.7** application
minimum and the separate **2.0.20** feature requirement for native Codex
Usage. No production API adapter or proxy expansion is necessary.
The branch starts at `dev@0822c794`, including #807 file navigation,
#811 native selected Codex credentials and #813 responsive conversation
controls. The conversation remains attached to the main checkout;
qualification uses a separate worktree and isolated synthetic
services/data.
## Upstream audit: 2.0.20 → 2.0.21
- Authenticated native OpenAPI retains **116 paths**. The only operation
change is `DELETE /api/session/{sessionID}/form/{formID}`: optional
`message` query parameter and updated description. `Form.State` adds
optional `message` to the cancelled variant. All other paths/components
are unchanged.
- Published declaration comparison: **2/30 client, 0/60 plugin, 1/36
protocol, 1/102 schema** files change. The differences correspond to the
optional cancellation message. The generated JavaScript forwards it as a
query parameter; existing callers omit it.
- An isolated native fixture uses the real generated 2.0.21 client to
cancel both session and global Forms, with and without a message. Native
state preserves exact URL-sensitive text (`&`, `?`, accented text), and
the no-message state is unchanged.
- Other relevant runtime changes: provider passthrough/cache fixes,
Workers AI/Nova overflow classification, avoiding duplicate ancestor
instructions, namespaced provider session/parent headers, and native
browser-tool availability tied to desktop attachment. These do not add a
new CodeNomad runtime dependency.
- The plugin's optional OpenTUI peer floors move to **0.5.14**. Those
terminal peers are not installed by CodeNomad. Lockfile scope is exactly
six `@opencode` packages and the two workspace entries;
metadata/integrities come from the independently installed published
packages. A clean `npm ci --ignore-scripts` validates the final lock.
- GitHub's release-tag comparison is diverged by one base-only commit:
`84c9be93a56304a108f1a22df0c5d62c26d5b6ca`, the 2.0.20 release
manifests/lock update, with no additional base-only production source
files.
## Isolated qualification
Windows / **Node 24.20.0**, separate CLI/profile/database instances and
synthetic providers. No shared-daemon or personal-history operations.
- Existing **2.0.20 dependencies + runtime 2.0.21**: full native pruning
acceptance passes, including relay/proxy/ownership, worktrees,
Forms/permissions, 241-message history search/cleanup, 1,501-message
navigation, concurrency, next-model payload, forks, compaction and
restart.
- With **2.0.21 dependencies**, all **seven native suites pass on both
2.0.7 and 2.0.21**: automation, pruning, per-send environment, forks,
idle/busy side questions, blank-session cleanup and Git-degraded
recovery.
- Additional **native Codex Usage** acceptance passes on 2.0.21:
production adapter selects native OAuth/accountID, invalidates a warm
snapshot on account switch and recovers despite a stale legacy file.
Only quota HTTP is mocked; credentials and daemon are synthetic. This is
not a real-account/WSL test.
- Complete native/UI pruning acceptance passes with the **ordinary
launcher**, without Vite preloading. Historical intermittent Windows
import failures remain unexplained, not claimed fixed.
- Full server suite: **751 passed, 6 skipped, 1 failed** in unchanged
`git-worktree-config.test.ts` cleanup (`rmSync` EPERM). The focused
unchanged fixture rerun passes **9/9** without forced exit. The original
failure is retained; the full run is not relabelled green.
- **71 UI tests** and **32 browser scenarios** pass
(client/store/reducer/usage state, setup/install progress, auth
recovery, tool images and rendered usage). Aggregate server/UI tests use
`--test-force-exit`; browser tests do not.
- Server/UI/Electron typechecks and production
server/UI/pruning/automation builds pass.
- Native historical migrations **2.0.3 → 2.0.21** and **beta-19271 →
2.0.21** pass.
- Isolated native npm upgrade **2.0.15 → 2.0.21** passes while the
authenticated running daemon stays **2.0.15 / PID 40568** before and
after.
- Standalone pruning plugin packed and installed outside the repository
passes native 2.0.21
history/navigation/proxy/concurrency/compaction/restart acceptance.
Local results do not establish all real providers, Linux/macOS/WSL or
installed desktop hosts. Independent gatekeeper and remote CI outcomes
are reported separately; no continuous CI monitoring is requested.
Align server/UI client and bundled-plugin pins with OpenCode 2.0.21 while keeping the demonstrated 2.0.7 application minimum and the separate 2.0.20 Codex Usage requirement. The native contract changes only by optional form-cancellation text, so existing callers need no production adapter or proxy expansion.
Extend recommendation/status coverage and update maintained architecture and compatibility references. Scope the lockfile to published OpenCode packages, including optional OpenTUI peer metadata, without refreshing unrelated dependencies.
Qualify minimum/current native suites, generated cancellation with and without a message, selected native Codex credentials, ordinary pruning/UI acceptance, standalone plugin, historical migrations and isolated upgrade retaining daemon version/PID. Typechecks, builds, 71 UI tests and 32 browser cases pass. Preserve the full server suite cleanup EPERM and its successful focused rerun as separate evidence rather than claiming a fix.
## Summary
- Improve mobile conversation controls for #800: one-row truncated
composer controls, compact touch actions, header overflow for transcript
filters and session-change header measurement rebinding.
- Hide the timeline below 420px and reduce the worktree selector to its
accessible arrow below 460px of conversation width; preserve
preferences.
- Make the prompt itself follow visible conversation height with a saved
manual proportion, 8% minimum / 60% maximum and a 44px floor. Keep
drafts and migrate legacy pixel preferences.
- Preserve the original six preview templates and add owned native
Android/Chromium touch emulation to mobile templates in Electron and
Windows Tauri. Allow main windows to shrink to 390px.
## Validation
- UI typecheck and build passed.
- Focused browser regressions cover narrow mouse/touch layouts,
thresholds, filters, draft preservation, pointer/keyboard resizing,
proportional window resizing and visual-keyboard changes.
- Native Electron emulation and controller/window tests and Tauri
controller/restoration tests exercised during implementation; final
verification and independent Gatekeeper review will be posted below.
## Scope and limitations
- Emulation is Android/Chromium, not a claim of Gecko/Waterfox or Safari
parity; iframe fallback changes only dimensions. Physical software
keyboard behavior is represented with deterministic visualViewport
fixtures.
- No shared daemon restart, profile reset or unrelated main-checkout
changes.
- Existing large files touched: `prompt-input.tsx` (~1068 lines),
`instance-shell2.tsx` (~1325), `session-view.tsx` (~697),
`browser-frame.tsx` (~877).
Refs #800.
## Summary
I replaced Codex Usage's legacy auth-file reads with the connected
OpenCode V2 daemon's selected ChatGPT OAuth credential. This addresses
the stale-file mismatch described in #808 without guessing WSL
credential paths or substituting another account.
- Resolve the provider integration in the owned session's native
location; use only its selected active credential and native accountID.
- Keep credentials server-only, OAuth refresh native-owned, and
credential export/generic RPC blocked through the browser proxy.
- Fence warm and pending quota results on account changes, reconnects
and session movement; scope the visible panel to its instance/session.
- Bound quota HTTP, reject redirects and sanitize errors. No SQLite
access or legacy/Codex CLI fallback.
The credential-list API requires OpenCode 2.0.20 for this feature only.
Older runtimes, expired native tokens and non-ChatGPT connections fail
closed; the global application minimum is unchanged. Other providers'
credential integrations are outside this focused fix.
## Validation
- Server/UI typechecks; 85 server tests; five UI unit tests; three
rendered browser scenarios; UI build and diff checks passed.
- A fresh native 2.0.20 Windows daemon with synthetic credentials
exercises the production adapter: selected OAuth/accountID, key-account
switch invalidating a warm snapshot, and recovery despite stale
auth.json. Quota HTTP is mocked; no shared daemon or real credentials
are used.
- This fixes the confirmed integration mismatch, but I have not
reproduced the author's real WSL/live account failure.
Closes#808.
Maintenance: existing `packages/server/src/server/http-server.ts`
(~2,317 lines) and `packages/ui/src/lib/api-client.ts` (~613 lines)
exceed the source-size guideline; their wiring changes remain small.
## Summary
I revisited the feedback on #724. I had deliberately removed three
permanent root/Home/start icons and moved the parent into the address
menu to avoid duplicate controls. That simplification went too far: the
configured workspace root disappeared when it differed from the initial
folder, and parent navigation was hidden until the address menu opened.
- Restore the server-reported workspace root as a named address
destination in both browsing scopes.
- Restore the familiar Up one level list row in folder and file modes,
including empty folders and Windows drive roots.
- Keep Back to start and unrestricted Home, deduplicate identical
targets, and remove the parent address option.
- Clear edited-path state and protect the parent click from address-blur
reflow.
- Add the root label to all ten locales. No new permanent toolbar icons
or server authorization changes.
Follow-up:
https://github.com/NeuralNomadsAI/CodeNomad/pull/724#issuecomment-5902482429
## Validation
- Both distinct-root browser regressions fail before the fix.
- All 19 real directory-browser scenarios pass, including restricted
boundaries, no initial path, deduplication, Windows Drives, edited-path
clicks, relative starts, reopen/stale-response fencing, keyboard entry
and 600/360 px layouts.
- UI typecheck/build and diff checks pass.
Maintenance: the existing
`packages/ui/src/components/directory-browser-dialog.tsx` is
approximately 575 lines; I kept the change focused rather than
refactoring unrelated behavior.
## Summary
Qualify **OpenCode 2.0.20** and synchronize server/UI client, plugin and
recommended runtime pins. Retain the demonstrated **2.0.7**
timestamp-based minimum. No production API adapter, proxy exposure or
implicit daemon restart is added.
The branch starts at `dev@d9957500`, including #803's close actions and
#806's static connected MCP indicators. The conversation stays attached
to the main checkout; qualification uses a separate worktree and
synthetic services/data.
## Upstream audit: 2.0.19 → 2.0.20
- Authenticated native OpenAPI: **116 paths**. The previous 115 path
definitions are unchanged; the new path exposes `GET` and `POST
/api/credential`. Listing exports stored secret values, so neither
operation belongs in the workspace proxy. A regression confirms both are
rejected before contacting upstream.
- Existing schemas gain optional session-error `response.body` and
connection `status` (`needs_auth`, message, optional URL). New
components describe the credential operations. No existing required
field or route is removed.
- Published declaration audit: **6/30 client, 2/60 plugin, 5/36 protocol
and 8/102 schema files change**, propagating these fields, credential
methods and the plugin's `integration.connection.status` method.
Generated `FormAnswer1` becomes `FormAnswer2` with the same value shape;
CodeNomad does not import the renamed helper. This is not a claim that
every generated public type is unchanged.
- A UI regression verifies optional provider response-body preservation
without replacing the existing display message. The existing
legacy/no-body error tests remain.
- Relevant runtime changes also cover provider error extraction,
Bedrock/Mistral reasoning, prompt caching, ChatGPT token-sharing
authentication, CLI permission rejection and owner-only database-file
permissions.
- The CLI's new `service disabled` setting affects implicit CLI
connections. An isolated fixture uses CodeNomad's real
`OpenCodeCliService` to authenticate explicit startup/discovery with
`disabled=true`; the setting remains true afterward. CodeNomad does not
write native service configuration.
## Isolated qualification
Windows, Node **24.20.0**, separate CLI/profile/database instances and
synthetic providers. No personal histories or shared daemon operations.
- Existing **2.0.19 dependencies + runtime 2.0.20**: full native pruning
suite passes, including relay/proxy/worktree ownership,
Forms/permissions, 241-message search/cleanup, 1,501-message navigation,
concurrency, next-model payload, forks, compaction and restart.
- With **2.0.20 dependencies**, all **seven native suites pass on both
2.0.7 and 2.0.20**: automation, pruning, per-send environment, forks,
idle/busy side questions, blank-session cleanup and Git-degraded
recovery.
- The complete native/UI acceptance passes using the **ordinary
launcher**, without diagnostic Vite preloading. Historical intermittent
Windows failures remain unexplained; a passing run is not a fix.
- **745 server tests pass, 6 skipped**; **66 UI client/store/reducer
tests pass**, including the new response-body regression. These
aggregate suites use Node's `--test-force-exit`; the focused **11/11
normalizer tests** also pass without it. **30 browser scenarios pass**
(setup/progress, auth recovery and tool-result images).
- Server/UI/Electron typechecks and production server/UI/plugin builds
pass.
- Both native history migrations **2.0.3 → 2.0.20** and **beta-19271 →
2.0.20** pass.
- Isolated native npm upgrade **2.0.15 → 2.0.20** passes while the
running daemon remains **2.0.15**, PID **31872** before/after.
- Standalone pruning plugin packed and installed outside the repository
passes native 2.0.20 acceptance, including
history/navigation/concurrency/compaction/restart.
The initial npm resolution also refreshed unrelated Redis and WSL
utility entries. Those entries were restored before publication; the
final lock changes only six `@opencode` packages and the two workspace
manifests. A clean `npm ci` accepts that final lock. Final-lock
revalidation passes server/UI/Electron typechecks, production builds,
all **745 server + 66 UI tests**, and the complete ordinary-launcher
native/UI acceptance. The initial and final logs are retained
separately; both ordinary native/UI runs pass.
Local results do not establish all real providers, Linux/macOS/WSL or
installed desktop hosts. Remote CI and independent gatekeeper outcomes
are reported separately.
Size signal: the touched existing
`packages/server/src/server/__tests__/instance-proxy.test.ts` is
approximately **1,073 lines**; no unrelated refactor is included.
Synchronize server/UI client and plugin pins with OpenCode 2.0.20 while retaining the demonstrated 2.0.7 step-timestamp minimum. Review the authenticated runtime contract: existing routes remain stable, while credential operations and optional connection/error metadata are added without requiring production adapters.
Protect the workspace proxy boundary with credential export/create rejection coverage and verify optional provider response bodies survive UI normalization. Update the maintained compatibility and architecture references, including explicit native service startup with the new disabled setting and the unresolved historical Windows import failure.
Validate minimum/current native runtimes, ordinary pruning/UI acceptance, standalone plugin installation, historical migrations and native npm upgrade with daemon version/PID preservation. Clean-install the scoped lockfile and revalidate typechecks, production builds, 745 server tests and 66 UI tests; browser qualification covers 30 scenarios.
Keep connected MCP status dots green without a permanent pulse. Pending connect/disconnect operations retain their warning pulse and spinner; the shared reduced-motion and metadata refresh policies are unchanged.
Add real StatusTab/SUID browser regressions at 150% scale, a bounded historical/current Chromium profiler, and measurement-limit documentation. Five browser scenarios, UI typecheck/build and repeatable profiler assertions passed. Fix the gatekeeper P2 by creating the temporary evidence parent on clean machines; the second independent review reported zero findings.
The change addresses the idle-animation source in #804, not its unconfirmed generation GPU symptom or #805. Remote CI was pending at the explicitly requested admin merge.
Make persistent utility windows and the web preview discoverably dismissible using an upper-right X in their existing toolbar. Share the localized square close control, move search dismissal from its input row to the options row, and preserve the aside's existing header. Do not add extra title bars or draggable-window behavior. Transient message-content popups retain outside/Escape dismissal without an X.
Keep initial focus on input fields and native close-button activation separate from palette command execution. Web dismissal returns to chat without deleting preview state or drafts; BrowserFrame close remains optional for other consumers. The separate mission-reader replacement was merged as #802 into its feature branch.
Final independent gatekeeper review at d4d35f20495b6df87634d1bc49db072571c8081a: PASS, zero findings. Validation: 22/22 browser scenarios, narrow/RTL checks, UI typecheck, production build and diff hygiene. Admin squash explicitly authorized by the user; broader hosted CI was still in progress at admission.
Replace the existing Back to chat arrow/text button with an X in the mission reader's current header. Preserve its localized accessible name and tooltip, chat transition, Escape handling and focus behavior; add neither an extra bar nor draggable-window behavior.
Independent gatekeeper review: PASS, zero findings. Target-branch mission browser suite: 7/7; UI typecheck passed. Admin merge authorized by the user; broader hosted CI was still in progress at admission. Companion utility/web-preview correction is #803.
## Summary
Qualify **OpenCode 2.0.19**, the latest stable publication, and
synchronize the server/UI client, pruning plugin and recommended
runtime. Keep the demonstrated **2.0.7** technical minimum. No
production API adaptation is required by the inspected contracts.
The branch starts at `dev@0b348e86`, including #784's sustained
installation progress and #785's destroyed-window close fix. Runtime
installation and shared-daemon restart remain separate explicit
operations.
## Upstream audit: 2.0.18 → 2.0.19
- Authenticated native OpenAPI: all **115 paths and component schemas
are identical** to the native 2.0.18 schema.
- Published declarations: byte-identical **30 client, 60 plugin, 36
protocol and 102 schema declaration files**. Distribution chunk
filenames differ; this is not a claim that the complete published
JavaScript packages are byte-identical.
- Relevant upstream changes: compaction refactor; output limits fitted
to context with a 256k cap; bounded shrinking after provider
context/payload rejection; provider-cache reuse and session affinity;
one-shot generation attribution; provider/media error fixes;
repository-host path validation.
- Native Shell tools now supply `AGENT=1`, `OPENCODE=1`, default
`AI_AGENT=opencode`, and the current `OPENCODE_SESSION_ID`. CodeNomad
still writes the complete profile session snapshot before each
prompt/command/session-shell send.
- No minimum increase follows from these runtime improvements. The
generated API and server-plugin contract do not add a CodeNomad
dependency boundary.
## Isolated qualification
Windows, Node **24.20.0**, synthetic providers and separate
CLI/profile/database instances. No shared daemon or personal histories
are used.
- Existing **2.0.18 dependencies + runtime 2.0.19**: complete native
pruning acceptance passed, including relay/proxy/ownership, worktrees,
Forms/permissions, 241-message search/cleanup, 1,501-message navigation,
concurrency, next-model payload, forks, compaction and restart.
- **Server/UI/Electron typechecks passed.** Full server run: **743
passed, 6 skipped, 1 failed** in an unrelated Git fixture cleanup
(`rmSync` EPERM). The focused unmodified Git-worktree fixture rerun
passed **9/9**; the original failure is retained rather than relabelled
an entirely green full run.
- **65 UI client/store/reducer tests passed.**
- **30 browser scenarios passed**, covering setup/install progress, auth
recovery and tool-result images.
- With the **2.0.19 dependency pins**, all **seven native suites passed
on both 2.0.7 and 2.0.19**: automation, pruning, per-send environment,
forks, idle/busy side questions, blank-session cleanup and Git-degraded
recovery. Pruning includes native
proxy/relay/worktree/history/concurrency/compaction/restart scenarios.
- Historical native migrations **2.0.3 → 2.0.19** and **beta-19271 →
2.0.19** passed: complete history, forks, historical
identities/configuration and same-version restart comparisons for Forms
durability.
- Real npm/native installation **2.0.15 → 2.0.19** passed while the
authenticated running daemon remained **2.0.15**, PID **43016**
before/after.
- Production server/UI/pruning/automation builds passed.
- The standalone pruning plugin was packed and installed outside the
repository, then passed native 2.0.19 acceptance through
history/search/navigation, proxy/ownership, concurrency, compaction and
restart.
## UI fixture diagnostic boundary
Two ordinary pruning/UI runs against 2.0.19 stopped abruptly while
dynamically loading Vite, after native history and proxy cases passed.
An unchanged **2.0.18 runtime control reproduced the same stop** using
the existing 2.0.18 dependency tree. The shell reported exit **116**,
with no JavaScript exception. Earlier qualifications recorded an
intermittent Windows heap-corruption exit around this phase; the new
observations alone do not establish the same native cause.
This PR adds only per-import progress traces to the native/UI fixture,
pinpointing completion of Playwright and entry into Vite import. It does
not claim to fix the underlying abrupt exit or silently retry it.
The **full 2.0.19 native/UI acceptance passes** with a temporary
diagnostic launcher that preloads Vite before starting the fixture (exit
0). The same assertions complete UI deletion, native persistence/reload,
plugin discovery and multi-backend lifetime, contention, next-model
payload, forks, compaction and restart. The diagnostic changes import
order; it does not prove the ordinary late-import launcher is reliable
or establish why it stopped. The preload is not introduced into
production or silently made the default test path.
Local qualification does not establish every provider configuration,
installed-desktop behavior or cross-platform coverage; remote CI
outcomes are reported separately.
