Load continuation message pages with the native cursor alone, hide deprecated models, and tolerate failed plugin records that do not carry an ID.
Match official Desktop URL handling by limiting native external openers to web and mail schemes. Connect wildcard-bound shared services through loopback while preserving strict authentication and non-loopback rejection.
Remove the inactive unrestricted Tauri asset scope and add focused regression coverage for cursor requests, model/plugin projection, URL schemes, and wildcard service discovery.
Validated with focused UI/server tests, all 158 Electron native tests, all 104 Tauri tests, package typechecks, the UI production build, Rust formatting, and diff checks.
Rewrite the migration guide around the architecture now present on DEV-v2. Inventory the removed V1 plugin, runtime, background-process, Question, delta, and native Tauri event layers; describe their native V2 replacements and the shared-service ownership model.
Document duplicate-folder instances, per-window tabs, native cursor authority, reconnect reconciliation, worktree evacuation, proxy security, multi-window persistence, restore fencing, UI performance work, current automated validation, and the remaining interactive smoke gate. Remove stale claims about private OpenCode storage, daemon shutdown, canonical workspace deduplication, projection resets, and pending CI.
Validated with stale-claim searches and git diff --check.
Delete the unused ClientStateLifecycle implementation and its isolated tests now that every production window routes through MultiwindowLifecycle. Remove the deleted test file from the native test command without changing multi-window close, persistence, or shutdown behavior.
Validated with all 158 Electron native tests and the Electron TypeScript typecheck.
Remove the one-caller workspace identity module now that logical workspace deduplication no longer exists. Keep realpath canonicalization directly at the launch boundary and cover it through duplicate alias creation behavior.
This removes another 22 net lines and one source file. Focused manager tests and the server typecheck pass.
Create a fresh logical workspace for each normal folder launch so repeated opens produce separate tabs again. The explicit Open action still selects an existing instance without creating one.
Keep the shared OpenCode location alive until its final logical workspace closes. Remove canonical deduplication, multi-owner launch bookkeeping, inode identity state, and the tests that only supported that behavior.
Validated with the full server suite, restore ownership tests, server typecheck, and focused concurrent launch and location eviction coverage.
Show the initial loading state while the native session cursor is still unresolved, including the metadata hydration window before the list request starts.
Remove the misleading load-more label from the pagination sentinel because the shared fetch flag tracks initial and refresh requests rather than cursor requests. Native cursor handling remains authoritative, including terminal empty pages.
Validated with UI typecheck, focused pagination and request-authority tests, and the production UI build.
Coalesce concurrent provider and agent catalog requests per OpenCode location while preserving one trailing refresh after reconnect, authentication, or catalog invalidation. Fence stale responses with monotonic request generations and cancel removed-instance flights so reused workspace IDs cannot install obsolete providers, agents, models, or commands.
Load only the selected session transcript instead of eagerly requesting every descendant. Keep thread cost and token totals complete from native session aggregates, including newly paginated descendants, while retaining cursor-based transcript history loading.
Strip upstream WWW-Authenticate and Proxy-Authenticate challenges alongside response cookies so OpenCode authentication cannot trigger the browser's native Basic Auth dialog. Coverage exercises coalescing, invalidation, location switches, instance-ID reuse, lazy transcripts, native totals, and real 401 proxy responses.
Preserve the OpenCode data controller across reconnects, require the native server.connected handshake, restore native cursor pagination for sessions and messages, and route global Forms through their validated worktree locations.
Make partitioned client state tolerate corrupt inactive leaves and store unsent attachment payloads as bounded content-addressed chunks without silently rewriting drafts. Align Electron and Tauri commit limits and shutdown-generation fencing.
Tighten SSE CORS, proxy ownership checks, remote-window navigation, process exit classification, and pre-navigation renderer flushing. Ordinary backend shutdown now detaches local workspaces without evicting shared OpenCode locations.
Coverage includes server proxy/event/lifecycle tests, UI pagination and restoration tests, Electron native lifecycle/security tests, and the full Tauri Rust suite.
Replace Array.prototype.at() in the new OpenCode service tests with equivalent indexed access so the Tauri prebuild compiles under the server workspace's existing TypeScript library target on macOS ARM64.
Validated with the full server production build and the focused host/WSL service test suite (14 passing).
Use the official host and WSL OpenCode service lifecycle instead of private daemon ownership. Workspace deletion now evicts only the selected location while shared sessions, agents, messages, and executions remain available to other windows.
Add profile-scoped singleton multi-window support for Electron and Tauri, isolate local window UI state in a durable partition graph, and preserve migration, fencing, bounded persistence, and cross-host ownership semantics. New Window and New Instance are exposed together in the native Window menu.
Harden renderer authority, remote profiles, SSE identity, idle attention, git-status concurrency, SideCar sandboxing, shutdown, generated Tauri ACLs, documentation, and CI coverage.
Validated with server, UI, Electron, and Tauri test matrices; TypeScript checks; cargo fmt; production Electron/server/Tauri builds; diff checks; and a packaged Windows smoke covering singleton focus, --new-window, one shared backend, menu placement, and slot hash verification.
Migrate the Status panel from interactive PTYs to the location-scoped shell API, refresh shell state after lifecycle events and reconnects, and route locationless shell events by their owned working directory.
Allowlist shell routes explicitly and verify ShellInfo.cwd before every ID-scoped request, including trailing-slash aliases, while preserving native output cursor parameters. Keep PTYs separate for interactive terminal use.
Load project metadata before the first session inventory, preserve native projected message order, invalidate inactive transcripts instead of reloading every transcript after reconnect, and keep native shutdown terminal without latching ordinary navigation flushes.
Update V2 documentation and CI test paths. Validated with UI and server typechecks, 15 focused UI tests, 35 focused server tests, and git diff --check.
Use the inbox identifier returned by OpenCode as the authoritative message identity instead of assuming every compatible CLI preserves the client-provided optimistic ID. This prevents the optimistic and admitted prompts from remaining as duplicate bubbles when their IDs differ.
Delete the replaced store record through a Solid produce update so the old key is actually removed. Covered by the optimistic send lifecycle suite and validated with the UI typecheck.
Stop comparing the selected OpenCode CLI version with the generated client package and stop constraining shared-service discovery to that exact string. Runtime releases can now update independently while existing health, location, API decoding, and launch-signature checks continue to fail closed on actual incompatibility.
Update migration and architecture guidance so the strict gate is not reintroduced. Validated server typecheck, 32 focused manager/service/identity tests with one platform skip, Tauri release build, NSIS installer hash, and diff cleanliness.
Disable native select required validation once a non-option custom value is present, so required long-option forms can submit through the existing schema validation.
Validated with UI typecheck, focused form protocol tests, and git diff --check.
Render the floating Form fallback whenever its inline tool target is unresolved, and allow required custom select answers to pass native validity checks. This prevents native Forms from leaving sessions permanently blocked.
Recheck affected session activity before each evacuation move and immediately before Git removal so execution starting after preflight aborts and rolls the transaction back. Validated with root typechecks, focused Form and projection tests, evacuation tests, and server typecheck.
Confirm same-ID user messages when createData exposes their native projected parts. This removes the client-only optimistic parts before applying the server representation, preventing every submitted prompt from rendering twice inside one message.
Add a regression that starts with an optimistic text part, applies the native inbox event, and asserts only the projected prompt remains. Validated with UI typecheck and 17 focused projection, send lifecycle, and request authority tests.
Scope global Form actions to the logical workspace location without hydrating a synthetic global session. Keep successfully loaded message sessions eligible for later reconnect retries and traverse project descendants independently of parent worktree subpaths.
Treat native session moves as asynchronous operations, block active worktree sessions, verify complete project inventory before Git removal, and roll all accepted moves back if verification or Git deletion fails.
Validated with server and UI typechecks, 255 passing server tests plus 3 platform skips, 31 affected UI tests, and git diff --check.
Merge live createData projections into REST history and reset their event cache for every internal stream generation. Load sessions by validated project scope across all descendant depths and apply native active state to later root pages.
Pin the updater and standalone server lockfile to the startup-compatible client version. Decode and authorize native session cursors, permit global Form actions, and prevent the WSL stop path from invoking the client's host PID fallback.
Make worktree deletion server-authoritative by inventorying the complete native project, moving affected session families with verification and rollback, and failing direct delete calls closed when evacuation cannot complete.
Validated with server and UI typechecks, 254 server tests plus 3 platform skips, 247 UI CI-partition tests, 122 Electron native tests, server/UI/Electron production builds, standalone server lockfile installation, Tauri cargo check --locked, and git diff --check.
Pin the server and UI client to the installed beta runtime and reject mismatched CLI versions before shared-service startup. Delegate proven shared-service shutdown to Service.stop while retaining CodeNomad lease, peer, registration, endpoint, and process-identity checks.
Adopt native Forms and the client/solid data reducer for live messages, tools, permissions, and input forms. Propagate internal stream generations into authoritative reconnect reconciliation and replace directory-wide session scans with native project cursor pagination.
Fail worktree deletion when session evacuation fails and deduplicate canonical workspace folders instead of exposing non-isolated duplicate instances. Update migration notes and CI coverage for the reviewed contract.
Validated with server/UI/Electron typechecks, 244 UI partition tests, 122 Electron native tests, 248 server tests plus 3 platform skips (the sole Windows cleanup race passed in isolation), UI/server/Electron builds, Tauri cargo check --locked, and git diff --check.
Treat DEV-v2 as an authorized development base in build, artifact-comment, and PR restriction workflows. GitHub evaluates pull_request policy from the base branch, so child PR changes cannot authorize themselves.
This allows PRs 648 and 649 to run validation without weakening restrictions for unrelated target branches. Workflow diffs and git diff checks pass.
Reduce the V2 test matrix to CodeNomad-owned behavior instead of repeating generated OpenCode request shapes, mock choreography, equivalent endpoint permutations, and source-level helper wiring.
Retain representative happy paths and the boundaries that protect workspace ownership, traversal and credentials, PID and WSL lifecycle proof, shutdown timeouts, permission isolation, restore handoff, deletion authority, streaming reconciliation, and persisted client state.
This removes 2,818 net test and CI lines. The full server suite passes with 249 tests and 3 platform skips; the PR UI matrices pass with 204 standard and 53 browser-conditioned tests, both server and UI typechecks pass, and git diff checks are clean.
Delete the obsolete pre-MVP roadmap and task references now that Git preserves that development history, while retaining current V2 operational and architecture guidance.
Remove behavior-neutral server and UI plumbing that has no remaining caller: unused workspace options and cached endpoint state, redundant auto-accept metadata, an unused PTY get adapter, and a one-use message-loading helper. Keep lifecycle proof, restore gates, timeline projection, and targeted invalidation because they still enforce runtime behavior.
Validated with server and UI typechecks, the full server suite (308 passed, 3 skipped), focused UI matrices, browser-conditioned UI tests, production server/UI build, diff checks, caller searches, and an independent regression review.
Keep tool-targeted V2 forms inline from the moment their metadata arrives instead of briefly opening the permission-center fallback while message state catches up.
Render the pending form directly in place of the tool-call chrome so users see one stable response surface without a stray disclosure chevron. Global and inactive-session forms retain the floating fallback.
Validated with the UI typecheck, the 83-test restore/form integration matrix, a production Tauri build, and git diff checks.
Update the empty plugin-status copy in every supported locale now that the panel reports runtime-active plugin IDs rather than configured package entries.
The UI typecheck and diff check pass.
Allow the read-only OpenCode /api/plugin endpoint through the workspace proxy so the status panel can distinguish active plugins from configured but unloaded packages.
Keep the route inside the explicit proxy allowlist and cover it with the instance proxy suite. The focused 25-test proxy suite, server typecheck, and diff check pass.
Keep provider usage visible across status-panel remounts and reuse fresh results for the normal polling interval so message refreshes cannot collapse the panel into a loading state.
Treat compaction as the boundary for the visible agent plan, source plugin status from active V2 plugin IDs instead of configured package entries, and reserve the background-shell panel for native PTYs.
Propagate session interruption to active descendants and replace the placeholder busy check with the real working/compacting status. Focused tests cover active plugin filtering, compacted plans, and descendant interruption; the complete UI test matrix, UI typecheck, and production build pass.
Document the A/B staging and deployment slot roles so smoke builds are launched from the validated deployed artifact.
Describe the complete external interactive-task handoff flow, including precise V2 process selection, request construction, environment setup, result verification, hash validation, and one-shot task cleanup. This gives future agents a positive executable procedure and prevents the handoff launcher from sharing the process tree it replaces.
The V2 migration first disabled and then removed the OpenCode update action because the native runtime no longer exposes V1's global upgrade endpoint. The remaining version card also queried the legacy opencode-ai package instead of the V2 beta channel.
Restore the settings action using the official @opencode-ai/cli beta installation flow for npm, pnpm, bun, and yarn. Restrict automatic updates to the managed opencode2 command, preserve custom binaries, compare monotonically numbered beta builds numerically, and verify the configured binary after installation before reporting success.
Validated against the live beta registry, 11 focused update tests, 307 server tests with 3 skipped, 544 UI tests, server and UI typechecks, the production UI build, and diff checks.
Rapid V2 deltas continuously extended the programmatic-scroll window. Virtua measurement corrections during that window could leave the controller logically following while the viewport remained above the bottom.
Enforce the bottom invariant whenever follow mode has no fresh user escape or active restoration. Classify page navigation from non-editing controls and primary selection drags as user ownership, cancel pending submit pinning for every recognized user scroll, and allow explicit downward intent to rejoin during a programmatic window.
Validated with 39 focused follow tests, 56 combined streaming/send/projection tests, the UI typecheck, 544 UI tests, and diff checks.
Optimistic user text was inserted synchronously but marked synthetic, causing timeline projection and message rendering to hide it until delayed REST or SSE reconciliation replaced the part. Large histories and active streaming made that delay especially visible.
Keep optimistic user text renderable while retaining reconciliation authority through the existing optimistic part ID registry. Also tolerate provisional text and reasoning parts without a text property when computing timeline signatures.
Validated with 12 focused projection and send-lifecycle tests, including a deferred native request proving pre-network visibility, plus the UI typecheck and diff checks.
Middle-button autoscroll starts from message descendants, but the virtual list only recorded pointer intent when the scroll container itself was the event target. The resulting scroll events had no user intent and were immediately pinned back to the bottom.
Treat a non-interactive middle-button pointer press anywhere inside the list as explicit user scroll ownership. This exits follow mode and cancels active bottom pinning without preventing the browser's native middle-button behavior.
Validated with 36 focused follow-controller tests, the UI typecheck, 539 UI tests, and git diff checks.
On large sessions, recent SSE messages can mount before the full paginated snapshot is hydrated. Scroll restoration then failed to find its saved anchor, immediately applied an obsolete absolute pixel offset, and was clamped near the bottom before the anchor arrived.
Keep restoration authoritative while waiting a bounded five seconds for the saved key to enter the virtual item set. Once available, the existing index navigation and offset stabilizer apply; genuinely missing anchors still fall back at the strict bound.
Validated with 39 targeted restoration tests, the UI typecheck, 538 UI tests, and git diff checks.
The first connected status from a newly started OpenCode stream waited for initial hydration and then repeated the same session, pending-request, catalog, metadata, and filesystem loads. This made every normal startup pay for a reconnect recovery pass.
Track only genuine error or unexpected-disconnect transitions as requiring recovery. Initial connecting-to-connected startup and deliberate workspace shutdown no longer resync, while failed streams still receive one coalesced authoritative recovery after reconnection.
Validated with 10 targeted connection and readiness tests, the UI typecheck, 537 UI tests, and git diff checks.
The instance bridge duplicated every OpenCode event payload into a synthetic properties field because server-side auto-accept still consumed the V1-style envelope. This expanded the SSE contract and left UI deletion handling with legacy fallbacks.
Move auto-accept and session deletion to native event.data, publish OpenCode events unchanged, type the shared stream as OpenCodeEvent, and guard PTY consumers before narrowing their event union. Internal CodeNomad worktree events remain separate.
Validated with server and UI typechecks, 51 targeted server tests, 21 targeted UI tests, 304 passing server tests with 3 platform skips, 535 UI tests, and git diff checks.
Volatile V2 events previously refreshed every catalog, metadata, and filesystem domain. Even an agent or command update therefore caused unrelated API requests and cache invalidation, with a trailing full rerun when events overlapped.
Map each native event to the state domains it can affect and merge pending domains in one coordinator. Reconnects retain a complete refresh, while agent, command, integration, metadata, filesystem, and VCS events now update only their relevant stores.
Validated with 21 targeted invalidation and request-authority tests, the UI typecheck, 535 UI tests, and git diff checks.
OpenCode SDK location responses expose workspaceID, while generated request inputs require workspace. Passing a response LocationRef directly was structurally accepted by TypeScript but caused the generated client to omit the workspace selector from catalog requests.
Centralize the output-to-request conversion and apply it to agent, provider, model, default-model, and command catalog calls. Internal session state continues using the SDK response shape.
Validated with 21 targeted request-authority tests, the UI typecheck, 533 UI tests, and git diff checks.
Real question-backed V2 forms set custom=true. The long-option branch therefore bypassed the intended select and rendered a text input with a datalist, so the tested 4/5 threshold did not hold for actual native requests.
Render every long option list as a select regardless of custom-value support, and preserve free-form answers in a separate custom input. Short lists remain visible cards.
Validated against a live four-option V2 form, targeted form tests, the UI typecheck, 532 UI tests, and git diff checks.
The Tauri macOS ARM prebuild combines DOM and Node timer declarations, so injected and global setTimeout implementations can return either a numeric browser handle or a Node Timeout. The previous inferred alias accepted only the Node variant and failed server compilation on that matrix leg.
Represent the manager timer handle as the actual portable union and avoid Array.prototype.at in a server test because the server TypeScript target predates ES2022.
Validated with the complete server build, 304 passing server tests with 3 platform skips, 11 targeted workspace tests, and git diff checks.
The Tauri client-state tests exercise process-global file locks and invoke PowerShell/CIM for process identity. Running them concurrently on the shared Windows runner can starve those probes, causing both cross-host election and bounded registration timing assertions to fail together despite passing independently.
Run the 74-test Windows Tauri suite with one test thread. Linux coverage remains parallel, and product-side participant reconciliation remains covered by repeated cross-host tests.
Validated with the exact serial Windows cargo command: 74 passed, 0 failed.
A session can mount from startup discovery before native workspace restoration seeds its saved scroll snapshot. The message stream previously marked that no-snapshot pass complete and ignored the authoritative seed when it arrived, leaving Virtua at the top despite a valid anchor.
Track no-snapshot completion as provisional and permit exactly one later restore when the reactive seed appears. Normal completed restores remain terminal, and session changes reset the provisional authority.
Validated with UI typecheck, 48 targeted restoration tests, 532 complete UI tests, and git diff checks.
Electron and Tauri can each publish a legacy running marker immediately before publishing their shared cross-host participant. On a simultaneous Windows startup, both hosts could observe that transient gap and yield ownership, leaving no primary.
When legacy detection initially blocks a primary candidate, wait for one bounded 50ms participant grace period and reconcile once before yielding. Apply the same protocol on both Node and Rust hosts; genuine legacy clients still block ownership after the grace period.
Validated with root typecheck, 50 repeated cross-host election runs, 122 Electron native tests, 74 Tauri tests, and git diff checks.
Render native V2 string option lists with up to four answers as visible radio cards, including each option description, so question-style forms retain the scannable V1 interaction. Lists with five or more answers continue to use a compact select control.
Apply the same selected-card treatment to multiselect answers, preserve custom-value entry, validate required inline strings, and keep grouped controls accessibly labelled. Option styling lives in a focused component stylesheet and uses existing square-corner design tokens.
Validated with UI typecheck, 531 UI tests, a production desktop build, git diff checks, and visual inspection in the deployed WebView.
When a native V2 form resolves to a tool call, render it as the sole interactive surface and suppress the legacy QuestionToolBlock for that call. Legacy questions remain available when no native form is pending, while unresolved and cross-session forms continue to use the existing floating fallback.
Improve the native form hierarchy with token-based panel and field surfaces, explicit required and focus states, consistent checkbox controls, square action buttons, and responsive stacked actions on narrow screens.
Validated with UI typecheck, 530 UI tests, a production desktop build, git diff checks, and desktop/mobile inspection in the deployed WebView.
Stop deleting OPENCODE_DB from legacy CodeNomad environment preferences during settings layout migration. Environment variables now migrate uniformly without a database-specific exception.
The OpenCode V2 service destination remains unchanged and continues to use ~/.local/share/opencode2/opencode.db through the launch-time service environment override.
Validated with the settings migration test, root typecheck, the complete server suite, and git diff --check.
Attempt configured WSL host-to-service translation before treating POSIX paths as already service-native. This preserves real Windows behavior while allowing Linux CI to exercise Windows workspace ownership with temporary git worktrees.
Remove the environment-dependent assertion that a bare opencode2 command resolves to a packaged executable. Deterministic shim coverage remains in buildServiceLaunchSpec and the Windows PATH/PATHEXT tests.
Validated with full typecheck, 27 spawn tests, 9 workspace manager tests, and the complete server suite with 304 passing tests and 3 skips.
Preserve the last authoritative non-empty tab snapshot through native shutdown, make shutdown capture terminal, and restore the exact saved active tab. Seed scroll snapshots before session selection and wait for usable Virtua measurements so project, tab, session, and anchor position survive A/B restarts.
Render native runtime forms inline only when their active-session tool target is resolved, retain the floating fallback for unresolved requests, share form schema visibility and URL validation with provider auth, and remove the unused session form-list proxy route and obsolete V1 request wrapper.
Return the native V2 session.active map without a legacy data envelope, avoid full-history refreshes for deltas already applied locally, and bound timeline projection refreshes during streaming. Coverage includes UI restoration, form targeting, proxy contracts, native streaming, and CI test registration.
Validated with root typecheck, 529 UI tests, 305 passing server tests with 3 skips, 74 Tauri tests, 122 Electron native tests, production A/B builds, a no-seed native handoff, and runtime verification of the active-session proxy shape.
The Star History chart was broken because it depended on the GitHub
stargazer API. Switch it to an alternative provider using the same data
source so the community chart renders correctly. No API token required.
Co-authored-by: OctoBored <212877535+OctoBored@users.noreply.github.com>
Keep follow ownership tied to explicit user intent so Virtua measurement corrections cannot silently escape an actively followed response. Large key jumps now land immediately, while explicit timeline and top navigation cancel submit pinning without confusing programmatic movement for user scrolling.
Rebuild timeline segments from cached V2 structural signatures instead of part-count and same-length replacement heuristics. This handles provisional-to-authoritative part replacement, type and renderability changes, terminal status updates, locale changes, duplicate part IDs, and the V2 time.completed contract without rebuilding streamed text on every token.
Add follow-state, timeline projection, and duplicate-part regression coverage to the PR workflow. Validated with 264 standard UI tests, 72 browser/integration tests, full UI and Electron typechecks, production UI build, and live Tauri WebView navigation/follow scenarios.
