Align server/UI client and bundled-plugin pins with OpenCode 2.0.21 while keeping the demonstrated 2.0.7 application minimum and the separate 2.0.20 Codex Usage requirement. The native contract changes only by optional form-cancellation text, so existing callers need no production adapter or proxy expansion.
Extend recommendation/status coverage and update maintained architecture and compatibility references. Scope the lockfile to published OpenCode packages, including optional OpenTUI peer metadata, without refreshing unrelated dependencies.
Qualify minimum/current native suites, generated cancellation with and without a message, selected native Codex credentials, ordinary pruning/UI acceptance, standalone plugin, historical migrations and isolated upgrade retaining daemon version/PID. Typechecks, builds, 71 UI tests and 32 browser cases pass. Preserve the full server suite cleanup EPERM and its successful focused rerun as separate evidence rather than claiming a fix.
## Summary
- Improve mobile conversation controls for #800: one-row truncated
composer controls, compact touch actions, header overflow for transcript
filters and session-change header measurement rebinding.
- Hide the timeline below 420px and reduce the worktree selector to its
accessible arrow below 460px of conversation width; preserve
preferences.
- Make the prompt itself follow visible conversation height with a saved
manual proportion, 8% minimum / 60% maximum and a 44px floor. Keep
drafts and migrate legacy pixel preferences.
- Preserve the original six preview templates and add owned native
Android/Chromium touch emulation to mobile templates in Electron and
Windows Tauri. Allow main windows to shrink to 390px.
## Validation
- UI typecheck and build passed.
- Focused browser regressions cover narrow mouse/touch layouts,
thresholds, filters, draft preservation, pointer/keyboard resizing,
proportional window resizing and visual-keyboard changes.
- Native Electron emulation and controller/window tests and Tauri
controller/restoration tests exercised during implementation; final
verification and independent Gatekeeper review will be posted below.
## Scope and limitations
- Emulation is Android/Chromium, not a claim of Gecko/Waterfox or Safari
parity; iframe fallback changes only dimensions. Physical software
keyboard behavior is represented with deterministic visualViewport
fixtures.
- No shared daemon restart, profile reset or unrelated main-checkout
changes.
- Existing large files touched: `prompt-input.tsx` (~1068 lines),
`instance-shell2.tsx` (~1325), `session-view.tsx` (~697),
`browser-frame.tsx` (~877).
Refs #800.
## Summary
I replaced Codex Usage's legacy auth-file reads with the connected
OpenCode V2 daemon's selected ChatGPT OAuth credential. This addresses
the stale-file mismatch described in #808 without guessing WSL
credential paths or substituting another account.
- Resolve the provider integration in the owned session's native
location; use only its selected active credential and native accountID.
- Keep credentials server-only, OAuth refresh native-owned, and
credential export/generic RPC blocked through the browser proxy.
- Fence warm and pending quota results on account changes, reconnects
and session movement; scope the visible panel to its instance/session.
- Bound quota HTTP, reject redirects and sanitize errors. No SQLite
access or legacy/Codex CLI fallback.
The credential-list API requires OpenCode 2.0.20 for this feature only.
Older runtimes, expired native tokens and non-ChatGPT connections fail
closed; the global application minimum is unchanged. Other providers'
credential integrations are outside this focused fix.
## Validation
- Server/UI typechecks; 85 server tests; five UI unit tests; three
rendered browser scenarios; UI build and diff checks passed.
- A fresh native 2.0.20 Windows daemon with synthetic credentials
exercises the production adapter: selected OAuth/accountID, key-account
switch invalidating a warm snapshot, and recovery despite stale
auth.json. Quota HTTP is mocked; no shared daemon or real credentials
are used.
- This fixes the confirmed integration mismatch, but I have not
reproduced the author's real WSL/live account failure.
Closes#808.
Maintenance: existing `packages/server/src/server/http-server.ts`
(~2,317 lines) and `packages/ui/src/lib/api-client.ts` (~613 lines)
exceed the source-size guideline; their wiring changes remain small.
Synchronize server/UI client and plugin pins with OpenCode 2.0.20 while retaining the demonstrated 2.0.7 step-timestamp minimum. Review the authenticated runtime contract: existing routes remain stable, while credential operations and optional connection/error metadata are added without requiring production adapters.
Protect the workspace proxy boundary with credential export/create rejection coverage and verify optional provider response bodies survive UI normalization. Update the maintained compatibility and architecture references, including explicit native service startup with the new disabled setting and the unresolved historical Windows import failure.
Validate minimum/current native runtimes, ordinary pruning/UI acceptance, standalone plugin installation, historical migrations and native npm upgrade with daemon version/PID preservation. Clean-install the scoped lockfile and revalidate typechecks, production builds, 745 server tests and 66 UI tests; browser qualification covers 30 scenarios.
Keep connected MCP status dots green without a permanent pulse. Pending connect/disconnect operations retain their warning pulse and spinner; the shared reduced-motion and metadata refresh policies are unchanged.
Add real StatusTab/SUID browser regressions at 150% scale, a bounded historical/current Chromium profiler, and measurement-limit documentation. Five browser scenarios, UI typecheck/build and repeatable profiler assertions passed. Fix the gatekeeper P2 by creating the temporary evidence parent on clean machines; the second independent review reported zero findings.
The change addresses the idle-animation source in #804, not its unconfirmed generation GPU symptom or #805. Remote CI was pending at the explicitly requested admin merge.
Align server/UI client and bundled plugin pins with OpenCode 2.0.19 while retaining the demonstrated 2.0.7 timestamp minimum. The authenticated native schema and published declarations preserve the consumed API contract; runtime improvements concern compaction, context limits, provider cache affinity and Shell conventions.
Extend setup version coverage and update the maintained compatibility and architecture references. Add per-import native/UI fixture diagnostics after late Vite loading stopped on both the new runtime and the 2.0.18 control; do not claim that eager-import diagnostic acceptance fixes that failure.
Qualify both minimum/current native runtimes, historical migrations, isolated npm upgrade without daemon restart, standalone plugin installation, UI/browser behavior and production bundles. Retain the original Windows fixture failures and their bounded diagnostic results in the PR evidence.
Align server/UI client and bundled plugin pins with the latest stable runtime while preserving the demonstrated 2.0.7 timestamp minimum. Review the published declarations and authenticated native schema: pairing and Shell signal additions require no CodeNomad API adaptation.
Make the isolated native upgrade fixture follow the recommendation while retaining its 2.0.15 source boundary and live-daemon PID assertion. Extend setup version coverage and update the current compatibility and architecture references.
Validate both minimum/current native runtimes, historical migrations, server/UI tests, setup and tool-image browser scenarios, typechecks and production bundles. Record the intermittent Windows Node pruning/UI heap exit and successful diagnostic rerun without claiming its cause is fixed.
## Summary
Fix the first-install recovery dead end observed in CodeNomad 0.20.0 on
Windows 11. npm failed to install the optional Windows binary packages,
then removed the CLI package while leaving terminal shims behind. These
shims disabled installation admission and hid the install button; later
status refreshes also erased the action error.
Recognize only the exact npm-generated orphan shim in the selected user
prefix with a missing canonical executable. Preserve custom-wrapper,
foreign-prefix and existing-binary authority checks. Keep action
failures visible across refresh and reopening.
## Validation
- 34 targeted updater/installer regressions passed.
- 21 browser setup regressions passed.
- Server TypeScript check passed with locked dependencies.
- On the affected machine, isolated package download and executable
validation succeeded without Git. Explicitly authorized repair using
bundled npm succeeded; the user confirmed CodeNomad now opens folders.
## Distribution
The maintainer explicitly requested replacing the existing 0.20.0
desktop release assets rather than creating 0.20.1. This branch is based
on v0.20.0 and preserves its version; the PR build artifacts will be
used for that revision after validation. The release notes will record
the source commit, and WinGet will receive a separate same-version
installer hash correction. No npm version republication is intended.
Co-authored-by: Shantur Rathore <i@shantur.com>
## Summary
- Add narrow CodeNomad routes for native OpenCode V2 plugin inventory
and activation-rule mutations.
- Present one row per user/configured plugin with exactly two compact
**Global** and **Project** switches, sharing Yolo/MCP switch geometry.
Builtins are hidden; exact configured disabled IDs remain available.
- Keep complete names, source paths, failures and configuration targets
readable on narrow keyboard/touch layouts. Retain focused rows across
refreshes and guard repeated pending activation without removing
keyboard focus.
- Provide translated feedback in all ten locales and suppress stale
feedback after the owning surface is disposed.
## Authority and refresh behavior
- Discover roots through the authenticated daemon's `config.get`, after
native-location ownership and connection-generation checks.
- Append only exact activation rules while preserving JSONC comments,
source options, unknown keys, formatting, BOM and native permissions.
Bound reads, check optimistic conflicts, serialize by write target and
use atomic replacement with nonce-owned locks.
- Require proven raw/normalized alignment before acknowledging a no-op.
Watcher lag cannot report success for a rule that is no longer saved on
disk.
- Account for inherited `.opencode` precedence by choosing a
higher-precedence target in the active project location; preserve
ancestor files and reject an escaping fallback target.
- Use native WSL filesystem operations. Retain canonical invalidation
and one trailing reconciliation when host/native cache records converge.
- Cache display snapshots by instance/worktree, share them across
sessions in that worktree, and refresh only on visible demand. Global
writes invalidate sibling snapshots without background reads.
## Compatibility
The current server/UI/bundled-plugin dependency pin and recommended
runtime are **2.0.16**, aligned with `dev`. The demonstrated technical
minimum remains **2.0.7**. Activation writes use the narrow local JSONC
operation rather than a runtime-specific write endpoint.
## Validation status and provenance
Final reviewed head: **`5204d97694ca8ced954bddc9cc94ea464e46119d`**,
aligned with `dev@9d7ea5d6`. Both independent resumed review loops
reached **ZERO actionable findings**: UX R6 and quality/optimization R5.
Local validation on the final head: **100 plugin/server/cache/WSL tests
passed**, **eight real-component browser regressions passed**, **14
restoration/metadata integration tests passed**, server/UI typechecks
and UI production build passed. Translation keys/placeholders match
across all ten locales. The current-dev baseline and PR browser
comparison passed the same 34 shared cases with one optional native
Electron skip; detailed revision provenance is in the final review
comment.
**CI qualification is excluded at the user's explicit request.** No
final CI success is claimed, and CI completion is not being awaited.
The earlier head `38845060` failed typechecking because `noticeId` was
undeclared; the earlier historical UX R4 zero-finding claim was also
incorrect and has been [explicitly
corrected](https://github.com/NeuralNomadsAI/CodeNomad/pull/726#issuecomment-5816956417).
Historical test results and the installer built from `bd31dcd0` are not
validation or artifacts of the final corrected head. See the final
review comment for completed counts, review evidence and revision
boundaries. The PR remains open.
## Scope note
Implemented independently; no code was copied from PR #593.
This separate V2 implementation supersedes PR #593.
Use one Attach file action for native device selection and retain project-scoped @ references in the active session worktree. Remove the duplicate upload entry and composer server browser, document the outside-project scope change, and translate attachment origins and feedback across all locales.
Share serialized, bounded byte ingestion across picker, drop and clipboard. Fence open pickers and late reads across session/worktree/lifecycle changes, preserve edits and newer selections without stealing focus, release rejected-read budgets, and restore failed custom-command drafts by attachment identity. Validate project directories through existing workspace ownership before filesystem listing/search.
Cover the behavior with 20 attachment and 11 session-aside browser scenarios, attachment/submission/persistence units, server budget/proxy/ownership regressions, and isolated native Windows picker fixtures. Three independent review passes corrected five P2 findings and ended at zero; the final merged-head review confirmed that result. UI checks/build, Tauri release build and native picker smoke passed. Remote CI was still in progress at the explicitly requested admin merge.
Persist explicit model selection through native switchModel during active and compacting execution. Previously those choices were local-only and could be replaced by a later authoritative session refresh.
Treat historical assistant model/agent metadata as fallback for missing selection fields, rather than overwriting the current selection on transcript hydration. Preserve choices made before or during the history request and avoid unnecessary default-model lookup for an existing choice.
Order explicit model and agent selections with the existing per-session admission queue. The gatekeeper reproduced an older prompt waiting on instruction synchronization rewriting its captured model after a successful newer selection. Queueing the complete selection, including its optimistic snapshot and rollback, ensures earlier prompt setup finishes first and later prompts use the selected context.
Treat model-selection SSE events as invalidations because their FIFO echoes can lag successful HTTP writes. Reconcile current native state through coalesced, bounded reads on the admission queue, with client/generation/selection fences and retained display on read failure. No sticky local override blocks later TUI or other-window choices.
Preserve pending optimistic choices in catalog merges and publish a fresh model reference on native confirmation. This fences native catalog snapshots captured during the write, including those arriving before authoritative event reconciliation.
Apply the same pre-request snapshot and publication merge to search, incremental catalog pages and restored-chain hydration, preserving selections introduced or confirmed while those reads were pending.
Validated 155 targeted store tests, the real Chromium session-search regression, UI typecheck, production UI build and isolated native OpenCode 2.0.16 active selection behavior. Regression coverage includes working/compacting persistence and rollback, transcript-load race orders, pending instruction/model/prompt/agent requests, delayed native selection echoes, external choices, rapid changes, rejected choices, reconciliation ownership and root/search/page/restoration catalog races. CI failure triage and clean-base reproduction evidence are recorded in the PR.
Backport upstream tao#1215 unchanged onto Tao 0.34.6 to correct the same-thread native input mutex deadlock identified in a symbolized Windows hang dump. Preserve the existing Tauri dependency/API line, all non-Windows sources, licensing and exact published-crate/patch provenance through a workspace Cargo override.
Add real isolated Win32 reentry regressions for keydown, keyup, character, system-character and IME input. Original-crate controls reproduce bounded deadlocks; the backport passes all five cases. Independently cover the IME lock boundary with temporary-source instrumentation and require an IME-only lock-order mutation to fail, preventing keyboard pre-peeking from masking an IME regression.
Independent gatekeeper pass 1 identified the IME coverage gap; pass 2 on 462f9eac reports zero actionable findings and independently reran all controls. Full local Tauri tests passed 181/181. Administrator squash merge requested by the user; remaining CI jobs were still running at merge.
Align the server/UI client, bundled plugin and recommended runtime at 2.0.16 while retaining the demonstrated 2.0.7 minimum. Verify the real generated-client detailed errors without duplicate proxy prefixes or failed mutation replay; retain explicit installation and daemon restart boundaries.
Independent gatekeeper audited all 63 upstream commits and the full comparison, published packages, native consumers and targeted regressions: zero actionable findings. Native pruning/UI and historical migrations pass across Windows, Linux and macOS; minimum/current runtime contracts and dedicated Tauri jobs pass. Generic browser failures were independently reproduced on the exact 2.0.15 base and documented in the published review. Admin squash merge explicitly requested by the user.
Delegate verified shared npm updates from OpenCode 2.0.15 onward to the native CLI with bundled Node/npm, a scoped prefix and registry, and Windows running-image retention. Preserve first-install and older-migration preflight, version/launcher verification and explicit daemon activation.
Retain installation ownership and the temporary adapter if an outer timeout, signal or output limit leaves descendant exit uncertain. Allow native timeout cleanup to finish and preserve original failures.
Validated with 37 targeted updater/route regressions, server typecheck, isolated live Windows 2.0.15-to-2.0.16 qualification, and a successful NSIS build/install of the initial implementation. Independent gatekeeper review found one timeout issue; the second pass after correction reported zero findings. Administrator merge explicitly requested by the user; final-head remote CI is still running.
## Summary
I fixed several cases where startup recovery and OpenCode settings could
show stale or misleading service state:
- Failed checks now revoke the connected claim and disable stale
reload/restart controls while retaining diagnostic details.
- Refresh requests arriving during a check coalesce into a trailing
read.
- Continue rechecks the service before retrying the pending workspace,
and activation stops after a failed pre-action read.
- Progress replaces the connected headline during an operation, and
failed checks no longer announce success.
The exact credential mismatch reported on another Windows PC remains
unconfirmed; this PR addresses verified UI state defects.
## Validation
- All 18 targeted setup browser tests pass, including five new
regressions.
- UI TypeScript check passes.
- git diff --check passes.
- Independent gatekeeper review: zero findings on the first pass.
I am merging with administrator privileges as requested once the PR is
ready. Remote CI status is recorded separately from these local checks.
## Summary
Adds a **"Workspace Root"** button to the directory browser dialog that
navigates the view back to the configured workspace root
(`FileSystemListingMetadata.rootPath`).
## What changed
- **New button**: a Home-icon button that calls `navigateTo(rootPath())`
to jump back to the workspace root. It is disabled when there is no root
path, when the user is already at the root, or while a folder is being
created (driven by a new `canGoToWorkspaceRoot` memo).
- **Placement / separation**: the button lives in its own grid cell to
the right of the "Select folder or enter path" label, fully separated
from the `New Folder` and `Open` actions. It uses a new transparent
`selector-button-ghost` variant so it reads as a navigation tool rather
than a filled action button.
- **i18n**: added `directoryBrowser.goToWorkspaceRoot` for `en` plus
`de`, `es`, `fr`, `he`, `ja`, `ne`, `ru`, `tr`, and `zh-Hans` (used for
tooltip/`aria-label`).
- **Layout**: `.directory-browser-current` now uses a four-column grid;
the flexible middle column pushes `New Folder` to the far right and
keeps the root button next to the label. Responsive rules stack the
controls at `<=640px` and `<=380px`.
## Edge cases
- In files mode the `New Folder` action is hidden, but the Workspace
Root button stays available so users can still jump back to the root.
- For the Windows drives pseudo-view `rootPath` is empty, so the button
is disabled.
## Validation
- No typecheck was run in this environment (`npx` is disallowed here);
manual browser verification of spacing and the localized label is
recommended.
🤖 Generated with
[CodeNomad](https://github.com/NeuralNomadsAI/CodeNomad)
---------
Co-authored-by: Pascal André <pascalandr@gmail.com>
## Summary
Retire the prerelease private OpenCode installation completely as an
executable source. Automatic selection now uses PATH and the
conventional shared user npm installation. Existing private files are
neither migrated nor deleted.
- Remove the private installer, receipt reader and fallback
introduced/retained by #756.
- Ignore saved private selections and reject validation/launch from
`~/.local/share/codenomad/opencode`, including private PATH entries.
Prevent installation into that retired prefix.
- Remove private-copy descriptions from all ten locales and update the
runtime policy documentation.
- Keep supported custom installations, native shared-service
ownership/authentication and explicit restart behavior.
## Reproduction and scope
The initial genuinely empty-profile test passed, but it did not match
the affected machine: that machine had no Git and retained a private
prerelease OpenCode copy.
On the exact installed `v0.20.0-dev-20260923-baf674fc` Tauri artifact,
seeding a valid private copy plus its `selected` receipt and `current`
marker makes setup report `state: ready`, `installationSource: legacy`,
and suppresses the missing-installation screen. The new desktop
regression fails against that release with `ready !== missing`.
With rebuilt server/UI resources in an isolated copy of the same Tauri
host, the identical private-copy scenario reports missing, offers
installation, installs the shared npm package, authenticates OpenCode
2.0.15 and resumes the requested folder without Git. This demonstrates
the missing-setup cause; it does not claim to explain every initially
reported startup slowdown.
## Validation
- 59 targeted server tests passed: discovery/install/update, retired
paths, binary selection, Windows/WSL spawn and binary validation routes.
- 13 real-component setup browser tests passed.
- 23 focused retirement/launch tests passed after the final network-path
preflight adjustment.
- UI TypeScript check passed; production server/UI/automation/pruning
build passed.
- Installed-release private-copy reproduction failed as expected;
corrected isolated Tauri acceptance passed.
- `git diff --check` passed.
Desktop qualification uses isolated profiles, services and databases.
The sole simulated installation side effect is HKCU PATH registration,
captured by a fixture preload; bundled npm installation, package
verification, native-parent service start and authenticated API checks
are real. The shared user daemon and installed application were not
replaced by the fix. Remote CI is pending.
## Maintenance notes
Existing oversized files touched: `packages/server/src/api-types.ts`
(~583 lines) and `packages/ui/src/lib/i18n/messages/*/settings.ts`
(~625–639 lines). No size-only refactor is included.
Prefer terminal PATH and a common user npm installation, migrate historical private and official npm copies, and retain explicit authority for custom and WSL executables. Preserve running daemon ownership and defer locked Windows updates. Align recovery and settings presentation across locales.\n\nReviewed through an independent gatekeeper loop (final zero-finding review on e33a6a16). Validated 34 targeted server tests, 13 browser scenarios, typechecks, isolated Windows npm installation and real historical migrations. Full CI browser job has unrelated existing system-message search failures reproduced locally; merge requested with administrator authority without waiting for CI.
Validation includes isolated minimum/current native suites, historical migrations on Linux/Windows/macOS, targeted unit and browser tests, production builds and two independent gatekeeper reviews with zero actionable findings. Retain startup diagnostics for an unexplained intermittent Windows pruning/UI process exit; the complete instrumented Node 24.20.0 rerun passes locally. Known system-message search fixture timeouts remain documented. Admin merge explicitly requested; runtime activation and desktop installation remain separate actions.
## Summary
Restore saved conversations promptly with the Git panel open. Preserve
Solid project-shell identity during metadata and sibling-project
restoration, defer inactive Git readers, and keep foreground message
requests independent of secondary HTTP fan-out.
Publish the visible project's recent worktree conversations from its
first verified page, before historical pagination completes. Promote
project/location and worktree membership dependencies on selection; keep
historical cursors and hidden projects within the secondary budget.
Partial rows join their request's reconciliation baseline so removed
worktrees cannot leave ghost conversations.
Run status/diff process creation in the existing Windows Git worker.
Bound untracked-file stat submission and prioritize worktree authority
commands over pending display work. Preserve UTF-8 content, final
newlines and large blobs.
## Lifecycle and refresh semantics
- Cancel queued and dispatched optional SDK reads with a dispatch-time
deadline.
- Fence passive and explicit refresh/mutation continuations on worktree
changes, deactivation and disposal.
- Preserve commit drafts and the last successful status snapshot on
failures.
- Keep native ownership validation and 200-message windows; no new
persistent transcript cache.
## Gatekeeper
Independent review round 1 reported three findings: dispatched SDK
cancellation, late explicit/mutation continuations, and worker admission
behind untracked-file batches. All corrected.
Round 2: **ZERO FINDINGS**, with nine independent isolated source-level
checks.
The visible-list extension received additional independent reviews. One
finding about partial rows being mistaken for concurrent creations
during worktree removal was fixed and regression-tested. Final review:
**ZERO FINDINGS**, including isolated checks for membership removal,
concurrent rename/local creation and deletion without resurrection.
## Validation
- 23 browser scenarios: restored selection and 200 messages with Git
open on Electron/Tauri adapters, stable shell/draft lifetime,
cancellation/deadlines and late commit handling. Both desktop adapters
additionally verify partial cross-worktree publication under a blocked
secondary budget, exclusion of foreign roots, selection promotion, and
final removal of a no-longer-owned partial row.
- Server Git status/content and common-directory/worker admission
regressions.
- 10 SDK/background/prioritized-read queue tests; 9 startup/reconnect
store tests.
- UI typecheck and production build; server TypeScript compilation.
- Installed native verification with the usual profile: the final
first-switch capture makes PR726 available in **2.04s** after renderer
navigation, then completes its first **200-message read 6.08s after
selection**, with no HTTP or renderer errors. Normal native restoration
of PR726 earlier measured **5.064s**, with variability up to **11.233s**
during concurrent activity. These are renderer timings, not
executable-launch timings.
- Restored the complete published e68ac524 server after a parallel
installation had left older inventory modules. Installed server
JavaScript artifacts match the compiled source; the shared daemon and
user profile were preserved.
## CI qualification
Compatibility migration CI fails on the unchanged historical credential
assertion at `scripts/test-opencode-history-migration.mjs:191`: the
latest upstream response adds `method: "key"`. Runtime-contract
qualification passes at minimum/latest; this failure is separate from
the changed session/Git behavior and is not represented as a green
check.
Existing large source files touched:
`packages/ui/src/components/instance/instance-shell2.tsx` (~1308 lines),
`packages/ui/src/lib/api-client.ts` (~597 lines), `useGitChanges.ts`
(~519 lines), `packages/ui/src/stores/instances.ts` (~2197 lines), and
`packages/ui/src/stores/session-api.ts` (~1898 lines).
## Summary
Remove the requirement that the invoking agent's conversation must
already be active before CodeNomad UI automation can inspect or navigate
the application. That restriction prevented agents from using the UI to
return to their own conversation after a session or project switch.
- Target the inspected native window/run independently of the selected
conversation or project, including views with no active session.
- Keep the actual selected context in inspection results as descriptive
metadata.
- Pin actions to the inspected native window/run. Keep accessibility
references document-scoped: page replacement, reload and native target
changes still require fresh inspection, while conversation selection
alone does not.
- Keep authenticated backend discovery and browser-preview session
attachments intact.
- Document the behavior and add CDP/route regressions for navigation,
empty views and native target changes.
## Validation
- 27 targeted CDP, automation route and plugin tests passed.
- `npx tsc -p packages/server/tsconfig.json` and `git diff --check`
passed.
- Compiled shared server modules installed in the usual Windows Tauri
installation.
- The actual native automation bridge navigated **CodeNomad → opencode →
gaffer → openchamber → CodeNomad** from the same invoking session,
successfully inspecting each different active conversation and returning
to the original conversation.
- Native restart/reconnection, final inspection and screenshot
succeeded.
The implementation is shared by Electron and Tauri; no host-specific
code changes are needed. Installed desktop validation was performed on
Windows Tauri.
Maintenance note: the touched `packages/server/src/developer-cdp.ts` is
approximately 564 lines; this PR does not refactor it solely for length.
## Summary
Restore the saved conversation promptly by moving worktree Git process
creation off the CodeNomad HTTP/SSE thread. On Windows, even
asynchronous `execFile` spends significant synchronous time starting a
process; concurrent ownership and worktree discovery amplified this into
multi-second startup stalls.
- Execute worktree Git commands through a lazy worker with two process
slots, preserving each request's environment, output and error details.
- Share in-flight common-directory preflight reads by directory. Remove
successful and failed reads immediately after completion; retain Git
configuration resolution and native worktree ownership validation.
- Keep the existing 200-message page and normal HTTP restoration. No
persistent message cache is introduced.
- Add real-Git regressions for concurrent-read coalescing, process
admission, changed identities and recovery from failed reads; document
the refresh semantics.
## Measured desktop result
The usual Windows Tauri installation restored the saved conversation in
**2.698 s and 3.011 s** on two complete application relaunches, versus
approximately **7.5 s** before the worker change. These timings run from
renderer navigation to rendered conversation content, rather than
measuring the entire native process-launch interval. Both successful
runs used one 200-message request and restored the correct saved
selection. The user also manually relaunched the installation and
confirmed the result.
## Validation
- 53 server regressions: common-directory preflight, configured Git
roots, worktree annotations and workspace manager lifecycle.
- 13 isolated browser worktree scenarios (keyboard, pointer/touch,
refresh, selection and pending-move behavior).
- `node scripts/test-opencode-location-native.mjs <absolute-cli-path>`
passed with isolated OpenCode **2.0.12**, including native ownership,
discovery/create/remove, family move/rollback, cache revalidation and
event relay.
- `npx tsc -p packages/server/tsconfig.json` and `git diff --check`
passed.
- Installed compiled server modules verified against build output; real
four-project navigation and the model menu checked. Temporary startup
instrumentation removed.
The native integration fixture used its own
configuration/database/process. The shared OpenCode daemon and the
user's profile were preserved.
## Summary
Restore the saved project/session ahead of secondary hydration while
retaining the existing 200-message page and selection/ownership
semantics.
- Publish the first directory session page before project metadata and
checkout discovery finish.
- Start saved-session hydration alongside creation-ownership release
rather than waiting for its HTTP acknowledgement.
- Share two secondary HTTP slots across catalogues, Shell lists,
complete inventories and inactive project reads.
- Promote queued root/ancestry reads when the user selects their
project, without duplicate dispatch; keep unselected roots bounded
before startup selection is known.
- Keep cancellation, request-generation fencing and verified family
reconciliation.
## Gatekeeper review
Two independent review passes were performed:
1. **Request changes:** two P2 findings — queued inactive-session reads
did not promote on selection; existing ready workspaces could all launch
root reads while the active selection was unknown.
2. **APPROVE: zero actionable findings** after fixes and regressions.
Reviewer independently checked admission races, observer disposal,
cancellation after promotion, duplicate dispatch and queue-capacity
recovery.
## Validation
- 88 focused unit tests passed locally; reviewer reports 89 tests in its
independently selected suite, plus isolated race checks.
- 12 Chromium browser cases passed using real session rendering and
Electron/Tauri host fixtures, including user selection while secondary
requests stall and eight pre-existing ready workspaces.
- UI TypeScript check and production build passed.
- `git diff --check` passed.
- Startup regressions are included in PR CI.
- Usual Tauri installation was exercised with four saved projects, the
exact saved conversation and the real model menu. The earlier candidate
restored text in 5.5–6 seconds versus a recorded ~100-second stalled
startup. This is a priority fix, not a claim of instantaneous startup;
server latency and message revalidation remain observable.
## Maintenance note
Touched existing oversized modules:
`packages/ui/src/stores/instances.ts` (~2,198 lines) and
`packages/ui/src/stores/session-api.ts` (~1,880 lines). The new
scheduling primitive is kept in a small dedicated module.
Merge the latest dev changes into the /btw feature branch so the pull request can be reviewed and tested against its actual target.
Preserve both the Turkish side-question strings and the newly merged full-timeline loading translation. The unrelated local OpenCode configuration remains untracked and untouched.
Batch branch and HEAD annotations from one Git worktree snapshot while retaining native inventory authority, physical local-repository identity and configured effective-root validation. Preserve fresh family transaction scans, mutation fencing and rollback without spawning three Git processes per checkout.\n\nKeep pending worktree selections in the store by instance and family so the target and busy state survive navigation, simultaneous moves and selector remounts. Independent gatekeeper review found two P2 issues; both were fixed and round two reported zero findings on f971419a.\n\nValidation includes 40 focused server tests, 13 real-component browser tests, UI/server typechecks, UI build, and isolated official OpenCode 2.0.11 native worktree/family integration. CI platform/native/runtime checks pass. Admin merge is user-authorized despite two system-message-search browser failures reproduced identically on the clean dev base; evidence and the review loop are published on the PR.
Reserve /btw in the composer and autocomplete, using session.generate to answer from the current native context in a non-modal Markdown window. Bare /btw opens the question form; answers can be copied or retried without adding transcript, inbox or child-session records.
Keep side-request cancellation independent of the main execution, fence late results on cancellation, replacement, session changes and disposal, and preserve unsent file/image attachments. Authorize only the reviewed session-scoped generation route through existing ownership and worktree-deletion checks. Add all ten locales and shared square window styling.
Cover routing, Markdown, attachments, concurrent main prompts, cancellation races and narrow layouts with ten browser scenarios, plus proxy regressions. Verify native idle and busy behavior with isolated local-provider fixtures on OpenCode 2.0.7, 2.0.11 and 2.0.12; include the fixture in minimum/latest CI. UI/server typechecks, twelve adjacent unit tests and diff checks pass.
Integrate dev at 306c2ba4, including full-history search, cached global timeline navigation and README updates. Preserve the new RPC/client methods alongside managed setup, explicit restart/reload and the technically justified OpenCode 2.0.7 minimum.
Correct the incoming standalone plugin manifest to include navigation-scope, outline-index and outline-preview. Both the existing packed-entrypoint regression and independent gatekeeper review identified the omitted dependencies; the corrected package resolves outside the source checkout.
Validate 643 server tests (2 skipped), 154 UI store/reducer tests, 29 browser scenarios and both typechecks. The rebuilt bundled plugin passes the complete isolated native 2.0.7 suite with rendered UI, including 241-message history cleanup and 1501-message global navigation/restore parity. Record pre-merge evidence in the compatibility register.
Record successful packaged Electron and Tauri runs at 781c3a42 for a compatible 2.0.10 daemon retained after installing 2.0.11 and a retired 2.0.3 daemon restarted only by explicit action. Both scenarios resume the requested folder, exercise recovery over its loading overlay, and verify that retired generated modules are absent.
Link final evidence and inspected captures, confirm isolated fixture cleanup, and keep completed local/native acceptance distinct from unconfirmed remote CI.
Rebuilt desktop acceptance exposed a blocked recovery action after dismissing setup during an initial folder open. Mount the persistent recovery entry through a body portal so the root-contained folder loading overlay cannot intercept its pointer events. Opening setup still removes the entry and preserves the dialog's modal behavior.
Exercise the real loading-overlay class with the full app stylesheet and normal Playwright clicks; all seven setup scenarios and UI typecheck pass. Independent gatekeeper review found no remaining issue. Record successful Windows and native Linux beta/2.0.3 migrations to the corrected 2.0.7 minimum.
Integrate the current dev baseline while retaining PR 723's server-backed full-history search and direct navigation. Resolve the sole message-section conflict by keeping the bounded history query flow instead of reinstating the superseded resident-page traversal and resident-result reconciliation.
Preserve dev's system-message visibility and untracked search locator changes. Validate UI and server typechecks against the updated locked dependencies, plus browser regressions for restored checkpoint reconciliation and current-session search navigation.
Replace the arbitrary 2.0.11 floor with the 2.0.7 native step-timestamp boundary, keeping 2.0.11 as the separately recommended qualification target. Unlisted, prerelease and custom runtimes negotiate authenticated API requirements; preserve complete CLI labels so unknown builds neither fail solely by name nor enable unintended automatic upgrades.
Finish retiring pre-2.0.4 location/worktree/credential/Form serialization and obsolete catalog events while preserving internal identity, import/cursor authorization, pruning claims and connection fences. Remove the unused global package-manager installer and clean generated server output before packaging so deleted modules cannot survive incremental builds.
Distinguish missing setup, technical incompatibility and optional updates in the shared UI, including minimum rationale and optional restart wording. Retain a usable daemon through older discovery CLIs, check reload capability independently, and suppress installation when bundled npm is unavailable.
Validated 622 server tests, 7 browser scenarios, real reducers and fixture guards, production native suites on 2.0.7 and 2.0.10, and synthetic 2.0.3-to-2.0.7 history migration. Independent gatekeeper re-review closed the production version-parser finding. CI now qualifies the source-defined minimum and latest; rebuilt desktop acceptance is recorded separately.
Restore provisional timeline geometry through optional content-addressed index chunks, bounded independently from drafts and attachments. Validate durable session/location/project/revert identity, preserve other restored state when an index chunk is missing, and reuse immutable normalized values and encoded leaves during scroll or draft captures. Fence older renderers with a graph extension and retain monolithic-host compatibility.
Revalidate native structural indexes using stable checkpoint ranges and return only changed structure. Grow the live tail before adding ranges, reserve a complete block within each RPC page budget, and schedule a trailing scan when messages arrive during a fixed-horizon read. Route bulk-cleanup completion and ambiguous failure through the shared coalesced refresh path so the final invalidation cannot strand an obsolete native transcript window.
Cover large partition round trips, corruption isolation, restoration clear/disable, offline edits/pruning/deletions/appends, manifest growth, deletion-hole pagination, active-window refresh races and Solid trailing scans. All 21 Chromium navigation cases, package typechecks, packaged-resource smoke, Electron state tests and isolated OpenCode 2.0.5 integration pass. The second independent whole-PR gatekeeper review reports zero actionable findings; installed-app restart verification remains pending and is documented explicitly.
Build rail geometry from a structural native index of IDs, sequence, types and technical-part counts. Project that metadata in SQLite without transporting or parsing full message bodies in JS. Bounded 16384-entry pages replace 256-entry excerpt scans, and indexing runs independently of transcript hydration. Remove the excerpt-loading countdown.
Retain up to sixteen structural snapshots with a 200000-entry LRU budget, allowing one larger active index. Unchanged session returns reuse the index without a read; message changes refresh only the last 32 indexed rows and arrivals. Preserve destructive-mutation, undo, connection-generation and route ownership fences.
Restore bounded Markdown hover and focus previews. Fetch visible-nearby excerpts in batches of twelve, prioritize the hovered marker and cancel obsolete demand. Keep a separate 512-excerpt cache with on-demand age revalidation. Unavailable excerpts show no empty popup, and arriving content cannot alter marker geometry or load a transcript window.
All nineteen browser navigation cases pass, including blocked transcript/excerpt hydration, exact scrollbar extent, native thumb gestures, rich historical/resident previews, six intervening session indexes and tail-only live refresh. Six SQL tests, three route race tests, UI/server typechecks, packaged-resource smoke and the full isolated OpenCode 2.0.5 native/UI fixture pass. Record installed desktop cold-index responses of 2.05s for 11210 messages and 0.58s for 4857 messages; the warm-switch run was interrupted by user selection and is not claimed as qualified.
Record the observed cancellation of session reads after deploying 0636301f resources and the empty comparison transcripts at five-second samples. The active instance changed before settling, so the capture cannot qualify real stale-anchor restoration or serve as an equivalent performance comparison.
Keep the passed fixture and resource checks distinct from desktop acceptance. Cold-load latency and an uninterrupted restoration check remain required before final review and merge.
Large-session desktop switching reproduced repeated restoration requests for the same absent anchor. Distinguish anchor_missing in the bounded native window RPC from ownership and revert conflicts. Automatic restoration recovers once through a fresh visible latest page and replaces the stale saved cursor only after success; explicit navigation and authority failures retain their error semantics.
Cancel view-owned initial reads when hidden, release their request authority before an immediate return, and prevent obsolete hydration callbacks from reviving after away-and-back navigation. Pause outline scans while transcript hydration is loading, preserving their accepted cursor and completed display. Add the user-approved lightweight timeline scrollbar separator, hidden when its measured content does not overflow.
Record the real Windows desktop baseline and remaining priorities in SESSION_HISTORY_STRESS_REVIEW.md: 62.62 MiB of transcript responses, repeated outline scans, transient heap growth and main-thread stalls. Separate observations from unproven leak or CPU attribution, and document the live-event merge, incremental metadata and byte-budget work still needed.
Validate 18 browser navigation cases (17 in the complete run and the corrected localized conflict assertion in a targeted rerun), four active-load lifecycle tests, seven navigation store/routes tests and both typechecks. The complete isolated native Windows OpenCode 2.0.5 UI fixture passes, including missing-anchor RPC semantics and native outline/window parity.
Historical markers rendered a bare paragraph outside the rich MessagePreview surface, leaving its text unbounded and transparent across the application. Use the same small plain-text tooltip for historical and resident markers, with wrapping, an opaque surface, viewport-constrained width and height, and clamped placement on either side of the rail.
Hover no longer mounts a message renderer or reads resident message data. Cancel delayed previews on scrolling and detached markers, dismiss on resize or Escape, and support keyboard focus with tooltip descriptions. A real SessionView regression covers both historical and resident previews, geometry, opaque styling and absence of payload loads; keyboard and native rail-thumb regressions and the UI typecheck pass.
Record completed historical migrations, bounded installation/reload fixtures, canonical WSL provisioning, cross-selection service-action fencing and packaged Electron/Tauri acceptance. Document the native watcher and reload semantics, read-only old-daemon registration fallback, final evidence roots and reproducible isolated commands.
Close local review gates after every actionable finding was corrected and independently re-reviewed. Record the final 621-pass server suite and seven browser regressions while keeping final-head remote CI distinct from earlier green test jobs.
Keep four recent metadata-only outline snapshots across SessionView unmounts. A hidden or evicted view cancels its active request but retains accepted pages and the sequence-horizon cursor. Returning immediately reuses a completed rail, or resumes its interrupted scan, instead of repeatedly showing only the resident transcript while scanning from zero.
Fence cached metadata by instance/session, connection generation, destructive content revision and staged undo. Message revisions and status transitions refresh completed snapshots without clearing their display; status churn cannot discard an incomplete scan. Show localized initial loading progress so a partial resident timeline is not silently presented as complete.
A real SessionView browser regression pauses the second outline page, changes status, unmounts and returns, then checks cursor reuse and immediate completed-rail restoration. All 14 navigation/browser cases and the UI typecheck pass.
Require stable OpenCode >=2.0.11 <3.0.0 from authenticated daemon metadata before functional clients and plugin provisioning. Keep bounded contract recognition, connection-generation fencing and native ownership checks while retiring old request, response and event conversions.
Unify missing and outdated runtime recovery with Preferences. Install exact stable releases through bundled Node/npm into a verified versioned user prefix, preserve custom and WSL selections, and separate installation from explicit shared-service restart through the native-parent starter. Fence stale setup responses, retain pending folder opening and never replay prompts.
Certify isolated 2.0.3-to-2.0.11 history migration with executable hashes, untouched seed storage, paginated messages, forks, compaction checkpoints, location moves and pending inbox data. Add minimum/latest cross-platform migration and installation gates, packaged npm closure checks, real Solid recovery regressions and supported-contract authority tests.
Validated server/UI types, focused unit and reducer suites, browser captures, actual packaging-prepared Node 24.20.0 installation without system Node, and native location, automation and pruning fixtures. Document packaged-desktop, WSL, broader historical-state and remote-CI evidence as remaining release gates.
Record that OpenCode V2 is published on the stable channel and make the transition register independently mergeable, with implementation and retirement gates maintained through follow-up PRs.
Specify a shared missing-runtime and required-update screen, optional-update notices, first installation through the existing updater, and bundled Node plus npm for desktops without system tooling. Preserve host/WSL targeting, persistent installation paths, shared service ownership and actual daemon revalidation after installation or explicit restart.
Correct the discovery-route retirement criteria and retain historical-data certification before changing support. Validate whitespace, referenced repository paths and local documentation links; no runtime behavior is changed.
The installed Windows application returned only four metadata entries from a 10,763-message session because the outline's wall-time budget included cooperative event-loop waits. Remove scheduler time from pagination and bound each page by 256 rows and 24 MiB of parsed source payloads instead. Yield every 16 rows in both outline and message-window reads, preserving cancellation without paying one scheduler round trip per message.
Regression coverage advances the clock across each observation, checks full metadata pages, verifies cancellation releases the read transaction, and proves byte-budget pagination retains the first unread message. Strengthen the isolated native fixture to require full small-record pages. Seven navigation/store/route checks and the server typecheck pass.
Align the server/UI OpenCode client and bundled plugin at 2.0.11. Route canonical server.info through authenticated discovery, preserve legacy step timing, and honor hidden Forms protocol fields without rendering their inputs or dropping defaults.
Reconcile terminal tools into the bounded visible transcript and fence native reducer history reads against intervening events. Discard stale pages and coalesce trailing reads so a late settlement snapshot cannot remove a newer streaming assistant. Preserve lifecycle, generation, disposal, location and historical-data safeguards.
Qualify the latest stable runtime in CI and record the resolved version. Each CodeNomad release fixes its minimum supported OpenCode version to the latest stable available when that CodeNomad release ships. Keep one shared compatibility reference and detailed evidence in PR/CI history rather than per-version reports.
Validation includes isolated native runtime/proxy/pruning, automation, environment and fork acceptance; hidden Forms browser coverage; deferred settlement/new-execution regressions; 112 final targeted UI tests, typechecks and production builds. Gatekeeper findings were fixed and independently re-reviewed before merging.
Replace estimated timeline row measurements with an exact virtual layout derived from the marker and group-gap primitives. Hidden tools no longer contribute estimated heights, and the rail uses the same standard native scrollbar as the transcript: only marker width changes, never icons or vertical spacing. Manual rail browsing suppresses active-marker reveals until a transcript gesture, and intermediate window positions cannot reclaim it.
Keep native transcript thumb drags escaped beyond the ordinary gesture timeout, delay adjacent-window paging until release, and recognize wheel gestures at an already-clamped boundary. Publish follow state before handing boundary callbacks control. Preserve access to first/latest commands at local window edges and default history search to excluding tools and reasoning.
Exercise the real SessionView with mixed long replies, short replies, tools and idle records. Browser regressions verify exact scroll extent, native held-thumb dragging, streaming anchors, distant landing positions, adjacent windows, global endpoints, keyboard ownership, RTL and fractional zoom. The held-thumb regression is red with native drag ownership disabled and green with it; transcript rendering and nested-scroll regressions and UI typecheck pass.
Extend the existing history-query plugin with bounded outline and anchor-window reads so timeline and current-session search can reach distant passages without loading intervening transcript pages. Share daemon-storage identity binding, preserve location/project/revert authorization, enforce payload budgets and retain overlapping neighbors for reading-position restoration.
Route timeline, search and missing restoration anchors through the existing message-load authority fences. Keep the visible transcript during navigation, let the latest requested destination win, reject late results after cancellation or leaving the session, and retain historical reading positions during live generation.
Restore a discreet timeline scrollbar with stable reserved geometry. Only marker rectangles narrow; icon dimensions and vertical spacing remain fixed across hover, focus, RTL and fractional zoom. Include localized loading/retry UI and document the navigation contract.
Validated with server/plugin/route regressions, 75 UI store tests, 56 distinct Chromium cases, server/UI typechecks, UI/plugin builds and an isolated Windows OpenCode 2.0.5 fixture comparing 1501-message navigation against native export and message reads. Installed desktop and other-platform validation remain separate.
Replace transcript-wide API downloads with bounded plugin-side history scans. The search window now offers session/workspace scope, message and technical-content snapshots, paginated excerpts and explicit single-message previews that do not populate or displace the resident transcript window.
Plan whole-session technical cleanup using compact IDs, revisions and counts, then execute batches through the existing synchronous SQLite ownership and durable execution-claim fences. Preserve text and pre-compaction history semantics, refuse changed or active content, retain atomic retry receipts, and expose progress, cancellation and partial failures.
Bind reads to the authenticated daemon storage, constrain cursors and payload sizes, and validate every contributing location against local worktree ownership before publishing workspace counts or excerpts. Keep native RPC access narrow, preserve migrated global history, add translations for all locales, and retain search-input focus with the new controls.
Validation: 56 server/plugin/route tests, 45 UI store tests, 43 transcript browser regressions and 8 search/utility-window browser tests passed. Server/UI typechecks, the UI build and bundled plugin build passed. The isolated Windows OpenCode 2.0.5 fixture verified 241-message counts/search/cleanup, exact batch retries, active-claim refusal, pre-compaction discovery and existing concurrency/cache behavior. Desktop release interaction and other native platforms remain separate validation.
## Summary
Live transcript events were measured arriving 139–160 seconds late
through CodeNomad while the direct native stream arrived in 22–55 ms.
Serial event routing awaited ownership checks across every logical
workspace before accepting the next SDK event.
- Buffer before slow routing I/O, preserving per-session/PTY/Shell
ordering and independent per-recipient FIFO delivery.
- Share validated ownership checks by recipient and complete native
location; fence inventory invalidation, disconnected generations and
stopped/reopened workspace incarnations.
- Bound retained jobs, payload size and routing age; reconnect through
normal authoritative recovery on overflow instead of silently dropping
deltas.
- Cancel pending session lookups and add rate-limited stage-specific lag
diagnostics without event contents.
## Base
Rebased onto upstream/dev at 7312ac22, including #717 and #718.
## Validation
- 43 targeted server routing/worktree regressions passed.
- Server TypeScript compilation and diff whitespace check passed.
- Isolated native OpenCode 2.0.9 fixture passed, including a
deliberately blocked recipient and another subscriber on the same SDK
client.
## Desktop testing
A Windows Tauri build of this PR is being prepared for manual testing
with the existing profile. Live before/after measurements will be added
after installation.
