Integrate current dev while preserving the mission routes, durable execution controls and specialist cleanup. Retain native usage route dependencies and align local plugin dependencies and architecture guidance with OpenCode 2.0.21.
Combine the workspace file reader with the mission reader in the central session surface. Explicit reader selection dismisses the competing preview without losing stored editor drafts or the composer. Extend the real-session browser regression to cover switching between both readers.
Validate server and UI typechecks and all ten mission browser/i18n tests. Preserve the upstream Tao patch unchanged, including its original whitespace and provenance.
Complete the earlier Usage flicker fix after reproducing eleven Loading flashes in twenty seconds in the installed Tauri app. Same-location provider catalogue events now revalidate quotas in place, unrelated native locations do not trigger reads, and window-label keys preserve quota rows during value changes.
Share one current-generation in-flight read and coalesce trailing refresh demand. Credential, integration, configuration, reconnect and source changes still clear old quotas immediately, fence late responses and discard obsolete trailing work. Failures revoke quotas rather than retain possibly different account data. Hidden panels remain inactive; no global browser quota cache, native API fallback or shared OpenCode lifecycle change is introduced.
Add controller and real Solid browser regressions for event bursts, location isolation, stable DOM, account changes during passive reads, removed windows and failures, and document the refresh policy. New burst/boundary tests fail before the fix; fourteen targeted tests, UI typecheck and production build pass. An independent published gatekeeper review of this exact head found zero findings and independently repeated these validations.
Admin merge without waiting for CI was explicitly requested. The installed application has not been replaced, and rebuilt installed Tauri or live account-switch validation is not claimed.
## Summary
I separated the connected CodeNomad server's environment from the client
information shown in Settings and diagnostic exports.
- The existing metadata endpoint now reports the backend process OS and
Node runtime architecture, independently of the browser's user agent or
OpenCode host.
- Server OS and architecture appear in the server information card.
Client runtime, platform and OS are explicitly labeled as client
information in all ten locales.
- Copied and downloaded diagnostics contain both environments. Older or
unreachable servers never fall back to the client's OS.
## Validation
- 761 server tests passed, with six platform skips.
- 14 targeted UI tests passed, including four real-component browser
scenarios for web, Tauri and Electron runtime fixtures, copy/download
exports, metadata refresh and older/unreachable servers.
- Both typechecks, all ten locale index checks, the server/UI build and
diff checks passed.
- I have not validated a physical remote Debian host or a native macOS
desktop build.
Existing oversized files touched: `packages/server/src/api-types.ts`
(~680 lines) and `packages/ui/src/lib/i18n/messages/*/settings.ts`
(~660–680 lines).
Backport the exact read-only macOS maximize getter from Tao #1182 into the existing 0.34.6 vendor override, preserving the Windows input backport. The original borderless getter changed AppKit style masks and generated geometry events whose persistence capture called the getter again, starving startup independently of OpenCode readiness. Window chrome, persistence policy and shared OpenCode lifecycle remain unchanged.
Add a bounded native AppKit regression with isolated original-crate negative-control artifacts, repeated warm-cache runs, getter-phase capture evidence, maximize/restore and fixed-size/decorated cases. Reject unrelated watchdog timeouts and validate runner results with platform-independent tests. Run the native regression in macOS ARM64 CI.
Validation includes the macOS Intel VM reproduction and rebuilt Tauri startup, second-window quit/relaunch with isolated OpenCode 2.0.21, 181 macOS and 188 Windows Tauri tests, Windows input negative controls, 44 targeted Electron regressions, successful ARM64 CI tests and a published ARM64 test artifact. Both independent gatekeeper findings were fixed and re-reviewed to zero findings. All test jobs passed; remaining platform builds were still running at the explicitly requested admin merge.
Fixes#819.
Flatten Mission Control into compact top-level rows with two-line objectives, semantic state colors, direct readers and coordinator navigation. Put Work first, collapse secondary sections by default, and retain per-window reader and disclosure state.
Create UI missions in a prepared state and use one Play button for start/resume alongside Pause and terminal Stop. Persist explicit control intents and per-target receipts, serialize them with mission admissions, and use the authenticated desktop bridge for native root-session interruption and environment-fenced resumption. Park report notifications while paused, cancel mission-owned queued inputs on Stop, and prevent stale retries from reopening terminal missions. Native descendant suspension remains outside these root-actor controls.
Add opt-in deletion of mission-created specialist conversations. Persist cleanup targets and receipts, reserve journal capacity, and validate ownership through a narrow cleanup authority RPC before native HTTP removal. Preserve coordinators, reused/shared/moved sessions and roots with children; partial failures keep stable explicit retry identities.
Validate with 88 focused server tests, 10 browser/i18n tests, server and UI typechecks, the full build and an isolated OpenCode 2.0.21 fixture covering Play/Pause/Resume/terminal Stop, cleanup and transcript preservation. Inspect rendered controls and document the lifecycle, cleanup and styling conventions.
## Summary
Follow-up to #813.
- Scale main local/remote Electron and Tauri content minimums with
application zoom: 390 × 600 CSS px, rounded up in native logical units
and capped to the monitor work area.
- Restore local window dimensions against their saved zoom; keep native
frame offsets and monitor DPI separate.
- Reserve 390 CSS px for conversations before side panels overlay.
- Force conversation-header actions into overflow below 420 CSS px,
matching timeline hiding, while preserving measured expansion and
filter/focus behavior.
- Leave Preferences, native preview guests, existing profiles and the
shared OpenCode daemon untouched.
## Validation
- 32 targeted browser tests, including real isolated Electron
framed/frameless zoom at 80/100/125/150%, menu/keyboard input and reload
persistence.
- 220 Electron native tests passed; 4 platform skips.
- 182 Windows Tauri tests passed.
- UI/Electron typechecks and UI/server/Electron builds passed.
- Rendered native captures inspected.
## Review and delivery
Independent Gatekeeper review reports will be published as GitHub
reviews. Findings will be corrected and re-reviewed until zero findings
before the requested administrator squash merge.
Keep the Usage panel mounted when streaming session metadata replaces the active session object. Deduplicate equal request identities without suppressing revalidation of actual instance, session, native directory, provider or model changes. This removes the repeated loading/unavailable flashes and quota reads while retaining native account, reconnect and late-response fences.
Expose only a sanitized feature-local reason for a missing native credential-list endpoint and translate the actionable service-version message in all locales. The global OpenCode minimum stays at 2.0.7; Codex Usage alone requires 2.0.20. Authentication/other errors remain generic, no legacy credentials are substituted, and service restart remains explicit.
Validation includes generated-client and HTTP route status regressions, real Solid panel lifecycles for available/unavailable usage, session identity transitions, 760 passing server tests with six platform skips, neighboring UI and desktop-resource checks, server/UI typechecks and build, and an isolated native OpenCode 2.0.20 fixture using synthetic credentials and mocked quota HTTP.
An independent published gatekeeper review of the exact head found zero actionable findings. The reviewer independently passed 71 targeted tests, exercised extra scope/lifecycle browser probes and checked all ten locales. No native desktop or live account/quota validation is claimed.
## Summary
Unify the right-panel Git and file surfaces as **Files**, with a compact
**Workspace / Changes / Commits** switch and a shared central preview
above the
conversation composer.
- Workspace: lazy, keyboard-accessible directory tree; read-only source,
Markdown and image previews; bounded binary-file fallback.
- Changes: indexed/working-tree files and central diffs, with existing
Git
mutations kept in a collapsed actions section.
- Commits: paginated history of the browsed worktree, commit
details/files and
first-parent diffs, including root commits, renames, deletions and
gitlinks.
- Preserve drafts and mode navigation; fence late responses across
session and
worktree changes. Migrate previous tab customization and retain
diff/wrap
preferences. Bundle Monaco tokenizers locally for offline highlighting.
- Worktree browsing does not move a conversation or check out a branch.
## Implementation
The common Solid UI is used by Electron and Tauri. New file previews
reuse the
directory ownership boundary and bounded filesystem reader. Historical
reads use
worker Git commands with full-hash validation, authoritative file
membership,
bounded command output/time and snapshot-based paging. The old sidebar
editor
and split viewer are retired. See `dev-docs/FILES_PANEL.md`.
## Validation
Before rebasing onto current dev:
- Server, UI and Electron typechecks passed.
- Server/UI and Electron builds passed.
- 20 focused unit/route tests passed, including real isolated root and
linked
repositories, preview bounds and directory ownership.
- 12 distinct browser scenarios passed: 5 Files flows (including real
SessionView/composer, Markdown/images/source and RTL keyboard
navigation) and
7 existing Git lifecycle regressions.
Post-rebase validation, independent gatekeeper reviews and the Windows
Tauri
test build will be recorded below as they complete. This PR is intended
for
interactive validation before merge.
## Summary
I confirmed #812: the proxy removes the native missing-session tag
during ownership preflight, so the existing frontend cannot skip an
unavailable parent.
I preserved the sanitized `SessionNotFoundError` response (`_tag`,
requested `sessionID`, `message`) and HTTP 404. No UI behavior change,
parent rewrite, session deletion, ownership bypass or raw upstream error
forwarding is needed.
## Validation
- The proxy regression fails on the original generic response and passes
with the fix; it covers direct/nested reads, deletion admission,
generated-client decoding and unrelated errors.
- The real UI session-list store reproduces failure with the old
response, recovers valid families beside an orphan on repeated
refreshes, and still surfaces authorization failures.
- Full server suite: 754 passed, six platform skips, no failures.
Focused UI tests: 27 passed. Both typechecks and diff checks passed.
- These are isolated synthetic fixtures, not a reproduction on the
reporter's Linux/Tauri installation. No shared daemon or user history
was accessed.
Closes#812.
Maintenance note: existing `packages/server/src/server/http-server.ts`
(~2,319 lines) and
`packages/server/src/server/__tests__/instance-proxy.test.ts` (~1,117
lines) exceed the repository size guidelines; no unrelated refactor is
included.
## Summary
Qualify **OpenCode 2.0.21** and synchronize the server/UI client, plugin
and recommended runtime. Keep the demonstrated **2.0.7** application
minimum and the separate **2.0.20** feature requirement for native Codex
Usage. No production API adapter or proxy expansion is necessary.
The branch starts at `dev@0822c794`, including #807 file navigation,
#811 native selected Codex credentials and #813 responsive conversation
controls. The conversation remains attached to the main checkout;
qualification uses a separate worktree and isolated synthetic
services/data.
## Upstream audit: 2.0.20 → 2.0.21
- Authenticated native OpenAPI retains **116 paths**. The only operation
change is `DELETE /api/session/{sessionID}/form/{formID}`: optional
`message` query parameter and updated description. `Form.State` adds
optional `message` to the cancelled variant. All other paths/components
are unchanged.
- Published declaration comparison: **2/30 client, 0/60 plugin, 1/36
protocol, 1/102 schema** files change. The differences correspond to the
optional cancellation message. The generated JavaScript forwards it as a
query parameter; existing callers omit it.
- An isolated native fixture uses the real generated 2.0.21 client to
cancel both session and global Forms, with and without a message. Native
state preserves exact URL-sensitive text (`&`, `?`, accented text), and
the no-message state is unchanged.
- Other relevant runtime changes: provider passthrough/cache fixes,
Workers AI/Nova overflow classification, avoiding duplicate ancestor
instructions, namespaced provider session/parent headers, and native
browser-tool availability tied to desktop attachment. These do not add a
new CodeNomad runtime dependency.
- The plugin's optional OpenTUI peer floors move to **0.5.14**. Those
terminal peers are not installed by CodeNomad. Lockfile scope is exactly
six `@opencode` packages and the two workspace entries;
metadata/integrities come from the independently installed published
packages. A clean `npm ci --ignore-scripts` validates the final lock.
- GitHub's release-tag comparison is diverged by one base-only commit:
`84c9be93a56304a108f1a22df0c5d62c26d5b6ca`, the 2.0.20 release
manifests/lock update, with no additional base-only production source
files.
## Isolated qualification
Windows / **Node 24.20.0**, separate CLI/profile/database instances and
synthetic providers. No shared-daemon or personal-history operations.
- Existing **2.0.20 dependencies + runtime 2.0.21**: full native pruning
acceptance passes, including relay/proxy/ownership, worktrees,
Forms/permissions, 241-message history search/cleanup, 1,501-message
navigation, concurrency, next-model payload, forks, compaction and
restart.
- With **2.0.21 dependencies**, all **seven native suites pass on both
2.0.7 and 2.0.21**: automation, pruning, per-send environment, forks,
idle/busy side questions, blank-session cleanup and Git-degraded
recovery.
- Additional **native Codex Usage** acceptance passes on 2.0.21:
production adapter selects native OAuth/accountID, invalidates a warm
snapshot on account switch and recovers despite a stale legacy file.
Only quota HTTP is mocked; credentials and daemon are synthetic. This is
not a real-account/WSL test.
- Complete native/UI pruning acceptance passes with the **ordinary
launcher**, without Vite preloading. Historical intermittent Windows
import failures remain unexplained, not claimed fixed.
- Full server suite: **751 passed, 6 skipped, 1 failed** in unchanged
`git-worktree-config.test.ts` cleanup (`rmSync` EPERM). The focused
unchanged fixture rerun passes **9/9** without forced exit. The original
failure is retained; the full run is not relabelled green.
- **71 UI tests** and **32 browser scenarios** pass
(client/store/reducer/usage state, setup/install progress, auth
recovery, tool images and rendered usage). Aggregate server/UI tests use
`--test-force-exit`; browser tests do not.
- Server/UI/Electron typechecks and production
server/UI/pruning/automation builds pass.
- Native historical migrations **2.0.3 → 2.0.21** and **beta-19271 →
2.0.21** pass.
- Isolated native npm upgrade **2.0.15 → 2.0.21** passes while the
authenticated running daemon stays **2.0.15 / PID 40568** before and
after.
- Standalone pruning plugin packed and installed outside the repository
passes native 2.0.21
history/navigation/proxy/concurrency/compaction/restart acceptance.
Local results do not establish all real providers, Linux/macOS/WSL or
installed desktop hosts. Independent gatekeeper and remote CI outcomes
are reported separately; no continuous CI monitoring is requested.
Align server/UI client and bundled-plugin pins with OpenCode 2.0.21 while keeping the demonstrated 2.0.7 application minimum and the separate 2.0.20 Codex Usage requirement. The native contract changes only by optional form-cancellation text, so existing callers need no production adapter or proxy expansion.
Extend recommendation/status coverage and update maintained architecture and compatibility references. Scope the lockfile to published OpenCode packages, including optional OpenTUI peer metadata, without refreshing unrelated dependencies.
Qualify minimum/current native suites, generated cancellation with and without a message, selected native Codex credentials, ordinary pruning/UI acceptance, standalone plugin, historical migrations and isolated upgrade retaining daemon version/PID. Typechecks, builds, 71 UI tests and 32 browser cases pass. Preserve the full server suite cleanup EPERM and its successful focused rerun as separate evidence rather than claiming a fix.
## Summary
- Improve mobile conversation controls for #800: one-row truncated
composer controls, compact touch actions, header overflow for transcript
filters and session-change header measurement rebinding.
- Hide the timeline below 420px and reduce the worktree selector to its
accessible arrow below 460px of conversation width; preserve
preferences.
- Make the prompt itself follow visible conversation height with a saved
manual proportion, 8% minimum / 60% maximum and a 44px floor. Keep
drafts and migrate legacy pixel preferences.
- Preserve the original six preview templates and add owned native
Android/Chromium touch emulation to mobile templates in Electron and
Windows Tauri. Allow main windows to shrink to 390px.
## Validation
- UI typecheck and build passed.
- Focused browser regressions cover narrow mouse/touch layouts,
thresholds, filters, draft preservation, pointer/keyboard resizing,
proportional window resizing and visual-keyboard changes.
- Native Electron emulation and controller/window tests and Tauri
controller/restoration tests exercised during implementation; final
verification and independent Gatekeeper review will be posted below.
## Scope and limitations
- Emulation is Android/Chromium, not a claim of Gecko/Waterfox or Safari
parity; iframe fallback changes only dimensions. Physical software
keyboard behavior is represented with deterministic visualViewport
fixtures.
- No shared daemon restart, profile reset or unrelated main-checkout
changes.
- Existing large files touched: `prompt-input.tsx` (~1068 lines),
`instance-shell2.tsx` (~1325), `session-view.tsx` (~697),
`browser-frame.tsx` (~877).
Refs #800.
## Summary
I replaced Codex Usage's legacy auth-file reads with the connected
OpenCode V2 daemon's selected ChatGPT OAuth credential. This addresses
the stale-file mismatch described in #808 without guessing WSL
credential paths or substituting another account.
- Resolve the provider integration in the owned session's native
location; use only its selected active credential and native accountID.
- Keep credentials server-only, OAuth refresh native-owned, and
credential export/generic RPC blocked through the browser proxy.
- Fence warm and pending quota results on account changes, reconnects
and session movement; scope the visible panel to its instance/session.
- Bound quota HTTP, reject redirects and sanitize errors. No SQLite
access or legacy/Codex CLI fallback.
The credential-list API requires OpenCode 2.0.20 for this feature only.
Older runtimes, expired native tokens and non-ChatGPT connections fail
closed; the global application minimum is unchanged. Other providers'
credential integrations are outside this focused fix.
## Validation
- Server/UI typechecks; 85 server tests; five UI unit tests; three
rendered browser scenarios; UI build and diff checks passed.
- A fresh native 2.0.20 Windows daemon with synthetic credentials
exercises the production adapter: selected OAuth/accountID, key-account
switch invalidating a warm snapshot, and recovery despite stale
auth.json. Quota HTTP is mocked; no shared daemon or real credentials
are used.
- This fixes the confirmed integration mismatch, but I have not
reproduced the author's real WSL/live account failure.
Closes#808.
Maintenance: existing `packages/server/src/server/http-server.ts`
(~2,317 lines) and `packages/ui/src/lib/api-client.ts` (~613 lines)
exceed the source-size guideline; their wiring changes remain small.
## Summary
I revisited the feedback on #724. I had deliberately removed three
permanent root/Home/start icons and moved the parent into the address
menu to avoid duplicate controls. That simplification went too far: the
configured workspace root disappeared when it differed from the initial
folder, and parent navigation was hidden until the address menu opened.
- Restore the server-reported workspace root as a named address
destination in both browsing scopes.
- Restore the familiar Up one level list row in folder and file modes,
including empty folders and Windows drive roots.
- Keep Back to start and unrestricted Home, deduplicate identical
targets, and remove the parent address option.
- Clear edited-path state and protect the parent click from address-blur
reflow.
- Add the root label to all ten locales. No new permanent toolbar icons
or server authorization changes.
Follow-up:
https://github.com/NeuralNomadsAI/CodeNomad/pull/724#issuecomment-5902482429
## Validation
- Both distinct-root browser regressions fail before the fix.
- All 19 real directory-browser scenarios pass, including restricted
boundaries, no initial path, deduplication, Windows Drives, edited-path
clicks, relative starts, reopen/stale-response fencing, keyboard entry
and 600/360 px layouts.
- UI typecheck/build and diff checks pass.
Maintenance: the existing
`packages/ui/src/components/directory-browser-dialog.tsx` is
approximately 575 lines; I kept the change focused rather than
refactoring unrelated behavior.
## Summary
Qualify **OpenCode 2.0.20** and synchronize server/UI client, plugin and
recommended runtime pins. Retain the demonstrated **2.0.7**
timestamp-based minimum. No production API adapter, proxy exposure or
implicit daemon restart is added.
The branch starts at `dev@d9957500`, including #803's close actions and
#806's static connected MCP indicators. The conversation stays attached
to the main checkout; qualification uses a separate worktree and
synthetic services/data.
## Upstream audit: 2.0.19 → 2.0.20
- Authenticated native OpenAPI: **116 paths**. The previous 115 path
definitions are unchanged; the new path exposes `GET` and `POST
/api/credential`. Listing exports stored secret values, so neither
operation belongs in the workspace proxy. A regression confirms both are
rejected before contacting upstream.
- Existing schemas gain optional session-error `response.body` and
connection `status` (`needs_auth`, message, optional URL). New
components describe the credential operations. No existing required
field or route is removed.
- Published declaration audit: **6/30 client, 2/60 plugin, 5/36 protocol
and 8/102 schema files change**, propagating these fields, credential
methods and the plugin's `integration.connection.status` method.
Generated `FormAnswer1` becomes `FormAnswer2` with the same value shape;
CodeNomad does not import the renamed helper. This is not a claim that
every generated public type is unchanged.
- A UI regression verifies optional provider response-body preservation
without replacing the existing display message. The existing
legacy/no-body error tests remain.
- Relevant runtime changes also cover provider error extraction,
Bedrock/Mistral reasoning, prompt caching, ChatGPT token-sharing
authentication, CLI permission rejection and owner-only database-file
permissions.
- The CLI's new `service disabled` setting affects implicit CLI
connections. An isolated fixture uses CodeNomad's real
`OpenCodeCliService` to authenticate explicit startup/discovery with
`disabled=true`; the setting remains true afterward. CodeNomad does not
write native service configuration.
## Isolated qualification
Windows, Node **24.20.0**, separate CLI/profile/database instances and
synthetic providers. No personal histories or shared daemon operations.
- Existing **2.0.19 dependencies + runtime 2.0.20**: full native pruning
suite passes, including relay/proxy/worktree ownership,
Forms/permissions, 241-message search/cleanup, 1,501-message navigation,
concurrency, next-model payload, forks, compaction and restart.
- With **2.0.20 dependencies**, all **seven native suites pass on both
2.0.7 and 2.0.20**: automation, pruning, per-send environment, forks,
idle/busy side questions, blank-session cleanup and Git-degraded
recovery.
- The complete native/UI acceptance passes using the **ordinary
launcher**, without diagnostic Vite preloading. Historical intermittent
Windows failures remain unexplained; a passing run is not a fix.
- **745 server tests pass, 6 skipped**; **66 UI client/store/reducer
tests pass**, including the new response-body regression. These
aggregate suites use Node's `--test-force-exit`; the focused **11/11
normalizer tests** also pass without it. **30 browser scenarios pass**
(setup/progress, auth recovery and tool-result images).
- Server/UI/Electron typechecks and production server/UI/plugin builds
pass.
- Both native history migrations **2.0.3 → 2.0.20** and **beta-19271 →
2.0.20** pass.
- Isolated native npm upgrade **2.0.15 → 2.0.20** passes while the
running daemon remains **2.0.15**, PID **31872** before/after.
- Standalone pruning plugin packed and installed outside the repository
passes native 2.0.20 acceptance, including
history/navigation/concurrency/compaction/restart.
The initial npm resolution also refreshed unrelated Redis and WSL
utility entries. Those entries were restored before publication; the
final lock changes only six `@opencode` packages and the two workspace
manifests. A clean `npm ci` accepts that final lock. Final-lock
revalidation passes server/UI/Electron typechecks, production builds,
all **745 server + 66 UI tests**, and the complete ordinary-launcher
native/UI acceptance. The initial and final logs are retained
separately; both ordinary native/UI runs pass.
Local results do not establish all real providers, Linux/macOS/WSL or
installed desktop hosts. Remote CI and independent gatekeeper outcomes
are reported separately.
Size signal: the touched existing
`packages/server/src/server/__tests__/instance-proxy.test.ts` is
approximately **1,073 lines**; no unrelated refactor is included.
Synchronize server/UI client and plugin pins with OpenCode 2.0.20 while retaining the demonstrated 2.0.7 step-timestamp minimum. Review the authenticated runtime contract: existing routes remain stable, while credential operations and optional connection/error metadata are added without requiring production adapters.
Protect the workspace proxy boundary with credential export/create rejection coverage and verify optional provider response bodies survive UI normalization. Update the maintained compatibility and architecture references, including explicit native service startup with the new disabled setting and the unresolved historical Windows import failure.
Validate minimum/current native runtimes, ordinary pruning/UI acceptance, standalone plugin installation, historical migrations and native npm upgrade with daemon version/PID preservation. Clean-install the scoped lockfile and revalidate typechecks, production builds, 745 server tests and 66 UI tests; browser qualification covers 30 scenarios.
Keep connected MCP status dots green without a permanent pulse. Pending connect/disconnect operations retain their warning pulse and spinner; the shared reduced-motion and metadata refresh policies are unchanged.
Add real StatusTab/SUID browser regressions at 150% scale, a bounded historical/current Chromium profiler, and measurement-limit documentation. Five browser scenarios, UI typecheck/build and repeatable profiler assertions passed. Fix the gatekeeper P2 by creating the temporary evidence parent on clean machines; the second independent review reported zero findings.
The change addresses the idle-animation source in #804, not its unconfirmed generation GPU symptom or #805. Remote CI was pending at the explicitly requested admin merge.
Make persistent utility windows and the web preview discoverably dismissible using an upper-right X in their existing toolbar. Share the localized square close control, move search dismissal from its input row to the options row, and preserve the aside's existing header. Do not add extra title bars or draggable-window behavior. Transient message-content popups retain outside/Escape dismissal without an X.
Keep initial focus on input fields and native close-button activation separate from palette command execution. Web dismissal returns to chat without deleting preview state or drafts; BrowserFrame close remains optional for other consumers. The separate mission-reader replacement was merged as #802 into its feature branch.
Final independent gatekeeper review at d4d35f20495b6df87634d1bc49db072571c8081a: PASS, zero findings. Validation: 22/22 browser scenarios, narrow/RTL checks, UI typecheck, production build and diff hygiene. Admin squash explicitly authorized by the user; broader hosted CI was still in progress at admission.
Replace the existing Back to chat arrow/text button with an X in the mission reader's current header. Preserve its localized accessible name and tooltip, chat transition, Escape handling and focus behavior; add neither an extra bar nor draggable-window behavior.
Independent gatekeeper review: PASS, zero findings. Target-branch mission browser suite: 7/7; UI typecheck passed. Admin merge authorized by the user; broader hosted CI was still in progress at admission. Companion utility/web-preview correction is #803.
## Summary
Qualify **OpenCode 2.0.19**, the latest stable publication, and
synchronize the server/UI client, pruning plugin and recommended
runtime. Keep the demonstrated **2.0.7** technical minimum. No
production API adaptation is required by the inspected contracts.
The branch starts at `dev@0b348e86`, including #784's sustained
installation progress and #785's destroyed-window close fix. Runtime
installation and shared-daemon restart remain separate explicit
operations.
## Upstream audit: 2.0.18 → 2.0.19
- Authenticated native OpenAPI: all **115 paths and component schemas
are identical** to the native 2.0.18 schema.
- Published declarations: byte-identical **30 client, 60 plugin, 36
protocol and 102 schema declaration files**. Distribution chunk
filenames differ; this is not a claim that the complete published
JavaScript packages are byte-identical.
- Relevant upstream changes: compaction refactor; output limits fitted
to context with a 256k cap; bounded shrinking after provider
context/payload rejection; provider-cache reuse and session affinity;
one-shot generation attribution; provider/media error fixes;
repository-host path validation.
- Native Shell tools now supply `AGENT=1`, `OPENCODE=1`, default
`AI_AGENT=opencode`, and the current `OPENCODE_SESSION_ID`. CodeNomad
still writes the complete profile session snapshot before each
prompt/command/session-shell send.
- No minimum increase follows from these runtime improvements. The
generated API and server-plugin contract do not add a CodeNomad
dependency boundary.
## Isolated qualification
Windows, Node **24.20.0**, synthetic providers and separate
CLI/profile/database instances. No shared daemon or personal histories
are used.
- Existing **2.0.18 dependencies + runtime 2.0.19**: complete native
pruning acceptance passed, including relay/proxy/ownership, worktrees,
Forms/permissions, 241-message search/cleanup, 1,501-message navigation,
concurrency, next-model payload, forks, compaction and restart.
- **Server/UI/Electron typechecks passed.** Full server run: **743
passed, 6 skipped, 1 failed** in an unrelated Git fixture cleanup
(`rmSync` EPERM). The focused unmodified Git-worktree fixture rerun
passed **9/9**; the original failure is retained rather than relabelled
an entirely green full run.
- **65 UI client/store/reducer tests passed.**
- **30 browser scenarios passed**, covering setup/install progress, auth
recovery and tool-result images.
- With the **2.0.19 dependency pins**, all **seven native suites passed
on both 2.0.7 and 2.0.19**: automation, pruning, per-send environment,
forks, idle/busy side questions, blank-session cleanup and Git-degraded
recovery. Pruning includes native
proxy/relay/worktree/history/concurrency/compaction/restart scenarios.
- Historical native migrations **2.0.3 → 2.0.19** and **beta-19271 →
2.0.19** passed: complete history, forks, historical
identities/configuration and same-version restart comparisons for Forms
durability.
- Real npm/native installation **2.0.15 → 2.0.19** passed while the
authenticated running daemon remained **2.0.15**, PID **43016**
before/after.
- Production server/UI/pruning/automation builds passed.
- The standalone pruning plugin was packed and installed outside the
repository, then passed native 2.0.19 acceptance through
history/search/navigation, proxy/ownership, concurrency, compaction and
restart.
## UI fixture diagnostic boundary
Two ordinary pruning/UI runs against 2.0.19 stopped abruptly while
dynamically loading Vite, after native history and proxy cases passed.
An unchanged **2.0.18 runtime control reproduced the same stop** using
the existing 2.0.18 dependency tree. The shell reported exit **116**,
with no JavaScript exception. Earlier qualifications recorded an
intermittent Windows heap-corruption exit around this phase; the new
observations alone do not establish the same native cause.
This PR adds only per-import progress traces to the native/UI fixture,
pinpointing completion of Playwright and entry into Vite import. It does
not claim to fix the underlying abrupt exit or silently retry it.
The **full 2.0.19 native/UI acceptance passes** with a temporary
diagnostic launcher that preloads Vite before starting the fixture (exit
0). The same assertions complete UI deletion, native persistence/reload,
plugin discovery and multi-backend lifetime, contention, next-model
payload, forks, compaction and restart. The diagnostic changes import
order; it does not prove the ordinary late-import launcher is reliable
or establish why it stopped. The preload is not introduced into
production or silently made the default test path.
Local qualification does not establish every provider configuration,
installed-desktop behavior or cross-platform coverage; remote CI
outcomes are reported separately.
Align server/UI client and bundled plugin pins with OpenCode 2.0.19 while retaining the demonstrated 2.0.7 timestamp minimum. The authenticated native schema and published declarations preserve the consumed API contract; runtime improvements concern compaction, context limits, provider cache affinity and Shell conventions.
Extend setup version coverage and update the maintained compatibility and architecture references. Add per-import native/UI fixture diagnostics after late Vite loading stopped on both the new runtime and the 2.0.18 control; do not claim that eager-import diagnostic acceptance fixes that failure.
Qualify both minimum/current native runtimes, historical migrations, isolated npm upgrade without daemon restart, standalone plugin installation, UI/browser behavior and production bundles. Retain the original Windows fixture failures and their bounded diagnostic results in the PR evidence.
Present missions as a compact index with inline actions and stable task rows, and move long objectives, briefs, reports, and plan changes into the shared reader surface. Add a measured dependency graph that tracks row geometry through expansion, resize, zoom, and RTL without inventing edges between unrelated tasks.
Keep historical and completed work navigable while collapsing secondary actor/history details and showing attention only when actionable. Document the presentation conventions and add browser coverage for branching dependencies, reader navigation, compact layout, and geometry updates.
Validation: UI typecheck and seven Mission Centre browser tests passed; git diff --cached --check reported no whitespace errors.
## Summary
Fix the main-process `TypeError: Object has been destroyed` dialog
observed when
closing the Windows Electron 0.20.0 build.
The local window's `closed` handler accessed `window.webContents` after
the native
BrowserWindow was destroyed. The exception surfaced while
`MultiwindowLifecycle.exit()` called `app.exit(0)`.
BrowserController now captures the owner WebContents while the window is
alive
and observes `closed` using that retained identity. Browser target
registrations
and pending-open claims are cleaned up after the registry's existing
removal
handler, without invoking getters on the destroyed BrowserWindow.
This is an Electron native-object lifetime correction; shared shutdown
semantics
and Tauri behavior remain equivalent.
## Validation
- Electron TypeScript check passed.
- 15 browser-controller regressions passed, including a
native-getter-throwing
window fixture that verifies registration cleanup still occurs.
- 16 multiwindow lifecycle regressions passed.
- `node scripts/test-electron-owner-close.mjs` passed on Windows with
real
Electron 39.0.0 windows: forced destroy, ordinary close and final
lifecycle
exit. It also asserts that the former getter really throws after
`closed`.
- Native fixture uses its own temporary profile and no
CodeNomad/OpenCode backend.
Separate from the installation-progress UI PR. This fix is not yet
included in
the already-published 0.20.0 replacement archives.
File-size note: the existing Electron `main.ts` entry point is
approximately
625 lines; the change replaces one cleanup call with owner observation.
## Summary
Make lengthy OpenCode installation visible in startup recovery and
Preferences:
- Animated activity indicator, operation elapsed time and translated
guidance to
keep CodeNomad open while setup runs.
- Real request phases: installation, installed-version verification and
service
connection/restart. No invented percentage or download progress.
- Timer survives dialog dismissal/reopening. A dismissed startup dialog
retains
a visible progress reminder until the operation completes.
- Live progress is outside the `aria-busy` controls; the timer is not
announced
every second. The same Solid component serves Electron, Tauri and web.
This addresses feedback from first-install tests on Windows. Closing the
desktop
could interrupt its installer process, but the original npm
optional-dependency
failure has not been attributed conclusively to an early close.
## Validation
- UI TypeScript check passed.
- All 23 browser setup regressions passed.
- Deferred-response tests cover sustained installation, elapsed time,
dialog
dismissal/reopening, version verification, connection and single
mutation
submission. Existing failure/retry and explicit-restart regressions
pass.
- Inspected real rendered recovery and settings captures with the full
stylesheet.
- New strings provided in all ten locales.
Separate from the Electron destroyed-window close fix. Neither change
has been
added to the already-published 0.20.0 replacement archives yet.
File-size note: existing locale `settings.ts` message files are around
661–675
lines; no size-only refactor is included.
Carry dev's backend Git availability advisory into mission assignment and report admission. Refresh only the owned native instruction under the existing worktree fence, after profile environment synchronization, and clear stale context after Git recovery. Advisory failures remain non-blocking while cancellation and connection retirement still prevent native input.
Cover missing Git for actors and coordinator reports, recovery cleanup, advisory failure and cancellation/retirement fence release. Targeted route tests and server typecheck pass; the complete isolated OpenCode 2.0.18 mission fixture passes and independent merge re-review reports zero remaining findings.
Integrate dev into the Missions PR without rewriting its reviewed history. Retain mission CRUD routes, authenticated report admission and the 512 KiB bridge limit alongside inspected-window automation and plugin controls. Keep dev's canonical transport, clean builds and 2.0.18 client/plugin dependencies; align the local plugin contract check with the same SDK.
Combine architecture guidance and preserve the technical runtime minimum of 2.0.7. Keep the isolated Missions fixture in the latest-runtime CI lane because its test-only ctx.tool.list driver is absent at that minimum; do not reintroduce legacy compatibility paths.
Validation: server, UI and plugin-contract typechecks; full server/UI/plugin build; 84 backend/compatibility/packaging tests; 59 UI/persistence/browser tests; isolated OpenCode 2.0.18 Missions fixture and workflow YAML parsing. Merge resolutions have no conflict markers or diff-check errors relative to dev.
Keep live task ancestry and replacement filtering while deduplicating candidate implementers by native session identity. Several completed implementation steps in one root can now receive their resolver without weakening ambiguity rejection between distinct actors.
Add helper coverage and a full Pocock artifact-driven regression exercising delegation, resolver replacement and revision through the shared implementer. Validated 46 combined backend tests, server typecheck and the rebuilt Missions plugin.
Declare expected mutation rejections in the native RPC contract and return them through the invocation error API. Map structured business codes to conflict, missing and ownership responses so stale editors can request a reload instead of reporting an unavailable plugin. Unexpected exceptions remain opaque 503 failures.
Extend the isolated OpenCode fixture through the real WorkspaceManager and HTTP routes to verify stale update/delete, create/update/delete request-ID conflicts and unknown missions. Observed native 503 before the fix and 409/404 after it; targeted route/plugin/reload tests and server typecheck pass.
Recover durable report notifications that were saved before a bridge outage prevented coordinator admission. Reuse native message identities, honor journal acknowledgements and lifecycle fences, and retry only notifications through the authenticated environment-aware bridge. Nonblocking single-flight retries use bounded backoff and rotating batches without dispatching tasks.
Show pending coordinator notification separately from task completion in Mission Control, with all locales aligned. Derive managed actors from immutable task identities, resolve Pocock implementers through live task ancestry, and normalize dependencies for both new and historical idempotent requests.
Validated 53 backend regressions, server and UI typechecks, UI and plugin builds, six real-component browser scenarios, locale parity, and an isolated OpenCode 2.0.18 fixture proving idle/busy resumption and automatic outage recovery with and without restart. Native replay retains one correlated report without another coordinator wakeup.
Share project mutation and append queues across content-addressed plugin incarnations so disposal cannot let competing revision checks overwrite history. Keep in-flight operations exclusive until settlement.
Raise assembled bridge text bounds to accommodate maximum XML-escaped objective and task fields within the existing HTTP body bound. Exercise real authenticated HTTP admission with XML, JSON-control and multibyte expansion.
Observe both regressions failing before their fixes, then passing with the focused bridge suite and server typecheck. The isolated OpenCode 2.0.18 fixture now proves reports reach an actual provider request for idle and busy coordinators instead of treating session idle as proof of consumption.
Make Mission Control actionable with create/edit/delete, persistent disclosures and selection, task dependencies, native attention requests, execution comparisons and a long-content reader above the mounted transcript. Preserve drafts and native per-window layout, and arbitrate browser/reader gestures without losing the preview target.
Add coordinator-only mission.revise with revision CAS, idempotent replay, linked replacements and explicit dependency changes. Retain withdrawn task contracts and late reports, require terminal settlement for outstanding native admissions, and attribute human metadata edits in the bounded history. Mission deletion tombstones the map without deleting conversations.
Cover lifecycle and revision semantics with backend regressions and the isolated OpenCode 2.0.18 fixture, including the repaired authenticated late-report notification. Validate real Solid UI restoration, editor retry identity, native background Forms, transcript/draft preservation, layout cleanup and ten-locale parity. Record Kandev research, scope decisions and separate follow-up opportunities.
Live multi-agent research exposed a second timeout after unrelated workspace waits were removed: the actual owner's validated linked-worktree inventory can take about 18 seconds when cold. Give mission discovery a bounded 30-second probe deadline instead of the five-second interactive browser deadline.
Keep browser discovery unchanged and continue probing for competing backend owners before admitting any mission input. Add a regression with ownership validation exceeding five seconds and verify a second owning backend prevents another admission.
Validated ten automation tests, server typecheck, bundled Missions build and the isolated OpenCode 2.0.18 native fixture. Loaded the updated bundle through the installed desktop lifecycle and successfully resumed the same previously blocked UX assignment without a duplicate actor or task.
Resolve desktop bridge ownership as soon as one workspace validates the session instead of waiting for every inventory. Probe mission admission candidates concurrently so an unrelated stalled connection cannot delay a verified owner.
Keep authenticated bridge discovery, cross-backend ambiguity rejection, durable contract checks, execution selection, worktree fences and per-send environment admission intact. Duplicate logical tabs still share their backend profile.
Add regressions for stalled unrelated ownership and connection checks. All eight route tests and server TypeScript compilation pass. Verified the installed Windows Tauri backend reconnects and accepts the original durable assignment after the fix; ownership probing dropped from roughly 13 seconds to 0.46 seconds.
Provision codenomad.missions through connected-daemon discovery and independent backend presence instead of requiring a source plugin in every project. Bundle the integration for Electron and Tauri, retain project-scoped mission journals across shutdown, and use the same secondary surface as Status.
Complete the existing native actor execution work: persist explicit agent/model/variant choices, validate catalog selections and avoid switching busy actors. Admit assignment and report writes through the authenticated desktop bridge with durable-contract verification, session ownership, connection and worktree fences, and per-send profile environment synchronization.
Advance the older source branch client/plugin pin to 2.0.11 and retain its bounded runtime metadata adaptation. The isolated 2.0.16 mission fixture passes native catalog, selection, busy queues, conflict, environment, reports, reconnect and idempotence checks. Server, UI and plugin typechecks, 31 mission tests, 10 lifecycle/transport tests and six resource-layout tests pass.
## Summary
Qualify the latest published stable OpenCode **2.0.18** and align the
server/UI client, bundled pruning plugin and recommended runtime. The
technically required minimum stays **2.0.7**
(`session.step.started.data.started`). No application API adaptation was
needed.
The setup regression covers the intermediate releases as usable, with
only the recommendation designated release-tested. The isolated native
npm upgrade fixture now follows `RECOMMENDED_OPENCODE_VERSION`,
retaining 2.0.15 as the native-upgrade source boundary and asserting
that installation does not restart the live daemon.
## Upstream review
- Compared `anomalyco/opencode` tags **v2.0.16...v2.0.18**, published
client/plugin declarations and a real authenticated 2.0.18 daemon
schema.
- The runtime has **115 paths**: the previous 113 are unchanged;
`/api/pair` and `/auth/connect/{code}` are additive. Component changes
are optional `Shell.Info.signal` and two pairing response schemas.
CodeNomad's guarded proxy does not expose the new pairing APIs.
- The tagged `packages/protocol/openapi.json` still has 113 paths, so
comparing that file alone would miss the additions. The actual runtime
schema and generated client agree.
- Client changes are additive; plugin declaration changes concern TUI
model variants. OpenTUI optional peers advance to >=0.5.12 and
`@opencode/util` adds the shared browser opener dependency.
- Relevant runtime fixes: flush batched transcript deltas before the
next block; report signal-terminated Shells; restore no-output
placeholders; improve provider errors/reasoning budgets; improve Code
Mode JavaScript semantics; decode legacy media in compaction checkpoints
(2.0.18).
- Authentication, native storage, explicit configuration reload and
install/restart ownership remain the existing CodeNomad contracts. No
minimum bump follows merely from the new publication.
## Isolated Windows qualification
Node **24.20.0**, synthetic providers, separate profiles/databases/CLI
installations; no shared daemon or personal histories used.
- Existing 2.0.16 dependencies against runtime 2.0.18: complete native
pruning/UI acceptance passed before the dependency change.
- 2.0.18 dependencies against minimum runtime 2.0.7: all seven native
suites passed (automation, pruning, environment, forks, side questions,
blank-session cleanup, Git-degraded recovery). Pruning includes
relay/proxy ownership, native worktrees, Forms/permissions, 241-message
search/cleanup, 1,501-message outline/navigation, concurrency and
restart persistence.
- 2.0.18 dependencies against runtime 2.0.18: automation, environment,
forks, side questions, blank-session cleanup and Git-degraded suites
passed. The initial pruning run passed the native
relay/proxy/worktree/history cases, then the Node process exited with
**0xC0000374** while loading browser/server dependencies. The prior
2.0.16 qualification already records an intermittent Windows exit at
this phase. This is retained as unresolved failure evidence, not claimed
fixed by a rerun.
- **744 server tests passed, 6 skipped; 65 UI client/store/reducer tests
passed.** Server, UI and Electron typechecks passed.
- Native migration **2.0.3 → 2.0.18** passed: complete histories, fork
identities, historical provider configuration and same-version restart
comparison for Forms durability.
- Native npm **2.0.15 → 2.0.18** installation passed, while the
authenticated daemon remained **2.0.15**, with the same PID
before/after.
- The diagnostic **2.0.18 native pruning/UI rerun passed in full**,
including UI deletion, automatic plugin discovery, multiple backends,
claim contention, next-model payload, fork isolation, compaction and
restart. `--report-on-fatalerror` was enabled; no failure occurred on
that run. This does not establish the cause or a fix for the first exit.
- Native migration **beta-19271 → 2.0.18** also passed, including
histories, forks, historical configuration and Forms durability checks.
- **25 setup/auth-recovery browser scenarios passed.**
- **3 tool-image browser scenarios passed**, covering
generic/specialized output, collapse, failed/unsupported sources and
replacement recovery.
- Production server/UI/pruning/automation build passed.
- Standalone pruning plugin was packed, installed outside the
repository, then passed the 2.0.18 native suite (including 241-message
search/cleanup, 1,501-message navigation, proxy/ownership, concurrency,
compaction and restart). This verifies the actual distributable
independently of the embedded bundle.
The independent gatekeeper review will be recorded before merge.
Cross-platform CI is distinct from these local Windows results.
## Review and merge
Base: `dev@14b1eaa48e2663733cbdd7f5ebaa3d91691bdbe1` (#787). The user
explicitly requested independent gatekeeper review/correction loops
until zero actionable findings, followed by administrator merge. Final
merge must target the reviewed head and verify any new `dev` merges
first.
Align server/UI client and bundled plugin pins with the latest stable runtime while preserving the demonstrated 2.0.7 timestamp minimum. Review the published declarations and authenticated native schema: pairing and Shell signal additions require no CodeNomad API adaptation.
Make the isolated native upgrade fixture follow the recommendation while retaining its 2.0.15 source boundary and live-daemon PID assertion. Extend setup version coverage and update the current compatibility and architecture references.
Validate both minimum/current native runtimes, historical migrations, server/UI tests, setup and tool-image browser scenarios, typechecks and production bundles. Record the intermittent Windows Node pruning/UI heap exit and successful diagnostic rerun without claiming its cause is fixed.
Persist the global favorites/all choice in the UI state owner instead of deriving it from each selected model. Search stays within the chosen mode, and the active model is added without becoming a favorite, respecting explicit provider visibility and disabled unavailable placeholders.
Publish mode intent immediately and serialize persistence. Fence completion by latest-write identity so double/triple clicks retain the latest intent throughout delayed responses. Keep a stored mode visible and revocable when no favorites remain.
Add real-component browser coverage for selection, search, remounts, hidden/unavailable models, empty favorites and click bursts. Register store coverage in CI, verify actual persistence ordering and ensure mocked writes finish before teardown. Independent final gatekeeper PASS at 1ee5a96e; 860 CI-group unit tests, 14 targeted tests, six browser tests and typechecks pass locally. Remote Windows Rust Node-election failure is documented separately in the PR.
## Summary
- Update the main README for the shared OpenCode V2 service, current
features, managed desktop setup, minimum/recommended OpenCode versions,
and explicit service restart behavior.
- Correct release links, actual Electron/Tauri artifact formats and
architectures, Node guidance, remote authentication and SideCar
configuration fields.
- Align server and contributor documentation with the 0.20 baseline.
- Replace the old hero screenshot with a current 1600x900 workspace
rendered using real Solid components and synthetic demo data.
- Include a reproducible Chromium capture script and provenance notes;
external traffic is blocked and no user backend, daemon or provider is
used.
## Preview
## Validation
- UI typecheck passes.
- Chromium capture passes transcript, connected-state, agent, timeline
and MCP readiness checks, with no uncaught renderer errors.
- Resulting image inspected visually.
- 20 local Markdown/image targets verified.
- Staged git diff --check passes.
Regenerate with: node packages/ui/scripts/capture-readme.mjs
Documentation and capture tooling only; CI is not being monitored.
## Summary
Fix the first-install recovery dead end observed in CodeNomad 0.20.0 on
Windows 11. npm failed to install the optional Windows binary packages,
then removed the CLI package while leaving terminal shims behind. These
shims disabled installation admission and hid the install button; later
status refreshes also erased the action error.
Recognize only the exact npm-generated orphan shim in the selected user
prefix with a missing canonical executable. Preserve custom-wrapper,
foreign-prefix and existing-binary authority checks. Keep action
failures visible across refresh and reopening.
## Validation
- 34 targeted updater/installer regressions passed.
- 21 browser setup regressions passed.
- Server TypeScript check passed with locked dependencies.
- On the affected machine, isolated package download and executable
validation succeeded without Git. Explicitly authorized repair using
bundled npm succeeded; the user confirmed CodeNomad now opens folders.
## Distribution
The maintainer explicitly requested replacing the existing 0.20.0
desktop release assets rather than creating 0.20.1. This branch is based
on v0.20.0 and preserves its version; the PR build artifacts will be
used for that revision after validation. The release notes will record
the source commit, and WinGet will receive a separate same-version
installer hash correction. No npm version republication is intended.
Co-authored-by: Shantur Rathore <i@shantur.com>
## Summary
Prepare the stable 0.20.0 version on top of `dev@25e07c74` before the
release PR from `dev` to `main`.
- Align the root, server, UI, Electron and Tauri npm versions and
workspace lock metadata to `0.20.0`.
- Align the Tauri Cargo manifest, Cargo lock entry and native config
version.
- Require CodeNomad server `0.20.0` in the remote UI manifest: the new
V2 frontend cannot use the old 0.19.x V1 backend contract.
- Leave the dependency graph unchanged.
The stable publication workflow reads the root version on a push to
`main`; this preparation PR targets `dev` and does not publish the
stable release.
## Validation
- Clean locked dependency installation in an isolated release worktree.
- Version consistency assertions across npm manifests, lock metadata,
Cargo and Tauri config; dependency graph comparison against the parent
commit.
- `npm run sync:version --workspace @codenomad/tauri-app` confirms all
native versions are already aligned.
- UI, server and Electron typechecks pass.
- UI production build passes.
- Remote UI selection and dev-release channel tests pass (3 tests).
- `git diff --check` passes.
Native installers and the cross-platform release matrix have not been
rebuilt locally in this preparation pass. No CI monitoring is started.
Let standalone reasoning cards inherit the configured thinking expansion default instead of forcing them open. Multi-step groups continue to own the outer disclosure with expanded inner cards, and visible response content remains unaffected.
Add real MessageSection and TranscriptFilters browser regressions covering one/two reasoning steps, expansion and visibility changes, native history reload and manual disclosure. The single-step test fails before the fix and passes afterward; both browser scenarios, 8 visibility units and UI typecheck/build pass. The independent mini-review found zero actionable issues. Remote CI was pending at the explicitly requested admin merge.
## Summary
Follow-up to #726 implementing the presentation explicitly reviewed and
approved by the user:
- Use a compact **Refresh icon / Global / Project** header, without
repeating the section's Plugins title. Per the user's final request, the
Refresh button replaces the intermediate Name label and spins during
loading and refresh.
- Keep each plugin to a compact name and two scoped switches.
- Remove the general description, inline status/source commentary,
configuration-path footer and success commentary.
- Show plugin details only in the name's hover/focus tooltip.
- Preserve automatic refresh through native events, renderer
reconnection and visible demand, plus focus handling and
unavailable-scope accessibility.
- Reuse the existing localized Refresh label and document the minimal UI
convention.
## Validation
- French minimal rendered preview reviewed by the user, followed by
their explicit request to restore the animated Refresh button in place
of Name.
- Rebased the isolated follow-up commit onto current `dev`.
- UI typecheck: passed with the final Refresh button restored.
- Real-component browser suite: **8 passed** with the final Refresh
button restored, covering manual refresh and its busy animation/disabled
state, scoped switches, disabled Project, hover/focus details, compact
long names, mutation focus, disposal and demand-driven refresh.
- `git diff --check upstream/dev...HEAD`: passed.
The user explicitly requested creation of this follow-up PR and an admin
squash merge without waiting for CI.
Display HTML and JSX tags literally in user messages, pasted-text disclosures and user timeline previews while keeping existing assistant HTML rendering. Preserve stored prompt text, Markdown formatting and code entity spellings, and isolate literal render requests and caches from older sanitized HTML entries.
Escape both HTML tokens and Marked raw-region text tokens so malformed source remains visible text. The first independent gatekeeper pass identified the raw-region bypass; it was corrected and covered by unit/browser regressions. The second independent pass found zero findings after additional raw-region variant checks.
Fifteen Markdown tests, two focused browser scenarios, the existing held-tool-scroller regression, UI typecheck/build and an isolated historical-source renderer comparison passed. The tested assistant HTML DOM matches v0.19.0; user rendering intentionally differs because v0.19.0 also interpreted user tags. Remote CI was still in progress at the explicitly requested admin merge.
## Summary
- Add narrow CodeNomad routes for native OpenCode V2 plugin inventory
and activation-rule mutations.
- Present one row per user/configured plugin with exactly two compact
**Global** and **Project** switches, sharing Yolo/MCP switch geometry.
Builtins are hidden; exact configured disabled IDs remain available.
- Keep complete names, source paths, failures and configuration targets
readable on narrow keyboard/touch layouts. Retain focused rows across
refreshes and guard repeated pending activation without removing
keyboard focus.
- Provide translated feedback in all ten locales and suppress stale
feedback after the owning surface is disposed.
## Authority and refresh behavior
- Discover roots through the authenticated daemon's `config.get`, after
native-location ownership and connection-generation checks.
- Append only exact activation rules while preserving JSONC comments,
source options, unknown keys, formatting, BOM and native permissions.
Bound reads, check optimistic conflicts, serialize by write target and
use atomic replacement with nonce-owned locks.
- Require proven raw/normalized alignment before acknowledging a no-op.
Watcher lag cannot report success for a rule that is no longer saved on
disk.
- Account for inherited `.opencode` precedence by choosing a
higher-precedence target in the active project location; preserve
ancestor files and reject an escaping fallback target.
- Use native WSL filesystem operations. Retain canonical invalidation
and one trailing reconciliation when host/native cache records converge.
- Cache display snapshots by instance/worktree, share them across
sessions in that worktree, and refresh only on visible demand. Global
writes invalidate sibling snapshots without background reads.
## Compatibility
The current server/UI/bundled-plugin dependency pin and recommended
runtime are **2.0.16**, aligned with `dev`. The demonstrated technical
minimum remains **2.0.7**. Activation writes use the narrow local JSONC
operation rather than a runtime-specific write endpoint.
## Validation status and provenance
Final reviewed head: **`5204d97694ca8ced954bddc9cc94ea464e46119d`**,
aligned with `dev@9d7ea5d6`. Both independent resumed review loops
reached **ZERO actionable findings**: UX R6 and quality/optimization R5.
Local validation on the final head: **100 plugin/server/cache/WSL tests
passed**, **eight real-component browser regressions passed**, **14
restoration/metadata integration tests passed**, server/UI typechecks
and UI production build passed. Translation keys/placeholders match
across all ten locales. The current-dev baseline and PR browser
comparison passed the same 34 shared cases with one optional native
Electron skip; detailed revision provenance is in the final review
comment.
**CI qualification is excluded at the user's explicit request.** No
final CI success is claimed, and CI completion is not being awaited.
The earlier head `38845060` failed typechecking because `noticeId` was
undeclared; the earlier historical UX R4 zero-finding claim was also
incorrect and has been [explicitly
corrected](https://github.com/NeuralNomadsAI/CodeNomad/pull/726#issuecomment-5816956417).
Historical test results and the installer built from `bd31dcd0` are not
validation or artifacts of the final corrected head. See the final
review comment for completed counts, review evidence and revision
boundaries. The PR remains open.
## Scope note
Implemented independently; no code was copied from PR #593.
This separate V2 implementation supersedes PR #593.
Bound retained transcript and derived render data with byte-aware inactive-session eviction and bounded message/tool projections, while keeping active, live and interrupted conversations protected. Preserve authoritative native pagination and restoration after eviction, including saved windows and staged undo.
Release actual Solid-store payload references and owned indexes instead of merely dropping accounting entries. Keep visibility pins stable across catalogue refreshes. Drain queued rotation and authoritative resync before idle reducer retirement, and preserve request revision fences so stale history cannot resurrect cancelled or reverted content.
Retain complete source access through lazy copy and bounded permission diff review. Fence task-history traversal and every asynchronous clipboard fallback by owner activity/cancellation, reject uncommitted pages, publish reactive content-part selection changes, and keep body/IO copy controls pointer-accessible under the real desktop stylesheet.
Repeated independent reviews reached zero actionable findings for memory/navigation and renderers/copy. Add store, authority, clipboard and real-component browser regressions covering retention, idle races, undo restoration, live text appends, nested copy cancellation, full diff approval recovery and untruncated content access with bounded DOM. Final candidate d086181fe8b36767ddd1a881b0bfdb3b2f40b517 passed GitHub validation run 36055529453, including native runtime/pruning matrices and Electron/Tauri builds across enabled platforms.
Use one Attach file action for native device selection and retain project-scoped @ references in the active session worktree. Remove the duplicate upload entry and composer server browser, document the outside-project scope change, and translate attachment origins and feedback across all locales.
Share serialized, bounded byte ingestion across picker, drop and clipboard. Fence open pickers and late reads across session/worktree/lifecycle changes, preserve edits and newer selections without stealing focus, release rejected-read budgets, and restore failed custom-command drafts by attachment identity. Validate project directories through existing workspace ownership before filesystem listing/search.
Cover the behavior with 20 attachment and 11 session-aside browser scenarios, attachment/submission/persistence units, server budget/proxy/ownership regressions, and isolated native Windows picker fixtures. Three independent review passes corrected five P2 findings and ended at zero; the final merged-head review confirmed that result. UI checks/build, Tauri release build and native picker smoke passed. Remote CI was still in progress at the explicitly requested admin merge.
Keep the colored connection dot visible when the message header becomes narrow. Compact density rules now hide only the status text, preserving connected, connecting and disconnected/error feedback. Reuse translated labels for accessible image names and hover tooltips in dot-only mode.
Independent exact-head gatekeeper review passed with zero actionable findings. Seven existing header browser tests, UI typecheck and production build passed. The real InstanceShell with full styles was checked across 72 locale/state/resize combinations, including 320px and RTL, with unobscured 8px dots and accessible names verified independently. Global CI was still running at the explicitly requested admin merge.
Match OpenCode's TUI by interrupting only the selected session with resume:true. The previous Stop/double-Escape action interrupted active descendants in parallel; a background child's completion notification could wake the parent after its interruption had already settled, producing new model activity after Stop.
Keep background children independently owned and directly interruptible when selected. Native control/steering input retains TUI resume semantics rather than introducing a separate CodeNomad cancellation policy.
Cover selected parent/child scope in store tests and both gestures through real Chromium composer and keyboard handlers using the generated native client. Include an isolated native fixture with a temporary HOME/database, private server and loopback provider that reproduces the cascade restart and verifies selected-session interruption. UI typecheck, production build and both browser regressions passed on the reviewed branch; full-CI failure triage is documented in the PR.
Persist explicit model selection through native switchModel during active and compacting execution. Previously those choices were local-only and could be replaced by a later authoritative session refresh.
Treat historical assistant model/agent metadata as fallback for missing selection fields, rather than overwriting the current selection on transcript hydration. Preserve choices made before or during the history request and avoid unnecessary default-model lookup for an existing choice.
Order explicit model and agent selections with the existing per-session admission queue. The gatekeeper reproduced an older prompt waiting on instruction synchronization rewriting its captured model after a successful newer selection. Queueing the complete selection, including its optimistic snapshot and rollback, ensures earlier prompt setup finishes first and later prompts use the selected context.
Treat model-selection SSE events as invalidations because their FIFO echoes can lag successful HTTP writes. Reconcile current native state through coalesced, bounded reads on the admission queue, with client/generation/selection fences and retained display on read failure. No sticky local override blocks later TUI or other-window choices.
Preserve pending optimistic choices in catalog merges and publish a fresh model reference on native confirmation. This fences native catalog snapshots captured during the write, including those arriving before authoritative event reconciliation.
Apply the same pre-request snapshot and publication merge to search, incremental catalog pages and restored-chain hydration, preserving selections introduced or confirmed while those reads were pending.
Validated 155 targeted store tests, the real Chromium session-search regression, UI typecheck, production UI build and isolated native OpenCode 2.0.16 active selection behavior. Regression coverage includes working/compacting persistence and rollback, transcript-load race orders, pending instruction/model/prompt/agent requests, delayed native selection echoes, external choices, rapid changes, rejected choices, reconciliation ownership and root/search/page/restoration catalog races. CI failure triage and clean-base reproduction evidence are recorded in the PR.
