48 Commits

Include renames

Author	SHA1	Message	Date
Jinwoo Hong	9fbdfc592c	refactor(mobile): generate the terminal WebView document from typed modules (OTA phase C, C7.1) (#21804) ... * test(mobile): pin the terminal WebView document byte for byte The document is already pinned as a digest, which says whether the emitted bytes moved and nothing about where. C7.1 moves the hand-written script inside it into modules the web page can import and rebuilds the document from them, and the claim that has to hold through every one of those commits is that the native screen kept the document it had. A digest cannot be the instrument for that: it fails as two hexadecimal strings. So the document is also committed as itself. The fixture is generated by `scripts/build-terminal-document-fixture.mjs`, never pasted, and the test rebuilds the comparison through that script's own substitution rather than restating it, so a fixture written by one rule and read by another cannot agree with itself. The generated xterm engine is stored as two placeholders. It is already covered by the digest test, postinstall regenerates it from whatever xterm the lockfile holds, and inlining it would put 612 KiB of vendored bytes into the file whose job is to isolate hand-written changes. Two further cases keep that from becoming a hole: the placeholders must each appear exactly once and the engine must not appear at all, and the restored document must equal the real one. Regenerating the fixture is a review event. It is only correct when the emitted document was meant to change, and the diff in that commit is the evidence. Red-first: flipping one character inside a comment in `write-queue.ts` fails both identity cases with a one-line diff naming the comment, where the digest test reports a hash. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * test(mobile): compare two terminal documents as programs, not as bytes The C7.1 flip commit moves the document's 57 reassigned variables onto a scope object, because a variable assigned across ES modules is a syntax error, and every read and write of them gains a qualifier. The ruling asks that the review of that commit be a test rather than a 515-line read. This is that test's instrument. It cannot be a byte comparison. Once the script's source is modules, `oxfmt` owns its style, and the repository's style has no semicolons where the hand-written document has one on nearly every line. A byte diff would therefore be dominated by changes that are not the refactor, which is the opposite of what the reviewer needs. So the comparison is over tokens: semicolons are excluded for the same reason they moved, comments never reach the stream, and one difference is allowed — `name` becoming `<qualifier>.name`, three tokens for one — which it counts and reports. It is stricter than "it still runs": a reordered statement, a changed literal, a dropped operator, a renamed local and a qualifier under the wrong object name all diverge, each reported with the token index and both sides. Acorn carries `value` on its tokens but does not declare it, so the field is read through a narrowing check rather than asserted onto the declared type. Red-first, by mutation: dropping the qualifier-name check fails the case that names it; removing the leftover-token check fails the dropped- and added-statement cases; treating semicolons as significant fails the three cases that depend on ignoring them. The acceptance case runs on the real 2,758-line script rather than on a fixture, so the instrument is known to survive everything the document actually contains. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * test(mobile): count each normalisation the move makes, separately Measured while extracting the first group: the document's ES5 style is not a style this repository's own rules permit. `curly` braces 279 brace-less if/else/for/while bodies, `no-unused-vars` unbinds 38 catch clauses, and 446 `var` declarators become `const`, `let` or a scope field. Those rewrites land before the qualifier is considered at all, so "the qualifier and nothing else" was never reachable once the source is a linted module. The comparison now allows exactly four classes and counts each on its own: a reference that gained the qualifier, a declaration that moved onto the scope object, a `var` that only changed keyword, a body that gained braces, and a catch clause that lost its binding. Separate counters rather than a total, because the flip commit pins each number and a total would let one class absorb another — which is the drift the pin exists to catch. The two `var` classes partition the 446, and the qualifier's 641 sites partition into references that kept their declaration and declarations that moved. Two ordering facts the cases pin. The catch rule is tried before the brace rule, or the inserted-brace rule eats the `{` that follows `catch` and the streams never resynchronise. A body braced at the very end leaves its closing brace after the baseline has run out, so trailing closes are absorbed after the walk rather than reported as a length difference. Everything outside the four classes still refuses with the token index and both sides: a changed literal, a dropped operator, a reordered pair, a renamed local, a qualifier under another object's name, a brace opened and never closed, and a brace closed where none was opened. Red-first, by mutation: disabling the catch rule, disabling the trailing-brace absorption, folding scope-field declarations into plain references, and not counting brace insertions each fail exactly the case that covers them. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): make the mouse-report cell a module the page can import The first of the twelve groups the document already names. `*-injected.ts` has been splicing JS strings into the document for a while, and tests evaluate those strings, so the one-source-two-consumers shape is already there; what is missing is that a string cannot be imported by the web page, typechecked, or linted. This turns one of them into a module and adds the generator that puts it back into the document. The generator is a transform, not a bundle: a bundler orders its output by the dependency graph, and the document's order is part of what the equivalence test holds fixed. Imports are dropped rather than resolved, because inside the document every name is already in scope — that is what the single IIFE means — and `document-externals.ts` declares the names whose groups have not moved yet and emits nothing at all. esbuild prints an ESM module's exports as a trailing block, so that block is dropped whole rather than by its keyword; leaving the keyword behind would put a bare block statement in the document. Both sides of the comparison now go through that same printer before being read. Otherwise every choice the printer makes — semicolons, property shorthand, quote style — reads as a difference in the program when it is a difference in who typed it, and each would need its own rule. A script that does not parse is reported as a refusal naming its side, not thrown. `let` is contextual outside strict mode, so acorn reports it as a name and not as a keyword; without that the var-to-let rewrite the linter performs would be refused on every reassigned local. The group's counts are pinned exactly: nine references gained the qualifier (`term` seven times, `panX` and `panY` once each), nine locals became `const` or `let`, thirteen one-statement `if` bodies gained braces, no declaration moved onto the scope object and no catch clause lost a binding. The document is untouched, so the byte pin from 3006d8dfdf is still green. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): make the query-reply gate a module the page can import The second of the twelve groups, and the one that corrects the scope table's membership rule. `terminalDataRepliesEnabled` is written from four places, so the whole-script census counted it among the 57 variables that cannot stay free across modules. All four writes are in this group. Once the script is modules, a variable written only inside the module that declares it is that module's own state, not the document's, and it stays a `let` there. So the scope object holds what crosses a module boundary, and the 57 is an upper bound rather than the answer; the qualifier count the flip commit pins will be lower than the 641 measured over the single scope, and by how much is a function of where the boundaries fall. Two references do cross here and are qualified: the write-queue generation this group compares against, and the observer-disposal list it pushes onto. Counts pinned: two qualified references, one `var` to `let`, two one-statement `if` bodies braced, both `catch (e) {}` clauses unbound, no declaration moved. The document is untouched, so the byte pin is still green. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): make reflow a module, and give the generator its own tests The third group, and the defect it found: esbuild wraps a long import list across lines, and the generator was skipping only the first of them, which left the remaining names loose in the emitted script. The document did not parse, and the equivalence check said so by name rather than throwing — which is what that refusal path was added for. Both lists, import and export, are now skipped to their closer instead of by their first line. The generator's own tests cover what the per-group comparisons cannot say on their own: an export is unmarked and indented into the document scope, a one-line import is dropped, a wrapped import is dropped whole, the trailing export block esbuild prints is dropped rather than left as a bare block statement, and types are erased without touching the program. Reflow's counts: eleven qualified references — the terminal ten times and the settled row count once — six locals that became `const`, and the two early returns braced. The row count is written from three groups, so unlike the query-reply flag it is the document's state rather than one module's. The document is untouched, so the byte pin is still green. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): make the keyboard-avoidance metrics a module The fourth group, and the first that needed a non-null assertion. `lineHasVisibleContent` reads the terminal's column count with no guard of its own; the guard is in `computeContentBottomRow`, which is its only caller. Adding a guard would change the program, and optional chaining would change what happens when there is no terminal — the document throws there today. TypeScript erases a non-null assertion, so the emitted script is unchanged and the invariant is written down where the reader needs it. Reflow now imports the metrics call from this module rather than declaring it an external, which is the shape every group takes as its neighbours arrive. Counts: fourteen qualified references, nine locals rebound, ten one-statement bodies braced, and the two `catch (e) {}` clauses — the row scan and the alternate-screen probe — unbound. The scope table's rule is stated more precisely with it: a variable is this module's own only when the group both declares and assigns it. While the rest of the document is still strings, one the main slice declares stays shared even if every use is in one group, because emitting a second declaration beside the one the slice still carries would not be the same program. The document is untouched, so the byte pin is still green. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): make WebGL loss recovery a module The fifth group, and the first carrying a top-level statement rather than only declarations: the visibility listener it registers. In the document that runs when the IIFE reaches it; as a module it runs on import, which is the same single registration. The context-loss listener disposes the addon it is registered on, so it cannot run before that addon exists, but the assignment is to a `let` a closure captures and TypeScript will not carry the narrowing across it. A non-null assertion, erased by the compiler, keeps the emitted script identical and puts the invariant where the reader is. Counts: twenty-three qualified references across the terminal, the addon, its retry timer and the theme the host last sent; three locals rebound; twelve one-statement bodies braced; five of the six catch clauses unbound, the sixth keeping its binding because the attach failure reads the error into its diagnostic. The document is untouched, so the byte pin is still green. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): make indirect-pointer scroll a module, and count a fifth class The sixth group found a rule the four classes do not cover, so I measured the whole script rather than meeting them one at a time: linting all 2,757 lines as a module trips `curly` 279 times and `no-unused-vars` 38, both already counted, and then five further rules at 23 sites — `prefer-number-properties` 17, `prefer-includes` 2, `no-useless-escape` 2, `prefer-exponentiation-operator` 1 and `no-unused-expressions` 1. Seventeen of those 23 are one rewrite: a global numeric function moved onto `Number`. It has the same token shape as the qualifier, so it is counted as its own class rather than folded into anything, and only the four numeric globals are admitted — anything else appearing under `Number` is refused, which a case pins. Every site is already behind a `typeof … === 'number'` check or is parsing a string, so the two forms are the same test. The remaining six sites are each a different shape and too few to be worth matching; they will surface as refusals in whichever group carries them, and I will report each rather than widen this. The scroll accumulator is the first declaration to move onto the scope: it is declared in this group but a touch scroll in another slice resets it, so the `var` becomes an assignment to the shared field and the class that exists for exactly that counts one. Counts: five qualified references, one declaration moved, four locals rebound, eight bodies braced, one `Number` rewrite. The document is untouched, so the byte pin is still green. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): extract the terminal surface-swap group into a module The seventh named group. `surface` and the uncommitted terminal are read by other slices, so both move onto the scope; the two committed handles and the pending surface are declared and assigned only here and stay module locals. Counts: qualified 7, scope declarations 1, rebindings 4, braced bodies 2, unbound catches 2, number properties 0. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * feat(mobile): substitute build-time constants into the emitted document The document's script text is not all hand-written: parts of it are template literals interpolating real values, starting with the theme background. A module cannot interpolate and still be the same program, so the generator now derives an esbuild `define` from `document-constants.ts` and substitutes after the import lines are dropped, when the names are free again. The page imports the very same bindings, so there is one source either way. The fixture script's TypeScript loader moves beside it rather than being written twice. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): extract the terminal theme group into a module The eighth named group, and the first parameterised one: its background fallback comes from the mobile theme through `document-constants.ts`. Two sites carry a line-scoped lint disable rather than the rewrite the rule asks for: `indexOf(',') >= 0` and `Math.pow`. Both rewrites are outside every normalisation class the equivalence instrument counts, so taking them would change the program the native document carries, which is the one thing this branch holds fixed. The reason is on the disable line. Counts: qualified 12, scope declarations 0, rebindings 28, braced bodies 13, unbound catches 0, number properties 9. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): extract the terminal path-tap group into a module The ninth named group, and a pure query: it reads no shared state, so it has no qualifier sites at all. Two things this group forced. The generator now drops lint directive lines before the transform, because a directive inside an expression makes esbuild parenthesise that expression to keep the comment where it was, and those parentheses are tokens the document does not have. And the two regexes keep their `no-useless-escape` escapes behind a line-scoped disable, for the same reason the theme group keeps `Math.pow`. One name the document declares twice in one function stays `var`. Two block-scoped declarations would be two bindings where the document has one, and esbuild renames the inner one to say so. Counts: qualified 0, scope declarations 0, rebindings 31, braced bodies 20, unbound catches 0, number properties 2. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): extract the terminal tap-dispatch group into a module The tenth named group, and the heaviest reader of shared state: the selection, its elements, its thresholds and both press origins are all declared by the overlay slice, which is still document text, so all of them move onto the scope with their declarations left where they are. Counts: qualified 49, scope declarations 0, rebindings 15, braced bodies 11, unbound catches 0, number properties 0. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): extract the terminal mouse-click-drag group into a module The eleventh named group. The escape byte and both SGR mouse modes join the scope from the runtime slice; the gesture itself is declared here and never read outside, so it stays a module local. Counts: qualified 17, scope declarations 0, rebindings 22, braced bodies 27, unbound catches 1, number properties 0. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): extract the terminal url-tap group into three modules The twelfth and last named group, and the second parameterised one: both candidate patterns and the length bound come through `document-constants.ts`. Three modules rather than one. At 303 lines it was over the file cap, and the document's own order interleaves the OSC 8 lookup with the file-URL parsing, so the split follows that order and the group's text is the three emissions joined. The test does the joining. Note for a later lane: `terminal-webview-url-tap.ts` and `terminal-file-url-tap.ts` already hold TypeScript twins of some of this, written for the React Native side and not identical to what the document carries. Collapsing the two is a behaviour change and does not belong in a branch whose whole claim is that the document did not move. Counts: qualified 10, scope declarations 0, rebindings 41, braced bodies 25, unbound catches 6, number properties 4. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): extract the mouse-mode DECSET scan slice into a module The first of the thirteen inline slices. Both control-sequence introducers, the straddling scan tail and all three mode fields are declared by the runtime-state slice, which is still document text, so they move onto the scope with their declarations left where they are. Counts: qualified 20, scope declarations 0, rebindings 10, braced bodies 9, unbound catches 0, number properties 0. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): extract the terminal message-bridge slice into a module The script and the document end in the same slice, so the slice splits in two at the point where the IIFE closes: the script half becomes a module, the document half stays text. The byte pin proves the join is unchanged. The second catch keeps its binding: it names the error and reports it. Counts: qualified 1, scope declarations 0, rebindings 1, braced bodies 0, unbound catches 1, number properties 0. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): give the document close its own slice file The previous commit put two exports in one slice file, which the slice-count guard reads as a mismatch: it derives the slice list from the composer's imports and cross-checks it against the composed entries, one per file. Five suites failed to load. Splitting the file rather than the constant is the better shape anyway. The file was called `message-bridge-and-document-close` because it carried two concerns; now each has its own. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): extract the terminal term-observers slice into modules This slice interpolates the already-extracted keyboard-avoidance group between its own two halves, so its text is three emissions joined in that order and the test does the joining. A sixth normalisation class, measured here rather than assumed: the printer writes `{ name: name }` back as shorthand, and qualifying the value makes the property name unavoidable again, so one baseline token faces four. It is counted on its own like the others, with its own acceptance case in the instrument's test, and every existing group's pin now carries a zero for it. Counts: qualified 36, scope declarations 1, rebindings 12, braced bodies 12, unbound catches 6, number properties 0, shorthand properties 4. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): extract the selection-state-and-eviction slice into a module The slice that declares most of the shared selection state: every threshold, every overlay element and the selection itself, twenty-two scope declarations in one place. The eviction counter is declared and assigned only here, so it stays a module local. Counts: qualified 12, scope declarations 22, rebindings 2, braced bodies 3, unbound catches 0, number properties 0, shorthand properties 0. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): extract the smooth-scroll and cell-geometry slice Two modules, not one: the slice carries the normal-buffer smooth scroll and then the cell-to-pixel geometry, and the split follows that order so the group's text is the two emissions joined. Four names stop being externals and become real imports. Counts: qualified 39, scope declarations 0, rebindings 15, braced bodies 16, unbound catches 0, number properties 0, shorthand properties 0. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): extract the terminal write-queue slice into a module The slice also carries `disposeTermObservers` and `extractMouseModeScanTail`, which belong to other concerns but sit here because emitted-document order pins them here; four names stop being externals as a result. The observer disposal keeps its guard-as-expression form behind a line-scoped disable: the rewrite the rule asks for is outside every counted class. Counts: qualified 50, scope declarations 0, rebindings 11, braced bodies 10, unbound catches 1, number properties 0, shorthand properties 0. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): extract the terminal fit-scale slice into a module The slice opens with the already-extracted theme group, so its text is two emissions joined. Four more names stop being externals. Counts: qualified 47, scope declarations 0, rebindings 47, braced bodies 20, unbound catches 0, number properties 9, shorthand properties 0. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): extract the terminal init-and-write slice into a module The slice opens with the already-extracted webgl-recovery group, so its text is two emissions joined. init() resets almost every field the document shares, which makes this the densest qualifier site in the script. The caret options were interpolated from the theme module, so they join `document-constants.ts` as four exports: a substitution is keyed by name, not by property path. One local the document declares and never reads keeps a line-scoped `no-unused-vars` disable. Removing it would be a different program, which is the one thing this branch does not do. Counts: qualified 83, scope declarations 0, rebindings 11, braced bodies 18, unbound catches 7, number properties 0, shorthand properties 0. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): extract the runtime-state and text-scaling slice The document's declaration block, where almost everything it shares is declared, with the query-reply and surface-swap groups interpolated inside it. Three modules: the two declarations that come before the groups, the text scaling, and the viewport transform with the scroll indicator. Seven more names stop being externals. Two things this slice forced. The scope-declaration rule now counts each declarator of one `var`, because `var panX = 0, panY = 0` becomes two assignments onto the scope. It has its own acceptance case in the instrument's test. The two halves are compared against their own text rather than as one joined program. The declaration the slice opens with is shadowed by a parameter inside one of the interpolated groups, and printing the baseline as one program renames that parameter; qualifying the outer name removes the shadow, so the rename has nothing to correspond to. Splitting the slice on the group constants compares like with like, and those groups have their own tests. Build-time constants are now substituted textually rather than through an esbuild `define`: a `define` whose value is an object or an array is injected as a helper binding instead of being inlined. Counts, head: scope declarations 2. Tail: qualified 31, scope declarations 38, rebindings 25, braced bodies 13, unbound catches 1. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * style(mobile): format the two test files the last commit left unformatted Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): extract the mouse-report and scroll-routing slice Two modules around the already-extracted mouse-report-cell group: the viewport cell lookup that precedes it, and the mouse input encoding and scroll routing that follow. Eight more names stop being externals, which leaves ten. Counts: qualified 49, scope declarations 0, rebindings 49, braced bodies 42, unbound catches 3, number properties 0, shorthand properties 0. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): extract the host-message-router slice into modules Two modules after the already-extracted reflow group: the postMessage bridge with the engine error reporting that rides on it, and the router itself. `notify`, `handleMsg` and `reportEngineError` stop being externals, which leaves seven. The catch binding handed to the error reporter keeps a cast: a catch variable is `unknown` under strict mode, and the reporter reads only `message` before falling back to `String()`. The reason is on the line. Counts: qualified 48, scope declarations 0, rebindings 20, braced bodies 12, unbound catches 2, number properties 0, shorthand properties 0. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): extract the selection-overlay slice into modules Two modules after the already-extracted path-tap and url-tap groups: the selection range with the xterm mirror, and the overlay positioning with the edge scroll. Six more names stop being externals, which leaves one. Counts: qualified 77, scope declarations 0, rebindings 96, braced bodies 63, unbound catches 9, number properties 6, shorthand properties 0. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): extract the surface-touch-gestures slice into modules The last of the thirteen slices. Two modules after the three already-extracted groups: the selection menu's buttons, and the touch gestures with the pinch and the momentum scroll. `attachSurfaceEventHandlers` was the last external, so `document-externals.ts` is gone: every name the document uses now resolves to a module. The instrument reads both sides strict. A loose script has to defend Annex B's block-scoped function declarations, and the printer does that by hoisting a `var` and renaming the function, so one side carried a rename the other could not. Neither name escapes its block, so the two readings agree on behaviour and only the strict one can be compared. It has its own acceptance case. Counts: qualified 104, scope declarations 1, rebindings 69, braced bodies 57, unbound catches 2, number properties 2, shorthand properties 0. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): extract the document's opening declarations into a module The document shell carried the IIFE opener and the eight declarations inside it, so it splits the way the message-bridge slice did: the shell keeps the HTML and the opener, a new slice file holds the declarations, and the byte pin proves the join is unchanged. With this every line of the document's script has a module behind it. Counts: qualified 3, scope declarations 8, rebindings 0, braced bodies 0, unbound catches 0, number properties 0, shorthand properties 0. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * test(mobile): pin the whole document script against the modules Every line of the script now has a module behind it, so the whole thing can be compared at once. This is the review of the move, as one number per class: qualifier 609 references + 73 declarations = 682 sites var rebindings 373, the document's 446 declarators less those 73 curly braces 279, the number measured before any of this started unbound catches 36 of 38; two name their error and report it Number properties 17, also measured up front shorthand properties 4, two SGR flags written twice each unshadowed names 7 A seventh class was needed and is counted like the others: a binding that shadowed a document variable stops being a shadow once that variable moves onto the scope, so the printer stops disambiguating it. It has its own acceptance case. The module order lives in one file that both this test and the generator read, so neither can drift from the other. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * style(mobile): keep only the lint directives that do something Seventeen of the disables were inert: `typescript/no-non-null-assertion` is not enabled here, and a directive naming two rules on one line is not parsed at all, so the one rule that did apply was being ignored too. The changed-code quality gate reports an inert directive as a finding. The two that matter are back, one rule per line: the guard-as-expression in the observer disposal, and the local the document declares and never reads. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * feat(mobile): generate the terminal document from its modules The WebView document is no longer a hand-written IIFE pasted into a template string. `scripts/build-terminal-document-script.mjs` reads `document-scope.ts` and the 36 modules under `src/terminal/document/` in document order, strips their imports, exports and line-scoped lint directives, substitutes the `document-constants.ts` exports textually, reprints each with esbuild and wraps the result in one IIFE. `terminal-webview-html.ts` composes the shell, that generated script and the close fragment. The artifact is gitignored and built by postinstall, like the two engine artifacts. The emitted document is token-equivalent to the old one under eight counted normalisation classes, each pinned as an exact number in `document/terminal-document-flip.test.ts` against the pre-flip text: qualifiedReferences 609 scopeFieldDeclarations 73 rebindings 373 bracedBodies 279 unboundCatches 36 numberProperties 17 shorthandProperties 4 unshadowedNames 7 Any other difference fails with the token index and both sides. The second case pins that the new document adds the scope object and nothing else. Ruling 17: the behavioural tests now grep the generated document through `XTERM_HTML`, never a module source, so every assertion still speaks about what the WebView runs. Every assertion stays and the `expect` count per file is unchanged: scroll-routing 95, text-zoom 59, engine 49, url-tap 33, reflow 22, keyboard-avoidance 18, query-reply 14. One control per file was run by deleting the module line the updated pattern guards; all seven red, and the tree restores green. Pattern changes, old -> new. terminal-webview-scroll-routing.test.ts var deltaY = ts.lastY - y; -> const deltaY = ts.lastY - y; smoothScrollOffsetY -= deltaY; -> scope.smoothScrollOffsetY -= deltaY; var lines = Math.trunc(-smoothScrollOffsetY / effectiveCellH); -> const lines = Math.trunc(-scope.smoothScrollOffsetY / effectiveCellH); 'touchmove' single-quoted, one line -> "touchmove" double-quoted, printer line break }, { capture: true, passive: false }); -> { capture: true, passive: false } function momentumStep() -> let momentumStep = function() pendingNormalScrollDeltaY += deltaY; -> scope.pendingNormalScrollDeltaY += deltaY; if (normalScrollFrameId !== null) return true; -> if (scope.normalScrollFrameId !== null) { normalScrollFrameId = requestAnimationFrame( -> scope.normalScrollFrameId = requestAnimationFrame( pendingNormalScrollDeltaY = 0; -> scope.pendingNormalScrollDeltaY = 0; cancelAnimationFrame(normalScrollFrameId); -> cancelAnimationFrame(scope.normalScrollFrameId); var writeQueueHead = 0; -> scope.writeQueueHead = 0; writeQueueHead++; -> scope.writeQueueHead++; writeQueue = writeQueue.slice(writeQueueHead); -> scope.writeQueue = scope.writeQueue.slice(scope.writeQueueHead); surface.style.transform = 'translate(' + panX -> scope.surface.style.transform = "translate(" + scope.panX getVisualPanY() + 'px) scale(' -> getVisualPanY() + "px) scale(" var FRICTION = 0.972; -> const FRICTION = 0.972; var MIN_VEL = 0.012; -> const MIN_VEL = 0.012; edgeScrollDir = dir; -> scope.edgeScrollDir = dir; term.scrollLines(edgeScrollDir); -> scope.term.scrollLines(scope.edgeScrollDir); // Latching document-level touch dispatcher -> function attachSurfaceEventHandlers( edgeScrollClientX = clientX; -> scope.edgeScrollClientX = clientX; edgeScrollClientY = clientY; -> scope.edgeScrollClientY = clientY; return mode !== 'none'; -> return mode !== "none"; var pixelX = cell.x; -> const pixelX = cell.x; var pixelY = cell.y; -> const pixelY = cell.y; ...isSafeSgrMouseCoordinate(cell.y)) return -> ...isSafeSgrMouseCoordinate(cell.y)) { ...isSafeSgrMouseCoordinate(sgrRow)) return -> ...isSafeSgrMouseCoordinate(sgrRow)) { if (mouseTrackingMode === 'x10') return pixelPress; -> if (mouseTrackingMode === "x10") { return pixelPress; if (mouseTrackingMode === 'x10') return sgrPress; -> if (mouseTrackingMode === "x10") { return sgrPress; if (mouseTrackingMode === 'x10') return press; -> if (mouseTrackingMode === "x10") { return press; if (col > 126 || row > 126) return ''; -> if (col > 126 || row > 126) { return ""; document.addEventListener('touchend' -> document.addEventListener( "touchend" }, { capture: true, passive: true }); -> { capture: true, passive: true } notifyTerminalSurfaceTap(tapCandidate.x, ...) -> notifyTerminalSurfaceTap(scope.tapCandidate.x, ...) document.addEventListener('touchstart' -> document.addEventListener( "touchstart" var clickInput = buildMouseClickInput -> const clickInput = buildMouseClickInput notify({ type: 'open-url', url: tappedUrl }); -> notify({ type: "open-url", url: tappedUrl }); notify({ type: 'terminal-input', bytes: clickInput }); -> notify({ type: "terminal-input", bytes: clickInput }); terminal-webview-text-zoom.test.ts var CLAUDE_STATUS_DOT = -> scope.CLAUDE_STATUS_DOT = var PRIVATE_MODE_SCAN_TAIL_LIMIT -> scope.PRIVATE_MODE_SCAN_TAIL_LIMIT \n\n function enqueueWrite -> \n function enqueueWrite var terminalFontFamily = -> scope.terminalFontFamily = output = terminalFontFamily; -> output = scope.terminalFontFamily; String.fromCharCode(0x23fa) -> String.fromCharCode(9210) TEXT_PRESENTATION_SELECTOR = String.fromCharCode(0xfe0e) -> scope.TEXT_PRESENTATION_SELECTOR = String.fromCharCode(65038) EMOJI_PRESENTATION_SELECTOR = String.fromCharCode(0xfe0f) -> scope.EMOJI_PRESENTATION_SELECTOR = String.fromCharCode(65039) data.replace(CLAUDE_STATUS_DOT_PATTERN, ...) -> data.replace( scope.CLAUDE_STATUS_DOT_PATTERN, scope.CLAUDE_STATUS_DOT + scope.TEXT_PRESENTATION_SELECTOR ) writeQueue.push(normalizeStatusDotPresentation(data)) -> scope.writeQueue.push(normalizeStatusDotPresentation(data)) var replayData = normalizeInitialData(initialData) -> const replayData = normalizeInitialData(initialData) } else if (msg.type === 'clear') { -> } else if (msg.type === "clear") { } else if (msg.type === 'measure') -> } else if (msg.type === "measure") statusDotPendingSelector = false -> scope.statusDotPendingSelector = false (x2) term.open(surface) -> scope.term.open(scope.surface) term.unicode.activeVersion = '11' -> scope.term.unicode.activeVersion = "11" enqueueWrite(ESC + '[0m' + replayData) -> enqueueWrite(scope.ESC + "[0m" + replayData) fontFamily: terminalFontFamily -> fontFamily: scope.terminalFontFamily fontWeight: '300' -> fontWeight: "300" fontWeightBold: '500' -> fontWeightBold: "500" terminal-webview-engine.test.ts var webglAddon = null; .. var webglRecoveryTimer = null; -> the refreshTerminalSurface()..init( block, with the scope preamble window.addEventListener('resize' -> window.addEventListener("resize" 'terminal init failed' -> "terminal init failed" 'terminal message failed' -> "terminal message failed" var everReady = false; -> scope.everReady = false; everReady = true; -> scope.everReady = true; fatal === undefined ? !everReady : !!fatal -> fatal === void 0 ? !scope.everReady : !!fatal msg.type === 'init' && !everReady -> msg.type === "init" && !scope.everReady /fatal === undefined \? !ready\b/ -> /fatal === void 0 \? !scope\.ready\b/ if (msg.type === 'ping') -> if (msg.type === "ping") notify({ type: 'pong', pingId: msg.id }) -> notify({ type: "pong", pingId: msg.id }) terminal-webview-reflow.test.ts } else if (msg.type === 'reflow') { -> } else if (msg.type === "reflow") { (x2) var MIN_FIT_COLS = 20; -> scope.MIN_FIT_COLS = 20; if (cols < MIN_FIT_COLS) return; -> if (cols < scope.MIN_FIT_COLS) { flog('measure-skip-small-width' -> flog("measure-skip-small-width" notify({ type: 'measure-result', ... }) -> notify({ type: "measure-result", ... }) var dispatch = { mode: 'idle' -> const dispatch = { mode: "idle" window.addEventListener('message' -> window.addEventListener("message" terminal-keyboard-avoidance-webview.test.ts \n // reflow() -> \n function reflow( } else if (msg.type === 'clear') { -> } else if (msg.type === "clear") { } else if (msg.type === 'measure') -> } else if (msg.type === "measure") \n var panX -> \n scope.panX TERMINAL_REFLOW_JS fragment import -> the reflow(cols, rows)..notify( slice of the document terminal-webview-query-reply.test.ts attachTerminalQueryReplyBridge(term, gen) -> attachTerminalQueryReplyBridge(scope.term, gen) (x2) term.attachCustomKeyEventHandler(function() { return false; }) -> term.attachCustomKeyEventHandler(function() { \n return false; \n }); term.textarea.readOnly = true -> term.textarea.readOnly = true; } else if (msg.type === 'clear') { -> } else if (msg.type === "clear") { } else if (msg.type === 'measure') -> } else if (msg.type === "measure") terminal-webview-url-tap.test.ts notify({ type: 'open-url', url: tappedUrl }); -> notify({ type: "open-url", url: tappedUrl }); terminal-webview-payload-hash.test.ts is the document byte pin; it moves to the generated document's digest, 730472 -> 723480 bytes. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): delete the slice constants and injected fragments The document is generated from its modules now, so the strings it used to be pasted together from are dead. Deleted: the fourteen slice constants under `terminal-webview-html/` (host-message-router, message-bridge, mouse-mode-decset-scan, mouse-report-and-scroll-routing, runtime-constants, runtime-state-and-text-scaling, selection-overlay, selection-state-and-eviction, smooth-scroll-and-cell-geometry, surface-touch-gestures, term-observers-and-mode-mirroring, terminal-fit-scale, terminal-init-and-write, write-queue) and the eleven `*-injected.ts` files. `document-shell.ts`, `document-close.ts` and `theme.ts` stay: the shell and close are still the document's HTML, and `theme.ts` is where `document-constants.ts` reads the palette from. Ruling 17, second commit. Tests that asserted the extraction mechanism itself went with it: they compared one module's emission against the slice text it was extracted from, and the flip test now pins the whole document against the whole pre-flip script with the same eight classes. Deleted, all under `document/`: fit-scale, host-message-router, keyboard-avoidance-metrics, message-bridge, mouse-click-drag, mouse-mode-decset-scan, mouse-report-and-scroll-routing, mouse-report-cell, path-tap, query-reply, reflow, runtime-constants, runtime-state, selection-overlay, selection-state-and-eviction, smooth-scroll-and-cell-geometry, surface-swap, surface-touch-gestures, tap-dispatch, term-observers, terminal-init, terminal-theme, webgl-recovery, wheel-scroll. `document/url-tap.test.ts` stays: it pins against `URL_TAP_WEBVIEW_JS`, which is neither a slice constant nor an injected file and still has a consumer. Tests that asserted behaviour through a deleted string now read the generated document. `document/generated-document-region.test-support.ts` is the one way in: `documentScopePreamble()` returns the scope object the document opens with, and `generatedDocumentModule(name)` re-emits a module and refuses unless the document carries that text verbatim, so an evaluated block is the WebView's own bytes. The two local copies of the preamble in the engine and text-zoom tests were folded into it. Moved, with every assertion kept and the `expect` count per file unchanged: terminal-webview-html/write-queue.test.ts -> document/write-queue.test.ts 34 terminal-webview-theme-injected.test.ts -> terminal-webview-theme.test.ts 14 terminal-webview-query-reply.test.ts 14 terminal-path-tap.test.ts 25 terminal-webview-url-tap.test.ts 33 terminal-keyboard-avoidance-webview.test.ts 18 terminal-webview-reflow.test.ts 22 terminal-webview-text-zoom.test.ts 59 terminal-webview-engine.test.ts 49 Pattern changes, old -> new. terminal-webview-reflow.test.ts if (!term || isAlternateBufferActive()) return; -> if (!scope.term || isAlternateBufferActive()) { term.resize(nextCols, nextRows); -> scope.term.resize(nextCols, nextRows); var wasAtBottom = buffer.viewportY >= buffer.baseY; -> const wasAtBottom = buffer.viewportY >= buffer.baseY; term.scrollToBottom(); -> scope.term.scrollToBottom(); if (nextCols === term.cols && nextRows === term.rows) return; -> if (nextCols === scope.term.cols && nextRows === scope.term.rows) { The other eight files kept their patterns; only the text they read changed, from a deleted constant to the document block. The harnesses that evaluate a block now build the document's scope object instead of declaring the vars it replaced, and hand the terminal in as `scope.term`. Controls, one per file: the module line an updated pattern guards was removed, the document rebuilt, and the test run. All red, and the tree restores green. query-reply terminalDataRepliesEnabled = true -> query-reply test, 2 failed path-tap const parsed = parsePathLineCol(...) -> path-tap test, red keyboard-avoidance-metrics contentBottomRow -> keyboard-avoidance test, 4 failed reflow scope.term.resize(nextCols, nextRows) -> reflow test, 2 failed webgl-recovery new window.WebglAddon.WebglAddon() -> engine and text-zoom tests, 4 failed osc-link-tap return parsePathLineCol(value) -> url-tap test, 1 failed terminal-theme scope.term.options.minimumContrastRatio = ... -> theme test, 4 failed write-queue scope.writeQueue[scope.writeQueueHead] = undefined -> write-queue test, 4 failed `document-scope.ts` docstrings named the slice each field belonged to; they name the owning module now. Three module comments pointed at deleted injected files and point at the modules instead. Neither changes the document: esbuild drops comments, and the byte pin is unmoved. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * test(mobile): name the right number of counted classes The flip test's title still said seven; the table it asserts has eight. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * fix(mobile): name the shape applyTerminalTheme writes through The anti-slop gate refused `loadThemeApplier(term: object)` in the theme test. `applyTerminalTheme` touches exactly two slots on the terminal it is handed, so `terminal-theme.ts` now exports that shape as `TerminalDocumentThemeTarget` and the test's parameter and both fixtures use it. The theme is optional on the way in because `applyTerminalTheme` is what writes it. No cast. The type is erased by the generator's transform, so the document is unchanged and the flip test's class table and the byte pin both still hold. Control: restoring the `object` parameter reproduces the finding at terminal-webview-theme.test.ts:35:33 and the gate exits 1; with the named type it exits 0. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): drop the dead URL-tap constant and two stale reflow guards Round 1 fixes, all three folded here. 1. `URL_TAP_WEBVIEW_JS` is gone from terminal-webview-url-tap.ts, with `document/url-tap.test.ts` deleted alongside it. The document is generated from its modules now, so that constant was a second copy of the URL-tap group with no consumer but its own tests. terminal-webview-url-tap.test.ts's resolver harness reads the document's own text instead, the path-tap, url-tap, osc-link-tap and surface-tap modules in document order through `generatedDocumentModule`, which refuses unless the document carries each verbatim. Its 33 expects all stay. One mechanism-only assertion went with the file: `document/url-tap.test.ts`'s single `compareTerminalDocumentScripts` pin of the three emissions against the constant, which the flip test's whole-document pin already covers. The file's other exports stay. The deletion surfaced a third reader. terminal-webview-scroll-routing.test.ts concatenated terminal-webview-url-tap.ts into its `source`, and its `notify({ type: 'terminal-tap' });` assertion was matching the constant's single-quoted text, not the document. The read is dropped, since nothing else in that file needed it, and the assertion is the document's form: notify({ type: 'terminal-tap' }); -> notify({ type: "terminal-tap" }); Its 95 expects stay. Leaving the read in place would let a document assertion pass against a module source, which is the hazard this lane exists to remove. 2. terminal-webview-reflow.test.ts guarded a template placeholder that no longer exists, so it could not fail: expect(XTERM_HTML).not.toContain('TERMINAL_REFLOW_JS}') -> expect(XTERM_HTML.split(reflowSource).length - 1).toBe(1) Same intent against the generated document: the reflow module's emitted text is in the document exactly once. The case is renamed to say so and the comment above it describes the generator, not the deleted template. 3. Same file, the routine assertion still passed as a substring of the qualified call; qualified as line 30 already was: term.resize(nextCols, nextRows); -> scope.term.resize(nextCols, nextRows); Its 22 expects stay. Controls, each verified to have changed the file first, all red, tree green after restore: osc-link-tap return parsePathLineCol(value) -> url-tap test, 3 failed surface-tap notify({ type: 'terminal-tap' }) -> scroll-routing, 1 failed reflow scope.term.resize(nextCols, nextRows) -> reflow test, 2 failed module order 'reflow' listed twice -> reflow test, expected 2 to be 1 Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * refactor(mobile): retire the last module concatenator and guard the order list Round 2 fixes, all five folded here. 1. Deleted terminal-webview-html-source.test-support.ts. `readTerminalWebViewHtmlSource()` had no consumers left once the behavioural tests moved to the generated document, and it was the last thing that built a document-shaped string by concatenating module sources — its filter admitted `.test-support.ts` files too, so it could have grown one. Confirmed by grep that the only occurrence of either name in the repository was its own declaration. 2. New document-module-order.test.ts asserts both directions: the non-test, non-test-support `.ts` files under `document/` are exactly `{document-scope} + TERMINAL_DOCUMENT_MODULE_ORDER + {document-constants}`, and no name is listed twice. `document-constants` is the one exception because it is never emitted: its exports are substituted into the modules that import them as literals, so the document carries its values without carrying the module. A module added here and forgotten there would be dead code that reads as live; a name left after its file goes makes the generator throw at build time rather than at review time. 3. terminal-document-flip.test.ts's docstring now carries the retirement policy from ruling 18: the test is the proof of the flip and holds only while no module changes, the first lane that must change one retires it together with `terminal-document-pre-flip-script.txt`, and the standing pin from then on is `terminal-document-identity.test.ts`, whose fixture regeneration is a review event. Comment only. 4. terminal-document-equivalence.test-support.ts said 57 reassigned variables and "Four classes and no others". It now says 73 declaration sites and eight classes, with each class's measured figure named. Two doc comments sat above the wrong declaration and were moved onto what they describe: the `NUMBER_GLOBALS` one down to that constant, and the printing one down to `significantTokens`, with `STRICT_DIRECTIVE` given its own line. 5. build-terminal-document-script.mjs substituted constants with `replaceAll(regexp, literal)`, where `$&`, `` $` ``, `$'` and `$n` in a constant's value are read as replacement patterns. The substitution is now `substituteDocumentConstants`, exported so it can be tested directly, and replaces with a function. Controls, each verified to have changed its input first, all red, tree green after restore: plant document/zz-planted-module.ts -> order guard, "+ zz-planted-module" drop 'wheel-scroll' from the order -> order guard, "+ wheel-scroll" revert to the string replacer -> 4 failed, "a $& b" became "a marker b" The `$n` case is deliberately absent from that table: the pattern has no capture group, so `$1` is already literal under either form and a case for it could not tell them apart. The document did not move. The byte golden, the digest and the flip test's class table are all unchanged. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * test(mobile): make the flip comparator refuse what it was accepting Round 2 items 6 and 7, both in the equivalence instrument. 6. `isPrinterDisambiguation` accepted any `name2` facing `name` without proving the two were the same binding, so an unrelated rename ending in a digit would have been counted rather than refused. It is replaced by `UNSHADOWED_RENAMES`, an explicit list of pre-flip name, generated name and declaring module. The whole script has one entry: `term2` -> `term` in `query-reply`, which is the `term` parameter of `attachTerminalQueryReplyBridge` and its six uses, seven sites in all. That is stated in the docstring rather than encoded as a second pin, since the flip test already pins the total. 7. Brace absorption treated every unexpected `{` as a linter-added body and absorbed any later `}` while one was outstanding, so a bare block anywhere would have been swallowed. `isBraceableHeadBody` now requires the open to be the body of `if`, `for`, `while`, `else` or `do` — walking a `)` back to its `(` and reading the keyword before it — and `matchingCloseIndex` records the index the close must appear at, so the absorbed `}` is that body's own. That check had to move ahead of the equality check. Wherever a braced body ends a block, the baseline's next token is a `}` as well, so pairing them would consume the wrong one and leave the counts right for the wrong reason. Both refusals are tested over snippets: function f() { return value2; } vs return value; -> token 6: expected name value2, generated name value let value = 1; use(value); vs { let value = 1; } use(value); -> token 0: expected name let, generated { and the braceable heads are tested one by one, `if`, `for`, `while`, `if`/`else` and `do`, so the new rule is shown to accept every shape the `curly` rule produces and not only the one the document happens to exercise. Controls: restoring the shape rule fails the first refusal case and nothing else; restoring the accept-any-brace rule fails the second and nothing else. The eight counts did not move: 609, 73, 373, 279, 36, 17, 4, 7. Splitting out `terminal-document-tokens.test-support.ts` is not cosmetic. The tightened rules put the file over the 300-line cap, and a `max-lines` disable is forbidden, so the token reader moved to its own module: that side answers what a script says, and says nothing about which differences between two of them are allowed. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb	2026-09-20 12:33:03 -04:00
Jinwoo Hong	40b2230508	test(mobile): typecheck the test files on a ratchet, and pin the reply enums where tsc looks (#21298) ... * fix(mobile): move the last six reply-enum pins where tsc looks mobile/tsconfig.json excludes *.test.ts, so a `Record<HostUnion, true>` coverage record in a schema test is never typechecked: the two that existed (SshConnectionStatus, GitHubProjectOwnerType) checked nothing, and the four closed enums beside them had only a doc citation of the host type. Each arm list moves into its schema module as hostUnionArms<Union>(), which #21269 introduced for the same reason, and each test iterates the exported list instead of holding its own copy: - SSH_CONNECTION_STATUS to SshConnectionStatus - PROJECT_OWNER_TYPE to GitHubProjectOwnerType - DETAIL_FILE_STATUS to GitHubPRFile['status'] - PUSH_TEST_REFUSAL_REASONS and PUSH_REGISTER_REFUSAL_REASONS to the refusal arms of MobilePushTestResult and MobilePushRegisterResult - SETUP_RUN_POLICIES to SetupRunPolicy openEnum's parameter widens from a non-empty tuple to `readonly string[]` so a hostUnionArms list can feed it. z.enum already accepts the same, so the tuple constraint only excluded callers zod itself takes; behaviour unchanged. Twelve mutations prove the pins: dropping one arm and adding a bogus one each fail mobile tsc in all six places. Zero goldens move, the schemas' behaviour being unchanged, and the 21 recording suites pass at the existing baseline. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * test(mobile): fix the type errors in eighteen test files Found by typechecking the tests for the first time (see the config that follows). All mechanical, none weakens a product type: - 67 `act(() => vi.advanceTimersByTime(...))` callbacks return VitestUtils where act wants void, so each becomes a block. The async ones await only a genuinely promise-returning call, so no extra microtask tick is introduced. - Four fixtures were stale against a product type that gained a required member: MobileViewState.alwaysShowDefaultBranch, PrSidebarData.checksError, the branch-compare summary's errorMessage, and SessionOptionDescriptor's transport, which #20884 added precisely so a producer could not inherit the wrong lane's rendering by omission. - `getLastConnectedAt` on the shared relay fake was typed `() => null`, which refused the timestamp two escalation suites assign to it. - Two holders used before assignment take `!`, one `advance!.kind === ...` becomes `advance?.kind`, one widened status arm takes `as const`, and the Expo notification fixture keeps `data` required because the dismissal cases assign through it. 631 test files pass, 6222 tests, unchanged. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * test(mobile): typecheck the test files, on a ratchet mobile/tsconfig.json excludes *.test.ts so Metro never compiles tests into the release bundle, and vitest transpiles without checking types. Nothing had ever typechecked a mobile test, which is why a `Record<HostUnion, true>` pin written in one proved nothing and why 144 of the 630 test files had drifted. tsconfig.test.json is that program with the tests put back, behind `typecheck:tests`. Four files stay out: they import the desktop main process or src/shared/child-process, which are written against @types/node, and this program's libs are React Native's, where setTimeout answers a number rather than a NodeJS.Timeout. Pulling that graph in reports ~280 errors about the desktop rather than about mobile; vitest runs those four under Node, which is where they belong. The CI gate is a ratchet rather than the raw typecheck, modelled on check-ts-nocheck-ratchet.mjs: 126 files still fail, so the gate freezes that set and fails when a file that checks today stops checking, or when a baseline entry starts checking and was not pruned. The list may only shrink. Why not zero: 180 of the remaining 510 errors are one seam — tests locate mocked react-native components by string name, which `ElementType` does not admit — and closing it means either 180 casts or a global JSX declaration for the mocked names. That is a design decision, not a mechanical fix, so it is left for a follow-up rather than made here. The rest are smaller clusters of the same kind: vi.fn mocks assigned into typed slots, call-arg tuple indexing, and createElement props fixtures. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * docs(mobile-recorder): correct the corpus counts and the salvage claim The oracle section still quoted the corpus as 368 scenarios and 727 goldens; it is 393 and 778, and the three replay suites report 781 tests. Each number now names the command that measures it. "No golden carries one" was the load-bearing error: 44 goldens carry a recorded `reply-salvage` today, starting with the push-test unknown-reason scenario #21176 added for exactly that purpose. The paragraph claimed the observation pins an absence when on those families it pins a recorded drop. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * test(mobile): pin the tests-typecheck ratchet's parser The gate reads tsc's output, and tsc indents the "Overload 1 of 2, ..." detail under an error. Counting those as filenames would write unparseable entries into the baseline and leave the gate unprunable, so the parser is pinned on that shape as well as on the added/stale diff. Written against the gate itself: it flagged this file before the directive it carried was removed, which is the end-to-end proof the spawn half works. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * test(mobile): await the timer advances the act() rewrite dropped Rewriting `await act(async () => vi.advanceTimersByTimeAsync(n))` into a braced body left the returned promise floating at 27 sites, so the advance was no longer ordered before the assertions that follow it. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * test(mobile): unshadow MobileHostCard's .tsx suite A wildcard `include` keeps only the higher-priority extension, so MobileHostCard.test.tsx sat outside every tsc program while MobileHostCard.test.ts existed beside it. Its one error is the same react-test-renderer seam its sibling is baselined for. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * test(mobile): census every test file into the typecheck program The ratchet diffs only files that error, so a test excluded from tsconfig.test.json or shadowed by a sibling extension left the gate silently. Every *.test.ts(x) on disk must now be in the program or named in TESTS_OUTSIDE_PROGRAM with its reason. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * fix(shared): make the enum helpers refuse the ways they can prove nothing openEnum takes a `const` T so a bare literal keeps its arms rather than widening to string. hostUnionArms blocks inference of U with NoInfer and defaults it to never, so a call that omits the host union — where the record would only pin itself — no longer compiles. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * docs(mobile): describe the census and correct the baseline count Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * test(mobile): give the push fixture cast its SAFETY rationale Widening the pre-existing cast made the changed-code gate attribute it as a new finding. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * test(mobile): build the push fixtures as typed notifications Replaces the `as unknown as` cast with Expo's own types, filling FirebaseRemoteMessage and its notification once in two builders, and passes the data payload in rather than mutating through an optional member. Typing the fixture showed one assertion comparing the scheduled content against the whole arriving content, which only held while the cast let the fixture omit the two members the presenter drops; it now names the four members the presenter forwards. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * test(mobile): keep the grouped-question advance read non-optional `advance?.kind` let an absent advance take the null-draft branch instead of failing. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * fix(mobile): run the tests-typecheck ratchet on Windows Spawns tsc's JS entry on this Node instead of the node_modules/.bin shim, which is a POSIX shell script that Windows resolves to tsc.CMD and then appends .exe to. Parsed paths are normalised to POSIX so a Windows run does not read every baseline entry as both stale and added. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * test(mobile): close the ratchet's @ts-nocheck hole and read tsc once tsc exits 0 on a @ts-nocheck file, so a baselined test could be "fixed" with one line, pruned, and never checked again; the census now names any program test file whose leading comment carries the directive. `--noEmit --listFiles` answers both questions in one pass, so the gate spawns tsc once rather than twice. Corrects the two stale counts, and states hostUnionArms' real reason for living in the schema module now that tests are typechecked. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb	2026-09-17 18:58:25 -04:00
Jinwoo Hong	341b13cf67	Restore mobile push and fix cold-start dismissals (#20068) ... * Restore mobile push for delivery validation * fix(mobile): register push task before headless startup * Add authenticated mobile push test and fix iOS release entitlements * Mock push-test transport in notification consent tests * Fix slept workspace test for structured remount result * Fix mobile notification review findings * Pad Android notification icon to prevent square cropping * fix(mobile): present visible Android data pushes in foreground * test: use deterministic clock for teardown deadline * fix(mobile): present foreground pushes through Expo public APIs * fix(mobile): check push eligibility before foreground scheduling * fix(mobile): register push from shared host connection lifecycle	2026-09-12 01:03:57 -04:00
Jinwoo Hong	e187c82678	Revert mobile push rollout pending delivery investigation (#20040)	2026-09-11 02:17:58 -04:00
Jinwoo Hong	d33354cfd2	feat(mobile): receive native push notifications from paired desktops (#19951) ... * feat(mobile): deliver native push notifications from paired desktops * fix(mobile): retry push capability probes * fix(mobile): cancel retired push capability probes * fix(mobile): ignore stale push reconciliations * fix(mobile): type capability probe at its boundary * fix(notifications): route mobile push taps to the originating pane * Require explicit mobile push-service consent on upgrade	2026-09-11 01:00:16 -04:00
Brennan BensonandMerge Sim	4b4acf26a4	fix(mobile): enable patch-free iOS text selection in native chat (#19769) ... * fix(mobile): make every native-chat text node selectable Long-press selection worked on some chat text and not others. Markdown paragraphs — the default block for agent prose — were the one block type left out when headings, quotes, code, lists and table cells gained `selectable`, and tool result output, diff rows, the unloadable-image placeholder, permission/question bodies and the send-error banner never had it at all. Selection is now set on every content Text in the chat surface, on the outermost block Text so nested inline spans inherit it. Labels inside a Pressable (option rows, tool-line headers, buttons) are deliberately left alone: selection there would swallow the tap they exist for. Extracting MobileNativeChatEmptyState keeps the view under its max-lines cap and matches desktop, where NativeChatEmptyState is already its own component. Tests render each surface and assert selection on the block that carries the prose; both files were ablated against the unfixed source (4/10 and 3/5 red) so they pin the defect rather than the current behavior. * fix(mobile): support native text range selection on iOS * fix(mobile): remove persistent assistant message controls * fix(mobile): scope patch-free text selection to chat Use the stock react-native-uitextview dependency behind an iOS adapter and opt assistant Markdown into range selection only in native chat. Preserve the existing React Native Text behavior elsewhere and remove the persistent assistant controls. --------- Co-authored-by: Merge Sim <sim@local>	2026-09-09 21:50:31 -07:00
Neil	e84042572c	Upgrade xterm to 6.1.0-beta.303 and generate addon patches ... * Upgrade xterm to 6.1.0-beta.303 and generate the addon patches Takes the current xterm beta line: xterm 287 -> 303, addon-webgl 286 -> 299, addon-serialize 287 -> 300, headless 302, the remaining addons -> 300, and the same set on mobile. All four packages stamp upstream commit d3e32b3. The reasons are upstream #6042/#6043/#6055 (a shared glyph atlas no longer garbles sibling panes on a page merge, clear, or sampler-budget overflow) and Note that core 303 is not image-addon-only over 302: it carries the buffer perf work, including the new BufferLineStringCache. addon-webgl and addon-serialize move into the patch generator -------------------------------------------------------------- Both were hand-edited minified bundles, which is what the Known Gaps section of docs/reference/xterm-patch-regeneration.md described. Both reproduce byte for byte from the pinned commit, so they are now manifest entries generated from a source patch like @xterm/xterm already was. Their sourcemaps now move with their bundles; before this they shipped maps whose offsets did not match the code beside them. The webgl patch shrinks from a 1.06 MB hand-edited bundle to a 6.6 KB source patch, because upstream took the invalidation half Orca had backported. What is left is only what upstream still lacks: the fragment-shader else branch for a v_texpage past the sampler budget, the clearTexture guard that no-ops once a merged page holds index 0, spending the merge retry budget before beginFrame latches the version it saw, and Orca's font-weight probe. The serialize source patch is byte-for-byte the same fixes as before; upstream changed nothing in that addon between 287 and 300. Generator fixes, each of which failed silently ---------------------------------------------- - `--relative` was appended after the `--` separator in CHECKOUT_DIFF_FLAGS, so git read it as a pathspec and kept repo-root-relative paths, dropping every source hunk from an addon's patch. - `git apply` run from a package subdirectory still resolves patch paths from the repo root, skips every hunk and exits 0. It now runs from the root with `--directory=<packageDir>`, and a source patch that leaves the checkout unchanged is a hard failure rather than an empty patch. - An addon's own `tsgo -p .` has empty files/include and only project references, so it emits nothing and the addon webpack then fails on a missing ./out/. The root build now runs first. - versionStampFile is optional; publish.js stamps an addon's package.json, which overlayBuildOutput never patches. - On a version bump the lockfile has no entry under the new key yet, so --write reports the gap instead of aborting mid-run. --check still fails on it. Adding the two addons pushed the generator and the Electron packaging contract test over max-lines, so the patch-text helpers move to xterm-patch-text.mjs (pure text: no checkout, no build) and the vendored-xterm assertions move out of the packaging contract into xterm-webgl-runtime-contract.test.mjs. Tests ----- Four tests asserted upstream bugs that are now fixed, not Orca behaviour: - xterm-user-scrolling-contract pinned headless and core by version string. Upstream bumps each package only when its own output changes, so headless 302 and core 303 are the same source. It now asserts they share a commit. - Five CSI 3 J assertions expected a reader stranded at the top after an erase. Upstream #6081 clears isUserScrolling there, so the erase releases them to the bottom instead. Orca's pin still lands them correctly, because its parser handler observes the erase before xterm's own handler runs. - The IME transaction test hard-coded the xterm version; it now reads the installed package, since the point is that bundle, map and version agree. - The Electron runtime contract asserted Orca's old clearModelGeneration. Shared atlas invalidation is upstream's now, so it asserts pageLayoutVersion on the resolved dependency, plus the Orca-only hunks on the patch. Verified: 66,008 unit tests, mobile's 3,863, the four WebGL atlas e2e specs, and `regenerate-xterm-patches.mjs --check` in sync on all three packages. Left alone deliberately: resetAllTerminalWebglAtlases still fans out globally even though clearTexture now self-heals siblings, and upstream #6068 (WebglAddon.dispose leaks the GL context) is still open. * Drop the two unused WebGL atlas fan-out exports resetAllTerminalWebglAtlases and presentAllTerminalPanesWithoutAtlasClear have no callers, and had none at cadfc55102 either — the last call site went in #6949, which routed reveal recovery through resetAndRefreshAllTerminalWebglAtlases instead. Only a comment in pane-manager.ts still named the first one; it now points at the live entry point. scheduleRevealPresent leaves the registry's structural type with them, though the manager method stays: terminal-visibility-resume.ts calls it directly. This is dead-code removal, not a consequence of the xterm bump. The live recovery path is unchanged. resetAndRefreshAllTerminalWebglAtlases stays, and so does the reveal-time escalation in pane-reveal-repaint.ts. Upstream 299 does make a pane-local clearTexture bump pageLayoutVersion so siblings rebuild on their next frame, which is the bug the escalation was written for, but I could not demonstrate that removing it is safe: with the escalation removed, floating-workspace-shared-glyph-atlas.spec.ts still passed headful, and it also passed with upstream's mechanism deliberately disabled (pageLayoutVersion pinned to 0 in the installed bundle, verified present in the built renderer). A guard that passes with the fix disabled cannot license removing the workaround, so the escalation stays until that spec can reproduce the garbling. Verified: pane-manager and terminal-pane suites (4,713 tests), typecheck, the headful shared-atlas spec, and the three headless WebGL specs. * Give the shared glyph atlas spec a trigger that can fail floating-workspace-shared-glyph-atlas.spec.ts guards the corruption where one terminal wiping the module-global atlas leaves sibling terminals drawing from stale texture coordinates. Both of its tests drive that through a floating panel reveal, and Orca's reveal paths escalate to a registry-wide atlas reset that repaints every pane — so the recovery under test heals the damage before the assertion runs, and the tests pass whether or not xterm propagates the invalidation at all. The new test clears the shared atlas straight through the floating manager with the panel closed, so nothing else repaints the workspace terminal, then repaints it with terminal.refresh(). That is the load-bearing detail: _updateModel skips cells whose content is unchanged, so the refresh reuses vertices baked against the pages that were just wiped, which is exactly the state the fix has to recover from. Verified as a discriminator rather than assumed. Pinning ITextureAtlas's pageLayoutVersion getter to 0 in the installed bundle, which disables the per-renderer invalidation upstream added in addon-webgl 0.20.0-beta.299, and confirming that reached the built renderer: fix intact: siblingClearIntact=true 1 passed fix disabled: siblingClearIntact=false 1 failed The failure renders the workspace terminal completely blank — stale coordinates into a wiped atlas sample nothing. The two reveal tests pass unchanged in both configurations, which is the gap this closes. * Compare shared-atlas screenshots with tolerance instead of byte equality Byte equality fails on sub-pixel antialiasing noise that leaves every glyph legible, so the headful spec flaked under xterm 303. Reuse the existing compareTerminalScreenshots helper: real stale-model corruption blanks the terminal at ~3% of pixels, twice the helper's 1.5% threshold, so the looser oracle keeps its teeth. Log the ratio so failures are diagnosable. * fix(xterm): cancel empty deferred IME compositions * test(xterm): strengthen runtime patch contracts	2026-08-30 15:14:49 -07:00
Neil	4bb9dd5b89	chore(deps): bump electron 43.4.1 and other meaningful runtime deps (#17330) ... Take the high-value desktop and mobile upgrades that fix crashes, jank, or security holes. Leave Electron 44, Lucide 1, Reanimated 4.6, Expo 56/57, and xterm betas for later. Desktop: electron 43.4.1, @tanstack/react-virtual 3.14.10, mermaid 11.17.2, ws 8.21.3, react 19.2.8, pdfjs-dist 6.3.289, vitest 4.1.11, happy-dom 20.11.8. Mobile: Expo SDK 55 patch train, react-native 0.83.10 (IME patch ported), reanimated 4.3.4, webview 13.16.2 (thread-safe decision manager; restore WebView generic default so TS 6 does not collapse props to never). Electron 43.4 dropped marginType from PrintToPDFMargins; CDP print mapping now supplies the four sides only.	2026-08-29 20:44:43 -07:00
Neil	2dfaa676d8	chore: update oxlint and oxfmt (#17150)	2026-08-29 14:13:35 -07:00
Neil	b17f60d744	build: upgrade to pnpm 12 (#17156)	2026-08-29 14:13:26 -07:00
NeilandBrennan Benson	66b599399f	fix(mobile): decide terminal preedit from the marked-text range, not a script table (#15007) ... * fix(mobile): decide terminal preedit from the marked-text range, not a script table The live terminal capture field decided what to withhold from the PTY with a Unicode-block allowlist (Hangul jamo and syllables) and held exactly one trailing code point. Kana and kanji are not in the table, so a Japanese reading streamed to the PTY one fragment at a time and was repaired afterwards with DEL bytes (#7427). A code-point table cannot work, and the counterexample is not exotic: Chinese pinyin preedit is plain ASCII, and a Japanese romaji reading is one code point on the first keystroke and three on the fourth. Preedit is a property of the FIELD, not of the characters in it, so the only signal that identifies it is the text system's marked-text range. That is what a reference terminal implementation uses on every platform it supports - `hasMarkedText` there, the input-method context's composing state elsewhere - and neither one classifies code points anywhere in the input path. So the mirror now takes the marked-text report per change and holds the whole preedit region, whatever its length or script: - Subscribe the capture field to `onChange`, not `onChangeText`; only the raw native event carries the report at all. - A reported preedit is held entire and is never committed by the settle timer, because preedit is not text yet. Explicit boundaries still flush it. - `isTerminalLiveHangulCodePoint` and its four ranges are deleted. iOS reports the range but React Native drops it before JS, so the pinned patch forwards `markedTextRange` into the change payload. It is three hunks and it compiles because the app already sets `buildReactNativeFromSource` for iOS. The same idea was proposed in #11450, which is where the patch comes from. Android has no marked-text report in React Native at all, and a Kotlin patch would not help: Android consumes the prebuilt react-android artifact, so node_modules sources are never compiled. Until the report exists there, the fallback holds the trailing non-ASCII run. It enumerates nothing, it covers kana, kanji and Hangul, and ASCII keeps its zero-latency echo - but it cannot see an ASCII preedit, so Chinese pinyin on Android still leaks its reading. Only a report fixes that. Not-tested: no physical device or emulator was available, so no real IME drove this path. Japanese, Chinese and Korean composition are covered at the model and hook level only, and the iOS patch has not been compiled. Co-authored-by: Brennan Benson <brennanb2025@users.noreply.github.com> * fix(mobile): bound the fallback hold to text the pty has not received The no-report branch walked the trailing non-ASCII run over the whole field and ignored stableLength, unlike the reported branch directly above it. So after a settle-timer commit the next keystroke re-held everything already delivered and the caller erased it with DEL and retyped it — a nine-character Cyrillic word cost a DEL per already-sent character, and for the 300ms before the re-send the held text was the only copy, so a blur or reconnect destroyed characters the pty already had. Bound it the way the reported branch is bounded. Pinned by a test that drives a settle commit between every keystroke and asserts no DEL reaches the wire. --------- Co-authored-by: Brennan Benson <brennanb2025@users.noreply.github.com>	2026-08-17 00:01:24 -07:00
NeilandOrca	17cfc968cf	Revert the terminal IME composition-ownership change (#13282) ... * Revert "test(ime): restore coverage the composition-ownership change removed (#13168)" This reverts commit 25a8c517e1. * Revert "refactor(terminal): return IME composition ownership to xterm (#13128)" This reverts commit 17b3dff3c4. * test(ime): keep the architecture-neutral Korean trace coverage The recorded IBus/fcitx5 and Windows MS-Korean traces from #13168 assert PTY byte order, not composition ownership, so they still hold once the terminal composition layer is restored. The mobile accessory-order test pinned the new handleLiveInputChange signature and does not. Co-authored-by: Orca <help@stably.ai> * fix(terminal): keep the macOS Backslash bypass through the revert The restored native-text forwarder only claims keys for input sources in its hardcoded CJK allowlist, so third-party IMEs off that list (Qingg, #10896) still get a raw backslash. #13128 added this bypass as a partial replacement; keep it rather than trade the open issue back. Scoped to the bare backslash key. The rest of shouldBypassXtermForMacNativeText bypassed all unmodified non-ASCII text, which would race the restored forwarder. Co-authored-by: Orca <help@stably.ai> * fix(mobile): move the mirror-step ref write out of render The restored hook assigned runMirrorStepRef during render, which is not replay-safe — React can discard render work, so the mutation can leak from UI that never commits. Its only read is inside the held-commit timer, which fires long after commit, and the ref has a safe default, so an effect is soon enough. Surfaced by the changed-lines React Doctor gate: the rule postdates this code, so restoring the file re-introduced it as a new violation. Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: Orca <help@stably.ai>	2026-08-08 19:06:50 -07:00
NeilandOrca	17b3dff3c4	refactor(terminal): return IME composition ownership to xterm (#13128) ... * fix(terminal): return IME composition ownership to xterm * fix(mobile): derive terminal input from native replacement ranges * test(mobile): record iOS Japanese IME traces * fix(mobile): preserve native IME replacement ranges * fix(xterm): flush queued application input after IME commit * test(terminal): pin Korean intermediate commit * test: pin Windows IME shortcut ownership * test: replay IBus number candidate commit * fix: preserve native macOS input-method punctuation * refactor(terminal): remove stale mac focus override * fix(mobile): preserve soft keyboard deletion ranges * fix: keep IME-owned palette chords in renderer * fix: stop carried IME shortcuts at renderer owner * fix: preserve carried IME shortcut dispatch * fix: narrow main-owned shortcut actions * test(mobile): pin Japanese IME replacement traces * test(terminal): retain paired native IME trace * fix(chat): preserve browser IME composition ownership * fix(chat): retain macOS IME confirm gesture * fix(chat): expire unmatched IME confirm carry * fix(chat): isolate IME confirmation expiry * fix(chat): retain active IME confirmation * refactor(terminal): remove dead composition handler * feat(ime): add shared Enter-ownership seams for CJK composition The confirming Enter of a CJK composition arrives as two keydowns and the orderings differ by platform: Windows/Linux redispatch the unmarked Enter/13 before keyup, macOS delivers keyup first. A guard reading only isComposing or keyCode 229 misses the redispatch, so surfaces submitted on a confirm. Adds useImeEnterGestureOwnership (carry token, next-frame expiry), a shared ImeEnterGuardedForm for native implicit submission, and the cmdk seam covering 18 CommandInput surfaces at one site. A chorded Enter arms the carry but is never swallowed — the reverse would eat a user's deliberate Cmd/Ctrl+Enter. Both failure modes are pinned by ime-enter-gesture-ownership-contract.test.ts. Co-authored-by: Orca <help@stably.ai> * refactor(terminal): consolidate native input listeners and parked-screen owner Extracts the shared native-input listener installer and renames the parked-screen detector for what it actually does, replacing per-call-site duplication. The listener installer keeps a forgetOptionKeyLocationOnBlur flag so per-window semantics are preserved rather than flattened. Net deletion; no behaviour change intended. Co-authored-by: Orca <help@stably.ai> * test(terminal): pin recorded IME shapes as regression tests Nine regression tests built from hashed affected-platform captures, each with a paired ordinary negative and a discriminating mutation verified to take the file from all-passing to exactly one failure. Covers the Windows MS-Korean Shift family (#12179, #11878, #12151, #11946, #12152) and the Korean TUI line-break rows (STA-3237, STA-3222, STA-3129). STA-3237 pins the empirical 3-Shift / 2-active-composition / 2-newline ratio the device run established — the third Shift produces nothing because Space has already committed. That ratio is not derivable from a static capture. Co-authored-by: Orca <help@stably.ai> * fix(ime): guard Enter-commit surfaces against CJK confirm Applies the Enter-ownership guards across the surfaces whose Enter commits something: publishes, clones, pairs, installs, posts, or persists. Tiered deliberately rather than uniformly. Irreversible and remote-effect sites take the carry token, which also blocks the unmarked redispatch. Locally reversible sites take the oracle check with a one-line comment naming the residual, because a spurious commit there costs one undo. Three numeric fields are left unguarded with the reason in-code: Chromium blanks number inputs at compositionstart, so a confirm-Enter only ever reaches an empty-draft reset. Measured with a CDP probe rather than assumed — a guard that cannot fire is noise. Co-authored-by: Orca <help@stably.ai> * test(ime): teeth-check the Enter guards on every guarded surface One suite per guarded surface, each verified by deleting the guard and confirming the test fails. A green guard test without that check is unverified, not verified. Two shapes pass vacuously in happy-dom and are avoided here: native implicit form submission never fires, and blur() is inert on an unfocused element. Both made "the commit did not happen" assertions pass with the guard removed, so the suites assert the guard's contract directly instead. Co-authored-by: Orca <help@stably.ai> * fix(mobile): keep iOS Korean commits whole through the live-input path iOS Korean reports isComposing: false on every event, so it bypasses the composition guard entirely. The strict owner rejected UIKit's transformed post-change field and sent only the leading jamo — the reported symptom. Prefers the authoritative same-event field text over the predicted text when the supplied operation cannot produce it. Generic: no Korean special-case, no locale classifier, no normalization. Adds the RN-target-keyed submit carry alongside it. Co-authored-by: Orca <help@stably.ai> * test(e2e): make IME capture harnesses fail loudly instead of silently Four instruments recorded silence as success, so a void run scored as a clean one: - readTerminalImeBoundaryTrace returned an empty trace when the probe never installed, making every "nothing leaked" negative pass vacuously - summarizeLatencies([]) returned a perfect zero distribution that passed all three latency thresholds - the macOS Vietnamese spec pinned an input-source ID that does not exist, and failed as though the operator had chosen the wrong source - the expectedLineCount=1 prefix property was undocumented and one edit from silently downgrading a PTY assertion Input sources now resolve by enumeration and name the near-matches on failure. Co-authored-by: Orca <help@stably.ai> * test(terminal): cover Cangjie cancellation and fix a cross-namespace assertion Adds #11951's recorded Cangjie cancel shape to the existing cancellation suite, which covered Pinyin and Sogou but not Cangjie. One keystroke then Backspace arriving as deleteContentBackward with data: null, so the stale preedit is the only thing a fallback could replay. Verified against the historical pre-6cd944c62b3 bundle: the positive fails with ['尸'] where [] is expected, while the ordinary negative stays green. Also fixes the Vietnamese spec, which asserted a TIS-space input-source ID against getKeyboardInputSourceId(). Those two Orca APIs report the same source in different namespaces — TIS nests it under VietnameseIM, the app API does not. The resolver stays as an installation precondition; the assertion matches the leaf. Co-authored-by: Orca <help@stably.ai> * test(e2e): add a real-IME macOS arm for the Korean chord commit The existing korean-ime-terminal-shift-enter-commit spec synthesizes composition over CDP: Input.imeSetComposition sets the preedit directly and Input.insertText performs the commit. Asserting the IME produced events you injected yourself is circular, so that spec cannot certify real-IME behaviour. This arm selects 2-Set Korean via TIS, reads it back live, and injects through System Events key codes, so the OS owns the preedit, the commit instant, and isComposing. PTY byte expectations are preserved verbatim. Covers 2 of the original 4 cases by design. The other two are the Windows/Linux redispatch-before-keyup ordering, which macOS cannot produce and which cannot be selected -- the OS decides it. Reintroducing synthesis to "restore coverage" would reintroduce the circularity. Co-authored-by: Orca <help@stably.ai> * test(e2e): assert the macOS chord arm at the PTY boundary, not the renderer The byte expectations were transcribed from korean-ime-terminal-shift-enter-commit :364/:383, which assert against onData -- a renderer boundary where the terminator is CR. This spec reads the PTY child, where the tty has already converted CR to LF. Names both forms per row rather than swapping the constant, so the conversion reads as evidence that the capture reached past the renderer, as #11936 and #11951 record. Ctrl+Enter's CSI-u sequence is unaffected and is identical at both boundaries. Co-authored-by: Orca <help@stably.ai> * test(e2e): measure composer-to-onData latency and stop dropping IME keystrokes Two defects in the echo latency probe. It hooked onWriteParsed and onRender but never onData, so it measured key->parse->render echo rather than the composer-vs-onData delta the latency rows need. Adds a third hook feeding its own sample set. And `event.key.length !== 1` silently dropped IME keystrokes: Pinyin and Cangjie keydowns arrive as key:'Process' (length 7). Replayed over the captured corpus, the old filter accepted 580 of 4137 Chinese IME keydowns -- it was discarding 80% of them. The new filter matches the shape the owner itself branches on. Attribution charges each onData to the latest keydown rather than a FIFO head, because composing jamo emit no onData at all and a queue would credit a whole composition to its first keystroke. The consumer now asserts sample count before any percentile, so a zero-sample run cannot render as a flawless distribution. Co-authored-by: Orca <help@stably.ai> * test(terminal): pin the WSL shifted-jamo newline shape for #11919 In Korean 2-set, Shift types ordinary letters -- the double consonants and the compound vowels. Each such keystroke reaches Chromium as key='Process', keyCode=229, shiftKey=true. The v1.4.163 classifier matched exactly that pattern with no code guard, so it called those keystrokes Enter, rewrote them to a synthetic Shift+Enter, and injected a newline into the middle of the word -- with no Enter key pressed. That is why the reporters said "no modifier key pressed": they had not chorded Shift+Enter, but they had pressed Shift, to type the double consonant. Asserts the row's own recorded capture: 40 immediate keydowns, exactly 3 of them Shift-carrying inside a single syllable, and an onData stream with one newline per Enter press and none mid-word. Two ordinary negatives keep it from being a blanket mute -- the same session's non-IME keydowns still reach shortcut policy, and an ordinary Shift+Enter still resolves through the real policy. Co-authored-by: Orca <help@stably.ai> * test(terminal): pin the composition commit lag that made Korean type one behind macOS Korean 2-Set commits syllable N only when the first jamo of N+1 arrives, so compositionend and compositionstart land in the same task. A composition-start handler cancelled the pending finalizer that was the only path to triggerDataEvent and ended the session without emitting bytes, so every committed syllable reached onData exactly one syllable late and the backlog cleared only at a Space or Enter. Types continuously with no Enter and no Space -- either would flush the backlog and hide it -- and samples onData at every syllable boundary. Paired with a length-matched ASCII arm that stays green throughout, so the positive is a fact about composition rather than about timing in general. Bisected to a single call site across five builds: pristine, 1.4.155 and 1.4.162 pass, 1.4.163 fails, removing the one call repairs it, restoring it fails identically. That window is exactly the reporter's "started immediately after updating". Co-authored-by: Orca <help@stably.ai> * test(mobile): cover the send-queue abort that silently drops queued keystrokes One failed send in use-terminal-live-input-commit aborts every keystroke queued behind it, with the error swallowed by .catch(() => false). The existing test resolves(true) on every send, so the failure branch was uncovered. Four arms: the abort itself, an ordinary negative on the healthy path, a throwing sender, and a liveness control proving the queue recovers once the chain settles. Deleting the abort takes 4 passed to 3 failed, with the ordinary negative correctly surviving. Scope is stated in the docblock: this is a transport send-queue abort, reachable only via a real disconnect or RPC error. REQUEST_TIMEOUT_MS is 30s, so latency alone cannot reach the branch — consistent with #7094's symptom class, not proven to be its cause. * test(terminal): pin that daemon snapshot/restore cannot disturb a composition Two independent reporters attributed broken Korean composition to the always-on PTY daemon repainting terminal state over the preedit. The attribution is wrong on ancestry — the daemon shipped three months before the version both call good — but the boundary was never actually tested. Runs the real applyMainBufferSnapshot choreography against a live composition, including the full 2J/3J/H wipe plus the resize and alt-screen branches. textarea.value, selectionStart/End, compositionView.textContent and .active all survive byte-identical, and interleaving a restore between every jamo of 문제 still commits 문제 at onData. Also pins that the uncommitted preedit is absent from the captured snapshot: it lives in the textarea, never the buffer, so a restore has nothing stale to echo back. Injecting one textarea.value = '' into the restore fails exactly the three restore-boundary tests. * test(terminal): pin that Cmd tears down a composition where Ctrl and Shift do not xterm's composition keydown exempts only keyCode 16/17/18 (Shift/Ctrl/Alt) plus 20/229. macOS Meta — 91/93/224 — is absent, so a Cmd press mid-composition takes _finalizeComposition(false): the overlay goes dark and never recovers, because compositionstart is not re-fired. The user composes the rest of the word blind. Linux and Windows users press Ctrl and are exempt. xterm already has a Meta-aware modifier predicate in wasModifierKeyOnlyEvent, so this is an internal inconsistency rather than a deliberate choice. Owns no reported row and is version-neutral: 5/5 on both 1.4.162 and 1.4.163. The branch is unexercised in all 328 recorded traces, so this is a hazard pin, not a regression guard. Only the teardown is asserted; the likely duplicated commit needs a compositionend the IME kept alive across the Cmd, which no capture contains. Deleting the exemption fails exactly the three paired negatives; adding Meta to it fails exactly the two Cmd arms. * test(native-chat): characterize preedit loss when a question card replaces the composer An AskUserQuestion card fully replaces the composer by design, but the in-flight composition goes with it: the composer unmounts before compositionend reaches it, so the preedit is never committed to the draft. The committed text survives only because the draft is cached and restored via defaultValue. Node identity changes, value 'abc' is preserved, the 가 is gone. Drives the real NativeChatView -> SessionGate -> InteractiveCard -> questionActive swap -> Composer -> ComposerField, flipped by writing the same store field an AskUserQuestion hook event writes. Flipping questionActive to false fails exactly this test and nothing else across 639 native-chat tests, so the path was entirely unguarded. CHARACTERIZATION TEST: it asserts the loss. Fixing the defect — committing the preedit before the swap, or keeping the composer mounted — will make this file fail. Update the expectations to the new contract rather than working around them. Owns no reported row. #12118/STA-3219 flicker is keyed to token counters, which provably do not remount, and a question card arrives once per question. * test(terminal): pin the duplicated commit when Meta interrupts a composition _finalizeComposition(false) sends textarea.value.substring(start, end) but cannot clear the IME-owned textarea, so a later compositionend re-sends the same range. Meta reaches that path because CompositionHelper exempts only Shift/Ctrl/Alt; xterm's own wasModifierKeyOnlyEvent covers Meta four ways, so the omission is an internal inconsistency rather than a choice. Companion to the modifier-exemption guard, which deliberately pins only the overlay teardown. This pins the data consequence. HAZARD PIN: owns no reported row. The trigger is unverified on hardware — no capture in the corpus contains a Meta-during-composition gesture, and whether macOS keeps the composition alive across it is unmeasured. The duplication follows from the code given that sequence; whether users reach the sequence is the open half. An earlier premise that Space (keyCode 32) reaches this path was refuted by a corpus scan: 0 of 731 evidence files carry a keyCode-32 Space while composing, against 171 at 229, and 229 returns early. * test(terminal): characterize the syllable lost when the textarea blurs mid-composition CoreBrowserTerminal._handleTextAreaBlur clears the helper textarea unconditionally — "Text can safely be removed on blur" — while CompositionHelper._finalizeComposition reads the committed text back out of that same value from a deferred timeout. By the time it runs the value is empty, the substring is '', and triggerDataEvent never sees the syllable. xterm checks composition state in _syncTextArea and omits the same check here. Six cases. Blurring mid-composition loses the syllable in every ordering, including compositionend-before-blur, which is Chromium's real order — so it is not an ordering artifact. A bare textarea.blur() with no Orca code loses it too, which places the owner upstream: Orca's unguarded release on outside pointerdown is one trigger, not the cause. Committing 한 then blurring mid-가 yields ['한'] where ['한','가'] is correct: one syllable gone, surrounding text intact. Teeth checked by inverting — adding an Orca-side composition guard flips exactly the three cases that route through the release path and leaves the bare-blur and no-blur cases green, which is the scope split: a fix in regular-terminal-focus-ownership alone would not close this. HAZARD PIN, but unlike the others this one has a real production injector — clicking outside the terminal mid-composition. Owns no reported row. The shape matches #9738's report; the injector does not, and a shape match with a mismatched injector is not an owner. * test(terminal): say which arm the STA-3237 fixture came from The recorded keydowns are wave 4's A-shift-unmarked-only — the arm that emits no PTY bytes. Nothing in the file said so, so two readers concluded the row's events fail the owner's predicate and that STA-3237 and STA-3222 were different defects. They share an owner; the arm that fires is Process/229+Shift, absent from this bubble-phase trace because the owner claims it in the capture phase. Also corrects "code-blind": the v1.4.163 policy emits \x1b\r only for a shift-only key:'Enter', and a jamo keydown reaches that branch solely via the isTerminalImeProcessEnter rewrite. The mock is deliberately wider so the ownership guard stays under test if that rewrite moves. Comments only — no assertion, fixture value, or mock behaviour changed. * test(e2e): track the input-source selector the macOS specs shell out to Five tracked macOS IME specs ran `swift .tmp/select-input-source.swift`, a file that is gitignored and existed only on one machine. Anyone else checking out the repo — or the same machine after .tmp is cleaned — could not run them, and they are the capture drivers for the macOS rows that are blocked waiting for exactly those runs. Moves it to tests/e2e/ beside its callers. The chord spec now resolves it from __dirname rather than reaching two levels up into .tmp. * test(terminal): pin the CJK repaint decision against the reporter's own output #12164 comment 1 and #5921 report agent output with double-width glyphs rendering duplicated character-by-character while ASCII in the same line stays clean. No IME, no composition, no keystroke — the user never types the CJK. Segmenting all three verbatim samples into maximal same-risk-class runs gives 33 runs and zero violations of "this run is corrupted iff the production detector flags it": 17 wide runs all corrupted, 16 narrow runs all byte-identical. The paired negative is co-located in the same line rather than in a separate run — the reporter supplied it without knowing. Doubling is asserted as present, not uniform: 자바스크립트 and 시스템 each leave a jamo undoubled, which is a repaint-region boundary artifact rather than a per-character transform. The discriminating arm is in the test rather than a source mutation: be3f30e2f8 (#6890) elects a repaint for all 17 corrupted runs when the agent types nothing, and reverting its disjunct elects none. Both predicates agree once the user has recently typed, which is the pre-#6890 condition. Samples inlined with per-sample SHA-256 because .tmp is gitignored and cannot back a landed test. * test(terminal): pin macOS period substitution landing after the composition #11504's reporter published a DOM trace showing insertText ". " arriving 149ms after compositionend, when two spaces are typed with a CJK input source and NSAutomaticPeriodSubstitutionEnabled is on. This replays that trace against a real Terminal and asserts what reaches onData — bytes to the PTY, not anything visual. The owner is stock upstream CoreBrowserTerminal._inputEvent, not an Orca module, confirmed at the resolved install and in the shipped bundle Vite loads rather than in the TypeScript source. Three mutations against that install, predictions written before the runs, each failing exactly the arms predicted: dropping the composed/keyDownSeen guard fails two, dropping Orca's intercept fails the one arm where the payload arrives before the send window drains, and flipping || to && — the candidate-fix shape — fails the arm that pins the defect itself. CHARACTERIZATION: arm 1 asserts the broken behaviour and will fail the moment #11504 is fixed. Update it to the new contract rather than working around it. composed is absent from every recorded bundle, so composed: true is the spec-required value rather than a captured one; the test asserts it before dispatching so a harness that dropped the field fails loudly. * test(terminal): replay the recorded Windows Shift sessions through the IME guard STA-3179 reports a Shift release sending Enter; #12171 reports delayed Hangul plus doubled newlines. Both replay their own recorded Windows MS-Korean keydowns through resolveTerminalKeyboardShortcutAction with the shortcut policy mocked, so the assertions are about which events reach the policy and what reaches terminal input. STA-3179's held-Shift gesture yields exactly one newline, from the unmarked Enter alone; its release arms nothing for the next composition, asserted after a precondition check that the release really is keyups with shiftKey already dropped; and an ordinary Shift press-and-release still routes every keydown, which is the paired non-IME negative. Teeth, verified by mutation: bypassing the isImeOwnedKeyboardEvent guard in keyboard-handlers takes STA-3179 from 3 passed to 2 failed / 1 passed — the survivor being the ordinary-session negative, which is correct, since a non-IME session should not depend on that guard — and #12171 from 2 passed to 2 failed. Source restored byte-identical. Recorded shapes are inlined and the bundles cited in comments; nothing is imported from .tmp, which is gitignored. * test(native-chat): correct 61977d4517 — the preedit survives the question card 61977d4517 claimed a composed syllable vanishes silently when an AskUserQuestion card replaces the composer, and characterized that loss. The claim was false. Its premise was an artifact of the harness: the test simulated a preedit with a silent textarea.value assignment and no input event, which no IME does. Real composition fires input with insertCompositionText on every keystroke — the shape this repo already records in its own observed-event capture — and React's change handler returns on input/change with no composition gate, so onChange runs for each frame. The draft cache is written synchronously inside the updater, so the preedit is already committed before the card can arrive. Driven that way, it survives. Renamed to match the contract that actually holds, and extended: Hangul jamo-per-frame, Japanese kana accumulation followed by per-segment conversion asserting the candidate the user was looking at survives, and a pin on the mechanism itself — the draft cache holds the preedit while the card is up. Teeth: there is no fix to revert, so the mutation is the plausible wrong one — gating onChange on isComposing(). That takes 4 passed to 3 failed, with the English negative correctly surviving, since it has no composition to gate. Two consequences remain, recorded rather than fixed: the OS aborts the composition when the field disappears, so a lone jamo returns as a compatibility jamo the user cannot compose onto, and the remounted composer is unfocused because the card owned focus. * docs(native-chat): name the corrected commit and the degraded-jamo consequence Records in the file itself that 61977d4517 is pushed and wrong, quoting the two claims that are false, so a reader who finds it in git log reaches the correction from the file that replaced it. Also states the residual as a consequence rather than a curiosity: a lone leading jamo returns as a standalone compatibility jamo (U+3131), which is not a composable state — the user cannot resume the syllable, only delete and retype. Preserved, but degraded into something unusable. That is the note to find if a reporter ever describes exactly that. The invariant these tests pin is not "the composer commits on unmount" but "composition input events must reach React" — which is what a future IME change would break, and is not visible from the swap site at all. * test(terminal): replay the recorded macOS Telex commit boundaries #6905 reports Vietnamese composed characters breaking in the terminal. Replays the retained macOS built-in Simple Telex capture — recorded selection and value set before each dispatch, since that is what the commit range reads — and asserts what reaches onData: the first commit alone, then through the real Enter, then the ASCII tail of the same run. A code-point count would catch NFD normalisation. ENGINE CAVEAT, stated first in the docblock: this is macOS built-in Simple Telex, Telex only. The reporter's three named engines cannot run on the platform they declared, and which macOS Vietnamese engine they used is unconfirmed. This file certifies no engine, and does not imply VNI. The owner is upstream's — CompositionHelper._finalizeComposition's waitForPropagation branch — so the arms are copies under .tmp aliased by a scratch config, with node_modules verified unchanged by shasum after every run. Collapsing the range end onto its start fails all three; collapsing the start to zero re-emits the first word into the second commit, which is the reporter's "duplicated" direction. Different failure sets, so the mutants are distinguishable rather than merely detectable, and the ASCII assertion passes under both. Falsifiability here is by mutation, not by a defective build: #6905 does not reproduce at HEAD, so this has never been watched going red on a real reproduction. * docs(terminal): lead the #6905 test with its engine caveat Comment-only. Moves the caveat above the source line so a reader meets what the file does NOT establish before what it does — the capture is macOS built-in Simple Telex, the reporter's named engines cannot run on the platform they declared, and which engine they used is what gates this row. Co-authored-by: Orca <help@stably.ai> * docs(terminal): record that the swallow eats a keystroke after Japanese conversion This pin framed the swallowed insertText around Cmd interrupting a composition. A differential through Japanese multi-segment conversion shows it is broader: type a segment, convert, then press `a`, and the `a` is lost. No modifier, no exotic gesture. Korean surfaced it first only because 2-Set composes on nearly every keystroke. Also records why it cannot simply be fixed. The suppression de-duplicates IMEs that deliver their commit a task after compositionend, which a sibling test pins; this swallow is that dedup's false positive, and the two events differ only in payload, so no flag-timing change separates them. Both a smaller redesign and a content-aware variant were built and measured — the first duplicates on IBus, the second costs a reported row's test and is blocked while the patch cannot be regenerated. The Japanese arrays behind this are authored, not observed: no Japanese DOM composition trace exists in the corpus. * docs(terminal): a Japanese capture does exist — correcting dbeecb11be That commit said no Japanese DOM composition trace exists in the corpus. False. One does, filed under the Linux bundles rather than the bundle named for Japanese: 30 DOM events, two にほんご->日本語 conversions, with full selection state per event. It is retained byte-identically in three further bundles — one capture copied four times, not four observations, checked by hash rather than by counting files. The claim came from checking the bundle named for Japanese, finding nothing, and generalising to the corpus without querying the rest of it. Replaying it emits 日本語日本語 under both sequencing extremes on all four arms, matching its own recorded onData. So "repeated conversion is undisturbed" is now captured rather than authored. It carries no post-compositionend insertText, so it cannot speak to the swallow: the a-after-conversion figure stays authored and unobserved. Also rewords the paragraph opener. It claimed to broaden a Cmd framing, but hazard 2 was never Cmd-framed — the lines above already say Cmd does not reach it. The real gap was that hazard 2 named no trigger at all, which reads as exotic when it is ordinary. * build(xterm): land the patch regeneration harness The five dependency patches under config/patches/ shipped with no tracked way to regenerate any of them. The xterm one is the hard case: it is derived from an upstream build, so no fix could be made without rebuilding, and the tooling to rebuild lived only in one machine's scratch directory. That blocked a measured fix for a live keystroke-loss bug, and the EditContext reduction an OSS survey identified as the only real one available. Adds the regenerator, the upstream pin, the hand-written source patch the bundle hunks derive from, tests, docs, and a PR job that verifies the shipped patches still match the pinned build. The job caches the shallow clone keyed on the manifest, so a cold run is minutes and a warm one under one. Round-trip verified: regenerating from a clean checkout reproduces the shipped patch byte-for-byte. Marks the emitted patch -diff -text. pnpm hashes it byte-for-byte, so a CRLF checkout would break install on Windows, and its minified bundle lines make a diff nobody can read — review the source patch instead. Also rejects unknown flags. --check was the fallback for any unrecognised argument, so a typo, or --help, silently triggered a full upstream build instead of what the caller asked for. * fix(xterm): stop swallowing a keystroke typed after an IME commit Type a Japanese segment, convert it, then press a key one macrotask later and that key was lost. No modifier, nothing exotic — every user who keeps typing straight after converting. Korean surfaced it first only because 2-Set composes on nearly every keystroke. handleCompositionInput discarded the payload unconditionally in the window after the deferred send: _isSendingComposition stays true for one macrotask after the timer cleared _pendingCompositionStart, and the branch substituted '' for whatever arrived. The suppression is not itself wrong — it de-duplicates IMEs that deliver their commit an event-loop turn late, which terminal-stock-composition.test.ts pins. It just could not tell a duplicate from new input, because the two events are identical apart from payload. Now it compares against _sentComposition, the text the deferred send actually emitted, and discards only a match. A flag-timing redesign was measured first and rejected: it fixed this and duplicated on IBus, because no timing change can separate events that differ only in content. Edited in config/patches/xterm-src/ and regenerated through the harness, so the emitted patch and the lockfile hash are derived, not hand-written. The commit-overlap pin's swallow arm now asserts the repaired contract — the value its own comment already named as correct and as what stock beta.287 emits. #11504's arm at :184 flips too; it never covered that report, as its own prior note recorded, and the reporter's +149ms arm is untouched and still asserting the defect. Provenance hashes in three test docblocks are updated, since regenerating changes the patch hash and with it the resolved install directory. * docs(terminal): re-measure the #6905 mutation citations against the new bundle Regenerating the patch moved the resolved install, so this docblock's patch_hash, line count, two line numbers and three mutation outcomes all described a bundle that no longer exists. The deferred branch is one the fix writes into, so the outcomes could not be re-pointed on reasoning. Line numbers read off both files by diffing anchors rather than derived by arithmetic: 201 to 205, 159 to 163. Outcomes re-run through the retained rig, which re-resolves through the module loader and re-derives each arm from a unique minified anchor: pristine 3 passed, m1 3 failed, m2 2 failed, m3 3 passed — identical to the old bundle. Guard controls in both directions exit 1, so the counts are falsifiable. Comment-only; the assertions and expectations are unchanged. * fix(xterm): size the preedit overlay to the cells its text will occupy updateCompositionElements computed the overlay's left edge from the grid but never its width, so the preedit rendered at the font's natural advance while the committed text takes two cells per wide glyph. Measured in Chromium 150: 가나다라 drew 48.45px as a preedit and 69.20px once committed — the same characters, same font, 30% narrower, and drifting further with each syllable. Every macOS mono font carrying Hangul measured 0.49–0.72 of two cells; never 1.0. Deriving the width from wcwidth and the cell measure moves Korean, Japanese and Chinese to 1.000 and leaves ASCII at 1.000, which it already was: 한 12.125 -> 17.297 (17.30 expected) 가나다라 48.453 -> 69.188 (69.20) 안녕하세요 60.563 -> 86.500 (86.50) 日本語 42.000 -> 51.906 (51.90) abcdefgh 69.234 -> 69.203 (69.20, unchanged) Edited in config/patches/xterm-src/ and regenerated through the harness, so the emitted patch and lockfile hash are derived rather than hand-written. The unit test asserts the arithmetic, which is what CI can run. The pixel consequence was measured on macOS with SF Mono in an Electron harness, not on the Windows font stack STA-3232 reports from — so this demonstrates the mechanism and does not stand as that row's platform evidence. * test(e2e): pin the macOS Korean preedit as visible only while composing #11914 reports the composing text invisible until Space. Its c3 was recorded as unobtainable, and the reason on file was wrong: the boundary IS assertable, but not in happy-dom, which reports display:block in BOTH the active and inactive states and zeros for every rect. A test there passes with the defect present. Captured on real hardware instead: hidden and 0x0 before, .active with display:block, a 15.84x16 rect and checkVisibility() true while composing 그, hidden again after. 39 DOM events, 2 composition starts, onData ["한","그","\r"]. Two mechanism findings are carried in the setup because both are invisible in the result and fatal if removed. The input source must be selected AFTER the app takes focus — focusing resets it to ABC. And the IME must be warmed until an observed keyCode 229; typed cold it emits raw QWERTY (g k s r m) with no composition at all, which is indistinguishable from an IME that is not installed. Two runs were voided on exactly that signature before the warm-up was found. The has229 and compositionStarts assertions exist to make such a run fail loudly rather than pass as a clean negative. Gated on darwin plus ORCA_E2E_NATIVE_MACOS_KOREAN, like its siblings. The final spec form has not itself been executed — the machine became unavailable — so it carries the probe's measured values as literals rather than a run of its own. * docs(e2e): correct 19a8d133db — the Korean preedit spec has been executed That commit said the landed form had never run and carried the probe's values as literals. It has now run on real hardware: 1 passed, 9.1s, rc=0, with the capture and log sealed under a verified hash manifest. The teeth check was also run rather than reasoned about, and it changes which assertion matters. Forcing the active overlay to max-width:0 with overflow:hidden — invisible on screen — leaves the active class, the textContent, display:block AND checkVisibility() all passing. Only during.rect.width fails. checkVisibility() is not sufficient against this defect; the bounding rect is the single load-bearing assertion, which the docblock already said and this run confirms. An earlier teeth attempt injected the CSS mid-run and tripped the hasActiveClass poll instead, failing at the wrong assertion. It is inconclusive and excluded from the seal rather than counted. * test(terminal): add #12171's ordinary-English arm from a real Windows capture c4 was recorded as unmet and the ledger sourced its control to evidence/windows-current/, which holds 12 captures and not one English one. The arm here comes from windows-9803-final instead — same probe, same host geometry, same injector, en-US with no IME, replayed keydown for keydown. Two limits are stated in the file rather than left for a reader to find. It is a different bundle and a different run about 3.6 hours later, so it is not a same-run arm. And it is #9803's range-active MUTANT arm: ordinary English stays byte-exact even with that saved-range mutation live, which is why it reads as a negative rather than as a baseline. Bundle cited by directory with its file SHA-256; MANIFEST.sha256 verifies 21/21, rc=0. Nothing imported from .tmp. * docs(terminal): correct #12164's grounds — the cited comments say no such thing The rejection of #12164 from this file's family was recorded as resting on its comment 1 (output doubling) and comment 2 (filed against 1.4.163). Checked against the API: the issue has exactly two comments, neither of which says that, and the string 1.4.163 appears nowhere in the thread. The conclusion survives on better grounds. The issue BODY's repro is "Run any CLI agent (Codex, AGY, Claude, etc.) that outputs Korean text into the Orca terminal" — untyped output, no keystrokes, no composition — so excluding CompositionHelper is right, and the input-path hunt was looking in the wrong place. The body is also LLM-authored (it still contains a literal "## 5. GitHub Submission Draft (Ready to Post)") and its Root Cause section blames a CJK IME preedit buffer its own repro never engages, so it should not be read as observation. Comment-only; suite unchanged at 5/5. * test(native-chat): make composition frames carry isComposing, not just inputType This suite's comment claimed "Gating onChange on `isComposing` breaks here." It did not. composeFrame() fired `input` with `inputType` but never set `isComposing`, so a gate on `isComposing` passed all four tests untouched — the suite asserted a discriminator it did not exercise. Composition frames now carry both, so neither gate is exempt. Verified by pointing the mutant at it: with an `isComposing` gate on the composer's onChange, this suite now fails 3 of 4 (it passed 4 of 4 before), and the ordinary-English arm correctly survives, since a composition gate should not touch it. Production code is unchanged and stays gate-free; the mutation was applied, measured, and reverted. Found while excluding NativeChatView's question-card remount as the owner of #12118 / STA-3219: the remount is real, but the preedit survives it precisely because this write path has no composition gate. * fix(mobile): ship the patched xterm build, matching desktop mobile pinned @xterm/xterm 6.1.0-beta.285 while the patch is keyed to 6.1.0-beta.287, so mobile shipped stock xterm and neither IME defect fix reached it: the swallowed keystroke after an IME commit (9506039de7) and the preedit sized to the font rather than the grid (e04e0c88da). Bumps the three xterm packages to the desktop versions and adds the patch to mobile's own pnpm.patchedDependencies. No copy of the patch: pnpm accepts the parent-relative path and records it in the lockfile against hash 8d63166272e9040a…, byte-identical to what desktop resolves, so the two stay in step by construction rather than by a drift check. The workspace separation is untouched — root pnpm-workspace.yaml still declares `packages: []` and mobile keeps its own lockfile, which is what keeps the root's patches from failing as ERR_PNPM_UNUSED_PATCH. Verified in the generated webview bundle rather than at the install: alignPreeditToGrid 0->2, sentComposition 0->3, pendingInput 0->11, and the stock-only _handleAnyTextareaChanges 2->0 and dataAlreadySent 4->0. pnpm applies patches during linking before postinstall regenerates the bundle, confirmed by a revert/reinstall/re-apply cycle in both directions. Mobile suite 2971 passed, 3 skipped — identical before and after. Bundle +1,514 B (+0.24%). Lockfile churn is xterm-only; --frozen-lockfile passes. mobile/src/ime/ime-submit-carry.ts is NOT made redundant and is untouched: it handles iOS firing onSubmitEditing on a React Native native TextInput after unmarking a composition, which is outside the WebView entirely. Known divergence left alone: desktop also patches @xterm/addon-webgl and mobile now runs that version unpatched. That patch is glyph/texture-atlas rendering with nothing IME-related, so it affects neither fix. * test(terminal): pin the preedit overlay against already-committed cells STA-3132 (arm A), STA-3170 and STA-3232 report a Korean preedit painted on top of text already on screen. Builds v1.4.163-v1.4.166 cancel the pending finalizer in compositionstart, so a committed syllable reaches onData one syllable late and buffer.x is stale — the overlay lands on the cell the flushed syllable is about to occupy. Replays a recorded hardware trace rather than an authored one: the ordered DOM event stream captured on Windows + MS Korean (wave5-r2 evidence, 64 events), echoing onData back as PTY output. The load-bearing assertion is deliberately not the obvious one. Comparing overlay style.left against cursorX is tautological — left is computed from buffer.x. This counts committed syllables from the compositionend events the IME fired, so the two sides are independently derived. Discriminated by a historical re-add across seven real bundles, since the owner is deletion-shaped: pristine beta287, v1.4.155 and v1.4.162 pass; v1.4.163 fails; v1.4.163 with that single call removed passes; the byte identical baseline restored fails again; head passes. Every failing arm fails only this case — the ordinary negative stays green in all seven. The negative asserts its own category rather than claiming it: zero composition events, zero isComposing, zero keyCode 229, exactly 16 events, paired against the Korean arm's 4 starts / 3 ends / 11 updates / 64 events. Scope: cell indices, not pixels. happy-dom has no layout, so the recorded 8x16 cell metrics are supplied to the render service. This makes no claim about pixels visually overlapping; that is affected-OS confirmation and stays open. Covers the overlap arm only — STA-3132's auto-line-break arm and STA-3232's half-line-capacity and a11y arms are untouched. * test(e2e): matrix macOS period substitution against the OS preference #11504 reports macOS inserting ". " after a Hangul Space commit. This sweeps six arms across both states of NSAutomaticPeriodSubstitutionEnabled, reading the preference live per run rather than asserting a literal. Two results worth having on record. The reporter's stated trigger did not reproduce. Their words are "There is no second press at all. One space is enough", but korean-single-space emits zero insertText with the preference on or off. So does word-space-word-space. Their timing does reproduce, with different content. korean-double-space and korean-longer-word-double-space emit a delayed insertText at +122.5-122.7ms after compositionend — squarely the reported +149ms — but the payload is a space, never ". ". Consistent with the double-space rule seeing two slots under ABC and only one under Korean, where the IME commit consumes the first. The substitution itself is real and preference-bound: latin-double-space gives "ab . " with the preference on and "ab " with it off, on one build with the preference as the sole variable, reproduced across two runs. That also refutes a claim in PR #11506, which states the substitution "is enforced outside the renderer and never reproduces in dev builds, so changes here must be verified against a packaged app". It reproduced in the dev build twice and did not reproduce on the signed packaged app. That claim should not be used as a verification gate. Gated @headful behind ORCA_E2E_NATIVE_MACOS_PERIOD, same shape as the Korean preedit spec, so it does not run in ordinary CI. Evidence is onData and DOM only — the PTY-child reader aborted and no packaged-app arm was stable. * test(terminal): actually enforce the recorded jamo progression The preedit assertion compared sample.overlayText against sample.overlayText — the same expression on both sides. A lane proved it by mutation: corrupting seven of the eight recorded preedit values left the suite fully green. So the docblock's ㄱ→가→간→나→낟→다→달→라, which the matrix also cites as this row's recorded shape, was cited and unenforced. The first attempt at a fix was insufficient and is worth recording. Threading stroke.preedit through to the expectation still passed on a corrupted fixture, because that value both drives the rig and was the expectation — corrupting it moved both sides together. Same tautology, one level down. The expectation is now an independent literal. Verified by mutation rather than by reading: corrupting two recorded values fails one arm; restoring them passes 3/3. overlayCell was never affected — it is compared against a count derived from the compositionend events, not from the buffer, and remains the load-bearing assertion for the overlap. * fix(e2e): select the selectable input source, not the first match TISCreateInputSourceList can return several entries for one input source id. A third-party IME publishes a non-selectable parent alongside the selectable mode, and taking sources.first can return the parent — after which TISSelectInputSource fails with paramErr (-50) while the caller reports success from the enable step. Found with Qingg (com.aodaren.inputmethod.Qingg), which exposes exactly that pair under one id. Its mode id equals the bundle id, so filtering by name would not have helped; selectability is the discriminator. Now filters on kTISPropertyInputSourceIsSelectCapable and falls back to the old behaviour when nothing advertises it, so single-entry sources are unaffected. Also enables every entry for the id rather than only the one being selected: selecting a mode whose parent is still disabled fails the same way. Compile-checked, and selecting com.apple.keylayout.ABC still exits 0. Unrelated to the enable path: on macOS 26.5.2 third-party IMEs are gated behind a consent sheet in System Settings. TISEnableInputSource returns noErr immediately regardless, and the enable only lands if that sheet is answered while the requesting process is still alive. * test(terminal): discriminate #12171 against the real shortcut policy The prior candidate mutation for this row was correctly refused: its suite mocked shortcut policy so Process/229 became actionable, while the real resolveTerminalShortcutAction has no Process branch — so the kill measured the mock. This does not mock it. Replays a capture of this row's own gesture (d, l, Shift+T, e, k, Space, Enter under MS Korean, committing 있다) taken on Orca 1.4.164, through the real useTerminalKeyboardShortcuts hook, capturing bytes at terminal.input. The earlier capture could not discriminate at all because it recorded no shiftKey; this one records it on 10 of 10 keydowns with code populated. One physical Shift+T produces two shifted Process/229 keydowns. Under the pre-#12265 classifier each synthesizes {key:'Enter', shiftKey:true}, which the real policy resolves to sendInput '\x1b\r' — twice, giving 1b0d1b0d, the two escapes the known-bad ed96881b0d1b0d contains. Mutation is the retained pre-12265-process-shift.patch applied to HEAD, not an authored one: patch -p1 applies clean and diffs identical to the mutant copy. Arms are copies; shared source hashes the same before and after. The English arm stays clean under both modules, so the mutation discriminates by language rather than by harness — and a real Shift+Enter through the same rig yields exactly ['\x1b\r'] in every arm, so a silent pristine result means the code is quiet rather than the harness dead. Scope: 1b0d1b0d is measured at the renderer boundary. The capture recorded no PTY bytes — window.api.pty is frozen on shipped builds and the onData channel needs a build-time flag — so this shows the renderer producing the two escapes that payload contains, not a re-observation of the payload. * docs(native-chat): narrow this file's disclaimer to what is now true It said "THIS OWNS NO REPORTED ROW". Half of that is stale: the remount site is now the attributed owner of #12118 and STA-3219. On real Windows TSF the questionActive swap aborts a live composition — the old node gets only a blur and no compositionend, the text returns as committed, and the next jamo yields 아ㄴ rather than 안. The other half holds. This file pins the opposite property, that the text survives, which is the half those reporters already agree with. Mutation shows the gap rather than asserting it: deleting the unmount entirely leaves three of four tests green, because every substantive assertion is after.value === … and a composer that never unmounts keeps its value. Also records why the abort cannot be asserted here. The DOM exposes no observable separating committed text from a live preedit — value is the same string either way, there is no EditContext, and the only composing-ness state is a per-instance ref discarded with the node. A test pinning "no compositionend fires" would be an anti-guard: red the day it is fixed. The cadence objection is kept, since it is now the open question rather than the reason for exclusion. * refactor(terminal): drop the unread isComposing field from XtermBypassEvent Added by #6396 for terminal IME candidate handling that this branch has since removed. No production or test code reads it, and the policy is safe without it: during composition `key` is 'Process', so the non-ASCII printable checks that would care never match. Co-authored-by: Orca <help@stably.ai> * fix(native-chat): keep the composer mounted through an in-flight IME composition A question card replaced the composer outright (`{questionActive ? null : <NativeChatComposer/>}`). Unmounting the field mid-composition aborts the composition in the OS: the node is detached before `compositionend` can fire, the preedit returns as committed text, and a resumed Hangul syllable degrades — 아 then ㄴ yields `아ㄴ`, never `안`. Confirmed in rasterised pixels on Windows with a real MS Korean IME, at both v1.4.171 and the reporter-era v1.4.164 (the swap block is byte-identical across them): the preedit underline present before the swap, the composer visibly absent during it, and the same glyph back afterwards WITHOUT the underline — committed, not composing. The swap is now deferred while a composition is in flight, which is what editors that survive IME do: ProseMirror gates DOM work on `view.composing`, CodeMirror protects the composing subtree from redraws. Hiding instead of unmounting does not work — `display:none` and `visibility:hidden` both blur the focused element and abort the composition the same way. The hold releases on `compositionend`, which browsers also fire on blur, so clicking into the card's own answer input yields the input region immediately; with nothing composing the card still replaces the composer at once, so no stray "Send a message" appears beside a question. The existing characterization test flips to a regression guard: it pinned the node being destroyed, which was the defect. Node identity is the load-bearing assertion — value-only checks are trivially satisfied by a composer that never unmounts and cannot tell a held composition from a destroyed one. The typing-redirect handler moves to its own hook. That is not cosmetic: both touched files sat at the 400-line cap, and `max-lines` suppressions are forbidden, so the room had to come from a real extraction. * fix(macos): opt Orca out of AppKit automatic period substitution macOS "Add period with double-space" (`NSAutomaticPeriodSubstitutionEnabled`, on by default) is applied by AppKit's text input system. Native terminals never join that system; Chromium text fields do, so xterm's helper textarea inherits it and a double space arrives as `". "` — a period nobody typed, handed straight to the PTY (#11504). Chromium answers AppKit for quote and dash substitution and defaults both off, but declares no period accessor at all, so AppKit applies that one without asking. This user default is the only lever: there is no per-field or per-webContents opt-out to prefer over it. Writing the key into Orca's own defaults domain overrides the global value for this app alone and leaves the user's system-wide setting untouched. It necessarily covers every Orca text field, not only terminals — AppKit offers no narrower scope, and that tradeoff is deliberate rather than accidental. Measured on the reporter's own build v1.4.161: with the preference ON, typing a,b,space,space yields `onData ["a","b"," ",". "]`; with it OFF the same arm yields two spaces. Note the issue's causal model is wrong and this fix does not follow it. It claims the substitution only fires with a CJK input source and never with ABC. The measurement is the inverse — every Korean arm is clean and the ABC arm is the one that fires — so the fix is not conditioned on input source. NOT YET VERIFIED ON HARDWARE. The unit tests inject the writer, so they prove the call is made on darwin and skipped elsewhere; they do not prove AppKit honours an app-domain override for this key. That check is outstanding. * fix(xterm): keep a live composition across a lone Cmd press on macOS CompositionHelper.keydown exempted keyCodes 16/17/18 from tearing a composition down, which covers Shift/Ctrl/Alt but not macOS Meta — 91/93 in Chromium, 224 in Firefox. A lone Cmd press mid-composition therefore reached _finalizeComposition(false), which dropped the preedit overlay's `active` class and committed the live syllable early. macOS keeps the marked text alive across that press, so no later compositionstart re-arms the overlay and the rest of the word composes invisibly. Measured on hardware (m4air, macOS 26.5.2, Apple M4, 2-Set Korean) with the Cmd posted as a CGEventType.flagsChanged, which is what a physical modifier emits. AppleScript `key code 55` posts nothing a browser can see — a bare `key code 56` for Shift is equally silent — which is why no capture in the corpus ever reached this branch. Three arms, same build otherwise: overlay live throughout with the exemption, dark and prematurely committed without it, live again with it restored. Evidence under .tmp/ime-handoff/swarm-scratch/wave31-cmd-preedit/evidence/. The fix cannot widen past a lone modifier: only a standalone press reports these keyCodes, and a Cmd chord during composition is reported by Chromium as 229, which was already exempt. Cmd+A still ends the composition, via the IME's own compositionend. Ghostty draws the same line, returning early from flagsChanged under hasMarkedText() for every modifier including Super. Orca's terminal pane was never affected — shouldSuppressTerminalModifierKeyboardEvent drops a standalone Meta keydown before xterm sees it, and deleting only 'Meta' from that set is what flipped the hardware arm to broken. The popout preview terminal and mobile's webview install no such guard and did reach the teardown. terminal-ime-xterm-composition-commit-overlap.test.ts asked its fixer to update the two Cmd arms to the values it named as correct; both now emit a single ['한']. * test(native-chat): drop two byte-identical duplicate cases `4632b86919d` copy-pasted two cases twice into the same describe block: `retains carry across a same-frame non-Enter keyup before redispatch` and `expires carry before a deliberate Enter after the next frame`. Each pair is byte-identical — same title, same body — so the copies asserted nothing the originals did not. This is what has been failing `static analysis` on this branch since 2026-08-06: `oxlint vitest(no-identical-title)` reports both under `--deny-warnings`, and `verify` fails solely because it requires static analysis to pass. Every other gate in `verify` was already green, including typecheck, xterm patch sync, the full test shard set, and both package jobs. 12 cases still pass in the file. * test(e2e): skip the WebGL arm when no WebGL renderer exists The #12164 probe runs two arms, webgl and dom, and closes by asserting the active renderer is the requested one. That assertion is right for the dom arm — it is what proves the pane actually left WebGL, without which the arm is meaningless — but headless CI has no GPU, xterm falls back to DOM silently, and the webgl arm then fails. The failure reads as a Korean rendering defect and is not one, so the webgl arm now skips with the active renderer named. The dom arm keeps the assertion unchanged. This is the third of three checks that have been red on this branch since 2026-08-06. `static analysis` and `verify` were fixed in c51c6b5837e; the CI log shows this job as 1 failed / 1 passed, the pass being the dom arm. * chore(lint): drop five unused no-console disable directives `check-changed-code-quality` reports unused eslint-disable directives as errors, and these five sat above diagnostic `console.log` calls in IME test and spec files where `no-console` is not enabled — so each suppressed nothing. This is the second of the two static-analysis steps. `c51c6b5837e` fixed "Enforce focused code-quality plugins" (duplicate test titles); this fixes "Enforce changed-code quality". Both had been red on this branch since 2026-08-06, and I mistook the first for the whole job. The diagnostic logs themselves are kept — they are what a failing IME arm prints for a reader to inspect. * test(e2e): cover #12164 under fractional device scale factor Fractional display scaling was #12164's last unexplored branch, and the reason is worth recording: earlier attempts were BLOCKED, correctly, because they proposed mutating the Windows display scale on a remote physical machine with no console recovery. `--force-device-scale-factor` reaches the same renderer state per process, so nothing outside the Electron instance changes and there is nothing to restore. The hypothesis was specific: `프프로로젝젝트트` is what a half-pixel cell boundary could produce on a 2-column glyph, and nothing else in the suite varies dpr. Measured at 1.25 and 1.5, both under WebGL: ink extents 25/21/16 with identical ink groups, matching the scale-1 run. No doubling. The arm self-certifies before asserting — if the flag does not take, the test fails rather than silently measuring at dpr 1. That matters here: the sibling spec's WebGL arm went two days reporting a missing GPU as a Korean rendering defect precisely because a silent fallback looked like a result. * fix(terminal): match Mod+letter shortcuts by physical key, not IME-rewritten key With a CJK input source active, macOS and Windows report the physical key through `code` but rewrite `key` to the layout's character: Korean 2-Set turns Cmd+C into `{ key: "ㅊ", code: "KeyC", metaKey: true }`. Every `key.toLowerCase() === 'c'` match misses it, so the shortcut is not recognised and xterm encodes the chord as PTY input instead — issue #13033 reports `ESC[12618;9u` and a terminal that jumps to the bottom, because user input scrolls the viewport. This is the same key-vs-code confusion that owned #12171, where a `Shift+T` typing ㅆ was read as Enter for want of a `code` guard, so the fix is the same shape: trust `code` when it is present, fall back to `key` and then the legacy `keyCode` when it is not (Chromium omits `code` on synthetic and some keypress events, and `keyCode` keeps its US value even when `key` is rewritten). Applied to the four terminal-side sites, including the dashboard pop-out, which #13033 called out specifically as having its own key handler: pty-connection.ts Cmd/Ctrl+C copy guard keyboard-handlers.ts Cmd+G search navigation agent-interrupt-inference.ts interrupt inference preview-terminal-key-handler.ts pop-out paste Nine further `key.toLowerCase()` letter matches exist outside the terminal (TaskPage, editor, GitHub composer, browser markup). They have the same defect and are deliberately left for a separate change rather than widening this one. An existing case, `matchSearchNavigate > returns null for wrong key`, overrode only `key` and left `code: 'KeyG'`, so it began passing for the wrong reason. It now overrides both — which is what "wrong key" means once matching is physical — and a companion case pins the Korean-rewritten chord still matching. #13033 was closed NOT_PLANNED; the reporter's event shapes drive the new test. * fix(renderer): match every Mod+letter shortcut by physical key, not IME-rewritten key Completes the previous commit. A CJK input source rewrites `event.key` while `event.code` keeps the physical key, so `key.toLowerCase() === 'z'` and friends silently stop matching — the shortcut is not recognised and the keystroke falls through to whatever handles unclaimed input. The helper moves to `@/lib/ime-latin-shortcut-key` first: it now serves the editor, GitHub composer and browser markup, and importing terminal-pane internals into those would be the wrong direction. `lib/` already hosts `ime-composition-keyboard-event` for the same reason. Nine remaining sites, all previously unreachable under Korean/Japanese/Chinese/ Vietnamese input: TaskPage, ActivityPrototypePage, ProjectViewWrapper Cmd+F search useMarkupKeyboardShortcuts Cmd+Z undo GitHubMarkdownComposer, RichMarkdownLinkBubble, rich-markdown-link-shortcut Cmd+K link native-chat-shortcut Cmd+J rich-markdown-key-handler Cmd+Shift+X Six of the nine test `!== 'letter'` as early-return guards and three test `=== 'letter'`; the negation is applied per site, since a blind substitution would have inverted six of them. Full suite: 4249 files pass. Three files fail locally and none is caused by this change — the branch touches no file under `src/main/` or `src/relay/`, all four failures reproduce on an unmodified tree or pass in isolation (the worktree poller passes 21/21 alone, so it is full-suite parallelism), and all 16 CI test shards are green. * docs(ime): scope the IME composition rules to the terminal-pane directory #11893 proposed adding these to the root `AGENTS.md`, which every agent loads on every task regardless of what it is doing. They only bind keyboard handling, the composer and the terminal input path, so they belong next to that code — `tests/e2e/AGENTS.md` already establishes the nested convention here. Kept from #11893: range-derived commits, guarding above the key dispatch, the `attachCustomKeyEventHandler` / `CompositionHelper` interaction, no normalization at commit, and the recorded-trace evidence bar. Added from defects found since it was written: - match shortcuts on `event.code`, not `event.key` (#12171, #13033) - `keyCode === 229` means an IME owns the press - do not unmount a field mid-composition, and hiding is not a fix because `display:none` blurs and aborts it too (#12118, STA-3219, #11332) The evidence bar now also names the mutation check, since a test that survives deleting the code it guards is guarding nothing — a failure this effort hit more than once. * fix(terminal): gate Ctrl+Enter CSI-u on a negotiated pane, porting #12462 Found while scoping the rebase onto `main`: #12462 landed on 2026-08-06 and fixes a real defect this branch does not carry. Ctrl+Enter emitted `\x1b[13;5u` unconditionally, so a pane that never negotiated the kitty keyboard protocol — local Windows ConPTY, plain shell — printed the escape verbatim into the prompt. This branch deletes `terminal-ime-deferred-newline.ts`, which is one of the files #12462 touched, so a rebase resolving those conflicts by taking our side wholesale would silently reintroduce the defect. Porting it forward now means the fix survives the rebase however the conflicts are resolved. Mirrors the Shift+Enter guard already here: local ConPTY falls back to the legacy CR every emulator sends, and a negotiated pane keeps the chord, so the fallback is scoped to panes that cannot receive CSI-u rather than to Windows. NARROWER THAN #12462 BY ONE CONDITION, deliberately. `main` also allows CSI-u via `hasCtrlEnterCsiUAuthority()` (trusted consumer evidence, #12329); that helper and its plumbing do not exist on this branch. Omitting it is the conservative direction — an authorised pane gets `\r` instead of the chord, rather than an unnegotiated pane printing an escape — but it should be restored when the two histories are reconciled. Test covers both directions and is mutation-checked: forcing the gate open fails it, so it cannot pass by construction. * fix: reconcile two more fixtures main moved while the stack waited Both caught by CI, not locally, and the reason the local run missed one is worth recording: 1. `browser-toolbar-profile-dialogs.ime-enter.test.tsx` did not pass `useNativeUserAgent` / `onUseNativeUserAgentChange`, which `main` added to `BrowserToolbarProfileDialogsProps`. Local `pnpm typecheck` reported 0 errors on the same commit CI failed. The cause was a stale `config/*.tsbuildinfo` — tsc reused an incremental cache from before the merge. Deleting it reproduced CI's error exactly. Any "typecheck clean" during this merge should be treated as unverified unless the cache was cleared first. 2. Localization keys for `SshDisconnectedDialog` were absent from `en.json`: the merge took this branch's component alongside `main`'s catalog. Regenerated with `pnpm run sync:localization-catalog` rather than hand-added. * fix(mobile): regenerate the lockfile the merge resolved by taking one side CI's `verify` failed with `ERR_PNPM_OUTDATED_LOCKFILE` on `mermaid (lockfile: 11.16.0, manifest: 11.16.1)`. The mismatch was in `mobile/`, not the root — the root lockfile was consistent throughout, which is why inspecting it (and even GitHub's merge ref) found nothing wrong. Cause: during the merge I resolved `mobile/pnpm-lock.yaml` by taking this branch's side wholesale rather than merging it, so it kept `mermaid 11.16.0` while `mobile/package.json` came from `main` at `11.16.1`. Taking one side of a lockfile is only safe when the corresponding manifest comes from the same side. Regenerated with `pnpm install --lockfile-only`; `--frozen-lockfile` now passes in `mobile/`. Verified the xterm patch entry survives intact — same hash `4f1b42d268f3964d…` and the parent-relative path into `config/patches/`, which is the desktop/mobile coupling that would silently break the mobile build. Two earlier diagnoses of this failure were wrong and are worth recording: it was not the root lockfile, and it was not a stale merge ref (a rerun reproduced it exactly). --------- Co-authored-by: Orca <help@stably.ai>	2026-08-07 22:58:40 -07:00
4 people	757b785e43	fix(deps): resolve Dependabot security alerts across root and mobile (#13113) ... Clears 47 of 49 open Dependabot alerts across the root and mobile lockfiles. The 2 remaining (image-size) have no patched upstream release. Direct bumps: pdfjs-dist 5.7.284 -> 6.2.108 (CVE-2026-16633), mermaid 11.16.0 -> 11.16.1 (root + mobile), dompurify 3.4.12 -> 3.4.13. In-range re-resolves: brace-expansion, fast-uri, hono, ip-address, js-yaml 4.3.1/3.15.1, nanoid, postcss, tar, undici 6.28.0/7.29.0. Drops the @modelcontextprotocol/sdk>@hono/node-server override by bumping shadcn's transitive SDK to 1.30.0, which widens its range to ^1.19.9 || ^2.0.5 so @hono/node-server resolves to a patched 2.1.0 on its own. The other two overrides must stay: monaco-editor hard-pins dompurify 3.2.7 and xcode wants uuid ^7.0.3, both vulnerable. pdf.js 6 removed PDFDocumentProxy.destroy(); PdfViewer now tears the document down via the loading task it was already destroying. Supersedes #13074, #13090, #12960, #12952. Co-authored-by: mondaychen <monday.chen@gmail.com> Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Orca <help@stably.ai>	2026-08-07 19:56:26 -07:00
3 people	a7ed5a45c2	fix(mobile): render Mermaid diagrams in MobileMarkdown (#11185) ... * fix(mobile): render Mermaid diagrams in MobileMarkdown (#11141) Co-Authored-By: Grok Companion <noreply@x.ai> * fix(mobile): keep streaming mermaid fences as raw code until the fence closes * perf(mobile): memoize MermaidDiagram and add a CDN load watchdog * fix(mobile): escape mermaid source before embedding in WebView script JSON.stringify leaves </script>, &, and U+2028/U+2029 raw, so a diagram source containing </script> broke out of the inline script and ran arbitrary WebView JS. Diagram source is untrusted (agent output, PR/chat content), and this component now renders from chat and markdown preview, not just the PR sidebar. Escape those chars to \uXXXX; the literal still parses back to the exact source. Adds an adversarial buildHtml test. * fix(mobile): embed the mermaid engine instead of fetching it from a CDN The diagram WebView loaded mermaid from jsdelivr at runtime: offline and constrained-network renders always fell back, the stalled-load watchdog existed only to paper over that, and an unpinned floating-major CDN script with no integrity check ran inside the WebView. Embed the lockfile-pinned package's prebuilt bundle via a postinstall generator (same mechanism as the terminal WebView engine) so the document loads nothing external; the watchdog is removed as obsolete and a no-external-URL gate pins it. * chore(deps): align mermaid at 11.16.0 across desktop and mobile Desktop floated ^11.15.0 while the mobile embedded engine resolved 11.16.0. Raise the desktop floor so both lockfiles resolve the same version, and pin mobile exact: the generated WebView engine embeds the package bytes, so an implicit range bump would silently change what ships. * fix(mobile): block Mermaid diagram network requests Mermaid image-node URLs can initiate subresource requests even with the engine embedded. Keep the WebView offline by restricting resource types through its document CSP. * style(mobile): format Mermaid routing test * fix(mobile): use stable keys for Mermaid diagrams * fix(mobile): keep duplicate Mermaid keys distinct Combine each diagram source with its sibling occurrence so identical diagrams remain unique while source edits still remount the WebView and later streaming prose does not. * fix(mobile): keep Mermaid transitive within release-age policy --------- Co-authored-by: Grok Companion <noreply@x.ai> Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>	2026-08-03 20:05:16 -07:00
Brennan Benson	af2972b3a9	fix(mobile): declare happy-dom so terminal-webview tests run standalone (#11238) ... mobile/src/terminal/terminal-webview-{tap-routing,init-surface}.test.ts request the happy-dom vitest environment, but happy-dom was only declared at the repo root. The mobile suite resolved it by walking up into the root node_modules, so `cd mobile && pnpm install && pnpm test` fails with ERR_MODULE_NOT_FOUND and loses those 12 tests unless a root install happens to be present.	2026-07-28 20:27:42 -07:00
Jinwoo HongandOrca	77b154d5dd	Add Orca Relay desktop and mobile transport (#8536) ... * feat(mobile): define relay protocol groundwork Co-authored-by: Orca <help@stably.ai> * feat(mobile): implement replay-safe E2EE v2 sessions Co-authored-by: Orca <help@stably.ai> * test(auth): lock cloud refresh single-flight Co-authored-by: Orca <help@stably.ai> * test(mobile): complete E2EE v2 adversarial coverage Co-authored-by: Orca <help@stably.ai> * refactor(runtime): unify mobile socket wiring Co-authored-by: Orca <help@stably.ai> * feat(runtime): add relay control and data clients Co-authored-by: Orca <help@stably.ai> * feat(runtime): coordinate desktop relay sessions Co-authored-by: Orca <help@stably.ai> * fix(auth): fence stale cloud session mutations Co-authored-by: Orca <help@stably.ai> * feat(runtime): add relay pairing and durable revoke Co-authored-by: Orca <help@stably.ai> * feat(runtime): add relay credential pairing RPCs Co-authored-by: Orca <help@stably.ai> * feat(settings): show Orca Relay sign-in status Co-authored-by: Orca <help@stably.ai> * test(relay): prove desktop lifecycle and E2EE splice Co-authored-by: Orca <help@stably.ai> * feat(mobile): persist relay pairing state Co-authored-by: Orca <help@stably.ai> * feat(mobile): race direct and relay pairing Co-authored-by: Orca <help@stably.ai> * feat(mobile): recover pairing through relay director Co-authored-by: Orca <help@stably.ai> * fix(relay): preserve origin controls during drain Co-authored-by: Orca <help@stably.ai> * feat(mobile): recover interrupted relay pairing Co-authored-by: Orca <help@stably.ai> * feat(mobile): add stable relay RPC sessions Co-authored-by: Orca <help@stably.ai> * feat(mobile): supervise direct and relay endpoints Co-authored-by: Orca <help@stably.ai> * Cover mobile relay director fallback matrix Co-authored-by: Orca <help@stably.ai> * Fix relay settings component test isolation Co-authored-by: Orca <help@stably.ai> * Remove unrelated merge formatting drift Co-authored-by: Orca <help@stably.ai> * Update runtime connection count integration assertion Co-authored-by: Orca <help@stably.ai> * Run mobile typecheck through pnpm Co-authored-by: Orca <help@stably.ai> * feat(relay): gate desktop controls on mobile demand Co-authored-by: Orca <help@stably.ai> * test(mobile): cover served relay recovery Co-authored-by: Orca <help@stably.ai> * feat(mobile): upgrade direct pairings to relay Co-authored-by: Orca <help@stably.ai> * fix(relay): harden mobile reconnect and teardown Co-authored-by: Orca <help@stably.ai> * fix(auth): clarify account sign-in state Co-authored-by: Orca <help@stably.ai> * fix(auth): polish sign-in completion flow Co-authored-by: Orca <help@stably.ai> * fix(auth): clarify sign-out confirmation Co-authored-by: Orca <help@stably.ai> * fix(auth): simplify sign-in completion page Co-authored-by: Orca <help@stably.ai> * feat(mobile): add per-device pairing connection mode Co-authored-by: Orca <help@stably.ai> * fix(mobile): stabilize pairing option layout Co-authored-by: Orca <help@stably.ai> * fix(mobile): give pairing choices stable space Co-authored-by: Orca <help@stably.ai> * fix(mobile): stabilize pairing QR regeneration Co-authored-by: Orca <help@stably.ai> * Animate mobile pairing flow height Co-authored-by: Orca <help@stably.ai> * Configure auth in packaged builds Co-authored-by: Orca <help@stably.ai> * Make Orca Relay pairing an opt-in beta Co-authored-by: Orca <help@stably.ai> * Show Relay beta details on hover Co-authored-by: Orca <help@stably.ai> * Refine mobile relay pairing choice Co-authored-by: Orca <help@stably.ai> * Polish Orca Relay pairing controls Co-authored-by: Orca <help@stably.ai> * Keep mobile contract fallback test additive Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: Orca <help@stably.ai>	2026-07-14 11:47:05 -07:00
Neil	cf04845f5b	fix(mobile): keep TypeScript 6 for Expo Metro bundling (#8243)	2026-07-11 00:04:03 -07:00
JinjingandOrca	2e48495273	Prevent mobile screen locking during voice dictation. (#7746) ... * Prevent mobile screen locking during voice dictation Integrate expo-keep-awake to prevent the mobile device from locking or sleeping while a voice dictation session is active. - Modularize useMobileDictation logic into separate helper files for keep-awake, audio chunking, session state, and desktop startup. - Acquire keep-awake lock only after successfully establishing a desktop session to avoid locking on stale start attempts. - Release the keep-awake lock on all completion, cancellation, error, and unmount paths. - Add source invariant unit tests to verify keep-awake ownership and strict cleanup ordering. * serialize keep-awake operations and avoid stale dictation start races - Implement a global execution queue and tag tracking for keep-awake operations to prevent concurrent races and stale deactivations. - Track failed native deactivations and retry them when a replacement hook owner mounts or starts a new dictation session. - Ensure stale or canceled desktop dictation starts do not reset the UI state or propagate outdated start/keep-awake failures. - Reuse the audio chunk queue wiring in useMobileDictation to avoid allocating new closure objects on the high-frequency microphone path. - Add comprehensive unit tests for the keep-awake and desktop start hooks. * Commit native recording during dictation session startup Commit native recording in the same continuation as the final session stale check. This prevents a queued cancellation from resurrecting the microphone recording after cleanup has already run. If microphone initialization fails or throws, acquired resources (like keep-awake locks and the remote desktop session) are properly rolled back. * Make keep-awake acquisition best-effort with a bounded startup timeout - Recording start no longer blocks (or fails) on keep-awake acquisition: a hung or failing native call is capped at a short budget and logged instead of delaying or aborting dictation. - Add native-call timeouts, orphan-tag tracking, and reacquire/drain logic in mobile-dictation-keep-awake.ts so Activity recreation on Android and stale tags no longer wedge the keep-awake queue. - Add useMobileDictationForegroundKeepAwake to refresh the wake tag on Android foreground and retry failed refreshes/deactivations. - Hold the wake tag through chunk drain and the finish RPC so a screen lock can't suspend the app before the transcript arrives, and keep cleanup running even if native recording shutdown throws. - Loosen expo-keep-awake to a caret range to unblock the patch pulling in these native fixes. * Fix cancellation races in mobile dictation keep-awake handling - Run wake-lock release and dictation cancel concurrently on stale starts so a hung acquisition no longer delays the native cancel - Guard foreground reacquire retries with a run token so a stale retry chain can't deactivate a wake lock reacquired by a newer AppState transition * Update source invariant test for concurrent stale-start cleanup Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: Orca <help@stably.ai>	2026-07-10 23:31:56 -07:00
Neil	69776e8d2b	Upgrade to TypeScript 7 and Electron 43 (#8189)	2026-07-10 19:08:12 -07:00
Brennan BensonandOrca	f4790e9fac	Fix blank mobile terminal on Android devices with outdated WebViews or blocked CDN (#7186) ... * fix(mobile): bundle terminal engine and show load errors instead of a blank pane The mobile terminal WebView loaded xterm.js from cdn.jsdelivr.net at runtime; old WebViews (< Chrome 85) fail to parse the modern bundle and blocked-CDN networks fail to fetch it, and the resulting error was silently dropped, leaving the pane permanently blank (#7030). Bundle the engine into the app via exact-pinned npm deps + a postinstall esbuild step (chrome74 target, guarded WeakRef/structuredClone/ replaceChildren shims) emitting a gitignored generated module, inline it into the terminal document, and surface fatal engine failures as a visible overlay with diagnostics and a Reload wired into the existing resubscribe path. Non-fatal errors log without covering a live terminal. Co-authored-by: Orca <help@stably.ai> * fix(mobile): add a native watchdog so a dead terminal document can't stay silently blank CodeRabbit round: if the webview document dies before the glue can post anything (or the RN message bridge never comes up), no error message and no native handler fires. Arm a 15s foreground-gated watchdog per document generation that paints the fatal overlay when web-ready never arrives; first fatal diagnostics win over later cascades. Extract the watchdog and the public contract types to keep TerminalWebView under the line cap, and document the SVG xmlns percent-encoding transform. Co-authored-by: Orca <help@stably.ai> * test(mobile): unmount TerminalWebView renderers so watchdog timers can't leak across tests Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: Orca <help@stably.ai>	2026-07-03 15:22:00 -07:00
WONGILandJinjing	4f0a141951	Fix mobile terminal Korean IME composition on Android (#7011) ... * Fix Korean IME composition by deferring live terminal preedit The mobile terminal capture field previously sent and cleared every TextInput change, which can break Hangul composition on Android keyboards. Introduce a small commit model and extracted live-input hook so composed text is flushed deliberately while ASCII remains immediate. Constraint: React Native TextInput has no portable composition event for this path; the fix uses a bounded commit delay for likely IME text. Rejected: Native-module IME integration | unnecessary for the confirmed JS dispatch/clear failure and higher maintenance risk. Confidence: high Scope-risk: moderate Directive: Keep terminal.send payload shape and buffered command input unchanged; do not claim physical Samsung Keyboard QA without device evidence. Tested: cd mobile && pnpm exec vitest run src/terminal/terminal-live-text-commit.test.ts src/terminal/terminal-live-input.test.ts src/terminal/terminal-text-input-normalization.test.ts src/terminal/terminal-keyboard-type.test.ts --reporter=verbose Tested: cd mobile && pnpm exec tsc --noEmit Tested: cd mobile && pnpm exec oxlint src/terminal/terminal-live-text-commit.ts src/terminal/terminal-live-text-commit.test.ts src/terminal/use-terminal-live-input-commit.ts app/h/[hostId]/session/[worktreeId].tsx Not-tested: Physical Galaxy Fold7/Samsung Keyboard and Android emulator/Gboard QA were unavailable; device probes recorded no attached Android device. * Preserve pending Korean IME text before mobile accessory controls Accessory keys share the same pending live-input commit gate as TextInput keypress and submit paths, so control bytes cannot race ahead of composed Hangul. Constraint: React Native mobile input does not expose portable composition events for Samsung/Gboard IME paths. Rejected: Let accessory buttons keep sending directly | Direct sends can drop pending Hangul before Tab/Esc/Enter/Backspace reaches the PTY. Confidence: high Scope-risk: narrow Directive: Keep all terminal control-byte paths behind the pending live-input flush/local-edit decision before sending to the PTY. Tested: pnpm --dir mobile test; pnpm --dir mobile lint; pnpm --dir mobile exec tsc --noEmit; pnpm --dir mobile exec oxfmt --check src/terminal/terminal-live-text-commit.ts src/terminal/terminal-live-text-commit.test.ts src/terminal/use-terminal-live-input-commit.ts src/terminal/use-terminal-live-accessory-input-commit.ts app/h/[hostId]/session/[worktreeId].tsx; git diff --cached --check Not-tested: Physical Galaxy Fold7 Samsung keyboard manual QA is still external-device only. * Prevent stale IME timer flushes after mobile terminal teardown Pending live-input timers now clear on hook unmount, and accessory Delete documents why it stays local without trimming pending IME text. Constraint: React Native TextInput lacks a portable composition lifecycle, so pending IME text is guarded by a bounded timer that must not survive screen teardown. Rejected: Use clearPendingLiveInputCommit during unmount | it would also touch React state/native props during teardown when only timer/ref cleanup is required. Confidence: high Scope-risk: narrow Directive: Any delayed terminal input commit must have an owner-lifecycle cleanup path before sending to the PTY. Tested: pnpm --dir mobile test; pnpm --dir mobile lint; pnpm --dir mobile exec tsc --noEmit; pnpm --dir mobile exec vitest run src/terminal/terminal-live-text-commit.test.ts --reporter=verbose; pnpm --dir mobile exec oxfmt --check src/terminal/terminal-live-text-commit.ts src/terminal/use-terminal-live-input-commit.ts; git diff --check Not-tested: Physical Galaxy Fold7 Samsung keyboard manual QA remains unavailable in this environment. * Use semantic accessory edits for mobile IME commits Accessory Backspace/Delete now carry semantic local-edit intent from built-in keys instead of inferring intent from raw bytes, and submit handling is reconnected to the pure submit-sequence model. Constraint: Custom terminal accessory keys may produce the same bytes as built-ins but should still flush pending IME text before sending rather than being silently treated as hidden-input edits. Rejected: Classify local accessory edits by raw bytes | That couples future custom controls to current built-in byte encodings. Confidence: high Scope-risk: narrow Directive: Keep semantic input intent separate from terminal byte payloads when pending IME text is present. Tested: pnpm --dir mobile test; pnpm --dir mobile lint; pnpm --dir mobile exec tsc --noEmit; pnpm --dir mobile exec oxfmt --check src/terminal/terminal-live-text-commit.ts src/terminal/terminal-live-text-commit.test.ts src/terminal/use-terminal-live-input-commit.ts src/terminal/use-terminal-live-accessory-input-commit.ts app/h/[hostId]/session/[worktreeId].tsx; git diff --check Not-tested: Physical Galaxy Fold7 Samsung keyboard manual QA remains unavailable in this environment. * Respect IME flush failures before control input Propagate terminal.send success from pending Korean IME text before sending Enter, Tab, or accessory bytes, while keeping custom no-pending accessory bytes on the original direct path. Constraint: PR #7011 review required follow-up control bytes only after the pending composed text send actually succeeds. Rejected: Treating send invocation as success | It can still reject or no-op when RPC state changed. Confidence: high Scope-risk: narrow Directive: Keep pending IME flush paths async-success-aware before adding new terminal control inputs. Tested: pnpm --dir mobile test; pnpm --dir mobile exec tsc --noEmit; pnpm --dir mobile lint; pnpm --dir mobile exec oxfmt --check changed files; targeted no-excuse clean for mobile/src/terminal changed files. Not-tested: Physical Galaxy Fold7 Samsung keyboard; full session file no-excuse audit still reports pre-existing unrelated violations. * Serialize mobile IME flushes before live controls Treat terminal.send as successful only when the RPC response is ok and the runtime send result is accepted, then route all live-input control sends through a shared in-flight pending-flush barrier. Constraint: PR #7011 review found that resolved RPC promises and per-call sequencing were not enough to prove pending Hangul text reached the PTY before follow-up controls. Rejected: Only awaiting each flush-then-send call | Repeatable accessory keys and no-pending sends can arrive while the first flush is still in flight. Confidence: high Scope-risk: moderate Directive: Keep future mobile terminal control paths behind the pending-flush barrier whenever IME text may be in flight. Tested: pnpm --dir mobile test; pnpm --dir mobile exec tsc --noEmit; pnpm --dir mobile lint; pnpm --dir mobile exec oxfmt --check changed files; no-excuse clean for terminal changed files. Not-tested: Physical Galaxy Fold7 Samsung keyboard; full session file no-excuse audit still reports pre-existing unrelated violations. * Queue current IME snapshots behind active flushes Drain the pending snapshot captured by a control action after any already-active terminal send, and make accessory commit handling explicit so raw fallback is not encoded as an inverted boolean. Constraint: Architecture review found the previous single-slot barrier could wait for an older flush while skipping newly pending Hangul text. Rejected: Reusing the prior in-flight promise as the current flush result | It proves only an older snapshot, not the current pending buffer. Confidence: high Scope-risk: narrow Directive: New mobile terminal control paths must distinguish allow-raw, handled, and suppress-raw outcomes explicitly. Tested: pnpm --dir mobile test; pnpm --dir mobile exec tsc --noEmit; pnpm --dir mobile lint; pnpm --dir mobile exec oxfmt --check changed files; no-excuse clean for terminal changed files. Not-tested: Physical Galaxy Fold7 Samsung keyboard; full session file no-excuse audit still reports pre-existing unrelated violations. * Preserve accessory raw-send terminal targets Capture the terminal handle at accessory keypress time and suppress raw fallback if the active live terminal changes while waiting for pending IME flushes. Constraint: Independent review found raw accessory bytes could retarget to a different terminal after an async IME flush barrier. Rejected: Re-reading activeHandleRef as the send target after await | It can point at a different terminal than the keypress belonged to. Confidence: high Scope-risk: narrow Directive: Raw accessory fallback must use the keypress-time target and revalidate it after any await. Tested: pnpm --dir mobile test; pnpm --dir mobile exec tsc --noEmit; pnpm --dir mobile lint; pnpm --dir mobile exec oxfmt --check changed files; no-excuse clean for terminal changed files. Not-tested: Physical Galaxy Fold7 Samsung keyboard; full session file no-excuse audit still reports pre-existing unrelated violations. * Document accessory flush barrier intent Make the non-obvious raw accessory wait/suppress behavior explicit so future changes preserve IME-before-control ordering. Constraint: CodeRabbit requested a why-comment for the send-now accessory branch. Rejected: Leaving the barrier semantics implicit | The branch can otherwise look like unnecessary async defensive code. Confidence: high Scope-risk: narrow Directive: Keep comments focused on why raw accessory bytes wait behind IME flushes. Tested: targeted terminal vitest suite; pnpm --dir mobile exec tsc --noEmit; pnpm --dir mobile lint; oxfmt check for changed file. Not-tested: Physical Galaxy Fold7 Samsung keyboard. * Preserve buffered accessory raw sends Keep the stale-handle guard focused on the captured active terminal instead of live-input opt-in state, so buffered mode keeps existing accessory key behavior while async live-input waits still cannot retarget to another terminal. Constraint: Buffered command input behavior must remain unchanged while fixing mobile Korean IME live input ordering. Rejected: Requiring live-input enabled handles for raw accessory fallback | suppresses valid buffered-mode accessory sends. Confidence: high Scope-risk: narrow Directive: Do not use live-input opt-in state as terminal liveness for raw accessory sends; validate captured target, active terminal tab, connection, and client instead. Tested: pnpm --dir mobile test; pnpm --dir mobile exec tsc --noEmit; pnpm --dir mobile lint; oxfmt --check changed mobile terminal/session files; TypeScript no-excuse checker for changed terminal files. Not-tested: Physical Galaxy Fold7 Samsung Keyboard manual QA and GitHub Actions jobs, blocked by unavailable device and upstream fork workflow approval. * Keep Hangul IME text pending until explicit flush Avoid timer-driven PTY writes for Hangul candidates so paused Korean composition cannot leak intermediate jamo, while preserving the bounded settle timer for non-Hangul IME text. Also keep disabled live-input accessory fallback behind any existing pending flush barrier. Constraint: React Native TextInput does not expose a portable composition lifecycle on this mobile surface. Rejected: Fixed 150ms auto-flush for Hangul | can emit ㅎ or 하 if the user pauses mid-composition. Confidence: high Scope-risk: narrow Directive: Treat Hangul candidates as pending until submit/control/accessory flush; do not reintroduce idle timer commits for Hangul without device-level composition evidence. Tested: pnpm --dir mobile test; pnpm --dir mobile exec tsc --noEmit; pnpm --dir mobile lint; oxfmt --check changed mobile terminal/session files; TypeScript no-excuse checker for changed terminal files. Not-tested: Physical Galaxy Fold7 Samsung Keyboard manual QA and GitHub Actions jobs, blocked by unavailable device and upstream fork workflow approval. * Gate dictation toast on accepted live send Honor the async live-input sender contract so the mobile UI reports dictation insertion only after terminal.send is accepted. Constraint: sendLiveTerminalInput now returns false for stale, disconnected, oversized, or rejected terminal sends. Rejected: Toasting immediately after dispatch | reports success for sends that never reached the PTY. Confidence: high Scope-risk: narrow Directive: Treat live-input UI success as terminal.send acceptance, not request dispatch. Tested: pnpm --dir mobile test; pnpm --dir mobile exec tsc --noEmit; pnpm --dir mobile lint; oxfmt --check app/h/[hostId]/session/[worktreeId].tsx. Not-tested: Physical Galaxy Fold7 Samsung Keyboard manual QA and GitHub Actions jobs, blocked by unavailable device and upstream fork workflow approval. * Keep accessory edits on Hangul pending path Make accessory local edits reuse the Hangul-aware defer policy so built-in Backspace/Delete cannot reintroduce timer-driven Hangul PTY writes. Constraint: Hangul IME candidates must remain pending until explicit submit/control/accessory flush. Rejected: Reusing the non-Hangul 150ms settle timer for accessory local edits | can leak pending Hangul after Backspace/Delete. Confidence: high Scope-risk: narrow Directive: Any future pending-text reschedule must use getTerminalLiveDeferredTextDelayMs instead of a hardcoded timer. Tested: pnpm --dir mobile test; pnpm --dir mobile exec tsc --noEmit; pnpm --dir mobile lint; oxfmt --check changed mobile terminal/session files; TypeScript no-excuse checker for changed terminal files. Not-tested: Physical Galaxy Fold7 Samsung Keyboard manual QA and GitHub Actions jobs, blocked by unavailable device and upstream fork workflow approval. * Prove Hangul live-input hook ordering Add a direct hook-level regression so Android Korean IME fixes are covered at the orchestration boundary, not only by lower-level helpers. Constraint: React Native mobile TextInput lacks portable composition lifecycle events in this path. Rejected: Relying only on helper tests | misses hook-level pending flush and submit ordering. Confidence: high Scope-risk: narrow Directive: Keep Hangul candidates pending until an explicit terminal action flushes them. Tested: pnpm --dir mobile test; pnpm --dir mobile exec tsc --noEmit; pnpm --dir mobile lint; oxfmt --check changed mobile files; no-excuse on terminal modules Not-tested: Physical Galaxy Fold Samsung Keyboard manual QA is not available in this environment. * Keep accessory raw-send tests precise Remove a duplicate raw-target assertion whose title implied disabled live-input behavior that is covered at the accessory commit boundary instead. Constraint: Anti-slop cleanup must preserve existing Hangul/accessory behavior and stay within changed terminal tests. Rejected: Keeping the duplicate disabled-input wording | it tests the same active-terminal predicate as the preceding case. Confidence: high Scope-risk: narrow Directive: Test disabled live-input buffering in the accessory commit layer, not in the raw-target predicate helper. Tested: pnpm --dir mobile test; pnpm --dir mobile exec tsc --noEmit; pnpm --dir mobile lint; pnpm --dir mobile exec oxfmt --check changed mobile files; terminal no-excuse checker Not-tested: Physical Galaxy Fold Samsung Keyboard manual QA is not available in this environment. * Explain stale mobile terminal send gates Document why async IME flush paths re-check terminal/client refs before sending raw bytes or reporting live-send success. Constraint: CodeRabbit review requested short why comments for non-obvious stale-send safety gates. Rejected: Leaving the gates undocumented | future edits could remove the stale-target suppression contract. Confidence: high Scope-risk: narrow Directive: Keep async terminal sends guarded by current client, active handle, tab type, and connection state. Tested: pnpm --dir mobile test; pnpm --dir mobile exec tsc --noEmit; pnpm --dir mobile lint; pnpm --dir mobile exec oxfmt --check changed mobile files; terminal no-excuse checker Not-tested: Physical Galaxy Fold Samsung Keyboard manual QA is not available in this environment. * Run mobile IME hook tests through effects Move the Hangul live-input hook regression from server rendering to react-test-renderer so effect cleanup and unmount timer cancellation are exercised. Constraint: @testing-library/react-native imports React Native's Flow entry under this Vitest setup, so the narrow effect-running renderer is the compatible test surface. Rejected: Keeping renderToString | it never runs useEffect cleanup and missed the pending timer cleanup path. Rejected: Adding @testing-library/react-native directly | it failed before tests with React Native Flow syntax under the current Vitest transform. Confidence: high Scope-risk: narrow Directive: Hook-level IME tests must use a renderer that runs effects when asserting pending flush cleanup. Tested: vitest targeted terminal tests; pnpm --dir mobile test; pnpm --dir mobile exec tsc --noEmit; pnpm --dir mobile lint; oxfmt --check changed mobile files; terminal no-excuse checker Not-tested: Physical Galaxy Fold Samsung Keyboard manual QA is not available in this environment. * Keep hook lifecycle tests quiet Suppress only the react-test-renderer deprecation warning around the effect-running hook harness so real console errors still surface. Constraint: CodeRabbit flagged React 19 renderer warning noise; @testing-library/react-native remains incompatible with the current Vitest/RN Flow transform path. Rejected: Global console silencing | it would hide unrelated test failures. Confidence: high Scope-risk: narrow Directive: Keep the renderer warning suppression scoped to this hook harness and pass all other console errors through. Tested: vitest targeted terminal tests; pnpm --dir mobile test; pnpm --dir mobile exec tsc --noEmit; pnpm --dir mobile lint; oxfmt --check changed mobile files; terminal no-excuse checker Not-tested: Physical Galaxy Fold Samsung Keyboard manual QA is not available in this environment. * fix: flush pending mobile IME input before external sends * fix: guard terminal command finished event dispatch --------- Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>	2026-07-02 02:31:19 -07:00
NeilandOrca	46646d7ff1	chore(lint): upgrade oxlint to 1.71 + enable 7 new rules (autofixed backlog) (#6841) ... * chore(lint): upgrade oxlint to 1.71 and enable 7 new rules Upgrade oxlint 1.67.0 -> 1.71.0 (1.72 was blocked by the repo's 3-day minimum-release-age supply-chain guard; nothing here needs it). The bump is a no-op on the existing config. Enable 3 error rules (backlog autofixed to zero in this commit) and 4 warn rules (surface signal without gating CI): error (autofixed, behavior-preserving): - unicorn/prefer-node-protocol (~1531 sites: bare builtin -> node:) - typescript/no-import-type-side-effects (~36: all-inline-type -> import type) - unicorn/no-array-reverse (19: copy-then-reverse -> toReversed) warn (real signal, current fires are test-only/correct): - unicorn/no-array-fill-with-reference-type (aliasing footgun guard) - typescript/no-unsafe-function-type (bans bare Function type) - unicorn/prefer-array-flat-map (map().flat() -> flatMap()) - unicorn/prefer-regexp-test (.match() in bool ctx -> .test()) mobile/.oxlintrc.json extends root, so it inherits all 7; the autofix ran from root and covered mobile/ too. Verification (all green): oxlint 0 errors (root+mobile+aux configs), oxfmt clean, typecheck (node+cli+web), vitest 22795 passed / 0 failed, builds (electron-vite + web + cli) succeed. node: rewrites confirmed to skip embedded SSH/CLI string payloads (AST-only); all toReversed sites verified to operate on fresh copies or write-once locals. * chore(lint): bump mobile oxlint to 1.71 so inherited rules parse mobile/ is a standalone pnpm project pinning its own oxlint@1.67, which lacks unicorn/no-array-fill-with-reference-type (needs >=1.70). Since mobile/.oxlintrc.json extends the root config, mobile CI's 'cd mobile && oxlint' failed to parse the new rule. Bump mobile to match root (1.71). Verified in mobile/: oxlint 0 errors, oxfmt --check clean, tsc --noEmit pass, vitest 978 passed / 0 failed. Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: Orca <help@stably.ai>	2026-06-29 22:38:29 -07:00
Jinjing	8a39450b18	refs/heads/handle-mobile-pull-request-issues (#6598) ... * feat(mobile): add commit failure recovery panel with AI fix action - Surfaces a "Commit failed" panel with a one-tap AI fix button when a git commit fails in the source control view or PR creation flow - Detects commit failures specifically during the committing progress step and captures staged entries and commit message for context - Extracts commit failure summary and prompt logic into `src/shared/source-control-commit-failure.ts` and PR checks prompt into `src/shared/pr-checks-fix-prompt.ts` so both desktop and mobile share the same implementations - Adds auto-find of an available Metro port starting from 8081 and extracts expo CLI bootstrap into `mobile-expo-cli.mjs` shared by `start-emulator` and a new `start-expo.mjs` wrapper * Share source-control AI prompts and simplify mobile PR actions - Extract conflict, check-fixing, and commit-failure prompt builders to shared modules for reuse by both desktop and mobile. - Configure Metro in the mobile package to watch and bundle modules from the repository-root shared directory. - Remove the desktop-style merge method picker from the mobile PR actions panel, opting to use repository defaults automatically. - Refactor mobile hosted review creation and git preparation logic into dedicated helper files.	2026-06-28 00:58:17 -07:00
NeilandOrca	47f66f53f5	chore(deps): bump vite/esbuild/dompurify to clear Dependabot alerts (#6538) ... Resolve security advisories without pnpm overrides: Root: - vite 7.3.5 -> 7.3.6 (widened esbuild range to ^0.27 || ^0.28) - esbuild 0.27.7 -> 0.28.1 (GHSA dev-server advisory) - dompurify 3.4.10 -> 3.4.11 (direct devDep) Mobile: - tsx ^4.21.0 -> ^4.22.4 (only hard esbuild consumer; pulls esbuild 0.28.1) - vitest ^4.1.5 -> ^4.1.9, add explicit vite ^8.0.16 (-> 8.1.0) Verified: typecheck:web, build:web, and full vitest suite (21246 passed) all green. Deferred (override-only, no plain-update path exists): - dompurify 3.2.7 x18 — monaco-editor@0.55.1 hard-pins it exactly - js-yaml@3 — @istanbuljs/load-nyc-config; uuid@7 — xcode@3.0.1; postcss@8.4 — @expo/metro-config (Expo SDK 55 lock) Co-authored-by: Orca <help@stably.ai>	2026-06-27 22:01:16 -07:00
Jinjing	8752996ef3	Allow switching to mobile website view in MobileBrowserPane (#5941) ... * rm validation report * Remove mobile browser view switch validation document	2026-06-20 19:41:19 -07:00
NeilandOrca	4e4fa9b8ee	chore(deps): resolve Dependabot security alerts (no overrides) (#5795) ... Co-authored-by: Orca <help@stably.ai>	2026-06-19 01:57:47 -07:00
3 people	f534cd5bc3	fix(mobile): downscale oversized clipboard images so paste no longer fails (#5601) ... * fix(mobile): downscale oversized clipboard images so paste no longer fails Pasting a large clipboard image (high-res screenshot or photo) failed with 'Image too large to paste' because the re-encoded PNG exceeded the 24 MiB base64 upload cap, with nothing shrinking it first. Now an oversized image is downscaled to fit the budget before upload: - computeMobileClipboardImageDownscale() picks target dimensions by area (~sqrt(budget/actual)), with a bounded retry loop since PNG size is nonlinear. - prepareMobileClipboardImageBase64() drives the loop with an injected resizer, so the byte/dimension logic is unit-tested without native modules. - The resizer stages the image to a temp file and hands ImageManipulator a file:// URI; the iOS native loader (Data(contentsOf:)) cannot decode large base64 data URIs, so a data URI made renderAsync throw. Adds expo-image-manipulator and expo-file-system. * fix(mobile): fail fast when resized clipboard image has no base64 Empty base64 from saveAsync would pass the downstream base64 check and upload a corrupt image; throw instead so the paste surfaces an error. Addresses CodeRabbit review on #5601. * Fix mobile clipboard image resize cleanup Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com> Co-authored-by: Orca <help@stably.ai>	2026-06-18 18:25:06 -07:00
4 people	c9bd61376f	feat(mobile): combine PR sidebar and checks parity (#5641) ... Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Orca <help@stably.ai> Co-authored-by: gsxdsm <gsxdsm@users.noreply.github.com>	2026-06-17 22:52:12 -07:00
Jinwoo HongandOrca	e3bf7d8614	feat(mobile): pickers, workspace parity, active-workspace focus, tap-to-open, source-control parity, artifact viewing (#5330) ... Co-authored-by: Orca <help@stably.ai>	2026-06-15 22:02:51 -07:00
3 people	c4fade90e7	Add mobile Review Changes workflow (#5313) ... * Add mobile diff review * Wrap mobile review notes prompt * Fix mobile review unreviewed navigation * Clear review completion when a refreshed diff invalidates a reviewed file mergeMobileDiffReviewState invalidates a file's reviewed flag when its diff identity changes, but left completedAt set — inconsistent with markUnreviewed. Drop completedAt on invalidation and add a regression test. Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com> Co-authored-by: Orca <help@stably.ai>	2026-06-13 14:24:26 -07:00
Jinwoo HongandOrca	93e59ab086	fix(mobile): recover Android remote sessions without an app restart (#5061) ... Co-authored-by: Orca <help@stably.ai>	2026-06-09 17:55:20 -07:00
Jinwoo HongandOrca	5ab1fe09b9	Fix mobile Tailnet pairing (#4415) ... Co-authored-by: Orca <help@stably.ai>	2026-06-01 17:30:10 -07:00
Neil	6f60541130	Make mobile lint inherit root policy ... Squashed from PR #4353.	2026-05-31 21:58:17 -07:00
Neil	ddbb6a1e7d	Update oxlint and oxfmt	2026-05-30 13:09:17 -07:00
Jinwoo HongandOrca	6f18d362cc	Improve mobile markdown editing (#2826) ... Co-authored-by: Orca <help@stably.ai>	2026-05-26 00:07:53 -07:00
dependabot[bot]	5ce01c8644	build(deps): bump ws from 8.20.0 to 8.20.1 in /mobile (#2278) ... Signed-off-by: dependabot[bot] <support@github.com>	2026-05-19 23:21:55 -07:00
Jinwoo HongandOrca	151040f05f	Add desktop-backed mobile voice dictation (#1869) ... Co-authored-by: Orca <help@stably.ai>	2026-05-14 14:36:44 -07:00
Jinwoo HongandOrca	7944293815	Improve mobile terminal streaming performance (#1700) ... * Improve mobile terminal streaming performance Co-authored-by: Orca <help@stably.ai> * Add mobile clear terminal action Co-authored-by: Orca <help@stably.ai> * Fix terminal connection test mock Co-authored-by: Orca <help@stably.ai> * WIP: mobile markdown tabs before rebase Co-authored-by: Orca <help@stably.ai> * Add mobile markdown editing Co-authored-by: Orca <help@stably.ai> * Harden mobile tab and markdown sync Co-authored-by: Orca <help@stably.ai> * Fix mobile terminal reconnect loading race Co-authored-by: Orca <help@stably.ai> * Polish mobile terminal keyboard behavior Co-authored-by: Orca <help@stably.ai> * Simplify mobile markdown editor chrome Co-authored-by: Orca <help@stably.ai> * Move mobile markdown actions to top Co-authored-by: Orca <help@stably.ai> * Use app modals for markdown discard Co-authored-by: Orca <help@stably.ai> * Dismiss keyboard before markdown confirmations Co-authored-by: Orca <help@stably.ai> * Add mobile file explorer Co-authored-by: Orca <help@stably.ai> * Fix mobile file explorer type narrowing Co-authored-by: Orca <help@stably.ai> * Fix mobile files navigation param Co-authored-by: Orca <help@stably.ai> * Show mobile files connection wait state Co-authored-by: Orca <help@stably.ai> * Preview text files on mobile Co-authored-by: Orca <help@stably.ai> * Simplify mobile file previews Co-authored-by: Orca <help@stably.ai> * Clarify unavailable mobile file types Co-authored-by: Orca <help@stably.ai> * Fix mobile subscription and preview review issues Co-authored-by: Orca <help@stably.ai> * Keep fallback terminals visible on mobile Co-authored-by: Orca <help@stably.ai> * Keep mobile terminal tap active Co-authored-by: Orca <help@stably.ai> * Preserve mobile terminal fallback order Co-authored-by: Orca <help@stably.ai> * Fix mobile session tab authority Co-authored-by: Orca <help@stably.ai> * Run mobile tests in mobile CI lane Co-authored-by: Orca <help@stably.ai> * Bump mobile app version to 0.0.7 Co-authored-by: Orca <help@stably.ai> * Allow main window IPC wiring size Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: Orca <help@stably.ai>	2026-05-12 14:38:12 -07:00
Jinwoo HongandOrca	cc14a0ade3	feat(mobile): terminal text selection, copy, and paste (#1553) ... Co-authored-by: Orca <help@stably.ai>	2026-05-07 18:24:05 -07:00
Jinwoo HongandOrca	22b63a0191	Mobile: indefinite phone-fit hold + configurable auto-restore (#1532) ... Co-authored-by: Orca <help@stably.ai>	2026-05-07 16:47:31 -07:00
zerone0x	998815c2dd	fix: allow omitted optional rpc schema fields with zod 4.4 (#1541)	2026-05-07 16:13:20 -07:00
Jinwoo HongandOrca	568d3175cf	Pin zod to ~4.3.6 (revert 4.4.x bump from #1526) (#1539) ... Co-authored-by: Orca <help@stably.ai>	2026-05-07 12:47:41 -07:00
NeilandOrca	f441ee8f3d	chore(deps): bump deps to clear Dependabot alerts (#1526) ... Run pnpm update in root + mobile to pull patched versions of vite, hono, @hono/node-server, dompurify, uuid, picomatch, lodash, brace-expansion, path-to-regexp, postcss, @xmldom/xmldom, and other transitive packages flagged by Dependabot. Co-authored-by: Orca <help@stably.ai>	2026-05-06 22:39:54 -07:00
Jinwoo HongandOrca	7f2f39b804	feat(mobile): pairing paste flow + Keychain-backed device tokens + deep link (#1475) ... Co-authored-by: Orca <help@stably.ai>	2026-05-05 17:14:08 -07:00
Jinwoo Hong	4140d6a4c0	Revert "feat(mobile): pairing paste flow + Keychain-backed device tokens (#1452)" (#1474) ... This reverts commit 55d3a42079.	2026-05-05 16:29:00 -07:00
Jinwoo HongandOrca	55d3a42079	feat(mobile): pairing paste flow + Keychain-backed device tokens (#1452) ... Co-authored-by: Orca <help@stably.ai>	2026-05-05 16:09:26 -07:00
Jinwoo HongandOrca	fc578f5ea9	feat(mobile): Expo companion app [beta] (#1245) ... Co-authored-by: Orca <help@stably.ai>	2026-05-04 13:08:27 -07:00