Commit Graph
11 Commits
Author SHA1 Message Date
Jinwoo Hong 4a86b2dc56 refactor(mobile): checked reply readers for files, dictation, host-screen and agent-history (step 7) (#21269)
* test(mobile): record main's file-preview and markdown-disk-fallback replies

Four of this branch's read sites had no malformed-reply coverage, so the reader
change would have had nothing to move at them. `familyGoldens` matrixes only the
first scenario of each family, and `files.preview-load`'s base is the grant-refresh
chain while `session.tab-documents`' is the served markdown tab — which left
`files.read` and `files.readPreview` on the worktree preview path, the artifact
image read, and the markdown tab's on-disk fallback recorded on their success path
only. This commit is the before picture, taken from main's own tree with no product
edit in it.

Three new families, five scenarios, ten goldens:

- `files.preview-worktree-text` / `files.preview-worktree-image` — `files.read` and
  `files.readPreview` as the preview screen asks them for a worktree file.
- `files.preview-artifact-image` — `files.readTerminalArtifactPreview`.
- `session.markdown-disk-fallback` — the `files.read` leg a headless host's
  `renderer_unavailable` sends the markdown tab down. It carries a second scenario
  that serves `markdown.readTab`, because a matrix site needs a fulfilled reply
  recorded somewhere in its own family to replay as the `normal` partition.

No existing scenario moved to a new family and no adapter changed, so every
pre-existing golden keeps its `adapterSha256` and `scenarioSha256`. Recorded in a
detached worktree at the manifest's pin (`4b876758d3`) with this manifest copied in;
the control is that all 748 pre-existing goldens came back byte-identical to
origin/main's, which `git diff c2962a765a -- mobile/rpc-foundation/goldens` confirms
as empty.

Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb

* refactor(mobile): checked reply readers for files, dictation, host-screen and agent-history

Thirty-five unchecked reply readers across seven files become checked zod readers,
so a malformed host reply surfaces as one readable error at the operation boundary
instead of a downstream TypeError, a rendered `undefined`, or a screen left ready
over garbage. Deliberately a behaviour change on malformed replies only: every good
reply decodes to the same value it did, which the `normal` partition of every
matrix golden holds byte for byte. Nothing on the wire moves — no method, params,
options, timeout or acceptance policy changes at any site.

The inventory drops from 137 readers over 31 files to 102 over 24.

What each domain checks, and what it deliberately does not:

- files/preview — one schema for `files.read` and `files.readTerminalArtifact`, one
  for the two preview methods. `content` is required on the text pair because the
  markdown disk fallback publishes it into the tab with no guard; the image pair
  requires nothing, because normalizeImagePreviewResult guards all four members and
  the host's own "binary I cannot preview" and "not actually an image" arms are good
  replies the screen renders today.
- files/tab-doc — stricter than the preview screen on the same two methods, because
  a tab publishes what it read into a typed ready document with no guard. `git.diff`
  reads as two variants, and an arm this build has not heard of takes the binary one
  rather than refusing the reply.
- files/explorer — the directory listing is an array and a row needs the name and the
  directory flag the tree projection turns on; the legacy capped list needs its rows'
  paths and the truncation flag its note draws.
- files/ownership — the two members that decide *where a write lands* are fatal on a
  wrong type rather than salvaged, because absence reads as `local` downstream and a
  salvage would send a mutation to the wrong host. `hostId`'s absent/null/string
  states stay distinct, and the SSH connection generation passes through at its own
  type because the mutation echoes it back to the host.
- dictation — the setup the sheet renders is checked; the model rows need the `id`
  the sheet keys and sends back. The five sends whose reply body no call site reads
  keep an unknown payload, and so does `speech.dictation.finish`, whose transcript is
  read past a staleness guard that a reader throw would move the failure across.
- host-screen — the repo catalog, the SSH labels and the host platform. The four
  writes read no reply body; `worktree.activate` stays opaque because the session
  route's second report site awaits it outside any catch.
- agent-history — the capability gate and both scan containers. The session rows stay
  unknown on purpose: `agent` is a vocabulary that grows with every agent CLI Orca
  learns to scan and that this client echoes back on resume, so narrowing it would
  refuse a newer host's reply or drop the very sessions it added.

Two shared readers were widened to take the strings the reply readers hand them —
`getRepoExecutionHostId` and `buildRepoHostIdByRepoId` — because both already answer
`local` for a host-id spelling they cannot parse, and closing that spelling in a
reply schema would refuse a newer host's own catalog.

Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb

* test(mobile): repin the corpus and re-record the checked reply readers

`baseline` moves to this branch's last fenced commit, which is what `--record`
refuses without: main's fenced tree drifted past the session domain's pin when
#21114 and the dependency bump landed, and the product edit in the commit before
this one moves it again.

Every body move is confined to a malformed partition of a family this branch
touched. No `normal` partition moved, which is the byte-for-byte control on good
replies, and no golden outside the seven files' families moved at all.

Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb

* fix(mobile): stop the dictation reader requiring a mode main rendered without

The setup sheet's `normal` partition refused after the reader landed, which is the
success control saying the schema was wrong rather than the fixture: `dictationMode`
was declared required because the one unguarded consumer pushes it into a
`useState<'toggle' | 'hold'>` and cannot invent a value, but main rendered a sheet
whose reply omitted it, and requiring a member no consumer crashes on is exactly the
version claim Rule 1 of the remote-wire contract warns about.

The member is salvaged now and keeps its open arm set, so an unknown mode still
degrades to `toggle` rather than to one that matches no segment. The native-chat
refresh spells that same `toggle` for an absent mode, which is the value its state
already started at, and the route parity pins are refreshed for the one literal and
the two callback bodies that moved.

Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb

* test(mobile): repin past the dictation fix and re-record

Second repin of the branch: the fix to the setup reader is a fenced-tree change, so
`--record` refuses until `baseline` names it. The speech family's `normal` partition
is back to main's projection, which is what said the first reader was wrong.

Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb

* test(mobile): mutant evidence for the checked reply readers

Three mutations applied by hand, run, and reverted, recorded beside the adapter
family mutations in the same shape. They are kept in their own file because a reader
mutation is not killed by a pilot scenario: a pilot serves a good reply, and a schema
that has stopped checking a member reads a good reply exactly as before. What kills
them is a matrix golden's malformed partition, the schema's unit pin, or a consumer
pin, and each is named against its mutation.

Two survived their first run, and both survivals were defects in the gates:

- Loosening the file tab's `content` was invisible, because the pin dropped members
  only in pairs and each pair is refused by the sibling. The pin now drops exactly
  one member per iteration, and the preview text schema and the legacy file list got
  the same treatment.
- Collapsing the hostId tri-state was invisible, because no golden serves an explicit
  null host — the local ownership scenario omits the member. The ownership test now
  captures all three states end to end, which is where a tri-state belongs.

`repo-metadata-platform` is re-anchored where this branch moved the read it mutates:
the hand-rolled `readHostPlatform` became the reply schema's own projection. The
defect it injects is unchanged.

Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb

* test(mobile): record main's repo-icon and speech-vocabulary replies

The closed enums this branch introduced had no fixture behind them. `provider`,
`dictationMode` and `repoIcon` were carried by no scenario at all — the fulfilled
repo-metadata golden records `repoIconsByName: []` — so the corpus could not have
moved whatever arm set the schemas declared, which is how a reader can pin a
vocabulary the host does not speak and still decode to a zero-move delta.

Two scenarios, both appended to an existing family so `familyGoldens` adds no
matrix golden, recorded from main's own tree at the pin with no product edit in it:

- `settings-repo-metadata-icons` — all three `RepoIcon` arms, a github-sourced
  image with a label, an explicit `badgeColor`, and a mixed-host catalog so the
  ssh/settings/platform wave runs too.
- `speech-setup-sheet-model-vocabulary` — `provider` on both arms, `status` on two,
  `dictationMode: "hold"`, and null and numeric `sizeBytes`/`progress`.

Control: re-recording the whole corpus at the pin reproduces every committed
golden body, including this branch's five earlier before-pictures; only `baseline`
and the masked `lockfileSha256` move.

Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb

* fix(mobile): stop the repo icon narrowing a member no consumer reads

The image arm of `repoIcon` declared `source` as the four values
`RepoIconImageSource` spells today (src/shared/repo-icon.ts:3). MobileRepoIcon
reads `type`, `src`, `label`, `emoji` and `name`, and never `source`, so the only
thing that enum could do was fail the union arm for a source a later host adds —
dropping the whole icon and drawing the Folder default where main drew the image.
That is the one arm set on this branch whose degrade was not already main's own
behaviour for an unknown value.

Dropping the declaration keeps the member: `looseObject` passes it through
verbatim, so the decoded object is byte-identical to the one main published, which
`settings-repo-metadata-icons` now records.

The two type sites that hold an icon move to the decoded type. A host `RepoIcon`
still satisfies the rendered union, so the worktree rows that carry one are
unaffected.

Every other closed enum on this branch was checked against the host's own shared
type and left alone: speech `provider`/`status`/`dictationMode`
(runtime-worktree-contracts.ts:83/85/86), `groupBy`/`sortBy`
(persisted-ui-state-types.ts:41-42), `platform` (Node's own domain; the handler
answers `process.platform`). For each, a salvaged member lands on the same branch
main's unknown value did: `=== 'openai'` and `=== 'ready'` stay false, a missing
`groupBy` and an unmapped one both answer null, and an unknown platform and a null
one both label the host "This computer".

Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb

* test(mobile): repin past the repo-icon fix and re-record

Header-only: all 770 goldens move on `baseline` alone, including the two recorded
from main's tree two commits back. The icon fix and the two new fixtures decode to
the bytes main published.

Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb

* fix(mobile): keep the repo-metadata readers total the way main's were

readSshTargets and readHostPlatform answered [] and null for any payload at
all. The checked schemas threw for a non-object, and because the label write
runs first in the same sequence that throw also skipped the platform write, so
a malformed reply left both decorative labels at their previous values instead
of degrading. A .catch on each restores main's answer without giving up the
row filter or the checked reader.

Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb

* fix(mobile): forward the dictation mode instead of substituting a default

The reader closed the mode to two arms and the native-chat refresh spelled
`?? 'toggle'`, which is a good-reply change no golden covers: main left the
state undefined for a reply that omits the mode, and undefined binds no press
handler on the terminal input mic. Head gave that mic a working toggle. The
member is forwarded as the string the host sent and the refresh is main's line
again, so an absent or unknown mode leaves the mic exactly as inert as main's.
The route-parity runtime-string pin is main's own sha again.

Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb

* test(mobile): repin past the review fixes and re-record

The repo-metadata readers are total again, so both families' `result-absent`
and `result-null` checkpoints decode to main's bytes instead of the caught
throw, and the two delta rows they cost go away. The dictation mode forwards
verbatim, which no recorded reply exercises differently.

Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb

* test(mobile): repin onto the merge and re-record

Pins the corpus to the merge commit so main's ten create-terminal goldens and
this branch's own are recorded from one tree.

Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb

* docs(mobile): correct three reader comments round 2 caught

The ownership schema said an explicit null hostId means the host said local;
the code refuses it, which is the whole reason mutant (c) exists. The AiVault
sessions cast cited a golden whose fixture row carries three members, not the
sixteen the cast claims — the full row is in aivault-history-screen-listed —
and both the issues cast and the schema doc said the rows are rendered when
the only read anywhere is issues.length.

Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb

* docs(mobile): correct stale file:line citations in the batch-A reply schemas

Resolved every citation in the seven reply-schema modules and the SAFETY
notes against the tree and diffed each target line against the claim beside
it. Twelve were wrong, two of them past the end of a file that had shrunk,
so they read as evidence while pointing at a closing brace.

- file-explorer: the entries put is :157 not :160, the relativePath split is
  file-list-fallback.ts:48 not :42, and the truncated publish is :136 not
  :141. buildFileExplorerRows is no symbol at all; the sort-and-walk is
  flattenDirectoryCache (file-tree.ts:58).
- file-ownership: the !summary throw is :68 not :64.
- file-preview: the markdown disk fallback reads content at :60 not :65.
- file-tab-doc: the html body render is :68 not :81 and the file arm is
  :73-75 not :86-88 (the file has 78 lines); the isImage guard is :58 not
  :66; the kind !== 'text' branch is :41 not :44; mobileDiffImageDataUri
  spans :22-33 not :20-31; the unguarded content.length is
  mobile-diff-lines.ts:35, the function that does it rather than :34.
- agent-history: both members land at :133-135; :135 alone is issues.
- dictation: the parenthetical read as citing the staleness guard when it
  named the rpcPayloadMember read. Both are cited now, :237 and :225.

Comments only. No schema, type, or runtime behaviour changes.

Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb

* docs(mobile): name the unguarded activation report site that pins the opaque schema

Handler audit over all 33 interpret sites in the four domains found one site
that is structurally unguarded: use-mobile-session-startup.ts:170 reports the
activation verdict from inside a fire-and-forget `void (async …)()` whose only
`.catch` sits on the request, not on the chain. A throw there would be an
unhandled rejection and would also skip the terminal fetch below it.

Nothing throws there today, because `worktree.activate` reads
hostScreenUnreadReplySchema, which is `z.unknown()`. That totality is load
bearing rather than incidental, so the doc now names the line it protects and
contrasts it with the first report site at :141, which is chained
`.then(…).catch(…)` and would survive a throw.

Comments only.

Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb

* test(mobile): pin that a bound descriptor's interpret survives being detached

bindDeferredRpcOperation builds interpret as a shorthand method closing over the
captured operation, never `this`, which is what lets eleven call sites pass it as
a bare function reference. Nothing named that invariant.

Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb

* chore(mobile): repin the RPC recording baseline to the main merge

Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb

* fix(mobile): pin the closed reply enums to the host unions where tsc looks

pullfrog: the PR body promised a Record<HostUnion, true> pin for every
closed enum in this batch and the code had none. Adding them in the
schema tests would have changed nothing: mobile/tsconfig.json excludes
*.test.ts, so a coverage record there is never typechecked (a mutation
that dropped a key stayed green).

hostUnionArms(coverage) in zod-salvage spells the arm list as a
Readonly<Record<U, true>> in the schema module itself, called with the
host union as the explicit type argument: an arm the host adds is a
missing property, one it drops is an excess property. Used for the speech
provider and status (RuntimeSpeechModelSummary), the workspace groupBy and
sortBy (PersistedUIState) and Node's platform list, which host-screen now
imports from mobile-runtime-host-platform instead of duplicating. The repo
icon branches satisfy Readonly<Record<RepoIcon['type'], z.ZodType>>.
Three mutations (drop `manual`, add `bogus`, drop the image branch) each
fail tsc. The tests iterate the exported lists; the platform mutant is
re-anchored to the renamed constant.

Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
2026-09-17 16:38:16 -04:00
Neil fb69f00b65 fix(hosts): resolve a folder workspace's SSH host from the repo's host, not its raw connectionId (#18598)
* fix(hosts): resolve a folder workspace's SSH host from the repo's host, not its raw connectionId

`resolveFolderWorkspaceHost` inferred a workspace's host by reading
`repo.connectionId` directly. SSH ownership has two spellings on a repo row, and
a row carrying only `executionHostId: 'ssh:<target>'` has no `connectionId` to
read — so it counted as a local repo and the workspace resolved `{ kind: 'local' }`.
That is an execute-here answer for a workspace whose files are on an SSH host,
the #11163 class, and it fires on a well-formed row.

Resolve the host first, then read the target off it. Every other row keeps its
existing contribution, including a `runtime:` row's nested SSH target: that
target is not this client's to dial, but narrowing it here would be a second
behaviour change riding on this one. The runtime branch above still answers
`local`, and now says so — `FolderWorkspaceHost` has no runtime variant, and
widening the type is its own change, not an oversight to be silently corrected.

Three smaller items that stand on their own:

- `resolveWorktreeExecutionHost` gains a `malformed` reason distinct from
  `unknown`. `unknown` (nothing carries the id) is a verdict the launch path may
  legitimately dispose of as a plain local folder; `malformed` (the row named a
  host that cannot be parsed) must fail closed. One word for two situations is
  the shape that lost the distinction in #18006. The strict read is private to
  that module: `getRepoExecutionHostId` stays the answer everywhere else, since
  its fall-through to `local` is harmless for the grouping, label and index
  callers that are nearly all of its ~340 call sites.
- `readAllWorktreeMetaForRepo` / `readWorktreeMetaForRepo` replace four
  open-coded copies of the same host-qualified read (the F7/F8 lockstep shape).
- `getExecutionHostLabel` answers 'Unknown host' rather than 'All hosts' for an
  id that names no host. Showing one unroutable row as though it were on every
  host is wrong on its own terms. Plain English like every other label in that
  module, none of which resolve through the renderer's i18n catalog.

* fix(hosts): resolve the host in candidate selection too, not just in resolution

The first pass fixed how a repo row is classified once it reaches
`resolveFolderWorkspaceHost`. The candidate filter decides which rows reach it at
all, and it read `repo.connectionId` raw as well — so an SSH-only row outside the
project-group subtree was dropped before the new logic could see it, and the
execute-here bug survived for the population the fix was for, via a different
path. Found in review by CodeRabbit.

Three repo-row reads had the same root cause, not one:

- the scope-connection filter, comparing a path repo's raw field against the
  workspace/group connection;
- the group-connection set, built from group repos' raw fields;
- that set's membership test against path repos' raw fields.

The last two are one comparison with the mismatch on either side, so resolving
only the path side would have reintroduced it from the other direction.

All three, plus the resolution loop, now go through one `getRepoScopeConnectionId`
helper. Non-SSH hosts still fall back to the raw field, so a `runtime:` row keeps
contributing its nested target exactly as before.

The new tests use a repo matched only by path, outside the subtree — the
population every existing test missed, which is why four passing revert-tests
did not catch this. One of them is labelled as pinning the resolver rather than
the filter: under the old raw read both rows came back connectionless and matched
each other by accident, so it survives a filter revert and must not be counted as
coverage for it.
2026-09-04 01:34:47 -07:00
Neil c61ca56a9b fix(ssh): resolve the worktree's execution host instead of guessing from one repo row (#17909)
* fix(host-routing): resolve the execution host before reading a connection

Three issues in one defect class: a resolver reads one spelling of one
arbitrarily chosen row instead of resolving the worktree's execution host,
so something local answers a question about a remote.

returned that row's connectionId. With duplicate repo rows for one repo id
it could pair a runtime owner with a client-owned SSH connection. It now
resolves through the same ambiguity-aware index getRuntimeEnvironmentIdForWorktree
uses, prefers the repo row for the host the worktree names, and derives the
connection from the resolved host. Conflicting rows return `undefined`
(this module's documented "cannot determine the host"), never `null`.

`store.getRepo(worktree.repoId)?.connectionId ?? null`. `getRepo` is
host-blind and the same repo id can exist on local, SSH and runtime hosts,
so a remote worktree could spawn its PTY on the client with the remote cwd.
resolveWorktreeLaunchHost picks the row for the worktree's host and reads
the connection off that host; conflicting rows are unresolved, not local.

session-partition owner maps that contradict each other. Both now compute
through one shared function whose argument records the divergence. No
behaviour change on either side: converging needs a read-both migration,
since both partitions hold real data written by shipping builds.

* fix(host-routing): keep nested SSH connections resolvable under a runtime host

getRepoSshConnectionId read only the resolved execution host, so a repo row
owned by a runtime that reaches a nested SSH target (connectionId: ssh-*,
executionHostId: runtime:*) resolved to no connection — answering 'local' for
a remote worktree, the same defect #17909 fixed in the other direction.

* fix(host-routing): resolve both sides of the execution host through one rule

The renderer resolver leaked between two different SSH hosts: a worktree on
`ssh:m4air` whose only indexed repo row belonged to `openclaw` answered
'openclaw', because the host-scoped lookup missing fell through to an id-only
one. Main's resolver, in the same change, answered 'm4air' — two resolvers, one
right and one wrong, on identical input.

Both sides now adapt one shared rule (`worktree-execution-host-resolution.ts`):
the worktree's own host outranks every repo row, and a row on a different host
is never evidence about this one. The renderer's WeakMap index becomes the
memoizing adapter it always was; `resolveWorktreeLaunchHost` becomes main's
mapping of unresolved onto its throw.

Settles the rule the change previously answered two ways.
`getRepoSshConnectionId` and `getSshTargetIdForExecutionHost` disagreed for a
runtime host carrying a nested `connectionId`; they now compose, so the
execution host is the single authority. On a `runtime:*` row that field is a
paired HUB's private SSH target, spread through by `repoWithFetchedOwner` and
unaddressable from this client — the project-first successor of the row nulls it
for exactly that reason. That also fixes the `kind !== 'ssh'` fallback, which
fired for `local`: a row declaring itself local handed out an SSH connection.
2026-09-02 16:41:13 -07:00
Neil b241a68ae4 Fix worktree identity collisions across hosts (#16691)
* fix(workspaces): add collision-safe worktree identity

* fix(workspaces): read worktree metadata per host and repair ambiguous identities

The canonical identity store landed write-only: getWorktreeMetaForHost had no
production callers while setWorktreeMetaForHost kept the legacy projection only
for the first known owner, so a second host's edits persisted and were never
read back. Wire the listing paths through host-qualified reads.

An ambiguous alias was also unrecoverable — reads returned undefined and writes
threw forever, and the throw escaped the detected-worktree loop, emptying the
whole repo's sidebar. Fail open onto the most recently active instance instead.

- collapse ambiguous aliases deterministically and persist the repair
- reclaim identity rows in the metadata GC so they cannot outlive their locator
  or resurrect onto a worktree recreated at the same path
- drop every host's rows when a locator is removed outright, not just the owner's
- honour an explicit instanceId so the stale-lineage rotation guard still works
- scope a rename to the moving host; other hosts keep their own locator
- prefer the project host setup matching the repo's own execution host, so a
  repoId registered on two hosts no longer stamps the wrong one durably
- reject an unencoded `|` in a host id, the invariant the alias delimiter needs
- drop the never-populated hostGeneration from the canonical key

* fix(workspaces): close remaining identity review gaps

* fix(workspaces): close remaining review gaps

* fix(workspaces): address review and CI regressions

* test(workspaces): update host-qualified metadata expectations

* fix(workspaces): preserve ambiguous identity records

* fix(workspaces): snapshot metadata during listing

* test(workspaces): mirror listing metadata snapshot in windows fixture

* fix(workspaces): preserve identity routing for metadata writes

* fix(workspaces): scope stale metadata cleanup by host

* fix(workspaces): rekey identities on SSH readoption

* fix(workspaces): fail closed for ambiguous board ids

* perf(workspaces): snapshot metadata across catalog listing

* fix(workspaces): retain neighboring manual order updates

* test(workspaces): cover ambiguous board id index

* fix(persistence): harden host-qualified worktree metadata

* refactor(shared): split project host setup lookup

* refactor(workspaces): simplify host-qualified metadata
2026-08-27 15:08:40 -07:00
Neil 77f23b013f refactor(shared): drop the shared/types barrel and import from the real modules (#14447)
#14397 split `shared/types.ts` into 46 per-domain modules but kept the path as
a re-export barrel so the import sites did not have to change. This removes
the barrel: every consumer now imports from the module that actually declares
the type, and `src/shared/types.ts` is deleted.

Barrels hide where a type lives, make every consumer look like it depends on
the whole domain, and let an unrelated edit invalidate a module that ~2,000
files transitively import.

2,323 import declarations across 2,321 files. Rewritten mechanically: each
specifier was resolved to an absolute path via the TypeScript AST and
recomputed, rather than string-substituted, so alias forms (`@/../../shared/
types`) and per-specifier `type` modifiers survive.

Four cases the mechanical pass had to handle, each found by a gate rather than
by reading the diff:

- Modules inside `src/shared` import the barrel as `./types`, not
  `shared/types`. A pre-filter on the latter string skipped 176 of them and
  left imports dangling at a deleted file, which surfaced as confusing
  `Property 'x' is optional in type 'Repo' but required in Pick<Repo, ...>`
  errors rather than "module not found".
- The barrel RENAMED one type on the way through
  (`WorkspaceSource as WorkspaceCreateTelemetrySource`), so the original name
  in the owning module has to be re-aliased at each consumer.
- Three test files put `;(globalThis as ...)` on the line after the import.
  TypeScript parses that `;` as the import statement's terminator, so
  replacing through `statement.getEnd()` deletes it and breaks ASI. The
  rewrite now stops at the module specifier.
- A file that already imported directly from a module got a SECOND import
  from it, because the barrel re-exported those same names — which trips
  `import/no-duplicates` under `--deny-warnings`. A post-pass merges
  declarations sharing a specifier and type-only-ness; the `import type` plus
  `import` pair from one module is left alone, since that form is allowed.

Splitting one barrel import into several genuinely adds lines, which pushed
`terminal-layout-pty-ownership.ts` to 301 counted lines: its 107-character
import must wrap, and neither local type collapses onto one line (101 and 116
characters). Rather than contort a type declaration to fit a line budget,
`collectLeafIds` and `pruneLeaves` move to `terminal-pane-layout-tree.ts` —
they are pure structural operations on the layout tree and independent of PTY
ownership. `visible-worktrees.ts` similarly loses its own mini-barrel
re-export of `isDefaultBranchWorkspace`, with the four real consumers
repointed at the declaring module. No `max-lines` bypass added.

Verified: cold `tsc --noEmit` green on node, cli, and web (buildinfo deleted
first — these projects are `composite: true` and reuse stale caches); the full
`pnpm lint` green, not just bare oxlint — the narrower local check is what let
the duplicate imports reach CI; max-lines ratchet OK at 344.
2026-08-13 22:48:24 -07:00
Neil 281cc77e79 fix(ai-vault): make the merged scan stamp independent of leg order (#14270)
* fix(ai-vault): make the merged scan stamp independent of leg order

The all-host merge picked its stamp with a strict `stampMs > latestMs` and
echoed the winning leg's verbatim string. Two legs reporting the same instant
in different legal ISO shapes ("...:05Z" vs "...:05.000Z") therefore resolved
by position in the results array, i.e. by host-enumeration order (local, then
SSH, then runtime). The prior lexicographic max was order-independent, so this
was a regression with no test covering it.

A merge has no single scan instant, so its stamp is derived data rather than
any one leg's string: return the canonical ISO form of the newest accepted
instant. That is order-independent and format-independent, and drops a
variable instead of adding a tie-break branch.

Also share one request resolver between main and the renderer so the
renderer's merged-scope predicate is equivalent to main's routing by
construction, rather than by a comment that overclaimed it.

* docs(ai-vault): scope the merged-predicate comment to the desktop IPC path

The replacement comment still asserted the result is always several hosts'
legs. The paired web transport drops executionHostScope and serves one host,
so 'all' there is a single scan. State that the predicate is deliberately
over-inclusive and why erring the other way would be unsafe.

* test(ai-vault): pin the merged-stamp Date range boundary

new Date(ms).toISOString() throws RangeError outside +/-8.64e15. That is
unreachable only because Date.parse applies TimeClip, so the NaN guard alone
constrains the argument. Nothing pinned that. Dropping the guard now fails
these two cases with the RangeError they exist to prevent.

* refactor(ai-vault): route session-title scope through the shared resolver

The last character-for-character copy of the request-scope default. Leaving
it would make the shared resolver the single source of truth for two of three
sites, which is the drift this change exists to remove. No behavior change.
2026-08-13 14:49:59 -07:00
Brennan BensonandOrca c5d2275c35 Add preference to show pinned worktrees in original lists (#6216)
* Add setting for pinned worktree group display

Co-authored-by: Orca <help@stably.ai>

* Fix pinned worktree host metadata

Co-authored-by: Orca <help@stably.ai>

* Polish pinned worktree setting copy

Co-authored-by: Orca <help@stably.ai>

* Clarify pinned worktree setting copy

Co-authored-by: Orca <help@stably.ai>

* Use original lists in pinned setting copy

Co-authored-by: Orca <help@stably.ai>

* Fix pinned sidebar order and render churn

* Fix pinned host and inbox placement

* Fix worktree host ownership consistency

---------

Co-authored-by: Orca <help@stably.ai>
2026-07-17 00:21:42 -07:00
Jinwoo HongandOrca 39964149c8 Per-Workspace Environments (on-demand disposable runtimes) + Add Project remote host setup (#6320)
Co-authored-by: Orca <help@stably.ai>
2026-06-30 11:31:55 -07:00
Jinjing a300e2c7b4 Add Source Control Create PR flow (#5436)
* Add Source Control Create PR intent flow

Implements the Source Control Create PR flow described in docs/source-control-create-pr-flow.md.

* Keep Commit visible beside Create PR

* Fix Create PR partial staging action band

* Integrate hosted review creation into Create PR intent flow

- Automatically create the pull or merge request on GitHub/GitLab after
  successfully staging, committing, and pushing in the intent flow.
- Introduce a unified `updateCommitDrafts` helper to keep React state and
  its ref synchronized, preventing draft-overwrite race conditions.
- Split primary action tests into focused files to satisfy the ESLint
  `max-lines` rule.
- Replace hardcoded "Local Mac" strings with dynamic host labels.

* Support Azure DevOps and Gitea PR creation and limit large diffs

Implement automated pull request creation for Azure DevOps and Gitea
repositories. This includes REST API integration, credential checks via
environment variables, template support, and error classification.

Additionally, introduce limits on large diff payloads in git status
extraction to prevent renderer-freezing performance bottlenecks when
loading extremely large files.

* Skip source control refetches when PR creation intent is in flight

Avoid recomputing branch eligibility while isCreatePrIntentInFlight is true.
This prevents tearing down the PR composer or rotating dropdown hints
prematurely if ahead/behind or dirty states are temporarily perturbed
temporarily perturbed mid-flow.

* Expose manual prerequisite actions next to Create PR button

Previously, the Create PR intent only supported "Stage All" as a
sibling action. This expands prerequisite resolution to handle other
intermediate steps such as committing, publishing, and pushing
(including force pushing).

This ensures the edit-commit-push-review loop remains streamlined
directly within the CommitArea by displaying the specific required
next action beside the primary Create PR button.

* Move PR creation actions from CommitArea to sidebar header

- Decouples PR creation and PR intent actions from the local commit area
  primary button, ensuring local/remote git actions remain primary.
- Renders a dedicated PR creation button in the source control header
  beside the hosted review status.
- Simplifies CommitArea by removing prerequisite split-button rendering
  and review composer logic.

* Delete source control create PR flow design document

Remove the design document for the source control create PR flow as the feature has been successfully implemented.

* Display PR creation errors in inline notice

Unify PR/review creation error reporting by replacing the duplicate
createPrErrors state with the shared createPrIntentNotice. Validation
and API errors are now shown directly within the visible inline alert
notice to improve layout consistency and visibility.

Also refactor the execution host platform label lookup to use simple
if statements instead of a switch block.

* Improve Create PR intent flow safety and provider awareness

- Integrate the hosted review composer directly into the Source Control
  panel when a direct review creation action is available.
- Abort the in-flight PR creation intent flow early if the current git
  branch changes to prevent staging or committing on the wrong target.
- Keep in-flight action labels provider-aware (e.g., "Create MR" on GitLab)
  by passing hosted review inputs to the action resolver.
- Omit large diff text payloads from git status responses when line counts
  exceed safe rendering limits to avoid UI performance degradation.
- Ensure field generation does not retarget the base branch of a PR/MR without
  explicit user confirmation.

* Preserve PR and MR templates in AI pull request generation

- Preload templates (including GitLab merge requests) into the AI
  context before generation to prevent bypassing provider-side fallbacks.
- Instruct the AI generator to fill out and preserve existing template
  headings, required sections, and checklists instead of deleting them.
- Pass provider and template settings from the renderer to the backend
  RPC and runtime handlers.

* Mock DropdownMenuShortcut in tab-title-tooltip test

Add a mock for the DropdownMenuShortcut component in the dropdown menu
mock to prevent test failures.
2026-06-16 15:36:27 -07:00
OrcaWin 03d572c022 Fix Windows worktree deletion and host labels (#5391)
- close local filesystem watchers before Windows worktree deletion\n- normalize local repo/worktree path comparisons for Windows casing and slashes\n- use platform-aware local host labels\n- remove the Nim highlighting changes; that should land separately via a maintained grammar path\n- add review coverage for pending watcher grace teardown
2026-06-15 17:07:12 -07:00
+3 36277801e4 Make remote hosts first class: concurrent multi-host workbench (#5071)
* Restore the outlined server card for host headers

Feedback: the bordered card with the server glyph made it clearer that
a host section is a separate machine, not just another group. Bring
that back while keeping the recent quieting: no status dot when
healthy (marks only for connecting/blocked/error/disconnected), no
'This computer' detail on the local host, and collapse/menu/count
behavior unchanged.

Co-authored-by: Orca <help@stably.ai>

* Anchor host badge to its label, indent rows under host cards

Sidebar polish from review:
- The count badge sat in dead space between the label and the
  hover-only chevron/menu; it now hugs the label like repo headers
- Rows under a host card get a left inset so projects and workspaces
  visibly belong to the machine above them
- A host whose only visible row is a collapsed repo group counted 0
  while the group badge said 9; host counts now fall back to header
  counts for groups contributing no visible items

Co-authored-by: Orca <help@stably.ai>

* Two-tier sticky headers: pinned host card above pinned group header

When scrolling inside a host section, the host card now stays pinned at
the top (z-30) while project/status group headers hand off beneath it
(z-20, offset by the pinned card height). The host is the outer
hierarchy level, so it is the most persistent context — previously the
first repo header replaced it, losing 'which machine am I on' exactly
when it mattered. The pinned card keeps its collapse/menu/warning
affordances. Handoff rules: the next host card pushes the previous one
out at the viewport top; a group pins only once it reaches the slot
beneath the host card, and a previous host's group can never pin under
the next host. Without host sections the logic degrades to the original
single-tier behavior.

Co-authored-by: Orca <help@stably.ai>

* Revert host-section row indent

The two-tier sticky host card now provides continuous 'inside this
machine' context at any scroll depth, making the static indent
redundant — and it cost 12px of sidebar width on every row while
making multi-host layouts misalign with single-host ones. Host cards
bracketing their sections plus the pinned header carry the ownership
signal on their own.

Co-authored-by: Orca <help@stably.ai>

* Checkpoint multi-host sidebar and project-first notes

Co-authored-by: Orca <help@stably.ai>

* Add project-first compatibility persistence

Co-authored-by: Orca <help@stably.ai>

* Expose project host setup APIs

Co-authored-by: Orca <help@stably.ai>

* Group sidebar rows by project setup

Co-authored-by: Orca <help@stably.ai>

* Document project-first host model discussion

Co-authored-by: Orca <help@stably.ai>

* Resolve workspace creation through project host setups

Co-authored-by: Orca <help@stably.ai>

* Stamp workspace ownership with project host setup

Co-authored-by: Orca <help@stably.ai>

* Add project host setup existing folder API

Co-authored-by: Orca <help@stably.ai>

* Summarize project-first host model discussion

Co-authored-by: Orca <help@stably.ai>

* Add project host setup CLI commands

Co-authored-by: Orca <help@stably.ai>

* Allow CLI worktree creation by project host setup

Co-authored-by: Orca <help@stably.ai>

* Add workspace host setup picker

Co-authored-by: Orca <help@stably.ai>

* Add project host setup settings summary

Co-authored-by: Orca <help@stably.ai>

* Make project host setup settings navigable

Co-authored-by: Orca <help@stably.ai>

* Stabilize project host setup settings selector

Co-authored-by: Orca <help@stably.ai>

* Add project host existing-folder setup form

Co-authored-by: Orca <help@stably.ai>

* Update project host model implementation status

Co-authored-by: Orca <help@stably.ai>

* Keep projects outermost in default sidebar view

Co-authored-by: Orca <help@stably.ai>

* Update project-first sidebar status

Co-authored-by: Orca <help@stably.ai>

* Show host context in project sidebar groups

Co-authored-by: Orca <help@stably.ai>

* Show unavailable hosts in workspace run target

Co-authored-by: Orca <help@stably.ai>

* Import missing project host from composer

Co-authored-by: Orca <help@stably.ai>

* Clone project host setup from composer

Co-authored-by: Orca <help@stably.ai>

* Persist project host setup method

Co-authored-by: Orca <help@stably.ai>

* Clone project hosts over SSH

Co-authored-by: Orca <help@stably.ai>

* Improve SSH clone cancellation cleanup

Co-authored-by: Orca <help@stably.ai>

* Backfill workspace project host ownership

Co-authored-by: Orca <help@stably.ai>

* Gate project host setup runtime capability

Co-authored-by: Orca <help@stably.ai>

* Preserve independent project host setups

Co-authored-by: Orca <help@stably.ai>

* Add project host setup update API

Co-authored-by: Orca <help@stably.ai>

* Add project host setup delete API

Co-authored-by: Orca <help@stably.ai>

* Add project host setup create API

Co-authored-by: Orca <help@stably.ai>

* Expose project host setup lifecycle in renderer store

Co-authored-by: Orca <help@stably.ai>

* Handle independent project host setups in settings

Co-authored-by: Orca <help@stably.ai>

* Add pending host setup action in project settings

Co-authored-by: Orca <help@stably.ai>

* Show pending project host setup status in composer

Co-authored-by: Orca <help@stably.ai>

* Report pending setup state in workspace target resolution

Co-authored-by: Orca <help@stably.ai>

* Use shared host registry for project setup choices

Co-authored-by: Orca <help@stably.ai>

* Add settings clone flow for project host setups

Co-authored-by: Orca <help@stably.ai>

* Gate unavailable project host setup options

Co-authored-by: Orca <help@stably.ai>

* Gate unavailable project setup hosts in settings

Co-authored-by: Orca <help@stably.ai>

* Stream SSH clone progress to renderer

Co-authored-by: Orca <help@stably.ai>

* Update project host model status notes

Co-authored-by: Orca <help@stably.ai>

* Add CLI project host setup clone command

Co-authored-by: Orca <help@stably.ai>

* Make add project host aware

Co-authored-by: Orca <help@stably.ai>

* Complete project host setup validation

Co-authored-by: Orca <help@stably.ai>

* Recover floating workspace terminal WebGL atlas on reopen (#5069)

Co-authored-by: Orca <help@stably.ai>

* Fix stale terminal daemon spawn health (#5064)

Co-authored-by: Orca <help@stably.ai>

* Suspend floating workspace terminal WebGL while the panel is closed (#5073)

Co-authored-by: Orca <help@stably.ai>

* Fix source control branch compare base (#5074)

Co-authored-by: Orca <help@stably.ai>

* Fix workspace-creation tour panel clipped by the Create Worktree dialog (#5078)

* Fix workspace-creation tour panel clipped by the composer dialog

The tour panel portals into dialog/sheet content that clips overflow, but
its position was clamped against the window viewport. With the Project
field spanning nearly the dialog's full width, the panel landed past the
dialog's right edge and overflow-hidden cut it down to a sliver. Clamp
hosted panels within the host's bounds instead, so the panel flips below
the target and stays fully visible.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Add JSDoc docstrings to satisfy CodeRabbit docstring coverage check

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Test hosted contextual tour overlay positioning

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>

* release: v1.4.56

* Handle buffer overflows gracefully and truncate diffs fairly (#5083)

- Gracefully fall back to file-name summaries when staged diffs exceed
  node/ssh execution maxBuffer limits, preventing generation failures.
- Split oversized diffs by file and allocate budget via water-filling,
  ensuring single huge files do not starve smaller human changes.
- Clip truncated diff sections on line boundaries to avoid half-lines.

* Wrap AI generation controls with tooltips and clean i18n dependencies (#5087)

- Wrap the AI generation button in a tooltip so users can see the
  disabled reason or the action description on hover.
- Add unit tests verifying tooltip triggers and aria-label safety.
- Simplify memo dependencies in settings metadata and worktree palette
  by using 'useTranslation()' to handle language-change rerenders
  directly without needing 'i18n.language'.

* fix: address review findings (#5088)

* Fix localization in repository hooks and base ref suggestion toast (#5089)

* Fix localization in base ref toast and custom hook description

- Localize the "commit"/"commits" plural nouns in the base ref toast.
- Translate missing suggestion toast strings for JA, KO, and ZH locales.
- Pass `{{artifact_url}}` as a literal template variable to translate
  calls to prevent i18next from treating it as a dynamic placeholder.

* Fix localization reactivity in RepositoryHooksSection

Move static variables containing translation calls into helper functions
and subscribe to translation updates using useTranslation. This ensures
that localized options, descriptions, and error messages refresh
dynamically when the user changes the UI language.

* Fix task page labels after language changes (#5086)

Co-authored-by: Orca <help@stably.ai>

* release: v1.4.57

* Fix automation tabs showing a shell instead of the live agent (#5099)

* Fix automation tabs showing a shell instead of the live agent

Opening a background automation's terminal tab showed a bare shell while
the agent (Claude) kept running headless — the sidebar updated but the
pane was attached to the wrong PTY.

On first mount the restored ptyId equals the tab ptyId, and
isSessionOwnedByWorktree() returns true for it, so connectPanePty routed
the still-live eagerly-spawned PTY into the daemon-reattach branch
(transport.connect({ sessionId })), which spawns a fresh shell and
orphans the live agent PTY instead of adopting it via attach()+replay.

Part A: gate the deferred reattach on the absence of a live eager buffer.
A live eager buffer means the PTY is a still-running local session to
adopt (attach + replay), not a daemon session to re-connect. Daemon
reattach and remote PTYs are unaffected (gated on the eager buffer).

Part B: publish never-mounted background automation tabs into the runtime
graph (gated on a live eager buffer) so the live agent PTY binds to its
real tab instead of surfacing as an orphan `pty:<id>` terminal — fixing
`orca terminal list`, the CLI, and automation session-reuse.

Adds a characterization test (fails on the old code, passes now) and a
runtime-graph publish test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Harden eager PTY tab adoption

Co-authored-by: Orca <help@stably.ai>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com>
Co-authored-by: Orca <help@stably.ai>

* Fix i18n label spacing in menus and settings (#5108)

* fix i18n label spacing

* Fix localized account runtime labels

Co-authored-by: Orca <help@stably.ai>

---------

Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com>
Co-authored-by: Orca <help@stably.ai>

* Improve localization catalog sync workflow (#5110)

Co-authored-by: Orca <help@stably.ai>

* Add Warp terminal theme import (#4714)

Co-authored-by: Orca <help@stably.ai>

* release: v1.4.58

* Tidy README badge layout

* Handle integration credential decrypt failures (#4683)

Co-authored-by: Orca <help@stably.ai>

* Fix git repo telemetry for repo adds (#5121)

Co-authored-by: Orca <help@stably.ai>

* Add feature interaction usage bucket telemetry (#5119)

Co-authored-by: Orca <help@stably.ai>

* Reset WebGL glyph atlases globally to stop cross-terminal glyph corruption (#5122)

Co-authored-by: Orca <help@stably.ai>

* perf(windows): fix 60s startup ACL walk and OpenCode streaming freeze, with benchmark harnesses (#5124)

* release: v1.4.59-rc.0

* Fix packaged shell PATH order (#5125)

Co-authored-by: Orca <help@stably.ai>

* Add Floating Workspace contextual tour (#5062)

* Add floating workspace contextual tour

Co-authored-by: Orca <help@stably.ai>

* Clarify floating workspace tour intro copy

Co-authored-by: Orca <help@stably.ai>

* Differentiate floating workspace tour steps instead of repeating examples

Co-authored-by: Orca <help@stably.ai>

* Lead floating workspace tour with the user benefit

Co-authored-by: Orca <help@stably.ai>

* Pitch floating workspace tour around cross-repo agents

Co-authored-by: Orca <help@stably.ai>

* Refine floating workspace tour step 1 copy

Co-authored-by: Orca <help@stably.ai>

* Anchor floating workspace tour step 2 on the minimize control

Co-authored-by: Orca <help@stably.ai>

* Restore floating workspace tour step 2

Co-authored-by: Orca <help@stably.ai>

* Anchor floating workspace tour steps on New Terminal and New Markdown Note

Co-authored-by: Orca <help@stably.ai>

* Retitle floating workspace tour step 2 as scratchpad

Co-authored-by: Orca <help@stably.ai>

* Add why-comments for tour selector fallback and placement flipping

Co-authored-by: Orca <help@stably.ai>

---------

Co-authored-by: Orca <help@stably.ai>

* Fix source control compare base ambiguity (#5127)

Co-authored-by: Orca <help@stably.ai>

* release: v1.4.59-rc.1 [rc-slot:2026-06-10-15]

* release: v1.4.59

* Default-driven create-project flow: name-first form with sensible defaults (#5115)

Co-authored-by: Orca <help@stably.ai>

* Redesign Connect integrations (#4531)

Co-authored-by: Orca <help@stably.ai>

* Expose E2E store via build mode

* File search match counts (#5085)

* Add matchCount to SearchFileResult for accurate per-file hit counts

Co-authored-by: Orca <help@stably.ai>

* Add file search match count design

* rm design doc

---------

Co-authored-by: Orca <help@stably.ai>

* fix: address review findings (#5139)

* perf(windows): avoid blocking daemon pid checks (#5137)

* release: v1.4.60-rc.0

* release: v1.4.60

* Preserve core workflow terms in English and apply CJK spacing (#5141)

* Preserve core workflow and product terms in English across locales

Update translation policy to prevent localization of key terms such as
"Agent", "Commit", "Markdown", and "Terminal". This ensures consistent
jargon and product branding.

Introduce CJK-Latin term spacing to keep these Latin terms legible
when combined with CJK text, while adjusting Korean particle spacing.
Also add overrides to prevent network proxy settings from being
mistranslated as "Agent".

* Preserve repo terminology in English and localize source control labels

Treat "repo" and "repos" (and their capitalized forms) as brand terms
that should remain in English/Latin across CJK and Spanish locales.
Update translation files and policies to replace translated words like
"repositorio" or "リポジトリ" with "repo"/"repos", and fix an issue where
latin brand terms could be incorrectly matched as substrings in larger
words during cleanup.

Additionally, externalize and localize the "Staged Changes", "Changes",
and "Untracked Files" section labels in the source control sidebar.

* UX (#5143)

* UX/copy tweaks (#5142)

* UX/copy tweaks

* UX/copy tweaks

* Fix missed star UI translations (#5148)

* fix: make windows ssh relay deploy survive session teardown (#5136)

* Add option to remove child projects when deleting repo groups (#4702)

Co-authored-by: Orca <help@stably.ai>

* fix: remove checks panel response badge (#5147)

* Add read-only `orca linear` CLI with trusted launch-prompt pointer (V1) (#5126)

Co-authored-by: Orca <help@stably.ai>

* Add AI Vault session history

## Summary
- add AI Vault session scanning and resume command construction
- add the Agents sidebar panel with filtering, grouping, copy/open actions, and local resume launch
- support dragging saved sessions onto terminal split panes

## Validation
- pnpm run lint
- pnpm run typecheck
- pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/register-core-handlers.test.ts src/main/ai-vault/session-scanner.test.ts src/renderer/src/components/right-sidebar/ai-vault-session-filters.test.ts src/renderer/src/lib/ai-vault-session-drag.test.ts src/renderer/src/lib/launch-ai-vault-session.test.ts

* Default agent launches to yolo permissions mode (#5145)

* Default agent launches to yolo mode

* test: update launch default validations

* Fix Claude usage refresh error copy (#5155)

Co-authored-by: Orca <help@stably.ai>

* Move workspace board to sidebar bottom toolbar (#5146)

Co-authored-by: Orca <help@stably.ai>

* Rebuild contextual tour positioning on floating-ui; fix hosted dialog placement and arrow seam (#5154)

Co-authored-by: Orca <help@stably.ai>

* Fix missing spaces in cross-repo switch dialog (#5158)

* Fix Ctrl+Tab switcher selection on release (#5116)

* Fix additional i18n spacing regressions from #4995 (#5159)

* Refine add project selection styling (#5160)

Co-authored-by: Orca <help@stably.ai>

* improve chinese localization (#5162)

* Fix floating workspace needing two clicks after app switch (macOS) (#5128)

* Autofocus feedback textarea when Send Feedback dialog opens (#5164)

* fix: address pr-bug-scan validated finding from #4683 (#5151)

Isolated CredentialDecryptionError per-item in Linear getClients (client.ts:518) and Jira getClients (client.ts:373) on the 'all' selection so one bad credential no longer collapses healthy workspaces

Co-authored-by: orca-bug-scan-bot <orca-bug-scan-bot@stably.ai>

* fix: enable claude agent teams by default (#5168)

* Refresh Jira and Linear status after credential errors (#5169)

* fix: address pr-bug-scan validated finding from #4683

Isolated CredentialDecryptionError per-item in Linear getClients (client.ts:518) and Jira getClients (client.ts:373) on the 'all' selection so one bad credential no longer collapses healthy workspaces

* Refresh Jira and Linear status to clear stale credential errors

Ensure stale credential decryption errors are cleared from the store
status once a successful API read completes. By updating the check in
shouldRefreshStatusAfterRead to trigger when a credentialError is
currently set, successful issue or list fetches will trigger a status
check and remove stale error flags.

---------

Co-authored-by: orca-bug-scan-bot <orca-bug-scan-bot@stably.ai>

* Hide internal context from AI Vault titles (#5175)

* Fix detached HEAD publish actions (#5173)

* Keep freshly split terminal pane mounted if newborn PTY exits early (#5171)

Prevent a newly split pane from collapsing immediately if its PTY exits
during initial setup before any output is received or input is sent.
This ensures a failed startup session remains visible to the user.

* Route task PR queries by upstream source (#5176)

* Route task PR queries by upstream source

Implements the routing described in docs/tasks-pr-upstream-source.md so task PR and issue queries stay scoped to the selected source.

* rm design doc

* Prevent stale PR refreshes from restoring unlinked review state (#5180)

- Pass `worktreeId` to `fetchPRForBranch` to track active worktree context
- Ignore inflight or queued PR fetches if the worktree has been unlinked
- Include linked PR/MR metadata in the checks panel snapshot key to trigger updates immediately on link/unlink events

* Fix Claude agents management status detection (#5179)

Co-authored-by: Orca <help@stably.ai>

* fix: address review findings (#5177)

* Allow resolving selected review comments with AI (#5184)

* Allow resolving selected PR/MR review comments with AI

Users can now select specific unresolved review comments or threads in
the Checks panel sidebar, queue them, and trigger an AI agent to address
them, marking resolved threads on the host upon agent launch.

- Adds checkboxes and action/send buttons to select and queue comments.
- Builds a structured, robust prompt with sanitized comment metadata.
- Optimistically marks threads resolved on launch with rollback on error.
- Supports both GitHub PRs and GitLab MRs.

* Consolidate PR comment selection state and eliminate effects

Combine independent selection states and context-tracking into a single
state object. Derive active selection data and prune ineligible comments
during render using useMemo instead of relying on asynchronous
useEffect synchronization hooks.

* Improve source control action dialog layout and recipe saving UX (#5153)

* Improve source control agent action dialog layout and recipe UX

- Constrain dialog and scroll area heights to prevent viewport overflow.
- Add variable chips to easily insert the base prompt with tooltip previews.
- Keep the recipe save controls visible when a recipe is already saved, showing informational status text instead of hiding them.
- Update localized copy across multiple languages and reduce textarea rows.
- Add unit tests for the variable chip preview and save target visibility.

* Fix recipe-saved check in source control action dialog

* Evaluate only the selected save target instead of checking all available targets, as the action only writes to the selected target.
* Update daemon PTY adapter test fake PID to prevent collision with real host OS processes during runtime directory lookups.

* fix: remove unsupported agent launch defaults (#5185)

* Update Chinese and Japanese translations for worktrees and fixes (#5187)

- Correct awkward Chinese translation of "fix" ("使固定") to "修复" and "基本的" to "主工作树" (main worktree).
- Improve Japanese translation of "fix" from physical repair ("修理") to software correction ("修正").

* Embed hosted review creation composer directly in Checks panel (#5140)

* Embed hosted review creation composer directly in the Checks panel

- Replaces the modal pull request/merge request creation dialog with an
  inline composer embedded in the empty state of the Checks sidebar.
- Extracts and moves pull request generation state to a dedicated store
  slice so AI-generated details are persisted across sidebar unmounts.

* Fix hosted review composer feedback

* Combine file search and file explorer right sidebar tabs (#5182)

Unifies file discovery and tree navigation under a single Explorer domain, simplifying the right sidebar activity bar and reducing tab clutter.

* Replaces the standalone 'search' activity bar tab with a nested 'search' subview inside the File Explorer tab
* Introduces 'rightSidebarExplorerView' ('files' | 'search') state to manage the active subview inside the Explorer
* Adds a search button to the File Explorer toolbar and a back button to the search subview for seamless transition
* Exposes 'showRightSidebarFiles' and 'showRightSidebarSearch' store actions to route and seed search queries/include patterns
* Adapts file explorer keybindings, git status polling, and external workspace watchers to respect the active subview
* Maps legacy persisted search tab state to the new explorer search view for backward compatibility

* release: v1.4.61-rc.1

* Add multi-repo folder workspaces (v1) (#5172)

Co-authored-by: Orca <help@stably.ai>

* release: v1.4.61-rc.2

* Hide unavailable project hosts in worktree composer

Co-authored-by: Orca <help@stably.ai>

* Remove inline project host setup from composer

Co-authored-by: Orca <help@stably.ai>

* Mark imported project host setup methods

Co-authored-by: Orca <help@stably.ai>

* Fix rebase merge fallout

Co-authored-by: Orca <help@stably.ai>

* Disable unavailable Add Project hosts

Co-authored-by: Orca <help@stably.ai>

* Compact Add Project host selector

Co-authored-by: Orca <help@stably.ai>

* Hide redundant SSH target chooser

Co-authored-by: Orca <help@stably.ai>

* Browse SSH clone destinations

Co-authored-by: Orca <help@stably.ai>

* Avoid local clone defaults for SSH hosts

Co-authored-by: Orca <help@stably.ai>

* Polish host-aware Add Project flows

Co-authored-by: Orca <help@stably.ai>

* Polish remote host add project flows

Co-authored-by: Orca <help@stably.ai>

* Remove redundant host kind chips

Co-authored-by: Orca <help@stably.ai>

* Fix remote project setup UX gaps

Co-authored-by: Orca <help@stably.ai>

* Fix multihost workspace composer project identity

Co-authored-by: Orca <help@stably.ai>

* Finish host context merge repair

Co-authored-by: Orca <help@stably.ai>

* Continue host context checklist implementation

Co-authored-by: Orca <help@stably.ai>

* Route Linear and Jira tasks by source context

Co-authored-by: Orca <help@stably.ai>

* Preserve Linear task source context in history

Co-authored-by: Orca <help@stably.ai>

* Scope task retry state by source context

Co-authored-by: Orca <help@stably.ai>

* Route GitHub drawer reads by source context

Co-authored-by: Orca <help@stably.ai>

* Guard GitLab selectors with repo context

Co-authored-by: Orca <help@stably.ai>

* Guard GitHub metadata selectors

Co-authored-by: Orca <help@stably.ai>

* Route GitHub task row actions by source context

Co-authored-by: Orca <help@stably.ai>

* Update GitHub source-context checklist status

Co-authored-by: Orca <help@stably.ai>

* Show host ownership for CLI provider accounts

Co-authored-by: Orca <help@stably.ai>

* Persist GitLab task detail source context

Co-authored-by: Orca <help@stably.ai>

* Show host scope for provider API budgets

Co-authored-by: Orca <help@stably.ai>

* Preserve Jira task source context

Co-authored-by: Orca <help@stably.ai>

* Scope Jira optimistic task patches

Co-authored-by: Orca <help@stably.ai>

* Resolve task PR bases on run host

Co-authored-by: Orca <help@stably.ai>

* Record Jira task workspace usage

Co-authored-by: Orca <help@stably.ai>

* Scope Linear optimistic task patches

Co-authored-by: Orca <help@stably.ai>

* Scope GitHub optimistic task patches

Co-authored-by: Orca <help@stably.ai>

* Clean host copy in onboarding flows

Co-authored-by: Orca <help@stably.ai>

* Preserve automation CLI run context

Co-authored-by: Orca <help@stably.ai>

* Add automation CLI source context selector

Co-authored-by: Orca <help@stably.ai>

* Clarify unavailable task source hosts

Co-authored-by: Orca <help@stably.ai>

* Surface host model runtime capability skew

Co-authored-by: Orca <help@stably.ai>

* Use SSH host copy in reconnect dialog

Co-authored-by: Orca <help@stably.ai>

* Show host context in task source picker

Co-authored-by: Orca <help@stably.ai>

* Mark task source display complete

Co-authored-by: Orca <help@stably.ai>

* Clarify provider account host selection

Co-authored-by: Orca <help@stably.ai>

* Guard task source switching boundary

Co-authored-by: Orca <help@stably.ai>

* Mark task source diagnostics persisted

Co-authored-by: Orca <help@stably.ai>

* Mark base resolution host boundary

Co-authored-by: Orca <help@stably.ai>

* Clarify external automation source states

Co-authored-by: Orca <help@stably.ai>

* Harden project host compatibility projection

Co-authored-by: Orca <help@stably.ai>

* Finish host copy audit

Co-authored-by: Orca <help@stably.ai>

* Add provider host scope controls

Co-authored-by: Orca <help@stably.ai>

* Show task source account labels

Co-authored-by: Orca <help@stably.ai>

* Show automation run context in CLI

Co-authored-by: Orca <help@stably.ai>

* Scope Jira task cache lookups by source

Co-authored-by: Orca <help@stably.ai>

* Seed workspace creation from task source context

Co-authored-by: Orca <help@stably.ai>

* Explain disabled external automation actions

Co-authored-by: Orca <help@stably.ai>

* Surface task source runtime capability gaps

Co-authored-by: Orca <help@stably.ai>

* Persist automation run context from UI saves

Co-authored-by: Orca <help@stably.ai>

* Require workspace run capability for setup hosts

Co-authored-by: Orca <help@stably.ai>

* Disable automation runs for stale host setup

Co-authored-by: Orca <help@stably.ai>

* Route GitHub drawer metadata by source host

Co-authored-by: Orca <help@stably.ai>

* Guard runtime project setup mutations by host model

Co-authored-by: Orca <help@stably.ai>

* Route PR page metadata by repo host

Co-authored-by: Orca <help@stably.ai>

* Route PR mention metadata by repo host

Co-authored-by: Orca <help@stably.ai>

* Route GitHub Project edits by view source

Co-authored-by: Orca <help@stably.ai>

* Clarify runtime automation disabled states

Co-authored-by: Orca <help@stably.ai>

* Guard runtime automation backend dispatch

Co-authored-by: Orca <help@stably.ai>

* Preserve GitLab task source identity

Co-authored-by: Orca <help@stably.ai>

* Remove redundant SSH target row in add project

Co-authored-by: Orca <help@stably.ai>

* Add task source provider availability reasons

Co-authored-by: Orca <help@stably.ai>

* Surface task provider preflight availability

Co-authored-by: Orca <help@stably.ai>

* Record local GitHub task source verification

Co-authored-by: Orca <help@stably.ai>

* Record Linear task source verification

Co-authored-by: Orca <help@stably.ai>

* Show automation source context in details

Co-authored-by: Orca <help@stably.ai>

* Record remote capability negotiation coverage

Co-authored-by: Orca <help@stably.ai>

* Record local add project create verification

Co-authored-by: Orca <help@stably.ai>

* Scope Linear cached task reads by source

Co-authored-by: Orca <help@stably.ai>

* Preserve PR generation host ownership

Co-authored-by: Orca <help@stably.ai>

* Route git operations by owner host

Co-authored-by: Orca <help@stably.ai>

* Route delete warnings by worktree owner

Co-authored-by: Orca <help@stably.ai>

* Route editor drops by worktree owner

Co-authored-by: Orca <help@stably.ai>

* Route agent draft paste by tab owner

Co-authored-by: Orca <help@stably.ai>

* Route file explorer requests by worktree owner

Co-authored-by: Orca <help@stably.ai>

* Document remaining host context gaps

Co-authored-by: Orca <help@stably.ai>

* Check runtime task source provider auth

Co-authored-by: Orca <help@stably.ai>

* Validate automation source availability

Co-authored-by: Orca <help@stably.ai>

* Route remaining UI requests by owner host

Co-authored-by: Orca <help@stably.ai>

* Route quick open file listing by worktree owner

Co-authored-by: Orca <help@stably.ai>

* Route typed GitHub lookups by source host

Co-authored-by: Orca <help@stably.ai>

* Centralize automation run identity fallback

Co-authored-by: Orca <help@stably.ai>

* Surface unsupported task source providers

Co-authored-by: Orca <help@stably.ai>

* Document automation legacy repo compatibility

Co-authored-by: Orca <help@stably.ai>

* Record live host model verification

Co-authored-by: Orca <help@stably.ai>

* Quiet disconnected SSH polling

Co-authored-by: Orca <help@stably.ai>

* Verify task drawer source boundaries

Co-authored-by: Orca <help@stably.ai>

* Verify GitLab repo source selectors

Co-authored-by: Orca <help@stably.ai>

* Route automations through owning host

Co-authored-by: Orca <help@stably.ai>

* Update host context verification checklist

Co-authored-by: Orca <help@stably.ai>

* Run remote automations headlessly in serve mode

Co-authored-by: Orca <help@stably.ai>

* Keep setup guide entry stable during refresh

Co-authored-by: Orca <help@stably.ai>

* Keep setup script prompt stable during host switches

Co-authored-by: Orca <help@stably.ai>

* Deduplicate Tasks project picker sources

Co-authored-by: Orca <help@stably.ai>

* Use project identity for Tasks picker dedupe

Co-authored-by: Orca <help@stably.ai>

* Add Tasks source host switcher

Co-authored-by: Orca <help@stably.ai>

* Refine Tasks source picker disclosure

Co-authored-by: Orca <help@stably.ai>

* Polish Tasks source picker hover

Co-authored-by: Orca <help@stably.ai>

* Open Tasks source menu on hover

Co-authored-by: Orca <help@stably.ai>

* Match Tasks source submenu hover behavior

Co-authored-by: Orca <help@stably.ai>

* Open Tasks source submenu from project row hover

Co-authored-by: Orca <help@stably.ai>

* Group automation project hosts

Co-authored-by: Orca <help@stably.ai>

* Tighten automation project picker density

Co-authored-by: Orca <help@stably.ai>

* Show selected host in Tasks project picker

Co-authored-by: Orca <help@stably.ai>

* Hide host labels for single-host project pickers

Co-authored-by: Orca <help@stably.ai>

* Use saved remote server names in host pickers

Co-authored-by: Orca <help@stably.ai>

* Use standard add project start for remote servers

Co-authored-by: Orca <help@stably.ai>

* Use saved host labels in workspace surfaces

Co-authored-by: Orca <help@stably.ai>

* Route remote browser tabs through runtime hosts

Co-authored-by: Orca <help@stably.ai>

* Keep sidebar project-first across grouping modes

Co-authored-by: Orca <help@stably.ai>

* Polish multi-host remote runtime UX

Co-authored-by: Orca <help@stably.ai>

* Fix CI lint and remove design notes

Co-authored-by: Orca <help@stably.ai>

* Fix CI test failures

Co-authored-by: Orca <help@stably.ai>

* Fix Windows CLI path expectation

Co-authored-by: Orca <help@stably.ai>

* Fix CI renderer test expectations

Co-authored-by: Orca <help@stably.ai>

* Fix remaining verify test failures

Co-authored-by: Orca <help@stably.ai>

---------

Co-authored-by: Orca <help@stably.ai>
Co-authored-by: Bryant Ung <bryant.ung@outlook.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
Co-authored-by: Borja <3930245+BorjaLL@users.noreply.github.com>
Co-authored-by: Parker Rex <me@parkerrex.com>
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
Co-authored-by: Trevin Chow <trevin@trevinchow.com>
Co-authored-by: buf0-bot[bot] <252831055+buf0-bot[bot]@users.noreply.github.com>
Co-authored-by: orca-bug-scan-bot <orca-bug-scan-bot@stably.ai>
2026-06-13 18:53:01 -07:00