* feat(native-chat): show Claude subagent activity on the shared carrier
Claude's `message:system:task_*` frames are classified `status-chrome` and
reach the transcript as nothing at all, so a turn that spawns subagents
renders as an idle turn. The journal translator now reads them into the
shared subagent-group carrier — no new UI, and the frames stay
`status-chrome` so nothing prints a raw opcode row.
`local_agent`, `local_workflow` and `local_bash` tasks share that channel
and all carry a `tool_use_id`, so `task_type` is the discriminator and a
backgrounded `sleep 20` stays out of the roster; `subagent_type` covers
releases that predate `task_type`. `skip_transcript` tasks never render,
`is_backgrounded` children survive the turn-end sweep, and a resumed task
re-announced under a fresh tool id is aliased onto its `task_id` rather
than duplicated.
A child still reported as working when the turn — or the session — ends
becomes `unverifiable`: contact was lost, which is not evidence it exited.
* fix(native-chat): stop the Claude subagent roster dropping its own rows
The roster published under the same coalescing key it appends the row
with, and the sink queue replaces any queued operation sharing a key
regardless of kind: once a write was in flight, each new append evicted
the pending publish and the next publish evicted that append, so the
body never reached the journal and `lastSerialized` had already moved
past it. Publish now takes the sink's own slot, as the Codex streams do.
A tombstoned row could never come back: the non-batch item-row builder
derived its revision from `items` alone, so a re-add was built at
revision 1 against a tombstone at 2 and the reducer discarded it
forever. It now takes the same `max(items, tombstones)` the batch
builder already used — reachable here because an announcement that
reveals a `local_bash` task empties and tombstones the group row that
a genuine subagent later in the turn reuses.
`settleTurn` swept whatever group the key named at the time it ran, so
children rostered before any turn key existed were never swept, and a
turn whose result never arrives was left working forever. The ending
turn's key is now an argument, a superseding turn start settles the
turn it replaces, and every turn end also sweeps the outside-turn
group. Teardown without an `ended` event, and eviction past the group
bound, both lose contact instead of stranding a row at `working`.
Label ordinals are a high-water mark now: releasing one on a re-label
handed the next child an ordinal that was already on screen.
* fix(native-chat): bound subagent-group blocks on every wire that carries one
Adding a fifth arm to `NativeChatBlock` made every consumer that assumed
four wrong. Two of them ended in `return block`, so they compiled while
handing a roster straight through: the mobile RPC sanitizer shipped it
unclipped past both mobile char caps, and the legacy transcript import
stored an untrusted roster unbounded. Both now clip each label and cap
the entry count the way they bound their other blocks.
The remaining three sites did not compile at all. The worker transcript
payload and the live-session benchmark get real arms rather than casts —
a cast would have turned the transcript one into a third silent
passthrough inside the wire byte budget — and the CLI worker output
renders a roster with its shared summary instead of `[image omitted]`.
The mobile sanitizer moves to a sibling module beside the image-block
one: the file sat exactly on the max-lines bound, and the block bounds
are a self-contained concern with their own caps.
Also caps the roster's `subagent_type` label fallback, which reached the
journal uncapped, and covers the new block type in the schema audit.
* test(native-chat): cover the capped subagent_type label
The roster stores the frame's label verbatim, so the cap on the
`subagent_type` fallback is the only thing bounding it.
* fix(native-chat): type the roster fixture so the suite typechecks
The mobile-cap test built its entries with an inferred `state: string`, which
is not a `NativeChatSubagentState` — the only typecheck failure on the branch.
* fix(native-chat): stop child traffic rostering an id Claude never announced
`observeChildActivity` minted a provisional row for any `parent_tool_use_id`
outside the excluded set. An id that was never announced is never excluded, so
a nested Task, a workflow child, or a grandchild parented to a tool id inside
the sidechain each produced a permanently unlabelled `subagent` row that could
only ever end `unverifiable`. The bounded exclusion set cannot cover an id no
frame ever declared, and in a long session it can forget a genuine exclusion.
Track instead whether this CLI announces tasks at all — set by ANY
`task_started`, including one the subagent filter rejects. Once it has, an
undeclared child is provably not a new subagent, so no row is created. The
provisional path now serves only releases that announce no task frames, which
is what its comment already said it was for.
The label-ordinal test moves to an announcement-driven removal, the scenario
that path now actually reaches; it still fails if `remove` releases the ordinal.
* fix(native-chat): outrank the tombstone when building one too
`buildJournalTombstoneRow` still built its revision from `items` alone, leaving
it asymmetric with the item builder. It is correct today only because
`upsertItem` clears the tombstone whenever a re-add wins — an invariant that
lives in the reducer and was not pinned. Apply the same `Math.max`, and pin the
invariant so the reducer cannot drop it silently.
* fix(native-chat): stop an unrelated turn end settling an outside-turn child
`settleTurn` swept the `outside-turn` group on every turn end, so a child
Claude announced while no turn was live — a frame trailing the previous
turn's result, or one that arrives before the first turn starts — was
marked `unverifiable` by the next, unrelated turn ending. That state is
terminal and latches, so the `task_updated: completed` that followed was
discarded: loss of contact was recorded as the child's outcome on
evidence that was never about that child.
A turn end now sweeps exactly the group its key names. `outside-turn`
belongs to no turn, so only an end with no key of its own reaches it, and
what no turn end reaches `settleSession` does — reliably, since teardown
without an `ended` event also routes through it. The cost is a child
outside every turn showing `working` a little longer; the alternative
prints a wrong outcome that nothing can revise.
Also pins that a subagent announced after a task the filter rejected
still rosters: the announcement path was never what the child-traffic
gate closes.
* fix(native-chat): bound a subagent entry's id, not just its label
Every site that bounds a `subagent-group` block clipped the label and
handed the id through whole. From the Claude producer the id is bounded
upstream, but the legacy transcript import reads an untrusted file, so an
oversized id survived into the journal and then out to every wire that
replays it — 64 entries of it, since only the entry count was capped.
Each site now clips the id with the helper it already uses for its other
bounded fields: the journal's inline-text bound on import, the
transcript payload's metadata clip, and the mobile char cap (renamed,
since it is no longer a label-only cap).
* fix(native-chat): surface an adverse subagent outcome in the fallback sentence
The roster row's plain-text stand-in counted only `working`, so a fan-out whose
children all latched `unverifiable` (or `failed`, or `stopped`) rendered as
"Ran 3 subagents" — a completion claim. Mobile and paired web have no roster
renderer, so that write-time-frozen sentence is the entire row there, and
collapsing `unverifiable` into something that reads like success is exactly what
the SSH execution boundary forbids.
It now appends the worst adverse count, worst-first across failed/stopped/
unverifiable, and shows it even while siblings still work — matching the Codex
lane's shared `subagentGroupFallbackText` verbatim so collapsing the two copies
later is a deletion, not a behaviour change.
Also bounds the provisional entry id. `observeChildActivity` wrote the
`parent_tool_use_id` straight into the entry's durable id with no length cap,
while the announced path already rejects an over-long id via `claudeTaskId`.
Both now share `isBoundedClaudeTaskId`, and the provisional path rejects rather
than truncates, as the announced one does.
* fix(native-chat): stop a subagent label ordinal and a clipped roster key colliding
- claimLabel probes the labels the group actually rendered instead of a
per-base counter, so a generated `Audit 2` cannot duplicate a provider's
own `Audit 2`.
- Bound `NativeChatSubagentEntry.id` with a head plus a digest of the whole
id at every site that bounds it. The id is the roster key: a prefix clip
merged two distinct children onto one entry.
- Correct a stale journal-reducer test comment: tombstone cleanup is a
map-state invariant, no longer load-bearing for revision ordering.
* fix(claude): merge duplicate unhandled-provider-frame imports
* fix(claude): preserve subagent lifecycle and bounded invocation identity
---------
Co-authored-by: Merge Sim <sim@local>
* fix(orchestration): let worker-start actually produce a structured chat
`orchestration.workerStart` reads the user's "open agent tabs in chat"
default, but two placement checks downgraded a structured-preferring
worker to a PTY terminal agent for the two flags a routine dispatch
always passes:
--worktree new-child / new-top-level -> worktree_creation
--model / --effort -> launch_preferences
so in practice a structured worker never happened.
launch_preferences was stale. PR #19040 gave AgentSessionAttachParams
`options` and added resolveStructuredLaunchSeedOptions, which narrows a
saved selection to exactly `model` and `effort` — the two ids both
structured providers accept as strings. --model/--effort now go through
that same narrowing (extracted as narrowStructuredLaunchSeedOptions) and
seed the worker's session instead of forcing a terminal. An option set
that narrows to nothing resolves to undefined, never `{}`, which would
fail the record's bounded-string guard under a code that is not a wire
refusal and strand the launch with no fallback.
worktree_creation was a consequence of createWorkerWorktree creating
agent-first: its startup terminal WAS the worker, so the structured
branch below it was unreachable for any new worktree. A structured
worker now creates the worktree with no startup agent and creates its
session for the worktree afterwards — the order the renderer's own
structured worktree create already uses. Because the executing host can
only answer agentSession.createSupport for a workspace that exists, that
verdict moved after creation: a refusal (WSL, and the rest) becomes a
terminal agent in the worktree just created, never a failed start.
--on and --terminal still downgrade, with their reasons intact, and
every remaining downgrade still states itself in the mode receipt.
The wait-for-setup gate is preserved explicitly. A PTY worker got it for
free — agent-first creation sequences the agent's startup command behind
the setup runner, so tui-idle could not arrive until setup exited. A
structured session has no startup command to sequence, so the gate is
now awaited directly, bounded by the start's own timeout.
Split out worker-worktree-creation.ts and worker-start-agent-placement.ts
rather than growing two files that were both pinned at the max-lines cap.
* refactor(native-chat): make shared feasibility authoritative for launch routing
* Type the structured setup gate's absent blocked reason so the wait union stays property-typed
The type-aware audit rejected the blocked-reason template literal: narrowing the
wait union with an 'in' check left the field typed unknown. Declaring that a
structured setup gate never carries a blocked reason restores the direct read.
---------
Co-authored-by: Merge Sim <sim@local>
* perf: check backfill date cardinality before expanding ranges
* test(codex): pin the backfill cardinality gate to the enumerated range
Differential coverage at maxDates === length and length - 1 across leap days,
century rules, year rollover and DST switch dates.
* test(codex): type the backfill cardinality table as date tuples
Untyped it.each rows widen to string[], which tsc rejects when cast to the
3-tuple CodexSessionBackfillDate.
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
Co-authored-by: Neil <neil@stably.ai>
* perf: count command-line escapes without regex match arrays
* test(windows): pin command-line budget counting against the regex oracle
Covers every BMP code unit, astral and lone-surrogate adjacency, trailing
backslashes, %VAR% and carets, plus randomized quote-heavy command lines.
* perf(windows): count command-line escapes by seeking, not scanning
Counting every character regressed the shape this estimator actually guards: a multi-KB WSL script with almost no escapes went 25-38x slower on Windows. Seek escapes with indexOf so the cost tracks their count, and hand the rest to a plain scan once they are dense enough to pay for it.
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* perf: reuse naturally ordered unique Codex trust ranges
* test(codex): pin the trust-range ordering the dedup removal relies on
Removing the pairwise dedup+sort is only sound while the scanner emits
strictly ascending, non-overlapping spans. Guard that precondition so a
future scanner change cannot silently widen or drop a trust block.
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* perf: cache update timestamps for Linear and Jira result sorting
* perf(issues): build updatedAt key map without an intermediate tuple array
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
Co-authored-by: Neil <neil@stably.ai>
* perf: select checks-panel workspace attribution in one pass
* perf(checks-panel): normalize candidate paths only after the cwd filter
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
Co-authored-by: Neil <neil@stably.ai>
* perf: index usage session breakdowns during aggregation and merge
* test(usage): cover key injectivity and merge-index freshness
Also restore both module docstrings to the top of their files.
Quote/backslash location and model keys prove the JSON tuple key stays
injective, and a second source carrying a location/model the merge itself
appended must fold into that row rather than duplicate it.
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* perf: validate terminal adoption MRU membership with group sets
* test(runtime): pin orphan-adoption group membership cardinality
Covers empty tab order, a tab claimed by two groups, duplicate group ids, an uncovered claimed tab, omitted/empty recentTabIds and both valid two-tab splits. The two-groups case is mutation-verified: swapping the global no-duplicate rule for the new per-group set fails it.
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* perf: skip folder-scope construction for separate repository imports
* refactor(project-groups): share one mode flag between scope skip and root guard
Also cover the separate-import path with real repo paths, which the throwing
getter test no longer exercises.
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* perf: index observable skill installations by locked name
* fix(skills): stop the convergence gate reading snapshots off Object.prototype
Lock names come straight from a JSON file on disk, so a skill directory named 'constructor' or 'toString' made knownSnapshots[name] resolve to a prototype function and threw TypeError out of the whole freshness inventory.
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* perf: prune metadata caches only when an entry can expire
* fix(metadata-cache): gate next sweep on the oldest capacity-eviction survivor
Capacity eviction drops the oldest entries after nextCacheExpiryAt is
computed, so the gate pointed at an expiry that no longer existed and
forced one needless full sweep.
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* perf: scope activation inventory to the owning host and workspace
* fix(activation): keep an unscoped census fallback when the owning host is unnameable
Scoping the activation inventory made resolveActivationPtyListScope throw for
paired-runtime workspaces and made a detached relay reject the scoped list, and
both collapse to a 'blocked' gate. 'blocked' skips the sleeping-agent resume and
the caller's reseed, so an SSH target on the bounded offline floor lost its
initial pane and peer workspaces stopped resuming.
Fall back to the unscoped inventory that shipped in exactly those two cases; the
scoped fast path still covers local, folder and attached-SSH workspaces. Also OR
the host-reported worktreeId with the id-prefix match instead of preferring it,
because a relay seeds worktreeId from the host's own ORCA_WORKTREE_ID and a
session dropped from the census is one the gate forks a second writer onto.
* test(activation): update forkbomb fakes to the scoped session.tabs.list shape
The gate now asks the host for one workspace's snapshot instead of the whole session.tabs.listAll inventory and refuses an answer that does not name its scope, so the old snapshots-array fakes made it block instead of resume.
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* perf: index selected skills when reporting bundle failures
* refactor(skills): reuse the shared renderer collator for delete-plan roots
src/renderer/src/lib/locale-text-collators.ts already memoises a base-sensitivity collator for six renderer modules; building another one per call in skill-delete-copy duplicated it and paid ICU setup on every summary render. Also pin dedup/order parity for the Set-based selected-skill filter.
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* perf: drop oversized diagnostic records before retaining serialized text
* fix(observability): leave a marker where an oversized trace record was dropped
Oversize records were discarded silently, leaving an unexplained gap in the
trace. Emit a tiny timestamped placeholder naming the span instead.
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* perf: index Resource Manager labels and accumulated workspace rows
* fix(status-bar): always build the resource tab-label index
The includeTabLabels flag left tabsByIdByWorktree empty for the orphan-count caller while the type declared it present, so a future reader would silently lose session labels. The only non-merge caller is memoized behind panel-open. Adds parity tests for the first-wins tab id and duplicated-worktree row rules the removed linear scans relied on.
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* perf(terminal): reuse forward OSC status terminator searches
* test(terminal): pin cached OSC terminator reuse across BEL frames
Document that forward match reuse requires a monotonic search offset and cover a distant ST held across many intervening BEL frames.
* perf: reuse collators when scanning Warp themes
* perf(warp-themes): filter before collating and skip trivial sorts
Warp discovery collated every entry in the user's home or %APPDATA%\\warp before discarding the non-Warp ones; filter first so ICU only sees candidate names (order is unchanged: filtering commutes with a stable total-order sort). Also skip the collator entirely for 0/1-entry directories and single-file dialog picks, and drop the sort that ran only to be thrown away when the preview budget expired.
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* perf: reuse collators when sorting discovered skills
* perf(skills): share the discovery-source label sorter
Both native and WSL discovery built the same one-off source collator inline; hoist it next to sortDiscoveredSkills with the same <2 short-circuit, and pin ordering parity against the per-call comparator over a wide collation corpus.
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* perf: skip fuzzy ranking when exact file matches fill the window
* test(tab-bar): pin exact-match ordering against the pre-skip rank-then-slice pipeline
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* perf: index discovered skill IDs and names for batch selection
* perf(skills): index only the selectors a share request asked for
Indexing every discovered skill made the common one-or-two-selector share slower than the linear scan it replaced (200 skills / 1 ID selector: 0.04us -> 38us). Scoping both indexes to the requested selector set keeps the O(selectors x skills) collapse and beats the unscoped index at every size measured, including 512x512 (5547us old, 176us unscoped, 64us scoped).
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* perf: preserve store state on unchanged document titles
* fix(browser): compare every doc-history field before skipping a title refresh
A hand-listed title check would silently swallow any field added to
WorkspaceDocHistoryEntry later. Cover the over-cap trim path too.
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* perf: track pane alias singleton or ambiguity without copying buckets
* test(persistence): pin pane-alias ambiguity cardinality parity
Covers 0/1/2/3/4 rows per tab plus a mixed ordering case, so a regression from has() to a truthy check would resurrect an ambiguous tab and fail.
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* fix(native-chat): reveal message chrome on keyboard focus, not any focus
`:focus-within` cannot tell a mouse click from a keyboard tab, so clicking any
control inside a message row — a tool run's disclosure, most visibly — parked
focus there and left the row's copy, scroll, and timestamp chrome showing after
the pointer had moved away. The row read as permanently hovered.
`:focus-visible` is the distinction the browser already computes, and it is the
keyboard focus this reveal was written for in #19218. Measured in the running
app: after a real click on a run header, `document.activeElement` is that button
and `:focus-visible` is false, while `:focus-within` is true.
* refactor(native-chat): spell the keyboard-focus reveal with the first-class has variant
Swaps the hand-rolled arbitrary variant `group-[&:has(:focus-visible)]:` for
Tailwind's `group-has-[:focus-visible]:`. Every other `has-` variant in the
renderer is already spelled in the bracket form, including the same
hover-plus-keyboard-focus reveal on the project header actions.
Measured in the running app: both spellings compile to an equivalent selector
and are identical in every state (idle, mouse click on a control inside the
row with the pointer moved away, and each keyboard tab stop).
Also asserts the pointer-events half of both reveals, which governs whether
the copy button is clickable and had no coverage.
* fix(native-chat): preserve message controls on touch devices
---------
Co-authored-by: Merge Sim <sim@local>
Brennan BensonandMerge Sim
