29 Commits

Include renames

Author	SHA1	Message	Date
Neil	0f47bb16e8	refactor(mobile): organize native chat prompts and permissions (#34189) ... * refactor(mobile): organize native chat prompts and permissions * fix(mobile): preserve extensionless test fixture imports	2026-10-26 18:37:33 -07:00
Kelvin Amoaba	57aa892951	fix(mobile): show chat images stored on the host as thumbnails (#33731) ... * fix(mobile): show chat images stored on the host as thumbnails Fixes #33554 * fix(mobile): read stored chat images two at a time A burst of megabyte replies over a slow link overflows the host's outbound queue and drops the phone's socket. * refactor(mobile): tidy stored chat image read * fix(mobile): skip stored image reads for rows that already left Also ignore a result read through a different host client.	2026-10-27 01:06:54 +00:00
JinjingandBrennan Benson	d249c21b7f	fix(native-chat): remove misleading usage-limit Continue action (#33392) ... * fix(native-chat): remove misleading usage-limit Continue action Keep limit warnings, reset times and provider details without offering an immediate continuation or adding manual continuation guidance. Preserve restart-interruption Continue and provider detection. * fix(i18n): sync runtime catalog for removed notice fallback * fix(i18n): remove unused usage-limit action translations * test(native-chat): cover historical usage-limit wording * test: admit historical notice fixtures through journal reader * test(mobile): admit the old-host usage-limit fixture through the journal reader --------- Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>	2026-10-26 00:58:14 -07:00
OrcaWinandOrcaWin	7d6603aa17	[comment audit] Complete repository-wide comment cleanup (#33249) ... * [comment audit] Align legacy failure-read counts with cached display * [comment audit] Condense shared provider lifecycle and browser recovery comments [skip ci] * [comment audit] Condense shared generation, path and preview comments [skip ci] * [comment audit] Condense host, file and Git contract rationale [skip ci] * [comment audit] Tighten Git lifecycle and provider contract comments [skip ci] * [comment audit] Clarify shared host authority and launch isolation [skip ci] * [comment audit] simplify local access mobile and native chat contracts [skip ci] * [comment audit] simplify native chat presentation and state contracts [skip ci] * [comment audit] simplify native runtime and provider contracts [skip ci] * [comment audit] simplify migration and orchestration contracts [skip ci] * [comment audit] simplify plugin trust and process capture rationale [skip ci] * [comment audit] simplify terminal delivery and remote compatibility rationale [skip ci] * [comment audit] clarify remote recovery and launch wire rationale [skip ci] * [comment audit] shorten shared RPC compatibility and runtime evidence comments [skip ci] * [comment audit] simplify secure storage shell startup and sidebar rationale [skip ci] * [comment audit] clarify sidebar, skill and SSH invariants [skip ci] * [comment audit] condense structured chat delivery and timing rationale [skip ci] * [comment audit] condense terminal replay and telemetry invariants [skip ci] * [comment audit] clarify launch permission and terminal delivery rationale [skip ci] * [comment audit] clarify workspace ownership and layout contracts [skip ci] * [comment audit] wait for fitted and painted SSH terminal links * [comment audit] clarify layout persistence and session ownership [skip ci] * [comment audit] clarify host routing and workspace lifecycle contracts [skip ci] * [comment audit] clarify startup persistence and app lifetime comments [skip ci] * [comment audit] clarify recovery and activity boundaries [skip ci] * [comment audit] condense activity and artifact invariants [skip ci] * [comment audit] condense automation authority contracts [skip ci] * [comment audit] simplify automation scheduling and history contracts [skip ci] * [comment audit] clarify browser chrome and annotation lifecycles [skip ci] * [comment audit] clarify browser routing and retained guest ownership [skip ci] * [comment audit] clarify browser recovery and document ownership comments [skip ci] * [comment audit] restore hosted runners required by native IME fixtures * [comment audit] shorten preview, palette and dashboard invariants [skip ci] * [comment audit] clarify terminal preview, dashboard and retention comments [skip ci] * [comment audit] clarify diff-note recovery and editor lifecycle comments [skip ci] * [comment audit] shorten rich-text and combined-diff ownership comments [skip ci] * [comment audit] shorten autosave, draft recovery and model ownership comments [skip ci] * [comment audit] shorten save-queue, notebook and Markdown constraints [skip ci] * [comment audit] shorten Monaco, PDF and rich Markdown safeguards [skip ci] * [comment audit] clarify rich Markdown source and selection safeguards [skip ci] * [comment audit] clarify editor loading and emulator stream lifetimes [skip ci] * [comment audit] trim emulator and feature tour narration [skip ci] * [comment audit] clarify floating workspace and GitHub cache ownership [skip ci] * [comment audit] trim provider controls and Linear filter explanations [skip ci] * [comment audit] clarify pairing and chat resume lifetimes [skip ci] * [comment audit] clarify chat delivery and transcript lifetimes [skip ci] * [comment audit] clarify session options and host-owned status [skip ci] * [comment audit] clarify draft durability and live-status precedence [skip ci] * [comment audit] Trim chat send and model ownership explanations [skip ci] * [comment audit] Shorten transcript ownership and send recovery comments [skip ci] * [comment audit] Simplify native chat composer and transcript hook comments [skip ci] * [comment audit] Shorten native chat scroll and structured session explanations [skip ci] * [comment audit] Trim workspace picker and onboarding commentary [skip ci] * [comment audit] Simplify pet rendering, review cache and quick open comments [skip ci] * [comment audit] Trim sidebar and session history explanations [skip ci] * [comment audit] Condense session resume and review checks comments [skip ci] * [comment audit] Shorten checks state and file explorer refresh comments [skip ci] * [comment audit] Trim plugin bridge and source-control action rationale [skip ci] * [comment audit] Trim source-control listing and review rationale [skip ci] * [comment audit] Shorten sidebar lifecycle and explorer safeguards [skip ci] * [comment audit] Condense Settings account and appearance rationale [skip ci] * [comment audit] Trim pairing and repository Settings explanations [skip ci] * [comment audit] Condense Settings search SSH and terminal safeguards [skip ci] * [comment audit] Shorten Settings voice and provider ownership comments [skip ci] * [comment audit] Condense Settings draft persistence and host-state rationale [skip ci] * [comment audit] Trim Settings hooks and sidebar setup rationale [skip ci] * [comment audit] Condense sidebar deletion and board-filter safeguards [skip ci] * [comment audit] Condense worktree cards, host ownership and Markdown contracts [skip ci] * [comment audit] Condense sidebar drag, folder and filtering contracts [skip ci] * [comment audit] Condense sidebar parity, sleep and host ownership contracts [skip ci] * [comment audit] Prune focus-read baseline after comment cleanup * [comment audit] Clarify sidebar visibility, board drops and agent evidence [skip ci] * [comment audit] Tighten sidebar listing, drag and reveal contracts [skip ci] * [comment audit] Clarify viewport geometry and skill update safeguards [skip ci] * [comment audit] Tighten skill inventory, usage and host status comments [skip ci] * [comment audit] Clarify usage ownership and resource kill safeguards [skip ci] * [comment audit] Tighten tab selection, rename and search contracts [skip ci] * [comment audit] Tighten tab-strip geometry and drag ownership comments [skip ci] * [comment audit] Tighten Tasks recovery, pagination and mutation comments [skip ci] * [comment audit] Tighten provider loading and terminal recovery comments [skip ci] * [comment audit] Tighten completion, cadence and PTY ownership comments [skip ci] * [comment audit] Clarify terminal restore and parked-pane boundaries [skip ci] * [comment audit] Tighten PTY startup and replay explanations [skip ci] * [comment audit] Clarify PTY identity and delivery ownership [skip ci] * [comment audit] Shorten remote reconnect and input replay rationale [skip ci] * [comment audit] Condense terminal parking clipboard and file link comments [skip ci] * [comment audit] Clarify IME ownership and trim trace history [skip ci] * [comment audit] Shorten pane recovery and parked watcher explanations [skip ci] * [comment audit] Condense snapshot replay and visibility recovery rationale [skip ci] * [comment audit] Shorten terminal parking and keyboard ownership rationale [skip ci] * [comment audit] Trim renderer lifecycle and menu rationale [skip ci] * [comment audit] Condense workspace cleanup ownership and settlement notes [skip ci] * [comment audit] Clarify renderer hook evidence and source ownership [skip ci] * [comment audit] Tighten IPC ownership and reconnect explanations [skip ci] * [comment audit] Trim renderer focus, paste and attention comments [skip ci] * [comment audit] Shorten scroll, locale and agent lifecycle comments [skip ci] * [comment audit] Trim agent launch, resume and ownership commentary [skip ci] * [comment audit] Shorten account, browser and editor comments [skip ci] * [comment audit] Clarify host-mirror waits, previews and input ownership [skip ci] * [comment audit] Condense launch recovery and editor tokenization comments [skip ci] * [comment audit] Condense workspace selection and terminal pane rationale [skip ci] * [comment audit] Condense terminal fitting and rendering recovery comments [skip ci] * [comment audit] Condense terminal input and host routing explanations [skip ci] * [comment audit] Condense ownership and sleeping-session recovery rationale [skip ci] * [comment audit] Condense structured launch and terminal link explanations [skip ci] * [comment audit] Condense terminal ownership and workspace file routing rationale [skip ci] * [comment audit] Condense session persistence and workspace activation rationale [skip ci] * [comment audit] Condense workspace routing and browser ownership rationale [skip ci] * [comment audit] Condense mirror recovery and layout authority rationale [skip ci] * [comment audit] Condense runtime transport and file safety rationale [skip ci] * [comment audit] Condense runtime graph and structured session rationale [skip ci] * [comment audit] Condense browser creation and remote tab recovery rationale [skip ci] * [comment audit] Condense snapshot authority and publisher recovery rationale [skip ci] * [comment audit] Condense frame, startup and provider cache rationale [skip ci] * [comment audit] Condense host twin and agent lifecycle rationale [skip ci] * [comment audit] Condense browser authority and editor cleanup rationale [skip ci] * [comment audit] Condense editor buffer identity and review cache rationale [skip ci] * [comment audit] Condense provider lifetime and repository ownership rationale [skip ci] * [comment audit] Condense reconnect, hydration and terminal retirement rationale [skip ci] * [comment audit] Condense recovery, reconciliation and persistence rationale [skip ci] * [comment audit] Condense cleanup ownership and listing admission rationale [skip ci] * [comment audit] Condense teardown ordering and terminal ownership rationale [skip ci] * [comment audit] Condense recovery ledger and web host-boundary rationale [skip ci] * [comment audit] Condense web reconnect and credential lifecycle rationale [skip ci] * [comment audit] Condense cloud rollout and assignment safety rationale [skip ci] * [comment audit] Condense relay session and database recovery rationale [skip ci] * [comment audit] Condense relay placement and protocol compatibility rationale [skip ci] * [comment audit] Condense build and packaging constraints [skip ci] * [comment audit] Condense CI gates and validation isolation rationale [skip ci] * [comment audit] Condense catalog identity and browser validation rationale [skip ci] * [comment audit] Condense mobile browser and frame-budget rationale [skip ci] * [comment audit] Shorten mobile route and browser test explanations [skip ci] * [comment audit] Condense editor and session seam test rationale [skip ci] * [comment audit] Trim session and terminal closure history [skip ci] * [comment audit] Shorten terminal browser and census explanations [skip ci] * [comment audit] Preserve root-only E2E diagnostic baseline * [comment audit] Condense mobile seam and HTML preview test rationale [skip ci] * [comment audit] Condense preview instrumentation and render harness rationale [skip ci] * [comment audit] Condense bundle contracts and native-build constraints [skip ci] * [comment audit] Shorten native packaging and CI routing rationale [skip ci] * [comment audit] Condense release tooling and benchmark constraints [skip ci] * [comment audit] Condense packaging and platform gate rationale [skip ci] * [comment audit] Shorten mobile route and history rationale [skip ci] * [comment audit] Condense mobile browser and component rationale [skip ci] * [comment audit] Shorten drawer and workspace-form rationale [skip ci] * [comment audit] Trim mobile review and editor-document explanations [skip ci] * [comment audit] Condense editor lifecycle and Markdown explanations [skip ci] * [comment audit] Trim mobile file, diagnostics and dictation commentary [skip ci] * [comment audit] Simplify mobile host-list and workspace-view explanations [skip ci] * [comment audit] Clarify mobile shell lifetime and bridge delivery constraints [skip ci] * [comment audit] Condense bridge stream, native request and audio rationale [skip ci] * [comment audit] Reduce bridge schema and page-client commentary [skip ci] * [comment audit] Tighten mobile page bridge contracts [skip ci] * [comment audit] Clarify mobile cache and session constraints [skip ci] * [comment audit] Condense mobile route and lifecycle rationale [skip ci] * [comment audit] Tighten mobile shell hook timing rationale [skip ci] * [comment audit] Clarify route handoff and notification compatibility [skip ci] * [comment audit] Clarify push registration and dictation cleanup constraints [skip ci] * [comment audit] Condense keyboard geometry and native media ownership rationale [skip ci] * [comment audit] Tighten mobile chat scroll and composer concurrency rationale [skip ci] * [comment audit] Condense mobile reply compatibility and upload ownership rationale [skip ci] * [comment audit] Condense optimistic echo and scroll ownership rationale [skip ci] * [comment audit] Tighten stream replay and queued session ownership rationale [skip ci] * [comment audit] Condense mobile composer and reply-schema constraints [skip ci] * [comment audit] Clarify mobile transcript recovery and session ownership [skip ci] * [comment audit] Clarify mobile queue and source-control compatibility [skip ci] * [comment audit] Condense storage and task launch constraints [skip ci] * [comment audit] Clarify task schemas and terminal document ownership [skip ci] * [comment audit] Tighten terminal input and viewport rationale [skip ci] * [comment audit] Shorten terminal and RPC recorder contracts [skip ci] * [comment audit] Condense recorder engine and connection contracts [skip ci] * [comment audit] Shorten host credential and relay recovery comments [skip ci] * [comment audit] Tighten pairing recovery and bundle transport rationale [skip ci] * [comment audit] Clarify RPC delivery and workspace catalog boundaries [skip ci] * [comment audit] Condense catalog and relay entry contracts [skip ci] * [comment audit] Shorten shutdown and SSH relay delivery contracts [skip ci] * [comment audit] Condense WSL relay and E2E regression rationale [skip ci] * [comment audit] Shorten cross-version harness and renderer fixture explanations [skip ci] * [comment audit] Condense paired-host and E2E lifecycle rationale [skip ci] * [comment audit] Shorten layout oracle and regression explanations [skip ci] * [comment audit] Condense paired recovery and ownership regression contracts [skip ci] * [comment audit] Shorten restart, sidebar and SSH lifecycle contracts [skip ci] * [comment audit] Condense terminal rendering and IME regression rationale [skip ci] * [comment audit] Shorten terminal recovery and benchmark contracts [skip ci] * [comment audit] Condense tooling and Windows lifecycle proof rationale [skip ci] * [comment audit] Condense workflow routing and release rationale [skip ci] * [comment audit] Condense mobile security and installer contracts [skip ci] * [comment audit] Shorten native rationale and stylesheet workarounds [skip ci] * [comment audit] Shorten Windows visibility probe rationale [skip ci] * [comment audit] Condense embedded release and signing rationale [skip ci] * [comment audit] Retain current main test behavior in final reconciliation [skip ci] * [comment audit] Complete final comment review across current source inventory * [comment audit] Handle consolidated audit reports before final CI * [comment audit] Preserve credential storage census detail [skip ci] * [comment audit] Scale broad changed E2E selections with verified timing shards * [comment audit] Align E2E assertions with browser close and settled session metadata * [comment audit] Match existing E2Es to current resource and windowing contracts * [comment audit] Observe the shared server outage notice in reconnect coverage * [comment audit] Make existing renderer probes measure settled tab and PTY work * [comment audit] Align palette E2E selector with task search * [comment audit] Refresh remaining palette search selectors * [comment audit] Keep selector correction within selected audit specs * [comment audit] Await emoji fixture settings inside renderer evaluation * [comment audit] Cancel fixture fit retries between terminal tests --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>	2026-10-25 04:05:46 -07:00
OrcaWinandOrcaWin	fdcf887bf0	chore(lint): fix suppressed lint violations instead of ignoring them (#33294) ... * chore(lint): remove disable directives that suppress nothing Each was reported unused by the oxlint config that owns its rule (root, casting, react-doctor, anti-slop, native-plugins), including 17 file-level react-doctor blanket disables whose rule no longer fires. An unused react-hooks disable was masking a react/purity finding in useAgentBucketCounts (compiler rules skip functions with hook suppressions); suppress that one explicitly where the code explains it. * test(tab-bar): use typed tab/file fixtures instead of @ts-expect-error partials * chore(lint): fix misc suppressed lint violations instead of disabling - consistent-type-imports: the "vi.importActual requires inline import()" rationale was wrong; use typed vi.mock(import(...), importOriginal) or a type-only namespace import. - no-control-regex: source-control commit/push failure summaries, shell PATH hydration, and ipynb ANSI parsing reuse the shared ansi-escape-sequences stripper and control-character pattern instead of private copies. - no-explicit-any / no-useless-spread / no-this-alias: typed `this` in bridge test mocks, drop blanket file-level disables, drop a this-alias. * refactor(main): replace avoidable type assertions with checked narrowing 17 production cast suppressions in main/wsl-guest removed: untrusted IPC and RPC payloads (Jira issue update, WSL guest plugin install, handshake type) now narrow through isRecord/type guards and build typed results; redundant casts dropped; hand-rolled object checks and errno casts use the existing isRecord / hasErrorCode helpers. * refactor(renderer,mobile): replace avoidable type assertions with checked types 13 production cast suppressions removed: RPC failures read through the `ok` discriminant instead of casting to RpcFailure; react-native-web host refs narrowed with instanceof HTMLElement; redundant reply/diff casts become checked annotations; the TUI agent param uses z.custom(isTuiAgent) like its sibling schemas; the agent-status slice cast that hid missing actions is gone so the creator's return type checks the whole slice. * chore(lint): drop dead tiptap wrapper; scope anti-slop mocking rule to test support - safe-react-node-view-renderer patched handleSelectionUpdate, which @tiptap/react 3.31.3 no longer has, so it always returned early. Use the stock ReactNodeViewRenderer. - The anti-slop test override only matched *.test.{ts,tsx}, forcing file-level no-module-mocking disables in test harnesses and fixtures. Match *-test-harness, *-test-fixture(s), .test-fixture and *.test.mjs, then drop those disables and the now-redundant per-file exemptions. * test: replace repeated cast suppressions with typed fixtures (main/shared/e2e) Net -119 cast directives. Typed fixtures replace recurring casts: unusedSshConnection/unusedOrcadHostTransport placeholders, a typed readPersistedState harness read (exposed a test treating optional httpProxyUrl as always set), real Response objects in fetch spies, an updater main-window fixture, a CDP webContents adapter, one shared releaseModuleExport for cross-version tests, and requireOverlayDir in place of `as string` on possibly-undefined overlay paths. * fix(runtime): validate loaded device rows and host scope instead of casting Two cast suppressions claimed checks that did not happen: - device-registry-file-read: "normalizeLoadedDeviceRow re-validates every field" was false; deviceId, token, name and timestamps were never checked. Rows without an identity are now dropped and the file is set aside through the existing corrupt-file path (registry reads as doubtful, so no revocation verdicts); a non-string token is stripped so the row stays listed but cannot authenticate. - client-ui: "only optionality differs" was false; any string reached persisted workspaceHostScope. Narrow it with isWorkspaceHostScope and ignore unknown scopes (wire schema unchanged for mixed versions). The remaining cast now states what it actually covers. * test(runtime,ipc): drop redundant cast suppressions; typed runtime store fixture -98 cast directives across runtime/ipc tests: 61 casts that typecheck without the assertion; a typed vi.fn for scoped invalidation; a partialRuntimeStore fixture in place of `store as never` for OrcaRuntimeService; typed worker terminal/authority builders in the incarnation-fallback suite (the old stub lacked runtimeId, ptyId, worktreeId and launchTokenHash) plus removal of stacked duplicate directives there. * chore(lint): typed vi.mock imports and explicit listener snapshot in shared-bucket tests Remaining files from the misc-rule pass that overlapped other buckets: codex-accounts mocks use the typed vi.mock(import(...)) form instead of a consistent-type-imports disable; the daemon late-exit fixture copies its listener set with Array.from instead of a no-useless-spread disable. * refactor(github,mobile): narrow routing settings type; drop remaining avoidable casts - work-item-routing cast a one-field object to AppState['settings'] under a claim that readers only consume activeRuntimeEnvironmentId. Return the existing RuntimeFocusSettings pick instead and narrow the cache-key chain's parameters, so the compiler enforces that claim. - mobile file preview reads refusals through the RpcResponse `ok` discriminant rather than a cast. - terminal document host-notify accepts `unknown` errors, removing the message-bridge cast. - native chat readability drops a redundant repo-list cast. * test(renderer): replace repeated cast suppressions with typed fixtures -140 cast directives (and ~150 unsuppressed casts of the same shapes): - mockPanePtyArgs owns the connectPanePty fixture casts, so a wrong argument order or fixture is now a type error; drop binding casts for members PanePtyBinding already declares. - Seed AppState tab rows with the typed makeTerminalTab; this exposed a split direction 'row' that is not a TerminalPaneSplitDirection. - Partial GlobalSettings use getDefaultSettings overrides; Jira-only stores use createTestStore; runtime environment rows/statuses come from a typed paired-runtime-environment fixture. * chore(lint): drop no-module-mocking disable now covered by the test-fixture glob * test(e2e): fix all 221 grandfathered e2e type errors; baseline to zero The e2e typecheck baseline grandfathered 221 errors in 119 files. About a third were tests drifted from the current API, several of which would fail or mislead at runtime: - terminal-shortcuts called a nonexistent xterm buffer method; - the daemon-lifecycle fake lacked terminateOwnedTree, hidden by importing its type from a module that does not export it; - arguments in the wrong position (listProcesses(hostId, opts), a dropped pty.write inputKind, an extra toWebTerminalSurfaceTabId argument); - removed enum values ('drawer', 'idle', 'editor', 'session-insecure-origin') and a launch_source the telemetry schema rejects; - missing required fields (turnScope, childWorkOpen, providerIdentity, reviewLookupOutcome, runtimeServiceAccount behind an `as RelayConfig`); - dead reads (tab.customTitle, bucket.targets, changedPixels). Also lifts variables that narrowed to `never` after poll-callback assignment, and adds a typed xterm render-dimensions accessor. Includes the cross-version suites' shared releaseModuleExport adoption. * chore(typecheck): gate the now-clean e2e typecheck in local lint The e2e baseline is empty, so the ratchet now rejects any tests/ type error. CI already runs it via run-ratchets; add it to pnpm lint's explicit ratchet list and replace the stale 'not yet clean' note. * test(mobile): typecheck every mobile test; baseline 105 files -> 0 mobile/tests-typecheck-baseline.txt grandfathered 105 test files (531 errors) whose types CI never checked. Contract changes had landed without these tests following, and type pins in them silently checked nothing. - Root cause: salvagedOptional (src/shared/zod-salvage.ts) cast away zod's optional marker, so every reply type built on it claimed salvaged fields were always present. Return a real ZodOptional; runtime is unchanged (the outer optional short-circuits undefined). - Production now takes the port it uses: RpcOperationSender instead of RpcClient for send-only callers, a narrow fetch signature, and only the request fields push-receive reads. - findAllByHostType/findByHostType replace `'Text' as never` lookups; stubRpcClient gives tests a typed RpcClient. - Real test bugs: settings-host-client-lifecycle "relay" hosts were direct hosts (relayHostId no longer exists); two toEqualTypeOf pins could never hold; a recovery hook ran with an undefined scope key; a create-PR test cast to a never-imported type; "no URL" assertions passed on null; plus stale required props, args and enum values. * test(e2e): parse workerStart result instead of casting it * test(runtime): typed partial runtime stores with production-shaped fixture data Route every partial store passed to OrcaRuntimeService through partialRuntimeStore with typed row builders, removing 60 cast directives that hid fixture data production never produces: - paired-client-navigation-test-harness keyed setWorktreeMeta writes by `[object Object]` (it took an id where the store takes a target), so reads never saw them; - invalid worktree lineage origin/capture and incomplete workspace lineage; - getWorkspaceSession returning null where the store returns the default session; getGitHubCache returning undefined; - orcad migration states missing migrationId/manifest/receipt, with a toEqual pinned to that incomplete shape; - partial repos, metadata, folders, project groups and notification rows. * refactor(renderer): resolve suppressed React hook lint instead of disabling it 109 of 187 react-hooks/react-doctor suppressions fixed: - ~95 exhaustive-deps disables only hid stable refs and setters passed through controller objects; list them (identity never changes, so nothing re-runs), plus a few real stale closures (tabId/worktreeId). - Effects keyed on one value that read the latest props now use useEffectEvent (WebConnect, skill freshness, Bitbucket dialog seeding, Landing preflight, automation catalog, structured-session recovery, file explorer). - The conditional layout-owner hook is selected once at module load from the build constant instead of a rules-of-hooks disable that also hid the whole controller from compiler and react-doctor rules. - A hook disable was masking a react/purity Date.now() in the palette's recent-tabs memo; sample it when the snapshot is captured. - Three identical debounced-search effects share useTaskSearchDebouncedApply; layout snapshot merge helpers move out to stay under max-lines. Remaining suppressions are mount-once resources, invalidation epochs, deliberately keyed fields, and test harnesses that mock the dispatcher. * chore(ratchet): exempt test harnesses and fixtures from the focus-read ratchet The ratchet skipped *.test-fixture.ts but scanned *-test-harness, *-test-fixture(s) and *.test-support files. Those seed settings with getDefaultSettings (which the ratchet discovers as a focus reader) and never route host work, so 17 baseline entries were false positives, and replacing a test's `settings: {...} as never` with typed defaults tripped it. Match the repo's test-support names and prune (which also drops one stale entry), and rename the frame-ordering harness to *-test-harness like its siblings. A blanket "-harness" match would also exempt e2e-terminal-pty-harness, which production imports, so the names stay explicit. * test: merge duplicate shared/constants imports * revert(file-explorer): restore original tree load effects pending SSH e2e investigation * test(runtime): drop RuntimeStore cast now that the fixture is typed --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>	2026-10-24 19:37:19 -07:00
Brennan Benson	cd1f1901ee	Show OpenCode provider quota failures as usage limits (#31937) ... * fix(opencode): show provider quota errors as usage limits * fix(opencode): preserve billing and entitlement failures * test(mobile): cover OpenCode failure notice contract	2026-10-23 13:47:32 -07:00
Brennan Benson	6de974ca5b	Mobile chat: remove the Tools toggle and its open-everything mode (#31188) ... * fix(mobile): remove the chat's Tools toggle and its open-everything mode * test(mobile): keep the scroll-ownership tests' runs drawn without the Tools default * test(mobile): the scroll-ownership harness opens settled turns as the old Tools default did	2026-10-20 22:56:11 -07:00
Kelvin Amoaba	12f3089b9c	feat(mobile): draw chat tool runs the way desktop does (#30135)	2026-10-18 01:48:36 +00:00
Kelvin Amoaba	432c6d0735	fix(mobile): show message times, keep the long-press sheet open, and say when a conversation isn't found (#29105)	2026-10-17 03:37:12 +00:00
Kelvin Amoaba	d963f2a23a	fix(mobile): draw your own messages as markdown, fold long ones and open attached pictures full size (#29075)	2026-10-16 23:27:45 +00:00
Kelvin Amoaba	507d0a9122	fix(mobile): show answered approvals and questions as receipts, and a waiting question as "Awaiting user input" (#28906) ... * fix(mobile): draw answered approvals and questions as receipts, and a pending question as its ask row The phone projected a structured chat's journal with the host's plain projection: an answered approval read "Allow Bash? {json} resolved", an answered question listed its choices without the answer, and every AskUserQuestion call stayed a raw tool line, also while its card was open above the composer. Desktop's question projection and receipt rules move to src/shared (structured-agent-question-projection, native-chat-resolution-receipt, with the receipt subject and answer heading and their words). The phone's structured session now projects through them and hands each row its receipt; new MobileNativeChatResolutionReceipt and MobileNativeChatAwaitingInputRow draw them as desktop does. In a terminal chat, a question call draws as "Awaiting user input:" until answered and "Asked:" after. * fix(mobile): say a question was asked, not awaited, once its agent has ended A structured chat's question stays pending in the journal after the agent that asked it ends (a restart, a crash, a new generation). The host stops listing it as actionable, so the answer card goes away, but the phone's row still read "Awaiting user input" and announced itself as live. The session hook now returns the host's actionable prompt ids next to the receipts, and each row asks the same shared isActionableStructuredAgentSessionPrompt desktop's transcript row calls. A question nobody waits on reads "Asked: …", as on desktop. The row callback moves to its own hook so the chat view stays within its size. * fix(mobile): decide a native chat's open question with desktop's selector The phone decided whether a question call was still awaited with its own rule (no answer yet and the turn working). Desktop asks the shared selectActiveToolCall, which also reads the call's state, so a call marked completed with no output reads "Asked" there and "Awaiting" on the phone. Native chats now call the same selector. Terminal chats keep their rule. * fix(mobile): zoom a receipt and its question row with the chat Before receipts, an answered question or approval was a faint system line that grew with the chat's pinch zoom. The receipt and the question row drew at fixed sizes, so zooming no longer enlarged them. Both now take the chat's zoom, through the same scaledType the notice row uses, which moves next to the other row styles. * fix(mobile): list a group's questions once nobody can answer them, and zoom the row's icon A grouped prompt's row names only a count ("Asked: 2 questions"). Once it is cancelled, or the agent that asked has ended, the answer card is gone and the receipt lists no answers, so the phone showed the questions nowhere. The row now lists them under its line, following desktop's listsQuestions rule: the receipt asks for the list only when it shows no answers, and the transcript's own question rows keep it off, as desktop's tool run does. While the host waits, the card shows them. The row's icon also grows with the chat's zoom, as the notice row's icon does, so it stays level with its line. * refactor(mobile): trim comments and simplify the question row and receipt Comments that restated the code go. The answer heading takes the subject its caller already has, dropping two conditions that never changed the result, on desktop and the phone. The question row lists a group's questions whenever its caller asks, as desktop's does, and the receipt asks only while nobody waits. fontScale is required on both new rows.	2026-10-15 14:14:50 +00:00
Kelvin Amoaba	f3551dba57	fix(mobile): show skill commands you ran and draw warnings, errors and status lines as notices (#28899) ... * fix(mobile): show skill commands you ran in the chat Claude records a skill run (/simplify, /review-pr 123) as a command envelope, which the noise filter hides. Desktop surfaces it as the typed `/name args` before folding; the phone only normalised image markers, so the turn vanished and the reply answered nothing. Both apps now prepare a terminal agent's transcript through one shared prepareNativeChatMessages: skill envelopes, reporting-command output and image marker turns. * fix(native-chat): keep a streamed sentence from coming back after a tool or thought row Both chats hide the live preview once the transcript shows it, but each only compared the preview with the last row. When a tool call or thought landed below the sentence, the last row had no words and the earlier sentence came back at the bottom as a live message. latestNativeChatReplyText reads back past those rows to the newest assistant words in the turn; desktop's preview check and the phone's streaming gate both use it. * fix(mobile): draw errors, warnings and status notices as notices, not agent replies The phone drew every system row through the agent's markdown, so an API retry warning, a sign-in failure, "Context compacted" or "Stopped manually" read as the agent's own words. Only the clear boundary and two host notices were special-cased. Desktop's notice rules move to shared native-chat-notice: which block of a system row is its notice, and the look it gets (divider, command output, host status, plan, aside, or a toned line). Desktop's notice row switches on it with no change in what it draws; the phone's new notice row draws the same looks, with words in faint type when a row has no notice. * fix(native-chat): show a new reply that follows a tool call on desktop The earlier fix read back past a tool call or thought to the newest assistant words, then kept desktop's length rule. Commentary written before the tool is often longer than the reply after it, so a new, shorter reply stayed hidden until the transcript caught up. The last-row rule is back as it was. Reading back now only hides the preview when the earlier words already contain it, which is the sentence still on screen while the tool runs. The phone's gate reads only rows that landed after the current reply began, so it was not affected. * fix(mobile): open the actions sheet from a long press on a plan's link A plan card's Markdown was drawn without the row's long-press handler, so on Android holding a link or file path inside a plan no longer opened Copy message / Select text, as it did before plans were drawn as notices. The notice row now passes the handler to the plan's Markdown.	2026-10-15 11:04:34 +00:00
Brennan Benson	94d2462379	fix(mobile): copy complete chat replies and loaded markdown (#26152) ... * fix(mobile): make message and markdown source copy reachable * fix(mobile): keep copy failure feedback during streaming * fix(mobile): complete source copy on paired web pages * Align mobile source Copy controls with desktop * Update chat status test for icon-only Copy * Preserve literal source when copying own messages * fix(mobile): show a message's copy button only after tapping it Like desktop's hover-only copy, the chat message copy button stays hidden until the message is tapped; another tap hides it. The tap target is not a single accessible element, so screen readers still reach the text inside. * fix(mobile): a held press on a message selects text without toggling Copy On iPad the release of a long-press selection, or of a selection-handle drag, also counted as a tap and toggled the message's copy button. Claiming the long press keeps only quick taps as toggles; native selection is unaffected. * test(mobile): load the web clipboard in the copy-button test the way other tests do vi.importActual with a relative path resolved from the mocker under CI's runner and failed to find ../platform/clipboard.web; a plain import() in the mock factory resolves from the test file.	2026-10-12 15:54:52 -07:00
Brennan Benson	6440d3c520	fix(mobile): keep a not-sent message in place on the phone, using the desktop's logic (#27936) ... * fix(native-chat): list not-sent rows at their journal places The shared projection appended rows the host recorded but never delivered after every other row, leaving the reader to sort them. A reader that draws the list as given showed an old not-sent message under newer turns. Merge them in at their journal places, after the stop rows are built, so the list is already in order. The desktop sorts by the same order, so what it draws is unchanged. * refactor(native-chat): move the recorded-rejection line into shared words The desktop's words for a message the host recorded and then rejected now live beside the other rejection words, returning notice parts each client renders its own way, so the phone can say the same thing. The desktop calls it with the same inputs; its words are unchanged. * refactor(native-chat): one projection behaviour for rejected rows Every reader now draws a message the host recorded and then rejected where it was sent, marked not sent, so the rejectedInPlace option goes. The phone was its last off caller apart from the host's conversation outline, which now leaves not-sent rows out itself; a test proves the outline is the same as if the rejected message had never been sent. * fix(mobile): show a not-sent message in place with the reason under it The phone now draws a message the host recorded and then rejected where it was sent, as the desktop does, with one small line under the bubble in the desktop's words. The line is built from the journal the view already receives; when a start-failure or sign-in row already gives the reason, it says only that the message was not sent. The load-earlier header moves to its own file to keep the view under its line limit. * fix(mobile): a send the host recorded is never handed back When the send's own reply said the host recorded the message and then rejected it, the phone put the text back in the composer with a banner, though the host and the desktop keep it in the chat. A recorded send now settles like any other: its row draws it in place as not sent (or its kept card holds it), and the composer stays empty. The banner's failure-fact plumbing, fed only by that branch, goes with it; the transcript states the sign-in guidance once. * fix(mobile): keep each structured send on the shared optimistic list Once a not-sent row stays in the chat, matching a pending bubble by its text breaks: resending the same words after a not-sent message never reached the count the bubble waited for, so a stray copy stayed, and an acknowledgement lost on that resend showed a false "Delivery unconfirmed". A structured send is now one record, kept by the structured session under the id it is sent with. Three parts match the desktop's sender: the id, the drawing (the shared projection draws it at the tail until the host's row under that id lands, in the same pass) and the settle rule (the host's own record of it, a submission, a card, or a card's hand-off, drops it by the one rule the desktop now shares). The rest stays the phone's own: the bubble shows once the host accepts the send, not from the tap; a send whose answer was lost is held undrawn and says "Delivery unconfirmed" only if its deadline passes first, instead of going back to the composer; records are kept whether or not a chat view is open; and one send in flight is the composer's rule, not the sender's. Its photo is kept under the row id it shares with the host's row, so it shows on the bubble, the landed row and a not-sent row. The drafts' text matching, with its older queued-card matching, now serves only terminal-backed chats, whose transcripts carry no ids. * fix(native-chat): merge not-sent rows by the transcript order alone The merge kept a rule for rows with no journal place that no caller reaches and that the desktop's sort does not have; drop it, and say what merging after the stop rows actually keeps. A test pins that the list the phone draws as given is already in the desktop's sorted order, with a moved stop row, a retry run, a cut-turn notice, a held card and two not-sent rows. * fix(mobile): draw the not-sent line as the desktop does Red and capped to the bubble's width, like the desktop's line and the phone's own returned-card caption, and only when there is a notice: the row had a second, unreachable source of words. A send a Stop took back is no failure, so it no longer rebuilds the notices on every streaming frame.	2026-10-12 15:16:23 -07:00
Brennan Benson	bb44f74d00	Keep native chat /clear in the same conversation (#26579) ... * Keep clear in the same chat and reset its provider context * Derive clear pauses only from journal membership and cover older rewind clients * Point queued command rewind test at the structured hook * Group queue consume errors and rewind replay assertions	2026-10-08 16:00:29 -07:00
Brennan Benson	c893048aeb	feat(native-chat): show which agent a chat message is from, and open it (#25888) ... * feat(native-chat): show which agent a chat message is from A message another agent sends into a native chat (today the orchestration mail notice) looked exactly like the person's own: a right-hand bubble and a queued card identical to theirs. The sender was recorded only on the queue row, so a message sent to an idle chat, or a card once it was sent, had no sender at all. The sender now lives on the message itself (`from` on the message body): - The send path carries it on both deliveries; an idle chat records it too, and it survives the queue, /clear's carry, restart and history. - No fingerprint covers it: one shared payload projection leaves it out at every fingerprint site, so stored digests are unchanged and the provider's echo still folds into the same bubble. The provider never receives it. - A client cannot set it: its send params stay strict. - One reader normalizes it where it is read (journal load, queued row, client projection); a newer message kind keeps the sender an agent's. - Each sender keeps a name snapshot from names Orca controls: a chat's conversation name or agent label, a terminal's own tab title or agent, a federated sender's task name. Never an agent-set terminal title. - The separate queued-row sender column and its plumbing are removed; it never shipped. Desktop shows such a message as a left-aligned "Message from <name>" row; the name opens the sender: its chat through the existing open-chat flow (after a host lookup that follows /clear and dispatch addresses), or its terminal through the terminal-link path, with the existing feedback when it is gone. A queued card shows a plain "From <name>" line. Mobile shows the same attribution, not yet clickable. * fix(native-chat): name and open an agent's message by what Orca shows for it Review fixes for showing who an agent message is from. - Names: a sender is named by its dispatch's task (local workers too, not only federated ones), else a chat by the label its tab shows, else a terminal by its tab's stored title, else its agent. The conversation name the snapshot read before has no writer, so every chat read "<Agent> Chat". - One sender builder (agentMessageSender) and a public runtime naming object (orchestrationSenderNames) any send site can use; the terminal naming moves out of the unrelated runtime layer into its own module. - Opening a terminal sender always asks the chat's host: a terminal handle is issued per run, so the host finds an earlier run's terminal again through the pane its mail was sent from. The pane key never leaves the host. - Feedback follows what the host found: a gone chat or a gone pane by the kind it lost, "pane no longer available" only when the terminal answer proves it, and the existing "couldn't reach" / "needs a newer Orca" words otherwise. - Another agent's message is not offered rewind (it would put the agent's text in the person's composer), and a Codex rewind keeps the sender on the messages it retains. - The queued card and mobile name every sender, two that share a name included, and count in "+N" only those left out; the transcript row separates names with ", ". - The host no longer normalizes the sender when loading the journal or the queue: nothing on the host reads it, and clients read it through the one reader at their projections. * fix(native-chat): name a worker's final report by its task; clearer open-sender failures - A worker's own worker_done settles its dispatch before the mail lane names who the report is from, so a terminal worker's completion read "Codex". A local worker is now named by the dispatch it holds, else the one it last held (handles are per run, so that is this run's). The coordinator mail rig now attests the worker's process, so its report is accepted and settles as it does in production. - Opening a sender: a version block or an unknown answer says "Update Orca to open it.", since either side may be the older one; "This needs a newer Orca on the computer running this chat" stays only for a host that predates the lookup. "Orca couldn't reach the agent." is followed by "Try again.", each sentence translated on its own. No new copy. * fix(native-chat): name a worker only by work it holds or just reported A worker with no active dispatch was named by the newest dispatch ever assigned to its terminal, at any status and any age: one that failed before it ran, or a task finished long ago that its later, unrelated mail kept showing. Now a worker is named by its active dispatch, else by the dispatch its own worker_done in the announced mail names (only if that dispatch is its own), else by its tab or agent as any terminal is. * fix(native-chat): restore a rewound message's sender through its typed body; mobile card fixtures name their attribution - The rewind's held-sender restore lives with the retained rows and reads both bodies through the journal's message-body check, instead of a shared helper taking any object (anti-slop: no-object-parameters). - Mobile queued-card test fixtures carry the attribution field the card gained. * fix(native-chat): never call a sender gone without proof; the sender builder moves out of the mail lane - A federated sender (dispatch:<id>) runs on another host, which the chat's host cannot open: its name is plain text, and the host's lookup answers 'not found' rather than 'gone' for a dispatch it does not run. Not seeing a worker is no evidence it stopped. - The lookup calls a chat gone only when the identity is proven lost; any other failure reaches the client as 'could not reach'. - A sender open that throws shows 'couldn't reach the agent' instead of an unhandled rejection. - agentMessageSender, the one sender builder, lives in its own module, so the runtime's naming no longer imports from the mail lane.	2026-10-06 15:14:04 -07:00
Brennan BensonandMerge Sim	7faa9f7cd3	fix(native-chat): reasoning rows with a real open/finished state, and readable Claude thinking (#19221) ... * fix(native-chat): render structured reasoning as collapsible messages * fix(native-chat): align expanded reasoning with summary * fix(native-chat): place reasoning chevron after summary * De-emphasize reasoning headlines with observed timing labels * Exclude later turn work from observed reasoning duration * fix(native-chat): give reasoning rows a host-owned open/closed lifecycle A reasoning row now says whether its block is still streaming (`state`) and, when the host saw it end, when (`completedAt`). The row's own start is its first-write time, so "Thought for N s" is measured on the execution host instead of by whichever window happened to be watching. Rows open with their first non-empty text and close on every path that ends them: the block's final frame, a new message in the same stream, every Claude turn end through one hook on the open turn, Codex item/completed, turn and session settlement, active-item eviction, and both host sweeps for a dead generation. Closing writes are lifecycle writes so backpressure cannot leave a row open. Rows without the field (older hosts, older journals) never read as live. The reasoning row's headline reads the row's lifecycle and its own turn's liveness: Thinking while open in a running turn, then Thought for N s, Thought when no span was seen, Reasoning when the host kept no lifecycle. * feat(native-chat): ask Claude for readable thinking summaries Under Orca's launch the Claude CLI streams thinking blocks with empty text, so no reasoning row ever had anything to show. Pass only `--thinking-display summarized`: it fills thinking blocks with the API's summaries without turning thinking on, so a user who disabled thinking keeps it off. Orca runs the user's own binary, and a CLI older than the flag exits on it before the session starts. The launch probes the binary it is about to run, overlapping the rest of launch resolution, and passes the flag only when that probe has already answered with 2.1.94 or newer. A slow or failed probe never delays a launch and is never remembered; a successful one is kept per binary until the binary changes. * test(native-chat): type the superseding send in the reasoning lifecycle test * fix(native-chat): stop reading an ended reasoning row as thinking The spinner line infers "Thinking" from the newest root row being a reasoning message. With summaries on, a closed reasoning row stays the newest row while Claude streams a tool's input, so the line read Thinking for the whole Write. A reasoning row now counts only while its own state is running; a row from a host that keeps no state reads as before. * fix(native-chat): measure reasoning from the block's start, not its first text A row opens with its first summary text, which trails the thinking block's start by seconds, and the journal stamps a row with its queued append time. So "Thought for N s" read 1 s for blocks that ran 4.65 s and 12.95 s. The block registry now records the host time at each block's content_block_start (else its first delta), and every write of that block's row carries it as the row's observed time; the close keeps the frame's own receipt time. Codex reasoning rows likewise carry their item/started time. * perf(native-chat): stop rewriting the reasoning row for every thinking token Claude sends a thinking_tokens frame after every thinking delta. Every frame the stream path did not consume forced the streamed text out first, bypassing the checkpoint widening and the coalescing window, so a single thinking block was rewritten and republished once per token: 212 full-row writes and 258 KB for one captured block. A frame that can write no row (token tallies, stream deltas no registry carries, pings) no longer forces that flush; every frame that can write still does. The same block now takes 14 writes. * fix(native-chat): time Codex reasoning by receipt and close evicted rows Codex summary text lands 13-50 ms before item/completed, inside one coalescing window, so a reasoning row's first write can be its completion. Item boundaries are now stamped with their host receipt time the way turn boundaries already were, so a retried or buffered delivery keeps it, and the item translator falls back to the host clock rather than Date.now(). The row carries its item/started time on every first write, including the completion, so its span is item/started to item/completed. An evicted active item is now closed from the text streamed so far, like both settle paths, and the eviction runs before the incoming item is tracked: tracking first let the stream bound drop the evictee's text before the eviction could close its row, stranding it running. completedAt now has one meaning everywhere: the host time the message was seen to end, or the end of the turn or stream that cut it off; absent only when no end was seen live. * refactor(native-chat): keep the Codex streaming body translation pure The streaming translation preserves a reasoning body as-is again; the stream writer, which is what knows the item has not completed, stamps it running. * test(native-chat): keep a re-collapsed reasoning row collapsed through a revision * fix(native-chat): estimate a collapsed reasoning row as its trigger A reasoning row renders collapsed, as one small button, but its height was estimated from its full text: a 4,129-character summary reserved about 950 px for a 24 px row, so long chats jumped as rows were measured. It is now estimated at the trigger's height; opening the row remeasures it. * fix(native-chat): probe the CLI the launch will run, and learn from a refusal The thinking-display gate probed `claude --version` with Orca's own cwd and env, while the launch spawns with the workspace's cwd and the shell env. Behind a version manager's shim those can pick different CLIs, so the probe could approve a CLI the launch never ran, and an older CLI exits on the unknown flag before the session starts. The probe also only counted if it had already finished when resolution did, so a first launch, or the first after a CLI update, usually went without the flag. The probe now runs with the launch's own resolved cwd and env, is keyed by the binary and the workspace, and a launch waits up to 200 ms for it (about 3x the probe's measured p95) before going without the flag. Only answers are kept, so a slow or failed probe is asked again next launch. A child that exits with commander's "unknown option '--thinking-display'" marks that binary in that workspace so the next launch skips the flag; that one start fails exactly as any CLI startup failure does today. * test(native-chat): type the thinking-display probe mock with both of its parameters * fix(native-chat): recheck the account switch after the probe, last as before Moving the invocation ahead of the probe, the transcript check and the permission mode put its account-switch recheck before those awaits, so a switch that began during them launched unchecked. The invocation is the last await again. The probe gets its own env from the same sources the launch uses, the inherited env and the overlay with the CLI's runtime on PATH, built by the same code, minus every credential: asking a CLI its version needs none. * fix(native-chat): wait up to 1.5 s for a cold probe, and remember every outcome 200 ms only covered a warm CLI; a cold disk, a node install or an antivirus scan exceeds it, and that chat's child then ran its whole life without summaries. A launch now waits up to 1.5 s, once per binary per workspace, measured from when that binary's probe began, so a later launch never waits again on a probe already past it. The probe gets its own 10 s kill timeout, and every outcome, including no version printed, a failure or a kill, is kept for the binary's life, so a probe that hangs costs one launch rather than every one. A refusal seen while a probe still runs wins over its late answer. * fix(native-chat): leave Thinking to the activity line while reasoning runs A reasoning row still being written drew a pulsing "Thinking…" header right under the turn's activity line, which already says Thinking: two live indicators for one fact. In a running turn an open reasoning row now draws nothing and reserves no height; it appears when it closes, as "Thought for N s". A row from a host that keeps no state, a closed row, and a row left open by a turn that ended draw as before. The row's Thinking headline is gone with its catalog key. * fix(native-chat): end every unfinished Codex item through one rule A reasoning completion with no text of its own left the row its stream wrote running for good: the completion translated to nothing and the item left the active set, so no settle could reach it. It now closes from the text streamed so far. Settlement, eviction and that completion now build an unfinished item's row through one choice (the streamed text when there is any, else the item as it started) and end it through one rule. An evicted file change with streamed tool output no longer keeps that output as its patch; it reads as interrupted, as a settled one does. A completion whose start was never recorded claims no span, so it reads "Thought". * fix(native-chat): catalogue Claude's stream keep-alive as benign An uncatalogued `ping` stream frame classified as substantive, so the fallback wrote a visible "claude · message:stream_event:ping" row, and since such frames no longer force streamed text out first, a ping inside a coalescing window landed above the open reasoning row. A ping is now benign: it writes no row. * fix(native-chat): bound finding the binary by the probe budget, and keep it LRU Resolving the command's real path and its mtime was awaited before the budgeted wait, so a slow filesystem could hold a launch indefinitely; it now counts against the same budget, and running out caches nothing. The cache is least recently used rather than first written, and holds 32 binary-and-workspace entries rather than 16. * feat(mobile): collapse reasoning rows the way desktop does With summaries on, every Claude turn now carries reasoning text, and the phone drew all of it inline, dimmed, between the prompt and the answer. Mobile now draws a reasoning row as desktop does: collapsed to "Thought for N s", "Thought" or "Reasoning", its text mounted only once opened, and nothing at all while the row is still being written in the live turn or has no text. The headline and the visibility rule live in one shared module both clients read, so they cannot drift. * fix(native-chat): let a failed CLI probe heal instead of latching A probe killed at its timeout, failing to spawn under a loaded boot, or printing no version was cached as "no flag" for the binary's life, so that workspace never got summaries again in that run. Only a version (either side of the floor) or the CLI's own refusal is kept for good now; a probe that gave no version is kept for 10 minutes, so a hung CLI still costs one wait per stretch and a boot-time failure heals. * docs(native-chat): say exactly what the version probe's env leaves out * fix(native-chat): record a Codex item's start whatever its first frame carried The start was recorded only for an item/started that wrote no row, so a reasoning item that started with text lost it and its completion claimed no span. Every tracked item/started now records its receipt time, and the started write carries it too. * fix(mobile): label the reasoning toggle and give it a full touch target The toggle now tells a screen reader what it is, "Reasoning: Thought for 3s", as desktop's prefix does, and reaches a 44 pt target. The shared English copy stays private to the module that formats it. * refactor(native-chat): build reasoning rows from one provider-neutral helper Claude, Codex and the terminal sweeps each built the reasoning row body and its running/ended stamp themselves. They now share journal-reasoning-row: blank text journals no row, text is bounded the same way, and an end carries completedAt only when the host saw it. * refactor(codex): move the active journal item type into the contracts file codex-unfinished-item-body imported the type from the settlement module, which imports values from it. * test(claude): read the launch PATH the way Windows spells it * test(claude): compare the probe's PATH to the launch's without Orca's CLI dir When the CLI's directory also holds node (Linux CI's /usr/local/bin), the runtime pairing puts that directory first, ahead of the Orca CLI directory the launch adds, so the launch PATH no longer ends with the probe's. Both still resolve the same claude and shims. The test now checks that exactly, for a CLI with and without a sibling node. * feat(native-chat): lead the reasoning row with a brain glyph in the tool-row column * fix(native-chat): route the reasoning glyph through the shared icon names, keep its chevron findable, and match it on mobile * fix(mobile): keep the long-press actions sheet on reasoning rows for Android * fix(native-chat): forward every exit argument through the thinking-display connection wrapper * refactor(codex): keep the receipt-timed notification methods with the event they stamp * feat(native-chat): read an open reasoning block through the one live "Thinking" line While the agent's open reasoning block has text, the turn's live activity line is its disclosure: collapsed by default, expandable to the live text (capped and scrollable), and the block's row draws nothing meanwhile. When the block ends, its row appears in place, open if the reader opened it live, because the line and the row read one disclosure key. Which block the line discloses is derived from the line's own render condition, so a row is never hidden while nothing on screen shows it; any other open block (a subagent's, or one a prompt pushed off the line) draws as "Reasoning". Desktop and mobile alike; no host or wire change. * fix(native-chat): a slot kept for its turn bar or diff rollup no longer draws its message The transcript row drew the message of every message slot, while the slot builder pushes a slot for a row it declined to draw whenever that row also carries its turn's bar or diff rollup. So the open reasoning block the live line discloses still drew as a "Reasoning" row when it was a provider-opened turn's first row or the last row of a turn that changed files, and one click opened both. The builder's decision now travels on the slot (`drawsMessage`) and the row draws only the bar and rollup when it is false; the row-level `folded` guard it made redundant is gone. * refactor(native-chat): draw the live line from one shared value, with one live region Desktop and mobile now render the live activity line from one pure function, `nativeChatLiveLine`: whether it draws, what it says, and the open reasoning block it discloses with the text it has so far. The open block's row is hidden from that same value, so desktop no longer restates the line's render condition beside it, and the lines no longer re-derive the text. The line keeps one element, and so one live region, through every state; only its trigger and body come and go, so a screen reader hears "Thinking" and the label after it. On mobile the live text gets the finished row's Android long press (copy or select through the message actions sheet), the line's touch target is the row's 44 pt, and its label and body sit in the finished row's column so nothing moves when the row takes over. * fix(mobile): keep the live text's actions sheet on the block it was opened for On Android the sheet opened by a long press on the live reasoning was a flag gated on a live block: it vanished when the block ended, mid Select text, and the stale flag reopened it unprompted on the next block. The sheet now holds the message it was opened for. * test(native-chat): the reasoning body owns its tone, live and once landed Rendered QA on a pre-merge build showed the live line's open reasoning in full foreground and the landed row's in muted text, so it dimmed as the block landed: the body set no colour of its own and inherited one from wherever it was mounted. Since the main merge (017ad743fa) the body carries the chat's faint tone itself; this pins that, and that the line and the row draw the same body. --------- Co-authored-by: Merge Sim <sim@local>	2026-10-06 07:19:24 -07:00
Brennan Benson	c4ea14cd9f	Show a tool call you stopped as interrupted, not failed (#25181) ... * Move the turn message ordinals and the turn-row revision to the neutral timeline folder Pure moves so a shared timeline assembler can use them: Codex's message ordinal counter becomes ProviderTurnMessageOrdinals and Claude's turn-row revision becomes the provider-neutral agent-journal turn-row revision. Only names and import paths change. * Admit one provider event's writes as one transition, and let rows be found again after a restart - A sink transition is admitted whole or not at all; its steps run back to back at their turn in the journal's write queue, and each resolver reads the fold with every earlier write landed. A resolver may also say where the row belongs (turn scope, provider reference), and the writer always hears how the transition landed. A resolved lifecycle batch chooses its settlement mutations from the fold at execution. - New optional row field providerItemRef: the provider's own reference for the item a row is, written only where the row's identity cannot spell it (Codex keys messages by their place in the turn and renumbers its item ids on resume). Set by the creating write, kept by revisions, indexed by the journal fold, never read by clients. A downgrade test shows an older host and client render such rows unchanged. - Provider timeline identity schemes (shared legacy arm, Codex) and the join index that resolves a provider item to its row from memory or the fold: ordinals and request incarnations are read back from the rows, so a restart or an evicted entry finds the original row instead of placing a new one. * Recover message ordinals from the journal's highest place, and forget joins read from a replaced epoch A fresh join index continued a turn's messages at the first free place, so a journal holding only a later ordinal (an imported or removed earlier row) had its sequence back-filled. The place is now one past the highest ordinal any row or echoed send holds there, read through a pure scheme reader. The join caches also drop what they read when the journal's epoch is replaced. * Spell the subagent thread's message slot without spreading an identity union * Add a provider timeline grammar and a shared assembler that decides at its turn in the journal Adapters translate their provider's dialect into a small grammar (turns, items, streamed text, requests, context facts, session end/reset); one shared assembler turns it into the journal rows every structured lane writes. Each event is planned as one sink transition. Which row a write lands on, whether a replay writes anything, and every change to what the assembler knows (its ledger) are decided by the transition's resolvers at the event's turn in the journal's write queue, against the fold as it stands then. A forecast (the ledger plus admitted events still queued) only answers apply() at once. So a refused event allocates nothing, a write the journal rejects leaves no trace in memory, and a restart or evicted cache finds the same rows again. Text and full snapshots of one provider item share one row and one lifecycle; reset always flushes text and settles the old session from the journal; the open-work budget is derived from what is actually open. Codex migration contracts compare against the existing Codex translator, including a restart mid-stream and a repeat that outlives the join cache. * Fix the types and the exhaustive event switch CI reported for the assembler * Let the journal decide stream lifetimes, request reuse, named sends and background work A third review found two blockers with the earlier rounds' cause, a remembered interpretation trusted after the journal moved on: - A reused request id was judged by its earlier prompt's settled turn before asking which turn the new one lands in, so a real approval in a later turn was dropped. The target turn now decides: the old turn again is a replay; a different live turn opens the next prompt beside it. - A text stream checked its row's turn only on its first write, and a turn's end released streams by the turn planning expected. Every write now checks the row, a turn's end stops the streams whose rows are in it, and turn status reads the journal first, so another writer's Stop wins. Also: a message boundary drawn by an event the journal held as a replay no longer splits an anonymous message; a send naming a turn not yet open waits for that turn; the budget charges a stream's thread and turn strings and the turn caches are byte-bounded; the open turn ends when the journal shows it settled; a turn's opener is read from the journal's row. Background work is now Orca's existing background-task row instead of a tool call flagged `outlivesTurn` (a flag remembered only in memory, so a restart failed the task). A turn's end never settles that row, so it survives restarts; session end leaves one in flight unverifiable. Three tests that opened a background tool call with `outlivesTurn` now open a background-task row and keep their original expectations about which turn the row stays in. * Type the unbound assembler helper's drain as the void it reports * Bound the rows kept for a continued anonymous message and the stopped streams A row kept for the anonymous stream that may continue it, and the marker that a stopped stream's queued writes write nothing, lived in the live-stream map and were never removed when no stream followed. They now live in their own bounded maps, so the live map holds open streams only. * Read a tool call a stop or the session's end cut short as interrupted, not failed A call still running when its turn was interrupted, when the provider child was seen to exit, or that the provider cancelled now carries `endedAs: 'interrupted'` beside `state: 'failed'`. Every build that predates the field keeps reading the call as the failure it always showed; this build reads both through one shared reader and counts the call apart from failures in the run header, without the error tint on its partial output. The shared assembler, the restart settlement and the Codex lane settle a running call through one rule: only a proven interruption cuts it short, so a turn the provider completed around an unclosed call, or work the host lost track of, still reads failed. * Assert a completed Codex turn leaves its unclosed call plainly failed * Assert an unverifiable restart settlement leaves its running call plainly failed * Let a later death proof correct the calls an unverifiable settle closed A settle with no proof of the child's death closed its running calls as plain failed, so a proof written afterwards corrected the turn to interrupted but could not find the calls. The call now keeps endedAs: 'unverifiable' beside its failed state, and the stale settle revises exactly those calls whose owner the proof names. Older builds still read them as failed. * Render a cut-short call's output on mobile, with and without proof * Find the mobile result box by walking to its View, and type the unverified-ending block * Walk to the mobile result box without a type assertion * Keep the journal store under its line limit after the main merge * Drop the provider item reference, join index and identity schemes from the transition PR Nothing in production reaches the state they defended (an assembler that lost its memory while its child keeps streaming the same turn), and the stored Codex id was positional. The legacy identity scheme moves to the assembler PR with its first caller; the Codex scheme and any persisted reference wait for Codex to move onto the assembler. The Codex ordinal counter goes back to codex/, since no neutral code imports it. * Write a resolved settlement in one transaction through enqueueRows A settlement too large for one row now commits all its rows or none, through the journal's existing all-or-nothing write, instead of a row-by-row writer. Every row is built before any commits, so a settlement naming one item twice is refused before anything is written. * Drop the transition's landing report; keep the turn-row write fire-and-forget Nothing reads which steps of a transition wrote. A failed step fails the sink, leaving the steps before it written; the header says so, and tests cover it plus a settlement whose second row fails inside the transaction. writeAgentJournalTurnRow returns nothing again, as on main. * Run a transition's steps as a prefix; drop the paced flag and resolved options A failed step no longer lets the steps after it write: each step checks, at its own turn in the journal's queue, whether the write handed over just ahead of it completed, using the queue's count of completed write bodies (a promise would report the failure only after the next step ran). The sink fails only once every step has had its turn. The item step's `paced` size bypass and the resolver's replacement `options` are removed; nothing planned uses them. * Rebuild the timeline assembler on one admission-order state The assembler kept a second copy of its state (a forecast beside a ledger), hydrated the open turn from the journal, and recognised replays, all to recover from losing its memory while the provider child kept streaming. That never happens: one assembler lives exactly as long as one child, and a new child is a new assembler in a new generation whose events land after the dead-generation sweep. - One state, changed only when the sink admits an event (minted keys included), so a refused event takes nothing. - Every journal-dependent choice is made when the write runs, by keyed reads: a turn row is written only where none is, a stream checks its row's turn on every write, a running snapshot never lands in a settled turn or relights a settled tool, a request takes the first incarnation the journal holds no row for. - Rows are found by spelling their ids (provider-timeline-rows.ts); no join cache. - The identity scheme (legacy arm only) lives here with its first caller; requests are spelled in their acquisition generation, since JSON-RPC ids restart per process. - Saved history goes in as `input.history` plus ordinary events with the provider's ids, into an empty journal; `session.reset` and every replay rule are gone. - One terminal-body function (`terminalAgentJournalBody`) is shared with the dead-generation settlement. - The test rig's restart now sweeps and starts a new generation, as production does. * Cover new running work in a turn the sweep ended * Run a transition's steps in one queued write that loops over them The steps of one event now share one turn in the journal's write queue: a loop writes each in its own transaction through the row writer's synchronous writeRows (split out of enqueueRows) and stops at the first throw. Prefix semantics and "nothing lands between the steps" now hold by construction, so the completed-write counter on the queue, the step gate and the allSettled barrier are gone; the queue is back to main's bytes. * End a turn another writer settled the way the provider's end does A person's Stop settled the open turn's row without a word to the assembler. The assembler then forgot the turn: its running tools and pending prompts were never settled, the provider's own end and withdrawal were dropped, and the turn's text streams stayed counted against the open budget for the life of the process. Text the provider kept streaming afterwards could land as a message outside the stopped turn. - The open turn the journal shows settled ends first, as one transition, through the same settlement the provider's turn.end plans; its streams stop and their keys drop later text until that turn's end or the next turn opens. - turn.end and request.withdrawn are admitted for a turn or request the journal holds; their settlement writes nothing for rows already settled. - The budget's re-check frees streams whose turn settled. - A settled tool keeps its terminal body against any differing write. - Session-end settlement of lost background work uses the journal's own lostLiveWorkJournalBody instead of a copy. - The rig's window elapses before every read, and restart swaps and disposes the old assembler. * Leave a stopped turn's running tools to the agent's own end When another writer settles the open turn (a person's Stop), the assembler now only stops that turn's text and cancels its pending prompts. Running tool calls stay the agent's: a progress update or completion it reports after the Stop lands as reported, and whatever is still running settles at the agent's turn end for that turn, the next turn's open, or the session's end. An agent's end for an earlier turn while a newer one is open no longer clears the open turn's activity line or ends its anonymous reply. An unnamed end right after a Stop ends the stopped turn instead of being dropped. The test rig's restart no longer writes the dead assembler's window text, matching dispose. * Pin that a stopped turn's running tools hold budget until the agent's end * Type the stopped turn's tool progress update as a tool body * List every event the assembler hands to the decision step The type-aware lint requires an exhaustive switch with no default case. Also retitle a Stop test to say what it asserts. * End a running call as its turn's journal row ends A call still running when its turn ends takes the state of that turn's row: a row another writer settled first (a person's Stop) stands, so its calls read interrupted whatever the provider's later end reports. The no-ending path that settled calls from the Stop row is gone, since a Stop now leaves running calls to the provider. Adds the two Spanish strings. * Settle a stopped turn's running call as its turn row ended after a restart too The restart sweep ended every running call by the death evidence alone, so after a person's Stop with no proof the child died the call read failed under a turn that read interrupted. The sweep and the live dead-generation settlement now ask the same rule the assembler does: a call in a turn already settled ends as that row ended; only a turn still running leaves its calls to the evidence. * Keep the dead-generation settlement under the line cap * refactor(native-chat): drop saved-history adoption from the timeline assembler The common pattern discards the history a provider replays while loading a session, so the assembler has no use for an input.history event. * refactor(native-chat): a pending input is only Orca's send now Review follow-up to the adoption removal: drop the comment naming the provider's saved message, and make requestedAt required since every pending input comes from input.accepted. * test(ratchet): require src/main/provider-process now that it has landed * test(native-chat): build this stack's journal identities with main's opaque provider handle Main's #24991 replaced the {kind, ...} handle with {transport, agent, nativeId}; three test files from this stack still wrote the old shape. Same lines the downstream ACP branch uses.	2026-10-06 00:40:47 -07:00
Daiki HirayamaandNeil	c2c7649849	fix(mobile): stop Android from selecting words while the chat transcript scrolls (#22871) ... * fix(mobile): stop Android from selecting words while the chat transcript scrolls On Android every paragraph, heading, quote, code block and table cell in the native chat transcript was a selectable TextView. Android starts a word selection, with the magnifier, on a double tap or a long press, and two flicks in the same spot while scrolling a FlatList register as a double tap, so scrolling the chat kept selecting words. iOS is unaffected: its UITextView path arbitrates scroll against selection itself. Android now renders transcript text without inline selection: one gate in MarkdownText covers every selectable span, and the user bubble follows it. A long press on a message opens a sheet with "Copy message" and "Select text", the latter a screen whose only content is one selectable Text, so a selection can only start where the user asked for it. The message row owns that sheet and mounts it only while open. iOS and web keep their inline selection and get no long-press handler. Verified on a Pixel 10 Pro Fold (Android 17): an adb double tap on the transcript selects nothing, the same double tap inside "Select text" selects a word, tool rows inside the bubble still expand on tap, and the long press opens the sheet. * fix(mobile): scope the Android selection gate to the transcript and route span long presses Review follow-ups on #22871: - The gate now applies only where `rangeSelectable` is passed (the chat transcript). Task comments and file previews keep their selectable text on Android as before. - On the Android transcript, spans that take taps (links, file paths) also take the row's long press, so a link under the finger no longer swallows the copy/select sheet. - Copied text keeps its whitespace; only whitespace-only blocks are dropped. - The Android markdown test compares `String(node.type)` instead of a type assertion, which the changed-code quality gate rejects. * fix(mobile): route long presses on Markdown images to the row on Android An image block is a Pressable of its own, so on the Android transcript it now carries the row's onLongPress like tappable spans do; a long press on an image opens the copy/select sheet instead of being swallowed. Test extended with an image block. * test(mobile): pin the Android long press from a chat row to its actions sheet The existing row suite runs as iOS, where the bubble has no long press. This one runs as Android: the bubble's long press mounts the actions sheet with the message, the markdown receives the same handler, closing unmounts the sheet, and the user bubble carries no inline selection. * fix(mobile): preserve Android message selection while replies stream --------- Co-authored-by: Neil <neil@stably.ai>	2026-10-05 01:41:19 -07:00
5 people	f199a20c3a	Preserve OpenCode reasoning and recorded patches in native history (#24790) ... * Use bounded OpenCode context for vault session continuation OpenCode database and synthetic row paths are not text transcripts. Use the vault preview or captured pane context, preserving actual transcript paths containing a hash and supporting both OpenCode lanes and Windows paths. Adapted the intent of #11859 and extended it to actual installed v2 vault rows. Co-authored-by: mrcha033 <mrcha033@users.noreply.github.com> * Read real OpenCode sessions in terminal-backed native Chat Reuse the bounded AI Vault SQLite worker for v1 and v2 session pages and live updates. Keep terminal input as the real execution path and pace OpenCode Stop through its two-Escape interrupt. Co-authored-by: xodmd45-ctrl <xodmd45-ctrl@users.noreply.github.com> * fix(opencode): publish approval cards for permission requests * Send OpenCode native approval through its Enter selector * Resolve mobile Chat readability for folder workspaces * Bound OpenCode part batches and preserve v2 image attachments * Prefer live migrated OpenCode sessions over legacy copies * Consolidate mobile Chat eligibility test imports * Consolidate OpenCode SQLite protocol type imports * fix(native-chat): preserve OpenCode reasoning and patch parts Separate genuine reasoning from answer blocks in both native SQLite schemas and retain recorded patches as completed patch tools. Keep each database row together at page boundaries so the existing raw-row cursors cannot drop half of a mixed row. Adapted from @akhan157's OpenCode native history work in #13287 at bb661d10d716764fb472d824cd434678875b1947; retains the current bounded reader and account discovery instead of restoring the older capture and cursor implementation. Verified against genuine private installed 2.0.16 and official 1.18.30 CLI ingestion. Co-authored-by: Adnan Khan <adnank11427@gmail.com> * fix(native-chat): keep split OpenCode rows intact on desktop and mobile Preserve the native reader's bounded OpenCode row groups in paired reads and snapshot/replacement frames so a second presentation-count slice cannot drop reasoning while advancing the database cursor. Sort derived reasoning before its answer under the same provider timestamp while retaining journal order. These two boundaries were reproduced with genuine installed 2.0.16 and official 1.18.30 sessions in a hidden desktop renderer and the current mobile view over an actual authenticated encrypted pairing. Completes the semantic presentation from @akhan157's #13287 without importing its older clipping or cursor implementation. Co-authored-by: Adnan Khan <adnank11427@gmail.com> * fix(native-chat): keep reasoning and answers together in live windows * Bound OpenCode transcript RPC pages and present omission notices * Bound OpenCode transcript RPC pages and present omission notices * Bound OpenCode transcript RPC pages and present omission notices * Update native worker oversized-history notice contract --------- Co-authored-by: mrcha033 <mrcha033@users.noreply.github.com> Co-authored-by: xodmd45-ctrl <xodmd45-ctrl@users.noreply.github.com> Co-authored-by: nwparker <nwparker@users.noreply.github.com>	2026-10-03 22:04:52 -07:00
Brennan Benson	21124db4d5	refactor(native-chat): a subagent's rows live in its own section, not in the parent's conversation (#23752) ... * refactor(native-chat): a subagent's rows live with that subagent, not in the conversation A subagent's rows were drawn in its parent's conversation, each captioned with the subagent's name. They now belong to the subagent: the transcript projection keeps the session's own rows as the conversation and each subagent's rows apart, keyed by the agent id its roster entry already carries, folded on their own. Desktop: a subagent's rows open in a section under the roster row that names it, from that agent's roster entry, and are windowed like any other rows. A subagent no loaded roster names opens where its first row happened, inside the section of the agent that spawned it or in the conversation. Its edits still count in the turn they were made, and revealing one opens the sections around it. Mobile shows the conversation, with each spawn's roster line. Worker reads and structured terminal reads serve the worker's own rows. Removes what the move makes redundant: the per-row caption and its copy, the producer check in the tool fold and the turn answer, the per-agent frontier interleaved in the conversation, worker-text subagent tags, and the agent id on worker-read messages. * refactor(native-chat): a diff target names the sections its row sits in Revealing a subagent's edit opens the sections around it from the target the rollup already holds, instead of looking the row up at click time. The section head keeps to the agent's name and dot; its state in words stays on the roster entry. The worker page test stubs the host through its module rather than a cast. * fix(native-chat): a working subagent's section is open; a worker page windows its own rows A subagent's section is open while its agent works and closes once it settles, the way the turn's own live run does; a section the reader opened or closed by hand keeps that choice. A subagent another subagent spawned opens inside that one's section, so a working grandchild shows inside its working parent. Openness is derived from the roster's state and the reader's choices; nothing stores an automatic open. A worker page is now the newest page of the worker's own rows. The host windows the read over them before the limit, so a subagent's burst can no longer crowd the worker's rows off the page, and "older" still means older worker rows. The scope is an in-process argument of the host's history read; no wire request carries it. * fix(native-chat): a subagent section head names the turn it sits in, for the outline rail * fix(native-chat): a subagent section's rows sit in the turn the section is shown in, for the outline rail A background subagent's rows written during a later turn carried that later turn onto their slots, so scrolling through its section lit the later turn's rail tick and then snapped back. The rollup still counts each edit in the turn it was made; only the slot, which the rail reads, takes the shown turn. * fix(mobile): Load earlier reads past pages that hold only a subagent's rows Mobile draws only the session's own rows, so an older page made entirely of a subagent's rows landed as nothing: the reader tapped Load earlier, saw the spinner, and got the same transcript back. One load now reads on (up to 8 pages) until a page holds a row of the session's own, then applies the pages in order. * test(mobile): stub the RPC client the way the other structured-session hook tests do * perf(native-chat): order subagent rows for the changed-files rollup once per change to them The rollup flattened and re-sorted every subagent row on each update, including every token the parent streamed. The ordering now keys on the projection's subagent rows, which keep their identity while only the conversation changes. * refactor(native-chat): order subagent rows in the sections hook, keeping the list under its line limit * fix(mobile): a transcript whose newest page is only a subagent's rows reads back on its own Opened while a subagent is busy, the newest page can hold nothing but that subagent's rows. Mobile draws none of them, so the reader saw an empty chat with a Load earlier button, and an empty list cannot be scrolled to page. The hook now reads back once from each such head, and the read runs on to the session's own rows. * fix(native-chat): count the live window in the session's own rows, so a subagent's burst keeps its roster The live window kept the newest 1,024 rows of every agent. A subagent writing more than that trimmed its own spawn's roster row and the prompt, and its section fell back to a closed, unnamed header. The window now keeps the newest 1,024 of the session's own rows and everything after, with an 8,192-row cap on every agent's rows as the memory backstop. A transcript with no subagent rows trims exactly as before. * fix(agent-session): window history pages by the session's own rows, with a subagent's rows riding along A history page held the newest 200 rows of every agent, so a subagent's burst could fill a page on its own: the phone opened on an empty chat and "Load earlier" landed nothing. A page now starts at the oldest of the newest `limit` rows of the session's own and serves every row from there, so the subagent's rows come with the conversation they happened in. The page stays contiguous, the cursor still names its first row, and the byte bound still applies. A transcript with no subagent rows gets the same pages as before. Clients already take a page larger than its limit: both reducers raise their retained window to the page's size. The mobile read-on and read-back stay for older hosts. * test(agent-session): a page reaches back to the start rather than leaving a subagent-only page * fix(native-chat): an own-row trim takes a trimmed roster's subagent rows with it The live window trimmed to just after the own row it dropped, so a subagent whose roster row went kept its rows at the top as an unnamed section until the parent wrote again. Trim to the oldest own row kept instead; it still fires only once an own row passes the limit, so a paged-in run of subagent rows at the head stays until then. With no subagent rows nothing changes. * perf(native-chat): cap the live window at 4,096 rows, bounding each delta's re-derivation Every live batch re-derives the transcript over every retained row. On the largest real window (7,374 rows) that cost 7-8 ms a delta on desktop against 0.6 ms at the old 1,024-row window, and held about 26 MB of row content. 4,096 halves both. The most rows any local journal puts between a roster and its subagent's last row, with the parent inside its own-row limit, is 3,005, so no observed subagent loses its roster to the lower cap. * fix(native-chat): a subagent section opens only while its roster is the running scope's live frontier A section used to open whenever its roster said the subagent was working, anywhere in the transcript and whether or not the session was running, so a background subagent's section stayed open and grew mid-transcript while the parent moved on. It now opens by default only while the session runs and the roster row naming the subagent is the newest thing the parent produced, user rows aside. Newer parent output closes it even while the subagent still works; the roster row keeps showing that live state. A subagent still working is a running scope of its own for the sections it spawned; a settled one closes its scope. Derived every render, no latch; the reader's own open or close still wins. * fix(native-chat): name a subagent's section from a client roster the window never trims A section took its name and state from a roster row in the loaded window. Once a burst trimmed that row, or the row sat on an older page, the section fell back to an unnamed, closed "Subagent" header. The shared reducer now keeps a roster keyed by agent id, folded from every roster row and revision the client receives: pages, older pages and live batches, including revisions of roster rows outside the window, which live batches already carry. The first roster naming an agent wins and its revisions update it; a removed roster row drops its entries; it is rebuilt on every page that replaces the window and bounded to 512 agents. Sections take their name, state and live-frontier place from it; placement stays under the loaded roster row, else at the section's first loaded row. Only a subagent no roster ever named stays unnamed. * feat(agent-session): a history page names the subagents whose roster row is older than it A page is a contiguous run of the journal whose older-page cursor is its first item, so it cannot pull an older roster row in without skipping the rows between. When a page held a subagent's rows but not the roster row naming it (about 11% of the moments a reader could open a session on local journals), that subagent drew as an unnamed "Subagent" header. History and hydration pages now carry an optional `subagentRoster`: the first roster entry naming each subagent whose rows are on the page and whose roster row is not, with the row's id, sequence and revision; bounded to 64 entries and 16 KB. Items and cursor are unchanged. The client seeds its roster from it. Rule 1 in docs/reference/remote-wire-compatibility.md: an optional field on an existing frame, no capability gate. An older client ignores it (the released reducer reads a page with it exactly as one without); against an older host the field is absent and the section falls back to an unnamed header. * Revert "fix(native-chat): an own-row trim takes a trimmed roster's subagent rows with it" This reverts commit 22078656b2. Its only purpose was to stop a subagent whose roster row an own-row trim had dropped from showing at the head of the window as an unnamed section. The client roster now names that section whatever the window holds, so the cut is back at just after the own row the limit passes. The retention test that pinned the unnamed-section case now asserts the section at the head keeps its name. * chore(native-chat): state the retention limits' own reasons, now that no name depends on the window Own-row retention keeps the conversation a reader sees from being crowded out by rows drawn as a one-row section on desktop and not at all on mobile; the every-agent cap bounds memory and each live delta's re-derivation. Neither is about keeping a roster row loaded any more. * fix(native-chat): hold the roster fold's draft map where type narrowing can see closure writes * fix(native-chat): a roster row's newer revision replaces it in the client roster too A revision that stops naming an agent (the host drops an entry it learns is not a subagent, or re-keys a provisional one) left the client roster holding the old entry, often still "working", with nothing to re-derive it. The section then read as working forever and could auto-open, while a fresh read of the same journal left it unnamed. The fold now drops an entry when a newer revision of the row that named it no longer does, before any roster takes it over. * fix(native-chat): a parent's spawn and wait calls keep the subagent they name open A subagent section auto-opened only while its roster row was the running session's newest row, so any later row closed it: a Codex wait on the agent, or the parent's text before its next spawn call. Now a row that is part of delegating to a subagent keeps that subagent open: - a Codex collab call (spawn, wait, resume, message, close) opens each agent its receiver thread ids name; one naming none is ordinary output; - a Claude spawn call names no agent, so it counts toward the roster announcing it; - a roster row at the frontier opens its most recently added agent, not all of them. A roster or call naming only agents one subagent spawned is that subagent's output, so a grandchild's roster, which the host journals as the session's row, no longer closes the spawner's section. * fix(native-chat): a parent's call right after the roster closes its subagent's section A parent's tool calls after a roster row fold into the tool run drawn above the roster, so the roster stayed the newest drawn row and its section stayed open while the parent was already reading or running commands. The fold now records the newest journal position among the rows it merged, and the live frontier orders rows by that newest part. The layout is unchanged. A spawn call folded there still counts as part of the roster announcing it. * fix(native-chat): a Codex call naming several subagents delegates to the first A Codex collab call that names several agents opened every one of their sections. It now counts as delegating to the first agent it names, so one section opens, the same as a call naming one agent. * fix(native-chat): closing a roster's list closes the sections under it Collapsing a roster row's list of subagents left their open sections drawn, so the section's own head became the only way to close them. And the list's open state lived in the row, so a row the window unmounted came back collapsed. The transcript now holds each roster list's open state beside the section choices. A closed list hides every section it anchors; each section keeps its own open or closed choice for when the list reopens. With no choice from the reader, a list is open while a section under it is open. Closing a section from its entry keeps the list open, and revealing a subagent's edit opens the list it sits under. * perf(native-chat): a reveal finds the roster lists it opens with one set lookup per entry * fix(native-chat): a subagent's roster entry heads its own rows An open section drew the agent's name twice: its entry in the roster's list, then a separate section head above its rows. The entry is now the head. The roster row draws its entries through the first open one, that agent's rows follow, then the entries after it, each run in its own windowed slot. A section no loaded roster row holds (an older page, a grandchild, an unnamed agent) keeps its own head. A roster list is open while the live frontier or a reader's choice is on one of its agents, unless the reader closed the list, so closing an agent from its entry no longer needs to pin the list open. The section emitter moves to its own module, and the trailing-run predicates it shares with the slot builder to theirs, to keep the slot builder under its line limit. * fix(native-chat): the entries after an open subagent's rows set in its roster's type The roster row's list inherits the system row's small muted type; the entries that follow an open section sit outside that row, so they now carry the same type. * docs(native-chat): a current host can also serve a page of only a subagent's rows A page is bounded by bytes after it is windowed by the session's own rows, so a burst that fills the bound yields a page, or an opening page, with none of the session's own rows. Mobile's read-on and read-back therefore serve current hosts too, not only older ones; the comments said otherwise. The retention comment still described a closed section as a row of its own; it now sits behind its roster entry. * fix(native-chat): a section's prose keeps its copy/timestamp controls inside the section An assistant row's hover controls (copy, scroll-to-top, timestamp) hang 20px below the row into the gap before the next one (`-mb-5`). Inside a subagent's section that put them below the section's left border, and on the section's last row they touched the parent's next row with no gap. Inside a section the controls now stay in flow, so the border covers them and the next row sits the normal gap below. The row-height estimate reserves the same 20px for a section's prose so windowing does not jump on measure. * test(agent-session): state each appended row's turn scope, as the journal now requires * refactor(native-chat): the client's journal retention policy lives in its own module	2026-09-29 23:47:02 -07:00
Brennan Benson	e8e144bf3c	fix(native-chat): a subagent's words are presented as that subagent's, never the parent's (#23605) ... * fix(native-chat): a subagent's words are presented as that subagent's, never the parent's The journal already names the agent that produced every row, but the transcript projection dropped it, so a subagent's prose rendered as the parent's reply, its tool calls folded into the parent's runs, and a settled turn could fold down to a subagent's words as its only visible answer. The transcript message now keeps the row's producer. The fold keeps each agent's calls in that agent's own run, a turn's answer is the session's own agent's last prose, and a subagent's row names the subagent on desktop, mobile and a worker's transcript text. * test(native-chat): give the window fixture's slot the attribution field it now carries * fix(mobile): read the subagent label the row is given, and pin the caption * fix(native-chat): keep interleaved agents in order and each agent's own run live Review follow-ups: - the fold is main's adjacency fold plus one condition: a row never folds into another agent's run, so an agent's later call stays below its subagent's work instead of jumping back into its earlier row - each agent has its own live frontier, so a parent still inside its spawn call reads as running while its subagent works below it - mobile names no one on a row whose only content is hidden behind its settled turn - a pending question from a subagent keeps its producer - worker reads serve only the producing agent's id, bounded like the roster key that names it, and drop the provenance fields - the single-message worker formatter is private, so no caller can drop names	2026-09-28 15:28:01 -07:00
Brennan BensonandMerge Sim	fab78c7669	fix(native-chat): show one live-turn indicator, and make Thinking mean reasoning (#19977) ... * native-chat: render one indicator row for the live desktop turn The turn-timing row and the spinner+activity line were two rows saying "Working" at once. A settled turn keeps its own row; the live turn now has only the spinner row, labelled provider activity -> Thinking -> Working for N through the shared resolver. Reasoning is the turn's content, so it no longer becomes the activity label, and "Thinking" now means the turn is reasoning right now rather than that it has produced no output yet. * mobile: give the live turn row a spinner and the shared indicator label Mobile's per-turn row is already the only live indicator on the structured lane, but it pulsed a bare word and never showed what the provider said it was doing. It now renders a spinner beside the same resolved label desktop uses, and reads reasoning from the journal instead of inferring it from missing output. The bridge lane's four prompt/interrupt write seams move to one module so the controller stays under its line cap. * codex: mark streamed reasoning as reasoning too, and pin the provider markers The settled reasoning item carried the marker but the streaming one did not, so a live Codex turn - the only time the indicator is on screen - never read as reasoning. Both paths now stamp it; a plan document keeps its own presentation and must never read as reasoning. * fix(native-chat): tighten live turn reasoning state --------- Co-authored-by: Merge Sim <sim@local>	2026-09-11 00:19:57 -07:00
Brennan BensonandMerge Sim	4b4acf26a4	fix(mobile): enable patch-free iOS text selection in native chat (#19769) ... * fix(mobile): make every native-chat text node selectable Long-press selection worked on some chat text and not others. Markdown paragraphs — the default block for agent prose — were the one block type left out when headings, quotes, code, lists and table cells gained `selectable`, and tool result output, diff rows, the unloadable-image placeholder, permission/question bodies and the send-error banner never had it at all. Selection is now set on every content Text in the chat surface, on the outermost block Text so nested inline spans inherit it. Labels inside a Pressable (option rows, tool-line headers, buttons) are deliberately left alone: selection there would swallow the tap they exist for. Extracting MobileNativeChatEmptyState keeps the view under its max-lines cap and matches desktop, where NativeChatEmptyState is already its own component. Tests render each surface and assert selection on the block that carries the prose; both files were ablated against the unfixed source (4/10 and 3/5 red) so they pin the defect rather than the current behavior. * fix(mobile): support native text range selection on iOS * fix(mobile): remove persistent assistant message controls * fix(mobile): scope patch-free text selection to chat Use the stock react-native-uitextview dependency behind an iOS adapter and opt assistant Markdown into range selection only in native chat. Preserve the existing React Native Text behavior elsewhere and remove the persistent assistant controls. --------- Co-authored-by: Merge Sim <sim@local>	2026-09-09 21:50:31 -07:00
Brennan BensonandMerge Sim	b0c67eaf88	feat(mobile): port the restructured native-chat turn status and live tool progress (#18761) ... * feat(mobile): port the restructured native-chat turn status and live tool progress Mobile chat had a single static "Agent is working" row and no live tool activity, while the desktop restructure (#17597, #18705) replaced that with a per-turn status row and a running-tool label. This brings mobile to parity and puts the derivation in one place instead of two. Shared (new, pure, RN-safe — desktop uses them as i18n fallbacks, mobile directly, matching the native-chat-empty-state pattern): - `native-chat-turn-status.ts`: duration formatting, label selection, the turn-timing state machine, and the active/settled split. - `native-chat-tool-activity.ts`: command-tool classification, the running-tool label descriptor, and running-call selection. Desktop now consumes both; `NativeChatWorkingStatus`, `NativeChatToolRun` and `use-native-chat-turn-status` keep their existing behavior and strings. Mobile gains the "Thinking" / "Working for 12s" / "Worked for 3m 4s" row with a caret that discloses the turn's tool activity, the pulsing "Running npm test" row with terminal-vs-wrench glyphs, and desktop's rule that a completed turn's tool run hides behind the turn caret. The bridge lane is untouched and keeps its three-dot indicator. Headings, quotes, code, lists and table cells are now selectable. Files at their max-lines cap were split rather than bumped: the tool-run subtree, the prompt card, the session-lane wiring, and the turn-disclosure state each move to their own module. * perf(mobile): stop the turn-status rows from re-rendering the whole transcript A streaming turn re-renders the chat list many times a second. The disclosure wiring handed every row a fresh status object and a fresh toggle closure on each of those renders, so `MobileNativeChatMessage`'s memo never held and every visible row re-rendered per tick — including settled turns that had not changed. Memoize the status selection on the timing map, and keep one stable toggle handler per turn (pruned when a turn leaves the transcript) attached only to the settled rows that can actually disclose anything. Now only the live turn's row changes identity while the agent works. * fix(mobile): keep the turn clock running when the optimistic echo is replaced An accepted send renders as `pending-N` until the transcript echo lands under its real message id. That flips the active turn key mid-turn, and the timing reducer treated the new key as a new turn — so a turn that had reached "Working for 8s" visibly restarted at "Working for 0s". The reducer now carries the start over when the previous key names a turn that has since left the transcript, which is exactly the echo-replacement case. A genuinely new turn (the previous key still in the transcript) and a turn that had already settled both keep their own clock; both are pinned by tests. Desktop does not pass the new key and is unaffected. * fix(mobile): keep the Tools toggle working on settled turns Hiding a settled turn's tool run behind the turn caret (desktop parity) also made the composer's global Tools control a no-op on every completed turn: the run it wanted to expand was not rendered at all. Let that toggle override the hiding, so it still reveals every run at once the way it did before. * fix(mobile): re-key the turn timing instead of only carrying its start The previous fix carried the start forward only while the turn was still working. When the transcript echo landed after the turn had already settled, the new key inherited nothing, the settled timing was pruned with the old key, and the turn's "Worked for N" row disappeared entirely. Move the timing onto the new key instead, which covers both orderings: an in-flight turn keeps counting from its original start (and later settles against it), and an already-settled turn keeps its duration. Both orderings are pinned. * test(mobile): pin the structured turn-status wiring at the view level Emulator QA could not reach the structured lane (mobile's Create Tab -> Codex falls back to a terminal tab when agentSession.createSupport says unsupported), so the view's own lane wiring had no coverage — the one seam between the shared turn-timing reducer and the rendered rows. Assert what the view hands each row: the live user turn gets a status object and the three-dot indicator is gone on the structured lane; the bridge lane keeps the indicator and gets no status; a finished turn settles to a numeric duration with a toggle; and an assistant row never carries a status row of its own. * fix(mobile): isolate structured chat turn state * fix(mobile): let the capability RPC actually store what a phone advertises `runtime.clientCapabilities.update` records the advertised set by assigning `authenticatedSocket.clientCapabilities`, but the socket handed to the dispatcher defined that property with a getter only. In strict mode the assignment throws `TypeError: Cannot set property clientCapabilities ... which has only a getter`, so the RPC answered `runtime_error` and the set was never stored. The consequence is not subtle: `supportsStructuredAgentSessions` requires the capability, so `projectSessionTabAgentStatus` removed every `agent-session` tab from a phone that had advertised it correctly. A paired phone saw ZERO tabs on a worktree whose only tab was a structured Codex chat — structured native chat was unreachable on mobile over this transport, not just missing its new turn UI. Give the socket a setter that writes through to the channel, which already owns the set for the connection's lifetime, so later requests on the same socket see it. Found while trying to capture emulator screenshots of the turn-status port: two full QA runs reported the new UI "missing" because the phone could only ever get a bridge/PTY tab. * fix(mobile): carry the turn key instead of caching a handler in a ref Builds on the scope-isolation fix: that kept (and extended) a ref that is written during render — once to memoize a per-turn handler, once to prune dead turns, once to reset on a scope change. React Doctor's "Ref mutated during render" is what CI's `check:react-doctor:changed` was failing on (x2), and on mobile it is a real hazard rather than a style note: react-freeze discards renders, and a discarded render would leave the cache mutated. Pass the settled turn's key down the row instead and let it call one stable handler with it. That preserves both properties the cache was bought for — per scope isolation, and identity stability so a streaming transcript does not defeat the row's memo — with no ref writes and no pruning to get wrong. The scope-keyed expanded set and the 128-turn cap are untouched; their tests move to the new contract and one now pins handler identity across a re-render. Note for future changes here: `check:code-quality:changed` does NOT cover this. CI additionally runs the standalone react-doctor CLI, which has rules the oxlint plugin config does not enable. * fix: ship native chat status translations * test(native-chat): pin the shared copy against the English catalog The shared constants are desktop's i18n fallback and mobile's actually-rendered string. If one changes without the other, desktop keeps rendering en.json while mobile renders the constant — and nothing fails, because a fallback is only used when the key is missing. That silent divergence is the exact thing the shared module exists to prevent, and it is now reachable precisely because these strings are runtime-required rather than statically extracted. Assert every key in both shared copy objects matches en.json byte for byte, plus the interpolation placeholders the catalog interpolates on. --------- Co-authored-by: Merge Sim <sim@local>	2026-09-04 23:31:39 -07:00
Neil	6c765d5ad3	refactor(mobile): remove native chat re-export facades (#13436)	2026-08-09 19:25:28 -07:00
Neil	c56ff58dd7	test(mobile): centralize renderer setup (#13408)	2026-08-09 18:31:00 -07:00
Brennan Benson	c511e51442	fix(mobile): label native-chat tool rows with a clean, expandable input summary (STA-3333) (#12498) ... * fix(mobile): label tool rows with a clean summary, expand full input (STA-3333) Mobile tool rows showed the raw input JSON (`{"file_path":…}`) as the row label, and the expanded detail just repeated that same truncated string. - `describeToolInput` labels a row with the target file path, else the primary argument (command/cmd/query/pattern/url/description), else the bounded JSON preview. - Codex delivers tool arguments as a JSON string; normalize those into the object shape the helpers already understand, so labels, file links, run summaries and the expanded detail all work for Codex calls too. - The expanded detail now renders the fully formatted input, capped at MAX_TOOL_RESULT_CHARS like desktop's tool detail (and like the result body), and a structured input makes the row expandable. * fix(mobile): name search rows by their term and keep the filename in path labels (STA-3333) Review follow-ups to the tool-row summary, all in the shared helper: - A Grep/Glob row labelled itself with the directory it scanned and dropped the pattern entirely, because `toolFilePath` treats `path` as a file target. That path is a scan root, so it also rendered a tap-to-open link that asked the app to open a folder. `toolFilePath` now ignores the generic `path` key for search-shaped input, which lets the pattern win the label and drops the bogus link; an explicit `file_path` still wins. - An overlong path was truncated from the head, cutting off the basename — the one part that tells two rows apart. Trim from the front instead, so the label reads `…/session/MobileNativeChatMessage.tsx`. - The primary-argument chain used `??`, so a present-but-blank key selected itself and swallowed the keys ranked after it, dropping the label all the way back to raw JSON. Take the first key that actually yields a label. Refs STA-3333. * fix(mobile): don't offer an expander whose detail repeats the row (STA-3333) An empty tool input formats back to the row label verbatim, so `{}` and `[]` advertised an expander and then re-showed the label — the same repeat-the-JSON problem this change set out to remove. Gate `isStructuredToolInput` on the collection actually having contents; the lazy detail path is untouched. Also pins the overlong-path test to the path itself: asserting only length<=80 plus a `…` passed just as well with path labelling deleted. * fix(mobile): gate the tool detail panel on having detail (STA-3333) The Tools toggle opens every row at once, bypassing the row's tap guard, so a row with nothing to expand rendered its own label again underneath itself — and the tap that would dismiss it is a no-op. Matches desktop. * fix(mobile): keep a blank tool argument out of the run header (STA-3333) Skipping a present-but-blank primary key let `briefToolArg` fall through to the raw JSON preview, so a run header read `Bash {"command":""}` where it used to read `Bash`. Also state the search-path trade-off honestly: suppressing the link costs a file-scoped search its tap target. * fix(mobile): only treat a blank primary key as a missing argument (STA-3333) The previous guard tested key presence, so a populated but non-string argument — a mixed argv like ['kill','-9',pid], or a structured query — dropped out of the run header instead of falling back to the preview. * test(mobile): pin the tool-row chevron to the detail panel (STA-3333) The panel gate was covered but the chevron beside it was not: swapping `showDetail` back to `expanded` on the icon alone left all 909 mobile tests green, so the affordance lie this branch fixes could return unnoticed — a down-chevron over no panel, on a row whose tap is guarded off. Asserts both icon counts on the fixture that test already renders. The two halves now die for distinct reasons: the panel gate on the duplicate label text, the chevron on the icon count. * test(shared): pin the blank-search-key guard in the tool label (STA-3333) Dropping `.trim()` from summarizePrimaryToolArg left all 32 tests green, yet it leaks through isSearchToolInput: a whitespace-only `query` starts counting as a search term, which suppresses `path`. One character takes the row's label, its tap-to-open link and its run-header argument at once, and puts the raw JSON label back — the bug this branch removes. Asserts all three outputs on that shape. Kills only that mutant; the isSearchToolInput mutant still dies on the existing search test. * fix(native-chat): share tool input display semantics (STA-3333) Build the tool row label, file target, detail eligibility and bounded detail from one normalized input model. Mobile no longer reparses JSON-string input across independent helpers or repeats an already-complete plain label, and desktop now uses the same clean row summary instead of retaining raw JSON.\n\nKeep full detail formatting lazy for collapsed rows and share the 4000-character detail cap across both renderers. Tests pin desktop adoption, mobile disclosure parity, one-pass JSON parsing and the shared bound.	2026-08-04 19:34:59 -07:00
NeilandJinjing	9500ca7a65	fix(mobile): show attached images in native (rich) chat (#10135) ... * fix(mobile): show attached images in native (rich) chat Attaching an image in the mobile native chat did nothing visible — it reused the terminal attach flow, which pastes a bracketed host path into the hidden terminal, so there was no composer preview and nothing in the transcript. Give native chat the desktop model instead: - pick + upload shows a removable thumbnail chip in the composer (no early paste) - on submit, images ride along: Ctrl+U clear -> bracketed paste(s) -> settle -> text + Enter (idempotent on retry) - the optimistic echo carries the local preview URIs and the message renderer draws image-ref blocks as real thumbnails when the URI is loadable, so the sent photo appears in the conversation immediately - image-only echoes reconcile by ordinal against user turns after their tail (ignores agent replies / paginated history / the 'unknown' ack-loss path) Terminal chat attach is unchanged (both flows consolidated behind useMobileSessionImageAttachments). Adds unit coverage for pick+upload, the ride-along byte order, chip render/remove, and echo reconciliation. * test(mobile): interactive native-chat image proof (real hooks, click-driven) Replace the hand-fed component render with an interactive harness that mounts the real MobileNativeChatComposer/Message + useMobileNativeChatImageAttachments + drafts under react-native-web and drives the actual flow via clicks. Only the two OS boundaries are faked: the photo picker and the paired-host RPC socket. Screenshots (mobile/docs/native-chat-image-attachment/) are produced by real clicks, not props: - attach -> real upload pipeline -> chip appears, nothing pasted yet - send -> real ride-along emits Ctrl+U clear, bracketed image paste, text+Enter (shown in the live byte trace) and the sent bubble renders the photo thumbnail * fix(mobile): scope native-chat image attachments by active tab Images are now scoped to the tab that initiated the pick, so switching tabs during upload cannot ride an image into another terminal. Chips stay with their original tab, and only the active scope's images send with text. Improved error handling with user-facing toast messages for disconnection and send failures. * test(mobile): add image attachment tab-scoping and error tests Add comprehensive test coverage for tab-scoped attachment behavior, error handling when transport fails or lease is gated, and edge cases like attaching images during an in-flight send. Extract baseArgs and update helpers to reduce boilerplate across test cases. * fix(mobile): show attached images in native rich chat Images attached in the mobile native (rich) chat now display as: - Removable composer chips while composing - Thumbnails in the sent user bubble after sending (desktop parity) Implements proper image echo reconciliation by distinguishing image-source marker turns from text echoes, so an image send isn't cleared by an unrelated text echo. Adds scope isolation to prevent chips and drafts from leaking between tabs, and detects tab switches during the image-paste settle window to abort the send. Fixes Android tap-target positioning for the image removal badge and clears stale terminal input after failed pastes to avoid gluing fragments onto the next message. * rm stubs --------- Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>	2026-07-23 13:25:50 -07:00