Move-only: the backoff timer, ladder and wake/network-return redial move into
SshConnectionReconnector, and exec/shell/sftp/system-command channel opening into
ssh-connection-session-channels, both reading the connection through host getters.
* refactor(ssh): remove the dead SSH filesystem provider and desktop SSH file watcher
Nothing in production has registered an SSH filesystem provider since the
relay removal (#27214/#27215), so every getSshFilesystemProvider read
returned undefined. Delete the provider table and the remote watcher
subsystem, and collapse the call sites to that always-undefined behaviour:
fs:watchWorktree/fs:unwatchWorktree ignore SSH roots, the worktree base
watcher only resolves local repos, and worktree removal skips the desktop
watcher for SSH paths.
* test: drop the nested SSH watcher catalog case that can no longer occur
The base-directory watcher never carries a connection id now, so the
host-blind-event guard it exercised is gone. Also prune the deleted remote
watcher suites from the shard timings and the nested-SSH wording from the
worktree catalog reliability gate.
* feat(terminal): the window's store shows main's pane start status (layout-owner build)
A status-only frame changes one store entry and no pane tree, so the pane's view stays mounted.
* refactor(terminal): keep the frame sync within its line budget
* feat(terminal): every pane main starts shows 'starting' from before it is written (layout-owner build)
* feat(terminal): a pane main is starting waits and attaches; a failed start shows why (layout-owner build)
Fixes owner-visible row 15: a failed agent or setup start no longer opens a plain shell.
* test(terminal): iterate store listeners directly
* fix(terminal): an exit that reports no code keeps its pane, as lost contact (layout-owner build)
* test(terminal): a pane main started attaches to main's terminal at its own grid
* test(terminal): detach census tests assert main's move and frame with the switch on
* fix(terminal): a restored pane paints history only from its terminal's host, never the window's copy (layout-owner build only)
* fix(terminal): main releases a painted cold restore only for the pane's current terminal (layout-owner build only)
* test(terminal): typed ack args in the painted cold-restore test
* test(terminal): exited-pane tests assert main's close with the switch on
These 8 have failed switch-on since #31130 moved the exit close to main.
* feat(layout): main starts the panes a client's startPane or wake names, through its one restored-pane starter (layout-owner build only)
The model's start and stop effects reach the runtime once the command is written, never the
reply. startPane starts a pane whose binding has a start status, and a slept pane from its record.
A wake keeps a pane's resume record until its start binds; a failed start keeps it and shows why.
With the switch on, main owns a running agent's wake even with a window open.
* fix(layout): a window's wake of a pane it resumed itself is record-only, so main does not start it again (layout-owner build only)
* test(layout): a client's startPane starts the pane before any other trigger
* Revert "fix(terminal): a restored pane paints history only from its terminal's host, never the window's copy (layout-owner build only)"
This reverts commit a646d89b26.
* test(terminal): the cold-restore repaint ack names its pane in the layout-owner build
* fix(layout): a wake keeps the pane's resume record in the pane-owned form, so a host crash resumes the agent again (layout-owner build only)
* test(layout): a failing start in the pane-start runner test throws
* feat(terminal): main writes and starts every split of a pane it holds; the window attaches (layout-owner build)
The window's split, a startup split with its command, and a CLI split all go through main's
terminal.split; main's frame mounts the pane, with or without a window intent. Deletes the
window's split wait and withdraw, the split appear intents, and the queued-split skip and cancel.
The e2e helper uses the real split. A startup split leaves focus on its source pane.
* fix(terminal): the attach-only wait leaves sleeping, resuming and held panes to their restore path
* fix(terminal): a split pane attaches to the terminal main bound it to; a taken pane id is refused
Also restores the proof that a split closed while it starts gets one answer and leaves no
pane or start status behind.
* Reapply "fix(terminal): a restored pane paints history only from its terminal's host, never the window's copy (layout-owner build only)"
This reverts commit 420e605ad0.
* fix(layout): a trigger between a restored pane's start and its bind write joins that start, not a second one (layout-owner build only)
* fix(terminal): a window split main cannot start still shows its pane, failed, with why
* fix(terminal): keep the switch import the D1b-1 merge dropped from the layout restore
* feat(layout): main's starter shows a restored pane starting before any await, and a failed start with its reason; startPane starts a pane whose bound terminal ended (layout-owner build only)
* feat(terminal): a window's attach-only view of a pane attaches to its terminal or starts nothing, keeping the binding for main's start (layout-owner build only)
* feat(terminal): a restored pane with no live terminal asks main to start it and attaches once main binds it; the window's wake, hibernated wake, restart-on-show and gone-terminal fallbacks route through main (layout-owner build only)
* fix(terminal): check a taken pane id first, keep the start's own error, clear a gone pane's status
Three test stores gain the pane-start field the window's store always has.
* test(terminal): the admission stub answers whether its pane is still written; a closed pane's failed start clears
* test(terminal): with the switch on, the window's restores, wakes and restart replacements ask main to start the pane and attach to the terminal main binds, starting and resuming nothing themselves
* refactor(terminal): the rebound workspaces' bindings show through one call in the bindings module
* fix(terminal): a held pane connects as today so main's refusal holds it; main's start follows output; a capacity death after main's resume keeps the resume (layout-owner build only)
* fix(layout): main passes its start options only for commands that start panes; a windowed open resumes the agent under main (layout-owner build only)
* refactor(terminal): break the pane start module cycle; typed test fixtures
* test(terminal): a pane main wrote and the user closed mid-start drops its failed status
* fix(terminal): every waiter on main's start runs, a failed or refused start settles and is asked again on the next view, a hidden gone pane waits for its view, a twin main hands back stays on today's path, and lost contact never starts a pane (layout-owner build only)
* test(terminal): iterate the store listeners directly
* test(terminal): a cold-restore paint applies no window resume with the switch on
* fix(terminal): a split main starts is listed to phones and session.tabs without a window's report
* test(terminal): name the main pane start test helper as a fixture
* fix(terminal): a reconnect shows its pane starting and why it failed; a lost owner race shows no failure; a split no one asked to see keeps the phones' tab
* fix(terminal): a kept create another owner won shows no failure; the window attaches to the winner
* fix(terminal): a pane main starts at relaunch keeps its full history and starts before the window's graph lists its tab (layout-owner build only)
* feat(terminal): main replaces the empty shell a hibernated agent left and resumes the agent when a view asks; a start main could not attach shows main's own terminal_not_started (layout-owner build only)
* test(terminal): main seeds its copy of a restored pane even when a window declared one, with the switch on
* fix(terminal): a pane main started hidden paints once when its view attaches (switch-on builds only)
The view's attach snapshot, taken after main unmarks the hidden gate, already holds the bytes main
dropped, so the reveal no longer asks a second restore from main's buffer.
* refactor(terminal): main's pane start reads the pane from its own layout, not the client projection (switch-on builds only)
* fix(terminal): a pane restart stops its terminal before writing the pane unbound, so a stop that fails keeps the pane (switch-on builds only)
* test(terminal): a start main could not bind shows terminal_not_started through the window's wait, from one copy site (switch-on builds only)
* fix(terminal): main's pane start resumes an agent recorded under the pane's number, as the window did; stale switch-on tests show main's start and the known banner loss (switch-on builds only)
* fix(terminal): review round: a visible view alone retires main's hidden-start drops, by episode; main reads a split pane's numbered record by its number; the window keeps a shell main kept (switch-on builds only)
* fix(terminal): main's start of a pane a window view is attaching to leaves it visible, so the view paints once (switch-on builds only)
* fix(terminal): a window view that attaches while main starts its pane takes main's start, with no second provider attach (switch-on builds only)
* fix(terminal): review round: a view takes main's start only when it carries a payload and still owns its terminal; attaching views are counted, keep main's pre-spawn mark off, and a failed attach hides only what it kept visible (switch-on builds only)
* test(terminal): checked test doubles in the view-join and numbered-record tests; reattach options fit the file budget
* test(e2e): with the switch on, the mount-authority spec keeps the window's bindings, which only main's frames write
Claude-Session: W5b
* test(e2e): the mount-authority spec fits its line budget; the layout-owner build check is one helper
Claude-Session: W5b
* test(layout): an unbound pane holding a resume record starts and keeps the record, since main's start resumes from it
Claude-Session: W5b
* fix(terminal): a pane main resumed holds a running agent's record, so it reads awake, not sleeping (switch-on builds only)
Claude-Session: W5b
* fix(terminal): in a split where no pane owns a numbered record, main resumes the tab's one conversation in pane 1 only (switch-on builds only)
Claude-Session: W5b
* fix(terminal): main marks only the record a resume started from live, never a sleep captured after it (switch-on builds only)
Claude-Session: W5b
* test(terminal): with the switch on, a windowless resume leaves the pane's record a running agent's
Claude-Session: W5b
* test(terminal): the resumed-record test double typechecks
Claude-Session: W5b
* refactor(terminal): with the switch off, main's pane start reads no resume record for the live mark
Claude-Session: W5b
* fix(terminal): main publishes whether its start of a pane resumed the agent, for the window's banner (switch-on builds only)
Claude-Session: W5b
* fix(terminal): a pane main started shows its "session restored" or "resume unavailable" banner again (switch-on builds only)
Claude-Session: W5b
* test(terminal): the resume-banner store double carries no type assertion
Claude-Session: W5b
* fix(terminal): main records a resume outcome only when its start wakes the pane's own sleeping record, and each new start clears the old one (switch-on builds only)
Claude-Session: W5b
* fix(terminal): a renderer reload shows no resume banner again for a pane main started, and the window stops waiting once that pane holds another terminal (switch-on builds only)
Claude-Session: W5b
* refactor(terminal): the merged files fit their line budget: the folder-fallback notice and a hidden pane's wait for its first view are helpers, and the answering-transport lookup moves to its one test caller
Claude-Session: W5b
* fix(terminal): main's resume outcome arrives in the same frame as the terminal it names, a same-id respawn included (switch-on builds only)
Claude-Session: W5b
* fix(terminal): the reopened-terminals toast counts agent sessions main resumed again (switch-on builds only)
Claude-Session: W5b
* refactor(terminal): the attach's resume check names the window's resume type
Claude-Session: W5b
* test(terminal): pin the resume outcome's wire contract: an outcome alone rebinds nothing, it shows once per start, and no saved session holds it
Claude-Session: W5b
* refactor(runtime): the window's layout apply fits the runtime's line budget after the main merge
Claude-Session: W5b
* test(terminal): any create through main that wakes a pane's record publishes its outcome, and the sidebar resume keeps its restored banner (switch-on builds)
Claude-Session: W5b
* refactor(runtime): the layout stream takes main's pane facts from one source, keeping the runtime in its line budget
Claude-Session: W5b
* fix(terminal): a relaunch resume into a pane kept under its saved terminal id shows its banner again, and a start whose bind fails leaves no outcome (switch-on builds only)
Claude-Session: W5b
* fix(terminal): the reopen toast counts only a resume main made for the attached terminal since the attach began, and the banner reads main's outcome once at attach (switch-on builds only)
Claude-Session: W5b
* test(terminal): two pane test stores carry main's resume outcomes, which every attach now reads
Claude-Session: W5b
* test(terminal): the hidden-output repro's test store carries main's resume outcomes
Claude-Session: W5b
* fix(terminal): an SSH same-id resume whose bind writes nothing new keeps its banner, and a start that lost its pane leaves the winner's outcome (switch-on builds only)
Claude-Session: W5b
* refactor(native-chat): share the catch-up open runner across agents
The Codex catch-up's agent-neutral parts move to one module: the open-time
envelope (its own deadline and cancellation, never gating the open), the
bounded staged batch, the single settlement commit that re-checks the
journal before writing, and the "Continued outside this chat." divider.
Codex keeps only how it reads its saved turns and what the chat already
holds. No behavior change; the other agents' catch-up builds on this
instead of copying it.
* chore: remove unrelated pnpm executable metadata
* refactor(native-chat): the catch-up runner reads the chat's view only when the agent asks
* chore: remove regenerated pnpm executable metadata
* fix(native-chat): the catch-up deadline also bounds waiting for its commit to be written
A journal write barrier that never settled after the import was admitted held
the provider's open past the catch-up deadline. The wait now ends with the
deadline or the open's cancellation, like every other step.
* test: type the history catch-up sink fixture without assertions
* fix(native-chat): bound and revoke history preparation
* feat(native-chat): validate expected saved items during history catch-up
* fix(session-history): freeze scan workload before checking candidates
* test(session-history): handle native fixture path separators
* test(session-history): control bucket fixture enumeration order
* test(session-history): preserve scoped fixture timestamps
* fix(session-history): repair integrated test and locale catalog
* ci: refresh history checks against current main
* ci: refresh history checks after catalog repair
A Claude approval card cancelled while the chat journal was briefly full
waited for a later provider event to retry the cancellation, so an idle
session could leave the card open. The sink's drain wake now retries owed
prompt cancellations alongside owed background-task rows, and reading
still waits for the next drain if the retry fills the sink again.
Tracked in STA-7630.
* fix(native-chat): show a prompt hook's block as its own row for every agent
When a prompt hook refused a message, Codex showed nothing, Claude showed
an unmarked warning the turn fold could hide (with a copy of the prompt),
and Grok read as the user stopping the turn.
Each adapter now writes one warning row, "Blocked by hook: <reason>" or
"Hook stopped: <reason>", marked with the hook-outcome presentation that
the turn fold never hides:
- Codex: a blocked or stopped UserPromptSubmit hook/completed frame
- Claude: a warning informational frame that halts the prompt, worded from
its structured prompt_submit_outcome when present
- Grok: a HookDenied end, from either completion signal under one row
identity; the turn ends completed instead of interrupted
Nothing new is saved and nothing changes on the wire beyond the new
presentation value.
* fix(native-chat): end a hook-denied Grok turn on its first signal, and clean older Claude block wording
Follow-ups from the size review of the hook-row change:
- Grok: a hook-denied turn_completed now ends the turn and writes the row
straight away, instead of waiting for the prompt's answer; a later answer
changes nothing.
- Claude: when an older Claude sends only its sentence, the row keeps the
hook's reason and drops the hook path and the copy of the prompt. Whether
the row shows still depends only on prevent_continuation.
- The turn-ending shape is declared once, the Codex hook payload is read
once, and the Codex hook row returns early instead of threading through
the generic frame row.
* test(native-chat): cover hook-block rows with real Grok frames and a preserved send
- Replace the source-derived Grok fixture with frames captured from Grok
1.0.62 (session, prompt ids renamed to the test's).
- One whole-flow file, three parameterized cases (Codex, Claude current and
older wording, Grok in every completion order), on the shared timeline
rig with a per-agent journal identity.
- Each case starts with a send on record and checks it is unchanged after
the reopen.
* fix(native-chat): word every Claude prompt-hook refusal, and draw the Codex hook row like the others
- Claude: a plugin module's dropped_by_hook / not_passed_on refusal reads "Blocked by hook" too.
- Older Claude sentence: an empty reason no longer turns the prompt copy into the reason; each hook's
path label goes per line, while a hook's own [TAG]: stays.
- Codex: the prompt-hook row is read once, before classification, and carries no raw-frame
disclosure, so it matches the Claude and Grok rows. The hook/completed table entry is back to main's.
- Comments the change had made wrong are corrected.
* fix(native-chat): strip only the older Claude sentence's first hook label, as before
Command labels without a slash were kept and labels inside a hook's own text were removed; the
first-line strip is back, with the empty-reason fix kept.
* refactor(native-chat): keep a hook's block row visible as a generic turn notice
The fold never hides a row presented as 'turn-notice', a host notice about the turn, instead of
a hook-specific value; the hook rows write it for every agent.
* fix(native-chat): report a Claude prompt hook's exit-2 block once
With hook events on, Claude also sends the blocking UserPromptSubmit hook's exit 2 as an error
hook_response; that is the block itself, already shown by the halting warning, so it writes no
red hook-failed row. Other hook events and exit codes are unchanged.
* docs(native-chat): say a prompt hook's exit 2 may also be a missing plugin script
* test(native-chat): type the Claude hook-outcome frame as a record
* fix(native-chat): keep a blocked Codex prompt's turn on its own message
Codex never echoes a prompt its hook refused, so its turn was anchored on the send only while
the send read in flight. Once the turn ended the host publishes the send as in doubt, the anchor
fell back to the turn record, and the block row moved to a second turn: live, the chat drew two
"Worked for" bars; after a reopen the bar sat on the row instead of the message. A send in doubt
now keeps anchoring the turn it opened (the first send in flight, else the newest in doubt).
* fix(native-chat): keep refused Codex hook notices outside turns
* revert(native-chat): keep Claude's exit-2 prompt hook_response as main's red row
A missing plugin script also reports exit 2 without blocking, so suppressing it hid a real failure main shows. With a user-added --include-hook-events an exit-2 block shows both rows (known limit).
* Layout groundwork (switched off): main derives agent tab titles from its own hook status
With the layout-owner switch on, main gives agent tabs their generated titles from
the hook-server status it owns, on the desktop, headless serve and orcad: one
renameTabs per status batch, so one write and one frame. It keeps the window's
rules (setting, custom and quick-command titles, first title wins, dispatch labels).
The window stops sending generated titles for tabs main holds; a paired server's
tab, or one main has no tab-bar entry for, is still titled by the window as today.
The title rules move to src/shared (agent-row-primary-text, and the new
agent-generated-tab-title-rules) so both sides share them; switch-off behaviour
is unchanged.
* feat(layout): main applies a phone's or paired client's tab move itself, and a tab move names the tab it follows so a stale index can't misplace it (layout-owner build, L193)
* fix(layout): a move in a group showing a tab main lacks goes the window's way, a twin's agent tab keeps its window title, and orcad subscribes titles through the store attach (layout-owner build)
* chore(layout): main's tab move reaches the old-client translation through its compat entry
* chore(layout): mark the window-only-row move fallback as bridge code (ledger L280)
* test(layout): attaching the hook store follows its rows for main's tab titles once
* chore(layout): the old-client move translation is a compat entry of its own, with no cyclic re-export
* test(config): the boundary message test names the old-client folder's configured entries
* fix(wsl-host): pair again from the distro when a WSL host refuses the enrolled token
A WSL host that lost its device registry, or revoked this desktop, refused the
enrolled token forever, and an update over it read as deferred. The connect now
re-pairs through the managed repair gate SSH uses (one repair at a time, a
capped number per window, only an offer under the pinned host key), reading the
host's published offer from the distro. The incumbent's terminal count uses the
same enrolled-or-live pairing the connect does.
* fix(wsl-host): retire a bridge whose pairing was refused, and let a user's Connect retry a repair
A refused or repaired-then-refused pairing on a reused bridge left its stale
token cached, and the failure status then saved it over the repair. That bridge
now closes first. A user-initiated Connect clears a standing repair failure or a
spent cap, as an explicit SSH connect does.
* fix(wsl-host): retire a refused bridge without cancelling a queued Update or Force
* fix(wsl-host): repair only a stored pairing, dispose the repair's transport directly, and log refusals neutrally
A host still being added has no stored record for the gate to re-pair, so its
live bridge is reused as before. The WSL repair deps are typed with the WSL
transport, and the shared refusal log no longer says SSH for WSL.
* fix(ssh): point unclearable move conflicts at plain SSH, and polish the plain SSH window
Conflicts retrying can't clear now say how to keep working on the host. The
plain SSH terminal paints its theme background past the grid, and a failed
open shows only its error, not an empty terminal.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(ssh): say what plain SSH is for beside its button, not in main's refusal text
Main's refusal text also reaches clients without a plain SSH terminal, so the
next step is shown next to the button wherever it renders. Also: a translucent
theme isn't painted twice, and a failed open shrinks to its error.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(ssh): treat only opacity below 1 as a translucent plain SSH background
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Preserve deliberate terminal taps after scrolling and keep them ordered with Live input. Retain fresh keyless edits, cap coalesced sends at the existing UTF-8 request limit, and settle cancelled flush barriers without waiting for retired acknowledgements.
Adapted from @innocarpe's community PR #30514, with additional ordering, lifecycle and bounded-send regressions.
Fixes#30510
Co-authored-by: Wooseong Kim <innocarpe@gmail.com>
* Polish explorer search layout and filter disclosure
* Use compact search details disclosure and lowercase filter labels
* fix: preserve query focus when switching explorer modes
* fix: announce active explorer search filter counts
Neil
Jinwoo Hong
Brennan Benson
Jinjing