* fix(editor): keep every view of a shared record on its text; ask before a lossy UTF-8 save
- A clean record's draft may reach a view's live model. Views of a record share one draft, so a
commit that reads clean (a rich-mode undo that differs from disk only in trailing whitespace)
is the record's text; refusing it left the source view showing undone text, and typing there
resurrected it.
- A rich view applies another view's text (or a reload) without an undo step, so its Cmd+Z no
longer reverts the source view's typing or re-applies text undone there.
- An outside change to a path (Source Control discard, watcher) now reaches views of the same
record in other workspaces' panels, not only the named workspace's, so their cached copy of the
discarded text is dropped and reloaded.
- Explicit saves send the lossless-UTF-8 precondition. A non-UTF-8 file asks for confirmation
(Save as UTF-8, destructive) before replacing characters that aren't valid UTF-8; declining
leaves the bytes alone. The autosave-paused notice no longer promises a lossless conversion.
- Dev builds resolve worker-thread entries from the main output folder when the caller was bundled
into a shared chunk (packaged builds resolve from resources and are unchanged).
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(editor): say why save-and-close refused a non-UTF-8 file
---------
Co-authored-by: Claude <noreply@anthropic.com>
* Autosave relies on the guarded write instead of pausing restored or moved tabs
Delete the pendingDiskBaselineVerification and pendingLiveDiskVerification
pause flags. Every editor save is already a guarded write; a refusal raises
the changed-on-disk banner, which is what stops autosave until an explicit
save.
A guarded write now succeeds when disk changed but already holds exactly the
text being saved (local/host compare is byte-exact; client-side fallbacks
compare decoded text and refuse when it holds U+FFFD), so a restored draft
that matches disk goes clean instead of showing a banner.
The restore scan only raises the banner early for tabs that arrive dirty; a
watch resync no longer re-checks dirty tabs.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(editor): skip guarded saves when disk is already identical
Return a compatible optional no-op result from hosts and client fallbacks, clean the tab, and clear its provisional self-write stamp without rewriting identical bytes.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(editor): refuse lossy automatic saves, keep identical-skip on older hosts, flag dirty tabs on resync
- Autosave and pre-restart saves refuse when disk text can't be decoded losslessly, so a
baseline that decoded to U+FFFD can't authorize overwriting different bytes.
- New files.write.identical-noop.v1 capability; for hosts with only the v1 guarded write the
client compares first, skips identical saves, then delegates to the host's guarded write.
- Watch resync compares dirty tabs against disk and shows the changed-on-disk banner.
- Local guarded writes check for identical content before the write-only regular-file probe.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(editor): tell non-UTF-8 files apart from disk changes, and quiet false resync banners
- Local guarded writes judge losslessness by bytes, so a valid UTF-8 file containing U+FFFD
autosaves again. A file that really isn't UTF-8 is refused with its own reason, 'not-utf8'
(older clients read it as 'changed'), which pauses autosave for that file with one notice
until an explicit save converts it.
- A watch resync whose disk read fails leaves dirty tabs alone; the guarded save still catches
a real conflict.
- Resync and restored-tab checks treat disk holding the tab's own just-written save as an echo.
- On hosts with only the v1 guarded write, only automatic saves read the file first; explicit
saves go straight to the host's guard.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(editor): lift the non-UTF-8 autosave pause when its edits end, and report disk changes first
- The pause is released once no dirty tab of the file remains (close, reload from disk,
discard), so a reopened or reloaded file's next autosave asks the host again and notifies.
- Client-side precondition checks compare the signature before looking for U+FFFD, so an
external rewrite shows the changed-on-disk banner rather than the non-UTF-8 notice.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* feat(files): guarded file writes that refuse to overwrite a changed file
Adds an optional disk precondition to file writes: the writer compares the file
on disk with an expected signature inside the write, serialized per file (path
then inode), and refuses with a typed changed/missing result instead of writing.
Remote hosts serve it as files.writeIfUnchanged behind a capability; older
hosts get a client-side compare that fails closed, pinned to the probed runtime
and connection. Undo of a delete and the MCP starter config use it to write only
into a missing or identical file. Groundwork for guarding editor saves.
* fix(files): pin guarded writes on the sending socket; keep refused undo; narrow not-found and pinning
* fix(files): pin a guarded save to one pairing; keep only refused undo steps
* fix(files): ENOENT by code only; resolve symlink chains fully; pin lost-reply recovery to the save's pairing
NeilandClaude