A managed SSH or paired-server workspace has no SSH connection id, so the
notebook read it as local and ran its cells in the desktop's own Python
against a same-named local file. Derive the execution host from resolveOwner;
refuse remote, ambiguous and unloaded owners.
* feat(layout): main drops the layout of workspaces the catalog no longer validates (dark, layout-owner build only)
* rename the paired-host check so the switch-off bundle keeps its names
* a repo id two hosts register skips the listing purge
The chat, simulator, and browser tab recorders each computed where the window
drew a just-opened tab with the same lines. They now share drawnTabPlacement.
* feat(sidebar): main produces the local workspace rows, checked against the window (dark)
* fix(sidebar): workspace rows invalidate the listing only on metadata saves; prove it on the real cache
* fix(sidebar): workspace rows merge the listing fresh instead of invalidating the shared cache
* chore(sidebar): workspace rows comments say what the fresh merge reads
Sessions saved before #29930 can hold a moved editor tab whose
worktree id still names the workspace it came from. Pin that the
saver writes the workspace's own id and that the window's tab carries
it after main's first snapshot. Tests only.
* fix(tasks): bound GitLab all-projects fan-out to avoid runtime queue overflow
The GitLab Tasks list started one listIssues/listMRs runtime RPC per selected repo at once. With 150+ projects this, combined with other callers on the same selector, overflowed the runtime RPC call queue and surfaced "Remote runtime call queue is full".
Fetch per-repo lists through mapSettledWithConcurrency with a limit of 6 (below the queue's foreground concurrency of 8), and stop starting new calls once the selection goes stale.
Fixes#30133
* test(tasks): assert merged GitLab rows without a type assertion
---------
Co-authored-by: Neil <neil@stably.ai>
* fix(sidebar): main takes its row baseline from the session's catalog and skips unchanged listings
* fix(sidebar): read catalog listings the way the window's merge does
* fix(sidebar): a seeding listing re-samples, and listings compare with the window's equality
* refactor(shared): move the pane title sanitizer to shared, unchanged
So main's layout Loader can apply the same rule the window applies on load.
* fix(layout): pane titles stay layout in a layout-owner build (dark)
The window stops writing a revealed terminal's tab name as its pane title,
and main's Loader drops a lone pane title that only repeats the tab's name,
as the window's load does. Both behind ORCA_LAYOUT_OWNER_IS_MAIN.
* fix(layout): the Loader compares a lone pane title with the tab bar's quick command label too (dark)
As the window's row hydration does when the row has no label.
* fix(layout): the Loader compares a lone pane title with the tab bar label, the live title (dark)
* feat(sidebar): dark phone feed of the sidebar inputs (sidebarInputs.read)
* fix(sidebar): feed review: fresh read on ready, notices kept per revision, one flush owner, closed connections never subscribe
* fix(sidebar): feed skips values JSON cannot hold; a failed read forgets its notice
* fix(sidebar): name the feed batch key by where the batch starts from
* fix(ssh): a tab closed while a managed host is disconnected stays closed after Connect
#30130 made a user's Disconnect mark the host's managed server manually
disconnected, so the desktop now answers its calls itself with
runtime_manually_disconnected. The tab close path read that as the host's
answer and dropped the close instead of holding it for replay, so the tab
came back on reconnect. Treat it as an undelivered close, and route the
Disconnect sources to the managed-orcad Docker lane.
* test(e2e): close the disconnected host's tab the way a user does
The journey called the store's bare closeTab, which sends only terminal.close
and holds nothing; it passed only because the disconnected host used to be
redialed in the background, which #30130 stopped. Click the tab's X instead,
the path that holds and replays an undelivered close.
* test(e2e): the shared-home spec tells a host's own server from a PID that only collides
Each Docker host has its own PID namespace, so the PID host A records in the
login-home slot can belong to an unrelated live process on host B; kill -0
alone then read it as B running from A's slot. Count a recorded PID only when
its process runs from that slot.
* fix(serve): orca serve on orcad serves the browser client and answers plain HTTP
orcad, the default local orca serve host since the compatibility launcher,
was never handed the app's web client directory, so its HTTP server had no
request listener: every GET hung and no Web client URL was printed (#30100).
The CLI now passes the app's unpacked out/web to orcad via --web-client-root,
a server without a web client answers plain HTTP with 404 instead of hanging,
and packaging fails when the unpacked web client or a file it loads is missing.
* test(serve): pin orca serve handing orcad the app's web client root
* fix(layout-owner): a frame rebuild keeps a background terminal's live agent title (dark, layout-owner build only)
The frame slice builder reuses restore's row hydration, which resets any
agent-activity title because a prior session's agents have exited. A
title main reports live for a running pane is not stale, so rows keep it.
Co-Authored-By: Claude <noreply@anthropic.com>
* refactor(layout-owner): restore's row hydration skips the agent-title reset for live titles
Moves the live-title keep into the row hydration so the frame builder
adds no layout write of its own; restore passes nothing and is unchanged.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* Save-divergence detector: skip empty workspaces, see dropped tab-bar entries and kept pane trees (dark, layout-owner build only)
- A workspace key that names nothing (or only places a stored closed-tab record) is no longer
reported as "workspace added/removed" or "terminal row owner changed".
- A save that drops a terminal tab's tab-bar entry while keeping its row is reported, read from
the stored session before the Loader rebuilds the entry.
- A pane tree main keeps over the window's (windowSaveForMain) is reported, so a window-side
pane repair shows up.
* Detector: keep reporting empty-row flips, cover every overridden pane tree and one-sided closed tabs (dark, layout-owner build only)
* Detector: a save with no pane tree for a tab main keeps one for is reported too (dark, layout-owner build only)
* Detector: a closed tab record moved to another worktree in one save is reported (dark, layout-owner build only)
A user's Disconnect of an SSH host is now recorded for the session, and background
dials (a managed server's tunnel and status checks, census, host-resume recovery,
pane and automation restores) refuse it until an explicit Connect. Disconnecting a
managed host from Settings also stops its server's status checks, and the status
bar's Disconnect of a managed server also disconnects the SSH host it runs on, so
both surfaces read the same verdict.
Fixes#30086Fixes#30085
* fix(sidebar): draw a project group once when two hosts publish it under one id
Moving a project to a managed server copies its project group there under the same id while the desktop keeps its copy. The row builder emitted a header per copy, so the second sat empty and both shared one virtual-row key.
Fixes#30045
* fix(cmd-j): search a same-id project group by the copy the sidebar shows
* fix(sidebar): reveal a same-id project group through the copy the sidebar draws
* fix(sidebar): reveal a folder workspace through the group parents the sidebar draws
* fix(sidebar): reveal from the host-filtered groups the rows were built from
A project's group membership is stored on the project's own host, and that host stores a group id it does not hold as 'no group' while still returning the row. Moving a remote-only project into a local group (menu or drag) therefore looked successful, and could even take it out of its current group.
The store now refuses a move into a group that only exists in another host's catalog, and reports failure when the host answers with the group cleared.
Refs #13699
* fix(layout): main's Loader repairs a terminal bound in two panes of one tab (dark, layout-owner build only)
* fix(layout): a window save stores main's repaired pane tree, so the duplicate-terminal repair survives the save (dark)
* test(layout): the SSH duplicate-terminal case builds an SSH-hosted tab
* refactor(sidebar): move the Smart comparator and attention scoring to src/shared/sidebar-list
Main needs them to own the frozen order. Renderer helpers they depend on move with
them; the window imports the shared copies. No behaviour change.
* refactor(sidebar): one shared ranking for the frozen sort order
The window's sort memo and the palette's Smart sort now call rankWorktreesForSort,
so main can produce the same order from its own records. The pure state-history
step moves to shared for the same reason. No behaviour change.
* feat(sidebar): main keeps the list's time rules on one clock, checked against the window in dev and test
* test(sidebar): fake-clock parity of main's temporal owner against the window
* fix(sidebar): main restarts the settle window only where the window's sortEpoch bumps
* test(sidebar): type the owner harness without an assertion
* fix(sidebar): main's temporal owner stays idle until a dev or test window begins a session
* fix(sidebar): main reads Hide sleeping from the field the window persists
* refactor(sidebar): keep the begin params in their own contract module so the snapshot schema compiles out
* chore: restore files the merge's formatter rewrote to their origin/main content
On a headless orcad with no browser provider, every browser RPC went to a
rejecting proxy, including browser.tabClose. Client-hosted page records and
session rows are runtime records, so closing them never needed the engine;
the proxy now retires them, and orcad's provider proxy checks its own page
registry before asking a provider that never held the page.
Orphan recovery republished a pending host row as ready on the strength of the
client's retained wake binding alone, even when the host's terminal inventory
omitted the handle. The mirror then counted the dead handle as live, so a slept
workspace came back awake in the sidebar. A pending row now stays pending unless
the host's inventory lists its handle; the wake binding is still kept.
Fixes#30108
* feat(sidebar): main serves workspace icons as small data URLs for the phone, unused until the phone switch
* fix(sidebar): settle review findings in the icons RPC and the manual-redirect port fix
* docs(sidebar): scope the icon fetch-slot bound to a lone read
* fix(sidebar): gate the icons RPC behind the sidebar-inputs switch; prove re-encoding end to end
* fix(sidebar): restore two files the merge reformatted; one pure annotation for the icons params
* fix(sidebar): restore two files the pre-commit formatter rewrote during the merge
* fix(sidebar): icons fetch through their own manual-redirect request; shared desktop HTTP client back to main
* fix(sidebar): settle review findings in the icons manual-redirect request
* fix(sidebar): end a bodyless icon response at once; clearer fetchRepoIcon doc
* fix(native-chat): the queue button you pressed shows a working spinner while its action is on its way
* test: keep the pending Resume test's action typed
* fix: the shared spinner shows its still hourglass under reduced motion instead of nothing
* refactor(pty): one spawn step stamps a terminal's pane identity for both spawn lanes
The window spawn controller and the host runtime's caller each wrote
ORCA_PANE_KEY/ORCA_TAB_ID/ORCA_WORKTREE_ID and jcode's runtime dir, in
different layers, so per-pane env behavior drifted (the jcode daemon
pre-warm exists only on the window lane). stampPtySpawnPaneEnv now writes
them in both controllers from the spawn's own tab/leaf/worktree ids;
buildTerminalWorkspaceEnv no longer stamps them. No behavior change: a
TEMPORARY prewarmsJcodeOnDaemonHost input keeps host daemon spawns from
pre-warming until its own PR.
* test(runtime): read a fake spawn's pane env without type assertions
* test(pty): host serializer-settlement spawns name their pane by tab and leaf, as the runtime does
* fix(pty): preserve caller runtime directory after managed preparation fails
* feat(acp): an agent's chat starts wait out a change to its shared sign-in
A launch spec can carry a gate that refuses new chat starts while an operation
replaces or removes the sign-in all of that agent's chats share on this host,
and aborts starts already under way when one begins. Antigravity's row sets it.
The refusal reuses the accountSwitchInProgress reason, now worded for any agent.
* Drain ACP starts before stopping chats for account changes
* Forward gated aborts into ACP launch preparation
* fix(acp): the launch gate holds every chat child it admits until it exits, so an operation can't run beside a chat still starting
A start leaves the gate when its child is up, but the host only lists the chat as loaded once its
attach finishes. A sign-in switch (and later Remove) in that window found no start to abort and no
loaded chat to stop. The gate now keeps each admitted child until it exits, and an operation closes
and proves gone any it still holds after the loaded chats stopped; otherwise it fails without
running.
* refactor(native-chat): one helper for failure sentences that only name the agent
Keeps agent-session-failure-words.ts under its line limit now that main grew it; the five sentences
read the same.
* fix(acp): a conversation copy runs the agent too, so it waits out a sign-in change like a chat start
* feat(linear): edit and delete Linear comments from the CLI
Adds orca linear comment edit <commentId> and orca linear comment delete <commentId>
(alias rm). The comment id alone names the comment; Orca finds the connected workspace
that owns it unless --workspace is given. Both refresh a linked worktree's issue and
report unconfirmed writes with a read-back step. The orca-linear guide documents them.
* test(linear): use a checked linked worktree fixture
* fix(linear): bound and cancel comment actions
* fix(native-chat): a Codex chat is Working only while Codex holds the send
Working read 'a send still pending delivery', so any echo or idle signal
that never arrived (a hook-blocked prompt, an answer naming no turn, idle
before a timed-out send was written) kept the chat Working, Stop up, the
queue frozen and /compact refused until the agent exited.
Codex now reports which sends it still holds: unanswered, answered into a
turn that has not ended, or answered into none while a status read after
that answer says the thread runs. Replies and statuses are ordered as they
are read, so a stale status cannot release a newer send. The host reads
that set (plus the short window while it hands a send over) for Working,
publishes a send the child stopped holding as in doubt on every page and
frame so older clients agree, and republishes when the set changes with no
row. The Codex idle latch and its release are removed.
* fix(native-chat): name the handover journal type; reverse without mutating
* test(native-chat): a lost Codex answer while idle is no longer the chat's work; run the held-sends test with the database runtime
* fix(native-chat): bound work updates and own command handovers
* refactor(native-chat): reuse session delivery plumbing
* test(native-chat): allow separate ownership restatements
* test(wire): resolve the release tab predicate after relocation
* test(native-chat): reuse existing promise and empty-batch primitives
A steer Codex answered into a turn that then ended without taking it is
rejected and moved to the thread, so the sidebar verdict and the
completion feed treated it as a refused request of its own and reported
it in place of the turn it joined.
* feat(sidebar): ui.setCollapsed changes one section's collapse, ordered per writer
* fix(sidebar): ui.setCollapsed accepts ui.set's callers; require a fresh writer per counter
* feat(sidebar): register ui.setCollapsed only with ORCA_SIDEBAR_INPUTS=main
* test(sidebar): hidden-app check of ui.setCollapsed in both switch builds
* test(sidebar): off-census covers every gated method; e2e skips before launching
* test(sidebar): type the gated method-name set as strings
* test(sidebar): type the collapse test's dispatch context
* fix(terminal): resume a relaunched workspace's sleeping agents only when shown
After a relaunch every terminal tab of the opened workspace mounts, and each
pane's connect resumed its agent from the saved sleeping record whether or
not the pane was visible, so all of them restarted at once.
A hidden pane with a sleeping record now arms the same reveal wake a
hibernated pane uses and spawns nothing. A hidden local reattach first asks
the host whether the session is still alive; only an authoritative "exited"
holds it, and the reveal re-runs the same reattach. Held panes count as
owning their record so the activation sweep does not relaunch them. Targeted
background mounts (phone, CLI, orchestration) still start their tabs'
agents immediately, and the phone wake still wakes held panes.
* fix(terminal): keep a held resume through an exit its wake did not start
* feat(acp): open Antigravity in the Chat UI over its ACP server
With the experimental chat setting on, Antigravity chats run Google's
Antigravity ACP server, which Orca installs only when the person clicks
Install: a pinned 1.3.0 release whose archive and both executables are
verified by hash and size (macOS arm64/x64, Linux x64/arm64). A start
never downloads it.
Each host keeps one private sign-in folder for these chats under Orca's
data folder, made owner-only before every start; the server keeps its
sign-in there as a file. A chat signs in with the server's Google method
through the existing auth-required retry; with no saved sign-in the
server's sign-in prompt ends the chat signed out. The Agent Permissions
setting maps to the server's own mode, and a question the server asks
shows as a question that takes one of its choices, never auto-answered.
A chat reopens its session with session/resume.
* fix(acp): separate Antigravity chat command and require pinned host
* test(acp): assert Antigravity launch arguments across hosts
* feat(acp): Antigravity chats offer Ask, Accept edits and Full access per chat
Each mode maps to the server's own (default, auto_edit, yolo). No Approve for me:
the server has no automatic reviewer. Accept edits gets its own description,
since auto_edit approves file edit tools only.
* feat(acp): Antigravity installs from Settings and Accounts, and says its download size
The Antigravity chat server installs only when the person clicks Install. Besides
the chat's own Install card, Settings > Chat gains a Providers section and the
Antigravity accounts section gains the same install row for its host (never a WSL
distro), both following the host's install status. A host now reports its pinned
release's download size, so an idle row reads "111.5 MB download." instead of
"Not installed.".
* test(acp): the launch parity install puts the Antigravity harness beside its server
* fix(acp): Antigravity chats also drop the gcloud project variables
* fix(acp): Antigravity command rows, a refused /logout, the risky Allow Always warning, and an install that proves the server runs
- A command's line and output now show in Orca's command row: the dialect maps the server's
command_line/combinedOutput/exitCode to the shared shape and drops its duplicate output copy.
- The server's own /logout is hidden from the command list, and a message that is only /logout is
refused before it is sent: it would sign out every Antigravity chat on this host outside Orca's
sign-in gate. Dialects can now name withheld commands; the refusal has its own plain sentence.
- The server's prompt-injection warning on "Allow Always (risky)" is shown on the approval card.
- Install starts the unpacked server once under a throwaway home, asks initialize only, and keeps
the copy only if it answers as the pinned release and its process is proven stopped.
- The server runs with PYTHONUNBUFFERED=1; its environment lives beside its runtime.
- The permission mode option is found by its category, so the spec no longer names it.
* fix(antigravity): the install check accepts only the protocol version Orca's connection speaks
* fix(acp): keep the structured session create support within its line limit
Main's file already sat at the limit, so the account-home services pass inline instead of
through a variable.
* test(acp): Antigravity's launch snapshots follow main's per-chat permission launches
Main now starts ACP chats without full access and applies the chat's own mode after
start, as the Grok and OpenCode snapshots already record.
* feat(sidebar): main keeps a registry of workspace creations in progress, checked against the window in dev and test
* fix(sidebar): open the runtime creation entry after the create's own repo resolve
* refactor(sidebar): one creation handle opened after the create's repo lookup; move create startup resolution to its own module
* feat(sidebar): put the creation registry behind the ORCA_SIDEBAR_INPUTS dark build switch
* test(sidebar): cover the creation registry with the switch off and the gated creation id
* fix(mobile): wall hosts that cannot serve the page instead of opening native screens
* refactor(mobile): drop the native-route state and the shell fallback prop; unknown routes say unavailable
* test(mobile): read the nullable page route refusal in its policy test
* refactor(mobile): every build is the OTA shell; drop the native/OTA build switch
The owner retired the native-screen fallback with no emergency native build, so
EXPO_PUBLIC_MOBILE_SHELL, mobileShellBuildKind, shellSwitchDecision, the Metro
cache-key suffix and both release workflows' shell input go. Every host route
mounts the shell; a route naming no screen the shell could open gets the
existing refusal screen instead of a native screen.
Claude-Session: https://claude.ai/code/session_6cea92f6
* refactor(mobile): delete native screens the OTA shell no longer reaches
With every build the OTA shell, these native siblings run nowhere: the
native-executed closure (index.js plus every non-web route) does not reach
them, and the page resolves their .web siblings. Each .web sibling takes the
plain name, its web-overrides entry goes, and the native-only rich Markdown
editor and Mermaid WebView generators and their outputs go with them.
Kept: native siblings the node test suite still renders shared screens
through (terminal WebView, browser frame path, clipboard, dictation, media
picker, live input, snapshot budget, input styles).
Claude-Session: https://claude.ai/code/session_6cea92f6
* test(mobile): drop the phone-preview comparison the deleted native sibling held
Claude-Session: https://claude.ai/code/session_6cea92f6
* refactor(mobile): drop the dead web route, flag-era comments and the one-value shell kind
The host route files no longer switch, so their comments say what they do now:
a route naming no screen shows the unavailable screen. app/h/[hostId]/web.tsx
duplicated index.tsx and nothing linked to it, so it and its stack entry go
(the bundle sweep is re-measured: 77 scripts at 15 routes). Diagnostics print
the bridge protocol on its own instead of a shell kind that has one value.
Claude-Session: https://claude.ai/code/session_6cea92f6
* refactor(mobile): one host for the rich editor, plain Text, and drop two unused native deps
MobileSelectableText was react-native's Text, so callers use Text. The rich
Markdown editor's host-facing seams (messages, URL prompt, keyboard inset) are
required now that the page is its only host; the WebView defaults go. Comments
that described deleted native components are rewritten, and
expo-image-manipulator and react-native-uitextview leave package.json and the
lockfile.
Claude-Session: https://claude.ai/code/session_6cea92f6
* feat(mobile): draw the host Accounts screen from the desktop's page
Accounts was the last host screen the shell still drew natively, so its
changes needed a phone build. It is now a page route like Tasks: the
screen moves to src/accounts/MobileAccountsScreen.tsx, accounts.web.tsx
renders it on the page, and accounts.tsx mounts the shell for it.
What React Native Web needed: Alert.alert is a no-op there, so the
reset confirmation, its outcome and a failed account switch are
ConfirmModal drawers (ConfirmModal can now drop Cancel for a notice);
Back goes through the route handoff, which pops the shell's stack; and
the reset idempotency key is built from getRandomBytes, since
randomUUID needs a secure context the iOS custom scheme is not.
edit.tsx edits the phone's own pairing and never renders on the page,
so the route manifest leaves it out and the page's host stack does not
declare it. The script sweep is re-measured for the 14-route tree.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(accounts): answer a same-offer Codex reset retry with its recorded outcome; mobile mirrors the desktop
The desktop keeps no client journal for a reset credit: the host's ledger
owns the attempt. A remote client that lost a reply and retried the same
offer under a new key was refused with "already attempted" (or "unknown
outcome" while the provider call was unresolved), which is why the phone
carried its own durable journal to replay the old key.
The coordinator now answers a request for an offer an earlier key already
claimed as that attempt: the settled outcome, the running attempt, or a
resume of the pending one under its original key. A different offer for
the account is still refused while an outcome is unknown, so nothing can
spend twice. The reply shape is the one a same-key replay always had, so
installed clients with their journal read it unchanged.
With that, the Accounts page sends a fresh key per attempt like the
desktop and keeps nothing on the phone: the AsyncStorage journal, its
client singleflight and the retry-record warnings are deleted, and the
journal-resume recording goes with them.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(accounts): resume an account's unresolved Codex reset when the retry names a newer offer
Review follow-ups:
- Host: after an unknown provider outcome the usage refresh moves the
offer, so a retry names a newer one. The coordinator now answers it as
the account's unresolved attempt (resumed under its own key and scope),
as the desktop's consumeCurrent does, instead of refusing forever. One
ledger lookup finds own key, offer claimant, then unresolved attempt.
- Mobile: a reply is matched on target, account and account revision,
not the offer, so the resumed attempt's scope is accepted.
- The key is minted inside requestCodexResetCredit from randomV4Uuid, the
session helper moved to src/platform/random-v4-uuid.ts.
- RefreshControl goes; the header refresh stays. ConfirmModal's
onConfirm is optional for an OK-only notice.
- Stale journal comments and the mobile docs line are corrected.
- The edit.tsx page exclusion is dropped from this PR; the script sweep
is re-measured for 15 routes.
- Root oxlint: escape the apostrophe; zod v4 strictObject.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): secure UUID fallback from expo-crypto; pin reset retry routing
- randomV4Uuid never falls back to Math.random: without crypto.randomUUID
it builds the v4 UUID from ExpoCrypto.getRandomBytes, as the old reset
key did. Tests get Node's secure bytes for expo-crypto from the setup
file, since the native module has no Node build.
- Host tests: a new offer after a settled attempt spends again rather
than replaying, and a retry naming a newer offer joins a resumed
attempt in flight (one provider call, original key).
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* chore: restore main's bytes for files the merge's pre-commit format touched
The merge commit's lint-staged run reformatted 27 files this PR does not
change. Committed without the hook so they match origin/main exactly.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* test(mobile): stand in for expo-crypto with a Node alias, not a setup-file mock
Anti-slop forbids module mocking outside test files. The vitest config
now aliases expo-crypto to a faithful Node implementation of the names
shared code reaches; a test file's own mock still wins.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* docs(mobile): match the bridged-parity comments to the measured 795-golden tally
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
Switch-on builds only; switch-off behaviour is unchanged.
Main stores a tab's preview flag only while it is true. A non-preview
editor open created its tab-bar entry with `isPreview: false`, and making
a preview permanent by an edit, by "keep open" or by pinning wrote the
same, so the window's next save changed that tab in main's model (the
save-divergence check's `tab <id> changed: isPreview` after a CLI file
open). New tabs now carry the flag only when true, and those writers drop
it, by the rule E2-4 gave activation, now in one place (tab-preview-flag).
Claude-Session: 10569c9a-a0a1-4fc9-8469-0edfb7aed125
* fix(native-chat): a running Claude chat keeps its model when two Claude Code versions list differently
A send's stand-in for a model the list lacks took its rows and default from the
chat's own answer but kept only rows the account's saved list names, and every
running chat rewrote that list whatever CLI version it ran. After Claude Code
2.1.280 -> 2.1.302 the filter dropped the default row and sends moved to Sonnet.
- The options answer names the ids its agent listed (listedModelIds); a live
catalog is verified only by its own listing. An older host's answer may move
only to the chat's own default row, and only where the host's list names it.
- Only a session's start (and the probe) writes the account's list; later reads
no longer do, so an older running CLI can't replace a newer start's list.
Tracked in STA-10947.
* fix: keep running chat model selection within its own listing
Preserve learned model menus on later reads and check launch-added model membership before saving.
Tracked in STA-10947.
* test: validate ACP menu regression fixtures
Use the protocol schema for config options and supply the catalog row default flag.
Tracked in STA-10947.
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
Neil
Jinwoo Hong
Max HsuandNeil
Kelvin Amoaba
Brennan Benson
