Files
orca/src/shared/session-tabs-runtime-capabilities.ts
T
NeilandBen Grynhaus d1f04e6042 fix(terminal): a pane moved to a new tab stays moved on paired servers (#33027)
* test(e2e): a pane moved to a new tab on a paired server workspace stays moved

* fix(terminal): keep a pane moved to a new tab on paired runtimes

Moving a split pane to a new tab in a paired-runtime worktree changed only
the window store. The host never learned about the move, so the next host
snapshot rebuilt the old tab and the pane snapped back.

Add a session.tabs.movePaneToNewTab RPC that commits the move in the host
session through planTerminalLeafMove and republishes the session tabs.
For a mirrored host tab, the renderer applies the move first under the
mirrored id the host snapshot will use, then asks the host to commit it.
An older host or a refused move falls back to the old local-only move.

Fixes #32939

* fix(terminal): commit a host pane move through the existing leaf-move writer

The layout-writer ratchet allows no new main-process layout writers. The
headless host now hands the move to commitLeafMoveAndRekey, the same
commit a local window uses, and keeps only the window check, validation,
rehydrate and notify.

* fix(terminal): gate the host pane move on a host capability

An older host keeps today's window-only move under a local tab id instead of
a mirrored one it never confirms. Adds a terminal.list check to the e2e.

* test: drop type assertions from the pane-move tests

* fix(terminal): the host keeps a moved pane's place, focus and live terminal

After the host commits the move, the window gives it the drop position and
focus through the existing tab move and activate calls; a refusal redraws the
host's tabs. The host moves the live PTY's surface with its pane and checks the
target tab id. The move lives in its own runtime module.

* fix(terminal): hold a moved pane's drop order until the host has it

The host's snapshot of the commit goes out before its reply and appends the
tab, so the window records the drawn order as a reorder intent at the drop and
sends that order, and the focus read then, once the host answers.

* fix(terminal): route the moved tab's reorder to its owning host

The follow-up names the worktree's host instead of reading the active-server
setting (focus-read ratchet); the e2e narrows host rows to terminal tabs.

* fix(terminal): the host places a moved pane's tab in the move itself; a refusal reverts

The move carries the drop's group and index (optional; an older host appends)
and the host places and selects the tab before its one publish, replacing the
follow-up reorder and the drop-time order hold. A refused move closes the tab
this window drew without stopping its terminal and redraws the host's tabs even
when unchanged. E2e covers a same-group drop and a refusal; host unit tests cover
same-group and cross-group placement.

* fix(terminal): a refused pane move keeps its pane records; drop index in host order

The revert hands the pane's status and launch records back to the source tab
before closing the drawn tab. The host turns a projected client's drop index
into its raw order with translateProjectedSessionTabMove, as session.tabs.move does.

* fix(terminal): only an unknown drop group appends a moved pane's tab

The host catches only target_group_not_found and invalid_tab_order from the index
translation and rethrows anything else.

* fix(terminal): settle a pane move by what the host holds when its reply is lost

A lost reply is not a refusal: the window asks the host whether it holds the
pane in the new tab before undoing anything, and waits for the next snapshot
when it cannot ask. A move the host committed but this window could not draw
takes the host's tabs.

* fix(terminal): a lost transport on a pane move is unknown, not a refusal

runtimeEnvironments.call answers a dropped or overloaded transport with an error
envelope; those codes (the shared recoverable set) now ask the host instead of
undoing a move it may have committed.

* test(e2e): pane-move spec waits on real signals, not delays

The source tab is created on the server and split once its shell is listed, so
the split no longer races a desktop-seeded tab's first spawn (the CI failure).
The stay check follows output from the moved pane; the refusal check waits for
the drawn tab to appear and go.

* test(e2e): read the refused move's tab counts without Reflect (anti-slop)

* fix(terminal): a moved pane's tab joins the order the user had, not a rebuilt one

The host inserts the new tab into the group order captured before the commit,
appending without a drop position, so editors and pages keep their places. The
shared group-move fallback is no longer used here.

* fix(terminal): a moved pane's groups hold the host's current tabs, in the user's order

Placement takes membership from the rebuild after the commit and only the order
from before it, so a tab opened while the commit was pending stays (after the
user's tabs) and no stale id is written.

* fix(terminal): a moved pane's placement keeps a reorder made while it committed

The order is read after the commit, from the host's current tabs, not before it.

* fix(terminal): a moved pane keeps the lone group the user merged into

A rebuild names a single group with the default id; placement keeps the user's
id for it, so the drop position still applies after a split was merged back.

* fix: import error classification from its new shared/remote-runtime path

* fix(terminal): a pane or divider drag survives focus moving inside the window

The drag's window blur listener was registered in the capture phase, so it also
heard every element blur. A terminal attach or host snapshot that moved focus
between panes mid-gesture ended the drag; in the paired pane-move e2e on CI it
cancelled the drag before the drop. Only the window losing focus ends it now.

* test: drive the focus-change drag test through a real pane manager, without casts

* fix(terminal): a headless host moves a pane with its live terminal and never empties its source

The host names the PTY it holds for the pane, so a session copy an SSH respawn
left with an old id no longer refuses the move as a mismatch. A move that would
leave its source tab with no pane (a sibling closed meanwhile) is refused, since
no headless cleanup retires the emptied tab and it would publish as a phantom.
The e2e fences its stays-moved check on a later server rename instead of
sampling on a timer.

---------

Co-authored-by: Ben Grynhaus <ben.grynhaus@wiz.io>
2026-10-26 02:01:08 -07:00

50 lines
3.0 KiB
TypeScript
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
import { QODER_OWNED_TERMINAL_CREATE_CAPABILITY } from './qoder-terminal-create-capability'
// Complete split-parent placement agrees across headed/runtime-owned hosts; legacy clients must wait for the snapshot.
export const SESSION_TABS_SPLIT_GROUP_PLACEMENT_RUNTIME_CAPABILITY =
'session-tabs.split-group-placement.v1' as const
export const SESSION_TABS_CHAT_FORK_CLI_RUNTIME_CAPABILITY =
'session.tabs.chat-fork-cli.v1' as const
// Host will follow placeholder session-tabs answers with a published one (#25736); never wait for that on older hosts.
export const SESSION_TABS_EMPTY_WORKTREE_ANSWER_RUNTIME_CAPABILITY =
'session-tabs.empty-worktree-answer.v1' as const
// Gate shell picks because older hosts strip shell and spawn their default.
export const SESSION_TABS_CREATE_TERMINAL_SHELL_RUNTIME_CAPABILITY =
'session-tabs.create-terminal-shell.v1' as const
// Why: a host with this commits a client's pane-to-new-tab move (session.tabs.movePaneToNewTab).
// An older host keeps the pane where it was, so a client moves it only in its own window there.
export const SESSION_TABS_MOVE_PANE_TO_NEW_TAB_RUNTIME_CAPABILITY =
'session-tabs.move-pane-to-new-tab.v1' as const
export const SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY = 'session-tabs.close-intent.v1' as const
// Gate force on confirmed pinned closes; old hosts drop it and refuse. Both build variants honor it.
export const SESSION_TAB_CLOSE_FORCE_RUNTIME_CAPABILITY = 'session-tabs.close-force.v1' as const
// Replay held closes as replay only where supported; old hosts accept user only.
export const SESSION_TAB_CLOSE_REPLAY_REASON_RUNTIME_CAPABILITY =
'session-tabs.close-replay-reason.v1' as const
export const SESSION_TABS_AUTHORITATIVE_INVENTORY_RUNTIME_CAPABILITY =
'session-tabs.authoritative-inventory.v1' as const
// Capable clients retain retirement proofs until live publication, allowing one send instead of full-list repetition on title ticks.
export const SESSION_TABS_RETIREMENT_PROOF_DELTA_RUNTIME_CAPABILITY =
'session-tabs.retirement-proof-delta.v1' as const
// Capable clients reconstruct updated tabs from the same stream’s prior frame, avoiding whole-workspace resends.
export const SESSION_TABS_TAB_DELTA_RUNTIME_CAPABILITY = 'session-tabs.tab-delta.v1' as const
// Capable clients read restoredUnconfirmed as unverifiable; legacy clients need done to avoid claiming live state.
export const AGENT_STATUS_RESTORED_UNCONFIRMED_RUNTIME_CAPABILITY =
'agent-status.restored-unconfirmed.v1' as const
export const SESSION_TABS_RUNTIME_CAPABILITIES = [
QODER_OWNED_TERMINAL_CREATE_CAPABILITY,
SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY,
SESSION_TAB_CLOSE_FORCE_RUNTIME_CAPABILITY,
SESSION_TAB_CLOSE_REPLAY_REASON_RUNTIME_CAPABILITY,
SESSION_TABS_AUTHORITATIVE_INVENTORY_RUNTIME_CAPABILITY,
SESSION_TABS_SPLIT_GROUP_PLACEMENT_RUNTIME_CAPABILITY,
SESSION_TABS_CHAT_FORK_CLI_RUNTIME_CAPABILITY,
SESSION_TABS_EMPTY_WORKTREE_ANSWER_RUNTIME_CAPABILITY,
SESSION_TABS_CREATE_TERMINAL_SHELL_RUNTIME_CAPABILITY,
SESSION_TABS_MOVE_PANE_TO_NEW_TAB_RUNTIME_CAPABILITY
] as const