`tab group` wrote a field the GUI recomputes on every sidebar render from
the tab's repository root, so a heading set from the CLI was overwritten
before anyone could read it. The command is gone; the read-only GROUP
column stays, and the docs now say where its value comes from.
Alongside it:
- `tty7 new --open` tells a failed request apart from a missing GUI
instead of reporting both as "no GUI is running", and its warnings
carry the `tty7:` prefix the rest of the CLI uses. Neither is an exit
code: the workspace exists by the time we ask.
- The switcher measures unclaimed workspaces against the rows already
listed rather than against the store that put them there, so this
window's own workspace cannot show up twice.
- `on_workspace_deleted` gets a test for its destructive half — the one
that erases state only this client holds.
- The empty-tree write-back says why it covers remote workspaces too,
and both unreachable `WorkspaceDeleted` arms say they are unreachable.
- `TabView` is no longer serialisable: it is a reading of the machine
tree, and both sides that want one have the tree already.
- New tests for the `tab ls` table and its JSON.
Five places where a workspace, a tab or an attachment was real on one side
of the socket and invisible on the other. They share a root: the GUI kept
its own list of which workspaces exist, and consulted the machine tree only
for the ones it already knew about.
- The switcher listed only workspaces this client had opened, so anything
the CLI made was missing from the GUI entirely — `tty7 new` looked like
it had done nothing. The local group now merges what the machine holds,
the way the remote groups already did, and `claim` keeps the id it was
handed instead of quietly opening a fresh workspace beside it. Opening
one hydrates from the tree whatever `restore_session` says: the setting
decides whether a window comes back at launch, not whether an open one
shows what is really in it, and the alternative was saving an empty
session over live tabs.
- A workspace deleted from another client left its row behind here, opening
onto nothing. It is now forgotten with it. A window still showing one
keeps it — `ws rm` leaves the panes running — and puts the workspace back
under the same id rather than carrying on writing to a tree that has no
record of it.
- `tty7 ls` could never fill its ATTACHED column: `Workspace::attachment`
was `serde(skip)`, which kept it off the disk as intended and off the
wire as a side effect, so a workspace held by a GUI window read to every
other client as unheld. It now travels, minus the token that proves the
hold, and is stripped when the document is written instead.
- `tab ls` and `ws tree` printed `tab.name`, which almost no tab has: the
GUI's strip names tabs from OSC titles the tree never sees. Both now fall
back through agent, cwd leaf and process name — the same ranking the
switcher uses, moved into the core so there is one of it — and `tab ls`
gained a GROUP column.
- `sidebar_group` was readable from the CLI and writable only from the GUI;
`tab group @TAB [GROUP]` closes that.
Also `tty7 new --open`, which asks a running GUI to put a window on the
workspace it just made: `GuiOpen` now carries a workspace id, since a
workspace with an id has no business being routed to whichever window was
focused last.
* fix(remote): let a WSL machine restart its server, and call it "server" in zh
The machine menu offered "restart server" only when `target.is_ssh()`, so a
WSL distro's row had just "new workspace" and "disconnect" — and the router
refused the action for anything but SSH, even though `restart_wsl_daemon`
had been sitting in `install/wsl.rs` unused since it was written. A distro's
server is installed and launched from this computer exactly like an SSH one;
only the transport differs.
- `RemoteTarget::hosts_our_server()` replaces `is_ssh()` as the gate in the
sidebar menu and in `restart_window_daemon`. A `--stdio` workspace still
has nothing to restart: it is whatever program the user named.
- The router grows WSL arms for both actions — `RestartServer` relaunches
the distro's daemon, `ReplaceServer` (new `replace_wsl_server`) publishes
the bundled binary first. The mismatch dialog's "update server" used to be
a dead end on WSL for the same reason.
- `AppRestartServerNotSsh` is now `AppRestartServerNoServer`: the message no
longer talks about SSH, since the only machine it can fire for is a local
`--stdio` one.
The Chinese table called tty7's server 服务器 / 服务器端 / 后台服务; it now
says `server`, the way it already keeps `shell`, `pane` and `agent` in
English. The macOS Services menu keeps its 服务.
* fix(i18n): keep 服务器 where it means the SSH host, and test the new gate
The sweep that renamed tty7's own server to `server` in the Chinese table
also caught two SSH settings where 服务器 was never tty7's server: the
host-key description talks about the key of each machine being connected
to, and the banner switch suppresses the login banner sshd prints. Written
as `server` both now read as if tty7 ran something there, which is exactly
the confusion the rest of the sweep removes. Put the Chinese word back in
those two.
`hosts_our_server()` is the gate the whole change hangs on and nothing
exercised it, while the test next door still asserted under the name
"only SSH machines have a server to restart" — the rule this branch
retires. Name that test after what it actually checks, the transport, and
add one for the new predicate. It matches on the variants rather than
negating a single one, so a transport added later has to say for itself
whether we can restart what is on the far end.
---------
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
ConPTY emits no repaint after a resize; conhost silently re-anchors its
layout and keeps painting with absolute cursor addresses computed against
it. Measured live: growing the window keeps rows and cursor pinned and
opens blank rows below, and shrinking scrolls the last written row to the
new bottom. The grid resized the alacritty way instead, so after a
maximize every absolute-CUP paint landed mid-screen inside the old output.
The vendored alacritty_terminal now has a conpty_resize mode mirroring
conhost's model (fork rev 1276f12); every Windows pane opts in.
Separately, a resize during a burst of output reflowed ahead of the
backlog (up to the gate's 16 MiB of old-width bytes). The daemon now
echoes a Size frame to the controller at the exact stream position where
the PTY geometry changes, and a client that probes the new resize-echo
feature defers its reflow to that marker. Remote routes and older daemons
keep the reflow-at-request-time path.
* fix(theme): keep the bright ANSI half of the palette legible on the theme background
fmt
* feat(theme): make the bright-color legibility rescue toggleable
fmt
* fix(workspace): stop switching workspaces from destroying live sessions
Switching workspaces rebuilt every pane it was asked to restore, and a
window that rebuilt nothing then deleted the workspace outright — tree
and store both. Three separate guesses, each one authorizing an
irreversible act:
- `session_from_tree` erased a pane's id when the tree said `live: false`.
That flag is a cached observation from another process, reloaded as
false on every server start, so a quiet pane read as dead while its
shell was running. The restore had nothing to attach to and spawned a
fresh shell over it.
- Two servers could start against one config dir. `run_with` decided
another server was dead by failing to connect once, then unlinked its
socket and bound its own. The loser kept `control.sock` with an empty
pane registry, so `MachineGet` reported every pane dead and nothing
logged an error.
- `finish_hydration` marked a window informed before the rebuild and
without looking at the result. `tabs_from_session` drops any tab whose
panes all fail to start, which is every tab when the pane socket is
unreachable — leaving a window that was empty and authoritative at
once, and the next switch deleted a workspace with ten live tabs.
Each is now settled by whoever holds the truth: attaching decides
whether a pane is there, an advisory lock decides which process is the
server, and a deletion needs the machine's own mirror to agree that the
workspace is empty.
* fix(state): quarantine a corrupt views.json instead of silently discarding it
machine.json already sets a corrupt file aside before falling back to
defaults; views.json just logged and returned None, and the next save
overwrote whatever the file held. Move the quarantine helpers to config
so both loaders share them.
Also make the no-lock-primitive fallback in the daemon singleton report
Unavailable rather than Taken, so a platform without flock still gets a
server instead of one that refuses to start.
* fix(restore): a failed List no longer reads as every pane being dead
Review follow-ups on #410, all three the same shape the PR exists to
stamp out:
- alive_panes_on flattened a failed List RPC into an empty alive-set,
which made pane_attachable respawn every pane in the batch over its
running session. The failure now surfaces as None and the attach
itself decides, the way session_from_tree already leaves it to.
- pub fn run() bypassed the singleton lock entirely; it had no callers,
so a future one would have silently reintroduced the split-brain.
Removed.
- Singleton::path() and the field behind it were unused. Removed.
---------
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
* fix(terminal): complete WSL panes over the distro's \\wsl$ share
Tab in a WSL bash pane always fell through to the shell: the pane's
filesystem is foreign, so the completion engine had no cwd to list and
handed every Tab back to bash. Now a WSL pane's POSIX cwd (OSC 7) is
translated to the distro's \\wsl$ share, which this process can read
like any directory:
- complete_foreign lists paths against the share but keeps everything
that would consult this machine switched off: no PATH binaries in the
command position, no generator scripts, and `~` is left to the shell
(it names the distro's home, not this machine's).
- Absolute words stay inside the share: Windows join semantics keep the
UNC prefix when a rooted word lands on it, so `ls /etc<Tab>` lists the
distro's /etc, not C:\etc. The automount stays on the share for the
same reason.
- A wsl.exe pane spawned without --distribution now resolves the default
distro from the registry (Lxss\DefaultDistribution), so its remote
context names a real distro instead of an empty placeholder.
- A WSL workspace no longer claims the SSH remote-listing path; only a
spec-carrying workspace does.
Verified end to end against a live Ubuntu-24.04 through an isolated
daemon: the default distro resolves, cwd frames flow on cd, and the
translated share lists from the Windows side.
* style: cargo fmt
* fix(terminal): keep the \\wsl$ completion route on this machine's panes
A WSL pane owned by a remote host reaches its distro through that host,
not through a local \\wsl$ share -- a same-named local distro would list
the wrong machine's files. Gate wsl_share_cwd on host locality, so a
remote host's WSL pane falls back to handing Tab to the shell.
---------
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
On mac/linux the daemon reads the foreground process's real argv, so
resume_command can replay launch flags like --dangerously-skip-permissions.
The Windows path detects the agent from the OSC 133;C shell-integration
command capture but threw the command line away, stamping an empty argv:
every resumed agent came back bare, with none of its launch flags.
Tokenize the captured command (case-preserved, quotes trimmed, PowerShell
call operator dropped) and stamp it as the pane's launch argv. Detection
keeps lowercasing its own copy; replay_flags' safety allowlist already
rejects tokens a whitespace split would mangle, falling back to the bare
resume command as before. Fork commands share the same argv source, so
they are fixed by the same change.
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
Issue #376 asked for `omp`. Oh My Pi is a fork of Pi (can1357/oh-my-pi,
descended from badlogic/pi-mono), but the fork is where the similarity
stops for our purposes: it ships one binary of its own — `omp`, the only
`bin` in `@oh-my-pi/pi-coding-agent`, and it never installs a `pi` — and
it keeps its config under `~/.omp`. A pane running it was therefore not
detected at all, and aliasing `omp` onto `CLIAgent::Pi` would have been
worse than nothing: the status bridge would land in `~/.pi`, and Resume
Session would offer `pi --session <id>` to a binary that spells that
flag `--resume`.
So it gets its own variant, wired the whole way through:
| | |
|---|---|
| Detection | argv stem `omp`, distinct from `pi` in both directions |
| Avatar | its own mark, normalized from the project's `assets/icon.svg` |
| Resume | `omp --resume <id>`, opting out on `--no-session` |
| Fork | `omp --fork <id>` — a verified fork command, so the menu item appears |
| Hooks | Settings → Agents, at `~/.omp/agent/extensions/tty7/index.ts` |
The status bridge is the one piece the fork did not change. Oh My Pi
inherited Pi's extension contract intact — same default-exported factory,
same `session_start` / `agent_start` / `agent_end` / `session_shutdown`,
same `ctx.sessionManager.getSessionId()` — so `pi_extension_ts` now takes
the agent and substitutes two things, the package it imports the type
from and the slug it calls the emitter with. Pi's generated file is
byte-identical to before, so no installed bridge goes stale.
`--resume`, `-r` and `--session` are three spellings of one flag in Oh My
Pi; all three shed when a session command is rebuilt, while `--session-dir`
is a different flag and rides along. `fork_command` now honors the same
`--no-session` opt-out `resume_command` already did — Oh My Pi rejects
`--fork` outright under it, and no existing agent declares an opt-out.
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
* fix(windows): make the install directory actually replaceable before updating
The updater stopped the daemon and started the Inno installer the moment
the daemon's endpoint disappeared — but the endpoint going away is not
the same event as the images being released. The ConPTY hosts
(OpenConsole.exe) are the daemon's children, not the shells', so the
per-pane kill never reached them, and the daemon's exit(0) skipped every
destructor that would have closed them; they kept the installed
OpenConsole.exe open for seconds after --stop-daemon returned. Silent
Setup then hit the lock, took the suppressed dialog's default (Abort),
and the updater's recovery relaunched the old build — "updated,
restarted, still the old version". A daemon that died without cleaning
up made it permanent: its orphaned hosts survive indefinitely, which is
the DeleteFile-code-5 users hit even after "closing everything".
Reproduced both shapes in isolation before fixing: with a pane open,
--stop-daemon returned ~1s in while OpenConsole.exe stayed locked for
another ~1.4s; after taskkill on the daemon, the orphaned host held the
lock forever.
The shutdown now finishes what it starts, at every layer that can be
the last one standing:
* The daemon reaps its remaining descendants and waits for them
before exiting, while the endpoint — the signal stop() watches —
is still up.
* stop() reads the pidfile before asking, and waits for that process
to actually exit after the endpoint goes, not just stop listening.
* The recorded-daemon reap waits for the images to be released
instead of returning on the async TerminateProcess.
* stop_for_update(dir) — reached via --stop-daemon
--update-install-dir, which PrepareToInstall and the portable
updater now pass — also terminates anything still running from the
installation directory (the orphan case no pidfile can name) and
only returns once the .exe/.dll images there open for writing,
naming the holdouts in the error if they never do.
* The updater runs that clearing itself before invoking Setup, so a
directory that cannot be cleared fails with a cause in update.log
and relaunches the previous build, instead of Inno's bare
"DeleteFile failed; code 5".
The update dialog on Windows also told a macOS truth — "the background
service keeps running, so whatever is open in your panes survives".
Windows cannot replace a running daemon's image, so its install path
stops the service; the dialog now says so.
* fix(windows): tighten the install-dir clearing per review
- An image that fails to canonicalize stays in the lock check instead of
being silently skipped; only a positive match against the caller's own
running image is excluded.
- reap_recorded_daemon shares one deadline across the whole tree via a
new winproc::terminate_and_wait_all, which stop_for_update and
reap_descendants_of now use too — one implementation of "terminate,
then wait, bounded overall" instead of three.
- [UninstallRun] passes --update-install-dir "{app}" like
PrepareToInstall, so uninstalling after a daemon crash gets the same
orphaned-ConPTY-host cleanup as upgrading.
* fix(update): close three gaps the update audit found
- macOS updater: wait for the parent by watching getppid() reparent to
launchd instead of polling kill(pid, 0), which a recycled pid could
satisfy forever. The kill loop remains only for a hand-run updater.
- Windows: a new update guard (config-dir update.lock, held by the
updater from daemon stop to relaunch) makes ensure_running refuse to
spawn a daemon mid-install, so a tty7 CLI call or manual launch can no
longer relock the images the installer is replacing. Stale guards —
dead writer or past the TTL — are shed on sight.
- Windows portable: the update backup now carries an incomplete marker
from before the first file moves until the replacement lands. At
launch the app reports a backup still carrying it as an interrupted
update (the installation may mix two versions; the old files are
preserved), and silently removes marker-less backups a finished
update failed to delete past an antivirus hold.
* fix(update): verify the guard's writer by start time, and guard manual Setup runs
Review round three, both findings and all three minors:
- The guard no longer expires a live, verified holder: a pid is believed
to be the writer only if the process behind it started before the
guard was written (winproc::creation_time via GetProcessTimes), which
is what tells a genuine holder from a recycled pid. The TTL now bounds
only the unverifiable case, so an install slowed past ten minutes by
an antivirus sweep keeps its protection.
- Manual Setup runs get the guard too: the --stop-daemon
--update-install-dir helper holds it in its parent's name — the Setup
or uninstaller that keeps replacing files after the helper returns —
and it goes stale when that parent exits. ensure_running gained five
seconds of patience so the post-install "Launch tty7" click, racing
Setup's own exit, gets its daemon instead of an error.
- processes_running_from also matches images against the canonicalized
install-dir spelling (junction, subst, 8.3 given form).
- reconcile_portable_backups reports every interrupted backup, not the
first.
- The unix signal-and-wait loop now reuses wait_for_recorded_exit.
* style: rustfmt
---------
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
A re-transmitting sender like terminal-browser sends a fresh full-window
frame per rendered frame — ~26 MiB of RGBA at Retina resolution. On the
client that buffer was copied twice for no reason on the way to the atlas:
`decode_frame` allocated a new Vec for the payload tail behind the 30-byte
header, and the uncompressed path of `to_rgba8` then cloned it again before
the in-place BGRA swap.
Thread ownership through instead:
- `Image::decode_frame_owned` consumes the frame Vec the reader already owns
off the socket and drains the header off the front, reusing that allocation
as the pixel buffer rather than allocating and copying a fresh one.
- `Image::take_rgba8` moves the pixel buffer out on the uncompressed fast
path (the shm/file transport hands us pixels already in `f=32` layout), so
`decode` swaps R<->B in place with no clone. The compressed inflate, the
PNG guard, and the declared-dimension inflate bound are unchanged; `f=24`
still repacks because RGB->RGBA changes the length.
Removes two ~26 MiB per-frame touches on the client hot path. On a 3216x2160
frame the decode+normalize step drops from ~1.78 ms to ~0.89 ms — ~0.9 ms
saved per frame, ~53 ms/s at 60fps. This does not touch the wire frame layout
or the daemon-side transfer; it is a pure client-side allocation cut.
* feat(terminal): animate wheel scrolling instead of jumping a notch at once
Sub-line scroll positions were already in place — the view keeps a
fractional remainder and paints the grid shifted by it — but the position
was a function of the event, not of time. A notch arrived and the whole
distance was applied at once, so whether it looked smooth came down to how
fine-grained the platform's deltas happened to be.
A macOS trackpad reports pixels, so it did. A wheel on Windows reports
whole lines (gpui multiplies the notch by the system's scroll-lines
setting, three by default), the fraction came out zero every time, and the
view jumped three lines per notch. The sub-line machinery was present and
never engaged.
A 120-step notch is one discrete pulse; no arithmetic on the delta recovers
a continuous gesture from it. So make position a function of time: a notch
adds to a remaining distance and each frame consumes a share of what is
left, ~120ms to land, exponential, with a sub-pixel remainder snapped
rather than approached since every frame of it costs a repaint.
Line deltas are discrete and get animated; pixel deltas are continuous and
do not — putting an animation between a trackpad and the grid would only
add lag. Mouse reporting and alternate-scroll keep forwarding whole lines,
which cannot be spread over frames either.
The distance in flight is relative rather than an absolute target, so
output arriving mid-scroll shifts the grid without dragging the animation
elsewhere. Everything that moves the view on its own cancels what is in
flight first.
Settings -> Terminal -> Scrolling -> Smooth scrolling, on by default.
Also pin the scratch config dir in the terminal-view test harness: building
a view reads the config, and which test got there first decided whether
that touched the real user directory.
* fix(terminal): tell a trackpad from a wheel by phase, not delta type
The first cut split the two on the delta variant — Lines meant a wheel,
Pixels meant a trackpad. That holds on Windows and Linux. It does not hold
on macOS, which sets hasPreciseScrollingDeltas for a wheel mouse as well, so
a wheel reported pixels, took the trackpad path, and was never animated.
Measured on this machine, one detent arrives as a single ~103px event —
about five lines at a 21px line height, applied in one go. That is a worse
jump than the three lines Windows produced, and it was invisible to a check
based on the delta's type.
Size cannot separate them either: a trackpad flick reaches ~3 lines in one
event while an inched wheel moves ~0.6, so the ranges overlap and any
threshold misclassifies a quarter of the trackpad stream.
Phase can. Only a device that can gesture ever reports Started/Ended; a
wheel is Moved forever, on every backend. So track the gesture instead —
and hold it open on a 150ms idle timer rather than closing it on Ended,
because lifting the fingers is not the end of the stream: the momentum tail
keeps delivering Moved events larger than the gesture that spawned them,
and animating those would smooth what the system already smoothed.
Also skip the animation for jumps under a line. Inching a wheel one detent
at a time lands there, and spreading a half-line move only adds lag to
something that already reads as continuous.
Tests are now shaped after the measured event streams rather than after an
assumption about which variant each device sends.
* chore: trigger a Claude review of this branch
---------
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
* fix(daemon): notice a server that is only a control dialect behind
The pane protocol and the control dialect are versioned apart, and the
launch check only compared the first. A server from before the v4 to v5
control bump answers the pane handshake with this build's own number, so
it was waved through as ours while every machine-tree call was refused:
the window opened with no tabs, the only trace a log line the default
config does not write anywhere.
Ask the control socket too, before calling the server ours, and say which
version disagrees when offering the restart. A window that still opens
empty now says why in the window it happened to.
* fix(daemon): do not call a newer server old, and say the empty-window reason once
The dialect handshake reports disagreement, not direction, but the restart
prompt read every mismatch as "from an older build". A daemon left running by
a newer build passes the pane-protocol check the same way an older one does,
so the prompt told users their newer server was old — the same wrong guess the
remote path stopped making in #384. Split the copy in two and pick by which
side is ahead, as `dialect_complaint` already does for remotes.
The window's own explanation had two ways to misfire. A hydration superseded
by a newer one still announced an emptiness someone else was already filling,
because only `owe_rehydration` checked the epoch; it now reports whether it
claimed the debt and only the owner speaks. And since a failed pull is retried
from every `sync_window`, a machine that never answers repeated the same
notification every fifteen seconds — latched to once per window, cleared when a
pull finally lands so a later outage still gets a word.
---------
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
The update channel becomes a property of the installation rather than
something derived from how version numbers happen to sort, so a Nightly
follows Nightly instead of being walked back onto Stable by an update it
never asked for. Stable reads /releases/latest, which excludes
prereleases; Nightly reads /releases/tags/nightly. Neither feed can hand
the other an update, so an installation only changes channel when the
user changes it in Settings.
The nightly release cannot state its version in its tag — `nightly` is
force-moved every night, so `tag_name` is the literal string. It now
publishes nightly.json beside the packages, falling back to parsing asset
filenames for builds that predate the manifest. Prereleases are ordered by
every numeric identifier in the stamp, and the stamp goes to the minute so
two builds in one day are distinguishable; a stable release still outranks
every dated build of its core version, which is how switching back to
Stable graduates instead of downgrading.
Switching channel invalidates what the old feed produced: the staged
package, the deferred prompt, and the transfer still in flight, which
would otherwise finish and stage a build from the channel the user just
left. Settings keeps one action on the update row rather than three —
the update dialog covers the rest, but it is a moment rather than a place,
and where the package cannot be installed for the user the release page is
the whole update path. Skipping a version is retired along with its state,
its Settings row, and its localization keys.
Also carries the staging work this was branched from: an update is fetched
and verified while the prompt is up, so installing it is a restart, and
declining one defers it instead of retiring it permanently.
A handshake refused on the control dialect was shown with the protocol
layer's own wording — "java answered, but not as a tty7 server: control
peer (build …) speaks control v4, this build speaks v5". The far end is
tty7; it is a build on the other side of a dialect bump, and the reader
cannot act on the dialect numbers either way. Restate it as which side is
behind, and name the action on the button: "Update Server", not
"Restart Server".
The failure that followed was also invisible. The switcher paints a failed
`connect` in preference to `remote_host_errors`, and restarting or
replacing a server cleared only the latter, so whatever went wrong during
the install was covered by the complaint that started it — the button read
as doing nothing at all.
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
* feat(switcher): two-column panel with IDEA-style Ctrl+Tab
The switcher listed workspaces only; reaching a tab inside one meant
opening it first. It is now two columns — workspaces on the left, the
tabs of whichever one the cursor sits on to the right — and Ctrl+Tab
raises it as a most-recently-used tab switcher that commits when the
modifier comes up.
Picking a workspace or a tab now switches this window in place. A second
window is something you ask for, with the platform modifier or "Open in
New Window", rather than what happens by default.
New workspaces get a codename ("amber-yak") instead of inheriting
whatever directory their first shell started in. The generator moves out
of worktree.rs into core::codename so both callers share it.
* fix(switcher): review fixes — platform-gate the Ctrl+Tab key test, park the new-window tab
- The key_intent test asserted only the macOS half of the Tab chord; off
macOS Ctrl *is* the secondary modifier, the raw key falls through on
purpose (the chord arrives as NextTab), and the test now says so
instead of failing there.
- open_at_tab probed a freshly opened window's tabs exactly once, but a
new window hydrates them asynchronously — route through
activate_tree_tab so the pick parks until the tab arrives.
- Escape mid-rename backs out of the rename instead of tearing down the
whole panel.
- A one-tab workspace reads '1 tab', not '1 tabs'.
Claude-Session: https://claude.ai/code/session_01V7xjxdUGWQp93KQDuFuh8d
* style: cargo fmt
Claude-Session: https://claude.ai/code/session_01V7xjxdUGWQp93KQDuFuh8d
---------
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
The single en/zh tuple table becomes one module per language behind a
`SUPPORTED_LANGUAGES` table, and Japanese joins English and Simplified Chinese.
- `gui_language` accepts `ja-JP`; anything unrecognized still falls back to `en`.
- The language picker and `refresh_locale_state` both read `SUPPORTED_LANGUAGES`
instead of keeping their own copy of the code list.
- Language names in the picker stay endonyms (English / 简体中文 / 日本語) in
every locale, as English and Chinese already were.
- The zh and ja key tables are exhaustive, so a new `L10nKey` fails the build
until it is translated rather than silently rendering English.
Co-authored-by: Chihiro WATANABE <chihiro.watanabe@live.jp>
The GUI update check already uses reqwest, which reads the Windows
system proxy from the registry by default. The remote server
installer / bundled-server fallback uses ureq, which only reads
HTTP_PROXY/HTTPS_PROXY environment variables unless the
win-system-proxy feature is enabled.
Enable ureqs win-system-proxy feature so that release downloads
inside the daemon also honor the Windows system proxy set by tools
like Clash (System Proxy mode), v2rayN, etc. This is a no-op on
non-Windows platforms.
Fixes the inconsistency where the update check could reach GitHub
through the proxy but the actual download would time out trying to
connect directly.
Resolve an HTTP/SOCKS proxy for tty7's own update checks and release downloads, from (in order) a new `http_proxy` config field, the platform system proxy — Windows registry / macOS SCDynamicStore — and the HTTP_PROXY/HTTPS_PROXY/ALL_PROXY environment variables.
Programs running in a pane are deliberately unaffected: they inherit their proxy from their own environment, as in any other terminal.
Fixes#365.
Removes the Outline right panel and all of its wiring: the `RightPanelTab::Outline` variant, the `ShowRightPanelOutline` action and its handler, the tab-strip button, the palette command, the keymap arm, `render_panel_outline`, `TerminalView::{command_marks, scroll_to_mark}`, the `one_line` helper, and four i18n keys.
An existing config value of "outline" falls back to the default Info tab via `de_lenient`, and a user keybinding naming `ShowRightPanelOutline` degrades to a logged warning rather than breaking the keymap.
Also drops what the removal stranded: `Marks::list` is now `cfg(test)` (its last production caller was `command_marks`), and `icons/list.svg` — the Outline button's icon, with no other user — is gone.
Closes#374
The per-window taskbar overlay badge (#355, for #199) is removed, and with
it the in-flight follow-up that was making its green "finished a turn"
state reachable: the feature is not wanted. Nothing shipped — the badge
only ever existed in Unreleased — so this is a plain removal rather than a
deprecation, and its CHANGELOG entry goes with it instead of gaining a
"Removed" counterpart.
What goes: `ui::taskbar` and its `ITaskbarList3::SetOverlayIcon` poll, the
`taskbar_status_icon` config flag and its Settings → Window & Tabs row and
strings, `Tty7App::taskbar_signals`, `TerminalView::shell_busy` /
`RemoteTerminal::shell_busy` (the overlay was their only caller), the
`raw-window-handle` dependency and the `Win32_UI_WindowsAndMessaging`
feature it needed, and the feature docs in both languages. A stale
`taskbar_status_icon` left in someone's `config.json` is ignored, as any
unknown key is.
The tray badge and the in-window status dots are untouched; they were
always the ones the taskbar was mirroring.
* fix(windows): bundle Microsoft's ConPTY so panes can answer color queries
The in-box conhost swallows a pane process's OSC 11 background query: it
never reaches tty7's emulator and no reply is ever written back, so
applications that choose a light or dark UI from the terminal background
render a dark UI under a light theme.
tty7 already answers OSC 10/11/12 from the live theme, so nothing was
missing but a pseudoconsole that forwards the question. Microsoft ships one
as a redistributable, and portable-pty already prefers a sideloaded
conpty.dll over kernel32's, so this is packaging rather than code: the pair
goes beside tty7-app.exe, where the DLL search path finds it.
Measured on Windows 11 26200, same binary, only the pair added beside it:
in-box conhost: the terminal side never sees the query; the client times
out with no reply
bundled ConPTY: the terminal side sees ESC]11;?BEL and a real pane reads
back rgb:efef/f1f1/f5f5 under catppuccin_latte, which is
the preset's exact background
The two files are one supported unit, so the release verifier fails a
package that carries only one, a mismatched pair, or the MIT notice-less
DLL. They also join PORTABLE_MANAGED_ROOTS, without which the updater would
reject every portable archive that contains them; they are deliberately not
required by verify_portable_payload, since tty7 runs without them and a
packaging slip should fail the release rather than a user's update.
build.rs stages the pair beside cargo's output so a development build does
not quietly run on the in-box host, and the daemon logs which pseudoconsole
it got.
Closes#345
* fix(windows): restage the bundled ConPTY when it goes missing
Watching only the vendored sources meant a staged copy that left the target
directory stayed gone: the build script was cached, so it never ran again to
put it back, and the build silently fell back to the in-box conhost. Cargo
treats a rerun-if-changed path that does not exist as changed, so naming the
destinations makes the staging self-healing.
Found by deleting target/debug/conpty.dll and watching the next build not
bring it back.
---------
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
* feat(windows): taskbar status overlay per window (#199)
Stamp a colored status dot on each window's taskbar button using the
same palette as the in-window agent dots:
- blue while a shell command or agent is working,
- amber when an agent is waiting on the user,
- green when work finishes while the window is unfocused (cleared on activation).
Adds a `taskbar_status_icon` setting (default on, Windows only) and a
Settings -> Window & Tabs row. The overlay is updated by a foreground
poll that aggregates agent status and shell busy state across each
window's panes, diffing against the current taskbar badge and only
calling ITaskbarList3::SetOverlayIcon when the badge changes.
Includes unit tests for overlay priority and the done-while-unfocused
edge tracking.
* fix(taskbar): retry a failed overlay instead of caching it as drawn
Four fixes on top of the overlay:
- A failed SetOverlayIcon was still recorded in `shown`, so a badge the
taskbar never took was remembered as drawn and never retried. Stamp now
reports success, and a failure drops the interface so the next tick
re-creates it — which is also what an Explorer restart needs.
- `create_failed` was a permanent latch: one CoCreateInstance failure
killed the badge for the whole process, though Explorer may simply not
be up yet when the first window opens. Use the tray's attempts/cooldown
backoff instead, which this module otherwise copies.
- The overlay's accessibility description was hard-coded English in an
app that localizes everything else. Reuse the panel and tray strings.
- Render the dot at 32px, not 16. SetOverlayIcon wants 16x16 at 96 dpi,
so at 150%/200% scaling the shell upscaled a 16px icon; `tray::icon`
already renders at 32 off macOS for the same reason.
Also drops the Win32_Graphics_Gdi feature: CreateIcon, DestroyIcon and
HICON all live in Win32_UI_WindowsAndMessaging, and the build and the
taskbar tests pass without it.
Claude-Session: https://claude.ai/code/session_01H9QqEZ6JH3dGS6atEcf6ab
---------
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
Co-authored-by: l0ng-ai <ysdpk123@gmail.com>
* feat(bell): add combined visual + audible terminal bell mode
Currently BellMode only offers None, Visual, and Audible. Audible falls
back to Visual if the system bell cannot be rung, but there is no way to
intentionally get both at once.
Add a `Both` variant that rings the system bell *and* flashes the pane,
exposing it as a fourth option in Settings -> Terminal -> Bell. Existing
`none`/`visual`/`audible` values remain backward compatible.
Updates config serialization tests and i18n keys/translations/test list.
* fix(bell): align the settings copy and picker with the new Both mode
The bell description still enumerated three outcomes and the settings
search keywords omitted both, so the new mode was invisible to search
and contradicted by the row that labels it. Drop the picker's catch-all
onto the default instead of Both, which is the shape the PR just fixed.
Claude-Session: https://claude.ai/code/session_01H9QqEZ6JH3dGS6atEcf6ab
---------
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
Windows hands every process a private copy of the environment block at
`CreateProcess` time and never updates it. A tty7 daemon that has been up
since before an installer edited `HKCU\Environment` therefore gave a
brand-new pane its startup `PATH`, and the freshly installed command was
unresolvable until tty7 restarted (#333) — while a Windows Terminal
launched from Explorer found it, because Explorer rebuilds its own block
when it sees `WM_SETTINGCHANGE`.
Rather than chase broadcast messages, `daemon::windows_env` re-reads the
two hives Windows itself composes a process environment from — the
machine `Session Manager\Environment` and `HKCU\Environment` — at the
moment a pane is spawned, and pins the merge onto the pane's command.
The merge is a pure function over (machine, user, process, configured
overrides), so every semantic that matters is unit-testable without a
registry:
- Names are keyed case-insensitively, so a `Path` from the process block
and a `PATH` from a hive collapse into one variable instead of reaching
the child as two.
- `PATH` and `PSModulePath` are *combined* — machine value first, user
value appended — which is what Windows does and what keeps a per-user
install from shadowing the system half. Nothing is ever written back to
the user hive; that would bake the machine half into it permanently.
- `REG_EXPAND_SZ` values are expanded against the merged map, so a user
value naming a machine value naming a process value resolves. A
reference that resolves to nothing is left verbatim, as Windows leaves
it, and the chain is depth-bounded so a self-referential value cannot
hang the spawn path.
- The machine hive's `USERNAME=SYSTEM` is dropped, as Windows drops it.
- Directories the daemon's own `PATH` held that neither hive lists stay
reachable, appended behind the registry entries: freshening `PATH`
should only ever add resolvable commands, never take one away.
- Configured `env` overrides are applied last and win outright.
Non-Windows builds are untouched: only the registry reader and the spawn
wiring are `cfg(windows)`, while `cfg(test)` keeps the pure merge
compiling everywhere so its tests run on every platform.
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
A pane configured to run fish still advertised the login shell, because
pane_environment() injected TERM, the TTY7_* markers and TERM_PROGRAM
but never touched SHELL -- so the pane inherited the GUI session's
login-time snapshot of it. Everything that spawns "the user's shell"
read that: tmux's default-shell started zsh inside a fish pane, and so
did sudo -s, an editor's shell escape, and any coding agent picking a
quoting dialect from $SHELL. The failure is silent -- fish rejects the
bash line, the agent's sentinel file never appears, and the rejected
text stays in the line editor to concatenate onto the next send.
Inject SHELL alongside the other markers, set to the absolute path of
the program the pane is about to exec. That program is read off argv
rather than off the shell tty7 resolved: an argv-replacing integration
injection and the parent-shell override both rewrite argv, while
CommandBuilder::get_shell() keeps answering the passwd entry.
Only an absolute path is ever written. A configured command may be bare
(the inventory keeps it bare so PATH decides which install wins), and
consumers exec $SHELL under a PATH of their own, so a bare name is
resolved against the PATH the pane will inherit -- the user's env-block
PATH when they set one -- and skipped when that finds nothing. A stale
login shell beats a name that resolves somewhere else.
An explicit SHELL in the user's env block still wins, the same
precedence TERM_PROGRAM has: tty7 describes the pane, the user's config
gets the last word.
Windows is deliberately left out. Neither cmd nor PowerShell reads
SHELL; the tools that do are the POSIX emulations (MSYS/Git Bash,
Cygwin, WSL), and they want a POSIX path, not the Windows one this
would have to give them. That also leaves the WSL pane alone, where the
pane program is wsl.exe and the distro's own login shell is the right
answer.
Native SSH panes are unaffected: they never build a local command, and
the remote sshd sets SHELL from the remote passwd entry.
Closes#342
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
* fix(install): prefer bundled server over release download for SSH remotes
SSH remote installs used , which only checks
and ignores the server binary already shipped next
to the Windows executable. WSL already uses
to find that bundled binary.
Add to auto-discover the bundled server and
fall back to the GitHub release download only when no matching local asset
exists. Switch and to use it.
This lets the Windows installer/zip (which already stages server binaries
under <exe>/server/) satisfy SSH remote installs without hitting the network.
The explicit path keeps its strict no-fallback behavior, and WSL
remains bundled-only.
Refs: future issue/PR for bundling server binaries into Windows releases.
* style(install): fix rustfmt formatting in bundled-server tests
---------
Co-authored-by: l0ng-ai <ysdpk123@gmail.com>
* fix(windows): advertise terminal background to TUI apps
* refactor(windows): keep the background hint out of config.json
The daemon needs to know whether the window is light or dark when it
spawns a Windows pane, because ConPTY drops the child's OSC 11 query
before tty7's emulator can answer it. It was reading that from
`Config::theme` — a field nothing had written since it went dead — which
meant the GUI had to rewrite the user's `config.json` every time the
effective preset changed sides.
Move the hint to `appearance.json`, beside `machine.json` in the data
dir, and leave `Config::theme` exactly as it was. It is derived state:
written by the process that paints the window, read by the process that
has to describe it, and of no interest to the user. A file of its own
rather than a field on `Machine`, because the machine tree is owned by
the daemon and flushed on a timer, so a second writer would clobber the
workspaces and panes it had not seen. Absent, unreadable, and unparsable
all read as light — what the default preset is — so a daemon that starts
before the GUI has ever applied a theme describes the default window
instead of guessing.
Also silence the `unused variable` warning the hint parameter raised on
every non-Windows build, where the `COLORFGBG` block it feeds is
compiled out.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(ui): add GUI localization for en and zh-Hans
* feat(ui): localize search placeholders and relative time
* feat(ui): localize palette, switcher, and sftp strings
* feat(ui): localize home shortcut labels
* feat(ui): localize tray, ssh prompt, and editor strings
* feat(ui): add plural/select i18n helpers and localize sftp/settings labels
* feat(ui): localize settings search, forwards panel, and file tree
* feat(ui): localize code editor and right panel
* feat(ui): localize stop/delete workspace confirmations with plural support
* feat(ui): localize diff overlay with plural-aware summary
* feat(ui): localize pending pane, worktree prompt, and home time strings
* feat(ui): localize app menus, tray, tab strip/sidebar, and remote status strings
* feat(ui): localize switcher, file_tree, machine_mirror fallback strings
* feat(ui): localize ssh prompts, theme presets, host error wrapper, and finish remote strings
* feat(ui): localize command palette strings
* feat(ui): localize app.rs notifications, prompts, placeholders, and parse errors
* feat(ui): localize remaining theme, switcher, settings, and sftp strings
* style: cargo fmt
* feat(ui): add language selector to settings
* fix(ui): refresh locales across windows
* refactor(ui): make GUI language selection explicit
* fix(ui): localize Explorer settings after merge
* fix(ui): keep persisted theme names out of the GUI locale
A theme's name is data, not chrome: it is written into the theme YAML and
matched back with `trim_end_matches(" (custom)")`. Translating it meant a
Chinese GUI forked "Nord" into "Nord（自定义）", the next fork stacked a second
suffix on it, and the name stayed Chinese after switching back to English. The
derived-name fallback had the same problem. Both are English again.
Also in this pass:
- Give each test thread its own locale override. The locale is process-wide and
tests run in parallel, so the two tests that switched to zh-CN could flip the
language out from under another thread's English assertions.
- Rebuild the menu bar when gui_language changes in config.json, the way the
in-app picker already does — otherwise the menus kept the old language.
- Document the values the setting actually accepts. The docs still described
`auto` and `zh-Hans`, which sanitize() resets to `en`.
- Put the English words back into the Chinese search keywords for the language
setting; the other 58 keyword sets keep them.
- Drop the unused is_zh_hans helper.
---------
Co-authored-by: thomas <thomas@gmail.com>
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
* add CLI support for opening directories in new tabs
f
* feat(windows): add optional windows explorer context menus
f
* fix(gui): restore missing windows and reject lossy paths
* fix(windows): harden explorer menu registration and native path handling
* fix(cli): preserve native GUI paths on Windows
---------
Co-authored-by: thomas <thomas@gmail.com>
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
The rcfile tty7 hands to bash replays the login-shell startup chain, but
sourced ~/.bashrc unconditionally after it. A login shell never does that
on its own — ~/.bashrc arrives only because the profile that won the chain
forwarded to it, which is how nearly every ~/.bash_profile is written. The
result was the user's whole ~/.bashrc running twice per pane: banners
printed twice, completions were sourced twice, and appends to
PROMPT_COMMAND stacked up.
Move ~/.bashrc into the same first-match-wins chain. That fixes the double
source and still keeps the fallback for a $HOME with no profile at all.
The existing test only asserted the rcfile mentions ~/.bashrc, which the
buggy version satisfied too. Add one that runs real bash against a
throwaway $HOME whose .bash_profile forwards, and counts the sourcings.
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
$SHELL is a snapshot the session inherits at login, so chsh never moves
it -- a GUI launch keeps reporting the shell that was current when the
user logged in, and goes on doing so until they log out. The window's
shell menu marked the wrong entry "default" for that whole stretch.
Read the passwd entry instead, via getpwuid_r -- the reentrant form,
since getpwuid returns a pointer into a shared static another thread's
lookup can overwrite. $SHELL stays as the fallback for the rare case
where the lookup fails. The three callers that each reached for the
variable on their own -- the default-name lookup, the PATH enrichment
that runs the login shell at startup, and the shell-integration kind
probe -- now share the one function.
Same commit fixes who wins a name in the menu. Candidates were login
shell, then /etc/shells, then $PATH, and dedupe keeps the first -- so
on a machine with a Homebrew bash, /etc/shells listing /bin/bash first
handed the entry to macOS's 3.2 from 2007, old enough that
bash-completion 2.x will not load against it. Probe $PATH before
/etc/shells and widen the probe list to the POSIX shells, so the menu's
"bash" is the binary typing bash would reach; /etc/shells still catches
anything installed off $PATH.
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
When a pane inherits no locale at all — the usual case for a GUI-launched
process on macOS — we derive an installed UTF-8 locale and inject it. But
we injected it as LC_CTYPE, which backs only character handling. Collation,
time and numbers stayed at C, and a shell that asks setlocale(cat, "") per
category finds no variable for the rest: bash warns
setlocale: LC_COLLATE: cannot change locale ()
once per category on every launch. zsh and fish swallow the failure, so
they merely look fine while being just as half-configured.
LANG backs every category and still loses to any LC_* the user's own rc
files set afterwards, which is what a fallback should do. LC_ALL would also
cover everything but would override those.
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
Some Windows shell brokers enforce `ProcessRedirectionTrustPolicy` on what
they launch. The daemon inherited it, every ConPTY shell under the daemon
inherited it in turn, and PowerShell could then no longer traverse a
user-created junction — which is exactly what Scoop's `current` links are.
`oh-my-posh` and `fzf` died with `Shim: Could not determine if target is a
GUI app`. Windows Terminal was unaffected because its process tree never
picked the policy up.
The policy cannot be relaxed once enabled, so the fix is to not inherit it:
when tty7 detects the enforcing bit, it creates the daemon with
`STARTUPINFOEXW` and `PROC_THREAD_ATTRIBUTE_PARENT_PROCESS` naming the
interactive desktop shell, which supplies the ordinary desktop token, device
map, and mitigation policy. The Win32 code stays isolated in
`daemon/spawn/windows.rs`, and the ordinary path still runs whenever the
policy is absent — or whenever the desktop shell cannot be borrowed, in
which case tty7 logs a warning and starts degraded rather than not at all.
Because naming a logical parent makes handle inheritance follow that
process, the daemon starts with no standard handles. `daemon::server` and
the pane reader's trace line now write to stderr in a way that tolerates
that, instead of `eprintln!`, which panics on a failed write.
ConPTY exit ordering: the process-exit monitor could observe a short-lived
shell exiting before the reader had delivered its final frame, so `Exited`
reached clients ahead of the output that preceded it. The monitor now
releases the pseudoconsole and lets the reader — which reports only after
forwarding everything up to EOF — announce the death, with a bounded window
behind it for the case where EOF never arrives because a grandchild holds
the ConPTY output pipe open.
Note this changes the daemon's token on the clean-parent path: it derives
from Explorer, so an elevated tty7 starts a medium-integrity daemon.
Co-authored-by: ARNO <ArnoChenFx@users.noreply.github.com>
capture_plain_returns_text_not_escapes gated its byte-level asserts on
the marker reaching the rendered capture, then asserted the raw capture
already carried a CR. The two captures are separate snapshots taken in
sequence, and on Windows ConPTY re-emits the echoed command in
escape-laden bursts: the marker can render (from the typed input line)
while the slightly earlier raw snapshot has yet to see a single CR —
Enter's CRLF only arrives with the command's execution. CI hit exactly
that window on x86_64-pc-windows-msvc.
Make the CR part of the settle condition the loop polls for, alongside
the marker, and name both in the timeout message so a genuine
CR-stripping regression still reads as one.
Co-authored-by: l0ng-ai <ysdpk123@gmail.com>
Three holes in the wait primitive, all of which make a delegation loop
answer with something other than what it asked for.
The agent status the server keeps is a level, not an event: `done` stands
until the next turn begins, `waiting` until the agent moves again. A wait
issued right after a `send` therefore returned last turn's state before
the worker had even read the input, and a second task in the same pane
matched `--until done` instantly. `--changed` snapshots the position the
wait arrived at — status plus the activity counter, which ticks even when
the status letter does not — and refuses to match it; the JSON carries
`stale` so a plain wait can tell whether the answer might be a leftover.
`exit` was unreachable for any pane that had ever had an agent: the
snapshot has no liveness in it, and the daemon keeps a dead pane
registered until it is closed. A worker that crashed mid-turn reported
`working` until the timeout. Liveness is now re-checked from the tree
every few polls; the fast path where the first poll already answers still
costs exactly one request.
The "pane exited before reaching the awaited state" branch built its JSON
and then threw it away on an anyhow error, leaving `--json` with nothing
to read and the exit indistinguishable from an unreachable daemon. It now
exits 1 with its report.
Also: the wire spelling of a state is written out instead of derived from
the variant name, the sleep no longer overshoots a near deadline, an
absurd `--timeout` cannot overflow, and `--interval` is range-checked at
parse time rather than silently clamped.
* feat(cli): `tty7 wait` + the agent-coordination note
The two pieces of the original session-CLI PR that main's own CLI
doesn't cover, rebuilt as a minimal delta against it.
`tty7 wait %N --until waiting,done --timeout 600` blocks until a pane's
agent reaches a requested state — the orchestration primitive that lets
one agent sleep until its peer blocks on a permission prompt or
finishes a turn, instead of screen-scraping. A poll of `AgentStates`
rather than an `events` subscription on purpose: a one-shot stateless
question composes into scripts, survives a server restart mid-wait, and
needs no cursor management. Agentless-but-live panes read as idle via
the machine tree; a dead or vanished pane reads as exit, which ends
every wait (matched only when asked for). Timeout exits 124, the
`timeout(1)` convention.
The coordination note is discovery for the whole CLI: a marked,
idempotent block describing the verbs, installed into
~/.claude/CLAUDE.md (always; CLAUDE_CONFIG_DIR honored) and
~/.codex/AGENTS.md (only when ~/.codex exists). A one-time "Let your
agents coordinate?" prompt fires the first time a pane detects a coding
agent; a Settings → Agents switch drives the same install/remove, with
state read from the files themselves. Uninstall strips exactly the
marked block; an unterminated block is left alone rather than truncated
at a guess.
* feat(agents): replace the global note with an orchestration skill
Per review: global instructions tax every session's context and hand
every agent — workers included — the ambient authority to orchestrate
its neighbours. The common shape is primary → workers: one agent owns
decomposition, dispatch, waiting and aggregation; workers just do
bounded tasks.
A Claude Code skill fits that exactly. `core::orchestration_skill`
installs ~/.claude/skills/tty7-orchestration/SKILL.md — only its
one-line description rides in context until the user or the primary
agent explicitly invokes it, and workers never see it. The body can
therefore afford the full delegation loop (tab new → send → wait →
answer-or-capture → pane close) instead of a token-starved cheat
sheet.
The file is wholly tty7-owned: install is a plain overwrite (also the
version-refresh path), and uninstall keys on an ownership marker so a
user's hand-written skill under the same name is refused, not deleted.
Gone with the global note: the first-agent-detected prompt, its config
flag, and the CLAUDE.md/AGENTS.md writers — the Settings → Agents
switch now drives the skill install instead.
---------
Co-authored-by: l0ng-ai <ysdpk123@gmail.com>
pane_title_of() picked any non-empty PaneRecord.title, but an idle
terminal's foreground process is just the shell itself (zsh, bash, ...).
That made almost every idle-shell workspace show up as "zsh" in the
sidebar instead of the far more useful cwd/repo-derived name, which
defeats the "cwd as final fallback" intent of this change.
Skip bare shell process names when picking a pane title, so the
process-name fallback only kicks in for genuinely distinctive
foreground processes (nvim, an agent, ...).
l0ng-ai
l0ng-aiandl0ng-ai
ARNO
ayamir
cwatanab
Hongwei Qin
ayamir
yetoneandl0ng-ai
shihuaidexianyu