mirror of
https://github.com/l0ng-ai/tty7.git
synced 2026-09-22 00:02:23 +00:00
fix/ssh-dead-ends
194
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 l0ng-ai
|
2d2cdb851d |
feat(forwards): switch a port forward off instead of deleting it (#437, #439)
A forwarding rule could be added and removed, and nothing in between. A service that is only up part of the day meant deleting the rule and typing it in again, twice a day, forever. - A saved rule carries an `enabled` flag. Off keeps the rule exactly as it was written and simply does not offer it to the far side. The settings row leads with the switch — it is the one control that decides whether the rest of the row means anything — and fades when it is off. The section header counts what the connection will open and what it will not. - A live forward can be switched off from the Forwards panel. The far side has no such thing as a paused listener, so this is a remove that keeps the rule: the row stays, faded, with the switch that puts it back always visible. A rule whose port has since been taken stays off and says why instead of vanishing. - Opening Add no longer greets you with a red line. The panel seeds the bind host with 127.0.0.1, and the blank-form check read that as typing, so every Add opened under a complaint about a form nobody had touched. - The address field on the SSH page's empty state was a 24px pill: `flex_1` under a parent chain with no width of its own resolves against nothing. It declares its width now, and the placeholder that explains the page is readable again. |
||
 ARNO
|
4f1e181bdf |
feat(shell): give Nushell panes OSC 7 cwd tracking and OSC 133 marks (#637)
* feat(shell): give Nushell panes OSC 7 cwd tracking and OSC 133 marks feat(shell): give Nushell panes OSC 7 cwd tracking and OSC 133 marks Nushell was the only detected shell with no integration: shell_kind never matched `nu`, so panes were spawned with no OSC 7 cwd reports and the daemon could not follow `cd` — pwsh, zsh, bash and fish all do. Recent Nushells emit their own OSC 133 marks and a Windows `OSC 9;9` cwd protocol, but tty7 only consumes OSC 7, and the native `shell_integration.osc7` toggle defaults to off. The injection rides `nu --config` (Nushell has no ZDOTDIR analogue): a throwaway config.nu sources the user's own config.nu back in first, then appends hooks. `source` is a parse-time construct in Nushell — it cannot be guarded at runtime or name a missing file — so the Rust side resolves the path with the same rules `$nu.default-config-dir` uses (APPDATA / XDG / HOME) and substitutes a literal, or a no-op line when there is no config.nu. The hooks report cwd (OSC 7, %-escaped, `/C:/…` shape on Windows), prompt start (A) and the previous command's exit (D, gated on a flag the pre_execution hook arms so the first prompt emits nothing), mark command output (C), and wrap prompt_indicator for the prompt-end mark (B) only when the config defines one — recent Nushells' built-in prompt keeps drawing its own indicator and B mark, and overlapping marks merge in the daemon's prompt-state machine. Remote SSH and WSL panes are unchanged: their bootstraps cannot carry a Nushell config, and a nu-as-login-shell session would break on one. Tests: static assertions on the script, setup dispatch, literal substitution, and a Windows real-PTY cycle asserting OSC 7 follows `cd` and every mark arrives with the correct exit status. fmt * fix(shell): resolve the Nushell config dir the way nu does The wrapper's `--config` replaces the user's config.nu entirely, so the path it sources back must be the one nu itself would load — anything else silently strips macOS panes of their prompt, aliases and keybindings. `dirs::config_dir()` is `~/Library/Application Support` on macOS, not `~/.config`, and nu-path consults `$XDG_CONFIG_HOME` on every platform (Windows included) but only when it is non-empty and absolute. The resolution now mirrors that: a per-platform default plus XDG winning only in the exact shape nu accepts. Also gate the OSC 7 backslash translation on Windows (`$nu.os-info.name`) so a Unix path with a literal backslash survives, and harden the real-PTY tests: one line per submitted command (reedline drops input while a command runs) and a grace period after the D mark so the cwd report that follows it in the same prompt cycle lands in the transcript. |
||
 l0ng-aiandl0ng-ai
|
f08d8c2764 |
fix(remote): stop the server on machines that have no /proc, and show the install on the strip (#627)
* fix(remote): stop the server on machines that have no /proc, and show the install on the strip Restarting the remote server timed out after ten seconds on every Mac and BSD, with the old daemon still running and the new binary already sitting next to it, unlaunched. Both the probe that finds the running `tty7-server-*` and the command that terminates it walked `/proc/[0-9]*` and read each `exe` symlink. There is no `/proc` there. Two things then went wrong at once. zsh is the login shell on macOS, and it aborts the whole command line when a glob matches nothing, so even the trailing `true` never ran; and `cycle_daemon` discards the result of the terminate, so a command that killed nothing was indistinguishable from one that worked. `daemon_is_serving` then answered yes until the deadline. Guard the glob behind `[ -d /proc ]` — unreached, it is never expanded, so zsh has nothing to abort on — and fall back to `ps`, whose `comm` is the full path on the BSDs. It cannot be the only branch: Linux truncates `comm` to 15 characters, one short of `tty7-server-c7p5`, which is why `/proc` stays the first choice where it exists. `check_running_build` reads the same probe and was equally blind on those machines; it can see now. Separately, the install progress bar only ever existed inside the switcher. Pressing Update Server from a parked workspace with no switcher open froze the window for the length of the download and then produced a modal, with nothing in between. The strip draws it too now — caption and bar from the same source the switcher uses, and no button while an install is in flight, since pressing it again would start a second one on top of the first. * fix(remote): say why a stop failed, and stop a leaked install from eating the strip's button Three things the no-/proc fix left standing. `cycle_daemon` still discarded the terminate's result, which is the other half of why a Mac cost a bug report: the command ends in `true`, so anything short of success means the far end never reached the kill at all, and that is exactly what a zsh abort looks like. It is now logged, and named in the timeout error — "the running remote daemon did not stop within 10s" on its own blames a daemon for ignoring a request nobody managed to send it. The strip hides its Update Server button whenever an install is in flight, which is right, but it reads the progress registry with no link state to temper it — unlike the switcher. `finish_connect` bows out before clearing that entry whenever `connect` has moved on in the meantime, and a switcher disconnect or a move to another workspace both do that mid-install. The leftover froze a progress bar on every window pointed at the machine and took away the one button that could have fixed it. Cleared where the attempt actually ends instead, however it ended. The switcher kept its own copy of the progress bar after the caption was shared; it draws the shared one now. Tests: the probe runs for real in every shell on the machine rather than only parsing under `sh -n` — the glob that started this was valid syntax and only fell over when zsh ran it, which no `-n` can see. `ps` is checked on its own where the fallback would actually be taken, since that arm eats its own stderr and a rejected flag would otherwise cost nothing visible. And a stop that fails is asserted to reach the error. `with_shutdown_timeout` exists so that last test does not sit out ten seconds. --------- Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com> |
||
|
l0ng-aiandl0ng-ai
|
52b823a9f3 |
test(history): stop the sweep test deleting the panes of tests running beside it (#638)
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com> |
||
 webdev
|
7fded5afd4 |
fix(tree-sync): record the panes a window seeded in its own mirror (#628)
A window's mirror of its machine held no `PaneRecord` for a pane the window itself created. Records ride inside layout deltas and a client is left out of the deltas its own ops raise, so the record the daemon mints when it registers a seed reached every window but the one showing the pane; `PaneFacts` closed the gap only when a fact changed, and a pane spawned into its directory and left at its prompt never changes one. The workspace answered no subject path, an unnamed one read "Untitled", and `record_geometry` stamped a null subject over the path views.json remembered. The window knows what it seeded, so it now puts those records into its own mirror through the same `PaneSeed::into_record` the daemon mints with — opened up rather than duplicated, so ssh-secret stripping stays shared — with the window's own Ready terminals standing in for the daemon's liveness probe. The write is insert-only: a record the mirror already holds came from the machine and outranks what a seed knows. Also closes the race that reopened the same symptom by another route: a `MachineGet` already in flight installed its tree whole and took the client's not-yet-acknowledged writes with it, and nothing re-inserted them until the next non-empty op. All four optimistic writers now go through one path that keeps each write for the life of a pull in flight and replays it over the tree that lands. The tree stays authoritative for everything it speaks about — only the ops it was built too early to know are put back on top, and the journal is drained once it has landed, so nothing a later tree dropped is resurrected. This covers #604's pushed tabs and workspace ops, not only the seeded records. Fixes #612. |
||
|
webdev
|
84a424006e |
fix(resize): defer the reflow to the daemon's Size echo on remote routes too (#632)
Since #415 the daemon echoes a `Size` frame at the stream position where the pty changes geometry and the client defers its grid reflow to that marker — but only on local routes, so a remote pane resized mid-flood still parsed queued old-width bytes into the new-width grid, which network transport makes worse. Rather than probing `Version` per pane (a whole routed connection, and for ssh/WSL a whole bridge process, on every spawn and attach), the server advertises the pane protocol's features on its control hello. The answer is cached on the link and read off the host when a pane's route is built, and the route carries it to the terminal at spawn, attach and relink. This is additive within `CONTROL_VERSION` 7: no new field, just extra names in the existing `ControlHelloOk.features`, so an older client cannot choke and an older server that names no echo makes the client reflow at request time as before. A route built while the link is down answers false. Known limitation, inherited from #415's design and not introduced here: there is no timeout if a promised echo never arrives — once deferred, a later identical resize neither re-sends nor reflows, so a wrongly-set bit would freeze the grid at the old geometry. Every traced path makes the control hello and the pane daemon the same build, normally the same process. Closes #416. |
||
|
webdev
|
422808191d |
feat(sidebar): group a tab by its folder when its cwd is not a repo (#631)
`sidebar_grouping` gains a third, opt-in mode, `repo-or-directory`: group by repository home as before, and when the repo probe has landed and answered "not a repo", group under the cwd itself instead of filing every such tab under Scratch. A probe that has not run yet resolves to no decision, so a tab keeps the group it already has rather than bouncing through Scratch mid-probe. The decision lives in one `resolved_group` free function shared by the per-frame key derivation and spawn-time seeding. The default (`repo`) and flat modes behave exactly as before, and an unknown value in an existing config still degrades to `repo`. Knock-on: `machine_mirror::subject_path_of` names a window after its most common group, so in the new mode a window of plain shells takes its name from the most common directory rather than from the first pane's cwd. Closes #620. |
||
|
webdev
|
0346e35b40 |
fix(shell): stop injecting into a zsh or fish the user gave arguments to (#629)
The zsh and fish arms of `shell_integration::setup` never checked `has_custom_args`, so a shell the user launched with their own arguments was injected anyway — fish had `-C <script>` appended to its argv, zsh had its ZDOTDIR swapped. Both arms now sit behind the same gate bash, PowerShell and WSL already used, hoisted to a single early return ahead of the dispatch so a new ShellKind cannot silently reintroduce the bug.
Docs now describe what the code does: the `shell` row's own `{"program": "fish", "args": ["-l"]}` example loses integration under this rule, and the shell-integration note distinguishes user-written arguments from the ones detection supplies (Git Bash, WSL).
Part of #624; the native-input-mode half is separate.
|
||
|
l0ng-aiandl0ng-ai
|
72db26d15a |
feat(prompt): let the shell's own line editor own the prompt (#633)
Closes #624 tty7's inline editor takes the prompt the moment OSC 133 reports one, and until now the only way to keep it off was to hide the shell's own name from tty7 so integration never armed — which costs the prompt boundaries, cwd and exit codes as well. Someone who binds `history-beginning-search- backward-end` to Up in their zshrc had no way to reach it, and the local history the editor walks instead is per-view: a command run in one pane is not in another's list, so the shell's shared history looked broken too. The new `prompt_editor` switch (Settings -> Input -> Prompt, on by default) hands the line back. Off, every key at the prompt goes to the PTY, so ZLE / readline / fish do the editing and what the user bound behaves as written. Shell integration is untouched by it. The gate is one line in `input_inactive_reason`, which every path that could take the prompt from the shell already asks: keys, IME commits, paste, Tab, the completion and reverse-search menus, the input bar. That is what makes this a mode rather than a special case per key. `shell_owns_prompt` learns the flag too, and that half matters more than it looks: the gap hold and the typeahead record both exist to feed the local editor, and `flush_typeahead` sends ^U to erase the line before moving it there — on a line only ZLE is editing, that erases the user's work. Ctrl-R landing on the PTY also stops raising the missing-integration notice: the shell owning it is what was asked for. Turning it off mid-line hands what is typed to the shell the way an unknown chord does, so the text is still on the prompt to finish. Live panes follow the switch, including a hand edit of config.json in another window. Tab completion and history search are menus tty7 opens inside that editor, so the page greys them out and says why while it is off. Only their text dims — a switch already draws its thumb at 35% when disabled, and dimming the row on top of that leaves a pill with nothing visible in it. Their stored values are left alone and come back with the editor. Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com> |
||
|
l0ng-ai
|
1424da0891 |
fix: nine UX fixes across the diff overlay, layout, settings and pane spawn (#623)
Found by driving a dev instance and measuring what an idle window costs. Two of them were frame loops that never stopped. A `Head` diff overlay calls itself stale when the cached git status disagrees with the snapshot on screen, and every landed probe wakes that check by touching the cache — but the read published its counts and left the branch behind, so a branch switched outside tty7 made the disagreement permanent: two `git` processes a lap, forever, with `refreshing…` pinned to the header and an idle window at 7% of a core. And the home page asked for a frame sixty times a second to change one glyph's opacity twice, which made a window with nothing open in it eight times more expensive than one running a shell. Both now settle: the diff read publishes the branch it found, and the home cursor flips a bool on a timer the way the terminal's own does. The rest: - The tab sidebar and the right panel each capped themselves at half the window and knew nothing about the other, so together they could take all of it — 260 points of terminal on a 720-point window. Both now cap at whichever binds harder: half the window, or what is left after the terminal's floor and the other panel's floor. The same cap bounds the drag, so a panel dragged to its limit stays where it was dropped. - Only a HEAD diff may correct the sidebar's counts. Those numbers mean `git diff --numstat HEAD`; an unstaged or staged patch answers a smaller question, so opening an untracked file from the Source Control panel took the staged lines off the total on the click. - An untracked row in the diff overlay had no click target, and once focused could not be left — the breadcrumb looks the path up in `files`, where an untracked file has no entry. Both ends fixed. - A new pane keeps the name its directory was reached by. `cwd()` alone loses it: the shell falls back to `getcwd()`, so `/tmp/x` became `/private/tmp/x` in every tab opened from the first. `PWD` carries it, and POSIX has the shell discard a `PWD` that names the wrong directory, so this can correct the name and cannot invent one. - The settings search now sees into the Keybindings page, which is generated from the binding table rather than the static index — so searching for a feature finds its shortcut, and the page filters to the matches. Closes #444. - The settings reading column is centred rather than pinned to the nav: on a window as wide as the display it was made for, 640 points of settings sat beside 1600 points of nothing. - `New Workspace…` takes the ellipsis its three sibling actions already carry — it opens a form asking for a name and a host. Every fix has a test. The re-probe loop is pinned end-to-end with `render_probe::draws() == 0` against a real repository, confirmed to fail on the old behaviour before it was kept. |
||
|
l0ng-ai
|
84f9d54ad6 |
fix(remote): finish the create a server update interrupted, and retire the note it answers
Creating a workspace on a machine whose server is the other side of a dialect bump took two creates and two update clicks in different places. Two holes in one flow: The create parked on the connect died with the refusal — finish_connect's Err arm dropped pending_create — so the update the refusal band offered ran to completion and then nothing happened: no workspace, and nothing left for any reconnect to finish. A create refused for the dialect now moves aside to parked_create, the replacement's success connects at the machine again, and whichever connect finally lands spends it, name and all. Dismissing the refusal or disconnecting the machine still calls the create off; every other failure does too. The mismatch note recorded during that failed attempt outlived the very replacement that answered it: the queue is only drained after a successful connect, so the next one raised "update this server?" about a server that was already updated — and confirming killed the fresh daemon all over again, sessions and all. reconnect_after_restart now retires the origin's notes the moment a restart or replacement lands. Three tests, each confirmed to fail without the change it guards. The end-to-end one drives finish_connect against a real control server over a socketpair, so the parked create is spent by the same code path a live reconnect uses. |
||
|
l0ng-aiandl0ng-ai
|
8296161b4a |
fix(remote): give a dialect refusal a way out instead of a retry loop (#617)
* fix(remote): give a dialect refusal a way out instead of a retry loop A remote workspace whose server is the other side of a control-dialect bump reconnected forever: the strip quoted the protocol layer's own wording verbatim inside a localised sentence, offered Retry Now, and counted attempts at 30s intervals. Retrying cannot work — neither build changes between attempts — and the only Update Server button lived in the switcher's error band, which a window that opens straight onto the remote workspace never reaches. Park the link on a refusal and put the working action on the strip. Restart Server now routes to the replace flow when the far end speaks another dialect, because restarting was the wrong action there twice over: it killed any running tty7-server-* and then launched the path named after *this* build's dialect, which on such a machine does not exist. Installer::restart_daemon now probes that binary before killing anything and refuses when there is nothing to start. CONTROL_VERSION moves to 7 with no message change, so the refusal path can be exercised against the v6 servers already deployed. * fix(remote): recheck a parked link, and name a downgrade a downgrade Review follow-ups on the dialect-refusal parking. `is_dialect_refusal` was a substring sniff on the marker while every reader of a `true` went on to parse the whole shape. Two predicates for one question, and the weaker one decided whether to park a link that only a person could free. It is the parse now. A parked link never looked again. `RouteLost`, the state it was modelled on, is re-tested every tick and comes back by itself; this one could not, so a machine somebody else updated — or one that rebooted onto a build that does speak to us — sat there claiming to be broken for the rest of the session. It looks again every five minutes: a slow clock, deliberately two orders of magnitude off the reconnect one, and the strip says nothing while it does. `retry_now` cleared `last_error` for every caller, so pressing Retry Now on an unreachable machine cost the user the reason why until the next attempt finished. Only leaving a park clears it. The one button read Update Server in both directions, including the one where installing our server takes the far end back a version. That direction reads Replace Server, and the confirmation it opens offers the same word the button did rather than renaming the act between the click and the prompt. The switcher's band gates that button on `hosts_our_server` as well now, the way the workspace strip already did. `a_dialect_refusal_parks_the_link_instead_of_counting_attempts` passed without reaching what it named: an `Alias` resolves only if the machine running the tests has that name in its ssh config, and the pump drops an unresolvable route before it reaches any parking. It uses a target that always resolves now, and both new pump tests were checked against a mutation that removes the recheck. --------- Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com> |
||
 
|
b2d73ec68b |
feat(update): update an all-users Windows install through one UAC prompt (#562)
* fix(update): surface a failed install instead of silently re-prompting (#540) The GUI quits as soon as tty7-updater is spawned, so an install that failed inside the helper left a trace only in update.log — and because launching the helper had already cleared the prompt state, the next check offered the same version again, and again. The failure mode the user saw was an app that nagged about an update it could not install. The helper now writes update-outcome.json beside update.json on every terminal path it can still reach, and the next GUI launch folds it into the update state: a failure shows in Settings with the installer's own reason until dismissed and stops the version from re-prompting on its own; a success at the running version retires a failure an earlier attempt recorded. A leftover result that exists but cannot be parsed is reported rather than dropped — something ran, and "unreadable" is a result too. The same change moves the config directory off the environment and onto the command line (--config-dir). An elevated child process does not inherit the spawner's environment, so TTY7_CONFIG_DIR would have fallen back to the administrator's config directory exactly in the over-the-shoulder case — the groundwork this lays for #504. The updater re-exports the variable for the helper children it spawns itself, so the relaunched app keeps answering for the same config directory. * feat(update): update an all-users Windows install through one UAC prompt (#504) An Inno install under C:\Program Files could not be replaced in place: the updater ran the release Setup as the signed-in user, which either installed a second, per-user copy beside the real one or let Inno re-launch itself elevated — a bare UAC prompt for an unsigned executable in %TEMP%, seconds after the GUI had vanished. So the layout was refused outright and told to download by hand. It now updates itself, with the split the design in #504 settled on: one UAC prompt covering two privileged stages, and one watcher that is never elevated at all. - The GUI probes the *installed* updater for the new verbs by running it ("capabilities"), so a side-loaded or downgraded binary answers for itself instead of being trusted by version number. An updater that predates the verbs exits with a usage error, and the install falls back to pointing at the release page exactly as before — the first release carrying this still updates the old way, and the one after it updates itself. - The prompt dialog says the UAC prompt is coming before the app quits, and stops offering "Install on Next Launch": nobody is there to answer a prompt before the first window exists. The same guard keeps a staged plan from being armed for the next launch, and apply_pending_at_launch leaves an elevation-needing plan staged rather than raising a windowless prompt at boot. - "Install now" spawns the watcher first (medium integrity, the signed-in user's token, so the relaunched app is never elevated), then ShellExecuteEx "runas" on the installed updater — the trust root a medium-integrity process cannot rewrite. Everything the elevated half needs crosses as command-line arguments, because an over-the-shoulder child inherits neither the environment nor the user's profile. The package's expected SHA-256 crosses the same way, from the checksums the GUI already holds in memory, so a payload and its checksums file cannot be rewritten together behind the IL boundary. - The privileged first stage re-verifies the payload against that digest, pins its helper byte-for-byte to the installed updater, stages both in a fresh administrator-only %ProgramData% directory (an explicit SDDL DACL, swept of stale directories first), and only then runs the install stage — which runs Setup silently, writes the outcome file, and never touches the app binary itself. The watcher follows the chain through the status file and pid liveness (ERROR_ACCESS_DENIED from OpenProcess still means "alive" across accounts), then relaunches the app de-elevated and probes that it actually came up. - Declining the UAC prompt is not an error: the watcher is reaped, nothing ran elevated, and the staged package simply waits in Settings. Persisted plans from before this protocol serde-default a plan version that is_usable rejects, so a stale plan is discarded instead of failing against a helper that would not understand its arguments. The installer script's explorer-menu registration gains skipifsilent: a silent run *is* this update path, and launching the app there would write the menu into the administrator's hive under over-the-shoulder elevation. One note on the test suite: ui::remote_connect's a_routed_auth_prompt_carries_the_machine_that_raised_it fails under parallel test execution on this machine both with and without this change — a pre-existing flake, unrelated. * fix(update): run the UAC request off the UI thread Real-machine verification of the elevated chain caught this on the first click: ShellExecuteExW pumps the calling thread's message loop while the shell raises the consent prompt (its change notifications re-enter the window), and from the UI thread that re-enters gpui with its App already borrowed — the process aborts on a RefCell double-borrow before anything ever elevates. The launch — watcher spawn included, so the pairing stays atomic — now runs on the background executor, and only the bookkeeping (quit / decline / failure) comes back to the UI thread. * fix(update): throttle a failed version instead of retiring it (#540) Per the review on #540: a failed install must not keep the version retired via last_prompted — record last_prompted plus a fresh remind_after deadline (the same three days "Later" uses), so the version asks again once the reminder expires. should_prompt already treats "last_prompted matches, reminder expired" as prompt-again, so no logic change is needed there, and the pinned a_failure_lets_the_version_prompt_again test still holds. Also write update-outcome.json *before* relaunching the previous app on the macOS/Windows/portable non-elevated paths: the GUI that comes up next is exactly the process that absorbs the outcome, and it used to be relaunched before the failure existed on disk. The elevated chain is unchanged — its watcher already waited for the file. * fix(update): let only the elevated updater's own image name the trust root Three holes on the privileged side of the #504 chain, all of the same shape: a value that decides what runs elevated was taken from the medium-integrity caller. - `elevated-stage` pinned the staged helper against `<install-dir>\tty7-updater.exe`, where `<install-dir>` is a command-line argument. Both halves of that comparison were the caller's to choose: name a directory holding two copies of any binary and the pin passes, then stage 2 runs it elevated. The stage now derives the installation from its own image — UAC pointed the prompt at `{app}\tty7-updater.exe`, so `current_exe` is the one path nothing below the boundary could have written — and passes that on to stage 2. A caller that named a different directory only gets a line in the log. - The staging directory's DACL let no standard user in, but its parent did: `%ProgramData%` grants Users the right to create directories, and the creator owns what it creates. A pre-created `%ProgramData%\tty7` gave its owner delete-child over the administrator-only staging inside it — enough to rename the verified staging aside and drop an identical name of their own into the gap between the digest check and the execute. The root is now created with the same protected descriptor, taking down whatever holds the name first; `CreateDirectoryW` applies a descriptor only when it is the one creating the directory, so succeeding is the proof. The per-run sweep goes with it — the root's removal takes the leftovers. - The GUI aimed the prompt at the updater the *plan* named, and `update.json` sits in the user's config directory. It now aims at the installation this process runs from, so the binary the prompt names is the binary that starts. Also quote the elevated command line the way `CommandLineToArgvW` reads it back: a backslash escapes only in front of a quote, so a config directory ending in one used to escape its own closing quote and swallow every argument after it, `--result-file` — the file the watcher waits on — included. * test(update): pin the elevated stage's trust root to its own image A regression test for the shape of the hole rather than the hole: if `installed_root` ever goes back to reading an argument, the pin the elevated stage runs before executing the staged helper stops meaning anything, and nothing else in the suite would notice. * fix(update): bring tty7 back when the elevated chain never reports The watcher's two timeouts returned without relaunching. Every other way out of the chain ends with the app back on screen, but a stage 1 that died before writing its status or its outcome — killed, crashed, an AppInfo service that never delivered it — left the user with the GUI already quit, nothing to replace it, and nothing said. Same for an install still running an hour later. Both paths now end the way the others do: an outcome the watcher wrote itself, then the relaunch. The synthesized outcome is written whether or not the relaunch succeeds, which also closes the same gap on the pre-existing "the elevated updater exited without recording a result" path — the next launch can name what happened instead of silently offering the version again. What kept those paths from relaunching was the risk of a second window beside a GUI that is still up: a declined prompt leaves this process running, and the kill that reaps its watcher can lose. The watcher now takes the GUI's pid and opens a handle to it at startup — while the GUI is provably alive, since it is sitting in ShellExecuteExW waiting on the prompt — so the number cannot be recycled out from under it. Before relaunching, a GUI that is still alive is waited out for 30 seconds: one that is quitting (a chain that failed fast can beat it out the door) is gone well inside that and gets its relaunch, one that is staying is recognized as staying and gets neither a relaunch nor a failure record it did not earn. A live process always answers to its own pid, so the check cannot be wrong in the direction that double-launches. Also give the Japanese elevation notice its closing 。 * fix(update): poll the parent out across the elevation account boundary Under an over-the-shoulder elevation the install stage runs as the administrator, and OpenProcess on the signed-in user's GUI answers ERROR_ACCESS_DENIED - the same boundary pid_alive already documents from the watcher's side. wait_for_exit treated that as a fatal error, so the chain recovered and reported a failure before Setup ever ran. The wait now degrades to polling the pid until it stops answering, bounded so a recycled pid cannot hold the install hostage forever. --------- Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com> Co-authored-by: l0ng-ai <l0ng-ai@users.noreply.github.com> |
||
|
Hongwei Qinandl0ng-ai
|
a2d53a9597 |
fix: 19 项低危 UX 问题（#584–#602） (#615)
* fix(scm): say what "discard all" actually discards (#594) The group-level Discard prompt asked to "discard every change in this repository", but discard_all_ops has only ever swept unstaged edits and untracked files — staged changes survive, as the function's own comment notes. Users confirmed under one belief and the code kept another. Narrow the prompt to the operation's real footprint, in all three languages. * fix(scm): keep the amend toggle when its confirmation is cancelled (#595) scm_commit cleared scm.amend when Commit was pressed, before the "rewrite the last commit?" prompt. Answering Cancel returned to a panel whose amend mode had silently been dropped, so the next Commit created a brand-new commit — exactly what the user had just declined to risk. The toggle now clears where scm.committing arms, at dispatch in run_git_op, extending the rule the armed flag already followed: a cancelled confirmation leaves nothing behind. * fix(cli): answer a wait timeout in the success path's JSON shape (#589) The 124 branch returned {pane,status,timed_out} while a finished wait returns {pane,status,matched,stale,activity,message,session_id} — so the one branch a consumer writes error handling for was the one missing its fields. The timeout now carries the full shape plus timed_out, and reference.mdx documents the schema and the flag. * fix(cli): report a failed wait on stderr, even under -q (#590) wait's failures are structured exits (124, or 1 when the pane died first), so they never passed through the anyhow path whose eprintln is the only thing quiet mode cannot silence — contradicting the documented "errors still go to stderr". Both exits now print their headline to stderr, the discipline pane close already established. * docs(cli): describe owner as the workspace that may attach (#591) commands.md still claimed the CLI stamps a literal "tty7-cli" owner on the panes it spawns — the behaviour the orphan-workspaces work removed, because an owner names the workspace allowed to attach and a stranger's stamp got the panes respawned. Every spawn path now writes the workspace id, or nothing while the pane is still unfiled. Bring commands.md in line with reference.mdx, and note the absent case in both. * docs(cli): close five contract drifts between the tables and the code (#592) - The key tables listed pgup/pgdn as aliases but not pgdown, which the parser has always taken; both references name it now. - "Case-insensitive" was flat wrong for Alt: M-x keeps its case because Alt is a prefixed ESC, unlike Ctrl. Both references note the exception. - procs' ports JSON has carried addr since the field exists; both schemas show it. - TTY7_WS is tab ls's default too; both environment tables say so. - split --ratio's clamp to [0.05, 0.95] was discoverable only in code; both split sections document it. * fix(cli): doctor exits 1 when the server is unreachable (#592) doctor is the verb people run when something is not working, so an unreachable server is *the* finding — not a row to exit 0 over while `tty7 doctor || alert` never fires. The table and JSON still go out (the context rows are the other half of what doctor is for), and stderr carries the headline under -q. MockBackend grows an `unreachable` flag so the branch is testable; no Status/Routes round-trips happen once hello has failed. * fix(settings): refuse a Start-in path that names no directory (#601) The custom path was stored unchecked, and the daemon's picker then skipped it — not a directory — so every new pane silently started in the fallback directory and the typo read as a tty7 bug. Settings now marks the field red and refuses to save, the proxy row's pattern (#551), with the red line and the commit gated on one shared predicate so they can never disagree; a hand-edited config.json holding such a path gets a log::warn! naming it at the moment the fallback engages. * fix(terminal): rescan search highlights when the pane's width changes (#586) A match point is an absolute (line, column) against the width it was scanned at, so a column change reflows the text out from under every highlight. Output rescans them (Wakeup → refresh), but a quiet local pane has no output coming and the drift outlasted the resize indefinitely. set_grid_size now rescans on a column change with the output path's discipline — selection and scroll untouched — and takes the Context it needs to do so; a rows-only change reflows nothing and stays cheap. * fix(terminal): keep the grid selection when the search bar opens and closes (#584) The selection that seeds the query is the thing being searched for, yet opening the bar ran recompute_matches' unconditional clear — right for its other callers, where the user *changed* the query and the old selection names nothing — and closing cleared it again, so select → Ctrl+F → Esc lost the selection every time. The seeded selection is now restored after the opening scan, and close_search no longer clears; a query the user actually changed still retires the stale selection, the discipline refresh_matches_after_output already stated. * fix(tabs): a zoomed pane stays zoomed across a tab switch (#599) Zoom was a window-level value that activate() cleared unconditionally, so looking at another tab and coming back restored the split layout — while a zoom is a tab's temporary view state, like its focused pane. It now rides with the Tab: activate stashes the outgoing tab's zoom and brings the incoming tab's back. The clears that genuinely reshape the layout (drag, split, close) still stand, and a stashed zoom whose pane exited while the tab was away is validated away rather than restored. * fix(tabs): track an open rename box by tree id, not index (#598) The rename box held only an index, which drifts the moment any other tab closes or the strip reorders — so close_tab_inner and apply_tab_order threw the half-typed name away on any unrelated tab event, and a reorder mid-rename still left a window where the commit landed on whichever tab had taken the index over. The box now names its tab by tree id end to end (start, render match, commit): only closing the renaming tab itself ends the rename, and the name lands on the tab the box was opened on wherever it has since moved. * fix(i18n): move seven hard-coded user-facing strings into the language tables (#602) Seven spots rendered English no matter which UI language was set: the shell-integration notice that explains why a wrapper was blocked or never engaged, the titles a pane wears once its process exits or the server loses it, the loopback forward's failure line, the tray tooltip that lists running agents (whose separator also wanted a CJK enumeration comma), the cursor-shape choices in settings, the command palette's empty-result hint, and the updater's install hint. Each is a L10nKey now with en/zh/ja entries, so the parity guard keeps them translated from here on. The palette's empty state was also wrong in content, not just language: every menu suggested connecting over SSH when nothing matched, including menus that have no hosts in them. The hint now only appears in the quick-connect menu; everywhere else the palette suggests a different search instead. Verified on Linux: the title/palette/tray suites (48 tests) and the i18n parity guard all pass. * fix(terminal): show remote path completion is listing, and say when it fails (#585) Tab-completing a path on a remote workspace had two silences. The whole network round-trip painted nothing, so a slow link read as a broken Tab key; and a listing that failed was unwrapped into an empty candidate list, so "the directory is empty" and "the listing never happened" ended in the same nothing. A pill over the pane's bottom-right corner — the style the integration notice already uses, factored out — now says the listing is running from the moment it starts, and a failed listing sets a notice with its error instead of the empty vector. The failure pill stays until the next keystroke dismisses it, and the trailing notify after an empty listing closes the menu brings the "listing…" pill down with it. Verified on Linux: the new gpui test covers the idle/listing/failed states, and the neighbouring completion tests still pass. * fix(files): quote cd Here / Insert Path for the shell the pane runs (#593) Both file-tree actions wrapped a path with spaces in POSIX single quotes whatever the focused pane's shell was. In cmd.exe a single quote is an ordinary character, so `cd 'C:\Users\me\My Documents'` split at the first space and cmd complained about 'C:\Users\me\My' — while the same action was fine in PowerShell and bash, which is why only cmd users ever saw it. shell_quote_for takes the pane's shell program (the pane already knows it — the settings page lists it) and picks double quotes for cmd.exe, single quotes for everything else; an unknown shell keeps the POSIX form, and a path that needs no quoting stays bare either way. Windows paths cannot contain a double quote, so the cmd form has nothing to escape. * fix(cli): pane close fails for a pane the registry does not hold (#588) `tty7 pane close %99` printed {"closed":[99]} and exited 0 for a pane that never existed. The workspace path cannot drift this way — PaneClose answers — but an orphan has no workspace to route through, so close hangs it up directly, and that kill is fire-and-forget: the daemon never says whether it knew the pane, so Ok(()) only ever meant the bytes reached the socket. A reaper script chasing the orphans `pane ls --all` points at would read the ghost success as cleanup done. The direct path now reads the running-pane registry once per batch and refuses ids it does not hold: the miss lands in `failed` with exit 1, next to the failures kill itself can report. A pane that exits between the listing and the kill is gone either way, which is what closing it wanted, so that race still reports closed. * fix(session): a launch that leaves workspaces running says so (#597) Quitting with several windows open and starting again restored only the most recent one; every other open window was marked detached — panes alive, nothing on screen, the only trace a "left N detached" log line. The workspaces were reachable from the sidebar, but nothing said they existed, so they were easy to forget entirely. restore_one now returns how many windows it detached, and both launch paths (normal startup and the CLI-driven open) push an in-app notification into the restored window naming the count and where to reopen them. The count rides the return value rather than firing the notification inside the store, because the store has no window to notify in — and a launch that detaches nothing, like the reattach-the-last- closed case, stays silent. * fix(switcher): list the local machine's orphan panes, with a way to close them (#596) A pane whose workspace went away — an interrupted `tty7 run`, a forgotten workspace that kept its shells — was invisible everywhere in the GUI: not in the sidebar, not in the switcher, not in the tray. It kept its process and its memory, and the only way to even learn it existed was the CLI's `tty7 pane ls --all`, which a GUI-only user never runs. The switcher's local machine group now carries a "Background panes" block under its workspace rows: one line per live pane the daemon's registry holds and no workspace does — id, owner, cwd — each with a Close button. The listing is the same PaneClient::list the CLI's reaper reads, fetched off the UI thread when the panel opens; closing kills and then re-lists, so a pane that survived simply stays on the list instead of pretending to be gone. The block steps out of the way while the search field holds a query, which narrows the panel to workspaces. Local on purpose: a remote machine's orphans belong to its own daemon, and routing a listing per host is what the CLI reaper is already for. The block joins no keyboard navigation — the panes are not workspaces and the arrows have no business landing on them. * fix(updater): keep Inno's progress window on screen during the install (#600) The Windows installer ran /VERYSILENT, so from the app quitting for the update to the watcher bringing the new build up — tens of seconds, longer under an antivirus scan — the screen held nothing at all: no window, no progress, no tray note. "Clicked update, the app vanished" reads as a crash, and double-clicking the icon does nothing while the files are being replaced. The installer now runs /SILENT instead. Nothing about the flow becomes interactive — /SP-, /SUPPRESSMSGBOXES, /NORESTART and /CLOSEAPPLICATIONS are untouched — but Inno's own progress window stays on screen for the gap, which is exactly the span the user had no word about. --------- Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com> |
||
|
l0ng-aiandl0ng-ai
|
3c0a700907 |
feat(switcher): flat workspace list, create form, connect-time workspace sync (#616)
* feat(switcher): flatten the workspace list, add a create form, sync remote listings on connect The switcher's left column is now one flat most-recently-used list across all machines, each row carrying its machine and link state; the per-machine tree, headers, and the Other Machines band are gone. Machine trouble (install progress, connect errors, parked routes) moves to contextual banners under the list, and machine verbs move into each row's menu. Cmd+Shift+N now opens a create form instead of silently swapping the workspace: a name prefilled with the usual generated codename, and a host combobox (searchable dropdown) defaulting to this computer. Creating on a machine with no live link connects first and completes when the link is up. Connecting to a machine also mirrors its workspace listing into the local store, so its workspaces survive a restart without a connection. Mirrored references are marked synced: launch restore skips them, and their clock follows the machine only until this client opens them. * fix(switcher): drop a parked create when its machine's connect is called off Disconnect clears the in-flight connect, so finish_connect never runs and the PendingCreate outlived the intent behind it: the next successful connect to that machine would have silently created a workspace nobody was waiting for anymore. --------- Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com> |
||
|
l0ng-aiandl0ng-ai
|
3cd90c6ca6 |
feat(ssh): name panes after their host, reach the host form from where you are, and test a connection (#566)
* feat(ssh): name panes after their host and reach the host form from where you are Five gaps in the SSH flow reported in #438, and the two silent no-ops around them. Panes now carry a display name: a saved host's own name, or its address when nobody named it — every host imported from ~/.ssh/config arrives nameless, and each one opened a tab reading "tty7". The name survives a title reset and a dropped link, and `strip_host_prefix` no longer cuts `deploy@10.0.0.5:2222` down to "2222" on its way to the tab strip. The host form is now reachable from the machine in front of you: the switcher's machine menu edits the host it is showing, or offers to save one for a machine reached by address or by ~/.ssh/config alias. A live connection dialled by hand can be kept as a host from the palette, with everything it was dialled with carried over — the one thing that cannot come along is an ad-hoc jump hop, and that is said out loud rather than saved broken. The New Tab menu lists the saved hosts, most-used first, and the typed address route that already understood -p, -J and config aliases. Both were behind the workspace switcher, its host dialog and the settings list. Finally, the three proxy fields are exclusive — map_proxy picks the first one filled and ignores the rest — so the ones that lose now say which field won instead of leaving it to be discovered by connecting. * feat(ssh): test a connection from the host form, and pick a host by name Three things the host form and the New Tab menu were missing. The form gets a Test button. It hands the spec to the daemon, which dials it the way Connect would — proxy, jump host, host key, auth — and drops the connection again, reporting how long it took. A test never rides an existing connection: one would answer for the credentials that connection was made with, so a password typed wrong would come back green. Anything the handshake stops to ask a person is declined on the spot and reported as what it asked for, since a form is nowhere to answer a password prompt and waiting out the two-minute prompt timeout would be a worse answer than "it got that far and wants your password". The result clears the moment a field changes: vouching for a host that was edited since is worse than saying nothing. The Auth row becomes a dropdown. Six methods is more than a segmented control can label without squeezing, and it is the row that stacks first on a narrow page. The New Tab menu scrolls — PopupMenu only does that past 20 items, and every shell on the machine plus a handful of hosts already runs off a short window — and past the five hosts it lists, Find a Host opens a filter box over all of them. * feat(new-tab): put a search box on the New Tab menu The menu is as long as the machine is — nine shells here, and a ~/.ssh/config with two dozen hosts in it is ordinary — so it needed filtering, not a scrollbar and a row leading somewhere else. A PopupMenu cannot hold a text field: it claims the keyboard for its own navigation, and there is no search input anywhere in it. So the New Tab button now opens a popover holding the same searchable list the command palette is built from, with the shells and the hosts under their own headings and one box over both. Typing filters across both groups; typing an address offers to connect to it, the way the palette does. The standalone host picker this replaces is gone with it, and the row that led there — one search reachable from the button beats two behind a menu. * revert(new-tab): put the New Tab menu back to shells only The searchable popover was the wrong shape for a button in the chrome: too big and too heavy next to the tab strip it hangs off. The menu is the plain shell list it was before this branch — byte for byte, so nothing about it needs re-reviewing — and the hosts, the search box and the row leading to a host picker are gone with it. Everything that came along to serve it goes too: the positional NewTabWithShell command, the picker's palette delegate and its compact row metrics, the standalone host palette, and the four strings they needed. Connecting to a saved host is the palette's job again, which is where it was and where it works. * fix(switcher): size and weight the machine glyphs like the icons beside them The two machine icons are drawn by hand; every other glyph in that gutter comes from lucide. Ours were built to a tighter box — ink 19.3 × 17.3 of a 24 grid against lucide's 22 × 20 — so at the same nominal 16pt the local machine rendered 11.5pt of ink beside a 14.7pt globe and read as a size smaller. Both are redrawn to lucide's extents, which also makes them agree with each other. The local machine's glyph was muted while every remote one was full strength, and while its own name was full strength either way. Beside the machine under it that read as a disabled row rather than as the computer you are sitting at. One weight for all of them now; the "Other Machines" globe keeps its dimmer register, which belongs to the muted section label it sits next to. * fix(tabs): only a port stops the host head being cut off a title Teaching `strip_host_prefix` that `deploy@10.0.0.5:2222` is an address and not a titled directory was done by requiring the tail to start with `/` or `~`. Two very common titles do neither. Debian's stock bash title is `\u@\h: \w` — a space after the colon — so `user@host: ~/work` would have stopped being cut at all, and every one of those tabs would have gone from reading `~/work` to `user@host: ~/wo…`. And tty7's own PowerShell integration writes `ann@BOX:C:/src` whenever the cwd is off the home drive, which would have read `ann@BOX:C:/src` rather than `C:/src`. Key on the port instead, which is the thing that actually makes the string an address: a tail of nothing but digits is kept whole, and everything else is the path it always was. The space belongs to the head, so the tail is trimmed on the way out. * fix(ssh): keep a connection test off the cache, off a stale form, and clear about a changed host key Three ways the new Test could answer for something other than the host in front of it. It dialled with `reuse: false` but still took the connection cache's slot lock, which is held for the whole handshake. So a test stalled every Connect to the same host behind a connection it was never going to leave them — and, queued behind a session already dialling, spent its own budget waiting and came back "connection timed out" about a host that answers fine. A test that is not going to touch the cache has no business locking it: it now skips the slot entirely, and only a reusing dial takes the guard it later fills in. The form dropped a test result whenever a typed field changed, on the grounds that the answer was about the host as it was a moment ago — but the authentication method is a dropdown, and changing it left the green line standing under a handshake the form would no longer make. And a host key that has *changed* was reported with the same words as one nobody has accepted yet. Those are not the same news: the first is a new host, the second is the server presenting a different key than the one on file. `SshTestNeed` now tells them apart and each gets its own line, in all three locales. Verified against a live sshd on localhost: refused port and unresolvable name come back in milliseconds with the connect path's own message, a password host comes back `NeedsInput { Password }` in 55 ms rather than waiting out the two-minute prompt timeout, and two tests of the same host back to back no longer serialize. * chore(palette): drop the root flag the New Tab revert left behind `grouped_root` was split out of `quick_connect_root` for the searchable host picker on the New Tab menu, which was taken back out again. Every constructor now sets the two to the same value, so the second one is a field and a doc comment describing a list that does not exist. * docs(changelog): record the SSH host form, pane names and connection test Every user-facing change in this branch: panes named after their host, the host form reached from the switcher and the palette, and Test. --------- Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com> |
||
|
l0ng-aiandl0ng-ai
|
60ef3fb758 |
fix(shell): name the user, host and home in a Unix pwsh pane's title (#611)
The PowerShell integration read its identity from USERNAME, COMPUTERNAME and USERPROFILE. Those three spellings exist only on Windows; on macOS and Linux they come back empty, so every pwsh pane there was titled `@:` followed by a full un-abbreviated path, and the `~` shortening never fired at all. Read them through .NET instead, and take home from PowerShell's own $HOME, which is correct everywhere. Nothing gated this to Windows and nothing tested it off Windows either: every pty round-trip in this module was `#[cfg(windows)]`, so a Windows-first script shipped to two platforms it had never run on. Open the harness up to Unix and give pwsh its own round-trip there. That took two fixes to the harness. It typed at spawn time, which puts the keystrokes ahead of the cursor-position reply in the same input stream — pwsh, still waiting on that reply, eats `false\r` as the answer to its own query and the command never runs; wait for the prompt-end mark before typing. And nothing was answering `CSI 6n`, which PSReadLine blocks on before it will draw anything. Enter comes in as a parameter now, because a raw-mode reader only accepts `\r` where a line-discipline shell also takes `\n`. While rewriting the home match: require the separator. With a home of `/Users/ann` a bare StartsWith also swallowed `/Users/annex`, retitling it `~ex`. Found while investigating #583, which reports a pwsh pane freezing on `ls`. This is not that bug — the injection runs clean on macOS pwsh 7.6.4 both over a raw pty and under tmux — but it is a real defect on the same untested path. Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com> |
||
|
l0ng-aiandl0ng-ai
|
6c26b35acc |
fix(control): bump the dialect to v6, and publish a tty7-server for macOS (#605)
* fix(control): bump the dialect to v6 so an out-of-date server says so The control dialect has been renamed, extended and cut since it was last numbered, all of it against CONTROL_VERSION 5: the machine tree replaced WorkspaceList/Get/Put/Delete with WorkspaceTree, MachineGet and the tab/pane verbs, GitStream arrived with its chunk and end events, and ReplyOk::Attached and FileMeta went away. A peer left behind by any of that still answers the hello, because the number it answers with still matches. It is also still sitting at the path the installer looks for, tty7-server-c5p5, so a client decides it already has the server it needs. Then the first call reaches a variant the peer has never heard of, the frame fails to decode, and the read loop takes the whole link down with it. What the user sees is a remote workspace that opens with no tabs and a git detail pane that never fills, with nothing anywhere saying why. Moving the number puts all three guards back: the hello is refused with the message that names the old build, the remote binary is looked for at c6p5 and installed rather than trusted, and a stale local daemon gets the restart prompt it should have been getting all along. Document the rule next to the constant while it is fresh: move it when a variant is added or removed. The feature strings only cover what a peer can safely ignore, and a request it cannot decode is not that. * feat(remote): publish a tty7-server for macOS hosts A remote workspace has been Linux-only for no reason anyone chose: the installer derives the asset name from `uname -sm`, and the only names it knew were the two musl builds. A Mac on the other end of an SSH profile got "a remote tty7 workspace needs a Linux host" and stopped there. Publish the two Apple slices alongside them and teach the installer to ask for them. `Darwin arm64` and `Darwin x86_64` now map to tty7-server-macos-aarch64 and tty7-server-macos-x86_64; everything past that point already worked, because nothing under it was ever Linux- specific — the install path is POSIX, the upload is SFTP, and the dialect probe runs the binary before trusting it. The machine names are matched per system rather than by architecture alone. Linux says aarch64 on one distribution and arm64 on the next, while a Mac only ever says arm64, so honouring Linux's spellings under Darwin would be guessing at output no Mac produces. Static linking is not the instrument on macOS — Apple ships no static libSystem — so assert-macho.sh stands in for assert-static.sh with the guarantee that actually matters: every dependency resolves under /usr/lib or /System/Library, so nothing the destination Mac lacks can be picked up from a build runner, and the binary carries the signature arm64 refuses to run without. Not signed or notarized beyond that, deliberately. The binary is never downloaded by the Mac that runs it: the client fetches it, verifies it against checksums.txt and writes it over SFTP, which sets no quarantine attribute, so Gatekeeper is not in the path. ASSET_X86_64 and ASSET_AARCH64 become ASSET_LINUX_*, which is what they always meant and could not keep meaning next to a macOS pair. * fix(ci): sign the x86_64 macOS server, and stop the guard flaking on it Two faults the first green run hid from each other. The linker ad-hoc signs the arm64 slice because Apple Silicon will not execute anything unsigned, and leaves x86_64 bare. That is fine on an Intel Mac, but the x86_64 server is also what an Apple Silicon box gets when it asks through a Rosetta shell, and handing that machine an unsigned binary is a guess about Rosetta nobody needs to make. Sign both slices ad-hoc in the workflow — no identity, no secrets, nothing to do with the notarized signing the GUI bundles get. The guard that caught it was itself unreliable: `codesign -dv | grep -q` under `pipefail` reports failure whenever grep wins the race, because -q exits on the first match and the writer takes SIGPIPE. Small output means the writer usually finishes first, which is why the arm64 job passed and x86_64 failed on the same signed-or-not question. Capture into a variable and match afterwards, the way the release workflow already does it. --------- Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com> |
||
|
l0ng-aiandl0ng-ai
|
49901d7f8a |
fix(cli): let --enter press the key it is shorthand for (#581) (#606)
`--enter` is documented as sugar for `--key enter`, but the send dispatch counted only `args.keys`, so `tty7 send %42 --enter` answered "needs TEXT ... or a --key to press" and pressed nothing. The key list is now built before the dispatch and the dispatch counts it, so a marked address with `--enter` and nothing else runs what the pane already has typed, and a bare `send --enter` presses Enter where the caller sits. An unmarked id is deliberately left out of that promotion. #567 made the address slot take bare ids, and `send 83 --key C-c` addressing pane 83 is fine because `--key` says "press this" and nothing else. `--enter` does not: `send 2 --enter` reads at least as much like typing 2 into your own pane and running it, and turning it into a keystroke at pane 2 would be the silent retarget #567 spent its diff closing. It stays a loud error, now naming both spellings (`send %83 --enter`, `send %PANE 83 --enter`) rather than only the typing one. The reference, the bundled skill reference, `send --help` and the `--enter` help all said the old thing in slightly different words; they now say the same thing as each other and as the code. Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com> |
||
|
Hongwei Qinandl0ng-ai
|
8071eddb5b |
fix(ui): clamp the font metrics to the config's own range, and stop buckets mislabeling a hand-set value (#550) (#572)
* fix(ui): clamp the font metrics to the config's own range, and stop buckets mislabeling a hand-set value (#550) The settings steppers and the Ctrl+=/Ctrl+- keys clamped font size to 6-48 and line height to 1.0-2.0, while `sanitize` allows 4-256 and 0.5-4.0. A value inside the config range but outside the GUI's got pushed the wrong way by a single step — `font_size: 50` shrank to 48 on "+" — and `set_font_size` writes the result back to the file, so one misclick permanently changed a value it only meant to nudge. The bounds move into tty7-core beside `sanitize` (the `ui_font_size` precedent), one shared range for validation, the steppers, and the keyboard path. The scrollback and notify-threshold preset rows had the matching display bug: the highlight matched a *range*, so a hand-set 5000 lit up "10,000" and 20s lit up "30s", and clicking that cell silently overwrote the real value with the bucket's. The segmented control now highlights a bucket only on an exact match and otherwise shows a "Custom (N)" cell that names the live value and is not a button. * fix(ui): name a custom preset the way the cells beside it are written Review follow-up on #550. The "Custom (N)" cell rendered the raw integer, so a documented `scrollback_limit: 50000` read "Custom (50000)" between cells reading "10,000" and "100,000" — the one number on the row not written like a count. It is grouped now, and the presets and their labels are one pair of lists each, checked against each other, so a cell cannot come to show one number and write another. The bucket match moves out of the render bodies into `preset_choice`, which is what makes the exact-match rule the issue asked for testable: the presets the default lands on, the 50,000 the example config in `docs/reference/configuration.mdx` carries, and 20s on the notify row. The core test claimed to pin "the GUI steps within the range sanitize allows", but only asserted that sanitize agrees with the constants it is written in terms of — true by construction, and its line-height case took the reset path rather than the clamp, so it passed without touching LINE_HEIGHT_MIN at all. It now pins the published numbers themselves, the clamp in both directions, and the two values the issue was reported with. --------- Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com> |
||
|
Hongwei Qinandl0ng-ai
|
cb473daf27 |
fix(cli): refuse a broken send address instead of typing it into your pane (#538) (#567)
* fix(cli): refuse a broken send address instead of typing it into your pane (#538) A lone positional that starts with `%` but fails parse_pane (`%3x`) used to fall through to the text branch: the typo was typed into the caller's own pane and any --key followed it there, so one wrong character redirected an interrupt to whatever the caller was looking at. The guard now propagates the parse error when the `%` is followed by a digit — "clearly tried to write an address" — and leaves `%`-led text whose second character is not a digit (`%s/foo/bar/`, `%!sort`) on the text path it always was, per the review's narrowing. The explicit address slot also accepts bare ids now: `pane ls --json` prints `83`, not `%83`, and refusing the bare form made the workaround for the typo hole (`"%${TTY7_PANE#%}"`) uglier than the hole. This matches what pane_from_env already accepted and closes the missing-`%` variant of the same mistake. Tests cover the branch with a `Context { pane: Some("5") }` — every existing send test used `Context::default()`, where the fallback errors OUTSIDE_SHELL before the guard is reachable, which is why the hole had no test. Also correct the `ws rm` docs (#539): the reference claimed its panes become orphans found via `pane ls --all`, but the code has hung them up since #319; only a hang-up failure (reported by pane id) leaves orphans. The site reference, the skill reference, and `ws rm --help` now say so. * fix(cli): keep the send guard to what actually looks like an address The narrowing was described more widely than it works: a digit-led token that fails to parse (`3x`) still types, only `%` then a digit refuses, so the reference and the skill both promised an error that never comes. Say what the code does and point at the two-argument form as the way to type an address-shaped string anyway. Now that the `%` is optional, `parse_pane` also has to be stricter than `u64::from_str`, which accepts a leading `+`: a bare `+5` meant as text would otherwise address pane 5. An address is digits and nothing else, and `pane_from_env` delegates rather than repeating the read. The broken-address arm parsed twice and ended in an `unreachable!` that a future edit could walk into; one match on the parse result carries the error out directly. A lone bare id is the one behaviour this takes away, so it says how to type the number instead, and a test pins that it never quietly presses a key at the pane the id names. --------- Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com> |
||
|
Hongwei Qinandl0ng-ai
|
14ab96284c |
fix(config): quarantine an unparseable config.json instead of overwriting it (#537) (#565)
* fix(config): quarantine an unparseable config.json instead of overwriting it (#537) A config.json that failed to parse was replaced by in-memory defaults with only a log line, and the next write of any setting — a dragged sidebar divider, Ctrl+=, anything saved in Settings — serialized those defaults over the file wholesale: one typo, and every hand edit was gone. views.json and machine.json already kept a corrupt file aside for exactly this reason; config.json was the one that did not. A failed parse now parks the file's contents as config.json.corrupt and hands back defaults marked quarantined — a non-serialized flag that makes Config::save refuse to run, so all twenty-plus write call sites are covered without touching them. Config::load_with_outcome returns the verdict beside the values (Parsed / Absent / Quarantined) so the hot-reload watcher can tell a broken file from a missing one: a broken one keeps the settings the app is running on instead of swapping defaults in, and says so in a toast; a startup on defaults after a quarantine says so too. A read failure (not merely a parse failure) warned nowhere at all — it logs, and suppresses writes the same way, without parking a copy there may be nothing readable to take. * fix(config): keep one copy of a broken config, and one word about it `Config::load` runs on every pane spawn and every palette command, so a file left unparseable was quarantined again and again: opening a couple of tabs filled the config directory with eight identical .corrupt files and then overwrote the first. A copy that already holds those bytes is the copy the call would make, so it is not made again. The hot-reload watcher covers the themes directory too, and returning early on a broken config.json took theme hot-reload down with it and re-announced the same breakage on every theme save. Themes now reload either way, and the toast speaks once per breakage. A file that cannot be read parks nothing, so it no longer reports itself as quarantined and no longer sends the user after a .corrupt file that was never written; and the reload toast no longer claims settings stop saving, which is true at startup but not mid-session, where the running config is kept and stays writable. --------- Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com> |
||
|
l0ng-aiandl0ng-ai
|
d343fd8a13 |
feat(links): open file links in tty7, resolved on the pane's own host (#568)
* feat(links): open file links in tty7, resolved on the pane's own host A clicked file path now opens in the built-in editor at the line and column the link named, and the Files panel reveals it; a directory link opens the panel on that directory. Settings -> Terminal -> Links -> Open files with picks between the built-in editor, the OS file association and a command, migrating anyone who had already set link_file_command. Detection is split into a filesystem-free candidate parser and a probe callback, so a pane whose paths live on another machine resolves them there instead of against the local filesystem -- an absolute path used to open this machine's copy silently. A pane running ssh typed into a local shell can answer for neither side and no longer offers file links at all. Relative paths are measured from the directory the work is happening in (the agent's, not the shell's kernel cwd) and then from the repository around it, and a path that matches nothing under either now says so instead of the click doing nothing. * fix(links): keep a remote path off the local openers, and off a dead end Review follow-ups on the file-link work. - A file resolved on another machine now opens in the built-in editor whatever `link_file_open` says. Under `system` or `command` the path was handed to a local `open` / `code --goto`, which threw away the resolution just done on the pane's host and silently showed this machine's copy — the same bug this branch set out to fix, left live for two of the three modes. A directory outside every tree root says so instead of opening a local file manager on a path that belongs to the far side. - `flush_link_probes` takes the host before it takes the wanted paths. `take_wanted` moves them into the in-flight set on the promise that a call is carrying them; a host that had gone away broke that promise for good and left those paths permanently unanswered — no underline, and a click that says nothing. - `~` no longer borrows this machine's `$HOME` for a pane whose paths are elsewhere. A cwd outside `/home` and `/Users` used to fall back to it, so `~/.zshrc` on a Linux box became `/Users/me/.zshrc` and was asked about — and possibly answered — over there. - An unresolved absolute or `~`-rooted path no longer claims it was looked for under the pane's directory. It never was: roots are only for relative paths. - A pending tree reveal counts down whether or not its row was found. A row that never reported bounds kept the request alive for good, re-issuing a scroll on every render and holding the column against a hand scroll. - The repo root comes from `GitStatusCache` when the git-status probe has already asked about that directory, rather than a second round trip. Tests: the migration `link_file_open` exists for (an old config with a command lands on Command, one without on the editor), a probe with no host staying wanted, and `~` refusing this machine's home for another one. * test(links): only claim a leading slash is absolute where it is `is_rooted` asks `Path::is_absolute`, the same question `FileCandidate::paths` asks before it decides the roots do not apply — and on Windows `/etc/hosts` answers no to both. The predicate is consistent; the assertion was not, so it now lives in a unix-gated test of its own next to the untouched one. --------- Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com> |
||
|
l0ng-aiandl0ng-ai
|
100904a313 |
fix(switcher): name another workspace's tabs from their terminal titles (#558)
A window names its own tabs from its live terminals' OSC titles; every other workspace it lists it reads out of the machine tree, which recorded each pane's foreground process name and never its title. So the naming fell through to the agent, and switching workspaces — which happens in place and drops the terminals the window was reading — turned the tabs of the workspace just left into a column of identical "Claude Code" rows. The daemon now sniffs OSC 0/2 and records the title beside the pane's cwd, capped at 256 characters, and `TabLabel` ranks it second only to a name someone gave the tab. The switcher puts it through the same abbreviation the tab strip uses, so a shell's `user@host:~/dir` reads `…/dir` in both places, and in a split the pane running an agent names the tab rather than whichever shell happens to be first. `tty7 tab ls` and workspaces on a remote machine were reading the same missing field and are named the same way now. Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com> |
||
|
webdev
|
4da3868797 |
feat(shells): let the new-tab menu carry entries the user wrote (#534)
Closes #443 |
||
|
webdev
|
bc7141404e |
fix(wsl): stop handing bash an rcfile the distro cannot read (#535)
The WSL bootstrap writes the rcfile on the Windows side and names it to the distro over `/mnt`. That path is not a given — automount can be off, `/etc/wsl.conf` can move the root, and a distro can have no drvfs at all — and the bash arm passed it to `--rcfile` without asking whether it was there. bash ignores an unreadable `--rcfile` in silence. And because tty7 starts it non-login on purpose, so that `--rcfile` is honoured at all, there is no `.bash_profile` pass to fall back on: such a pane opened a shell that had read no startup file of any kind. Not tty7's integration, which is the part that was supposed to be optional — the user's own `.bashrc`, gone, with nothing said. The pane looks fine; every alias, prompt and function the user wrote is simply absent. The arm now checks the file is readable from inside the distro before committing to it, and falls back to a plain login shell when it is not: no integration, but a shell that reads everything the user wrote. That is the same shape the zsh arm beside it already uses, and the failure worth having of the two. The dispatch test grows the case: with a `TTY7_RC` naming a file that is not there, the bootstrap must exec `bash -l` and must not mention `--rcfile` at all. |
||
|
webdev
|
06d4d7c301 |
feat(wsl): give a zsh distro the same shell integration a bash one gets (#533)
Closes #135 |
||
|
l0ng-aiandl0ng-ai
|
b7196ae49a |
Give the side panel's Info tab rows that do what they show (#531)
* feat(right-panel): give the Info tab rows that do what they show The panel's Session table rendered every fact the same inert way, and its two actions sat in a strip of their own under the whole list — unlabelled, four rows below the path they acted on. Rows now carry their own shape: `changes` is the sidebar's green-and-red `+N −M` and opens the same diff overlay under the same setting, an agent wears the same status dot its tab does, and what a row can do appears at the end of it on hover, in the strip Source Control rows already use. A port row hands over its address instead of leaving it to be retyped, and the lit panel tile closes the panel the way every other activity bar does. * fix(right-panel): answer for the row the pointer is actually on Review of #531 found the new rows promising more than they could keep. Port rows keyed their element id on the port alone, but a port is only unique with its pid — a pre-forking server puts one row per worker on screen, and gpui handed them a single interactive state, so a click on one lit the tooltip and the pressed fill on all of them. The `changes` counts were read off `Tab::git_status`, which resolves a split tab to its *first* leaf, while the click target came from `detail_pane`, which resolves it to the *last focused* one. Inert text could disagree harmlessly; a button could not, and clicking `+2 −0` opened another pane's repository. Both now come from the pane the rest of the rows describe. A port is only `localhost` if localhost reaches it. `lsof`'s bind address was parsed and dropped, so a server on `172.17.0.1:8080` was offered as `localhost:8080` — a refused connection, or somebody else's service. `PortEntry` carries the address (`serde(default)`, so an older daemon still answers), and the wildcard and loopback binds keep the `localhost` spelling anyone would type. The browser tile hung off `remote_context()` — where the *shell* is — though the ports come from the pane's own process tree either way. It hid the tile on the one pane where it works, a `ssh -L` forward listening on this machine. It is about the host now. The action strip is opaque and pinned to the row's right edge, so on the working-directory row it covered the leaf that the head-first elision exists to preserve. The value holds that width back for good rather than on hover: taking it on hover would re-elide the path under the pointer, which is the pixel-shifting the strip is absolutely positioned to avoid. Also: the counts were `flex_1`, so the whole rest of the line was the button and empty space underlined numbers it was nowhere near; the agent pip was pinned in pixels inside rem-sized text and slid off its line at any interface scale but 100%, and drew Waiting as a thin ring where the tab strip punches a hole in a filled dot — one rule, two dialects; the panel-toggle chrome tile, which on macOS lives inside the panel it closes, still dropped focus into the destroyed element and left ⌘J dead; and `scm/detail.rs` kept a third copy of `ROW_INSET`. --------- Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com> |
||
|
l0ng-ai
|
4b7719ba5f |
fix(watch): stop a filesystem watch feeding itself on Linux (#523)
On Linux, an idle window with a repository open ran `git status -uall` about 2.6 times a second, forever. `notify`'s inotify backend subscribes with `WatchMask::OPEN`, so every `open(2)` under a watched directory is an event — and `git status` opens `.git/index`, `.git/HEAD` and `refs/heads/*`, all of which the source control watch covers. The read that answers "did this repository change" was itself an event saying it may have changed, so each answer scheduled the next question. Measured on the Linux runner: 78 debounce bursts in 30 seconds, from one real change. `Debounce`'s doc argued this was impossible because `GIT_OPTIONAL_LOCKS=0` stops `git status` writing the index back. That covers writes; `IN_OPEN` fires on reads. macOS FSEvents has no equivalent, which is why it was invisible on the machine it was written on. `is_content_change` drops `Access(Open | Read | Close(Read))` and keeps `Access(Close(Write))`, at both the host watch and the config hot-reload watch. Guarded by a host conformance case rather than a platform test, verified red on the Linux runner with the filter removed. Also here, and how the above was found: the `render_idle` tests counted frames across a window they advance a virtual clock over, while the pane runs its own git pipeline off a 300ms timer on that same clock that nothing advanced during settle — so the measurement set off the pane's first `git` run and raced its landing. `test_window::quiesce` settles both clocks, and the kernel's, before counting. That turned #523 from a 1-in-50 flake into a deterministic failure, which is what made the watch loop findable. Third: `ssh_config::an_alias_added_to_an_included_file_is_seen_without_touching_the_root` (from #528, already on main) failed on every Windows run of this branch. The cache keys on mtime and the test writes twice inside one ~15ms Windows clock tick, so the cache was right to say nothing changed. Test-only; the poll behind it runs at 4Hz and real edits arrive at human speed. Closes #523. |
||
|
l0ng-ai
|
a2eab07f8d |
fix(ssh-config): watch every included file an alias was parsed from (#528)
The cache behind `alias_still_resolves` keyed on the mtime of `~/.ssh/config` alone, and `Include` leaves the including file's timestamp untouched — so an alias put back in the file it lived in went on reading as gone, parking its workspaces with no retry and no error. Every file the parse reads is watched now, plus the root even when unreadable. Two tests that failed on CI for reasons outside the code they cover go with it. `pane_history` waited on the seed file existing, but the snippet seeds through a redirection, which creates the file before `tail` fills it. `daemon::singleton` asked for the seat back the instant it dropped it, and a neighbour's fork keeps an inherited descriptor referencing the same flock until its exec. Closes #524. Closes #525. |
||
 cwatanab
|
5452414a20 |
feat(agent-hooks): report the opencode session id (#481)
The opencode plugin now captures the session id from event properties and forwards it to the emitter on stdin, so a restarted pane can resume the same session with `opencode --session <id>`. Also maps session.status busy/idle for versions that no longer emit session.idle. A task-tool subagent runs in a child session whose events are structurally identical to the pane's own, so the bridge remembers child ids from session.created/session.updated and lets their events pass without touching the pane's session — otherwise the pane would report (and resume) the subagent's session, and a subagent going idle would call the pane done. |
||
|
Hongwei Qin
|
c2950fc434 |
feat(ui): forget orphaned remote workspaces when a profile is deleted (#508)
Deleting an SSH profile used to leave every remote workspace entry that had connected through it behind, labelled with a bare internal id and retrying a route that could never work again. `RemoteRef` now carries a `RouteSnapshot` of the profile it was made from — name, user, host, port — written at creation and refreshed on every reopen, `serde(default)` so older session files load. The snapshot serves labels only: `PartialEq`/`Hash` ignore it, or a refresh would split one entry into two. Deleting a profile cascade-forgets the entries routing through it. Forgets, not deletes: `WorkspaceRemove` is never sent, so the sessions on the remote machine keep running and connecting again under a new profile brings them back from the machine's own workspace list. An entry holding a live or in-flight link is left alone, as is one whose window is still on screen — a window whose workspace the store has forgotten reads as local, and its next tab would open a local shell on what the user still sees as a remote box. Whatever survives parks instead: no retries, no error, and an inline action to drop it deliberately. A live or preempted link outranks a lost route. Labels fall back from the live profile to the snapshot to a placeholder, so no branch renders a bare UUID. Resolving the live name reads memory rather than reparsing `~/.ssh/config`, because that path runs on every frame of a window with a remote workspace open. Closes #485. |
||
|
l0ng-aiandl0ng-ai
|
bf9c57dec7 |
fix(ssh): let a rejected stored credential ask again (#519)
* fix(ssh): let a rejected stored passphrase ask again (#486) Saving the wrong passphrase for an encrypted key locked that key out permanently. `passphrase_submit` wrote `SetKeyPassphrase` on the "remember" checkbox alone — before the daemon had tried the secret, since `apply_keychain_write` runs ahead of `respond_active` — and `try_identity_file` treated a stored passphrase as final: a decrypt failure with one went straight to "could not decrypt identity file", with no prompt and nothing in the UI that could let go of it. The daemon now says so. `AuthPromptKind::KeyPassphrase` grows a `rejected` flag, and a stored passphrase that does not open the file falls through to the interactive prompt carrying it, so the typed answer still gets its attempt. A passphrase the user typed this time keeps the hard failure — that is a wrong answer, not stale state. The sheet renders the warning line the password sheet already had, and a rejected prompt answered without "remember" now emits `DeleteKeyPassphrase`, mirroring the password idiom exactly. The flag is a `#[serde(default)]` field on a struct variant of an externally tagged enum, which is compatible in both directions: an older peer never sets it and serde ignores fields it does not know. So `PROTOCOL_VERSION` deliberately does not move — the remote-server handshake gates on it, and a bump would turn away older servers over a field they can safely ignore. `protocol.rs`'s compat test pins both directions. Also: deleting an SSH profile now drops the key-passphrase entries no other profile still references, which is what `delete_profile_confirmed`'s own comment already claimed to do but only ever did for the password. * fix(ssh): stop replaying a stale password at keyboard-interactive (#487) `try_keyboard_interactive` answered a password-shaped round from the keychain, marked the stored password spent whether or not it had been used, and returned on the first `Failure` — so the `MAX_ROUNDS` loop never got a second pass with the stored password withheld. The same dead secret went out on every reconnect and the user was never once asked to type a different one; `ki_submit` always emitted `KeychainWrite::None`, so nothing could clear it either. `collect_ki_answers` now reports where its answers came from, and only a round that actually sent the stored password spends it — which also fixes an OTP-then-password flow that was refusing the stored password for no reason, its first round having burned the allowance on a code. On a rejection whose last round came from the keychain, and where the server still offers the method, the request is started over with the stored password withheld, so the next round reaches the prompt. That retry is bounded twice over: the restart spends the stored password, so no second restart can qualify, and the round counter it shares with the info-request loop caps the method either way. The failure text now says which of the two was turned down. Scope, honestly: the only live scenario is auth mode Auto against a server offering keyboard-interactive but not password, with a stored password for that endpoint — a profile pinned to KeyboardInteractive gets `password: None` and always prompts, and Password never tries KI. Whether the symptom shows also depends on the server: OpenSSH ends a rejected kbdint request with USERAUTH_FAILURE (symptom holds), while a device that re-issues an InfoRequest in the same request already reached the prompt. `AuthPromptKind::KeyboardInteractive` grows a `#[serde(default)]` `stored_rejected`, same both-directions compatibility as `KeyPassphrase`'s `rejected` and the same reason `PROTOCOL_VERSION` stays put. The sheet shows the warning line and, on submit, forgets the rejected password. That needed an endpoint the KI prompt does not carry, which also fixed a bug next door: `raise_routed_auth` called `from_prompt(.., None, false)`, so every routed password write was keyed to port 22 regardless of the real port and the rejected self-heal could never fire there. `PendingAuth` now carries the endpoint and the auto-supplied flag, read straight off the route's `NativeSshSpec`. --------- Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com> |
||
|
l0ng-ai
|
d4643f0532 |
fix(ssh): offer keys in the order the user asked for them (#520)
Every public key offered spends one of the server's `MaxAuthTries` — six by default — whether or not the server wants it, so the order decides who gets locked out when the budget runs dry. Offering the `~/.ssh` defaults before the agent, and offering them on top of a profile's own key rather than instead of it, spent the budget on the keys least likely to be accepted: three stale defaults in `~/.ssh` with the working key in a loaded agent could exhaust the attempts before the agent was reached, and a profile naming its own key came off worse than one naming none. Order the sources by how plainly the user asked for the key: 1. a key the profile names — "use this one" 2. the agent — "I loaded these" 3. the ~/.ssh defaults — nobody said anything, we are guessing Steps 1 and 3 are the same leg, because the defaults now stand in for the identity list only when the profile names no key of its own, the way `IdentityFile`'s default works in ssh_config — verified against the local OpenSSH: `ssh -G` lists five defaults with no IdentityFile and only the named key with one. WezTerm and Tabby both replace rather than append too (wezterm-ssh/src/config.rs:589, tabby-ssh/src/session/ssh.ts:194). The file-vs-agent order has no single convention to follow — WezTerm asks the agent first, Tabby reads files first, OpenSSH merges the two and trims the agent's extras with `IdentitiesOnly`, which tty7 does not parse. This order agrees with OpenSSH and Tabby when the user named a key and with WezTerm when they did not. Dedup by canonical path goes with it: the two lists are alternatives now, so there is nothing to dedup between them. `auth_steps` and `identity_offers` carry the two rules as pure functions, so both are unit tested instead of living inside the async round. The GUI's keychain preload follows the same rule, so both sides still key passphrases by the same strings. Closes #513. |
||
|
l0ng-aiandl0ng-ai
|
efe345174b |
fix(ssh): stop a new host-key algorithm from reading as a compromise (#516)
* fix(ssh): stop a new host-key algorithm from reading as a compromise A host that grows an ed25519 key beside the ssh-rsa one it has always had raised the full man-in-the-middle sheet — red border, fingerprint diff, a "type yes" field — because `check_in_str` folded "known by another algorithm" into `HostKeyStatus::Changed`. OpenSSH treats a key of an algorithm the host has no entry for as simply unknown, and saves the alarm for a key that contradicts one on file. `ChangedAlgorithm` splits the two apart, with `Changed` keeping precedence so a same-algorithm mismatch still screams however many other-algorithm lines sit beside it. The dialog was only half of it. Negotiation started from russh's default order, which leads with ed25519, so a host known only by ssh-rsa was *asked about on every single connection* — and an attacker could pick an algorithm the user had no entry for to trade the alarm for the mild confirmation. `build_preferred` now orders the host-key list the way OpenSSH's `order_hostkeyalgs()` does: what is already on file goes first, nothing is dropped, and a pinned `HostKeyAlgorithms` is left alone. It matches on key type, so all three RSA spellings travel together rather than pinning the host to SHA-1 signatures. The prompt reuses `AuthPromptKind::HostKeyUnknown` with an added optional field rather than gaining a variant: the enum is externally tagged and crosses both the daemon/GUI and the GUI/tty7-server boundaries, where a new variant is a hard decode failure on an older peer and a new field is not. Also fixes a defect the issue did not mention: overriding a genuinely changed key appended the new line without removing the old one, and since any same-algorithm match answers `Known`, the superseded — possibly attacker's — key stayed trusted forever, silently. The superseded line is now dropped first, and only lines naming this one host are touched, so a wildcard or `@revoked` entry is never collateral. * fix(ssh): make the Override button on a changed host key actually override `host_key_changed_decision` returns `accept: false` for anything but "yes", which is byte-for-byte what Abort sends — and the button had no disabled state and closed the sheet unconditionally. So clicking Override with an empty field rejected the key and dismissed the prompt, indistinguishable from having aborted, with nothing said. Enter on the input had the same trap. Override is now dead until the word is there, which is what the line above the field has been claiming all along, and Enter on a half-typed answer leaves the sheet up instead of quietly deciding. `changed_confirmed` is the single predicate behind both, so the button and the decision cannot disagree about what "yes" means. `host_key_changed_decision`'s `false` branch stays as defence in depth. Both input subscriptions also notify on `Change`, or the enabled flag would go stale between keystrokes, and a hint appears once the field holds something that is not "yes". Abort is untouched: still primary, still last. --------- Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com> |
||
|
l0ng-aiandl0ng-ai
|
f2fe829cb6 |
fix(sftp,forwards,files): tell a failure apart from an empty result (#518)
* fix(sftp): stop a failed poll from reading as an empty transfer list
A transfer poll that could not reach the daemon answered with an empty
`Vec`, which is indistinguishable from "every transfer is gone": the tray
disappeared and every upload the panel was waiting on counted as landed,
so a spurious "the upload finished" refresh fired. Over a link that is
down that is the permanent answer, not a blink.
`SftpRoute::transfer_list` and `RemoteTerminal::sftp_transfer_list` now
report the failure the way `sftp_list` already does. A failed poll keeps
the jobs the panel last saw, settles nothing, and says so in the transfer
tray through a new `jobs_error` — kept apart from `SftpPanelState::error`,
which blanks the directory listing a poll knows nothing about.
* fix(forwards): let a forward whose loop has exited say so
`ForwardEntry.status` was written once when the forward was set up and
never touched again, so a local or dynamic forward went on reporting
`Listening` after its accept loop had already exited. The pane outlives a
dead SSH transport on purpose, the daemon keeps it while a subscriber is
attached, and the panel re-polls every 2s — so the stale `Listening` is
not a blink but the permanent answer. `nc` to the port gets accepted once
and refused thereafter while the panel still shows it as live.
The status is now an `Arc<Mutex<ForwardStatus>>` shared with the task, and
both break arms record why they left: the listening socket closed, or the
SSH connection went away. `ForwardStatus::Error` carries it rather than a
new variant, because the enum crosses the protocol to `tty7-server` builds
that would not know one. `find_auto_local` reads the live status too, so a
loopback link is no longer reused after its forward has stopped serving.
A remote forward has no accept loop of its own — the far end opens the
channels — so it keeps whatever the `tcpip-forward` request answered.
* fix(files): tell a failed search from an empty one, and name the file a write failed on
Two ways the file tree answered a failure with something that reads as a
result.
A search was `unwrap_or_default()`ed inside the worker, so a host that
refused the walk left `hits` empty and the column printed "Nothing matches
{query}" — byte-identical to a genuine zero-hit search. The worker now
reports `(ok, hits)` the way `spawn_load` already reports a listing, and a
failed walk draws a `SearchFailed` note in the danger colour, the same
distinction `FileTreeState.unreadable` draws for a directory.
Creating and renaming pushed the bare `io::Error`, so the toast was
literally "Permission denied (os error 13)" — neither which file nor what
was being done to it. Both now go through `HostOps::notify_err` like
delete and drop-copy already do, naming the file; a rename names the name
it is leaving, which is the one still on screen.
---------
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
|
||
|
l0ng-aiandl0ng-ai
|
27880c0f14 |
feat(cli): wait on commands, press keys, and reap orphan panes (#505)
* feat(cli): wait on commands, press keys, and reap orphan panes
`tty7 wait` was the orchestration primitive for agents only. A pane with
nothing reporting agent status read as `idle`, so `--until idle` returned
success instantly about a shell that was midway through a build, and there
was no state that meant "the command finished" at all.
Panes with no agent now report `no-agent`, and `free` ends the wait when the
foreground command has exited — the process-tree question `procs` could
already answer but nothing could block on. `send --key` covers the keystrokes
text cannot express, which is what a worker stopped at `waiting` is usually
asking for. `pane close` takes several panes and `--orphans` clears what an
interrupted `run` leaves behind. `doctor` finally performs the hooks check
its own help has advertised.
The skill shipped in this repo predated `wait` entirely and taught a
hand-rolled `procs` polling loop with no notion of delegation; it now covers
the loop, and its agent statuses, `ws rm` orphan claim and not-implemented
list are corrected against the code.
* fix(cli): close the gaps review found in wait, --key and pane close
Five things the first pass got wrong, in the order they bite.
`--until free --changed` waited on a command it had already missed: the
"something ran" edge is only set by a poll that catches the pane busy, and a
command that starts and finishes inside one 500ms interval never is. That is
indistinguishable from a command that never ran, so the timeout now names both
doors instead of letting a finished build read as a hang.
`free` also outranked the agent ladder, which is backwards. A pane whose depth-0
process *is* the agent — the tree cannot tell that apart from a shell at its
prompt — reads free for its whole turn, so a `waiting` the caller explicitly
asked for could be overwritten by a process-tree fact and then withheld by the
`--changed` rule that comes with it. `free` is now consulted only when none of
the requested agent states answered, which is both cheaper and what the docs
already claimed. An empty process tree is "we could not see in" rather than
"free" for the same reason `no-agent` exists.
`--key M-X` sent `ESC x`: the whole spelling was folded to lowercase, which is
free for Ctrl (the C0 rule clears the case anyway) and wrong for Alt, where the
character rides through as itself.
`send --help` listed the key vocabulary by hand next to the table it is a list
of; it had already drifted by one alias. It is generated now.
And a `pane close` batch that could not close everything raised an error, which
left `--json` holding prose exactly when a cleanup script needs to know which
panes are still its problem. It exits 1 with `{"closed":[…],"failed":[…]}`, with
the complaint still on stderr so `-q` reports it.
---------
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
|
||
|
Hongwei Qin
|
364e24af87 |
feat(ssh): probe ~/.ssh default identity keys (#507)
A connection with no explicit IdentityFile used to offer the server nothing at all when the agent was unavailable — the default on Windows, where the OpenSSH Authentication Agent service ships disabled — and then reported "no public key was accepted", for keys it had never sent. Offer the `~/.ssh` defaults (id_ed25519, id_ecdsa, id_rsa) after the explicit identities and before the agent, from one shared candidate list in `core::ssh_profile` so the GUI and the daemon key `key_passphrases` by the same strings. Candidates are deduped against the explicit list by canonical path, comparing the expanded paths the reader actually opens. A discovered key that is encrypted is used only when its passphrase is already cached, never prompted for; explicit keys keep prompting. Files that do not exist are skipped in silence, a `.pub` is never offered as a private key, and the failure text now separates "the server turned these down" from "nothing usable was found". The tests build their ed25519 fixture at run time from a fixed seed rather than embedding a PEM blob, so the tree carries no private key. Closes #484. |
||
|
l0ng-ai
|
9735a490b5 |
Merge pull request #479 from l0ng-ai/perf/wsl-tab-open-cost
perf(wsl): stop re-proving the distro on every new tab |
||
|
l0ng-ai
|
d09fc10878 |
fix(wsl): make the remembered server path safe to trust
The note the last commit introduced had no working way to be wrong. Its only repair was the router forgetting the distro when `RemoteLink::wsl` returned an error, and that call only spawns `wsl.exe` — which starts perfectly happily with a server path that no longer exists inside the distro. The exec failure arrives later, as an EOF on the bridge, so a distro that was reinstalled or had its bin directory cleaned out failed every WSL tab from then on, with nothing re-installing it and no way out but restarting tty7. So forget it where the truth actually shows up: a bridge that closed without ever sending a byte never ran, and after one of those the next pane proves the distro again. The spawn-error retry stays, but only when the path came from memory — a path proved a moment ago will prove the same, and re-probing it just doubles the wait before the error reaches the user. Two more things the note quietly took away. It was read before `install_lock`, so a pane spawn was no longer mutually exclusive with `replace_wsl_server`, whose whole job is to move the file the note names: a window restoring panes while the user updates the WSL server could spawn the binary being replaced. The read moves under the lock, which costs nothing when no install is running and correctly waits when one is. And it short-circuited `Installer::run`, the only thing that notices a foreign build serving the distro — so the "a different build of tty7-server is serving this machine" warning reached the first pane of the daemon's lifetime and no other, including a whole new GUI session, since the daemon outlives one. The note now carries the mismatch it found and re-files it for each later pane, which is the same warning without the five round trips that found it. The wall-clock budget in the remembered-answer test is gone: the returned path already proves no probe ran, and 200ms of elapsed time on a loaded CI box only ever proved the box was loaded. |
||
|
l0ng-ai
|
e0745329db |
fix(wsl): do not pass off a half-read registry as the distro list
`registry_user_subkeys` ended its walk on any non-zero return and reported what it had as the answer. Only one of those returns means "that was all of them"; the rest mean the walk stopped early — a `wsl --unregister` running right now, a Store install rewriting `Lxss` underneath it — and a failure at the very first index came back as `Some(vec![])`, an authoritative "there are no distros". The sweep that feeds the shell menu keeps the last good list only when the probe says `None`, so that empty answer erased the user's distros for the length of the TTL, with no error anywhere and no `wsl -l -q` to catch it: the fallback only runs when the key will not open at all. The walk now says nothing unless it reached the end. `State` is now read too, the way Windows Terminal reads it. A `DistributionName` is not a promise that the distro can be entered: an install that was cancelled half way, a failed `--import`, one being uninstalled as we look, all leave the key behind. `wsl -l -q`, which this replaced, never listed those; without the filter they arrive in the shell menu and open a pane that dies of a WSL registration error. A key with no `State` at all is still taken at its word, which is the conservative direction — inventing one would hide working distros, which is the mistake `Modern = 1` would have been. That also makes `registry_user_dword` production code rather than a `cfg(test)` copy of `registry_user_string`'s FFI scaffolding kept alive for one assertion. The timing test now skips when the registry has nothing to read: on a machine with no `Lxss` key the listing is *supposed* to go to `wsl.exe` and wait, so timing it there failed the test on exactly the machines the fallback is for. And hoisting `LXSS` had left `default_wsl_distro`'s doc comment attached to the const; it goes back on the function. |
||
|
l0ng-ai
|
7f16f6a6ff |
fix(wsl): read the distro list from the registry, not the WSL service
`wsl -l -q` has to reach the WSL service, and reaching the WSL service is the part that can be slow. Behind a hardcoded 3s timeout that made the listing all-or-nothing: on the machine in #454 a round trip took 3.3s, so the call timed out every time, the list came back empty every time, and no WSL distro was ever offered in the shell menu. Not slow — absent. `Lxss` is where `wsl.exe` registers them, it is the same key `default_wsl_distro` already reads for the same stated reason, and nothing is listening on it, so it cannot hang. `wsl -l -q` stays as the fallback for when the key will not open at all, which means this is not a machine with WSL on it rather than a machine whose WSL is busy. Windows Terminal made this move in 2021 (microsoft/terminal#10967) after the same symptom — distros "missing entirely" on first launch. It skips distros whose key carries `Modern = 1`; we must not. That is a deduplication rule specific to Terminal, which modern distros hand a profile fragment of their own. Nothing hands tty7 anything, and on an up-to-date machine `Modern = 1` is the ordinary case — on the box this was written on, the only distro installed. There is a test pinning that. |
||
|
l0ng-ai
|
c5a0d8665b |
perf(wsl): let a distro say once where its server is
`ensure_wsl_server` re-proved everything on every pane: uname, $HOME, a stat, a liveness probe, a look at what is running — five serial `wsl.exe` round trips to re-learn what the previous pane had just learned. Fine once per distro, absurd per pane. It now keeps the answer in memory, and nothing expires on a timer, because the answer barely rots. A tty7 upgrade renames the binary, but a new build is a new process and the map starts empty. A distro shutting down does not invalidate it either: `wsl.exe` restarts a stopped distro on demand, and the bridge starts its own daemon when none is listening, so the one claim that really does stop being true is repaired a layer below without anyone asking. What is left is a path that could stop existing — the distro reinstalled, the directory cleaned out. Starting the bridge is what discovers that, so the router forgets the distro and proves it again from scratch, once. The two operations that deliberately disturb what is running forget first, so a restart that fails halfway leaves no note claiming otherwise. |
||
|
l0ng-aiandl0ng-ai
|
425f87e9a4 |
fix(core): key the machine tree to the config directory (#462)
* fix(core): key the machine tree to the config directory The tree resolved from $HOME while everything else an instance owns — views.json, the scrollback, the history, both sockets, the pidfile, and daemon.lock — resolved from the config directory. So --config-dir moved every part of an instance except the one that says which workspaces exist, and two tty7s pointed at different config directories, each holding its own lock and each certain it was the only server on the machine, still co-owned one ~/.local/share/tty7/machine.json. MachineStore::persist writes the document whole. The second one to flush replaced the first one's workspaces with its own, and the next daemon to start read the survivor's tree as the machine's. An empty tree is not distinguishable from a machine that really has nothing on it, so the GUI does what an empty tree means and forgets those workspaces for good. A lock and the thing it protects have to be keyed alike. data_dir() now follows the config directory; TTY7_DATA_DIR stays as the highest-priority override so the test harnesses keep their sandboxes. Moving the path without carrying the file would lose every workspace at the moment of upgrade, which is the failure this change exists to stop, so the daemon adopts the legacy file on startup before it opens the store. The destination already existing is the whole guard: it means a newer run owns the tree and the copy at the old path is stale, from a build that predates the move and still writes where it believes the tree lives. Adopting that over the live file would hand the old tree back. * fix(core): only the machine's own instance inherits the legacy tree The migration moved `machine.json` into whichever config directory started first. In the very setup this change exists to fix — a default install beside a `--config-dir` one — that is the second instance renaming the machine's tree into its own directory, leaving the primary to come up owning nothing. It also fired in our own test suite, where `routed_pane` and friends launch a real `tty7-server --config-dir <TempDir>` under the developer's own `HOME`. Adoption is now the entitlement of the instance running out of the config directory this machine resolves to on its own: `$TTY7_CONFIG_DIR` where the box names one, `$HOME`'s otherwise. Comparing paths rather than asking whether `--config-dir` was passed is what keeps the ordinary install working — `spawn` hands every daemon it starts an explicit `--config-dir`, its own included — and counting `$TTY7_CONFIG_DIR` is what keeps remote hosts upgrading, since a remote `tty7-server` is launched without the flag and finds its directory that way. Also tightens the cross-filesystem fallback: a rename that failed because another process already carried the file over is the one benign race, not an error to report and not something to copy over. What is left copies through `create_new`, so "never overwrite what is already there" holds against a racing writer and not merely against an `exists` check several syscalls old, and a write that does not finish leaves nothing behind. Tests: the gate both ways, the appearance hint riding along, the same directory under two names, the copy path refusing an occupied destination, and two cross-process cases in `machine_tree` that start a real server under a scratch `HOME` — one carrying the legacy tree in, one leaving it alone. --------- Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com> |
||
|
l0ng-ai
|
a55340ed7f |
fix(daemon): sweep a dead daemon's leavings on the writer's tick, not at startup
Review follow-ups on this branch. `history::sweep` still ran at startup, three lines under a new comment explaining why sweeping there is wrong. The reasoning transfers exactly, and worse than by analogy: a restore carries the dead pane's commands to its successor via `history::carry`, so sweeping before the window can ask deletes the file the request is about. Same shape as the scrollback bug, one file over. Both sweeps now run on the writer's tick off one shared id set, and the writer is named for what it does. `pane_attachable` lost its only caller when the restore path moved to `pane_free_for`, leaving a function kept alive by the test asserting on it. The attach site does not need to predict the listing: it tries the attach, and a pane that is gone falls through to the fresh spawn on its own. Gone, with its tests folded into `pane_free_for`'s. `restored_screen` now drops the snapshot in both directions. Keeping the file when it decoded to nothing left it to be re-read and re-rejected by every later restore, and swept never, for a pane the tree still names. Also: the module doc still said scrollback was off unless asked for, which is what this branch reverses; and #449 landed the whole feature with no CHANGELOG entry, so nothing told anyone that pane output now lives on disk. |
||
|
l0ng-ai
|
b3a66e75d0 |
fix(test): let the machine-tree seed keep up with a new pane field
PaneSeed grew a `shell`, but this test is unix-only, so a Windows box never compiles it and never says so. Build the seed from `bare` and the next field lands on its own. |
||
|
l0ng-ai
|
852d3178c8 | style: rustfmt | ||
|
l0ng-ai
|
477d82524f |
feat(daemon): keep every pane's screen, without asking
`persist_scrollback` is gone, and with it the switch, its three translations and the branches that read it. Keeping a capped tail of each pane's output is now what the daemon does, not something it can be asked to do. This reverses the call made when the feature landed. The argument for off-by-default was that the ring holds whatever the pane printed — echoed tokens, `env` output, an agent's transcript — and that writing that down should be the user's decision to make. What the argument missed is when the decision gets made: the moment anyone learns they wanted this is the moment a daemon has already died, and by then the setting could only be turned on for next time. A feature whose entire purpose is to survive an event nobody schedules cannot be opt-in. The cost is real and does not go away: pane output now lives at `<config>/scrollback/*.bin` on every machine, 0600 on unix and behind the config directory's ACL on Windows, capped at 256 KiB per pane and dropped as soon as no window can still ask for it. Old configs naming the key still parse — nothing in `Config` refuses unknown fields — so the key simply stops meaning anything. |
||
|
l0ng-ai
|
c138be687a |
fix(daemon): keep a pane's shell and its screen across a restart
Two things a pane lost when the background service stopped and started, both of them things the tree was the only possible place to keep. **The shell.** `PaneRecord` and `PaneSeed` carried a pane's cwd, its ssh spec and its agent, but never what it was running. A window rebuilding a dead pane from the tree therefore had nothing to pass and spawned on whatever the default shell is now — so a restart turned a bash pane into a PowerShell one, quietly and in place. The daemon resolves the override against the config at spawn time and is the only party that knows the answer, so it keeps it and reports it; the seed carries it too, for the panes a window spawned itself. A handoff carries it in the blob, because nothing on the far side of an `execve` can work out the command line of a child it never spawned. **The screen.** The startup sweep ran before the endpoint was listening, which is the one moment nothing can answer the question it asks: the registry is empty and the windows that know which screens are still wanted cannot say so yet. A tree that failed to parse made it worse — `read_machine` quarantines it and returns an empty `Machine`, so one bad file took every pane's stored screen with it. The sweep now happens only on the periodic pass, a tick later, with the registry filled in and the tree caught up; nothing is serving a request in between. Turning the setting *off* still clears the directory at once, because there the promptness is the whole promise. Two smaller ones alongside it: `restorable_pane_ids` now counts the tree's pane list and not only the panes some tab currently stands on — the two disagree while a window is between layouts, and being wrong costs a file swept a tick late in one direction and somebody's terminal in the other. And `restored_screen` drops the snapshot file *after* deciding it was not empty, so a snapshot holding nothing is no longer consumed by the request it could not answer. The restore path had no end-to-end test, which is how this shipped: the unit tests cover the file, not whether a window that reattaches is shown anything. The new one runs a real daemon, puts a marker on a real pane, stops the daemon, starts another, and reads the wire. |
||
|
l0ng-ai
|
edfadb7df2 |
Merge pull request #424 from l0ng-ai/feat/scm-foundation
feat(scm): a full Source Control panel, decorations and commit history |