9 Commits

Include renames

Author	SHA1	Message	Date
l0ng-ai	5e2b28be67	ci(host-boundary): allow the local stat on paste/drop upload sources ... #1004 stats the source of a paste or drop upload to decide whether to upload recursively. That path comes from this machine's clipboard or desktop, so it is a local read by construction.	2026-09-28 21:25:51 +08:00
l0ng-ai	7016fdb7ed	feat(editor): IDE-level code editor — multi-cursor, LSP, git gutter, symbols, split (#1002) ... * fix(keymap): let the code editor's multi-cursor chords beat the pane keys gpui-component now binds secondary-d, secondary-shift-l and secondary-alt-up/down in the Input context for multiple cursors. A context-free binding ranks as deep as the focused context and ties go to the one added last, so tty7's SplitRight and FocusPaneUp/Down took those keys inside the editor. Re-add the editor bindings after tty7's table; other text fields have no handler for them and fall through to the pane keys. * feat(editor): show the selection count in the status bar With several cursors the Ln/Col readout (the primary caret's) is followed by "(N selections)". * feat(editor): git change markers in the gutter Diff each buffer against its file's index version (what VS Code's quick diff and the SCM panel's Changes compare with) and hand the hunks to the editor as gutter markers: added, modified, and a wedge where lines were deleted. The base is read with `git show :./name` through the buffer's own host, so remote workspaces work too; SFTP buffers and untracked files get no markers. It is re-read when the repository's SCM epoch moves, on save and when the path changes; the diff itself is a line-level Myers diff run off the UI thread shortly after each edit. Next/previous change and Revert Change (one undo step, also in the right-click menu) are commands; clicking a marker opens a peek of the staged lines with a Revert button. The editor watch now also follows the repository the gutter found, so a stage or checkout refreshes the markers. The `editor_git_gutter` config (default on) is flipped by the ToggleEditorGitGutter command. * feat(editor): go to symbol, breadcrumbs, and back/forward navigation Go to Symbol (Cmd-Shift-O in the editor) lists the file's outline on a new Symbols tab of Search Everywhere: indented by nesting while browsing, ranked flat with the containing symbols as a subtitle while searching. Arrowing through the rows previews each symbol; Escape puts the caret and the scroll back, Return keeps it. The outline comes from the tree the highlighter already parsed, with a small query per language (Rust, Go, Python, JavaScript, TypeScript/TSX, C, C++, Java, Markdown, Ruby, shell). Tty7App::editor_set_document_symbols lets a language server's documentSymbol answer replace it per buffer. A breadcrumb row over the text shows the file's path from its project root and the symbols around the caret; the symbols open Go to Symbol. Back and forward (Ctrl-- / Ctrl-Shift-- on macOS, Alt-Left/Right elsewhere) walk a per-tab history. Jumps are noticed by sampling the caret whenever the editor draws: a change of file, or a move of ten lines or more without an edit, records where the caret was. Quick open, go to line, file links and anything that goes through open_file_in_editor_at are therefore captured without hooks of their own; a place in a closed file reopens it. * feat(editor): bind next/previous change to Alt+F5 in the code editor Bind EditorNextChange / EditorPrevChange to alt-f5 / shift-alt-f5 in the Input context only, after tty7's own table, so a terminal never loses the function key. Mark the hunks stale right after a revert, before the input's Change event lands, and cover the whole loop (markers, stepping, revert as one undo) with a window test. * feat(editor): line commands in the editor's right-click menu Toggle Comment, Move Line Up/Down, Duplicate Line, Delete Line and Go to Matching Bracket, dispatched to gpui-component's new editing actions so each row shows its chord. Strings in en, zh and ja. * feat(editor): language servers for the code editor A new ui::lsp module runs language servers for local files the editor opens: rust-analyzer, typescript-language-server, pyright (or pylsp), gopls and clangd, from a registry table. Each server is keyed by (server, project root), found from markers such as a Cargo workspace, package.json, go.work/go.mod or pyproject.toml, and shared by every buffer under that root. A server missing from PATH (which tty7 already fills from the login shell) means no LSP for that language and a one-line hint in the status bar. The JSON-RPC client frames Content-Length messages over the server's stdio on dedicated threads, holds everything back until initialize is answered, cancels requests nobody waits for any more, and answers the server's own requests (configuration, capability registration, applyEdit). Documents use full-text sync, debounced, and flushed before every request. A server whose last file closed shuts down after a grace period, every server exits with the app, and one that crashes is restarted a few times before it is left down. Features: diagnostics as underlines with hover messages and an error and warning count in the status bar; completion (snippets flattened to plain text); hover; go to definition by secondary-click or F12, across files through open_file_in_editor_at; code actions on the editor's own menu (cmd-.), resolved and executed as the server needs; Format Document (shift-alt-f); and Rename Symbol (F2) in the editor's bar, applied to open buffers and to files on disk. The key bindings sit in the Input context so F2 and F12 stay with terminal programs. Positions are converted at the boundary: servers count UTF-16 units, gpui-component counts chars, and the rope counts bytes. The new editor_lsp setting (default on) turns it all off. * fix(editor): clear the change markers when the file loses its base A file that becomes untracked or leaves its repository kept the markers of its last diff; clear them when the base goes away. Guard the base read against a panic, which would otherwise leave the fetch flagged forever, and test the read against a real repository: the base is the staged version, and untracked files have none. * test(keymap): the editor's navigation chords win inside the editor, not in a terminal * fix(keymap): let the code editor's line commands beat the app's chords The editor binds toggle comment, move/copy/delete line, insert line, select line and go-to-bracket on its CodeEditor key context. A context-free app binding ranks as deep as the focused context and wins the tie by being added later, so ⌘/ (shortcut sheet), ⌘↵ (fullscreen), ⌘⇧↵ (maximize) and, off macOS, ⌥↑/⌥↓ (pane focus) took those keys inside the editor. Re-add them in fixed_bindings on CodeEditor, which only a multi-line code editor declares, so plain text fields and the terminal keep the app's keys. * fix(keymap): route cmd-K cmd-D to the code editor's skip-occurrence The chord starts with ClearScrollback's key on macOS, and gpui drops a pending chord that ranks below a complete match, so the fork's binding never got its second key. Re-add it after tty7's table, in the CodeEditor context only, so other text fields don't wait on cmd-K. * feat(editor): history follows edits, and paging is not a jump Places in the back/forward history now move with lines inserted or deleted above them, read from the editor's line-edit log on every change. The caret move a Page Up/Down, paste, undo or redo makes is heard through the keystroke that caused it and is not recorded as a jump. * feat(editor): Problems list, keyboard change peek, Editor settings - Problems: every error, warning and note the language servers published for the open files, grouped by file, at the foot of the code panel. The status bar's counts and ToggleEditorProblems (Cmd/Ctrl+Shift+M) open it; a row opens its file at the line and column. Read through a new LspStore::diagnostics_snapshot, mapped to editor columns. - EditorPeekChange (Alt+F3 in the editor) peeks the change under the caret, or goes to the next one. The peek now takes the keyboard from a click too: Enter reverts, Escape closes and hands focus back. - Settings > General gains an Editor group: git change markers, language servers, soft wrap and rendered Markdown, searchable and resettable like every other row. * feat(lsp): outline, references, workspace symbols, signature help - documentSymbol feeds the editor's outline (breadcrumbs, Go to Symbol) through editor_set_document_symbols, refreshed 500 ms after typing pauses. Flat answers are nested by range; an empty answer from a server still indexing leaves the tree's outline in place. - Find All References (shift-F12) and a definition with several answers open a Locations tab in the search. Arrowing through it previews a place in the file in front, and Return goes there, into any file. - Go to Symbol in Workspace (secondary-T inside the editor) asks the server's workspace/symbol as the query is typed, into the same list. - Completion items are resolved for their documentation and auto-import edits, which are applied on accept (with the gpui-component fork). - Signature help opens on the server's trigger characters (or on '(' and ','), stays current while typing in the call, and closes when the server says the cursor has left it or on Escape. - Diagnostics are replaced wholesale on publish; between publishes the fork now carries them through edits instead of dropping them. - workspace/configuration answers from per-server settings, with an empty object for a section tty7 sets nothing for. rust-analyzer gets checkOnSave with cargo check, also as initializationOptions, and every server gets didChangeConfiguration after initialized. * feat(editor): text commands in the palette and keymap Transform to Upper/Lower/Title Case, Trim Trailing Whitespace, Join Lines and Remove Surrounding Brackets, as tty7 actions (bindable on the Keybindings page, unbound by default) and as palette rows offered while a buffer is open. Both run gpui-component's editing action on the active buffer. Join Lines gets VS Code's ctrl-j as a fixed CodeEditor binding on macOS, where the terminal keeps it as a line feed. Strings in en, zh, ja. * feat(editor): split the editor into two groups Cmd-\ (Ctrl-\ off macOS, bound only inside the editor so the terminal keeps SIGQUIT) opens the file in front in a second group on the right. Each group has its own file in front and, for different files, its own caret and scroll; Cmd-Alt-Left/Right (Ctrl-Alt off macOS) or a click moves the focus between them, and a group whose last file closes goes away. The split is saved with the tab's other editor state. The focused group is always TabCode's own files/active and the other waits beside it, so everything that acts on the file in front - saving, go to line, language servers, change markers, multiple cursors, history - follows the focus unchanged. A file shown in both groups is drawn once, in the focused one; the other shows a placeholder that brings the focus over. A second InputState kept in sync would have needed every hook attached twice. Also: palette rows and View menu items for Go to Symbol, Back, Forward and Split; Cmd-Shift-O closes Go to Symbol when it is open; the status bar no longer repeats the path the breadcrumbs show (a rendered Markdown file keeps its breadcrumb path); change markers are kept current in both groups. * test(keymap): the editor group chords win inside the editor * fix(lsp): close a window's documents when the window closes Documents were only closed by sync_window, which runs when a window's buffer set changes. Closing a window never ran it, so no didClose was sent, the idle shutdown never started, and a language server lived on until quit (forever, with the app retired to the tray). * fix(editor): restore a split whose left group had no recorded files The recorder writes files: [] with a split when the left group held only untitled or remote buffers, but restore returned early on an empty left list and dropped the right group too. * fix(editor): forget a swept orphan buffer's navigation state The orphan sweep dropped clean buffers without calling forget_buffer, so each one's outline cache (a full copy of its text), LSP symbols and edit-log cursor stayed in EditorNav for the life of the window. * fix(lsp): owner-only sync, stale-edit checks, request timeouts, re-enable - Only the buffer that owns a document may use its server. The same file open in another window used to send its own text as didChange on F12, rename, references or signature help, swapping the document under the owner. LspStore::context now takes the requester and refuses a non-owner quietly, before anything is sent. - apply_workspace_edit checks every open buffer an edit touches against a baseline: the texts when a rename was asked for or the code-action menu was filled, or the text the server last heard for its own workspace/applyEdit (which then answers applied: false). A buffer typed in, opened or closed since means nothing is applied. - A request made after the server's output closed fails at once instead of waiting forever. Requests time out after 10 s (initialize after 60 s, shutdown after 2 s) and cancel themselves on the server. - Turning editor_lsp back on asks every window for its open files again, which starts their servers. Windows register how to be asked; closed ones are forgotten. * test(nav): spell out LineEdit's new at_line_start field gpui-component's LineEdit now records an insertion at column 0, which moves the whole line down. The literal edits in this test are mid-line. * fix(editor): a restore merges into the tab, and commands follow the group focus Session restore used to assign the recorded groups over whatever the tab held when its files finished loading, so a file opened or a split made in the meantime was lost. TabCode::restore_groups keeps a split made meanwhile as it is, and otherwise lays out the recorded groups and puts the files opened meanwhile back into the focused group, the last of them in front. A restore the reader has moved on from no longer takes the keyboard, and never hides a panel they opened. The group focus only followed the keyboard when the editor drew. Keys are safe - gpui draws a window whose focus moved before dispatching the next key - but a command from the menu bar or a context menu is dispatched without a draw, and acted on the group that had the focus before. A capture-phase listener for every editor command on the editor's element now settles the group first, wherever the command's handler sits. * fix(editor): leave cmd-T to New Tab; offer workspace symbols from the palette Inside the code editor cmd-T was rebound to Go to Symbol in Workspace, which made tty7's most-used chord mean two things depending on focus. It is New Tab everywhere again. Workspace symbols stay reachable as an Editor palette row and as a rebindable, unbound action. * build: pin gpui-component to the fork's editor work (0e7541fb) * fix(search): let the editor's pickers stand alone in Search Everywhere Go to Symbol, a language server's places and Go to Symbol in Workspace opened on hidden tabs, so the window-wide scope row (All, Terminals, Sessions, Hosts, Commands) sat over them with nothing selected, and Tab swapped the list for the terminals. They now show a heading in place of the row (References / Definitions / Symbols / Workspace Symbols, with a count), Tab stays put, and the footer drops the scope hint. * fix(search): Go to File stands alone like the editor's pickers Go to File (cmd-O) is reached only by its chord, yet it sat under the scope row with nothing lit and offered Tab to leave for the terminals. Every tab outside the row now stands alone the same way: its name in place of the row, Tab stays put, no scope hint in the footer. * feat(search): give the editor its own scope row — Files, Symbols, Workspace Symbols Go to File, Go to Symbol and Go to Symbol in Workspace were three separate pickers, each on its own chord. They now share a second scope row, the editor's, next to the window's: cmd-O and cmd-shift-O open on it and Tab walks it. Only tabs that can answer show: Symbols needs a file in front, Workspace Symbols a language server that searches the project. A row of one shows as a heading. Each tab is opened the way its chord opens it, so it arrives set up; references and definitions still stand alone. * feat(search): fold Workspace Symbols into Symbols Symbols and Workspace Symbols answered the same question at two scopes. Symbols now does both: with nothing typed it is the file's outline; once a query is typed, the front file's language server is asked across the project and its answers are listed after the file's own, each under a heading when both have rows (the front file's own hits are dropped from the project's). The separate tab, action and palette row are gone. * fix(search): call the language server's project results Project, not Workspace LSP's workspace/symbol searches the server's project root, which has nothing to do with a tty7 workspace (a group of tabs). The Symbols tab's second section said Workspace, reading as if it searched those. It says Project now, and the tty7-facing names follow (project_symbols, set_project_symbols, lsp_project_symbol_query); only code that speaks the protocol keeps its word. * ci(host-boundary): allow the language servers' local reads ui::lsp only ever holds local buffers (OpenFile::local refuses any other host) and runs its servers on this machine, so the files it reads to measure a column, apply a rename to disk or find a project root are on this disk. Each call is allowlisted with that reason. * test(editor): spell test paths so they hold on Windows The language-server tests used /p/... paths, which are not absolute on Windows and so have no file:// URI; they now build platform paths (lsp::test_path) or spell the URI out. The gutter and split tests canonicalized their temp dirs to get past macOS's /private symlink, which on Windows yields the \\?\ form no editor path is ever in; they share a helper that canonicalizes everywhere but Windows. * test(editor): resolve temp dirs the way the editor does On the Windows runner the temp dir is an 8.3 short name (RUNNER~1), which the editor's load expands through Host::canonicalize. The split tests now resolve their fixtures through that same call instead of guessing per platform.	2026-09-28 20:47:07 +08:00
l0ng-ai	bf5149bea0	fix(editor): stop losing edits, share buffers, add file strip, quick open and go to line (#984) ... * fix(host): save local files atomically via a temp file and rename LocalHost::write_file truncated the target in place, so a crash, a full disk or a killed process mid-save destroyed the user's file. It now writes a hidden sibling temp file, syncs it, keeps the old file's mode and renames it over the target, removing the temp file on any error. It still writes in place where a rename would change something visible: a non-regular target (symlink, directory, FIFO), a read-only file, and on Unix a hard-linked file or one owned by another user, or when the temp file cannot be created (e.g. a read-only directory). * feat(editor): add editor_text for encodings, line endings, indentation and EditorConfig A pure module the code editor will use when loading and saving files: decode detects BOMs, binary files, UTF-8, GB18030 and a lossless Windows-1252 fallback and normalises CRLF; encode restores the exact bytes and names the first unrepresentable character; detect_indent infers tabs or a 2/4/8 space width with language defaults; and editorconfig_for resolves .editorconfig sections with save-time rules. * feat(editor): share buffers across tabs, guard unsaved work, add a file strip - One buffer per file per window; tabs list which buffers they show. The same file open in two tabs is no longer two diverging copies. - Closing a tab, its last pane, the window, or quitting asks about unsaved files (Save / Cancel / Discard) instead of dropping them. Bulk closes skip tabs with unsaved files; a tab that vanishes any other way hands its unsaved buffers to the tab in front. - File tree rename/delete now retarget or flag the open buffer, so a save no longer recreates the old path. - Saves check the file's mtime first and ask before overwriting a change made elsewhere; this is the only detection SFTP buffers get. - Dirty is a comparison with the saved text, so undoing back clears it. - Reloads replace only the changed span as an ordinary edit, keeping undo. - Load/save go through editor_text: encoding, BOM and CRLF round-trip, indentation is detected, .editorconfig is honoured. - Header shows a strip of open files; New File, Save As (native panel locally, a path bar remotely), Go to Line (Ctrl+G), and the status bar shows indentation, encoding and a clickable line ending. - Open files are remembered per tab across restarts. * feat(search): quick open a file by name from a Files tab Search Everywhere gains a Files tab that finds any file in the active tab's project by fuzzy name and opens it in the built-in editor, with `name:line[:col]` jumping to that spot. The list comes from one walk of the project through the host (Host::search with an empty query), so it works the same on local, SSH and WSL workspaces and skips what the tree hides: dotfiles, .git and gitignored paths. The walk is capped at 50k entries / 20k directories, kept between openings and revalidated in the background each time the search opens. Files join the All tab once a query finds them. Go to File... is bound to Cmd+O on macOS (Cmd+P is already Search Everywhere) and ships unbound elsewhere, where every obvious chord is taken or owed to the shell. * chore(editor): allowlist the editor session file, tidy lints * fix(editor): keep restored file order, drop stale close waits, carry files through tab merges - Background arrivals (restore, merge, rescue) append to the strip in order instead of inserting beside the active file, which reversed them. - A cancelled Save As, a dismissed path bar, or a dropped buffer cancels any close that was waiting on that save. - Merging a tab into another carries its open files along. - A shell exiting closes its tab without a prompt it could not honour; unsaved buffers move to the tab in front. - Tabs rebuilt under the same id (server restart) restore their files. * fix(host): only fall back to an in-place write when the rename is refused On Windows every failure of the atomic save fell back to fs::write, including a failure while staging the temp file. A full disk would then truncate the original in place, the very loss the temp file prevents. Staging errors now return as-is; only a refused rename (a file held open elsewhere) takes the in-place path.	2026-09-28 00:32:18 +08:00
l0ng-ai	2e8a43a35e	fix(settings): pass the host-boundary guard and follow the default keys ... The passphrase box checks which key file is on this machine with std::fs::metadata, which the host-boundary guard rejected; allowlist it beside the existing std::fs::read entry for the same client-side key. An empty key field now resolves to the ~/.ssh defaults build_spec_inner offers, so a default encrypted key can be given a passphrase from the form. The key is also re-resolved when host or user change, since they fill %h/%r in the path. Drop the unused SettingsForget string.	2026-09-14 18:32:55 +08:00
l0ng-ai	e743005321	fix(links): green the Windows test and the host boundary ... The traceback test located the path by its first `/`. A Windows temp path keeps the forward slash it was built with, so the search landed three quarters of the way along the path and the expected span was 63 columns off. Look for the whole path instead. The detection itself was right all along; only the expectation was wrong, which is why the Windows job was already red before the review fixes landed. The executable check reads the local filesystem from `ui::`, which the host boundary forbids on sight. It is only reachable once `host_id.is_local()` has answered, so it goes on the allowlist with that as its reason. Claude-Session: https://claude.ai/code/session_01NE3M5Q94Jyxmj5Rdm9bcg4	2026-09-09 16:33:42 +08:00
l0ng-aiandl0ng-ai	bf9c57dec7	fix(ssh): let a rejected stored credential ask again (#519) ... * fix(ssh): let a rejected stored passphrase ask again (#486) Saving the wrong passphrase for an encrypted key locked that key out permanently. `passphrase_submit` wrote `SetKeyPassphrase` on the "remember" checkbox alone — before the daemon had tried the secret, since `apply_keychain_write` runs ahead of `respond_active` — and `try_identity_file` treated a stored passphrase as final: a decrypt failure with one went straight to "could not decrypt identity file", with no prompt and nothing in the UI that could let go of it. The daemon now says so. `AuthPromptKind::KeyPassphrase` grows a `rejected` flag, and a stored passphrase that does not open the file falls through to the interactive prompt carrying it, so the typed answer still gets its attempt. A passphrase the user typed this time keeps the hard failure — that is a wrong answer, not stale state. The sheet renders the warning line the password sheet already had, and a rejected prompt answered without "remember" now emits `DeleteKeyPassphrase`, mirroring the password idiom exactly. The flag is a `#[serde(default)]` field on a struct variant of an externally tagged enum, which is compatible in both directions: an older peer never sets it and serde ignores fields it does not know. So `PROTOCOL_VERSION` deliberately does not move — the remote-server handshake gates on it, and a bump would turn away older servers over a field they can safely ignore. `protocol.rs`'s compat test pins both directions. Also: deleting an SSH profile now drops the key-passphrase entries no other profile still references, which is what `delete_profile_confirmed`'s own comment already claimed to do but only ever did for the password. * fix(ssh): stop replaying a stale password at keyboard-interactive (#487) `try_keyboard_interactive` answered a password-shaped round from the keychain, marked the stored password spent whether or not it had been used, and returned on the first `Failure` — so the `MAX_ROUNDS` loop never got a second pass with the stored password withheld. The same dead secret went out on every reconnect and the user was never once asked to type a different one; `ki_submit` always emitted `KeychainWrite::None`, so nothing could clear it either. `collect_ki_answers` now reports where its answers came from, and only a round that actually sent the stored password spends it — which also fixes an OTP-then-password flow that was refusing the stored password for no reason, its first round having burned the allowance on a code. On a rejection whose last round came from the keychain, and where the server still offers the method, the request is started over with the stored password withheld, so the next round reaches the prompt. That retry is bounded twice over: the restart spends the stored password, so no second restart can qualify, and the round counter it shares with the info-request loop caps the method either way. The failure text now says which of the two was turned down. Scope, honestly: the only live scenario is auth mode Auto against a server offering keyboard-interactive but not password, with a stored password for that endpoint — a profile pinned to KeyboardInteractive gets `password: None` and always prompts, and Password never tries KI. Whether the symptom shows also depends on the server: OpenSSH ends a rejected kbdint request with USERAUTH_FAILURE (symptom holds), while a device that re-issues an InfoRequest in the same request already reached the prompt. `AuthPromptKind::KeyboardInteractive` grows a `#[serde(default)]` `stored_rejected`, same both-directions compatibility as `KeyPassphrase`'s `rejected` and the same reason `PROTOCOL_VERSION` stays put. The sheet shows the warning line and, on submit, forgets the rejected password. That needed an endpoint the KI prompt does not carry, which also fixed a bug next door: `raise_routed_auth` called `from_prompt(.., None, false)`, so every routed password write was keyed to port 22 regardless of the real port and the rejected self-heal could never fire there. `PendingAuth` now carries the endpoint and the auto-supplied flag, read straight off the route's `NativeSshSpec`. --------- Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>	2026-08-11 21:40:49 +08:00
l0ng-ai	1df43b72b5	feat(files): copy dropped files into the folder they were dropped on (#458) ... * feat(files): copy dropped files into the folder they were dropped on The Files panel has only ever been a drag *source* — a row dragged into a terminal inserts its path. Nothing on the tree ever registered a drop, so a file dragged in from the desktop did nothing at all, not even a highlight. Closes #453. The drop is the whole gesture: files land where the cursor was, not somewhere a dialog asks about afterwards. A folder row takes them itself, a file row stands in for the folder holding it — "next to this one" — and the space the rows do not cover belongs to the top of the tree. The placeholder inside an empty folder takes a drop too; it is the only thing drawn there, and letting it fall through to the root would put files somewhere the cursor never was. A row under the cursor wins over the column, which is what gpui's innermost-first dispatch already does. The copy itself goes through the `Host` the tree is listing, so a remote workspace reads here and writes there. Locally it is `fs::copy`, which is what keeps the executable bit that `write_file` would drop; remotely the bytes ride one control frame, and a file too big for that is refused with the advice to use SFTP rather than half-sent. Names already taken are asked about before anything is written, and the answer governs the whole drop — a half-done copy would have to be undone to honour a "no". Replacing a folder replaces it rather than merging into it. A drag let go where it started is a miss, not an error, so it says nothing. * fix(sftp): list the directory again once an upload lands An upload is written to `<name>.tty7-upload-<hex>` and renamed into place at the very end. The browser listed the directory the moment the transfer was handed to the daemon, so it caught that temporary name — and nothing ever listed again, so a finished upload sat on screen as a file with a hash glued to its name until the directory was navigated by hand. The premature listing is gone, and the panel now remembers the job ids it started: once one stops running — done, failed, cancelled, or dropped off the job list entirely — the directory is listed once more. Two uploads in flight settle independently, so the second one finishing does not depend on the first. * docs(changelog): note the SFTP upload listing fix * ci(host-boundary): allow the source side of a file drop, and stop scanning two files as empty The Files panel now copies dropped files in, and what the desktop hands over is by construction a path on the desktop's own machine: reading it is a local read even when the tree being dropped on is remote. The destination side goes through `Host`, and the one `std::fs::copy` that touches a destination sits inside a branch already gated on `host.id().is_local()`. While adding that entry: `attr` starts unset, which awk reads as 0, so a file whose first line is `mod something` matched `attr == NR - 1` and cut its body at line 0. `head -n -1` then errored and the file was scanned as empty — `src/terminal/mod.rs` and `src/ui/tray/mod.rs` both open that way, and the guard had been blind to both. Neither contains a violation, so seeing them is free.	2026-08-10 12:41:17 +08:00
l0ng-aiandl0ng-ai	bed22d899e	Keep workspaces whole: remote reopen/restart recovery, and cross-workspace restore guards (#257) ... * feat(remote): keep a remote workspace whole across reopens and restarts Reopening a remote workspace — or coming back to one whose `tty7-server` had been replaced — landed on a screen of `tty7 — disconnected` panes with their coding-agent conversations gone. Several independent holes added up to that; this closes them together, and picks up the surrounding work the same session produced. **Telling a restarted server from a blinked link.** `ControlHelloOk` now carries an `instance` minted once per server *process*. Nothing else in the handshake changes across a restart — `build` and both dialect numbers survive it — so a reconnect had no way to know its `pane_id`s were dead. It does now: a different instance rebuilds the window from its layout (same tabs and splits, fresh shells in the saved cwds) instead of re-attaching to a process that is gone. An absent instance means *unknown* and is never read as a restart. **An attach can now fail.** `Attach` has no synchronous reply, so the client returned `Ok` unconditionally and the daemon's `Error` frame was read much later by the reader thread, which has no arm for it — the pane then landed in the *link is down* state instead of falling back to a fresh shell. The client now reads far enough into the reply to classify it on the kind byte (the snapshot behind it can be megabytes) and hands those bytes to the reader thread, so a successful attach loses none of its replay. Local and remote attaches get different waits: the local one is on the UI thread. **The agent session survives to be resumed.** `TerminalView` raises `AgentSessionChanged` when the pane's agent reports a new native session id, so the layout on file catches up instead of waiting for the user to happen to open a tab. A pane that is still connecting now carries its agent through `PendingSpawn` — a save landing in that window used to write `agent: null` over the record — and `land_pane` sends `--resume` when the attach turned out to need a fresh shell. **Ending sessions says so on file.** "End Sessions" kills the panes and then drops their ids from the record, pushing the cleared layout to the machine that owns it (design §10: the remote's copy wins, so a local-only clear would be undone by the next open — the open this exists for). **The new-tab dropdown lists the window's machine.** `Host::shells` and a `Shells` control request (dialect v2) make the "+" menu a property of the machine the window is bound to. A remote window filled from this computer's `/etc/shells` offered `/bin/zsh` on a box whose zsh is elsewhere, and every pick failed to spawn. **An install reports its bytes.** The download and the SFTP upload each report progress, relayed to the client over the routed connection as a `RoutePrompt::InstallProgress`, and painted as a bar under the machine's row in the switcher. ~8 MB across two hops behind the word "connecting…" was indistinguishable from a hang. **The installer compares dialects, not version strings.** `tty7-server --protocol` prints what a binary speaks without starting it, so a connect adopts an already-running server it can talk to rather than prompting about a build difference and uploading 8 MB the machine did not need. **Switcher.** A machine's `⋯` menu holds "New Workspace" (it was a row under every machine, pushing the list a quarter of a card down) and a new "Disconnect", which drops the connection and leaves the windows open and read-only. The suspension lasts exactly as long as that machine has a window on it. Also drops three design/contract docs for the now-shipped remote-workspace work. * fix(session): stop one workspace's panes from being restored into another A restart put a copy of one workspace's seven tabs — cwds, layout and recorded agent sessions — in front of another workspace's own tabs, and auto-resumed every one of those agents a second time: six `claude --resume <id>` pairs running in parallel against the same conversations, one set per window. The record-level corruption that seeded it is still unattributed, but every mechanism that let it propagate, amplify, or go unnoticed is closable, and this closes them. **Panes now know their owner.** `Spawn` can carry the workspace the pane is created for; the daemon stores it immutably and reports it in `List`'s `PaneInfo.owner`. Restore refuses to re-attach a pane another workspace owns (`pane_attachable`) — before this, a saved id landing on somebody else's live pane attached silently, which is how one window could pick up another's shells. The field rides a new `SPAWN_OWNED` frame with a struct payload (the legacy spawn payloads are positional tuples an old daemon cannot grow), gated on a new `pane-owner` feature string: a client only sends it to a daemon that advertises it, so the legacy kinds stay byte-for-byte what old daemons expect. A pane with no recorded owner stays attachable by anyone — that is the pre-field behavior, not a new risk. **Saved pane ids are bound to the daemon process that issued them.** `DaemonVersion` now carries an `instance` minted once per process (the local twin of the control hello's), the GUI caches it at the `ensure_running` handshake, and each local workspace records it as `daemon_instance` beside its layout. Claiming a workspace whose ids came from a different instance blanks them first: daemon pane ids restart from 1, so after a reboot every saved id points at whatever unrelated shell holds the number now, and the aliveness check cannot tell a survivor from a squatter. A blank on either side means "cannot tell" and never trips it. Unlike the duplicate-claim case below, this path keeps the agent resume — the pane is genuinely gone with its daemon, and the fresh shell resuming the conversation is the feature. **A duplicate claim loses its agent resume along with its pane id.** `dedupe_pane_ids` kept the loser's layout *and* its `agent_session_id`, so the blanked leaves took restore's spawn-fresh path and auto-typed `claude --resume` for conversations the winning workspace's panes were still running — the doubling above. The winner keeps the panes and the resume; the loser keeps only cwds. **Cross-workspace saves are caught at the write.** Every terminal view remembers the workspace whose window created it, and `save_session` logs an error naming both ids if a window ever records a pane created for a different workspace — the tripwire for the still-unattributed seed corruption, so a recurrence is caught in the act instead of reconstructed from `session.json` archaeology days later. Wire compatibility both ways: `PaneInfo.owner`, `DaemonVersion.instance` and `Workspace.daemon_instance` are `#[serde(default)]` struct fields (old peers' JSON decodes, new fields are ignored by old readers), and `SPAWN_OWNED` is feature-gated as above. `daemon_instance` is client-owned in the design-§10 storage split — it names the local daemon, and the field-census test pins the classification. * fix(session): resume the agent when a local pane dies mid-restore `session_to_pane` decided whether to send a coding agent's `--resume` from `restore.is_none()` — i.e. from whether the pane looked alive when the restore started. But `alive_panes_on` runs one `List` at the top of the restore, while the attaches happen per leaf afterwards. A pane that exited in between failed its attach, fell back to a fresh shell inside `spawn_shell_terminal_in`, and then landed in the `restore.is_some()` arm: an empty shell with its conversation dropped. `ShellParts.restored` already answers this exactly, and the remote path already reads it in `land_pane`. Carry it onto `TerminalView` so the synchronous local path can read it too, and branch on that instead of re-deriving the answer from a set that may be stale by the time it is used. No behaviour change on the paths that were already correct: a view that was never restoring anything reports `restored: false`, which is the same answer `restore.is_none()` gave them. * fix(remote): check the server instance against the record, not just memory A remote workspace's pane ids were only guarded against server restarts by `RemoteLinks::instances`, an in-memory map. On the first connect after the client starts, every machine is a first sighting, so `server_restarted` answers false — and a `tty7-server` that was replaced while the client was closed sails straight through. Its pane ids restart from 1, so the saved ones now name unrelated shells, and the reconnect attaches to them: the exact id-reuse failure the local side already guards against. `Workspace::daemon_instance` was local-only for the stated reason that a remote server's identity is tracked live per connection. That tracking is correct but not sufficient — it cannot survive the client restart that makes the question worth asking. So the field now means the same thing on both sides: which process minted the pane ids in this record. `WorkspaceStore::serving_instance` picks the local daemon or the far machine's server depending on the workspace, and `finish_attempt` compares it per workspace before deciding to re-attach or rebuild. It stays client-owned: it records what *this* client last saw, so two clients on one remote workspace each keep their own and neither may overwrite the other's. An unreachable machine still records nothing, which is what keeps a good stamp from being erased with `None` — that would disarm the next check. Also in these three files: the §N references to the deleted design docs, cleaned up as part of the sweep in the following commit. * docs: drop the references to the deleted design documents The three documents this branch removed were cited ~280 times: `design §10`, `contract §8`, `§17` and friends in comments, five references by file path in code and manifests, five in CI workflows and one in the release skill. Every one of them now points at nothing. Rewritten rather than merely stripped, because most were not decoration: "design §10 makes the remote's `workspaces.json` the authority" becomes a statement in its own right, and the several that carried a Chinese phrase from the document as their justification say the same thing in English instead. Where the reference was purely parenthetical it is simply gone. Not touched: `PRD §7.1`, `brief §8` and the like, which name documents this branch did not remove and were already external before it, and the `RFC 4648 §10` test-vector citation, which is a real specification. The `host boundary` CI job loses `(§10.6)` from its name. It is not one of the required checks, so branch protection is unaffected. --------- Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>	2026-07-29 19:15:19 +08:00
l0ng-ai	208454e202	feat(remote): remote workspaces — a window that is one machine ... Split the framework-free half of tty7 into `tty7-core` and add a headless `tty7-server` built on it, so a workspace's filesystem, git and session state can live on another machine while the GUI stays where it is. - `crates/tty7-core`: wire protocol, session daemon, PTY, native SSH engine and the domain model, with no gpui dependency. Module paths are unchanged. - `crates/tty7-server`: the same daemon with no GUI attached, linked fully static against musl and pushed onto the remote box. One dependency, on purpose — a second one the GUI also needs belongs in core. - `Host` trait + `HostId`/`HostRegistry`: every fs/git/watch call a workspace makes goes through the machine it belongs to. `LocalHost` answers on this box, `RemoteHost` over a routed control connection. - `ui::host_ops`: the GUI's single door to a `Host`. Host calls block, so all of them run on the background executor with the result landed on the UI thread; de-duplication, staleness and error reporting live here rather than at each call site. Enforced by a CI grep. - Connect flow: home page → pick a configured SSH host → the machine's own workspace list → a window bound to one workspace on it. Workspace switcher groups by machine, this computer included. - CI: static musl builds of `tty7-server` for x86_64/aarch64 via cargo-zigbuild, a host-boundary grep, and version stamping factored out of the nightly workflow. Both new jobs are non-required so branch protection does not wedge open PRs. Design and the interface contract it was built to are in `docs/2026-07-27-remote-workspace-{design,impl-contract}.md`.	2026-07-28 10:59:46 +08:00