main's #806 changed the fold test while this branch changed
toggle_sidebar_group to take Option<&GroupKey>; the textual merge left
one call site on the old signature. Fixed here.
Claude-Session: https://claude.ai/code/session_01MS7VnqvGRtNTrJG9zxtz51
A fold left the active tab's row on screen, so folding the group you are
working in drew a shut chevron with one row hanging under it and a header
counting rows that were not there — it reads as a list that failed to load,
not as a group you closed.
The exception existed to keep Cmd-T inside a folded group visible, since
`spawn_group` seeds a new tab with the group it came from. That cost is
taken instead: the pane area shows the fresh shell and the header count goes
up, and the row waits for the group to be opened. Auto-unfolding on spawn was
the other option and is worse — it only fires when the repo probe already hit
the cache, so a cold tab parks in Scratch and moves into its group later
without passing through it, and a magic that works half the time is harder to
read than none.
Claude-Session: https://claude.ai/code/session_01XD6R419Hy1CV1CeVZSRBf7
Ctrl+Tab raises the panel and holds it up until Ctrl comes back up, which
commits whatever is highlighted. That is right while the gesture is a keyboard
one, and wrong the moment the user reaches for the mouse: letting go of Ctrl
over the workspace list slammed the panel shut and picked a tab, so switching
workspaces by hand — the thing the pointer was on its way to do — was
unreachable.
The panel now tracks where the pointer is, on the card at all and on the tab
column specifically. A release with the pointer parked on the card but off the
tab column drops the hold and leaves the panel up for the mouse to finish in;
over the tab column it still commits, because that is the ordinary gesture.
Both flags come from hover listeners, so they mean nothing until the mouse has
actually moved since the panel came up, which is exactly the distinction
wanted.
Two macOS consequences of holding Ctrl, fixed with it. A held Ctrl turns every
click into a right click, so reaching for the search box mid-gesture popped
Cut/Copy/Paste instead of placing a caret — the rows already dodged this by
dropping their own menus while the gesture is on, and the box has no menu worth
keeping either (Cmd+V still pastes). And a tab row picked with the mouse
arrives on the right button, so nothing between the row and the window may
swallow that press first.
Guarded by three tests that put the pointer on a computed point of the card
rather than a hard-coded pixel: release over the workspace list keeps the panel
up and picks nothing, release over the tab column still commits, and a
Ctrl+click on a tab row mid-gesture picks the row under the pointer rather than
the one the keyboard had reached.
One UI thread paints every pane in every window, and the thread holding the
grid lock is the pane's own reader part-way through feeding a batch of output
into the emulator. Waiting for it wired one pane's write speed to the frame
rate of the whole window — the read-side twin of #709, which was this same
thread parked in `write(2)` for a stalled link.
`build_grid` now takes the lock with `try_lock_unfair` and returns `None` when
it cannot have it, so that frame paints the one before it; nobody can see a
frame of lag. Unfair rather than queued on purpose: a painter that queued would
make the reader wait for a frame it is not going to get anyway, and skipping
the queue is safe precisely because it never waits. Two frames still block,
because neither has anything to fall back on — the first frame a pane ever
paints, and the frame after a resize, whose previous grid is the wrong shape.
The cells therefore have to survive a refused frame, so the shared `GRID_BUF`
thread_local is gone and each pane owns its own `grid_buf` and `grid_snap` on
the view. What made the buffer reusable was always that it is the previous
frame *of this pane*; one shared scratch buffer could not be that once a frame
could decline to rebuild it. The `buf.clear()`/`resize` moves below the lock
for the same reason.
`key_context` and `any_selection` read frame-cached copies of the terminal mode
and the selection flag, refreshed by one `try_lock` at the top of `render`
rather than one per caller. gpui matches keystrokes against the context the
last painted frame published, so the mode was already a frame-old reading even
when it locked. Anything with a real decision to make still asks the terminal
itself — `alternate_paste` is the chord that cannot be a frame late.
`sync_scrollbar` stops blocking too: the scrollbar is a picture of where the
grid is, not worth parking a window to refresh a thumb.
Guarded by `a_frame_that_cannot_have_the_grid_leaves_the_previous_one_alone`,
which reproduces "the reader has it" with no second thread and no timing —
`try_lock` fails against a lock this thread already holds.
`subject_path_of` picks the group most of a workspace's tabs are in and hands
it back as a path. `display_name_of` then titles the window after its last
component. A custom group is a name, not a path, so a workspace grouped by
hand would have been titled `custom:work` — and one grouped as `work/urgent`
would have been chopped to `urgent`.
Only repo roots are counted now. A workspace grouped entirely by hand falls
through to a pane's cwd, which is a real path and is what the window was
titled after before any of this existed.
Claude-Session: https://claude.ai/code/session_01MS7VnqvGRtNTrJG9zxtz51
A custom group you could not drag into was a box that looked like it took
drops and did not. Dragging a tab onto one now moves it there.
The reorder surface stays split one-per-group. Merging it into a single
sidebar-wide surface would have to answer "which slots may this land on",
clamp the target through the groups that refuse it, and correct the animation
for the header heights it crosses — for an insertion point that cross-group
dragging does not need. Moving between groups is filing, not sorting: land in
the group, then reorder within it if the position matters.
So this rides beside the reorder rather than through it, the way a pane
dropped on the sidebar already does. Each frame the pointer is inside a custom
group's block, that group is offered; the offer is cleared with the rest of
the drag's pending state, so letting go anywhere else drops on nothing. On
landing, a group outranks any order the drag recorded on its way out of the
one it came from — the pointer left, so the shuffle it caused before leaving
is not what was asked for.
Only custom groups register a rectangle. A repo group's membership is decided
by its tabs' cwds, so "put this tab in tty7" is a request the sidebar has no
honest way to honour, and the same goes for Scratch. Rather than let a drag
die silently over them, a lifted tab fades every block that cannot take it and
tints the one under the pointer. Two kinds of group look alike while nothing
is moving; this is where the difference becomes visible without a word of
explanation.
The tab is carried by id. A drag lasts several frames, and a tab closing in
that time — another window on the workspace, a shell exiting — would shift
every index after it and land the drop on a bystander.
Claude-Session: https://claude.ai/code/session_01MS7VnqvGRtNTrJG9zxtz51
Groups were derived and nothing else: the sidebar read a tab's cwd and filed
it under the repo it found. Tabs that belong together for a reason the cwd
cannot see — a few ssh sessions, three forks of one project, the two panes an
investigation is spread across — had no way to sit together.
A tab can now be moved into a named group from its context menu, and the group
is remembered. What makes this safe is the previous commit: a stated group is
never recomputed, so the probe no longer drags a hand-placed tab home again.
Laid out flat rather than behind a "Move to Group ▸" submenu. Custom groups are
maintained by hand and there are never many, so a submenu would cost a second
click to reveal two or three items — and `PopupMenu::submenu` needs a `&mut
Context` that `tab_context_menu`, which reads the app entity, cannot hold at
the same time.
Three things the feature does not work without, so they ship with it:
- "Group Automatically" clears the stated group. A stated group locks the probe
out of that tab, so without a way back a tab could be moved into a group and
never follow its cwd again — and nothing on screen says that is what just
happened.
- `spawn_group` inherits a custom group. ⌘T inside a folded one would otherwise
draw nothing but the header's count going up by one, which is exactly the
symptom #804 fixed for repo groups.
- Renaming rewrites every tab in the group in one pass, and carries the fold
state to the new key. A group is only the set of tabs that name it, so a
half-applied rename would not leave a half-renamed group — it would leave two.
Renaming is on the header's own context menu rather than a double click: the
first click of a double folds the group, so the name would be edited on a box
that had just shut. A repo group gets no rename — it is named after its root,
and renaming it could only lie about where its tabs are.
Custom headers carry an asterisk. It is the only thing separating them on sight
from derived ones, which matters because the two behave differently under `cd`
and because a custom group may be named after a real repo.
Dragging a tab between groups is not in this commit; the reorder surface is
still split one-per-group.
Claude-Session: https://claude.ai/code/session_01MS7VnqvGRtNTrJG9zxtz51
Four things a user can walk into today, all of them an interaction the app
starts and does not finish.
The remote input notice and the ssh status strip were written out a builder
call at a time in two files, identical down to the padding and differing only
in the border colour. Each also placed itself: both `absolute` at `bottom_4`,
centred, and both children of the same container in `body_area` with nothing
arbitrating between them. A remote workspace whose ssh link had also dropped
drew them on top of each other. The shell moves to `ui::notice`, the notices
stop placing themselves, and the anchor is a column, so a second one stacks.
The managed port-forward form had no keyboard contract at all: zero
`on_key_down`, zero input subscriptions. No Return, no Escape, and it opened
cold, so adding a rule meant clicking into Bind first and committing with the
mouse. Every sibling form in the app has all three.
The four sftp edit forms took the focus into a box they owned and dropped the
box without handing the focus back — `sftp_cancel_edit` took no `Window` at
all, so it could not have. Naming a folder and pressing Escape left the caret
on an element that had stopped rendering and the next keystroke went nowhere
until you clicked. `ssh_prompt` asserts in a comment and a test that every
overlay in the app hands focus back on the way out; these were the
counterexample. Fixed on all three paths that take the form down: cancel, a
rename to the name it already had, and a successful op coming back from the
far side.
`Override` on the changed-host-key sheet — the one control in the product that
can accept a key that no longer matches, which is what a man-in-the-middle
looks like — carried no colour at all. `.danger()` had zero call sites across
the whole tree. It is disabled until "yes" is typed, so it greys until armed
and then goes red: the emphasis arrives exactly when the button does. Button
order and `.primary()` are deliberately left alone; `.primary()` means "the
recommended action" on both host-key sheets, and on this one that is Abort.
A sidebar group was a bare `Option<PathBuf>` the sidebar recomputed from the
tab's cwd every frame. That is right for a group the sidebar derived and wrong
for one a user states by hand: the probe overwrote whatever it found, so a
hand-placed tab would be dragged back to its repo on the very next frame.
`GroupKey` names which of the two a key is. `Repo` stays the probe's to change;
`Custom` is never recomputed. One enum rather than a path plus a `pinned` flag,
because the flag and the path are then free to disagree — and because a custom
group's name is not a path at all, which is the second half of this: it must
skip `group_names`, whose job is to lengthen repo roots until they stop
colliding. Run a name through it and `work/urgent` prints as `urgent`.
The flat spelling the protocol, the session file and the fold list all need
marks a custom group with a `custom:` prefix. No absolute path can collide with
it, and every group written before this decodes as a `Repo` — so old sessions
and old daemons keep working untouched.
Under `SidebarGrouping::None` a custom group hides like everything else. It is
tempting to exempt it, but `sidebar_sections` gives Scratch a header as soon as
any keyed group exists, so exempting one would draw two headers for a user who
asked for none. The key stays on the tab; switching grouping back on brings it
straight back.
No custom group can be created yet — this is the data layer alone.
Claude-Session: https://claude.ai/code/session_01MS7VnqvGRtNTrJG9zxtz51
A sidebar group folds shut when its header is clicked, and stays shut across
launches. A search outranks the fold — a row a live query matches shows
whatever its group says — and so does the active tab's own row, which a fold
must never hide: `spawn_group` seeds a new tab with the group it came from, so
otherwise Cmd-T inside a folded group would draw nothing but a header count
going up by one. Folded rows register no rectangle, so a pane cannot be dropped
into a group that is shut, and the header still counts every row the group has.
Separately, the diff overlay's header stops clipping its own controls. Every
element on it but the commit subject was `flex_shrink_0`, and one of those was
a focused file's path, which is unbounded — in a docked column the two things
you can actually click were pushed off the end and clipped mid-word. The path
and the byline now yield first, ahead of the subject, because each has a second
home elsewhere in the overlay and the subject has none; the path yields
head-first so the filename is the last thing to go. `split_path_leaf` moves to
`path_display` with its tests, which is where a path's display spelling lives.
* style(theme): drop the lift under every inline control
Theme::shadow gates exactly one thing -- the shadow_xs an inline control
(button, input, select trigger, checkbox, radio, slider knob) paints under
itself -- and never the drop shadow on a menu, tooltip or popover, which each
draw theirs unconditionally. Left on, every field and button in the window
carried a faint lift that nothing else here has: this chrome separates surfaces
with low-contrast fills and hairlines, so a control sitting a millimetre above
the panel was the one place claiming depth. Panels that really do float keep
their shadow.
Also bumps the gpui-component pin, and records why the switch and slider keep
their accent: both were tried on the neutral ramp the segmented controls use,
and a dark-grey "on" against a light-grey "off" turned out not to be a large
enough step to read while scanning a column of rows.
* style(tooltip): render a chrome tile's chord as a chord
chord_hint pasted a label and its shortcut into one string -- "Hide sidebar
<cmd>B" -- and handed that to Button::tooltip. Inside the card the chord then
wore the label's own size and colour, so the tooltip read as one odd sentence
rather than as a name with a shortcut beside it.
Tooltip already has a key_binding slot that sets a chord apart on the right, a
size down, in muted_foreground. What was missing was a way to hand Button a
built tooltip instead of a string; gpui-component grew tooltip_element for
that. chord_hint becomes chord_tooltip, and key_hint gains a key_stroke sibling
so a caller can reach the Keystroke rather than only its formatted text.
* style(settings): one field width, and a chevron that is not a patch
The right-hand column had three widths, each picked where it was written: text
fields 260, sliders 240, dropdowns 180. Every row still ended on the same right
edge, so on one page the difference read as controls aligned carelessly rather
than as controls of different kinds -- and moving between Appearance and
Terminal, where the mix differs, the column visibly changed width. FIELD_W is
the one number now, at 260, the widest of the three because it is the one with
a requirement behind it: a font name or a shell path has to fit untruncated.
The Program row's shell picker was a ghost button, which fills a rounded
rectangle while its menu is open, sized by hit_target to the 24px
accessibility floor -- exactly the field's inner height, so that fill met the
border top and bottom and looked like a patch stuck over the field's right end.
It now draws with no fill in any state, the way Select draws its own chevron.
Its menu was min_w(200) anchored TopRight on a chevron that sits inside the
field, so it hung off the field's right half with its left edge 110px in from
the field's own; it is now as wide as the field it drops out of.
The merge for #799 re-resolved Cargo.lock and pointed twenty consumers at
older copies of dependencies that were already in the tree for other
crates. No `version =` line moved, so the change is invisible to the usual
scan of a lockfile diff, but the graph regressed:
* 15 crates off `windows-sys 0.61.2` onto `0.60.2`
(anstyle-query, anstyle-wincon, dirs-sys, errno, miow, muda,
nu-ansi-term, quinn-udp, rustix, socket2, stacker, tempfile,
tray-icon, uds_windows, winreg)
* `winapi-util` off `windows-sys 0.61.2` all the way onto `0.48.0`
* `gpu-allocator` off `windows 0.62.2` onto `0.58.0`
* `iana-time-zone` off `windows-core 0.62.2` onto `0.58.0`
* `dlib` off `libloading 0.8.9` onto `0.7.4`
* `bindgen` off `itertools 0.13.0` onto `0.11.0`
Nothing in that PR asked for it. Its only dependency change was the gpui
fork rev, and the range it moved over touches one file in
`crates/gpui/src/elements/list.rs` and no manifest, so the resolution was
incidental to the merge rather than required by it.
This points those twenty edges back at the versions they held before, which
is what a fresh resolve picks. Every version already present in the lock
stays present: `windows-sys 0.60.2` is still there for `notify 8.2.0`,
which pins `^0.60.1`, and the older `windows`/`windows-core`/`libloading`/
`itertools` copies still serve their own consumers. So this drops no
duplicate builds; it only stops the newer copies from being compiled
alongside older ones for crates that had already moved on.
Lockfile only. No manifest and no source changes, and `cargo metadata
--locked` accepts the result without wanting to rewrite it.
Refs #433.
Adopts the held seed at the editor's own doors rather than at submit time, so a recalled history entry, a ctrl-U, a ghost suggestion or a completion is no longer glued to the front of the gap text.
Also closes a paste-provenance hole left by #790: release_hold()/dump_hold() pushed the hold's contents into the typeahead record as plain text, dropping the paste mark, so a paste made during a gap that outlived the hold window came back looking typed and was submitted raw through the shell's binding table.
Windows tty7-app tests go 1466 -> 1638 with no assertion weakened.
Also holds the SCM graph idle test's daemon end open: the moved handle closed the socket right after writing Cwd, which on Windows (loopback TcpStream with unread data) is an abortive close, so settle_graph would time out and the test would silently skip every assertion.
Refs #738.
Keys the origin memory by the pane a move lands on as well as the direction: the per-direction array meant a two-step walk clobbered the first step, so Left, Left, Right, Right ended in the wrong pane. Entries are pruned on write when either side names a pane the tab no longer holds.
Refs #751.
The PR body's rationale is stale as of #788: build_font now emits calt:0 liga:0 clig:0 and gpui's DirectWrite backend zeroes all three, so ligatures are off by default on Windows and the Calibri office/waffle repro no longer fires with default settings. This is a fix for users who opt ligatures back on, and for any face on any platform that collapses glyph count.
Reconciled onto #783: the fit flag is gone, so seg_budget now takes ink_covers_segment and the shaping moved above the budget.
Refs #750; only half fixed — the US SHIFTED_GLYPHS table means secondary-shift-]/[ stay unpressable on German/French/Nordic layouts. A layout-correct fold needs KeyBinding::load with the real keyboard mapper.
Also runs the control-code guard over the folded spelling, so ctrl-shift-2 no longer installs ctrl-@ (NUL) beside it.
Refs #710; does not close it (the request was a jump list opening a chosen existing workspace).
Registers NewWindow globally as well as on the render root, since with the tray icon on (the default) closing the last window retires to the tray and leaves no window to dispatch it.
Refs #721.
Reconciled onto the virtualised row list from #799: the selection is keyed on RowAt { path, RowId } rather than the flat list index, since collapsing a file above the selection re-points flat indices.
26.9.0's tray-retire model made closing the last window the "keep the daemon,
drop the UI process weight" gesture, but that path was reachable only from the
OS red close button: no action, no palette entry, nothing to bind. `⌘W` closes
a pane or tab, `⌘H` hides the window but keeps it in memory, and `⌘Q` stops the
server. There was nothing that closed the window and left the shells running.
`CloseWindow` is that action, with no default key — the slot is left free.
The logic that decided what a window close means (detach the workspace, and
on the last window retire to the tray if an icon is actually up, otherwise
quit) moves out of `on_window_should_close` into `prepare_window_close`, so
the button and the action share one decision instead of two that can drift.
Notably not routed through `close_window_for`: that one recycles the last
window onto a fresh workspace, which is what deleting a workspace wants and
not what closing a window wants.
It reaches the command palette, the Keybindings UI, and the reference table
of actions with no default key. In the palette it sits beside Quit, because
that pair is the whole point of the action: both end the window in front of
you and only one takes your shells with it. Their subtitles now say which —
including Quit's, which had been promising "shells keep running" while
calling `daemon::spawn::stop()`.
Co-authored-by: bytehello <bytehello@users.noreply.github.com>
https://claude.ai/code/session_01LKMZVh6mUBxXAn6v7P6JC6
The overlay built its whole patch as a nested element tree on every frame:
a card per file, a header per hunk, six elements per line. gpui notifies the
view on each scroll wheel event, so a few hundred lines of diff rebuilt tens
of thousands of elements tens of times a second, and the window stalled.
Flatten the tree into one row per line in a new `diff_list` module and draw it
with `gpui::list`, which builds only the rows on screen. The rows are rebuilt
only when what they are built from changes, so scrolling no longer re-splits
hunks or re-clones every line, and a change to one file splices just the rows
it touched rather than resetting the list and losing the scroll position.
The key that decides a rebuild takes the snapshot each frame was asked about
even when it matched only by contents. A probe that finds nothing new still
lands a fresh `Arc` over an equal snapshot; a key left pointing at the old one
would go on walking the whole patch to prove the two equal, once per wheel
event, which is the cost the key exists to avoid.
A list counts a row it has not laid out yet as zero tall, which left the
scrollbar reading an 800-line patch as one viewport: its thumb filled the
track, and a drag from top to bottom travelled 248px and stopped. The rows
below the fold are counted at the 19px both views already give a line of a
patch, through `ListState::with_size_hint` — added to the gpui fork for this,
`Cargo.lock` following its `tty7` branch to `ece710e3`.
A card cannot survive that flattening — its rows are separate items now — so
the frame it drew is gone, and with it the grey header bars and hunk bands
that made the overlay the one view in the app still speaking gpui-component's
default container language. The rows take the source control panel's own
measurements instead: 26px, 10px inset, 5px radius, colour only under the
pointer. The title bar's view switch loses its border for the same reason.
Reverting the projects layer took CONTROL_VERSION back to 7 with the
verbs it had been raised for. The dialect that number describes is
correct — this build speaks v7's messages again, one for one — but the
number is not, because v8 is already deployed.
A version that moves backwards stops being an identity. A 7 on the wire
would mean "before projects" or "after them" depending on which build
sent it, and the handshake has nothing but the number to tell those
apart: a v8 peer would read our 7 as an older server it may keep
talking to, and every project verb it pushed would fail to decode and
drop the link.
v9 is a number no peer has seen, so a v8 peer is turned away at the
handshake instead. Nothing else changes; every other reference to the
constant is relative to it.
Claude-Session: https://claude.ai/code/session_015q6HRem76HYy33T39bp34c
Reverts cebd871c. The declared layer sat beside the derived repo groups
rather than replacing them, so the sidebar carried two kinds of heading
that look alike and behave differently, plus the verbs to create, rename,
re-root, reorder and delete one. That is more interface than the problem
was worth, and the derived grouping already covers the common case.
Everything the commit touched goes back: the Project entity on the
machine, the per-tab reference, the six control verbs and their layout
deltas, the sidebar rail and tab strip surfaces, the mirror and tree-sync
paths, and the i18n strings.
CONTROL_VERSION drops back to 7 with the verbs it was raised for. A
remote box still serving the v8 build will be turned away at the
handshake until its tty7-server is replaced.
Sessions written while projects existed still load: `projects` and a
tab's `project` are unknown fields now, and serde drops them.
Claude-Session: https://claude.ai/code/session_015q6HRem76HYy33T39bp34c
A daemon that died without unlinking its Unix socket stopped every later
daemon on that machine from ever starting. The client launched one, it
exited on the bind, the client launched another, forever.
run_with does clear a stale endpoint, but only after a probe it skipped
whenever the recorded daemon was known dead — reasoning that the bind below
would overwrite the file. That is true of a Windows port file, and the whole
of #639, where the skip came from, is Windows ports: it added a connect
timeout so a firewalled stale port fails fast. On Unix the endpoint is a
socket file and bind refuses any path that exists, so the one path that
reached the bind with a leftover still there was the one that skipped its
removal.
What decides the removal is now the single-server seat, not the pidfile.
Holding it means nobody else can be serving this config dir, so anything
still at the endpoint belongs to a process that is gone — safe by
construction, which is the property `singleton` exists to provide. Removing
on one failed connect instead is the race that module was written to retire,
so it is used only where there is no seat, and even there a socket that
answers is refused rather than removed.
Reproduced on a Linux box: with a socket nothing was behind and a pidfile
naming a dead pid, main exits 1 on the bind and this starts and serves.
Claude-Session: https://claude.ai/code/session_015q6HRem76HYy33T39bp34c
A remote workspace could sit in a loop nobody could get out of: every
reconnect failed with "started but nothing was answering on the control
socket after 15s", the strip showed a copy bar frozen at 100%, and no
button was offered.
The daemon is the root of it. When its control listener would not open it
logged one line and kept running — and a running daemon holds the
single-server lock, so every later --daemon stood down at once and every
client probe failed, forever. Whether something else is serving cannot be
read off the errno: bind_control_socket clears the leftovers it can, but a
path it cannot clear comes back AddrInUse in the same words a live server
does. Ask by connecting, and exit when nothing answers.
The reason was thrown away twice over: the daemon's stdout and stderr went
to /dev/null, and the readiness probe kept only out.success(). Both are
kept now — output and exit status land beside the binary, stamped with the
launch's own nonce so a restart never reads the outgoing daemon's status as
the incoming one's. A start that has already failed no longer waits out the
full timeout.
The UI half: an automatic reconnect never retired its install progress, and
a leftover entry draws an install in flight instead of the failure and its
button. And a long error stretched the status card to 1978px in a 1440px
window, taking the retry button off the screen with it.
Closes part of #774. The Vim :wq cursor and the btop re-attach items in that
issue are not touched.
Claude-Session: https://claude.ai/code/session_015q6HRem76HYy33T39bp34c
* feat(sidebar): add projects as a declared layer beside the derived groups
The sidebar's repo groups are derived: a group's identity is a path
recomputed every frame from a leaf's cwd, it appears when a tab lands in
it and vanishes with its last tab. That layer cannot carry a name of its
own, cannot be created before a tab is opened in it, and orphans anything
keyed to it when a directory is renamed or moved.
Add a Project as a real entity on the workspace — an id, an optional
name, a root — and an optional reference to one on each tab. Nothing
probes it: a tab joins a project only by an explicit action, and a tab
that leaves one lands back in the group the probe would have put it in,
so declaration and inference never disagree and no third membership
state is needed.
The derived grouping, the cwd probe, the write-back and the
SidebarGrouping config are untouched; the only difference is the tab list
they are fed. A server that predates the projects feature ignores the new
array and serves today's sidebar.
Closes#756
* fix(sidebar): stop a searched row claiming a chord it does not own
A live search deliberately ignores a folded heading — the query is asking
about tabs — so the rail draws rows the chord order has taken out. The badge
was read from a `Vec<usize>` that started at zero, so every one of those rows
claimed ⌘1 while ⌘1 opened something else. It is `Option<usize>` now, built by
`badge_positions` off the same order `activate_visual` walks, and a row the
order left out wears no badge at all.
Also in the rail: the block loop reads "declared" off the section key rather
than the position it happens to sit at, and an unreachable `continue` for a
folded empty derived block is gone — `sidebar_sections` never makes one.
Projects:
- `MAX_PROJECTS` is held on the window side too. The machine refuses past it
and a refusal resynchronizes, which would re-push the project this window
kept and be refused again. Checked before the folder panel opens, so a full
workspace says so before asking for a folder rather than after.
- `set_project_root` keeps the one-project-per-directory rule `declare_project`
holds on the way in; pointing one project at another's folder reached the
two-headers-that-mean-the-same-thing state by the back door.
- Opening a rename box over one already on another project commits it instead
of dropping it with its subscription, which threw the typing away.
Sync:
- Project reordering moves after `retire_projects`. `to` indexes the machine's
whole list, so a project on its way out pushed the survivors along and spelled
a move for one already in place.
- `adopt_projects` reports whether it changed anything and the callers repaint
when it did; it was mutating the window's list with nothing to notify.
- `migrate_panes` gets its doc comment back — `reconcile_projects` had been
inserted between it and the comment describing it.
Dead `L10nKey::ProjectNew` removed: translated four times, used nowhere.
* fix(control): move the dialect to v8 for the project verbs
`CONTROL_VERSION`'s own doc says to move it whenever a variant is added to
`ControlRequest`, `ReplyOk` or `ControlEvent`, and says why the feature strings
are not a substitute: they cover what a peer can safely ignore — a field added
to a message it already decodes — while a variant it has never heard of fails
to decode and takes the whole link down with it.
The project verbs shipped behind a `projects` feature string instead. That
gates what a client *sends*, so a v7 server never saw a verb it could not read,
but nothing gates what a server *pushes*: a v7 client meeting a v8 server that
had grown a project would take the `ProjectCreated` delta, fail to decode the
frame, and lose the link — `read_until_closed` calls `fail_all` on any decode
error. Only the number can turn that pairing away at the handshake.
So the number moves and the feature goes. It was redundant even for the
direction it did cover: `MACHINE_TREE` and `PROJECTS` were pushed under the
same `services.machine.is_some()`, so within one build they were always equal
and only a cross-version pairing could tell them apart — which is exactly what
v8 now refuses at the handshake. Keeping both would be two mechanisms for one
job, and the weaker one silently covering half the problem.
Removed with it: `is_project_op` and the `pump` filter it fed.
Disk compatibility is a separate axis and is untouched — `Workspace::projects`
and `Tab::project` keep their `serde(default)`, and the test that reads a tree
written before either still passes.
Remote workspaces need their `tty7-server` pushed before they will connect.
That is the dialect-refusal path v7 was minted to make reachable: the parked
strip and its Update Server button.
Also: the two sidebar `+` buttons now fade in on their own heading's hover
rather than the whole rail's, so a control appears where the pointer is.
One hairline value served every line in the app: the outline that closes a
menu, tooltip or card floating over other content, the rule under a header, and
the seam where the sidebar meets the terminal. Those are not the same job. The
first two are the only thing saying where an edge is; the last runs between two
panes that already carry their own fills, so painting it at full weight makes a
workspace read as boxes bolted together instead of one surface.
Split the derivation into two tiers off the same blend. `border` keeps the 1.5:1
floor for outlines and in-pane rules; `divider` takes 1.2:1 and feeds
`sidebar_border`, which is already used at exactly the six pane seams that want
it — the tab sidebar, the right panel, the document column, and the two
workspace edges in `app.rs`. On the default light theme that moves the seam from
#c8c8c8 to #dfdfdf and leaves every popover outline where it was.
`right_panel`'s rule under the tab row goes back to `border`: same fill above
and below, so the line is carrying the separation alone.
Worth stating because the code hid it: the `mix(bg, fg, 0.16)` seed clears
neither floor in any builtin theme, so both values are decided entirely by the
constants. Lowering the seed changes nothing — that is now in the comment, and
`DIVIDER_FLOOR` is the knob if the light tier turns out too faint.
Claude-Session: https://claude.ai/code/session_01GAjHNse9BDu5jSCjU5QTKe
* fix(daemon): let a clean version probe clear the mismatch record
The restart prompt was armed from a global that only ever accumulated:
`note_daemon_mismatch` could set it, and nothing could take it away
except the window that consumed it. `ensure_running`'s agreeing path
never touched the record at all.
That matters because `ensure_running` is the first thing every
control-link reconnect attempt runs, and a mismatched daemon is one no
connect succeeds against. The link backed off and retried, arming the
prompt again each time round — including in the seconds the user spent
reading the dialog it had already opened. Restarting the daemon then
fixed the daemon and not the record, so the next window built took that
last arming and asked a second time about a server that was already
gone.
Make a probe's verdict settle the record rather than only add to it: a
daemon found to be ours wipes what an earlier probe left. The probe
judgement moves into `judge_probe`, and the handoff's own return
judgement into `judge_handoff_return` / `land_handoff_return`, so both
are testable apart from the sockets it takes to reach them.
Claude-Session: https://claude.ai/code/session_01GAjHNse9BDu5jSCjU5QTKe
* fix(daemon): tell a silent control socket apart from an agreeing one
`control_dialect_refusal` returned `Option<DialectRefusal>`, and `None` meant
both "it answered with our own dialect" and "it never answered at all" — a
connect that failed, the handshake timing out, a peer that hung up before
`HelloOk`. That conflation was harmless while silence only meant "record
nothing". It stopped being harmless when a clean verdict started *clearing* the
mismatch record: a control socket that times out now wipes a refusal the
control link had already met, and the window built next opens with no tabs and
nothing on screen to explain why — the exact state the record exists to
prevent. The function's own doc comment still promised the opposite.
Give the answer three shapes (`DialectAnswer::{Agrees, Refuses, Silent}`) and
carry the distinction through to the verdict (`MismatchVerdict::{Clear, Found,
Unchanged}`). Only `Agrees` clears. Silence leaves the record exactly as it
stands, which is the cheap side of the asymmetry: a stale record costs one
prompt about a daemon that turned out fine and the next probe takes it away,
while a wrongly cleared one costs a window its tabs.
The landing also moves out of `ensure_running` into `land_probe`, so the
logging and the record write are one thing a second caller can reuse.
Claude-Session: https://claude.ai/code/session_01GAjHNse9BDu5jSCjU5QTKe
* fix(daemon): settle the mismatch record on the restart path too
`ensure_running` only settles the record on the branch where a daemon is
already listening and answers. `restart()` is `stop()` + `ensure_running()`, so
by the time it runs the connect is refused, the endpoint is reaped, a daemon is
spawned, and the startup poll loop returns having written `note_local_daemon`
and nothing else. The record still describes the daemon the user just killed.
That is the path a mismatch is most likely to take. A daemon from before
protocol versioning reports no version at all, so `local_daemon_supports`
answers false for the handoff feature and the prompt's Restart takes
`restart()`, not `hand_off()` — the one branch that was given a clear.
Judge the freshly spawned daemon with `judge_probe` and land it with
`land_probe`, the same pair the already-running branch uses. The control
listener is up before the pane endpoint binds, so the dialect can be asked this
early; a daemon that answers neither handshake is still recorded as nothing,
same as before.
Claude-Session: https://claude.ai/code/session_01GAjHNse9BDu5jSCjU5QTKe
* fix(daemon): drop a probe verdict about a daemon that is already gone
A probe is not one instant: it connects, asks the pane endpoint and the control
socket, and only then writes what it found. In between, this build can stop the
daemon, hand it off, or spawn a new one — and now that a verdict *settles* the
record rather than only adding to it, a late one is not a stale read but a
wrong write.
Against a mismatched daemon that is the normal case, not a corner. The control
link retries on a backoff and every retry runs `ensure_running`, so when
`land_handoff_return` clears the record, a probe that connected to the outgoing
image before the exec lands afterwards and re-arms the prompt about the daemon
the user just replaced. The clear was best-effort against its own retry loop.
Stamp each verdict with a counter that moves whenever this build deliberately
changes which process serves — `stop`, `reap_stranded`, `spawn_detached`, and
the handoff at the point the exec is asked for — and drop a landing whose stamp
is stale. Probes against the same daemon are still last-one-wins, which is what
a record of "what is running now" should do.
Claude-Session: https://claude.ai/code/session_01GAjHNse9BDu5jSCjU5QTKe
* fix(terminal): recall the last matching command on ↑ and Ctrl+P
The prompt editor walked history in file-load order and ignored the
prefix on the line, so the first press showed whatever had been
concatenated last — often an old tty7 record, or a command that had
nothing to do with what was already typed. Keep the prefix from when
navigation started, the way zsh's up-line-or-beginning-search does,
and order merged history files by timestamp.
* fix(terminal): search history on the text left of the cursor
up-line-or-beginning-search matches on $BUFFER[1,CURSOR], not on the
whole line, so Ctrl+A followed by UP has to walk every entry rather than
filter on text the user is about to type in front of. Keep the search
prefix and the line stashed for DOWN in separate fields: restoring what
was typed still needs the part sitting right of the cursor.
Also cover the borrowed-mtime path, which had no test: untimestamped
bash lines must take the file mtime, keep a real timestamp when they
have one, and survive an unreadable mtime untouched.
Claude-Session: https://claude.ai/code/session_01GAjHNse9BDu5jSCjU5QTKe
---------
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
* feat(ssh): allow remote image clipboard writes
* fix(ssh): keep a profile's clipboard grant across a re-attach
A native ssh pane's OSC 5522 permission is decided by the spec that
dialled the host, and the daemon is the only side that holds it. A window
reopening onto a pane that outlived it attaches by pane id, has no spec
to read, and sends `allow_remote_clipboard_write: false` — which the
daemon took as the new answer and the pane's own view took as a refusal.
Both sides then said no, so the first restart after switching the
permission on turned every copy into an `EPERM` with the switch still
reading "on".
Pin the spec's answer in the pane and route both attach and detach
through one decision point, so a pane that carries a spec keeps that
spec's answer whatever an attaching client claims, and a pane without one
— everything on a remote `tty7-server` — is exactly as permitted as its
controller says. On the client side, refuse only what the pane can see is
forbidden and leave the verdict to the daemon otherwise.
Also: release a failed transfer's buffered bytes instead of parking up to
`MAX_CLIPBOARD_BYTES` per pane until the next request, and answer the
capability probe with the permission actually in force rather than a
constant that always reads as "off".
---------
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
l0ng-ai
ayamir
bytehelloandbytehello
dependabot[bot]
momoandl0ng-ai