The phone showed Tauri's default icon: `tauri ios init` filled the Xcode
project with it. The committed icons/ios set was drawn on the macOS grid,
a rounded tile inset on transparency, which iOS would shrink inside its own
mask with a pale border. icons/app-icon-ios.svg is the same Duo mark full
bleed, rendered without alpha as the App Store requires.
Claude-Session: https://claude.ai/code/session_01HVosmYyVSH3BrsLYx3tcSS
The app takes the desktop's neutral greys, light and dark, with ink rather
than a system blue for what is pressed or chosen.
- Machines: pairing's "+" moves to a floating bar at the bottom beside a
search field. Each machine shows its link, round trip and tab count as
last seen.
- A machine: tabs grouped by workspace with a count; round agent glyphs;
a dot on the right for running or waiting on you. The per-group New tab
buttons give way to one "+" in the same floating bar, beside tab search.
- New tab: a sheet to pick Claude Code, Codex or a shell, and the
workspace. An agent's command is typed into the new tab once it is live.
- A pane: the bar keeps only back, the title with its state, and a menu
for selecting text, the fit and the phone's size. Under it, one row of
equal keys, a page at a time, and a message box that is always there;
its round button sends, or when empty hands the keyboard to the
terminal.
Co-Authored-By: Claude <noreply@anthropic.com>
The WKWebView's scroll view inset its content by the safe areas, and the
page, laid out with viewport-fit=cover, padded by env(safe-area-inset-*)
as well. The viewport came out 778pt tall on an 874pt screen: everything
sat a status bar's height too low, with a blank band under it. The scroll
view's automatic inset adjustment is now off, so the page runs edge to
edge and its CSS alone keeps clear of the status bar and home indicator.
Co-Authored-By: Claude <noreply@anthropic.com>
Sets the development team so `tauri ios init` writes it into the Xcode
project, and marks the app's encryption (standard TLS/QUIC only) as exempt
so TestFlight uploads skip the export-compliance question.
Co-Authored-By: Claude <noreply@anthropic.com>
Pairing took a pasted `tty7pair:` code, which on a real phone means getting
text off the desktop somehow. A Scan button next to Paste now reads the QR
code tty7 shows, through tauri-plugin-barcode-scanner, and pairs straight
away. The camera runs behind the WebView with our own viewfinder and Cancel,
since the plugin's full-screen view has no way out. The plugin is registered
on phones only, so the desktop dev build is unchanged.
The key bar gains Enter, so an agent's highlighted choice can be confirmed
without raising the keyboard, and 1 2 3 y n for numbered choices and y/n
prompts.
Co-Authored-By: Claude <noreply@anthropic.com>
Panning a pane wider than the phone scrolled xterm's own box sideways with
the text. The box was only the view's width, so its vertical scrollbar
panned off with the columns and its scrollback stopped taking touches past
the first screen. The box now spans every column, and the bar is shifted
to the visible right edge as the view pans.
The bar is also drawn like the indicator WebKit shows for the pan, thin,
rounded and translucent, instead of VS Code's 14px square slider, so the
two axes match.
Co-Authored-By: Claude <noreply@anthropic.com>
The first iOS build failed to link: netdev and system-configuration, pulled
in by iroh, need SystemConfiguration.framework, which the generated Xcode
project does not list. bundle.iOS.frameworks adds it on `tauri ios init`.
Once linked, the app panicked at launch: iroh builds its reqwest client with
`rustls-no-provider`, so a process-wide crypto provider must be installed
before any client is built. Install ring's, which is already in the tree.
Co-Authored-By: Claude <noreply@anthropic.com>
The + menu lists up to three agents that have actually been run, beside
Local and SSH. Other Agents… opens Search Everywhere already filtered to
agent. New Agent Tab still starts the one used last.
Refs #955
Co-authored-by: stevelliu <stevelliu@tencent.com>
The docs root becomes a custom-mode landing page modelled on the Claude
Design "Terminal Redesign v5" window. The hero is an HTML/CSS rebuild of
that window that autoplays five chapters taken from the promo storyboard:
agent status and notifications, one agent driving another through the
tty7 CLI, the editor prompt, Search Everywhere, and sessions outliving
the window. It follows the docs light/dark theme and pauses off screen.
Agent avatars use the app's own marks and brand colours (CLIAgent::
accent_rgb / icon_path), and status dots use AgentStatus::dot_rgb.
The previous introduction moves to /introduction, and the navbar logo
now links to the landing page instead of GitHub. All landing-page CSS
is scoped under .t7h / .t7w, since Mintlify loads it on every page.
The rule between kept and derived groups sat in the list as a child of
its own, between two GROUP_GAPs, so kept groups stood more than twice as
far from the rest as groups stand from each other. It now takes up the
one gap instead of adding another.
The kept-group mark is a drawn pin rather than a diamond glyph, on the
header and on the pin button an auto header shows on hover.
Right-clicking the empty sidebar under the tabs did nothing. The room
below the last row now opens New Tab and New Group.
* fix(deps): gpui-component keeps highlight boundaries on char boundaries
Typing Chinese through the IME in the code editor could panic the app:
after a sync parse ran past its 2ms budget, the stale injection layers
put a style boundary inside the committed glyph and the text system split
the line mid-character. Debug builds miss the budget often enough to hit
it; the fork now snaps every style range to the current text.
* feat(ui): bring the modal cards onto the v5 design
- Confirmations take v5's alert shape: title and detail as one
paragraph, answers beneath, no header row or footer rule, 360px wide
and set lower, at eye height.
- Dialog buttons take the field's 7px corner and 14px padding; a
secondary answer rests on the well's faint fill instead of bare text.
- The scrim dims rather than blacks out: 45% dark, 14% light.
- The New Workspace form joins the other cards: 12px corner, borderless
wells for its fields, an esc cap and the shared 40px footer.
* feat(editor): draw the editor's right-click menus like the rest of the window
The text's menu was gpui-component's native OS menu: another font and
material, no shortcuts, and Go to Definition / Show Code Actions that no
language server ever enables. It is now a PopupMenu with Attach to Agent
(the selected lines ride along as #L3-9), Undo/Redo, the clipboard,
Find, Go to Line, and the file's own items: Open in Browser for web
files or Open with Default App, Reveal, Copy Path, Copy Relative Path.
The file tabs get a menu too: Close, Close Others, Close to the Right,
and the same file items. Closing several asks once about unsaved edits.
* chore(deps): gpui-component moves the caret on right-click under a host menu
* feat(agents): add Qoder CN CLI integration
* fix(agents): spell Qoder CN's config override QODERCN_CONFIG_DIR
The China build of Qoder resolves its configuration through QODERCN_CONFIG_DIR.
The first pass invented QODER_CN_CONFIG_DIR instead, so an install that set the
real one was treated as unrelocated: hooks went to ~/.qoder-cn and history was
scanned from a directory the CLI never writes to. The test that should have
caught it set the same invented name, so it only proved the name agreed with
itself.
Picks up the rest of the review as well — detect the `qoder-cn` dispatcher
beside the other two binaries, call it the mainland-China build rather than a
different vendor, and drop the QODER_CN_HOOK_EVENTS alias for the table it only
pointed at. The serialized enums keep their variants appended; only the
independent ALL arrays moved QoderCLICn next to QoderCLI.
* fix(path): read the interactive shell's PATH, not just the login shell's
The GUI starts with launchd's bare PATH and refills it by running the login
shell. A login shell reads .zprofile/.bash_profile and never .zshrc/.bashrc,
so every directory exported there was invisible to the app: agent quick
launch found only what /opt/homebrew/bin and /usr/local/bin happened to hold,
and an agent_launch override could not bring a missing program back, since
the override's program is looked up on the same PATH.
Probe with -i as well (fish unchanged: it reads its config in every mode) and
take the last non-empty line, so an rc that prints a greeting above the
echo $PATH cannot be mistaken for the value.
* fix(path): bound the interactive PATH probe and bracket its output
Running .zshrc/.bashrc on the startup path needs guards the login-only
probe could do without:
- Read the PATH between markers instead of the last line, so an exit
hook that prints after it cannot be taken for the PATH.
- Return as soon as the closing marker arrives rather than at EOF: an rc
that backgrounds a daemon hands it the pipe, which then never closes.
- Give up after 5s and kill the shell, so a slow or stuck rc delays
startup instead of preventing it.
- Probe after forwarding an open path to a running window, which has no
use for the PATH.
* docs(changelog): describe the bounded PATH probe
---------
Co-authored-by: stevelliu <stevelliu@tencent.com>
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
The GitHub panel borrowed only gh's active account, so a private repository
owned by an organisation another signed-in account belongs to read as a 404.
When the active account gets a 404, 401 or 403, retry with gh's other
github.com accounts and remember, per owner, the one that got through. The
other accounts are listed lazily (gh auth status checks each online), and a
token from GH_TOKEN/GITHUB_TOKEN keeps its no-fallback meaning.
The empty view replaces the rows, so the list's top padding the scope row
is laid over never reached it and the row sat on top of "No results". It
now keeps its own clearance and sits left-aligned on the rows' column.
Claude-Session: https://claude.ai/code/session_01Aeskbok7Ah7dvKWnaaJFEg
Picks up l0ng-ai/gpui-component bce0d8ec: popup and context menus take
the v5 popover look — a neutral hover step, 28px rows, a hairline ring
and v5's long shadow.
Claude-Session: https://claude.ai/code/session_01Aeskbok7Ah7dvKWnaaJFEg
- Search Everywhere follows the v5 design: the scope row sits under the
field, Files leaves the row, Tab and the All tab (Go to File still opens
it), the scopes run All, Terminals, Sessions, Hosts, Commands, matches are
picked out in the title, subtitles move to the right edge, and the footer
leads with Next scope.
- The right panel's Files field searches file names and file contents at
once, in two sections. The Search tab folds into it; a stored "search"
tab and Show Search open Files with the field focused.
- The right panel's tab row is words again: Info, Files, Changes, GitHub.
Claude-Session: https://claude.ai/code/session_01Aeskbok7Ah7dvKWnaaJFEg
The repo row, the two segmented switches and the list sat flush against
each other. The list now starts 10px below the header, the gap the Files
and Search tabs leave under their search field, and the switches get more
space between them when a narrow panel wraps them onto two lines.
With a document or the detail panel docked, the title bar spans the
workspace on Windows and Linux, and the Search Everywhere box centred on
all of it landed under the document's hoisted header, which has no fill
to hide it.
* fix(ui): draw every confirmation as the app's own dialog card
window.prompt fell through to NSAlert on macOS and TaskDialog on Windows,
so closing a busy tab threw up a system alert with a centred app icon and
stacked grey buttons while every other question the app asks is a
ui::dialog card. The Linux fallback card had drifted too (accent buttons,
its own padding).
TextPrompt is now built from ui::dialog on all three platforms: the 12px
card at the switcher's top offset, a wrapping title row with an esc cap,
a hairline footer and ink-filled primary. Return and Escape keep the
native meanings; the scrim occludes the window and backs out; a lone OK
answers Escape; an answer listed after Cancel in a prompt of three stands
apart at the footer's left, and an action behind a Cancel-first default
is painted red.
SCM's discard and destructive-op prompts passed Cancel as a bare label,
which gpui only recognises as a cancel when it is the English word; they
now mark it explicitly.
* fix(ui): show the settings window's toasts and title git failures
The settings window is a gpui Root of its own but never rendered the
notification layer, so everything the page reported (an ssh_config
import, a passphrase it could not store) was pushed into a layer nobody
drew.
A failed git op was toasted as one bare stderr line
('push: fatal: ...'). It is now an error toast titled 'git push failed'
with git's reason, severity prefix dropped, beneath it.
* fix(settings): one control language down the right-hand column
The page had drifted from the design system: dropdowns and secondary
buttons were raised white with a drop shadow, fields had a half-pixel
inset ring that anti-aliased to nothing on a 1x display (the shell and
proxy rows read as loose monospace text), and dropdowns sized to their
value beside fixed-width fields, so the column's left edge zig-zagged.
Fields, dropdowns, secondary buttons, steppers and search fields now all
stand on the theme's muted well with no outline or shadow; a field shows
a ring only for focus (accent) or error. Fields and dropdowns are 28px
and one width (kit::CONTROL_W); only path and command fields are wider.
Field text is sized on the Input itself, since its own text_sm outranked
the size set around it. A host saved under its own address no longer
repeats it as a subtitle.
* fix(ui): tidy menus, the switcher and the editor's conflict strip
- New Tab menu: host endpoints elide against fixed caps instead of being
clipped mid-glyph at the panel edge; notes are right-aligned again.
- Switcher: a workspace's tab count reads '1 tab', not a bare 1 beside
the slot number.
- Editor 'changed on disk' strip: neutral with an amber dot and dialog
buttons, Keep mine as the safe primary, instead of an amber wash with a
library-default outlined button.
- Title bar search keeps its full label with a document docked.
* fix(search): a command named in the query leads over a session that says it
'worktree' then Return resumed a past agent session instead of opening
New Worktree Tab. Two causes:
- The fuzzy scorer matched greedily from the left, so the query's first
letter was spent on any earlier occurrence ('New') and the rest
scattered: a title containing the whole word scored as a poor match.
It now tries every position the first letter occurs and keeps the
best; the leftmost alignment is one of those, so no score drops.
- Session titles are whatever was first typed to an agent, and those
often open with a command's name, taking the prefix bonus. On the All
tab the Sessions section now stands back by a little more than that
bonus when sections are ordered; a session still leads when it is
plainly the better answer, and the Sessions tab ranks untouched.
* fix(ui): dialog wells and mono detail that hold up in the dark
Dialog fields, info wells, keycaps and disabled filled buttons used the
theme's muted fill, a step off the window. Cards sit on the popover
surface, which a dark theme lifts to about the same value, so every
field on a dialog lost its shape. They now take the card's own next
rung.
The host-key fingerprint and the worktree path preview asked for the
'monospace' family, which gpui resolves as a literal family name and
falls back from; they use the theme's mono family.
* fix(ui): one way to draw a shortcut
- Every chord is one cap per key. The home page and the switcher's
footer packed theirs into a single cap (⇧⌘T, ⌘↵) beside Search
Everywhere's ⌘ T; dialog::chord is the one spelling now, and the
switcher's private copy of dialog::keycap is gone.
- On macOS modifiers are listed ⌃ ⌥ ⇧ ⌘ whatever order the binding was
written in, as the menu bar lists them; the palette read ⌘ ⇧ D.
- Return is ↵ everywhere; key_tokens alone drew ⏎.
* fix(ui): file errors as titled error toasts; say a delete is for good
HostOps::notify_err ran its context and the reason together as one
plain line ('Could not delete a.txt: You do not have permission.').
Every context it is given is already a sentence about what failed, so
it is now the title of an error toast and the reason sits under it. The
'{context}: {error}' template is gone with its last caller.
The delete confirmation's detail repeated its title ('The file will be
deleted.'). The remove is permanent, not a move to the Trash, and that
is the one thing worth saying there.
* fix(ui): every failure toast says what failed, why, and that it failed
About twenty toasts reported failures as one plain line with no
severity: 'Could not open a terminal: <why>', 'Couldn't forward :3000 —
<why>', 'SSH reconnect failed: <why>'. host_ops::failure turns such a
sentence into an error toast, taking what failed as the title and the
reason beneath it. It splits the formatted text rather than the
templates, because some of them are also shown whole (the home screen
keeps the start-up failure on screen), and a reason that is not at the
end leaves the sentence whole.
Waking a tab and reopening one are errors too; tabs that could not be
restored are a warning.
* fix(settings): a primary with nothing to do rests on the well
A disabled or not-yet-dirty primary (the host form's Save) was the ink
button faded to 45-55%: a washed-out black button that still looked
like the thing to press. It now sinks to the well with secondary text,
the fall the dialogs' Create and the Git panel's Commit take, and turns
ink once there is something to save.
* fix(settings): the shortcuts page's way back is drawn, and its title lines up
The back link to Keyboard & Mouse was pulled up out of the page column
with negative margins, above the scroll area's clip, so it was never
drawn - the page had no visible way back - while the rest of its height
pushed the title 16px below every other page's. It now sits in the
title-bar band, and the title is where the others are.
* fix(settings): searchable dropdowns say they can be searched
The filter field shared by the page's searchable dropdowns (themes,
shells) had no placeholder, so it read as a stray caret between the
preview and the list.
* fix(i18n): no stray space before the default shell in zh and ja
The shell intro put a space before {default}, meant for a Latin shell
name, but the default is the localized 'your login shell', so zh read
'留空则使用 你的登录 shell'. The ja sentence also ended on the bare
noun.
* fix(settings): action menus don't reserve a column for a tick
Every settings menu kept an empty tick column, so a menu of actions
(an agent's Reinstall / Reveal / Uninstall) set its labels 24px in from
a 12px right edge. The column is kept only when some entry is ticked -
a choice menu - and an action menu is padded evenly.
* refactor(settings): drop the raised-control paint nothing uses now
Tk::btn and Tk::raised_hover lost their last callers when the page's
controls moved onto the well. Also corrects two comments that described
the old field ring and claimed more than was observed.
* revert(settings): keep the v4 Settings design's controls
The earlier commits on this branch moved the settings page's dropdowns,
buttons, steppers and fields onto flat outline-less wells, following
docs/design-system.md. That paragraph predates the v4 Settings design
the page was rebuilt to on 2026-09-26 (raised controls, hairline-ringed
fields) and was never updated to it, so the change took the page away
from the design rather than toward it. The raised controls, 26px
heights and the faded disabled primary are back as v4 drew them, and
the design-system edits are withdrawn.
Kept, as fixes within the design:
- dropdowns and fields share one width (kit::CONTROL_W);
- the field's value is sized on the Input, which otherwise beat it;
- the field hairline is one device pixel: v4's half point is one pixel
on Retina and nothing at all on a 1x display.
* fix(settings): a primary with nothing to do falls to the faint fill
A disabled or not-yet-dirty primary (the host form's Save) was the ink
button faded to half opacity - still a black button that looked like
the thing to press. It now takes the fall v4 already gives the Commit
button and the dialogs' Create: faint fill, secondary text, ink again
once there is something to do.
* fix(settings): tab position rows are dropdowns again
#982 moved New tab position and Tab bar position into General with the
segmented control they had before #979 made every pick-one setting a
dropdown, so General mixed the two again. Both use settings_choice.
* fix(scm): the Changes list sits on the same rhythm as the Files tab
- The filter was appended to the pinned block without the pause the
blocks above carry, and the list starts flush, so the first group
header sat on the field's edge (0px) while 14px stood above it. It
now leaves the Files tab's 10px under its search.
- File rows (working tree and commit detail) padded 3px above and below
a 23px line box, standing 29 tall - 30px pitch - beside the tree's
26px directory rows and the Files tab's 26px rows. They are ROW_H,
26, as v4 specifies.
* fix(host): save local files atomically via a temp file and rename
LocalHost::write_file truncated the target in place, so a crash, a full
disk or a killed process mid-save destroyed the user's file. It now
writes a hidden sibling temp file, syncs it, keeps the old file's mode
and renames it over the target, removing the temp file on any error.
It still writes in place where a rename would change something visible:
a non-regular target (symlink, directory, FIFO), a read-only file, and on
Unix a hard-linked file or one owned by another user, or when the temp
file cannot be created (e.g. a read-only directory).
* feat(editor): add editor_text for encodings, line endings, indentation and EditorConfig
A pure module the code editor will use when loading and saving files:
decode detects BOMs, binary files, UTF-8, GB18030 and a lossless
Windows-1252 fallback and normalises CRLF; encode restores the exact
bytes and names the first unrepresentable character; detect_indent
infers tabs or a 2/4/8 space width with language defaults; and
editorconfig_for resolves .editorconfig sections with save-time rules.
* feat(editor): share buffers across tabs, guard unsaved work, add a file strip
- One buffer per file per window; tabs list which buffers they show. The
same file open in two tabs is no longer two diverging copies.
- Closing a tab, its last pane, the window, or quitting asks about unsaved
files (Save / Cancel / Discard) instead of dropping them. Bulk closes skip
tabs with unsaved files; a tab that vanishes any other way hands its
unsaved buffers to the tab in front.
- File tree rename/delete now retarget or flag the open buffer, so a save
no longer recreates the old path.
- Saves check the file's mtime first and ask before overwriting a change
made elsewhere; this is the only detection SFTP buffers get.
- Dirty is a comparison with the saved text, so undoing back clears it.
- Reloads replace only the changed span as an ordinary edit, keeping undo.
- Load/save go through editor_text: encoding, BOM and CRLF round-trip,
indentation is detected, .editorconfig is honoured.
- Header shows a strip of open files; New File, Save As (native panel
locally, a path bar remotely), Go to Line (Ctrl+G), and the status bar
shows indentation, encoding and a clickable line ending.
- Open files are remembered per tab across restarts.
* feat(search): quick open a file by name from a Files tab
Search Everywhere gains a Files tab that finds any file in the active
tab's project by fuzzy name and opens it in the built-in editor, with
`name:line[:col]` jumping to that spot. The list comes from one walk of
the project through the host (Host::search with an empty query), so it
works the same on local, SSH and WSL workspaces and skips what the tree
hides: dotfiles, .git and gitignored paths. The walk is capped at 50k
entries / 20k directories, kept between openings and revalidated in the
background each time the search opens.
Files join the All tab once a query finds them. Go to File... is bound to
Cmd+O on macOS (Cmd+P is already Search Everywhere) and ships unbound
elsewhere, where every obvious chord is taken or owed to the shell.
* chore(editor): allowlist the editor session file, tidy lints
* fix(editor): keep restored file order, drop stale close waits, carry files through tab merges
- Background arrivals (restore, merge, rescue) append to the strip in order
instead of inserting beside the active file, which reversed them.
- A cancelled Save As, a dismissed path bar, or a dropped buffer cancels any
close that was waiting on that save.
- Merging a tab into another carries its open files along.
- A shell exiting closes its tab without a prompt it could not honour;
unsaved buffers move to the tab in front.
- Tabs rebuilt under the same id (server restart) restore their files.
* fix(host): only fall back to an in-place write when the rename is refused
On Windows every failure of the atomic save fell back to fs::write,
including a failure while staging the temp file. A full disk would then
truncate the original in place, the very loss the temp file prevents.
Staging errors now return as-is; only a refused rename (a file held open
elsewhere) takes the in-place path.
The Window & Tabs page is gone. Its three remaining tab settings (new tab
position, tab bar position, auto grouping) are a Tabs group on General,
below Startup & restore, so the nav has seven sections.
Removed outright:
- SSH tab title (`ssh_tab_title`, #726, unreleased). The sidebar already
groups SSH tabs under their host, and renaming a tab pins its name.
- Open diff preview from sidebar counts (`sidebar_diff_preview`, #247).
The sidebar counts and the Info panel's changes row always open the
diff overlay; the large-tree stall it worked around is bounded. An old
config.json that still carries either key loads as before.
The now-unused window settings icon goes with the page.
* feat(panel): add Search and GitHub tabs to the right panel
The right panel grows from three tabs to five. Five word labels do not
fit the panel's 280px resting width, so the tab row now draws a glyph
per tab and names it in a tooltip.
Both new panes are placeholders here; the content search and the
GitHub issues/PR browser land on top of this.
* feat(panel): find in files in the right panel's Search tab
The Search tab replaces its placeholder with a content search over the
active tab's project -- the same roots the Files tab shows -- on the host
that project lives on. Hits arrive as you type (debounced, with a
generation counter so a stale answer never lands), grouped by file with a
count, each line excerpted with its matches highlighted. Clicking a hit
opens the built-in editor at that line and column; Enter searches again.
Match-case, whole-word and regex toggles sit at the end of the field, and
the tab focuses its field whenever it is brought forward.
Host::search_content is new on the Host trait, implemented once in
host::content_search (ignore walk + regex) and run by LocalHost directly
and by tty7-server over a new SearchContent control request. The walk
honours .gitignore with or without a repository, skips dot-entries, binary
files and files over 1 MB, and reports a capped search as truncated. The
request is gated on a new `content-search` hello feature, so a server that
predates it is never sent it; the panel says the server needs updating
instead of showing no results. Conformance cases cover local and the
stdio server alike.
* feat(panel): browse GitHub issues and pull requests in the right panel
The GitHub tab follows the focused pane's repository: its root is resolved
the way the Source Control tab does, its remotes are read through the Host
(the tree may be on another machine), and the github.com remote is bound,
upstream over origin in a fork, with a menu to pick another.
The list switches between issues and pull requests, open and closed, 50 rows
a page with Load more; rows carry a state glyph distinct by shape, labels
(click one to filter by it) and relative times. A row opens the detail in
place: title, state, author, labels, description and comments as Markdown,
and for a pull request its branches, size and changed files. A file opens in
the diff overlay through a new supplied-patch DiffSource, so GitHub's patch
renders exactly like a local one without a git probe.
Read-only, and sign-in reuses the GitHub CLI: GH_TOKEN, GITHUB_TOKEN, then
`gh auth token`, found on PATH or at the Homebrew locations a Finder launch
cannot see. Signed out, public repositories still work; 401, 403, 404 and
rate limits are told apart and explained. Requests go out from this machine
over the installer's ureq stack and proxy settings, on threads of their own,
cached per repository with background revalidation. Remote images in issue
text become links instead of loading, and non-web link targets are disarmed.
The Info tab gains a GitHub row that opens the branch on the remote it
tracks, or the repository for a branch never pushed.
* docs: list ShowRightPanelGitHub with the other panel actions
* feat(panel): one-line GitHub rows, a pill for the current tab
- GitHub list rows are one line: state glyph, #number, title. Labels and
the age of the last update appear on hover, from state rather than a
group_hover display switch, which gpui cannot paint.
- The current right panel tab sits on the sidebar's selected fill; ink
alone could not tell five same-weight glyphs apart.
- The GitHub glyph is a 1.8px outline like the other tab icons, not the
filled mark.
- The detail byline names both times (opened / updated) so it no longer
reads as disagreeing with the list's update age.
* feat(github): show screenshots pasted into issues
Images GitHub hosts itself (github.com/user-attachments, a repo's
/assets, *.githubusercontent.com) now render in issue and PR text, each
in a paragraph of its own so the text view draws it at its size rather
than at line height. Images from any other host stay links, so opening
an issue still tells no third party that you read it.
gpui held a null HTTP client, so no remote image could load; the app now
installs the update check's reqwest client (same user agent and proxy)
at launch.
* fix(github): load private-repo screenshots, give inline code a neutral fill
- Pasted attachments (github.com/user-attachments/assets/<uuid>) want a
browser session on a private repository, which an API token is not.
The detail and comment requests now ask for the full media type, and
each attachment is swapped for the signed private-user-images URL the
rendered body_html carries for the same uuid.
- Inline code in rendered Markdown (the GitHub tab and the editor's
preview) sits on a faint neutral fill instead of the theme accent,
which is also the selection colour. Needs gpui-component 6af19d91 for
TextViewStyle::inline_code_background.
* style(panel): tidy the GitHub and Search tabs' top rows
- GitHub drops its heading row on macOS. It existed only to hold the
refresh tile, and no other tab has one; refresh now sits with the
repository's other actions, in the repo row and a detail's header.
- Search's Aa / ab / .* toggles are muted while off instead of body ink.
- Search's idle note puts the folder on its own line, spelled ~/…, so
the narrow column no longer breaks the path at a slash.
* feat(panel): order the right panel's tabs Info, Files, Search, Changes, GitHub
Info stays first as the default and the pane's overview; after it come
two pairs, the project's files (Files, Search) and its version control
from local to remote (Changes, GitHub), where Changes and GitHub were
split by the file tabs before. The palette, the Keybindings list and the
docs follow the same order.
* style(panel): drop the change count from the Changes tab
Beside one glyph of five, the number read as a badge on that tab alone,
and the Changes tab already leads with the same count under its own
heading. right_panel_tabs no longer needs the row's width, which it only
measured to decide whether the count fit.
* style(icons): fit the GitHub glyph to the other tab icons' size
The Lucide mark filled its whole 24px box, edge to edge, where tty7's
own icons keep about 3.5px clear, so at 15px it drew a size larger than
the four tabs beside it. Scale it to 0.9 about the centre, and raise the
stroke to 2.0 so it still renders at the others' 1.8.
* style(icons): a simpler GitHub glyph
Drop the Lucide mark's tail and redraw the head and legs on tty7's own
grid: the same ~15px live area and 1.8 stroke as the other tab icons, no
scale transform. The legs keep it reading as the Octocat; a head alone
read as any cat.
* test(github): find gh on PATH in the blank-variable token test
The test placed gh only at /opt/homebrew/bin/gh, which gh_candidates never
offers on Windows, so the Windows CI job panicked at unwrap. Put gh on a PATH
directory spelled with the platform's exe name instead.
* fix(github): close image and link bypasses in the issue Markdown sanitiser
Checked against markdown-rs (the parser TextView uses), several inputs got
past the line-based rewrite:
- is_github_hosted cut the host only at `/`, so
`https://evil.io?.githubusercontent.com/x.png` (and `#`, `\`, `/`)
counted as GitHub-hosted and was fetched from evil.io. The host now ends
at the first of `/?#\` and may hold only DNS characters.
- `<img src>` values were written into `` unescaped, so a `)` in
the value closed the image and opened a second one from any host. Written
destinations are now percent-encoded.
- `<image>` (which the HTML parser reads as `<img>`) passed as an ordinary
tag and loaded its src.
- A kept link target was copied without scanning; when the parser ended
the link elsewhere (open title, unbalanced paren) a `` inside it
came alive. Markup characters in it are now encoded.
- `file:///...` and similar character references passed is_safe_target
and decoded to a `file:` link. References are decoded before judging.
The rewrite still cannot see every construct the way the parser does
(code spans inside tag attributes, fences the parser rejects, multi-line
link definitions), so the detail view now also checks the parsed tree: a
block containing a non-GitHub image, an unsafe link or definition, or raw
`<img>` is drawn as its plain source instead.
* fix(github): hide gh's console, bound Retry-After, and reject URL authorities with ?#\
- run gh through proc::output_within with hide_console, so a Windows GUI
launch does not flash a console window and stdout is drained while gh runs.
- saturating_add a hostile Retry-After instead of overflowing i64.
- parse_github_url no longer accepts `https://evil.io#@github.com/o/r`.
* fix(search): no panic on an unbounded time budget, and read files through the size cap
ContentLimits arrive off the wire on a server; Instant + u64::MAX ms
panicked. A file that grew between the size check and the read was read
whole; it is now read through a take() at the cap.
* fix(panel): keep Load more on an empty filtered page, and drop another host's hits
- /issues pages filtered to one kind can come back empty while later pages
hold matches; the GitHub list said "No issues" and hid Load more. It now
reads on through up to five such pages and keeps Load more offered.
- While a new search runs, the previous hits stay on screen; if they came
from another host, a click opened their path on the active host. They are
now kept only when the host is the same.
The terminal's phone button asks the gateway to run the pane at the
phone's grid (PaneRequest::TakeOver), which it turns into a size lease on
the observer connection, named after the paired device. The grid follows
the keyboard and rotation; leaving the pane, or the connection dropping,
gives it back. When the desktop takes it back the app says so and offers
to take it over again, never doing it on its own. A daemon too old for
leases is reported, and the pane keeps working.
An observer can now run a pane at its own size (ClientMsg::Lease, feature
size-lease). The pty and every observer go to that size. The controller
keeps its grid, its resizes are remembered rather than applied, and the
pane goes back to the last of them when the lease ends: the observer lets
go, its connection closes, or the controller takes it back.
A controller hears about leases only after asking (Watch), since an older
client cannot decode DaemonMsg::Lease. The desktop asks on every attach,
spawn and relink where the daemon advertises the feature, locally or
through the host hello for remote workspaces, and shows the pane as in
use on the phone with a Take Back button.
Fix half-width punctuation, unify terminology (passphrase, Finder,
server), quotes and dash styles, and rewrite the most literal
translations. Point every language and the CLI at Settings →
Integrations, the page's actual name, instead of Settings → Agents.
* feat(search): list more agents' past sessions, and fork, copy or hide one
The Sessions tab listed Claude Code and Codex only, and a row could only
be resumed.
- Past sessions of Gemini CLI, Qwen Code, Pi, Oh My Pi, Kimi Code,
Copilot CLI, Droid, Qoder CLI and CodeBuddy are read from where each
keeps them (honouring QWEN_HOME, COPILOT_HOME, KIMI_CODE_HOME, …), with
the name the agent or user gave the session, else the first prompt.
Context blocks agents prepend (<system-reminder> and kin) no longer
hide a prompt.
- Cmd/Ctrl-E on a session row opens its actions: Resume, Fork Session
(agents that can fork, with the configured launch flags), Copy Session
ID, and Remove from List. Removing keeps the search open, drops the row
at once and remembers it in `hidden_agent_sessions`; the agent's own
history is not touched.
OpenCode and Cursor keep sessions in SQLite and are not read yet.
Claude-Session: https://claude.ai/code/session_01JRqYZ9E153WpSHGS2AW3BM
* feat(search): list remote workspaces' sessions, and OpenCode and Cursor
The Sessions tab only ever read this computer, and left out the two
agents that keep their history in SQLite.
- agent_history moves into tty7-core, and the scan goes through the
Host: a local workspace reads this machine in-process, a remote one
asks its server (new ControlRequest::AgentSessions; CONTROL_VERSION
11 -> 12, so each remote host takes one Update Server). Resumed or
forked sessions open on that machine, in the directory they ran in.
The last answer is kept per host so the tab does not open empty.
- OpenCode: top-level, unarchived sessions from opencode*.db (or
$OPENCODE_DB); a placeholder title gives way to the first prompt.
- Cursor CLI: chats under ~/.cursor/chats (or $CURSOR_CONFIG_DIR), named
from meta.json or store.db. Cursor files a chat only under the md5 of
its directory, so it is placed by matching open tabs' and other
sessions' directories; chats nothing matches are left out, since they
could not be resumed anywhere.
- SQLite is bundled (rusqlite), opened read-only, falling back to an
immutable read when the writer's WAL cannot be shared.
Claude-Session: https://claude.ai/code/session_01JRqYZ9E153WpSHGS2AW3BM
* test(search): wait for the real scan before seeding sessions
The search's own scan runs on a real thread. On CI it landed after the
test seeded its rows and replaced them, so the edit gesture found no
row. The test now waits for the scan first. Assertion messages no
longer print session ids (CodeQL rust/cleartext-logging).
Claude-Session: https://claude.ai/code/session_01JRqYZ9E153WpSHGS2AW3BM
* fix(search): harden the past-session scan and note it in the changelog
- Honour CLAUDE_CONFIG_DIR for Claude Code's projects, as the hooks
installer already does.
- Read a Codex rollout's head as bytes: the 2 MiB cap can split a
multi-byte character, and read_line then dropped the whole session.
- Escape `%` and `#` (not only `?`) in the immutable SQLite URI fallback,
so a database under such a directory still opens.
- Refuse a session id starting with `-`: ids now come from file and
directory names on disk, and one would be read as a flag by the
resume or fork command.
- Update the unreleased Sessions changelog entry for the new agents,
remote workspaces, the Cmd-E actions and the v12 dialect bump.
* fix(search): spell the immutable SQLite fallback as file:///C:/ on Windows
SQLite reads file:C:/x as a relative path, so the fallback open (and its
test) failed on Windows. An empty authority and a leading slash name the
file on every platform.
* test(search): keep ? out of the fixture directory name on Windows
Windows file names cannot hold a '?', so the fixture's create_dir_all
failed there before the fallback was ever opened.
A dropped pane or machine stream is retried with backoff (1s, 2s, 4s …
15s) and at once when the network comes back, rather than waiting for a
tap on Reconnect. The pane keeps its last screen up until the new
replay starts, and output or errors from a replaced stream are ignored.
Touch selection does not work in xterm, so a copy key lays the whole
buffer out as plain text over the pane, wrapped to the phone and joined
where the terminal wrapped, for the phone's own selection and Copy.
Replying to an agent meant typing into xterm a character at a time,
without autocorrect, dictation or a usable IME. The compose box is a
real text field: Send types the text and then Enter, as its own write,
and several lines go in as one bracketed paste when the program asked
for it. Drafts survive leaving the pane and a send that failed. An
agent's pane opens on the box with the keyboard down.
The key bar gains Shift+Tab (Claude Code's mode switch) and a paste key.
A failed keystroke now takes the pane offline with a Reconnect banner
instead of being swallowed.
The gateway's input thread gave up silently on a failed send_input, and
the app's input task did the same on a failed write, so the phone kept
showing a live pane while keystrokes went nowhere. Both now report the
failure as a pane error. Keys after it are dropped rather than ending
the stream, which the phone would read as the pane closing.
Single choices were drawn two ways — segmented buttons for most, a
dropdown for a few — and the segmented rows ran to their labels' width,
so the right-hand column never lined up. settings_choice now renders a
dropdown; an off-preset value shows as a checked "Custom (N)" row.
The SSH strip's forward form keeps the segmented control: it lives
outside the settings window and has no popover state to use.
The machine screen gathered every pane whose agent was waiting or done into
a "Needs you" section above the workspaces. Done lasts until the next prompt,
so the section grew with every finished agent and mostly held panes that
needed nothing.
Panes now appear once, in their own workspace. Each keeps its status badge
and words ("Needs input", "Working", "Done") and the agent's message.
PRODUCT.md and the design sidecar are updated to match.
Settings → Mobile had an "Allow phone access" switch that showed intent and a
separate Status row that showed reality. That is one thing shown twice, and
the switch could sit on while nothing was running.
- The switch is the state. Switching on holds it at "Starting…", disabled,
until a gateway is actually serving. If the daemon reports a failure, or
nothing comes up within 15 s, the switch goes back off, `mobile_access`
is reverted, and a notification says why.
- If the page opens on a failure the daemon is still retrying, the switch
shows off with the reason in its description, and switching it on
retries.
- The Status row is removed, with its four strings. There are two new
strings for the failure, in en, zh and ja.
Also fixes the Settings window never showing notifications. It is a `Root`
like the workspace window but did not draw the notification layer, so any
toast pushed from Settings was queued and never shown. That included the
existing "Set as Default Terminal" result.
Checked in a dev instance. On a tty7-server daemon with no tty7-gateway:
Starting… first, then off, with "Phone access could not start: … no
tty7-gateway beside it or on PATH". On a tty7-app daemon: on, with Show
code enabled and no toast.
Found by running a real `tty7 server restart`. The old gateway did exit,
because the new image's supervisor started its own gateway and the old one
lost the lock. But it was left as a zombie: the image after the exec never
reaps a child it did not start, so each handoff leaked a process entry.
`hand_over` now calls `daemon::mobile::stop_for_handoff` before the exec,
which closes the gateway's stdin and waits for it. A flag keeps the
supervisor from starting another in the moments before the exec, and
`handoff_failed` clears the flag if the exec never happens, so the daemon
goes on serving.
Checked with two handoffs in a row (tty7-app → tty7-server → tty7-server):
- each old gateway was reaped, with no zombies system-wide;
- exactly one fresh gateway was running after each handoff;
- the pane's shell and its environment survived;
- the probe phone kept working.
There were two ways of running the gateway: a thread inside `tty7-app
--daemon`, and a detached helper the GUI started when the daemon could not.
That is now one way.
Every daemon, whether `tty7-app --daemon` or `tty7-server`, runs
`tty7_core::daemon::mobile::supervise` from `run_with`. While
`mobile_access` is on it keeps the gateway running as a child process, and
stops it when the switch goes off.
- Which program: `tty7-app` runs itself as `--mobile-gateway`. `tty7-server`
runs a `tty7-gateway serve --exit-with-stdin` from beside it or on PATH,
and links nothing new. Without one, it writes the reason into
`mobile/status.json` for Settings to show, instead of "Starting…" forever.
- Lifetime: the child's stdin is a pipe from the daemon, and the gateway
exits when it closes. A stopped, crashed or handed-off daemon (the pipe
is close-on-exec) takes its gateway with it, and the next daemon starts
one from its own binary. No gateway from an older build survives an
update.
- Isolation: iroh no longer runs inside the process that holds every pane.
- `Status` moves to tty7-core, the one definition that the daemon, the
gateway and the GUI all share.
- Gone: the GUI's helper check (`core::mobile` in the app) and the in-daemon
gateway thread.
A daemon started by `tty7 server start` is the lean tty7-server, which
carries no gateway. With phone access on, the Settings status stayed on
"Starting…" and no phone could connect.
The GUI now checks, 5 s after it starts and whenever phone access is
switched on. If nothing is serving, it starts `tty7-app --mobile-gateway`,
detached the same way as the daemon (`spawn::detach_helper`). The helper
serves until the switch goes off, and exits at once if another process
already holds the gateway lock. When the daemon's own gateway is up, no
helper is started. The helper logs under its own role, "mobile".
Phone access no longer needs `tty7-gateway serve` in a terminal.
Settings → Mobile switches it on, and the local daemon runs the gateway from
then on, with every window closed as well. That is where the panes a phone
reaches live anyway.
- Settings → Mobile, in all three locales:
- an "Allow phone access" switch;
- a status line (running, starting, off, or why it failed);
- "Show code", which draws the QR code and the tty7pair: code with a
Copy button, and closes on its own once a phone uses it;
- the paired phones, each with Unpair.
The section is in search, including by its config key `mobile_access`.
- The daemon (`tty7-app --daemon`) runs a supervisor (`core::mobile`). It
watches `mobile_access` in config.json, re-reading only when the file
changes, and starts or stops the gateway. A failed start is retried every
30 s and logged once.
- tty7-gateway grows a `service` module: `start()` returns a stoppable
handle, and `pair_code()` makes a code. The CLI's `serve` and `pair` are
thin wrappers over them now. The gateway logs through `log`, so the
daemon's output lands in its log file, and it reports itself in
`mobile/status.json`. `State::serving()` checks the lock, which a crash
cannot leave stale. A gateway that cannot take the lock leaves the
status alone, because it belongs to the one holding the lock.
- iroh is linked into the GUI binary only. tty7-server stays the lean static
binary pushed to remote machines.
Every `serve` bound a random port, so a restart left each phone holding
addresses that no longer answered. Where the n0 relays are unreachable, which
is common behind the Great Firewall, the phone had no other way to find the
gateway until it was paired again.
- `serve` listens on the same UDP port every time. It picks one on first run,
keeps it in `<config dir>/mobile/port`, and moves only if the port is taken.
IPv6 binding may fail, as in iroh's own defaults.
- Both ends add mDNS lookup (`iroh-mdns-address-lookup`, service `_tty7._udp`).
On the same network a phone finds the gateway by key when its addresses are
stale, such as after a new DHCP lease or a new IPv6 prefix. The gateway
advertises and the phone only listens. If multicast is refused, each side
starts without it and says so, rather than failing.
- iOS: `Info.ios.plist` declares the local-network use and the Bonjour
service, without which iOS blocks multicast.
- An ignored test (`--test mdns`) connects by key alone over mDNS, for a
machine that allows multicast.
Linked machines were read one after another on every tree poll. One slow
SSH link, whose requests can take 10 s, stalled the whole tree for every
phone, local workspaces included. It also held a lock that queued pane
opens, input and new tabs on every other link.
- Each linked machine is read on its own thread (`poller::Poller`). A poll
waits at most 250 ms. A machine that has not answered is reported as it
last was, and its read lands for the next poll. Only one read is in flight
per machine, however many phones are watching. A machine that drops off and
comes back cannot receive a stale read, because each slot has a generation.
- Routed control connections are locked per machine, not all together.
- A link that is up but has not answered its first read is sent as
`RemoteView.pending` (additive). The app shows "Reading…" with skeleton
rows instead of claiming the machine has no workspaces.
l0ng-ai
LiuSirandstevelliu
ARNO
