`tauri ios init` fills the asset catalog with Tauri's placeholder icon,
so a regenerated gen/ shipped build 0.1.0.9 with the wrong icon. Copy
src-tauri/icons/ios over it on every run.
Claude-Session: https://claude.ai/code/session_01HVosmYyVSH3BrsLYx3tcSS
* fix(ssh): start a redialled SSH pane in the remote directory it was in
A native SSH pane dialled again (restore after a daemon restart, Reconnect,
a split, ⌘T on an SSH tab, waking a sleeping tab) always landed in the login
directory. The client already sent the pane's remote cwd as
`SpawnNativeSsh.cwd`, but the daemon dropped it on the floor.
The daemon now threads it through `Pane::spawn_native_ssh` and
`SshManager::run_session` into the shell-integration bootstrap, whose first
line becomes `builtin cd -- '<dir>' 2>/dev/null` (fish-quoted for fish). It
is never typed at the prompt, never lands in history, and a directory that
is gone leaves the shell in the login directory without a word. Sessions
without integration take the plain shell request as before, so jump-host
menus never see it. The per-host probe cache still holds only the shell.
Only absolute paths are honoured. No wire or protocol change.
Callers now say what they mean: a saved host or quick connect passes no
start dir instead of the local cwd of whatever tab was in front; ⌘T and a
split on an SSH pane pass that pane's remote cwd; a sleeping SSH tab keeps
its remote cwd in the session layout. The daemon's replay now sends the
remote context before the cwd, so a window that reattaches to an SSH pane
does not wipe the remote directory it was just told.
Refs #1028
Claude-Session: https://claude.ai/code/session_011mDkkQhwx4RJJBHee3yVpq
* fix(ssh): a local shell standing in for a restored SSH leaf starts locally
pane_to_session now keeps a native SSH leaf's far directory, so the
session_to_pane fallback that brings such a leaf back as a local shell
(the redial failed, or its daemon pane is gone on reattach) would hand
that remote path to a local spawn. Pass no cwd there for an SSH leaf.
Claude-Session: https://claude.ai/code/session_011mDkkQhwx4RJJBHee3yVpq
* feat(settings): an Appearance option to show the title-bar buttons only under the pointer
26.9.2 painted the new-tab and sidebar tiles only while the pointer was
over the bar they sit in; 26.9.3 took that out so the buttons would stay
discoverable. Both are fair, so it comes back as a choice: Appearance >
"Show title bar buttons on hover" (`auto_hide_titlebar_buttons`), off by
default, which keeps today's always-visible bar for everyone who has not
asked otherwise. A config written before the key existed reads as off.
With it on, the rail's two tiles follow the rail, and the collapsed
rail's pair and the trailing panel toggle follow the tab strip. The
window mark stays put, the tiles keep their layout slot so a reveal
never shifts anything, and the title-bar search box is always drawn.
The trailing toggle stays painted while the detail panel is open, as
before, since the panel's own tab row beside it always is.
The reveal is the hover sheet from 26.9.2 — a transparent last child
over each region, because `group_hover` loses the region the moment the
pointer reaches an occluding tile. Resting tiles go to zero opacity
rather than `invisible()`: gpui skips a hidden element's paint pass,
which is where its click and accessibility actions are registered, so a
screen reader could find a hidden tile by label and then not press it.
Shortcuts are actions and never depended on the tiles.
Claude-Session: https://claude.ai/code/session_011mDkkQhwx4RJJBHee3yVpq
* fix(titlebar): centre the search box on the window, not the bar after the traffic lights
On macOS `TitleBar` leaves an 80pt lead for the traffic lights before
the tab strip — whether or not the rail stands in front of them — and
the Search Everywhere box was centred on the strip. So it sat 40pt right
of the terminal column's middle: with the rail collapsed, 40pt right of
the window's (#1033). Fullscreen added the bar's own inset on top.
The band the box centres in now reaches back over that lead, so its left
edge is the terminal column's on every platform (12pt elsewhere). Its
right edge is unchanged: the strip's end on macOS, the terminal column's
end beside a docked panel or document off it.
Reaching back puts the collapsed rail's tiles inside the band, so the
box now keeps an equal clearance at both ends — two springs with a
minimum width either side of it. In a narrow column it shrinks instead
of sliding under New Tab or the panel toggle, and stays centred while
it does. The geometry is a pure `search_band`, tested for the macOS
rail-collapsed, rail-open and fullscreen cases and off macOS.
Claude-Session: https://claude.ai/code/session_011mDkkQhwx4RJJBHee3yVpq
* fix(titlebar): clear a hover flag whose sheet is not on screen; document the key
A title-bar hover flag is written only by its sheet, and only when the
sheet sees the pointer cross its edge. Hide the rail from its own tile, or
turn the switch off mid-hover, and the sheet leaves the tree with its flag
still set: the next time it is built the tiles came back painted with
nobody pointing at them, until the pointer happened to pass through and
out again. Clear the flag of any sheet not built this frame.
Also list auto_hide_titlebar_buttons in the configuration reference.
Claude-Session: https://claude.ai/code/session_011mDkkQhwx4RJJBHee3yVpq
The phone can now hand a pane a photo or file, read what an agent changed,
answer its prompts with a tap, and keep its link across leaving a pane.
Gateway and protocol:
- `Open::Upload` puts a file (up to 20 MB) in the directory the desktop
keeps pasted images in, under a name a shell takes unquoted, and answers
with its path. Panes on this machine only for now.
- `Open::Diff` answers with the working tree's changes against HEAD and its
untracked files, for the directory a pane is in.
- Both are one-shot streams; an older gateway drops them unanswered, which
the client reports as "update tty7".
App:
- Attach button in the message box: the uploaded path goes into the draft.
- Changes sheet from a pane's menu: a block per file, lines coloured.
- Settings → Key bar: remove, reorder and add keys, from a catalog or
written out (`/compact\r`, `^C`), across pages; reset to the default.
- An agent's numbered choices show as buttons while it waits.
- Pinch to zoom, tap a link to open it, find in the scrollback, a Copy
button for text a program copies (OSC 52), and an optional Face ID lock.
- Swipe from the left edge to go back; the iOS WebView has no page stack.
- One workspace at a time on a machine, picked from a row of chips.
- Agent avatars in their own colours.
- Each screen's watch is its own: a second watch no longer ends the first,
which showed as "Can't reach" and a reconnect after leaving a pane.
- Dialing no longer holds the session lock, so Forget works while a
machine is still connecting; its confirmation is an in-app sheet, since
`window.confirm` shows nothing in the iOS WebView.
- iOS 15 minimum, as App Store Connect will require from April 2027.
- `scripts/testflight.sh` archives, signs for the App Store at export (the
team has no devices for a development profile) and uploads.
Co-authored-by: Claude <noreply@anthropic.com>
* feat(switcher): say Offline in words and dim the avatar; drop the link dot for a reachable workspace
The normal case carries nothing extra. An offline machine's row reads
"Offline" under the tab count, where Open and This window go, and its
avatar is dimmed. A dot stays only for states that want attention:
connecting, reconnecting, failed, or taken over by another client.
* fix(tabs): ⌘T on an SSH tab dials the same host and files the tab under it
A new tab from an SSH pane used to open a local shell in the default
directory, which landed in Ungrouped instead of under the host the user
was on. A native SSH pane now dials again with its spec, as ⌘D already
did; a shell that ssh'd onward from a local prompt gets a local tab that
types the same ssh command at its first prompt. Either way the tab is
seeded into the host's auto group before its pane reports in.
* fix(ssh): a connection at the server's session limit is full, not dead
sshd allows ten sessions per connection by default and every remote pane is
one of them. The eleventh was refused with ConnectFailed, and the connection
was marked dead for it: taken out of the cache while all ten panes on it were
still using it. Every pane after that dialled its own fresh link, paying a full
handshake and server probe, and so did every short-lived route afterwards,
because nothing held the replacement and it went away as soon as that route
closed.
The cache now keeps a pool per destination. A refusal marks that connection
saturated for a while instead of dead; the pool hands out the first live one
with room and dials another beside them only when all are full. A route or a
native SSH pane that lands on a connection that turns out to be full goes back
to the pool for another.
* perf(remote): prove a server that is already running in one round trip
Every new connection to a machine tty7 had been to before spent six
sequential round trips proving what it already had: uname, a home lookup and
a stat over SFTP, a control probe and a process scan. The SFTP session it
opened also stayed open for the life of the connection, one of the handful of
sessions the server allows it.
One `sh -c` script now answers the common case: this dialect's server is
installed, answers the bridge probe, and is the one running (or a build of the
same dialect). Anything else falls through to the full install path unchanged.
* fix(remote): don't replace a pane that could not be reached with a fresh shell
Reattaching a restored pane treated every failure other than silence as "the
pane is gone on its machine" and spawned a fresh shell in its place. That
includes the link never opening at all — the server refusing another session,
a transport error — when the pane is still running over there. The tab lost
its session, and the old shell was left orphaned on the remote daemon; one
workspace had accumulated 53 shells for 17 panes.
Only the daemon's explicit "no such pane" now means gone. For a remote pane,
any other failure leaves it pending, and a pane that stands in for a running
one retries on its own a few times (2s, 4s, 8s, 16s, 16s) before leaving it to
Try Again. Local panes keep their previous behavior.
* perf(remote): ask a machine which panes are live over its control link
The pane liveness probe opened a pane route every ten seconds, which is an SSH
session channel on the remote side — one of the few the server allows per
connection. Once panes had taken them all, each probe dialled a whole new
connection. Ask over the control link that is already up instead: the
machine tree's pane records carry the daemon's own liveness.
* fix(scm): stop two windows from trading one repository watch every frame
Who holds a repository open is a global, reconciled by every window every
frame, but it was keyed by watcher kind alone. Two windows whose file trees or
panels sat in different repositories took the hold from each other each
frame, and every hand-over dropped the watch and opened it again. On a remote
workspace that is four round trips per cycle — about 28 control requests a
second for as long as both windows were open.
Holds are now keyed by window as well, and a closed window gives back what it
held.
* perf(ssh): open channels on one connection concurrently
The russh handle sat behind a tokio mutex held across every request on it,
and each request waits a full network round trip for its reply. So every
pane on a connection opened its channel after the one before it: on a link
with a few hundred milliseconds of latency, a workspace of twenty tabs came
back one tab at a time over about ten seconds.
Every call on the handle takes `&self` and waits on a reply channel of its
own, so the lock bought nothing. Drop it.
Claude-Session: https://claude.ai/code/session_011mDkkQhwx4RJJBHee3yVpq
Bump the gpui fork to paint an aligned line into a layer that covers its
glyphs. The layer was sized from the unaligned origin, so the Changes panel's
flush-right directory shared a draw order with the opaque action strip painted
over it, and sprites draw after quads within one order.
* fix(palette): an open palette keeps workspace keys, and ⌘P answers from the Settings window
While the palette was open, any app binding it did not handle — ⌘1–9,
⌘D, ⌘W — fell through to the workspace behind it. The Settings window
has no palette listener, so the palette chord did nothing there. A
keystroke interceptor, which gpui runs before matching any binding,
now handles both.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(palette): shifted editing letters are not the query field's
The modal rule let every secondary+A/C/V/X/Z chord through as the query
field's own, shift included, so on macOS Cmd+Shift+A (New Agent Tab)
still opened a tab behind the open palette. Only redo keeps its shift.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
* fix(ui): refocus the app when focus is lost so global shortcuts answer
With focus on nothing, or on a handle whose element is no longer drawn (a
closed file panel, a dismissed menu), gpui dispatches keys on the window root
alone, one level above Tty7App's listeners. TogglePalette, ToggleSwitcher,
OpenSettings and every other tty7-root action went dead. on_focus_lost now
hands focus back via focus_active.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ui): refocus settings only in the window that draws it
Settings opens in a window of its own, but focus_active handed focus to
the page's handle whenever settings was up, including in the workspace
window. There that handle is not drawn, so the refocus on focus loss
parked focus on nothing and the workspace shortcuts stayed dead while the
settings window was open. Focus the page only when this window draws it,
and fall through to the workspace's own panes otherwise.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
* fix(agents): a Claude resume that finds no conversation starts fresh under its id
A tab opened and never used, or run with transcript saving off, has no
saved conversation, and `claude --resume` then stops at an error.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(agents): only chain the fresh Claude start where the pane's shell has ||
Windows PowerShell 5.1 and nu reject a line containing `||` outright, so
the fallback took the resume down with it there. The restore line now
chains the fresh start only for shells known to have the operator, judged
by the pane's own shell: its spawn spec, else the configured or login
shell for a local pane. A workspace pane with no explicit shell stays
unknown and gets the plain resume, since its default lives on its host.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
* feat(daemon): panes set FORCE_HYPERLINK=1
tty7 renders OSC 8 links, but supports-hyperlinks only trusts a fixed
TERM_PROGRAM list and strips them for tty7, so Claude Code's statusline
PR links came out as plain text.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(daemon): note that FORCE_HYPERLINK also reaches redirected output
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
* ci: seed rust-cache from main, skip Rust jobs on docs-only PRs
Every PR branch saved its own ~2 GB rust-cache per target, readable only
by that branch, so the repo sat over its 10 GB quota with nothing from
main and every branch built cold. Save from main pushes and manual runs
only, keep the cache when a test step fails, and build with
line-tables-only debug info so the cached target dir is smaller.
Docs-only PRs skip the Rust work: a changes job diffs the merge commit
against its base, and build skips its steps rather than the job, so the
required build & test checks still report instead of pending forever.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* ci: count both sides of a rename in the docs-only check
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
The New Workspace form prefilled a random codename and offered no button,
only an "Enter to create" hint. The name box now starts empty and must be
filled; the footer carries Cancel and Create, with Create disabled (and
Enter inert) while the name is blank.
Bumps gpui-component to the tty7 branch commit that gives Button and
Input a role and a name and exposes popup menu items, and names the icon
buttons whose tooltips are elements rather than text (New Tab, the
sidebar and detail-panel toggles, Switch Workspace) and the file search
toggles (Match case, Match whole word, Use regular expression).
Editor tabs are tabs named by file (and unsaved state) with a named close
button; Info rows read as 'label, value'; keyboard shortcut rows as
'action, keys'; SSH hosts as 'name, address' with their expanded state.
File-tree rows open on the press, which assistive tech cannot send, so
they take its press action directly: a screen reader could select a file
but never open it.
Each row is a group named by its title and description, so the control in
it is heard with its setting's name; switches report on or off, the reset
link is a button, and the Modified only switch has a name of its own.
Group headers are buttons named with their count and expanded state; files
are tree items named by path and group; directories by name with their
expanded state.
Settings sections are tabs with their names and selected state, file-tree
rows are tree items named by file with selection and expansion, and the
Settings window carries a title for VoiceOver and the Window menu.
Each is a tab with its full title and selected state, and pressable by
assistive tech. Before, VoiceOver saw the window, its buttons and the
terminal, and nothing between them.
Sent the moment the pane was up, the line was echoed by the tty above
everything the shell printed while starting, then read after it. It now
waits for the first prompt, for at most three seconds.
After the server restarted, a native SSH tab's old pane id was attached
to, the attach failed, and the fallback spawned a local shell in its
place: the tab that had been another machine was now this one, still
titled and grouped like the remote. An SSH leaf is now only reattached
when the server lists its pane; otherwise the host is dialled again.
A window reattaching to a live SSH pane also never learned its phase,
since status frames only went to whoever was attached when they were
sent. The pane keeps the last one and replays it, so the tab keeps its
connected dot and warn-before-closing still applies.
The form says a blank User is resolved at connect, and the host card shows
$USER, but the empty string went to the server as the user name. sshd
refused it as an invalid user and tty7 reported every key as rejected.
A resize while vim was open started the newest segment inside the
alternate screen. Replayed from the ground state its redraws landed on the
main screen, so capture still showed vim's ~ column after vim had exited.
git and canonicalize hand back /private/tmp/… for anything under /tmp, and
the workspace switcher and the worktree form drew that spelling, which no
shell or pane title uses. Only what is drawn changes.
The daemon reports a pane at its prompt from the D precmd writes first,
before the user's own hooks have drawn the prompt. A line exec sent in
that window was followed by that prompt's A and only then read and run,
and exec reported 'came back to its prompt without running the line'
with exit 1. Back-to-back exec calls failed that way under any prompt
theme slow enough, as did exec_returns_the_commands_output_and_exit_code.
A prompt with no command started before it now has to stay that way for
a moment before the line counts as refused.
Add host opened a blank form with nothing focused, so typing went
nowhere. A host saved in tty7 read 'Defined in: In tty7'; the label is
now 'tty7 settings', as a group heading and after 'Defined in' alike.
`shell` was the one structured field still read strictly, so a hand-edited
{"args": [...]} without a program failed the whole file. It was
quarantined and every other setting fell back to its default, and changes
made in Settings afterwards were never saved.
The list was ordered by current-then-recent whatever the query, so typing
'qa' and Enter reopened this window's workspace (its tabs are under
/tmp/t7qa) instead of the workspace named qa.
Any subsequence of a long description counted as a hit, so 'theme' listed
Git: Discard All Changes second, through the letters of 'Throws away every
uncommitted change'.
The Info tab named the login shell for any pane on the default shell, but
a server started from a terminal spawns the shell it was started from.
The root of the pane's process tree is that shell.
Launched from a terminal, the daemon spawns the shell it was started from
rather than the login shell. The name handed to shell integration still
came from get_shell(), which is always the login shell, so tty7 started
from bash with zsh as the login shell ran bash with zsh's ZDOTDIR and no
rcfile: no prompt marks, no prompt editor, no completion.
zsh's PROMPT_SP pads dangling output until it wraps onto the prompt's row.
The grid took that wrap for the prompt's own first row, so the next resize
at the prompt cleared the output and widening joined it onto the prompt.
At the prompt marks, a padded wrap after dangling output is turned back
into a hard break.
Also: editor breadcrumbs, breadcrumb reveal and Problems labels match
files against the project root's real path, so a project under a symlink
(macOS /tmp) no longer shows the absolute path; the terminal font size
setting says points, which is what its stepper shows.
While a code was on screen the Show code button was disabled, so the only
way to a fresh code was Cancel then Show code. Worse, any attempt at a
code closes the offer, so after a mistyped paste or a dropped connection
the page kept showing a dead code for up to ten minutes with no hint.
- The button reads "New code" while a code is up, and replaces it.
- A code that can no longer pair stays on screen faded, saying why
(expired, tried, or replaced by a newer offer), with New code beside it.
- The validity note counts down instead of saying "10 minutes".
- Cancel, and switching phone access off, now withdraw the offer on disk;
before, a dismissed code could still pair until it expired. Only our own
offer is withdrawn, never one opened elsewhere since.
The gateway's pair_code now returns the offer's secret alongside the code,
and State gains pairing_is_open / has_open_pairing / close_pairing.
Claude-Session: https://claude.ai/code/session_01BDVpJ78s7RQVcj57vjTcfA
The graph's row cache keyed on the page's address. Once the old page
was freed, the next one could land in the same allocation, match the
key, and be served the old, longer index list - so rendering indexed
past the end of the new page's commits and panicked (seen as
'index out of bounds: the len is 1 but the index is 1').
Key the cache on a Weak to the page instead: while the cache holds it,
the allocation can't be reused, so ptr_eq only matches the same page.
The author was already fetched for every issue and pull request but only
the detail view showed it. A hovered row now shows it between the labels
and the age.
In a narrow panel the author is what gives: it is capped, then truncated
down to nothing, while the labels and the age keep their width and the
title keeps a stub, so the meta no longer pushes past the row's edge.
tty7.log is only written when TTY7_LOG is set, so reporters following
the template find no file (#1010). Say how to turn it on, and ask for
crash.log, which is always written.
Claude-Session: https://claude.ai/code/session_01JRqYZ9E153WpSHGS2AW3BM
Forking from a pane in a remote workspace always failed with "the pane is
still connecting": a remote workspace's new pane is dialled asynchronously,
and the fork path demanded a ready terminal to type into. It now hands the
fork line to `run_when_ready`, the same land-then-run path quick launch uses.
The new pane also opens in the source's directory on its own host
(`spawnable_cwd`) rather than only a local one. Agents key their history by
directory, so a fork started in the remote home would find nothing to branch.
Panes that have ssh'd or entered WSL themselves stay excluded (tty7 holds no
link to that machine), and the notification now says exactly that instead of
"local panes only".
The retry added in #1011 went through update_global on every 300ms poll
while a pane's repo was unanswered, even when the probe was still in
flight or throttled and nothing was claimed. Each mutable touch of the
GitStatusCache global wakes its observers, so the window redrew about
three times a second for as long as a probe was pending or failing.
That is what a_commit_detail_reads_its_own_files_and_draws_them caught
on Linux CI (2 idle frames where 0 are expected).
Ask whether a retry is due read-only (GitStatusCache::probe_due) and
only touch the global when one is.
The sidebar branch (group header and row git line) was front-elided,
but its width budget was a few pixels short: the line paints with
tabular figures while it was measured with proportional ones, and the
separator was measured as " · " though it is drawn as a bare "·"
between two gaps. The front-elided branch then overflowed and CSS
truncation cut its tail too, leaving "…nd-error-classificati…".
- Measure the git line and header with the same tabular font they paint
with, and measure the separator as drawn.
- Elide the branch from the end, the plain cut a reader expects; the
CSS backstop now cuts in the same direction.
The tab rail's current row read as a dark slab. Both side panels (the tab
rail and the docked right panel) now step on their own lighter rungs,
1.07:1 for hover and 1.12:1 for selected, and step toward the panel's own
shade instead of the foreground, so a warm panel keeps its tint rather
than turning into a grey patch. On the default light theme that lands on
#ededec / #e8e8e7.
The settings page's nav sits on the same rail fill, so it now paints with
the rail's rungs instead of its own alpha tokens.
* feat(mobile): a gateway that lets a paired phone reach this machine over iroh
The first half of the mobile app: everything on the desktop side, plus the
client library the app will link.
- tty7-mobile-proto: the phone<->gateway wire protocol. One stream per purpose
(pair, control, pane), framed like the daemon's frames, with raw terminal
bytes kept out of JSON. No tty7-core, so it cross-compiles for iOS/Android.
- tty7-gateway: dials nothing, accepts phones over iroh (hole punching, relay
fallback, end-to-end encrypted), checks the peer's key against the paired
device list, and bridges to the daemon. Panes are observed, not attached,
and keystrokes go in through SendInput, so a phone never resizes a pane or
takes it away from the desktop window. `pair` prints a one-time QR code.
- tty7-mobile-client: the phone side (pair, tree, pane streams, direct/relay
and RTT for the link), plus a `probe` example that stands in for a phone.
Verified against a real, isolated daemon: pair, tree, and typing into a pane
over a direct path, ~0.8 ms median echo on loopback.
* feat(mobile): the Tauri app — pair, browse the machine, drive a pane
The phone half, as a Tauri 2 app in mobile/ (its own cargo workspace, so the
desktop build and CI never compile a WebView stack).
- Rust side: the phone's iroh endpoint and key, paired machines, and every
live stream, behind eight commands. Terminal output crosses to the WebView
as raw ArrayBuffers on a Tauri channel, batched per frame, in order with the
pane's JSON events.
- Frontend: vanilla TS + xterm.js. Paired machines and pairing; one machine's
workspaces, tabs and panes with agents that need you pinned on top and the
link's direct/relay path and RTT in the header; a terminal that fits the
desktop pane's width, with an esc/tab/ctrl/arrows key bar. Coming back from
the background re-watches and re-opens, relying on the daemon's replay.
Verified as a macOS build against a live gateway and an isolated daemon:
paired from the app, tree rendered on a direct path, keystrokes and key-bar
arrows reached the pane. iOS/Android builds need Xcode / the Android NDK,
neither of which is on this machine; mobile/README.md has the steps.
* fix(gateway): one serve per machine, and say how to start a missing server
- `serve` takes an exclusive lock on <config dir>/mobile/serve.lock. A second
gateway on the same key is a second endpoint answering to one address, so a
phone reached whichever the network picked. It is now refused, naming the
pid that holds the lock.
- With no tty7 server running, phones and the terminal both hear "tty7 isn't
running on <host> — open tty7 there, or run `tty7 server start`" instead of
"lost the tty7 server: No such file or directory". `serve` checks once at
startup, and still starts, since tty7 may be opened after it.
* feat(mobile): redesign the app as a native-feeling, minimal UI
The first cut read as a web page of bordered boxes. This rebuilds it the way a
phone app moves and reads, in the desktop tty7's own look:
- Screens push and pop with View Transitions; large titles fold into the bar.
- Grouped inset lists on a tinted canvas, following the system Light/Dark with
the desktop presets, accent and ANSI palettes. Hack for code and terminal.
- Panes are listed by tab, one card per workspace, with the desktop's agent
avatars and status badges (Waiting hollow, Working blinking) and its words.
- Pairing is its own screen, with steps, a Paste button and inline errors.
- A machine that stays silent for 10 s says so and offers to pair again; an
offline notice says what to check.
- The terminal header shows live/offline in words. A pane too wide to read is
shown at a readable size and pans to follow the cursor, with a toggle to fit
the whole width. The key bar has drawn icons, puts left/right first, and
has a keyboard toggle.
PRODUCT.md and DESIGN.md record the product facts and the design system.
* feat(mobile): open a new tab from the phone
Each workspace on a machine's screen gets a "New tab" action. It starts a
shell at the end of that workspace, in the directory its last tab is in, and
opens it straight away.
- Protocol: a one-shot `Open::NewTab { workspace_id, cwd, size }` stream,
answered with `Ok` and a `TabCreated { tab_id, pane_id }`, or `Denied`.
It is additive, so the protocol version stays. A gateway from before this
drops the stream unanswered, and the app says to update it.
- Gateway: takes the same two steps as `tty7 tab new`, spawning a shell owned
by the workspace and then TabCreate. The shell starts at the grid the phone
asked for, because no desktop window is showing it yet. Sizes are clamped.
- App: a `tab_new` command, with the size worked out from the screen at the
readable font size.
- probe: `newtab <workspace-id> [cwd]`.
* feat(mobile): reach the machines the desktop is linked to over SSH
A machine's screen now lists, under its own workspaces, every machine its
tty7 holds an SSH link to, with that machine's workspaces. Panes there open,
take input and get new tabs like local ones. "Needs you" gathers panes from
all of them.
- The gateway routes through the local server over links it already holds,
the same way `tty7 -m <machine>` does. It never dials a down link, because
that would guess at credentials the phone does not have. A down link
shows as "Link down", with a note to reconnect it on the desktop.
- Protocol, additive: `Tree.remotes`, and an optional `machine` (the link
key) on `Open::Pane` and `Open::NewTab`. A local pane is asked for exactly
as before, so older gateways still understand it.
- Rebuilding a route target from a link key moves from the CLI into
tty7-core as `RouteInfo::target` / `RouteInfo::host`, so the CLI and the
gateway share one rule. The CLI now calls it.
* perf(gateway): read linked machines in parallel, never waiting on a slow one
Linked machines were read one after another on every tree poll. One slow
SSH link, whose requests can take 10 s, stalled the whole tree for every
phone, local workspaces included. It also held a lock that queued pane
opens, input and new tabs on every other link.
- Each linked machine is read on its own thread (`poller::Poller`). A poll
waits at most 250 ms. A machine that has not answered is reported as it
last was, and its read lands for the next poll. Only one read is in flight
per machine, however many phones are watching. A machine that drops off and
comes back cannot receive a stale read, because each slot has a generation.
- Routed control connections are locked per machine, not all together.
- A link that is up but has not answered its first read is sent as
`RemoteView.pending` (additive). The app shows "Reading…" with skeleton
rows instead of claiming the machine has no workspaces.
* fix(mobile): keep reaching the computer after the gateway restarts
Every `serve` bound a random port, so a restart left each phone holding
addresses that no longer answered. Where the n0 relays are unreachable, which
is common behind the Great Firewall, the phone had no other way to find the
gateway until it was paired again.
- `serve` listens on the same UDP port every time. It picks one on first run,
keeps it in `<config dir>/mobile/port`, and moves only if the port is taken.
IPv6 binding may fail, as in iroh's own defaults.
- Both ends add mDNS lookup (`iroh-mdns-address-lookup`, service `_tty7._udp`).
On the same network a phone finds the gateway by key when its addresses are
stale, such as after a new DHCP lease or a new IPv6 prefix. The gateway
advertises and the phone only listens. If multicast is refused, each side
starts without it and says so, rather than failing.
- iOS: `Info.ios.plist` declares the local-network use and the Bonjour
service, without which iOS blocks multicast.
- An ignored test (`--test mdns`) connects by key alone over mDNS, for a
machine that allows multicast.
* feat(mobile): run the gateway in the desktop daemon, paired from Settings
Phone access no longer needs `tty7-gateway serve` in a terminal.
Settings → Mobile switches it on, and the local daemon runs the gateway from
then on, with every window closed as well. That is where the panes a phone
reaches live anyway.
- Settings → Mobile, in all three locales:
- an "Allow phone access" switch;
- a status line (running, starting, off, or why it failed);
- "Show code", which draws the QR code and the tty7pair: code with a
Copy button, and closes on its own once a phone uses it;
- the paired phones, each with Unpair.
The section is in search, including by its config key `mobile_access`.
- The daemon (`tty7-app --daemon`) runs a supervisor (`core::mobile`). It
watches `mobile_access` in config.json, re-reading only when the file
changes, and starts or stops the gateway. A failed start is retried every
30 s and logged once.
- tty7-gateway grows a `service` module: `start()` returns a stoppable
handle, and `pair_code()` makes a code. The CLI's `serve` and `pair` are
thin wrappers over them now. The gateway logs through `log`, so the
daemon's output lands in its log file, and it reports itself in
`mobile/status.json`. `State::serving()` checks the lock, which a crash
cannot leave stale. A gateway that cannot take the lock leaves the
status alone, because it belongs to the one holding the lock.
- iroh is linked into the GUI binary only. tty7-server stays the lean static
binary pushed to remote machines.
* feat(mobile): serve phones whichever daemon is running
A daemon started by `tty7 server start` is the lean tty7-server, which
carries no gateway. With phone access on, the Settings status stayed on
"Starting…" and no phone could connect.
The GUI now checks, 5 s after it starts and whenever phone access is
switched on. If nothing is serving, it starts `tty7-app --mobile-gateway`,
detached the same way as the daemon (`spawn::detach_helper`). The helper
serves until the switch goes off, and exits at once if another process
already holds the gateway lock. When the daemon's own gateway is up, no
helper is started. The helper logs under its own role, "mobile".
* refactor(mobile): the daemon owns the gateway, as a child, whoever started it
There were two ways of running the gateway: a thread inside `tty7-app
--daemon`, and a detached helper the GUI started when the daemon could not.
That is now one way.
Every daemon, whether `tty7-app --daemon` or `tty7-server`, runs
`tty7_core::daemon::mobile::supervise` from `run_with`. While
`mobile_access` is on it keeps the gateway running as a child process, and
stops it when the switch goes off.
- Which program: `tty7-app` runs itself as `--mobile-gateway`. `tty7-server`
runs a `tty7-gateway serve --exit-with-stdin` from beside it or on PATH,
and links nothing new. Without one, it writes the reason into
`mobile/status.json` for Settings to show, instead of "Starting…" forever.
- Lifetime: the child's stdin is a pipe from the daemon, and the gateway
exits when it closes. A stopped, crashed or handed-off daemon (the pipe
is close-on-exec) takes its gateway with it, and the next daemon starts
one from its own binary. No gateway from an older build survives an
update.
- Isolation: iroh no longer runs inside the process that holds every pane.
- `Status` moves to tty7-core, the one definition that the daemon, the
gateway and the GUI all share.
- Gone: the GUI's helper check (`core::mobile` in the app) and the in-daemon
gateway thread.
* fix(mobile): stop and reap the gateway before a daemon handoff
Found by running a real `tty7 server restart`. The old gateway did exit,
because the new image's supervisor started its own gateway and the old one
lost the lock. But it was left as a zombie: the image after the exec never
reaps a child it did not start, so each handoff leaked a process entry.
`hand_over` now calls `daemon::mobile::stop_for_handoff` before the exec,
which closes the gateway's stdin and waits for it. A flag keeps the
supervisor from starting another in the moments before the exec, and
`handoff_failed` clears the flag if the exec never happens, so the daemon
goes on serving.
Checked with two handoffs in a row (tty7-app → tty7-server → tty7-server):
- each old gateway was reaped, with no zombies system-wide;
- exactly one fresh gateway was running after each handoff;
- the pane's shell and its environment survived;
- the probe phone kept working.
* feat(mobile): the switch shows whether phones can reach you, not a status row
Settings → Mobile had an "Allow phone access" switch that showed intent and a
separate Status row that showed reality. That is one thing shown twice, and
the switch could sit on while nothing was running.
- The switch is the state. Switching on holds it at "Starting…", disabled,
until a gateway is actually serving. If the daemon reports a failure, or
nothing comes up within 15 s, the switch goes back off, `mobile_access`
is reverted, and a notification says why.
- If the page opens on a failure the daemon is still retrying, the switch
shows off with the reason in its description, and switching it on
retries.
- The Status row is removed, with its four strings. There are two new
strings for the failure, in en, zh and ja.
Also fixes the Settings window never showing notifications. It is a `Root`
like the workspace window but did not draw the notification layer, so any
toast pushed from Settings was queued and never shown. That included the
existing "Set as Default Terminal" result.
Checked in a dev instance. On a tty7-server daemon with no tty7-gateway:
Starting… first, then off, with "Phone access could not start: … no
tty7-gateway beside it or on PATH". On a tty7-app daemon: on, with Show
code enabled and no toast.
* feat(mobile): drop the "Needs you" section
The machine screen gathered every pane whose agent was waiting or done into
a "Needs you" section above the workspaces. Done lasts until the next prompt,
so the section grew with every finished agent and mostly held panes that
needed nothing.
Panes now appear once, in their own workspace. Each keeps its status badge
and words ("Needs input", "Working", "Done") and the agent's message.
PRODUCT.md and the design sidecar are updated to match.
* fix(mobile): say when typing doesn't reach the pane
The gateway's input thread gave up silently on a failed send_input, and
the app's input task did the same on a failed write, so the phone kept
showing a live pane while keystrokes went nowhere. Both now report the
failure as a pane error. Keys after it are dropped rather than ending
the stream, which the phone would read as the pane closing.
* feat(mobile): a compose box, paste and Shift+Tab on the terminal
Replying to an agent meant typing into xterm a character at a time,
without autocorrect, dictation or a usable IME. The compose box is a
real text field: Send types the text and then Enter, as its own write,
and several lines go in as one bracketed paste when the program asked
for it. Drafts survive leaving the pane and a send that failed. An
agent's pane opens on the box with the keyboard down.
The key bar gains Shift+Tab (Claude Code's mode switch) and a paste key.
A failed keystroke now takes the pane offline with a Reconnect banner
instead of being swallowed.
* feat(mobile): reconnect on its own, and select text to copy
A dropped pane or machine stream is retried with backoff (1s, 2s, 4s …
15s) and at once when the network comes back, rather than waiting for a
tap on Reconnect. The pane keeps its last screen up until the new
replay starts, and output or errors from a replaced stream are ignored.
Touch selection does not work in xterm, so a copy key lays the whole
buffer out as plain text over the pane, wrapped to the phone and joined
where the terminal wrapped, for the phone's own selection and Copy.
* feat(daemon): size leases, and Take Back on the desktop
An observer can now run a pane at its own size (ClientMsg::Lease, feature
size-lease). The pty and every observer go to that size. The controller
keeps its grid, its resizes are remembered rather than applied, and the
pane goes back to the last of them when the lease ends: the observer lets
go, its connection closes, or the controller takes it back.
A controller hears about leases only after asking (Watch), since an older
client cannot decode DaemonMsg::Lease. The desktop asks on every attach,
spawn and relink where the daemon advertises the feature, locally or
through the host hello for remote workspaces, and shows the pane as in
use on the phone with a Take Back button.
* feat(mobile): take a pane over at the phone's size
The terminal's phone button asks the gateway to run the pane at the
phone's grid (PaneRequest::TakeOver), which it turns into a size lease on
the observer connection, named after the paired device. The grid follows
the keyboard and rotation; leaving the pane, or the connection dropping,
gives it back. When the desktop takes it back the app says so and offers
to take it over again, never doing it on its own. A daemon too old for
leases is reported, and the pane keeps working.
* fix(mobile): link SystemConfiguration and install a rustls provider on iOS
The first iOS build failed to link: netdev and system-configuration, pulled
in by iroh, need SystemConfiguration.framework, which the generated Xcode
project does not list. bundle.iOS.frameworks adds it on `tauri ios init`.
Once linked, the app panicked at launch: iroh builds its reqwest client with
`rustls-no-provider`, so a process-wide crypto provider must be installed
before any client is built. Install ring's, which is already in the tree.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(mobile): keep the terminal's scrollbar on screen while panning
Panning a pane wider than the phone scrolled xterm's own box sideways with
the text. The box was only the view's width, so its vertical scrollbar
panned off with the columns and its scrollback stopped taking touches past
the first screen. The box now spans every column, and the bar is shifted
to the visible right edge as the view pans.
The bar is also drawn like the indicator WebKit shows for the pan, thin,
rounded and translucent, instead of VS Code's 14px square slider, so the
two axes match.
Co-Authored-By: Claude <noreply@anthropic.com>
* feat(mobile): pair by scanning the QR code, and Enter and quick-answer keys
Pairing took a pasted `tty7pair:` code, which on a real phone means getting
text off the desktop somehow. A Scan button next to Paste now reads the QR
code tty7 shows, through tauri-plugin-barcode-scanner, and pairs straight
away. The camera runs behind the WebView with our own viewfinder and Cancel,
since the plugin's full-screen view has no way out. The plugin is registered
on phones only, so the desktop dev build is unchanged.
The key bar gains Enter, so an agent's highlighted choice can be confirmed
without raising the keyboard, and 1 2 3 y n for numbered choices and y/n
prompts.
Co-Authored-By: Claude <noreply@anthropic.com>
* chore(mobile): sign for the App Store and declare exempt encryption
Sets the development team so `tauri ios init` writes it into the Xcode
project, and marks the app's encryption (standard TLS/QUIC only) as exempt
so TestFlight uploads skip the export-compliance question.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(mobile): count the iOS safe areas once
The WKWebView's scroll view inset its content by the safe areas, and the
page, laid out with viewport-fit=cover, padded by env(safe-area-inset-*)
as well. The viewport came out 778pt tall on an 874pt screen: everything
sat a status bar's height too low, with a blank band under it. The scroll
view's automatic inset adjustment is now off, so the page runs edge to
edge and its CSS alone keeps clear of the status bar and home indicator.
Co-Authored-By: Claude <noreply@anthropic.com>
* feat(mobile): the Terminal Mobile redesign
The app takes the desktop's neutral greys, light and dark, with ink rather
than a system blue for what is pressed or chosen.
- Machines: pairing's "+" moves to a floating bar at the bottom beside a
search field. Each machine shows its link, round trip and tab count as
last seen.
- A machine: tabs grouped by workspace with a count; round agent glyphs;
a dot on the right for running or waiting on you. The per-group New tab
buttons give way to one "+" in the same floating bar, beside tab search.
- New tab: a sheet to pick Claude Code, Codex or a shell, and the
workspace. An agent's command is typed into the new tab once it is live.
- A pane: the bar keeps only back, the title with its state, and a menu
for selecting text, the fit and the phone's size. Under it, one row of
equal keys, a page at a time, and a message box that is always there;
its round button sends, or when empty hands the keyboard to the
terminal.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(mobile): the tty7 mark as the iOS app icon
The phone showed Tauri's default icon: `tauri ios init` filled the Xcode
project with it. The committed icons/ios set was drawn on the macOS grid,
a rounded tile inset on transparency, which iOS would shrink inside its own
mask with a pale border. icons/app-icon-ios.svg is the same Duo mark full
bleed, rendered without alpha as the App Store requires.
Claude-Session: https://claude.ai/code/session_01HVosmYyVSH3BrsLYx3tcSS
* fix(mobile): typing, scrolling and pairing on a real phone
- Typing into a pane: an input method's text never reached it, since iOS
never commits a candidate into xterm's hidden textarea. Tapping the
terminal now focuses a plain field of our own, whose committed text goes
to the pane as it is committed. Backspace on the empty field, Enter, Tab
and the arrows go as the terminal's keys.
- xterm sends nothing itself any more (disableStdin). That also stops the
phone answering a program's colour and device queries: the desktop
answers those, and the phone's late second answer landed in the shell as
typed text.
- Scrolling the scrollback: xterm 6 has no working touch scrolling. A
mostly vertical swipe now scrolls the buffer a row at a time and coasts;
a sideways one is left to the native pan.
- Pairing: the steps name the desktop's Settings -> Mobile, Allow phone
access and Show code, not a command-line gateway, and so do the notices
when a machine cannot be reached.
Claude-Session: https://claude.ai/code/session_01HVosmYyVSH3BrsLYx3tcSS
* fix(mobile): room for the keyboard, and smoother vertical scrolling
- The keyboard: the WebView runs edge to edge and is not resized for it,
so it covered the dock and the pane's last lines. The app now takes the
size of the visual viewport, drops the home indicator's gap while the
keyboard is up, and keeps the cursor's line in sight.
- Scrolling: the terminal draws with xterm's WebGL renderer, which a
scroll does not make lay every row out again. A swipe is applied once a
frame, and moves the view by pixels: xterm scrolls whole rows, and the
rest of a row is a GPU shift of the drawn screen, put on together with
the rows it goes with.
Claude-Session: https://claude.ai/code/session_01HVosmYyVSH3BrsLYx3tcSS
* feat(mobile): settings, message history, and a tighter home screen
- Settings, from beside the Machines title: appearance (automatic, light,
dark; the status bar and keyboard follow through the window's interface
style), terminal text size, how a pane wider than the phone first shows,
clearing the message history, and the version.
- The message box keeps what it sends on the phone. As a message is
written, past ones that match take the key row's place; with the box
empty, a History button opens them all, searchable. A line that asks for
a password is sent but not kept.
- ^R on the third key page, for the shell's own history search.
- A top-level screen's bar floats over the list, clear until the title
scrolls under it, so the large title sits just under the status bar.
Claude-Session: https://claude.ai/code/session_01HVosmYyVSH3BrsLYx3tcSS
* fix(mobile): a fitted pane fills the view, and its scrollbar drags
- A pane shorter than the view (a wide one, fitted) no longer leaves the
bottom of the screen blank: the terminal here runs as many rows as fill
the view, the extra ones holding the pane's earlier lines, and what is
left over goes above so the prompt stays next to the keys. The pane on
the desktop keeps its size.
- A drag that starts on the scrollbar is left to xterm. The swipe handler
took it too, the other way round, and the two cancelled out.
Claude-Session: https://claude.ai/code/session_01HVosmYyVSH3BrsLYx3tcSS
* fix(mobile): errors say what to do in the app, not on the command line
The messages a phone shows, and the two Settings → Mobile can, named the
gateway process, the CLI's `tty7 server start`, the transport and a lock
file's path. They now speak of tty7 on the computer and of pairing: open
it there, update it, pair again, quit the other copy.
Claude-Session: https://claude.ai/code/session_01HVosmYyVSH3BrsLYx3tcSS
* style: rustfmt the gateway and mobile client
Claude-Session: https://claude.ai/code/session_01HVosmYyVSH3BrsLYx3tcSS
---------
Co-authored-by: Claude <noreply@anthropic.com>
canonicalize answers \\?\C:\... on Windows while git prints C:/...; the
production path already folds the first into the local spelling in
probe_repo, only the test compared them raw.
A tab's auto group comes from probing its cwd for a repository. Any
failure of that probe - git failing to spawn, the macOS /usr/bin/git shim
dying while Xcode is mid-switch, a remote link dropping - came back as
"not a repository", overwrote the tab's remembered group, and was never
re-checked while the pane sat idle. Tabs in perfectly good repositories
dropped into Ungrouped and stayed there.
- Read root, home and branch in-process on this machine with
gix-discover instead of three git processes. Only the line counts
still come from `git diff --numstat`, so they keep matching the diff
views; a detached HEAD is still named by git for the same reason.
- Remote hosts keep asking their own git (a new control request would
force a dialect bump), but the probe now tells "not a repository"
(exit 128, or the directory is gone) apart from a failure.
- A failed probe leaves the cache as it was, so a tab keeps its
remembered group, and an unanswered cwd is retried every 10s.
l0ng-ai
