707 Commits

Include renames

Author	SHA1	Message	Date
Mohamed Boudra	0fa7f840b4	Add fx as a provider you can opt in to from the catalog (#9160) ... * feat(providers): add fx as an opt-in bundled ACP provider fx ships a native ACP server, so it follows the catalog opt-in shape of the other bundled ACP provider and needs no vendor protocol code. fx files its provider selector first under ACP's "model" category, then the model, Fast, and Ultrafast. The ACP adapter took the first option in that category as the model, so the model picker listed fx's providers. It now prefers the option with id "model" and keeps the rest as settings. * fix(providers): keep the chosen model across ACP provider changes fx's provider option also selects that provider's saved model. Paseo applied the model before the option, so a new agent lost the requested model. It also kept the old model as the agent's preference after a switch, and reopening the agent sent that model to the new connection. Apply opening configuration in the order the agent lists its options, and store the model an option moved the session to.	2026-11-09 20:58:01 +07:00
Mohamed Boudra	9a5b4aefa4	Stop showing Updating messages for a chat that has not changed (#9175) ... * fix(app): stop showing Updating messages for a chat that has not changed Every return to a chat fetched from the daemon just to learn nothing had changed, and the toast covered that fetch. The subscribe request that attaches a chat now carries its cursor, and the daemon answers current or behind in the same round trip, so an unchanged chat needs no fetch and shows nothing. The daemon attaches before it compares, so a commit landing in between is either delivered live or counted as behind. It never loads an agent to answer: an agent it has not loaded answers behind and resumes in the fetch, as before. The delay before an unanswered check shows the toast starts when the request is sent. A cold start's cache read alone can outlast the delay, which would flash the toast for a chat the daemon then reports current. * fix(app): keep agent details and stay quiet after a current timeline answer The timeline fetch that a current answer skips also delivered the full agent row, and the replica cache stores only part of it. After a cold reload with an empty incremental directory page, usage, modes, permissions and runtime info stayed empty. The subscribe answer now carries the row for each current chat, gated with the rest of the freshness check. The panel also reported ready before the timeline owner was published, so a connected render with cached content showed Updating messages. No owner now reads as a check that has not begun. * test(app): pin the held running turn across a freshness check A chat that left mid-turn holds its running footer until its messages are current. With the freshness check, "current" is that commit with no rows, so the tests and the timeline-sync doc now cover the check in flight, a current answer, and a behind answer that holds until the fetched rows land. * fix(app): keep hidden chats live while a subscription is replaced The old timeline subscription was released in the same tick the new one was requested. The client deletes a route on release and adds the new route only when the daemon responds, so events sent in between were dropped. Visible chats recover through the cursor check; hidden chats skip it and stayed behind until something else fetched them. Release the old subscription when the new one settles. Accepting the new route and releasing the old one happen without a socket frame in between, so each event reaches the client once. * test(app): make the plugin chat reload spec independent of the freshness answer The spec reloaded and waited for a held timeline fetch. A chat with a cached cursor now answers current and never fetches, so the wait hung until the test timed out, depending on whether the cursor had been saved before the reload. Hold the subscribe request instead: the catalog still has to arrive while the timeline is outstanding, for either answer.	2026-11-09 17:56:48 +07:00
Mohamed Boudra	28c188513e	feat: plugin API for agent options, metadata, composer and New workspace (#8744) ... * feat(protocol): option controls, options patch, and provider.controls.list Add AgentOptionControl descriptors, snapshot options/controls, an options patch on agent.config.apply, provider.controls.list RPC, and server_info.features.providerOptionControls. featureValues stays accepted on the wire (COMPAT). * feat(server): fold featureValues into providerOptions and describe composer controls Providers emit option controls over top-level providerOptions keys; the daemon stores one options record per agent, merges config.json defaults as effective values, and applies patches live via AgentSession.applyOptions. Legacy featureValues (wire, stored records, profiles, schedules, hooks, MCP) fold into providerOptions; snapshots still carry features built from controls. Snapshot options expose only keys that have a control. * fix(server): address Phase 1 audit findings on option controls - Removing auto_accept (OpenCode, ACP) turns live approval off; ACP selects return to their session default. - agent.create.before hook featureValues edits override options the create already set. - Claude commits fast_mode only after the runtime accepts it. - Codex snapshots show a saved Fast preference as the tier the model resolves it to (AgentSession.displayOptions). - Profiles are folded into options in the daemon config store; the config API still answers with featureValues. - Snapshot options and provider.controls.list carry all effective options. - Test: Claude fast_mode survives a restart through stored providerOptions. * fix(server): keep snapshot options as configured, restore OMP baseline, cover options through public interfaces - Codex: drop displayOptions; a select choice may carry aliases so a saved Fast preference selects the model's Fast tier from options + controls alone. - OMP: removing fast_mode restores the runtime's starting setting. - ACP/Cursor removal tests run through real session initialization. - agent.config.apply of a non-control option reaches the provider and shows in the next snapshot (daemon e2e). - Daemon config store persists legacy-featureValues profiles as options on the next profile save. * fix(server): read a pre-v0.10 Codex fast_mode record as service_tier "fast" and store it that way A record holding `fast_mode: true` without `service_tier` ran Fast but the speed control showed Normal, and picking Normal then wrote "default". The Codex session now normalizes the old boolean at construction and reports the new shape through its existing options_changed event. * fix(server): show Fast for a stored Codex fast_mode: true without rewriting the record Reverts the storage migration from a987b4a43. The Codex speed control now takes its default from the session's current options with the same rule the runtime uses (an explicit service_tier wins; fast_mode: true applies only while service_tier is absent). This holds on create, resume, live apply and for config.json defaults, and stored options stay as set. * chore(website): regenerate the config schema for profile options * refactor(server): providers report option differences once, after create, resume and apply Providers used to write their own reports into the agent's options while a session was being created, resumed or updated, which needed a growing set of reconciliation, baseline and suppression rules to stay in step with the daemon. The contract is now transactional. A provider opens or updates with the options it is given and emits nothing while doing so; if the result differs it says so once, afterwards, as `options_changed`. Live apply hands the provider only the keys the patch sets and the daemon stores them onto the agent's current options when the provider accepts, so the last write wins. A change the provider makes on its own is stored and forwarded, not undone. Removing an option drops the key and sends nothing live. Controls carry no state; `options` is the only option state. A legacy `agent.create.before` hook's `featureValues` edits are applied as a patch over the returned options, so its deletions and replacements hold. The unreleased `aliases` field on option choices is gone; a pre-v0.10 Codex Fast preference is reported once as the model's tier id. * refactor(server): providers return what apply and open ended with instead of reporting it afterwards applyOptions returns the options the session ended up with and the session exposes its open difference as openOptionsPatch, so the manager stores the patch and the provider's answer in one step. Removal is an ordinary patch: the provider receives the default the key falls back to, or null, and returns what it kept. Controls no longer take a default from a stored legacy feature value. * fix(server): apply an old app's profile featureValues over the profile's stored options The unchanged app's profile form only knows the controls, so a name-only edit dropped options it never shows, such as sandbox_mode. Its featureValues now apply as a patch over the options already stored for the profile (null removes a key), and a write with no featureValues keeps them. * fix(server): ACP reports the selects it moved during open or apply as that call's result A config_option_update that arrived before the write response was emitted as an event on top of the result the manager stores. Notifications during open or apply now fold into the open patch or apply result, and a rejected apply reports what the agent moved since nothing is stored. Live options are validated with the creation schema. Tests drive a stdio ACP agent. * fix(server): providers validate live option patches and Claude reports Fast dropped by a model switch Live patches go through the schema used at creation. A Claude model switch that cannot keep Fast reports fast_mode as removed so the stored options match the session. * fix(server): Claude reports Fast as off, not removed, when a model switch drops it A removed key lets a config.json default of fast_mode: true fill back in while Fast is off at runtime. * fix(server): fold an old app's profile featureValues by the provider and options the write carries A write with options folds featureValues over those options. A write without them patches the stored options, unless the profile moved to another provider, which starts from no options. * docs(server): a rejected apply reports what the provider moved after the call ends * test(server): a patch key is resolved against nested configured defaults * test(server): a setting a plugin changes on its own is forwarded as options_changed * test(server): assert the forwarded plugin setting without nesting callbacks * test(server): removal of auto_accept returns ACP to asking; Claude keeps opening restrictions across a patch * fix(server): Codex returns the tier it resolved and drops a speed the new model lacks A live service_tier: fast is stored as the catalog's Fast tier id instead of a value the control cannot show, and a model switch to a model without the stored speed reports Normal so choosing a supporting model again does not bring the paid tier back. * fix(server): Claude applies only the keys a patch sets over its current options A Fast patch kept a copy of the options taken before the runtime answered, and assigning it afterwards dropped a patch that landed meanwhile. * fix(server): a plugin that moves settings and then refuses an apply reports what moved * refactor(server): the legacy featureValues folds take one named-input object * fix(server): a live patch is rejected for an option the session only reads at start, and opening reports every option it ended up with A stored option has to describe what runs. OpenCode, OMP and ACP now reject a live change to a key they apply only when the agent opens; Claude applies such a change from the next turn and rejects it while a turn is running. Opening reports every select or setting the session came up with, including ones nobody set, so a native default (Cursor opening with Fast on) is stored as option state like any other. * fix(server): Claude rejects a live change to an option it reads when the query starts Replacing a started query to apply the option would end its background shells and tasks. Once the query exists only Fast can change; before the first prompt every option still applies, because it is read when the query is built. * fix(server): a live options patch is rejected when the session cannot apply it A session with no applyOptions (Pi) now rejects a patch instead of storing a value that fails on reopen. Codex applies only service_tier, plan_mode and fast_mode live, since the approval policy and sandbox are fixed when the thread starts. Claude also rejects a launch option change while its first query is starting, after the options have been copied. * fix(server): plugins reject keys they do not report as settings, and Codex opening reports the speed it runs A plugin session applied the settings it knew and silently stored the rest; it now rejects a patch that names a key the plugin does not report. Codex opening on a model without the saved speed ran Normal while the stored options still said priority; opening now reports the tier it runs, as a later model switch does. * refactor(server): option helpers take named inputs, control types come from their schemas, and a plugin accepts launch options it opened with A whole profile is applied by the unchanged app, so a launch-only plugin option whose value has not changed must not fail the apply. applyProviderOptionsPatch and featuresFromControls take one object, and the protocol control types are inferred from the wire schemas. * fix(server): ACP reports a select that appears after startup with its native value A model switch can introduce a select (Cursor Fast) that the session did not have at open. Its value is now stored like any other native selection instead of being skipped because the previous snapshot did not name it. * fix(server): a loaded agent's options stay what its session opened with when a provider default is edited effectiveOptions was recomputed from the current config.json defaults on every state emission, so editing a default changed the snapshot of an agent whose session never received it. It is now computed when the session opens and moves only through an apply or an options_changed. Editing a default affects agents the next time they open. * fix(server): a live apply shows the merged defaults the provider was given in the options snapshot The snapshot took the raw patch, so a nested patch over configured defaults dropped the defaults the provider had accepted. The snapshot now takes what the provider was sent plus what it reports back; stored options still keep the raw patch. * fix(server): an option a session drops when opening is not brought back by a configured default The opening snapshot merged defaults over the options after the session's openOptionsPatch had removed a key. Defaults now merge into what the session was given and the patch applies after. * fix(server): Codex keeps the speed it opened with when the legacy Fast key is removed Opening moves a legacy fast_mode into service_tier, so removing fast_mode afterwards changed the runtime speed to Normal while the stored options still said Fast. Removing the alias now changes no speed. * fix(server): opening snapshots keep the defaults the session launched with, and config-change pushes carry legacy profile values An opening resolved defaults once for the session and again at registration; an edit in between showed options the session never received. Create, resume and reload now resolve once, before the provider opens, and registration starts from that. The daemon_config_changed push skipped the featureValues projection that config replies apply, so the unchanged app lost a profile's legacy values when any setting changed. * fix(server): every opening path hands registration the options it launched with Registration took the launch options as optional and reread the defaults when a path did not supply them, as provider-session import did. It is now required, so create, resume, reload and import each resolve once before opening. The option helpers take named inputs. * fix(server): a saved legacy Codex Fast preference wins over a configured service_tier default The defaults merge put a configured service_tier next to the agent's own legacy fast_mode, and Codex reads service_tier first, so the agent opened Normal. The agent's own alias now replaces the default of the key it stands for. * fix(server): Codex keeps a Fast chosen by alias as the catalog's tier id A live fast_mode or service_tier "fast" was stored as the alias while the apply reported the catalog id, so a later switch to a model with a different Fast id ran Fast under an option that said otherwise. The session now stores the id it accepted and drops the folded fast_mode. * fix(server): the legacy Codex Fast alias folds into one speed on apply and in configured defaults A patch with both speed keys left the alias in the stored options, so a reload started Fast again after the speed was removed; the apply now reports the folded alias. A configured fast_mode default now supplies the service_tier default, so removing an agent's own speed falls back to the configured Fast like opening does. * fix(server): an OMP replacement runtime starts with the Fast the session has now A restart (for example an approval-mode change) restored Fast from the options the session opened with, turning back on a Fast the user had switched off. The session now keeps the Fast it applied or the provider changed, which is what a replacement reads. * refactor(server): Codex's legacy fast_mode converts to service_tier where old data enters Stored records, config.json defaults, profiles, older clients' requests, MCP settings and plugin hooks go through convertLegacyOptions as they come in. Past that point the defaults merge, the manager and the Codex session never see fast_mode for Codex, so the alias branch in the defaults merge and Codex's fast_mode handling are deleted. * fix(server): a legacy hook's replaced speed and an apply request's options convert before they are compared or applied A hook that swaps the canonical speed it was sent for fast_mode is diffed in canonical form, so its replacement is not read as a deletion. An apply request carrying featureValues and options sends one options patch with options winning, so a superseded legacy value is never applied. * refactor(server): the agent manager converts Codex's legacy fast_mode for the adapter behind the provider id The rename is adapter-specific, so it lives where the provider id resolves to its adapter: AgentManager converts an agent's own options on create, resume, import, reload, apply and draft controls, following derivedFromProviderId, so a custom provider extending codex keeps working with a saved or requested fast_mode. Storage, MCP, schedules, hub and profiles pass options through. The featureValues-to-options fold stays provider-agnostic at the legacy edges. * fix(server): a rejected OpenCode auto_accept leaves the session asking for permission applyOptions committed the new flag before approving pending requests, so a failed reply left the session auto-approving while the stored option stayed off. The flag is restored when the apply throws. * fix(server): legacy Fast reaches draft discovery and saved profiles, and overlapping or replaced options keep the state they committed Draft controls and commands convert the config they hand to the provider, so inspecting a legacy Fast preference no longer fails Codex's strict options. A profile naming codex converts its saved fast_mode for the app's controls. OpenCode serializes auto_accept applies so a failed one restores exactly what it changed, and a replacement OMP runtime starts from the Fast the session opened with. * fix(server): an OMP replacement runtime that refuses the session's Fast publishes what it accepted The approval-mode restart installed the new runtime's state without comparing its Fast result to the session's, so a refusal never reached options_changed, the remembered value, or storage. The replacement now goes through the same comparison as refreshState. * fix(server): OMP turn completion publishes a Fast change, and Claude opens with Fast off on a model that has none OMP installed runtime state in several places and only one compared Fast; every state read from the runtime now goes through one install step. Claude kept a Fast default on a model without Fast, which made unrelated options reject until the user cleared it; the session now opens with Fast off and reports it in openOptionsPatch, as the model-switch path already does. * fix(server): a malformed Codex fast_mode is rejected, and profile options are renamed for clients by the agent manager's conversion convertLegacyOptions read any truthy fast_mode as Fast, so the string "false" ran priority. It now accepts only true, false or null. The profile store no longer renames keys: a literal codex profile was renamed in storage while an extends-codex profile was not. The config API now converts each profile's options with the manager's adapter-aware conversion, so codex and my-codex profiles read the same. * fix(server): a profile is stored in the current option keys, converted for the adapter its provider extends Profiles in config.json are old data entering, so the store converts them (stored value and incoming patch) with the same conversion the agent manager uses. Storage and clients now share one vocabulary: resetting a legacy Codex profile's speed removes what was shown, and a malformed fast_mode rejects the write instead of breaking later config reads. The config API goes back to copying the field shape only. The extends chain is followed by one function over either the registry's definitions or config.json's providers. * fix(server): profile options convert against the provider graph a write commits A write that edited a provider and a profile together folded the profile against a shallow merge that dropped the provider's extends, so its legacy Fast was not converted. The fold now sees the same deep-merged providers the write commits. * fix(server): draft speed shows the tier the first turn will run with Draft discovery reported the options as requested, so a Fast configured as a legacy fast_mode or the fast alias read as Normal while creating sent the model's own Fast tier. The draft now reports the options the scratch session opened with, as registration does. * fix(server): ACP option applies run one at a time Two overlapping applies shared one transaction guard, so when the first was refused after the agent had moved a select, its report was dropped as 'still in a transaction' and the second saw no difference. Applies are serialized, as OpenCode's are, so each reconciles against the state the previous one left. * fix(server): an ACP removal reports the choice the select lands on, and the Codex plan tests enable plan mode A removal asks the select for its empty choice and compared the result against that same empty choice, so applyOptions returned nothing and the manager stored the removal as null while the session ran the Default choice. The difference is now computed against what was asked (null), so the options hold the value the session runs with. The Codex plan-mode end-to-end tests called the removed session.setFeature through an optional call and silently skipped plan mode; they apply the option and fail loudly if the method is gone. The MCP parity wrapper forwards listControls instead of the removed listFeatures. * fix(server): plugin option applies run one at a time, and OpenCode reports the Auto Accept legacy full-access turns on Plugin sessions let two applyOptions overlap. The second finished and re-recorded the settings the plugin held, which included a change the first had already made and not yet reported; when the first then failed, nothing was left to report and the stored options kept the old value while the plugin ran the new one. Applies now queue on the session, the way the ACP adapter's do, so each reconciles against what the one before left. OpenCode normalizes the legacy full-access mode to build with Auto Accept on, but the session never said so, so the options the manager keeps did not hold Auto Accept and a reopen turned it off. The session now reports it through openOptionsPatch on create and resume. * refactor(server): openCodeOpenOptionsPatch takes one named-fields object * feat(app): the client and app work on options and controls The agent snapshot's `options` are the state and `controls` only draw them. Running and closed agents draw from the snapshot; drafts and profile forms ask `provider.controls.list.request` with their `providerOptions`, so aliases such as a legacy Fast profile's `service_tier: "fast"` are resolved once, by the daemon, and the draft keeps Fast highlighted. A draft adds only the user's edits and each provider's last-used control values; applying a profile seeds its non-control options (e.g. `sandbox_mode`) into the draft, and a profile form saves them back instead of pruning to the controls it can draw. A daemon without `server_info.features.providerOptionControls` still sends `features` and `featureValues`. `LegacyProviderOptions` in the client package is the one place that translates snapshots, draft listings, create and apply requests, and daemon-config profiles, so the app never branches on it. Persisted preferences and tab layouts rename `featureValues` through tagged COMPAT preprocessors. The features/controls bridge moves from the server into the protocol package so the client can reuse it. * fix(app): drafts and profile forms send every option layer to the daemon A cold create against a daemon without providerOptionControls routed control options (Claude fast_mode, Codex service_tier) as providerOptions, which that daemon does not read for them. The client now lists the provider's features before the first create or workspace create that carries options, so callers never prime a cache. Draft options moved into a plain model. Applying a profile replaces provider and options in one step, so the form's provider change that follows no longer clears a cross-provider profile's non-control options; choosing a provider by hand still starts over. The model sends its complete options (seed, last-used values once the provider says it still draws them, edits) to the daemon and the controls draw only the answer, so a remembered legacy fast is drawn as what it runs as. A toggle shows over the last answer until its own arrives. The profile form does the same: its edits go through resolution too. * fix(client): a legacy create routes its options from the controls of its own config Which options a legacy daemon exposes as features depends on the model, mode and thinking level, not only the provider: a Haiku snapshot with no features says nothing about Opus. The provider-keyed memory of control keys sent an Opus create's fast_mode as providerOptions, which that daemon does not read. A create that carries options now lists the controls for its own draft config and splits on that answer. The memory, and the snapshot and listing hooks that fed it, are gone. * fix(app): a closed agent shows its stored options, and a provider switch asks about its own options A closed agent's snapshot is projected from its stored record, which kept controls and provider options but dropped them from the payload, so the app drew no speed or other controls for it. The stored projection now carries them, with the legacy features derived from the same source. The draft read the form's provider and the model's options separately, so for the render after a manual provider change it asked the new provider about the previous provider's options. The request is now built from one snapshot of the model and is absent until the model has observed the new provider. * fix: persisted options keep their full shape, and every legacy snapshot gains controls Draft setups and form preferences validated option values as booleans, strings or null, but the options they now receive come from agents and profiles and can be objects, arrays or numbers. One such value failed validation and wiped the whole saved layout or the saved preferences. Both schemas now accept any JSON value. The legacy-daemon translation skipped the snapshots carried by agent_created, agent_resumed and timeline responses, so a created agent or a timeline refresh left the SDK handle without options and controls. The profile journey asserted the create request's options field; the wire field is providerOptions. * fix(client): a legacy profile with both featureValues and options keeps both A legacy daemon keeps an unknown `options` field on a profile it stored (profiles are passthrough), for example after a downgrade, while its own app keeps editing `featureValues`. Reading such a profile took `options` and dropped `featureValues`, so a Fast setting there was lost and the next save replaced it. Both are merged on read with an explicit `options` key winning, the same rule the daemon applies when it folds `featureValues`. The draft form input of draftControlsRequest is a named type. * fix(app): a draft stops sending a toggle the model in use does not offer A toggle made on one model stayed in the draft's edits after the form moved to a model whose controls do not include it, and was sent with the create. On a legacy daemon that key is not a feature for the new model, so it went out as a native provider option the daemon rejects. The draft now sends an edit only while the latest answer draws a control for it, and sends it again when a control for it returns. * fix(server): a closed agent's options include the provider defaults, like a live one's The stored snapshot projected only the options the agent owns, so an agent that ran with a config.json default (for example Claude fast_mode: true) showed the option as missing, and its legacy Fast control as off, until it was resumed. The projection takes the same resolver the live agent uses (the provider's defaults under the agent's own options). * fix(app): a draft keeps sending an option no control has drawn The previous change stopped sending any edit the latest answer drew no control for, which also dropped options set without a control (a plugin setting a token budget on the draft). Only an edit of a key an earlier answer for this draft drew as a control stops applying when a later answer draws none; every other edit always applies. * test(server): the MCP test agent manager resolves effective options * fix(app): a profile stops saving a toggle the model in use does not offer Switching a profile from Opus to Haiku kept the Fast edit, so the saved profile carried fast_mode that no control draws and an old daemon's provider rejects at create. The profile editor now drops a key an earlier answer drew as a control and the latest one does not, the rule the draft already follows; options no control ever drew are never touched. * fix(client): resetting an option on an old daemon writes the default it can take setAgentOptions({ service_tier: null }) sent a feature write with value null, which the old Codex setter rejects, leaving the paid Fast tier on. A toggle now resets to off and a choice to its default; an option with no control to name a default fails with the host-update message before anything is written. * fix(client): applying a config with a reset option on an old daemon writes the default it can take applyAgentConfig({ options: { service_tier: null } }) reached an old daemon as featureValues with null, which its Codex setter rejects. The config now takes the same translation as setAgentOptions: a toggle goes off, a choice goes to its default, and an option with no named default fails with the host-update message before anything is sent. * feat(plugin): provider plugins declare option controls and receive option changes A provider plugin reports `controls` and the `providerOptions` it runs in `session.config`, and receives running-session changes as `session.configure` `changes.providerOptions` (null returns a key to its default), under the same apply-or-throw contract as built-in providers. A control may declare a `defaultValue`; a value a plugin reports at that default for a key nobody set stays unset instead of being pinned to the agent. A plugin that still reports `settings` keeps working: the daemon reads each setting as a control plus an option and sends changes in both shapes (COMPAT(plugin-provider-settings)). The app resolves a control's icon as a Lucide name when it is not one of the built-in kebab-case names, so a plugin's icon shows live and in drafts. Public docs and the provider-direct example use only `providerOptions` and controls; the migration doc gains the rows. * fix(server): a plugin provider's reported options are stored like any provider's A control's `defaultValue` only says what the control shows for a key with no value. Opening and applying store every option the session reports, defaults and values nobody set included, as built-in providers do; the special case that left a value at the default unset is removed. * fix(server): a plugin decides which options it applies live A plugin reporting `controls` and `providerOptions` receives every key a live change touches, with or without a control, and applies them or rejects the whole request. The daemon's live-key guard now runs only for a plugin still reporting `settings`, which cannot refuse a key. * fix(server): a rewound plugin session reopens with its options as they stand The reopen merged the plugin's reported options over the launch record, so a key the plugin reset by leaving it out came back at its launch value. The session now keeps the committed options, removals included. The provider-direct example also refuses a combined request before changing anything. * fix(server): a plugin that stops reporting an option has reset it The adapter only visited keys present in a new report, so a key the plugin dropped to return to its default kept its stored value and its rewind value. A previously reported key that disappears is now reported as removed. * fix(server): an apply reports the options the plugin reset along the way Applying and unsolicited reports now share one conversion from the plugin's report to a patch, so a key the plugin stops reporting is a removal on both. * fix(server): an apply never reads a requested option as one the plugin dropped A plugin may run an option it never reports. Only a key it reported before can be reported as removed, and a rewind reopens with the accepted request plus what the plugin reported back. * test(server): an apply to a plugin that reports controls sends its changes as provider options * feat(plugins): agents and workspaces carry plugin metadata Plugins had nowhere to keep their own data on an agent or workspace, so Phase 5 and 6 surfaces would each have invented a side store. Both now hold an opaque Record<string, JsonValue> that Paseo stores, snapshots and hands to hooks without reading a key. Set at creation or changed with agent.metadata.update.request / workspace.metadata.update.request (top-level keys replace, null removes). Persisted on the agent and workspace records, so it survives a restart. Reaches agent.create.before (which may add to it), agent.open.before (read-only), agent.create.after and workspace.create.before/after. Gated once on server_info.features.entityMetadata; the client throws "Update the host" instead of sending to a host without it. * fix(plugins): an agent.open.before result may omit metadata The result schema required metadata, so a plugin written before metadata existed that returns its own object instead of spreading the request failed validation and the session open failed, even for agents with no metadata. An omitted metadata now means unchanged and is filled back in from the request so later plugins in the chain still see it; a present value that differs is still rejected. The restart test now sets metadata through the PaseoApi handles and checks that agent.open.before sees the patched value after the restart. * fix(plugins): omitted metadata in a hook result means unchanged An agent.create.before hook that returned its own { config, env } dropped metadata that an earlier hook in the chain had added, because only the caller's original metadata was restored at the end. The omitted field is now carried forward at each hook handoff, as agent.open.before already does. The agent.open.before result type also required metadata, so an older TypeScript plugin that returned its own object no longer compiled even though the daemon accepted it. The result type now makes it optional. * fix(plugins): omitted metadata in a workspace.create.before result means unchanged Same handoff as agent.create.before: a legacy hook that returned only { source, ... } dropped the caller's metadata and anything an earlier hook added, and workspace provisioning then defaulted it to {}. The omitted field is carried forward at each handoff; an explicit {} still replaces. * test(server): fixtures for agents and workspaces carry metadata Agent snapshots and workspace records now always carry metadata, so the hand-built fixtures and expectations in three existing suites name it. * docs(plugins): the hook result comment names metadata as the field that stays * fix(server): reopening a closed agent keeps metadata saved just before The loader reads the agent record, then queues a resume. A setMetadata queued ahead of that resume saves a newer record, and the open hooks saw it, but registration took metadata from the loader's older read and wrote it back over the saved patch. Registration now uses the metadata read inside the lifecycle lane. * docs(server): name the metadata gap when a handle-less agent is recreated on load * docs(server): the handle-less recreate gap spans the agent.create.before hook * docs(plugins): an agent.open.before hook starts writes to its own agent without awaiting An agent.open.before hook that awaits setMetadata (or any write) on the agent being opened deadlocks: the write joins the agent's lifecycle lane behind the open, and the open waits on the hook until it times out. The hooks reference now says so and shows the supported shape, a write started without awaiting, which runs right after the open. Deferred, not in this stack: reject such a write immediately instead of letting the hook time out. The host knows which plugin hook it is awaiting for the agent and which channel the write arrives on, so the rejection can be keyed on "this plugin is inside an open hook for this agent" without cross-process tagging, and an unrelated client's write would still wait as it does today. * feat(plugins): composer items and controls in all three composers A plugin registers a component with addComposerItem and reads and changes the composer through useComposer(): provider, model, mode, thinking, options, prompt, attachments and agent metadata. The agent, draft and New workspace composers provide the same ComposerInput and ComposerAgent halves, so a command reaches the right model without the plugin knowing which composer it sits in. Toggle, Select and Action are drawn by one ComposerControl renderer that the thinking select and provider option controls now use too. Controls sit in the toolbar when there is room and become rows in the existing overflow sheet otherwise, so on a phone they appear in the overflow. Plugin items count in the density presence so the composer condenses to make room. Model and mode stay specialized but share the trigger, density and overflow. Draft metadata is kept locally, sent at creation and reset when the prompt is sent. PluginAgentSnapshot.metadata, deferred from the metadata phase, lands here. The unused provider badge is removed. vitest resolves @floating-ui/react-native to its ESM build: the CJS entry requires the real react-native, whose Flow sources do not parse. * fix(plugins): composer commands run on current state, report failures, and reach the overflow sheet Draft commands read the state captured at render, so a plugin's `await setProvider(); await setModel()` acted on a stale provider. The draft form and options are now plain stores that commands read live, and `setProvider`/`setModel` reject an unavailable provider or a model the loaded catalog does not list. Draft `options` include the plugin's pending edits. Shared composer controls own the pending state and show a rejected command as an error toast, like the built-in controls. Callback payloads are objects (`{ value }`, `onPress(event)`) so they can grow without breaking plugins. The overflow sheet's content portals to the app root and lost the composer's agent, input, toast and query contexts, so plugin items drew nothing in it. `useComposerSheetBridge` carries them across. * test(plugins): composer commands tested on the models, overflow sheet in Playwright The draft composer's command rules (unavailable provider, unlisted model, edits belonging to the provider the form has now) moved from the React hooks into the form store and the draft options model. They take the host's catalog as a plain input, so the command tests run on the real models with no module mocks and no renderer. The overflow-sheet test faked the portal it was meant to verify. It is replaced by a Playwright spec that installs the composer-controls example and checks its rows in the narrow composer's Features sheet; it fails when the sheet's context bridge is removed. * test(plugins): lock draft option ownership without a subscription, name the overflow-sheet steps The draft option test subscribed the options model to the form, which in the app happens in a render effect, so it passed without the model observing the form's provider itself. A case with no subscription now fails when that observation is removed. The overflow-sheet spec reads as steps through a helper. * fix(plugins): composer option resets and model checks match the documented commands A draft kept `null` as an option value, so `setOptions({ key: null })` sent the null to the provider and creation failed. A null edit now removes the key from every draft layer, as the patch does on a running agent. A running agent's `setModel` accepted ids its catalog does not list; it now rejects them the way a draft does. The composer controls imported the toast host through the toast context, which pulled the host's animation module into every module that loads plugins. They use the API-only context instead. The migration guide's registration table gets the `addComposerItem` row its test requires. * fix(plugins): draft metadata survives a remount, plugin commands follow the composer lock Draft metadata was component state while the prompt lived in the draft store, so a composer that remounted across the compact breakpoint kept its text and lost the plugin's choices. It now lives in the draft store beside the prompt, is cleared when the draft is sent, and is not cleared when the prompt is emptied. It is not persisted across app restarts. While the New workspace composer is creating the agent, the built-in controls are disabled but plugin controls and commands were not. They read the composer's own lock: Paseo controls render disabled, and setPrompt, insertText and the agent commands refuse. The options and metadata a plugin reads are frozen copies, through the same helper the timeline projection uses. The composer control test mounted components in JSDOM, which the testing rules ban; it now runs in the browser project. * fix(plugins): a kept command honors the composer lock, and useAgent metadata is frozen A plugin action that awaits an RPC holds the composer it was created with. The lock was captured at that render, so a submit that started meanwhile did not stop its insertText. Commands now ask the composer whether it is locked when they run. The agent snapshot a plugin gets from useAgent froze only the outer metadata record. It now uses the same deep frozen copy as the composer. * fix(plugins): attachment commands honor the composer lock The creation request captures the attachments when it starts, so an attachment a plugin added or removed afterwards was lost or left in the request. They refuse like the prompt commands. * fix(plugins): a built-in select in the compact sheet keeps its action name The shared control named every icon-only select by its value ("Speed: Fast"), including in the compact sheet, where the row already shows the value. The sheet row is named by its action again ("Select speed"), as before the shared renderer. * test(app): composer item test installation carries the subscribe main added to InstalledPlugin Main's plugin streaming (#8527) made subscribe a required field of InstalledPlugin; the composer item model test builds its own installation and predates it. * feat(plugins): New workspace items set the branch and workspace metadata addNewWorkspaceItem mounts a plugin field on the New workspace screen, and useNewWorkspace() exposes host, project, isolation, base ref, branch and metadata with commands that follow the composer item rules: they act on the screen's state when they run, resolve once applied, reject while the screen is locked, and take JSON payloads. Host and project are read-only because a command that switched them would unmount the item that called it. The screen's pickable state (base selection, manual isolation, branch, metadata) moves into one plain store so pickers and plugin commands write to the same place; the screen reports derived facts to it on each render. The branch is sent as source.branchName only for a branch-off worktree, and metadata on workspace.create. Items render through ComposerControl with a new "field" surface (badge on desktop, full-width field when compact). Combobox ships here: Paseo owns the loading and error states, keeps previous results, and drops superseded searches. * fix(plugins): New workspace commands work from mount effects, and branch and base ref match what creation uses A command called from a New workspace item's mount effect rejected because the setup model only received its inputs and the pickers' handlers from a passive effect on the screen, which runs after a child's. The model now takes its inputs at construction, picks the base and isolation itself, and is refreshed in a layout effect; the screen supplies the side effects of a pick (the PR attachment, the remembered isolation) as listeners. The branch a plugin sets was dropped when no base was resolved, such as on a detached HEAD, because it was sent only for an explicit branch-off. It now applies whenever the worktree cuts a new branch, decided in one place that mirrors the daemon. baseRef.name was the display-shortened branch name, so setting back what was read based the worktree on the local branch instead of the origin one. It is now the exact ref creation uses, and host and baseRef are frozen like project and metadata. * fix(plugins): New workspace commands have the same effects as a pick, even from a mount effect The screen attached the pick side effects (remembering the isolation, syncing the picker's PR attachment) as listeners in its own useEffect, which runs after a child item's mount effect. A mount-time setIsolation("worktree") switched the screen but was not saved, and setBaseRef skipped the attachment sync. The effects are now injected when the setup model is built, so a command and a pick run the same code from the first render. Closing the picker stays in the picker's handler. * fix(plugins): a Combobox shows a failed refresh instead of the old results The query keeps its cached data when a reopened list fails to refresh, so the old items stayed selectable and the error never showed. A failed search now clears the list so its error shows. The migration guide maps addNewWorkspaceItem, which its registration-coverage test requires, and the superseded-search test waits on a later search instead of sleeping. * fix(plugins): a branch and metadata chosen for one project are not sent for another The setup model outlives the project and host it was chosen for, so an issue picked for project A was sent on workspace.create after the user switched to project B. The model now drops the branch and metadata when the project changes (project ids are host-scoped, so a host switch counts). A project that is still resolving is not a switch. The base selection is left alone: the built-in picker keeps a branch pick across a project switch, and that behavior is unchanged. * test(plugins): the project-switch spec expects the other project's metadata to be empty * fix(plugins): a host switch drops the branch and metadata even when the project id repeats A remote repository keeps the same project id on every host, so comparing the project id alone missed a switch from host A to host B for the same repository. The target is now the host and the project id together. * fix(server): a branch the caller named is not renamed from the first agent context The daemon marked every new branch-off worktree for automatic naming, recording the chosen branch as the placeholder, so the first agent's prompt could rename a branch a plugin or client had named through branchName. Only a branch the daemon derived from the worktree slug is a placeholder now. * fix(plugins): New workspace items remount when the project or host changes An item stayed mounted across a project switch, and its Combobox kept the previous project's results (same query key, cached data) selectable until the next search returned, so an issue from the old project could set the branch and metadata on the new one. A Combobox cannot detect that its inline search now means another project, so the item host keys the items by host and project id. Items and their search results start fresh for the new target, and a mount effect sets up again after the model clears the branch and metadata. * docs(plugins): a layout-effect command on mount also races the reset on a project switch * fix(plugins): a New workspace item's commands stop working once its project or host is left Every item received the same command functions, which act on the current screen state. A lookup that finished after the user switched projects could still call setBranch or setMetadata and overwrite the new project's choices; the reset on a switch only clears what was already written. The setup model now hands out commands per target with commandsFor({ serverId, projectId }). They reject with a "moved to another project or host" error when the screen is on another target, like the lock rejects, so the promise only resolves when the change took effect. * feat(plugins): reach a running agent's composer by reference useComposers(selector) in any plugin component and composers(selector) on every command context return the composer of a running agent, named by id or by focus, whether or not its tab is open. A running agent now has one store-backed composer model apart from any mounted tab. The mounted composer plugs its cursor-aware insert in while mounted; otherwise insertText and setPrompt write the agent's saved prompt. model and thinking resolve through the provider catalog with the picker's own function, so a read equals what the picker shows. The host reads one ComposerModel from context and no longer knows whether it is in an agent, a draft or New workspace. The daemon rejects an unlisted model or thinking option for a running agent, replacing the app-side guard. * fix(plugins): composers by reference follow the focused agent and reach retained composers - `{ focused: true }` is the agent Command Center hands to agent items, published by its registration through plugins/focused-agent.ts and empty outside a workspace. The composer source reads that module instead of the remembered workspace selection, the navigation store and the layout store, which also removes the require cycles those imports added. - A composer the app retains in a workspace the user left has no live input. `insertText` and `setPrompt` now store the text with `replaceDraftText`, which asks the mounted input to show it; before, the text reached the store but the retained input never displayed it. - `model` and `thinking` read exactly what the picker resolves before the catalog loads (no models), then re-resolve when it lands, instead of reading null. - The daemon validates a thinking option against the model the agent runs: the runtime model when the provider lists it, else the configured one. - The composer sources subscribe to query-cache updates only. A query another component creates during its render is announced as `added`, and a subscriber that updates then made React warn about updating a component while rendering a different one. A catalog read no longer starts its load synchronously either. * test(plugins): a Command Center agent item reaches the composer through the real client state The command-path test now reads workspace and agent through createPluginClientStateSource over seeded session stores, so an empty lookup, which makes the Command Center return before calling the item, would fail it. Also records at the focused-agent publisher that it publishes in an effect. * fix(plugins): a running agent's composer validates and refreshes against the agent's own catalog setAgentModel and setAgentThinkingOption checked the provider's global catalog, while the picker reads the catalog of the agent's directory, so a model only the project lists was rejected. The validation input now carries the directory. The composer read the catalog once with no observer, so reconnect repair, which refetches only active queries, never refreshed it and a failed load never retried. While anything watches, the composer now observes the catalog query. The shared composer map kept every agent's composer for the session. It is now dropped when nothing watches it and no composer is mounted. * fix(plugins): useComposers holds the composer it names, and a composer lives as long as its agent PluginComposersSource.subscribe watched the stores directly and never the composer model, so a component using useComposers did not keep the model's catalog observer alive and reconnect repair skipped it. subscribe now takes the selector and holds the model it names, following focus. Dropping a composer when it went idle left a command a plugin had saved calling a dead model after the tab reopened. A composer is now dropped when its agent leaves the session and nothing watches it or has one mounted. * fix(plugins): a composer refreshes a stale catalog on resumed demand, shares its store watches, and is released with its last holder Watching again, or reading once, after the catalog was invalidated or failed while nothing watched now starts one deduplicated refresh; the observer refetches on mount. Reconnect repair only refetches watched queries, so an unwatched catalog stayed stale. Each subscribe installed its own session and draft store callbacks, so N watchers received N squared notifications, including for other agents' drafts. One pair of subscriptions now serves all listeners, and the draft callback ignores drafts of other agents. A composer whose agent was removed while it was held was only released on the next session change. The last holder letting go now checks too, and an archived agent's idle composer is releasable. * test(server): live model and thinking switches use values the provider lists The daemon rejects a model or thinking option its provider does not list, so the live-preferences e2e can no longer switch to a made-up id. A provider that lists nothing to switch to skips the case. * test(server): the test providers list two models with thinking options, and the live switches run The fake providers listed one model and no thinking options, so once the daemon validated selections against the catalog the live model and thinking switches had nothing valid to switch to and skipped. Every fake provider now lists two models with thinking options, and the switches run for all three providers without depending on installed binaries. * fix(plugins): a retained composer that is not showing takes plugin writes through the draft On native a retained composer keeps its input mounted under display none, so the ref alone said the input was live and a plugin insertText replaced the stale selection instead of appending to the draft. The input is live only while its retained panel is showing. * test(plugins): the retained input liveness test runs in real Chromium * fix(plugins): a model or thinking change, an unreported option key, and a draft model reach the provider unchecked Paseo no longer checks these in front of the provider. A running agent's model or thinking change no longer waits for the catalog or checks it, a plugin provider is sent every option key and refuses what it cannot apply, and a draft setModel keeps the id as the model picker does. * fix(plugins): a plugin reporting settings is sent every key of an options patch * Run option, model, thinking and mode changes in the agent's lifecycle lane The agent manager owns all sequencing for one agent: applyOptions, setModel, setThinkingOption and setMode now run in the same lane as open, close, archive, labels and metadata, so a provider session never sees two of them at once. Provider-side serialization (the applying chains in the ACP, plugin and OpenCode sessions, and Claude's apply-over-current-options handling) is deleted. * Reopen a handleless agent inside its lifecycle lane A stored agent with no resumable session is now reopened by AgentManager.createAgentFromRecord, which rereads the record inside the agent's lane before creating the first session. A metadata or label write queued ahead is in the record it reads; one queued behind applies to the live agent. The loader no longer passes a record it read outside the lane. createAgent itself also runs in the lane, like resume. * Return the draft's options from AgentClient.listControls listControls now answers { controls, options } like AgentManager.listDraftControls: the options a session opened from the draft would run with, with config defaults merged in and anything the provider resolves natively for the ones nobody set. ACP fills unset feature selects from the probe session's currentValue, so a fresh Cursor draft shows the Fast selection the agent opens with instead of no selection. The legacy features response and the MCP draft listing already project from the manager's result, so they follow. * Send a profile's options on every write, empty included The profile form always sends options. The daemon reads a write without them as one from an app that predates options and folds featureValues over the stored ones; a write that carries them, empty included, replaces them. A profile left with no options is stored without the key, so removing the last one persists. * Read a remembered Codex fast_mode as its service tier The create-agent preferences convert the legacy key on read, keyed on the built-in codex provider id, so the Codex draft shows the Fast selection the user last used. Tagged COMPAT(featureValues) with the other legacy-option shims. * Document one option change at a time per agent The agent manager runs option, model, thinking and mode changes in the agent's lifecycle lane; providers do no sequencing. The hook deadlock warning now covers agent.create.before and option writes. * Flatten the profile fold's base selection and drop an unused import * Carry the New workspace context through portal hosts and the draft's metadata through retry * Convert legacy options when resolving a stored agent's effective options * Keep stored-record reads tolerant of a legacy option the conversion rejects * Keep plugin attachment items separate from the draft's own * Hand plugin command inputs to the host as its own copies	2026-11-09 10:10:16 +07:00
paseo-bot[bot]	249c35891b	fix(app): load History after a browser reload (#9029) ... Consume host connection statuses in History instead of a version-only dependency that the React Compiler removes. Keep saved sessions reachable when the host connects after the screen mounts. Co-authored-by: paseo-bot[bot] <266920839+paseo-bot[bot]@users.noreply.github.com>	2026-11-07 20:02:59 +00:00
Mohamed Boudra	9131505810	Fill short collapsed chat histories (#8358) ... * fix(app): fill short collapsed chat histories Collapsed whole turns can leave the initial viewport short even when older history exists. Continue paging through measured pages before revealing a fresh chat, while preserving visible history and the reading anchor. * fix(app): settle padded and stalled chat history Measure the native history edge using the same content area as viewport filling, and bound child history requests so retry can start after a stalled fetch. * fix(app): adapt viewport filling to the current timeline * fix(app): resume history filling after switching tabs	2026-11-07 23:12:08 +07:00
Mohamed BoudraandClaude	161076a853	Show loading and errors in the slash command menu, and stop defaulting to /exit (#8905) ... * feat(app): show loading and errors in the composer command menu Rows are single lines with a kind icon, the matched part of the name, the argument hint, the description and a source tag. The detail card is gone. The menu used to stay hidden while commands loaded and then show "Error: ..." over a list whose options Enter could still pick, so a failed load plus Enter archived the agent through a hidden /exit. Loading and error are now status rows with no options; the error row names the reason and offers Retry. Loading appears after 300ms so a warm cache paints the results first, as before. An empty query used to select /exit. Provider commands now come first, so the bottom row the input selects is a provider command. useAutocomplete derives the selection during render. When results replace the loading row, the selection is valid in the same render, so the popover stays mounted at its anchor instead of remounting. Claude Code's `__`-prefixed commands (/__remote-workflow) only run in its own server-launched sessions, so the Claude provider no longer lists them. * fix(app): never default the command menu to a Paseo action An arrow-key choice was tied to the query it was made for, so returning to that query brought it back: arrow to /exit on `/`, type `com`, delete it, and Enter archived the agent. A choice now clears whenever the query changes. An empty query still selected /exit when the agent had no provider or plugin commands, because Paseo's actions were the only entries. With nothing else to list, an empty query now lists nothing and waits for a search; typing `/ex` still finds /exit. * fix(app): sort empty-query commands without toSorted Hermes has no Array.prototype.toSorted, so typing `/` threw "undefined is not a function" on iOS and Android and the app showed its error screen. Browsers and Node have it, which is why web and unit tests passed. * test(app): cover the stale command choice in Playwright and wait out the loading row on devices The renderHook test mounted React under JSDOM, which docs/testing.md forbids. The Playwright test drives the same sequence in a real browser and fails without the reset in useAutocomplete: Enter chose the stale /exit. The composer-keyboard harnesses treated a visible popover as a ready list. The popover now shows a loading row first, and a cold Claude command list takes several seconds, so both harnesses wait for the rows. * fix(app): size the command menu loading spinner to the row icons Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-11-06 22:15:10 +07:00
Mohamed Boudra	616f5e155c	fix(app): show branch loading and fetch errors (#8938) ... * fix(app): distinguish branch loading from empty results Preserve branch query pending and error states through the switcher so first open does not report missing branches before the response. Show request failures with a retry action. * fix(app): keep branch retry progress and keyboard focus Verify failed cached refresh and keyboard retry through the real browser and daemon. Keep focus in the footer while Retry is disabled so repeated Enter cannot select a cached branch. * fix(app): preserve picker interaction when retrying branch loads Use the existing close-and-reopen retry behavior with clear feedback rather than introducing an action that competes with native list keyboard ownership.	2026-11-06 21:35:20 +07:00
Mohamed Boudra	471db4bdb5	Keep workspace tabs predictable and clear attention on deliberate focus (#8935) ... * fix(app): preserve workspace tabs and acknowledge deliberate agent focus Workspace navigation no longer chooses an attention agent. Preserve repeated focus actions so an already selected chat can be acknowledged, and stop consuming attention on departure. * fix(app): retain deliberate focus until fresh agent data arrives Connection readiness permits a pending focus acknowledgement without creating a new focus action. Keep that intent across client changes and wait for the current timeline synchronization generation before consuming it. * fix(app): preserve reconnect feedback during attention acknowledgement	2026-11-06 20:55:16 +07:00
3 people	77798b2e46	Show and stop agent background work (#6220) ... * feat(server): add an in-memory store for agent background work Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(claude): report background tasks as background work Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(server): track agent background work in the agent manager Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(protocol): add agent background work messages Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(server): serve and push agent background work Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(client): expose agent background work on agent handles Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(sdk): document agent background work Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(claude): cover background shells in background work end to end Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(client): resync background work subscriptions on every snapshot subscribe() now lists the agent's background work each time the event observation is established, so the listener starts with the current list and catches up after a reconnect. A list answered after a newer update is dropped. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(server): answer background work lists without loading dormant agents Background work lives only in memory, so a stored agent that is not loaded has none. The list handler now answers [] from storage instead of resuming the agent, and still rejects unknown, internal, and archived agents. A new test pins that old apps never receive agent.background_work.update. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(server): read Claude background tasks defensively The user's claude binary can differ from the SDK typings, so a task's description is read as unknown and an empty or missing one becomes null. Drop the monitor kind: Claude Monitor watches report as local_bash, so kind is "shell" or "other" today. The store now copies only the wire fields of each input. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(server): prove internal background work was emitted before checking globals Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(sdk): describe background work resync and feature gating Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(claude): cover background work reported by a retired query The daemon stops reading a Claude query it no longer owns, so work that a retired process still had queued cannot reach the background work list. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(client): let background work subscribers handle a failed list read When the list read that follows each subscription snapshot failed, the error was only logged and the caller got neither the list nor a failure. subscribe() now takes an optional onError that receives it; without one the error is still logged. The read is not retried, since the next reconnect reads the list again. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(agents): show background work as active Keep background activity visible after a foreground turn ends while preserving independent send and interrupt behavior. * fix(agents): protect background work subscriptions Keep internal work out of public updates and restore observation after a subscription failure. * feat(agents): show Codex and OpenCode background work Keep provider-owned shell activity visible after a turn ends while leaving foreground turn controls independent. * feat(agents): stop individual background work Wait for provider confirmation so stopping one background item leaves sibling work and foreground turn controls independent. * refactor(agents): name background stop parameters * test(website): isolate browser tests from live metadata * test(agents): clarify background stop journeys * fix(sdk): report background work subscription failures Report setup failures so subscribers can replace an observation that the host released. * fix(app): restore background work after reconnect Wait for the host handshake before selecting the retained client so an offline pane starts observing when the connection returns. * fix(agents): retain background shells across rewind Preserve known live shell ownership when conversation history is rewound, and revoke it when the provider runtime exits. * fix(website): launch test seeder across platforms Invoke Wrangler through Node so local website test startup does not depend on an executable npm command shim. * feat(agents): clarify background task details and tracks Keep launch descriptions and commands distinct so background work remains identifiable, and allow composer tracks to scroll when space is limited. * fix(agents): preserve active background work during archive Keep background-running children out of bulk cleanup and warn before an individual archive. Preserve first taps on composer tracks while the keyboard is open. * fix(codex): retain background terminals across rewind Keep live terminal inventories attached to their originating threads so a fork does not hide or misroute their stop actions. * fix(codex): scope background terminal identities to threads Prevent commands on separate threads with the same provider process ID from sharing a stop target. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Mohamed Boudra <boudra.moha@gmail.com>	2026-11-06 19:49:49 +07:00
Mohamed BoudraandElsa Granger	ac775a2904	Reveal collapsed navigation as a touch overlay on wide layouts (#8739) ... * feat(app): swipe open collapsed tablet navigation Reuse the retained sidebar and mobile panel motion for a partial-width navigation overlay when the wide dock is hidden. Preserve the dock preference, project gestures through the sidebar width, and dismiss the overlay when revealing workspace content. Reset the animated frame width explicitly across dock transitions and keep the resize origin on the UI thread. Validated on Duo portrait and landscape, iPad portrait and landscape, iPhone full-width navigation, and browser sidebar interactions. Typecheck, lint, targeted formatting, and 31 relevant tests passed. Co-authored-by: Elsa Granger <zeyugao@outlook.com> * fix(app): refine touch navigation overlays Enable navigation swipes only on touch-capable runtimes and reject mouse and pen input per gesture event. Allow swiping from anywhere in the workspace instead of requiring an edge start. Cover the full application window with the backdrop, including safe-area padding, and remove the wide overlay's inline close button. Preserve swipe, backdrop, and destination-selection dismissal. Validated interior swipes on Duo and iPad, mouse exclusion in a browser, and full-window dimming and dismissal in Duo portrait and landscape. Typecheck, lint, and targeted formatting passed. Co-authored-by: Elsa Granger <zeyugao@outlook.com> * refactor(app): let the panel store drop the overlay target on dock Docking the sidebar, or any layout that no longer presents it as an overlay, now drops the transient agent-list target inside the panel store. App chrome publishes one left sidebar presentation (overlay, dock, hidden) instead of an effect in SidebarChrome watching flags. Co-authored-by: Elsa Granger <zeyugao@outlook.com> * refactor(app): answer fine pointer and touch screen from one module Merge use-fine-pointer and use-has-touch-screen into hooks/pointer-capabilities, which reads both answers from the media queries it subscribes to. The touch answer now comes from (any-pointer: coarse) instead of navigator.maxTouchPoints, which that query's change events never reported. Co-authored-by: Elsa Granger <zeyugao@outlook.com> * fix(app): keep the phone web drawer on its edge swipe Restore the 32px left-edge start for the compact web navigation drawer, so interior rightward swipes over terminals, code blocks, and diffs stay with their horizontal scrollers. The wide navigation overlay still opens from anywhere. The edge rule moves into resolveMobilePanelGestureIntent so both drawers share it and it has a test. Co-authored-by: Elsa Granger <zeyugao@outlook.com> * refactor(app): one sidebar handler per destination Settings, host settings, add host, add project, and every navigation row now use one handler that closes the navigation overlay before it navigates. Closing is idempotent, so the docked sidebar shares it and the overlay ? mobile : desktop handler pairs go away. Co-authored-by: Elsa Granger <zeyugao@outlook.com> * refactor(app): resolve the left panel width in one place MobilePanelsProvider now resolves the left sidebar width (full window on compact, the saved width clamped to the safe viewport on wide) and exposes it through the panel runtime. The open and close gestures, the overlay frame, and the docked sidebar all read that value, so gesture travel and panel width cannot disagree. MobileGestureWrapper no longer recomputes it, and the panelWidth/width parameters go away. Co-authored-by: Elsa Granger <zeyugao@outlook.com> * docs: fold the wide navigation overlay into the mobile panel rules Move the facts the overlay PR appended into the sections that own them: the destinations intro, store ownership of the agent-list target, the projection widths, gesture pointer and edge rules, and the sidebar presentation bullets. Co-authored-by: Elsa Granger <zeyugao@outlook.com> * fix(app): keep the sidebar pans live across dock and overlay switches On an Android tablet, opening the dock with the header toggle and collapsing it again left the touch swipe unable to open the overlay until the app reloaded. Swipe-to-close from the sidebar also stopped working after the same toggle cycle. Both pans took the dock/overlay state through RNGH's `.enabled()`. On Android, RNGH 2.32 cancels the native handler when `isEnabled` changes and resets its config on every update. After a false -> true flip the handler stayed inert. `.enabled()` now carries only the device capability (touch screen present), which does not change at runtime. The dock/overlay state moves to a UI-thread derived value that fails the gesture in onTouchesDown, next to the existing non-touch pointer check. The wide sidebar's workspace list now always receives the close gesture ref, as the compact sidebar already does. Toggling it between undefined and the ref rewired the list's simultaneous handlers on every dock switch, and that also left the close pan dead after a toggle cycle. This is a native RNGH handler behavior, so there is no unit repro. It was verified on the Android fold emulator: toggle open, toggle closed, swipe opens the overlay, swipe on an empty sidebar strip closes it, no reload. Co-authored-by: Elsa Granger <zeyugao@outlook.com> * fix(app): keep the workspace full width after collapsing the dock On an Android tablet, opening the dock with the header toggle and collapsing it again could leave the workspace at the docked width, with a blank strip on the right, until the overlay was next opened. Elsa's original head showed the same. The sidebar's panel host flips between an in-flow dock and an absolute overlay. Its width came from a Reanimated style that read the React `overlay` flag, so the width reached the native view on the UI thread after React had already committed the new presentation. Layout logs on the fold emulator show the lag on every toggle-open: the workspace laid out at width 0 while the docked host still had the overlay's full window width, then a second pass laid out the 320dp dock. When the late update was lost on collapse, the workspace kept its dock width. The host no longer has a width of its own: - The dock sizes to the inner sidebar view, which already carries the animated resize width. - The overlay host is absoluteFill, which covers the whole row including the safe-area padding. With no animated layout prop on the host, a presentation switch is one React commit, and the host and the workspace lay out in the same pass. Device evidence on the fold emulator: - Toggle open and collapse cycles: the host and the workspace lay out together (320/521dp, then 841/841dp). - A swipe opens the 320dp overlay with a full-window backdrop, and a swipe on the sidebar closes it. - Dragging the dock edge still resizes the dock and the workspace together. There is no unit repro: the defect is the ordering of Reanimated's UI-thread layout updates against React commits. Co-authored-by: Elsa Granger <zeyugao@outlook.com> * fix(app): cancel pending sidebar swipes when docking An opening swipe still has the agent target until release. Leaving overlay presentation must advance its revision even then, so motion ownership and queued commits reject the obsolete swipe. Co-authored-by: Elsa Granger <zeyugao@outlook.com> * fix(app): keep mouse selection free of the touch-only pan's capture On a touch-capable browser the navigation pan registers pointer listeners over the whole workspace. Gesture Handler's web pointer manager captured the pressed element before the handler saw the pointer, and captured it again on every move, so a mouse drag that the pan rejects stayed captured and the browser's selection stopped at the starting paragraph. The patched manager now captures after pointer-down, and only a pointer the handler still tracks. The resize handle and touch swipes keep capturing. Co-authored-by: Elsa Granger <zeyugao@outlook.com> * fix(app): drop the compact Explorer target when the layout widens Opening the Explorer on a compact layout selects the `file-explorer` mobile panel target. Widening the window (unfolding a foldable, rotating a tablet) kept that target, because the store only heard the left sidebar presentation, which is `overlay` on both compact layouts and wide layouts with a collapsed dock. The navigation swipe begins only from `agent`, so on the wide layout every swipe was rejected until something else reset the target. App chrome now publishes the whole panel layout (compact or wide, plus the left sidebar presentation) and the store drops any target that layout does not present. Co-authored-by: Elsa Granger <zeyugao@outlook.com> * fix(app): keep wide overlay sidebar content inside the left safe area The overlay starts at the window's left edge, over the workspace's safe-area padding, so its content now takes the left inset itself. The dock already sits inside app chrome's padding and stays unchanged. Co-authored-by: Elsa Granger <zeyugao@outlook.com> * fix(app): return an interrupted swipe to its anchor when docking cancels it Docking mid-swipe bumps the panel revision while keeping the agent target. The command treated the unchanged target as motion already in progress and skipped the animation, leaving the dragged position stranded between anchors. A command that interrupts a drag now always animates to its target. Co-authored-by: Elsa Granger <zeyugao@outlook.com> * fix(app): synchronize startup panel selection and gate pending swipes A child layout effect can publish panel layout before the motion provider subscribes. Establish the current selection when subscribing, then observe later commands. Recheck presentation eligibility before gesture activation so docking also cancels touches that have not started dragging. Co-authored-by: Elsa Granger <zeyugao@outlook.com> * test(app): cover panel subscription through its public contract Verify initial snapshot delivery, later commands, and unsubscription directly in the existing panel-store suite instead of mounting test-only React components. Co-authored-by: Elsa Granger <zeyugao@outlook.com> * test(app): reopen compact navigation after leaving settings Destination navigation clears the transient overlay selection. Reopen the compact drawer before asserting its configured footer rather than relying on a stale open target surviving a wide layout. Co-authored-by: Elsa Granger <zeyugao@outlook.com> * test(app): open navigation by keyboard in composer focus checks Navigation pans intentionally reject mouse drags. Use the keyboard sidebar command to exercise focus and fullscreen Escape behavior without relying on the former mouse swipe helper. Co-authored-by: Elsa Granger <zeyugao@outlook.com> * fix(app): complete sidebar integration after main rebase Retain the resize width resolver and format the shared division-width and hybrid touch-sizing integration. Co-authored-by: Elsa Granger <zeyugao@outlook.com> * test(desktop): give split browser panes room for tab rails After #8740, narrow panes replace tab rails with compact dropdowns. The desktop browser journey counts and selects rail tabs, so widen the real Electron content window before splitting instead of treating missing narrow-pane rails as missing panes. Co-authored-by: Elsa Granger <zeyugao@outlook.com> --------- Co-authored-by: Elsa <zeyugao@outlook.com>	2026-11-04 13:30:39 +01:00
Mohamed Boudra	fcbfb4f0d3	Size controls for touch on iPad and other touch screens (#8748) ... * feat(app): size controls for touch on any touch device, not just compact layouts One gate picks touch or pointer sizing: touch when the layout is compact or the device has a touch screen. The touch fact is read once, so attaching a mouse or keyboard to a tablet never shrinks its controls. Stylesheets take `bySizing({ touch, pointer })`, which resolves to a breakpoint value, so the existing `{ xs, md }` consumers follow the gate without call-site changes. Touch values follow the iOS HIG 44pt hit region: controls, icon buttons, rows, bars and menu rows are 44 on touch; `sm` controls are 32. Glyphs move to a touch ladder (14/18/20/24). Pointer sizes are unchanged. Merges duplicated header control heights, density's private icon ladder and the compact-only icon button sizes into control-geometry. * feat(app): size the composer for touch through control geometry The composer toolbar, attach / dictation / realtime / send buttons, context meter and model triggers take TOOLBAR_CONTROL_SIZES (28 pointer, 44 touch) instead of private 28 constants. The density budget, button glyphs and the fullscreen glyph rail offset resolve the same gate, replacing the isWeb / isNative glyph branches. Track rows join the menu row height. Desktop geometry is unchanged. On touch the toolbar steps down density earlier: iPad portrait goes from condensed to tight. * feat(app): fold composer controls before the model label truncates The composer toolbar walks one width budget: full, condensed, tight, compact, then icon-only. Tight keeps the model at its family label; below that, thinking, mode and features fold into the model control's sheet (the phone toolbar), and only then does the model drop its label. A touch iPad in portrait with an attachment now reads "GPT-6-Astra Medium" instead of "GP…". The context meter glyph and combobox rows and icons take the density ladder. Desktop is pixel-identical in the content area. * refactor(app): keep the sizing gate free of the theme constants/layout sized its bars through control-geometry, which loads the theme and runs Platform.select at import. The gate (resolveControlSizing, bySizing, TOUCH_TARGET) moves to control-sizing.ts with no theme import; control-geometry re-exports it, so its callers are unchanged. * test(app): expect touch sizing in the compact Changes and plugin sidebar specs The compact Changes options button is a 44pt icon button with a 20pt glyph, and its framed actions trigger is 32 tall. In the compact sidebar the nav block is capped at half the height, so 44pt rows put the plugin header row below the cap; the spec scrolls it into view as a user would. * fix(app): close composer menus when the controls fold or unfold Folding swaps the toolbar controls for the model sheet. A menu opened on the separate controls stayed marked open across the fold, so widening the composer again reopened Thinking without a click.	2026-11-04 11:04:52 +01:00
Mohamed Boudra	a880c9619d	feat: background agents for hidden helpers (#8683) ... * feat(server): add background agents An agent can be created background in any workspace. It stays a durable, addressable agent, but default discovery, workspace status and attention leave it out. Effective background is agent.background || workspace.background. - Protocol: `create_agent_request.background` now marks the agent itself and stays the workspace intent for a workspace the request creates. Snapshots carry `background`. The daemon advertises `features.backgroundAgents`. Clients advertise the `background_agents` capability. - Daemon: the flag persists in the agent record, so restart and resume keep it. AgentDirectory owns visibility. Inclusive reads and subscriptions from sources without `background_agents` see only agents in background workspaces, because older apps would otherwise open a tab for each one. - Inheritance: omitted on agent-scoped creation, children and new workspaces take the caller agent's background. - MCP: create_agent accepts `background`. - SDK: placing a background agent in an existing workspace, or under a caller, fails fast with "Update the host to use background agents." on older hosts. - CLI: `ls -a` and `ls --background` add a BACKGROUND column. * feat(app): hide background agents from tabs, track and status * docs(plugins): point hidden helpers at background agents * fix: keep background agents hidden across cache reload and connected hosts * fix: keep remote creation working on older hosts and inherit foreign parents' background	2026-11-04 07:19:21 +07:00
4 people	1c4400194a	Support hardware keyboard shortcuts across native and desktop apps (#8625) ... * feat(keyboard): support hardware keyboards on iPad Register app shortcuts as iOS UIKeyCommands so a paired hardware keyboard drives the same bindings as web and desktop. Overlays (menus, comboboxes, modals, command center) get first refusal on bare keys, and a focused terminal keeps the keys it needs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(keyboard): record iOS hardware key observation spike With a UITextView focused on iPad Pro M4/iOS 18.6, window and controller observers received Cmd+B, Cmd+P and Escape. Escape also invoked UIKeyCommand when registered, so the stream must be the sole emitter. Use observation for shortcuts and commands only for text-control ownership. Simulator intercepted Cmd+K as HID184; input capture blocked synthetic typing entirely. Keep capture off and verify the toggle via a rebind during simulator QA. * refactor(keyboard): give overlays one key registration API Overlay ownership now follows one layer-ordered registry on every runtime. Web retains focus trapping and restoration through its adapter; native registers the same key handler without a DOM scope. Picker navigation and dismissal no longer require a parallel native stack. Co-authored-by: jeroenfrenken <16974549+jeroenfrenken@users.noreply.github.com> * feat(keyboard): route native hardware keys through the shared resolver Observe each physical press once, including native modal windows, and derive focus from declared composer and terminal surfaces. Native bindings and rebinds now use the same resolver and overlay precedence as browser and Electron input. Co-authored-by: jeroenfrenken <16974549+jeroenfrenken@users.noreply.github.com> * feat(keyboard): show shortcuts when hardware keyboards are present Keep routing independent of compact layout and detect hardware capability for hints and settings. Rebind capture uses the shared overlay interface on native too. Keep the filtered sidebar model available for keyboard navigation while its panel is hidden. Co-authored-by: Les Stroud <public@lesstroud.com> Co-authored-by: jeroenfrenken <16974549+jeroenfrenken@users.noreply.github.com> * test(keyboard): allow shortcut hints in compact menu assertions Compact menus now display hardware keyboard hints. Assert action labels, order and uniqueness without treating a trailing shortcut badge as part of the action label. * fix(keyboard): retain an overlay's opening layer in state Capture the registry's current top when an overlay opens and retain that layer through rerenders. React Compiler removed the previous useMemo cache after the registry getter moved across modules, allowing a parent modal to rise above its child and start an infinite focus loop. Compile this hook in Vitest as Expo does. The new hook regression failed first with layer 220 instead of 20, then passed with explicit opening state. Focused unit and browser tests pass, and the previously failing onboarding E2E completes through the real Expo compiler. Typecheck, lint and format pass. * refactor(keyboard): let overlays own native hardware input Remove the TextInput key handlers that duplicate declared overlay arrows and Escape in Add Project and Command Center. Remove Add Project's hidden responder now that native window sources observe keys without it. Keep soft-keyboard submit editing behavior. * fix(keyboard): close Add Project outside its state updater Root Escape previously called the parent close action from a React state updater, producing a cross-component render warning when navigation was still queued. Compute the previous page in the event handler and close outside the updater. The existing Escape/Back E2E now batches navigation and dismissal through the DOM key source. It failed first with the AddProjectFlowHost render warning, then passed after the correction. Typecheck, lint and format pass; native Escape checks pass on Android and iPad. * fix(keyboard): preserve Android dead-key composition * fix(keyboard): recognize focused native text inputs * test(keyboard): replace JSDOM coverage with browser tests * refactor(menu): spell out arrow navigation branches * fix(composer): claim fullscreen Escape on native * refactor(composer): one fullscreen Escape module for every platform The shared registration lived in fullscreen-exit.shared.ts with two one-line re-exports (fullscreen-exit.ts and fullscreen-exit.native.ts). Metro needs no native override now that the Android back button is its own adapter, so the implementation moves into fullscreen-exit.ts and the browser test imports the module every platform resolves. --------- Co-authored-by: Ubuntu <jeroenfrenken@icloud.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: jeroenfrenken <16974549+jeroenfrenken@users.noreply.github.com>	2026-11-03 18:08:27 +07:00
paseo-bot[bot]andhadan8977	e06adf7a3e	Show new files in collapsed folders after Refresh (#8582) ... * fix(app): show current contents of collapsed folders after Files refresh Refresh only re-listed expanded folders, and expanding a folder skips the request when a listing is cached, so a folder collapsed during Refresh kept showing its old contents. Drop the cached listings Refresh does not re-list. The refresh helper moves to file-explorer/tree.ts so it can be tested. * test(app): cover refreshing collapsed folders through the browser Exercise the reported file creation, refresh and reopen sequence through a real daemon, then check refresh while expanded. Co-authored-by: hadan8977 <zc-huang23@mails.tsinghua.edu.cn> * fix(app): ignore directory replies invalidated by Refresh A directory request started before Refresh could finish afterwards and restore a stale collapsed listing. Track the refresh generation in explorer state and accept completion only from the current generation. Keep directory loading and invalidation in the file-explorer model. * fix(app): preserve expansion when Refresh cancels restoration Keep an invalidated directory operation distinct from a failed listing. Propagate cancellation through saved-folder restoration so it preserves the current expansion state instead of committing an incomplete restored path set. --------- Co-authored-by: hadan8977 <zc-huang23@mails.tsinghua.edu.cn> Co-authored-by: paseo-bot[bot] <266920839+paseo-bot[bot]@users.noreply.github.com>	2026-11-02 21:59:28 +00:00
Mohamed Boudra	1008e9fffc	Insert suggested commands into the composer (#8371) ... * feat(composer): insert suggested commands into drafts * fix(composer): close suggestions after command insertion * fix(composer): place caret after inserted commands	2026-10-31 19:25:16 +07:00
paseo-bot[bot]andOuyang Xingyuan	0e5bcbd9f5	fix(app): open relative chat links inside nested repositories (#8361) ... * fix(app): open a nested-repo file when the workspace-root path is missing A workspace that contains another git repo often gets paths written relative to that nested repo. `schema/x.md` is really `repo-a/schema/x.md`. A markdown link was joined onto the workspace root and opened a missing file. Inline code already asked the daemon for a suffix match. Resolved workspace-relative paths that contain a slash now use that same lookup before opening. An exact hit stays on the original path. A suffix hit replaces it and keeps the line range. A failed lookup still opens the original path. Bare names, absolute paths, and `~/` paths are unchanged. Example: - Input: workspace `/repo`, link `schema/x.md`, file at `repo-a/schema/x.md` - Before: open `/repo/schema/x.md` (missing) - After: open `/repo/repo-a/schema/x.md` * fix(app): preserve explicit destinations when finding nested files Relative chat links can name a file inside a nested repository. Retain the suffix lookup while using the original href and document base to preserve absolute paths, preview links, and folder destinations. Co-authored-by: Ouyang Xingyuan <galaxyroaming@qq.com> * fix(app): keep network share links on their absolute destination Use the shared absolute-path classifier so network share hrefs retain their destination alongside drive and POSIX paths. * fix(app): keep nested-file lookup inside ordered path opening Resolve the original directory before considering suffix matches, and allocate click ordering before asynchronous lookup. The existing opener now owns the complete operation so a slow earlier click cannot replace a later selection. * test(app): load UI modules before test lifecycle hooks Cold module transformation exceeded the lifecycle hook deadline before these suites could run. Complete module initialization before registering the tests, retaining their assertions and timeout settings. --------- Co-authored-by: Ouyang Xingyuan <galaxyroaming@qq.com> Co-authored-by: paseo-bot[bot] <266920839+paseo-bot[bot]@users.noreply.github.com>	2026-10-31 11:05:06 +00:00
Mohamed Boudra	385c29b655	Keep failed chat history available for retry (#8278) ... * fix(app): keep failed chat history until retry Automatic retries repeatedly reopen provider sessions after persistent failures. Keep the error visible until the user retries, while retaining reconnect recovery. * fix(app): catch up chats after subscription failure A failed replacement subscription leaves chats unsubscribed, so discard its old catch-up state and fetch missed history after retry. * fix(app): recover gaps during history retry Keep gap recovery active while a user-initiated retry is running so the chat is not marked current before its follow-up fetch. * fix(app): show history errors in archived chats Cached archived chats need the same manual retry affordance when history synchronization fails.	2026-10-30 17:57:52 +07:00
PeanutandPeanut-HZM	1f79efcd62	fix(providers): name the MiniMax Code binary so npx can resolve it (#8201) ... The MiniMax Code catalog entry ran `npx -y @minimax-ai/code@0.6.13 acp`. npx derives the executable from the unscoped package name, which is `code`, but the package publishes `mcode` and `mcode-tools`. npm therefore exits with "could not determine executable to run" before the agent starts. Paseo reports this as a provider that timed out during `initialize`, so the entry looks like a broken agent rather than a malformed command. Name the package and the binary separately. The ACP handshake then completes and the provider reports its models and modes. Co-authored-by: Peanut-HZM <peanut@hzm.me>	2026-10-30 08:08:14 +00:00
Mohamed Boudra	b12eefb28f	Keep conversation turns distinct and history stable (#7990) ... * fix(app): keep autonomous turns distinct and readable Hidden system prompts merged autonomous work into the previous response and reopened completed turns. Preserve canonical turn boundaries and expose their triggers, while making received messages attributable and expanded turn details readable in one step. * fix(timeline): mount history at actual run boundaries * fix(timeline): load and retain complete available turns * fix(app): summarize actions and preserve conversation events * test(timeline): verify whole-turn paging stays responsive * fix(app): group reasoning according to thinking preference * test(app): align history journeys with whole-turn loading	2026-10-27 13:57:17 +07:00
Luke LaBonte	7f6a805e0e	feat(app): choose the composer send shortcut (#5503) ... Add a client-local Send shortcut selector with Enter and Command/Ctrl+Enter choices. Preserve Enter as the default and route the selected shortcut through the existing send behavior. Cover selection, persistence, editing, and running-agent send behavior with browser tests. Co-authored-by: Luke LaBonte <contact@lukelabonte.com>	2026-10-27 10:05:16 +07:00
Mohamed Boudra	428ef707ad	fix(app): demand the host directory from the workspace route (#7918) ... A workspace restored at launch with no open chat had nothing demanding its host's directory on a phone, so the deck waited on hydration that never started. The workspace route now keeps its host's directory demanded while mounted, through the same hook the agent route uses.	2026-10-26 15:46:10 +07:00
Mohamed BoudraandKino Roy	27d6b3b7ce	feat(desktop): remember project editors and support Xcode (#7898) ... Keep editor choices local to each project and shared across its worktrees. Reuse the Xcode target contribution while preserving explicit editor selection. Co-authored-by: Kino Roy <kinoroy@me.com>	2026-10-26 13:36:00 +07:00
5 people	4bbacfed46	feat(app): fold finished agent turns behind a summary line (#7785) ... Long agent turns bury the answer under intermediate messages, thoughts and tool calls. A new Chat display preference (Full / Collapse tool calls / Collapse turns) replaces the tool call detail level. Collapse turns folds everything a finished turn did before its final message into one summary line under the prompt; opening it shows those rows inline behind the same indent rail that expanded tool call groups now use. Expanded turns stay real timeline rows so virtualization, chat find and scroll-to-message keep working; find and outline jumps open the turn that holds their target. Opening or closing a turn stops following output so the summary stays under the pointer. Collapse turns is the default for new installs only. Existing settings were materialized on first launch, so stored blobs without the new field map from the legacy tool call detail level and otherwise stay on Full. Co-authored-by: Ready <127541578+akaready@users.noreply.github.com> Co-authored-by: Waishnav <86405648+Waishnav@users.noreply.github.com> Co-authored-by: Shreyan Dey <90114886+Dey11@users.noreply.github.com> Co-authored-by: Sebastian Parfitt <7753735+Sebeb@users.noreply.github.com>	2026-10-26 10:50:16 +07:00
3 people	a54cc6dd11	chore(acp): refresh pinned provider packages (#7781) ... * chore(acp): refresh pinned provider packages Co-authored-by: Kim <androidj@qq.com> Co-authored-by: Louis Deconinck <louis.dck@gmail.com> * test(app): capture the visible composer across retained tabs The settings regression sampler selected the first mounted composer even when it belonged to an inactive retained tab. Mount both tabs before capturing so the test consistently covers that case, and sample the visible composer. --------- Co-authored-by: Kim <androidj@qq.com> Co-authored-by: Louis Deconinck <louis.dck@gmail.com>	2026-10-24 12:36:10 +07:00
Mohamed Boudra	686588c44b	feat(app): restore manual workspace sorting (#7771) ... Keep manual workspace order separate from automatic sorting so surviving pre-beta arrangements and subsequent drags remain available across mode changes. Created stays the default; data already discarded by the beta cannot be reconstructed.	2026-10-24 09:06:05 +07:00
Mohamed Boudra	582beeb10b	fix(app): preserve compact sidebar context under sheets (#7693) ... Keep compact sidebars open while users inspect Search, Import session, Add project, or file sheets. Reveal the resolved destination when navigation commits, and place compact workspace sheets above both sidebars while preserving shared editing and cache state.	2026-10-23 15:57:12 +07:00
Mohamed Boudra	6405edd8dc	feat(app): show consistent agent and workspace status in search (#7690) ... Share tab agent presentation and effective workspace status with Command Center. Preserve unchanged result identities so live directory updates only rerender the changed row, with bounded retention and browser regression coverage.	2026-10-23 14:35:27 +07:00
Mohamed Boudra	55a7590952	Sort sidebar workspaces and keep active overflow visible (#7635) ... Order ordinary sidebar workspaces by Created or Last prompt, preserve project and pin ordering, and keep later active or unacknowledged work visible beyond the first seven rows. Preserve reveal state through live updates and verify sorting, visibility, compatibility, and rendering behavior.	2026-10-22 19:59:28 +07:00
Mohamed Boudra	6376f2bf40	Remove the WebView terminal renderer: xterm on web, native grid on mobile (#7639) ... * refactor(terminal): remove the WebView terminal renderer Native uses the native grid renderer only; web keeps xterm. The legacy renderer setting, its diagnostics toggle, the esbuild WebView bundle and its CI drift check are gone. * test(terminal): target the visible terminal surface in the file paste spec A second page opening a terminal in the same workspace adds a retained, hidden surface to the first page, so the unscoped locator matched two textareas and failed strict mode. * test(server): wait for the shortstat warm instead of polling 500ms The background warm shells out to git; on Windows CI that regularly outlasts the 20x25ms poll and fails the test. Use the completion callback the warm already exposes and keep the non-blocking check.	2026-10-22 19:47:28 +07:00
Gerard BalaoroandMohamed Boudra	9d908d678b	feat(terminal): support image paste into agent TUIs, local and remote (#3795) ... * feat(terminal): support image paste into agent TUIs, local and remote (#3725) Codex and OpenCode receive image pastes by binding Ctrl+V (\x16) and reading the OS clipboard of the machine they run on; no image bytes travel through the pty. Paseo's terminal swallowed that keystroke and only ever pasted text, so image paste silently did nothing. - web/Electron runtime: forward \x16 when the clipboard holds no text, keep the existing text-paste path otherwise (bash quoted-insert stays intact) - new terminal.clipboard.write_image RPC ships client clipboard bytes to the daemon, which writes them onto its host clipboard (osascript / wl-copy / xclip / Set-Clipboard) so remote clients work like local ones; gated by server_info.features.terminalClipboardImage with a bare-\x16 fallback for older daemons - clipboard tools are waited on via their exit event, not stream close: wl-copy and xclip fork a selection owner that inherits our pipes, so waiting for stream closure hung every Linux write until timeout - headless hosts without a clipboard get a temp-file fallback: the daemon materializes the image under os.tmpdir() and returns its path; the client injects it as bracket-pasted text - all four renderers covered (web DOM, Electron, native grid, WebView bridge); mobile Paste button enables for image clipboards and toasts failures in all 10 locales * fix(terminal): bind image paste to private retained files * fix(terminal): recover interrupted image metadata safely * fix(terminal): retire image files with background lifecycle maintenance * fix(terminal): check live paste modes and refresh native bridge * fix(terminal): order image paste input and isolate failures * fix(terminal): normalize paste and release failed creation reservations * fix(terminal): validate missing Windows launch paths before spawn * fix(terminal): keep input live during cancellable image uploads * test(terminal): follow streamed input-mode updates * feat(terminal): upload dropped images through the paste flow * feat(terminal): paste and drop images through file uploads Terminal image paste and drop now reuse the existing upload path (client.uploadFile -> file.upload.request -> FileUploadStore) and paste the quoted host path through the pane's input, bracketed when the app asked for it. This replaces the PR's daemon-side image store, RPCs, paste permits and file lifecycle, so the daemon, protocol and client diffs for this feature are empty. - terminal/image-paste owns a per-pane serial queue: gesture order, keystrokes stay live, Ctrl+C and pane/connection teardown cancel pending pastes, and a cancelled path is never pasted. - Clipboard text wins over an image; any image/* type is accepted up to the composer's 50MB upload limit. - Host paths are quoted for the host OS by path shape. - One failure toast; i18n keeps two keys. - Browser e2e covers two panes pasting distinct PNGs, drop, ordering, Ctrl+C cancel and disconnect against a real daemon. Co-authored-by: Gerard Balaoro <miogerard@yahoo.com> * fix(terminal): translate the disconnected image upload error * feat(terminal): report image uploads through toasts Show a lasting "Uploading image…" toast while an image uploads, replace it with "Image uploaded" or a failure toast that carries the reason, and dismiss it when Ctrl+C cancels the upload. Toast show now returns a dismiss scoped to that toast, so the pane can clear its own toast without removing a newer one. * build(terminal): regenerate the WebView HTML for the toast events * fix(terminal): keep i18n out of the terminal WebView bundle The image paste queue imported i18n for its size-limit message, which pulled every translation into the WebView HTML. The queue now reports a typed TerminalImageTooLargeError and the pane words it. * refactor(terminal): route dropped files by host locality and share the drop overlay A dropped file pastes its own path only when the host is the desktop app's own daemon (useIsLocalDaemon); anywhere else the host cannot read the client's disk, so the file uploads through client.uploadFile and the host path is pasted. File type no longer plays a part: images and other files take the same route, and clipboard images always upload because they have no path. The terminal pane now sits in the shared FileDropZone, so dragging files over it shows the agent panels' "Drop files here" overlay. The emulator's own drag listeners, blue tint and 180 ms timeout are gone. FileDropSink.onFiles is optional so a sink can take raw files without persisting raster images as attachments. terminal/image-paste becomes terminal/file-paste; the queue, callbacks, toasts and i18n keys say "file". * test(terminal): keep the fake desktop bridge in an e2e support helper The CI contract test forbids browser specs from installing paseoDesktop directly; the local-host drop scenario now imports it from support. --------- Co-authored-by: Mohamed Boudra <boudra.moha@gmail.com>	2026-10-22 17:40:01 +07:00
Mohamed Boudra	91dca5702b	Connect saved hosts and delegate agents across daemons (#7370) ... * feat(hosts): connect to saved hosts through a daemon * fix(hosts): validate safe targets and verify encrypted relay routes * test(hosts): include relay coverage in existing CI contracts * fix(cli): preserve validated addresses in daemon command hints * fix(hosts): share daemon links across isolated routed sessions Multiplex logical sessions over the monitored daemon connection and wrap original binary bytes in routing headers. Admit channels under their authenticated parent and current grants; preserve scoped delivery and physical send completion. * fix(hosts): bound encrypted overload and initial acquisition Check encrypted wire capacity before the async channel converts a resource limit into a physical connection error. Bound initial routed acquisition with the existing client timeout, then enable reconnect after admission. * fix(hosts): keep compact row actions clear of host labels Give compact connected-host rows separate text and action widths so long names and producer labels cannot compete with primary controls. * refactor(hosts): remove management settings UI from phase one Keep connected-host management in the CLI and shared SDK while preserving app saved connections and plugin access. * test(hosts): control physical write backpressure across platforms Hold real TCP writes until assertions finish instead of assuming a paused receiver exhausts every platform receive buffer. Preserve physical send settlement, byte identity, capacity and sibling checks. * refactor(hosts): use the ordinary client contract over channel transports Keep queuing, permission codes and reconnection independent of transport selection. Track submitted request outcomes generically while retaining connection error codes and structured causes. * test(e2e): keep transient developer toasts from stalling checks Concurrent locator handlers can wait for a dismiss button another handler removed. Dismiss existing toast DOM at document lifetime, including its open shadow root, without intercepting app actions. * Create, prompt, and monitor agents across connected hosts (#7507) * feat(hosts): delegate agents across connected hosts Resolve MCP host operations through in-process commands for self and the existing routed client transport for other destinations. Keep ordinary parent labels, app sessions and idle finish notifications. * test(app): normalize subagent fixtures through snapshots * docs(protocol): clarify same-host parent labels * fix(hosts): resolve subagents through destination sessions A child address identifies its destination regardless of the connection used. Reuse the existing host candidate selection for discovered routes and direct connections, and keep navigation and row actions independent of the parent transport. * fix(hosts): keep routed destinations distinct during discovery A routed candidate names only the origin daemon. Match it within the named destination profile so two destinations discovered through the same origin retain separate identities and connections, including existing saved routes. * feat(hosts): prompt and query agents on selected hosts Extend the existing MCP host operation boundary with prompt, status, activity and list operations. Local calls retain their handlers and notification owner; selected destinations use ordinary client RPCs and the existing idle finish wait. * test(e2e): preserve toast coverage with CSS hiding * docs(hosts): translate connected host references	2026-10-21 16:10:47 +07:00
Mohamed Boudra	e464fd3bd3	feat(plugins): file panels (#7411) ... * fix(files): report document MIME types for binary files File reads now carry the document's MIME type for binary files, so a file panel can hand the bytes to a viewer that needs the real type (application/pdf). * feat(plugins): file panels Plugins contribute file panels with addFilePanel. A file tab hosts the panels that claim the file: the built-in Markdown, HTML and image panels, plugin panels, and Source, Paseo's editor, which claims every text file and is always the last candidate. The panel is the tab body; the bar shows the document's status and a switcher between the file's panels (side by side up to three, two on a phone, a menu beyond that). Paseo asks which panel opens a file only when a plugin panel is among several candidates, once per open, and remembers the answer per extension or exact filename when told to. Open with in the tab menu and the switcher change the tab's panel; Always use remembers it. Opening a file at a line switches the tab to Source. Panels read and write the host's document, so dirty state, autosave and conflicts stay Paseo's. DocumentFrame shows bytes documents such as PDFs in the browser's viewer. Replaces the file tab's Preview/Source mode toggle. * feat(file-panels): choose and forget file panels in Settings > Files Settings > Files lists each extension or filename where a plugin panel competes with another candidate, or that has a remembered panel. Each row chooses the panel that opens it, or Ask every time; Ask again forgets the choice. Source appears as a candidate for text files. Panels no connected host offers can be forgotten but not chosen. * docs(plugins): file panel examples and author reference Adds the pdf-panel and markdown-panel examples, the File panels section of the plugin reference, and an e2e spec that installs both examples, opens a PDF in the browser viewer, and edits Markdown through Paseo's document across the switcher, Source, autosave and conflicts. * feat(file-panels): panels read and write through a file handle The file tab stats the file and mounts its panel without reading it. Every panel, built-in or plugin, gets a PluginFile handle: readText, readBytes, url, version-checked writeText/writeBytes (PluginFileConflictError unless force), and watch. useFileText, useFileBytes and useFileUrl read through it, and Loading joins @getpaseo/plugin/client/ui. Panels own their loading state. The host document pipeline, the explorer preview cache and the preview lifecycle are deleted. The daemon classifies a file version from a bounded sniff and writes base64 content as bytes behind fileByteWrites. A deleted file keeps its panel mounted; a read confirms the deletion first, so a remove-and-rewrite is not reported as one. Native Source decodes with builtins and highlights in idle-time slices, the lines around the opening line first, so a large file no longer blocks the JS thread. * fix(file-panels): Settings offers Source where the picker does, and review follow-ups - Settings > Files offers Source on every key except those a built-in panel of another kind (Image) claims, so a plugin that alone claims a text extension shows the same choices as the picker. - Delete the unused isSourceFilePanel. - The Markdown example warns with the file name when its unmount write fails, rather than dropping the edit silently. - Document that PluginFile stat fields are read at render time and that watch or the read hooks are how a panel learns they changed. * fix(plugins): file events are objects, deletion is a typed error, DocumentFrame owns its fallback - watch listeners receive { type: "changed" } | { type: "deleted" }, so later versions can add fields without breaking them. - PluginFileDeletedError joins PluginFileConflictError. The read hooks report a deleted file with it, and a write over a deleted file rejects with it; Source shows that as the deleted notice. PluginFileConflictError now means only "changed on disk". - DocumentFrame on Android shows Paseo's "<TYPE> files can't be shown on this device" message for documents its WebView cannot display, so the PDF example is useFileUrl + Loading + DocumentFrame with no platform branch. * test(file-panels): Settings offers Source for a remembered panel no host has * test(e2e): hide the developer error toast instead of clicking it away The locator handler that dismissed #error-toast could match a toast that closed before its click, then wait on it until the test timed out (agent-timeline-resume.spec.ts:45 failed every attempt on this branch). Hiding the toast with CSS keeps it off app actions with no race. * test(e2e): desktop browser-tabs hides developer toasts on its attached page	2026-10-21 10:49:04 +07:00
Mohamed Boudra	1e0e56c721	refactor(app): unify built-in file panel selection (#7366) ... * refactor(app): unify built-in file panel selection * refactor(app): resolve file panels once per pane	2026-10-19 15:35:41 +07:00
3 people	7c7b6555f1	Show provider artwork in the catalog and provider rows (#7330) ... * Add missing monochrome provider icons (kiro, devin, hermes, minimax-code, traecli, grok, deepseek-tui) * fix(app): add Kiro catalog icon and Antigravity builtin icon The ACP catalog's kiro entry had iconId null and no vendored svg, and the native Antigravity provider resolved to the Bot fallback before the daemon snapshot arrived. Vendor the Kiro brand mark, wire iconId, and register a builtin AntigravityIcon matching the plugin's theme-aware icon.svg. * fix(app): keep Kiro eyes in monochrome icon * test(providers): cover catalog artwork and snapshot-free icons Lock down the missing provider marks through the catalog and the shared icon hook. Exercise the rendered catalog artwork in Chromium alongside coverage for the pre-snapshot fallback. Co-authored-by: kevenhu001-cyber <keven.hu001@gmail.com> Co-authored-by: Lu <jack1125516912@outlook.com> * fix(website): preserve unrelated agent directory artwork Drop the unrelated website mark introduced with the provider artwork. Cover the existing directory fallback and retained provider mark in a browser regression. --------- Co-authored-by: kevenhu001-cyber <keven.hu001@gmail.com> Co-authored-by: paseo-bot[bot] <266920839+paseo-bot[bot]@users.noreply.github.com> Co-authored-by: Lu <jack1125516912@outlook.com>	2026-10-18 20:00:36 +02:00
paseo-bot[bot]andIvan Malison	60fa12c4de	Report disconnected hosts in new agent drafts (#7303) ... * fix(app): report offline hosts in new agent drafts A disconnected client still exists, and pending form resolution and retained loading catalogs outlive the connection. Use host connection state for draft readiness and model loading while keeping known models available for reconnect. Co-authored-by: Ivan Malison <IvanMalison@gmail.com> * test(app): confirm draft recovery on a fresh host connection --------- Co-authored-by: paseo-bot[bot] <266920839+paseo-bot[bot]@users.noreply.github.com> Co-authored-by: Ivan Malison <IvanMalison@gmail.com>	2026-10-18 11:57:41 +02:00
paseo-bot[bot]andMoy	fa70b215a8	Open chat folder links in Files with their contents visible (#7205) ... * fix(app): open folders from inline path links in the file explorer Clicking a folder path in an assistant message opened a file tab that failed with "Requested path is not a file". Extension-less workspace-relative paths without a line number are now probed with a directory listing before opening: directories open the Files explorer navigated to that folder, everything else opens as a file like before. Lexical directories (trailing slash, workspace root) now navigate the explorer to the folder instead of only preloading its listing. * fix(app): reveal linked folders and their contents Resolve workspace folder links from directory metadata and expand their ancestor paths in Files. Preserve file and line-reference opening, including extensionless files. Co-authored-by: Moy <moyfoxther@gmail.com> * fix(app): cancel stale path opens and reveal hidden folders Keep pending directory checks inside the path-opening model so a later click or navigation supersedes them. Explicitly revealing a hidden directory also enables the existing hidden-file visibility preference. --------- Co-authored-by: Moy <moyfoxther@gmail.com> Co-authored-by: paseo-bot[bot] <266920839+paseo-bot[bot]@users.noreply.github.com>	2026-10-17 09:53:28 +02:00
Mohamed Boudra	6e1ec21c6a	Keep Android dictation running through audio interruptions (#7200) ... * fix(android): preserve dictation across audio interruptions Playback focus loss does not mean microphone capture is unavailable. Keep dictation alive across media takeovers and wait for Android input silencing to clear, while preserving conversation interruption protection. * test(android): verify dictation clears its selected audio route	2026-10-17 12:53:06 +07:00
Mohamed Boudra	0d7a234e63	perf(app): preserve unchanged sidebar workspace projections (#7157) ... Reopening a retained sidebar rebuilt its entry collection and invalidated every project row despite unchanged workspace data. Preserve collection identity as well as row identity, while keeping membership and ordering changes observable.	2026-10-16 21:10:42 +07:00
Mohamed Boudra	eb1a8a2ec7	fix(markdown): one renderer on react-native-enriched-markdown for iOS, Android and web (#6973) ... * fix(app): group native assistant prose into selectable runs * fix(app): render selectable native prose with enriched markdown * docs: explain native prose selection boundaries and tradeoffs * fix(app): preserve markdown semantics and render limits in prose runs * docs: record native prose compatibility fixes and heading limits * fix(app): allow additive task lists and admonitions in native prose * fix(app): preserve inline image formatting and reference scope * fix(app): preserve markdown source and file actions in native prose Prepare original source blocks with source-position edits from the assistant parser. Keep reference scope and live/history projection consistent, and retain link text when dispatching workspace file actions. * fix(app): preserve native prose entities and links while bounding preparation cost * fix(app): preserve provisional syntax at cached reveal boundaries * fix(app): bound prose append work and preserve markdown edge cases * fix(app): preserve home paths and normalized prose links * fix(app): preserve parser-owned links and streaming tilde tails * fix(app): keep growing markdown on the streaming block renderer * fix(app): preserve bracketed IPv6 links in native prose * fix(app): skip prose classification for blocks over the render cap * fix(app): share selectable native prose across Markdown surfaces * fix(app): preserve Markdown containers before grouping prose * revert(app): remove shared prose-run renderer changes Reverts ab4737bb2 and ac47e1063 before replacing the Markdown engine across all platforms. * feat(markdown): use enriched renderer across all platforms * test: verify library image controls and isolate website config * fix(markdown): preserve file links and image revisions * fix(markdown): restore diagrams and preserve link origin * fix(markdown): retain diagram identity and reference scope * fix(markdown): avoid empty web history measurements * fix(markdown): preserve authored empty link titles * test(markdown): exercise find across whole-message history * fix(markdown): preserve encoded image paths after rebase Keep the shared renderer image normalization and file-read regression coverage that originally lived in the main integration merge. * fix(markdown): derive table and task list colours from the theme * fix(markdown): restore selection highlight on web * fix(markdown): restore file link hover tooltips on web * fix(markdown): normalize inline HTML before rendering * fix(markdown): create renderer types when applying package patch The published nightly omits both MarkdownRenderers type files. Represent them as new files so patch-package succeeds on a fresh npm install, matching the already patched development package. * fix(markdown): keep the renderer tree stable while images resolve * fix(markdown): size inline images to the line and collapse failed loads * fix(markdown): normalize only parsed HTML nodes * fix(markdown): keep the first image reference definition * fix(markdown): preserve complete assistant messages on native * fix(markdown): classify web links explicitly and complete renderer types * fix(markdown): preserve spacing between HTML elements * fix(markdown): normalize HTML following code elements * fix(markdown): preserve literal image fallback labels * fix(markdown): retry transient image decode failures * docs(markdown): record native selection and image limitations * fix(markdown): preserve first definitions across Mermaid segments * fix(markdown): reserve pending images and harden web rendering * test(markdown): cover state retention during image arrival * fix(markdown): preserve reader position while responses grow Keep the same message component boundary when a live row becomes retained history, preserving Mermaid runtimes and selection nodes. Observe paced child text commits at the web viewport so sticky-bottom follows before the next frame. * test(markdown): require growth while holding a streaming paragraph * test(markdown): isolate image arrival from reload positioning Mounted row totals change as history virtualizes, so observe the new response and tool directly. Hold the real PNG response after reload until the reading position settles, then verify its reserved height and viewport instead of attributing initial bottom-follow positioning to image decoding. * fix(markdown): preserve adjacency around inline HTML * fix(markdown): keep summary block boundaries outside bold text * perf(markdown): scan HTML block boundaries incrementally * test(markdown): gate delivery while establishing a held reader * test(markdown): name shared renderer setup and file actions * test(markdown): assert linear HTML boundary work without timing * test(markdown): check large HTML table output without observing built-ins * fix(markdown): restore accentBright link colour * fix(markdown): require letters and known extensions in bare path recognition * fix(markdown): match main's blockquote, bullet and h6 colours * fix(android): keep inverted chat still during text selection React Native decomposes Android list inversion into a 180-degree rotation with positive scaleY, so the existing visibility-scroll guard never recognized the inverted viewport. Inspect the composed matrix and reproduce the actual list transform through the native view manager in regression tests. * fix(markdown): linked inline code keeps inline code size * fix(markdown): reserve a placeholder box with an image glyph while images load * fix(markdown): bare prose paths need an extension, line suffix or depth Slash-separated English pairs were recognized as file links in prose. Require stronger path intent there while preserving the existing inline-code recognition rule. * fix(markdown): horizontal blocks own their drags on compact layouts * perf(markdown): keep native streaming updates in the unfinished tail Native markdown reparses each updated view in full. Keep parser-closed blocks in a memoized head during paced reveal, then reunite completed prose for cross-paragraph selection. Preserve trailing spacing and source indentation at the split. * perf(markdown): reuse Android measurements across view mounts * test(markdown): bare Fabel/model and daemon/client stay plain text when copied a502cfd0d stopped linking bare two-segment prose paths; the clipboard expectation still carried the links from the earlier loose pattern and failed on CI (playwright shard 1/4 on 60b4e2d05). main expects the plain text, so restore that. * perf(app): limit native chat mount batches Whole-message Markdown rows measure synchronously during Fabric layout. Render fewer history rows per batch and retain a smaller offscreen window so opening a chat does not measure twelve history rows at once. * fix(app): keep populated markdown in sync with native layout Fabric can collapse streaming blocks before asynchronous rendering replaces the old text, producing a blank frame. Commit populated-view updates synchronously while retaining worker preparation for first mounts to avoid moving large history parsing onto the UI thread. * perf(app): preserve unchanged sidebar workspace projections Reopening a retained sidebar rebuilt its entry collection and invalidated every project row despite unchanged workspace data. Preserve collection identity as well as row identity, while keeping membership and ordering changes observable. * Revert "perf(app): preserve unchanged sidebar workspace projections" This reverts commit a3919faed4.	2026-10-16 21:03:37 +07:00
4 people	5acfbb3777	Let Escape close plugin previews before stopping agents (#7110) ... * fix(app): let Escape close an open popover before it interrupts the agent The agent.interrupt shortcut listens on the window in the capture phase, so it sees Escape before anything else. Registered overlays get first refusal through dispatchTopWebOverlayKeyDown, but plugins cannot register, and draw their floating panels with the Popover API instead. With such a panel open and the composer focused while an agent runs, Escape closed the panel and interrupted the agent in the same press. While a popover is open, Escape is left to it and no app shortcut runs. A second Escape, with nothing open, interrupts as before. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: RoundRedDot <roundreddot@gmail.com> * test(app): cover Escape with a popover open through the shortcut path The first test only checked hasOpenDomPopover and would still pass with the guard removed from useKeyboardShortcuts. The check is now keyBelongsToDomPopover, called by the hook, and a browser test drives it the way the app does: a window capture listener for shortcuts, a popover closed by its own document Escape listener, focus in a textarea. The first Escape closes the popover with no interrupt; the second interrupts. Both new tests fail with the guard removed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: RoundRedDot <roundreddot@gmail.com> * test(app): exercise plugin Escape through the real composer Keep the contributor fix and replace the substitute shortcut-listener test with an installed-plugin browser regression. The first Escape must close the preview without cancelling the turn; the second must cancel it. Co-authored-by: luke <luopeihuan@gmail.com> Co-authored-by: RoundRedDot <roundreddot@gmail.com> * test(app): check dismissed model pickers leave the viewport --------- Co-authored-by: luke <luopeihuan@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: RoundRedDot <roundreddot@gmail.com> Co-authored-by: paseo-bot[bot] <266920839+paseo-bot[bot]@users.noreply.github.com>	2026-10-16 09:14:10 +02:00
Mohamed Boudra	2d86b94b2f	Refine provider catalog buttons and show Add errors as toasts (#7030) ... * fix(app): refine provider catalog actions and error feedback Use compact row tiles and the shared error toast so failed Add actions remain visible while browsing the catalog. Point Hoplite installation instructions at the CLI install section. * test(app): supply toast context in provider settings tests Import the toast API independently of its renderer so the provider section only depends on the context it consumes.	2026-10-15 22:45:12 +07:00
Mohamed BoudraandOdin Glynn-Martin	16bb179e67	feat(providers): add opt-in Hoplite and searchable provider grid (#6953) ... Preserve the bundled Hoplite ACP adapter and provisioning transformer, activate it only after Add, and provide a searchable provider grid. Restore the contributor's original icon without the copyright mark. Co-authored-by: Odin Glynn-Martin <odin.glynn@icloud.com>	2026-10-15 21:25:23 +07:00
paseo-bot[bot]	e1a5664d9b	fix(app): keep malformed font settings from breaking the UI (#6695) ... Unfinished CSS strings in font preferences consumed the shared theme stylesheet. Reject incomplete syntax at the settings boundary, recover persisted malformed values through the existing default path, and restore rejected edits in the font field. Co-authored-by: paseo-bot[bot] <266920839+paseo-bot[bot]@users.noreply.github.com>	2026-10-14 19:17:06 +02:00
4 people	56448842f0	Download files over the connected host (#6595) ... * Let readFile callers disable the request timeout readFile resolves only when FileEnd arrives, so the default 60 s request timeout bounds the whole transfer. A large file over a slow relay fails before it finishes even though every chunk is arriving. Thread an optional timeout through requestFileExplorer; 0 disables the timer, as the workspace.create request already does, and a dead connection still rejects on disconnect. The relay e2e case reads a 1 MiB file through a real daemon and a local relay with timeout 0 and compares SHA-256 digests with the source. * Reject a binary file transfer whose byte count differs from FileBegin.size concatByteChunks allocated FileBegin.size bytes and copied the chunks in: a short transfer resolved as a zero-padded file, and a long one threw a RangeError inside the transport callback and left the request pending. Count the received bytes at FileEnd and reject the read when they differ from the announced size. * Download files over the session socket when no direct connection is active The download store only knew the HTTP token route and picked the first directTcp connection in the host profile, whatever connection the host runtime was using. A relay-only host has none, so every download ended in "Download host is unavailable." (#543). SSH, socket and pipe hosts failed the same way, and a stale directTcp entry won over a working relay (#3753). Choose the transport from the active connection: directTcp keeps the HTTP token download unchanged; anything else reads the file over the session socket with the binary frames previews already use, then hands the bytes to the browser's download manager on web and Electron or writes them to the cache directory and offers the share sheet on native. Files over 64 MiB are refused before any byte moves, using the existing fileTooLarge string, and a daemon response without content fails instead of saving an empty file. * fix(app): enforce the session download size limit during the read The token size is sampled before the file is read. Pass the download byte budget through the actual read so a changed file cannot bypass the in-memory limit. Co-authored-by: Michael Vandesompel <mv@droggol.be> Co-authored-by: YASICJUNWOO <joonoo3@naver.com> Co-authored-by: JrDw0 <JrDw0@users.noreply.github.com> * test: verify TCP downloads and own relay fixture cleanup --------- Co-authored-by: Michael Vandesompel <mv@droggol.be> Co-authored-by: paseo-bot[bot] <266920839+paseo-bot[bot]@users.noreply.github.com> Co-authored-by: YASICJUNWOO <joonoo3@naver.com> Co-authored-by: JrDw0 <JrDw0@users.noreply.github.com>	2026-10-14 17:25:31 +02:00
4 people	0009a7e717	feat(workspaces): add background visibility (#5039) ... * feat(server): let clients create internal agents The daemon's own branch-name and commit-message generators run as internal agents: never persisted, listed, flagged, announced, or seen by plugin lifecycle hooks. Nothing outside the daemon could ask for one, because the wire config schema strips `internal` and the agent.create transform re-pins it. A plugin that runs a one-turn helper per event therefore left an archived session in History every time. Add an optional `internal` flag to `create_agent_request` (inherited by `agent.create.request`), copy it onto the config in the session's create path, and skip provider session persistence for it like the generators do. The client SDK forwards the flag on both creation paths and gates it once on `server_info.features.internalAgents`. Two daemon paths assumed every agent is public and had to follow: `resolveAgentIdentifier` now accepts a live agent by exact id, since the id set it matched against came from listings that exclude internal agents and left `wait_for_finish` answering "Agent not found"; and archiving an internal agent now closes it without writing the record that `registry.applySnapshot` used to leave behind, so `autoArchive` does not accumulate hidden files on disk. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(server): keep internal agents whole through failure, archive, and wait Review follow-ups for internal agents: - A create that fails after the runtime is registered now closes the internal agent before rethrowing, so a hidden runtime cannot outlive the failed request. Public agents keep today's behaviour. - Archiving an internal agent cascades to attached children like any parent. cascadeArchiveChildren takes the parent record instead of reading it back from storage, where an internal agent never is. - The archived snapshot and last message of an internal agent stay readable by exact id for ten minutes, so create-then-waitForFinish returns the finished turn whether the wait lands before or after an auto-archive. Storage plays that role for public agents. - The internal-agent e2e scenarios live in the existing create_agent_request lifecycle suite rather than a new file. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(server): cascade to live internal children and keep a failed internal create's worktree until it closes Internal children never reach storage, so the parent archive cascade scans live agents for them as well. A failed internal create now clears the created id only after the runtime is archived, so worktree cleanup cannot delete the directory under a runtime that would not close. Stored agent payloads carry lastError, so a retained failed helper reports its error through wait_for_finish instead of the generic message. * feat(cli,mcp): expose internal agents and document --no-wait paseo run gains --internal and create_agent gains internal, both forwarded to the create request. --no-wait becomes the documented spelling for returning immediately, matching paseo send; --background and --detach stay as hidden aliases under COMPAT tags. * test: follow the --no-wait rename and stub getRetiredInternalAgent * feat: list internal agents on request and add internal workspaces Internal agents stay hidden by default, but a caller can now ask for them: `fetch_agents_request` takes `filter.includeInternal`, snapshots carry `internal: true`, and `paseo ls --internal` shows them in an INTERNAL column. The app never passes the flag. Workspaces get the same flag. `workspace.create.request` with `internal: true` persists a hidden workspace: listings, update subscriptions, sync reads, empty-project counting, open-by-path, MCP `list_workspaces`, and plugin workspace hooks all skip it unless the caller opts in with `filter.includeInternal`. Every agent created inside an internal workspace is internal and unpersisted; AgentManager applies that from the workspace id before the plugin hook so creators cannot opt out. Archive and shutdown enumerate internal agents so nothing inside an internal workspace outlives it. Surfaces: `paseo workspace create --internal`, `paseo workspace ls --internal`, `paseo run --internal --new-workspace`, MCP `create_workspace({ internal })`, SDK `workspaces.create({ internal })` and `list({ filter: { includeInternal } })`. Clients gate on `features.internalWorkspaces`. Co-Authored-By: Claude <noreply@anthropic.com> * feat(workspaces): add background visibility with inherited creation defaults * fix(cli): resolve workspace callers on the selected daemon * test(workspaces): keep caller integration coverage in server suite * test(cli): exercise workspace callers through CLI integration harness * test(mcp): remove obsolete execution flags from browser fixtures --------- Co-authored-by: marvin-ambrozio <marvin@gustavo.eng.br> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> Co-authored-by: Mohamed Boudra <boudra.moha@gmail.com>	2026-10-09 09:31:50 +01:00
paseo-bot[bot]	81a5e5bc61	Show the PR checks summary, sidebar status, and "Worked for" line in the app language (#6196) ... * fix(app): translate the PR checks summary, sidebar status labels, and "Worked for" line These were written in the components, so they stayed English in every other language. They now come from the translation files, with copy for all nine supported languages. Closes #6190 * fix(app): rebuild translated labels when the app language changes The checks summary, sidebar status groups, and turn footer now take the translation function, so their memoized labels rebuild on a language switch. Russian one-check group labels use singular wording. * test(app): compare compact footer targets at sub-pixel precision The browser reports the 44pt footer buttons as 43.99999 wide on some runs, which fails the finger-size check on main as well. --------- Co-authored-by: paseo-bot[bot] <266920839+paseo-bot[bot]@users.noreply.github.com>	2026-10-06 09:19:52 +02:00
Mohamed Boudra	fa0f04058d	Keep account usage accessible before the first turn and restore compact sheets ... * fix(usage): keep details hoverable and restore compact sidebar sheets Share hover-card mechanics with workspace details so context usage can stay open while users press Refresh. Honor Retry-After for rate-limited usage requests, and let both sidebar entry points share the compact sheet. * fix(usage): restore settings cog with a fitted popover and compact sheet Keep shared Usage preferences in the title controls on every surface. Settings rows use the menu surface directly, avoiding the trailing margin and duplicate card border from the page layout. * fix(app): show account usage before the first agent turn Keep the context meter available for existing agents without context readings so account usage can be opened before a turn. Show an empty ring and an explicit no-data state until readings arrive. * fix(usage): preserve keyboard access and hover card positioning Context details must remain reachable by keyboard after replacing the tooltip. Keep focus within the card, restore side flipping, and dismiss detached cards when the viewport moves. Prune expired cooldowns even after credential rotation. * chore: remove QA screenshots from the source tree * fix(app): let hover cards claim Escape before agent shortcuts Register hover surfaces with the shared overlay keyboard owner without moving or trapping focus on pointer hover. Component-local Escape handling ran after the global interrupt shortcut and cancelled the underlying turn. * fix(app): reopen focused hover cards with button keys Keep focused triggers registered with overlay arbitration after dismissal so activation keys are handled before composer shortcuts. * fix(app): release overlay ownership when hover cards close Closed triggers handle activation locally, so a dismissed card does not block pane Find. Open cards retain shared Escape arbitration to protect running turns. * test(app): pin Linux keyboard identity for composer Find * test(app): synchronize context usage hover journeys Return focus to the composer before asserting pointer dismissal, wait for the card to reach the viewport, and park the pointer before reloading so it cannot consume the next scripted usage response early.	2026-10-05 01:59:15 +01:00
Mohamed Boudra	154a088d6e	feat(app): default sidebar workspace slots to last activity (#6087)	2026-10-04 23:04:17 +01:00
Mohamed Boudra	42806cdbf9	Let plugins play audio on every client (#5976) ... * feat(plugins): play audio files on every client * fix(audio): preserve voice output and isolate waiting cues * fix(plugins): normalize audio MIME parameters * refactor(audio): share PCM conversion and keep plugin playback file-only	2026-10-03 16:56:59 +01:00
Mohamed Boudra	73d25317a4	fix(usage): derive window names and unify pin selection (#5903) ... * fix(usage): derive window names and unify pin selection Quota slots do not identify a period. Derive numeric windows and IDs from reported duration and quota scope; keep unknown lengths neutral. Resolve source defaults and explicit pins through one model, with a persisted empty selection distinct from defaults. * fix(plugins): declare the duration helper host requirement * fix(usage): verify persisted selections at the storage boundary	2026-10-02 11:18:13 +01:00