136 Commits

Include renames

Author	SHA1	Message	Date
Mohamed Boudra	28c188513e	feat: plugin API for agent options, metadata, composer and New workspace (#8744) ... * feat(protocol): option controls, options patch, and provider.controls.list Add AgentOptionControl descriptors, snapshot options/controls, an options patch on agent.config.apply, provider.controls.list RPC, and server_info.features.providerOptionControls. featureValues stays accepted on the wire (COMPAT). * feat(server): fold featureValues into providerOptions and describe composer controls Providers emit option controls over top-level providerOptions keys; the daemon stores one options record per agent, merges config.json defaults as effective values, and applies patches live via AgentSession.applyOptions. Legacy featureValues (wire, stored records, profiles, schedules, hooks, MCP) fold into providerOptions; snapshots still carry features built from controls. Snapshot options expose only keys that have a control. * fix(server): address Phase 1 audit findings on option controls - Removing auto_accept (OpenCode, ACP) turns live approval off; ACP selects return to their session default. - agent.create.before hook featureValues edits override options the create already set. - Claude commits fast_mode only after the runtime accepts it. - Codex snapshots show a saved Fast preference as the tier the model resolves it to (AgentSession.displayOptions). - Profiles are folded into options in the daemon config store; the config API still answers with featureValues. - Snapshot options and provider.controls.list carry all effective options. - Test: Claude fast_mode survives a restart through stored providerOptions. * fix(server): keep snapshot options as configured, restore OMP baseline, cover options through public interfaces - Codex: drop displayOptions; a select choice may carry aliases so a saved Fast preference selects the model's Fast tier from options + controls alone. - OMP: removing fast_mode restores the runtime's starting setting. - ACP/Cursor removal tests run through real session initialization. - agent.config.apply of a non-control option reaches the provider and shows in the next snapshot (daemon e2e). - Daemon config store persists legacy-featureValues profiles as options on the next profile save. * fix(server): read a pre-v0.10 Codex fast_mode record as service_tier "fast" and store it that way A record holding `fast_mode: true` without `service_tier` ran Fast but the speed control showed Normal, and picking Normal then wrote "default". The Codex session now normalizes the old boolean at construction and reports the new shape through its existing options_changed event. * fix(server): show Fast for a stored Codex fast_mode: true without rewriting the record Reverts the storage migration from a987b4a43. The Codex speed control now takes its default from the session's current options with the same rule the runtime uses (an explicit service_tier wins; fast_mode: true applies only while service_tier is absent). This holds on create, resume, live apply and for config.json defaults, and stored options stay as set. * chore(website): regenerate the config schema for profile options * refactor(server): providers report option differences once, after create, resume and apply Providers used to write their own reports into the agent's options while a session was being created, resumed or updated, which needed a growing set of reconciliation, baseline and suppression rules to stay in step with the daemon. The contract is now transactional. A provider opens or updates with the options it is given and emits nothing while doing so; if the result differs it says so once, afterwards, as `options_changed`. Live apply hands the provider only the keys the patch sets and the daemon stores them onto the agent's current options when the provider accepts, so the last write wins. A change the provider makes on its own is stored and forwarded, not undone. Removing an option drops the key and sends nothing live. Controls carry no state; `options` is the only option state. A legacy `agent.create.before` hook's `featureValues` edits are applied as a patch over the returned options, so its deletions and replacements hold. The unreleased `aliases` field on option choices is gone; a pre-v0.10 Codex Fast preference is reported once as the model's tier id. * refactor(server): providers return what apply and open ended with instead of reporting it afterwards applyOptions returns the options the session ended up with and the session exposes its open difference as openOptionsPatch, so the manager stores the patch and the provider's answer in one step. Removal is an ordinary patch: the provider receives the default the key falls back to, or null, and returns what it kept. Controls no longer take a default from a stored legacy feature value. * fix(server): apply an old app's profile featureValues over the profile's stored options The unchanged app's profile form only knows the controls, so a name-only edit dropped options it never shows, such as sandbox_mode. Its featureValues now apply as a patch over the options already stored for the profile (null removes a key), and a write with no featureValues keeps them. * fix(server): ACP reports the selects it moved during open or apply as that call's result A config_option_update that arrived before the write response was emitted as an event on top of the result the manager stores. Notifications during open or apply now fold into the open patch or apply result, and a rejected apply reports what the agent moved since nothing is stored. Live options are validated with the creation schema. Tests drive a stdio ACP agent. * fix(server): providers validate live option patches and Claude reports Fast dropped by a model switch Live patches go through the schema used at creation. A Claude model switch that cannot keep Fast reports fast_mode as removed so the stored options match the session. * fix(server): Claude reports Fast as off, not removed, when a model switch drops it A removed key lets a config.json default of fast_mode: true fill back in while Fast is off at runtime. * fix(server): fold an old app's profile featureValues by the provider and options the write carries A write with options folds featureValues over those options. A write without them patches the stored options, unless the profile moved to another provider, which starts from no options. * docs(server): a rejected apply reports what the provider moved after the call ends * test(server): a patch key is resolved against nested configured defaults * test(server): a setting a plugin changes on its own is forwarded as options_changed * test(server): assert the forwarded plugin setting without nesting callbacks * test(server): removal of auto_accept returns ACP to asking; Claude keeps opening restrictions across a patch * fix(server): Codex returns the tier it resolved and drops a speed the new model lacks A live service_tier: fast is stored as the catalog's Fast tier id instead of a value the control cannot show, and a model switch to a model without the stored speed reports Normal so choosing a supporting model again does not bring the paid tier back. * fix(server): Claude applies only the keys a patch sets over its current options A Fast patch kept a copy of the options taken before the runtime answered, and assigning it afterwards dropped a patch that landed meanwhile. * fix(server): a plugin that moves settings and then refuses an apply reports what moved * refactor(server): the legacy featureValues folds take one named-input object * fix(server): a live patch is rejected for an option the session only reads at start, and opening reports every option it ended up with A stored option has to describe what runs. OpenCode, OMP and ACP now reject a live change to a key they apply only when the agent opens; Claude applies such a change from the next turn and rejects it while a turn is running. Opening reports every select or setting the session came up with, including ones nobody set, so a native default (Cursor opening with Fast on) is stored as option state like any other. * fix(server): Claude rejects a live change to an option it reads when the query starts Replacing a started query to apply the option would end its background shells and tasks. Once the query exists only Fast can change; before the first prompt every option still applies, because it is read when the query is built. * fix(server): a live options patch is rejected when the session cannot apply it A session with no applyOptions (Pi) now rejects a patch instead of storing a value that fails on reopen. Codex applies only service_tier, plan_mode and fast_mode live, since the approval policy and sandbox are fixed when the thread starts. Claude also rejects a launch option change while its first query is starting, after the options have been copied. * fix(server): plugins reject keys they do not report as settings, and Codex opening reports the speed it runs A plugin session applied the settings it knew and silently stored the rest; it now rejects a patch that names a key the plugin does not report. Codex opening on a model without the saved speed ran Normal while the stored options still said priority; opening now reports the tier it runs, as a later model switch does. * refactor(server): option helpers take named inputs, control types come from their schemas, and a plugin accepts launch options it opened with A whole profile is applied by the unchanged app, so a launch-only plugin option whose value has not changed must not fail the apply. applyProviderOptionsPatch and featuresFromControls take one object, and the protocol control types are inferred from the wire schemas. * fix(server): ACP reports a select that appears after startup with its native value A model switch can introduce a select (Cursor Fast) that the session did not have at open. Its value is now stored like any other native selection instead of being skipped because the previous snapshot did not name it. * fix(server): a loaded agent's options stay what its session opened with when a provider default is edited effectiveOptions was recomputed from the current config.json defaults on every state emission, so editing a default changed the snapshot of an agent whose session never received it. It is now computed when the session opens and moves only through an apply or an options_changed. Editing a default affects agents the next time they open. * fix(server): a live apply shows the merged defaults the provider was given in the options snapshot The snapshot took the raw patch, so a nested patch over configured defaults dropped the defaults the provider had accepted. The snapshot now takes what the provider was sent plus what it reports back; stored options still keep the raw patch. * fix(server): an option a session drops when opening is not brought back by a configured default The opening snapshot merged defaults over the options after the session's openOptionsPatch had removed a key. Defaults now merge into what the session was given and the patch applies after. * fix(server): Codex keeps the speed it opened with when the legacy Fast key is removed Opening moves a legacy fast_mode into service_tier, so removing fast_mode afterwards changed the runtime speed to Normal while the stored options still said Fast. Removing the alias now changes no speed. * fix(server): opening snapshots keep the defaults the session launched with, and config-change pushes carry legacy profile values An opening resolved defaults once for the session and again at registration; an edit in between showed options the session never received. Create, resume and reload now resolve once, before the provider opens, and registration starts from that. The daemon_config_changed push skipped the featureValues projection that config replies apply, so the unchanged app lost a profile's legacy values when any setting changed. * fix(server): every opening path hands registration the options it launched with Registration took the launch options as optional and reread the defaults when a path did not supply them, as provider-session import did. It is now required, so create, resume, reload and import each resolve once before opening. The option helpers take named inputs. * fix(server): a saved legacy Codex Fast preference wins over a configured service_tier default The defaults merge put a configured service_tier next to the agent's own legacy fast_mode, and Codex reads service_tier first, so the agent opened Normal. The agent's own alias now replaces the default of the key it stands for. * fix(server): Codex keeps a Fast chosen by alias as the catalog's tier id A live fast_mode or service_tier "fast" was stored as the alias while the apply reported the catalog id, so a later switch to a model with a different Fast id ran Fast under an option that said otherwise. The session now stores the id it accepted and drops the folded fast_mode. * fix(server): the legacy Codex Fast alias folds into one speed on apply and in configured defaults A patch with both speed keys left the alias in the stored options, so a reload started Fast again after the speed was removed; the apply now reports the folded alias. A configured fast_mode default now supplies the service_tier default, so removing an agent's own speed falls back to the configured Fast like opening does. * fix(server): an OMP replacement runtime starts with the Fast the session has now A restart (for example an approval-mode change) restored Fast from the options the session opened with, turning back on a Fast the user had switched off. The session now keeps the Fast it applied or the provider changed, which is what a replacement reads. * refactor(server): Codex's legacy fast_mode converts to service_tier where old data enters Stored records, config.json defaults, profiles, older clients' requests, MCP settings and plugin hooks go through convertLegacyOptions as they come in. Past that point the defaults merge, the manager and the Codex session never see fast_mode for Codex, so the alias branch in the defaults merge and Codex's fast_mode handling are deleted. * fix(server): a legacy hook's replaced speed and an apply request's options convert before they are compared or applied A hook that swaps the canonical speed it was sent for fast_mode is diffed in canonical form, so its replacement is not read as a deletion. An apply request carrying featureValues and options sends one options patch with options winning, so a superseded legacy value is never applied. * refactor(server): the agent manager converts Codex's legacy fast_mode for the adapter behind the provider id The rename is adapter-specific, so it lives where the provider id resolves to its adapter: AgentManager converts an agent's own options on create, resume, import, reload, apply and draft controls, following derivedFromProviderId, so a custom provider extending codex keeps working with a saved or requested fast_mode. Storage, MCP, schedules, hub and profiles pass options through. The featureValues-to-options fold stays provider-agnostic at the legacy edges. * fix(server): a rejected OpenCode auto_accept leaves the session asking for permission applyOptions committed the new flag before approving pending requests, so a failed reply left the session auto-approving while the stored option stayed off. The flag is restored when the apply throws. * fix(server): legacy Fast reaches draft discovery and saved profiles, and overlapping or replaced options keep the state they committed Draft controls and commands convert the config they hand to the provider, so inspecting a legacy Fast preference no longer fails Codex's strict options. A profile naming codex converts its saved fast_mode for the app's controls. OpenCode serializes auto_accept applies so a failed one restores exactly what it changed, and a replacement OMP runtime starts from the Fast the session opened with. * fix(server): an OMP replacement runtime that refuses the session's Fast publishes what it accepted The approval-mode restart installed the new runtime's state without comparing its Fast result to the session's, so a refusal never reached options_changed, the remembered value, or storage. The replacement now goes through the same comparison as refreshState. * fix(server): OMP turn completion publishes a Fast change, and Claude opens with Fast off on a model that has none OMP installed runtime state in several places and only one compared Fast; every state read from the runtime now goes through one install step. Claude kept a Fast default on a model without Fast, which made unrelated options reject until the user cleared it; the session now opens with Fast off and reports it in openOptionsPatch, as the model-switch path already does. * fix(server): a malformed Codex fast_mode is rejected, and profile options are renamed for clients by the agent manager's conversion convertLegacyOptions read any truthy fast_mode as Fast, so the string "false" ran priority. It now accepts only true, false or null. The profile store no longer renames keys: a literal codex profile was renamed in storage while an extends-codex profile was not. The config API now converts each profile's options with the manager's adapter-aware conversion, so codex and my-codex profiles read the same. * fix(server): a profile is stored in the current option keys, converted for the adapter its provider extends Profiles in config.json are old data entering, so the store converts them (stored value and incoming patch) with the same conversion the agent manager uses. Storage and clients now share one vocabulary: resetting a legacy Codex profile's speed removes what was shown, and a malformed fast_mode rejects the write instead of breaking later config reads. The config API goes back to copying the field shape only. The extends chain is followed by one function over either the registry's definitions or config.json's providers. * fix(server): profile options convert against the provider graph a write commits A write that edited a provider and a profile together folded the profile against a shallow merge that dropped the provider's extends, so its legacy Fast was not converted. The fold now sees the same deep-merged providers the write commits. * fix(server): draft speed shows the tier the first turn will run with Draft discovery reported the options as requested, so a Fast configured as a legacy fast_mode or the fast alias read as Normal while creating sent the model's own Fast tier. The draft now reports the options the scratch session opened with, as registration does. * fix(server): ACP option applies run one at a time Two overlapping applies shared one transaction guard, so when the first was refused after the agent had moved a select, its report was dropped as 'still in a transaction' and the second saw no difference. Applies are serialized, as OpenCode's are, so each reconciles against the state the previous one left. * fix(server): an ACP removal reports the choice the select lands on, and the Codex plan tests enable plan mode A removal asks the select for its empty choice and compared the result against that same empty choice, so applyOptions returned nothing and the manager stored the removal as null while the session ran the Default choice. The difference is now computed against what was asked (null), so the options hold the value the session runs with. The Codex plan-mode end-to-end tests called the removed session.setFeature through an optional call and silently skipped plan mode; they apply the option and fail loudly if the method is gone. The MCP parity wrapper forwards listControls instead of the removed listFeatures. * fix(server): plugin option applies run one at a time, and OpenCode reports the Auto Accept legacy full-access turns on Plugin sessions let two applyOptions overlap. The second finished and re-recorded the settings the plugin held, which included a change the first had already made and not yet reported; when the first then failed, nothing was left to report and the stored options kept the old value while the plugin ran the new one. Applies now queue on the session, the way the ACP adapter's do, so each reconciles against what the one before left. OpenCode normalizes the legacy full-access mode to build with Auto Accept on, but the session never said so, so the options the manager keeps did not hold Auto Accept and a reopen turned it off. The session now reports it through openOptionsPatch on create and resume. * refactor(server): openCodeOpenOptionsPatch takes one named-fields object * feat(app): the client and app work on options and controls The agent snapshot's `options` are the state and `controls` only draw them. Running and closed agents draw from the snapshot; drafts and profile forms ask `provider.controls.list.request` with their `providerOptions`, so aliases such as a legacy Fast profile's `service_tier: "fast"` are resolved once, by the daemon, and the draft keeps Fast highlighted. A draft adds only the user's edits and each provider's last-used control values; applying a profile seeds its non-control options (e.g. `sandbox_mode`) into the draft, and a profile form saves them back instead of pruning to the controls it can draw. A daemon without `server_info.features.providerOptionControls` still sends `features` and `featureValues`. `LegacyProviderOptions` in the client package is the one place that translates snapshots, draft listings, create and apply requests, and daemon-config profiles, so the app never branches on it. Persisted preferences and tab layouts rename `featureValues` through tagged COMPAT preprocessors. The features/controls bridge moves from the server into the protocol package so the client can reuse it. * fix(app): drafts and profile forms send every option layer to the daemon A cold create against a daemon without providerOptionControls routed control options (Claude fast_mode, Codex service_tier) as providerOptions, which that daemon does not read for them. The client now lists the provider's features before the first create or workspace create that carries options, so callers never prime a cache. Draft options moved into a plain model. Applying a profile replaces provider and options in one step, so the form's provider change that follows no longer clears a cross-provider profile's non-control options; choosing a provider by hand still starts over. The model sends its complete options (seed, last-used values once the provider says it still draws them, edits) to the daemon and the controls draw only the answer, so a remembered legacy fast is drawn as what it runs as. A toggle shows over the last answer until its own arrives. The profile form does the same: its edits go through resolution too. * fix(client): a legacy create routes its options from the controls of its own config Which options a legacy daemon exposes as features depends on the model, mode and thinking level, not only the provider: a Haiku snapshot with no features says nothing about Opus. The provider-keyed memory of control keys sent an Opus create's fast_mode as providerOptions, which that daemon does not read. A create that carries options now lists the controls for its own draft config and splits on that answer. The memory, and the snapshot and listing hooks that fed it, are gone. * fix(app): a closed agent shows its stored options, and a provider switch asks about its own options A closed agent's snapshot is projected from its stored record, which kept controls and provider options but dropped them from the payload, so the app drew no speed or other controls for it. The stored projection now carries them, with the legacy features derived from the same source. The draft read the form's provider and the model's options separately, so for the render after a manual provider change it asked the new provider about the previous provider's options. The request is now built from one snapshot of the model and is absent until the model has observed the new provider. * fix: persisted options keep their full shape, and every legacy snapshot gains controls Draft setups and form preferences validated option values as booleans, strings or null, but the options they now receive come from agents and profiles and can be objects, arrays or numbers. One such value failed validation and wiped the whole saved layout or the saved preferences. Both schemas now accept any JSON value. The legacy-daemon translation skipped the snapshots carried by agent_created, agent_resumed and timeline responses, so a created agent or a timeline refresh left the SDK handle without options and controls. The profile journey asserted the create request's options field; the wire field is providerOptions. * fix(client): a legacy profile with both featureValues and options keeps both A legacy daemon keeps an unknown `options` field on a profile it stored (profiles are passthrough), for example after a downgrade, while its own app keeps editing `featureValues`. Reading such a profile took `options` and dropped `featureValues`, so a Fast setting there was lost and the next save replaced it. Both are merged on read with an explicit `options` key winning, the same rule the daemon applies when it folds `featureValues`. The draft form input of draftControlsRequest is a named type. * fix(app): a draft stops sending a toggle the model in use does not offer A toggle made on one model stayed in the draft's edits after the form moved to a model whose controls do not include it, and was sent with the create. On a legacy daemon that key is not a feature for the new model, so it went out as a native provider option the daemon rejects. The draft now sends an edit only while the latest answer draws a control for it, and sends it again when a control for it returns. * fix(server): a closed agent's options include the provider defaults, like a live one's The stored snapshot projected only the options the agent owns, so an agent that ran with a config.json default (for example Claude fast_mode: true) showed the option as missing, and its legacy Fast control as off, until it was resumed. The projection takes the same resolver the live agent uses (the provider's defaults under the agent's own options). * fix(app): a draft keeps sending an option no control has drawn The previous change stopped sending any edit the latest answer drew no control for, which also dropped options set without a control (a plugin setting a token budget on the draft). Only an edit of a key an earlier answer for this draft drew as a control stops applying when a later answer draws none; every other edit always applies. * test(server): the MCP test agent manager resolves effective options * fix(app): a profile stops saving a toggle the model in use does not offer Switching a profile from Opus to Haiku kept the Fast edit, so the saved profile carried fast_mode that no control draws and an old daemon's provider rejects at create. The profile editor now drops a key an earlier answer drew as a control and the latest one does not, the rule the draft already follows; options no control ever drew are never touched. * fix(client): resetting an option on an old daemon writes the default it can take setAgentOptions({ service_tier: null }) sent a feature write with value null, which the old Codex setter rejects, leaving the paid Fast tier on. A toggle now resets to off and a choice to its default; an option with no control to name a default fails with the host-update message before anything is written. * fix(client): applying a config with a reset option on an old daemon writes the default it can take applyAgentConfig({ options: { service_tier: null } }) reached an old daemon as featureValues with null, which its Codex setter rejects. The config now takes the same translation as setAgentOptions: a toggle goes off, a choice goes to its default, and an option with no named default fails with the host-update message before anything is sent. * feat(plugin): provider plugins declare option controls and receive option changes A provider plugin reports `controls` and the `providerOptions` it runs in `session.config`, and receives running-session changes as `session.configure` `changes.providerOptions` (null returns a key to its default), under the same apply-or-throw contract as built-in providers. A control may declare a `defaultValue`; a value a plugin reports at that default for a key nobody set stays unset instead of being pinned to the agent. A plugin that still reports `settings` keeps working: the daemon reads each setting as a control plus an option and sends changes in both shapes (COMPAT(plugin-provider-settings)). The app resolves a control's icon as a Lucide name when it is not one of the built-in kebab-case names, so a plugin's icon shows live and in drafts. Public docs and the provider-direct example use only `providerOptions` and controls; the migration doc gains the rows. * fix(server): a plugin provider's reported options are stored like any provider's A control's `defaultValue` only says what the control shows for a key with no value. Opening and applying store every option the session reports, defaults and values nobody set included, as built-in providers do; the special case that left a value at the default unset is removed. * fix(server): a plugin decides which options it applies live A plugin reporting `controls` and `providerOptions` receives every key a live change touches, with or without a control, and applies them or rejects the whole request. The daemon's live-key guard now runs only for a plugin still reporting `settings`, which cannot refuse a key. * fix(server): a rewound plugin session reopens with its options as they stand The reopen merged the plugin's reported options over the launch record, so a key the plugin reset by leaving it out came back at its launch value. The session now keeps the committed options, removals included. The provider-direct example also refuses a combined request before changing anything. * fix(server): a plugin that stops reporting an option has reset it The adapter only visited keys present in a new report, so a key the plugin dropped to return to its default kept its stored value and its rewind value. A previously reported key that disappears is now reported as removed. * fix(server): an apply reports the options the plugin reset along the way Applying and unsolicited reports now share one conversion from the plugin's report to a patch, so a key the plugin stops reporting is a removal on both. * fix(server): an apply never reads a requested option as one the plugin dropped A plugin may run an option it never reports. Only a key it reported before can be reported as removed, and a rewind reopens with the accepted request plus what the plugin reported back. * test(server): an apply to a plugin that reports controls sends its changes as provider options * feat(plugins): agents and workspaces carry plugin metadata Plugins had nowhere to keep their own data on an agent or workspace, so Phase 5 and 6 surfaces would each have invented a side store. Both now hold an opaque Record<string, JsonValue> that Paseo stores, snapshots and hands to hooks without reading a key. Set at creation or changed with agent.metadata.update.request / workspace.metadata.update.request (top-level keys replace, null removes). Persisted on the agent and workspace records, so it survives a restart. Reaches agent.create.before (which may add to it), agent.open.before (read-only), agent.create.after and workspace.create.before/after. Gated once on server_info.features.entityMetadata; the client throws "Update the host" instead of sending to a host without it. * fix(plugins): an agent.open.before result may omit metadata The result schema required metadata, so a plugin written before metadata existed that returns its own object instead of spreading the request failed validation and the session open failed, even for agents with no metadata. An omitted metadata now means unchanged and is filled back in from the request so later plugins in the chain still see it; a present value that differs is still rejected. The restart test now sets metadata through the PaseoApi handles and checks that agent.open.before sees the patched value after the restart. * fix(plugins): omitted metadata in a hook result means unchanged An agent.create.before hook that returned its own { config, env } dropped metadata that an earlier hook in the chain had added, because only the caller's original metadata was restored at the end. The omitted field is now carried forward at each hook handoff, as agent.open.before already does. The agent.open.before result type also required metadata, so an older TypeScript plugin that returned its own object no longer compiled even though the daemon accepted it. The result type now makes it optional. * fix(plugins): omitted metadata in a workspace.create.before result means unchanged Same handoff as agent.create.before: a legacy hook that returned only { source, ... } dropped the caller's metadata and anything an earlier hook added, and workspace provisioning then defaulted it to {}. The omitted field is carried forward at each handoff; an explicit {} still replaces. * test(server): fixtures for agents and workspaces carry metadata Agent snapshots and workspace records now always carry metadata, so the hand-built fixtures and expectations in three existing suites name it. * docs(plugins): the hook result comment names metadata as the field that stays * fix(server): reopening a closed agent keeps metadata saved just before The loader reads the agent record, then queues a resume. A setMetadata queued ahead of that resume saves a newer record, and the open hooks saw it, but registration took metadata from the loader's older read and wrote it back over the saved patch. Registration now uses the metadata read inside the lifecycle lane. * docs(server): name the metadata gap when a handle-less agent is recreated on load * docs(server): the handle-less recreate gap spans the agent.create.before hook * docs(plugins): an agent.open.before hook starts writes to its own agent without awaiting An agent.open.before hook that awaits setMetadata (or any write) on the agent being opened deadlocks: the write joins the agent's lifecycle lane behind the open, and the open waits on the hook until it times out. The hooks reference now says so and shows the supported shape, a write started without awaiting, which runs right after the open. Deferred, not in this stack: reject such a write immediately instead of letting the hook time out. The host knows which plugin hook it is awaiting for the agent and which channel the write arrives on, so the rejection can be keyed on "this plugin is inside an open hook for this agent" without cross-process tagging, and an unrelated client's write would still wait as it does today. * feat(plugins): composer items and controls in all three composers A plugin registers a component with addComposerItem and reads and changes the composer through useComposer(): provider, model, mode, thinking, options, prompt, attachments and agent metadata. The agent, draft and New workspace composers provide the same ComposerInput and ComposerAgent halves, so a command reaches the right model without the plugin knowing which composer it sits in. Toggle, Select and Action are drawn by one ComposerControl renderer that the thinking select and provider option controls now use too. Controls sit in the toolbar when there is room and become rows in the existing overflow sheet otherwise, so on a phone they appear in the overflow. Plugin items count in the density presence so the composer condenses to make room. Model and mode stay specialized but share the trigger, density and overflow. Draft metadata is kept locally, sent at creation and reset when the prompt is sent. PluginAgentSnapshot.metadata, deferred from the metadata phase, lands here. The unused provider badge is removed. vitest resolves @floating-ui/react-native to its ESM build: the CJS entry requires the real react-native, whose Flow sources do not parse. * fix(plugins): composer commands run on current state, report failures, and reach the overflow sheet Draft commands read the state captured at render, so a plugin's `await setProvider(); await setModel()` acted on a stale provider. The draft form and options are now plain stores that commands read live, and `setProvider`/`setModel` reject an unavailable provider or a model the loaded catalog does not list. Draft `options` include the plugin's pending edits. Shared composer controls own the pending state and show a rejected command as an error toast, like the built-in controls. Callback payloads are objects (`{ value }`, `onPress(event)`) so they can grow without breaking plugins. The overflow sheet's content portals to the app root and lost the composer's agent, input, toast and query contexts, so plugin items drew nothing in it. `useComposerSheetBridge` carries them across. * test(plugins): composer commands tested on the models, overflow sheet in Playwright The draft composer's command rules (unavailable provider, unlisted model, edits belonging to the provider the form has now) moved from the React hooks into the form store and the draft options model. They take the host's catalog as a plain input, so the command tests run on the real models with no module mocks and no renderer. The overflow-sheet test faked the portal it was meant to verify. It is replaced by a Playwright spec that installs the composer-controls example and checks its rows in the narrow composer's Features sheet; it fails when the sheet's context bridge is removed. * test(plugins): lock draft option ownership without a subscription, name the overflow-sheet steps The draft option test subscribed the options model to the form, which in the app happens in a render effect, so it passed without the model observing the form's provider itself. A case with no subscription now fails when that observation is removed. The overflow-sheet spec reads as steps through a helper. * fix(plugins): composer option resets and model checks match the documented commands A draft kept `null` as an option value, so `setOptions({ key: null })` sent the null to the provider and creation failed. A null edit now removes the key from every draft layer, as the patch does on a running agent. A running agent's `setModel` accepted ids its catalog does not list; it now rejects them the way a draft does. The composer controls imported the toast host through the toast context, which pulled the host's animation module into every module that loads plugins. They use the API-only context instead. The migration guide's registration table gets the `addComposerItem` row its test requires. * fix(plugins): draft metadata survives a remount, plugin commands follow the composer lock Draft metadata was component state while the prompt lived in the draft store, so a composer that remounted across the compact breakpoint kept its text and lost the plugin's choices. It now lives in the draft store beside the prompt, is cleared when the draft is sent, and is not cleared when the prompt is emptied. It is not persisted across app restarts. While the New workspace composer is creating the agent, the built-in controls are disabled but plugin controls and commands were not. They read the composer's own lock: Paseo controls render disabled, and setPrompt, insertText and the agent commands refuse. The options and metadata a plugin reads are frozen copies, through the same helper the timeline projection uses. The composer control test mounted components in JSDOM, which the testing rules ban; it now runs in the browser project. * fix(plugins): a kept command honors the composer lock, and useAgent metadata is frozen A plugin action that awaits an RPC holds the composer it was created with. The lock was captured at that render, so a submit that started meanwhile did not stop its insertText. Commands now ask the composer whether it is locked when they run. The agent snapshot a plugin gets from useAgent froze only the outer metadata record. It now uses the same deep frozen copy as the composer. * fix(plugins): attachment commands honor the composer lock The creation request captures the attachments when it starts, so an attachment a plugin added or removed afterwards was lost or left in the request. They refuse like the prompt commands. * fix(plugins): a built-in select in the compact sheet keeps its action name The shared control named every icon-only select by its value ("Speed: Fast"), including in the compact sheet, where the row already shows the value. The sheet row is named by its action again ("Select speed"), as before the shared renderer. * test(app): composer item test installation carries the subscribe main added to InstalledPlugin Main's plugin streaming (#8527) made subscribe a required field of InstalledPlugin; the composer item model test builds its own installation and predates it. * feat(plugins): New workspace items set the branch and workspace metadata addNewWorkspaceItem mounts a plugin field on the New workspace screen, and useNewWorkspace() exposes host, project, isolation, base ref, branch and metadata with commands that follow the composer item rules: they act on the screen's state when they run, resolve once applied, reject while the screen is locked, and take JSON payloads. Host and project are read-only because a command that switched them would unmount the item that called it. The screen's pickable state (base selection, manual isolation, branch, metadata) moves into one plain store so pickers and plugin commands write to the same place; the screen reports derived facts to it on each render. The branch is sent as source.branchName only for a branch-off worktree, and metadata on workspace.create. Items render through ComposerControl with a new "field" surface (badge on desktop, full-width field when compact). Combobox ships here: Paseo owns the loading and error states, keeps previous results, and drops superseded searches. * fix(plugins): New workspace commands work from mount effects, and branch and base ref match what creation uses A command called from a New workspace item's mount effect rejected because the setup model only received its inputs and the pickers' handlers from a passive effect on the screen, which runs after a child's. The model now takes its inputs at construction, picks the base and isolation itself, and is refreshed in a layout effect; the screen supplies the side effects of a pick (the PR attachment, the remembered isolation) as listeners. The branch a plugin sets was dropped when no base was resolved, such as on a detached HEAD, because it was sent only for an explicit branch-off. It now applies whenever the worktree cuts a new branch, decided in one place that mirrors the daemon. baseRef.name was the display-shortened branch name, so setting back what was read based the worktree on the local branch instead of the origin one. It is now the exact ref creation uses, and host and baseRef are frozen like project and metadata. * fix(plugins): New workspace commands have the same effects as a pick, even from a mount effect The screen attached the pick side effects (remembering the isolation, syncing the picker's PR attachment) as listeners in its own useEffect, which runs after a child item's mount effect. A mount-time setIsolation("worktree") switched the screen but was not saved, and setBaseRef skipped the attachment sync. The effects are now injected when the setup model is built, so a command and a pick run the same code from the first render. Closing the picker stays in the picker's handler. * fix(plugins): a Combobox shows a failed refresh instead of the old results The query keeps its cached data when a reopened list fails to refresh, so the old items stayed selectable and the error never showed. A failed search now clears the list so its error shows. The migration guide maps addNewWorkspaceItem, which its registration-coverage test requires, and the superseded-search test waits on a later search instead of sleeping. * fix(plugins): a branch and metadata chosen for one project are not sent for another The setup model outlives the project and host it was chosen for, so an issue picked for project A was sent on workspace.create after the user switched to project B. The model now drops the branch and metadata when the project changes (project ids are host-scoped, so a host switch counts). A project that is still resolving is not a switch. The base selection is left alone: the built-in picker keeps a branch pick across a project switch, and that behavior is unchanged. * test(plugins): the project-switch spec expects the other project's metadata to be empty * fix(plugins): a host switch drops the branch and metadata even when the project id repeats A remote repository keeps the same project id on every host, so comparing the project id alone missed a switch from host A to host B for the same repository. The target is now the host and the project id together. * fix(server): a branch the caller named is not renamed from the first agent context The daemon marked every new branch-off worktree for automatic naming, recording the chosen branch as the placeholder, so the first agent's prompt could rename a branch a plugin or client had named through branchName. Only a branch the daemon derived from the worktree slug is a placeholder now. * fix(plugins): New workspace items remount when the project or host changes An item stayed mounted across a project switch, and its Combobox kept the previous project's results (same query key, cached data) selectable until the next search returned, so an issue from the old project could set the branch and metadata on the new one. A Combobox cannot detect that its inline search now means another project, so the item host keys the items by host and project id. Items and their search results start fresh for the new target, and a mount effect sets up again after the model clears the branch and metadata. * docs(plugins): a layout-effect command on mount also races the reset on a project switch * fix(plugins): a New workspace item's commands stop working once its project or host is left Every item received the same command functions, which act on the current screen state. A lookup that finished after the user switched projects could still call setBranch or setMetadata and overwrite the new project's choices; the reset on a switch only clears what was already written. The setup model now hands out commands per target with commandsFor({ serverId, projectId }). They reject with a "moved to another project or host" error when the screen is on another target, like the lock rejects, so the promise only resolves when the change took effect. * feat(plugins): reach a running agent's composer by reference useComposers(selector) in any plugin component and composers(selector) on every command context return the composer of a running agent, named by id or by focus, whether or not its tab is open. A running agent now has one store-backed composer model apart from any mounted tab. The mounted composer plugs its cursor-aware insert in while mounted; otherwise insertText and setPrompt write the agent's saved prompt. model and thinking resolve through the provider catalog with the picker's own function, so a read equals what the picker shows. The host reads one ComposerModel from context and no longer knows whether it is in an agent, a draft or New workspace. The daemon rejects an unlisted model or thinking option for a running agent, replacing the app-side guard. * fix(plugins): composers by reference follow the focused agent and reach retained composers - `{ focused: true }` is the agent Command Center hands to agent items, published by its registration through plugins/focused-agent.ts and empty outside a workspace. The composer source reads that module instead of the remembered workspace selection, the navigation store and the layout store, which also removes the require cycles those imports added. - A composer the app retains in a workspace the user left has no live input. `insertText` and `setPrompt` now store the text with `replaceDraftText`, which asks the mounted input to show it; before, the text reached the store but the retained input never displayed it. - `model` and `thinking` read exactly what the picker resolves before the catalog loads (no models), then re-resolve when it lands, instead of reading null. - The daemon validates a thinking option against the model the agent runs: the runtime model when the provider lists it, else the configured one. - The composer sources subscribe to query-cache updates only. A query another component creates during its render is announced as `added`, and a subscriber that updates then made React warn about updating a component while rendering a different one. A catalog read no longer starts its load synchronously either. * test(plugins): a Command Center agent item reaches the composer through the real client state The command-path test now reads workspace and agent through createPluginClientStateSource over seeded session stores, so an empty lookup, which makes the Command Center return before calling the item, would fail it. Also records at the focused-agent publisher that it publishes in an effect. * fix(plugins): a running agent's composer validates and refreshes against the agent's own catalog setAgentModel and setAgentThinkingOption checked the provider's global catalog, while the picker reads the catalog of the agent's directory, so a model only the project lists was rejected. The validation input now carries the directory. The composer read the catalog once with no observer, so reconnect repair, which refetches only active queries, never refreshed it and a failed load never retried. While anything watches, the composer now observes the catalog query. The shared composer map kept every agent's composer for the session. It is now dropped when nothing watches it and no composer is mounted. * fix(plugins): useComposers holds the composer it names, and a composer lives as long as its agent PluginComposersSource.subscribe watched the stores directly and never the composer model, so a component using useComposers did not keep the model's catalog observer alive and reconnect repair skipped it. subscribe now takes the selector and holds the model it names, following focus. Dropping a composer when it went idle left a command a plugin had saved calling a dead model after the tab reopened. A composer is now dropped when its agent leaves the session and nothing watches it or has one mounted. * fix(plugins): a composer refreshes a stale catalog on resumed demand, shares its store watches, and is released with its last holder Watching again, or reading once, after the catalog was invalidated or failed while nothing watched now starts one deduplicated refresh; the observer refetches on mount. Reconnect repair only refetches watched queries, so an unwatched catalog stayed stale. Each subscribe installed its own session and draft store callbacks, so N watchers received N squared notifications, including for other agents' drafts. One pair of subscriptions now serves all listeners, and the draft callback ignores drafts of other agents. A composer whose agent was removed while it was held was only released on the next session change. The last holder letting go now checks too, and an archived agent's idle composer is releasable. * test(server): live model and thinking switches use values the provider lists The daemon rejects a model or thinking option its provider does not list, so the live-preferences e2e can no longer switch to a made-up id. A provider that lists nothing to switch to skips the case. * test(server): the test providers list two models with thinking options, and the live switches run The fake providers listed one model and no thinking options, so once the daemon validated selections against the catalog the live model and thinking switches had nothing valid to switch to and skipped. Every fake provider now lists two models with thinking options, and the switches run for all three providers without depending on installed binaries. * fix(plugins): a retained composer that is not showing takes plugin writes through the draft On native a retained composer keeps its input mounted under display none, so the ref alone said the input was live and a plugin insertText replaced the stale selection instead of appending to the draft. The input is live only while its retained panel is showing. * test(plugins): the retained input liveness test runs in real Chromium * fix(plugins): a model or thinking change, an unreported option key, and a draft model reach the provider unchecked Paseo no longer checks these in front of the provider. A running agent's model or thinking change no longer waits for the catalog or checks it, a plugin provider is sent every option key and refuses what it cannot apply, and a draft setModel keeps the id as the model picker does. * fix(plugins): a plugin reporting settings is sent every key of an options patch * Run option, model, thinking and mode changes in the agent's lifecycle lane The agent manager owns all sequencing for one agent: applyOptions, setModel, setThinkingOption and setMode now run in the same lane as open, close, archive, labels and metadata, so a provider session never sees two of them at once. Provider-side serialization (the applying chains in the ACP, plugin and OpenCode sessions, and Claude's apply-over-current-options handling) is deleted. * Reopen a handleless agent inside its lifecycle lane A stored agent with no resumable session is now reopened by AgentManager.createAgentFromRecord, which rereads the record inside the agent's lane before creating the first session. A metadata or label write queued ahead is in the record it reads; one queued behind applies to the live agent. The loader no longer passes a record it read outside the lane. createAgent itself also runs in the lane, like resume. * Return the draft's options from AgentClient.listControls listControls now answers { controls, options } like AgentManager.listDraftControls: the options a session opened from the draft would run with, with config defaults merged in and anything the provider resolves natively for the ones nobody set. ACP fills unset feature selects from the probe session's currentValue, so a fresh Cursor draft shows the Fast selection the agent opens with instead of no selection. The legacy features response and the MCP draft listing already project from the manager's result, so they follow. * Send a profile's options on every write, empty included The profile form always sends options. The daemon reads a write without them as one from an app that predates options and folds featureValues over the stored ones; a write that carries them, empty included, replaces them. A profile left with no options is stored without the key, so removing the last one persists. * Read a remembered Codex fast_mode as its service tier The create-agent preferences convert the legacy key on read, keyed on the built-in codex provider id, so the Codex draft shows the Fast selection the user last used. Tagged COMPAT(featureValues) with the other legacy-option shims. * Document one option change at a time per agent The agent manager runs option, model, thinking and mode changes in the agent's lifecycle lane; providers do no sequencing. The hook deadlock warning now covers agent.create.before and option writes. * Flatten the profile fold's base selection and drop an unused import * Carry the New workspace context through portal hosts and the draft's metadata through retry * Convert legacy options when resolving a stored agent's effective options * Keep stored-record reads tolerant of a legacy option the conversion rejects * Keep plugin attachment items separate from the draft's own * Hand plugin command inputs to the host as its own copies	2026-11-09 10:10:16 +07:00
Mohamed Boudra	02ad59908f	Keep show more and plan card toggles in place on Android (#9085) ... * fix(app): keep show more and plan card triggers in place on expand Long user message previews and plan cards toggled with a plain setState, skipping the timeline's disclosure hold. On Android the expanded content painted over the next row for a frame before the list learned the new size and corrected the scroll. Route both toggles through useDisclosureHold like the other timeline disclosures. * fix(app): keep show more at the same y by holding the message's bottom edge Show more sits under the text it opens, so a top-anchored hold pushed it off screen. The disclosure hold takes a trigger edge; MessagePreview passes the bottom edge. Web pins that edge in the reading anchor, native anchors the row below the message, and while following the end pin keeps the bottom in place. The LegendList patch counts the row just past the viewport as in view and drops the Android clamp prediction that moved a collapse near the end to the end. * fix(app): keep show more in place on an unanswered final prompt The last row has no row below it to anchor its bottom on, so a show more on a prompt the agent has not answered yet moved the trigger off screen. The hold now mounts the end pin while detached and toggles a frame later, once the pin anchors, and re-sticks only if the list was at its end when the toggle was tapped. The disclosure browser test now renders the real Markdown renderer. * fix(app): resume following when a final prompt collapse reaches the end An end hold decided its release from whether the list was at its end when tapped. A collapse that leaves less scroll room than that distance ends at the end, so the list stayed detached and later output grew below the viewport. The release now clamps the tapped distance to the room left. A row hold also clears an end hold still in progress, so the plan card or another toggle anchors its own row. * fix(app): keep following when a reply lands during a final prompt collapse The end hold clamped its distance from the end only against the final content size. A reply that grew the content after a collapse reached the end brought the old distance back, so the hold released detached. The hold now clamps on every content size change. * fix(app): let a reply grow below a held final prompt An end hold pinned the content end for the whole hold, so a reply that landed during it scrolled the toggled prompt up. The pin now holds only while the toggled row is the last row, and drops in the commit that mounts the reply. * fix(app): move a waiting final prompt hold to a reply that lands first The end hold's toggle waits a frame for the end pin, and it kept the anchor from the tap. A reply landing in that frame dropped the pin but left the hold with no row, so the toggle moved the button. The disclosure hold now owns the waiting toggle and resolves the anchor when the frame runs.	2026-11-08 15:34:26 +07:00
Mohamed Boudra	2d7a115614	fix(app): keep the latest turn footer in the chat column on web (#9083) ... At widths beyond the chat's max width, the latest turn's footer sat at the chat's left padding instead of under the message column, while running and after it ended. Earlier footers were aligned. #8358 wrapped the web viewport's live auxiliary (the latest turn footer and pending permissions) in a measuring div with no style. That div is a block box, so the footer row's alignSelf: center no longer applied. Give it the same flex column style as the stream rows. Fixes #9081	2026-11-08 12:48:07 +07:00
Mohamed Boudra	680e6077a8	test(app): keep turn footer timing on one line when the chat has room (#9080) ... The completed turn footer wrapped "Worked for 26s" onto two lines at full chat width in builds before #9007, which sized the duration to whichever label had more characters. A label with fewer characters can paint wider, so the duration wrapped inside the narrower timestamp's width. #9007 gives both labels the full label column; this locks that behaviour with a browser test using real layout. The browser test project could not load anything that reaches the toast context: react-native-web has no ToastAndroid, and native ESM rejects the named import. A react-native test shim re-exports react-native-web and adds it. The lucide test stub gains the icons the message module imports.	2026-11-08 12:00:08 +07:00
Mohamed Boudra	9131505810	Fill short collapsed chat histories (#8358) ... * fix(app): fill short collapsed chat histories Collapsed whole turns can leave the initial viewport short even when older history exists. Continue paging through measured pages before revealing a fresh chat, while preserving visible history and the reading anchor. * fix(app): settle padded and stalled chat history Measure the native history edge using the same content area as viewport filling, and bound child history requests so retry can start after a stalled fetch. * fix(app): adapt viewport filling to the current timeline * fix(app): resume history filling after switching tabs	2026-11-07 23:12:08 +07:00
Mohamed Boudra	c6f0c24bf6	Make a folded turn's summary line its own chat row (#9009) ... * fix(app): make a folded turn's summary line its own chat row The summary line of a collapsed turn was drawn inside its prompt's row, so the row gap landed below the summary and the prompt touched it. Turn collapse now emits a `turn_summary` row between the host and the reply, and one spacing rule covers every prompt: 16 above whatever answers it (reply, summary row or tool row). The summary row spaces like the work rows it stands for, 4 above the reply and flush under a tool host. This removes the per-row summary lookup, the host revision tracking and the fragments in the view. A fold reuses a turn's previous summary row object while its work and open state are unchanged, so mounted rows do not re-render. * fix(app): keep the turn summary row at its host's timeline position The chat outline resolves the active prompt from the timeline position of the row under the reading line. The summary row had none, so the outline lost its mark while the row sat there. The row now carries its host's position and is replaced when that position lands. * fix(app): keep the reader on a folding turn's host, not its summary row When an older page completes the oldest loaded turn and it folds, the reading position moves from the hidden rows to the turn's host row, as on main, so the prompt and its summary row both land in view. The pagination helper now finds the summary line in the row under the prompt.	2026-11-07 23:00:13 +07:00
Mohamed Boudra	b7b38412a0	Keep turn footer timing within the available chat width (#9007) ... * fix(app): keep turn footer timing within the chat width Let visible timing text determine its height within the available chat width instead of sizing an absolute overlay by character count. Keep actions anchored when duration and timestamp labels swap. * fix(app): keep footer timestamp hover target stable * fix(app): reserve both wrapped timing label heights	2026-11-07 21:32:14 +07:00
Mohamed Boudra	a9bce9a18d	Keep the chat still when an agent's turn ends (#8944) ... * Land a turn's reply, completed footer, and tool summary in one frame The stream handler closed turn liveness as soon as turn_completed arrived, while the final reply waited in the frame-coalesced reducer queue. For one commit the turn was finished with no reply: the footer vanished and the timeline jumped twice, and tool turns folded into their summary later. The viewed timeline owner now takes stream events whole: a turn boundary commits the queued content before liveness changes. Running and completed footers share one fixed content height so the phase switch moves nothing. * Document the turn-boundary commit and stop racing the re-pin in the turn-open test The turn-open test scrolled the received message into view with a programmatic scroll, which leaves the chat following its end. Pressing the turn summary swaps its icon, and that DOM change re-pins the chat to the end between pointerdown and pointerup. The summary had moved 14 px, which left the pointer 2 px inside the button; with the completed footer now 2 px taller, it moved 16 px and the click landed on the reply below. The message's fade and Show more are already on screen at the end, so the test no longer scrolls.	2026-11-06 23:10:29 +07:00
Mohamed Boudra	ae157dbfb6	Even out chat footer spacing and show the Changes base only on worktrees (#8934) ... * fix(app): space the turn footer like the rest of the timeline The footer sat 13px under the last line of text while the text sat about 21px under a tool or thinking row, so the footer looked glued to the message. The message drops its bottom padding when a footer follows, so the footer's top margin alone sets that gap; 20 makes the centre-to-centre distance match the tool-to-text gap. * fix(app): show the Changes base only on Paseo worktrees The header rendered "branch -> base" whenever checkout status carried a baseRef, and the daemon sends one for every git checkout, so plain checkouts showed "-> main" with no way to change it. Only Paseo worktrees store a base, so only they show it. The arrow is extra muted so it reads as a separator, and the base no longer shrinks, so a long branch name truncates instead of the base. * fix(app): let a long Changes base truncate instead of overflowing	2026-11-06 20:20:11 +07:00
geoqiao	dc51a3b6a9	fix(app): preserve plugin-rendered replies when collapsing turns (#8811) ... * fix(app): preserve plugin-rendered replies when collapsing turns * test(app): exercise plugin reply folding in the browser	2026-11-06 13:12:44 +00:00
Mohamed Boudra	4928500e1f	fix(app): keep chat rows their size while their tab is hidden on Android (#8911)	2026-11-06 14:08:09 +07:00
Mohamed Boudra	1e2ab3d596	Keep the first prompt on screen when a new agent starts on Android (#8898) ... * refactor(app): stop resetting the chat timeline when its agent id changes A mounted timeline only ever shows one agent: every host keys its panel by tab id, and a tab keeps its id across a target change only when a draft becomes the agent it created. The per-agent resets inside the timeline therefore never had a different agent to reset for. They only fired at that create handoff, where they hid and re-placed a timeline that was already on screen. Delete them: LegendList's dataKey and the placed agent id, the web viewport key, the bottom anchor's resetForAgent, the history window's agent id, and the expansion and path-opener resets in the stream view. * fix(app): keep one chat timeline across the draft-to-agent handoff A draft tab and the agent its first prompt creates rendered two different panels: DraftPanel mounted its own dock and list, and the retarget swapped it for AgentPanel's. On Android, with the LegendList timeline, the swap blanked the first turn and re-placed it. Render both from the agent panel. A draft supplies its timeline from the pending create in the create-flow store (composer/draft/timeline.ts) and its composer in the composer slot. The retarget then re-renders the same stream view with the agent's timeline, so the list instance and its measured rows stay mounted. Agent gating is unchanged. Float the compact header over draft tabs as it already floats over agent tabs. The header sat in flow above a draft and over an agent, so the list viewport grew 92 dp at the retarget and the turn moved. The handoff E2E now fails if the first row disappears, hides, or shifts down while the draft becomes the agent. * fix(app): load subagents and tasks only for an agent, not a draft tab	2026-11-06 13:38:10 +07:00
Mohamed Boudra	4f7813d3aa	Keep the tapped line in place when chat disclosures expand or collapse, with the native timeline on LegendList (#8717) ... * Keep a disclosure's trigger in place on web Expanding or collapsing a turn summary, tool-call group, tool call details or todo badge now holds the row that owns the trigger. Rows inside the timeline get a disclosure context; each toggle runs its state change through `useDisclosureHold()`, and the viewport's new `holdRow(rowId, apply)` replaces `holdReadingPosition()`. On web the hold pins the reading anchor to that row, stops following output, and resumes following when the change leaves the list at its end. Native keeps its previous behaviour (detach, then apply) until the anchored toggle lands. * Render the native chat timeline with LegendList in forward order The native timeline was an inverted FlatList. Disclosure toggles moved their trigger, and a cold open settled visibly. It is now a forward-order LegendList that stays virtualized, and one owner moves the scroll offset at a time: - Before placement: LegendList's initial scroll, behind its hidden reveal. - While following: the end pin (native-end-pin.tsx). This is a zero-height first child at the bottom of the content, which native maintainVisibleContentPosition keeps in place. A content shrink or growth never scrolls from JS; only a viewport resize or an explicit jump does. - During a disclosure hold and while detached: LegendList MVCP with shouldRestorePosition (native-disclosure-hold.ts), so a toggle keeps its trigger at the same y and paints one layout change. - Every newly mounted row starts at a per-kind estimate (new-row-estimates.ts). PaseoScrollView defers React Native's content clamp while MVCP is set. A shrink below an unmoved anchor no longer draws a frame past the end (RN #58578, PR #58695). VisibleContentPositionClampTest covers this. LegendList 3.7.1 patch, one "Paseo patch" comment per hunk: - The content height comes from React state on the new architecture. - Rows get a per-row size estimate. - The MVCP anchor lock runs on native too. Upstream gated it to web in d24a9d93 without a native reason. Without the lock, the size pass for prepended history re-anchors on a prepended row and moves the rows on screen. Native ends the lock when its row leaves the view, not on the 300 ms clock. - Header and footer reveal together with the rows. - Only lists that keep their end preserve the initial end. - A remeasure within one pixel plus the 1/8 dp floor of the known size is noise. Upstream compares the raw size with the floored one, so the live turn's assistant row (1380 -> 1381 px) read as a resize and moved every row a frame after the reveal. - The Android silent initial scroll retry sends its 1 dp nudge and the return to the target in one task. Upstream returns on the next frame, but its 16 ms check can finish the scroll first and cancel that frame, so the list revealed 3 px short of its end and moved into place a frame later. - The top-padding shrink hold applies on iOS only. Android, emulator. Evidence is in .artifacts/legend-impl. - J1, J2 at the end, J3, J4, J5, J6, J7: pass. - J2 while streaming: not reachable on the Ten second stream fixture; its turns never fold. - J8: no blank frames over 10 fresh flings, at host load 32-37. J4: still. Before these two hunks, 6 of 7 cold opens moved every row one frame after the reveal. After them, 9 valid cold opens show no shift. 5 of those were traced through the nudge path. Runs that hit the dev client's startup SIGSEGV in MountingCoordinator::pullTransaction were left out. That crash is in the emulator's dropbox from before this work. * Revise a history row when its turn summary line changes LegendList renders a row again only when its item changes. The forward-order timeline in d1f2ae352 folds a finished turn into its host user message, but the host's item does not change when the fold appears, so a turn that folded live lost its summary line until something else revised the row. collapseTurns now reports the hosts whose summary line appeared, changed or went away since the previous fold (updatedHostIds), and the history row revision treats them as changed content. * Stop following the end while a user scroll owns the viewport The bottom anchor controller kept sticky-bottom for the whole of a drag and its momentum and only decided at the end. While it is sticky the native list mounts the end pin, so a drag started during a stream had every new line move the rows under the finger: on the iOS simulator the offset jumped by each line's height (+22, +35, +22 pt) mid-drag, and Android does the same with the same code. beginUserScroll now detaches. endUserScroll resumes following when the gesture ends at the end (scrolling there without animation) and otherwise stays detached and drops any pending anchor, as before. The re-stick is not animated: on Android a line that mounts during a smooth scroll cancels it, and the list then followed 40 pt short of the end until the controller detached it. Measured after the change, frame by frame: - iOS and Android, drag up mid-stream: the content tracks the finger and momentum with no line steps; the stream grows below; tapping the pill re-sticks and follows again. - A short drag at the end, mid-stream: following resumes; the release lands on the end in one frame (the drag distance, here 8 pt on iOS and 21 dp on Android). A line already mounting when the drag begins can still move the rows once in its first frame, because the detach reaches native one commit after the touch. * Correct the iOS scroll view under maintainVisibleContentPosition Phase 2 of the LegendList timeline. The native timeline relies on maintainVisibleContentPosition for the end pin and the disclosure hold, and React Native 0.86 on iOS gets two cases wrong. modules/paseo-scroll now registers PaseoScrollViewComponentView, a subclass of RCTScrollViewComponentView, for the iOS scroll view, like PaseoScrollView on Android. - A mount that removes its own anchor: detaching removes the end pin in the same mount that opens the tapped disclosure, and the offset jumped by the removed view's frame. The subclass keeps the offset when the anchor's tag is no longer registered, the check React Native 0.88 adds in https://github.com/react/react-native/pull/57294. That PR's extra superview check is not copied because it skips anchors detached by removeClippedSubviews (https://github.com/react/react-native/issues/58910). - A shrink at the end: UIKit clamps the offset to the new end during the mount, then React Native adds the anchor's movement, so a turn folding while following landed above the end (https://github.com/react/react-native/issues/58578). The subclass restores the pre-mount offset for the adjustment and clamps after it, as https://github.com/react/react-native/pull/58695 does. The dev client was rebuilt with the module. Verified on the iPhone 16 Pro simulator, frame by frame: the summary far up and the latest turn's summary while following each keep the trigger at 0 px with one layout change per toggle, the todo card the same, the cold open lands still, older history pages keep the visible rows in place, and the keyboard, send-time shrink and streaming stay pinned to the end. Freshly mounted markdown on iOS paints one frame after its layout, because enriched-markdown renders asynchronously (https://github.com/software-mansion/enriched-markdown/issues/1131). A synchronous first render removed that frame but raised fling frame time at p90 and p99, so it is not part of this change. docs/agent-stream-disclosure.md now describes the clamp correction on both platforms. * Keep the rows under the finger at a drag's start and its release Two one-frame row movements remained around a user scroll while the timeline streams. A drag's first frames. The end pin stays mounted until JS stops following, one round trip after the drag begins, so a line mounting in those frames scrolled the rows under the finger by its height. Both scroll view subclasses now skip the content-position correction while the user drags and the anchor is the end pin, which they recognise by its native ID ("paseo-end-pin"). Android overrides scrollToPreservingMomentum, the position keeper's only scroll call, from the begin-drag event until the finger lifts; iOS skips the adjustment while the scroll view is dragging. The skip is limited to the pin: LegendList's own anchoring for the detached list also uses the native correction, and a history page landing mid-drag needs it. It starts at the drag rather than at touch-down: a tap or long press while following would otherwise leave the list stranded short of its end, still following, once the finger lifts. The release. A gesture ending within 32 pt of the end re-stuck with an instant scroll, a snap of up to 56 px. Following now resumes only when the finger lifts at or past the end, or momentum stops there, within 1 px, the distance web resumes at (strategy-web.tsx). Anything else stays detached with the pill. The check runs when the gesture is decided, so output that arrived below meanwhile counts. A release past the end counts as at the end: on iOS it bounces back, and a line landing during the bounce scrolls in as following would. endUserScroll takes isAtEnd, like releaseDisclosure. Tests: VisibleContentPositionClampTest gains growth at the end during a drag (red before the change: the offset moved by the 120 px growth, 352 -> 472) and growth without a touch (the pin still follows); the module suite passes on emulator-5558, 11 tests. bottom-anchor-controller.test.ts: a release near but short of the end stays detached. Device, frame scans while streaming (dev clients rebuilt): - Android, 8 slow drags with a pill tap between: no frame moves against the finger once a drag starts; the stream follows between drags. Three short releases 50 px short of the end stay put until the pill; three drags back past the end resume following. - iOS simulator, 6 drags: no line step during any drag or its momentum. Two short releases stay detached with no snap; three drags past the end resume following within 0.5 s of the bounce. * Document the LegendList timeline and remove what the inverted list left The native section of docs/agent-stream-disclosure.md described the FlatList hold (anchor neighbour, native child index, frame spacing, render window). It now covers why the timeline is forward order, who owns the offset in each state, the hold and its sync layout trigger, user scroll and release, draw distance numbers, the LegendList patch and the scroll view corrections. Draw distance stays at 2000. The spike measured it on a chat with a 15,000 px turn expanded: 500 blanked the viewport 1.0 to 1.5 s per fling and 2000 not at all. A re-measure on the collapsed chat (500, 1000, 1500, 2000, interleaved) blanked at no value and its jank followed host load, which stayed between 19 and 40, so it could not separate 1000 or 1500 from 2000. The patch file now opens with a header listing its eight hunks by purpose and linking LegendApp/legend-list#593, which reports each one upstream. The markdown doc records the iOS first-paint delay (software-mansion/enriched-markdown#1131). Removed with the inverted list: PaseoScrollView's child-reveal override (a no-op without the inverting transform) and ScrollSelectionTest, the invertedWrapper style, and the inverted-list passages in android.md, native-text-selection.md, mobile-testing.md, floating-panels.md and agent-stream-performance.md. model.test, layout.test and footer-spacing.test still asserted the inverted native order and failed; they now assert forward order, and footer-spacing uses the real strategies instead of an inverted stub. * fix(app): show a reply's footer when the next prompt arrives on native LegendList re-renders a mounted row only when its item or extraData changes. When a new prompt arrives, the previous reply's footer moves from the live auxiliary slot into that reply's layout item (completedFooter). The reply's StreamItem keeps its identity, and renderItem is a stable event, so the row never rendered its new layout and the footer (copy, timing, fork) disappeared until the row remounted. FlatList had the same gap. The history renderer is now LegendList's extraData. Its identity changes with the history layout map, and StreamRow's memo limits the pass to rows whose layout item changed. * test(app): run the web disclosure hold cases in a real browser The three hold cases simulated layout in jsdom: hand-written row heights, scroll clamping and resize callbacks. They could pass while Chromium paints the trigger somewhere else. They now run in Vitest browser mode with real layout, ResizeObserver and scroll clamping. The two hold cases fail when the hold is bypassed. The browser project pre-bundles @tanstack/react-virtual, so its first import no longer reloads the test mid-run. The lucide stub gains ArrowDown, which pane-find imports. * fix(app): let a drag end a disclosure hold on native A drag detached the bottom controller but kept the disclosure hold. Every item size change restarts the hold's quiet frames, including a streaming row's, so the hold can outlive the toggle. While it lasts, shouldRestorePosition accepts only the held row. Once the drag scrolls that row away, a history page arriving mid-gesture gets no anchor, and the rows the reader was on move by the page's height. The drag now cancels the hold without releasing it. The controller keeps no hold state of its own beyond detached, and the gesture's end decides whether following resumes. * perf(app): keep the scroll-to-bottom button's state out of the timeline Opening a tool call or turn at the end of the chat now holds its trigger in place, so the timeline detaches and the scroll-to-bottom button appears. That visibility was useState in AgentStreamView, so showing the button re-rendered the whole timeline view for a change only the button reads. The viewport now writes near-bottom into a per-agent store that only the button subscribes to. * fix(app): show the scroll-to-bottom button on native whenever following has stopped A gesture now resumes following only when it ends within 1 px of the end, but the button still hid within 32 px. A release 2-32 px short of the end left the list detached with no button to return. While detached the button now hides only at the end; while following it keeps the 32 px tolerance so content growth that the offset trails for a frame does not flash it. The button also updates when following starts or stops without a scroll. * fix(app): stop the timeline jumping when the keyboard opens or closes on native The keyboard's settled height was committed to the list after the motion, as paddingTop on Android and contentInset.top on iOS, to keep the top of the history reachable under the translated dock. While following, the end pin absorbed it in the same mount. While detached or holding a disclosure, nothing did: Android's native anchor is LegendList's ScrollAdjust view, which padding does not move, and LegendList compensates a padding change only on iOS. Every row jumped by the keyboard height 0.2-1 s after the keyboard settled, and back after it closed. On send, the same commit raced the jump to the end. The keyboard now only translates the list with the composer. The cost: while the keyboard is open, the composer viewport clips the top keyboard-height of the list, so the start of a short conversation is hidden until it closes. * chore(app): describe the native timeline as LegendList in stream comments * fix(app): keep a disclosure's trigger in place when its row is cut off at the top on native LegendList's idsInView starts at the first fully visible row. When a turn host's prompt bubble sat above the viewport, a disclosure hold found no anchor in the data pass (shouldRestorePosition rejects every other row), and the size pass anchored on the row below the host instead, so the trigger moved by the host's size change. The patch appends the partly visible rows to idsInView after the fully visible ones, so the held row anchors while every pass that does not restrict the anchor keeps the first fully visible row. The browser test renders the patched native build, which vitest now aliases instead of the package's unpatched web build. * fix(app): let a turn's summary line collapse again after it opens The React Compiler cached StreamRow's `renderStreamItem(layoutItem)` on the layout item and the renderer. The revised item that useRevisedHistoryRows hands a row whose display state changed only fed the row id, so the row reused its cached content. Opening a turn usually inserts its rows directly below the host, which also gives the host a new layout item. When another row sits between them, such as a compaction marker, the host kept its layout item, its summary line stayed collapsed, and every later tap asked to open the turn again. The renderer now takes the item it renders, so the compiler's cache keys on the revision. StreamRow moves to its own module, which the tests compile the way Expo does. * test(app): alias the patched LegendList build in browser tests only Unit tests load @legendapp/list outside Vite, so the native build's react-native import skipped the react-native-web alias and reached React Native's Flow source, failing every unit suite that imports the native strategy. * fix(app): keep a size-only disclosure's trigger in place when its row is cut off at the top on native LegendList's prepareMVCP picks the anchor for a size change with no data change as the first row in view, without asking shouldRestorePosition. A disclosure that only grows its own row (a todo card) while that row's top was above the viewport therefore held the row below it, and the trigger moved by the row's size change. The patch now applies shouldRestorePosition to size changes as it already does to data changes. * test(app): render the timeline row revision test in a real browser The repo's unit tests do not mount components in JSDOM. The test still compiles stream-row.tsx with the React Compiler, so it fails when a revised row ignores the item it was handed.	2026-11-04 17:21:31 +07:00
4 people	1c4400194a	Support hardware keyboard shortcuts across native and desktop apps (#8625) ... * feat(keyboard): support hardware keyboards on iPad Register app shortcuts as iOS UIKeyCommands so a paired hardware keyboard drives the same bindings as web and desktop. Overlays (menus, comboboxes, modals, command center) get first refusal on bare keys, and a focused terminal keeps the keys it needs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(keyboard): record iOS hardware key observation spike With a UITextView focused on iPad Pro M4/iOS 18.6, window and controller observers received Cmd+B, Cmd+P and Escape. Escape also invoked UIKeyCommand when registered, so the stream must be the sole emitter. Use observation for shortcuts and commands only for text-control ownership. Simulator intercepted Cmd+K as HID184; input capture blocked synthetic typing entirely. Keep capture off and verify the toggle via a rebind during simulator QA. * refactor(keyboard): give overlays one key registration API Overlay ownership now follows one layer-ordered registry on every runtime. Web retains focus trapping and restoration through its adapter; native registers the same key handler without a DOM scope. Picker navigation and dismissal no longer require a parallel native stack. Co-authored-by: jeroenfrenken <16974549+jeroenfrenken@users.noreply.github.com> * feat(keyboard): route native hardware keys through the shared resolver Observe each physical press once, including native modal windows, and derive focus from declared composer and terminal surfaces. Native bindings and rebinds now use the same resolver and overlay precedence as browser and Electron input. Co-authored-by: jeroenfrenken <16974549+jeroenfrenken@users.noreply.github.com> * feat(keyboard): show shortcuts when hardware keyboards are present Keep routing independent of compact layout and detect hardware capability for hints and settings. Rebind capture uses the shared overlay interface on native too. Keep the filtered sidebar model available for keyboard navigation while its panel is hidden. Co-authored-by: Les Stroud <public@lesstroud.com> Co-authored-by: jeroenfrenken <16974549+jeroenfrenken@users.noreply.github.com> * test(keyboard): allow shortcut hints in compact menu assertions Compact menus now display hardware keyboard hints. Assert action labels, order and uniqueness without treating a trailing shortcut badge as part of the action label. * fix(keyboard): retain an overlay's opening layer in state Capture the registry's current top when an overlay opens and retain that layer through rerenders. React Compiler removed the previous useMemo cache after the registry getter moved across modules, allowing a parent modal to rise above its child and start an infinite focus loop. Compile this hook in Vitest as Expo does. The new hook regression failed first with layer 220 instead of 20, then passed with explicit opening state. Focused unit and browser tests pass, and the previously failing onboarding E2E completes through the real Expo compiler. Typecheck, lint and format pass. * refactor(keyboard): let overlays own native hardware input Remove the TextInput key handlers that duplicate declared overlay arrows and Escape in Add Project and Command Center. Remove Add Project's hidden responder now that native window sources observe keys without it. Keep soft-keyboard submit editing behavior. * fix(keyboard): close Add Project outside its state updater Root Escape previously called the parent close action from a React state updater, producing a cross-component render warning when navigation was still queued. Compute the previous page in the event handler and close outside the updater. The existing Escape/Back E2E now batches navigation and dismissal through the DOM key source. It failed first with the AddProjectFlowHost render warning, then passed after the correction. Typecheck, lint and format pass; native Escape checks pass on Android and iPad. * fix(keyboard): preserve Android dead-key composition * fix(keyboard): recognize focused native text inputs * test(keyboard): replace JSDOM coverage with browser tests * refactor(menu): spell out arrow navigation branches * fix(composer): claim fullscreen Escape on native * refactor(composer): one fullscreen Escape module for every platform The shared registration lived in fullscreen-exit.shared.ts with two one-line re-exports (fullscreen-exit.ts and fullscreen-exit.native.ts). Metro needs no native override now that the Android back button is its own adapter, so the implementation moves into fullscreen-exit.ts and the browser test imports the module every platform resolves. --------- Co-authored-by: Ubuntu <jeroenfrenken@icloud.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: jeroenfrenken <16974549+jeroenfrenken@users.noreply.github.com>	2026-11-03 18:08:27 +07:00
Mohamed Boudra	336e7d1b89	Add first-run setup that walks new users through Paseo (#8363) ... * feat(app): add first-run setup modal New users landed on an empty "Add a project" screen and never found providers, Paseo tools or phone pairing, which all live in Settings. A one-time setup modal now walks them through Appearance, Providers, Projects, Orchestration and Phone. Every step renders the same component Settings uses, so changing something in setup changes it in Settings too. The modal opens only when the setup host is connected, its workspaces have loaded and it has no projects. Existing users already have projects, so they never see it after upgrading and no migration is needed. Finishing or skipping writes `@paseo:onboarding` on this client. It uses its own key because it records feature state, and e2e specs replace app settings wholesale. Settings > General > "Show setup again" reopens the modal on step 1. Native phones skip the modal for now. Shared pieces moved out so setup and Settings render the same thing: - ThemePicker is a tile grid and replaces the Settings theme dropdown. - PaseoToolsCard is extracted from the host page. - The skeleton pulse moves to components/ui. Provider rows show it while the first snapshot loads instead of "Loading…". - The pair-device direct-connection hint links to the Tailscale docs. The e2e fixture marks setup completed by default so existing specs keep their starting state. The desktop smoke and lifecycle scripts, which start from a fresh daemon, mark it before they continue. * feat(onboarding): suggest projects from agent history The setup's Projects step lists the repos the user already ran agents in, with busy recent ones preselected, so a new user adds their projects in one click instead of browsing for folders. With rows checked, the footer's main button adds them and only moves on once every one was added; a checked row always means "this will be added". The daemon resolves each session folder to its project root (main checkout for worktrees, repo root for subfolders) because only it can read the git state; the app asks once per provider so a slow or broken provider never holds up the others and can be retried on its own. Hosts without the projectSuggestions feature show only the Add project button. Onboarding e2e hosts read an empty Claude history with other providers off, so suggestions never depend on the machine running the tests. * fix(onboarding): keep late project adds on their step and show Retry early - A finished add only advances setup while the Projects step is still open. - A failed provider shows its Retry as soon as any provider answers. - The desktop lifecycle check no longer reloads the window: setup never opens there because no host is connected. * fix(onboarding): bind late project adds to their step visit and freeze rows while adding - Each step visit has an id; a finished add only advances the visit that started it, so leaving and returning to Projects, or reopening setup, ignores it. - Suggestion rows are disabled while their batch is being added. * test(app): drive theme selection through the tile picker Settings → Appearance no longer has a theme dropdown. The Escape test opens the syntax theme dropdown instead, and the Android system-bars check taps theme tiles. * fix(server): return project suggestion roots in the form project.add stores Git reports Windows repo roots with forward slashes, so an added suggestion kept showing because its path never matched the new project's root. * feat(app): two control sizes, orchestration switches and mobile connect choices in setup Controls had four sizes picked per call site, so a button in a dialog, a settings row and a setup step came out at different heights. Controls now have two: md (default; 32px with a pointer, 44px in the compact layout so phone controls are full touch targets) and sm (28px, for tight chrome and nested settings rows). The breakpoint picks md's height, not the caller. Setup: - Orchestration is three switches (Paseo tools, agent skills, CLI), all on, applied on Continue. Turning one off undoes it; the desktop CLI uninstall removes only the file this app installed. - The Mobile step has store buttons and a "Choose how to connect" section: Relay opens the existing pairing modal, Tailscale opens the docs. Settings section docs links are one pattern, SettingsSection's `link` prop, and modals sit on surface0 like a screen. The vitest unistyles stub now resolves breakpoint values by window width, as Unistyles does at runtime; without it md controls had no height in browser tests. * fix(app): finish setup on its last step and confirm undoing orchestration In the compact layout Orchestration is the last step, and Finish closed setup without applying its switches. The last step's work now runs before Finish, the same as Continue. Turning off skills now asks first, as Settings does. Removing the CLI keeps a paseo command this app didn't install and says so. A failed Paseo tools update shows a toast. Adding suggested projects no longer advances when a row was checked while the add ran. Chat sender attribution and the message preview toggle go back to the sm button: md padding is a breakpoint value, and on web its media-query rule beat the zero right padding that aligns the sender with its bubble. * fix(app): ignore a late Finish once the user left the last setup step Finish called complete(), which ignored the step visit, so pressing Back while Orchestration applied its choices still closed setup and recorded it as done. next(visit) now finishes setup from the last step, so a late Finish is dropped the same way a late Continue already was. * fix(app): hold the skills switch while setup applies its choices The Paseo tools and CLI switches were disabled while Continue or Finish applied them, but the skills switch only locked while a skills operation ran. With skills needing no change, it stayed editable during a pending tools update and the new value was silently dropped. * fix(app): read setup's skills choice as off when no skill is picked Saving an empty selection in the skills picker left setup's skills switch on. Continue then asked the host to install nothing, the host reported skills as not installed, and the step stayed put with no error. Setup now reads skills as off with nothing picked, as Settings does.	2026-11-03 10:28:26 +07:00
Mohamed Boudra	d4ac64f335	Let plugins stream live events and binary data to the app (#8527) ... * feat(plugins): stream events and bytes between plugins and the app Plugins can declare a subscription with defineSubscription, handle it with server.handle(contract, (input, { push, signal })), and listen from a surface with useSubscription or client.subscribe. A top-level Uint8Array in an event, an RPC output, or an RPC input crosses the wire as a binary frame (opcodes 0x20-0x2f) without JSON or base64; a nested one fails validation on the sender. Each subscriber runs its own handler, owned by the session that subscribed, so release, disconnect, plugin stop and reload need no plugin code. The runtime buffers pushes until the subscribe response has gone out, so a client never sees an event for a subscription it does not know yet. Gated on server_info.features.pluginSubscriptions; binary outputs reach only clients that advertise plugin_binary_payloads. * fix(plugins): close subscription gaps found in review - Losing daemon.manage now releases the session's plugin subscriptions; binary events bypass the outbound permission check, so streams would otherwise outlive the revocation. - A subscribe that times out sends unsubscribe, since the plugin may still start the handler after the daemon gave up. - The byte limit leaves room for the largest frame header and routing, and lives in assertPluginWireValue so events, outputs and inputs share it. - A release right after the host accepted keeps `ready` resolved, so a handler that returns at once reports closed rather than an error. - Session trace logging tolerates loggers without isLevelEnabled. * fix(plugins): withhold binary plugin results after plugin access is revoked A binary RPC output or event skipped the outbound permission check its JSON form passes, so an RPC in flight when daemon.manage was revoked still delivered its bytes. Each frame now checks the permission of the JSON message it stands in for. * test(plugins): cover subscriptions in a real browser instead of JSDOM The app subscription tests mounted hooks in JSDOM, which docs/testing.md rules out. The adapter and contract behavior is now a plain unit test, and a Playwright spec drives the diff-watch and media-stream examples: JSON events following file changes, streamed bytes, and an upload. * test(plugins): add the plain subscription unit test and the browser spec * fix(plugins): apply subscription schema transforms once Both ends parsed each subscription value, and the sender sent its parse output, so the receiver parsed a schema's output as fresh input. An event schema like z.string().transform((s) => s.length) closed the stream as invalid. The sender now validates and sends the value as given; the receiver's parse produces what the handler or callback sees. * fix(plugins): parse a subscription's input once in the plugin process server.handle wrapped subscription handlers in a second input parse, so a transforming input schema rejected its own parsed output before the handler ran.	2026-11-02 14:10:15 +07:00
paseo-bot[bot]andOuyang Xingyuan	0e5bcbd9f5	fix(app): open relative chat links inside nested repositories (#8361) ... * fix(app): open a nested-repo file when the workspace-root path is missing A workspace that contains another git repo often gets paths written relative to that nested repo. `schema/x.md` is really `repo-a/schema/x.md`. A markdown link was joined onto the workspace root and opened a missing file. Inline code already asked the daemon for a suffix match. Resolved workspace-relative paths that contain a slash now use that same lookup before opening. An exact hit stays on the original path. A suffix hit replaces it and keeps the line range. A failed lookup still opens the original path. Bare names, absolute paths, and `~/` paths are unchanged. Example: - Input: workspace `/repo`, link `schema/x.md`, file at `repo-a/schema/x.md` - Before: open `/repo/schema/x.md` (missing) - After: open `/repo/repo-a/schema/x.md` * fix(app): preserve explicit destinations when finding nested files Relative chat links can name a file inside a nested repository. Retain the suffix lookup while using the original href and document base to preserve absolute paths, preview links, and folder destinations. Co-authored-by: Ouyang Xingyuan <galaxyroaming@qq.com> * fix(app): keep network share links on their absolute destination Use the shared absolute-path classifier so network share hrefs retain their destination alongside drive and POSIX paths. * fix(app): keep nested-file lookup inside ordered path opening Resolve the original directory before considering suffix matches, and allocate click ordering before asynchronous lookup. The existing opener now owns the complete operation so a slow earlier click cannot replace a later selection. * test(app): load UI modules before test lifecycle hooks Cold module transformation exceeded the lifecycle hook deadline before these suites could run. Complete module initialization before registering the tests, retaining their assertions and timeout settings. --------- Co-authored-by: Ouyang Xingyuan <galaxyroaming@qq.com> Co-authored-by: paseo-bot[bot] <266920839+paseo-bot[bot]@users.noreply.github.com>	2026-10-31 11:05:06 +00:00
Mohamed Boudra	eee70e7fef	Show a lone tool call as itself and group from the second call (#8109) ... * fix(app): show a lone tool call as itself and group from the second call A run of one tool call or thought renders as the call. When a second call arrives the row becomes a group that keeps the first call's id, so the row key stays put. Tool call and group open state move into a per-agent store: opening a lone call also opens its future group without notifying the timeline, so a click re-renders only that tool call. * test(app): cover lone tool calls turning into groups Desktop journeys check that an opened lone call keeps its details open inside the new group, that clicking it renders no timeline component, and that the group header lands where the call was. Compact covers the call sheet and a closed group.	2026-10-28 16:34:58 +07:00
Mohamed BoudraandClaude	25721c7847	fix(app): keep grouped reasoning closed when Expand thinking is off (#8042) ... Thoughts are grouped with tool calls only while Expand thinking is off, yet opening a group rendered each thought with `defaultExpanded`, so the reasoning text popped open against the setting. Grouped thoughts now open like any other call: a closed Thinking row the reader clicks. The folded history also treated the latest retained turn as live whenever the agent was active without a known turn id, which unfolded the previous turn until the new turn's rows arrived. Without head rows, the latest turn stays live only while the active run is that turn. Co-authored-by: Claude <noreply@anthropic.com>	2026-10-27 22:34:13 +07:00
Mohamed Boudra	1b8dbc38ab	fix(app): preserve chat reading position across older pages (#8026) ... * fix(app): preserve reading position when older turns fold Item-based history pages can complete and collapse the row at the reading position. Transfer its anchor to the folded turn host so reaching history start does not drain older pages. Also omit reasoning from action summaries and align sender attribution with its message bubble. * fix(app): preserve the reader when older pages extend tool groups Resolve grouped calls and folded turns through one presentation-owned row lookup. Keep retained group indexing off the streaming path and verify item-page group replacement against its failing baseline. * fix(app): preserve message previews when opening turns Keep the wrapper child structure stable so React does not remount the message fragment when the indent rail appears. Remounting reset preview measurements and briefly removed the fade and Show more control. * fix(app): separate show less from expanded message text	2026-10-27 19:25:13 +07:00
paseo-bot[bot]andJacek Tomaszewski	a8032a1502	fix(app): open outside folder links without breaking Files (#7726) ... Outside folder links were routed to the workspace-scoped Files explorer, which kept an access error until Retry. Route explicit outside folders to the local file manager or show an outside-workspace message, while preserving existing file and inside-folder behavior. Refs #7513 Co-authored-by: paseo-bot[bot] <266920839+paseo-bot[bot]@users.noreply.github.com> Co-authored-by: Jacek Tomaszewski <jacek@fullstack.house>	2026-10-27 10:57:58 +00:00
Mohamed Boudraandluke	ef58ace424	Fix history compatibility and turn presentation regressions (#8010) ... * fix(client): preserve history loading on older hosts Whole-turn paging is optional, but requiring its capability blocked existing history reads before any request was sent. Negotiate the paging enhancement at the client boundary while preserving item-based requests for older daemons. * fix(app): preserve row ownership during late turn updates Late lifecycle events retagged the newest row even when they updated an earlier call, causing the next update to append a duplicate tool ID. Assign turn membership only to rows written by the event before finalizing unrelated reasoning. Co-authored-by: luke <luopeihuan@gmail.com> * fix(app): preserve reasoning continuity and turn expansion controls * fix(app): hide reasoning inside collapsed turns --------- Co-authored-by: luke <luopeihuan@gmail.com>	2026-10-27 15:49:42 +07:00
Mohamed Boudra	b12eefb28f	Keep conversation turns distinct and history stable (#7990) ... * fix(app): keep autonomous turns distinct and readable Hidden system prompts merged autonomous work into the previous response and reopened completed turns. Preserve canonical turn boundaries and expose their triggers, while making received messages attributable and expanded turn details readable in one step. * fix(timeline): mount history at actual run boundaries * fix(timeline): load and retain complete available turns * fix(app): summarize actions and preserve conversation events * test(timeline): verify whole-turn paging stays responsive * fix(app): group reasoning according to thinking preference * test(app): align history journeys with whole-turn loading	2026-10-27 13:57:17 +07:00
Mohamed Boudra	78a3083fea	perf(app): avoid stream updates in hidden chats (#7901) ... Retained chats already preserve their last visible transcript. Keep their stream-tail selection stable while inactive so incoming chunks do not schedule React work; reveal reads the current model tail.	2026-10-26 13:49:56 +07:00
5 people	4bbacfed46	feat(app): fold finished agent turns behind a summary line (#7785) ... Long agent turns bury the answer under intermediate messages, thoughts and tool calls. A new Chat display preference (Full / Collapse tool calls / Collapse turns) replaces the tool call detail level. Collapse turns folds everything a finished turn did before its final message into one summary line under the prompt; opening it shows those rows inline behind the same indent rail that expanded tool call groups now use. Expanded turns stay real timeline rows so virtualization, chat find and scroll-to-message keep working; find and outline jumps open the turn that holds their target. Opening or closing a turn stops following output so the summary stays under the pointer. Collapse turns is the default for new installs only. Existing settings were materialized on first launch, so stored blobs without the new field map from the legacy tool call detail level and otherwise stay on Full. Co-authored-by: Ready <127541578+akaready@users.noreply.github.com> Co-authored-by: Waishnav <86405648+Waishnav@users.noreply.github.com> Co-authored-by: Shreyan Dey <90114886+Dey11@users.noreply.github.com> Co-authored-by: Sebastian Parfitt <7753735+Sebeb@users.noreply.github.com>	2026-10-26 10:50:16 +07:00
Mohamed Boudra	30464cf234	Translate plugin content and labels in each app language (#7478) ... * feat(website): serve paseo.sh in Simplified Chinese Every page of the website now has a Simplified Chinese version under /zh-CN: the interface, docs, blog posts, comparison pages, legal pages, all changelog releases and the homepage mockup. English URLs are unchanged. The URL alone decides the language. There is no browser-language redirect and no stored preference, because either would have to redirect the unprefixed English URLs that people share and search engines index. Internal links carry the page's language instead, and hreflang alternates point Chinese search results at /zh-CN. Translated headings pin the English anchor with {#id}, so section links work in both languages. content-translations.test.ts fails when a page has no translation or a translation's headings drift from the English. Changelog releases and plugin listings without a translation render whole in English under a notice, so a release never waits on one. Plugin manifests and the registry gain optional translations and OVERVIEW.zh-CN.md fields; older clients and registries ignore them. * feat(website): replace the native language select with an EN/ZH menu The header showed an OS-native select whose popup did not match the site. The trigger now shows the language abbreviated (EN, ZH) and opens a menu in the app's dropdown style that names each language in itself, with its name in the page language underneath. Rows are real links to the same page in that language; arrows, Escape, outside presses and taps behave as a menu button, and the menu keeps itself on screen when a narrow header pushes the trigger toward an edge. Also drops the stray space after the full-width comma in the Chinese homepage subtitle. * docs(website): translate main's new docs and 0.12.0 release notes Main added Keep run workspaces to the schedules docs, rewrote plugin icons around inline SVG, and promoted 0.12.0 with new entries. Bring the Chinese pages and changelog in line so no section falls back to English. * fix(server): leave plugin listing translations to the registry The daemon rejected manifests whose translations the registry would refuse, so a plugin main installs could fail to load here. Paseo never reads translations; the registry validates them at publish. Docs now say which checks are automated at publish and which are human review. * docs(plugins): describe the registry's final overview translation discovery * style(server): format manifest test * feat(plugins): translate plugin UI in each app language Keep translation resources and subscriptions inside each installation. Resolve host labels against the presentation locale so live language changes preserve mounted drafts and RPC state. Existing descriptor types retain string defaults for source compatibility. * test(plugins): dismiss developer chrome in second translation client * test(app): measure sidebar rows one at a time After a reload the developer error toast appears while expectVerticalOrder measures every row at once. Each concurrent boundingBox runs the toast locator handler, and only one of them resumes, so the poll timed out on every attempt since #7424. Measuring sequentially keeps one action in flight. * test(app): return sidebar row measuring to main #7480 hides the developer toast instead of running a locator handler, so measuring the rows concurrently no longer races it. Reverts 41ac23016. * test(app): wait for the compact shell before opening compact Changes The shell survives the breakpoint, so right after the resize the wide Explorer could still be visible: the test skipped the Explorer toggle and the tab then disappeared, or toggled at the wrong time. Wait for the compact-shell marker, as the composer helpers do since #7424. * docs(website): translate main's plugin file panel docs	2026-10-21 13:40:46 +07:00
Mohamed Boudra	adf27de7d0	Keep Explorer consistent across phone, tablet and desktop layouts (#7424) ... * Upgrade to Expo 57 and unify Explorer across layouts * feat(app): retain Explorer across layout and appearance changes Keep one workspace Explorer host and destination-aware navigation so folding, theme updates and compact sheets preserve the current panel. Scope pull request discovery and timeline demand to active surfaces. * fix(app): keep Explorer resize handles stretched through the dock The shared frame moved the divider into an absolute column, leaving its horizontal handle without height. Restore the row so pointer drags reach it, preserving the existing resize and performance contract. * fix(app): keep Explorer drag widths out of the shared stylesheet Carry the existing inline sizing policy into the shared frame so pointer previews do not accumulate CSS rules. * fix(test): align isolated test runtimes with Expo 57 Hoisted React consumers need the matching DOM renderer at the repository root. Automated Metro processes must not install native DevTools into disposable homes, and development toast overlays must not cover compact actions. Keep Explorer journeys on the shared host and synchronize setup fixtures on daemon output rather than a one-second file-marker window. A delayed real child start reproduces the readiness failure on every platform. * fix(test): await retained shell layout after composer resize The gesture host now stays mounted across breakpoints, so its presence no longer identifies compact layout. Report the current layout on the retained host and synchronize composer journeys with that state. * fix(app): preserve browser interactions in retained workspace hosts Initially disabled gesture hosts still registered pointer and wheel listeners, while hover cards used window positions inside a workspace-local sheet portal. Respect initial gesture enablement and position cards relative to their measured floating host. Keep developer-toast dismissal independent of pointer input and replacement toast visibility so modal, hover, and focus checks retain their input state. * fix(test): share developer toast handling with Electron browser runs The standalone Electron browser runner bypassed the browser fixture, allowing developer errors to cover Settings. Use the same non-pointer dismissal in both runners while retaining their console logs.	2026-10-20 11:59:49 +07:00
paseo-bot[bot]andStephen Holiday	dc7bed417a	Keep late composer pills clear of completed turn actions (#7341) ... * fix(app): keep composer tracks clear of timeline footers * fix(app): preserve detached scroll on overlay mount * style(app): use object input for overlay anchor policy --------- Co-authored-by: Stephen Holiday <stephen.holiday@gmail.com> Co-authored-by: paseo-bot[bot] <266920839+paseo-bot[bot]@users.noreply.github.com>	2026-10-19 00:08:37 +02:00
Mohamed Boudra	9521ee9955	feat(app): label Paseo tool calls verb-first with their context (#7283) ... Paseo tool rows put the variable part first ("QA messenger finished"), so truncation hid the fixed part, and MCP calls showed only the humanized tool name with no context. Every Paseo tool now has one catalog entry in protocol/paseo-tool-presentation owning its fixed label, the input field shown as context, and its detail layout. Agent-message events read noun-first ("Agent finished" + sender) and use the Paseo icon; the app ignored it before because the wire detail's legacy "bot" icon won. Summaries are capped in code at 120 characters because prompts can be one enormous line; the renderer is not trusted to clip them. The activity curator behind `paseo logs` and get_agent_activity printed a bare "[Agent message]" because the server tool-call type never declared the agentMessage field the projection sets; it now prints the event, sender, and body.	2026-10-18 13:10:09 +07:00
Mohamed Boudra	bd5061e7bd	fix(app): stop blank rows while scrolling tall Android chats (#7278) ... Two causes, both reproduced on a clone of a real long thinking-partner chat (replies and thinking rows several screens tall, GFM tables). 1. The window lowered in e42771970 (initial 2 / batch 2 / window 5) holds only two or three tall rows, so a fling outruns the mounted range and the viewport crosses unmounted rows: 65 blank frames over a 4,152-frame traversal. Keep the small initial render that bounds cold-open measurement, but refill a window of 10 in batches of 10: 0 blank frames over 4,347, p95 25 ms. 2. Scroll-to-bottom from deep history animated across every row in between, which no finite window can mount in time: 9 blank frames (~150 ms) per jump. Animate only when the current offset is within the bottom-side overscan, otherwise jump instantly. Near-bottom jumps still animate. Web already does not animate this jump. Cold open on the same chat is unchanged (first content 569 -> 568 ms); the deeper window costs first-scroll acknowledgement (2.58 -> 2.94 s in a debug build).	2026-10-18 13:05:33 +07:00
paseo-bot[bot]	b2da58b5bf	fix(app): keep chat keyboard scrolling after closing Find (#7263) ... Closing Find focused its non-scrolling wrapper, leaving Page Up and Page Down unable to move the feed. Return focus through the viewport handle while preserving the reading position. Co-authored-by: paseo-bot[bot] <266920839+paseo-bot[bot]@users.noreply.github.com>	2026-10-18 01:51:49 +02:00
paseo-bot[bot]anda-grasso	e2ad26d238	Find source-message text in plugin timeline rows (#7253) ... * fix(app): find text in rows a timeline plugin draws Chat find located a replaced message by its source id but counted matches only inside elements marked as message text, which a plugin renderer never sets, so a replaced prompt or reply reported no matches. Mark plugin rows and search the whole row, with each view bounding a match. * docs(plugins): qualify search in replacement timeline rows Chat find discovers source-message matches before inspecting a replacement renderer. Document that renderer-added text is not independently indexed. Co-authored-by: a-grasso <antonino.grasso@device-insight.com> * fix(app): find visible text within contiguous plugin blocks A whole-row walk counted closed popover text and reunited text before and after nested blocks. Keep consecutive block groups and exclude plugin text the browser is not drawing. --------- Co-authored-by: a-grasso <antonino.grasso@device-insight.com> Co-authored-by: paseo-bot[bot] <266920839+paseo-bot[bot]@users.noreply.github.com>	2026-10-17 21:58:07 +02:00
paseo-bot[bot]andMoy	fa70b215a8	Open chat folder links in Files with their contents visible (#7205) ... * fix(app): open folders from inline path links in the file explorer Clicking a folder path in an assistant message opened a file tab that failed with "Requested path is not a file". Extension-less workspace-relative paths without a line number are now probed with a directory listing before opening: directories open the Files explorer navigated to that folder, everything else opens as a file like before. Lexical directories (trailing slash, workspace root) now navigate the explorer to the folder instead of only preloading its listing. * fix(app): reveal linked folders and their contents Resolve workspace folder links from directory metadata and expand their ancestor paths in Files. Preserve file and line-reference opening, including extensionless files. Co-authored-by: Moy <moyfoxther@gmail.com> * fix(app): cancel stale path opens and reveal hidden folders Keep pending directory checks inside the path-opening model so a later click or navigation supersedes them. Explicitly revealing a hidden directory also enables the existing hidden-file visibility preference. --------- Co-authored-by: Moy <moyfoxther@gmail.com> Co-authored-by: paseo-bot[bot] <266920839+paseo-bot[bot]@users.noreply.github.com>	2026-10-17 09:53:28 +02:00
xzthemeofsss	d152f1529f	fix(app): recover failed question responses (#7098) ... * test: reproduce failed question response recovery * fix: show question response failures and allow retry	2026-10-16 22:12:05 +02:00
Mohamed Boudra	eb1a8a2ec7	fix(markdown): one renderer on react-native-enriched-markdown for iOS, Android and web (#6973) ... * fix(app): group native assistant prose into selectable runs * fix(app): render selectable native prose with enriched markdown * docs: explain native prose selection boundaries and tradeoffs * fix(app): preserve markdown semantics and render limits in prose runs * docs: record native prose compatibility fixes and heading limits * fix(app): allow additive task lists and admonitions in native prose * fix(app): preserve inline image formatting and reference scope * fix(app): preserve markdown source and file actions in native prose Prepare original source blocks with source-position edits from the assistant parser. Keep reference scope and live/history projection consistent, and retain link text when dispatching workspace file actions. * fix(app): preserve native prose entities and links while bounding preparation cost * fix(app): preserve provisional syntax at cached reveal boundaries * fix(app): bound prose append work and preserve markdown edge cases * fix(app): preserve home paths and normalized prose links * fix(app): preserve parser-owned links and streaming tilde tails * fix(app): keep growing markdown on the streaming block renderer * fix(app): preserve bracketed IPv6 links in native prose * fix(app): skip prose classification for blocks over the render cap * fix(app): share selectable native prose across Markdown surfaces * fix(app): preserve Markdown containers before grouping prose * revert(app): remove shared prose-run renderer changes Reverts ab4737bb2 and ac47e1063 before replacing the Markdown engine across all platforms. * feat(markdown): use enriched renderer across all platforms * test: verify library image controls and isolate website config * fix(markdown): preserve file links and image revisions * fix(markdown): restore diagrams and preserve link origin * fix(markdown): retain diagram identity and reference scope * fix(markdown): avoid empty web history measurements * fix(markdown): preserve authored empty link titles * test(markdown): exercise find across whole-message history * fix(markdown): preserve encoded image paths after rebase Keep the shared renderer image normalization and file-read regression coverage that originally lived in the main integration merge. * fix(markdown): derive table and task list colours from the theme * fix(markdown): restore selection highlight on web * fix(markdown): restore file link hover tooltips on web * fix(markdown): normalize inline HTML before rendering * fix(markdown): create renderer types when applying package patch The published nightly omits both MarkdownRenderers type files. Represent them as new files so patch-package succeeds on a fresh npm install, matching the already patched development package. * fix(markdown): keep the renderer tree stable while images resolve * fix(markdown): size inline images to the line and collapse failed loads * fix(markdown): normalize only parsed HTML nodes * fix(markdown): keep the first image reference definition * fix(markdown): preserve complete assistant messages on native * fix(markdown): classify web links explicitly and complete renderer types * fix(markdown): preserve spacing between HTML elements * fix(markdown): normalize HTML following code elements * fix(markdown): preserve literal image fallback labels * fix(markdown): retry transient image decode failures * docs(markdown): record native selection and image limitations * fix(markdown): preserve first definitions across Mermaid segments * fix(markdown): reserve pending images and harden web rendering * test(markdown): cover state retention during image arrival * fix(markdown): preserve reader position while responses grow Keep the same message component boundary when a live row becomes retained history, preserving Mermaid runtimes and selection nodes. Observe paced child text commits at the web viewport so sticky-bottom follows before the next frame. * test(markdown): require growth while holding a streaming paragraph * test(markdown): isolate image arrival from reload positioning Mounted row totals change as history virtualizes, so observe the new response and tool directly. Hold the real PNG response after reload until the reading position settles, then verify its reserved height and viewport instead of attributing initial bottom-follow positioning to image decoding. * fix(markdown): preserve adjacency around inline HTML * fix(markdown): keep summary block boundaries outside bold text * perf(markdown): scan HTML block boundaries incrementally * test(markdown): gate delivery while establishing a held reader * test(markdown): name shared renderer setup and file actions * test(markdown): assert linear HTML boundary work without timing * test(markdown): check large HTML table output without observing built-ins * fix(markdown): restore accentBright link colour * fix(markdown): require letters and known extensions in bare path recognition * fix(markdown): match main's blockquote, bullet and h6 colours * fix(android): keep inverted chat still during text selection React Native decomposes Android list inversion into a 180-degree rotation with positive scaleY, so the existing visibility-scroll guard never recognized the inverted viewport. Inspect the composed matrix and reproduce the actual list transform through the native view manager in regression tests. * fix(markdown): linked inline code keeps inline code size * fix(markdown): reserve a placeholder box with an image glyph while images load * fix(markdown): bare prose paths need an extension, line suffix or depth Slash-separated English pairs were recognized as file links in prose. Require stronger path intent there while preserving the existing inline-code recognition rule. * fix(markdown): horizontal blocks own their drags on compact layouts * perf(markdown): keep native streaming updates in the unfinished tail Native markdown reparses each updated view in full. Keep parser-closed blocks in a memoized head during paced reveal, then reunite completed prose for cross-paragraph selection. Preserve trailing spacing and source indentation at the split. * perf(markdown): reuse Android measurements across view mounts * test(markdown): bare Fabel/model and daemon/client stay plain text when copied a502cfd0d stopped linking bare two-segment prose paths; the clipboard expectation still carried the links from the earlier loose pattern and failed on CI (playwright shard 1/4 on 60b4e2d05). main expects the plain text, so restore that. * perf(app): limit native chat mount batches Whole-message Markdown rows measure synchronously during Fabric layout. Render fewer history rows per batch and retain a smaller offscreen window so opening a chat does not measure twelve history rows at once. * fix(app): keep populated markdown in sync with native layout Fabric can collapse streaming blocks before asynchronous rendering replaces the old text, producing a blank frame. Commit populated-view updates synchronously while retaining worker preparation for first mounts to avoid moving large history parsing onto the UI thread. * perf(app): preserve unchanged sidebar workspace projections Reopening a retained sidebar rebuilt its entry collection and invalidated every project row despite unchanged workspace data. Preserve collection identity as well as row identity, while keeping membership and ordering changes observable. * Revert "perf(app): preserve unchanged sidebar workspace projections" This reverts commit a3919faed4.	2026-10-16 21:03:37 +07:00
3 people	8d424e039e	Reduce rendering cost in long chats (#7052) ... * perf(app): stop re-walking the timeline on every streamed delta Every coalesced delta rebuilds the stream render model with the same tail. The model re-sliced the tail at the history-window start on every call, so the rendered tail was a fresh array per delta and every WeakMap keyed on it (ordering, history split, turn timing, the layout history cache, row revision) missed each time. Cache the slice by tail identity and window start. Turn timing then still walked the whole rendered tail per delta and allocated a new assistant-timing Map, which the layout memo depends on. Split the walk: the tail is walked once per tail identity and the head is walked from the carried open turn per delta. The Map keeps its identity while the head adds no completed turn. Adds identity-contract tests and a vitest bench for the per-delta pipeline. 200 deltas over a 2,000-item timeline, mean per run: default mounted window 5.68ms -> 2.82ms, history fully revealed 16.95ms -> 1.81ms. Fixes #4816 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * perf(app): keep the stream view's per-delta work bounded by the head The chat outline concatenated tail and head, reduced over the result in the render body, and rebuilt jumpToPrompt on every delta even when the outline was disabled, which is every native viewport. Memoize the tail's contribution, scan only the head per delta, do nothing while disabled, make jumpToPrompt a stable event so the rail's memo holds, and republish the active prompt only when the index or reading position changes. The view built a Set of every mounted id plus the live head per delta for the outline's pending-jump check; key it on mounted history only and treat live head rows as always mounted. Split plugin projection so a head change does not re-project the tail, memoize the history-window boundary lookup, and read the turn presentation's submission flag with some() instead of allocating a filtered array. Refs #4816 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * test(app): confirm full history before measuring streaming --------- Co-authored-by: Ivan Malison <IvanMalison@gmail.com> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> Co-authored-by: paseo-bot[bot] <266920839+paseo-bot[bot]@users.noreply.github.com>	2026-10-16 01:15:40 +02:00
paseo-bot[bot]andIvan Pantic	d9b874f9d0	Scroll chat with Page Up and Page Down after clicking messages (#7033) ... * fix(app): focus chat feed when clicking message content * test(app): wait for new chat output before checking scroll position Co-authored-by: Ivan Pantic <panta@talentkit.io> * test(app): capture the keyboard paging regression * test(app): verify paged chat text stays in place --------- Co-authored-by: Ivan Pantic <panta@talentkit.io> Co-authored-by: paseo-bot[bot] <266920839+paseo-bot[bot]@users.noreply.github.com>	2026-10-16 00:14:23 +02:00
3 people	99e4b53aa0	fix(app): restore outline jumps to prompts rendered by plugins (#6690) ... * fix(app): jump the chat outline to prompts a timeline plugin draws A timeline transformer replaces a stream item with plugin rows whose ids are "<pluginId>/<itemId>". The chat outline, chat find and history reveal look a message up by the source item's id, so once a plugin drew the prompts the outline found no row: the rail showed the prompts and clicking one did nothing, for mounted, virtualized and unloaded prompts alike. Projected plugin rows now carry the id of the item they replaced, and getStreamItemMessageId answers with it. Row wrappers, the virtualized index lookup, the visible-message set and history reveal all read that function, so they now find the plugin row. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(app): verify outline jumps to virtualized plugin prompts Replacing every prompt keeps all loaded rows mounted, so the original plugin regression never exercised a virtualized target. Retain newer native prompts and verify that a loaded unmounted plugin prompt lands without fetching. Co-authored-by: luopeihuan <luopeihuan@roundreddot.com> * test(app): retain outline navigation screenshots --------- Co-authored-by: luopeihuan <luopeihuan@roundreddot.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: paseo-bot[bot] <266920839+paseo-bot[bot]@users.noreply.github.com>	2026-10-12 12:10:54 +02:00
Mohamed Boudra	01f9bc8291	Modernize compact headers and sidebar affordances (#6431) ... * feat(app): modernize compact headers and sidebar affordances Use a shared island header with quick tab creation and keep sheet footers inside their visible layout. Opt sidebar rows into touch sizing without changing global appearance settings. * test(app): match darker light-theme workspace selection * test(app): align plugin journeys with compact header	2026-10-10 20:53:09 +01:00
Mohamed Boudra	d0bc188a5b	Show agent messages and completion notifications with sender identity (#6373) ... * feat(agents): show agent messages and completion notifications with sender identity * fix(agents): preserve human envelope examples and attachment context * fix(agents): separate message provenance from timeline presentation	2026-10-08 14:42:34 +01:00
Mohamed Boudra	543e3712e1	fix(app): preserve chat rows across virtual layout changes (#6172) ... * fix(app): preserve timeline rows across virtual layout changes Keep recent and virtual history rows under one keyed host so entering virtual history preserves their DOM and loaded image state. Initialize the virtual range from the mounted viewport to avoid an empty handoff commit. Measure committed row dimensions before accepting reading geometry, including child layout changes flushed during resize observation. Separate row content from position updates while retaining live revision signals. Add a regression covering row identity through virtualization and the position of content following a growing row. Keep the existing browser assertions unchanged. * test(app): verify child state survives timeline virtualization	2026-10-06 12:31:49 +01:00
Ruichen ZhouandMohamed Boudra	84054f8d72	fix(desktop): restore titlebar dragging after scrolling chat (#5233) ... * fix(app): restore desktop screen header dragging * fix(desktop): keep the titlebar draggable after scrolling chat * fix(desktop): preserve global control exclusions without blocking chat headers Keep programmatic focus containers out of the global interactive no-drag rule. Retain semantic controls everywhere, including window-owned sidebar toggles and negative-tabindex buttons. Verify both header rows and independently positioned controls with native input. Co-authored-by: Ruichen Zhou <ruichenzhou@outlook.com> * fix(desktop): isolate chat content from window drag regions Electron includes scrolled interactive rectangles outside their viewport in window hit testing. Reset window regions at the chat viewport while preserving the global control exclusions for chrome and portals. --------- Co-authored-by: Mohamed Boudra <boudra.moha@gmail.com>	2026-10-05 23:09:19 +01:00
Mohamed Boudra	5f28b3cf8c	fix(app): smooth chat history pagination and reserve image space (#5970) ... * fix(app): smooth chat history pagination and reserve image space Select the range at the pending reading offset before a prepend mounts rows. Reuse committed geometry for scroll input so a layout correction cannot hide the user's movement. Reserve image dimensions before loading and measure transient mounts in the browser regression. * fix(app): scope cached image dimensions to their source Raw file-path aliases let one workspace supply dimensions for another. Keep file metadata tied to its daemon and workspace, and close the delayed-image test server even when setup fails. * fix(app): retain local image context in row height estimates Pass the rendering server and workspace through height estimation so scoped image metadata remains usable before an older row mounts. * refactor(app): name row height estimate inputs	2026-10-03 14:41:32 +01:00
Mohamed Boudra	8aec0787d2	fix(app): keep chat reading position stable while scrolling (#5945) ... * fix(app): keep chat reading position stable while scrolling Prepend restoration froze the reading offset while wheel input and delayed image measurements changed layout. Give the viewport one reading anchor, preserve concurrent user movement, and apply virtual row measurements before paint. Suspend automatic pagination while explicit message navigation settles. * fix(app): type the reading anchor scroll intent explicitly * fix(app): retain the reading anchor through virtualization startup Keep the reader pinned while the first virtual range mounts. Strengthen the scroll regression detector to compare shared rows when the original anchor unmounts, and consume fixture replies only when they are emitted. * test(app): distinguish delayed wheel input from idle scroll drift CI frames can arrive long after their wheel events. Start idle assertions after the input driver finishes, and account for an image entered by wheel input expanding below the new reading line. Replayed all six CI captures without false positives while retaining the original 76 baseline jumps. * test(app): bound image growth allowance to displaced reading rows Require the entered image top to follow wheel input before attributing movement of a later row to its growth. Calibrate the detector against simultaneous viewport jumps and jumps of the growing row itself. * test(app): clamp scroll expectations at the history boundary	2026-10-03 10:12:01 +01:00
Mohamed BoudraandClaude	3a9304607c	feat: sidebar header and footer plugin items, Usage in the sidebar footer (#5685) ... * refactor(usage): remove agent-to-usage wiring * feat(plugins): screens, sidebar header and footer items Plugins register screens with addScreen and contribute component-based sidebar items with addSidebarHeaderItem and addSidebarFooterItem. Items get currentScreen, openScreen and openPopover, and render the SidebarRow and SidebarButton kit. The footer shares the header's ordering model through the new sidebarFooterItems preference, and Settings > Sidebar gains a Footer card. addSurface, openSurface and addSidebarItem stay as aliases with their settings keys and routes. * refactor(plugins): share resolvePluginPlatform and keep header remembered-host key Consolidate the five resolvePlatform copies into plugins/platform.ts. Header sidebar items keep the <pluginId>/sidebar/<id> remembered-host key so existing users keep their remembered host; footer items use <pluginId>/sidebar-footer/<id>. * feat(usage): global usage summary, pins and used/remaining display - Device-local usage preferences (displayAs, pinned windows) in app settings. - Sidebar footer usage summary: pinned windows in pin order, one per account; opens the expanded view as a popover on desktop and a sheet on compact. - Pin checkboxes on window rows and a used/remaining toggle shared by the summary, popover, Usage screen and Settings usage section. - Usage screen shows one host with a selector when several are connected. - Extract HostSwitcher and the sidebar popover host for reuse. * fix(usage): render each usage report as its own card * feat(usage): row pinning, one title row for usage controls, even sidebar footer - Window rows are the pin toggle (checkbox role, checked state); pinned rows get a surface2 highlight, unpinned rows an interactionHighlight hover. - Usage screen, Settings section, popover and sheet put the title left and the host selector, used/remaining toggle and Refresh right (UsageControls). PageLayout gains an actions slot; the menu sheet header a trailing slot. - Sidebar footer rows share 28px height, spacing[1] gaps and one leading rail. * fix(usage): keep row hover lighter than the pinned highlight Hovering an unpinned window row shows the pinned surface2 at half opacity on a separate layer, so it never reads stronger than a pinned row. Pinned rows do not react to hover. * fix(app): defer sidebar styles and preserve layout exports in timeline test * fix(usage): open the Usage screen on desktop, drop the Usage footer icon, match git panel refresh - Desktop presses on the usage summary open the Usage screen; only compact opens the sheet. - The Usage footer icon is gone; with nothing pinned the summary renders a plain "Usage" row in the footer row style. A stored `usage` footer preference is ignored. - Refresh controls use the Changes panel's icon-only ToolbarButton with RotateCw. * fix(sidebar): keep the footer icon row fixed; footer items are rows only The footer's icon row (Hosts, Import session, Help and support, Settings) is back to main's fixed implementation: not in Settings, not reorderable, and plugins can't add to it. - Footer items are full-width rows between Add project and the icon row: the usage summary and plugin `addSidebarFooterItem` rows. The Footer card in Settings lists only those rows. - Stored `sidebarFooterItems` keys for hosts, import, help and usage are ignored. - `SidebarButton` is removed from the plugin UI kit; a footer item renders `SidebarRow`. * refactor(usage): call the sidebar footer item Usage One concept, one word: the footer item is the Usage item, with key `usage`. - Settings > Sidebar > Footer lists it as "Usage"; its preference key is `usage`. - `usage/summary-item.tsx` becomes `usage/sidebar-item.tsx` (`UsageSidebarItem`); both states use testID `sidebar-usage`. - `usage/summary.ts` becomes `usage/pinned.ts` (`resolvePinnedUsage`, `PinnedUsageWindow`): it resolves the pinned windows the item shows. * feat(plugins): screen params, several rows per sidebar item, SidebarSeparator openScreen takes { screenId, params }; params live in the screen route's query so reload, history and links keep them. currentScreen carries the params. A sidebar item may render a fragment or array of rows; a row press anchors the popover to that row. SidebarSeparator joins the plugin UI kit. Co-Authored-By: Claude <noreply@anthropic.com> * fix(plugins): any screen param key; trailing presses anchor the row's popover Screen params go in the query under a param. prefix, so keys like serverId no longer collide with the route segments Expo Router merges into search params. A press anywhere inside a SidebarRow, trailing content included, makes that row the popover anchor. Co-Authored-By: Claude <noreply@anthropic.com> * feat(plugins): plugins title their screens addScreen takes { id, title, Component }. title is a string or a function of the screen's params; the screen header shows it and follows param changes. A title function that throws or returns empty falls back to the screen id. Legacy addSidebarItem screens keep their item's title and icon, and the addSurface alias titles its screen with the id. Co-Authored-By: Claude <noreply@anthropic.com> * fix(usage): require discovery and remove unreleased agent resolver * fix(plugins): restore legacy sidebar rows, share the item runtime, header hint presses its row - Legacy addSidebarItem rows are their own group kind again: main's row, registered icon in Settings, /sidebar/<id> route, host remembered per row. - New-API items follow the host last used on any of the plugin's screens. - /sidebar/<id> falls back to a same-id screen so pre-migration links resolve. - params moves to PluginScreenProps; settings screens no longer receive it. - Sidebar items, buttons and popovers share one runtime per installation, so no empty first frame. - A header row's hint slot presses the row; labels wrap as on main. - Skill and docs corrected. Co-Authored-By: Claude <noreply@anthropic.com> * fix(usage): one host resolver, sheet reuses the screen's controls, name the host - The Usage row and screen default to the same host. - The compact sheet carries the screen's controls, host selector included. - The host selector shows with one host, and unavailable messages name the host. - The row, sheet title and pinned label use the sidebar.footer.usage translation. - Window rows read their percent and reset after the pin label. - Drop the unread per-report cache writes and headline fixture fields. Co-Authored-By: Claude <noreply@anthropic.com> * fix(plugins): popovers, header buttons and composer pills own their runtime again Only sidebar item rows use the installation's shared runtime. Popover content disposes its runtime on unmount, so observations close with the popover. * fix(plugins): a sidebar item releases its subscriptions when it unmounts Each mounted sidebar item gets its own API scope over the host's client, created during render so its first frame has content. The scope closes a microtask after unmount (StrictMode's remount keeps it), when the item moves to another host, or when the installation stops. Replaces the installation-wide shared runtime. * refactor(plugins): one Paseo client per plugin; authors own their subscriptions usePaseo() in every plugin surface, and client.paseo in setup, is the installation's client, created with the installation in the registry. Authors release their subscriptions in their own cleanup; plugin teardown disposes the client and ends the rest. Nothing is created or disposed per mounted surface: the per-surface runtimes, their boundaries, and the per-run Command Center and slash command APIs are gone. * refactor(plugins): one Paseo client per plugin; authors own their subscriptions usePaseo() in every plugin surface, and client.paseo in setup, is the installation's client, created with the installation in the registry. Authors release their subscriptions in their own cleanup; plugin teardown disposes the client and ends the rest. Nothing is created or disposed per mounted surface: the per-surface runtimes, their boundaries, and the per-run Command Center and slash command APIs are gone. * fix(usage): show usage from released hosts Normalize released-host usage responses at the client boundary so existing usage and pins remain available across app and daemon versions. Include account labels in legacy responses for older apps. * fix(usage): keep the usage capability check out of the public SDK * test(server): retry transient locks during runtime test cleanup * test(usage): model hosts without either usage capability --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-09-30 12:52:13 +01:00
Mohamed Boudra	cc744cc669	feat(app): let users set the chat and Markdown content width (#5680) ... * feat(app): let users set the chat and Markdown content width Wide and ultrawide screens were stuck with an 820px reading column. The width is now an Appearance setting that flows through the Unistyles theme, like the font sizes, so every content surface picks it up. The stored value stays null until the user picks a width, so a future change to the default reaches everyone who never customized it. Reset writes null back. The native composer dock keeps plain React Native styles and takes the width inline because those styles land on Reanimated views, where theme-driven Unistyles crash on theme changes. * fix(app): pass the content width into the web stream viewport The viewport read app settings itself, which required a QueryClient in every render of the stream strategy. The agent stream view already reads settings, so it hands the width over with the rest of the render input.	2026-09-29 13:49:03 +01:00
paseo-bot[bot]	68e722ec2e	fix(app): request a chat outline only for a timeline the daemon has served (#5602) ... A new agent's draft pane rendered the chat outline with its local tab or draft id, so the web app asked the daemon for that id's prompt index before the agent existed and the daemon logged Agent not found. The outline now waits until the viewed timeline has an epoch, which only a daemon-served agent timeline has. Co-authored-by: paseo-bot[bot] <266920839+paseo-bot[bot]@users.noreply.github.com>	2026-09-29 06:16:30 +02:00
paseo-bot[bot]	f4ba16a0b3	fix(app): keep line breaks in streamed replies when a chunk ends in indentation (#5577) ... While a reply streams, presentation reparses only the growing last Markdown block: the cached block text plus the new chunk. splitMarkdownBlocks drops a trailing whitespace-only line, and only trailing "\n"s were added back, so a reply that paused on "]\n " cached the block as "]". The next chunk " B -->" then continued the previous line, joining two lines of a code block. Codex streams a line break and the next line's indent as separate deltas, so its Mermaid diagrams hit this and failed to render. History reparses the whole text, which is why a reload showed the reply correctly. Keep every trailing blank line the split drops on the last block. Closes #5456 Co-authored-by: paseo-bot[bot] <266920839+paseo-bot[bot]@users.noreply.github.com>	2026-09-28 22:09:16 +02:00
Mohamed Boudra	b2ce2bcb83	Count chat Find matches across the whole chat (#5167) ... * fix(app): count chat Find matches across the whole chat Chat Find searched the whole chat but its counter read "1 of N in message", where N was the occurrences inside the selected message. The per-message split is an implementation detail of how the client verifies and highlights a hit; a reader counting matches is counting the scope they searched. The counter now reads "3 of 7" for the position across every message that holds a hit, and Next/Previous walk that sequence, crossing message boundaries and wrapping at the ends. Per-message occurrence stays inside the model as navigation state. The total needs a per-message count for messages that are not on screen, so the daemon now reports one. It counts with the same matcher the browser uses on rendered text — query words joined by any whitespace, case-insensitive, never across a Markdown block boundary — which also stops it from reporting locations the client would reject. The client replaces the estimate with the rendered count as each message is revealed, so the total is exact for everything that has been on screen. `count` is optional on the wire and tagged COMPAT(timelineSearchCount): a host that omits it is worth one match per located message until a reveal corrects it. * fix(server): stop chat search reporting matches the browser cannot show Falling back to the whole Markdown source when the per-block scan found nothing reported a match whenever the query words straddled a block boundary — "one target" across "target one\n\ntarget two" — and on syntax the reader never sees. The client always rejected those locations, so before the whole-chat counter the cost was a wasted round trip. Now that the total sums the host's per-message counts, a rejected location inflates the number the reader sees until navigation reaches that message and drops it. The block scan alone is the whole rule. The model's Location derives from the wire type again, with count narrowed to required: the search boundary fills in the COMPAT default, so the interior never re-checks it.	2026-09-22 10:36:13 +02:00
Mohamed Boudra	135a3b4c9e	Find text in assistant messages that streamed in the open chat (#5146) ... * fix(app): find text in assistant messages that streamed in the open chat Chat find failed with the generic "check the host connection" text whenever the oldest hit sat in a response that streamed while the chat was open and had more than one Markdown block. Presentation rendered such a message as one row per block with ids `<messageId>:block:n`, while hydrated history stayed one row with the raw message id, and every message-addressed DOM lookup (find reveal, scroll-to-message, history reveal, the render-cap expansion) only knew the raw id. The reveal step polled for a row that never existed and gave up after five seconds. The defect was the dual rendering, so this removes it: every assistant message is a block group however it arrived, single-paragraph messages included, so a row id is never a message id. Rows carry `data-message-id`, `getStreamItemMessageId` is the one way from a row to its message, and find, scroll-to-message, history reveal and selection copy address messages through it. Chat find force-mounts every row of the selected message under virtualization so counts span the whole message, and pins the chosen occurrence to its row while the scroll settles. Link reference definitions fold into their neighbouring block so history never paints an empty row. Find failures now say what went wrong (connection, history changed, could not show the match) instead of blaming the connection for everything. * fix(app): let the Markdown parser decide which blocks are link definitions A hand-rolled CommonMark regex rejected destinations markdown-it accepts, such as escaped spaces, so those definitions still became their own empty row and the neighbouring paragraph lost its link. The block splitter now parses the block with the same parser: no tokens plus registered references means definitions only. The two new chat find journeys move their mechanics into named helpers so the test bodies read as intent.	2026-09-21 22:31:08 +02:00