22 Commits

Include renames

Author	SHA1	Message	Date
Mohamed Boudra	28c188513e	feat: plugin API for agent options, metadata, composer and New workspace (#8744) ... * feat(protocol): option controls, options patch, and provider.controls.list Add AgentOptionControl descriptors, snapshot options/controls, an options patch on agent.config.apply, provider.controls.list RPC, and server_info.features.providerOptionControls. featureValues stays accepted on the wire (COMPAT). * feat(server): fold featureValues into providerOptions and describe composer controls Providers emit option controls over top-level providerOptions keys; the daemon stores one options record per agent, merges config.json defaults as effective values, and applies patches live via AgentSession.applyOptions. Legacy featureValues (wire, stored records, profiles, schedules, hooks, MCP) fold into providerOptions; snapshots still carry features built from controls. Snapshot options expose only keys that have a control. * fix(server): address Phase 1 audit findings on option controls - Removing auto_accept (OpenCode, ACP) turns live approval off; ACP selects return to their session default. - agent.create.before hook featureValues edits override options the create already set. - Claude commits fast_mode only after the runtime accepts it. - Codex snapshots show a saved Fast preference as the tier the model resolves it to (AgentSession.displayOptions). - Profiles are folded into options in the daemon config store; the config API still answers with featureValues. - Snapshot options and provider.controls.list carry all effective options. - Test: Claude fast_mode survives a restart through stored providerOptions. * fix(server): keep snapshot options as configured, restore OMP baseline, cover options through public interfaces - Codex: drop displayOptions; a select choice may carry aliases so a saved Fast preference selects the model's Fast tier from options + controls alone. - OMP: removing fast_mode restores the runtime's starting setting. - ACP/Cursor removal tests run through real session initialization. - agent.config.apply of a non-control option reaches the provider and shows in the next snapshot (daemon e2e). - Daemon config store persists legacy-featureValues profiles as options on the next profile save. * fix(server): read a pre-v0.10 Codex fast_mode record as service_tier "fast" and store it that way A record holding `fast_mode: true` without `service_tier` ran Fast but the speed control showed Normal, and picking Normal then wrote "default". The Codex session now normalizes the old boolean at construction and reports the new shape through its existing options_changed event. * fix(server): show Fast for a stored Codex fast_mode: true without rewriting the record Reverts the storage migration from a987b4a43. The Codex speed control now takes its default from the session's current options with the same rule the runtime uses (an explicit service_tier wins; fast_mode: true applies only while service_tier is absent). This holds on create, resume, live apply and for config.json defaults, and stored options stay as set. * chore(website): regenerate the config schema for profile options * refactor(server): providers report option differences once, after create, resume and apply Providers used to write their own reports into the agent's options while a session was being created, resumed or updated, which needed a growing set of reconciliation, baseline and suppression rules to stay in step with the daemon. The contract is now transactional. A provider opens or updates with the options it is given and emits nothing while doing so; if the result differs it says so once, afterwards, as `options_changed`. Live apply hands the provider only the keys the patch sets and the daemon stores them onto the agent's current options when the provider accepts, so the last write wins. A change the provider makes on its own is stored and forwarded, not undone. Removing an option drops the key and sends nothing live. Controls carry no state; `options` is the only option state. A legacy `agent.create.before` hook's `featureValues` edits are applied as a patch over the returned options, so its deletions and replacements hold. The unreleased `aliases` field on option choices is gone; a pre-v0.10 Codex Fast preference is reported once as the model's tier id. * refactor(server): providers return what apply and open ended with instead of reporting it afterwards applyOptions returns the options the session ended up with and the session exposes its open difference as openOptionsPatch, so the manager stores the patch and the provider's answer in one step. Removal is an ordinary patch: the provider receives the default the key falls back to, or null, and returns what it kept. Controls no longer take a default from a stored legacy feature value. * fix(server): apply an old app's profile featureValues over the profile's stored options The unchanged app's profile form only knows the controls, so a name-only edit dropped options it never shows, such as sandbox_mode. Its featureValues now apply as a patch over the options already stored for the profile (null removes a key), and a write with no featureValues keeps them. * fix(server): ACP reports the selects it moved during open or apply as that call's result A config_option_update that arrived before the write response was emitted as an event on top of the result the manager stores. Notifications during open or apply now fold into the open patch or apply result, and a rejected apply reports what the agent moved since nothing is stored. Live options are validated with the creation schema. Tests drive a stdio ACP agent. * fix(server): providers validate live option patches and Claude reports Fast dropped by a model switch Live patches go through the schema used at creation. A Claude model switch that cannot keep Fast reports fast_mode as removed so the stored options match the session. * fix(server): Claude reports Fast as off, not removed, when a model switch drops it A removed key lets a config.json default of fast_mode: true fill back in while Fast is off at runtime. * fix(server): fold an old app's profile featureValues by the provider and options the write carries A write with options folds featureValues over those options. A write without them patches the stored options, unless the profile moved to another provider, which starts from no options. * docs(server): a rejected apply reports what the provider moved after the call ends * test(server): a patch key is resolved against nested configured defaults * test(server): a setting a plugin changes on its own is forwarded as options_changed * test(server): assert the forwarded plugin setting without nesting callbacks * test(server): removal of auto_accept returns ACP to asking; Claude keeps opening restrictions across a patch * fix(server): Codex returns the tier it resolved and drops a speed the new model lacks A live service_tier: fast is stored as the catalog's Fast tier id instead of a value the control cannot show, and a model switch to a model without the stored speed reports Normal so choosing a supporting model again does not bring the paid tier back. * fix(server): Claude applies only the keys a patch sets over its current options A Fast patch kept a copy of the options taken before the runtime answered, and assigning it afterwards dropped a patch that landed meanwhile. * fix(server): a plugin that moves settings and then refuses an apply reports what moved * refactor(server): the legacy featureValues folds take one named-input object * fix(server): a live patch is rejected for an option the session only reads at start, and opening reports every option it ended up with A stored option has to describe what runs. OpenCode, OMP and ACP now reject a live change to a key they apply only when the agent opens; Claude applies such a change from the next turn and rejects it while a turn is running. Opening reports every select or setting the session came up with, including ones nobody set, so a native default (Cursor opening with Fast on) is stored as option state like any other. * fix(server): Claude rejects a live change to an option it reads when the query starts Replacing a started query to apply the option would end its background shells and tasks. Once the query exists only Fast can change; before the first prompt every option still applies, because it is read when the query is built. * fix(server): a live options patch is rejected when the session cannot apply it A session with no applyOptions (Pi) now rejects a patch instead of storing a value that fails on reopen. Codex applies only service_tier, plan_mode and fast_mode live, since the approval policy and sandbox are fixed when the thread starts. Claude also rejects a launch option change while its first query is starting, after the options have been copied. * fix(server): plugins reject keys they do not report as settings, and Codex opening reports the speed it runs A plugin session applied the settings it knew and silently stored the rest; it now rejects a patch that names a key the plugin does not report. Codex opening on a model without the saved speed ran Normal while the stored options still said priority; opening now reports the tier it runs, as a later model switch does. * refactor(server): option helpers take named inputs, control types come from their schemas, and a plugin accepts launch options it opened with A whole profile is applied by the unchanged app, so a launch-only plugin option whose value has not changed must not fail the apply. applyProviderOptionsPatch and featuresFromControls take one object, and the protocol control types are inferred from the wire schemas. * fix(server): ACP reports a select that appears after startup with its native value A model switch can introduce a select (Cursor Fast) that the session did not have at open. Its value is now stored like any other native selection instead of being skipped because the previous snapshot did not name it. * fix(server): a loaded agent's options stay what its session opened with when a provider default is edited effectiveOptions was recomputed from the current config.json defaults on every state emission, so editing a default changed the snapshot of an agent whose session never received it. It is now computed when the session opens and moves only through an apply or an options_changed. Editing a default affects agents the next time they open. * fix(server): a live apply shows the merged defaults the provider was given in the options snapshot The snapshot took the raw patch, so a nested patch over configured defaults dropped the defaults the provider had accepted. The snapshot now takes what the provider was sent plus what it reports back; stored options still keep the raw patch. * fix(server): an option a session drops when opening is not brought back by a configured default The opening snapshot merged defaults over the options after the session's openOptionsPatch had removed a key. Defaults now merge into what the session was given and the patch applies after. * fix(server): Codex keeps the speed it opened with when the legacy Fast key is removed Opening moves a legacy fast_mode into service_tier, so removing fast_mode afterwards changed the runtime speed to Normal while the stored options still said Fast. Removing the alias now changes no speed. * fix(server): opening snapshots keep the defaults the session launched with, and config-change pushes carry legacy profile values An opening resolved defaults once for the session and again at registration; an edit in between showed options the session never received. Create, resume and reload now resolve once, before the provider opens, and registration starts from that. The daemon_config_changed push skipped the featureValues projection that config replies apply, so the unchanged app lost a profile's legacy values when any setting changed. * fix(server): every opening path hands registration the options it launched with Registration took the launch options as optional and reread the defaults when a path did not supply them, as provider-session import did. It is now required, so create, resume, reload and import each resolve once before opening. The option helpers take named inputs. * fix(server): a saved legacy Codex Fast preference wins over a configured service_tier default The defaults merge put a configured service_tier next to the agent's own legacy fast_mode, and Codex reads service_tier first, so the agent opened Normal. The agent's own alias now replaces the default of the key it stands for. * fix(server): Codex keeps a Fast chosen by alias as the catalog's tier id A live fast_mode or service_tier "fast" was stored as the alias while the apply reported the catalog id, so a later switch to a model with a different Fast id ran Fast under an option that said otherwise. The session now stores the id it accepted and drops the folded fast_mode. * fix(server): the legacy Codex Fast alias folds into one speed on apply and in configured defaults A patch with both speed keys left the alias in the stored options, so a reload started Fast again after the speed was removed; the apply now reports the folded alias. A configured fast_mode default now supplies the service_tier default, so removing an agent's own speed falls back to the configured Fast like opening does. * fix(server): an OMP replacement runtime starts with the Fast the session has now A restart (for example an approval-mode change) restored Fast from the options the session opened with, turning back on a Fast the user had switched off. The session now keeps the Fast it applied or the provider changed, which is what a replacement reads. * refactor(server): Codex's legacy fast_mode converts to service_tier where old data enters Stored records, config.json defaults, profiles, older clients' requests, MCP settings and plugin hooks go through convertLegacyOptions as they come in. Past that point the defaults merge, the manager and the Codex session never see fast_mode for Codex, so the alias branch in the defaults merge and Codex's fast_mode handling are deleted. * fix(server): a legacy hook's replaced speed and an apply request's options convert before they are compared or applied A hook that swaps the canonical speed it was sent for fast_mode is diffed in canonical form, so its replacement is not read as a deletion. An apply request carrying featureValues and options sends one options patch with options winning, so a superseded legacy value is never applied. * refactor(server): the agent manager converts Codex's legacy fast_mode for the adapter behind the provider id The rename is adapter-specific, so it lives where the provider id resolves to its adapter: AgentManager converts an agent's own options on create, resume, import, reload, apply and draft controls, following derivedFromProviderId, so a custom provider extending codex keeps working with a saved or requested fast_mode. Storage, MCP, schedules, hub and profiles pass options through. The featureValues-to-options fold stays provider-agnostic at the legacy edges. * fix(server): a rejected OpenCode auto_accept leaves the session asking for permission applyOptions committed the new flag before approving pending requests, so a failed reply left the session auto-approving while the stored option stayed off. The flag is restored when the apply throws. * fix(server): legacy Fast reaches draft discovery and saved profiles, and overlapping or replaced options keep the state they committed Draft controls and commands convert the config they hand to the provider, so inspecting a legacy Fast preference no longer fails Codex's strict options. A profile naming codex converts its saved fast_mode for the app's controls. OpenCode serializes auto_accept applies so a failed one restores exactly what it changed, and a replacement OMP runtime starts from the Fast the session opened with. * fix(server): an OMP replacement runtime that refuses the session's Fast publishes what it accepted The approval-mode restart installed the new runtime's state without comparing its Fast result to the session's, so a refusal never reached options_changed, the remembered value, or storage. The replacement now goes through the same comparison as refreshState. * fix(server): OMP turn completion publishes a Fast change, and Claude opens with Fast off on a model that has none OMP installed runtime state in several places and only one compared Fast; every state read from the runtime now goes through one install step. Claude kept a Fast default on a model without Fast, which made unrelated options reject until the user cleared it; the session now opens with Fast off and reports it in openOptionsPatch, as the model-switch path already does. * fix(server): a malformed Codex fast_mode is rejected, and profile options are renamed for clients by the agent manager's conversion convertLegacyOptions read any truthy fast_mode as Fast, so the string "false" ran priority. It now accepts only true, false or null. The profile store no longer renames keys: a literal codex profile was renamed in storage while an extends-codex profile was not. The config API now converts each profile's options with the manager's adapter-aware conversion, so codex and my-codex profiles read the same. * fix(server): a profile is stored in the current option keys, converted for the adapter its provider extends Profiles in config.json are old data entering, so the store converts them (stored value and incoming patch) with the same conversion the agent manager uses. Storage and clients now share one vocabulary: resetting a legacy Codex profile's speed removes what was shown, and a malformed fast_mode rejects the write instead of breaking later config reads. The config API goes back to copying the field shape only. The extends chain is followed by one function over either the registry's definitions or config.json's providers. * fix(server): profile options convert against the provider graph a write commits A write that edited a provider and a profile together folded the profile against a shallow merge that dropped the provider's extends, so its legacy Fast was not converted. The fold now sees the same deep-merged providers the write commits. * fix(server): draft speed shows the tier the first turn will run with Draft discovery reported the options as requested, so a Fast configured as a legacy fast_mode or the fast alias read as Normal while creating sent the model's own Fast tier. The draft now reports the options the scratch session opened with, as registration does. * fix(server): ACP option applies run one at a time Two overlapping applies shared one transaction guard, so when the first was refused after the agent had moved a select, its report was dropped as 'still in a transaction' and the second saw no difference. Applies are serialized, as OpenCode's are, so each reconciles against the state the previous one left. * fix(server): an ACP removal reports the choice the select lands on, and the Codex plan tests enable plan mode A removal asks the select for its empty choice and compared the result against that same empty choice, so applyOptions returned nothing and the manager stored the removal as null while the session ran the Default choice. The difference is now computed against what was asked (null), so the options hold the value the session runs with. The Codex plan-mode end-to-end tests called the removed session.setFeature through an optional call and silently skipped plan mode; they apply the option and fail loudly if the method is gone. The MCP parity wrapper forwards listControls instead of the removed listFeatures. * fix(server): plugin option applies run one at a time, and OpenCode reports the Auto Accept legacy full-access turns on Plugin sessions let two applyOptions overlap. The second finished and re-recorded the settings the plugin held, which included a change the first had already made and not yet reported; when the first then failed, nothing was left to report and the stored options kept the old value while the plugin ran the new one. Applies now queue on the session, the way the ACP adapter's do, so each reconciles against what the one before left. OpenCode normalizes the legacy full-access mode to build with Auto Accept on, but the session never said so, so the options the manager keeps did not hold Auto Accept and a reopen turned it off. The session now reports it through openOptionsPatch on create and resume. * refactor(server): openCodeOpenOptionsPatch takes one named-fields object * feat(app): the client and app work on options and controls The agent snapshot's `options` are the state and `controls` only draw them. Running and closed agents draw from the snapshot; drafts and profile forms ask `provider.controls.list.request` with their `providerOptions`, so aliases such as a legacy Fast profile's `service_tier: "fast"` are resolved once, by the daemon, and the draft keeps Fast highlighted. A draft adds only the user's edits and each provider's last-used control values; applying a profile seeds its non-control options (e.g. `sandbox_mode`) into the draft, and a profile form saves them back instead of pruning to the controls it can draw. A daemon without `server_info.features.providerOptionControls` still sends `features` and `featureValues`. `LegacyProviderOptions` in the client package is the one place that translates snapshots, draft listings, create and apply requests, and daemon-config profiles, so the app never branches on it. Persisted preferences and tab layouts rename `featureValues` through tagged COMPAT preprocessors. The features/controls bridge moves from the server into the protocol package so the client can reuse it. * fix(app): drafts and profile forms send every option layer to the daemon A cold create against a daemon without providerOptionControls routed control options (Claude fast_mode, Codex service_tier) as providerOptions, which that daemon does not read for them. The client now lists the provider's features before the first create or workspace create that carries options, so callers never prime a cache. Draft options moved into a plain model. Applying a profile replaces provider and options in one step, so the form's provider change that follows no longer clears a cross-provider profile's non-control options; choosing a provider by hand still starts over. The model sends its complete options (seed, last-used values once the provider says it still draws them, edits) to the daemon and the controls draw only the answer, so a remembered legacy fast is drawn as what it runs as. A toggle shows over the last answer until its own arrives. The profile form does the same: its edits go through resolution too. * fix(client): a legacy create routes its options from the controls of its own config Which options a legacy daemon exposes as features depends on the model, mode and thinking level, not only the provider: a Haiku snapshot with no features says nothing about Opus. The provider-keyed memory of control keys sent an Opus create's fast_mode as providerOptions, which that daemon does not read. A create that carries options now lists the controls for its own draft config and splits on that answer. The memory, and the snapshot and listing hooks that fed it, are gone. * fix(app): a closed agent shows its stored options, and a provider switch asks about its own options A closed agent's snapshot is projected from its stored record, which kept controls and provider options but dropped them from the payload, so the app drew no speed or other controls for it. The stored projection now carries them, with the legacy features derived from the same source. The draft read the form's provider and the model's options separately, so for the render after a manual provider change it asked the new provider about the previous provider's options. The request is now built from one snapshot of the model and is absent until the model has observed the new provider. * fix: persisted options keep their full shape, and every legacy snapshot gains controls Draft setups and form preferences validated option values as booleans, strings or null, but the options they now receive come from agents and profiles and can be objects, arrays or numbers. One such value failed validation and wiped the whole saved layout or the saved preferences. Both schemas now accept any JSON value. The legacy-daemon translation skipped the snapshots carried by agent_created, agent_resumed and timeline responses, so a created agent or a timeline refresh left the SDK handle without options and controls. The profile journey asserted the create request's options field; the wire field is providerOptions. * fix(client): a legacy profile with both featureValues and options keeps both A legacy daemon keeps an unknown `options` field on a profile it stored (profiles are passthrough), for example after a downgrade, while its own app keeps editing `featureValues`. Reading such a profile took `options` and dropped `featureValues`, so a Fast setting there was lost and the next save replaced it. Both are merged on read with an explicit `options` key winning, the same rule the daemon applies when it folds `featureValues`. The draft form input of draftControlsRequest is a named type. * fix(app): a draft stops sending a toggle the model in use does not offer A toggle made on one model stayed in the draft's edits after the form moved to a model whose controls do not include it, and was sent with the create. On a legacy daemon that key is not a feature for the new model, so it went out as a native provider option the daemon rejects. The draft now sends an edit only while the latest answer draws a control for it, and sends it again when a control for it returns. * fix(server): a closed agent's options include the provider defaults, like a live one's The stored snapshot projected only the options the agent owns, so an agent that ran with a config.json default (for example Claude fast_mode: true) showed the option as missing, and its legacy Fast control as off, until it was resumed. The projection takes the same resolver the live agent uses (the provider's defaults under the agent's own options). * fix(app): a draft keeps sending an option no control has drawn The previous change stopped sending any edit the latest answer drew no control for, which also dropped options set without a control (a plugin setting a token budget on the draft). Only an edit of a key an earlier answer for this draft drew as a control stops applying when a later answer draws none; every other edit always applies. * test(server): the MCP test agent manager resolves effective options * fix(app): a profile stops saving a toggle the model in use does not offer Switching a profile from Opus to Haiku kept the Fast edit, so the saved profile carried fast_mode that no control draws and an old daemon's provider rejects at create. The profile editor now drops a key an earlier answer drew as a control and the latest one does not, the rule the draft already follows; options no control ever drew are never touched. * fix(client): resetting an option on an old daemon writes the default it can take setAgentOptions({ service_tier: null }) sent a feature write with value null, which the old Codex setter rejects, leaving the paid Fast tier on. A toggle now resets to off and a choice to its default; an option with no control to name a default fails with the host-update message before anything is written. * fix(client): applying a config with a reset option on an old daemon writes the default it can take applyAgentConfig({ options: { service_tier: null } }) reached an old daemon as featureValues with null, which its Codex setter rejects. The config now takes the same translation as setAgentOptions: a toggle goes off, a choice goes to its default, and an option with no named default fails with the host-update message before anything is sent. * feat(plugin): provider plugins declare option controls and receive option changes A provider plugin reports `controls` and the `providerOptions` it runs in `session.config`, and receives running-session changes as `session.configure` `changes.providerOptions` (null returns a key to its default), under the same apply-or-throw contract as built-in providers. A control may declare a `defaultValue`; a value a plugin reports at that default for a key nobody set stays unset instead of being pinned to the agent. A plugin that still reports `settings` keeps working: the daemon reads each setting as a control plus an option and sends changes in both shapes (COMPAT(plugin-provider-settings)). The app resolves a control's icon as a Lucide name when it is not one of the built-in kebab-case names, so a plugin's icon shows live and in drafts. Public docs and the provider-direct example use only `providerOptions` and controls; the migration doc gains the rows. * fix(server): a plugin provider's reported options are stored like any provider's A control's `defaultValue` only says what the control shows for a key with no value. Opening and applying store every option the session reports, defaults and values nobody set included, as built-in providers do; the special case that left a value at the default unset is removed. * fix(server): a plugin decides which options it applies live A plugin reporting `controls` and `providerOptions` receives every key a live change touches, with or without a control, and applies them or rejects the whole request. The daemon's live-key guard now runs only for a plugin still reporting `settings`, which cannot refuse a key. * fix(server): a rewound plugin session reopens with its options as they stand The reopen merged the plugin's reported options over the launch record, so a key the plugin reset by leaving it out came back at its launch value. The session now keeps the committed options, removals included. The provider-direct example also refuses a combined request before changing anything. * fix(server): a plugin that stops reporting an option has reset it The adapter only visited keys present in a new report, so a key the plugin dropped to return to its default kept its stored value and its rewind value. A previously reported key that disappears is now reported as removed. * fix(server): an apply reports the options the plugin reset along the way Applying and unsolicited reports now share one conversion from the plugin's report to a patch, so a key the plugin stops reporting is a removal on both. * fix(server): an apply never reads a requested option as one the plugin dropped A plugin may run an option it never reports. Only a key it reported before can be reported as removed, and a rewind reopens with the accepted request plus what the plugin reported back. * test(server): an apply to a plugin that reports controls sends its changes as provider options * feat(plugins): agents and workspaces carry plugin metadata Plugins had nowhere to keep their own data on an agent or workspace, so Phase 5 and 6 surfaces would each have invented a side store. Both now hold an opaque Record<string, JsonValue> that Paseo stores, snapshots and hands to hooks without reading a key. Set at creation or changed with agent.metadata.update.request / workspace.metadata.update.request (top-level keys replace, null removes). Persisted on the agent and workspace records, so it survives a restart. Reaches agent.create.before (which may add to it), agent.open.before (read-only), agent.create.after and workspace.create.before/after. Gated once on server_info.features.entityMetadata; the client throws "Update the host" instead of sending to a host without it. * fix(plugins): an agent.open.before result may omit metadata The result schema required metadata, so a plugin written before metadata existed that returns its own object instead of spreading the request failed validation and the session open failed, even for agents with no metadata. An omitted metadata now means unchanged and is filled back in from the request so later plugins in the chain still see it; a present value that differs is still rejected. The restart test now sets metadata through the PaseoApi handles and checks that agent.open.before sees the patched value after the restart. * fix(plugins): omitted metadata in a hook result means unchanged An agent.create.before hook that returned its own { config, env } dropped metadata that an earlier hook in the chain had added, because only the caller's original metadata was restored at the end. The omitted field is now carried forward at each hook handoff, as agent.open.before already does. The agent.open.before result type also required metadata, so an older TypeScript plugin that returned its own object no longer compiled even though the daemon accepted it. The result type now makes it optional. * fix(plugins): omitted metadata in a workspace.create.before result means unchanged Same handoff as agent.create.before: a legacy hook that returned only { source, ... } dropped the caller's metadata and anything an earlier hook added, and workspace provisioning then defaulted it to {}. The omitted field is carried forward at each handoff; an explicit {} still replaces. * test(server): fixtures for agents and workspaces carry metadata Agent snapshots and workspace records now always carry metadata, so the hand-built fixtures and expectations in three existing suites name it. * docs(plugins): the hook result comment names metadata as the field that stays * fix(server): reopening a closed agent keeps metadata saved just before The loader reads the agent record, then queues a resume. A setMetadata queued ahead of that resume saves a newer record, and the open hooks saw it, but registration took metadata from the loader's older read and wrote it back over the saved patch. Registration now uses the metadata read inside the lifecycle lane. * docs(server): name the metadata gap when a handle-less agent is recreated on load * docs(server): the handle-less recreate gap spans the agent.create.before hook * docs(plugins): an agent.open.before hook starts writes to its own agent without awaiting An agent.open.before hook that awaits setMetadata (or any write) on the agent being opened deadlocks: the write joins the agent's lifecycle lane behind the open, and the open waits on the hook until it times out. The hooks reference now says so and shows the supported shape, a write started without awaiting, which runs right after the open. Deferred, not in this stack: reject such a write immediately instead of letting the hook time out. The host knows which plugin hook it is awaiting for the agent and which channel the write arrives on, so the rejection can be keyed on "this plugin is inside an open hook for this agent" without cross-process tagging, and an unrelated client's write would still wait as it does today. * feat(plugins): composer items and controls in all three composers A plugin registers a component with addComposerItem and reads and changes the composer through useComposer(): provider, model, mode, thinking, options, prompt, attachments and agent metadata. The agent, draft and New workspace composers provide the same ComposerInput and ComposerAgent halves, so a command reaches the right model without the plugin knowing which composer it sits in. Toggle, Select and Action are drawn by one ComposerControl renderer that the thinking select and provider option controls now use too. Controls sit in the toolbar when there is room and become rows in the existing overflow sheet otherwise, so on a phone they appear in the overflow. Plugin items count in the density presence so the composer condenses to make room. Model and mode stay specialized but share the trigger, density and overflow. Draft metadata is kept locally, sent at creation and reset when the prompt is sent. PluginAgentSnapshot.metadata, deferred from the metadata phase, lands here. The unused provider badge is removed. vitest resolves @floating-ui/react-native to its ESM build: the CJS entry requires the real react-native, whose Flow sources do not parse. * fix(plugins): composer commands run on current state, report failures, and reach the overflow sheet Draft commands read the state captured at render, so a plugin's `await setProvider(); await setModel()` acted on a stale provider. The draft form and options are now plain stores that commands read live, and `setProvider`/`setModel` reject an unavailable provider or a model the loaded catalog does not list. Draft `options` include the plugin's pending edits. Shared composer controls own the pending state and show a rejected command as an error toast, like the built-in controls. Callback payloads are objects (`{ value }`, `onPress(event)`) so they can grow without breaking plugins. The overflow sheet's content portals to the app root and lost the composer's agent, input, toast and query contexts, so plugin items drew nothing in it. `useComposerSheetBridge` carries them across. * test(plugins): composer commands tested on the models, overflow sheet in Playwright The draft composer's command rules (unavailable provider, unlisted model, edits belonging to the provider the form has now) moved from the React hooks into the form store and the draft options model. They take the host's catalog as a plain input, so the command tests run on the real models with no module mocks and no renderer. The overflow-sheet test faked the portal it was meant to verify. It is replaced by a Playwright spec that installs the composer-controls example and checks its rows in the narrow composer's Features sheet; it fails when the sheet's context bridge is removed. * test(plugins): lock draft option ownership without a subscription, name the overflow-sheet steps The draft option test subscribed the options model to the form, which in the app happens in a render effect, so it passed without the model observing the form's provider itself. A case with no subscription now fails when that observation is removed. The overflow-sheet spec reads as steps through a helper. * fix(plugins): composer option resets and model checks match the documented commands A draft kept `null` as an option value, so `setOptions({ key: null })` sent the null to the provider and creation failed. A null edit now removes the key from every draft layer, as the patch does on a running agent. A running agent's `setModel` accepted ids its catalog does not list; it now rejects them the way a draft does. The composer controls imported the toast host through the toast context, which pulled the host's animation module into every module that loads plugins. They use the API-only context instead. The migration guide's registration table gets the `addComposerItem` row its test requires. * fix(plugins): draft metadata survives a remount, plugin commands follow the composer lock Draft metadata was component state while the prompt lived in the draft store, so a composer that remounted across the compact breakpoint kept its text and lost the plugin's choices. It now lives in the draft store beside the prompt, is cleared when the draft is sent, and is not cleared when the prompt is emptied. It is not persisted across app restarts. While the New workspace composer is creating the agent, the built-in controls are disabled but plugin controls and commands were not. They read the composer's own lock: Paseo controls render disabled, and setPrompt, insertText and the agent commands refuse. The options and metadata a plugin reads are frozen copies, through the same helper the timeline projection uses. The composer control test mounted components in JSDOM, which the testing rules ban; it now runs in the browser project. * fix(plugins): a kept command honors the composer lock, and useAgent metadata is frozen A plugin action that awaits an RPC holds the composer it was created with. The lock was captured at that render, so a submit that started meanwhile did not stop its insertText. Commands now ask the composer whether it is locked when they run. The agent snapshot a plugin gets from useAgent froze only the outer metadata record. It now uses the same deep frozen copy as the composer. * fix(plugins): attachment commands honor the composer lock The creation request captures the attachments when it starts, so an attachment a plugin added or removed afterwards was lost or left in the request. They refuse like the prompt commands. * fix(plugins): a built-in select in the compact sheet keeps its action name The shared control named every icon-only select by its value ("Speed: Fast"), including in the compact sheet, where the row already shows the value. The sheet row is named by its action again ("Select speed"), as before the shared renderer. * test(app): composer item test installation carries the subscribe main added to InstalledPlugin Main's plugin streaming (#8527) made subscribe a required field of InstalledPlugin; the composer item model test builds its own installation and predates it. * feat(plugins): New workspace items set the branch and workspace metadata addNewWorkspaceItem mounts a plugin field on the New workspace screen, and useNewWorkspace() exposes host, project, isolation, base ref, branch and metadata with commands that follow the composer item rules: they act on the screen's state when they run, resolve once applied, reject while the screen is locked, and take JSON payloads. Host and project are read-only because a command that switched them would unmount the item that called it. The screen's pickable state (base selection, manual isolation, branch, metadata) moves into one plain store so pickers and plugin commands write to the same place; the screen reports derived facts to it on each render. The branch is sent as source.branchName only for a branch-off worktree, and metadata on workspace.create. Items render through ComposerControl with a new "field" surface (badge on desktop, full-width field when compact). Combobox ships here: Paseo owns the loading and error states, keeps previous results, and drops superseded searches. * fix(plugins): New workspace commands work from mount effects, and branch and base ref match what creation uses A command called from a New workspace item's mount effect rejected because the setup model only received its inputs and the pickers' handlers from a passive effect on the screen, which runs after a child's. The model now takes its inputs at construction, picks the base and isolation itself, and is refreshed in a layout effect; the screen supplies the side effects of a pick (the PR attachment, the remembered isolation) as listeners. The branch a plugin sets was dropped when no base was resolved, such as on a detached HEAD, because it was sent only for an explicit branch-off. It now applies whenever the worktree cuts a new branch, decided in one place that mirrors the daemon. baseRef.name was the display-shortened branch name, so setting back what was read based the worktree on the local branch instead of the origin one. It is now the exact ref creation uses, and host and baseRef are frozen like project and metadata. * fix(plugins): New workspace commands have the same effects as a pick, even from a mount effect The screen attached the pick side effects (remembering the isolation, syncing the picker's PR attachment) as listeners in its own useEffect, which runs after a child item's mount effect. A mount-time setIsolation("worktree") switched the screen but was not saved, and setBaseRef skipped the attachment sync. The effects are now injected when the setup model is built, so a command and a pick run the same code from the first render. Closing the picker stays in the picker's handler. * fix(plugins): a Combobox shows a failed refresh instead of the old results The query keeps its cached data when a reopened list fails to refresh, so the old items stayed selectable and the error never showed. A failed search now clears the list so its error shows. The migration guide maps addNewWorkspaceItem, which its registration-coverage test requires, and the superseded-search test waits on a later search instead of sleeping. * fix(plugins): a branch and metadata chosen for one project are not sent for another The setup model outlives the project and host it was chosen for, so an issue picked for project A was sent on workspace.create after the user switched to project B. The model now drops the branch and metadata when the project changes (project ids are host-scoped, so a host switch counts). A project that is still resolving is not a switch. The base selection is left alone: the built-in picker keeps a branch pick across a project switch, and that behavior is unchanged. * test(plugins): the project-switch spec expects the other project's metadata to be empty * fix(plugins): a host switch drops the branch and metadata even when the project id repeats A remote repository keeps the same project id on every host, so comparing the project id alone missed a switch from host A to host B for the same repository. The target is now the host and the project id together. * fix(server): a branch the caller named is not renamed from the first agent context The daemon marked every new branch-off worktree for automatic naming, recording the chosen branch as the placeholder, so the first agent's prompt could rename a branch a plugin or client had named through branchName. Only a branch the daemon derived from the worktree slug is a placeholder now. * fix(plugins): New workspace items remount when the project or host changes An item stayed mounted across a project switch, and its Combobox kept the previous project's results (same query key, cached data) selectable until the next search returned, so an issue from the old project could set the branch and metadata on the new one. A Combobox cannot detect that its inline search now means another project, so the item host keys the items by host and project id. Items and their search results start fresh for the new target, and a mount effect sets up again after the model clears the branch and metadata. * docs(plugins): a layout-effect command on mount also races the reset on a project switch * fix(plugins): a New workspace item's commands stop working once its project or host is left Every item received the same command functions, which act on the current screen state. A lookup that finished after the user switched projects could still call setBranch or setMetadata and overwrite the new project's choices; the reset on a switch only clears what was already written. The setup model now hands out commands per target with commandsFor({ serverId, projectId }). They reject with a "moved to another project or host" error when the screen is on another target, like the lock rejects, so the promise only resolves when the change took effect. * feat(plugins): reach a running agent's composer by reference useComposers(selector) in any plugin component and composers(selector) on every command context return the composer of a running agent, named by id or by focus, whether or not its tab is open. A running agent now has one store-backed composer model apart from any mounted tab. The mounted composer plugs its cursor-aware insert in while mounted; otherwise insertText and setPrompt write the agent's saved prompt. model and thinking resolve through the provider catalog with the picker's own function, so a read equals what the picker shows. The host reads one ComposerModel from context and no longer knows whether it is in an agent, a draft or New workspace. The daemon rejects an unlisted model or thinking option for a running agent, replacing the app-side guard. * fix(plugins): composers by reference follow the focused agent and reach retained composers - `{ focused: true }` is the agent Command Center hands to agent items, published by its registration through plugins/focused-agent.ts and empty outside a workspace. The composer source reads that module instead of the remembered workspace selection, the navigation store and the layout store, which also removes the require cycles those imports added. - A composer the app retains in a workspace the user left has no live input. `insertText` and `setPrompt` now store the text with `replaceDraftText`, which asks the mounted input to show it; before, the text reached the store but the retained input never displayed it. - `model` and `thinking` read exactly what the picker resolves before the catalog loads (no models), then re-resolve when it lands, instead of reading null. - The daemon validates a thinking option against the model the agent runs: the runtime model when the provider lists it, else the configured one. - The composer sources subscribe to query-cache updates only. A query another component creates during its render is announced as `added`, and a subscriber that updates then made React warn about updating a component while rendering a different one. A catalog read no longer starts its load synchronously either. * test(plugins): a Command Center agent item reaches the composer through the real client state The command-path test now reads workspace and agent through createPluginClientStateSource over seeded session stores, so an empty lookup, which makes the Command Center return before calling the item, would fail it. Also records at the focused-agent publisher that it publishes in an effect. * fix(plugins): a running agent's composer validates and refreshes against the agent's own catalog setAgentModel and setAgentThinkingOption checked the provider's global catalog, while the picker reads the catalog of the agent's directory, so a model only the project lists was rejected. The validation input now carries the directory. The composer read the catalog once with no observer, so reconnect repair, which refetches only active queries, never refreshed it and a failed load never retried. While anything watches, the composer now observes the catalog query. The shared composer map kept every agent's composer for the session. It is now dropped when nothing watches it and no composer is mounted. * fix(plugins): useComposers holds the composer it names, and a composer lives as long as its agent PluginComposersSource.subscribe watched the stores directly and never the composer model, so a component using useComposers did not keep the model's catalog observer alive and reconnect repair skipped it. subscribe now takes the selector and holds the model it names, following focus. Dropping a composer when it went idle left a command a plugin had saved calling a dead model after the tab reopened. A composer is now dropped when its agent leaves the session and nothing watches it or has one mounted. * fix(plugins): a composer refreshes a stale catalog on resumed demand, shares its store watches, and is released with its last holder Watching again, or reading once, after the catalog was invalidated or failed while nothing watched now starts one deduplicated refresh; the observer refetches on mount. Reconnect repair only refetches watched queries, so an unwatched catalog stayed stale. Each subscribe installed its own session and draft store callbacks, so N watchers received N squared notifications, including for other agents' drafts. One pair of subscriptions now serves all listeners, and the draft callback ignores drafts of other agents. A composer whose agent was removed while it was held was only released on the next session change. The last holder letting go now checks too, and an archived agent's idle composer is releasable. * test(server): live model and thinking switches use values the provider lists The daemon rejects a model or thinking option its provider does not list, so the live-preferences e2e can no longer switch to a made-up id. A provider that lists nothing to switch to skips the case. * test(server): the test providers list two models with thinking options, and the live switches run The fake providers listed one model and no thinking options, so once the daemon validated selections against the catalog the live model and thinking switches had nothing valid to switch to and skipped. Every fake provider now lists two models with thinking options, and the switches run for all three providers without depending on installed binaries. * fix(plugins): a retained composer that is not showing takes plugin writes through the draft On native a retained composer keeps its input mounted under display none, so the ref alone said the input was live and a plugin insertText replaced the stale selection instead of appending to the draft. The input is live only while its retained panel is showing. * test(plugins): the retained input liveness test runs in real Chromium * fix(plugins): a model or thinking change, an unreported option key, and a draft model reach the provider unchecked Paseo no longer checks these in front of the provider. A running agent's model or thinking change no longer waits for the catalog or checks it, a plugin provider is sent every option key and refuses what it cannot apply, and a draft setModel keeps the id as the model picker does. * fix(plugins): a plugin reporting settings is sent every key of an options patch * Run option, model, thinking and mode changes in the agent's lifecycle lane The agent manager owns all sequencing for one agent: applyOptions, setModel, setThinkingOption and setMode now run in the same lane as open, close, archive, labels and metadata, so a provider session never sees two of them at once. Provider-side serialization (the applying chains in the ACP, plugin and OpenCode sessions, and Claude's apply-over-current-options handling) is deleted. * Reopen a handleless agent inside its lifecycle lane A stored agent with no resumable session is now reopened by AgentManager.createAgentFromRecord, which rereads the record inside the agent's lane before creating the first session. A metadata or label write queued ahead is in the record it reads; one queued behind applies to the live agent. The loader no longer passes a record it read outside the lane. createAgent itself also runs in the lane, like resume. * Return the draft's options from AgentClient.listControls listControls now answers { controls, options } like AgentManager.listDraftControls: the options a session opened from the draft would run with, with config defaults merged in and anything the provider resolves natively for the ones nobody set. ACP fills unset feature selects from the probe session's currentValue, so a fresh Cursor draft shows the Fast selection the agent opens with instead of no selection. The legacy features response and the MCP draft listing already project from the manager's result, so they follow. * Send a profile's options on every write, empty included The profile form always sends options. The daemon reads a write without them as one from an app that predates options and folds featureValues over the stored ones; a write that carries them, empty included, replaces them. A profile left with no options is stored without the key, so removing the last one persists. * Read a remembered Codex fast_mode as its service tier The create-agent preferences convert the legacy key on read, keyed on the built-in codex provider id, so the Codex draft shows the Fast selection the user last used. Tagged COMPAT(featureValues) with the other legacy-option shims. * Document one option change at a time per agent The agent manager runs option, model, thinking and mode changes in the agent's lifecycle lane; providers do no sequencing. The hook deadlock warning now covers agent.create.before and option writes. * Flatten the profile fold's base selection and drop an unused import * Carry the New workspace context through portal hosts and the draft's metadata through retry * Convert legacy options when resolving a stored agent's effective options * Keep stored-record reads tolerant of a legacy option the conversion rejects * Keep plugin attachment items separate from the draft's own * Hand plugin command inputs to the host as its own copies	2026-11-09 10:10:16 +07:00
Mohamed Boudra	680e6077a8	test(app): keep turn footer timing on one line when the chat has room (#9080) ... The completed turn footer wrapped "Worked for 26s" onto two lines at full chat width in builds before #9007, which sized the duration to whichever label had more characters. A label with fewer characters can paint wider, so the duration wrapped inside the narrower timestamp's width. #9007 gives both labels the full label column; this locks that behaviour with a browser test using real layout. The browser test project could not load anything that reaches the toast context: react-native-web has no ToastAndroid, and native ESM rejects the named import. A react-native test shim re-exports react-native-web and adds it. The lucide test stub gains the icons the message module imports.	2026-11-08 12:00:08 +07:00
Mohamed Boudra	4f7813d3aa	Keep the tapped line in place when chat disclosures expand or collapse, with the native timeline on LegendList (#8717) ... * Keep a disclosure's trigger in place on web Expanding or collapsing a turn summary, tool-call group, tool call details or todo badge now holds the row that owns the trigger. Rows inside the timeline get a disclosure context; each toggle runs its state change through `useDisclosureHold()`, and the viewport's new `holdRow(rowId, apply)` replaces `holdReadingPosition()`. On web the hold pins the reading anchor to that row, stops following output, and resumes following when the change leaves the list at its end. Native keeps its previous behaviour (detach, then apply) until the anchored toggle lands. * Render the native chat timeline with LegendList in forward order The native timeline was an inverted FlatList. Disclosure toggles moved their trigger, and a cold open settled visibly. It is now a forward-order LegendList that stays virtualized, and one owner moves the scroll offset at a time: - Before placement: LegendList's initial scroll, behind its hidden reveal. - While following: the end pin (native-end-pin.tsx). This is a zero-height first child at the bottom of the content, which native maintainVisibleContentPosition keeps in place. A content shrink or growth never scrolls from JS; only a viewport resize or an explicit jump does. - During a disclosure hold and while detached: LegendList MVCP with shouldRestorePosition (native-disclosure-hold.ts), so a toggle keeps its trigger at the same y and paints one layout change. - Every newly mounted row starts at a per-kind estimate (new-row-estimates.ts). PaseoScrollView defers React Native's content clamp while MVCP is set. A shrink below an unmoved anchor no longer draws a frame past the end (RN #58578, PR #58695). VisibleContentPositionClampTest covers this. LegendList 3.7.1 patch, one "Paseo patch" comment per hunk: - The content height comes from React state on the new architecture. - Rows get a per-row size estimate. - The MVCP anchor lock runs on native too. Upstream gated it to web in d24a9d93 without a native reason. Without the lock, the size pass for prepended history re-anchors on a prepended row and moves the rows on screen. Native ends the lock when its row leaves the view, not on the 300 ms clock. - Header and footer reveal together with the rows. - Only lists that keep their end preserve the initial end. - A remeasure within one pixel plus the 1/8 dp floor of the known size is noise. Upstream compares the raw size with the floored one, so the live turn's assistant row (1380 -> 1381 px) read as a resize and moved every row a frame after the reveal. - The Android silent initial scroll retry sends its 1 dp nudge and the return to the target in one task. Upstream returns on the next frame, but its 16 ms check can finish the scroll first and cancel that frame, so the list revealed 3 px short of its end and moved into place a frame later. - The top-padding shrink hold applies on iOS only. Android, emulator. Evidence is in .artifacts/legend-impl. - J1, J2 at the end, J3, J4, J5, J6, J7: pass. - J2 while streaming: not reachable on the Ten second stream fixture; its turns never fold. - J8: no blank frames over 10 fresh flings, at host load 32-37. J4: still. Before these two hunks, 6 of 7 cold opens moved every row one frame after the reveal. After them, 9 valid cold opens show no shift. 5 of those were traced through the nudge path. Runs that hit the dev client's startup SIGSEGV in MountingCoordinator::pullTransaction were left out. That crash is in the emulator's dropbox from before this work. * Revise a history row when its turn summary line changes LegendList renders a row again only when its item changes. The forward-order timeline in d1f2ae352 folds a finished turn into its host user message, but the host's item does not change when the fold appears, so a turn that folded live lost its summary line until something else revised the row. collapseTurns now reports the hosts whose summary line appeared, changed or went away since the previous fold (updatedHostIds), and the history row revision treats them as changed content. * Stop following the end while a user scroll owns the viewport The bottom anchor controller kept sticky-bottom for the whole of a drag and its momentum and only decided at the end. While it is sticky the native list mounts the end pin, so a drag started during a stream had every new line move the rows under the finger: on the iOS simulator the offset jumped by each line's height (+22, +35, +22 pt) mid-drag, and Android does the same with the same code. beginUserScroll now detaches. endUserScroll resumes following when the gesture ends at the end (scrolling there without animation) and otherwise stays detached and drops any pending anchor, as before. The re-stick is not animated: on Android a line that mounts during a smooth scroll cancels it, and the list then followed 40 pt short of the end until the controller detached it. Measured after the change, frame by frame: - iOS and Android, drag up mid-stream: the content tracks the finger and momentum with no line steps; the stream grows below; tapping the pill re-sticks and follows again. - A short drag at the end, mid-stream: following resumes; the release lands on the end in one frame (the drag distance, here 8 pt on iOS and 21 dp on Android). A line already mounting when the drag begins can still move the rows once in its first frame, because the detach reaches native one commit after the touch. * Correct the iOS scroll view under maintainVisibleContentPosition Phase 2 of the LegendList timeline. The native timeline relies on maintainVisibleContentPosition for the end pin and the disclosure hold, and React Native 0.86 on iOS gets two cases wrong. modules/paseo-scroll now registers PaseoScrollViewComponentView, a subclass of RCTScrollViewComponentView, for the iOS scroll view, like PaseoScrollView on Android. - A mount that removes its own anchor: detaching removes the end pin in the same mount that opens the tapped disclosure, and the offset jumped by the removed view's frame. The subclass keeps the offset when the anchor's tag is no longer registered, the check React Native 0.88 adds in https://github.com/react/react-native/pull/57294. That PR's extra superview check is not copied because it skips anchors detached by removeClippedSubviews (https://github.com/react/react-native/issues/58910). - A shrink at the end: UIKit clamps the offset to the new end during the mount, then React Native adds the anchor's movement, so a turn folding while following landed above the end (https://github.com/react/react-native/issues/58578). The subclass restores the pre-mount offset for the adjustment and clamps after it, as https://github.com/react/react-native/pull/58695 does. The dev client was rebuilt with the module. Verified on the iPhone 16 Pro simulator, frame by frame: the summary far up and the latest turn's summary while following each keep the trigger at 0 px with one layout change per toggle, the todo card the same, the cold open lands still, older history pages keep the visible rows in place, and the keyboard, send-time shrink and streaming stay pinned to the end. Freshly mounted markdown on iOS paints one frame after its layout, because enriched-markdown renders asynchronously (https://github.com/software-mansion/enriched-markdown/issues/1131). A synchronous first render removed that frame but raised fling frame time at p90 and p99, so it is not part of this change. docs/agent-stream-disclosure.md now describes the clamp correction on both platforms. * Keep the rows under the finger at a drag's start and its release Two one-frame row movements remained around a user scroll while the timeline streams. A drag's first frames. The end pin stays mounted until JS stops following, one round trip after the drag begins, so a line mounting in those frames scrolled the rows under the finger by its height. Both scroll view subclasses now skip the content-position correction while the user drags and the anchor is the end pin, which they recognise by its native ID ("paseo-end-pin"). Android overrides scrollToPreservingMomentum, the position keeper's only scroll call, from the begin-drag event until the finger lifts; iOS skips the adjustment while the scroll view is dragging. The skip is limited to the pin: LegendList's own anchoring for the detached list also uses the native correction, and a history page landing mid-drag needs it. It starts at the drag rather than at touch-down: a tap or long press while following would otherwise leave the list stranded short of its end, still following, once the finger lifts. The release. A gesture ending within 32 pt of the end re-stuck with an instant scroll, a snap of up to 56 px. Following now resumes only when the finger lifts at or past the end, or momentum stops there, within 1 px, the distance web resumes at (strategy-web.tsx). Anything else stays detached with the pill. The check runs when the gesture is decided, so output that arrived below meanwhile counts. A release past the end counts as at the end: on iOS it bounces back, and a line landing during the bounce scrolls in as following would. endUserScroll takes isAtEnd, like releaseDisclosure. Tests: VisibleContentPositionClampTest gains growth at the end during a drag (red before the change: the offset moved by the 120 px growth, 352 -> 472) and growth without a touch (the pin still follows); the module suite passes on emulator-5558, 11 tests. bottom-anchor-controller.test.ts: a release near but short of the end stays detached. Device, frame scans while streaming (dev clients rebuilt): - Android, 8 slow drags with a pill tap between: no frame moves against the finger once a drag starts; the stream follows between drags. Three short releases 50 px short of the end stay put until the pill; three drags back past the end resume following. - iOS simulator, 6 drags: no line step during any drag or its momentum. Two short releases stay detached with no snap; three drags past the end resume following within 0.5 s of the bounce. * Document the LegendList timeline and remove what the inverted list left The native section of docs/agent-stream-disclosure.md described the FlatList hold (anchor neighbour, native child index, frame spacing, render window). It now covers why the timeline is forward order, who owns the offset in each state, the hold and its sync layout trigger, user scroll and release, draw distance numbers, the LegendList patch and the scroll view corrections. Draw distance stays at 2000. The spike measured it on a chat with a 15,000 px turn expanded: 500 blanked the viewport 1.0 to 1.5 s per fling and 2000 not at all. A re-measure on the collapsed chat (500, 1000, 1500, 2000, interleaved) blanked at no value and its jank followed host load, which stayed between 19 and 40, so it could not separate 1000 or 1500 from 2000. The patch file now opens with a header listing its eight hunks by purpose and linking LegendApp/legend-list#593, which reports each one upstream. The markdown doc records the iOS first-paint delay (software-mansion/enriched-markdown#1131). Removed with the inverted list: PaseoScrollView's child-reveal override (a no-op without the inverting transform) and ScrollSelectionTest, the invertedWrapper style, and the inverted-list passages in android.md, native-text-selection.md, mobile-testing.md, floating-panels.md and agent-stream-performance.md. model.test, layout.test and footer-spacing.test still asserted the inverted native order and failed; they now assert forward order, and footer-spacing uses the real strategies instead of an inverted stub. * fix(app): show a reply's footer when the next prompt arrives on native LegendList re-renders a mounted row only when its item or extraData changes. When a new prompt arrives, the previous reply's footer moves from the live auxiliary slot into that reply's layout item (completedFooter). The reply's StreamItem keeps its identity, and renderItem is a stable event, so the row never rendered its new layout and the footer (copy, timing, fork) disappeared until the row remounted. FlatList had the same gap. The history renderer is now LegendList's extraData. Its identity changes with the history layout map, and StreamRow's memo limits the pass to rows whose layout item changed. * test(app): run the web disclosure hold cases in a real browser The three hold cases simulated layout in jsdom: hand-written row heights, scroll clamping and resize callbacks. They could pass while Chromium paints the trigger somewhere else. They now run in Vitest browser mode with real layout, ResizeObserver and scroll clamping. The two hold cases fail when the hold is bypassed. The browser project pre-bundles @tanstack/react-virtual, so its first import no longer reloads the test mid-run. The lucide stub gains ArrowDown, which pane-find imports. * fix(app): let a drag end a disclosure hold on native A drag detached the bottom controller but kept the disclosure hold. Every item size change restarts the hold's quiet frames, including a streaming row's, so the hold can outlive the toggle. While it lasts, shouldRestorePosition accepts only the held row. Once the drag scrolls that row away, a history page arriving mid-gesture gets no anchor, and the rows the reader was on move by the page's height. The drag now cancels the hold without releasing it. The controller keeps no hold state of its own beyond detached, and the gesture's end decides whether following resumes. * perf(app): keep the scroll-to-bottom button's state out of the timeline Opening a tool call or turn at the end of the chat now holds its trigger in place, so the timeline detaches and the scroll-to-bottom button appears. That visibility was useState in AgentStreamView, so showing the button re-rendered the whole timeline view for a change only the button reads. The viewport now writes near-bottom into a per-agent store that only the button subscribes to. * fix(app): show the scroll-to-bottom button on native whenever following has stopped A gesture now resumes following only when it ends within 1 px of the end, but the button still hid within 32 px. A release 2-32 px short of the end left the list detached with no button to return. While detached the button now hides only at the end; while following it keeps the 32 px tolerance so content growth that the offset trails for a frame does not flash it. The button also updates when following starts or stops without a scroll. * fix(app): stop the timeline jumping when the keyboard opens or closes on native The keyboard's settled height was committed to the list after the motion, as paddingTop on Android and contentInset.top on iOS, to keep the top of the history reachable under the translated dock. While following, the end pin absorbed it in the same mount. While detached or holding a disclosure, nothing did: Android's native anchor is LegendList's ScrollAdjust view, which padding does not move, and LegendList compensates a padding change only on iOS. Every row jumped by the keyboard height 0.2-1 s after the keyboard settled, and back after it closed. On send, the same commit raced the jump to the end. The keyboard now only translates the list with the composer. The cost: while the keyboard is open, the composer viewport clips the top keyboard-height of the list, so the start of a short conversation is hidden until it closes. * chore(app): describe the native timeline as LegendList in stream comments * fix(app): keep a disclosure's trigger in place when its row is cut off at the top on native LegendList's idsInView starts at the first fully visible row. When a turn host's prompt bubble sat above the viewport, a disclosure hold found no anchor in the data pass (shouldRestorePosition rejects every other row), and the size pass anchored on the row below the host instead, so the trigger moved by the host's size change. The patch appends the partly visible rows to idsInView after the fully visible ones, so the held row anchors while every pass that does not restrict the anchor keeps the first fully visible row. The browser test renders the patched native build, which vitest now aliases instead of the package's unpatched web build. * fix(app): let a turn's summary line collapse again after it opens The React Compiler cached StreamRow's `renderStreamItem(layoutItem)` on the layout item and the renderer. The revised item that useRevisedHistoryRows hands a row whose display state changed only fed the row id, so the row reused its cached content. Opening a turn usually inserts its rows directly below the host, which also gives the host a new layout item. When another row sits between them, such as a compaction marker, the host kept its layout item, its summary line stayed collapsed, and every later tap asked to open the turn again. The renderer now takes the item it renders, so the compiler's cache keys on the revision. StreamRow moves to its own module, which the tests compile the way Expo does. * test(app): alias the patched LegendList build in browser tests only Unit tests load @legendapp/list outside Vite, so the native build's react-native import skipped the react-native-web alias and reached React Native's Flow source, failing every unit suite that imports the native strategy. * fix(app): keep a size-only disclosure's trigger in place when its row is cut off at the top on native LegendList's prepareMVCP picks the anchor for a size change with no data change as the first row in view, without asking shouldRestorePosition. A disclosure that only grows its own row (a todo card) while that row's top was above the viewport therefore held the row below it, and the trigger moved by the row's size change. The patch now applies shouldRestorePosition to size changes as it already does to data changes. * test(app): render the timeline row revision test in a real browser The repo's unit tests do not mount components in JSDOM. The test still compiles stream-row.tsx with the React Compiler, so it fails when a revised row ignores the item it was handed.	2026-11-04 17:21:31 +07:00
Mohamed BoudraandElsa Granger	4991efddf8	feat(app): follow iPhone Duo vertical bars and fold divisions (#8741) ... * feat(app): follow system vertical bars and fold divisions Keep custom navigation controls outside system content areas and use active division regions for temporary panel allocation. Normal sidebar preferences resume when the division disappears. Co-authored-by: Elsa Granger <zeyugao@outlook.com> * fix(app): show window actions in the active portal scope The bottom-sheet provider creates its own portal context. Register the window action host within that context so symbols reach the root host. Co-authored-by: Elsa Granger <zeyugao@outlook.com> * fix(app): hide workspace bar actions behind compact panels Compact panels keep the workspace route focused while covering its content. Hide its portal actions until the workspace panel is active again. Co-authored-by: Elsa Granger <zeyugao@outlook.com> * fix(app): continue the sidebar surface across divisions Keep the fold free of controls while painting it as part of the sidebar, with the shared divider at the workspace edge. Co-authored-by: Elsa Granger <zeyugao@outlook.com> * fix(app): omit tab count beside the full tab rail The full tab rail already exposes navigation. Use the same compact/full header selection for the vertical action list. Co-authored-by: Elsa Granger <zeyugao@outlook.com> * fix(app): preserve folded navigation and bar action lifetime Use resolved sidebar visibility for desktop activity, and keep bar controls mounted while compact panels cover them so pending menu work survives. Carry circular button chrome inside the portal and exercise the rendered boundary in Chromium. Co-authored-by: Elsa Granger <zeyugao@outlook.com> * fix(app): own script actions across header placement changes Keep one script action instance on the workspace screen so pending restarts survive removal of either menu. Pass activity through the bar portal so covered menus close their overlays without taking workflow state with them. Co-authored-by: Elsa Granger <zeyugao@outlook.com> * test(app): exercise script ownership through the workspace Replace synthetic ownership fixtures with a real workspace, script menu and isolated terminal worker. Hold terminal exit until the compact header is removed so moving pending state back into the menu fails the regression. Exercise portal activity with production menu and header controls. Co-authored-by: Elsa Granger <zeyugao@outlook.com> --------- Co-authored-by: Elsa Granger <zeyugao@outlook.com>	2026-11-04 11:05:45 +01:00
Mohamed Boudra	336e7d1b89	Add first-run setup that walks new users through Paseo (#8363) ... * feat(app): add first-run setup modal New users landed on an empty "Add a project" screen and never found providers, Paseo tools or phone pairing, which all live in Settings. A one-time setup modal now walks them through Appearance, Providers, Projects, Orchestration and Phone. Every step renders the same component Settings uses, so changing something in setup changes it in Settings too. The modal opens only when the setup host is connected, its workspaces have loaded and it has no projects. Existing users already have projects, so they never see it after upgrading and no migration is needed. Finishing or skipping writes `@paseo:onboarding` on this client. It uses its own key because it records feature state, and e2e specs replace app settings wholesale. Settings > General > "Show setup again" reopens the modal on step 1. Native phones skip the modal for now. Shared pieces moved out so setup and Settings render the same thing: - ThemePicker is a tile grid and replaces the Settings theme dropdown. - PaseoToolsCard is extracted from the host page. - The skeleton pulse moves to components/ui. Provider rows show it while the first snapshot loads instead of "Loading…". - The pair-device direct-connection hint links to the Tailscale docs. The e2e fixture marks setup completed by default so existing specs keep their starting state. The desktop smoke and lifecycle scripts, which start from a fresh daemon, mark it before they continue. * feat(onboarding): suggest projects from agent history The setup's Projects step lists the repos the user already ran agents in, with busy recent ones preselected, so a new user adds their projects in one click instead of browsing for folders. With rows checked, the footer's main button adds them and only moves on once every one was added; a checked row always means "this will be added". The daemon resolves each session folder to its project root (main checkout for worktrees, repo root for subfolders) because only it can read the git state; the app asks once per provider so a slow or broken provider never holds up the others and can be retried on its own. Hosts without the projectSuggestions feature show only the Add project button. Onboarding e2e hosts read an empty Claude history with other providers off, so suggestions never depend on the machine running the tests. * fix(onboarding): keep late project adds on their step and show Retry early - A finished add only advances setup while the Projects step is still open. - A failed provider shows its Retry as soon as any provider answers. - The desktop lifecycle check no longer reloads the window: setup never opens there because no host is connected. * fix(onboarding): bind late project adds to their step visit and freeze rows while adding - Each step visit has an id; a finished add only advances the visit that started it, so leaving and returning to Projects, or reopening setup, ignores it. - Suggestion rows are disabled while their batch is being added. * test(app): drive theme selection through the tile picker Settings → Appearance no longer has a theme dropdown. The Escape test opens the syntax theme dropdown instead, and the Android system-bars check taps theme tiles. * fix(server): return project suggestion roots in the form project.add stores Git reports Windows repo roots with forward slashes, so an added suggestion kept showing because its path never matched the new project's root. * feat(app): two control sizes, orchestration switches and mobile connect choices in setup Controls had four sizes picked per call site, so a button in a dialog, a settings row and a setup step came out at different heights. Controls now have two: md (default; 32px with a pointer, 44px in the compact layout so phone controls are full touch targets) and sm (28px, for tight chrome and nested settings rows). The breakpoint picks md's height, not the caller. Setup: - Orchestration is three switches (Paseo tools, agent skills, CLI), all on, applied on Continue. Turning one off undoes it; the desktop CLI uninstall removes only the file this app installed. - The Mobile step has store buttons and a "Choose how to connect" section: Relay opens the existing pairing modal, Tailscale opens the docs. Settings section docs links are one pattern, SettingsSection's `link` prop, and modals sit on surface0 like a screen. The vitest unistyles stub now resolves breakpoint values by window width, as Unistyles does at runtime; without it md controls had no height in browser tests. * fix(app): finish setup on its last step and confirm undoing orchestration In the compact layout Orchestration is the last step, and Finish closed setup without applying its switches. The last step's work now runs before Finish, the same as Continue. Turning off skills now asks first, as Settings does. Removing the CLI keeps a paseo command this app didn't install and says so. A failed Paseo tools update shows a toast. Adding suggested projects no longer advances when a row was checked while the add ran. Chat sender attribution and the message preview toggle go back to the sm button: md padding is a breakpoint value, and on web its media-query rule beat the zero right padding that aligns the sender with its bubble. * fix(app): ignore a late Finish once the user left the last setup step Finish called complete(), which ignored the step visit, so pressing Back while Orchestration applied its choices still closed setup and recorded it as done. next(visit) now finishes setup from the last step, so a late Finish is dropped the same way a late Continue already was. * fix(app): hold the skills switch while setup applies its choices The Paseo tools and CLI switches were disabled while Continue or Finish applied them, but the skills switch only locked while a skills operation ran. With skills needing no change, it stayed editable during a pending tools update and the new value was silently dropped. * fix(app): read setup's skills choice as off when no skill is picked Saving an empty selection in the skills picker left setup's skills switch on. Continue then asked the host to install nothing, the host reported skills as not installed, and the step stayed put with no error. Setup now reads skills as off with nothing picked, as Settings does.	2026-11-03 10:28:26 +07:00
Mohamed Boudra	d6d5a266ad	Open a subagent in place of the subagents list on mobile (#8093) ... * fix(app): seat the subagent sheet's parent callout like the composer The sheet tab body padded the bottom safe-area inset, and the composer dock padded it again, so the parent callout in a subagent sheet floated a full navigation-bar height above where the composer sits in a tab. The sheet body (SheetBottomInset) now owns the inset: it pads it once and tells its content none is left, so the dock stays host-agnostic. Overlay sheets (adaptive modal sheet, menu sheet, combobox sheet) read the inset on the far side of their portal, so ones opened from sheet content still clear the screen edge. The callout takes the composer's rail and shows the parent's provider icon through StatusIcon: no icon box, with the running ring, attention dot or needs-input alert on the icon. * fix(app): give the attachment lightbox its own safe area An RN Modal passes its call site's context straight through, so a lightbox opened from a sheet tab read the bottom inset the sheet body had already spent (0) and drew over the navigation bar. The modal is its own window: it now gets its own SafeAreaProvider, which measures that window, and the image area reads its insets below it. floating-panels.md records the rule for overlays: read insets where the overlay draws. * feat(app): open a subagent in place of the subagents list on compact On phones, choosing a subagent from the subagents list now replaces the list inside the same sheet instead of stacking a second sheet over it. Back returns to the list, Close closes both, Android Back steps subagent -> list -> closed, and Open parent lands on the pane the list was opened from (for a nested subagent, its parent's sheet). - Menu engine: fill pages (`fill: true`) take the full sheet height, Back pops a page via `goBack`, and a page whose definition disappears falls back to the list. - One sheet pane (`screens/workspace/sheet-pane`) renders the header, body, bottom inset and focus for both containers: the workspace's detached sheet tabs and the in-list menu page. Only the container differs. - The header drags the sheet through `SheetDragArea`; compact menu sheets use the shared `SheetBackground`/`SheetHandle` chrome. - `selectSheetTab` describes the sheet a reveal would show without opening it. * fix(app): put the parent callout on one row The Open parent button already says what the callout is, so the Parent label goes. The parent's title shrinks to one line before the button does, so Open parent never wraps or leaves the row. * refactor(app): register panels once in the workspace screen Every reader of the panel registry called ensurePanelsRegistered, which imports every panel module. The panels render those readers (the agent panel's subagent track and parent callout, the new-tab panel's launcher, the diff panel's review surface), so each reader closed an import cycle through register-panels. The workspace screen, the only route that renders a registry reader, now registers the panels before anything under it renders, and the readers import only the leaf panel-registry. The pane content test registers a probe panel for real instead of mocking the registry. * test(app): transform the markdown WASM factory when Vite versions its URL Importing the sheet pane barrel in retained-chat-content.browser.test.tsx made Vite request md4c.js with a ?v= query, which the CommonJS-to-ESM transform did not match, so the test file failed to import.	2026-10-28 13:55:41 +07:00
Alessio Re	16fe07560f	fix(app): make question cards link-aware and selectable without accidental answers ... Render question bodies and option text with the shared Markdown renderer. Opening links or selecting question and description text leaves answers unchanged. Labels remain answer controls, and double-clicking a label advances only once. Add browser regression coverage and stabilize Markdown WASM loading in the test harness. Closes #3164. Co-authored-by: Alessio Re <NoSync@users.noreply.github.com>	2026-10-26 10:51:44 +07:00
Mohamed Boudra	995ad2f878	feat(plugin): render Markdown content with host UI (#7579) ... * feat(plugin): expose Markdown content component * docs(plugin): translate Markdown component reference	2026-10-21 19:14:17 +07:00
Mohamed BoudraandClaude	e5124b039a	Put sheets on one stack and show an agent's facts in its sheet (#6958) ... * Put sheet tabs on the one sheet stack Sheets are one primitive with one stack. A sheet opened from any sheet stacks on top of it, and closing it uncovers the sheet underneath. The compact workspace's file and subagent sheets were an in-tree Gorhom BottomSheet with their own stacking, so a subagent chosen from the subagents list sheet replaced the list instead of covering it. - SheetHostScope: a subtree hosts the sheets presented inside it, so the sheet tabs draw inside the compact column and read the workspace providers while still joining the app-wide stack. Needs Gorhom's BottomSheetModalInternalProvider, which the patch exports. - IsolatedBottomSheetModal takes enableDismissOnClose; false keeps the content mounted through a close so the unsaved-changes guard can veto it. Its backdrop then closes the sheet rather than dismissing the top modal. The Gorhom patch also keeps a dismissing modal's status through its final onChange(-1), without which such a modal unmounting while presented never left the portal. - SheetTabs (was WorkspaceSheetHost) renders one IsolatedBottomSheetModal per store entry. The store never reorders sheets; a reveal of a covered sheet drops the unmodified sheets above it. - Subagent rows that open a sheet keep the list open (closeOnSelect false); rows that open a tab still close it. - A menu closes when its retained panel goes inactive, instead of hiding and reappearing with the panel on the next tab switch. Co-Authored-By: Claude <noreply@anthropic.com> * Show an agent's model and thinking in its sheet, and fit Open as tab in the header rail A Paseo agent shown in a sheet has no composer, so the facts the composer's model and thinking controls would show now sit in one line under the sheet header, the same row provider subagents already get from the daemon. The line resolves exactly as the controls do (resolveAgentModelSelection), from the session agent and the providers snapshot, and shows wherever the pane host is a sheet. Open as tab becomes the full-screen glyph beside Close, drawn by the shared SheetHeaderIconButton, so the title keeps its width. The tab switcher sheet is titled "Workspace tabs" so it reads as what it lists. Co-Authored-By: Claude <noreply@anthropic.com> * Show mode and context usage in the sheet facts line The line under a sheet's header now carries everything the composer's controls and context meter show: model, thinking, mode, and used/max context tokens with the share, each resolved as its control resolves it. Co-Authored-By: Claude <noreply@anthropic.com> * Re-render subagent rows when the workspace's tabs change A row decides at render time whether choosing it opens a sheet or reveals a tab, and keeps the list open only for a sheet. The hook behind it only subscribed to the layout mode, so a row rendered while its agent was a full tab kept closing the list after that tab was gone: on iOS, promoting a managed child, closing its tab, and reopening it from the list dropped the list under the sheet. Subscribe to the workspace's layout too. Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-10-15 12:16:45 +07:00
Mohamed Boudra	6ad124758c	Stack workspace sheets and tighten sidebar density (#6885) ... * Stack workspace sheets and tighten sidebar density - Workspace sheets stack: opening a target from a sheet covers it, Back and drag close only the top sheet, and the header is the sheet's drag handle. - The workspace sheet reuses the shared sheet handle, background and header. - Fix the shared sheet handle indicator rendering black. - Sidebar text returns to semantic sizes; Pinned and Workspaces share one section header. * Pause covered workspace sheets and mock the shared sheet handle in tests * Export BottomSheetHandle from the browser test Gorhom stub * Let a stacked sheet's backdrop catch taps on iOS * Bring a revealed sheet to the top instead of duplicating it as a tab	2026-10-15 06:30:17 +07:00
Mohamed Boudra	e939dd4c7a	Streamline sidebar usage and stacked sheet interactions (#5805) ... * feat(app): streamline sidebar usage and stacked sheets * fix(app): restore compact sidebar navigation clicks The close button container emitted box-none through Unistyles as invalid CSS and intercepted New workspace clicks. Let React Native apply click-through behavior at the view boundary. Keep the import journey on its existing New workspace screen and assert only the visible transcript. * fix(app): cap menu sheets at eighty percent height Keep long sidebar usage reports recognizably sheet-sized while allowing the content to scroll. Short menu sheets retain dynamic sizing.	2026-10-01 04:55:17 +01:00
Mohamed Boudra	d7b7016cc9	feat(settings): polish navigation and controls (#5459) ... * feat(settings): polish navigation and controls * test(settings): update navigation assertions	2026-09-26 20:26:04 +02:00
3 people	a3fc59e818	Keep a project in the sidebar when its folder name ends in a space (#5205) ... * fix(app): keep sidebar order keys that end in whitespace A project view key embeds the project's path, so a directory whose name ends in a space produces a key that ends in a space. The sidebar order store trimmed every key on write, so the stored key could never match the key the sidebar looks up. computeSidebarOrderUpdates saw the project as missing from the order on every pass, appended it, and the store trimmed it away again, setting a fresh array each time. The effect that applies those updates re-ran on every render until React gave up with error #185, and the app failed to load until the folder was renamed. Keep keys verbatim on the runtime setters, dropping only blank keys and duplicates. Migration of persisted state still trims, where a stray space is an artifact of an older format rather than part of the key. Fixes #4880 * test(app): give AsyncStorage a real in-memory stub instead of mocking it `docs/testing.md` bans `vi.mock`, and the test added here mocked `@react-native-async-storage/async-storage` only because the module has no Node implementation: its default export reaches for the native module, so every write from the persist middleware rejects and a test that touches a persisted store drowns in unhandled rejections. That is exactly the case `test-stubs/` exists for, reached through the resolve.alias in `vitest.config.ts` the same way react-native-unistyles, react-native-svg and expo-linking are. The stub is a real in-memory key-value store with the same contract, so a test can read back what a store wrote rather than inspect a recording double. `sidebar-view-store.test.ts` carried the same mock for the same reason and no longer needs it either. * test(app): give the AsyncStorage stub the multi-key calls the app uses `provider-snapshot-cache` declares its own `ProviderSnapshotStorage` port and is handed the real AsyncStorage, so it calls `multiGet` and `multiRemove` during reconciliation and cleanup. The stub stopped at the single-key calls, which is fine until a test reaches the provider cache and then fails with `storage.multiGet is not a function`. `multiSet` comes along with them so the three multi-key calls behave as a set rather than leaving the next caller to notice the gap the same way. * test(app): cover a project folder name ending in a space end to end Adds a browser regression for #4880: the daemon accepts a directory whose name ends in a space, and the sidebar has to render its project row instead of tearing the app down with "Maximum update depth exceeded" on every load. * test(app): move the trailing-space spec setup behind a seeded-project helper docs/testing.md asks for E2E bodies that read like plain English with the setup in helpers, and for helpers that own the project record until cleanup. The spec did its directory creation, daemon seeding, and removal inline. seedProjectNamedWithTrailingSpace owns the directory and the daemon project and returns a cleanup, the same shape seedWorkspace returns, which cannot be used here because mkdtemp appends the random suffix and so cannot produce a name that ends in a space. The body is now goto, assert the row, assert no error screen. The row is still located by its sidebar-project-row test id, which is how every other sidebar spec and the shared sidebar helpers address a project row. --------- Co-authored-by: L4XB <lukas.buck@e-mail.de> Co-authored-by: paseo-bot[bot] <paseo-bot[bot]@users.noreply.github.com>	2026-09-22 22:06:24 +02:00
Mohamed Boudra	19a7d26349	feat(app): make the side panel user-directed (#3605) ... * feat(app): let the file panel close its tree rail The file panel's tree rail was permanent on desktop — the changes panel had a folder-tree toggle in its toolbar, the file toolbar had nothing, so the rail was there whether you wanted it or not. The changes panel's private DesktopTreeToggle becomes a shared TreeRailToggle so both toolbars render the same affordance; that also drops the treeToggleStyle prop threaded through ChangesToolbarProps, which recomputed exactly what the component already built internally. The i18n keys move out of workspace.git.diff into workspace.tree, since a shared component reaching into the git namespace would rot. The two rails keep independent flags — the file rail in panel-store, the changes rail in useChangesPreferences — so closing one leaves the other alone. FileTreeToggle wires itself to the store rather than taking a callback: the bar renders several components below FilePanel, where the rail actually lives. Both rails also get narrower (320 -> 260 default, 200 -> 180 minimum). The persist version bump resets treeRailWidth on purpose: nearly every existing install carries the old 320 default, so without the reset the narrower rail would only ever reach new users. Anyone who dragged their rail to a deliberate custom width loses it once. Note that MIN_CONTENT_WIDTH still clamps the rail to `containerWidth - 240`, so in a narrow pane the new default never applies — that floor, not the default, is what sets the width there. * feat(app): make the side panel an empty workspace surface The fixed, hideable side panel keeps supporting context beside an agent without seeding content. Pane-local choices stay local, while implicit supporting opens follow a persisted routing preference. * test(app): exercise side panel policy through its capability boundary The browser rail journey already covers the real tree-toggle behavior. Side-panel policy tests now pass their platform capability through the public boundary instead of replacing a production module. * test(app): expect an empty side panel after upgrade * test(app): expect an empty first split pane * test(app): account for the empty side panel in split retention * feat(app): make workspace panel tabs independent Give explicit New actions fresh tab instances, keep panel state opaque to tab management, preserve File navigation context, and stabilize uncached File transitions. * fix(app): preserve file conflicts during preview refresh Keep the current preview mounted for same-target reads and conversions so the editor retains its conflict observation state. Clear retained previews only when the file target changes.	2026-08-20 21:49:23 +02:00
Mohamed BoudraandChristoph Leiter	c779ef06c5	feat(workspaces): add workspace labels (#3510) ... * feat(app): workspace labels baseline Existing labels implementation, committed as-is as the baseline for the UI redesign. Server, protocol, catalog store and sync are sound; the UI layer is reworked in the commits that follow. Co-authored-by: Christoph Leiter <christoph@leiter.io> * feat(app): show workspace labels on the sidebar meta line Labels could be assigned and then appeared nowhere. They now draw as a chip on the workspace meta row, after the host, change request, checks and service, and they can be switched off from the Show submenu like any other item on that line. One palette, not two. `baseColors.workspaceLabel` was ten raw Tailwind 500s spanning a 1.9:1 to 4.5:1 contrast range — the exact set identity-colors.ts was written to replace. Label color is now the identity color of the same name, so a chip, a host badge and a CI check on one row sit in one contrast band. `workspace-labels/colors.ts` and its per-file `labelColorViolet` blocks are gone; `chip.tsx` and `swatch.tsx` are the only places a label color becomes ink. A row resolves its labels against its own host's catalog and nothing else. The cross-host projection answers too, but two hosts may give one name two colors and the merge settles that by target precedence and then alphabetical serverId — a row painted in a color its host never assigned is lying about the one thing the color is for. The meta row's doc comment argued against tinted chrome on that line. The chip is a deliberate exception — everything else there reports state and shares the state colors, a label is a name a person chose — so the comment now says that instead of contradicting the code. Alignment: - The chip is exactly as tall as the line: text at the row's 16pt lineHeight, no vertical padding, so a labelled row is the same height as an unlabelled one. - A label run that opens the line hangs left by the chip's own padding, landing the name on the rail the title above it uses. Mid-line the ground stays in the flow. - The swatch row reaches 44pt through hitSlop growing outward from a 20pt swatch, replacing ten 44pt colored blobs in the manager modal. - The picker's raw `<Plus>`, `<CheckSquare>` and `<Square>` go through withUnistyles with module-level mappings, at the menu's 14pt. Also fixes a bug this change exposed: `SidebarRowItemsSchema` is a strict object, so adding an item without a key there fails the whole settings write and silently loses every other Show toggle with it. A test now covers each item in SIDEBAR_ROW_ITEMS. Phase 1 of the workspace labels redesign. The filter menu, the picker's interaction model and the manager modal's layout are later phases. Co-authored-by: Christoph Leiter <christoph@leiter.io> * feat(app): one Labels filter page with tri-state rows Filtering by label cost three levels: Display -> Labels -> Include -> a page of labels, or -> Exclude -> the same page again. It is now one page: every label across every host, one row each, leading with its colour dot. A row cycles off -> include -> exclude -> off. Include is MenuItem's own check; exclude is lucide's X, the check's own pair, at the same 16 in the same trailing slot, so the column does not shift as a row cycles. Exclude also dims the row, because a state you have to identify by its glyph is not one you read at a glance. Unlabelled is a row in the same list, with a hollow ring where the others carry their colour. Match any / all still appears only once two labels are included. Clear is absent, not disabled, when nothing is filtered. Manage labels sits at the bottom below a separator. The whole root row is gone when no host has a label — unless a filter is still active, since the merged catalog only counts online hosts and losing one would otherwise strand a filter that is still hiding workspaces. The page is titled Labels, so its rows stop repeating the word: "Match any", "Match all", "Clear filter". The two Match rows sit directly under the list they qualify and only appear once two labels are included, so the subject is already on screen. All nine locales move together, translated rather than transliterated — Arabic keeps its noun, where "أي" is a determiner that needs one to stay grammatical. SidebarLabelFilter collapses from four collections plus match to one Record<labelKey, "include" | "exclude"> plus match: a tri-state row is one value per label, so include and exclude can no longer disagree about the same name. Unlabelled keys off the empty string, which normalizeWorkspaceLabelName makes unreachable for a real label. toggleSidebarLabelSelection, countSidebarLabelSelections, sidebarLabelSelectionIncludes and deduplicateSidebarLabelNames go with the old shape; setLabelFilter becomes cycleLabelFilter and setLabelMatch, so the store owns its own transitions. No migration: labels are unreleased, so the old persisted shape never shipped, and migrateSidebarViewState already resets on a safeParse failure. The e2e manager step asserted "Red label color" on a swatch that Phase 1 renamed to "Red"; the selector follows the code, and the accessibility.color key behind the old string is deleted from all nine locales as unreferenced. Co-authored-by: Christoph Leiter <christoph@leiter.io> * feat(app): assign labels on the menu's own rails The assign picker was a search box, a create row that unfolded an inline form under it, and hand-rolled label rows whose 44x44 checkbox pushed every dot and name off the rail the rows above them sat on. Nothing lined up with anything. Rows are `MenuItem` now: the colour dot in the 16pt leading slot, assignment as the trailing check the engine already draws for a chosen row. Using the engine's row is the alignment fix; there is no second row implementation to keep in step. Every press toggles and the menu stays open — assigning labels is multi-select, so the dual-target model (`source: "row" | "checkbox"`, `shouldCloseWorkspaceLabelPicker`) is gone along with the model's `close` dependency. You leave by dismissing the menu. Search is deleted. Nobody has enough labels to search, and the field was the thing pushing the list down the surface. `workspaceLabels.search` and `createNamed` go with it across all nine locales; `clearSearch` stays because the manager modal still owns a search field (Phase 4's copy, untouched here). `Create label` moves below a separator at the bottom and opens a page that replaces the list: a name field, the swatch row, one commit row. Picking a colour picks a colour — it no longer creates the label. A failed create keeps the draft and shows the error on the page; a successful one creates, assigns, and returns to the list with the row ticked. Both menus share one page definition. `SidebarWorkspaceMenu` and `SidebarWorkspaceContextMenu` each built the same `pages` memo; they now call `useWorkspaceLabelMenuPages`. Menu engine, all of it forced by putting a text input on a menu page: - `MenuTextField` — the form kit's `FormTextInput` carries a screen's geometry and lands its text 4pt inside the labels above it. This one is drawn as a row's own fill, so the box and the text sit on the row's two rails at once. - `MenuPageDefinition.hoverIntent` — a page you type into is not one the pointer opens or dismisses. Without it the create flyout opened on a pointer passing over the row, and threw the draft away when the mouse drifted off it while the hands were on the keyboard. - The sheet keeps `keyboardBehavior="interactive"`, not `extend`. With `enableDynamicSizing` the largest snap point is the content's own height, so a short page did not grow and the keyboard came up over the field. Caught on an iOS simulator, fixed, and re-shot. - `MenuItem` announces `selected` as `aria-checked`. The deleted checkbox said so; a check drawn and never announced would have been an accessibility regression. Tri-state rows (the filter page's exclude) still cannot announce themselves — menu-wide, still Phase 5's. `sidebar-workspace-row.tsx`'s `isTouchPlatform = platformIsNative || isCompact` is kept deliberately. On a compact web viewport there is no hover, so the row's trailing actions and kebab were unreachable and the labels menu with them; this is the documented `isHovered || isNative || isCompact` shape from CLAUDE.md. Evidence: /tmp/labels-p3-{wide,compact}-{light,dark}-{list,create}.png, the create page on iOS with the keyboard up (/tmp/labels-p3-native-compact-keyboard.png) and the clipped sheet it replaced (-before.png). `packages/app/e2e/browser/workspace-labels.spec.ts` rewritten for the new model, daemon-backed failure coverage kept for both the toggle and the create path, green with the menu unit suites. Co-authored-by: Christoph Leiter <christoph@leiter.io> * feat(app): edit a label in one operation `workspace.label.rename.request` and `workspace.label.recolor.request` become one `workspace.label.update.request { name, newName?, color? }`. Both old RPCs are deleted outright — no COMPAT shim, because the labels feature is unreleased and neither name has ever been on a wire a user owns. The `workspaceLabels` capability flag stays; that one is how a new app detects an old daemon. Two calls could land half-applied, which left the catalog in a state nobody asked for and the UI with nothing true to say. One catalog commit now applies the name, the colour, or both. Renaming onto a name the host already has is rejected rather than merged, and the check runs inside the planner so a refused collision applies neither field. A label keeping its own key is not colliding with itself, so case-only edits pass. The manager modal follows: - The host selector is `HostFilter`, the pill History and Schedules use. `includeAllHost` is now a prop: a surface that edits one host's catalog cannot carry out "all". - Search moves to the sheet header, where it spans the header's own rails. As a body control it capped at the component's 420pt and left a hole on the right whenever a host filter wasn't beside it. `workspaceLabels.clearSearch` goes with the box that had a clear button. - A row no longer opens an editor. It carries a pencil in its trailing slot, hover-revealed on web and always visible on native and compact, on the canonical plain-View hover pattern with the press on an inner Pressable. - The edit view is a name field, the swatch row, and one Save that issues one update. Delete keeps its confirm and its affected-workspace count, and moves to `outline` — red belongs to the dialog, not to the surface that opens it. - Copy says edit, never rename or recolor, in all nine locales. `workspaceLabelErrorMessage` drops the `requestType=… code=…` the daemon client appends to every RPC failure. That is what a log wants, not what a user reads under a name field. `workspaceLabels.accessibility.color` stays deleted: the swatch's accessible name is already the colour's name, so nothing needed it back. Co-authored-by: Christoph Leiter <christoph@leiter.io> * chore(app): converge the labels phases The sweep at the end of the labels redesign: the three items earlier phases found and kept out of their own commits, one cross-phase pass, and the docs. `AdaptiveModalSheet`'s close button reaches its target with `hitSlop` instead of `padding`, which had inset its glyph 8pt from the rail the title, the search field and every trailing glyph below it sit on. This is shared chrome, so it moves the close glyph in every sheet in the app; measured on four of them across both paths — the labels manager desktop and compact, the shortcuts dialog, the rename sheet — and each one's trailing rail now agrees with its leading one. `MenuItem` takes `selected: boolean | "mixed"`. A tri-state row was silent to a screen reader: the check announced itself after the last phase, but exclude had no state at all, so an excluded label was indistinguishable from an untouched one. `"mixed"` is ARIA's own third state, the engine still draws the check only for `true`, and the row keeps supplying its own trailing mark — nothing in the menu engine learns what a label is. CLAUDE.md's platform-gating rules said "NEVER use `onPointerEnter`/ `onPointerLeave`", which is the opposite of what `docs/hover.md` and `constants/platform.ts` both mandate. It now names the real rule — hover on a plain `View`, press on a separate inner `Pressable`, and no `onHoverIn`/ `onHoverOut` on a `Pressable` that contains other pressables — and links the doc that owns it rather than restating it. The cross-phase pass turned up one real defect: the replica cache never learned about labels. `StoredWorkspaceSchema` had no `labels`, so a restored workspace came back unlabelled, and since the directory cursor is current on reconnect the daemon has nothing newer to send — the chips stayed gone for the whole session and the filter matched nothing. An optional field, a serializer line, and an assertion in the restore spec. Everything else measured onto its rails already. Left alone and logged: the per-row `Map` in `useWorkspaceLabelDefinitions`, and the display menu closing when the sidebar swaps to its empty state, which is confined to that swap and predates every phase here. `docs/architecture.md` and `docs/data-model.md` described rename and recolor; they now describe the one update commit, which fields it rewrites, and the per-host resolution a row's chips use. `docs/menus.md` documents the third item state where it already documents the other two. Co-authored-by: Christoph Leiter <christoph@leiter.io> * feat(app): split the labels filter into include and exclude controls The Labels page rotated one row through off -> include -> exclude -> off, which billed the rare operation to the common one: clearing an include cost two presses and routed through exclude, so the sidebar visibly re-filtered into a state nobody asked for on the way out. The row now owns include and a control on its trailing rail owns exclude. Each is one press each way and neither is reached through the other. `cycleLabelFilter` becomes `toggleLabelInclude` and `toggleLabelExclude`; the store's map shape is unchanged, and setting either state clears the other for that label, so including an excluded row is still one press. A row is never both, so the trailing rail holds exactly one 16pt glyph in every state: the check, a permanent `X`, or the same `X` revealed on hover. `X` rather than a circle-slash for the reason Phase 2 settled it — `Ban` fills its box where the check does not, and the column twitches. The control fades rather than mounts and takes its 44pt target from `hitSlop`, so neither revealing it nor changing state moves anything: measured 453-469 on every row, wide and compact. The control carries a tooltip, gated to web where hover exists. It portals into the overlay root above the flyout with no backdrop of its own, and resting on it does not read as the pointer leaving the surface, so the menu stays up. Accessibility: the control is a `checkbox` named "Exclude {label}" with its own checked state, and it stays in the tree at opacity 0 on rows that have no visible mark, so it is reachable without hover. Keyboard focus reveals it, so tabbing to it never means pressing something invisible. The row keeps Phase 5's `selected="mixed"` for exclude. Co-authored-by: Christoph Leiter <christoph@leiter.io> * feat(app): put include and exclude on their own rails on every label row Phase 6 gave the row include and its trailing rail a hover-revealed exclude. The rotation was gone but the awkwardness was not: `X` is the glyph this app dismisses things with, so on a filter row it reads as delete rather than exclude, and one rail with a changing occupant still means the row's trailing area keeps changing identity as you read down the column. Both controls are now on every row in fixed positions, and state is which one is lit. Nothing appears, disappears, swaps places or shifts: the check box is 429-445 and the ban box 453-469 on an included row, an excluded row and an untouched one alike, wide and compact. Because the ban is always there, include -> exclude is one press instead of two. The row still includes, and the check is that same action named. `Ban` rather than `X`. Phase 2 rejected it because its ink fills its 16pt box where a check's does not, so the column twitched when the two swapped on one rail. Nothing swaps here, so what is left is a weight difference: the ban is drawn at 14 inside a 16pt box, which is the visible optical correction available before it stops being a glyph. The box is what the rail is measured from and it stays 16. Lit is `foreground`, unlit `foregroundExtraMuted`. Not `foregroundMuted`, which is the obvious choice and is wrong here specifically: the Match rows further down the same page carry `MenuItem`'s own check in that colour to mean *selected*, so an unlit check in the same ink would say the opposite thing eight pixels above it. Excluded keeps Phase 2's dimmed row. Accessibility: the row keeps `selected` — `true` include, `"mixed"` exclude — and the two buttons carry no checked state of their own, so a label's state is announced once and its two controls read as the actions they are. Both buttons take a tooltip, gated to web with `enabledOnDesktop={isWeb}`, because on non-compact native `TooltipContent` falls back to a `Modal` with its own backdrop. Deleted with it: the `isHovered || isFocused || isNative || isCompact` reveal, the `opacity: 0` mounting, the hover-tracking `View` and the focus plumbing that existed to keep an invisible control reachable. Net -7 lines of code on this row, all of the growth in comments. The store is unchanged; both buttons and the row press map onto `toggleLabelInclude` / `toggleLabelExclude` as they are. The e2e's hover-reveal and `toHaveCount(0)` steps encoded the deleted behaviour and are replaced by a rail measurement taken in every state — relative to the row, since filtering moves the anchor the menu hangs off, and behind a settle poll, since the flyout scales in and a box read mid-animation is not a rail. Co-authored-by: Christoph Leiter <christoph@leiter.io> * feat(app): reveal the label filter's controls, and stop the empty state closing the menu Phase 7 put the check and the ban on every label row at all times, which made a resting list of labels read as two columns of buttons with a filter somewhere behind them. A row now shows its own state and nothing else — a marked row its mark, an untouched row nothing — and hovering any row brings both controls up, the mark you have lit and the other one unlit beside it. So the column you read down is the filter, and the row you are pointing at is the one offering to change it. Nothing about the rails changed. The two boxes are laid out in every state and only their ink comes and goes: check 429-445, ban 453-469 on an included row, an excluded row, an untouched one, hovered or not, wide and compact. The reveal is opacity, never mounting, so it cannot move the row out from under the pointer that fired it. Hover is tracked on a plain `View` wrapping the `MenuItem` with the presses on the buttons inside it, since `MenuItem` is itself a `Pressable` (docs/hover.md); each control counts its own keyboard focus as revealed, so tabbing to one never means pressing something invisible; and `pointerEvents` follows visibility so a hidden control cannot be clicked. On native and compact there is no pointer, so both simply stand there. Everything Phase 7 settled is kept: `Ban` at 14 in a 16pt box, `foregroundExtraMuted` for unlit against `foregroundMuted` meaning *selected* eight pixels below, `spacing[2]` between the two with `hitSlop` tiling the gap, the row owning `aria-checked` while the buttons stay plain named actions, and both tooltips gated `enabledOnDesktop={isWeb}`. --- Excluding a label that empties the sidebar closed the display menu. Logged since Phase 2, narrowed in Phase 5 to the empty-state swap, owned by nobody. `SidebarLabelFilterEmptyState` was a component rendered *instead of* the list, with its own container and scroll view, and both branches were handed the same header element. Different subtrees, so React unmounted the header on the swap — and the header holds the display menu's trigger, so the popover went with its anchor. The empty state is now a body: both list modes render it where their groups would go, inside the scroll they already own and below the header they already render, and the swap can no longer reach anything above it. Cleared from that same still-open page, the way back out is the swap in reverse and it holds too. `ProjectModeList` was already the right shape — its "no projects yet" body sits below the header — but its header was conditional on `unpinnedProjects.length > 0 || hasActiveHostFilter`, which is the same bug written as a guard: keep the header when there is a filter to undo. The label filter joins that condition rather than getting a second mechanism. Both empty states move into `sidebar/empty-states.tsx` so the two list modes can render either without importing each other, which also leaves the card's geometry defined once instead of once per body. Still conditional, and left alone: a sidebar with no projects and no filter has no header at all, so clearing the last host filter on an empty sidebar closes the menu the same way. That one is the onboarding empty state, where a section heading over "Add a project" would be a heading over nothing, and no menu is reachable in the state it lands in. The e2e gets the step that would have caught this: exclude into the empty state, assert the page you pressed on is still up, clear from it, assert the same. Verified by reverting both list files to Phase 7 and watching it fail on "element(s) not found". Phase 7's rail assertions are kept as they are — offsets within the row, behind a settle poll — and joined by computed-opacity reads for the four states of the reveal. Evidence: /tmp/labels-qa-p8/, 28 shots plus INDEX.md — the resting list, a hovered row, an included row with the pointer away, and the empty state with the menu still open over it, at wide and compact in both schemes. Co-authored-by: Christoph Leiter <christoph@leiter.io> * feat(app): make the label filter include-only Phases 2, 6, 7 and 8 each tried to give exclusion a comfortable shape inside a 232pt menu row: tri-state rotation, a hover-revealed control, two permanent buttons, two hover-or-lit buttons. Every fix bought a new awkwardness, because two controls in one menu row is a lot of machinery for a filter. The label filter is now the host filter — one tap in, one tap out — and nobody has ever complained about that one. A row is a plain `MenuItem` with the colour dot leading and the engine's own check trailing. Nothing else. Which makes the alignment law trivial to satisfy, and that is the point. Deleted rather than disabled, since 6, 7 and 8 are in the branch history if exclusion ever comes back: both trailing controls, the hover-tracking `View`, the `opacity: 0` mounting, the focus/blur plumbing, the `pointerEvents` gating, both tooltips and their `enabledOnDesktop={isWeb}` gates, the lit/unlit token pair, `Ban`, and the two rails they held. `SidebarLabelFilter` collapses onto the shape of `hostFilters` sitting three fields above it in the same store: `labels: string[]` plus `match`, one `toggleLabelFilter`, one `clearLabelFilter`. The exclude arm of `filterWorkspacesByLabels` goes with it, and `filter.include` / `includeLabel` / `exclude` / `excludeLabel` leave all nine locales. Persisted version 4 with no migration — the record shape never shipped, and `createValidatedPersistStorage` drops state that fails the current schema before `migrate` ever runs. Two things this leaves unused, both deleted: - `MenuItem`'s `selected: boolean | "mixed"`, added in Phase 5 so a tri-state row could announce itself. The filter row was the only caller, so the union collapses back to `boolean` and the two `selected === true` guards that existed for `"mixed"` go back to plain truthiness. - The `docs/menus.md` paragraphs from Phases 7 and 8 on hover-revealing a pressable trailing control inside a menu row. No caller does that any more, so the doc was describing a pattern the codebase no longer has. Kept: `SIDEBAR_UNLABELLED_LABEL_KEY`, because `Unlabelled` is still a row and now includes like any other; `Match any` / `Match all`, because multi-select include still means two different things. Phase 8's empty-state fix is untouched and still holds — `hasActiveSidebarLabelFilter` is what the header's survival condition reads, and it answers the same question against the new shape. Evidence: /tmp/labels-qa-p9/, 12 shots plus INDEX.md — resting, two selected, and the empty state with the menu still open over it, at wide and compact in both schemes. Co-authored-by: Christoph Leiter <christoph@leiter.io> * fix(app): give label-grouped rows their project icons, and label groups a tag Grouping the sidebar by label rendered every workspace row with its placeholder initial. The same workspace under status or project grouping showed its real project icon. The components were reused; the data feeding them was not. One component served both grouping modes and threaded the icon map through correctly. Fourteen lines above it, a second `useProjectIcons` call was gated on `groupMode === "status"`, written when status was the only mode that put icons on rows. Phase 2 extended the render branch to `status || label` and left the gate alone. Nothing forces a render branch and the data it renders to agree, and these two were far enough apart to drift in silence. Reuse buys you one implementation of the drawing; it buys you nothing about who decides what to fetch. So the fix is the shape, not the line. There is now one `useProjectIcons` call for every mode, and its targets come from `buildSidebarProjection` — the same function that produced the rows, from the same `projects` list. A mode can only render a row for a project the projection already knows about, so the map cannot disagree with the screen. The gate is gone rather than extended: extending it would leave the identical trap for the next grouping mode. `useProjectIcons` dedupes by `serverId:projectId` and caches through `useQueries`, so the gate was a premature optimization that bought a bug. Pinned by `sidebar-projection.test.ts`: for each of the three modes, every project view key the projection will render — pinned rows, grouped rows, project headers and the rows under them — has an icon target. Red on the old gate: restoring `groupMode === "status" ? … : []` in its new home fails project and label grouping with `['project', 'other-project']` uncovered, and status passes, which is exactly the bug's signature. The sibling sweep over everything `SidebarStatusModeWrapper` is handed found one more of the same shape, correct today: the projection chose its shortcut sections with `status || label`, so a fourth mode would have silently walked the project rows. Both the groups and the sections now come from one exhaustive `switch` on the mode, which makes the next mode a compile error rather than an empty list. `workspaceEntriesByKey` is already written the safe way round (`!== "project"`), and the rest — host badges, pinning support, the empty-filter state — never read the mode at all. Two names moved with the shape: `SidebarStatusModeWrapper` is `SidebarGroupedModeList`, and its branch is `groupMode !== "project"`, so a new mode lands in the grouped list instead of the project list's `else`. Also: label group headers draw lucide `Tag` instead of `CircleDot`, in the label's colour, muted for `Unlabelled` — the glyph the Labels menu and the workspace menu already use for this feature. It keeps `StatusGroupIcon`'s 14 with no optical nudge, and that is measured rather than assumed: in the header's leading slot both ink a 14x14 box at the same offset, and the tag lays down 76 ink pixels to the circle's 84, so reaching the corners of its box costs it no weight beside the status glyphs. QA: /tmp/labels-qa-p10/ — wide and compact, light and dark, label grouping and the same workspaces under status grouping, plus the hover chevron swap, the glyph zooms, and a before/after pair taken with the fix reverted to the bug's shape. Co-authored-by: Christoph Leiter <christoph@leiter.io> * fix(app): align label chip typography Co-authored-by: Christoph Leiter <christoph@leiter.io> * docs: format architecture module table Co-authored-by: Christoph Leiter <christoph@leiter.io> * fix(app): narrow workspace labels workflow Co-authored-by: Christoph Leiter <christoph@leiter.io> * fix(app): mirror bottom sheet test exports Co-authored-by: Christoph Leiter <christoph@leiter.io> * test(desktop): assert project browse by destination Co-authored-by: Christoph Leiter <christoph@leiter.io> * fix(app): retain empty projects without label filters Co-authored-by: Christoph Leiter <christoph@leiter.io> * fix(app): preserve status grouping test contract Co-authored-by: Christoph Leiter <christoph@leiter.io> * fix(app): retain filters after label load failures Co-authored-by: Christoph Leiter <christoph@leiter.io> --------- Co-authored-by: Christoph Leiter <christoph@leiter.io>	2026-08-18 12:49:23 +00:00
Mohamed Boudra	c859b59c99	fix(app): dismiss the composer track panel when a row is chosen ... Track pills became menu surfaces when the trackers moved out of stacked cards, but ComposerTrackRow kept the raw Pressable it had as an inline card row. Nothing in that path reaches selectItem, so the popover or sheet stayed parked over the transcript after opening a subagent, and on iOS the action fired while UIKit was still tearing the sheet down. Rows now hand the press to the engine and take closeOnSelect, as MenuItem does; bulk archive opts out because its progress lands in the panel. The running mark is the shared StatusRing rather than a still dot the pill drew for itself, and the remaining dots read their colour from the one bucket-to-colour map. The slot is sized for the ring in every state so the label does not step sideways when the last child finishes. Mounting the real menu engine in a test needed harness work: stubs for two packages that ship untranspiled Flow, reanimated left out of Vite's prebundle so its .web files win, and the gaps filled in the unistyles test theme.	2026-08-17 23:43:01 +02:00
Mohamed Boudra	6d7606160e	Let plugins add contextual workspace tools (#3465) ... * feat(plugins): add workspace panels and command center contributions Give local plugins contextual UI entry points without making the daemon interpret client placement or callbacks. Panels receive stable IDs and read cached client state through required selectors with shallow equality, avoiding unrelated guest rerenders and context-discovery RPCs. * fix(plugins): align shared client state ownership Workspace panels and Command Center callbacks consume the same frozen client snapshots, so their adapter belongs to the plugin boundary rather than either contribution surface. Refresh the Nix dependency hash for the selector-store dependency added by this feature.	2026-08-17 19:26:40 +02:00
Mohamed Boudra	16120ebff1	Make local plugins manageable and debuggable (#3446) ... * feat(plugins): expose Paseo API to local plugins Plugin surfaces borrow the selected host connection while subprocess handlers receive an exclusively owned IPC session, so plugins can use normal workspace and agent operations without inventing another transport. * feat(plugins): reload global enablement safely Treat the global plugin switch as a live daemon setting and teach plugin automation to inspect it before acting. Enabling remains permission-gated because plugin backend code can access the daemon machine and client contributions execute inside the app. * feat(plugins): expose plugin logs Capture plugin stdout and stderr separately from IPC so authors can debug initialization, RPC, cleanup, and crash behavior from the app or CLI. Keep a bounded tail across lifecycle recovery while preserving structured output in the daemon log. * fix(build): order plugin dependency builds * test(plugins): align startup and CLI expectations	2026-08-16 18:54:44 +08:00
Mohamed Boudra	23853a1515	Add managed local plugin lifecycle (#3222) ... * feat(plugins): add local plugin surfaces and RPCs Keep plugin execution scoped to its daemon while allowing one local TypeScript entry point to contribute validated RPCs and native client surfaces. Paseo owns host selection, navigation chrome, and per-installation query caches. * feat(plugins): add Linear attachment source * fix(nix): refresh npm dependency hash * test(server): exclude internal sessions from Hub counts * test(server): distinguish Hub execution sessions * feat(plugins): make local plugins explicitly opt-in Keep plugin loading dormant until configuration enables it, and collect unsupported examples under one directory. * refactor(plugins): establish host boundaries * fix(nix): refresh plugin dependency hash * fix(plugins): complete packaging and startup rollback * feat(plugins): add managed local lifecycle Make trusted local plugins recoverable and authorable through daemon-owned lifecycle operations, host settings, and a capability-gated CLI. Reloads fully stop the previous plugin before starting new code, while generated projects provide strict TSX checking without changing runtime dependency ownership. * fix(nix): refresh plugin dependency hash	2026-08-14 17:12:49 +02:00
nllptrxandMohamed Boudra	a8ebd390fa	feat(forge): pluggable forge abstraction + GitLab and Gitea/Forgejo/Codeberg (#1913) ... * refactor(forge): forge-neutral foundation (GitHub-only) Decouple git-hosting from GitHub behind a neutral abstraction (issue #1616), GitHub-only for now; existing GitHub behaviour is unchanged. - Forge manifest, neutral ForgeService contract, forge registry + resolver, and a client forge-module registry. - GitHub code renamed to the neutral shape; PR/Issue attachment wording preserved. - forge.search.response enums parse tolerantly (unknown kind/auth state degrade instead of breaking the client). - createPullRequest reports typed CLI/auth errors instead of a generic message. - forge-resolver host/remote caches are LRU-bounded. - Forge host trust is explicit: only a known cloud host or a CLI-authenticated host is ever talked to; an unauthenticated GitHub Enterprise host fails resolution instead of routing to github.com. - Docs: forge-providers guide, glossary and i18n forge-copy conventions, architecture and rpc-namespacing terminology. - Vitest React Native mocks (unistyles, svg, linking, lucide) consolidated into shared aliased test-stubs. * feat(forge): GitLab adapter, forge-aware UI, pipelines and approvals GitLab adapter over the glab CLI on the neutral contracts: MR status, forge-aware UI, pipeline tree, and N-of-M approvals. - threadIsResolved is part of the neutral timeline item. - Pipeline load failures show an error instead of an empty section. - Manual pipeline jobs render as pending. - Fork/detached MR head pipelines are fetched by MR iid (glab ci get --merge-request). * feat(forge): Gitea family adapter (Gitea, Forgejo, Codeberg) One adapter over the tea CLI serving Gitea, Forgejo, and Codeberg on the neutral contracts. - CI status aggregates commit statuses and Actions runs together. - Gitea's terminal "warning" state maps to failure on server and client. - Gitea Actions check details are reachable from the PR pane by workflowRunId. * refactor(forge): localize compatibility handling * test(forge): expect normalized GitLab facts --------- Co-authored-by: Mohamed Boudra <boudra.moha@gmail.com>	2026-07-17 15:03:26 +08:00
Mohamed Boudra	79bf5ac3c7	test: add app browser coverage	2026-04-21 20:46:49 +07:00
3 people	6d4cc53a0a	ci: fix all tests to green (#236) ... * ci: add CI status tracker for test fix iteration Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * cli: honor daemon connect timeout * app: fix e2e helper server path * e2e: fix helper imports and ws cleanup * cli: align daemon status tests * style: autoformat with biome to fix 195 formatting errors Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * server: fix 4 stale test expectations and setup bug - logger.test.ts: update expected default level from trace to debug matching intentional product change - session.workspaces.test.ts: only opened worktree reconciles, not siblings; add explicit reconcileWorkspaceRecord before owner-change assertion - worktree.test.ts: add explicit git checkout -B main origin/main for deterministic CI branch state Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * server: align daemon-client test expectations with ignoreWhitespace field normalizeCheckoutDiffCompare() now always emits ignoreWhitespace: false, so update the two checkout-diff subscribe test assertions to match. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * style: format daemon-client test to satisfy biome Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * cli: update provider test for new providers and model lineup Update 15-provider test expectations to match current product state: - Provider count: 3 → 5 (added copilot, pi) - Claude models: 3 → 4 (added claude-opus-4-6[1m]) - Codex models: replace retired gpt-5.1-* with gpt-5.4/gpt-5.4-mini Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * app: fix 18 failing test files with vitest setup and stale expectations Add vitest.setup.ts to define __DEV__, shim Expo globals, mock react-native-unistyles/expo-linking, and stub @xterm/addon-ligatures. Update stale test expectations across combined-model-selector, use-settings, tool-call-display, sidebar-project-row-model, sidebar-shortcuts, keyboard-shortcuts, host-runtime, use-agent-form-state, desktop-permissions, and voice-runtime to match current source behavior. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * ci: add missing highlight build step to app-tests job The app-tests CI job was missing the `npm run build --workspace=@getpaseo/highlight` step that all other jobs have. This caused diff-highlighter.test.ts to fail with "Failed to resolve entry for package @getpaseo/highlight" because the dist/ directory did not exist. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * ci: install codex and opencode CLIs in cli-tests job The 15-provider test expects `provider models codex` and `provider models opencode` to succeed, which requires the actual CLI binaries to be on PATH. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * app: fix Playwright e2e helpers using import.meta.url in CJS context Revert dynamic import path resolution from `new URL(..., import.meta.url)` to `path.resolve(__dirname, ...)` + `pathToFileURL(...)` in three e2e helpers. Playwright's TS loader emits CommonJS, where import.meta.url is undefined, causing "exports is not defined in ES module scope" and blocking all e2e test discovery. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * ci: add missing server build step to playwright job The Playwright e2e helpers dynamically import from packages/server/dist/server/server/exports.js, but the CI job only built highlight and relay dependencies. Add the server build step after relay so the dist artifacts exist when tests run. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * test(cli): make codex model assertions resilient to catalog changes The 15-provider test hard-coded exact model IDs (gpt-5.3-codex-spark, etc.) which depend on the external codex CLI's model/list endpoint. Replace with structural checks: all IDs in gpt- family, at least one codex-optimized model, and all models have required fields. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * test(cli): make opencode model assertions resilient to catalog changes The 15-provider test hard-coded exact model IDs (opencode/gpt-5-nano, openrouter/openai/gpt-5.3-codex) which break when the external opencode CLI updates its model catalog. Replace with structural checks: at least one first-party opencode model, at least one OpenAI-backed model, at least one codex-optimized model, and all models have required fields. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * app: fix Playwright E2E WebSocket errors on Node 20 + fix format E2E helpers used DaemonClient without a webSocketFactory, which relies on globalThis.WebSocket — unavailable in Node 20 (CI). Add a shared node-ws-factory helper using the ws package (matching the CLI pattern) and inject it in all three E2E connection helpers. Also fix a biome formatting issue in the cli provider test. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: update lockfile signatures and Nix hash * test(cli): replace OpenAI-specific assertions with generic third-party check The opencode provider test asserted models with "openai/" or "openrouter/openai/" prefixes, but these are environment-dependent — opencode returns whatever providers are connected, and CI may not have OpenAI configured. Replace with a generic check that at least one non-opencode/ namespaced model exists. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: advance stale schedule nextRunAt on daemon restart On restart, persisted nextRunAt could be in the past, showing stale dates in `schedule ls`. Now recoverInterruptedRuns() advances any past-due nextRunAt forward to the next future tick. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * ci: install agent CLIs in playwright job + remove env-dependent opencode test assertions The Playwright E2E tests (archive-tab, terminal-performance) fail because the CI job doesn't install Codex/OpenCode binaries that the tests need to create agents. Add the same install step already used in cli-tests. The 15-provider CLI test still asserts third-party providers are connected in OpenCode, which is environment-dependent. Remove that assertion and lower the minimum model count to 1, keeping only deterministic structural checks (namespacing, required fields, first-party models). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: apply biome formatting to schedule service files Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(cli): parse localDaemon field in daemon supervisor test assertions The daemon status JSON uses `localDaemon` not `status`, so the polling condition was always null and timed out after 120s on CI. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: apply biome formatting to daemon supervisor test files Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(cli): spawn supervisor directly via node --import tsx instead of npx wrapper The daemon supervisor tests (22, 23, 25) spawned the supervisor through `npx tsx` which creates a wrapper process. When SIGINT was sent, the npx wrapper died with signal=SIGINT instead of forwarding it to the actual supervisor which handles graceful shutdown. Now matches production startup pattern using process.execPath with --import tsx. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(server): acquire pid lock for unsupervised daemon workers The direct worker path (non-supervisor) was not writing paseo.pid, so `paseo daemon status` could not detect the running daemon. This caused test 26-daemon-restart-unsupervised to time out in CI waiting for the status to become "running". Acquire the pid lock before daemon creation, update it with the listen address after start, and release on shutdown/error. Supervision detection now requires both PASEO_SUPERVISED=1 and an active IPC channel to avoid misclassification when the env var is inherited. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(e2e): correct terminal tab testid and navigation URL in Playwright helper navigateToTerminal() used the bare workspace route instead of the URL with ?open=terminal:<id> intent, and looked for testid "workspace-tab-terminal:<id>" (colon) when the real tab key is "terminal_<id>" (underscore). Both bugs prevented the terminal surface from ever appearing, causing terminal-performance tests to timeout. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(e2e): wait for open-intent redirect before interacting with terminal surface The navigateToTerminal helper was racing the workspace layout's ?open= redirect, which returns null during the useEffect cycle. Now waits for the clean workspace URL before looking for the terminal tab, and removes the fallback that created a different terminal via the "New terminal tab" button. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: apply biome formatting to terminal-perf.ts Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(app): ungate host routes from storeReady to preserve deep links Host routes (workspace, agent, sessions, etc.) were inside Stack.Protected guard={storeReady}, causing deep links to be rejected during initial storage hydration and redirected to /welcome. Move them outside the guard so they can render their own loading state while stores hydrate. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(app): gate open-intent consumption on navigation readiness After moving host routes outside Stack.Protected, the workspace layout could mount before the root navigator was ready. router.replace() would silently fail, but consumedIntentRef was already set, preventing retries. Gate the effect on rootNavigationState.key so the intent is only consumed once Expo Router can actually process the replace. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(app): use history.replaceState to strip ?open since Expo Router skips query-only changes Expo Router's findDivergentState ignores search params, so router.replace with the same pathname but without ?open is a no-op. Use window.history.replaceState on web to directly strip the query param, and track intent consumption in component state so WorkspaceScreen renders once the tab is prepared. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: update stale codex model from gpt-5.1-codex-mini to gpt-5.4-mini The Codex CLI no longer supports gpt-5.1-codex-mini. Update all references to gpt-5.4-mini, which is available in the current CLI. This fixes archive-tab Playwright tests that create codex agents which were erroring due to the unsupported model. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(ci): pin codex CLI to 0.105.0 and improve turn_failed diagnostics Playwright archive-tab tests fail because CI installs @openai/codex@latest (0.120.0) which has breaking protocol changes vs the known-working 0.105.0. Pin the version and add diagnostics for future debugging: elevate turn_failed log from TRACE to WARN, and include error details in test assertions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(e2e): switch archive-tab tests from codex to opencode provider Codex CLI requires OAuth auth (~/.codex/auth.json) that CI lacks — OPENAI_API_KEY alone gets 401. These tests verify archive tab behavior, not any specific provider. Switch to opencode/gpt-5-nano which authenticates via standard OpenAI API that the CI key supports. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * ci: retrigger CI for PR #236 * ci: trigger CI for opencode provider switch Previous commits (3cbd7976, bdf768d6) were pushed with a token that did not trigger GitHub Actions workflows. This empty commit forces a fresh pull_request event. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * ci: add workflow_dispatch trigger to CI workflow Enable manual triggering of the CI workflow. Previous pushes to ci/fix-tests-green failed to trigger pull_request events for the CI workflow, so this allows manual dispatch as a fallback. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(ci): unblock remaining test lanes * test(server): allow slower CI Claude model listing * fix(cli): stabilize unsupervised restart regression * test(ci): harden restart and archive e2e timing * test(server): align workspace reconciliation expectation * test(server): tolerate platform-specific workspace ids * fix(app): gate host route logic on bootstrap readiness --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-04-12 09:56:05 +08:00