Restore scroll position after Pierre reconciles measured heights, before paint
Only remember line anchors when the anchor line is visible in the viewport
Remember scroll positions for code and markdown previews per file, runtime, mode and surface
Restore editor cursor and scroll state when returning to previously opened files
Wait for async content to render before restoring, and stop on user scroll
Go returns ISO reset dates, but the shared usage contract requires numeric timestamps. Convert dates to milliseconds before building usage windows.
Verified all three windows against the live Go API. Added numeric timestamp and partial-window regressions; 14 focused tests, web type-check, lint, and syntax checks pass.
Remove the Committed heading above the Commit option in Walkthrough and delete its unused translations from all 12 locales.
Validation: UI type-check and focused Walkthrough ESLint passed; no references to the removed locale key remain.
Remove the uncommitted-changes tooltip, warning icon, and tooltip timer from mobile draft target triggers. Drop the unused mobile warning props while preserving desktop behavior.
Validation: UI type-check and lint passed. Oxlint and dead-code reported existing findings outside the changes. Visual validation was unavailable because the in-app browser timed out.
Diff prefetch released concurrency slots after its UI deadline while the underlying requests kept running, allowing overlapping batches to accumulate work.
Retain per-runtime directory slots until transport completion, preserve outstanding requests across cache resets, and skip prefetch in hidden Git views. Clear deadline timers and avoid invalidating active batches on duplicate demand.
Validated 43 focused tests, UI type-check and ESLint. Reproduced four outstanding requests against a limit of two before the fix. Reviewed existing oxlint findings; Windows process failure was not reproduced.
Replace the shared hunk menu with compact per-hunk controls over following context. Preserve canonical patch checks, bind controls to rendered rows, and keep EOF actions inside the code column.
Validated 19 focused tests, UI type-check, UI/web lint and the web build. Browser checks covered unified and split layouts, themes, and one-line EOF hunks.
Opening the sidebar reset its width to the reduced resize minimum. Keep visibility independent from the persisted width and restore the 280px initial default.
Validated five sidebar regression tests, UI type-check and UI lint.
New sessions fetched history before their confirmed empty state was published, and cold worktree selection ignored globally indexed session directories.
Initialize new transcripts before navigation, reject stale-runtime creation responses, and resolve cold sessions through their known directory. Preserve earlier live records and explicit recovery.
Validated 191 focused tests, UI type-check and ESLint. Reviewed dead-code and oxlint reports; existing anti-slop findings remain outside the added code. Remote and Windows runtime behavior has not been manually verified.
The fixed 35ms sleep could finish before reconnect when workspace builds and test workers ran concurrently. Poll the actual ready frame and always close the runtime.
The final workspace run passed: 429 UI, 40 VS Code, 23 Electron and 4 root test files; 2154 web tests passed with one existing platform skip.
Resolve the Changes-view conflict without reverting branch or commit comparisons. Pair canonical action patches with displayed blob identities, refresh all path views after mutation, exclude historical snapshots, and reject stale or multi-file patches at the server boundary.
Preserve CRLF bytes and make long hunk menus keyboard-reachable. Workspace type-check, lint and build passed; focused parser, menu, view and real Git regressions passed.
Mini Chat used the API origin in HMR mode and could load the server auth page instead of the local application. Retain the resolved local UI URL and use it for Mini Chat windows.
Verified native menu zoom in main and Mini Chat windows in isolated HMR and bundled Electron profiles; Electron syntax checks passed.
The composer also mounts CodeMirror, so Mini Chat focus incorrectly changed the file editor font size. Exclude the explicit chat-input owner from file-editor zoom routing.
Validated the ThemeProvider focus regression, including a focused CodeMirror composer.
Deliver queue updates on the control SSE stream, recover independently of bootstrap suppression, and preserve authoritative empty snapshots against delayed responses. Coalesce hydration and recovery while retaining unfinished legacy migration across runtime switches.
Workspace type-check, lint, tests and build passed. Follow-up recovery and migration fixes pass 27 queue tests, 3 control-stream tests and UI type-check.
Keep normal web headers at 48px, send native zoom directly to the focused main or Mini Chat window, and restore walkthrough widths through validated persisted ratios.
Validated 40 context-panel tests, the focus-aware ThemeProvider regression, UI type-check and Electron syntax checks. Runtime smoke and combined workspace validation follow before publication.
Add ClinePass across server and VS Code quota paths. Reject malformed windows, preserve valid sibling limits, align credential fallback, and report timeout failures accurately.
Validated 30 server quota tests, 129 VS Code quota tests and VS Code type-check. Oxlint findings are confined to pre-existing VS Code code.
Render details and summary as controlled disclosures with rich Markdown and shared sprite chevrons. Preserve expansion through streaming, settlement, and redecorating while keeping other raw HTML inert.
Validated with 59 focused tests, UI type-check and lint, and maintainer testing during live generation. Dead-code and oxlint reports retain existing findings.
Browser-style chunk recovery used location.reload inside VS Code webviews, where navigation reload is unsupported. Preserve import retries and let the original failure reach the error boundary instead.
Validated with focused regression tests, UI type-check and lint, and the VS Code webview build. The reported gray-screen crash has not been reproduced.
The footer collapsed its facts by wrapping the overflow onto a clipped
second line. The fact disappeared but its width did not: the row kept the
space it had been given, so a dropped agent left a hole between the effort
and the duration — visible on both the phone and the desktop.
Decide it by measuring instead. The row cannot overflow, because the model
name truncates, so "did it fit" is read off the model: while the model is
cut, hide the next fact by priority — timestamp, then agent, then thinking
effort — and measure again. Hidden facts leave the layout entirely, the
model truncates only when there is nothing left to give, and the row stays
tight at every width.
CSS could not do this. Container-width breakpoints know nothing about the
model's length and dropped facts that still fitted; wrap-and-clip is what
left the hole in the first place.
Testing: package type-check, lint, the message test suite under the
isolated runner; drove a real chat in a browser (430px drops the timestamp
and the agent, 330px also the effort, restoring the width brings them all
back, no gaps in any state). The ResizeObserver path is unverified — this
preview browser delivers no observer callbacks at all — while the window
resize path is.
Mobile Changes only exposed working-tree edits. Share comparison loading and source pickers with desktop, with phone sheets, tablet popovers, scoped file navigation and retry states.
Keep checkout, Sync and commit controls under Changes. Compact the section and source triggers, center menu items, and preserve repeated file-open requests from chat.
Validated with UI type-check and lint, comparison and navigation tests, web/mobile asset builds, and maintainer app testing.
Co-authored-by: gaojunran <nebula2021@126.com>
Branch comparisons could retain an old base or omit local edits, while Changes and walkthrough selected their sources independently.
Share branch and commit selectors across both panels, honor exact refs, include local branch edits, and support first-parent commit diffs with the latest 50 commits. Compact message metadata and move touch actions into a shared sheet.
Validated with workspace type-check, lint and build, focused Git and UI tests, and maintainer testing in the app.
Shared session-list subscriptions opened server-only event and URL-token routes against the webview origin, causing repeated 403 responses. Skip the control-stream subscription in VS Code while preserving OpenCode bridge sync and polling.
Validated with regression tests, UI type-check and lint, and the VS Code webview build. The reported gray-screen crash remains unconfirmed pending user logs.
The five sort modes sat as a chip row under the search field, which cost a
project row of list space for a setting people touch about once a month.
Put them behind an icon in the header next to reordering — the two answer
the same question about the list — and let it open the same sheet the
composer already uses to pick a model or an agent, with a check on the
active mode. The icon hides while reordering or searching, where sorting
means nothing.
The new-session button moves to the outer right edge and stays there: it
is the one action people hit without looking, so it must not slide as the
icons beside it come and go.
Testing: package type-check and lint; drove the drawer in a browser at
390px (chip row gone, sheet lists the five modes and marks the active one,
picking one reorders the list and closes the sheet, the icon disappears in
reorder mode, and the new-session button keeps the right edge with and
without a search).
Android 15+ enforces edge-to-edge, and Capacitor stops padding the WebView
once it can hand the insets to the page instead — so the app draws under
the gesture/navigation bar. Only the top inset was ever consumed: full
cover surfaces ignored the bottom one entirely, which is why a settings
list ran under the bar, and the chat shell reserved half of it, which is
enough for a home indicator but not for a bar that swallows taps.
Reserve the full inset in the shell on Android and give the surfaces that
own the bottom edge — fullscreen surfaces, the workspace drawer, bottom
sheets — an opt-in class that pads them. The sessions drawer already did
this through its footer, so it stays as it is. Capacitor reports a zero
bottom inset while the keyboard is up, so none of this stacks with the
keyboard inset. iOS deliberately keeps its softer visual inset.
Testing: package type-check and lint; drove the mobile surface in a
browser with the Android platform class and a simulated 48px inset (shell
and surfaces reserve exactly that, drawer footer unchanged, and removing
the class returns every surface to zero).
Snippets, Agents, Commands, Plugins and Skills were desktop-only, even
though the composer already reads snippets and slash commands and the chat
lets you pick an agent: you could use those features from a phone but not
manage them. They render through the same page and sidebar components, so
the mobile settings surface only had to stop filtering them out.
Making them usable needed the drill-down to be real. A split page opens
its own list on mobile, but back from an item jumped all the way out to
the settings root, and a separate header button was the only way back to
the list — except on Skills, which had a hand-rolled exception. Turn that
exception into the rule: back walks nav → page list → item in reverse on
every split page, browser and system history follow the same path, and the
extra header button goes away because back now does its job. The Android
hardware button asks Settings to step up before the shell closes it.
MCP, Providers, Usage and Magic Prompts inherit the same navigation.
Testing: package type-check, lint, settings suites under the isolated
runner; walked all six pages plus MCP in a browser at 390px (list → item →
back to list → back to root, no horizontal overflow). The hardware back
button needs a device check.
The final answer divider was too prominent and sat too far below Activity. Lower its opacity to 30% and remove the header's bottom margin in both states, matching the maintainer's visual adjustments.
Validated UI type-check, lint for both changed files, and seven existing activity and rendering tests.
The sidebar's project order (manual, A-Z, Z-A, newest, recently used) is a
shared setting, but the mobile drawer ignored it and always rendered the
manual order, so a phone could not put the project you actually work in at
the top of the list.
Read the same setting in the drawer and offer it as a chip row under the
search field, which scrolls away with it — mobile navigation has no
overflow menu to hide it in, and a control touched once a month should not
hold permanent room above the list. Picking an order persists it the way
the desktop sidebar does, so the choice follows the user across surfaces.
Drag-to-reorder is offered only under the manual order, since dragging
rewrites exactly the order the other modes ignore.
The ordering itself moves into one helper the desktop sidebar now uses
too, so both surfaces answer the setting identically.
Testing: package type-check and lint; new unit tests for the helper plus
the sidebar list suite under the isolated runner; drove the mobile surface
in a browser against an isolated server (chips fit a 390px viewport,
switching to "recent" reorders the list, the reorder button hides, and the
choice reaches the server settings).
Project rows carried an active-project dot and a session count, neither of
which answers a question the user has while browsing the drawer, and there
was no way to start a session in a project's root directory: the only
per-row action was creating a worktree.
Drop both indicators and put a "+" beside the worktree button instead. It
opens a draft already carrying the project and its directory, the same
contract as the desktop sidebar's per-project "+", so the current
directory is not switched out from under the session behind the drawer.
Project rows in search results lose the count the same way and gain the
same button; dropping it there also drops a per-project session scan that
ran on every keystroke.
Testing: package type-check and lint; drove the mobile surface in a
browser against an isolated server (rows render the button, counts gone).
Code comments required Cmd/Ctrl+Enter while quotes and browser annotations used Enter. Align desktop submission and its placeholder, preserve Shift+Enter line breaks and mobile keyboard behavior.
Validated UI type-check, UI lint, and six existing IME checks. Lint reports one existing warning in MobileChangesSurface. In-app browser validation was unavailable.
Use received frames for peer liveness and reject new requests after terminal relay failures. Keep authoritative usage snapshots separate from refresh errors, bound request lifetime, and guard concurrent refreshes and runtime switches.
Add regression coverage for relay liveness, terminal rejections, quota failures, cancellation and request deadlines. Validated with 51 focused tests, workspace type-check and lint, web build and mobile assets.
The chat opens the sessions drawer with a left-edge swipe and the
workspace drawer with a right-edge one, but neither could be closed the
same way: the only way back was the header X or the Android back button.
Reuse the edge-swipe hook on both open drawers so the mirrored gesture
closes them. To keep that free of the row swipe actions in the sessions
list, those are mirrored too: session, project and worktree rows now
reveal their actions on the LEFT with a swipe to the right, in the
mirrored button order so a partial drag still exposes delete first. When
a row has its actions out, the closing swipe puts them away first
instead of closing the drawer.
The hook grew an `enabled` flag so the listeners re-attach when a drawer
opens or a tablet rotates the workspace between panel and drawer.
Testing: package type-check and lint; gestures need a device check.
Negotiate downstream delivery credit and schedule response streams fairly before encryption. Bound queued output, preserve deltas and WebSocket close ordering, and retain legacy peer compatibility.
Validated with 81 relay tests, workspace type-check and lint, web build and mobile assets, and slow-link tests through the production relay. Confirmed on LTE by the maintainer.
Lower the compact header breakpoint from 640px to 560px while preserving file statistics on mobile. Validated with focused tests, UI type-check and lint, and the web build.
Upgrade LegendList to 3.3.10 and patch temporary padding cleanup to compare CSSOM-serialized values. Settle Activity height when React replays an interrupted layout effect.
Validated with 16 padding regressions, 3 collapse lifecycle tests, the UI suite, workspace type-check and lint, and web and VS Code builds.
The half-viewport band made return-to-end detection too broad. Restore the fixed 40px threshold without changing gesture handling or follow transitions.
Testing: 14 focused scroll tests pass; UI type-check passes; UI lint has one unrelated existing warning; dead-code report inspected. Live chat behavior not validated.
Keep live history compact without changing sorted rendering. Reuse Activity Default, preserve final answers, and summarize tool-result diffs under an animated disclosure.
Validated with the UI test suite, focused disclosure tests, UI type-check and lint, web production build, dead-code scan, and browser and animation fixtures.
Keep top padding on task tool entries and simplify the Turn stats release note to state its default without an instruction.
Testing: focused ToolPart ESLint, changelog validation, and diff checks passed. No interactive layout verification was run.
Turn stats was hidden unless users opted in. Show it by default, migrate implicit hidden lists, and preserve explicit section choices through reloads and settings sync.
Prepare App and VS Code release notes with Turn stats as the headline and BTW composer changes under improvements.
Testing: 115 focused tests passed; UI type-check passed; UI lint has one existing warning. Changelog validation and diff checks passed. Oxlint findings are limited to existing code in sections.ts; interactive app validation was not run.
Shows a separator when the last live assistant answer follows earlier visible content
Keeps render comparisons in sync with the new assistant-text context
Tweaks tool summary spacing and path text styling
Reserves scrollbar space in overlay overlays when the thumb appears
Keeps text and layout from jumping on hover
Avoids double-reserving space for nested scrollers
Updates the setting hint to explain scrollbars stay visible when the pointer leaves the scrollable area.
Refreshes the wording across all supported locales.
Adds a device-local setting to keep overlay scrollbars visible.
Surfaces the setting in visual settings and settings search.
Updates scrollbar behavior and tests for the new preference.
Retain the capped reasoning implementation and adopt the scroll-position release behavior from #3394. Cover pause, resume, and observer cleanup on the mounted component.
Co-authored-by: alvins82 <alvins82@gmail.com>
Complete #3227 by keeping browser completion polls on the native updater, checking the requested version, and preserving retry access after a failed restart.
Share the Ollama request and parser between credential validation and quota refresh so unparseable pages cannot produce successful empty usage. Reject redirects and bound requests with a timeout while preserving both plan formats.
Tested with 94 quota tests, VS Code type-check and ESLint, and the extension build. Reviewed dead-code output; existing anti-slop findings remain outside the changed code.
A streaming Thinking block grew without a height cap and only moved into
the capped, scrollable box once it finished, so a long thought pushed the
whole timeline down while it streamed. The cap was dropped in June because
the box then pinned to its own end on every tick and captured the wheel,
so the chat could not be scrolled while thinking streamed.
The box is capped in every state now and follows its own end only while
streaming and only until the reader wheels or drags upward inside it;
returning to its end re-arms the follow. It is marked as a nested scroller,
so an upward wheel scrolls the box first and reaches the chat once the box
sits at its top. Growth is observed on the content box because markdown
commits asynchronously.
Testing: reasoning block tests extended for the capped, nested box while
streaming; ui type-check and lint; web build. Live reasoning stream not
exercised in a browser.
The Activity block stacked its tool rows with an extra 0.375rem gap on top
of each row's own padding, while the live timeline stacks the same rows
with nothing between them. Both views now share the 36px row step.
Testing: measured both render modes on one session in headless Chrome;
ui type-check and lint.
At cold launch the container opens a new-session draft as a placeholder
until the last session restores. The draft's dirty-directory warning
announced itself by opening its tooltip for five seconds, so on mobile the
tooltip appeared alone over an almost empty screen and vanished with the
draft once the session came back.
The draft state now records that the app opened it automatically, and the
warning does not flash for such a draft. The icon still shows and the
tooltip stays reachable by hover or long press; a draft the user opens
flashes as before.
Testing: ui type-check and lint; session store and composer tests; web
build.
The server echoes a sent message part by part. The reducer replaced an
optimistic part with its server echo only while the FIRST part of the
message was still optimistic, so once the text echo had landed the file
echo no longer qualified and was appended instead: an attached image
showed twice until the next page fetch rewrote the parts.
Any remaining optimistic part of the same type is now a replacement
candidate. The scan only runs when a part with a new id arrives, which is
once per part during assistant streaming.
Testing: reducer test extended past the first echo to the file echo; ui
type-check and lint; verified the event order against a live OpenCode
(message, text part, file part within ~70ms of the accepted request).
Sending used to park the new user message near the top of the viewport by
reserving blank space below it and holding the viewport there while the
reply streamed in. The reserved space showed up on its own at times and the
hold fought other corrections; with a reliable end-follow and pin in place
the effect no longer pays for its machinery.
The anchoring mode, its arm/claim/position/settle lifecycle, the reserved
end space passed to the list and the anchored-turn geometry are removed.
Sending from the live edge is now an instant return to the end, and the
reply is kept in view by ordinary end-follow; sending from mid-history with
auto-follow off still leaves the viewport untouched.
Testing: scroll module tests trimmed to the remaining geometry; ui
type-check, lint and dead-code report; web build.
Chat prose read looser than the rest of the app: 15px body with a single
line-height for everything, headings barely larger than the text, list
bullets drawn as dashes with a 2em gutter, no vertical rhythm for lists or
quotes, and inline code that took a syntax colour from the theme.
Body text is 14px with a whole-pixel line height (22.75px rounded to 23px
so baselines stay on the pixel grid). Every block carries the same 0.65rem
margin on both sides, so any two neighbours are one spacing apart and the
outer blocks add nothing. Headings step 20/18/16/14px at weight 600 with
more air above than below. Lists use native markers that cycle by depth
with a 1.25rem gutter and 0.25rem between items; task-list checkboxes
replace the marker. Blockquotes get their left rule back. Headings, list
markers and inline code render in the text colour; inline code is a muted
chip one step smaller than the prose. The inlineCode theme tokens are
removed from the built-in themes, the generator and the VS Code adapter;
custom themes that still carry them are simply ignored.
The remaining semantic sizes shrink by the same step (code 12px, labels and
meta 13px, settings title 17px), in VS Code proportionally.
Text selection in chat used the browser default in dark themes while the
comment overlay painted the theme's row-selection token, so the colour
changed the moment Comment was clicked; that token is also nearly the page
background in several light themes and opaque in monokai, where the overlay
hid the text. Native selection, file-preview selection and the overlay now
share one translucent accent tint (primary at 30%), which stays visible over
every built-in theme's background.
Testing: ui type-check and lint; all theme JSON re-parsed; screenshots of
prose, lists and the selection/comment states in headless Chrome; contrast
of the new selection tint computed against every theme's background and
text.
Opening a panel or resizing the window while pinned to the end of an idle
session bounced the timeline and left it above the end with the pin
released. Every row re-wraps on a width change and the list's total
content length lags a frame behind the rows, so anything scrolling to the
end from it (the list's own maintainScrollAtEnd, scrollHeight) landed on a
blank tail or short of the real end; the idle branch then released the pin
instead of recovering.
An idle session no longer hands end-keeping to the list at all: the hook's
same-frame pin owns it, and during a width resize it holds the measured
bottom of the last real row plus the list footer, for streaming readers
too. The footer size was missing from that measurement (the list does not
expose it through getState) and left the viewport short by the tail
spacer; it now arrives through onMetricsChange. Size compensation applies
only to a reader who left the end.
The follow re-arm band is half a viewport instead of 40px: leaving the end
is decided by a real gesture only, so the band now only decides how close
a reader must come back before follow re-arms.
Testing: scroll module tests updated (footer in the real end, half-viewport
band with a 40px floor); ui type-check and lint; measured in headless
Chrome that scrollTop equals the maximum on every frame of a panel toggle,
a height change and a combined resize, where the previous build ended 122px
and 462px above the end.
* refactor(settings): settings registry and intent-gated writes
Problem: every setting lived in a flat document with ten hand-maintained
key lists that had drifted (three keys the server silently dropped, five
it kept that nothing read), and three code paths wrote to the server
without a person changing anything: the theme persist effect on mount,
bootstrap seeding of server-missing keys, and the auto-save echoing
values just adopted from the server.
Approach: one registry (packages/ui/src/lib/settings/registry.ts) names
every key with its scope (instance / profile / device), a boundary parser
and its store binding; DesktopSettings, the sanitizer, the mirror, the
apply step and the auto-save derive from it. A generated JSON snapshot
carries the key list to the server and the VS Code bridge. Writes carry
intent: the theme context writes only from its user-facing setters, a
missing server key leaves the local store alone instead of resetting it,
updateDesktopSettings drops values the server already holds, and the
auto-savers treat values applied from the server as a new baseline.
Testing: bun test packages/ui (registry + persistence suites cover zero
writes on load, dedup, toggle-back cancellation, failed-save retry, and
snapshot freshness); tsc for every workspace.
* refactor(ui): read and write settings through the shared path only
Problem: fourteen pages and stores fetched /api/config/settings on their
own and re-parsed the raw document by hand, so the registry could not
guard them and two of them treated a failed load as an empty list.
Approach: loadDesktopSettings() and updateDesktopSettings() (which now
resolves { ok }) replace every direct call; SkillsCatalogPage and
AddCatalogDialog refuse to write the catalog list until it is known.
Testing: bun test packages/ui (403 files), eslint on the changed files.
* refactor(server): validate settings writes against the registry snapshot
Problem: the server whitelist was the only guard on PUT /api/config/settings
and had drifted from the client; dead keys were still persisted.
Approach: settings-helpers.js drops any key the generated registry
snapshot does not list as persistable and strips secret keys from
responses; the dead keys (markdownDisplayMode, toolCallExpansion,
typographySizes, expandedEditorToolbar, gitProviderId/gitModelId) are
gone; the profile keys that were client-only now round-trip. A drift
test requires a valid sample for every persistable registry key.
Testing: vitest run in packages/web (182 files), including the packed
tarball import.
* refactor(vscode): gate bridge settings writes by the registry
Problem: the extension host wrote any key the webview sent straight into
settings.json, and commit-message generation read the dead
gitProviderId/gitModelId pair instead of the small-model setting.
Approach: filterPersistableSettingsChanges applies the registry snapshot
before the file write; chooseBridgeGitGenerationModel honours
smallModelUseDefault/smallModelOverride ahead of the zen fallback.
Testing: bun test packages/vscode (37 files), tsc, build:extension.
* feat(settings): split the user's profile into preferences.json
Problem: one flat settings.json held instance facts, the user's
preferences and device state together, so device state travelled between
installs and the profile had no document of its own to sync from.
Approach: the server keeps one merged document for clients but routes
each key by registry scope on disk (settings-files.js): profile keys go to
preferences.json as { value, updatedAt } entries stamped when the value
changes, everything else stays in settings.json, device keys are dropped
from writes. A missing preferences.json is seeded once from settings.json,
which is left intact; an unreadable one is a failure that pauses profile
writes and never gets overwritten. Server modules that read a profile key
off the disk use the merged sync read. Electron main reads the theme mode
from both files and now owns the splash colours, handed over the
window-theme IPC instead of the settings document. Clients stop sending
device keys, seed them once from a pre-split document, and persist
inputBarOffset locally. The PWA manifest keys are instance facts.
Testing: vitest in packages/web (seed, split write, timestamp retention,
unreadable file), bun test in packages/ui and packages/electron, tsc for
every workspace.
* feat(vscode): write the profile to preferences.json from the extension host
Problem: the extension host writes the shared settings files directly and
had to follow the server's split, and its file writes reported success on
failure.
Approach: settings-files.ts mirrors the server's format and split rules
(seed once, unreadable preferences.json is a failure); persistSettings
routes profile keys to preferences.json and the rest to settings.json,
and the atomic writers now throw so a failed save reaches the webview.
Clearing a key now actually removes it from the owning file.
Testing: bun test packages/vscode (38 files), tsc, build:extension.
* feat(settings): store the per-surface profile fields by surface kind
Problem: theme, chat-layout switches and typography sizes are one value
for every client of an instance, so the phone and the desktop cannot
disagree without a hard-coded runtime branch.
Approach: every settings request carries the client's surface kind in the
x-openchamber-surface header (web, desktop, vscode, mobile — the phone app
and the hosted mobile shell are one kind). For the registry's perSurface
keys the store writes a changed value under fields[key].surfaces[kind] in
preferences.json and never touches the base from a surface; reads resolve
the kind's own value, then the base, then nothing. Writes without a
surface (migrations, the seed) set the base. The VS Code host is always
vscode; Electron main resolves desktop for the native window theme. The
Settings UI is unchanged.
Testing: vitest in packages/web (surface write/read, no base copy, unknown
surface falls back to base), bun test in packages/vscode and packages/ui,
tsc for every workspace, build:extension.
* fix(settings): keep a legacy copy of the profile in settings.json
The first write after the split rewrote settings.json with the instance
part only, and that write happens on startup (relay reconcile). A build
from before the split reads only settings.json, so rolling back would
have lost every preference: theme, default model, all of it.
Every write now stores the profile's base values in settings.json next
to the instance part (`legacySettingsDocumentOf`), on the server and in
the VS Code extension host alike. Current builds ignore the copy because
preferences.json wins in the merged read. When preferences.json is
unreadable the copy already on disk is kept rather than dropped.
Testing: settings-runtime tests updated for the copy; full web suite
(182 files), VS Code tests and extension build, tsc clean. Verified live
on a scratch OPENCHAMBER_DATA_DIR: all 136 keys survive startup, theme
changes land per surface, plain keys land in the base.
* feat(settings): make the UI password and tunnel preset tokens write-only
GET /api/config/settings returned desktopUiPassword and the managed
remote tunnel preset tokens to every authenticated client, including
paired phones and the VS Code webview that never need them.
Both keys are now `secret` in the registry: accepted on write, withheld
from reads. The server answers with a hasDesktopUiPassword flag; the
desktop network page shows "Password set" and sends a value only when
the user types a new one or presses "Remove password" (an empty string
clears it and turns LAN access off). The tunnel page already learned
token presence from the status endpoint. The VS Code bridge strips
secret keys from what it hands the webview while still merging them
from disk on write.
Testing: registry, i18n parity, server settings, VS Code gate tests and
tsc; workspace type-check. Verified against a scratch server: GET
carries the flag and no password, PUT with '' clears, PUT with a value
sets. The desktop-only page itself awaits the owner's run.
* fix(settings): send the surface kind as a query parameter, not a header
The packaged desktop shell (openchamber-ui://app) and the phone app are
cross-origin to the OpenChamber server, so the x-openchamber-surface
header turned every settings request into a CORS preflight the server
did not allow. Settings looked reset and every save reported "Save
failed" without reaching persistSettings. An older remote instance would
refuse the header the same way even with the allow-list fixed.
The client now sends ?surface=<kind>, which keeps the request
CORS-simple on every server version; the server reads the query
parameter and still honours the header. The header is also in the CORS
allow-list for completeness.
Testing: workspace type-check, persistence and registry tests, server
opencode tests. On a scratch server: PUT with ?surface=vscode lands
under surfaces.vscode, GET without or with an unknown surface serves the
base, the header fallback resolves. Confirmed in the owner's rebuilt
desktop and on the phone.
* refactor(settings): drop the show-password toggle from the desktop network page
With the password write-only, the field only ever holds a value the user
is typing right now; the reveal toggle and its strings are gone from
every locale.
* refactor(projects): serve project setup through the server, drop the legacy migration
The shared UI read and wrote ~/.config/openchamber/projects/<id>.json
itself: it resolved the home directory, composed the path, and used the
Files API, which only desktop and VS Code have natively and which cannot
see a remote instance's file at all. It also still carried the months-old
migration from <repo>/.openchamber/openchamber.json, which deleted files in
the folder the upcoming shared project config will use.
The client-owned keys (worktree setup commands, project actions, draft
starters) now live behind GET/PUT /api/projects/:projectId/config.
project-setup.js sanitizes and builds the view; the project-config runtime
merges a patch under the same cross-process lock the scheduled-task writers
hold, so unknown and server-owned keys survive. A wrongly shaped key is a
400, not a silent drop. openchamberConfig.ts keeps its exported functions
and is now an HTTP client. The VS Code webview handles the route locally
and bridges to the extension host, which owns the file with a TS mirror of
the sanitizers.
Testing: server tests for sanitizers, round trip, lock, and invalid patch;
client tests against a mocked route; VS Code sanitizer and bridge tests;
workspace type-check, both VS Code builds, UI isolated suite (409 files),
server projects and project-context suites. Live GET/PUT against a
running server with the owner's real project config.
* feat(projects): read the team's shared config and merge it with the personal one
A project can now carry <repo>/.openchamber/project.json (version 1:
setupWorktree, setupWorktreeWait, projectActions, draftStarters,
plansDir). The server finds the checkout from the path-derived project
id, parses the file, and answers GET /api/projects/:id/config with one
merged view: what runs at the top level, plus shared and personal blocks
so a page can edit the personal file without copying a teammate's entry
into it.
Merge rules: shared setup commands run first (a personal
setupWorktreeMode of "replace" uses the personal list only); the
personal wait flag wins when set; actions union by id with a personal
action replacing the shared one and personal hiddenSharedActionIds
dropping shared ones; starters union by type:name; the primary action is
personal only. A shared file that exists but cannot be parsed, or that
names a plansDir outside the repo, is reported as invalid with a reason
and never treated as "no shared setup". Nothing writes the repo file yet.
Client: getProjectSetup exposes the view; the existing helpers return
effective values, while the Projects page sections and the draft
starters hook edit the personal block only. Shared entries show a quiet
"shared" mark in the actions dropdown and read-only lists above the
editable ones on the Projects page; shared starter chips have no remove
handle. The VS Code extension host mirrors the parser and merge.
Testing: server tests for the parser, plansDir guard, merge table, id
round trip, and a runtime test against a temp checkout; client tests
against a mocked route; VS Code sanitizer, merge, and bridge tests; the
section test covers the shared row; locale parity; workspace type-check;
UI isolated suite (409 files). Live: GET against a temp repo with a
shared file and with a broken one.
* feat(projects): ask before the team's shared commands run, once per set of commands
Shared setup commands and shared actions come from a file a git pull can
change, and they run on the machine of whoever pulls. The first time one
would run, a dialog now shows exactly what would run and asks: "Trust and
run" or "Not this time". A "trust" answer is recorded in the personal
config against a SHA-256 of the executable parts (setup commands and each
action's id, command, and runIn; renames and icons do not count), so a
pull that changes a command brings the prompt back. Nothing asks when the
shared file has nothing that executes.
Worktree creation (session creator, new-worktree dialog, session store,
multi-run launcher, agent-manager empty state) resolves its commands
through the prompt; "not this time" runs only the user's own commands.
The actions dropdown asks before a shared action runs. The Projects page
shows "Trusted on this instance" with a "Reset trust" button next to the
shared actions. The dialog is mounted beside the app-link confirmation on
every shell. The VS Code extension host mirrors the hash and the record.
Testing: server tests for hash stability, ordering, and the trusted flag,
plus a runtime test that changes the shared file and sees trust drop;
client tests for the confirmation store (ask, trust, skip, replace mode,
newer request, failed record, reset); VS Code mirror tests; the actions
button, new-worktree dialog, and issue-2039 tests updated for the trust
path; locale parity; workspace type-check; UI isolated suite (410 files).
* feat(projects): share and unshare setup with the team from the Projects page
The repo file <repo>/.openchamber/project.json is now written by the app,
and only when the user shares something: nothing appears in a repository
until then. PUT /api/projects/:id/config/shared replaces the keys it
names over the current file, writes it pretty-printed with version first
and only the keys that carry something, removes the file (and an empty
.openchamber folder) when nothing is left, refuses a missing checkout or
a plansDir outside the repo, and records trust for the writer, who has
seen what they shared.
On the Projects page, actions and setup commands get "Share with team"
and "Make personal"; shared actions can be hidden for this user; a
checkbox switches to "Use only my setup commands". Project starter chips
get share and make-personal hover buttons. A new "Shared config" block
shows the file's path and status, the shared plans folder, and the trust
status with "Reset trust". A share is a repo write followed by a personal
write; a failure after the first leaves the item visible once, as
personal. The VS Code extension host mirrors the writer.
Testing: server tests for the patch, serialization, emptiness, the write
and removal round trip, the writer's trust record, and the refusals;
client test for the shared route; VS Code bridge test for write and
removal; locale parity; workspace type-check; UI isolated suite (410
files). Live on a scratch server: share, invalid plansDir (400), unshare
to removal of file and folder.
* feat(projects): list, edit, and move plans in the team's shared plans folder
When the shared config names a plansDir, every markdown file in that
folder is a plan on the Plans tab: listed after the user's own plans,
marked shared, addressed as shared:<file>, read and edited in place
(the raw document is written verbatim, so a plan another tool wrote
keeps its shape), and deletable. Share moves one of the user's plans
into the folder; make personal moves it back under a new id; a name
collision gets a numeric suffix. Sharing is refused, with a hint in the
panel, until a shared plans folder is set in Project settings. This
answers the request to read plans from an existing folder such as
docs/plans.
Server: the project-context runtime takes resolveSharedPlansDir from the
project-config runtime; readContext reports sharedPlansDir; POST
.../plans/:id/share and /unshare. Client: movePlan in the context store,
a shared badge and a share / make-personal button per plan row. Session
attachments reference plan ids, so an attached plan that moves has to be
attached again.
Testing: runtime tests for listing, foreign markdown titles, id
traversal, in-place update and delete, share and unshare with a
collision, and the refusal without a folder; HTTP route tests; store and
locale parity tests; workspace type-check; full web suite (183 files);
UI isolated suite (410 files). Live on a scratch server against a temp
repo: list, share, read, unshare.
* fix(server): make OPENCHAMBER_DATA_DIR move every folder, not just the flat files
The variable is documented as the OpenChamber data directory, but only
settings, preferences, auth, and push files followed it; projects,
themes, speech models, and the chats default stayed under
~/.config/openchamber. A second instance started with a custom
directory therefore read and wrote the default instance's project
configs.
Every folder now hangs off the one root. An instance that already used
a custom directory gets projects, themes, and speech-models copied in
once at startup; copied, not moved, so a second instance beside the
default one cannot strip it, and nothing is merged into a folder that
already exists. Existing managed chats are not copied, as with
OPENCHAMBER_CHATS_DIR.
Testing: migration tests for copy-once, no-merge, and same-root no-op;
full web suite; a scratch server with an empty data dir copied the real
project configs and kept its writes in the copy.
* fix(projects): keep a plan's id when it moves into or out of the repository folder
A plan moved into the repository plans folder used to be listed under a
new shared:<file> id, so a session that had attached it lost the
attachment. The manifest entry now stays with a `shared` flag that says
which folder holds the file; the id survives both directions. Only a
plan that never had an entry (one written by another tool) gets an id
when it is brought in. A personal file and a repository file may share
a name because they live in different folders.
Testing: runtime tests for share and unshare with a stable id, reading
and editing the moved plan, the suffix on a name collision, and the
adoption of a foreign file.
* feat(projects): default repository plans folder, "move to repository" wording, tooltips
Plans now have a repository folder without any setup: .openchamber/plans
by default. A custom plansDir replaces the default outright (only that
folder is read and written; moving files between the two is the user's
job), and the field's placeholder and hint say so. The move buttons on
plans are therefore always available.
The word "share" is gone from the UI: it read like publishing, while
the action stores an item in the repository so everyone who pulls it
gets it. Labels are "Move to repository" / "Move to my settings", the
badge is "In repo", the block is "Repository config", and every button
on the Projects page carries a tooltip that says what happens (the
"Move to repository" button explains that edits save first while the
form is dirty). The trust status with "reset trust" moved from the
repository block into the Worktree section next to the commands it
guards; the plan row's badge sits beside the title.
Testing: locale parity, section test, workspace type-check, UI isolated
suite (410 files), full web suite.
* fix(projects): leave the icon key out of the repository file when an action has none
Actions without an icon were written as "icon": null into
.openchamber/project.json. The key is now omitted; readers already fall
back to the play icon. Server and VS Code serializers, tests updated.
* docs: describe the repository config file and how items move into it
A new page in every locale: what stays personal and what can move into
the repository, the .openchamber/project.json format with an example
and every key explained (setup commands, actions with the supported icon
names, starters, plansDir), the merge rules, the trust prompt, and plans
in the repository. Linked from the sidebar and from Project Actions.
Translations written by hand.
The PTY runtime exported an empty NODE_CHANNEL_FD to override the daemon's
IPC descriptor, because bun-pty merges the native environ back into the
child and a JS-only delete does not stick. Node CLIs launched from the
shell (opencode, claude) then printed "warn: Failed to parse IPC channel
number ''" on exit.
The Linux-only env -u ARGV0 wrapper now applies on macOS and Linux and
also unsets NODE_CHANNEL_FD, so the variable is gone instead of empty.
Testing: runtime and inherited-env tests updated for the POSIX wrapper;
verified in the running app that exiting opencode no longer prints the
warning.
The terminal ran on the ghostty-web npm package plus a hand-written patch,
and every rendering bug (recycled rows, duplicated reflow fragments, prompt
artifacts) had to be worked around from outside. The emulator now is the
official libghostty-vt C ABI compiled to WebAssembly, driven by a browser
adapter ported from T3 Code (MIT, notice in LICENSE-T3CODE) and owned in
packages/ui/src/lib/ghostty. The artifact is reproducible with
scripts/build-libghostty-wasm.sh, including a workaround for Zig 0.15.2 on
macOS 27 SDKs.
On top of the port: one WASM instance per page with every tab kept mounted
and hidden tabs paused; history replayed at the PTY size it was drawn for;
shells spawned only after the first fitted grid so zsh never prints the
PROMPT_SP marker; box drawing, block elements and Powerline arrows drawn
procedurally to the exact cell so TUI borders and block logos have no gaps
between rows; a software-rasterized canvas so Gecko renders every tab's text
with the same smoothing; the symbols-only Nerd Font bundled instead of a CDN
fetch; touch selection and scrolling driven through the surface API; a copy
button in the tab strip for touch hosts; localized aria labels.
Testing: bun tests run the real WASM (reflow, palette, replay isolation,
recycled rows, box glyph geometry); viewport and view tests use a surface
double; verified in Chromium and Zen (windowed and headless) for crisp text,
new tabs, panel reopen, resize and box glyph rendering; package type-check,
oxlint/eslint on new files, web build.
Remove automatic moves on session activation, terminal failures, and archive restoration while preserving manual moves and worktree deletion.
Replace directory listing probes with a stat-only endpoint using Node built-ins, including an isolated module-load regression test for packaged desktop.
Validation: focused session, worktree, filesystem, localization, and bridge tests; workspace type-check and lint; web and VS Code builds. Desktop startup and behavior verified by the maintainer.
ghostty-web 0.4.0 hands rows that scroll into view out of recycled WASM
page memory without clearing them, so after a tab or project switch the
new emulator showed the previous terminal's text (upstream #138). The fix
landed only in prereleases, so pin 0.4.0-next.20 and carry the local
block-glyph rendering patch over to the new dist file.
Verified in a production build: creating an emulator after disposing a
full one no longer exposes its rows, and switching between two projects
with live output in each keeps every terminal's content to itself.
Opening the terminal panel sometimes showed stray fragments on the prompt
row: zsh's end-of-line mark and pieces of the prompt path. The shell had
laid its output out for one PTY width, but the client replayed that
history into an emulator of another width (an early size estimate, a
remount, or a renderer rebuild after fonts loaded). ghostty-web's reflow
then left fragments the shell's SIGWINCH redraw never clears.
The server now reports the PTY cols/rows in every snapshot, the transport
carries them through projections and accepted resizes, and the viewport
replays a sized snapshot chunk at that size before returning to the
fitted size. The container-based size estimate only seeds newly spawned
shells and is no longer sent to a running PTY.
Tests cover the sized replay, the store chunk size, the transport
projection, and the server snapshot; verified in a production build by
reloading with the panel open and switching tabs at a changed width.
Reject invalid credentials while preserving valid token fallback, parse balances with existing boundary helpers, and keep credit values free of untranslated unit text. Inject auth and HTTP dependencies for focused tests in both runtimes.
Validated web quota and registry tests (35 passed), VS Code quota tests (70 passed), both package type checks and lint, extension build, and changed-line anti-slop checks. Reviewed dead-code output. Live Hyper validation was not run because no API key is available.
Input history (#3035) shipped with "All projects" as the default scope and
only recorded prompts sent after the upgrade, so ArrowUp showed other
sessions' prompts and, once switched to "Current session", nothing at all.
Default to the current session and merge the visible transcript's prompts
with the persisted bucket. Existing sessions recall as they did before
#3035, while new prompts keep their attachments and stay recallable after
a revert hides them from the transcript.
Cleanup across #1855, #2297, #3072, #3178, #3035 and #3135: drop the
duplicate poll guards in the file content poller, the zod schema the
VS Code package cannot depend on, a copied file-URL helper and stray
whitespace; move the Enter-to-send strings into the settings namespace;
document OPENCHAMBER_CHATS_DIR, resolve the chats root once on the server
and warm it alongside the other bootstrap calls.
The update dialog (server and desktop) now reads changelog/index.json and
renders title, intro and groups; the release workflow builds the GitHub
Release body and name from changelog/<version>.md; oc-dev, the issue-intake
agent, AGENTS.md and the changelog skill no longer point at the file.
CHANGELOG.md stays as a legacy copy for installs up to 1.22.1, which fetch
it for update notes. The generator refreshes it while it exists and never
recreates it, so deleting it after 2026-09-19 retires it for good.
Generated outputs hold released versions only, so editing unreleased.md
never makes them stale: agents write that file and nothing else, and
oc-dev create-release does the generation.
Claude-Session: https://claude.ai/code/session_01VqV56Hez25hTxXH4ipJfzH
Every release file now carries a title: two to six plain words naming the
change a user would remember it for. The generator refuses a release without
one, promote carries the title from unreleased.md, and the unreleased
template opens with a title line. The changelog-authoring skill and the
format README describe how to write it.
Claude-Session: https://claude.ai/code/session_01VqV56Hez25hTxXH4ipJfzH
The grouped notes put the OpenCode Go header change under Improvements, so
the site's headline fallback (first bold bullet) picked Message queue. The
explicit title keeps the release's most important change on the index.
Claude-Session: https://claude.ai/code/session_01VqV56Hez25hTxXH4ipJfzH
Release notes now carry New, Improvements, Fixes, and Misc headings.
Inside the update dialog they render as small uppercase labels over
their lists instead of full-size document headings.
Claude-Session: https://claude.ai/code/session_01VqV56Hez25hTxXH4ipJfzH
Releases 1.13.1 through 1.22.1 are regrouped by what each change is
(New, Improvements, Fixes, Misc) and reworded in the voice the
changelog-authoring skill asks for: one or two plain sentences per
bullet, the symptom or the capability named, no mechanism. Packed
bullets were split, every fact and every contributor credit kept.
Older releases keep the mechanical grouping.
Claude-Session: https://claude.ai/code/session_01VqV56Hez25hTxXH4ipJfzH
Release notes now live in changelog/<version>.md (front matter with
version and date, then ## App and ## VS Code sections grouped into
New, Improvements, Fixes, Misc) plus changelog/unreleased.md for what
has not shipped. `bun run changelog:build` renders CHANGELOG.md,
packages/vscode/CHANGELOG.md, and changelog/index.json from them;
`changelog:check` fails when the outputs are behind and runs in CI and
in release:prepare. `oc-dev create-release` promotes unreleased.md to
the versioned file dated today and rebuilds.
The existing history was split mechanically: every bullet kept, sorted
into groups by keyword, five hand-typed headers with one-digit days
normalised to YYYY-MM-DD (the update dialog matched none of them). The
generated files keep today's release headers, which the update dialog,
the release workflow, and the website match by regex.
Claude-Session: https://claude.ai/code/session_01VqV56Hez25hTxXH4ipJfzH
Release sections now carry New, Improvements, Fixes, and Misc groups,
and the bullets are written for a user who never opened the code: one
or two plain sentences naming what they see. The changelog-authoring
skill makes that shape the primary rule, with a worked example, a
five-second reader test, and checks per bullet.
Claude-Session: https://claude.ai/code/session_01VqV56Hez25hTxXH4ipJfzH
The splash and the UI bundle both started in English on a fresh install
even when VS Code ran in a supported language, because only OpenChamber's
own saved locale was consulted. The HTML now exposes VS Code's display
language; the splash and detectInitialLocale use it until the user picks
a locale, which still wins.
Claude-Session: https://claude.ai/code/session_01VqV56Hez25hTxXH4ipJfzH
While a turn runs, the collapsed pill showed a plain Send button for a
draft that the expanded composer shows as Queue with a rotated icon, and
the pill routed it through the primary action. The pill now queues, with
the same label and icon as the expanded composer.
Claude-Session: https://claude.ai/code/session_01VqV56Hez25hTxXH4ipJfzH
The sidebar indicator kept the terminal listing loop going for as long as
the sidebar was visible, in every client, whether or not anything was
running. It now lists once on mount, to pick up runs another client
started, and keeps the loop only while a project action is known to be
running anywhere; an idle sidebar costs no polling.
Claude-Session: https://claude.ai/code/session_01VqV56Hez25hTxXH4ipJfzH
The runtime stage copied node_modules from the deps stage, but patch-package
runs in the builder stage, so a patched server-side dependency reached the
image unpatched; only the bundled dist carried the fix. Both node_modules
copies now come from builder.
Claude-Session: https://claude.ai/code/session_01VqV56Hez25hTxXH4ipJfzH
The terminal store keyed its directories by trimming trailing slashes,
while the new sidebar activity indicator and the whole-server session
grouping keyed the same folder with the project-action normalizer, which
also rewrites backslashes. On Windows that split one project into two
namespaces: the sidebar reconciled server sessions under "C:/repo" while
the terminal panel and the project actions button worked under "C:\repo",
so the running-action indicator never lit up, adopted tabs were duplicated
and a stop recorded in one namespace did not guard reconciliation in the
other. The project actions button also read the store map directly with a
path normalized somewhere else, missing its own directory entry.
All terminal directory keys now come from normalizeTerminalDirectory in
lib/pathNormalization, and store reads go through getDirectoryState.
The 256 KiB budget for an oversized tool diff preview counts UTF-16 units, so
the cut can land between the two halves of an astral character - an emoji in a
patched string, for instance. The preview then ended in a lone surrogate that
renders as the replacement glyph.
Step back one unit when the boundary splits a pair.
The IME fix covered the diff/file comment input and the browser annotation
overlay, but two other places where a user writes a comment still acted on
the Enter that confirms an IME candidate: the chat quote comment in the text
selection menu, and the in-place comment editor on a composer context chip.
Confirming a candidate there attached or committed the half-typed reading and
closed the input. Escape, which abandons a candidate, had the same problem.
Both handlers now return early on a composing keystroke, and a single test
asserts the guard across every comment input so the next one added does not
quietly skip it.
The add-folder dedup normalized the drive letter to uppercase on one side and compared it with Uri.fsPath, which VS Code lowercases again. On Windows an already-open folder therefore never matched and was re-added. Uses pathsEqualWithNormalizedDriveLetter so both sides normalize.
The inline-comment feature added its manifest and runtime strings to English and French only, so Turkish users saw English command titles, thread labels and warnings. Adds the ten missing keys and a test that fails whenever a locale bundle drifts from the English key set or its placeholders.
isBunInstalled() spawned <BUN_INSTALL>/bin/bun, which does not exist on
Windows where the installer ships bun.exe. spawnSync adds no extension to
an explicit path, so the probe failed and the CLI quietly started the
server under Node even with Bun installed. The probe now names bun.exe
on win32.
Claude-Session: https://claude.ai/code/session_01VqV56Hez25hTxXH4ipJfzH
Child discovery now pages through the whole session list, so one pull can
take longer than the 15s watchdog interval. Two overlapping pulls each read
the store before either commits, so both appended the same newly found child
and the directory store ended up with duplicate rows. Keep one pull per
directory in flight, mirroring the status-poll guard.
Bohdan Triapitsyn