Saved Project knowledge plans opened as an empty editor whenever the
viewer could not resolve the owning project from the current directory:
managed chats (openchamber:chats is not a registered project), worktrees
outside the repo path, and plan tabs restored after a reload. Titles
still rendered because the list reads the manifest through the correct
owner.
- Thread the owner explicitly (savedProjectPlan = { projectRef, planId })
from the panel, mobile surfaces, and persisted context tabs; PlanView
no longer guesses the project.
- An unrecognized directory resolves to no owner instead of borrowing
the active project's knowledge.
- Serialize plan writes per document (planSaveQueue) so close/switch
within the autosave debounce no longer drops the last edits, saves
cannot land out of order, and a recovered save clears the error banner.
- Send saved-plan contents inline in Improve/Implement prompts (they
have no file path); disable those actions for managed-chat plans,
which have no project directory to create a session in.
- Drop persisted plan tabs that carry an id without an owner rather than
reopening them against a guessed project.
`useBtwPanelState` already subscribes to the composer's own session — it is
what the fork link is derived from — so asking `useSession` for the same
session and directory a second time in `ChatInput` was a duplicate
subscription for a value already in hand. Expose it as `parentSession` and
read the promoted flag from there.
No behavior change.
Review catch: `promoteBtwSession` removes the btw metadata, but the
boundary instruction is persisted on every message the session sent while
it was a side conversation, and there is no API to delete a message part
after the fact. A promoted session therefore keeps reading "no sub-agents,
do not touch the workspace" out of its own history, in a session that is
no longer a side conversation.
Promotion cannot delete those lines, so it answers them instead:
`withoutBtwSessionMarker` now leaves `openchamber.btwPromoted`, and the
composer sends `BTW_PROMOTION_NOTICE` with every message in a session
carrying it — stating that the session is now the main thread and the
usual tool, sub-agent and workspace permissions are in force.
It rides with every send for the same reason the boundary does: the
instructions it revokes are re-read on every turn, so a one-shot notice
would lose its position relative to them as the conversation grows.
`btwPromoted` is additive and optional. A session that never went through
`/btw` never has it, and one promoted before this change simply keeps the
old behavior.
Two related fixes to what a btw session inherits and shows.
**Fork point.** `/btw` is typically typed *while* the main thread is
working — that is the moment a side question comes up. Forking at HEAD
then clones a turn that is still streaming, so the fork inherits a
truncated assistant message and the user instruction that provoked it as
the newest, most salient thing in its context. Fork at the parent's last
completed assistant turn instead, read from the sync store with no extra
round-trip. A parent with no completed turn yet keeps the previous
fork-at-HEAD behavior.
**Boundary.** `filterBtwTailMessages` shows every inherited message when
the boundary is `null`, and the boundary is `null` whenever the
newest-cloned read comes back empty. That is correct for a fork of an
empty parent, but it also turns an empty read into "nothing was
inherited" for a fork that demonstrably did inherit history — the panel
then opens with the parent's whole transcript in it. Having picked a
fork point proves the parent had turns, so fall back to that id instead
of `null`. The fork's own messages are created later and still sort
after it, so its tail stays complete either way.
`/btw` forks the session, so the model receives the parent's whole
conversation — including whatever plan was in flight when the user typed
the command. Nothing tells it that this history is context rather than
its own task, so the fork frequently carries on with the parent's work
instead of answering the side question, which is the opposite of what
`/btw` is for.
Send a boundary instruction as a synthetic part with every message in a
btw session: with the first question in `startBtwSession`, and with each
later send while the panel is expanded and the composer is talking to the
fork.
The wording is deliberately position-independent — it names the history
inherited from the parent thread rather than "everything before this
boundary". The instruction rides along with each send instead of being
pinned once at fork time, so a positional phrasing would be re-anchored
every turn and would end up telling the model to disregard the btw
session's own earlier turns.
The part is synthetic, so it is filtered out of the rendered transcript
whenever the message also carries user text — which is always the case
here. No visual change.
The startup path probed a relay host's stored direct URL — often the
pairing creator's own loopback — and any failure landed on the Remote
Server Unreachable screen before the renderer's relay restore could run.
A relay-capable default host now boots to main on the local substrate for
any failed direct probe (unreachable, wrong-service, incompatible), skips
the 10s second probe, and lets the renderer's existing restore pick
direct-or-relay.
The chat screen relied on the browser's focused-field reveal, which holds
on iOS Safari but not on Android, where interactive-widget is also widely
ignored — the composer just stayed behind the keyboard. The draft screen's
visual-viewport pin now covers the chat screen on Android; iOS chat keeps
the native reveal.
The eslint pass in release:prepare caught what the package-scoped checks
did not: Header's handleOpenContextPlan and servicesTabs lost their last
callers with the removed shortcuts, the settings-synced listeners no
longer need the DesktopSettings import, and the store's openContextPlan
action itself went unused once the plan surface was reachable only through
the digit switcher and the rail.
The agent's browser.open used to force the context panel open and steal
the active surface, which read as panels opening by themselves. Tab
upserts now take a reveal option: the agent's opener passes reveal: false,
so the tab mounts invisibly (panes are kept alive regardless of
visibility, so agent control still works) while the panel and the active
tab stay exactly as the user left them. Manual opens are unchanged.
Aborting a run now just ends it quietly: the status chip and the composer
bar no longer flash an Aborted notice, and the indicator state machine and
its timer are gone from the composer. Acknowledging the session abort
record stays — it is what lets the working chip resume on the next run.
The pre-dvh -webkit-fill-available viewport fix freezes Android Chrome's
root at the pre-keyboard height; when interactive-widget=resizes-content
shrinks the viewport, the document stays taller than the screen and the
clipped composer hides behind the keyboard with no way to scroll to it.
dvh-capable browsers now take a dynamic 100dvh instead, and the legacy
fallback keeps serving browsers without dvh.
Removes the transient aborted banner from the composer status area
Simplifies status row rendering to focus on working state and pending changes
Cleans up unused abort-status localization strings
## Problem
Review on #3151: with isCurrent reduced to store liveness, a completed
run's context stays current while a forced same-directory rerun starts,
so a late deferred response could commit over the newer run's state.
## Fix
Track a per-directory run sequence. isCurrent captures the sequence at
run start and stays true across settle (deferred recovery pulls still
commit — the original bug) but flips false the moment a newer run for
the same directory begins. Entries are cleared on directory disposal.
## Validation
- New test: after a forced rerun the first context is retired and the
second is current. 20 pass in child-store.test.ts.
- bun test src/sync/: 540 pass / 15 fail — same 15 pre-existing on main.
- type-check and oxlint clean on authored lines.
Command Code's official API has no usage endpoints; the old usage source
was the unofficial studio API reached through a now-archived plugin, so
the tile could only ever fail for officially configured users. Removed
across server, shared UI, and the VS Code extension; the provider logo
fallback stays — it serves the model picker, not usage.
## Problem
Pending permission requests (and questions, MCP/LSP/VCS status) vanish
permanently after a page reload. The deferred recovery phase in
bootstrapDirectory — the code that re-pulls permission.list after load —
never executed, so the UI had no way to re-render a card for a request
the opencode server still holds. Fixes#3150.
## Root cause
The deferred phase is scheduled via setTimeout(0) guarded by isStale(),
which maps to the pump's isCurrent(). isCurrent required the run token
to still be present in runningBootstraps, but the pump deletes that
token in .finally() as soon as onBootstrap settles — always before the
setTimeout macrotask fires. The guard was therefore deterministically
stale and the phase was dead code (introduced by 85400459).
## Fix
Make isCurrent a store-liveness check — disposed, generation, and store
identity — instead of run-token ownership. The pump never replaces a
running entry for the same directory (queueBootstrap defers via
rerunRequested), so during the run itself this is equivalent. This
mirrors the existing isCurrent contract in session-message-loader.ts.
## Validation
- New regression test in child-store.test.ts fails on main and passes
with the fix (isCurrent stays true across the post-settle macrotask,
flips false after teardown).
- bun test src/sync/: 539 pass / 15 fail — the same 15 fail on pristine
main; the only delta is the new passing test.
- bun run type-check (packages/ui): pass.
- bunx oxlint on both changed files: no findings on authored lines.
Add to input leaves the desktop menu (mod+L owns it; mobile keeps the
button) and the New session action is gone from both variants along with
its handler and dead locale keys.
Bohdan Triapitsyn