A sweep verifies whether an earlier push-back or recorded product
decision was addressed at the current HEAD and reports that explicitly;
it never re-decides or re-asks. The generic rebase-request is never
posted over an existing substantive review comment.
Conversation-style entry points so the maintainer can start real work
without opening the GitHub UI: feature-work serves a menu of accepted
features (approved scope from the acceptance comment is binding);
bug-work serves verified bugs from the local fix backlog and the
root-cause:found label, severity-first, re-verifying anchors before
fixing. Both close the loop with fixes #N in the eventual commit.
A maintainer's answer on a FEATURE-DECISION now resolves mechanically:
wanted features get an acceptance comment plus the new accepted label
(never re-asked by later sweeps; label:accepted is the implementation
roadmap), declined ones get the drafted close; conditional answers are
recorded as the accepted scope.
triage-issues gains a silently-fixed detection ladder, strongest
evidence first: mechanism-anchor (git log -L on the root-cause:found
file:line since the issue date), repro re-run against current main, and
symptom search over commits/CHANGELOG/merged PR titles. CLOSE-FIXED
always names its evidence; an unverified hunch only asks the reporter
to retry.
pr-review's merge verdicts now search open issues for the symptom a bug
fix resolves and propose Closes #N, so fixes stop landing unlinked.
One issue now gets one comment instead of two posted minutes apart
(the old triage bot asked questions its reproduce sibling then answered
itself). The combined issue-intake agent, driven by an audit of recent
bot output:
- duplicate check before anything else — duplicates are closed, not
reproduced (the duplicate label had zero uses across 1,353 issues
while the bot found duplicates in prose)
- reproduction artifacts live in a collapsed block inside the comment;
the reproduce/issue-N branch convention is retired (382 stale branches
removed from origin)
- reproducible:true renamed to root-cause:found — it asserts a traced
mechanism, not reporter-confirmed causation; confirmed:reporter is the
human-set complement
- the bot no longer sets priority (maintainer-only flag), announces its
labels, opens with flattery, or interrogates feature reporters about
design decisions
- comment opens with a For-the-maintainer line (fix-ready /
needs-reporter / duplicate / likely-fixed / feature)
- label taxonomy cut from 65 to ~26: api:*, reproduction-steps:*,
priority:medium/low, 13 near-zero-use area labels, ios/android
platforms, and orphans removed
- runs on zai-coding-plan/glm-5.3-flash via ZHIPU_API_KEY
- new triage-issues skill mirrors the PR triage pipeline: mechanical
sweep, verdict fan-out, approved batch actions, fix backlog
Post-merge hardening of the session-to-worktree move (#2998), driven by
review findings on the follow-up pass:
- an ambiguous transport failure (relay abort, timeout) on the
change-carrying move no longer force-deletes the fresh worktree that
may hold the user's only copy of their changes; both intent kinds
surface honest guidance and refresh both directories
- assertSdkSuccess re-tags ambiguous transport errors when wrapping SDK
failures, so ambiguity classification survives the wrapper on every
path, matching the prompt-send precedent
- session liveness checks scan all child stores plus the global status
index, and report unknown (not idle) when no store covers the session
— an evicted background directory can no longer make a busy session
look movable
- incomplete-rollback errors carry the changes-may-be-in-destination
guidance instead of swallowing it
- move-message assembly shared across the three call sites; tests now
exercise the real ambiguity classifier (extracted to
send-failure-classification.ts) instead of a hand-mirrored mock
- i18n fallout from the merge train: Turkish gains the 21 worktree-move
keys, all 12 locales get the hedged ambiguous-failure toast; owning
DOCUMENTATION.md files record the new contracts
Comments and reviews from patrick-motard and mattv8 are strong human
signals during batch triage: their approval upgrades confidence, their
concerns become findings to verify. They write free-form; sweeps map
their conclusions onto the verdict ladder.
Re-enable the automated PR review (pull_request_target + /oc-review
comments) on zai-coding-plan/glm-5.3-flash via ZHIPU_API_KEY.
Recalibrate the output contract based on an audit of 69 past reviews
(22 PRs, Aug 15-18): 18 of 27 BLOCKED verdicts were template-policing,
3.1 reviews per PR, ~8.4K chars per comment.
- BLOCKED now means code/merge problems only; handoff/template gaps move
to a separate one-line Handoff flag that never changes the verdict
- re-reviews emit deltas (verdict + what changed) instead of full
re-emission; push-triggered re-reviews are throttled to one per 15
minutes (manual /oc-review always runs)
- hard length budgets by change class; the applied-guidance table is
gone (guidance is applied silently, named only when it produced a
finding); empty evidence/security sections are omitted
- evidence demands are single-shot and escapable, never raised for
dependency bumps, string edits, server code, or packaging
- the comment opens with a one-line maintainer verdict (merge / merge
after X / don't merge because Y), enforced by the workflow
- triage-prs skill treats review:* labels as a pre-sort for verdict
reviews
Follow-ups promised on merge, plus review findings on the batch itself:
- chat: task-tool output now respects the 512KiB render cap; quick-open
icon is visible at rest on coarse pointers and reachable by keyboard
(row keydown no longer swallows inner-button Enter/Space); composer
inline-code decoration drops the metric-shifting padding; a btw fork
send carries only the boundary instruction, never the promotion notice
- sync: cascade revert/unrevert aborts busy descendants, busy state is
read from every child store at the moment of use; rule 9 documents
redo clearing all descendant revert markers
- electron: renderer recovery keeps memory-eviction (a valid
render-process-gone reason) and both windows share one
attachRendererRecovery helper
- vscode: process registry is a thin re-export of the web module
(provider-env-aliases precedent) with ordered register/unregister
writes and an awaited close
- server/cli: managed-process registry takes injectable deps (fixes the
unreaped-orphans ReferenceError), corrupt settings errors name the
file, getWorktrees test restores console.warn
- tests: module-mock harnesses removed (AgentsSidebar, SettingsView
mobile focus — behaviors stay live but uncovered, accepted trade),
QuestionMarkdown asserts rendered DOM
- i18n: German gains the debug-panel request keys, Japanese/German drop
removed worktree keys, Ukrainian unit spacing fixed
- changelog: Copilot AI Credits entries (main + VS Code)
Saved Project knowledge plans opened as an empty editor whenever the
viewer could not resolve the owning project from the current directory:
managed chats (openchamber:chats is not a registered project), worktrees
outside the repo path, and plan tabs restored after a reload. Titles
still rendered because the list reads the manifest through the correct
owner.
- Thread the owner explicitly (savedProjectPlan = { projectRef, planId })
from the panel, mobile surfaces, and persisted context tabs; PlanView
no longer guesses the project.
- An unrecognized directory resolves to no owner instead of borrowing
the active project's knowledge.
- Serialize plan writes per document (planSaveQueue) so close/switch
within the autosave debounce no longer drops the last edits, saves
cannot land out of order, and a recovered save clears the error banner.
- Send saved-plan contents inline in Improve/Implement prompts (they
have no file path); disable those actions for managed-chat plans,
which have no project directory to create a session in.
- Drop persisted plan tabs that carry an id without an owner rather than
reopening them against a guessed project.
The startup path probed a relay host's stored direct URL — often the
pairing creator's own loopback — and any failure landed on the Remote
Server Unreachable screen before the renderer's relay restore could run.
A relay-capable default host now boots to main on the local substrate for
any failed direct probe (unreachable, wrong-service, incompatible), skips
the 10s second probe, and lets the renderer's existing restore pick
direct-or-relay.
The chat screen relied on the browser's focused-field reveal, which holds
on iOS Safari but not on Android, where interactive-widget is also widely
ignored — the composer just stayed behind the keyboard. The draft screen's
visual-viewport pin now covers the chat screen on Android; iOS chat keeps
the native reveal.
The eslint pass in release:prepare caught what the package-scoped checks
did not: Header's handleOpenContextPlan and servicesTabs lost their last
callers with the removed shortcuts, the settings-synced listeners no
longer need the DesktopSettings import, and the store's openContextPlan
action itself went unused once the plan surface was reachable only through
the digit switcher and the rail.
The agent's browser.open used to force the context panel open and steal
the active surface, which read as panels opening by themselves. Tab
upserts now take a reveal option: the agent's opener passes reveal: false,
so the tab mounts invisibly (panes are kept alive regardless of
visibility, so agent control still works) while the panel and the active
tab stay exactly as the user left them. Manual opens are unchanged.
Aborting a run now just ends it quietly: the status chip and the composer
bar no longer flash an Aborted notice, and the indicator state machine and
its timer are gone from the composer. Acknowledging the session abort
record stays — it is what lets the working chip resume on the next run.
The pre-dvh -webkit-fill-available viewport fix freezes Android Chrome's
root at the pre-keyboard height; when interactive-widget=resizes-content
shrinks the viewport, the document stays taller than the screen and the
clipped composer hides behind the keyboard with no way to scroll to it.
dvh-capable browsers now take a dynamic 100dvh instead, and the legacy
fallback keeps serving browsers without dvh.
Removes the transient aborted banner from the composer status area
Simplifies status row rendering to focus on working state and pending changes
Cleans up unused abort-status localization strings
Command Code's official API has no usage endpoints; the old usage source
was the unofficial studio API reached through a now-archived plugin, so
the tile could only ever fail for officially configured users. Removed
across server, shared UI, and the VS Code extension; the provider logo
fallback stays — it serves the model picker, not usage.
Add to input leaves the desktop menu (mod+L owns it; mobile keeps the
button) and the New session action is gone from both variants along with
its handler and dead locale keys.
PR-status source candidates were every configured remote, so a checkout
carrying contributor forks matched a fork's closed PR whose head merely
shared the branch name — a fork's 'main' surfaced on the local main in the
git and work-status panels. Only the ranked-first remote (the one the
branch pushes to) and its fork network are PR sources now; other remotes
remain search targets but their owner:branch heads no longer count.
Every window shares one server settings document, and every PUT returns the
merged whole, so one window's activeProjectId write was adopted by the
other on its next unrelated settings save — its sidebar then auto-selected
a session in that project and wrote the pointer back, converging both
windows onto one session. settings-synced now carries an adoptWorkspace
flag: only bootstrap-grade syncs (startup, runtime switch) may adopt the
shared workspace pointers; reconcile responses keep the window's own active
project while it exists. Notification clicks and session deep links also
stopped broadcasting the session switch to every window.
Every response already funnels through runtimeFetch, so a classifier there
spots 401s, confirms them against /auth/session (a proxied provider 401
must not read as a logout), and flips a small auth-session store. The web
and hosted surfaces show a frosted banner under the header whose Log in
button hands off to the session gate's existing unlock flow; sends are
paused while expired, the session-load error screen explains the auth case
and retries itself after login, and returning to a long-idle window
revalidates once via visibility/focus. Native mobile feeds the same signal
into its connection re-probe instead of showing the banner; VS Code is
exempt.
The failure handler restored the text only for a new-session draft; a
regular session kept its attachments but lost the prompt to a toast. The
restore now runs before any cause-specific branching: an unchanged composer
gets the text (and the session draft) back, new typing gets the failed
prompt appended instead of clobbered, and a mid-send session switch writes
it into the originating session's persisted draft.
With streaming auto-follow off nothing moves the viewport, so a growing
reply slides below the composer without a single scroll event and the
at-end transition that shows the pill never fires. Content growth now
doubles as the signal: once the measured last row extends past the visible
area by the follow re-arm threshold, the end state clears and the pill is
scheduled.
Opening a session (or any relayout that shrinks off-screen size estimates)
could leave the viewport in a phantom tail below the measured content, with
every row out of reach above; a totalSize-change check now detects the
fully blank viewport and returns to the real end, and settling a width
resize re-asserts the end for a reader who was on it. Prompt-rail and
message jumps land on estimated offsets that shift as the target mounts and
measures; a short settle loop now re-aligns the target until layout rests,
backing off on the first user gesture.
A trailing configure button on the rail — outside the sortable list and the
digit shortcuts — opens a dialog that toggles each surface. The choice is
stored as the hidden set so newly added surfaces appear for everyone, and
the rail and the mod+alt+digit switcher share the same visibility filter, so
badges and shortcuts always agree. Hidden surfaces keep their data and stay
reachable from the command palette.
mod+alt+arrows step through this window's session-open history (or between
neighbouring tabs when session tabs are on), mod+k r renames the current
session inline, and mod+k a toggles permission auto-accept. Pending
permission cards respond to alt+enter / alt+shift+enter / alt+backspace with
the keys printed on the buttons. The commit message box commits on
mod+enter, alt+arrows step the diff review between changed files, and the
command palette gains search-only commands for rare actions so the initial
list stays short.
Bohdan Triapitsyn