* fix(sessions): select the active project using session ownership
Keep a same-project worktree session while its rendered map is stale, but switch to the remembered or fallback session when the current session is known to belong to another project.
Fixes#2317
* test(sessions): pin project-switch ownership recovery in the selection hook
German and Japanese locales (added on main after the original branch point) still interpolated {max}, which would render literally now that the tooltip passes no max param. Also cover the isolated per-worktree dispatch path (>5 models) in the store test.
The per-group cap of 5 models was enforced in three client-side locations with no server-side constraint and no technical justification; the store iterates models in a plain loop and dispatches each run via Promise.allSettled. Remove the cap entirely from MultiRunLauncher, useMultiRunStore, and AgentManagerEmptyState, and drop the {max} ceiling from the launcher info copy across all locales.
Closes#2847
A single fast probe (2.5s per transport) used to be the only chance a
connection got on cold launch and resume, so a just-woken network, a
WireGuard re-handshake, or a relay cold start (TLS + WS + E2EE) regularly
produced false "unreachable" verdicts that kicked the user to the connect
screen. Now:
- cold launch releases the splash on the fast verdict and retries once in
the background with the full connect budget — a reachable instance
reconnects on its own, and a manual connect started meanwhile wins;
- resume retries on a 4s/10s ladder, the last attempt with the full budget,
before tearing the connection down; needs-login still disconnects
immediately on every path;
- full-budget relay probes are capped at the shared 8s connect budget
instead of inheriting the 15s relay session default, so a genuinely dead
server does not pin the retry for 15 extra seconds.
Probe steps, budgets, and retry decisions all land in the connection log.
Connection lifecycle events (probes, transport failures, resume decisions)
are mirrored into an in-memory trail that resets on every launch. A long
press on the connect-screen logo or the instances list opens a panel that
renders the trail with one-tap copy, so release builds can report the exact
probe sequence without a tethered debugger. Details reuse the already-masked
log payloads — no tokens or secrets are captured.
A request body stream that yields no chunks still declares hasBody in
the request head; send one empty HttpBody frame so the host can tell an
intentionally empty body apart from body frames lost in transit.
Settle the buffered-body wait when the delivery deadline fires so the
stream's buffered chunks are freed immediately, and make the deadline
injectable for tests. Covers the stalled-mid-body path with a test.
When the relay drops mid-request, the prompt_async body frames can be
lost. The tunnel host forwarded the request to loopback as an
empty/truncated chunked body, which the server rejects with a bare 400
(empty response body) — the mobile app's 'Failed to send message (400)'.
Host now buffers request bodies (<512KB) and forwards the complete body
only once StreamEnd arrives; larger bodies still stream live. A new
hasBody flag on the request head lets the host detect a body that
delivered zero frames and abort it as an ambiguous transport failure
(which the client already retries) instead of forwarding an empty body.
A 15s body-delivery deadline converts stalled tunnels into clean aborts.
The netstat-based parser matched the literal English "LISTENING"
state string, which is translated on non-English Windows (e.g.
"ABHÖREN", "ÉCOUTE", "ESCUTANDO"). On those systems the regex matched
zero lines, so killProcessOnPort silently did nothing -- fail-open,
not a regression, but ineffective for the exact users the fix targets.
Replace it with `Get-NetTCPConnection -State Listen -LocalPort <port>`,
which reads the same underlying WinNT API netstat's display layer
translates, so it's unaffected by OS display language. Verified
against a real listening port on this machine (matched the actual
owning PID).
Also fixed a stale duplicate of the "killProcessOnPort is a no-op on
Windows" comment left behind in server/index.js.
killProcessOnPort() was a no-op on win32 (POSIX-only, via lsof/kill),
so a restart could leave the old OpenCode process holding the port
while a new instance spawned on a different one. That's a plausible
contributor to a chronic pattern seen in production logs: repeated
"OpenCode process exited, restarting" cycles and hundreds of
ECONNRESET/proxy errors over multiple days on Windows.
Give killProcessOnPort a real Windows branch: parse `netstat -ano`
for PIDs listening on the target port, filter out our own pid, and
force-kill each via `taskkill /PID <pid> /F` (no /T -- we don't own
that process, so only the listener itself is killed, not any
children it may have).
waitForPortRelease()'s existing soft-fail-and-warn behavior is left
untouched -- it's a deliberate safety net for any platform where the
port doesn't free up in time, not just Windows, and the restart
already rebinds event-stream readers to the actual resulting port via
onOpenCodeRestarted.
Creating a device key while the UI is open through a public https domain
(reverse proxy) dropped that domain from the QR payload whenever the
dialog passed a preferred LAN URL, leaving only the local IP and relay
as transports. Carry the non-loopback request origin as an additional
direct candidate (priority 20, between LAN and relay) so paired devices
can keep using the same domain on any network.
OpenCode Go now reads quota usage with a bearer API key from OpenCode auth.json
Removes the old workspace ID and browser cookie credential flow
Deletes legacy OpenCode Go credential files during upgrade
Adds a dedicated skill for drafting user-facing unreleased changelog entries.
Covers both the main app changelog and the VS Code extension changelog.
Updates agent guidance to route changelog work to the new skill.
* feat(desktop): upgrade Electron to 43.3 for Linux frameless rounded corners
- electron ^41.2.1 -> ^43.3.0 (electron/electron#51459/#52111: rounded
corners for frameless windows on Linux, default-on; disable via
roundedCorners: false)
- @electron/rebuild ^3.7.0 -> ^4.2.0 to build native modules against
the new Electron ABI
- pin node-abi to 4.33.0 via root overrides so @electron/rebuild (and
electron-builder's internal rebuild) can resolve Electron 43's ABI
- README: Electron 43 ships its own fixed extractor (extract-zip 2.0.1
Node-24 unpack bug no longer applies; ensure-electron remains a
safety net for interrupted/wrong-arch installs)
* chore: re-trigger pr-review after adding visual evidence
* fix(desktop): scope node-abi to Electron rebuild tooling
* chore: re-trigger pr-review after dependency fix
* chore: re-trigger pr-review with drag evidence
* chore: retry pr-review after evidence confirmation
Keeps the work status panel aligned to the draft's target directory
Resolves project labels for sibling worktrees using shared session-directory logic
Adds coverage for resolving a worktree back to its registered project
Use content fingerprints instead of full source as cache keys, record
entry sizes once (no TextEncoder/JSON.stringify on get/evict), and
highlight multiple markdown fences concurrently.
Co-authored-by: Serhii Dziupin <makeittech@users.noreply.github.com>
* fix(ui): mount only the active session chat iframe
* repro(ui): mount-all-persisted session-chat iframes (#2815)
Adds a regression-style reproduction for issue #2815: ContextPanel
renders one full-application iframe for every chat tab (inactive tabs
are only hidden via the Tailwind 'hidden' class, never unmounted), so a
reload restores all persisted session-chat tabs from the ui-store and
mounts N embedded OpenChamber apps in one browser tab.
The test reads the real ContextPanel.tsx render block, drives the real
useUIStore with the issue's persisted scenario (11 tabs, 8 read-only
session-chat tabs), and models the render block with the real
buildEmbeddedSessionChatURL helper, showing 8 live src iframes (7
hidden but loaded).
* test(ui): adapt issue 2815 reproduction for active chat
* fix(ui): unmount session chat when panel closes
---------
Co-authored-by: ChangeHow <23733347+ChangeHow@users.noreply.github.com>
The /init command was only offered in the autocomplete when the current session had no messages yet, and it was filtered out entirely once any message existed. Since the underlying session.command endpoint works in any session, keep /init available whenever a session exists so AGENTS.md setup stays reachable mid-conversation.
* fix: keep work-status panel reachable when all sections are hidden
When every section was unchecked in the Panel Sections dialog, the panel
went transparent and inert, making the settings gear icon unreachable.
The only recovery was knowing to toggle the panel off and on from the
header, which still rendered the same empty/inert state.
Changes:
- Panel stays interactive (not inert) when visible, even with zero
rendered sections. This matches how other panels in the app use inert
only for visually-collapsed (width/height = 0) states.
- Empty state shows 'No sections selected' with a link to reopen the
sections dialog, matching the centered text-muted-foreground pattern
used by the file tree, review panel, and home page empty states.
- Sections dialog gains a 'Show all' link (visible whenever any section
is hidden) and a warning when all sections are unchecked, matching the
keybinds settings 'Reset to defaults' pattern.
- Added i18n keys to all 10 locale files (English fallback).
Fixes#2804
* Round 1: fix interactive guard for fresh-mount; translate i18n keys
Address openchamber-bot review findings:
1. (blocker) Replace English fallback strings in all 10 non-English
locale files with real translations per locale-ui-patterns guidance.
2. (non-blocker) Restore the renderedSections > 0 guard for the
transient no-data-on-mount state so the panel doesn't flash a bare
bordered card. The interactive condition is now:
visible && (renderedSections > 0 || allSectionsHidden)
Empty-state rendering is gated on allSectionsHidden alone (not
renderedSections === 0) so it works correctly on fresh mount when
all sections were already hidden in persisted settings.
Validation:
tsc --noEmit: 0 errors
bun test work-status: 34 pass, 0 fail
* Round 2: use .every() guard, dedup chooseLabel key, add tests
1. Replace >= length check with areAllWorkStatusSectionsHidden() helper
that uses .every() — stale section ids left in persisted settings
from a future removal can no longer inflate the count.
2. Remove duplicate chooseLabel i18n key from all 11 locales — the
empty-state link now reuses the existing sections.open key.
3. Add 6 focused tests for areAllWorkStatusSectionsHidden covering
empty, null/undefined, partial, full, stale-id, and stale+full.
Validation:
tsc --noEmit: 0 errors
bun test work-status: 40 pass (6 new), 0 fail
MCP authorization was broken in several stacked ways. The browser return
leg landed on the SPA behind the auth gate, so the system browser saw a
login page instead of finishing; the pending-context store silently
saved nothing because its route had no JSON body parser; and the
callback-URL config write started deferring behind Apply & Restart, so
authorization ran against a runtime without the URL and dead-ended on
OpenCode's loopback listener.
The return leg is now completed entirely server-side by an
unauthenticated GET /mcp/oauth/callback that only forwards a code whose
state matches a parked context. Desktop with the local server and VS
Code switch to OpenCode's native flow over its fixed loopback port —
no config writes or restarts at all, with a one-time cleanup of the
previously written callback URL — and its completion signal drives the
page instead of blind status polling. Remote, hosted-web, and mobile
keep the server-callback flow, applying a queued callback-URL write
immediately since authorization cannot wait for a manual restart.
Also: a server queued behind Apply & Restart now shows an Awaiting
restart badge and explanation instead of connect/reauthorize buttons
that can only fail, and Reauthorize is offered only while the server is
actually connected.
Dialogs and settings window now use the standard background color
Removed dialog from the glass utility styles
Preserves existing glass effects for other surfaces
Relay demand now counts the authoritative transport signal: a request
arriving through the tunnel permanently marks the client usesRelay, and
hasActiveRelayClients also accepts lastTransport === 'relay'. Store read
failures no longer masquerade as no demand, so reconcile can't persist
enabled=false and sever paired devices on a transient error.
Drops the macOS vibrancy toggle, IPC, and related settings copy
Updates dialogs, popovers, tooltips, and dropdowns to use shared glass styles
Adds sticky header fade behavior to model picker and sidebar lists
`getWorktrees` logs a warn-level line every time the managed OpenCode
process or any other caller passes a directory that is not inside a
git repository. The OpenChamber desktop main.log fills with hundreds
of these "Failed to list worktrees, returning empty list: fatal: not
a git repository ..." entries over a normal session.
The empty-list fallback is already correct (worktrees are an optional
feature), but the warning is noise that hides real git failures. Use
the existing `isNotGitRepositoryError` helper to suppress the warn
specifically for the "not a git repository" case and keep the
warning for genuine failures (lock contention, permission errors,
corrupt repos, etc.).
ChangeHow