* fix: windows shutdown and restart orphaned cleanup
* fix: launch managed OpenCode directly on Windows
Unwrap OpenCode wrappers to launch directly on Windows, improving shutdown reliability and avoid orphans.
* fix: restore desktopNotifyEnabled in health snapshot
---------
Signed-off-by: Dr. Zed <142888684+DocterZed@users.noreply.github.com>
Co-authored-by: Bohdan Triapitsyn <artmore@protonmail.com>
* feat(cli): add --foreground flag for systemd and process manager deployments
Adds --foreground / --no-daemon to `openchamber serve` which runs the
server inline in the CLI process instead of spawning a detached daemon child.
Required for systemd Type=simple (and other process managers) that track the
direct child — the always-daemon behavior introduced in #640 broke this use case.
Also documents OPENCHAMBER_HOST (bind address) in --help, which was
implemented but never exposed to users.
* docs: add systemd service guide for VPN/LAN deployments
Documents how to run OpenCode and OpenChamber as separate systemd
user services for persistent access over Tailscale or LAN, using
the new --foreground flag and OPENCODE_HOST to wire them together.
* fix(cli): address foreground mode parity issues from PR review
- Fix Ctrl+C handling: CLI SIGINT handler now defers to server in
foreground mode; dedicated signal handlers perform graceful shutdown
and clean exit
- Restore lifecycle parity: foreground instances write PID/instance
files so status, stop, and restart can discover them
- Add deterministic --foreground --json output: emits stable startup
JSON with port, pid, url, and foreground flag before blocking
* fix(cli): tighten inline foreground behavior for restart UX and JSON-only output
* fix(cli): pass --host to foreground server, reject --json, add --quiet output
- Pass options.host through to startWebUiServer() in foreground mode so
the bind address is respected (fixes localhost-only regression from #750)
- Reject --foreground --json with a clear usage error; --json is only
supported in background (daemon) mode
- Emit resolved port on stdout in --quiet foreground mode, matching
daemon parity
- Update systemd docs to include --host 0.0.0.0 for LAN/VPN access
now that the default bind is 127.0.0.1
* fix(cli): remove duplicate OPENCHAMBER_HOST entry from help text
* fix(cli): emit restart summary before foreground serve() blocks
restart --json (and --quiet / human) with a foreground instance would
hang forever without output because serve() blocks and the post-loop
summary was unreachable. Emit the final output after stop succeeds
but before the blocking serve call — foreground is always sorted last
so all daemon results are already collected.
* fix(cli): restart stops foreground instances without re-attaching
Foreground instances are managed by a process manager (systemd, Docker,
etc.) that will restart them automatically. The restart command now
just stops the foreground instance, records the result, and exits —
no serve() call, no blocking. This makes restart --json and all
other output modes work correctly for foreground instances.
* feat(server): support configurable hostname for managed OpenCode server spawn
Allow the managed OpenCode server bind hostname to be configured via
OPENCHAMBER_OPENCODE_HOSTNAME environment variable (default: 127.0.0.1).
This enables LAN/Tailscale access without a reverse proxy by setting
the hostname to 0.0.0.0.
Closes#597
* fix: address review feedback — input validation, port probe hostname, security docs
- Add defensive parsing for OPENCHAMBER_OPENCODE_HOSTNAME with trim/empty
check and warning log, matching OPENCODE_HOST validation pattern
- Pass configured hostname to resolveManagedOpenCodePort() so port
availability is probed on the actual bind address, avoiding EADDRINUSE
- Add security note in README docs warning about 0.0.0.0 exposure on
untrusted networks
## Summary
Fixes#736 — OpenChamber listens on `0.0.0.0` (all interfaces) by default, exposing the server to the network without warning. The log output shows `visit: http://127.0.0.1:...` which is misleading.
## Changes
- **Default bind address changed to `127.0.0.1`** — server is only accessible locally unless explicitly configured otherwise
- **New `--host` CLI flag** — `openchamber --host 0.0.0.0 -p 8080` to listen on all interfaces
- **`OPENCHAMBER_HOST` env var** — documented in help text and docker-compose.yml as an alternative to `--host`
- **Docker entrypoint** defaults to `OPENCHAMBER_HOST=0.0.0.0` so container port mapping continues to work
- **Startup logs** show the actual bind address instead of hardcoded `localhost`
### Resolution priority
```
--host flag > OPENCHAMBER_HOST env var > 127.0.0.1 (default)
```
### What doesn't break
- **Desktop app** — already forces `OPENCHAMBER_HOST=127.0.0.1` via Tauri
- **VS Code extension** — doesn't use the web server
- **Docker** — entrypoint sets `OPENCHAMBER_HOST=0.0.0.0`, preserving current behavior
- **Tunnels** — cloudflared connects to `127.0.0.1` origin internally, works regardless of bind address
## Testing
Automated:
- `bun run type-check` / `bun run lint` — pass
Manual (CLI, direct `node` execution):
- Default bind → `127.0.0.1` (verified via `lsof`/netstat)
- `--host 0.0.0.0` → binds all interfaces
- `--host=0.0.0.0` (inline) → works
- `--host` without value → error exit 2
- `OPENCHAMBER_HOST` env var → respected
- `--host` flag overrides env var
- IPv6 `::1` → correct bracketed URL, health check 200
- CLI daemon start/stop → works
- `visit:` URL → correct
- Help text → `--host` in OPTIONS, `OPENCHAMBER_HOST` in ENVIRONMENT
- Browser UI → loads and works
- Tunnel via UI → works
- Desktop app → no regression
Docker (tested on Ubuntu with native Docker):
- SSH key generated successfully
- `OpenChamber server listening on 0.0.0.0:3000`
- Health check 200
- `uid=1000(openchamber)` confirmed
* fix: preserve unsent prompt when adding editor context in VS Code
* fix: append Add to chat selections as markdown blocks with stable spacing
Convert selected assistant content to markdown before appending
Wrap each Add to chat selection in an `md` fenced block
Preserve multiline composer formatting across repeated appends
* fix: normalize persisted Windows paths to prevent identity mismatches
* fix: hide Windows subprocess console popups across server tasks
Hide OpenCode startup and shell command child windows in the web server
Apply windowsHide to cloudflared and skills-catalog git subprocesses
Cover remaining git service exec paths that could surface console windows
* fix: restore chat auto re-pin when reaching bottom
Re-pin now triggers when scrolling back into the bottom zone, not only via the button.
Upward user scroll intent still unpins immediately and is not overridden by re-pin.
Unified bottom/re-pin threshold logic to reduce sensitivity mismatches.
* fix: restore chat scroll release on mobile during streaming
Restores pinned-scroll release on touch scroll up so mobile users can leave auto-follow while streaming.
Improves re-pin behavior near bottom to avoid sticky or inconsistent pin states.
Includes related chat UI and dependency updates in the same change set.
* fix: hide daemon startup probe consoles on Windows
* fix: prevent pinned scroll tug-of-war during streaming
* fix: prefer git.exe to avoid Windows diff popup flashes
* fix: prefer git.exe discovery in Windows git flows
* fix: avoid where probes in Windows git resolution
* fix: avoid update-check subprocess flashes on Windows
* fix: normalize read file path labels
* feat: add OpenChamber defaults and improve theme ports
Add new OpenChamber light and dark themes
Regenerate imported themes with stronger surface mapping
Set OpenChamber themes as the default top options
* fix: stabilize chat pin and unpin behavior during streaming
Restores reliable unpin on upward wheel and touch gestures while auto-follow is active.
Prevents immediate re-pin while the user is actively scrolling upward near the bottom.
Keeps smooth follow-to-bottom behavior while reducing scroll tug-of-war.
* fix: suppress Windows command popups in VSCode runtime processes
Hide spawned git and server process windows in VS Code runtime
Extend hidden-window handling to server port cleanup and reveal commands
Keep behavior unchanged on non-Windows platforms
The CLI tunnel startup generated a bootstrap token but discarded it,
then built a URL with ?token=<uiPassword> which the tunnel auth system
ignores. Remote users always saw 'Tunnel access required' with no way
to authenticate.
Capture the bootstrap token, build the /connect?t=... URL, and pass it
through onTunnelReady so the CLI prints the correct one-time connect
link (and QR code).
* fix: resolve Windows CLI module loading on absolute paths
* fix: improve chat tool rows layout and timestamp readability
* fix: make web update restart more reliable
* fix: make web self-update detect package manager correctly
Node's ESM loader rejects bare Windows paths (e.g. C:\...) passed to
dynamic import(), interpreting the drive letter as a URL protocol.
Convert the package-manager.js path through pathToFileURL() to produce
a valid file:// URL, matching the fix already applied to the server
import on line 628.
* feat(server): add OPENCODE_HOST env var for external OpenCode connections
Allows specifying a full base URL (e.g. https://hostname:4096) for external
OpenCode connections, supporting custom hostnames and HTTPS. When set,
OPENCODE_HOST overrides OPENCODE_PORT. Malformed values are fatal at startup.
* docs: document OPENCODE_HOST env var in README and AGENTS
* Fatal error when OPENCODE_HOST has path, search or hash
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Colin Mollenhour <colin@mollenhour.com>
* fix(server): use external origin when re-probing OpenCode
---------
Signed-off-by: Colin Mollenhour <colin@mollenhour.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* feat: add OpenCode server authentication with auto-generated passwords
* fix(auth): separate user env and managed OpenCode password state
* fix(auth): enforce env precedence and managed password rotation across runtimes
* fix(vscode): rotate managed auth on startup and harden webview proxy
* build: add dev icons and config for Tauri desktop development
* fix(runtime): start managed OpenCode via CLI and expose active API port
* fix(managed-runtime): control OpenCode lifecycle and surface secure diagnostics
* docs: remove VS Code plugin test runbook
* 🐛 Fix UI crash when subagent is active
Remove sessions dependency from hooks to prevent cascading re-renders.
Use getState() instead and switch to getGlobalSessionStatus().
* ✨ Add support for connecting to external OpenCode server
Add OPENCODE_SKIP_START env var to skip starting embedded server.
Use OPENCODE_PORT to connect to existing OpenCode instance.
Update help text to document the new environment variables.
* 📝 Document external OpenCode server support
Add OPENCODE_PORT and OPENCODE_SKIP_START to READMEs.
Update AGENTS.md with external server integration notes.
* ✨ Add URL-based routing for shareable session links
- Add react-router-dom dependency
- Create URL store for bi-directional sync with Zustand
- Add WebRouter/DesktopRouter context for runtime-aware routing
- Add useURLSync hook to sync URL with session/tab state
- Add useNavigation hook with copySessionLink utility
- Add share button in Header for copying session links
- Update App.tsx to use router wrappers
URL structure:
/session/:sessionId?tab={chat|git|diff|terminal|files}&directory=/path
/settings
This enables shareable links and deep-linking to specific sessions.
* Revert "✨ Add URL-based routing for shareable session links"
This reverts commit b53ee304950a789538fa3d4a236d6361e634ea61.
* feat: add Web Push API support and PWA integration
Add web Push API with subscribe/unsubscribe and visibility endpoints
Introduce usePushVisibilityBeacon and useSessionDeepLink hooks
Integrate PWA with service worker, registerSW, and VAPID key persistence
* feat: add heartbeat visibility beacon for web runtime
Add a 10s heartbeat to ping visibility while visible
Subscribe to visibilitychange, focus, blur, pageshow, and pagehide events to report state
Clear heartbeat interval on unmount to avoid leaks
* feat: add QR code and password URL parameter for Cloudflare tunnel
Add --tunnel-qr flag to generate scannable QR code for tunnel URL in terminal.
Add --tunnel-password-url flag to include password as URL parameter for auto-login.
Frontend now automatically detects and submits password token from URL.
* docs: update README with tunnel QR and password URL features
Add dev script for concurrent server, web, and UI watch mode.
* feat(terminal): replace xterm with ghostty-web
Replace xterm.js terminal with ghostty-web implementation
Add terminal serialization support for state restoration
Apply custom patches to ghostty-web for enhancements
* feat(terminal): add bun-pty backend support
Switch terminal to ghostty-web with bun-pty backend for better performance
Auto-detect and prefer Bun runtime when available for terminal sessions
Update terminal viewport write queue handling for improved reliability
* fix(terminal): prevent unnecessary resize events
Only report terminal resize when dimensions actually change
Simplify chunk processing state tracking
Disable terminal transparency for consistent rendering
* feat(terminal): increase scrollback and buffer limits
Increase terminal scrollback buffer from 10k to 50k lines
Increase terminal buffer limit from 256k to 1M bytes
Add rate limiting and improve output handling for terminal streams
* feat(web): add Cloudflare Quick Tunnel support for remote access
Implement --try-cf-tunnel flag that creates a temporary public URL
routing to the locally running server via cloudflared.
Features:
- Auto-detect and spawn cloudflared subprocess
- Extract and display *.trycloudflare.com URL
- Proper cleanup on server shutdown
- Dynamic port handling (tunnel routes to actual listening port)
- Isolated HOME dir to avoid config conflicts
- Installation help and limitations warning
* docs: add Cloudflare tunnel feature to README
- Document --try-cf-tunnel flag in CLI examples
- Add Cloudflare Quick Tunnel to Web/PWA features
* docs: add cloudflared as prerequisite for --try-cf-tunnel
* feat(web): auto-generate password for Cloudflare tunnel
When using --try-cf-tunnel without --ui-password, automatically generate
a secure random password to protect the publicly exposed service.
Features:
- 16-character random password (easy to read, no ambiguous characters)
- Password is displayed after tunnel is established
- Warning to save the password (not shown again)
- Works in both foreground and daemon modes
- Uses same password for subsequent restarts (stored in instance file)
* fix(web): improve Cloudflare tunnel UX and fix spawn ENAMETOOLONG
- Generate and display password before tunnel starts (green colored)
- Display tunnel URL in cyan via onTunnelReady callback
- Fix ENAMETOOLONG by using env:undefined instead of copying process.env
- Pass tryCfTunnel flag from CLI to main function
- Remove duplicate tunnel URL output
- Update warning message to reflect password protection
- Change start script to use CLI wrapper for proper initialization
---------
Co-authored-by: aptdnfapt <197602950+aptdnfapt@users.noreply.github.com>
