* fix(sessions): keep a shared chat directory until its last session is deleted
Deleting a root chat session removed its managed scratch directory even
when forks, side threads, or subagents still lived in it; OpenCode then
failed every prompt in those sessions with FileSystem.realPath NotFound.
The directory is now removed only once no other known session resolves
to it. The deleted subtree does not count, because the server cascade-
deletes it, and an unloaded global cache keeps the directory instead of
guessing.
Closes#3312.
* fix(sessions): relocate a session whose worktree directory disappeared
A worktree removed outside OpenChamber, by the agent or by hand, left its
sessions pointed at a path that no longer exists: every terminal create
and restart failed with "Invalid working directory" and the tab stayed
stuck, while Git, Files, and prompts kept targeting the dead path.
The terminal server now names that one rejection (TERMINAL_CWD_MISSING)
instead of substituting a directory of its own. The shared UI reuses the
archived-restore fallback for live sessions: a server-confirmed missing
directory moves the session and its stranded subtree to the project's
primary directory through the control-plane move, clears the worktree
hint, re-selects the session, and tells the user where it went. It runs
from a terminal failure and on activation of any session whose directory
is neither a project root nor a managed chat directory; available,
unknown, and failed probes leave everything untouched.
Closes#3338.
* fix(scripts): make oc-dev load again after the changelog cleanup
The changelog cleanup referenced fs.existsSync in a module that imports
existsSync by name and never binds fs, so every oc-dev invocation failed
with "fs is not defined" before reaching its action.
* fix(sessions): probe directory availability on disk, not through OpenCode path resolution
OpenCode's /path never checks that a directory exists: it echoes the
requested path and resolves its project through Git discovery that
swallows errors, so a deleted worktree came back as a valid location and
every missing-directory fallback (draft recovery, archived restore,
session relocation) stayed inert on a real server. The probe now asks
OpenChamber's own /api/fs/list, which stats the path and reports
not-found and not-directory explicitly; anything else stays unknown.
* fix(sidebar): keep a worktree whose directory is gone visible as missing
git keeps a worktree registered after its directory is deleted outside
git and marks it prunable; the list parser ignored that line, so a
deleted worktree looked alive, and nothing in the app asked for a new
listing anyway. The server now reports prunable, the UI keeps such a
worktree in the topology with worktreeStatus missing and a warning icon
on its sidebar group, and relocating a session out of a confirmed-
missing directory raises an in-app topology signal the sidebar
rediscovers on. Dropping the worktree instead would hide every session
that lived there, and a hidden session can never be opened or relocated.
No idle polling is added.
* fix(sessions): never relocate a session to the filesystem root
OpenCode files a directory outside any Git repository under its global
project, whose worktree is the filesystem root. A managed chat whose
directory vanished would otherwise be moved to /. The relocation now
refuses a root destination, and the activation probe recognizes chat
directories through the home-based check as well, so it does not depend
on the chats root having been resolved yet.
* test(sessions): mirror the relocation action in the issue-2039 session-actions mock
session-ui-store now imports relocateSessionFromMissingDirectory, and the
mocked module in this test listed every other action but not that one, so
the file failed on import.
* fix(docker): apply patch-package in the builder stage
The deps stage installs with --ignore-scripts, so the root postinstall never
runs and patches/ghostty-web+0.4.0.patch is never applied. The web bundle in
the Docker image therefore shipped an unpatched ghostty-web renderer.
Run patch-package explicitly in the builder stage, after the full source copy,
before building the web assets.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(docker): set a UTF-8 locale in the runtime image
The oven/bun base image ships with the POSIX locale, so bash readline in the
built-in terminal treated each byte of a multibyte character separately and
garbled the echo of pasted Unicode input.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
The send write was fixed, but the message that send echoes back arrives with
model metadata and no effort, and its model matches the one the send just
saved. That is exactly when `shouldPreserveManualModelOverride` declines to
protect the selection, so the history branch ran with no variant and recorded
"no choice" over the user's explicit `Default`. Picking Default, sending, then
switching agent and back still put the settings default in the picker.
A message carrying no effort is not evidence that the session has none. The
history branch now keeps whatever the session already recorded when the message
carries no variant, and a concrete historical effort still replaces it.
The behavior test ran the real guard through a mock that returned a fixed
answer, so the failing branch had no coverage. It now calls the real function
unless a test opts out, and the new case fails without this change.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EZuVVgziiLjD81W5vaxdH2
A send carries no effort both when nothing was chosen and when the user picked
"Default", so `sendMessage` could not tell the two apart and recorded the raw
value, which clears the entry. Picking "Default", sending, then switching agent
and back put the settings default back in the picker — the shape of the bug
this branch set out to fix.
`materializeOpenDraftSession` already read the live selection to keep that
distinction on the draft path. Both paths now share `resolveVariantToRecord`,
which prefers `currentVariantSelection.override` while the live selection still
describes the agent and model being sent to, and falls back to the sent value
when it does not.
Three tests go through the real `sendMessage`; two of them fail without this
change. The existing ones seeded the record directly, which is why the send
path was never covered.
Also documents the `oc.chatInput.lastDraftTarget` record in the owning sync
documentation: its three `target` values, what a pre-`target` record and a
removed project fall back to, and why a chat scratch directory is not a project
target.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EZuVVgziiLjD81W5vaxdH2
Nothing covered ModelControls, which is where the effort restore decides
between "the user chose Default" and "nothing was found". Three cases: a
concrete effort in the session history is restored, history without an effort
records no choice, and a preserved manual override keeps a recorded Default.
The middle one fails on the previous commit's parent — it recorded `null` and
then `undefined` for the same restore.
Also drops the `fetchAll` binding GitView stopped using when the post-bootstrap
refresh moved to a forced `fetchStatus`; it was failing `bun run lint:ui`.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EZuVVgziiLjD81W5vaxdH2
`commitVariantSelectionForModel` turned every `undefined` into an explicit
`Default` (`null`), but it serves two kinds of caller. The picker means "the
user chose Default"; the history and manual-override restores mean "nothing
was found". Restoring a session therefore recorded a choice nobody made, and
`resolveModelVariantSelection` collapsed that `null` back to `undefined`, so
the next restore recorded it again. Because an explicit `Default` outranks the
agent and settings defaults by design, the session latched onto `Default` and
the concrete effort its own history carried could not come back.
Move the decision to the callers: the four picker paths pass `variant ?? null`,
the restore paths pass their result through, and the resolver returns the
selection store's three states instead of two. The follow-up write in the
history restore goes with it — the apply above it already recorded the same
agent and model, and a second write could only disagree.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EZuVVgziiLjD81W5vaxdH2
Removing a worktree archived its sessions one SDK call at a time and
then re-rendered the whole sidebar once per streamed session.updated
echo. On a worktree with 121 sessions that meant 14.8s of main-thread
work, 121 requests, and 328 localStorage writes.
- Add POST /api/openchamber/sessions/archive: validates a batch (max
500 ids, per-request archivedAt), archives sequentially, and reports
partial failures instead of dropping the batch. VS Code serves no
such route and answers 501; the shared UI then falls back to the
per-session path.
- Plan batches from the sessions this client actually holds, live
directory stores first, so worktree-only sessions still batch.
- Claim (id, archivedAt) pairs before the request and consume the
matching session.updated echoes, so the server's own confirmations
no longer fan out into 121 store publications. Runtime-scoped, TTL
30s, released on response or fallback; non-matching updates pass.
- Make the managed-chats persistence a real trailing debounce instead
of a 50ms throttle, so a burst of publications coalesces into one
localStorage write.
Benchmark (121 sessions, production build, real Chrome): 14785ms ->
~1030ms, long tasks 100 -> 1, global store publications 236 -> 1,
persistence writes 328 -> 3.
Refresh hints fired while setup commands run can cache a mid-creation
dirty snapshot; lifting the gate the moment bootstrap settles flashed
that stale snapshot until the forced fetch resolved. The gate now stays
down until the post-bootstrap status fetch completes.
Message metadata records the effective effort, inherited defaults
included. The history-restore effect re-applied it as an explicit
override and re-pinned it per session one render after every send, so
the picker still jumped from Default to the settings default despite the
send-time fix. Only an effort deviating from what the model would
inherit is restored as a choice; the preserve-manual-override branch
follows the same rule.
'New session in the current directory' callers (shortcut, menu, composer)
forward the current session's directory even when that session is a
chat. Its managed scratch directory names no project, but it counted as
an explicit project target, so a plus pressed inside a chat session
opened a project draft. Chat scratch overrides now resolve to a chat
draft.
A freshly created worktree transiently looks dirty until its setup
commands and initial git reset finish. The work status panel showed
those files as changes on the branch and the draft's worktree dropdown
flashed its dirty warning, and both then froze on that state because
nothing refetched after bootstrap. Make the bootstrap state (the
existing authority on unfinished creation) subscribable, suppress the
dirty probe and the changed-files row while it is pending, and force one
status fetch when it settles so the lifted gate shows the reset tree.
Sending recorded the effective variant - inherited settings/agent
defaults included - as the session's explicit per-session choice, so the
picker jumped from Default to the inherited effort right after the send
and the session stopped following later default changes. Record only an
explicit picker override when the send reflects the live selection;
sends carrying a captured configuration for another session keep their
captured variant.
The reset-on-open effect also depended on generateUniqueSlug, which is
derived from the available-worktree list, so a worktree appearing or
disappearing while the dialog was open wiped the form (branch name,
linked issue). Initialize once per open via a ref guard, pinned by a
behavior test. Also tightens CreateWorktreeArgs/GitHub selection typing
in place of type assertions.
The explicit-Default behavior from 77d756aeb (Default = send no effort)
was based on a misdiagnosis: the tester did not know a default effort was
configured in settings, so the settings default applying under Default is
the intended behavior, not a bug. Restores the pre-fix effort resolution,
tests, and documentation.
* refactor(worktrees): fetch source once during creation
* fix(worktrees): remove worktrees in background
* fix(worktrees): show background removal progress
* fix(worktrees): name the worktree in removal toasts
* feat(ui): block branch switches on dirty trees
* feat(ui): show unpushed commits in git branch selector
* feat(ui): show recent branches in git selector
* fix(ui): persist recent branch status
* feat(ui): add mobile branch picker
* fix(ui): guard mobile branch checkout
* fix(i18n): restore Turkish git empty state labels
* feat(ui): flag dirty draft directories on the branch selector
Replaces the draft dirty-directory banner with an indicator on the branch
selector: a warning icon plus a hover tooltip that opens by itself for five
seconds when the dirty state first appears, then stays hover-only. The copy
states the situation and the options (commit or worktree) without prescribing
either.
* feat(ui): optional push in the dirty branch switch dialog
Commit-and-switch gains an opt-in "Push after commit" checkbox. When the
push fails the commit stands but the switch is cancelled with an explicit
toast, so the user is never moved off a branch without knowing its push did
not happen. Without the checkbox the toast states the commit is local only.
* fix(i18n): align dirty-directory copy across locales
* fix(a11y): name the unpushed-commit badge in the branch picker
The badge showed a bare arrow and number with no accessible name or tooltip.
Both the desktop recents list and the mobile picker now carry a localized
"N commits not pushed" title and aria-label.
* fix(mobile): push before switching dirty branches
Honor the dirty-switch dialog's push option on the mobile Changes surface.
A failed push leaves the new commit on its source branch, refreshes state, and
cancels checkout. Mobile branch selection now also shows the existing dirty
switch notice.
* fix(sidebar): search the managed chats along with project sessions
The sidebar builds search data per group, and every group renders
`filteredNodes ?? []` while a query is active. Only project groups were ever
given that data, so the managed chats — which render outside any project
section — collapsed to an empty list as soon as anything was typed, however
well a title matched. The header count ignored them for the same reason.
Pass the chats group to the sections hook as a standalone group so it takes
the same search pass and joins the match count. Building it before the hook
runs keeps search-data ownership in one place instead of registering entries
from the rendering component.
No CHANGELOG entry: it is left out deliberately to keep this branch free of
conflicts with other open PRs, and is to be written at release time.
fixes#3200
* fix(sidebar): report the real search match count to the header
The header rendered whatever `SessionSidebar` passed it, and that was a
literal `0` — so "0 matches" was shown no matter how many sessions matched.
The count exists: the sections hook already computes it, but only the session
list can see it, and the header renders above the list.
Report it upwards from the list instead of recomputing it in the header, so
the number and the visible rows cannot disagree, and reset it to 0 when the
list unmounts.
fixes#3200
* fix(sidebar): keep chat-only search results on screen
The chats render inside the scroller's top content, and the branch that
handles "no project section matched" replaced the whole list with the empty
state. A query matching only a chat therefore showed "No matching sessions"
while the header — now reporting the real count — said one match, and the
chat itself stayed hidden. That is the exact reproduction in the issue; the
earlier manual check missed it because the query used also matched a project
session.
Tell the scroller when its top content holds results, and keep it on screen
in that branch. The decision moves to `sessionProjectRender` next to the
other render-selection helpers, where it can be tested without mounting the
Vite-only component graph.
fixes#3200
CodeMirror collapses a CRLF pair into one line break, so the document is
shorter than the string it was given. The composer derived the caret from
the JS string length, which put it past the end of the document and made
dispatch throw `RangeError: Selection points outside of document`.
Because the exception fires before the transaction applies, the document
never updates, the un-normalized text stays in React state, and the draft
persists as-is: every later visit to the session restores it and crashes
again, with no way out from the UI.
Derive the caret from the change set instead, in the controlled writeback
and in the imperative insert/replace handles.
fixes#3013
# Conflicts:
# CHANGELOG.md
# packages/vscode/CHANGELOG.md
Since opencode 1.18.x, `POST /global/upgrade` requires a `target` semver in
the body. OpenChamber sent an empty object, so every "Update OpenCode" click
came back 400. The rejection arrives as `{name, data:{message}}`, which has
no `error` field, so the user was left with the bare status text: "Bad
Request".
Resolve the target from the latest release — the same lookup the upgrade
prompt already uses to decide there is anything to offer — and fail with an
explicit code when it cannot be resolved, rather than sending a body opencode
is guaranteed to reject. Read the upstream rejection message so a refused
upgrade explains itself.
The VS Code extension carries its own copy of this flow and had the same two
defects; both are fixed there.
fixes#3121
"Restart to Update" answered the renderer with null before the install was
attempted, so a rejected install only reached main.log and the button looked
dead. The apply-update path now keeps the IPC call open until the app quits or
autoUpdater reports the failure, rolls the quit/install flags back when the app
stays up, and the update dialog shows the real reason with a translated hint for
a rejected code signature.
Also settle the download promise on downloadUpdate() itself: an already cached
payload emits no 'update-downloaded', which left that promise pending with its
listeners attached on every retry.
* perf: optimize session loading and startup
* fix(chat): stabilize history prepend virtualization
* perf: unblock first session open from startup network contention
Opening the first session after app start waited seconds for its message
fetch. Three independent contributors, each measured via CDP network
capture and Chromium net-log against the packaged desktop app:
- The active-session watchdog fired an uncapped per-directory status poll
and child-session discovery burst at startup, and other subsystems
(git checks, global session pages, command/skill discovery) fanned out
alongside it, saturating the browser's ~6 HTTP/1.1 sockets per origin.
Add a shared background-network gate (concurrency 3) and route the
watchdog, poll-shaped git reads (also priority: low), global session
pages, command/skill loads, and the background update check through it.
- The packaged renderer is cross-origin to the loopback backend, so every
API call needs a CORS preflight; a few slow OpenCode-proxied requests
held the whole pool while preflights and interactive traffic queued
behind them. Lift Chromium's per-host connection cap for loopback via
ignore-connections-limit in the Electron shell.
- OpenCode initializes each directory lazily on its first request, so the
first click paid that cost interactively. Warm the last-used directory
and the three most recently opened projects right after OpenCode
readiness, sequentially and best-effort, overlapping UI startup.
Validation: new background-network tests, lifecycle warmup test, focused
store/sync tests, UI type-check and lint, dead-code report, node --check
plus electron type-check/lint, and CDP first-open measurements on the
packaged app (message fetch socket queue 5.4s -> 0.03s).
* fix(ui): keep interactive git reads out of background queue
---------
Co-authored-by: Bohdan Triapitsyn <artmore@protonmail.com>
Reworks how devices connect to an OpenChamber server, end to end.
Pairing v2:
- One-time pairing links/QR codes (openchamber://connect?v=2) carrying a set of transport candidates (LAN/tunnel/relay) and a single-use secret redeemed server-side; no tokens embedded in links
- Add-a-device dialog written for first-time users: intent-based transport choice (Anywhere / Home network only / This computer only) with plain-language descriptions, transparent fallback checkboxes, server-authoritative LAN detection, high-res QR dialog
- Private relay folded into pairing as a transport candidate with a demand-driven lifecycle (enables when a relay device is paired, disables when none remain)
Multi-transport devices:
- A saved device holds all its transports and one token; mobile re-probes on connect, resume, and network change and hot-switches LAN<->relay seamlessly (no re-pairing, no remount, session preserved)
- Desktop can import relay pairing links, switch to relay hosts through the E2EE tunnel, and restore a relay default host after relaunch
Device management:
- Device list (web + desktop) shows live per-device connectivity with the active transport (Connected - Local network / Relay) and platform badges (iOS/Android/macOS/Windows/Linux)
- One physical device = one record: stable per-install dedupe keys across pairing and password re-login; typed pairing label names the device, paired devices name the connection by the issuing server hostname
- Trusted desktop-local client manages all devices (list, revoke, clear revoked); relay host reaps dead client sockets after 3 missed keepalives
Android:
- LAN transport unblocked (cleartext + mixed content, mirroring iOS ATS exceptions); resume re-probe retries through network flux and silently auto-reconnects from a disconnected state
## Summary
Fixes#736 — OpenChamber listens on `0.0.0.0` (all interfaces) by default, exposing the server to the network without warning. The log output shows `visit: http://127.0.0.1:...` which is misleading.
## Changes
- **Default bind address changed to `127.0.0.1`** — server is only accessible locally unless explicitly configured otherwise
- **New `--host` CLI flag** — `openchamber --host 0.0.0.0 -p 8080` to listen on all interfaces
- **`OPENCHAMBER_HOST` env var** — documented in help text and docker-compose.yml as an alternative to `--host`
- **Docker entrypoint** defaults to `OPENCHAMBER_HOST=0.0.0.0` so container port mapping continues to work
- **Startup logs** show the actual bind address instead of hardcoded `localhost`
### Resolution priority
```
--host flag > OPENCHAMBER_HOST env var > 127.0.0.1 (default)
```
### What doesn't break
- **Desktop app** — already forces `OPENCHAMBER_HOST=127.0.0.1` via Tauri
- **VS Code extension** — doesn't use the web server
- **Docker** — entrypoint sets `OPENCHAMBER_HOST=0.0.0.0`, preserving current behavior
- **Tunnels** — cloudflared connects to `127.0.0.1` origin internally, works regardless of bind address
## Testing
Automated:
- `bun run type-check` / `bun run lint` — pass
Manual (CLI, direct `node` execution):
- Default bind → `127.0.0.1` (verified via `lsof`/netstat)
- `--host 0.0.0.0` → binds all interfaces
- `--host=0.0.0.0` (inline) → works
- `--host` without value → error exit 2
- `OPENCHAMBER_HOST` env var → respected
- `--host` flag overrides env var
- IPv6 `::1` → correct bracketed URL, health check 200
- CLI daemon start/stop → works
- `visit:` URL → correct
- Help text → `--host` in OPTIONS, `OPENCHAMBER_HOST` in ENVIRONMENT
- Browser UI → loads and works
- Tunnel via UI → works
- Desktop app → no regression
Docker (tested on Ubuntu with native Docker):
- SSH key generated successfully
- `OpenChamber server listening on 0.0.0.0:3000`
- Health check 200
- `uid=1000(openchamber)` confirmed
* feat(git): show current branch boundary in commit history
* style(git): round commit cards around branch divider
* style(git): refine branch divider visual boundary
* docs: clarify named and quick Cloudflare tunnel usage
* feat: make chat file paths openable from rendered responses
* perf: speed up chat file-path links and open behavior
* fix: open chat file references at mentioned lines
* fix: prevent context panel flicker on blocked file opens
Prevent a feedback loop between remote selection and refresh effects in PullRequestSection. This keeps refresh callback dependencies stable and avoids repeated state updates that triggered maximum update depth errors in desktop Git PR view.
* feat: open focused file in selected desktop app
* fix: make file tree indicators match active open tabs
* fix: limit preview functionality to markdown files only
* feat: add Open In action to file editor toolbar. add antigravity to openin app list
* feat: add Cloudflare Tunnel settings for desktop app
Add a 'Remote Tunnel' section in Settings (desktop-only) that lets users
start/stop a Cloudflare quick tunnel on demand, with auto-generated
password protection and a QR code for easy mobile access.
- Server: 4 new API endpoints (check/status/start/stop) reusing the
existing cloudflare-tunnel module
- UI: TunnelSettings component with full state machine
(checking → idle/not-available → starting → active → stopping)
- QR code rendered via the qrcode package for in-app display
- Hidden from VS Code extension (desktop/web only)
* fix: use ?token= instead of ?p= in tunnel password URLs
REST API endpoints were building passwordUrl with ?p=<token> but
SessionAuthGate reads the ?token= query param, causing QR code
auto-login to fail — the password was never extracted from the URL.
Standardize all three tunnel URL construction sites to use ?token=
so scanning the QR code correctly pre-fills and submits the password.
* feat: secure remote tunnel access with one-time connect links
* feat: redesign remote tunnel settings and access flow
* fix: cleaned up unused desktop close code path
* feat: overhaul named tunnel setup and persistence flow
* chore: align codemirror language dependency resolution
---------
Co-authored-by: Brian-Hwang <brian.hwang@cornelisnetworks.com>
Route /api/fs/read and /api/fs/raw through the extension bridge with workspace-boundary enforcement and canonical path checks, so VS Code parity matches hardened web endpoint behavior.
Treat selecting Default as an explicit variant clear across send-time persistence, stream metadata sync, and historical session analysis so stale non-default variants are not reapplied.
* feat(chat): add mermaid preview popups and fullscreen diagram viewer
Enable opening Mermaid diagrams from markdown and file attachments with a dedicated fullscreen dialog, while tightening preview loading behavior and sizing for more reliable interaction.
* refactor(chat): extract shared preview overlay hooks
Centralize fullscreen preview transition and viewport lifecycle logic so image and Mermaid dialogs stay behaviorally aligned while reducing maintenance overhead.
* fix(security): enforce workspace boundaries for fs read endpoints
Validate /api/fs/read and /api/fs/raw paths against active workspace roots and canonical realpaths to block traversal and symlink escapes before serving file contents.
* fix(chat): remove dead Mermaid copy component
Drop an unused merge-leftover component in MarkdownRenderer to keep lint clean without changing Mermaid preview behavior.
Remove the 'OpenChamber for Actions' feature that ran OpenChamber on
GitHub runners via Cloudflare/Ngrok tunnels. This was a separate
deployment target with its own lifecycle scripts and documentation
that added maintenance overhead without benefiting local usage.
Deleted:
- .github/workflows/opencode.yml (Actions workflow)
- scripts/monitor.sh (service self-heal loop)
- scripts/persistence-save.sh (artifact encryption/upload)
- scripts/persistence-restore.sh (artifact decrypt/restore)
- scripts/opencode-config.sh (Actions config bootstrap)
- docs/OPENCHAMBER_FOR_ACTIONS.md (user guide)
Updated:
- README.md: removed 'GitHub Actions (Cloud Usage)' section
Local Cloudflare Quick Tunnel support (--try-cf-tunnel) is unaffected.
* feat: add OpenCode server authentication with auto-generated passwords
* fix(auth): separate user env and managed OpenCode password state
* fix(auth): enforce env precedence and managed password rotation across runtimes
* fix(vscode): rotate managed auth on startup and harden webview proxy
* build: add dev icons and config for Tauri desktop development
* fix(runtime): start managed OpenCode via CLI and expose active API port
* fix(managed-runtime): control OpenCode lifecycle and surface secure diagnostics
* docs: remove VS Code plugin test runbook
Save and restore main-window bounds/state in desktop settings so reopen behavior is consistent, while keeping new windows on defaults. Add debounce, off-screen fallback, and minimum-size guards to prevent unusable or stale geometry restores.
* feat: add worktree validation and deleteLocalBranch option
Add API to validate and create worktrees with new payload types
Allow deleting local branches when removing worktrees via UI and API
Introduce OpenCode style random names for worktrees when not provided
* feat: enable SSH/HTTPS transport detection for PR picker
Load remotes for the current project directory to inform PR picker options.
Determine preferred push transport from remotes and apply it.
Expose sshUrl in API for frontend to build SSH clone URLs
* feat: extend head repo with sshUrl and improve push error messages
Add sshUrl field to head repo mapping
Enhance push failure handling to display stderr or stdout details
Return push details on success
* fix: worktree path
* feat: worktree set upstream on creation
Enable pushing to upstream by default when no remote is specified
Remove per-remote dropdown for push actions and auto-use first/upstream remote
Update server and VSCode git services to support push without explicit remote and set upstream
* fix: worktree-name sanitization
* feat: rename worktree path field and branch prefix
* feat(worktrees): add git.worktree facade, validation endpoint, upstream/remote-aware creation, and non-blocking setup execution
* refactor(git): use git.worktree namespace in branch picker
* feat(worktrees): sync OpenCode sandbox metadata on create/remove
* fix(worktrees): accept new path key in workspace guard and validate remote startRef
* chore(docs): remove temporary worktree testing plan
* feat: add git worktree management API (list/create/delete/validate) for vscode
* feat: wire root tracking remote and defaults for new worktrees
Add resolveRootTrackingRemote to detect upstream remote for root branch
Apply upstream defaults when creating new worktrees to auto-set upstream
Replace validation and creation flow to use new worktreeCreate APIs
* feat(worktrees): enable root tracking remote handling
* feat(macos): add New Window menu item
Add a New Window option to the macOS menu bar
Trigger opening a separate window when the New Window action is selected
* feat: enable multiple desktop windows and new window shortcut
Enable multiple desktop windows by extending manifest to main-*
Expose desktop_new_window to create additional windows from UI
Show New Window shortcut in Help dialog (Desktop only) with Shift + Alt + <mod> + N
* feat(desktop): enable opening host URL in new window from host switcher
Add a new action to launch a URL in a separate window from the host switcher
Wire the UI to open the selected host in a new window using a dedicated control
Expose a cross-platform API to create a new window pointing at a URL
* fix(desktop): validate URL scheme before opening new window
* fix(desktop): skip unreachable hosts when opening new windows
- Use git reset --hard HEAD by default when startPoint is not provided or is HEAD
- Preserve resetting to the provided startPoint when a concrete value is supplied
𝖎𝖚𝖑𝖎𝖎𝖆