* fix: make textarea focus highlight render inside
Apply inset focus ring to shared textarea component
Prevent focus border from appearing clipped near container edges
* fix: build desktop sidecar with target-matched architecture
Map Tauri target triples to Bun compile targets
Pass explicit Bun compile target for sidecar builds
Prevent x86_64 releases from shipping arm64 sidecar binaries
* fix: allow Windows git custom binary paths
Enable safe use of resolved custom git executable paths
Prevent git status failures when path contains restricted characters
Keep default behavior unchanged for plain git invocations
* fix: allow toggling diff line wrap on mobile
Stops forcing wrapped lines in mobile diff view
Line-wrap button now reflects and applies user preference
* fix: align VS Code managed server env with shell settings
Import login-shell environment variables before starting managed OpenCode
Apply Windows and Unix shell snapshot resolution for parity
Improve proxy-dependent provider connectivity in VS Code extension
* fix: respect user scope when adding MCP servers
Prevent user-scope MCP entries from being written to project config
Keep project writes only for explicit project scope
* fix: show linked GitHub issues and PRs as user message attachments
Preserve synthetic issue/PR context parts during message filtering.
Convert synthetic GitHub context JSON into attachment-style user parts.
Open issue/PR attachment links via shared external URL helper.
* fix: restore and polish project notes in sessions sidebar
Restored the Notes button in the left sessions sidebar header
Improved notes panel layout with wider dialog, larger notes area, and project name in the header
Refined todo rows with inline expand/collapse text and stable action/checkbox alignment
* fix: hide sidebar footer actions in VS Code runtime
Remove Settings, About, and Shortcuts buttons from the sessions sidebar footer in VS Code
Keep update button behavior unchanged across runtimes
* fix: normalize Windows paths for VS Code session loading
Canonicalize drive-letter casing in session path normalization
Align VS Code workspace path persistence with the same Windows path format
Normalize client directory context before API calls to keep session filtering consistent
* fix: open linked GitHub attachments with shared URL helper
Use runtime-aware external URL opening for issue/PR attachment links.
Keep GitHub attachment labels readable without altering normal file name rendering.
* fix: keep user MCP config writes out of project files
Respect user scope when selecting config write target
Prevent MCP user entries from being written to project opencode.json
* fix: prevent project menu from overlapping new session button
Align project menu positioning for non-git and git project rows
Avoid kebab-menu and plus-button overlap in sessions sidebar
* feat: add project actions in header with reliable terminal run flow
- Add per-project Actions settings with icons, platform filters, and default action
- Run/stop actions from header using terminal tabs, including Ctrl+C then force-kill fallback
- Improve terminal UX with stable selection, resize handling, and smarter URL auto-open for localhost ports
* feat: add project actions UI with refined header dropdown behavior
* feat: add parent-session back button in chat
* fix: make web and desktop dev modes reliable and conflict-free
- Separate desktop and web dev ports to avoid collisions
- Add robust process-tree shutdown so Ctrl+C cleans sidecars
- Add true web HMR mode and keep service worker out of dev
* fix: linux safe scripts for dev
* feat: run project actions on web and add desktop SSH forward URL opening
* feat: add mobile project actions button with terminal tabs and tighter tab UI
* revert: remove experimental mobile terminal selection UI
* feat: show Add action button in header when empty
* fix: make retry countdown human-readable in status row
* fix: prevent nav rail actions from firing through overlays
* feat: add OpenCode server authentication with auto-generated passwords
* fix(auth): separate user env and managed OpenCode password state
* fix(auth): enforce env precedence and managed password rotation across runtimes
* fix(vscode): rotate managed auth on startup and harden webview proxy
* build: add dev icons and config for Tauri desktop development
* fix(runtime): start managed OpenCode via CLI and expose active API port
* fix(managed-runtime): control OpenCode lifecycle and surface secure diagnostics
* docs: remove VS Code plugin test runbook
- Start API server on port 3001 and Vite dev server on port 5173 in the desktop dev flow
- Proxy /auth, /health, and /api to the local API server for development
- Gracefully handle startup/shutdown and report failures clearly
## What / Why
This PR finishes the desktop refactor: the Tauri app is now a thin shell that launches the web server as a sidecar and loads the UI from `http://127.0.0.1:<port>`. All real backend logic lives in `packages/web/server/index.js`; desktop Rust keeps only native integrations (menu/dialog/notifications/updater/deep-link + window chrome).
This unblocks:
- consistent behavior across web/desktop/vscode (single backend)
- simpler desktop maintenance (no duplicated Rust backend)
- host switching between Local + remote instances in desktop
- reliable cold-start behavior on slow machines (VSCode + desktop)
## Key changes
- Desktop sidecar runtime
- build pipeline to bundle web dist + `openchamber-server` sidecar (`packages/desktop/scripts/build-sidecar.mjs`)
- robust local port selection (prefer saved/default, fallback to random; persisted in `~/.config/openchamber/settings.json`)
- improved PATH handling so the sidecar can locate `opencode` CLI (incl `~/.opencode/bin`, overrides, common bins)
- disable native right-click context menu in production builds (dev keeps it)
- Desktop instance switcher (Tauri-only)
- header button + modal to add/edit/delete remote hosts, set default, probe status/ping, switch back to Local escape hatch
- auth gate includes host switcher so you can recover when a remote host is broken/auth-required
- host list stored desktop-locally (not tied to the currently selected remote server)
- Notifications
- decision logic moved server-side; desktop notifications emitted via sidecar stdout and shown natively by Tauri
- prevent double-notifications on desktop Local origin (UI ignores SSE notification when native path is active)
- restore macOS notification sound
- Updates
- Tauri updater used only when viewing Local instance in desktop shell (avoid “remote web update” triggering desktop restart)
- Settings persistence & UX polish
- persist model favorites/recents via `/api/config/settings` (works for web + desktop; not origin-dependent)
- persist per-project sidebar collapse state in `projects[].sidebarCollapsed` via `/api/config/settings` (with debounce on toggles)
- macOS header sizing/traffic-lights offsets fixed (marketing macOS major injected from desktop; MultiRun header aligned)
- VSCode cold-start: keep retrying provider/agent loads after connection to avoid empty UI on slow machines
- misc lint/type fixes + bun.lock sync
- Desktop bootstrap / resiliency
- show onboarding screen when OpenCode CLI is missing (desktop Local origin), with retry hook to restart OpenCode after install
## Testing notes
- Desktop (macOS): switch Local <-> remote, set default host, verify auth gate recovery, native notifications (with sound), updater gated to Local
- Web: favorites/recents + per-project collapsed state persist across reload/restart
- VSCode: slow startup no longer results in missing providers/agents/models
Bohdan Triapitsyn