* fix(sidebar): search the managed chats along with project sessions
The sidebar builds search data per group, and every group renders
`filteredNodes ?? []` while a query is active. Only project groups were ever
given that data, so the managed chats — which render outside any project
section — collapsed to an empty list as soon as anything was typed, however
well a title matched. The header count ignored them for the same reason.
Pass the chats group to the sections hook as a standalone group so it takes
the same search pass and joins the match count. Building it before the hook
runs keeps search-data ownership in one place instead of registering entries
from the rendering component.
No CHANGELOG entry: it is left out deliberately to keep this branch free of
conflicts with other open PRs, and is to be written at release time.
fixes#3200
* fix(sidebar): report the real search match count to the header
The header rendered whatever `SessionSidebar` passed it, and that was a
literal `0` — so "0 matches" was shown no matter how many sessions matched.
The count exists: the sections hook already computes it, but only the session
list can see it, and the header renders above the list.
Report it upwards from the list instead of recomputing it in the header, so
the number and the visible rows cannot disagree, and reset it to 0 when the
list unmounts.
fixes#3200
* fix(sidebar): keep chat-only search results on screen
The chats render inside the scroller's top content, and the branch that
handles "no project section matched" replaced the whole list with the empty
state. A query matching only a chat therefore showed "No matching sessions"
while the header — now reporting the real count — said one match, and the
chat itself stayed hidden. That is the exact reproduction in the issue; the
earlier manual check missed it because the query used also matched a project
session.
Tell the scroller when its top content holds results, and keep it on screen
in that branch. The decision moves to `sessionProjectRender` next to the
other render-selection helpers, where it can be tested without mounting the
Vite-only component graph.
fixes#3200
CodeMirror collapses a CRLF pair into one line break, so the document is
shorter than the string it was given. The composer derived the caret from
the JS string length, which put it past the end of the document and made
dispatch throw `RangeError: Selection points outside of document`.
Because the exception fires before the transaction applies, the document
never updates, the un-normalized text stays in React state, and the draft
persists as-is: every later visit to the session restores it and crashes
again, with no way out from the UI.
Derive the caret from the change set instead, in the controlled writeback
and in the imperative insert/replace handles.
fixes#3013
# Conflicts:
# CHANGELOG.md
# packages/vscode/CHANGELOG.md
Since opencode 1.18.x, `POST /global/upgrade` requires a `target` semver in
the body. OpenChamber sent an empty object, so every "Update OpenCode" click
came back 400. The rejection arrives as `{name, data:{message}}`, which has
no `error` field, so the user was left with the bare status text: "Bad
Request".
Resolve the target from the latest release — the same lookup the upgrade
prompt already uses to decide there is anything to offer — and fail with an
explicit code when it cannot be resolved, rather than sending a body opencode
is guaranteed to reject. Read the upstream rejection message so a refused
upgrade explains itself.
The VS Code extension carries its own copy of this flow and had the same two
defects; both are fixed there.
fixes#3121
"Restart to Update" answered the renderer with null before the install was
attempted, so a rejected install only reached main.log and the button looked
dead. The apply-update path now keeps the IPC call open until the app quits or
autoUpdater reports the failure, rolls the quit/install flags back when the app
stays up, and the update dialog shows the real reason with a translated hint for
a rejected code signature.
Also settle the download promise on downloadUpdate() itself: an already cached
payload emits no 'update-downloaded', which left that promise pending with its
listeners attached on every retry.
* perf: optimize session loading and startup
* fix(chat): stabilize history prepend virtualization
* perf: unblock first session open from startup network contention
Opening the first session after app start waited seconds for its message
fetch. Three independent contributors, each measured via CDP network
capture and Chromium net-log against the packaged desktop app:
- The active-session watchdog fired an uncapped per-directory status poll
and child-session discovery burst at startup, and other subsystems
(git checks, global session pages, command/skill discovery) fanned out
alongside it, saturating the browser's ~6 HTTP/1.1 sockets per origin.
Add a shared background-network gate (concurrency 3) and route the
watchdog, poll-shaped git reads (also priority: low), global session
pages, command/skill loads, and the background update check through it.
- The packaged renderer is cross-origin to the loopback backend, so every
API call needs a CORS preflight; a few slow OpenCode-proxied requests
held the whole pool while preflights and interactive traffic queued
behind them. Lift Chromium's per-host connection cap for loopback via
ignore-connections-limit in the Electron shell.
- OpenCode initializes each directory lazily on its first request, so the
first click paid that cost interactively. Warm the last-used directory
and the three most recently opened projects right after OpenCode
readiness, sequentially and best-effort, overlapping UI startup.
Validation: new background-network tests, lifecycle warmup test, focused
store/sync tests, UI type-check and lint, dead-code report, node --check
plus electron type-check/lint, and CDP first-open measurements on the
packaged app (message fetch socket queue 5.4s -> 0.03s).
* fix(ui): keep interactive git reads out of background queue
---------
Co-authored-by: Bohdan Triapitsyn <artmore@protonmail.com>
Reworks how devices connect to an OpenChamber server, end to end.
Pairing v2:
- One-time pairing links/QR codes (openchamber://connect?v=2) carrying a set of transport candidates (LAN/tunnel/relay) and a single-use secret redeemed server-side; no tokens embedded in links
- Add-a-device dialog written for first-time users: intent-based transport choice (Anywhere / Home network only / This computer only) with plain-language descriptions, transparent fallback checkboxes, server-authoritative LAN detection, high-res QR dialog
- Private relay folded into pairing as a transport candidate with a demand-driven lifecycle (enables when a relay device is paired, disables when none remain)
Multi-transport devices:
- A saved device holds all its transports and one token; mobile re-probes on connect, resume, and network change and hot-switches LAN<->relay seamlessly (no re-pairing, no remount, session preserved)
- Desktop can import relay pairing links, switch to relay hosts through the E2EE tunnel, and restore a relay default host after relaunch
Device management:
- Device list (web + desktop) shows live per-device connectivity with the active transport (Connected - Local network / Relay) and platform badges (iOS/Android/macOS/Windows/Linux)
- One physical device = one record: stable per-install dedupe keys across pairing and password re-login; typed pairing label names the device, paired devices name the connection by the issuing server hostname
- Trusted desktop-local client manages all devices (list, revoke, clear revoked); relay host reaps dead client sockets after 3 missed keepalives
Android:
- LAN transport unblocked (cleartext + mixed content, mirroring iOS ATS exceptions); resume re-probe retries through network flux and silently auto-reconnects from a disconnected state
## Summary
Fixes#736 — OpenChamber listens on `0.0.0.0` (all interfaces) by default, exposing the server to the network without warning. The log output shows `visit: http://127.0.0.1:...` which is misleading.
## Changes
- **Default bind address changed to `127.0.0.1`** — server is only accessible locally unless explicitly configured otherwise
- **New `--host` CLI flag** — `openchamber --host 0.0.0.0 -p 8080` to listen on all interfaces
- **`OPENCHAMBER_HOST` env var** — documented in help text and docker-compose.yml as an alternative to `--host`
- **Docker entrypoint** defaults to `OPENCHAMBER_HOST=0.0.0.0` so container port mapping continues to work
- **Startup logs** show the actual bind address instead of hardcoded `localhost`
### Resolution priority
```
--host flag > OPENCHAMBER_HOST env var > 127.0.0.1 (default)
```
### What doesn't break
- **Desktop app** — already forces `OPENCHAMBER_HOST=127.0.0.1` via Tauri
- **VS Code extension** — doesn't use the web server
- **Docker** — entrypoint sets `OPENCHAMBER_HOST=0.0.0.0`, preserving current behavior
- **Tunnels** — cloudflared connects to `127.0.0.1` origin internally, works regardless of bind address
## Testing
Automated:
- `bun run type-check` / `bun run lint` — pass
Manual (CLI, direct `node` execution):
- Default bind → `127.0.0.1` (verified via `lsof`/netstat)
- `--host 0.0.0.0` → binds all interfaces
- `--host=0.0.0.0` (inline) → works
- `--host` without value → error exit 2
- `OPENCHAMBER_HOST` env var → respected
- `--host` flag overrides env var
- IPv6 `::1` → correct bracketed URL, health check 200
- CLI daemon start/stop → works
- `visit:` URL → correct
- Help text → `--host` in OPTIONS, `OPENCHAMBER_HOST` in ENVIRONMENT
- Browser UI → loads and works
- Tunnel via UI → works
- Desktop app → no regression
Docker (tested on Ubuntu with native Docker):
- SSH key generated successfully
- `OpenChamber server listening on 0.0.0.0:3000`
- Health check 200
- `uid=1000(openchamber)` confirmed
* feat(git): show current branch boundary in commit history
* style(git): round commit cards around branch divider
* style(git): refine branch divider visual boundary
* docs: clarify named and quick Cloudflare tunnel usage
* feat: make chat file paths openable from rendered responses
* perf: speed up chat file-path links and open behavior
* fix: open chat file references at mentioned lines
* fix: prevent context panel flicker on blocked file opens
Prevent a feedback loop between remote selection and refresh effects in PullRequestSection. This keeps refresh callback dependencies stable and avoids repeated state updates that triggered maximum update depth errors in desktop Git PR view.
* feat: open focused file in selected desktop app
* fix: make file tree indicators match active open tabs
* fix: limit preview functionality to markdown files only
* feat: add Open In action to file editor toolbar. add antigravity to openin app list
* feat: add Cloudflare Tunnel settings for desktop app
Add a 'Remote Tunnel' section in Settings (desktop-only) that lets users
start/stop a Cloudflare quick tunnel on demand, with auto-generated
password protection and a QR code for easy mobile access.
- Server: 4 new API endpoints (check/status/start/stop) reusing the
existing cloudflare-tunnel module
- UI: TunnelSettings component with full state machine
(checking → idle/not-available → starting → active → stopping)
- QR code rendered via the qrcode package for in-app display
- Hidden from VS Code extension (desktop/web only)
* fix: use ?token= instead of ?p= in tunnel password URLs
REST API endpoints were building passwordUrl with ?p=<token> but
SessionAuthGate reads the ?token= query param, causing QR code
auto-login to fail — the password was never extracted from the URL.
Standardize all three tunnel URL construction sites to use ?token=
so scanning the QR code correctly pre-fills and submits the password.
* feat: secure remote tunnel access with one-time connect links
* feat: redesign remote tunnel settings and access flow
* fix: cleaned up unused desktop close code path
* feat: overhaul named tunnel setup and persistence flow
* chore: align codemirror language dependency resolution
---------
Co-authored-by: Brian-Hwang <brian.hwang@cornelisnetworks.com>
Route /api/fs/read and /api/fs/raw through the extension bridge with workspace-boundary enforcement and canonical path checks, so VS Code parity matches hardened web endpoint behavior.
Treat selecting Default as an explicit variant clear across send-time persistence, stream metadata sync, and historical session analysis so stale non-default variants are not reapplied.
* feat(chat): add mermaid preview popups and fullscreen diagram viewer
Enable opening Mermaid diagrams from markdown and file attachments with a dedicated fullscreen dialog, while tightening preview loading behavior and sizing for more reliable interaction.
* refactor(chat): extract shared preview overlay hooks
Centralize fullscreen preview transition and viewport lifecycle logic so image and Mermaid dialogs stay behaviorally aligned while reducing maintenance overhead.
* fix(security): enforce workspace boundaries for fs read endpoints
Validate /api/fs/read and /api/fs/raw paths against active workspace roots and canonical realpaths to block traversal and symlink escapes before serving file contents.
* fix(chat): remove dead Mermaid copy component
Drop an unused merge-leftover component in MarkdownRenderer to keep lint clean without changing Mermaid preview behavior.
Remove the 'OpenChamber for Actions' feature that ran OpenChamber on
GitHub runners via Cloudflare/Ngrok tunnels. This was a separate
deployment target with its own lifecycle scripts and documentation
that added maintenance overhead without benefiting local usage.
Deleted:
- .github/workflows/opencode.yml (Actions workflow)
- scripts/monitor.sh (service self-heal loop)
- scripts/persistence-save.sh (artifact encryption/upload)
- scripts/persistence-restore.sh (artifact decrypt/restore)
- scripts/opencode-config.sh (Actions config bootstrap)
- docs/OPENCHAMBER_FOR_ACTIONS.md (user guide)
Updated:
- README.md: removed 'GitHub Actions (Cloud Usage)' section
Local Cloudflare Quick Tunnel support (--try-cf-tunnel) is unaffected.
* feat: add OpenCode server authentication with auto-generated passwords
* fix(auth): separate user env and managed OpenCode password state
* fix(auth): enforce env precedence and managed password rotation across runtimes
* fix(vscode): rotate managed auth on startup and harden webview proxy
* build: add dev icons and config for Tauri desktop development
* fix(runtime): start managed OpenCode via CLI and expose active API port
* fix(managed-runtime): control OpenCode lifecycle and surface secure diagnostics
* docs: remove VS Code plugin test runbook
Save and restore main-window bounds/state in desktop settings so reopen behavior is consistent, while keeping new windows on defaults. Add debounce, off-screen fallback, and minimum-size guards to prevent unusable or stale geometry restores.
* feat: add worktree validation and deleteLocalBranch option
Add API to validate and create worktrees with new payload types
Allow deleting local branches when removing worktrees via UI and API
Introduce OpenCode style random names for worktrees when not provided
* feat: enable SSH/HTTPS transport detection for PR picker
Load remotes for the current project directory to inform PR picker options.
Determine preferred push transport from remotes and apply it.
Expose sshUrl in API for frontend to build SSH clone URLs
* feat: extend head repo with sshUrl and improve push error messages
Add sshUrl field to head repo mapping
Enhance push failure handling to display stderr or stdout details
Return push details on success
* fix: worktree path
* feat: worktree set upstream on creation
Enable pushing to upstream by default when no remote is specified
Remove per-remote dropdown for push actions and auto-use first/upstream remote
Update server and VSCode git services to support push without explicit remote and set upstream
* fix: worktree-name sanitization
* feat: rename worktree path field and branch prefix
* feat(worktrees): add git.worktree facade, validation endpoint, upstream/remote-aware creation, and non-blocking setup execution
* refactor(git): use git.worktree namespace in branch picker
* feat(worktrees): sync OpenCode sandbox metadata on create/remove
* fix(worktrees): accept new path key in workspace guard and validate remote startRef
* chore(docs): remove temporary worktree testing plan
* feat: add git worktree management API (list/create/delete/validate) for vscode
* feat: wire root tracking remote and defaults for new worktrees
Add resolveRootTrackingRemote to detect upstream remote for root branch
Apply upstream defaults when creating new worktrees to auto-set upstream
Replace validation and creation flow to use new worktreeCreate APIs
* feat(worktrees): enable root tracking remote handling
* feat(macos): add New Window menu item
Add a New Window option to the macOS menu bar
Trigger opening a separate window when the New Window action is selected
* feat: enable multiple desktop windows and new window shortcut
Enable multiple desktop windows by extending manifest to main-*
Expose desktop_new_window to create additional windows from UI
Show New Window shortcut in Help dialog (Desktop only) with Shift + Alt + <mod> + N
* feat(desktop): enable opening host URL in new window from host switcher
Add a new action to launch a URL in a separate window from the host switcher
Wire the UI to open the selected host in a new window using a dedicated control
Expose a cross-platform API to create a new window pointing at a URL
* fix(desktop): validate URL scheme before opening new window
* fix(desktop): skip unreachable hosts when opening new windows
- Use git reset --hard HEAD by default when startPoint is not provided or is HEAD
- Preserve resetting to the provided startPoint when a concrete value is supplied
𝖎𝖚𝖑𝖎𝖎𝖆