Before returning a successful immutable ownership result, recheck whether a WAL appeared and rerun through SQLite normal read-only access. Add a deterministic real-SQLite regression that commits the ownership row after the immutable connection opens.
Keep the immutable-first ownership probe and WAL-aware corruption retry in one bounded connection loop. The selected location makes the retry single-shot while preserving handle cleanup and the no-mutation cold-family path.
Poll both fixed-width selection rails together and compare their trailing edges so the browser assertion measures settled popover geometry instead of sampling different points in the open animation.
Retry an immutable ownership probe through SQLite normal read-only access when a WAL appears during the open and produces a false corruption result. Treat a WAL without SHM as live state, and cover that rebuildable-index boundary with a real database-family regression.
Treat only live WAL sidecars as requiring a normal read-only ownership connection. Keep rollback journals on immutable preflight inspection so the canonical writable lifecycle remains the sole owner of crash recovery.
Use WAL-aware read-only access when SQLite journal sidecars are live, while retaining immutable inspection for quiescent database families. This prevents false corruption during concurrent state initialization without mutating cold databases or changing the schema.
Keep Web Awesome checkbox semantics while rendering the selection state in the sidebar filter shared trailing rail. Add mocked-browser coverage for the hidden native mark and one-pixel alignment invariant.
Co-authored-by: Vyctor H. Brzezowski <krzyszchweski@gmail.com>
* fix: exec approvals fail with a pairing prompt when the device pairing lacks operator.approvals
Local approval-runtime gateway calls sent the shared device identity in
addition to the process-local approval-runtime token, so the connect was
re-evaluated against that device paired scope baseline and rejected with
"scope upgrade pending approval" whenever operator.approvals was missing
from the pairing record. Nothing could clear it from inside the session:
the prompt that would approve the upgrade is delivered by the call that
was rejected.
Make the two requester credentials exclusive by passing the resolved
approval-runtime token into the identity resolver, matching the rule
createOperatorApprovalsGatewayClient already follows. Remote,
env-selected, and gatewayUrl-override approval calls still require a
stable device identity, as does approved node.invoke system.run replay.
Closes#121525
* fix(lint): drop dead applySessionHints import in media-only reply test
4b0151682e removed the only use of applySessionHints from this test but
left the import, so oxlint fails no-unused-vars on main and blocks the
merge gate. The vi.mock("./body.js") factory keeps the entry because
get-reply-run-context.ts still calls it.
* fix(plugin-sdk): dedupe declaration dependency types
Keep Zod declarations owned by the published dependency across partitioned SDK declaration builds, and compile an isolated external consumer that mixes the documented runtime and schema entrypoints.
* fix(plugin-sdk): narrow package type regression guard
Keep the cross-entrypoint assignment and exported-schema checks while excluding unrelated declaration-library diagnostics. Inline the temporary consumer and carry the current-main unused-import repair required for green CI.
* fix(ui): unify initial prompt handoff projection
Route create-time prompts through the canonical session projection so live persistence and delayed history adopt one stable bubble. Preserve inline attachment content across reconnects and authoritative identity handoff while removing duplicate matching and post-reducer mutation paths.
* fix(ui): preserve initial prompt projection contracts
* fix(ci): restore exact-head validation
* fix(ui): keep typing indicator in the composer footer
Keep typing activity in the fixed-height Control UI composer footer so collaborators no longer shift the textarea.
Render up to three author avatars before the localized typing label.
* test(ui): target the typing label in E2E
* fix(ui): hide typing avatars from the status announcement
Status text already names typers; role=img avatars made screen readers announce names twice. Addresses ClawSweeper P2.
* refactor(sessions): collapse session accessor aliases
Declaration ownership moved to defining modules; no name or signature changed.
* test(auto-reply): remove stale session hint import
* feat(skills): repair used skills in turn
* fix(skills): bind repair to used skill receipt
* fix(skills): preserve explicit repair review
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
* fix(terminal): always emit full intro art
Open-time request.cols is the pre-fit boot grid (the client resizes right
after open), so the 40-column gate suppressed the art on real terminals.
Live-verified against a dev gateway on post-merge main.
* test(terminal): align intro banner fixture
Jesse Merhi