* refactor(ui): dissolve the General settings page into Appearance
* test(ui): drop dissolved config route expectation
* test(ui): cover legacy General model redirect
* style(ui): format legacy redirect test
* docs(agents): standardize canonical record guards
* refactor(model-catalog): use canonical record guard
* refactor(scripts): use canonical record guard
* refactor(ui): use canonical record guard
* refactor(codex): use canonical record guard
* refactor(agents): use canonical record guard
* refactor(sessions): use canonical record guard
* refactor(doctor): use canonical record guard
* refactor(infra): use canonical record guard
* feat(ui): move settings save feedback to sidebar
* test(ui): support stateful config writes in mock gateway
* test(ui): add save indicator to memory sidebar test
* fix(agents): use lastSeenAtMs tie-break in canvas default-node selection
When multiple nodes share the same connectedAtMs (or are all disconnected),
the comparator now checks lastSeenAtMs before falling through to the stable
nodeId alphabetical ordering. This prevents the canvas from selecting a stale
node that was connected long ago but has since been replaced by a more recently
active device.
* fix(nodes): harden offline canvas target selection
Co-authored-by: Kagura <kagura.chen28@gmail.com>
* fix(nodes): keep offline target fix release-ready
Co-authored-by: Kagura <kagura.chen28@gmail.com>
* fix(nodes): ignore stale connection times offline
Co-authored-by: Kagura <kagura.chen28@gmail.com>
* test(ci): stabilize startup and memory UI assertions
* test(gateway): inject prepared manifest metadata
* test(gateway): isolate startup model log coverage
* test(gateway): reuse prepared model manifests
* test(ui): keep startup abort fixture cold
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* test(ui): remove two load-dependent flakes in the Control UI suite
Both failed only under a saturated worker pool, roughly one full run in four.
The board refresh tests asserted a 1ms boundary (nothing at 4999ms, fired at
5000ms) on a timer armed during a render cycle, so any drift in when it was
armed failed them. Assert the band that carries the meaning instead: silent at
2s rules out the 1s floor, fired by 8s rules out the 15s a full-TTL calculation
would give. Call count is no longer pinned because the unreplaced ticket keeps
retrying, which has its own test.
The router outlet settled by pumping a fixed five cycles, which returns while a
chain is still resolving into another render. Drain to Lit's documented settled
state instead, via a shared helper with its own coverage.
* test(ui): keep a drain floor so settling never regresses the fixed pump
A settled update only says that render did not reschedule itself, so a promise
chain that requests an update at its end can still be in flight. Keep the five
turns unconditionally and let the settled check extend past them.
* docs(test): state the settle helper's bound instead of implying quiescence
Add agent ownership to observer digests, scope global observer delivery and reconciliation, and centralize application session selection across navigation and reconnects.
Co-authored-by: xbrxr03 <abrarhabib03@gmail.com>
* feat(ui): resolve session URLs through the gateway with best-effort slug matching
Session URLs now resolve a stored board face and a display-name slug through
the gateway instead of guessing from the browser's cached session page.
- An uncached open marks only the in-app navigation, never the shareable href,
so the chat loader can re-derive the face and replace the URL.
- A cached row settles the lookup locally, keeping navigation off the wire.
- A one-segment reference resolves short id, then literal key, then display-name
slug; ties reuse the existing disambiguation view.
* refactor(ui): keep slug ties on short disambiguation prefixes
Slug candidates reused the full uuid, which produced 32-character links in the
disambiguation view. uniqueShortIdPrefix already falls back to the full id when
the bounded search was truncated, so reuse it and drop the flag.
* fix(ui): navigate worktree owner links in-app so the face marker survives
The Worktrees owner link was a bare anchor consuming only the shareable href,
so preferenceDerivedFace was a no-op there and an uncached owner always opened
on chat. Match the other session surfaces: keep the clean href and navigate
with the options on plain clicks.
* fix(ui): search the first uuid block so long session references resolve
The gateway matches sessions.list search as a plain substring and stored keys
hold a hyphenated uuid, so any hyphen-stripped reference past the first block
matched nothing and 404'd. This hit disambiguation links, which offer prefixes
longer than eight characters. Send the first block and keep applying the full
prefix per row.
A resolved slug now canonicalizes to that same short reference instead of a
full uuid, so /chat/main/deploy-monitor settles on -6db92d48.
* docs(ui): record why the face marker stays out of shareable hrefs
* fix(ui): keep stable chat rows in insertion order and only sort live tool/stream items by timestamp
* fix(ui): keep live rows within current turn
* fix(ui): keep current work above queued turns
* fix(ui): keep streamed replies above queued turns
* fix(ui): preserve reconnecting run order
* fix(ui): preserve causal terminal ordering
* fix(ui): bound replay rows to owning turns
* fix(ui): keep question summaries in owning turns
* fix(ui): scope question run ownership to session
* fix(ui): restore reconnecting chat run identity
* fix(ui): remove unused chatItemTimestamp import in chat-thread-build.ts
* fix(ui): correlate question summaries with agent runs
Co-authored-by: Peter Lee <li.xialong@xydigit.com>
* chore(i18n): refresh native source baseline
Co-authored-by: Peter Lee <li.xialong@xydigit.com>
* fix(ui): remove unused chatItemTimestamp export and split tool-stream test file
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(ui): sync Control UI prefs via hash-free LWW config.patch
* test(ui): prove prefs reconnect replay end to end
* fix(gateway): surface hash-free prefs commit races instead of replaying stale intent
* fix(ui): never re-reconcile a retained config snapshot over acked prefs
* fix(ui): merge persisted pending prefs across tabs instead of clobbering
* test(ui): pass current runtime config through sidebar prefs reconcile fixture
* feat(ui): durable session board face and dashboards index
Board face lived only in client-side boardSessionViews, capped at 50 entries,
so the preference never followed the user to another device, evicted as
sessions accumulated, and could not be seen as a set.
Persist it as SessionEntry.boardFace, which rides the existing entry_json blob
and so needs no SQLite schema change or version bump. Expose it on the session
list row and add it to the sessions.patch write-scope allowlist alongside label,
pinned, and archived: setting your own view preference is user-level chat
organization, not policy. Unknown patch fields still fail closed to
operator.admin.
Generic navigation now reads the stored face, so the sidebar and session list
open a thread on the face you left it on. boardSessionViews keeps only
activeTabId and reopenDockByTab, which are genuinely per-device.
Add /dashboards listing threads whose preferred face is dashboard. Filtering
runs server-side in filterSessionEntries before pagination, because the client
holds only a capped page and a client-side filter would silently omit
dashboards.
* test(protocol): assert the pre-rename face param is rejected
The gateway-protocol validator test still passed the pre-rename 'face' key,
which the closed schema rejects. Use boardFace, and pin the old name as a
negative case so it cannot silently return.
* chore(protocol): regenerate Swift bindings and docs map for boardFace
Adding boardFace to the sessions schema changes two committed generated
artifacts: the Swift gateway models (pnpm protocol:gen:swift) and the docs map
(pnpm docs:map:gen), which now lists the dashboards index section.
Three fabrication points told clients the assistant agent was "main" before
any roster/config resolution: DEFAULT_ASSISTANT_IDENTITY in
src/gateway/assistant-identity.ts, the Control UI store's initial snapshot
(ui/src/app/gateway-store.ts:65), and its hello fallback (:336). On installs
whose implicit main agent is retired, every page reload fired
sessions.catalog.list for the nonexistent agent and flashed
'unknown agent id "main"' in the sidebar.
The no-roster state now carries no agent id: DEFAULT_ASSISTANT_IDENTITY drops
agentId, resolveAssistantIdentity returns ResolvedAssistantIdentity (agentId
required) for config-backed paths, the bootstrap omits the optional
assistantAgentId field without config, the UI store starts null, and agent
selection adopts the roster default once agents.list arrives.
* feat(ui): path-based session and dashboard URLs
* docs(ui): document control UI URLs
* fix(ui): finalize session path routing
* feat(ui): anchor session URLs on stable keys
* docs(ui): clarify stable session URL identity
* fix(ui): resolve session prefixes with full prefix and pagination
Query sessions.list with the full supplied prefix instead of an eight-char
truncation, and paginate up to a bounded page count so longer disambiguation
links resolve instead of being reported ambiguous. Zero strict-prefix matches
now fall through to literal-key resolution rather than rendering an empty
ambiguity view.
Also document the ~dot/~dotdot segment escape: peer ids reach session keys
trimmed and lowercased only (src/routing/session-key.ts), so a literal '.' or
'..' segment is reachable and browsers would normalize it away.
* fix(ui): synchronize committed session routes
* test(ui): split native shell host coverage
* fix(ui): thread configured mainKey through session URL builders
Reserved-set disambiguation needs the operator-configured mainKey at runtime, so
thread it from agentsList through every session path builder and the ClickClack
control URL. Unambiguous non-hex single-segment rests now resolve literally while
short-id-shaped rests still fail closed, which restores ClickClack channel
compatibility detection and control-link reconciliation.
Also bound prefix-resolution retries, preserve catalog thread identity, and keep
draft state on ambiguous candidate links.
* fix(ui): repair session URL CI integration
* perf(ui): lazy-load session route resolution
* perf(ui): isolate session prefix resolution
* perf(ui): defer session path parsing
* perf(ui): defer session navigation startup
* fix(ui): preserve first-run and literal session navigation
* fix(ui): satisfy session routing type and export gates
* fix(clickclack): preserve unscoped control link agent
* style(ui): satisfy chat page line limit
* refactor(ui): move chat page helpers to owning modules
* fix(ui): preserve destination session route identity
* fix(ui): preserve agent identity in session routes
* fix(ui): escape dots in literal session path segments
encodeURIComponent leaves periods intact, so a literal key segment like
channel:release.js produced /chat/main/channel/release.js. In-app navigation is
intercepted by the SPA, but a refresh, an external link, or a ClickClack link
would be served as a static asset request and never reach the app.
pathForWorkboardBoard already escapes dots for this reason; mirror it in both the
session URL contract and the ClickClack encoder, route the agent id through the
same segment encoder, and pin the case in both shared vector tables.
* fix(ui): stop bootstrap after teardown race
* refactor(ui): centralize session navigation targets
* fix(ui): consume bootstrap teardown abort
* fix(ui): canonicalize configured main session routes
* fix(ui): preserve distinct session references
* fix(ui): redirect released session query links
* fix(ui): make bootstrap teardown abort-safe
* feat(ui): gateway-owned sidebar section order with hover-only drag grips
* fix(ui): repair sidebar section order CI gates
* fix(protocol): keep sectionOrder optional for older gateways
Native Swift clients ship separately from gateways, so new clients must decode older gateway responses that omit sectionOrder.
* fix(ui): reconcile gateway section ordering with main
* fix(state): allow lazy tables in v5 maintenance
* refactor(ui): retire prefs session section order in favor of gateway-owned order
Supersedes #113948 by deleting the unreleased ui.prefs.sessionSectionOrder key and its browser plumbing. Gateway SQLite sidebar_sections remains the single canonical store.
* feat(ui): drag custom sidebar groups between built-in session zones
* test(ui): remove stale split ratio fixture
* perf(ui): raise startup budget baseline for session-section ordering pref
* feat(ui): add persisted sidebar layout model
* feat(ui): render flexible chat sidebar columns
* test(ui): align board sidebar fixture type
* fix(ui): preserve sidebar panels across responsive layout
* fix(ui): satisfy sidebar CI ownership and performance
* test(ui): derive discussion helpers from panel config
* test(ui): mount session rail through its registry
* fix(ui): preserve sidebar state across projections
* style(ui): format sidebar state fixes
* fix(ui): satisfy sidebar lint constraints
* refactor(ui): break sidebar layout import cycle
* fix(ui): stabilize sidebar panel rendering
* fix(ui): keep the narrow sidebar grid off for an empty layout
The two-row narrow grid reserved a panel row even with no sidebar panel open, halving the primary surface height on every default mobile chat pane.
* fix(ui): lazy-load chat sidebar region
* style(ui): format rebased chat state page
* chore(ui): raise sidebar startup baseline
* fix(ui): preserve sidebar move and resize state
* chore(ui): align sidebar startup baseline
* chore(ui): refresh sidebar startup baseline
* test(ui): register discussion element in isolated test
* fix(ui): persist the dragged panel as the collapsed active panel
Drag moves activated the panel in its destination column but left the separate persisted collapsed-mode selection stale, so the narrow layout foregrounded the wrong panel after a move and the stale choice survived reload.
* fix(ui): preserve resolved canvas URL in detail panel
* feat(ui): publish carapace embed font stacks to MCP apps
Adopt the carapace embed contract's sandbox-safe font stacks: publish
--font-sans for the first time and switch --font-mono from the host's
JetBrains-led token to the embed mono stack. Both are static, system-
resolvable values byte-identical to carapace candidate/embed.css, since
the sandbox font-src policy silently drops brand faces.
* feat(ui): emit data-theme-resolved alongside theme attributes
Carapace CSS selects on [data-theme-resolved]; keep it in lockstep with
data-theme-mode at boot (index.html IIFE) and on every runtime theme
change (bootstrap publish path). Rename applyStartupPresentation to
applyThemePresentation: it runs on every theme change, not just startup.
* fix(ui): resolve undefined --success/--warning tokens and drop dead hex fallbacks
--success and --warning were never defined (real tokens: --ok/--warn),
so sites with literal fallbacks rendered off-palette one-off colors and
sites without them silently dropped declarations (invalid color-mix in
the chat sidebar warn banner). Map all uses to the semantic tokens
across board, chat sidebar/layout, layout, and components styles, and
strip the stale dead var() hex fallbacks in these global stylesheets.
Code-syntax palette hexes in the file view are documented as deliberate.
Vincent Koc