1017 Commits

Include renames

Author	SHA1	Message	Date
Rounak DattaandClaude Opus 5	e1e7dc5bd8	fix(terminal): Ark0N's read of the #464 geometry work ... Five items, two of which he could only see by running it, plus six smaller ones. Taking the two blockers first, because both were wrong in ways the existing tests could not catch. **Adopting the PTY's rows put the CLI's input line off-screen.** A phone that took a desktop's 43 rows into a viewport with room for 18 painted an `.xterm-screen` far taller than its container; xterm's own viewport then had nothing to scroll, so the bottom of the frame sat below the container with no gesture able to reach it. Output visible, typing invisible, for as long as the desktop kept the claim hot. `reconcilePtyGeometry` adopts COLUMNS ONLY now: width is the axis Ink's wrap and `eraseLines` arithmetic depend on, and keeping the local row count keeps the composer at the bottom of a viewport that scrolls. Measured at his geometry — a 360x300 container against a 198x43 pane now keeps 13 rows, takes 198 columns, paints 202px into a 210px container, and the input line is inside the box. **`capture-geometry-retry.browser.test.ts` failed, and CI could not see it** because the file is in `BROWSER_TEST_GLOBS`. Its premise WAS the clamp — `getTerminalDimensions()` floored while `fitAddon.fit()` did not — which this work removes at the source, so it can never hold again at any viewport. The case survives on its own terms: a pane already drawing at the requested size must not be replayed. Its premise is now the #464 invariant itself, that the floored report and the terminal agree, which is a stronger guard because the clamp coming back fails it here rather than silently restoring the replay loop. The helper docblock that repeated the old premise is corrected too. **A session with no pane reported 120x40 and the client adopted it.** `resize()` writes `_ptyCols`/`_ptyRows` only when `ptyProcess` is set and nothing seeds them from the spawn geometry, so a dead-pane session still held the constructor defaults — clicking that tab resized the browser terminal to 120x40 and, on anything narrower, claimed another device owned the pane when none existed. `Session.ptyGeometry` returns null without a pane, the HTTP route answers `{}` and the socket sends no frame at all. The raw `ptyCols`/`ptyRows` getters are deleted rather than left available to be misused again. **The 40-column floor clipped the pane with nothing able to reach it.** The affordance keyed on a PTY mismatch, and the floor produces no mismatch — xterm and the PTY agree throughout, the terminal is simply wider than the box. It keys on what does not FIT now, MEASURED (`.xterm-screen` against the container, on the next frame, because the screen takes its width with the render) rather than derived from cell arithmetic. Measured at 360px: font 24 applies 40 columns and paints 560px, and all 200px of the overhang is reachable. `.pty-oversized` is renamed `.term-overflows-x`, because after this the old name describes only one of the two causes. **"Scroll sideways" did not work on touch for the sessions it targets.** `touch-action: pan-x` is cancelled before it starts by the `preventDefault()` `touchstart` calls on every 'content' tap. The terminal's own touchmove handler pans the container now, with the axis locked once per gesture so a diagonal cannot pan and scroll at once, and the CSS grants no `touch-action` at all — handing the browser a pan AS WELL would move the pane twice for one finger on the taps where that preventDefault does not run. Measured under real touch dispatch: a 140px swipe reaches `scrollLeft` 140 where it reached 0 before, the buffer does not move with it, and a vertical swipe still scrolls the scrollback. Three defects in the above, found while checking it rather than by being told: - `canPanHorizontally` first tested `scrollWidth > clientWidth` alone, which is true of a container that is not a scroller — a sideways swipe would have locked the axis, done nothing, AND suppressed the vertical scroll it should have been. Gated on the class as well. - The notice advised scrolling sideways whenever the PTY was wider, including when it still fitted and nothing scrolled. It is gated on measured overflow, and on a comparison against the width this container WOULD request rather than the one it currently holds — once adopted those are equal, so the second question answers itself false while the condition is still true. - `_syncTerminalOverflowAffordance` could throw out of `document.getElementById` before reaching its try block. It runs off every geometry change, so a cosmetic affordance could have taken the resize down with it. The smaller items: - `docs/architecture-invariants.md` no longer explains the equality guard as a clamp signature; it records what the clamp used to do and why it cannot any more. Edited by hand — that file is outside the Prettier glob, and letting Prettier near it rewrote eleven unrelated emphasis markers. - `throttledResize`'s HTTP fallback reads the reply. It is the path where a declined resize is least likely to be noticed, because no socket means no `{"t":"zc"}` frame either. - The changeset covers the whole release: the geometry work, the queued replay clear, the renderer watchdog, the body-covering fetch deadline, the WebSocket output-gap reconcile, the build-generated service-worker precache and per-build cache key, and the crash-trail hygiene. - `@xterm/headless` is declared in the root devDependencies instead of being reached through workspace hoisting. - The output-gap marker is cleared after any response arrives, not only when the capture was non-empty: a server that answers with an empty capture HAS reconciled us, and leaving the marker set refetched on every reconnect. - `e587d845`'s message claimed a test asserted the failed-load copy against the built asset. It did not — that assertion lived in a probe deleted with the other scratch scripts, so the claim was false when it was written. There is a real test now, and it reads the source rather than `dist/`, because `dist/` is not committed and a test that skips when it is absent would pass for the wrong reason in CI. `Session.ptyGeometry` gets behavioural coverage against the real class in `session-resize-arbitration.test.ts` rather than a source guard, including the contrast — a pane that does exist still reports, and still follows a resize — so "always null" would fail it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-22 18:53:46 +05:30
Michael GrundbergandClaude Opus 5	ce80b7a212	feat(terminal): take the transcript gutter off a copy, at the width the CLI declares ... Copying a paragraph out of a Claude Code or Codex pane puts that pane's own two-column transcript gutter on the clipboard, so every pasted line arrives indented. #451 shipped the trailing half of the copy clean and left the leading half out, because deriving the width from the selection fires on 73% of ordinary indented text and cannot tell a margin from content. The width is DECLARED rather than derived. `capabilities.transcriptGutter` on the CLI registry is a bounded integer; claude and codex each declare 2, measured on live panes, and no other stock entry declares any, so a CLI whose transcript layout nobody has measured is never touched. The server publishes the map as `window.__codemanTranscriptGutter`, built by filtering `enabledClis()` on the capability rather than by listing ids, and `_activeCliGutterColumns()` looks the active session's mode up in it. The copy path reads no terminal buffer at all. The declared width is a CEILING, not the answer: `clean()` strips the lesser of it and the run every selected line shares. A block can therefore only shift as a unit, the structure inside a selection survives by construction, and a selection reaching column 0 loses nothing. That is what keeps a `git log` body at its own four-space indent inside an agent's two-column gutter. Codex was measured separately, because it renders nothing like Claude: it draws boxes narrower than the pane and pushes its transcript into ordinary scrollback. On a live 0.154.0 answer its `•`/`›`/`⚠` markers sit in the gutter, prose continuations sit at 2, and a nested YAML block the model wrote rendered at 2/4/6/8 for its own 0/2/4/6. Replayed at 100, 120, 160, 198, 235 and 282 columns its indents were 0, 2, 4, 6 and 8 at every one, never 1. Copying that YAML out of a live Codex pane now yields 0/2/4/6: gutter gone, nesting intact. Two derived versions were built and measured first, and both are recorded in the code because both looked correct: - Painted trailing padding — a full-screen TUI writes real spaces across the unused part of a row, a shell leaves them never-written for xterm to trim — has no false positives and never over-stripped. It is also a function of pane WIDTH: the padding exists only while a rendered line stops short of the CLI's own layout width, and Claude's prose wraps to fill it. Dragging the same two prose rows of one live transcript at five window sizes, the share of padded rows ran 44%, 6%, 6%, 7% and 87% at 123, 160, 198, 235 and 298 columns, so the strip silently did nothing at every ordinary size while a corpus captured entirely at 282 columns said it worked. - Taking the narrowest indent on the rows around the selection fires at every width and over-strips about 1% of selections, because a file listing inside the transcript can be the narrowest thing on screen. Measured over 1,392,281 selections — every 1, 2, 3, 5, 10 and 20-row window of real Claude screens replayed from live PTY streams at 100, 120, 160, 198, 235 and 282 columns — the declared width over-strips none, breaks no relative indent and alters no text, and serves 100% of the selections whose own indent covers the gutter. Verified end to end in a browser with a real mouse drag and a real Ctrl+C: Claude and Codex panes paste flush at 123, 198 and 298 columns, a shell pane is untouched at every one. The strip sits behind `copyStripMargin` (App Settings, Selection & clipboard), per-device and default ON: a display key, absent from the .strict() SettingsUpdateSchema, read as `!== false` because the desktop branch of getDefaultSettings() returns {}. The toggle is checked before the map. Two review findings from #451, handled: - The mid-row flag governs ONE line now. `range.start.x > 0` excludes only the first selected line, the one whose margin the mousedown genuinely cut off, so the same three rows no longer produce three different clipboard results. - The reversed-drag finding does not reproduce on the pinned xterm. `getSelectionPosition()` reads `_selectionService.selectionStart`, whose getter returns `SelectionModel.finalSelectionStart`, and that swaps the pair when `areSelectionValuesReversed()` says so. A real upward mouse drag through chromium against xterm 6.0 reports the same range as the downward drag. `_normalisedSelectionRange()` keeps the ordering as a guard, because the model one layer down exposes the unnormalised fields under the same two names. Tests: test/terminal-copy-clean.test.ts (64, up from 31), plus the injected script stripped in test/server-index-title.test.ts. Every guard is pinned: removing any one of seven reds at least one test, including declaring the wrong gutter width. Full suite green, 7,861 passed, 0 failed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-22 13:33:50 +02:00
Rounak DattaandClaude Opus 5	d9fa9ba1eb	test(terminal): follow the existing suites to the one geometry owner ... The gate caught fourteen failures the focused tests could not: every harness that builds a partial app out of cherry-picked mixin methods, and every source guard that named `fitAddon.fit()` by hand. Most are wiring — `syncTerminalGeometry`, `_refitAfterCellSizeChange` and `_resizeTerminalTo` added to the fakes so the real chain runs rather than a stub of it. `file-browser-search` is the one that shows why it matters: without the method on the fake, selectSession's unconditional call threw into its own catch and every later assertion in the file measured a load that never happened. Two are not wiring. `detached-session-pane-sizing` pinned the behaviour this change deliberately reverses. It asserted the LOCAL fit still runs for a session owned by its own window — "withhold the send, never the reflow" — so the assertion is restated rather than patched, with the reason beside it and in the file's docblock: a reflow the PTY is never told about leaves this xterm rendering a CLI's frames against a shape that does not exist, and the popup that owns the pane is drawing for its own width regardless. The old rule bought a garbled frame, not a correct one. `mobile-prompt-composer` sliced `_cleanupSessionData` as a fixed 1200-character window, so the assertion depended on how much unrelated code sat above the line it cared about. It reads the whole method now. `terminal-scroll-intent` records `syncTerminalGeometry` rather than `fit`, under its own name: recording a bare fit there would name the very thing the subject was changed to stop doing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-22 13:22:28 +05:30
Rounak DattaandClaude Opus 5	abf1d1f1ca	fix(terminal): the PTY and the browser terminal must never disagree about size ... Issue #464, "text gets muffled sometimes, in both TUI default and fullscreen". The screenshot is not a dropped frame or a frozen renderer — it is arithmetic. Claude Code's TUI wraps its frame at the width the PTY reported and erases the previous frame by walking the cursor up the rows it believes that frame took. A browser terminal of a different width makes each logical line occupy more physical rows than Ink counted, so `eraseLines(n)` clears too few and the new frame paints over rows nothing erased: doubled lines, and short tool summaries sitting inside longer prose rows with the prose's tail still visible. Reproduced against this repo's own xterm before changing anything — a 120-column PTY against a 62-column terminal renders every wrapped line twice. `test/ terminal-pty-geometry.test.ts` pins that, and pins the clean render at matching widths beside it, so the assertion cannot be satisfied by code that fixes nothing. Four ways the two drifted apart, none of them observable from either end: 1. `fitAddon.fit()` resizes xterm to `proposeDimensions()` RAW while every server-facing path reported those floored at 40x10. Measured in Chrome at 430px: font size 44 proposed 13 columns, the server was told 40, and xterm stayed at 13. Three call sites each did their own fit-then-floor, and two re-read the proposal after the fit — `_shrinkPaddingToFit()` runs exactly there, so the container had moved. 2. `throttledResize` (keyboard up) and `sendResize` (session detached into its own window) reflowed locally and withheld only the SIGWINCH. That is the one combination that cannot be right: a reflow nothing is rendering for buys nothing and costs correctness. Both now withhold everything, and the keyboard's settle timer still sends the one resize that stops the PTY going stale. 3. `setFontSize`/`setFontFamily`/`setFontWeight` move the cell size — a geometry change — and told the server nothing at all, so raising the font on a phone left the CLI wrapping at the old column count. 4. `Session.resize` DECLINES a small-viewport request while a desktop connection holds an active sizing claim, and said nothing, because resize was write-only. `syncTerminalGeometry()` is now the one function that may change the terminal's size: it fits, floors and applies as a single step, so the numbers xterm holds are the numbers the server is told. A test sweeps every module for a bare `fit()` on the main terminal, and finds exactly one — the owner's own. For (4) the client cannot win, so it is told the truth instead: both transports answer a resize with `session.ptyCols`/`ptyRows` (`{"t":"zc"}` on the socket, the body of the resize POST) and `_onPtyGeometryReport` adopts them. A terminal that keeps a shape the PTY refused does not render "too narrow", it renders garbled. Adopting can leave the pane wider than the screen and the container is `overflow: hidden`, so `.pty-oversized` grants horizontal reach for exactly as long as the mismatch lasts: correct-and-reachable beats correct-and-clipped beats garbled. That rule sets both overflow axes and its own `touch-action` because mobile.css loads later and sets `.terminal-container { overflow: visible; touch-action: none }` — a bare `overflow-x` would leave overflow-y computing to `auto` and hand the browser a vertical scroll container the terminal's touch handler knows nothing about. Verified in Chrome at 430px against a live server, with a desktop client holding the claim: the phone adopts 198x43, gets `overflow-x: auto` / `overflow-y: hidden` / `touch-action: pan-x`, 758px of reach to the right, and keeps its own vertical scrolling. The pre-fix build was measured in the same harness for the control. Two things this deliberately does not do. It does not change who owns the pane size — the desktop still wins, and `_startMobileResizeRetry` still takes it back once that goes idle. And `throttledResize` still holds the PTY's shape for the whole keyboard animation rather than sending a SIGWINCH per step; that decision predates this and was not re-tested here. Also in this commit, Ark0N's third-pass review items on #431: - The response viewer's byte-buffer fallback and `_onSessionClearTerminal` both used the no-param `/terminal` form, capped only by `terminalBufferMaxBytes` (32MB) — the largest body the frontend asks for anywhere. One carried no deadline at all and the other got the 15s tail budget. Both now take the full-history budget. - A `?full=1` capture that outruns its deadline falls back to the bounded tail. The pane is blanked before that fetch, so an abort used to leave a black rectangle, discard the queued live output and never reach `_connectWs`. A failed load now still opens the socket, says one dim line where the content would have been, and clears the tab's spinner — which nothing did, so a failed select left `aria-busy="true"` set forever. - `_wsOutputGapSession` is cleared at the repaint that settles it, not in a `finally` that also ran on the catch. A reconcile that threw, or hit the new deadline — the flaky link the marker exists for — dropped the gap with nothing to retry it. `ws.onopen` no longer clears it up front either. - The replay-clear invariant is pinned in the gate, which is the drift this PR exists to fix: `_resetTerminalForReplay` must be a queued write and nothing else, and no module may blank the terminal with a `clear()+reset()` pair. - `DIAG_ENTRY_MAX_CHARS` replaces the hardcoded 300, bound through a local first: `CodemanDiag?.x` still throws a ReferenceError when the identifier was never declared, and that is the one function in the app that must not throw. - panels-ui's two kill-all clears route through the same helper, and the xterm-version guard's comment says "resolved lockfile version" rather than "dependency RANGE", which is what it has pinned since the last round. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-22 13:07:33 +05:30
Michael GrundbergandClaude Opus 5	90fd0a5a15	fix(tmux): gate the pane-exit read, and mute the dot on the rich rail too ... Four changes the maintainer asked for on Ark0N/Codeman#446 before merging. The pane-exit watcher stays always-on, but a tick now costs nothing when there is nothing to observe. `hasObservablePaneSession()` skips the tmux exec while every session on the manager is one of the shapes `Session.paneExitApplies` already forces to UNKNOWN: a remote SSH session (its local pane holds the ssh client), a docker case (a `docker exec` into the container's own tmux), and a record rebuilt from the socket (no provenance at all). The timer is untouched. Skipping retracts nothing, for the same reason a failed read does not: the map still holds the last real reading, and every path that puts a new command in a pane calls `clearPaneExit()` itself. The two copies of that rule are pinned against each other in `test/session-pane-exit.test.ts`, because drift between them is silent in both directions. `DEFAULT_PANE_EXIT_INTERVAL_MS` was already a constant beside the stats and remote-reconnect intervals; its comment now says why the watcher owns its own cadence and why the number is what it is. The never-default-an-absent-status rule is written where `PaneExit` is declared. It names `status ?? 0` as the thing never to write, and says that an agent the OOM killer took would otherwise read as a user typing `/exit` — which is what absent-stays-absent keeps a later clean-exit sweep away from. Nothing fails when somebody adds that `??`, which is why the sentence is there rather than a test. Checking the dot's specificity found a second fight, and it was losing. On the tab strip the alert rules win as intended: a session that exits with a permission dialog pending still renders red, and yellow for an idle alert. On the rich vertical tab rail they did not — that rail's own `tab-state-*` dot rules are (0,9,1) against the strip's mute at (0,5,0), so an exited session there kept a full green dot AND the working halo beside a badge reading "exited". The rail twin matches that specificity exactly and therefore must stay below those rules in source order; it clears the halo as well, which the strip's rule never had to think about. `test/session-pane-exit-ui.test.ts` now resolves the real stylesheet in jsdom rather than matching selector text: postcss collects every rule that paints `.tab-status`, a real engine decides, and the tests read back the answer. Two mutations were run against it to prove it has teeth — dropping the hand-written alert exclusions fails three cases, and moving the rail twin above the state rules fails one. Refs Ark0N/Codeman#446. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-22 09:19:55 +02:00
Michael GrundbergandClaude Opus 5	64c288a683	feat(codex): read Codex's own background-terminal row ... Codex states background work too, and it says so in a different place. Claude writes `· 1 monitor ·` on the last row of the screen; Codex pins `1 background terminal running · /ps to view · /stop to close` ABOVE its composer, which puts that row third from the bottom once the status line and the composer are counted. So how far up the screen to look is now per-CLI data as well: `capabilities.workDetect.watchingLines`, bounded to 1..8 by the schema, and defaulting to Claude's two. That bound is the point. The window is half the injection guard, since every row it adds is another row the agent itself may be able to write, and the label is what silences an idle alert. The other half is the anchor, and Codex's is ` · /ps to view`: chrome naming a slash command only the CLI can offer, so a session that writes "I left 1 background terminal running for you" into its own output matches nothing. Measured against a live codex-cli 0.154.0 pane rather than read out of a binary. The row appears when the terminal starts, follows the composer down as the conversation grows, and is gone after `/stop`. Verified end to end on an isolated beta: the session payload carried `watching: "1 background terminal"` and the badge rendered with it, and both cleared when the terminal stopped. The fixtures in the tests are that capture verbatim. Codex has no hook signals, so no idle prompt and no false NEEDS YOU row: for a Codex session this is the badge alone, which is the case the maintainer said a registry field could cover and a hook never could. Cross-CLI tests pin that neither pattern fires on the other's screen, and that a CLI declaring nothing still reports nothing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-22 08:58:52 +02:00
Rounak DattaandClaude Opus 5	abd39318e6	fix(terminal): deadline must cover the body, precache must ignore the cache-bust query ... Review fixes. Two of these are defects in the previous commit. 1. The fetch deadline only covered time-to-headers. `await fetch()` settles on response headers, so clearing the abort timer in a finally around it left the body — the multi-megabyte `?full=1` capture the deadline exists for — completely unbounded; it only ever bounded a server that accepts a connection and never replies. Measured against a server that sends headers immediately and stalls the body 4s under a 1s deadline: fetch resolved at 30ms, timer cleared there, body completed at 4026ms unaborted. Now the body is read inside `_fetchTerminalCapture`, which returns {json, headers, headersAt} — headers because two callers read server-timing, headersAt because those same callers measure header-vs-body time and can no longer observe that moment. `_terminalCaptureInflight` is scoped the same way, so a body still streaming counts toward a capture starting beside it. Same test now aborts at 1005ms. 2. The precache could never be hit, and the previous commit made that expensive rather than free. `renderIndexHtml` runs `cacheBustAssets`, which appends `?v=<mtime>` to every same-origin .js/.css reference INCLUDING content-hashed names — confirmed against a running instance: `vendor/xterm-zerolag-input.6fee72f2.js?v=1789402869101`. `caches.match` is query-sensitive, so entries keyed on the bare hashed path were unreachable; deriving the list from the manifest turned cheap 404s into ~1.3MB downloaded at every install that nothing could read back, once per deploy now that CACHE_NAME rotates. The fallback match takes `{ ignoreSearch: true }`, which also lets runtime-cached entries survive an mtime change. 3. `_wsOutputGapSession` was only cleared in ws.onopen, so paths that already repaint the buffer left it set and the socket replayed everything a second time. `selectSession` loads the buffer and only THEN calls `_connectWs`, so neither the _isLoadingBuffer nor the _terminalRefreshOwner guard applied. `_markTerminalBufferReconciled()` is now called from _onSessionNeedsRefresh's finally, from selectSession after its load, and from _cleanupSessionData. The scope claim was also wrong and is corrected in the comment: when the network drops, SSE drops with it and handleInit's keepTerminal branch already reconciles. The genuinely uncovered case is the WS dying while SSE stays up, where _onSSETerminal discards SSE terminal frames until _wsReady flips in onclose — up to the ping+pong window of output nothing writes. 4. CLAUDE.md said "all of them measured rather than reasoned", which the PR's own "not verified" section contradicted. Split explicitly: the replay race is measured, the watchdog mechanism is verified against xterm 6.0.0 under jsdom (field path resolves, a forced stale handle makes refreshRows a no-op, the kick schedules a fresh frame), and the iOS rAF-discard premise is reasoned and still wants a device. Adds the two missing entries — the WebSocket reconcile and the sw.js/build.mjs "keep these in sync or the build throws" contract. Also: test/xterm-private-api.test.ts pins the RESOLVED lockfile version instead of the declared `^6.0.0` range, which was the wrong assertion in both directions — a real upgrade to 6.4.0 can rename a private field while resolving inside the range, and an innocuous range edit failed while changing nothing installed. And test/sw-precache-manifest.test.ts now parses HASHABLE out of scripts/build.mjs rather than hand-copying it, which was the same drift this PR exists to fix; the parse is guarded against silently matching nothing. The deadline fix has a behavioural test against a real socket plus a source guard asserting `await res.json()` precedes the finally — verified to fail when the helper is reverted to the old shape, so it is not vacuous. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-22 12:25:36 +05:30
Rounak DattaandClaude Opus 5	c0422c4e21	feat(terminal): renderer watchdog, atomic replay clear, fetch deadlines, reconnect recovery ... Four ways the terminal can silently stop being correct — in each case the buffer keeps updating, nothing throws, and the only recourse is a reload. 1. Renderer freeze after backgrounding. iOS DISCARDS scheduled rAF callbacks when a PWA backgrounds, and xterm's RenderDebouncer only clears its `_animationFrame` handle from inside that callback — so one drop leaves it permanently set and every later refresh() early-returns. Parsing is decoupled from rendering, so bytes keep filling the buffer correctly while nothing paints. Codeman has exactly ONE xterm for the whole page load, so a single backgrounding wedges it until a reload. Adds a 2s liveness poll and `_kickRenderer()`, which does what the dropped `_innerRefresh` would have. 2. Replay clears raced live output. xterm's write() is async-queued while reset() is synchronous and, per upstream, "does not clear input buffers and does not reset the parser" — so bytes queued before a reset are parsed after it and fuse into the snapshot. Verified against the real xterm 6 here: write('p8'); reset(); write('rmissions') renders "p8rmissions". The main path was already safe via a queued erase; the needsRefresh and clearTerminal paths were not. All three now share one queued `\x1bc` (RIS), which unlike 3J/H/2J also resets modes, charsets, scroll regions and SGR state. 3. Output lost on WebSocket reconnect. Input frames carry seq+cid and are delivered exactly once; output frames carry nothing. ws.onopen re-sends dims and flushes queued input, and needsRefresh only fires on external-CLI startup and SSE backpressure drain — never on reconnect. Output produced while offline was simply absent afterwards. Interim fix: reaching onclose means the drop was unintentional, so the session is marked and the next open reconciles from the server buffer. Sequencing output is the follow-up. 4. Terminal captures had no deadline. No AbortController anywhere in the frontend, including `?full=1`, which the code itself calls "unbounded-ish work: at the default history limit it can be megabytes". Adds a budget that scales with full-vs-tail and with captures in flight, degrading to a plain fetch where AbortController is missing. Also: the service-worker precache was dead — the build content-hashes assets but sw.js listed pre-hash names, so 15 of 23 entries 404'd (verified against a running instance) and cache.add().catch() hid it. Offline still worked via runtime caching, but CACHE_NAME was a constant so activate's cleanup never deleted anything and every past release's assets accumulated. Both are now derived from the build manifest. Crash-trail entries are flattened and capped, since they are joined with \n into one value and one call site interpolates a server-controlled WS close reason. The watchdog reads xterm privates — there is no public API. Every access is optional-chained so a shape change degrades to a no-op. `_renderService` only exists after open(), which needs a real DOM, so the gate cannot assert the field path; test/xterm-private-api.test.ts pins the dependency range instead. Tests: 23 new (terminal-resilience, sw-precache-manifest, xterm-private-api), all pure/static so they run in the gate, which excludes the mobile suite. One static source guard in history-truncation-notice updated for the renamed call; the behaviour it pins is unchanged. Not verified: no browser available, so no runtime reproduction of the freeze and no real-device test of the reconnect path. Both warrant a device pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-22 12:24:52 +05:30
Michael GrundbergandClaude Opus 5	74884a20eb	feat(approvals): let a watching session keep quiet, and fix the tui gate ... The badge alone left the row in NEEDS YOU, which is the thing the issue was about. The fix is the alert that does not fire. An idle prompt from a session that is watching its own background work now opens ALREADY acknowledged. `hook-event-routes` passes `Session.watching` to `notePrompt()`, which sets `acknowledgedAt` and records why in a new `acknowledgedReason`. Nothing new suppresses anything: `acknowledge()` has always meant "the alert this prompt armed is spent", and the prompt itself stays pending, answerable and available as Read My Mind context. A wrong label therefore costs a card that does not blink, never an alert that was never created. Every surface follows from that. The broadcast carries the reason, so a live page declines to arm the tab alert and raises no desktop notification. The push is skipped, since a false alarm is hardest to ignore on a phone. A reloading page reads `acknowledgedAt` in `seedApprovals()`, which it already did. And `classifySession()` now reads it too, which is a pre-existing bug fixed here: acknowledging on one device cleared the alert everywhere except `codeman tui`. It re-arms for free, because the next idle prompt supersedes the item and is built fresh. Only `idle` is eligible, so a dialog that blocks the agent still goes red whatever else it started. The label is pane-derived and therefore prompt-injectable, so it is now read from the last two rows of the screen only, with Claude's pattern anchored on the `·` its footer joins items with, ANSI-stripped and length-capped at the source. An agent that prints `· 1 monitor ·` into its own output finds no match. Verified on an isolated beta: a session that armed a monitor took its idle prompt acknowledged with no alert on any surface, wore the badge, and showed "quiet, watching 1 monitor" on its still-answerable card; the same session with the monitor killed alerted normally on the next prompt. `test/watching-no-alert.test.ts` pins both directions across all four surfaces. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-22 08:10:05 +02:00
Michael GrundbergandClaude Opus 5	1cb0441bd8	fix(session): degrade the resume pin to the session id, not to nothing ... A single pin that failed its transcript gate returned the options untouched, so `resumeSessionId` fell back to `_resumeSessionId` — undefined for an ordinary session — and the renderer emitted the bare `claude --dangerously-skip-permissions --session-id "<this.id>"`. Every session prompted before its first `/clear` owns a transcript under that id, so the dropped pin handed back exactly the refusal this branch removes, with no `||` branch to catch it. It was also a regression against master on the `restartCli()` path, which pinned `_claudeSessionId ?? this.id` and, since the constructor seeds that field, could never land unpinned. The pin now walks three candidates in priority order — the conversation chain's tail, the launch seed, then the session's own id — and takes the first one a transcript backs. A candidate that misses is passed over rather than ending the walk. Falling off the end pins nothing, which also settles the second half of the problem: the old code skipped the transcript check whenever the pin was the session's own id, so a genuinely new pane rendered the two-branch form after all. That costs a brand-new session claude's "No conversation found" line in its scrollback, and `wrapWithNice()` prefixes only the first branch of the rendered `a || b`, so the branch that actually runs loses its priority for the life of the session. With no transcript anywhere the bare `--session-id` is the correct command, so the comment claiming an unchanged shape is now true. The transcript lookup reads the server process's own `CLAUDE_CONFIG_DIR` when a session declares none. A pane inherits the server environment through tmux, so on an install that exports it the CLI writes its transcripts there and every lookup under `~/.claude` was a false negative — which under the old code meant the colliding command. `claudeCredentialsPath()` and `realClaudeConfigDir()` resolve the same directory the same way. The header sentence calling a skipped resume "the safe direction" described the opposite of what happens at this call site, and says so now. The create-path fallback writes `_resumeSessionId` alongside the create options. That branch leaves `isRestored` false, so `_claudeSessionId` is recomputed from the launch fields and settled on `this.id` while the CLI resumed the chain tail; the response viewer, Read My Mind and the unified-list alias map read that field until the next first-hand hook. Four new tests: a chain tail with no transcript while the session id has one, no transcript anywhere, the create path's alias, and the process-env lookup. All four fail against the previous commit. Two existing tests move with the gate — the guess-refusal test now backs the session's own id, and the custom-model restart test gives its working pane the transcript that makes `--session-id` collide in the first place, alongside a new one pinning the no-transcript case. CLAUDE.md described the pin as a `restartCli()`-only thing sourced from the live conversation id. All three halves of that moved here. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-21 18:21:21 +02:00
Michael GrundbergandClaude Opus 5	3f2cde2db7	feat(session): say when a session is watching its own background work ... An agent that arms a monitor, backgrounds a shell or hands a task to a cloud session is told to end its turn. The pane then falls quiet, Claude Code's idle_prompt notification arrives a minute later, and every surface files the session under NEEDS YOU with nothing for a human to answer. Claude states what it is still running on the last row of its screen (`⏵⏵ bypass permissions on · 1 monitor · ← for agents`). That row is now `capabilities.workDetect.watchingLine` in the CLI registry, guarded by compileVersionRegex() like every other config regex, and the idle probe reads it off the capture it already takes: `watchingLabel()` in session-activity.ts searches the last five lines only, so a session that PRINTS "1 monitor" is not mistaken for one running it. The label lands on Session.watching and rides toLightDetailedState() out to every surface. The phone overview, the desktop home rail and the rich sidebar rows wear it as a `watching` badge in the accent colour, beside the state pill and never in place of it: an agent can arm a monitor and ask a question in the same breath, and only the pill says which. Verified end to end against a throwaway session on an isolated beta instance: the payload carried `watching: "1 monitor"` once the turn ended, the badge rendered next to a yellow `waiting` pill, and both cleared when the monitor died. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-21 18:00:30 +02:00
Michael GrundbergandClaude Opus 5	47e7935274	fix(session): resume the conversation when respawning a dead pane ... A CLI that launches with `--session-id <id>` refuses an id that is already in use (claude: `Error: Session ID ... is already in use.`), and every session whose agent has been prompted owns a transcript under that id. The dead-pane respawn in `_setupOrAttachMuxSession()` passed the bare launch line, so recovering such a session relaunched a CLI that died on startup, the pane went dead again at once, and the conversation was stranded behind a tab that looked merely idle. `restartCli()` has pinned a resume id against this since the custom-model work, and its comment states the assumption that made the other path look safe: "Unlike the dead-pane respawn, this one kills a WORKING pane whose conversation already has a transcript". A pane whose agent exited has a transcript too. Both relaunch paths now build options through `_buildRespawnPaneOptionsWithResumePin()`, and so does the create-path fallback after a failed respawn, which otherwise met the same refusal that made it the fallback. Four gates guard the pin, each standing for a way of resuming the WRONG conversation or of making a working relaunch fail. A remote or docker session is never pinned. Unlike `restartCli()`, whose route refuses both, the dead-pane respawn is reached by every session shape. Their pane commands already render a self-healing `--session-id || --resume`, and both flip to resume-first once the resume id differs; the conversation lives on the far side, so a local id resolves to nothing there and the `--session-id` fallback then collides with the transcript the far side does hold. The id comes from the conversation CHAIN rather than `_claudeSessionId`, which also holds history-correlated guesses keyed on the working directory. `_recordClaudeSessionInChain()` refuses those so they cannot "write a foreign conversation into this pane's permanent record", and launching from one is worse than the display bug that rule prevents. The chain tail also outranks the launch seed, which is written once at construction and never moves off a `/clear`. A pin no transcript backs is dropped, because the fallback branch keeps `--session-id <this.id>` and would collide. A synthetic `restored-<fragment>` id from socket discovery is dropped too, and logged: it fails claude's `uuid` token pattern, so the renderer would emit the unpinned command while the caller believed otherwise. Tests cover each gate and the rendered command. Four of them fail against the unfixed source; the remote and docker ones were separately checked against a build with only that guard removed, since they pass on master for the wrong reason. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-21 15:36:17 +02:00
DevvynandClaude Sonnet 5	a2dcc91ddf	fix(docker): add and correct the cross-checkout collision guard for Update-Codeman.sh ... Same guard as Start-Codeman.sh's own (docs/docker-self-update.md-adjacent incident, 2026-09-21): docker-compose.yaml hard-codes `name: codeman`, so a second checkout run without COMPOSE_PROJECT_NAME resolves to the SAME Compose project as any other checkout on the host. It has to live here too, not just in Start-Codeman.sh: this script's own --no-cache build and its `down`/`down --volumes` both run BEFORE the handoff at the bottom of the file, so Start-Codeman.sh's copy of the guard would only fire after this script's own destructive calls already ran — and its default `down --volumes` is more destructive than Start-Codeman.sh's own targeted refresh, clearing every named volume the resolved project has. Also fixes a real bug the same guard shipped with: under `set -o pipefail`, `grep -v` legitimately exits 1 when nothing survives the filter (the ordinary, no-collision case), and without `|| true` on the pipeline that non-zero status propagates through the command substitution and `set -e` aborts the WHOLE script at the guard — every time, collision or not. Caught only by actually executing the guard end-to-end against a stub `docker` (the existing smoke-test harness), never by a static text/regex check on the source; the stub's `config --format json` response was also fixed to pretty-print like real Compose does, since a compact one-liner silently resolved project_name to empty and exercised neither script's guard the way production output does. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GuHtuPiHXdykq9T6rKQJ9n	2026-09-21 21:23:39 +08:00
Michael GrundbergandClaude Opus 5	c67c130caa	feat(web): mark a session tab whose agent has exited ... The tab now reads "exited (137)" beside the session name, drawn from the `paneExit` field the server publishes. `applyPaneExitBadge()` owns the DOM work, called from the incremental render path — the only path a live session ever takes, since going from live to exited adds and removes no tab and so never reaches the full rebuild. An unknown answer draws nothing. A death tmux could not explain reads "exited" with no number rather than "exited (0)", so an unexplained death and a clean exit do not look alike. A signal death reads "exited (signal 9)". The badge carries `data-i18n-skip`, like the status pills: it is generated text, `i18n.js` walks inserted content, and a dictionary entry added later would fight the renderer, whose in-place comparison is against English. The tab also carries a `tab-agent-exited` class that mutes the status dot. That dot is drawn from `status`, which stays `idle` or `busy` for an exited pane as the issue requires, so without this a green or pulsing dot sits beside a badge saying the agent is gone — the first thing a tester asked about. `status` itself is untouched, so this is a rendering rule only. The CSS excludes the two alert classes by hand, following the convention the rich-rail dot rules document: a dot turning red or yellow because a session is blocked on a human outranks "the agent exited". The tab keeps its click behavior. X still closes it, and nothing here closes, sweeps or restarts anything. `docs/architecture-invariants.md` gains the mechanism under "Session data and lifecycle", where every comparable one already lives: what the tri-state means, the four shapes it is absent for, why the watcher cannot ride the stats collector, why an absent `#{pane_dead_status}` is not 0, and the three things that must never happen to an exited pane. Refs Ark0N/Codeman#446. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-21 10:52:15 +02:00
Michael GrundbergandClaude Opus 5	90a95f562b	feat(session): publish and persist a local pane's agent exit ... The mux layer now knows a pane's agent has exited. This puts it on the session record, where the board and, later, the reboot restore can see it. `SessionState.paneExit` carries `{ status?, signal?, at }` and rides the existing `session:updated` broadcast through `toState()`. No new SSE event. The server pulls each answer from `mux.getPaneExit()` rather than off a broadcast payload, so the raw reading never reaches a browser: for a remote or docker session that reading is the death of an ssh client or a `docker exec`, not of the agent. The field is tri-state, and the third state is its absence: `undefined` means Codeman does not know, and it never reads as alive. `Session.setPaneExit()` forces that unknown for every shape a dead local pane does not describe. A direct-PTY session owns no pane. A remote SSH session's local pane holds the ssh client, whose death means a transport drop OR an exit, which is the ambiguity PR #355 settled by not guessing. A docker case's local pane holds a `docker exec` into the container's own tmux. And a session rebuilt from the socket has no provenance at all: `reconcileSessions()` gives it a synthetic `restored-<fragment>` id that matches no `state.json` entry, so a remote session rediscovered after `mux-sessions.json` was lost arrives with no `remote` field and looks local — `MuxSession.discovered` marks it, and absent metadata there counts as unproven rather than as proof. The scoping lives on `Session` rather than in `TmuxManager` so there is one copy of the rule. `status` and `pid` are untouched. `status: 'error'` belongs to the PTY-exit circuit breaker and makes the browser offer a restart, and a null `pid` is what makes the browser re-attach and launch a fresh CLI. A reading that repeats the previous answer writes nothing and broadcasts nothing. An unknown answer never reads as alive, but a stale KNOWN one would keep reading as exited, so `clearPaneExitForNewPane()` retracts it on every path that puts a new command in the pane: the start/attach path, the `restartCli()` relaunch behind a custom-model switch, and the remote reattach. Without the second of those, switching an endpoint on an exited session launched a new command and then persisted and broadcast the old exit straight back onto it. `toState()` is also what `state.json` persists, so the record survives a reboot, which is the only thing that does: a reboot takes the tmux server, and with it every live signal and every `mux-sessions.json` entry. Nothing reads it there yet — making the restore refuse such a session is a behavior change that belongs with the part that closes them. Recovery threads the saved value back through the constructor so the first persist after boot cannot blank it. Refs Ark0N/Codeman#446. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-21 10:01:09 +02:00
Michael GrundbergandClaude Opus 5	02dc46dcd7	feat(tmux): report a dead pane's exit from the batched pane list ... Codeman creates every tmux pane with `remain-on-exit on`. When the agent exits, tmux keeps the pane, the tmux session, and the `tmux attach-session` process Codeman records as the session's pid, so no PTY exit handler fires and nothing writes the exit down. tmux itself knows: it marks the pane dead and reports the exit status. This reads that. `PANE_LIST_FORMAT` gains `#{pane_dead}`, `#{pane_dead_status}` and `#{pane_dead_signal}`, and `startPaneExitWatcher()` refreshes a muxName-to-observation map from ONE batched `tmux list-panes -a` per tick. Boot reconciliation already ran that same call, so it now fills the map too and recovery starts with a reading. The watcher owns its own interval rather than riding `startStatsCollection()`, which the issue suggested. That collector is armed when a browser opens the Monitor panel and DISARMED when it closes it, and boot skips it entirely unless recovery found a live session, so a session created on a freshly booted server would publish nothing and one browser could turn detection off for every other. Measured on an isolated instance: a dead pane with status 0 reported nothing until `POST /api/mux-sessions/stats/start` was called by hand. It is still one batched read per tick; only the timer changed. Three rules keep a positive answer trustworthy. A session answers only when tmux listed exactly one pane for it, because Codeman never splits a pane and a session the user split by hand has none that speaks for the agent. A pane answers only when `#{pane_dead}` said 1 or 0, because an empty field is a tmux that did not answer. An absent status stays absent rather than becoming 0: measured on tmux 3.2a, a SIGKILLed pane reports neither a status nor a signal, and calling that a clean exit would be wrong in the direction that matters. Two guards stop a slow read undoing a fast one. `EXEC_TIMEOUT_MS` is 5000 ms against a 2000 ms interval, so a read can outlive two ticks: one already in flight suppresses the next, and a generation counter that every `clearPaneExit()` bumps discards a read that started before a respawn or a kill. An observation also carries its pane pid, so a second command in the same pane that exits the same way starts a new timestamp rather than inheriting the first death's. A non-empty read of `list-panes -a` is authoritative for the whole socket, so sessions missing from it are pruned, which also bounds the map as tmux sessions come and go outside `killSession()`. A failed or empty read retracts nothing. The manager reports the raw pane reading and applies no session-shape scoping, because the remote-reconnect watcher beside it needs exactly that raw reading. `parsePaneList` becomes `parsePaneRows`, returning one row per pane instead of a name-to-pid map; reconciliation builds its map from the rows. The parser's existing cases carry over unchanged, including the launchd/systemd literal-tab regression from PR #71. Refs Ark0N/Codeman#446. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-21 10:00:54 +02:00
DevvynandClaude Sonnet 5	5b4878df3b	fix(docker): address Ark0N's PR review on Update-Codeman.sh — fix the handoff, the build/down ordering, and default-clear the build volumes ... Three blockers, all fixed and verified by actually running the script (not just string-matching it): 1. `exec "$script_dir/Start-Codeman.sh"` failed EACCES/exit 126 on every checkout, since Start-Codeman.sh is committed non-executable (100644) — the same fact my own second commit on this branch established. Fixed to `exec bash "$script_dir/Start-Codeman.sh"`. 2. `down` ran before `build --no-cache`, so Codeman and every session it was running were offline for the entire rebuild, and a build failure left the stack down with nothing to bring it back — the exact ordering mistake Start-Codeman.sh's own "Build BEFORE taking the stack down" comment exists to prevent. Reordered to build, then down, then hand off. 3. The default path could throw the rebuild away: codeman-node-modules/ codeman-dist only re-seed from the image while EMPTY, Start-Codeman.sh only clears them when it detects the checkout's HEAD or package-lock.json moved, and neither condition is true for the Dockerfile-only change this script exists for — so a plain `bash docker/Update-Codeman.sh` rebuilt an image whose fresh node_modules/dist then sat unused behind the old volumes. Made clearing them the default; `--keep-volumes` opts out (replaces the old `--volumes`/`-v` flag, which is no longer needed since clearing is now the default). Smaller items from the same review, also fixed: - The --no-cache build now derives PUID/PGID from CODEMAN_APPDATA_PATH's owner first, via the identical owner_of() helper Start-Codeman.sh uses (parity-tested) — without it, the build used Compose's default 1000:1000 regardless of the real appdata owner (99:100 on the Unraid layout docker/README.md documents), and Start-Codeman.sh's own correctly-PUID'd build during the handoff would then rebuild those layers anyway, so the --no-cache image never actually shipped. - docker/README.md's "rebuilds ... only when it detects ... moved" wrongly described BOTH the rebuild and the volume-clearing as conditional; Start-Codeman.sh rebuilds on every start, only the volume-clearing is conditional. Corrected, and reworded around the new default. - --help/-h now prints usage and exits 0 instead of falling into the unrecognised-argument branch. - "the ONLY named volumes this stack declares" now says docker-compose.yaml specifically, since a docker-compose.override.yml could add more. New tests: PUID/PGID derivation parity with Start-Codeman.sh's owner_of(), --help handling, and — the one that actually catches blocker #1, which five source-string-matching tests did not — a real end-to-end smoke test: a synthetic deployment, a stub `docker` on PATH logging every invocation, the real script executed via a real subprocess. Confirms the real command sequence (build --no-cache, then down --volumes or plain down, then evidence the handoff genuinely ran Start-Codeman.sh) and that a working handoff fails honestly at Start-Codeman.sh's own later check rather than with EACCES. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N6eadpRyqpA9PD3i139cSD	2026-09-21 15:19:00 +08:00
DevvynandClaude Sonnet 5	3b714446b4	fix(docker): drop the wrong executable-bit assertion for Update-Codeman.sh ... Start-Codeman.sh, its sibling and the script it hands off to, is itself committed non-executable (100644) upstream — it's documented and invoked as `bash docker/Start-Codeman.sh`, never `./docker/Start-Codeman.sh`. The "is executable" test I'd added for Update-Codeman.sh asserted the opposite convention, which the file correctly does not follow. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N6eadpRyqpA9PD3i139cSD	2026-09-21 13:58:45 +08:00
DevvynandClaude Sonnet 5	9ba90a674a	chore(docker): add Update-Codeman.sh for scripted major-update rebuilds ... docker/README.md and docs/docker-self-update.md both already point operators at "stop the stack, rebuild, restart" for anything the in-app updater refuses to apply (a changed server.Dockerfile, a changed docker-compose.yaml, or a new required .env key) — but that was a manual, hand-typed procedure with no script of its own, unlike every other start/update path this deployment has. docker/Update-Codeman.sh scripts it: `docker compose down`, then an unconditional `docker compose build --no-cache` (a major update should be certain of what actually ships, not reuse whatever layers happened to be cached), then hands off to the existing Start-Codeman.sh for the same careful PUID/PGID, override-file and fingerprint handling every other start already goes through — rather than reimplementing any of that by hand and risking it drifting out of step. An optional --volumes/-v flag also removes the codeman-node-modules/ codeman-dist named volumes, the scripted form of the "Resetting the build artefacts" procedure docs/docker-self-update.md already documents by hand. Safe: those two are the only named volumes this stack declares; application data and case workspaces are host bind mounts, never touched by `docker compose down` either way. Docs updated: a "Major updates" section in docker/README.md, and a pointer from docs/docker-self-update.md's existing "Resetting the build artefacts" troubleshooting entry. Tests: extended test/docker-entrypoint.test.ts (the existing home for Start-Codeman.sh's own static checks) with a bash -n parse check, the down-before-build-before-handoff ordering, the --volumes flag's effect, unrecognised-argument handling, and byte-for-byte agreement with Start-Codeman.sh's own override-file resolution logic (so `down` here and `up` there can never target different Compose files). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N6eadpRyqpA9PD3i139cSD	2026-09-21 13:57:54 +08:00
Codeman maintainer	299a21d5f5	fix(split-pane): merge-time fixes for split-pane sessions (#453) ... The maintainer's promised merge-time fixes from the final review of #453: 1. closeSplitPane() tears down a divider drag still in progress, so a split that collapses mid-drag no longer leaves body.split-pane-resizing (the page-wide col-resize cursor and user-select lock) set until a reload. 2. openSplitPane() re-applies the picker's own exclusions (detached session, pid === null, no session record) for a row that went stale while the menu sat open, refusing silently like its neighbouring gates. 3. architecture-invariants: the hard-hide of .btn-split is the @media (max-width: 1179px) rule in styles.css, not mobile.css. 4. SplitTerminalPane.destroy() nulls onclose (and onerror) beside onopen and onmessage. 5. Picker rows drop the data-session-id attribute nothing read. 6. The Pane-A-ends branch collapses with skipPrimaryResize, so the closing resize is no longer aimed at the session the server just removed. 7. The {t:'r'} refresh path is single-flight across the fetch and the chunked write, coalescing a mid-replay refresh into one trailing re-run. Tests: split-pane-auto-collapse-unit gains the drag-teardown, exclusion and skip-resize cases; the new split-pane-terminal-unit covers destroy() and the refresh single-flight. All were run against the pre-fix module to confirm they fail there. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> (cherry picked from commit dbd39aed015ae5ae5870aba398bf4b4ab5118e47)	2026-09-21 04:53:19 +02:00
Codeman maintainer	d8e85285c9	fix(mobile): merge-time fixes for the prompt composer (#444) ... - styles.css: restate the composer overlay's own bottom gutter after the fold rules (the generic .paste-overlay longhand erased it: 0px flat, hinge strip replacing it folded) and subtract the fold strip from the dialog's max-height - test/foldable-layout.test.ts: simulate the cascade for .paste-overlay.prompt-composer-overlay (fails without the CSS fix); pin the palette anchor by name instead of ELEMENTS.at(-1) - keyboard-accessory.js: guard the app global in refreshForActiveSession() like the rest of the file - keyboard-accessory.js: a whitespace-only draft is empty (Send no longer submits blank lines); the text still goes out untrimmed - keyboard-accessory.js: derive _composerMaxLength and the frame refusal from one 64 KiB frame limit minus both bracketed-paste markers so they cannot drift - keyboard-accessory.js: translate the textarea placeholder and label at build time, since the DOM translator skips <textarea> subtrees - i18n.js: zh-CN entries for the composer dialog copy - docs/wiki/Mobile-Guide.md: describe the Compose key instead of a clipboard key - CLAUDE.md: a "Mobile prompt composer" paragraph after the accessory bar one - test/mobile-prompt-composer.test.ts: pin the whitespace rule and the derived budget Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> (cherry picked from commit f6725ba52da17b0bdbee8be3b5011e7cae514f69)	2026-09-21 04:39:28 +02:00
Codeman maintainer	0f955327b2	fix(cli-registry): merge-time fixes for the run-menu consolidation (#458) ... - test/opencode-resize.test.ts: retarget the launcher guard at the real code (this.selectSession(firstSessionId), any this.activeSessionId assignment) with an anti-vacuity check; the old strings existed nowhere, so it could never fail - session-ui.js: restore as comments the two invariants the merged bodies lost (deepseek leaves statusReporting unset, i.e. ON; no effort field for external CLIs, it is Claude-specific) - docs/cli-registry.md: move the frontend-guard paragraph below the two backend-guard paragraphs so they keep their antecedent, and note the widened comparison shape - test/frontend-cli-no-id-branching.test.ts: the comparison shape accepts any left-hand identifier (const m = this._runMode; m === 'codex' was invisible), normalized to `mode`; the two `m !== 'shell'` display filters are allowlisted and the remaining blind spots documented - test/run-mode-dispatch.test.ts: table-driven pin of run() dispatch (claude to runClaude, each RUN_MODE_LAUNCH id to _runCliMode(id), shell to runShell, unknown to runClaude, lock held and released) - CLAUDE.md: name the second CI-gated guard next to the backend one - server.ts: every </head> injection passes a replacer function; a clis.json label containing $' re-injected the rest of the document past escapeScriptJson (two render tests pin it, proven failing on the string form) - _isAltCliMode(): no reference anywhere in the tree, nothing to fix Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> (cherry picked from commit 1ea363ff808a62861559bc141e724b163cc1c56e)	2026-09-21 04:37:45 +02:00
Codeman maintainer	d3f2ec0220	fix(custom-model): merge-time fixes for the promoted-model picker (#459) ... The maintainer's promised follow-ups to opticon454's picker promotion, applied on the landing branch after the merge (ecb95b5d): - session-ui.js: the promotion tag ("Currently loaded" / "Last used") and the "Default" pill are two separate spans, so a promoted row that is also the endpoint's defaultModelId shows both instead of silently losing its Default marking; two tests pin it (both fail on the old exclusive-slot rendering). - styles.css: a dedicated #customModelPickModal .set-scope rule, since the pill was only styled inside the three settings modals and rendered as plain body text here; same skin tokens, modal layout untouched. - docs/wiki/Custom-Model-Endpoints.md: describe the promotion (currently loaded, else last used per device), the separate Default pill, and that nothing is ever auto-chosen. - CLAUDE.md + docs/custom-model-endpoints.md: credit the real "Last used" writers (_runCustomModelEntryViaRestart and _quickStartWithCustomModelConfirm; runCustomModelEntry only dispatches since 88e5b7b2) and drop the now-wrong "both defer to Default" sentence. - Not done: moving the one-shot "last used" write into _runCustomModelEntryOneShot, because the existing one-shot tests assert that _quickStartWithCustomModelConfirm writes the key itself. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> (cherry picked from commit 0cb0f911adc14a852ba5c2951768a4aa87c25657)	2026-09-21 04:30:01 +02:00
Codeman maintainer	dcf9437308	Merge pull request #460 from Ark0N/feat/installer-v2 ... feat(install): three questions up front, an unattended build, and a URL you can scan	2026-09-21 04:23:15 +02:00
Codeman maintainer	aa13af1f7f	Merge pull request #444 from DodgyBadger/feat/mobile-prompt-composer ... feat(mobile): add manual prompt composer	2026-09-21 04:23:15 +02:00
Codeman maintainer	9a2e14a93a	Merge pull request #453 from timkjr/feat/split-pane-sessions ... feat: split-pane sessions — view two live terminals side by side	2026-09-21 04:23:14 +02:00
Codeman maintainer	ecb95b5d67	Merge pull request #459 from opticon454/feature/run-menu-picker-currently-loaded-model ... feat(custom-model): promote the currently-loaded/last-used model in the Run-menu picker	2026-09-21 04:23:14 +02:00
Codeman maintainer	72d437ab63	fix(install): fold in both reviews of #460 ... The two reviews on the PR (DeepSeek Harness, then Claude) found one class of bug twice and a list of smaller ones; all of them land here, each pinned in test/install-sh-invariants.test.ts and, where it is bash logic, driven in the bash:3.2 CI step as well. The Start line the done screen prints is now composed in one place (start_command_hint) from every non-default value, the same five the exec branch exports through export_bind_env, so "do not start" under a sub-path or a custom port no longer prints a bare `codeman web`. The --lan / --tailscale / env preset paths read ${CODEMAN_PASSWORD:-$EXISTING_PASSWORD}: a flag re-run on a unit that carried a password used to rewrite it without the password and with the unauthenticated ack. --password and --port flip RECONFIGURE so they reach the unit instead of taking the quiet update path, and `install.sh name` re-syncs the unit's base URL after the mapping is re-added. Also: the sudo keepalive is ended before the exec into the foreground server (exec skips the EXIT trap, and the loop keys on $$); Ctrl+C in the HTTPS-toggle poll is trapped for the poll only and skips Tailscale for the run instead of killing the installer; uninstall asks before removing a LaunchDaemon this installer never wrote; a foreign daemon gets a launchctl kickstart hint and the done screen stops claiming the new build is running; the preflight summary reads the Tailscale state with a line grep when node is not installed yet; the LAN security notice uses the configured port; a bare re-run ends on the done screen; a build failure after a rename names the install.sh tailscale recovery; TS_JOINED_HERE (written, never read) is gone; the plan doc and architecture-invariants say what the code does. A minor changeset is included. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-21 03:03:31 +02:00
Codeman maintainer	af744bdb54	feat(install): ask three questions up front, then install unattended and end on the URL with a QR code ... The installer used to ask about ten things, half of them after a multi-minute build, and the question that matters most (how do I reach the dashboard) came last. It now looks at what is on the machine, asks at most three questions (access, an optional tailnet name, service), and does the rest unattended. - Every step that needs a human runs before the build: one consent for all missing packages, one sudo prompt kept warm for the run, the AI CLI menu, and the Tailscale install/login/operator/HTTPS-toggle preflight (the toggle is polled and the admin page opened in a browser, instead of "re-check now?"). - The build, the service and `tailscale serve` run behind spinners with their output in ~/.codeman/install.log; the tail is shown on failure and a failed dependency install names its step. - The done screen leads with the URL (tailnet, network, this machine) and a terminal QR code from the qrcode package Codeman already ships. `install.sh status` prints it again. - Tailscale is two halves: tailscale_prepare (question phase) decides the serve SHAPE, tailscale_apply (after the build) issues the one serve command. When :443 already belongs to another app, Codeman goes under a sub-path (serve --set-path /codeman + CODEMAN_BASE_URL in the unit; serve strips the prefix, Codeman's ingress tolerates that, --base-url covers the URLs it emits) or a second port, instead of replace-or-nothing. - Renaming the node to codeman-<hostname> is opt-in and defaults to no everywhere (the tailnet name is the machine's ssh identity); --name and `install.sh name` do it, uninstall offers the old name back. Serve config is keyed by the DNS name, so a rename takes our mapping down first and re-adds it under the new name. - Flags pipe through `bash -s --`: --tailscale|--lan|--local, --name|--no-rename, --service|--run|--no-start, --yes, --password, --port. --port is now also written into the service file. - npm install runs with CODEMAN_NO_AUTOSTART=1: postinstall otherwise builds and starts a detached `codeman web` on 127.0.0.1:3000, which made the service crash-loop on EADDRINUSE while the done screen reported "running" off the orphan (fresh Ubuntu 24 sandbox). - The LAN address comes from the default route, not the first interface. - A foreign /Library/LaunchDaemons/com.codeman.web.plist is left alone instead of being replaced by a LaunchAgent. - The cloudflared question leaves the main flow (`install.sh cloudflared`). - "Continue WITHOUT a password?" defaults to yes (owner decision). Tests: the invariants test pins no `serve reset`, no funnel, no Tailscale Service, every serve mutation through ts_cmd_serve, rename before shape, flag/header parity, the rename default and the NO_AUTOSTART opt-out; the CI bash 3.2 step drives the question phase with stubbed tailscale state. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-20 21:38:11 +02:00
timkjrandClaude Sonnet 5	46d8b92049	fix(split-pane): port Ctrl+Shift+C's never-falls-through guarantee to Pane B ... The smart-copy gate only entered its selection-check block behind hasSelection(), so a selection-less Ctrl+Shift+C skipped straight to `return true` and ceded the keystroke to the browser's own handling (e.g. Chrome's Inspect-Element binding) instead of matching Pane A's "never falls through" contract for that chord. Verified live in a real browser that this is a UX-parity fix, not an interrupt-safety one: xterm's evaluateKeyboardEvent never emits PTY data for a shifted ctrl-letter regardless of any gate (only "_" and "@" get special-cased), so no accidental 0x03 was ever at risk. The regression test added here asserts on the dispatched event's defaultPrevented rather than the absence of a WS frame, since the frame-count check passes vacuously for this exact key combo whether or not the gate fires. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-20 13:10:34 -05:00
timkjrandClaude Sonnet 5	0b3e086334	fix(split-pane): address Ark0N's fourth pass — PTY-less picker exclusion, hollow chord test, remaining key gates ... - buildSplitPickerSessions() now excludes any session with pid === null (exited CLI, tripped PTY-exit breaker, a restore that never re-attached). Pane B has no equivalent of selectSession()'s auto re-attach POST, so a split opened onto one had nothing reading its tmux pane: no terminal events ever arrived and Session.write() silently dropped every keystroke with no ack either way, while the socket itself reported healthy. - Fixed the hollow chord regression test: the synthetic keydowns carried no keyCode, which is what xterm's evaluateKeyboardEvent switches on to produce a data frame at all, so the assertion held regardless of whether the gate fired. Adding real keyCodes surfaced a second, real bug in the Alt+B case: the event bubbles to app.js's own document-level shortcut dispatcher, which really toggles the sidebar and resets the layout attribute the gate reads before Pane B's own (later, non-capture) handler ever sees it — fixed by driving the app's real settings cache instead of only the DOM attribute. - Ported the two remaining primary-pane gates with real consequences: Ctrl+Z (SIGTSTP) is swallowed for every non-shell session, matching terminal-ui.js's reasoning (an Ink/TUI agent loop stops dead with no visible output otherwise), and Shift/Ctrl+Enter now POSTs to /api/sessions/:id/send-key for THIS pane's own session instead of letting xterm send a bare \r, which used to submit an incomplete prompt instead of inserting a newline. Smart-copy Ctrl+C is re-implemented against Pane B's own terminal (copying app.copyTerminalSelection() would have copied Pane A's selection instead). - Updated docs/architecture-invariants.md and docs/split-pane-sessions-plan.md to match, and added CLAUDE.md's missing .split-picker-menu z-index entry. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-20 13:10:34 -05:00
timkjrandClaude Sonnet 5	fafef0aa00	fix(split-pane): gate app-level chords out of Pane B, address Ark0N's third pass ... Pane B had no attachCustomKeyEventHandler of its own, so the document capture-phase shortcut handler's preventDefault() (which does not stop xterm) left Ctrl+K/Alt+1/Alt+B ALSO writing their raw byte/escape sequence into Pane B's live PTY on top of whatever the app action did to Pane A. Pane B now installs the same registry-aware gates the primary pane's own attachCustomKeyEventHandler uses. Ctrl+V is left on xterm's default paste — no image-paste trap to route it to. Plus the rest of the review's smaller items: - Narrowing the window past the desktop gate now closes an open split instead of leaving it stranded on screen. - Split is refused while a web tab is active (activeWebviewId), which used to open Pane B's socket behind a hidden container. - Pane B now handles the server's `{t:'r'}` refresh frame via a shared _loadBuffer() helper (also used by connect()), instead of ignoring it. - The divider drag now uses pointer events + setPointerCapture (mirrors tab-rail-resize.js), a button!==0 guard, preventDefault, and a body.split-pane-resizing cursor/selection lock — a plain mousedown drag selected the text under the cursor as it crossed both terminals. - Pane B's close control and the picker rows are real <button>s now (keyboard-reachable), with matching CSS chrome resets. - Dropped the redundant CodemanBase.base prefix on the buffer fetch (the global fetch wrapper already applies it). - data-preview-order for the Split settings chip moved from a collision with Ultracode Agents (both 15/12) to 11.5, matching its real position between Multi-monitor and Ultracode Agents in the header; widened test/app-settings-structure.test.ts's regex to allow the decimal (Number() already parses it fine for the preview sort). - Added zh-CN i18n entries for the Split button and empty-picker text. - Dropped the stray unused `vi` import Ark0N flagged as unrelated to this feature (vitest's `globals: true` makes it ambient anyway). - Documented the fix and the deliberate no-cid/seq choice in the split-pane-sessions architecture-invariants entry. Added a real-Chromium regression test asserting Ctrl+K/Alt+1/Alt+B dispatched at Pane B's own textarea send no `{t:'i'}` frame over its WebSocket. Full CI gate green (409 files, 7736 tests) plus all 8 split-pane browser tests. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-20 13:10:33 -05:00
timkjrandClaude Sonnet 5	2e3e245cc6	fix(split-pane): throttle the drag, chunk the scrollback, and the rest of Ark0N's second pass ... Two majors: - The divider drag was unthrottled: every mousemove did a full xterm reflow on BOTH panes and sent Pane B a {t:'z'} resize frame with no unchanged-dimensions skip, fanning out into a `tmux resize-window` child plus a SIGWINCH per event — ~50 of each dragging across half a wide viewport. SplitTerminalPane.fit() is now split into localFit() (reflow only) and fit() (reflow + send); the drag coalesces moves into one localFit() per animation frame via requestAnimationFrame, and sends the real resize for both panes exactly once, at drag end, matching the primary pane's own throttledResize convention. - Pane B pulled the FULL scrollback unchunked for every session mode, writing it in one terminal.write() call. Mirrors the primary pane's own mode check (app.js's selectSession): shell sessions get a bounded 1MiB ?tail= fetch instead of ?full=1, and the fetched buffer is written through a minimal chunked writer (32KB slices, yielding a frame between each) instead of one primary-pane chunkedTerminalWrite this simpler, independently created/destroyed pane has no equivalent of (no session-switch generation counters or live-output gate). Smaller items from the same review: - Pane B now follows live appearance changes (applyTerminalSkin, applyTerminalFontFamily, applyTerminalFontWeights, setFontSize all propagate to it, matching the teammateTerminals pattern) and reads the real codeman-font-size/terminalFontFamily/weights/DEFAULT_SCROLLBACK settings at construction instead of hardcoding fontSize 14 / scrollback 5000. - The Pane-B-promotion path now skips selectSession() when _closingSessions already owns this delete (the user closing Pane A's own tab), matching _onSessionDeleted's own active-session-handoff guard. - Detaching a session AFTER a split is already open now yields the PTY size in _sendResize() too (not just at picker-open time), mirroring sendResize's own detachedElsewhere guard. - .btn-split joins the body.solo-mode hide list, next to .btn-multimonitor. - The split row was 6px wider than its container (two flex-shrink:0 50% panes plus a 6px divider): both panes are now flex-shrink 1. - Pane B's header and the split-picker rows are marked so i18n.js's exact-string lookup skips them, matching .session-name elsewhere — a session literally named e.g. "Sessions" was translatable on zh-CN. - The Split button now reflects open/closed state via a `.split-open` accent style, aria-pressed, and a title/aria-label that says which behaviour the next click gets. - _splitPane.connect() is no longer an unawaited call with no .catch(). - terminal-split.js's fileoverview pointed at a doc path that was renamed away in the previous push; @dependency now credits constants.js for CodemanTerminalFont, not terminal-ui.js. - index.html's Split settings chip no longer reuses data-preview-order "12" (already the Ultracode Agents chip's slot in the same "header" preview group). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-20 13:10:32 -05:00
timkjrandClaude Sonnet 5	165cfb52d6	fix(split-pane): stop breaking every settings save, finish the desktop gate ... Blocker from Ark0N's second PR #453 pass: moving showSplitButton into settings-ui.js's per-device displayKeys set was only half of making it per-device. saveAppSettings() still put it in the object PUT to /api/settings, SettingsUpdateSchema (.strict()) does not declare it, the server answered 400 INVALID_INPUT, and because the call site never checked res.ok the UI still reported "Settings saved" while NOTHING persisted — workspaceHooksEnabled, agentSkillEnabled, tunnelEnabled, claudeModel, every toggle, on every save, on every device. Strip it out via the same destructure every other per-device key goes through (`showSplitButton: _ssp,`), drop the stray mention from a schemas.ts comment (a mention there reads as "this is a real field" to the next grep), and add a static guard test mirroring test/terminal-auto-copy.test.ts's three-way rule. Also finishes the desktop gate the first pass only did in CSS at 599px: SPLIT_PANE_MIN_WIDTH (1180, matching HOME_SESSIONS_MIN_WIDTH) now backs an actual JS width check in _applySplitButtonVisibility, with a matchMedia listener so a live window resize hides/shows the button without a reload — the CSS backstop in styles.css is the reverse-direction guarantee for when JS hasn't run. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-20 13:10:32 -05:00
timkjrandClaude Sonnet 5	8d3bde5469	fix(split-pane): address the rest of Ark0N's PR #453 review ... - Exclude popped-out (detached) sessions from the split picker: SplitTerminalPane._sendResize() has no yield-to-detached-window check the way the primary pane's sendResize() does, so splitting against a detached session put its own window and Pane B in a fight over the same PTY's dimensions. Simplest fix per the review: keep them out of buildSplitPickerSessions() entirely. - Show a visible dead state when Pane B's WebSocket drops. onData already silently discards keystrokes while the socket isn't OPEN (there is no reconnect for v1), so a dropped socket left the pane looking normal while it quietly ate everything typed into it. - openSplitPane() returns early with no active session, so a split triggered from the home screen no longer creates and connects Pane B behind the opaque welcome overlay with nothing to show for it. - onMove() during a divider drag now bails when the split has auto-collapsed mid-drag (the other pane's session ending) instead of throwing on `divider.parentElement` being null. - Promote Pane B via `selectSession(id, { auto: true })` when Pane A's session ends — this is an app-driven selection, not the user clicking a tab, so it must not spend the promoted session's idle alert. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-20 13:10:31 -05:00
timkjrandClaude Sonnet 5	78dcb0aa24	fix(split-pane): refit Pane B when the window/sidebar/tab-rail resizes ... Ark0N's PR #453 review: fit() was only ever called from the divider drag, and the trailing-edge ResizeObserver callback in terminal-ui.js (throttledResize) only ever measured Pane A's own container. Split at a wide viewport, shrink the window (or toggle the Alt+B sidebar, or drag the tab rail), and Pane A's cols changed while Pane B silently kept its stale PTY size in both xterm and the real pane. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-20 13:10:31 -05:00
timkjrandClaude Sonnet 5	1678386f50	test(split-pane): cover the blank-Pane-B and stale-width-Pane-A fixes ... Real-browser regression coverage for the previous commit: - SplitTerminalPane connects onto an already-quiet session and shows its existing scrollback with no new output, proving the ?full=1 fetch (not a live echo) populated the pane. - openSplitPane() force-resizes Pane A synchronously as part of opening a split. - Dragging the divider force-resizes Pane A once, at drag end. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-20 13:10:30 -05:00
timkjrandClaude Sonnet 5	33b2605815	fix(split-pane): stop leaking document listeners on repeated split-picker toggles ... Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-20 13:10:29 -05:00
timkjrandClaude Sonnet 5	d0a887d98a	test(split-pane): add fast unit coverage for the _onSessionDeleted auto-collapse ordering ... test/split-pane-auto-collapse.browser.test.ts covers "Pane B's session ends" in a real Chromium, but that suite is excluded from the npm test CI gate. The "Pane A's session ends, Pane B gets promoted" branch had no coverage anywhere, and it is the one branch whose correctness depends on exact ordering: _splitSessionId must be captured BEFORE closeSplitPane() runs (which nulls it) or the promoted session id is lost. Loads terminal-split.js via `vm` against a minimal fake CodemanApp (same technique as test/session-close-fallback.test.ts), and pins all three branches (Pane A ends, Pane B ends, unrelated session ends) plus that the original _onSessionDeleted always still fires. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-20 13:10:29 -05:00
timkjrandClaude Sonnet 5	8903a72662	fix(split-pane): hide the Split header button when showSplitButton is off ... .btn-split--hidden had no matching CSS rule anywhere, so the opt-in Split header button shipped visible to every user on every viewport regardless of the setting. Add the `display: none !important` rule alongside its sibling marker classes (.btn-multimonitor--hidden etc.), plus a static regression guard (test/split-pane-hidden-button-css.test.ts) that fails if any future "*--hidden" marker class in index.html is missing a matching CSS rule. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-20 13:10:27 -05:00
timkjr	8c73128cd6	feat(split-pane): auto-collapse split when either session ends	2026-09-20 13:10:26 -05:00
timkjrandClaude Sonnet 5	2abf328db8	feat(split-pane): add open/close orchestration, picker, and divider drag ... Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-20 13:10:25 -05:00
timkjrandClaude Sonnet 5	97a1238c85	feat(split-pane): add SplitTerminalPane class for Pane B ... Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-20 13:10:24 -05:00
timkjr	2bc16d5fd9	feat(split-pane): add showSplitButton setting and header button	2026-09-20 13:10:23 -05:00
timkjr	d60a164025	feat(split-pane): add pure divider-clamp and picker-list helpers	2026-09-20 13:10:23 -05:00
DodgyBadger	ac574d6c64	fix(mobile): compact the compose key	2026-09-20 17:31:10 +00:00
DevvynandClaude Sonnet 5	d9e6ebb20a	fix(cli-registry): address round-2 review on #458 — count-based allowlist, RUN_MODE_LAUNCH drift guard ... Three of Ark0N's four "will take at merge" items, applied instead since they were straightforward to do properly: 1. test/frontend-cli-no-id-branching.test.ts's ALLOWED_BRANCHES keyed on <file>::<expression> (fixed last round) closed the line-shift problem but opened a new one: every stock id was already allowlisted for session-ui.js in the `mode === '<id>'` form, so a BRAND NEW branch reusing that exact expression anywhere in the file passed unnoticed. Reproduced live (`if (this.mode === 'codex')` injected into runOpenCode()) — stayed green under the old version. Each allowlist entry now carries the exact count of approved call sites, and a new test asserts actual-vs-declared count for every key; a mismatch in either direction is real (higher = new unreviewed branch riding in on an existing approval, lower = a reviewed site was removed and the entry is now stale). Reproduced again against the fix: same injection now fails with an exact diagnostic (expected 2, found 3). 2. Added test/run-mode-launch-table-drift.test.ts. RUN_MODE_LAUNCH restates four things stock.ts already owns (label, install command, supportsCustomModel, the external-mode key set), and they agree today with nothing enforcing it. supportsCustomModel is the dangerous one: the Run-menu picker's rows come from the server-injected window.__codemanCustomModelClis (built from capabilities.customModelInjection.kind), so a CLI gaining a real injection recipe later would be OFFERED in the picker while _runCliMode silently drops the customModel field for it — the session launches on the vendor's cloud while the UI claims the local endpoint. Drives the real session-ui.js via JSDOM and compares RUN_MODE_LAUNCH against STOCK_CLIS on all four axes. 3. Inlined the "Open Question 7 in PR-B2.md" references in the allowlist reasons — PR-B2.md is a local planning doc, never part of the committed tree, so the reference was dead on arrival for anyone reading the repo. Points at the PR #458 review thread instead. 4. Added a sentence to docs/cli-registry.md naming the new frontend guard alongside the backend one it mirrors. Full gate: 406 files / 7721 tests / 0 failures, typecheck/lint/format/ check:frontend-syntax all clean. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GuHtuPiHXdykq9T6rKQJ9n	2026-09-20 21:37:05 +08:00
DevvynandClaude Sonnet 5	88e5b7b200	fix(custom-model): address Ark0N's PR review — client-side probe timeout, defer "last used" past confirmation, docs, zh-CN ... Four things from the maintainer's review on PR #459, all fixed: 1. Bound _getCustomModelCurrentlyLoaded's probe client-side (~800ms via Promise.race, on top of — never instead of — the route's own 5s server-side timeout). Without it, an asleep/firewalled endpoint behind a saved model list left the picker completely invisible for up to 5s after the Run menu had already closed, with no spinner or toast. `timeoutMs` is an optional param (default 800, real callers never pass it) so a test can drive it in milliseconds, same pattern as `_watchLlamaSwapLoading`'s own `pollIntervalMs` — this code runs in a JSDOM window's own realm, whose setTimeout vi.useFakeTimers() cannot patch. 2. "Last used" is now written only once a launch actually applies, never on the mere click. It moved out of runCustomModelEntry (unconditional) and into each path's own success point: _quickStartWithCustomModelConfirm after the final post succeeds, and _runCustomModelEntryViaRestart right after the apply's success check. A context-window-warning decline means this exact model cannot work with this CLI at all, so the old unconditional write would promote, next time the picker opened, the one model guaranteed to fail again. 3. Documented the promotion/tag precedence and the new codeman:customModelLastUsed:<mode>:<endpointId> localStorage key in both CLAUDE.md's Custom Model Endpoint Profiles section and docs/custom-model-endpoints.md's Run-menu picker section. 4. Added zh-CN entries for "Currently loaded" and "Last used" in i18n.js, next to this modal's existing "Choose a model"/"Custom Endpoints" pair. New tests: the client-side timeout (endpoint that never answers, one that answers within the bound, and a rejected-after-timeout probe settling quietly), and "last used" recording on success vs. NOT recording on either confirmation's decline, for both the restart and one-shot paths. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N6eadpRyqpA9PD3i139cSD	2026-09-20 21:19:42 +08:00
DevvynandClaude Sonnet 5	73607663fd	fix(custom-model): guard the picker's async open against a slower, superseded probe ... Code review (high effort) on the previous commit found a real race: making _openCustomModelPickModal async (it now awaits the currently-loaded-model probe before rendering) meant a second, faster call for a different endpoint could render first, only for the first call's slower probe to resolve afterwards and overwrite the modal with the wrong endpoint's model list — while _pendingCustomModelPick (set synchronously, before either await) still named the second, correct endpoint. Picking a model in that state would launch/apply the wrong model on the wrong endpoint. Fixed with the same mutable-generation-counter guard _watchLlamaSwapLoading already uses for an identical async-superseded-by- newer-call shape: every DOM write, including _pendingCustomModelPick itself, is deferred until after the awaited probe, and a call that finds its generation already superseded bails out untouched instead of clobbering whatever a newer call already rendered. Added a regression test driving two overlapping opens with a controlled promise so the earlier, slower probe resolves after the later, faster one renders, asserting the late response is a no-op. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N6eadpRyqpA9PD3i139cSD	2026-09-20 19:27:07 +08:00
DevvynandClaude Sonnet 5	458ca578e7	feat(custom-model): promote the currently-loaded/last-used model in the Run-menu picker ... Custom Model Endpoint Profiles' "which model" picker (session-ui.js's _openCustomModelPickModal) always listed models in their raw discovery order, so on a host with several downloaded GGUFs the user had to remember (or eyeball the "Default" tag) which one llama-swap actually had hot before picking — the whole point of the picker being fast is undone if it makes you think first. The picker now promotes exactly one model to the top of the list: - If llama-swap reports a model from this host's own list `ready` right now (via the existing GET /api/model-endpoints/:id/running-status route), that model is promoted and tagged "Currently loaded" — it's what a launch attaches to with zero wait. - Otherwise, the last model actually launched on this exact (harness, endpoint) pair is promoted and tagged "Last used", read from a new per-device localStorage key (codeman:customModelLastUsed:<mode>:<endpointId>), written by runCustomModelEntry on every launch attempt regardless of outcome. - A plain (non-llama-swap) OpenAI-compatible server, an unreachable endpoint, or a loaded-but-not-yet-ready model never promotes anything — the rest of the list keeps its discovery order. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N6eadpRyqpA9PD3i139cSD	2026-09-20 19:20:45 +08:00