mirror of
https://github.com/wu736139669/hapi.git
synced 2026-11-01 23:41:40 +00:00
190293ce9e19c35d39fd07d480fef4e5e3dbddbb
1175
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 SSU-WEI HUANGandGitHub
|
190293ce9e | fix(voice): preserve compatible dictation locale (#1455) | ||
|
|
fe4d51043c |
fix(cli): remap bracketed Cursor wires onto bare/SKU catalogs (#1430)
* fix(cli): remap bracketed Cursor wires onto bare/SKU catalogs #1271 only handled the grok-4.5 legacy alias family. Persisted wires like gpt-5.3-codex[fast=false] still failed agent --model on resume against today's bare ACP catalogs. Remap non-legacy wires to bare bases / CLI SKUs (and nearest configOption wires), and prefer spawn-safe ids in session state. Fixes #1428 Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): harden Cursor stale-model remap against silent wrong picks Address Codex Major review on #1430: prefer spawn-safe ids even on exact bracket cache hits, require explicit wire params when ranking configOption candidates, and stop downgrading unavailable CLI SKU variants. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): preserve desired Cursor variant across spawn-safe remap Do not overwrite session.model with the bare/SKU spawn id before ACP apply, and keep spawn-safe requested ids in wireIdForCursorSessionState so apply does not re-poison hub state with bracket wires. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): remap-retry Cursor session/new on stale model reject Initialize and session/load already retried once after Cannot use this model; session/new had the same failure mode with an empty shared cache. Mirror the one-shot remap+respawn path and cover it with a launcher test. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): resolve Cursor apply against ACP option values first Spawn-safe remap prefers bare/SKU ids, but set_config_option may only accept full bracket wires. Resolve against the model option list before falling back to metadata so apply does not pick a rejected bare base. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): fail Cursor launch when remapped spawn cannot restore model When --model was remapped for spawn, restoring the original desired variant via ACP is mandatory. Soft-failing left sessions running on the wrong model. Cover success and hard-fail paths in launcher tests. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
|
06e2507ad8 |
fix(web): add Ctrl+X / Ctrl+S to mobile terminal Control pad (#1460)
Dedicated C0 chords for Jed Emacs save (C-x C-s); sticky Ctrl+softkey is unreliable on mobile IME. Keeps Ctrl+L. Fixes #1459 Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
|
b8a765d4ef |
fix(web): keep project pin inside groups below In progress (#1458)
* fix(web): keep project pin inside groups below In progress Revert #1432's section lift: Pin in project stays first inside its folder and among directory groups, but must not promote whole folders above In progress. Restore Settings copy to match. Fixes #1457 Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): align pin-in-progress Settings copy with exclusions Describe unpinned floaters only, keep global pins above In progress, and avoid implying every working session or project-pin folders float. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
|
00b6e44869 |
fix(web): keep project-pin groups above In progress (#1432)
Durable project pins were losing to unpinned In progress floaters. Render pin-containing directory groups between the global pinned band and the In progress section; leave project-pinned rows inside groups. Closes #1431 Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
|
df958ae349 |
fix(shared): parse AGENT_NOTIFY_SUMMARY with glued last-line prose (#1426)
* fix(shared): parse AGENT_NOTIFY_SUMMARY with glued last-line prose Agents sometimes omit the newline before the footer. Accept an optional prefix on the last non-empty line when it still ends with a well-formed AGENT_NOTIFY_SUMMARY JSON payload. Mid-body quotes stay ignored. Fixes #1425 Co-authored-by: Cursor <cursoragent@cursor.com> * fix(shared): prefer first valid AGENT_NOTIFY_SUMMARY JSON match lastIndexOf broke footers whose string values mentioned the token. Scan left-to-right and accept the first occurrence with parseable JSON. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
weishu
|
cde0507bad | fix(codex): harden model discovery fallback | ||
|
|
3da9f7780a |
feat(web): support project and global pinned sessions (#1115)
* feat(web): support persistent pinned sessions * fix(web): preserve project hierarchy for pinned sessions * fix(web): preserve pins during session deduplication * fix(hub): preserve pins when merging sessions * fix(hub): migrate session pins from schema v15 * chore: retrigger PR review * chore: retrigger PR review * chore: retrigger PR review * chore: retrigger PR review * fix: align pinning with schema and sidebar filters * fix(web): expose pinning in session header menu * test(hub): expect schema v17 after pin migration * fix(web): report pin action failures * chore: retrigger PR review * chore: retrigger PR review * chore: retrigger PR review * chore: retrigger PR review * fix: address pinning review regressions * fix(web): scope pin error toast to session rows * test(hub): expect schema v20 after migration * fix(hub): preserve latest source pin during merge * test(hub): expect schema v22 after pin migration * feat(web): add project and global session pin modes Support mutually exclusive project vs global pins, surface both in the session action menu, and render globally pinned sessions in a top-level sidebar group with project path labels. * fix(web): polish pinned section icon and divider alignment * fix(web): tighten pinned section title icon alignment * fix(web): restore original pinned section pin icon shape * fix(web): rename pinned section to pinned sessions * fix(hub): prefer stronger pin mode when merging sessions Keep global pins over project pins during consolidation so a project-pinned source cannot downgrade an already or concurrently global-pinned target. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): keep inactive project-pinned groups expanded Pinned sessions should stay easy to find after reload; do not hide them behind the default inactive-group collapse. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): keep project pins in directory groups --------- Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
weishu
|
e95e111a5c | Release version 0.27.2 | ||
|
17d1ea0c75 |
fix(web): close composer settings on outside click (#1354)
* fix(web): close composer settings on outside click Co-Authored-By: Codex <noreply@anthropic.com> * fix(web): capture composer outside clicks Co-Authored-By: Codex <noreply@anthropic.com> --------- Co-authored-by: Codex <noreply@anthropic.com> |
||
|
|
bdf8da1d5a |
fix(web): preserve drafts across inactive session resume (#1378)
* fix(web): preserve drafts across inactive session resume * fix(web): address resumed draft review findings * fix(web): preserve drafts during hydration resume * fix(web): reset resume cache when session lifecycle changes Clear resolvedSessionRef when session id or active flag changes so a same-id resume that later archives again cannot skip a required new resume. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): gate inactive attachments on resumability Skip the attachment adapter and disable drops when an inactive session cannot resume, so file picks do not become stuck error attachments. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): avoid source-session 404 during reopen handoff When reopen merges into a different id, skip invalidating the source session detail so draft transfer can finish before navigation without flashing Session unavailable. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): include in-flight attachments in inactive resume handoff Pass the selected file into draft transfer and coalesce concurrent multi-file drops so resume navigation cannot drop attachments that were never published to the live snapshot. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): harden inactive draft handoff edge cases Re-check attachment cancellation after resume, always copy from the source draft instead of a stale target snapshot, and force a fresh getSession after optimistic seeding. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): prevent passive resume and preserve staggered handoffs Restore attachments only on active sessions so draft hydration cannot resume an archived session, and remember completed handoff targets so slower multi-file adds append instead of overwriting. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): avoid empty inactive snapshots shadowing attachment drafts When attachment restoration is disabled, persist composer text without publishing an empty live snapshot so reopen can still transfer IndexedDB attachments. Co-authored-by: Cursor <cursoragent@cursor.com> * test(web): cover inactive draft archive-switch-reopen lifecycle Add a component-level harness that exercises HappyComposer snapshot rules with useComposerDraft and transferComposerDraft across archive, session switch, and reopen to a new id. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): resolve SessionChat conflict markers for draft handoff Keep upstream send-message types and the inactive-resume handoffComposerDraft import so typecheck no longer dies on committed merge markers. Co-authored-by: Cursor <cursoragent@cursor.com> * chore: retrigger CI after conflict-marker fix Co-authored-by: Cursor <cursoragent@cursor.com> * chore: retry CI after Actions outage (Meta daily) Co-authored-by: Cursor <cursoragent@cursor.com> * chore: retrigger CI and PR review on current tip Re-queue Test and Codex PR Review after the conflict-marker fix and Actions outage. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): do not overwrite stored attachments from inactive composer Skip attachment draft persistence on unmount when restoration is disabled, so a failed inactive file pick cannot replace hidden IndexedDB attachments with a partial visible list. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): merge inactive picks into stored attachment drafts When restoration is disabled, persist visible pending attachments by merging them with IndexedDB instead of clearing the live snapshot alone, so a failed resume still keeps newly selected files for the next reopen. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): harden inactive draft persist for failed picks Keep pathless attachment ids stable, serialize inactive merge/writes, drop removed visible picks from IndexedDB, and await pending persist before transfer/reopen. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): navigate after cancel during inactive resume handoff If resume already merged into a new session id, still call onSessionResolved without the cancelled file so draft transfer + navigation leave the deleted source route. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): harden inactive draft handoff cancel and persist Carry a live isCancelled predicate through resume handoff so mid-transfer removes drop the file from the source snapshot, persist inactive blobs only on attachment revision (not keystrokes), and keep upload metadata on same-target staggered appends. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): await durable draft move and tombstone source Cross-session transfer now awaits an atomic IndexedDB put+delete via moveDraftAttachments, clears the source text draft, and skips unmount re-persist once the source id is marked handed off. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): re-sample cancel after draft drain; fail closed on move moveDraftAttachments resolves attachments only after awaiting queued writes, and rolls cache back + throws when a real IndexedDB transaction fails so transfer cannot clear the source or mark a handoff on loss. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): re-sample composer text after awaited draft move Keystrokes during the IndexedDB drain keep updating the source draft; re-read live/persisted text after the move resolves before clearing the source and writing the target snapshot. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): navigate after resume even if draft move fails Hub reopen can delete the source row before local IndexedDB finishes. Catch transfer failures, still copy text best-effort, and always navigate via transferComposerDraftThenNavigate / handoff onNavigable. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): harden draft move prune and in-flight persist Delete the source row before put/prune so a full retention store cannot evict an unrelated draft, and buffer inactive persist edits during an in-flight transfer onto the target instead of recreating the source. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): close inactive draft remount and transfer races Reset visibility bookkeeping on inactive remount, install the transfer barrier before the first await, and await a durable corrective target write when late edits land during an in-flight move. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): unbreak draft transfer typecheck and remaining races Re-read pendingTransfers.latest after awaits (TS2339), propagate real IndexedDB write failures on corrective same-target moves, and restore only missing stored attachment ids when same-id resume already has a visible pick. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): stabilize late draft edits and multi-file resume Repeat corrective target writes until pending.latest is unchanged across the await, sync keystrokes into the transfer barrier, and keep one resume promise per inactive adapter instance so staggered files join the same handoff after navigation. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): keep IDB attachments when typing during transfer Track inactive keystrokes on pending.latestText instead of inventing pending.latest with an empty attachment list that would overwrite hidden stored files during a cross-session move. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): fail closed when draft attachment reads fail Cross-session transfer now requests throwOnError for IndexedDB reads so a transient empty result cannot delete the source draft during the durable move. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): fail closed on inactive merge reads and keep target text Strict-read every inactive attachment RMW merge so a transient IDB error cannot publish a partial live snapshot, and copy composer text to the resumed id before aborting when attachment transfer reads fail. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): keep resumed session active after stale detail fetch Reapply optimistic active after background getSession settles so a lagging inactive REST snapshot cannot flip the target composer back, and catch strict inactive persist rejections at fire-and-forget call sites. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): prune attachments cancelled during durable draft move Always rewrite the target after the cross-session move so isCancelled flips during the IndexedDB commit window still drop the file, and prune again in handoff before navigation when the batch reports cancellation. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): stabilize multi-file cancel across draft corrections Treat the pending cancellation set as part of post-move stability so a sibling remove mid-corrective rewrite is re-sampled before navigation, and loop handoff same-target rewrites until that set stops changing. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): transfer inactive drafts before text-only resume send Await onSessionResolved so composer draft handoff completes before the send mutation, and route text-only auto-resume through transferComposerDraftThenNavigate like upload/reopen paths. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): transfer Files reopen drafts and respect SSE active Wire the Files-page reopen path through transferComposerDraftThenNavigate, and refresh resumed session detail only when the cached active flag still matches so a mid-flight inactive SSE transition is not resurrected. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): defer send until hidden inactive drafts hydrate After text-only resume transfers stored attachments, skip the mutation when the target draft still has files the inactive composer never exposed, so clearDraftsAfterSend cannot wipe them after a text-only POST. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): defer any attachment resume and expose stored drafts Always defer cross-session send when visible or stored attachments exist so source-scoped upload paths are not POSTed, and surface IndexedDB attachment presence to disable scheduling on inactive composers. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): resume same-id drafts and block pending schedule races Return resumed independently of session id so same-row PTY/Pi resumes still defer for hidden files, route attachment-only Send through an explicit resume callback, and treat incomplete inactive hydration as schedule-blocking. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): preserve send text during deferred draft handoff Pass the immutable submitted text into draft transfer so assistant-ui clearing the composer while resume is in flight cannot drop text from deferred hidden-attachment sends. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: HeavyGee <133152184+heavygee@users.noreply.github.com> |
||
|
|
b7f52f58ca |
feat(media): add audio and file display (#1405)
* feat(cli): cross-flavor inline image display via MCP and ACP Share display_image prompt across MCP-bridge flavors (Cursor, Gemini, Kimi, Codex, Claude, OpenCode), auto-approve the tool in buildHapiMcpBridge, handle ACP image content blocks, and harden generated-image registration with content sniffing. Closes tiann/hapi#956 Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): render generated-image cards reliably in chat Keep object URLs stable across refetch, upscale tiny inline images, fetch generated-image bytes with cache no-store (avoid empty 304 bodies), and load hapiMcpUrl from per-session API in hapi-display-image tooling. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(cli+web): display_video MCP for inline mp4/webm (#956) Add display_video alongside display_image, video MIME sniffing with avif guard, web GeneratedImageCard video player, and hapi-display-image auto-routing. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(cli+web): cross-flavor display_video parity with images (#956) Share display_video prompts across MCP-bridge flavors, auto-approve the tool, register mp4/webm via path sniffing, render inline video in web on the existing generated-image RPC path, and restore robust media card fetch. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): ACP image ordering and inline media source provenance Flush buffered assistant text before async generated_image emit from ACP image blocks (PR #958 review Major). Add optional source metadata on generated-image wire messages (ingress, flavor, toolCallId, toolName) for MCP, ACP, and Codex tool-result paths. Seeds artifact-event follow-up #966. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli+web): address PR #958 review Majors on media order and stale blobs Queue ACP session updates and await async image registration before later events; clear GeneratedImageCard blob state when imageId changes. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): await ACP queue after late-drain before turn_complete Straggler session/update during drainLateBuffers can queue async image registration; re-await sessionUpdateQueue so generated_image is not emitted after turn_complete. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(scripts): route AVIF ftyp brands to display_image in helper Match server-side detectImageMimeType so .avif files are not sent to display_video and rejected as unsupported video. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(#956): agent inline-media doctor and discovery fixes - hapi doctor inline-media: probe bridges, print per-session inline commands - Expose hapiMcpUrl on session list summaries (stops false "no MCP" scans) - Helper script: match cursorSessionId prefixes; HAPI_SESSION_ID path-only mode - ACP bridge prompt: shell fallback + HAPI session id vs agent id rule Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): allow immutable cache for generated media blobs Drop cache: no-store on generated-image fetch so browser can reuse hub immutable responses; on 304 re-read via force-cache (#927, PR review). Co-authored-by: Cursor <cursoragent@cursor.com> * fix(#956): Cursor native MCP overlay; drop user-turn bridge prepend Cursor ACP ignores session/new mcpServers. Write .cursor/mcp.json and run agent mcp enable hapi instead. Remove HAPI_MCP_BRIDGE_PROMPT from user turns on ACP remotes; enrich MCP tool descriptions for discovery. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): preserve non-HAPI mcp.json keys on Cursor overlay cleanup Cleanup only removes or restores the hapi MCP entry instead of rewriting the full pre-session snapshot, so concurrent edits to other servers survive. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): handle generated_image in Grok ACP launcher switch Upstream Grok launcher exhaustiveness broke after AgentMessage gained generated_image for cross-flavor inline media. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): rebase fallout for display_video + OpenCode skill lookup Gate display_video in the STDIO bridge, restore OpenCode first-prompt TITLE_INSTRUCTION (skill_lookup), and update tool-list test expectations. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): leave user-owned hapi MCP entry alone on overlay cleanup Only undo mcpServers.hapi when it still matches the exact entry this session installed; concurrent Cursor/user edits of that key survive. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): exact-match auto-approve for display_image and display_video Move media tools off substring name/id hints onto the exact-name set so forged lookalike tools are not approved in default permission mode. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): drop dead Cursor bridge prompt; put guidance in MCP descriptions Cursor must not get a user-turn media prepend (prompt-taint). Remove unused HAPI_MCP_BRIDGE_PROMPT_CURSOR and embed DISPLAY_*_PROMPT_CURSOR in the display_image/display_video MCP tool descriptions instead. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): require user approval for display_image and display_video Those tools read arbitrary local paths into chat; keep them on MCP approval_mode prompt and out of default-mode auto-approve exact names. Co-authored-by: Cursor <cursoragent@cursor.com> * chore: re-trigger Codex PR review after provider 503 Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): ignore URI-only ACP image blocks that read local disk Passive ACP agentMessageChunk handling must not load file:// or bare paths; local media goes through prompt-gated display_image/display_video. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): allowlist MP4 ftyp brands for video sniffing Reject HEIC/HEIF and other non-video ISO-BMFF containers instead of treating every non-AVIF ftyp as video/mp4. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): keep Cursor ACP startup if MCP overlay fails Wrap installCursorMcpOverlay so a malformed project .cursor/mcp.json cannot abort the session; continue without inline media tools. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): fail doctor inline-media when checks fail Exit non-zero whenever required checks fail, even if an active hapiMcpUrl bridge is present. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): expect display_video when change_title is disabled Native ACP title mode still exposes display_image and display_video; update startHappyServer test after rebase onto 0.23.4. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): keep ACP title sync synchronous outside media queue session_info_update title forwarding (#1028) must not wait on the async message-handler queue used for inline media ordering. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): sniff media headers only; advertise OpenCode display_video Read 16 bytes for detectMediaTool instead of the whole file, and include hapi_display_video in OPENCODE_NATIVE_TOOL_INSTRUCTION for remote ACP. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): show Cursor generate_image inline in HAPI chat cursor/generate_image only emitted a tool card; register filePath or base64 imageData into generatedImages and emit generated_image so the web chat card renders (issue #956 / swear01 report). Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): ignore path-only Cursor generate_image reads Path-only filePath registration bypassed permission-gated display_image / display_video MCP tools. Keep base64 imageData only; local paths must go through MCP approval. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): gate inline media base64 length before decode Reject oversized ACP/Cursor base64 payloads by character count so the CLI never allocates past the 25 MB generated-image cap. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): require EBML DocType webm for inline video sniff Bare EBML magic matches Matroska/MKV too; only accept DocType webm. Also restore annotated Playwright cursor in annotatedVideoUseOption. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(scripts): read 128-byte header for WebM DocType sniff detectMediaTool only loaded 16 bytes, so EBML DocType webm was often missing and valid WebM files fell through to display_image. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): compare generated-image source by value in reconcile Wire normalization allocates a fresh source object each pass; reference equality forced media-card recomputation on every reload/SSE refresh. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): inject Cursor MCP enable for overlay unit tests installCursorMcpOverlay always spawned `agent mcp enable`; tests now pass a noop so the suite never shells out to a real Cursor binary. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): shell-quote doctor inline-media helper command Paths and session prefixes with spaces/metacharacters broke the copied snippet; JSON.stringify each interpolated argument. Co-authored-by: Cursor <cursoragent@cursor.com> * test(cli): fix doctor inline-media quote path expectation Repo root from scriptPath is three levels up (cli/), not the parent of cli. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli/web): per-session Cursor MCP overlay id and bound tiny-image scale Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): redact generate_image base64 from logs and fix doctor MCP ids Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): harden inline-media doctor for packaged installs and hub headers Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): lock Cursor mcp.json updates and bound ACP media filenames Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): preserve mcp.json mode and token-scoped overlay locks Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): publish Cursor MCP lock owners via link(2) and treat EPERM as alive Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): fail closed on stale MCP locks; keep concurrent mcp.json top-level keys Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): roll back Cursor MCP overlay when agent mcp enable fails Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): await ACP session queue in suppressUpdatesDuring tests #958 queues handleUpdate for media registration; upstream compact tests assumed sync delivery after restore. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): capture ACP handler at enqueue; keep display_video manual Close two Major review findings on #958: suppress queue leak after restore, and Claude --allowedTools auto-approving local-path video. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: write through symlinked mcp.json; lazy-load inline video Preserve user Cursor MCP symlinks on atomic overlay writes, and require explicit Load video before fetching large generated-video blobs. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): use valid TerminalToolDisplayMode in media card test Co-authored-by: Cursor <cursoragent@cursor.com> * fix(scripts): require unique session prefix in display helper Reject ambiguous prefix matches so images/videos cannot land in the wrong HAPI chat when multiple agent session ids share a prefix. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): always cleanup Cursor MCP overlay on teardown Run overlay cleanup in finally so cancelAll/disconnect failures cannot leave a dead hapi-<sessionId> entry in .cursor/mcp.json. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): handle Copilot generated_image; refuse MCP symlinks Unblock typecheck after Antigravity/Copilot merge, and fail closed when .cursor/mcp.json or .cursor is a project-controlled symlink. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: abort restore deliveryMode; prune dead Cursor MCP overlays Unblock web typecheck after steer merge, and recover orphaned hapi-* mcp.json entries via HAPI_MCP_OVERLAY_PID ownership stamps. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): recover dead-PID Cursor MCP overlay locks Token-matched unlock so a crash mid-lock no longer permanently disables inline media; keep live-owner waits identity-safe. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): serialize Cursor MCP stale-lock recovery Acquire an exclusive recovery lock before token-matched unlink so two recoverers cannot remove a successor's live mcp.json lock. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): fail closed on stale Cursor MCP overlay locks Withdraw racy auto-recovery: pathname check-then-unlink/rename can steal a successor lock. Stale locks throw with an explicit rm hint instead. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): drop duplicate deliveryMode on abort restore Merge left both steer and queue; keep queue so retries after abort do not re-bind to a later Pi turn. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): bound inline media reads on open fd Close TOCTOU between pathname size check and readFile for display_image / display_video and registerGeneratedImageFromPath. Also preserve non-PID env edits on Cursor MCP overlay cleanup. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): repair happyMcpStdioBridge test syntax after merge Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): write Cursor MCP overlay to ~/.cursor, not the project Keep ephemeral hapi-<sessionId> bridges out of the checked-out tree so agents cannot git-add a live loopback URL. Tests inject mcpConfigDir. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): point Cursor MCP diagnostics at ~/.cursor/mcp.json Co-authored-by: Cursor <cursoragent@cursor.com> * feat(media): add audio and file display --------- Co-authored-by: HeavyGee <133152184+heavygee@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Debian <heavygee@oos-linux.in.lockhouse> |
||
|
Junmo KimandGitHub
|
64a85ad923 |
fix(agy): move carrier sweep off the startup path, enable on macOS (#1406)
* refactor(agy): make sweepAgyHookCarriers async via fs/promises Convert the carrier sweep's directory scan (readdir/lstat/readFile/rm) from sync fs calls to fs/promises, so it no longer blocks the event loop while it runs. The call site in runAgy.ts still awaits it in place, so this preserves the current blocking-before-hook-server ordering exactly -- only the mechanism changes. Also adds racing-safety tests proving a carrier created after the readdir() snapshot was taken (or written by this session's own prepareAgyHookCarrier() while a sweep is in flight) is never examined, since decoupling the call site (next commit) makes that interleaving possible for the first time. * perf(agy): decouple carrier sweep from session startup sweepAgyHookCarriers is a backup path -- normal teardown already removes a carrier via cleanupAgyHookCarrier, so sweep only matters after a crash. There is no reason for it to delay this session's own startup (hook server, carrier prep, PTY spawn). Now that it is async (previous commit), fire it without awaiting it instead of blocking on it before startHookServer. It runs concurrently with this session's own prepareAgyHookCarrier() call further down; the previous commit's racing-safety tests prove that interleaving is safe. Still guaranteed to never throw or leave an unhandled rejection. * refactor(agy): add a process-lifetime cache for carrier scope The upcoming macOS/Windows identity probes are async child-process calls (ioreg/sysctl, reg query), but writeOwnerMetadata is called synchronously from prepareAgyHookCarrier -- including from agyPtyLauncher.ts's respawn path, which must stay synchronous per its fail-closed contract. A warm cache lets that synchronous call read a value computed ahead of time instead of needing to await a probe. Adds computeLocalCarrierScopeAsync (platform dispatcher, Linux-only for now -- delegates to the exact same sync read computeLocalCarrierScope already does, so no platform's observable output changes here), warmCarrierScope (populates the cache once, including caching a failed probe so it is never retried), and resolveLocalCarrierScope (used by sweepAgyHookCarriers; bypasses the cache for any non-default probe so the many existing custom-probe tests keep forcing a fresh computation per call). writeOwnerMetadata reads the cache first and falls back to the existing synchronous Linux computation when the cache was never warmed -- unchanged behavior wherever nothing calls warmCarrierScope yet. * feat(agy): enable carrier sweep on macOS computeLocalCarrierScope was Linux-only, so sweepAgyHookCarriers was a no-op on macOS -- only crash leftovers there ever accumulated (normal teardown still works via cleanupAgyHookCarrier), but they accumulated forever. Adds a strong-identity scope for macOS: IOPlatformUUID (ioreg) + kern.bootsessionuuid (sysctl), the macOS analogue of Linux's boot_id -- NOT kern.boottime, which a live re-measurement showed drifts by over a second across 8 days on the same boot (recomputed from NTP-adjusted wall clock time under the hood). The probe runs by absolute path via execFile (never a shell, never PATH-dependent) with a 2s timeout; a failed or timed-out probe still resolves to undefined, preserving sweepAgyHookCarriers's existing "cannot identify -> preserve everything" contract unchanged. Windows is deliberately not enabled. MachineGuid -- the obvious candidate for a win32 scope -- is a machine identifier, not a PID-space identifier: it is written once at OS install time and is NOT regenerated by cloning a disk image (that is exactly what sysprep exists to fix). Two clones of the same image sharing a HAPI_HOME (SMB share, sync folder, shared VM folder) would compute the identical win32:<guid> scope while having completely independent PID spaces, so sweep could delete a live session's carrier and its --dangerously-skip-permissions approval bridge with it. No cheap per-boot alternative exists on Windows: no boot-id registry key, Get-CimInstance's LastBootUpTime measured 1.4-2.5s per call (an order of magnitude too slow for identity plumbing), and net statistics/systeminfo output is locale-dependent. computeLocalCarrierScopeAsync's docstring records the full reasoning and the bar for re-enabling it (a boot-scoped, not machine-scoped, identifier cheaper than CIM). Windows carriers keep accumulating exactly as before this change -- this is a purely additive capability for macOS. Wires warmCarrierScope into runAgy.ts's PTY setup: fired without awaiting it right after the sweep call (so the probe cost -- two child processes on macOS -- overlaps with hook server startup instead of adding to it), then awaited immediately before prepareAgyHookCarrier() so its synchronous owner.json write reads a warm cache. agyPtyLauncher.ts's respawn path needs no equivalent wiring: it always runs in the same, by-then-warm process. |
||
|
|
a13b54ccc7 |
feat(web): improve mobile terminal input (#1407)
* feat(web): improve mobile terminal input Co-Authored-By: Codex <noreply@anthropic.com> * fix(web): preserve terminal IME and key activation --------- Co-authored-by: Codex <noreply@anthropic.com> |
||
|
weishu
|
e3ed80676a | fix(codex): restore transcript messages from Codex 0.147 | ||
|
TEEKandGitHub
|
cfca9d210d |
fix(web): prevent near-bottom chat scroll jump (#1358)
* fix(web): prevent near-bottom chat scroll jump * fix(web): preserve explicit tail scroll intent |
||
|
|
28df974edd |
feat(settings): onboard hub provider credentials for dictation and voice (#1392)
* feat(settings): onboard hub transcription provider credentials in UI Env-only keys made dictation invisible; Settings can now add/edit/clear hub-side credentials (masked), with env still winning as override. Refs tiann/hapi#1384. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(settings): onboard voice-assistant backends alongside dictation Same Settings credential surface now covers ElevenLabs, Gemini Live, and Qwen Realtime (alias env pairs), not only transcription providers. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(settings): address PR #1392 Major credential onboard findings Alias env locks, non-destructive Save (omit empty fields), and owner-only settings.json permissions for hub-stored provider secrets. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(settings): harden credential onboard for second-pass Majors Owner-namespace gate, stage-then-sync env after persist, and per-field OpenAI-compatible editability under mixed env locks. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(settings): serialize settings RMW and clear partial compatible creds Per-file settings lock for concurrent credential PUTs, and Clear shown for partial OpenAI-compatible entries (key/url/model alone). Co-authored-by: Cursor <cursoragent@cursor.com> * fix(settings): serialize all settings writers via updateSettings Route credentials, relay auth, generators, server settings, and CLI token persistence through a locked RMW helper; reset Clear form state. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(settings): share cross-process settings lock with CLI Extract withSettingsFileLock for hub+CLI, keep owner-only 0o600 rewrites, and race hub credential updates against CLI-style writers. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(settings): keep UI secrets out of process.env; PID-own settings locks Settings-backed provider credentials now live in an in-memory overlay (getProviderEnvironment) so tunnel/ACP/Codex children do not inherit them. Settings file locks record pid+token and only reclaim dead or legacy locks. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(settings): never reclaim ownerless settings lock sidecars wx creates the lock path before the owner JSON is visible; unlinking null owners let a waiter steal a live acquisition and collide on settings.json.tmp (CI ENOENT). Only reclaim parsed owners with dead PIDs. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(settings): reclaim dead locks via rename; clean up failed publishes Stale reclaim renames the sidecar to a unique break path and re-verifies the expected dead owner before deleting it, so a loser cannot unlink a successor's live lock. Failed owner writes unlink the wx sidecar. Reclaim uses a sync owner read so contenders do not all observe one dead owner across an await and race the exclusive create. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(settings): reclaim dead locks under exclusive reaper sidecar Stale reclaim now takes a fixed settings.json.lock.reap lock, re-validates pid+token, then unlinks — so a delayed contender cannot move a successor's live lock aside. Also document providerCredentials in settings.schema.json. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(settings): fail closed on corrupt CLI settings; backoff busy reaper CLI updateSettings now uses a strict read that rejects invalid JSON instead of treating errors as {}, which could wipe providerCredentials. Settings lock reclaim sleeps when another process holds .reap so retries are not burned synchronously. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(settings): publish locks via candidate+link; fix CLI vitest hoist Acquire settings locks by writing a complete candidate then linkSync to the fixed path so a crash cannot leave an empty live sidecar. Fix the CLI persistence regression test to create its temp dir inside vi.hoisted. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(settings): replace bespoke lock with proper-lockfile; hide tenant creds UI Codex kept finding crash windows in hand-rolled lock sidecars. Switch the shared settings lock to proper-lockfile's mkdir + mtime lease. Hide the owner-only credentials editor from non-default namespaces on the voice page. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(settings): adapt sessionSummaryContract to outcome updateSettings Rebase onto main brought #1376 unique tmp + outcome-shaped writers; wire sessionSummaryContract and the write-failure credential test to match. Co-authored-by: Cursor <cursoragent@cursor.com> * chore: retrigger CI after rebase onto upstream/main Empty commit — Meta reported no checks on da0c6c258 after tip-forward rebase. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
|
a020c73629 |
feat(web): interactive storage usage pie in Settings (#1383)
* feat(web): interactive storage usage pie in Settings Show relative DB/WAL/SHM share beside absolute sizes on the Storage settings page, with hover/legend selection and no new chart dependency. Fixes #1382 Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): lead Settings Storage with relative-share donut Put the interactive chart above exact byte rows so mobile users see proportions first and scroll for drill-down sizes. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): drop duplicate Exact sizes table on Storage Keep one interactive donut + legend (bytes/%) beside or below the chart; total and path stay as non-redundant footer lines. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): storage pie legend roving tabindex + empty footers Address Codex review: one Tab stop via roving tabindex, total outside the listbox, and keep total/path when all slices are zero. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
KorenKritaandGitHub
|
0a05fada00 | fix(web): coordinate reasoning panel scrolling (#1398) | ||
|
KorenKritaandGitHub
|
feb4099731 | fix(web): stabilize fork boundary while streaming (#1399) | ||
|
|
f399aa0222 |
feat(web): transient Unread-only session list filter (#1400)
* feat(web): opt-in needs-attention session list filter Add a default-off sidebar filter (and Settings → Display toggle) that keeps permission/input/unread rows while excluding background-only busy work, mirroring the active-only preference pattern from #903. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): make needs-attention filter a transient sidebar toggle Drop the Settings → Display preference and localStorage persistence. This is an inbox lens: toggle in the session list, rows fall away as they're seen, and a reload clears the filter. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): unread-only sidebar lens, not needs-attention Rename the transient toggle to Unread only and filter solely on updatedAt > lastSeenAt. Permission/input attention stays on row dots; this is not Overseer review inbox. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): use unread-dot shape for unread filter toggle Match the session-row unread indicator instead of an inbox tray so Overseer can own inbox chrome later without competing metaphors. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): apply unread filter after machine scope Keep machineFilters derived from the unfiltered sidebar set so a persisted machine selection is not cleared when that machine has no unread rows. Unread intersects with the selected machine instead. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): snapshot last-seen once for unread filter pass Avoid N localStorage read/parse calls while the unread lens is on by loading the store once per memoized filter pass. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
AnanovoandGitHub
|
b57fb35867 |
fix(web): collapse expanded composer after successful send (#1368)
* fix(web): collapse expanded composer after send * fix(web): wait for send result before collapsing composer * fix(web): match composer collapse to send settlement |
||
|
|
988f8f183f |
feat: settings toggle for AGENT_NOTIFY_SUMMARY contract injection (#1376)
* feat: settings toggle for AGENT_NOTIFY_SUMMARY contract injection Add a hub-persisted, default-off Settings control so operators can opt agents into emitting the trailing AGENT_NOTIFY_SUMMARY line. Propagate the resolved flag on CLI session bootstrap and inject at call time for Claude, Codex, OpenCode, and Grok (Cursor still unsupported). Closes #1375 Co-authored-by: Cursor <cursoragent@cursor.com> * fix: lock hub settings RMW and restore abort deliveryMode Serialize settings.json updates with the shared .lock protocol and unique temp files so the new hub toggle cannot clobber CLI/relay fields under concurrency. Also supply deliveryMode on abort send-error restore so web typecheck (and CI) pass. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): wrap SettingsGeneralPage tests with QueryClientProvider The hub-settings toggle uses TanStack Query; the settings page suite was rendering without a QueryClient and blew up CI. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): defer summary-contract toggle until settings load Avoid rendering an interactive false switch while the hub GET is still in flight, which could overwrite an enabled preference on early click. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): clarify Grok coverage for summary-contract toggle Local Grok has no instruction inject path; settings copy now matches remote-only Grok support (and still excludes Cursor). Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
KorenKritaandGitHub
|
5e7e930713 | fix(web): fit composer placeholder to available width (#1388) | ||
|
KorenKritaandGitHub
|
256ad98ece |
fix: normalize cache token usage semantics (#1390)
Normalize usage input at parse time, mark inclusive producers, rebuild derived usage indexes, and preserve valid primary usage when cache partitions are malformed. Fixes #1389 |
||
|
|
6ffc125b1a |
fix(web): show truncated query on collapsed session search (#1391)
* fix(web): show truncated query on collapsed session search Collapsed SessionListSearch only showed an indicator dot for active filters, hiding the terms operators need. Render a compact truncated query chip when text filter is set (Fixes tiann/hapi#1356). Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): use chat-user chip colors for active search chip --app-link/15 washes to near-gray in default light mode (link is near-black). Use --app-chat-user-chip-* so the collapsed query chip stays a visible blue highlight when text truncates away. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
weishu
|
828e984508 | Release version 0.27.1 | ||
|
weishu
|
97c7412434 | fix(codex): forward lifecycle hooks without allow decision | ||
|
KorenKritaandGitHub
|
e532ff259b | feat(web): add setting to keep reasoning collapsed by default (#1385) | ||
|
AnanovoandGitHub
|
3eff0ec688 |
fix(web): keep session date filter directly accessible (#1367)
* fix(web): keep session date filter directly accessible * fix(web): announce active session date range |
||
|
|
c0b30bf916 |
feat(cli): MCP list_peers + runner hub auth for peer discovery (#1372)
* feat(cli): MCP list_peers + runner hub auth inheritance Runner-spawned agents could not discover same-hub peers without sitting on the hub host or pasting a session id. Add MCP list_peers (in-process credentials), export HAPI_API_URL/CLI_API_TOKEN after auth init for shell fallbacks, and clearer auth failure hints. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): do not export default hub URL into HAPI_API_URL exportHapiHubAuthEnv was writing the implicit localhost default into process.env, which made maybeAutoStartServer skip starting the bundled hub. Only export HAPI_API_URL when the URL came from env or settings; always still export CLI_API_TOKEN. Also fill missing deliveryMode on abort restore so web typecheck matches RawSendError (main tip unblock). Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): widen initializeApiUrl mock return type in test Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): never export CLI_API_TOKEN; exclude self from list_peers Keep settings/prompt-backed hub secrets out of wrapped agent env so shell JWT+curl cannot bypass peer-tool approval. Fresh hapi re-reads settings; env-backed tokens already inherit. list_peers omits the calling session from the shortlist. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): resolve peer labels via summary/path like web titles list_peers was showing (unnamed) for ordinary sessions because titles live in metadata.summary.text. Match web getSessionTitle and collapse whitespace so each peer stays one agent-readable line. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli,hub): emit full peer ids and honor GET /sessions?limit Short 8-char prefixes collide across UUID namespaces; print full ids so resolveSessionByPrefix stays unambiguous. Honor optional limit after sort so listPeerSessions stops loading the whole namespace for scheduled counts. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(hub): type sessions limit test mock as Map<string, number> CI tsc rejected Map<string, null> for getNextScheduledAtBySessionIds. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli,hub): unbounded ping resolve; peer list order=updatedAt Keep GET /sessions?limit only for discovery callers. ping/inspect omit limit so full UUIDs outside the first 500 stay resolvable. Peer lists pass order=updatedAt so truncation matches newest-first. Basename fallback splits Windows paths. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): auto-approve ACP title List Peer Sessions Permission derivation prefers request.title; match the MCP tool title form so default-mode ACP sessions do not prompt on discovery. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): pad list_peers fetch; split hub URL vs token hints Fetch limit+2 when excluding the caller so overflow still surfaces at limit=100. Clarify that auth login only saves the token, not HAPI_API_URL. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): use boolean overflow for ping-peer --list Match MCP list_peers: fetch limit+1 and mark hasMore instead of claiming an exact omitted count from a 200-row sample. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(hub): tolerate mocked machineCache without expireInactive CI flake: 5s inactivity tick hit test doubles that only stubbed getOnlineMachinesByNamespace. Optional-call + stub the method. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
KorenKritaandGitHub
|
3aff832246 |
fix(pi): advertise runner capabilities at registration and on connect (#1386)
* fix(pi): advertise runner capabilities at registration and on connect The hub only persists registration-time runner state for brand-new machines, and the socket heartbeat replays only what the hub already persisted. A runner upgraded in place (e.g. to 0.27.0, which adds piExistingSessionResume) never gets its new capabilities observed: the stale runner_state stays in the hub DB and Pi resume fails with "Pi resume requires an upgraded runner". - shared: RUNNER_CAPABILITIES single source of truth - runner: advertise capabilities again on every socket connect, so a reconnected runner self-heals without a hub-side change - hub: merge registration-time capabilities into an existing machine's runner_state, leaving live fields (status/pid/startedAt) socket-owned * fix(hub): backfill runner capabilities when metadata also changes The existing-machine registration path returned early after the metadata merge, skipping the capabilities backfill whenever registration changed metadata too. An upgraded runner necessarily changes happyCliVersion, so its first upgraded registration missed the backfill and Pi resume could still fail until the async socket state update landed. Merge both fields in the same call and return the latest row; add a test covering metadata and capabilities changing together. |
||
|
weishu
|
0a037c9812 | Release version 0.27.0 | ||
|
KorenKritaandGitHub
|
0201b9f6d4 |
feat(pi): import and reconcile local sessions (#1365)
* feat(pi): expose local session transcripts over machine rpc * feat(pi): import and incrementally reconcile local sessions * feat(web): import and resume local Pi sessions * build(web): precache the expanded app bundle * fix(pi): harden imported history reconciliation * fix(pi): persist import cursors and media placeholders * docs(web): warn about concurrent native Pi writers * feat(pi): sync native history from session menu * fix(pi): address import review findings * fix(web): preserve delivery mode for abort restores * test(hub): use the Bun test runtime * fix(pi): preserve custom names during sync * docs(pi): clarify concurrent session guidance * perf(hub): index imported Pi sessions once * perf(hub): reuse Pi import lookup for batches * fix(web): ignore stale Pi session scans |
||
|
weishu
|
5122a3fc5f |
fix(hub): reindex usage events to backfill model attribution
#1359's session-model fallback only applies to events indexed after the upgrade. Clear usage_scan_state in a V19→V20 migration so the lazy re-index re-derives legacy rows instead of leaving them bucketed as "unknown". |
||
|
wushenghuaandGitHub
|
f157d29b20 |
fix: preserve fallback models for legacy usage events (#1359)
* fix: preserve fallback models for legacy usage events Use the session model when historical usage lacks event-level metadata, while retaining indexed attribution across model changes and epoch rebuilds. Explicit event models remain authoritative.\n\nvia [HAPI](https://hapi.run)\n\nCo-Authored-By: Codex <noreply@anthropic.com> * fix: persist explicit usage models on replay |
||
|
|
c7e38e872c |
feat(a2a): steer session citations toward inspect_peer (#1373)
* feat(a2a): steer session citations toward inspect_peer Copy-reference prose and markdown /sessions/<id> links both parse to hub ids; MCP/CLI descriptions and flavor prompts forbid treating them as local FS paths so agents call inspect_peer first (tiann/hapi#1370). Co-authored-by: Cursor <cursoragent@cursor.com> * fix(a2a): fail closed on ambiguous session citations Codex #1373: do not silently pick ids[0] when a paste contains multiple /sessions/ links (shared by inspect_peer and ping_peer). Also strip trailing prose punctuation from bare citation ids. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(a2a): prefer Copy-reference path over title /sessions/ Codex #1373 MINOR: titles containing /sessions/<other> must not make normalizeSessionIdPrefix fail closed on an otherwise valid paste. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(a2a): do not short-circuit multi-citation Copy-reference pastes Codex #1373 MAJOR: only treat parenthesized Copy-reference as canonical when the paste is that citation alone (plus optional steer suffix). Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
KorenKritaandGitHub
|
8c4d4198a8 |
fix(web): preserve manual scroll during initial settling (#1377)
* fix(web): preserve manual scroll during initial settling * fix: remove duplicate Windows lockfile entry * fix(web): capture scrollbar input during settling |
||
|
KorenKritaandGitHub
|
e50099e4a4 |
fix(pi): keep running state through active RPC turns (#1379)
* fix(pi): keep running state through active RPC turns * test(pi): cover pre-settlement state snapshots |
||
|
|
9b4b9ec9d4 |
fix(web): avoid React #185 from MessageActions useAuiState object snapshot (#1381)
#1306 returned a fresh object from useAuiState on every call. useSyncExternalStore compares snapshots with Object.is, so that looped re-renders and crashed every session chat with minified React error #185. Split into primitive selectors and add regression coverage. Fixes #1380. Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
weishu
|
46fc83d211 |
feat: cut relay tunnel bandwidth with compression and SSE replay
Relay-metered traffic drops on every channel that carried avoidable bytes; binary payloads (attachments, voice audio) are unchanged. Hub: - gzip /api/* JSON responses, gated by q-aware Accept-Encoding negotiation (explicit gzip;q=0 beats a wildcard in either order; hono's compress() alone matches by substring) - enable WebSocket permessage-deflate and default flagless ws.send() to compressed frames - Bun negotiates the extension but compresses nothing unless each send opts in, and @socket.io/bun-engine never passes the flag (measured 96 KB terminal payload -> 608 B on wire) - replay missed SSE events on reconnect: 256-event/2MB ring buffer, per-process epoch ids bound to the authenticated namespace so a token swap can never resume from a foreign cursor, standard Last-Event-ID header preferred over the ?lastEventId fallback, live broadcasts queued until the replay flushes to preserve order Web: - skip the full sessions/details/messages resync when the hub answers resume:ok - a phone unlock now costs a handshake plus the gap delta instead of refetching everything - own every EventSource retry path: take over browser-native CONNECTING retries, defer reconnects while the tab is hidden, and raise the backoff ceiling to 5 min after repeated failures - drop the 30s skills/slash-commands polling; refresh on demand without blocking the suggestion menu behind a stalled CLI RPC - remember the websocket upgrade across terminal socket reconnects |
||
|
|
27bc6bade3 |
fix(web): drop Idle session-list badge (keep working/pending) (#1366)
* fix(web): drop Idle session-list badge (keep working/pending) Quiet active rows already read as the default via full opacity vs faded archived; labeling Idle was badge inflation. Pin-in-progress now only surfaces working/pending so the section does not advertise lack-of-state. Fixes #1362 Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): include deliveryMode on abort send-error restore Unblocks web typecheck: RawSendError requires deliveryMode, and the abort-restore path was omitting it (already red on upstream/main CI). Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
Junmo KimandGitHub
|
229766dd21 |
fix(agy): make conversation discovery deterministic at session start (#1369)
* refactor(agy): extract brain UUID adoption from the PreToolUse hook handler
Pull the first-wins UUID-adoption block out of onPreToolUse into a
standalone adoptBrainUuidIfUnset() helper so it can be shared with the
upcoming PreInvocation hook handler without duplicating the guard logic.
No behavior change.
* feat(agy): discover the brain UUID from agy's PreInvocation hook
PreToolUse only fires once a tool actually runs, so a tool-free turn
(e.g. a plain "hi") never gets a brain UUID from it. Register agy's
PreInvocation hook alongside PreToolUse: it fires before every model
call regardless of tool use, carries the same conversationId, and lets
discovery resolve deterministically instead of depending on a tool
being invoked.
PreInvocation uses agy's flat hook schema (distinct from PreToolUse's
grouped {matcher,hooks} shape) and a short 5s timeout, since it blocks
the agent loop synchronously on every model call. The forwarder gains
an explicit --event flag (default pre-tool-use, unchanged) to route to
a new /hook/agy-invocation endpoint; that path is fail-open (always
responds 200 / stdout "{}") since a lost discovery signal must never
block a model call, unlike a permission decision.
Both hooks funnel into the same first-wins UUID adoption guard, so a
resume-seeded sessionId is never overwritten by either.
* refactor(agy): drop transcript content-matching now that the hook is authoritative
The scanner's content-match discovery was the fallback for turns where
the PreToolUse hook never fired (no tool used). Now that PreInvocation
covers exactly that case, the fallback never actually gets a chance to
run in practice: carrier hook loading fails all-or-nothing (both events
live in the same hooks.json), and a failed carrier already aborts the
PTY session before discovery matters. Keeping unreachable code around
just keeps the risk it was flagged for — attaching to an unrelated agy
session that happens to share the same first prompt.
Removes the scan-window heuristics, the wrapped-USER_REQUEST content
matcher, and the ambiguity-reporting path entirely. The scanner is now
purely reactive: it watches nothing until onNewSession() (driven by a
hook) tells it which brain to watch. extractUserRequest/
normalizeUserInput and the launcher's userRequestMatches are untouched
— they answer a different question (did the web-submitted message echo
back into the PTY), which hook payloads carry no text to answer.
* feat(agy): drop the PreInvocation discovery hook once the conversation is identified
PreInvocation fires on every model call (~424ms round trip measured), but the
brain UUID only needs to be discovered once. agy re-reads hooks.json before
every model call, so the carrier's hooks.json can be rewritten in place (via
a temp-file-plus-rename atomic write) to drop the PreInvocation block the
moment handleSessionFound confirms the UUID, leaving PreToolUse untouched.
PreInvocation is restored before every respawn, since a resume that silently
fails would otherwise leave no way to discover the replacement conversation's
UUID. If the carrier itself has vanished (e.g. /tmp's tmpfiles.d sweep on a
long-lived session), it is rebuilt from scratch and hookCarrierDir is
repointed for the next agy spawn.
* refactor(cli): extract resolveHapiHomeDir from Configuration's constructor
Configuration.happyHomeDir is a singleton computed once at process
startup, which the upcoming agy carrier relocation can't reuse directly
without breaking per-test HAPI_HOME isolation. Extract the priority
logic into a standalone, env-injectable function with no behavior
change.
* feat(agy): relocate the hook carrier under HAPI_HOME and sweep dead ones
Carriers used to live under mkdtempSync(join(tmpdir(), 'hapi-agy-
carrier-')). On this machine /tmp is swept by tmpfiles.d after 30 days,
and agy re-reads hooks.json on every model call (not just at spawn), so
a long-lived session's carrier could be deleted out from under it,
silently killing both the permission bridge and discovery at once.
Move carriers to <HAPI_HOME>/agy-carriers/<random>/, record owner
metadata (pid, startedAt) at the carrier root (outside .agents/, which
agy itself reads), and sweep carriers whose owner process has
confirmed-died at session start. Liveness is judged strictly by
process.kill(pid, 0): ESRCH means dead and safe to remove, EPERM means
alive but not ours and must be preserved, anything else is unknown and
also preserved. Carriers with unreadable or missing owner metadata
(pre-existing or corrupted) are only swept once old enough to rule out
a carrier still mid-creation. Every ambiguous case defaults to
preservation, since deleting a live session's carrier is far more
costly than leaving an inert directory on disk.
* fix(agy): abort respawn instead of spawning agy without a permission bridge
syncPreInvocationHookForLaunch used to log-and-return when the hook
carrier could not be recreated before a respawn, letting launchOnce
spawn agy anyway with --dangerously-skip-permissions and no PreToolUse
hook wired up — every tool call would auto-approve with nobody in the
loop. Throw instead, matching runAgy.ts's existing fail-closed contract
for the initial carrier, and notify the web chat via sendSessionEvent
so the abort isn't silent.
* fix(agy): sweep carriers only when the owner is positively identified
An unreadable owner.json is not evidence of staleness: a live session
whose metadata cannot be parsed would have its carrier removed once it
aged past the threshold, taking the PreToolUse approval bridge with it.
Hostname is not an identity either — containers sharing a HAPI_HOME can
share a hostname while their PIDs live in unrelated namespaces, so a
liveness probe there reports ESRCH for a process that is very much alive.
Scope the owner record to the boot id and PID namespace on Linux, fall
back to a distinguishable hostname-only scope elsewhere, and delete only
when the scope matches and the pid is confirmed dead. Carriers whose
owner cannot be identified are now kept.
* fix(agy): drop the hostname scope fallback rather than guess ownership
Hostname is not an identity. Where /proc is unavailable, two machines or
containers sharing a HAPI_HOME and a hostname compute the same scope, so a
pid that is live on the owning system reads as ESRCH here and its carrier
is deleted — taking the PreToolUse approval bridge with it while agy runs
with --dangerously-skip-permissions.
Without a strong boot and PID-namespace identity the scope is now
undefined, which makes the sweep preserve everything. Orphaned carriers
accumulate on those platforms instead, which is the cheaper failure:
ordinary teardown still removes carriers, so only crash leftovers remain.
* fix(agy): point carrier failures at HAPI_HOME instead of the temp dir
The carrier moved under HAPI_HOME/agy-carriers earlier in this branch,
but the abort messages still told users to check the temporary directory.
On a custom or quota-limited HAPI_HOME that sends remediation to a
filesystem that has nothing to do with the failure.
Both the initial-preparation path and the respawn-recreation path carried
the stale hint, so both are updated — otherwise the same failure would
suggest two different places to look.
|
||
|
weishu
|
b7503d9309 |
docs: restructure docs site and fix drift against code
- split installation.md into installation/deployment/notifications - merge cursor/grok guides into new agents.md with full support matrix - sidebar: grouped sections; add namespace, deployment, notifications, native companion contract - fix license footer (AGPL-3.0), settings schema fields and $id - fix drift in pwa, faq, namespace, how-it-works, voice-assistant, quick-start, native-companion-contract - move mermaid lightbox dogfood doc to localdocs (untracked) - README: complete agent list, replace dead cursor/grok links |
||
|
weishu
|
de5fa4aecd | docs: update voice assistant guide for multi-backend support | ||
|
weishu
|
b31c5a8e76 | fix(web): skip filler br element in contenteditable composer | ||
|
|
807fa72aaa |
fix(opencode): surface stall errors and clear thinking spinner (#869)
* test: reproduce issue #865 Co-authored-by: Cursor <cursoragent@cursor.com> * fix(opencode): surface stall errors and clear thinking spinner (closes #865) Route quota/rate-limit/HTTP-2 cancel stderr through error-styled agent messages, cancel the in-flight prompt, and clear thinking so the web UI does not stay stuck while OpenCode retries upstream. Co-authored-by: Cursor <cursoragent@cursor.com> * test(opencode): non-stall stderr surfaces error without canceling prompt Co-authored-by: Cursor <cursoragent@cursor.com> * fix(acp): use agent-neutral retry stderr message in shared transport AcpStdioTransport is shared by Cursor, Gemini, Kimi, and OpenCode. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(opencode): surface stall errors and clear thinking spinner * fix(acp): parse split stderr stall records Buffer stderr through newline-delimited records so split retry and HTTP/2 cancel signatures still clear stalled OpenCode turns, and retain one web error presentation branch. Verified: targeted ACP and presentation tests plus CLI/web typechecks. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(acp): emit stalled stderr tails immediately Classify buffered retry and HTTP/2 cancellation tails as soon as their signatures are complete, without waiting for the ACP process to close. Verified: targeted ACP transport test and CLI typecheck. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(acp): flush newline-free quota errors * fix(acp): surface newline-free stderr errors * fix(acp): scope stall cancellation and bound stderr * fix(opencode): bind stall cancellation to prompt RPC * fix(acp): preserve partial stderr until classification * fix(acp): report complete cancellation records --------- Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
|
3556c7d7f1 |
Support macOS Codex Desktop restart from Hapi (#912)
The Codex Desktop restart route already supports a Windows PowerShell script, but macOS installations can have Codex.app available without any Restart-CodexDesktop.ps1 file or pwsh. In that case the web restart control reports a missing script even though the desktop app is installed. This adds a native macOS path that detects Codex.app, reports running state via pgrep, and restarts the app with osascript plus open when no custom restart script is configured. Existing configured scripts and Windows behavior stay unchanged. Constraint: macOS users may not have PowerShell installed for the Codex Desktop restart control. Rejected: Require HAPI_CODEX_RESTART_SCRIPT on macOS | preserves the current failure mode for default installs. Confidence: medium Scope-risk: narrow Directive: Keep configured restart scripts higher priority than native macOS fallback so operators can override local app behavior. Tested: bun test hub/src/web/routes/codexDesktop.test.ts Tested: tsc -p hub/tsconfig.json --noEmit Not-tested: Manual click of restart button, to avoid restarting the active Codex desktop session during development. Co-authored-by: zhangrui <3014594405@qq.com> |
||
|
|
f6da005b50 |
feat(web): FUE + composer hint for session @-mentions (#1274)
* feat(web): FUE + placeholder for rich composer session @-mentions Discover session @-mentions via composer-grounded FUE and always-on placeholder copy when rich composer is active (#1273). Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): notify onFocus after programmatic rich-composer autofocus Playwright headless (and some engines) skip the DOM focus event for element.focus(), so FUE engage never ran. Call the onFocus prop after autofocus so discovery still works. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): engage rich-composer FUE on mount DOM focus events are unreliable for programmatic autofocus (and in Playwright). Treat the live rich composer as the affordance and open the callout when the rich path mounts. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): measure FueCallout height; ellipsis rich placeholder Bot review on #1274: position from real panel height (ResizeObserver) so multi-line FUE bodies clear the composer, and keep long mention placeholders on one ellipsized line in the input row. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): Escape dismisses rich-composer FUE; keep expand flex chain Escape while the mention FUE is engaging only dismisses the callout (no abort/collapse). FUE anchor is a flex container so expanded RichComposerInput still fills height. Mock resolveComposerPlaceholderKey in sendError tests. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
AnanovoandGitHub
|
a0c676818f |
fix(web): sync share metadata and active-turn availability (#1306)
* fix(web): align sharing with session state * fix(web): keep share state in sync * fix(web): fail closed for trimmed active turns * fix(web): refresh prepared share images * fix(web): preserve sharing during queued thinking * fix: track a stable active turn boundary * fix: anchor active turns to persisted messages * fix(web): include Pi reasoning in share metadata * fix(hub): refresh queued thinking grace on retry * test(web): isolate mobile thread scroll setup * fix(hub): advance queued turn boundaries * fix(hub): guard queued boundary advancement * perf(web): precompute running turn sharing * fix(hub): use hub time for turn boundaries * perf(web): pause closed share metadata timer |