88 Commits

Include renames

Author	SHA1	Message	Date
3 people	3c3bffdfbd	feat: message-level conversation fork and rewind (#1263) ... * feat: add message-level conversation fork and rewind Expose native Codex/Grok/Claude history controls through hub REST+RPC and web ConfirmDialog actions, without file rewind or composed forks. Also reconcile the duplicate hub V14→V15 migration so typecheck can pass. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: hydrate fork transcript and consume Claude --fork-session Forked HAPI children now copy the source transcript prefix so navigation is not a blank thread, and Claude drops --fork-session after the first launch so relaunches do not branch again. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: harden fork/rewind concurrency and durable history points Skip pending scheduled rows when hydrating fork transcripts, serialize fork/rewind per session, and persist conversation history points/indexes across existing-session bootstrap and Grok relaunches. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: close remaining fork/rewind races and UI anchoring Block sends and scheduled maturation while history actions run, order fork prefixes by invocation time, inherit history locators into children, and only offer Fork current on the live tail boundary. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: address remaining fork/rewind bot findings Materialize Claude --fork-session before the first child prompt, validate HAPI history boundaries before native RPC, expose forkCurrent on a latest user boundary, fully demote unsupported conversationHistory capabilities, and fix the truncate test setup order. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: align fork-current ids and Claude fork bootstrap Compare the latest fork boundary in assistant-ui threadMessageId space, spawn Claude forks with the persisted session mode, and preserve forkedFrom across existing-session bootstrap. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: close fork/rewind consistency holes at the contract layer Hold the source history lock until Claude child binds a distinct native id, persist Codex localId→turnId locators, and mark/block diverged sessions when native rewind outruns HAPI truncate. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: use Codex stable lastTurnId for historical fork Map HAPI's exclusive boundary to the previous turn's inclusive lastTurnId so native fork context matches the hydrated transcript. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: require exact Grok native resume for fork children Reject newSession fallback when forkedFrom is set, and keep the hub history lock until the child binds the forked grokSessionId. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: kill active fork children before failed-fork cleanup Bind/readiness failures can leave the child process running; deleteSession rejects active rows, so terminate first then remove the HAPI session. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: close remaining fork lock, hydrate, and todos gaps Reject mode switches during history actions, batch-copy fork transcripts in one SQLite transaction, and rebuild todos after fork hydrate / rewind truncate. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: allow Codex historical fork before the first turn Use experimental beforeTurnId when there is no previous turn for the stable inclusive lastTurnId boundary. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: mark Grok history busy immediately after dequeue Hub idle checks clear once messages-consumed fires; hold the busy flag across permission sync and rewind-points lookup before prompt starts. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: encode copied conversation history content * fix(web): hide local conversation history actions * style(codex): remove trailing whitespace * fix(fork): preserve children when cleanup is unconfirmed * fix(history): confirm cleanup and guard rewind divergence * fix(history): probe capabilities before advertising --------- Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-03 09:28:01 +08:00
KorenKritaandGitHub	abf9cb02a5	fix(pi): resume archived sessions safely (#1308) ... * fix(pi): resume archived sessions safely * fix(pi): harden native resume startup * fix(pi): harden resume termination evidence * fix(runner): persist resume process evidence * fix(runner): track resume process generations * fix(runner): verify full session tree shutdown * fix(pi): block pre-mapping resume dedup	2026-08-02 21:15:52 +08:00
Junmo KimandGitHub	08fbea5311	feat(cli): bridge OpenCode native compaction via internal REST API (#1252) ... * feat(cli): allocate a loopback port for the OpenCode ACP subprocess opencode does not announce which port it bound when launched with --port 0 (verified: not present in stdout/stderr even at DEBUG level), so pick a free loopback port ourselves and pass it explicitly via --port/--hostname. This makes the ACP subprocess's internal HTTP API reachable at a known baseUrl for follow-up work (native /compact bridging). * feat(cli): add REST bridge for OpenCode native session compaction opencode's ACP method table has no session/compact RPC, but the opencode acp subprocess also runs an internal HTTP API. That API's POST /api/session/:id/compact route is an unimplemented v2 stub (always 503); the route that actually performs native AI compaction is the legacy POST /session/:id/summarize, which requires providerID and modelID in its payload. This adds a small client for that route plus a helper to split ACP's combined "provider/model" wire id. Not wired into the slash-command flow yet. * feat(cli): trigger native OpenCode compaction from /compact Wires the REST bridge into the OpenCode slash-command flow so /compact performs real context compaction instead of returning a "not yet supported" message. - slashCommands.ts: /compact now resolves to its own `kind: 'compact'` (the synchronous 'handled' shape can't carry an async REST round trip). /clear is unchanged. - opencodeRemoteLauncher.ts: registers a compact trigger callback once the ACP backend + internal HTTP baseUrl are ready, reading the session's current provider/model on every call so it reflects inline model switches. A `runExclusive` promise-chain mutex serializes the compact trigger against `backend.prompt()` so a still-in-flight prompt and a `/compact` sent moments later can't race against the same OpenCode session concurrently, in either arrival order. - runOpencode.ts: on /compact, emits "Compaction started" as a session event (the same `sendSessionEvent({ type: 'message', ... })` status- line channel Claude/Codex already use for compaction and other transient state, rather than a chat message), awaits the bridge with no artificial timeout (compaction on a reasoning model can take 90s+), then emits "Compaction completed" or "Compaction failed: <reason>" the same way. Falls back to the previous not-yet-supported chat message when no trigger is registered (local mode has no ACP backend, so this is unreachable there today). If the user cancels the message while compaction is queued or in flight, the eventual result is suppressed instead of surfacing a stray status message for an action the user already considered cancelled (aborting the in-flight HTTP call itself is left as follow-up scope). - help text now notes /compact is remote-sessions only, since local mode has no ACP backend to bridge through. Also fixes a runOpencode.test.ts fixture gap: the mocked OpencodeSession was missing onThinkingChange, so any exception in that call path was silently swallowed by the handler's outer catch instead of failing the test. * feat(cli): show compaction summary as a reasoning block After a native OpenCode compaction succeeds, OpenCode's session history gains a `role: "user"` marker message (a `{type:"compaction"}` part with no text) followed by a normal assistant message holding the actual generated summary in a `text` part. Left alone, neither is visible in HAPI — the bridge only checked success/failure and never looked at the resulting messages. - opencodeCompactBridge.ts: `fetchCompactionSummary()` does one more GET against the session's message list after a successful compact, finds the most recent `type:"compaction"` marker, and extracts the following assistant message's text — preferring a match via the marker's `parentID` (order-safe) and falling back to simple array adjacency, both gated on `role === 'assistant'` so an unrelated same-shaped sibling can't be silently misattributed as the summary. Concatenates every `text` part in case a summary spans more than one. Never throws: any unexpected shape or request failure just yields "not found" so the caller can skip showing anything. - opencodeRemoteLauncher.ts / runOpencode.ts: on a successful compact, forward the extracted summary as a `{ type: 'reasoning', text, id }` AgentMessage through the same `handleAgentMessage()` / `convertAgentMessage()` path OpenCode's own live thought-chunk streaming already uses, so it renders in the existing collapsible "Reasoning" block — no new UI component or schema field. The `role:"user"` marker is never constructed or forwarded at all, so there's nothing to filter (unlike Claude's compact summary, which is hidden after the fact via an `isCompactSummary` flag). * fix(cli): disable Bun's hardcoded fetch timeout for OpenCode compaction Isolated E2E against a real OpenCode session showed compaction always failing with "Compaction failed: The operation timed out." after ~250s, even though session/prompt-style unlimited waits were intended. Root cause: Bun's global fetch() hardcodes an internal ~5 minute timeout that fires independently of any AbortSignal (or its absence) — see oven-sh/bun#16682. The only documented workaround is passing the non-standard `timeout: false` fetch option that Bun itself recognizes. Cast through a local `BunFetchInit = RequestInit & { timeout?: false }` type alias rather than `Record<string, unknown>`, so the option stays structurally checked against the rest of the fetch call's shape. * fix(cli): serialize /compact through the message queue instead of a mutex HAPI Bot flagged two Major correctness issues on the PR: - `/compact` bypassed `MessageQueue2` and entered a `runExclusive` mutex directly from the user-message handler. If prompt A was in flight and prompt B already queued behind it, `/compact` sent afterward could still reach the mutex before B did, running compaction ahead of an earlier-queued user prompt. - `compactTriggerRef` (a closure capturing the remote backend) was never cleared on a remote→local handoff, so `/compact` typed after switching to local mode could call a stale closure targeting an already-disposed backend instead of the intended local-mode fallback. Removes the mutex entirely and routes `/compact` through the same `messageQueue` regular prompts use (a new `operation?: 'compact'` field on `OpencodeMode`, dequeued by the launcher's single sequential consumer loop, which branches to a new `runCompactOperation()` instead of `backend.prompt()`). Ordering is now enforced by construction (one queue item in flight at a time) rather than a second bolted-on lock. Replaces the closure-based `onCompactTriggerReady` callback with a boolean-flag `onCompactAvailabilityChange`, reset to `false` on every entry into local mode (cold-start and handoff alike) before the remote backend is even disposed, so there is no window where the flag says available but the backend underneath it is gone. * fix(cli): let /compact's cancel ack fire at dequeue time, not on queue A follow-up HAPI Bot review caught a Major issue this PR's queue-based /compact serialization (previous commit) left open: runOpencode.ts still called session.emitMessagesConsumed manually and synchronously the instant /compact was pushed onto the queue -- a leftover from before /compact was routed through the queue at all. That beat MessageQueue2's automatic dequeue-time ack (onBatchConsumed, wired in sessionBase.ts, already used by every regular prompt) to the hub, so a /compact sitting behind other queued prompts was marked "invoked" immediately and could never actually be cancelled from the UI. Removes the manual ack; the queue's own dequeue-time ack now covers /compact exactly like any other queued operation. Adds a deterministic test for the reported scenario: prompt A generating, /compact queued behind it, cancelled before A finishes -- the compact REST bridge must never be called. * fix(cli): suppress live ACP updates while a compact REST call runs Found via live use: OpenCode keeps streaming session/update notifications (thought chunks, etc.) over the ACP transport while /compact's REST call runs outside prompt(), and AcpSdkBackend.handleSessionUpdate forwarded them unconditionally to whatever messageHandler was still installed from the last real prompt turn -- rendering the compaction summary a second time as a plain assistant message, alongside the explicit Reasoning block this PR already sends for the same content. Adds a narrow, opt-in AcpSdkBackend.suppressUpdatesDuring() (shared with Gemini, but a pure addition with no behavior change for existing prompt() callers) that temporarily swaps out the message handler for the duration of an async callback, restoring it afterward. Wraps the compact bridge's REST call with it so the live stream produces no output during that window -- the Reasoning block built from the explicit GET response becomes the only place the summary appears. * fix(cli): let Stop/switch-to-local interrupt an in-flight /compact REST call triggerOpencodeCompact's HTTP request is intentionally unbounded (a real compaction can take minutes), but the launcher awaited it with no way to interrupt it once dequeued and running. handleAbort() only cancels the ACP prompt() turn and resets the queue -- neither touches this raw HTTP call -- so Stop (and switch-to-local, which routes through the same handler) stayed blocked until the request settled on its own: a stale "Compaction completed/failed" could still surface afterward, queued prompts behind it were delayed, and remote->local handoff couldn't proceed. Add a per-call AbortController (compactAbortController) that handleAbort() aborts before cancelling the prompt, and thread it through triggerOpencodeCompact's new optional `signal` (kept separate from the existing timeout:false Bun workaround, which stays unconditional). An aborted call now folds into the same isCancelled() check that already suppresses a stale result for the existing queue-cancel race, so either kind of interruption behaves the same way. * fix(cli): structurally close remaining /compact abort/lifecycle races Two more narrow races surfaced in review, both symptoms of ad hoc per-site fixes rather than a shared mechanism: 1. The signal threaded through triggerOpencodeCompact (the POST) did not also reach fetchCompactionSummary (the GET runCompactOperation makes right after it), so Stop/switch-to-local could still block on that call alone. Introduce OpencodeCompactCallOpts with `signal` required (not optional) so every HTTP step opencodeCompactBridge.ts makes on behalf of one /compact operation is forced by the compiler to accept it, not left to remembering to wire it in per call site. 2. /compact availability (runOpencode.ts's compactSupported flag) was only reset to false on the *next* local-mode entry (loop.ts's runLocal callback), leaving a window between "switch/exit was requested" and "local mode actually started" where a /compact arriving mid-transition could still queue, and -- since local mode hands straight back to remote when it finds a non-empty queue -- run anyway despite the user having already left remote mode. Add an onLeavingRemote() hook to RemoteLauncherBase (no-op default, so the other six flavors built on it are unaffected) called synchronously as the very first action of requestExit() -- closing the race at its source -- and again unconditionally in start()'s finally block as a backstop for exit paths that never call requestExit() at all (an exception thrown from runMainLoop, for instance). OpencodeRemoteLauncher overrides it to flip availability false; loop.ts's local-entry reset is removed as redundant now that leaving remote is what's authoritative. * fix(cli): create compactAbortController before the inline model/effort switch A hostile-review whole-feature sweep of the /compact abort/lifecycle surface (round 5) found that the dequeue loop applied the per-batch inline model/effort switch (real async ACP round-trips that yield to the event loop) *before* branching into runCompactOperation(), which is where compactAbortController used to get created. An abort firing during that switch hit a still-null controller (a no-op), and by the time the switch resolved and runCompactOperation() created a fresh one, the abort was forgotten -- the compact's unbounded REST call would then run to completion despite the user having already pressed Stop/switch/exit. Move controller creation to the top of the loop iteration, as soon as the batch is known to be a compact operation, and pass it into runCompactOperation() rather than having that function create its own. Also: soften an overstated doc comment about what the required `signal` field actually guarantees, and add a regression test locking in that two sequential compact operations each get an independent controller (no leak or cross-clearing). * fix(cli): drain quietly before restoring the handler in suppressUpdatesDuring A 5th PR-review round found that suppressUpdatesDuring restored the suppressed messageHandler the instant its callback settled, but aborting the client-side HTTP call (e.g. OpenCode's compact bridge aborting via compactAbortController) does not necessarily stop the agent from continuing that operation server-side -- session/update is a separate notification channel from the HTTP request's lifecycle. A late straggler notification from a still-running server-side operation could leak straight into the restored handler (or into a new one prompt() installs right after). Reuse the same quiet-drain prompt() already runs before installing a new handler for the next turn (waitForSessionUpdateQuiet with the PRE_PROMPT_* constants) -- same class of race, same validated mechanism, just on the way back in instead of the way out. No new state or Stop-vs-switch branching: the wait is internal to suppressUpdatesDuring and the handler stays suppressed throughout it. * fix(cli): queue /compact during remote-mode initialization instead of rejecting it compactSupported alone conflated two different situations: a genuinely local-mode session (compact fundamentally can't run) versus a session that's already in remote mode but hasn't finished ACP initialize + session load/new yet (onCompactAvailabilityChange(true) hasn't fired yet, but will shortly). A regular prompt sent in that same startup window queues normally and just waits its turn; /compact sent in the identical window instead got an immediate not-yet-supported reply. Check sessionWrapperRef.current?.mode (the actual OpencodeSession instance's mode, synced synchronously by onModeChange before either launcher starts) alongside compactSupported: only genuinely local mode now gets the not-yet-supported reply. A session already in remote mode but still initializing queues /compact exactly like a prompt and lets it settle into its real FIFO position once the launcher is ready. * fix(cli): don't let the remote-init /compact queuing fix reopen the teardown race A hostile-review whole-feature sweep found that gating /compact queuing on sessionWrapperRef.current?.mode alone (26344118) fixed the startup window but silently reopened the exact race OpencodeRemoteLauncher's onLeavingRemote() exists to close: mode stays 'remote' for the entire teardown window too (it only flips back to 'local' once runMainLoop() fully unwinds), so a /compact arriving after switch/exit was requested -- while compactSupported has already gone false -- queued anyway instead of getting rejected, and could still run once local mode bounced back to remote to drain a non-empty queue. Add compactTeardownInProgress, true from the moment onCompactAvailabilityChange(false) fires (which -- since the old reset-on-local-entry was removed -- only ever means "leaving remote", never "not ready yet") until the session next re-enters remote mode. Wrap the onModeChange callback opencodeLoop already receives to reset it back to false on that re-entry. The existing "stops queuing /compact once availability is reset to false" test didn't catch this because its mock never set mode to 'remote' during the simulated teardown, unlike real production timing -- fixed to match. * fix(cli): keep the dequeue loop blocked on a compact until it really finishes on plain Stop A 6th PR-review round rejected the quiet-drain mitigation from the previous round (bounded at ~1.2s) and asked for the originally proposed fix instead: quiet-drain cannot guarantee a multi-minute server-side compaction has actually finished, since session/update is a separate notification channel from the aborted HTTP request's lifecycle. Unconditionally aborting compactAbortController on any abort (the previous fix) let the dequeue loop move on to the next queued prompt while the agent could still be compacting the same OpenCode session server-side -- breaking the core invariant this feature's whole queue-based redesign depends on: compact and a prompt must never touch the same session concurrently. handleAbort() now takes a leavingRemote parameter. Plain Stop (leavingRemote=false, the default) only sets compactResultSuppressed -- the eventual result gets hidden, but compactAbortController is left alone, so runCompactOperation()'s own awaits keep blocking the dequeue loop until the real HTTP response arrives, i.e. until the server actually finishes. Switch-to-local/exit (leavingRemote=true) still abort the controller for real, since cleanup() disconnects the whole ACP subprocess right after regardless -- there's no shared session left to protect there, and the responsiveness fixed in an earlier round still matters for that path. The quiet-drain from the previous round (AcpSdkBackend.suppressUpdatesDuring) is left in place -- it still helps for a compaction that finishes quickly and for trailing session/update stragglers right after a real completion, it's just no longer the thing plain Stop relies on for correctness. * fix(cli): close 3 gaps a hostile-review pass expected the next bot round to flag Pre-emptively addresses findings a hostile-review final pass on 65729bb7 judged likely for the next external bot round, since a communication round-trip costs more than fixing them now: 1. No dedicated test existed for the Stop/switch-to-local RPC-overlap message-ordering fix (handleAbort() re-reading compactAbortController's abort state instead of a stale snapshot). The test harness has no way to observe MessageBuffer/Ink content, so the decision logic that picks the status message and whether to clear `thinking` is extracted into a pure, exported selectAbortStatusMessage() function and unit tested directly against all four (hasCompactInFlight, leavingRemote, compactAborted) combinations, including the exact overlap case. 2. No test verified compactResultSuppressed doesn't leak between two sequential compact operations. Added a regression test: a Stop-suppressed compact #1 finishing for real must not silence a normally-completed compact #2 queued after it. 3. The "Stop requested — waiting..." status message didn't tell the user how to actually leave the session (switch-to-local/exit) while a compaction is deliberately left running. Appended that guidance. * fix(cli): skip a compact cancelled before its request ever went out A plain Stop landing during the inline model/effort switch that precedes a compact batch only set compactResultSuppressed; it never stopped the dequeue loop from calling runCompactOperation() unconditionally once that switch resolved, so a cancelled-before-start compact would still fire a brand new REST request and block the loop for however long that call takes. Skip starting the operation when compactResultSuppressed is set and the controller was never actually aborted (plain Stop leaves the signal alone by design). Deliberately excludes the compactAbortController.signal.aborted case (switch/exit) and isLocalIdCancelled: both must keep falling through to runCompactOperation() as before, per Round 5's and the isLocalIdCancelled suite's existing coverage. * fix(cli): also skip a compact cancelled-before-start via isLocalIdCancelled Round 7's pre-start skip check only covered compactResultSuppressed (plain Stop), deliberately leaving isLocalIdCancelled out so as not to disturb the "Compaction started is never suppressed" tests that predated that check. But isLocalIdCancelled's backing Set can only ever be populated during the brief ack-vs-hub-DB-write race before a queued item's REST call is sent, never while it's actually running (see runOpencode.ts's cancelledBeforeEnqueue doc comment) — so a true result here unconditionally means the same "cancelled before it ever went out" situation Round 7 already handles for plain Stop, and deserves the same treatment: skip starting the operation instead of sending "Compaction started" for a request already known to be discarded. Updates the two tests that had encoded the old "started is never suppressed" behavior for this specific signal to their corrected expectation, and removes a no-longer-consumed mockImplementationOnce that would otherwise have leaked its failure response into the next test that actually calls the REST bridge. * fix(cli): don't resurrect /compact availability after a startup-time switch/exit onCompactAvailabilityChange(true) fired unconditionally right after newSession/loadSession resolved, with no way to know a terminal switch-to-local/exit had already run during that pending ACP round trip (RemoteLauncherBase.requestExit() sets shouldExit synchronously before awaiting its handler, so the flag is already accurate at that point). runOpencode.ts's compactSupported/compactTeardownInProgress gate treats compactSupported flipping true as reason enough to ignore compactTeardownInProgress entirely, so this belated true could let a /compact arriving right after slip into the queue mid-teardown. Guard the call with the same shouldExit flag requestExit() already set. The race can only be reached via the terminal UI's onExit/ onSwitchToLocal callbacks (wired up before runMainLoop starts, well before the RPC 'abort'/'switch' handlers exist), so the regression test forces isTTY and captures ink's render() props to invoke them directly. * fix(cli): clear the hub's queued-thinking grace when a compact is skipped pre-start The cancelledBeforeStart skip path never calls session.onThinkingChange(true) (the whole point of skipping), but also never told the hub the queued item was done. The hub's 15s queued-thinking grace (markMessageQueued, sessionCache.ts) keeps thinking pinned true regardless of keepalives until a messages-consumed ack with clearQueuedThinkingGrace arrives, so the web UI spinner could sit stuck for the full grace window. Applies the same pattern already used by runOpencode.ts's synchronous slash.kind === 'handled' path (e.g. /model): an emitMessagesConsumed ack with clearQueuedThinkingGrace, then an immediate thinking=false keepalive. This is additive to, not a replacement for, the queue's own unflagged onBatchConsumed ack — a second ack for an already-invoked localId is a no-op on the hub's first-write-wins protocol, and clearQueuedThinkingGrace is keyed by session, not localId, so both are idempotent.	2026-08-01 17:20:07 +08:00
3 people	bc543dc494	feat: rich composer session @-mentions + inspect_peer (#1228) ... * feat(web): feature-flagged rich composer for inline session @ mentions Custom segmented contenteditable (not TipTap) inserts caret-local session atoms from the existing @ picker and serializes to markdown links on send. Textarea path remains default until flag parity dogfood. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): rich composer mention boundary + #1215 refs Treat U+FFFC mirror atoms as word boundaries so @ after a session token still opens autocomplete. Point comments at Fixes #1215. Co-authored-by: Cursor <cursoragent@cursor.com> * test(web): peer-stack e2e for rich composer session @ mentions (#1215) Smoke: flag on, @ picker inserts inline session atom chip (not prose dump). Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): preserve newlines in rich composer Enter-newline mode Chromium splits contenteditable on Enter into block divs; serialize those as \\n and insert <br> when parent leaves Enter unhandled (Shift+Enter / enter-inserts-newline). Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): show @ badge when rich composer mentions flag is on Dogfood was invisible: flag-off looks like a normal textarea, and flag-on had no chrome. Surface a small @ badge when enabled. * fix(web): rich session composer on by default (not a user setting) The plan dual-path was an engineering kill-switch, not an opt-in. Default to the segmented composer; only richMentions=0 disables. Drop the flag badge and record a peer-stack motion proof covering chips + baseline UX. * fix(web): make rich composer Shift+Enter create a visible newline Trailing <br>+empty text node was a silent no-op at EOL. Use insertLineBreak (ZWSP pad fallback), assert real \\n in peer e2e. * feat(web): hover tooltips on rich composer session chips Show full title, status, short id, and path on chip hover via a portal bubble fed by live useSessions lookup (drafts fall back to title + id). * fix(web): dismiss rich composer chip tooltips on mouse leave contenteditable pointerout/relatedTarget was flaky so tips stuck after leaving the chip. Hit-test on pointermove, clear on prose/input/leave. * fix(web): address cold-review Blocker/Majors on rich composer Exclude peer e2e from default Playwright; force plain-text paste; restore newline hard-stop in findActiveWord; fix root-anchored selection mapping and nested-block serialize; cover with unit tests. * chore: drop accidental .cursor files from rich-composer tip * fix(web): close remaining cold-review gaps on rich composer Drop absolute peer e2e tooling imports, prove chip→markdown send, and harden paste/EOL/focus/tooltip/Enter edges before Meta rematerialize. Co-authored-by: Cursor <cursoragent@cursor.com> * chore: absorb soup playwright.config union for clean remat Keep fork peer-stack timeouts/annotated-video wiring and add testIgnore for e2e/peer so the next driver rematerialize does not conflict. Co-authored-by: Cursor <cursoragent@cursor.com> * revert: drop fork playwright tooling from upstreamable tip Peer-stack annotated-video + HAPI_PEER wiring stay on fork main / soup. Product tip only needs testIgnore for e2e/peer (see docs/tooling/peer-stack.md). Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): fix rich composer Shift+Enter double newline and paste space Prefer manual newline+pad over execCommand insertLineBreak, and stop applying autocomplete trailing-space on paste/drop paths. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): pad EOL Shift+Enter after Range.insertNode split insertNode always leaves an empty text sibling, so !nextSibling never saw EOL; detect meaningful trailing content and cover with jsdom tests. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): drop custom onDrop from rich composer Intercepting drop without caretRangeFromPoint landed text at EOF or no-oped in-editor moves. Native CE drop is enough for #1215; paste still forces plain text. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(web): sidebar-parity tooltips on rich composer session chips Reuse SessionRowSummary (flavor, thinking/attention, schedule, todos, relative ago, path) for chip hover so the tip matches the session list. Co-authored-by: Cursor <cursoragent@cursor.com> * chore: keep peer-stack e2e off the upstreamable tip Peer specs and playwright.peer.config stay on fork main per docs/tooling/peer-stack.md; default config still testIgnore's e2e/peer. Co-authored-by: Cursor <cursoragent@cursor.com> * feat: cite sessions with UUID wire + inspect_peer for agent/overseer Rich composer chips already serialize to [title](/sessions/<id>); flush before send so the agent prompt never gets title-only chip text. Add inspect_peer (MCP + hapi inspect-peer) as the read twin of ping_peer so that same id is immediately usable for overseer/agent peer lookup, with system-prompt glue from citations to inspect/ping. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): gate inspect_peer behind permission approval Cross-session history reads need the same prompt path as ping_peer: keep inspect_peer off Claude --allowedTools and treat it as sensitive in ACP/OpenCode read-only mode so prompt injection cannot silently enumerate peer transcripts. Co-authored-by: Cursor <cursoragent@cursor.com> * chore: clarify playwright peer testIgnore is upstream-safe Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): keep session UUIDs on rich composer copy/cut/paste Copy/cut write wire markdown so chips do not collapse to @title-only clipboard text; paste reparses session links back into atoms. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>	2026-07-31 19:42:56 +08:00
3 people	d8aa8736cd	fix(cli): surface real Cursor ACP session/load errors (#1198) ... * fix(cli): surface real Cursor ACP session/load errors Stop mislabeling every ACP session/load failure as a legacy stream-json protocol problem. Prefer Cursor's Cannot use this model stderr (including Available models when present), attach drained stderr on process close, and keep structured formatAcpLoadError logs. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): accumulate ACP stderr across split chunks Address Codex Major on #1198: child_process stderr data events are not message boundaries. Concatenate raw chunks in a rolling window, extract Cannot use this model from the window on close, and prefer that over a partial onStderrError hint when classifying resume failures. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): pin ACP model-rejection stderr when catalog overflows Once Cannot use this model appears, keep the buffer from that match head so a long Available models list cannot roll the rejection out of the rolling window (Codex follow-up on #1198). Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): wait for model id before ACP model-rejection emit Only emit Cannot use this model via onStderrError once a non-space token follows the colon, so a split before the id cannot suppress the completed rolling-window message (Codex Minor on #1198). Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): block ACP writes between process exit and close Keep the post-exit stdin write guard while deferring markClosed until stdio close so stderr can still enrich the failure (Codex Minor on #1198). Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>	2026-07-29 10:05:41 +08:00
3 people	e2631a553a	feat(cli): ping-peer CLI + MCP ping_peer for peer messaging (#1195) ... * feat(cli): add ping-peer CLI and MCP ping_peer for peer messaging Promote resume-if-inactive + wait-active + POST message into a first-class CLI command and session MCP tool so agents stop reinventing JWT+curl. Fixes #1194 Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): do not auto-approve MCP ping_peer Cross-session messaging can resume a peer and inject a prompt, so keep permission-mode gating (Codex PR review Major on #1195). Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): require approval for ping_peer in read-only mode Read-only auto-approve treated non-write names as safe; ping_peer can still resume a peer and inject prompts, so gate it like a write tool. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): keep ping_peer out of Claude --allowedTools toolNames still registers the MCP tool, but Claude auto-allow must not pre-approve cross-session resume+inject without a permission prompt. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): re-check session active before ping-peer send List/get can race; POST /messages still 409s if the target flips inactive before send. Resume+wait again (and re-gate pi) immediately before POST. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>	2026-07-28 08:36:56 +08:00
weishu	042ffced8d	fix(kimi): sync native local session titles	2026-07-27 10:19:25 +08:00
Haoqing WangandGitHub	6bddc9d044	fix(cli): stop internal agent events from leaking into chat as raw JSON (#1165) ... * fix(cli): drop unknown SDK message types instead of passing them through The SDK-to-log converter's switch had a fail-open default that stamped any unrecognized SDK message with transcript base fields (parentUuid/sessionId/ userType) and forwarded it. Claude Code emits a tool_progress heartbeat every 30s for long-running tools, so a single slow Bash call flooded the chat: the web normalizer matches no known shape for those records and falls back to rendering the raw envelope as message text. Gate the switch on an explicit allowlist instead, bailing before the uuid is allocated so a dropped event cannot advance sidechain/parent tracking -- the heartbeats share one parent_tool_use_id and were overwriting the pointer a subagent's next real message parents to. This matches the local launcher, which already enforces the same allowlist via RawJSONLinesSchema.safeParse. The default branch stays as a fail-closed guard so adding a type to the allowlist without a matching case drops the message rather than leaking it. * fix(cli): re-check reassembled text for internal event JSON at flush boundary isInternalEventJson was only applied per incoming chunk. In delta mode (OpenCode) every chunk is a fragment, so none of them parses as JSON on its own and the filter never fires; the pieces accumulate and flushText emits the reassembled envelope verbatim. The dedupe path has the same hole whenever two chunks share no overlap. Check again in flushText, which is the first point the complete text exists, and tolerate surrounding whitespace so an envelope preceded by a newline is not waved through by the leading-'{' fast path. Genuine assistant output that happens to be JSON is unaffected: the matcher still requires the specific { type: 'output', data: { parentUuid, sessionId, userType } } envelope shape. * fix(cli): fail closed on unrecognized agent message in converter convertAgentMessage's exhaustiveness default returned the message object itself at runtime. The never binding makes the branch unreachable today, but every caller forwards a non-null result straight into the chat stream, so the failure mode if it were ever reached is a raw object on screen. Keep the compile-time check, return null at runtime. * test(cli): cover command_lifecycle, a second unknown type seen leaking Observed in the same session after tool_progress. The allowlist already covered it with no code change, which is the argument for gating on known types rather than adding a case per offender.	2026-07-26 02:46:29 +08:00
SSU-WEI HUANGandGitHub	40c1789357	fix(acp): sync native agent session titles (#1028) ... * fix(acp): sync native session titles * fix(acp): keep title refresh off turn path * fix: reconcile native ACP titles with skill lookup * fix: preserve OpenCode image tool instruction	2026-07-24 10:59:47 +08:00
4 people	af8d160364	feat(cli): export HAPI_SESSION_ID into wrapped agent env (self-targeting) (#1121) ... * feat(cli): export HAPI_SESSION_ID into wrapped agent env Publish the hub session id into process.env at session bootstrap so every downstream agent spawn inherits it. HAPI runs one hub session per CLI process (the runner forks a fresh hapi child per session; local is 1:1) and every flavor's agent spawn derives its child env from process.env, so a single seam covers claude / codex / cursor / gemini / opencode / kimi / grok / pi - runner-spawned and local - plus future flavors, without touching each launcher. Agents can read HAPI_SESSION_ID to self-target their own hub session over REST or shell helpers without listing /api/sessions. Prefer the MCP display_image tool for inline media when available; HAPI_SESSION_ID is the deterministic fallback for non-MCP tooling. Closes #1119 Co-authored-by: Cursor <cursoragent@cursor.com> * feat(scripts): self-target hapi-display-image via HAPI_SESSION_ID Teach the in-tree shell helper to use $HAPI_SESSION_ID for path-only / self invocations: GET /api/sessions/:id directly instead of listing /api/sessions. Explicit session prefixes keep the previous list path. Gives #1119 a tangible now benefit - the tool that forced the wasteful list-and-reverse-lookup dance no longer needs it inside a wrapped session. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): defer HAPI_SESSION_ID export until lazy Codex materializes The provisional lazy-session id was exported at bootstrap before the hub row existed, so path-only self-targeting (GET /api/sessions/:id) could 404 while materialization was still pending. Export on onMaterialized instead, and await materialize in buildHapiMcpBridge before starting the MCP server / spawning Codex so the agent inherits an id the hub can resolve (and so hapiMcpUrl is persisted, not only local pending state). Addresses Codex review Major on #1121. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Debian <heavygee@oos-linux.in.lockhouse> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-07-24 10:56:59 +08:00
SSU-WEI HUANGandGitHub	6bedd0d924	feat(tooling): preserve native tool titles (#1133)	2026-07-23 08:41:33 +08:00
4 people	af962fc61f	fix(cli): stop prepending skill_lookup $name instruction onto user turns (#1096) ... Cursor ACP (and other remotes) flagged the glued-on SKILL_LOOKUP_INSTRUCTION as prompt injection. Keep discovery on the skill_lookup MCP tool description and on system prompts (OpenCode/Grok); do not taint user messages. Fixes #1095 Co-authored-by: Debian <heavygee@oos-linux.in.lockhouse> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-07-20 18:29:29 +01:00
3 people	64834467e3	feat(codex): import and resume sessions from runners (#1088) ... * fix codex import resume flow * fix hub restart session active state * fix codex transcript workspace scoping * Address Codex import review findings * Fix Codex import machine selection * Update Codex sessions error test * Address Codex import review findings * Preserve forked Codex session id on sync * Make Codex duplicate cleanup source-aware * Handle Codex archive failures * Limit existing session flag to Codex * Preserve Codex import machine binding * fix: rebase runner Codex import onto current main * fix: preserve runner-scoped Codex import behavior --------- Co-authored-by: syy <815728149@qq.com>	2026-07-19 14:14:42 +08:00
DullJZandGitHub	e737d67aaa	fix(opencode): treat empty tool input as missing and recover late tool-calls (#1052) ... * fix(opencode): stop treating empty tool input as final args OpenCode emits input/rawInput as {} on tool start (and sometimes again during permission), then fills real arguments on running/completed. Treat empty objects as unusable so ACP and local hooks keep waiting for real args, never clobber them, and ignore non-tool parts as fake results. * fix(web): add exec timing fields to ToolCard test fixture ChatToolCall now requires execStartedAt/execCompletedAt; update the fixture so typecheck passes. * fix(opencode): recover late tool-call after empty execute.before Skip empty before under name-only queue pairing, emit tool-call on after when still missing, and reject content JSON {} on ACP initial tool_call.	2026-07-18 12:26:23 +08:00
SSU-WEI HUANGandGitHub	f457156bd1	feat(cli): add skill_lookup MCP for non-native agents (#1035) ... * test: reproduce issue #752 * fix: expose skill lookup MCP tool (closes #752) * test: cover ACP skill lookup instructions * fix: inject ACP skill lookup instruction * test: narrow skill lookup auto-approval * fix: restrict skill lookup auto-approval * test: cover exact skill lookup tool names	2026-07-16 12:31:36 +08:00
SSU-WEI HUANGandGitHub	b9eed7c071	feat: add Grok Build support (#1030) ... * test: define Grok Build integration behavior * feat: add Grok Build agent integration * test: cover Grok permissions and resume paths * docs: add Grok Build setup guide * fix: scope Grok ACP discovery to session cwd * fix: align Grok permission UI semantics * docs: clarify Grok runner setup * test: require Grok create model and effort options * feat: add Grok create model and effort pickers * test: define Grok runtime parity behavior * feat: add Grok runtime ACP controls and discovery * fix: tighten Grok runtime controls * fix: suppress nonfatal Grok title quota errors * feat: support Grok Auto permission mode * feat: forward ACP native session titles for Grok * fix: guard Grok Windows shell arguments	2026-07-13 08:41:30 +08:00
HaoandGitHub	d0c8391261	fix(opencode): preserve ACP text deltas (#1023)	2026-07-12 18:40:18 +08:00
weishu	5a377e38b9	fix(codex): defer session persistence until user activity	2026-07-12 11:00:08 +08:00
SSU-WEI HUANGandGitHub	5ade952218	fix(cursor): support ACP parameterized model picker (#969) ... * test: reproduce issue #968 * fix: support Cursor parameterized model picker (closes #968)	2026-06-29 11:41:21 +08:00
3 people	2ab3b39887	fix(hub,cli): four hub-restart-cascade cleanup bugs (#913 #914 #916 #919) (#923) ... * fix(hub,cli): four hub-restart-cascade cleanup bugs (#913 #914 #916 #919) These four contained bugs were uncovered by a 2026-06-15 hub-restart incident where `hapi-restart-hub` SIGTERMed 23 cursor ACP sessions. Each fix lands independently of the architectural #915 (hub-restart cascade-archive) and the hypothesis-pending #917 (reopen creates dead session); audit-trail correctness and idempotency wins stand on their own. Fresh ACP sessions could be SIGTERMed during the async `update-metadata` ACK round-trip, stranding the on-disk ACP store with no DB handle. Add `ApiSessionClient.flushMetadata()` and await it after `onSessionFoundWithProtocol` on the fresh-session branch. Resume-path pre-registration (PR #834) is unchanged. Hub-restart-cascade SIGTERMs went through the same path as web-UI Archive clicks, both writing archiveReason='User terminated'. New default is 'Hub restart'; the KillSession RPC handler (the authoritative user-archive signal) now explicitly stamps 'User terminated' before cleanupAndExit. SIGINT (local-terminal Ctrl-C) keeps the 'User terminated' label too. `rpcGateway.killSession` threw a generic Error when no target socket was registered, and the archive route surfaced that as 500. Add typed `RpcTargetMissingError`, narrow on it in `syncEngine.archiveSession`, fall back to a hub-side `markSessionArchivedFromHub` write so lifecycleState still flips to 'archived'. Drop the requireActive guard on the route and 2xx-noop for already-archived rows. without refresh, producing forever-409 on rename/reopen until an unrelated event triggered a cache refresh. `renameSession`, `clearSessionArchiveMetadata`, `restoreSessionArchiveMetadata` now retry-with-refresh (5 attempts, then throw) mirroring the existing good pattern in `mergeSessions`. Refs tiann/hapi#913 Refs tiann/hapi#914 Refs tiann/hapi#916 Refs tiann/hapi#919 AI disclosure: implementation by Claude Sonnet 4.5 (Cursor agent peer) under operator supervision. Issue triage by a sibling discovery agent. Per CONTRIBUTING.md AI-assisted contributions policy. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): runner-spawned children use 'Stopped by runner' as default archive reason Addresses bot review of #923: with the #914 default-archiveReason flip to 'Hub restart', runner-driven SIGTERM paths (`hapi runner stop-session`, webhook-timeout cleanup at run.ts:587, orphan-cleanup at run.ts:267) all mislabel as 'Hub restart' which is also inaccurate audit-trail noise. Smallest defensible change: parameterise the lifecycle default via HAPI_DEFAULT_ARCHIVE_REASON env, and have the runner set 'Stopped by runner' on spawn. Terminal-launched sessions (no runner parent, no env var) still default to 'Hub restart' since hub-restart cascade documented at #915 is the most plausible SIGTERM source for those. Explicit overrides via setArchiveReason (KillSession RPC, SIGINT Ctrl-C, markCrash uncaught exception) still win. Two new unit tests cover the env-var default and the override precedence. Refs tiann/hapi#914. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(hub): markSessionArchivedFromHub surfaces persistence failures as 5xx Addresses second-round bot review of #923 (Major): `markSessionArchivedFromHub` silently returned on DB write errors and on exhausted version-retry attempts, which would let `/archive` claim 200 OK while the row stayed unarchived. That regresses the #916 acceptance criterion that non-RPC errors during archive must still propagate as 5xx. Both fall-through paths now throw, matching the contract of the sibling writers in this file (renameSession, mergeSessions). The sessionModel test suite gains two cases that spy on `store.sessions.updateSessionMetadata` to force `error` and `version-mismatch` shapes and asserts the helper throws. The existing route test at `hub/src/web/routes/sessions.test.ts:1015` already covers the route-level 500 propagation for any error thrown out of `archiveSession`, so no new route test is needed. Imports `spyOn` from `bun:test` to match this test file's runtime (the rest of the hub package uses bun:test, not vitest). Refs tiann/hapi#916. Co-authored-by: Cursor <cursoragent@cursor.com> * revert(cli): drop HAPI_DEFAULT_ARCHIVE_REASON env override Reverts `1c8972a3`. Bot review round 3 surfaced that the env-on-spawn approach (the bot's own round-1 suggestion shape) mislabels hub-restart-cascade SIGTERMs against runner-spawned children: systemd killcgroup on `hapi-runner.service` stop sends SIGTERM to all runner-children directly, and those would archive as 'Stopped by runner' instead of 'Hub restart'. The two suggestions are mutually incompatible without adding an IPC channel (stdio: 'ipc' on spawn) so the runner can stamp setArchiveReason via childProcess.send() before SIGTERMing. That is a refactor, not a smallest-defensible change. Going back to the simple shape: SIGTERM default is 'Hub restart' for everyone, runner-internal stop paths share that label. The audit-trail-correctness criterion from the #914 issue is met (SIGTERM no longer falsely labels as 'User terminated'). Finer attribution between cascade vs runner-stop is deferred as a follow-up. Refs tiann/hapi#914. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): clean completions get 'Session completed', not 'Hub restart' Addresses bot review round 4 of #923 (Major): every agent runner (runClaude, runCodex, runCursor, runGemini, runKimi, runOpencode) calls setSessionEndReason('completed') on the natural exit path without touching archiveReason. With the SIGTERM default flipped to 'Hub restart', clean completions were now archived as restart cascades. Fix: setSessionEndReason flips archiveReason to 'Session completed' when it transitions to 'completed' AND no caller has already overridden the archive reason. This covers all six agent runners with a single setter change (no per-runner edits). Two new tests cover the natural-completion default and the override precedence (explicit setArchiveReason still wins). Refs tiann/hapi#914. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(hub): restore inactive-session guard on /archive except split-brain Addresses post-rebase bot review Major on #923: dropping requireActive entirely let normal inactive non-archived rows (completed stubs, UI Delete/Reopen targets) fall through to archiveSession, which could stamp archivedBy=hub on sessions that were never active. Restore the 409 for inactive rows unless metadata.lifecycleState is still 'running' (hub-restart split-brain cleanup case from #916). Two route tests cover the guard and the exception. Refs tiann/hapi#916. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): merge runnerLifecycle tests after upstream rebase Post-rebase fix: Session completed tests referenced makeFakeSession which was renamed to createMockApiSessionWithMetadataCapture when merging upstream hasExplicitSessionEndReason tests with #914 archive reason coverage. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): pass lifecycle object to KillSession handler in Pi runner Upstream #862 (Pi agent) landed after this branch was cut. runPi.ts still registered the legacy bare cleanupAndExit callback, so web Archive for Pi sessions would persist archiveReason: Hub restart instead of User terminated. One-line fix matching the other six agent runners. Refs tiann/hapi#914. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>	2026-06-19 17:37:32 +08:00
3 people	02a0aa6733	fix(cursor): surface agent errors with warning styling in web UI (#871) ... * test: reproduce issue #864 Assert Cursor error paths emit agent error payloads and web UI renders them as warning-styled events instead of neutral session messages. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cursor): surface agent errors with warning styling in web UI (closes #864) Route Cursor stderr, init, prompt, and legacy exit failures through sendAgentMessage({ type: 'error' }) and teach the web chat layer to render error events with a warning icon instead of neutral info text. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>	2026-06-18 10:17:57 +08:00
4 people	e23ae1b265	feat: add Pi Coding Agent support (#862) ... * docs: spec for hapi-pi-agent-backend * docs: spec retrospect for hapi-pi-agent-backend * docs: plan for hapi-pi-agent-backend * docs: plan retrospect for hapi-pi-agent-backend * feat(pi): add hapi pi command with JSONL transport and event converter - PiTransport: spawn pi --mode rpc, JSONL stdio, ENOENT/EPIPE handling - PiEventConverter: Pi AgentEvent → HAPI AgentMessage conversion - runPi: session lifecycle, dual-track event routing, model switching - pi command: CLI registration with PI_PERMISSION_MODES - Shared: add 'pi' to AGENT_FLAVORS, FLAVOR_CAPS, FLAVOR_LABELS 30 tests passing (15 transport + 15 converter) * fix(pi): add Pi RPC types, fix double-cleanup/double-start/converter safety net - Add cli/src/pi/types.ts with PiAgentEvent/PiResponseEvent discriminated unions - PiTransport: constructor uses options object, double-start guard, drop log - PiEventConverter: typed events via type assertions, top-level try/catch - runPi: safeCleanup guard prevents double-cleanup race, sendAgentMessage for converted events, keepAlive() for session pings - 33 tests passing * docs: dev phase reviews and test results for hapi-pi-agent-backend - Business logic review: pass (0 must_fix) - Standards review: pass (0 must_fix) - Taste review: P0 types issue fixed in code - Robustness review v2: pass (v1 3 MUST_FIX all fixed) - Integration review: pass (0 must_fix) - Test results: 33 passing, all type errors resolved * docs: taste review v2 pass after type definition fixes * docs: dev retrospect for hapi-pi-agent-backend * test: test execution for hapi-pi-agent-backend (20/20 pass) * fix: add taste_review symlink for gate pattern match * docs: test retrospect for hapi-pi-agent-backend * fix(web): add pi to MODEL_OPTIONS Record type * ci: PR and CI evidence for hapi-pi-agent-backend * docs: overall retrospect for hapi-pi-agent-backend (all 5 phases) * test(pi): add buffer split, missing fields, and handleResponse tests - PiTransport: buffer cross-chunk reassembly test - PiEventConverter: tool_execution_end with missing result/toolCallId - handleResponse: 10 tests covering all branches (error, get_state, set_model, new_session, abort, prompt, unknown command) - Extract handleResponse to accept onUpdate callback for testability - Total: 46 tests passing (was 33) * fix(pi): set requiresRuntimeAssets to false — pi runs as subprocess, no native tools needed * refactor(cli): lazy import ensureRuntimeAssets to reduce startup overhead * docs: add 15 manual E2E protocol test cases (TC-4-xx) based on real Pi RPC capture - TC-4-01 to TC-4-15: manual tests covering tool execution, thinking lifecycle, multi-turn, abort, error scenarios, model switch, cleanup - Priority: P0 (tool fields, failure, thinking, multi-turn, abort) > P1 (basic conversation, write tool, model switch, usage) > P2 (edge cases) - Includes actual Pi RPC event sequence from live capture as reference - e2e-test-plan.md updated with test environment setup instructions - Total test cases: 35 (6 unit + 14 integration + 15 manual) * test: E2E protocol test results for hapi-pi (11/15 pass) P0/P1 automated tests (8/8 pass): - TC-4-01: Basic text conversation ✓ - TC-4-02: Tool read (field names verified) ✓ - TC-4-03: Tool write (file created) ✓ - TC-4-04: Tool failure (isError=true) ✓ - TC-4-05: Thinking lifecycle + usage ✓ - TC-4-06: Multi-turn context retention ✓ - TC-4-07: Abort generation ✓ - TC-4-14: Token count ✓ - TC-4-15: Extension UI events ignored ✓ P2 results: - TC-4-10: Invalid token → 401 ✓ - TC-4-12: Ctrl+C cleanup, no orphans ✓ - TC-4-08: ENOENT (harness issue, exit code correct) - TC-4-11: set_model not supported by Pi (success=false) - TC-4-13: Pi crash (harness output capture issue) * test: fix TC-4-11 result — Pi set_model works with correct provider/modelId Previous test used invalid provider='' + modelId='deepseek-chat'. Re-tested with provider='deepseek' + modelId='deepseek-v4-flash': - set_model success=true - model switched glm-5.1 → deepseek-v4-flash - subsequent prompt confirmed working Final E2E results: 12/15 PASS, 2 FAIL (test harness), 1 SKIP * chore: remove .xyz-harness/ from git tracking, add to .gitignore Local harness workflow artifacts should not be tracked in the repo. * fix(pi): resolve web UI bugs for hapi-pi integration Five bugs fixed for end-to-end pi session via hapi web UI: 1. runner buildCliArgs: add 'pi' branch to spawn correct command (was falling back to 'claude', launching wrong agent) 2. runPi: implement real keep-alive (2s interval) to prevent hub 30s timeout marking session inactive 3. runPi: bump keep-alive to active state during agent/turn_start 4. sessionResume: add 'pi' to flavor switch and resume condition (was returning undefined, causing 'cannotResume' on inactive session) 5. PiEventConverter: emit codex-compatible {type:'message',message:...} /{type:'reasoning',message:...} with streamId; dedup by skipping text_start/text_end (only send deltas) to avoid triple-rendered text 6. PiTransport: fallback to stdout 'end' event when child process close event doesn't fire (bun spawn quirk) Verified end-to-end: web UI shows pi reasoning + reply correctly, session stays online, no duplicate text. * fix(pi): address 4 web UI display bugs in hapi-pi integration Three of four follow-up bugs reported after the initial fix (6c28949): 1. Stuck in 'queued' status — fix Pi's runner doesn't use MessageQueue2, so the base session's onBatchConsumed hook never fires. Add a FIFO of pending localIds in runPi and emit messages-consumed on agent_start. turn_start is intentionally skipped (it can fire multiple times per agent run after tool calls). A prompt rejection from Pi also consumes the localId so the next prompt isn't poisoned. 2. AI thinking only displays ':' — fix Pi emits pure incremental deltas (text_delta / thinking_delta) per token. The web reducer dedupes reasoning by streamId WITHIN one message's content array only — separate wire messages produce separate renders. Without accumulation, 50 deltas = 50 reasoning renders, of which the reducer keeps only the last delta (a single character like ':'). 3. Output text on separate lines — fix Same root cause as #2 but for text: the reducer appends each text AgentMessage as a new agent-text block (no dedup), so 50 deltas become a 50-row character-by-character column. 4. Tool call execution status (in_progress -> completed) The tool result wire CodexMessage type is 'tool-call-result' (with callId + is_error?); the internal AgentMessage 'tool_result' is converted to that. Status mapping is preserved. Implementation: extract a PiMessageAccumulator class (testable in isolation) that mirrors codex's ReasoningProcessor pattern: - message_start resets state and streamId - text_delta / thinking_delta append to internal text / reasoning - text_start/thinking_start/text_end/thinking_end ignored (they carry full partial state — would duplicate) - message_end flushes (max 1 reasoning + 1 text message, in order) - turn_end safety net flushes if active - flushIfActive() exposed for transport close / crash The converter now routes AgentMessage through convertAgentMessage so the wire format is codex-shaped (matches opencode/gemini/kimi path). AgentMessage 'text' and CodexMessage 'message' both gain optional id; convertAgentMessage preserves caller-provided id for streamId-based dedup on the web side. Tests: 16 new PiMessageAccumulator tests + 5 updated PiEventConverter tests + 4 messageConverter tests, all passing. Full suite: 909/910 (1 unrelated macOS path normalization). tsc clean. * fix(pi): review round 1 - 1 must-fix issue The web session-resume helper referenced metadata.piSessionId, but the shared MetadataSchema does not define the field, and the back-end has no path to populate it (Pi session resume is out of scope per spec.md). This caused web typecheck to fail and would also have produced a runtime 'resume_unavailable' from the hub if a user tried to resume a Pi session that had any user messages (the stale 'flavor === pi' branch in inactiveSessionCanResume claimed resume was supported). Revert the two early Pi branches from the web resume helper. Add a comment pointing at the spec and noting what to undo when back-end resume ships (re-add 'case pi' + 'piSessionId' on MetadataSchema + extend hub resolveAgentResumeId). * fix(pi): review round 2 - 4 must-fix issues 1. cli/src/runner/run.ts buildCliArgs: stop forwarding --resume to the pi binary. Pi session resume is out of scope (no piSessionId on Metadata), so forwarding would create an orphan session the hub can't track. Hub already returns null from resolveAgentResumeId for flavor='pi' and falls through to fresh spawn; this just hardens the runner layer to match. 2. cli/src/pi/runPi.ts: cache currentProvider from get_state and use it for subsequent set_model RPCs. Pi's set_model requires both provider and modelId, but the bootstrap-time code emitted provider: '' which Pi rejects. The bootstrap-time model is still applied by Pi at startup, so suppressing set_model until get_state arrives is a no-op for same-model configs rather than a wrong-model emit. 3. web/src/components/AssistantChat/modelOptions.ts: add explicit pi branches to getModelOptionsForFlavor and getNextModelForFlavor. Without them, Pi sessions fell through to the Claude preset cycler, which would push sonnet/opus ids into a Pi session via set-session-config. Mirrors the opencode handling introduced earlier. Tests added/updated: buildCliArgs covers pi + claude resume; handleResponse mirror test covers provider caching; modelOptions tests cover pi no-fallback behavior for both option list and cycler. * fix(pi): add session resume support and fix review issues - Add piSessionId to MetadataSchema (shared/src/schemas.ts) - Persist piSessionId from get_state response to metadata (cli/src/pi/runPi.ts) - Pass --session-id to Pi spawn on resume (cli/src/pi/runPi.ts) - Add pi branch to resolveAgentResumeId (hub/src/sync/syncEngine.ts) - Add case 'pi' to resolveAgentSessionIdFromMetadata (web/src/lib/sessionResume.ts) - Replace pi resume skip guard with --session-id forwarding (cli/src/runner/run.ts) - Preserve piSessionId in pickExistingSessionMetadata (cli/src/agent/sessionFactory.ts) - Add pi badge to AgentFlavorIcon (web/src/components/AgentFlavorIcon.tsx) - Fix transport.onClose crash-marking on normal shutdown (cli/src/pi/runPi.ts) * fix(pi): review round 1 - 3 must-fix issues - resume.ts: add pi branch to dispatchLocalResume() so hapi resume dispatches to runPi instead of falling through to cursor - runPi.ts: accept existingSessionId and use bootstrapExistingSession when resuming, matching other agents' pattern - agentCommandOptions.ts: parse --session-id in addition to --resume so runner-spawned pi resume actually forwards the session ID - types.ts: export PiPermissionMode alongside other agent permission mode types for consistent import convention * fix(pi): review round 2 - 2 must-fix issues * refactor(workflow): improve pi-adaptation-review-loop robustness - Switch from structured output to file-based JSON output for reliability - Replace per-round file limit (20→30) with clear wording (remove misleading split-commits instruction) - Return { data, error } from readResultFile() to surface parse/validation failures in abortReason - Fix lastMustFix sentinel: initialize to null, use ?? for explicit N/A reporting - Add getAgentDirs() to dynamically discover agent dirs from cli/src/ - Document rollbackTo() atomic-round design intent - Add isValidIssue() validation, runFinalCleanup() helper, git repo pre-check * test(pi): add coverage for pi flavor across shared, cli, and web - shared/flavors.test.ts: pi/kimi capability, label, known, supports - shared/modes.test.ts: PI_PERMISSION_MODES contract, per-mode checks (7-mode allowed/denied matrix) - web/AssistantChat/modelOptions.test.ts: pi shortcut vs Claude cycler, normalize filter (auto/default/whitespace), kimi/cursor/ opencode cross-flavor consistency - web/lib/sessionResume.test.ts: piSessionId resolver, cross-flavor stale-id protection, inactiveSessionCanResume for pi, regression coverage for all 6 other flavors - web/components/AgentFlavorIcon.test.tsx: pi badge styling (bg-[#5b21b6]), Un fallback, case/whitespace normalize, className override - cli/commands/agentCommandOptions.test.ts: --session-id (pi-specific flag), --resume alias, PI mode validation, --yolo vs explicit-mode priority 137 new test cases, all passing. Full suite: 96 files / 933 tests green (unrelated apiMachine.test.ts macOS /private/var path issue remains as documented in handoff). * feat(pi): implement P0 — context budget bar + dynamic model discovery P0-1: Context Budget Bar - Add pi branch to modelConfig.ts getContextBudgetTokens() - Conservative 200K default context window for Pi sessions P0-2: CLI-side model discovery - Add get_available_models to PiRpcCommand type - Auto-send get_available_models after get_state in runPi.ts - Cache model list and push to session metadata - Register ListPiModels RPC handler with promise-based transport query P0-3: Hub-side routing - Add listPiModelsForSession to rpcGateway and syncEngine - Add REST endpoint GET /sessions/:id/pi-models (pi sessions only) P0-4: Web-side rendering - Add PiModelSummary type to shared apiTypes - Add usePiModels hook (TanStack Query, stale 60s) - Add getSessionPiModels to API client - Add sessionPiModels query key - Wire piModelOptions into SessionChat availableModelOptions - Model dropdown renders discovered models or falls back to Default * fix(pi): address code review findings + pre-existing test issue Review fixes: - Fix race condition in sendPiRpcAndWait: use incremental id as key instead of command type, preventing resolver overwrite on concurrent calls (e.g. auto-discovery + ListPiModels RPC) - Extract parsePiModels() to eliminate duplicated model parsing logic between handleResponse and ListPiModels RPC handler (DRY) - Add resolvePendingRpc() call in error response path to prevent promise leaks when Pi rejects an RPC with an id - Add piModelsState.error guard to onModelChange in SessionChat, matching the pattern used by codex and cursor flavors Pre-existing fix: - Fix apiMachine.test.ts symlink assertion on macOS (/var vs /private/var) by applying realpathSync to the expected path * feat(pi): P1 — session rename sync, thinking level UI, skills/commands P1-1: Session Rename → Pi notification - Add set_session_name to PiRpcCommand - Register RenamePiSession RPC handler in CLI - Hub syncEngine.renameSession now forwards to Pi CLI for active sessions - Hub rpcGateway + REST endpoint added P1-2: Thinking Level support - Add Pi thinking level constants to shared/src/piThinkingLevel.ts (off/minimal/low/medium/high/xhigh) - Add ThinkingLevel capability to Pi flavor in flavors.ts - sessionConfigRpc now supports effortMode for Pi thinking level - runPi captures thinkingLevel from get_state and forwards via set_thinking_level - Hub effort endpoint accepts pi sessions (was claude-only) - Web: piThinkingLevelOptions.ts + HappyComposer renders Pi options when flavor=pi P1-3: Skills/Commands discovery - Add get_commands to PiRpcCommand, auto-discover after get_state - Register ListPiCommands + ListSlashCommands RPC handlers in CLI (maps Pi commands to HAPI SlashCommand format) - Hub: listPiCommandsForSession + REST GET /sessions/:id/pi-commands - Web: usePiCommands hook + api client + query keys Also fixes: - Pre-existing ZodError.errors → ZodError.issues in hub/socket/server.ts - Updated test expectation for effort endpoint error message * feat(pi): implement P2 features — steer, queue modes, history, native images P2-1: Steer/Follow-up - Track piIsStreaming state from agent_start/turn_start/turn_end/agent_end - When streaming, onUserMessage sends steer instead of prompt - Added PiSteer/PiFollowUp RPC methods + hub routing + REST endpoints P2-2: Queue modes - Added set_steering_mode/set_follow_up_mode to PiRpcCommand - CLI RPC handlers with mode state tracking - Hub routing + REST POST endpoints - Web API client methods P2-3: History replay - Added get_messages to PiRpcCommand - CLI handler converts Pi AgentMessage to PiMessageEntry format - Hub RPC routing + REST GET /sessions/:id/pi-messages - Web usePiMessages hook + query key P2-4: Native image passing - Added PiImageContent type for base64 image data - extractPiImages() helper reads attachment files as base64 - prompt/steer commands now include images field - Falls back to @path text reference for non-image/unreadable files * feat(pi): implement P3 advanced features — compact, fork, clone, switch, stats, export P3 features for Pi agent integration: - Compact: compact RPC with custom instructions, set_auto_compaction toggle - Fork: fork at entry ID, get_fork_messages for fork context - Clone: clone current Pi session - Switch Session: switch Pi to a different session by path - Session Stats: get token counts, message counts, cost - HTML Export: export session as HTML file All features follow existing P2 pattern: - CLI: RPC handlers in runPi.ts with sendPiRpcAndWait - Hub: rpcGateway + syncEngine routing + REST endpoints - Web: API client methods + query keys + type exports + hooks (stats, fork messages) Total: 8 new REST endpoints, 9 RPC handlers, 6 web API methods Typecheck: all 3 packages pass (cli+hub+web) Tests: 1155 pass (263 hub + 803 web + 89 shared), 0 failures * refactor(pi): clean up runPi.ts imports and readability - Replace require('fs') with top-level import { readFileSync } from 'fs' - Extract handleGetState() as standalone function from handleResponse switch case (get_state case: 35 lines → 4 lines dispatch) Typecheck: all 3 packages pass Tests: 1066 pass (263 hub + 803 web), 0 failures * fix(pi): remove native image passing, fix version pollution - Remove extractPiImages helper and PiImageContent type: all attachments now use @path text references via formatMessageWithAttachments, consistent with every other agent - Remove images field from prompt/steer/follow_up RPC commands - Remove unused readFileSync import - Restore cli/package.json version from test pollution (0.0.0-integration-test-should-be-auto-cleaned-up-51369 → 0.20.0) Typecheck: all 3 packages pass Tests: 1286 pass, 0 failures * refactor(pi): extract hub helper, unify web hooks, fix import style - Hub: extract withPiSession helper eliminating boilerplate across 15 Pi REST endpoints (~400 lines → ~150 lines) - Web: unify usePiForkMessages and usePiSessionStats to return destructured typed fields matching usePiModels/usePiCommands pattern - Web: move 15 Pi response types from inline import() to top-level named imports in api/client.ts - CLI: remove duplicate PiCommandSummary/PiCommandsResponse from types.ts, re-export from @hapi/protocol/apiTypes Typecheck: all 3 packages pass Tests: 1286 pass, 0 failures * chore: untrack .agents/skills and .pi, fix .xyz-harness in gitignore * refactor: remove unused text message id from converter layer, update gitignore * fix: update tests for pi resume support and text id removal * fix: restore cursor resume branch in buildCliArgs * refactor: remove pi-specific rename from syncEngine, align with other agents * refactor: remove effort field from sessionConfigRpc, Pi self-handles RPC Pi agent now self-handles SetSessionConfig RPC (like Claude) using the existing field, instead of adding a parallel field to the shared sessionConfigRpc helper which only knows about . - Remove effort/effortMode from sessionConfigRpc types and logic - runPi.ts: self-register RPC handler with PiThinkingLevel validation - Reuse resolveSessionConfigPermissionMode from sessionConfigRpc * refactor: consolidate Pi RPC layer from 36 methods to 3 generics rpcGateway: 12 methods → callPiRpc<T> syncEngine: 12 passthroughs → callPiRpc<T> delegate web client: 12 methods → callPiEndpoint<T> routes: use engine.callPiRpc with RPC_METHODS constants hooks: use callPiEndpoint, add missing type imports * chore: revert unrelated apiMachine test change * refactor: remove unused ThinkingLevel capability from flavors Pi's thinking level is an effort variant, not a separate capability. The ThinkingLevel constant and supportsThinkingLevel() had zero callers — the frontend uses flavor-based branching for effort option rendering. * refactor: drop Pi prefix from generic RPC method names * refactor: remove 13 Pi RPC methods with no UI consumers Steer: already handled by onUserMessage auto-routing Follow-up: redundant with HAPI message queue ListPiCommands/GetMessages/ForkMessages/SessionStats: no UI Compact/SetAutoCompaction/Fork/Clone/SwitchSession/ExportHtml: no UI SetSteeringMode/SetFollowUpMode: no UI Kept: ListPiModels (has UI), SetSessionConfig, ListSlashCommands, Abort, Switch Deleted: 4 web hooks, 13 RPC handlers, 12 REST routes, 13 rpcMethods entries Net: -730 lines * refactor: extract session.ts and loop.ts from runPi.ts Restructure Pi agent following Codex pattern (without Local/Remote splitting since Pi only has remote mode): - session.ts: PiSession class managing state + hub communication - loop.ts: response parsing, RPC resolver, transport event wiring - runPi.ts: thin entry (bootstrap, RPC handlers, lifecycle) Changes from review: - Encapsulate RPC resolver in PiRpcResolver class (session-scoped, not module-level singleton) - Remove unused extractTextFromPiMessage export - Fix inline import('./types') → top-level import * refactor: normalize Pi file naming and improve test coverage - Rename PiTransport.ts → piTransport.ts, PiEventConverter.ts → piEventConverter.ts, PiMessageAccumulator.ts → piMessageAccumulator.ts (match project-wide camelCase convention) - Delete handleResponse.test.ts (tested stale copy of inline function) - Add loop.test.ts with 20 tests covering parsePiModels, parsePiCommands, wireTransportEvents integration, and sendPiRpcAndWait - Total Pi tests: 73 (was 53) * test: add E2E harness with 4 core helpers and integration specs Helper functions in e2e/harness.ts capture the four non-obvious interactions discovered during the 2026-06-09 retest: - longPress: SessionActionMenu is triggered by 500ms press, not click - mockOffline: useOnlineStatus hook listens to navigator.onLine + window offline event, not CDP Network.emulateNetworkConditions - pollForText: thinking indicator flickers in <1s, 3s polling misses - isVisible: element.offsetParent returns null for position:fixed dialogs even when visible; use getBoundingClientRect Plus Chrome lifecycle (startChrome/stopChrome, never pkill chrome) and hub API helpers (loginWithToken, listSessions). 5 integration specs (e2e/integration/) cover: - yolo-permission: toggle + localStorage persistence (4 cases) - codex-dialog: pre-flight check + dialog render (3 cases) - stress: 10 concurrent + invalid JWT + malformed + unknown endpoint (5 cases, all PASS) All 12 integration cases pass. Full E2E results in .xzy-harness/2026-06-09-full-e2e-retest/ (67 cases, 0 functional bugs found). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * fix: resolve Pi model selection and thinking level issues - Fix PiModelPanel: use provider+modelId composite for selection check and React key, preventing duplicate highlights for same-name models across different providers - Fix PiThinkingLevelPanel: unify thinkingLevelMap filtering logic by extracting shared isThinkingLevelSupported utility - Fix HappyComposer: auto-reset effort to highest supported level when switching models, update label to reflect effective level * refactor: remove 29 dead exports from feat-pi-support Remove unused types, methods, and re-exports identified by dead code audit: shared/src/apiTypes.ts (19): - SessionModelIdentifier, ListPiCommandsResponse - PiSteeringMode, PiFollowUpMode, PiSteerResponse, PiFollowUpResponse - PiQueueModeResponse, PiMessageEntry, PiMessagesResponse - PiCompactResponse, PiSetAutoCompactionResponse - PiForkResponse, PiForkMessageEntry, PiForkMessagesResponse - PiCloneResponse, PiSwitchSessionResponse - PiSessionStats, PiSessionStatsResponse, PiExportHtmlResponse cli/src/pi/types.ts (6): - PiSessionStats, PiCompactionResult, PiForkMessageEntry (dead local duplicates) - PiCommandsResponse, PI_THINKING_LEVELS, PI_THINKING_LEVEL_LABELS (dead re-exports) cli/src/pi/piMessageAccumulator.ts (1): - flushIfActive() method (comment claimed runPi calls it, but it doesn't) cli/src/pi/piTransport.ts (1): - isRunning() method (never called in production code) web/ (2): - ProviderGroup, PiThinkingLevelOption (unnecessary exports, made local) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix: resolve 7 PR review issues in Pi support #3 Remove duplicated PI_THINKING_LEVELS in schemas.ts, import from @hapi/protocol #2 Add piAvailableModels field to MetadataSchema (schema-runtime consistency) #6 Replace hardcoded flavor names with supportsEffort() in effort route #1 Move PiRpcResolver from module-level singleton to PiSession instance #4 Add piCachedModels fallback in piModelOptions useMemo #7 Merge message_update dead branch into unified not-converted case #10 Fix misleading Pi model list comments in modelOptions.ts Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix: normalize Pi model object to string in hub sessionCache (#5), remove extra blank line in rpcGateway (#8) #5: applySessionConfig now extracts modelId from { provider, modelId } before passing to setSessionModel / session.model, preventing [object Object] from being stored in SQLite when Pi switches models. #8: Remove double blank line before RpcGateway class declaration. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(pi): preserve piAvailableModels on resume, document SetSessionConfig divergence - sessionFactory: preserve piAvailableModels in pickExistingSessionMetadata so web shows cached models on inactive-session view without RPC round-trip - sessionConfigRpc: extend resolveNullableSessionModel to accept {provider, modelId} object form for schema consistency - runPi: document why Pi manually registers SetSessionConfig instead of reusing registerSessionConfigRpc (wire protocol needs separate fields) - package.json: restore version to 0.20.0 * refactor: remove unused Pi types, extract JsonLineParser, clean up review findings - Remove 13 unused PiRpcCommand variants and PiStreamingBehavior type (YAGNI) - Remove unnecessary exports on 3 internal Zod schemas in pi/schemas.ts - Extract JsonLineParser base class to utils/, shared by PiTransport, CodexAppServerClient, and AcpStdioTransport (eliminates 3x duplicate handleStdout buffer logic) - Remove DEV-only duplicate session ID detection from SessionList.tsx (debug code unrelated to Pi support scope) - Add comments explaining key prefix rationale in SessionChat.tsx * chore: remove unrelated E2E test harness from Pi support PR E2E harness (codex-dialog, stress, yolo-permission, scratchlist specs) was introduced in this branch but tests generic HAPI behavior unrelated to Pi agent support. Should live in a separate PR. * fix: wrap cursor model change handler for union type compatibility * fix: apply startup --model to Pi and remove duplicate lockfile entry 1. --model startup bug: - Add initialModel to PiSession to preserve startup model - handleGetState preserves initialModel instead of overwriting with Pi default - get_available_models handler resolves provider from cached models and sends set_model 2. bun.lock duplicate key: - Remove duplicate @twsxtd/hapi-win32-x64@0.20.0 entry - Fixes CI lockfile regeneration that caused hono type errors * fix: update test expectation for effort endpoint error message * fix(pi): resolve 8 link-review defects + abort session termination - W1C-D-1: hasSameAgentSessionIds missing piSessionId/kimiSessionId + extractAgentSessionId also needs piSessionId recognition - D-1: dispatchLocalResume pi branch missing effort param - W1B-1-01: buildCliArgs only passes --effort for claude, not pi - W2B-D-2: effort=null does not send set_thinking_level to Pi - D-3: turn_start does not consume pendingLocalIds - D-7: keep_alive falls into default case in convertPiEvent - D-9: finally overwrites sessionEndReason set by Switch/Abort - W2B-D-3: ListPiModels RPC does not update metadata - Abort handler: remove cleanupAndExit, only cancel current turn Also: Switch handler returns { success: true } for consistency Test coverage: 13 new test cases across 5 files * fix: restore cli version from integration test placeholder * fix(pi): send restored thinking level to Pi subprocess on startup opts.effort was stored in piSession.currentThinkingLevel but never forwarded via set_thinking_level during the startup sequence, causing runner-spawned and resumed sessions to show the restored effort in HAPI while Pi kept its default. * fix: restore cli package version from integration test residue * fix(pi): switch-to-remote handler preserves session instead of terminating Replace lifecycle.cleanupAndExit() with createModeChangeHandler + keepAlive in the Switch RPC handler. Pi runs as a single long-lived subprocess without BaseLocalLauncher's restart loop, so cleanupAndExit() permanently destroyed the session on mode switch. The web handoff button now correctly changes control mode while keeping Pi alive. * fix(pi): remove permission mode selector (Pi RPC has no runtime switching) Pi's --mode rpc is non-interactive and auto-approves all tool execution; there is no set_permission_mode command in the protocol. The selector reported success without changing Pi's behavior, misleading users. Remove the concept across all four packages: - shared: getPermissionModesForFlavor('pi') returns [] (cascades to hub 400 + web UI auto-hide via length===0 guards); drop PI_PERMISSION_MODES / PiPermissionMode - cli: strip permissionMode from PiSession/runPi/pi command/resume; drop the no-op SetSessionConfig permission branch that stored state without forwarding to the subprocess - web: delete PiPermissionPanel.tsx; remove panel block + imports from HappyComposer * fix(cli): realpath workspace root in apiMachine test assertion The handler realpaths the cwd as a symlink-escape guard, so on macOS /var/folders/... resolves to /private/var/folders/... The test compared against the un-resolved path and failed on macOS. Use realpathSync on the expected value for cross-platform consistency (no-op on Linux where /tmp has no symlink prefix). * fix(pi): keepalive reads current mode instead of constructor-time startingMode The Switch handler updated controlledByUser but PiSession.pushKeepAlive() still emitted the readonly startingMode every 2s, so a runner-started session switched to local would flip back to remote on the next keepalive. Replace readonly startingMode with a mutable mode field; add setMode() that updates it and re-pushes keepAlive immediately. The Switch RPC handler now calls setMode() before handleModeChange. * fix(pi): runner no longer passes permission flags to Pi subprocess After removing the Pi permission selector, the Pi command parser rejects --permission-mode and ignores --yolo. But the shared buildCliArgs tail in the runner still appended these flags for Pi sessions, making runner- spawned Pi children exit before registering a session. Guard the permission/yolo append with agent !== 'pi'. * fix(pi): preserve provider identity when persisting selected Pi model The hub's applySessionConfig normalized Pi's { provider, modelId } object down to a plain modelId string for the shared session.model field, losing the provider. On reload or next render, web's selectedPiModel lookup matched by modelId alone — if two providers share a modelId, the wrong one was highlighted, and subsequent model/thinking-level changes sent the wrong provider to the Pi subprocess. Add a provider-qualified piSelectedModel field to session metadata (schema + persistPiSelectedModel mirroring persistPreferredPermissionMode). Web's selectedPiModel now prefers the provider-qualified match and only falls back to modelId-only matching when absent. * fix(pi): model picker checkmark follows provider-qualified selection selectedPiModel already resolves via provider+modelId, but the model panel's currentPiModel still matched by modelId alone — so with two providers sharing a modelId the checkmark pointed at the wrong row. Reuse selectedPiModel directly. * fix(pi): steer messages consumed immediately, not queued in pendingLocalIds onUserMessage unconditionally pushed localId into pendingLocalIds, but a steer (sent while piIsStreaming) does not start a new turn — so the steer's localId was never drained by turn_start. The next normal prompt's turn_start would consume the stale steer localId instead, leaving the new prompt's bubble stuck in the queued bar. Only queue localId for the prompt path. Steer path emits messages-consumed immediately. * fix(pi): clear stale thinking level when switching to non-reasoning model The model-change effect early-returned when selectedPiModel.reasoning === false, leaving the previously-set effort (e.g. 'high') persisted on the session. The UI hid the thinking picker for the non-reasoning model, but the hub still forwarded the stale effort as set_thinking_level — with no visible control to clear it. Call onEffortChange(null) for non-reasoning models. * fix(pi): return provider-qualified model in SetSessionConfig applied The CLI handler returned only currentModel (bare string), so the hub's applySessionConfig saw a non-object model and cleared metadata.piSelectedModel via persistPiSelectedModel(session, null) — undoing the provider that was just stored on the inbound config. Return { provider, modelId } when both are known so the hub keeps the provider-qualified metadata intact across active model changes. * fix(pi): preserve piSelectedModel in bootstrapExistingSession metadata The metadata whitelist rebuild kept piAvailableModels but omitted piSelectedModel, so the first resume/local-handoff update dropped the provider identity — after which web fell back to modelId-only matching and could select the wrong provider for duplicate modelIds. * fix(pi): await Pi confirmation before reporting model/effort applied SetSessionConfig was fire-and-forget — transport.send wrote JSONL to stdin and returned immediately. If Pi rejected an invalid provider/model or thinking level, the hub still persisted the new value and the UI reported success while Pi kept the old runtime state. Use sendPiRpcAndWait so a failed set_model/set_thinking_level rejects the web request and leaves the session config unchanged. * fix(pi): resolve set_model RPC so awaited model switch does not time out SetSessionConfig awaits sendPiRpcAndWait(set_model) before reporting the model applied, but handleResponse's set_model branch updated state and fell through without calling resolvePendingRpc. The pending RPC promise then waited the full 10s timeout and rejected, making /sessions/:id/model return 409 even though Pi accepted the change. Mirror every other branch by resolving the pending RPC after updating currentModel/currentProvider. * fix(pi): drain pending localId on turn_start only; throw when set_model suppressed - loop.ts: split agent_start/turn_start branches. Pi emits both per prompt; draining on both popped the FIFO twice and shipped an undefined localId to the hub. agent_start now only sets thinking state; turn_start drains. - runPi.ts: when set_model is suppressed (provider unknown), throw instead of silently returning applied, so the hub returns 409 rather than persisting a piSelectedModel Pi never received. - loop.test.ts: assert agent_start does not drain; add regression test that a single turn drains exactly one real localId. * fix(pi): exclude Pi from generic Ctrl/Cmd+M model cycler SessionChat fed piModelOptions into HappyComposer.availableModelOptions, so the global Ctrl/Cmd+M shortcut ran getNextModelForFlavor over the Pi list and called onModelChange with a bare modelId string. Pi needs { provider, modelId } to disambiguate duplicate model IDs across providers; a bare string made runPi fall back to the first cached provider match (wrong provider) or throw when the provider was unknown. Drop the piModelOptions useMemo and pass undefined for Pi, mirroring modelOptions.ts where the Pi branch already returns the current model unchanged (no-op) when no custom options are supplied. Pi model changes now go only through the dedicated provider-qualified picker (piModels). * fix(pi): commit PiSession config only after Pi confirms the RPC SetSessionConfig previously mutated piSession.currentModel / currentProvider / currentThinkingLevel BEFORE awaiting sendPiRpcAndWait(set_model / set_thinking_level). When Pi rejected the value or the RPC timed out, the handler threw and the route returned 409, but PiSession kept the unconfirmed values; the 2s keepalive then reported them back to the hub, where handleSessionAlive persisted a model/effort Pi never accepted. Resolve the requested model/effort into locals first, send the RPCs, and only commit to PiSession after each await resolves. The null (clear-model) path needs no RPC so it still commits immediately; the unknown-provider path still throws without committing. * fix(pi): apply startup model only after Pi confirms set_model Two startup paths persisted the requested --model before Pi confirmed it: 1. handleGetState set session.currentModel = session.initialModel as soon as get_state returned, using the unconfirmed startup model instead of Pi's actual default. If the model was unavailable or rejected, the 2s keepAlive reported it to the hub, which persisted/showed a model Pi never accepted. 2. get_available_models then sent set_model fire-and-forget, so a Pi rejection was never observed and currentModel stayed on the bad value. Fix: handleGetState now reports Pi's real current model (newModel) while a startup model is merely requested. get_available_models resolves the provider from the cached list, awaits set_model, and commits currentModel/currentProvider only on success — on rejection it logs and keeps Pi's default. The await is fired detached so the get_available_models RPC itself still resolves for ListPiModels. * fix(pi): do not persist startup model before Pi confirms set_model The startup --model still reached the hub unconfirmed via two paths the previous Fix #13 left open: 1. bootstrapSession({ model: opts.model }) seeded the hub session model at creation time, and SessionCache.handleSessionAlive persists every non-undefined keepAlive model — so an unavailable/rejected model was stored and shown before get_available_models/set_model ran. 2. PiSession constructor set this.currentModel = opts.model, so the very first keepAlive (sent by startKeepAlive before any RPC confirms the model) reported the unconfirmed value. Pass model: undefined to bootstrapSession and start PiSession.currentModel at null; opts.model is still captured as initialModel and applied/committed only after get_available_models confirms it exists and set_model succeeds (Fix #13). The hub now sees Pi's real current model from the first get_state keepAlive and switches to the requested model only once accepted. Also add sendPiRpcAndWait contract tests pinning the await<->resolve symmetry (Fix #10): set_model/set_thinking_level/get_available_models must resolve before timeout on a success response, and reject on a Pi error. * fix(pi): apply startup effort only after Pi confirms set_thinking_level runPi restored opts.effort straight into piSession.currentThinkingLevel before startKeepAlive ran, and pushKeepAlive persists effort — so a resumed/runner-spawned session could store/show a thinking level Pi rejected or ignored. This is the effort analog of the startup-model confirmation contract (Fix #13/#14). Capture the requested effort into a local startupThinkingLevel instead of mutating currentThinkingLevel up front. After transport.start() and the get_state/get_available_models/get_commands sends, await set_thinking_level and commit currentThinkingLevel + push a keepAlive only on success; on rejection keep Pi's default (already reported by get_state). The await is detached so the run loop is not blocked, and get_state is sent before the set so its authoritative baseline lands first and cannot clobber the confirmed value. * fix(pi): omit unknown runtime config from keepalive, don't clear persisted state Fix #14 changed PiSession.currentModel to start at null so the startup --model was not leaked before confirmation. But the hub treats keepAlive model:null as an explicit clear (sessionCache.ts only skips when the field is undefined), so the first heartbeat (startKeepAlive runs before get_state) now erased a resumed Pi session's persisted model/effort before Pi reported its real state. Distinguish "unknown" from "clear": currentModel/currentThinkingLevel start undefined and keepAlive omits undefined fields (via getKeepAliveRuntime), so the hub leaves persisted values alone until Pi confirms. null remains an explicit clear and is still forwarded. Once get_state/set_model/set_thinking_level confirm a value it is set and reported normally. * fix(pi): disable Ctrl/Cmd+M model cycler for Pi entirely Fix #11 removed piModelOptions from availableModelOptions, assuming getNextModelForFlavor('pi', model, undefined) was a no-op. It is not: the Pi branch returns normalizeCurrentModel(model), i.e. the current modelId as a bare string, so the shortcut still called onModelChange with a bare modelId. That loses the provider and can pick the wrong cached match, clear the model when session.model is empty, or hit 'provider is not yet known'. Short-circuit the handler for Pi so model changes go only through the dedicated provider-qualified PiModelPanel. * fix(pi): persist piSelectedModel from get_state and startup set_model paths Pi stores session.model as the bare modelId and relies on metadata.piSelectedModel ({ provider, modelId }) to disambiguate duplicate modelId values across providers in the web picker and thinking-level filtering. But piSelectedModel was only written by the web /sessions/:id/model path (hub persistPiSelectedModel). The runtime paths that set currentModel/currentProvider — get_state, the startup get_available_models set_model, and the set_model response — only keepAlive'd the bare modelId, so a Pi session on Pi's default model, resumed from CLI, or started with --model had no provider identity in metadata and could render/filter against the wrong provider. Add persistSelectedPiModel(session) (no-op unless both fields are known) and call it after get_state, after a successful startup set_model, and after the set_model response updates the fields. This mirrors what the web picker already does. * fix(pi): default startingMode to remote — Pi has no local TUI path A terminal `hapi pi` launch defaulted to startingMode 'local' and marked the session controlledByUser, but Pi only runs as `pi --mode rpc` with piped stdio — there is no local terminal/TUI input path like Claude/Codex have. The terminal user could not drive the session and the web treated it as local-controlled, so the first terminal Pi session was stuck until manually switched from the web. Default to 'remote' so the session is immediately drivable from the web. An explicit opts.startingMode (runner path) still takes precedence. * fix(pi): resume with remote startingMode — no local TUI path The previous Fix #19 changed the `hapi pi` default to remote, but `hapi resume` still passed startingMode: 'local' into runPi for Pi sessions, re-introducing the same unsupported local-control state on the resume path: setControlledByUser publishes controlledByUser while Pi has no terminal/TUI input, hiding/rejecting remote-only controls until a web switch. Pass 'remote' here too and update the resume test accordingly. * fix: restore e2e/scratchlist.spec.ts deleted from main by mistake The earlier "remove unrelated E2E harness" commit (d1e5b4c) deleted the whole e2e/ directory this branch had added, but scratchlist.spec.ts is a main-branch Playwright spec (the only file under playwright testDir ./e2e). Its removal left `bun run test:e2e` with no tests to run while the script and playwright.config.ts still point at that directory. Restore scratchlist.spec.ts from main; the unrelated harness files (HARNESS.md, harness.*, integration/*.mts) that were genuinely branch-only additions stay removed. --------- Co-authored-by: pi <pi@local> Co-authored-by: Claude <noreply@anthropic.com>	2026-06-18 10:01:10 +08:00
SSU-WEI HUANGandGitHub	c311afddca	fix(codex): Fast mode (service tier) toggle + /fast command (closes #898) (#904) ... * test: reproduce issue #898 (Codex fast mode service tier) * fix(codex): add Fast mode (service tier) toggle and /fast command (closes #898) * feat(codex+web): Fast mode UI toggle with full persistence Wires the Codex Fast mode (service tier) end-to-end so it can be toggled from the web composer and survives reload/handoff: - shared: serviceTier on Session/SessionPatch, session-alive payload, resume target, and a SessionServiceTierRequest schema - cli: AgentSessionBase carries serviceTier through keepAlive; runCodex syncs it to the session instance - hub: service_tier column (schema v10 + migration), store setter, sessionCache + syncEngine plumbing, POST /sessions/:id/service-tier - web: api.setServiceTier + mutation, a Fast/Standard toggle in the composer settings (gated to Codex GPT-5.5/5.4), and StatusBar now reflects the real tier instead of the effort heuristic Refs #898 * fix(codex): preserve unset/persisted service tier on startup keepalive Addresses HAPI Bot [Major] on PR #904: applyCurrentConfigToSession ran setServiceTier(currentServiceTier ?? null) on wrapper-ready, collapsing the untouched `undefined` state into explicit Standard. The immediate setCollaborationMode keepalive then persisted serviceTier: null, silently downgrading resumed Fast sessions and disabling account-default Fast. - Seed currentServiceTier from the persisted session (sessionInfo.serviceTier), so a resumed Fast thread keeps running Fast. - Only call setServiceTier when the tier is explicit (!== undefined), preserving the three-state omit semantics at the keepalive boundary. - Add regression tests: persisted Fast is re-asserted; untouched omits the tier. * feat(codex+web): gate Fast toggle on catalog-advertised service tier The Fast toggle was gated on a model-name regex (gpt-5.5/5.4), which still showed a no-op control to API-key users — Fast credits only apply with ChatGPT login. Codex's model/list catalog advertises the service tiers actually available for each model in the current auth/plan context, so gate on that instead: - cli: capture serviceTiers (ids) per model in ModelListItem + normalizeModel - shared: CodexModelSummary.serviceTiers (flows through the existing getSessionCodexModels pass-through; no hub change needed) - web: codexModelAdvertisesFastTier(sessionModel, models) replaces the regex; SessionChat gates the toggle on it (hidden while the catalog is loading/errored). The toggle now only appears when toggling it will actually take effect. Refs #898 * fix(codex): make explicit Standard service tier sticky across resume Addresses HAPI Bot [Major] (round 2): a single persisted null conflated "untouched" with "explicit Standard". A user who turned Fast off persisted null, but startup mapped null -> undefined (untouched) and omitted serviceTier, so an account/thread-default Fast could silently return after restart/resume. Introduce a distinct stored representation: - 'fast' / 'standard' are explicit user choices; null/undefined = untouched. - Translate 'standard' -> Codex app-server serviceTier: null ONLY when building thread/turn params (toAppServerServiceTier); untouched omits the field. - /fast off now stores 'standard'; the web Standard option sends 'standard'. - Tighten SessionServiceTierRequest to enum(['fast','standard']) so stray tier strings are never forwarded. Tests: sticky-Standard-on-resume regression; turn/thread params translate 'standard'->null and omit on untouched; hub route applies fast/standard and rejects unsupported values + local sessions. Refs #898 * fix(codex): recognize real Fast tier (id 'priority', name 'Fast') in catalog gate Live E2E against an authed Codex session revealed the model catalog advertises the Fast tier with id 'priority' and display name 'Fast' (not id 'fast'), so the /fast/i gate — which only saw tier ids — wrongly hid the toggle for valid ChatGPT users on gpt-5.5/gpt-5.4. Capture both the tier id and name as lowercased tokens so the existing name-based match recognizes 'Fast'. The sent value stays 'fast' (the documented service_tier value / raw additionalSpeedTiers request tier). Verified end-to-end: gpt-5.5/gpt-5.4 gate on, gpt-5.4-mini off. Refs #898 * fix(codex): preserve service tier across session resume Resuming a Codex session spawns a fresh session (serviceTier null) and merges the old one in. Unlike model/effort/permissionMode, serviceTier was neither threaded through the resume spawn nor preserved in mergeSessionData, so a resumed Fast (or explicit Standard) session silently reverted to the account default. Thread serviceTier through the spawn path like its siblings: - hub: resumeSession passes session.serviceTier to spawnSession; rpcGateway + syncEngine carry it in the spawn RPC payload; mergeSessionData preserves it old->new (safety net). - cli: SpawnSessionOptions.serviceTier; apiMachine forwards it; buildCliArgs emits --service-tier for codex; the codex command parses it; runCodex seeds currentServiceTier from the spawn override first (opts.serviceTier ?? sessionInfo.serviceTier), so a resumed thread immediately runs the right tier. Verified end-to-end: set Fast -> kill process -> reopen -> resumed session (new id) still runs Fast. Tests: buildCliArgs --service-tier (codex only), runCodex spawn-override seed, mergeSessionData service-tier preservation. Refs #898 * fix(codex): send advertised 'priority' tier id for Fast, not 'fast' The model catalog advertises the Fast tier with request id 'priority' (display name 'Fast'), and OpenAI docs confirm service_tier='fast' maps to the request value 'priority'. The app-server serviceTier override is a raw request value that does not validate unknown strings (a live probe accepted 'bogus-xyz'), so sending 'fast' risks being silently ignored — no Fast applied. Translate the stored 'fast' state to app-server 'priority' at the thread/turn param boundary (toAppServerServiceTier); the stored/UI/command representation stays 'fast'/'standard'. Verified live: a turn with serviceTier='priority' runs and consumes the Fast-tier rate budget. Addresses HAPI Bot [Major]. Refs #898 * fix(codex): validate --service-tier CLI value (fast|standard) Addresses HAPI Bot [Minor]: the internal --service-tier spawn arg accepted any non-empty string, unlike the web /service-tier enum, so a malformed value could be seeded into currentServiceTier and persisted via keepalive. Parse it to 'fast'|'standard' and reject anything else, matching the web endpoint. Refs #898	2026-06-17 10:27:33 +08:00
3 people	434cd9021d	fix(cursor-acp): surface ACP stdin write failures to web UI (#870) ... * test: reproduce issue #863 Co-authored-by: Cursor <cursoragent@cursor.com> * fix: surface ACP stdin write failures to web UI (closes #863) Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>	2026-06-11 09:11:06 +08:00
3 people	ad038bbf2e	fix(cursor): merge SKU catalog under ACP lock and refcount agent guard (#835) ... Fixes incomplete cliModelSkus while agent acp holds the CLI lock (#831) and replace single-pid ACP lock with cross-process refcount (#832). Web picker merges machine/session catalogs and waits for SKU readiness before showing variant labels. Fixes #831 Fixes #832 Co-authored-by: Cursor <cursoragent@cursor.com>	2026-06-08 13:30:43 +08:00
3 people	3a8693f380	feat(cursor): migrate remote sessions to ACP with model/variant pickers (#799) ... * feat(cli,web,hub): migrate Cursor remote sessions to ACP with model/effort pickers Move stream-json remote launcher to legacy path and add ACP launcher with set_config_option model/mode sync, optimistic keepalive on config changes, and shared catalog caching. Web gets dual base/effort Cursor pickers for session and new-session flows; hide composer status bar when Cursor sends no usage_update. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli,web,shared): Cursor model picker — ACP wires + CLI sku variants Enrich the web/mobile picker with agent --list-models SKUs grouped under ACP wire bases, fix session-open base highlight, and keep catalog discovery safe while the ACP transport holds the CLI lock. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cursor-acp): apply ACP default model when web resets to Default Web sends model: null for Default; push session/set_config_option with the ACP default[] wire so Cursor backend matches hub state. Regression tests for setModel(null) and applyModelConfig(null). Co-authored-by: Cursor <cursoragent@cursor.com> * fix(acp): clear stale agent-acp lock when owning process is gone Check lock pid with signal 0; remove orphaned lock dirs after SIGKILL or crash so listCursorModels can run cold probes again. Regression tests for guard and catalog discovery. Co-authored-by: Cursor <cursoragent@cursor.com> * test(cursor): use live pid for ACP lock handler tests Stale-lock cleanup clears dead pids; handler tests must simulate an active lock with the current process pid to avoid cold probes/timeouts. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(acp): scope agent CLI lock guard to Cursor agent command only Gemini/OpenCode/Kimi ACP sessions must not register agent-acp-active; that blocked listCursorModels while unrelated backends were running. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(hub,web): reject Cursor model changes for local sessions Hub returns 409 when controlledByUser is set, matching Codex. Web hides model and variant pickers for local Cursor sessions so users do not hit a dead RPC path. Document pre-push-review in AGENTS.md. Verified: bun typecheck; bun run test (919 cli + 243 hub + 768 web + 46 shared). Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): send stable ids for Cursor ask_question replies Parse and submit question.id and option.id so ACP receives keys like { approach: ['a'] } instead of index/label. Verified: bun typecheck && bun run test. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>	2026-06-06 19:51:35 +08:00
junesandGitHub	30564601ed	fix(cli,web): hide Windows spawn windows and show queued attachments (#765) ... * fix(cli,web): hide Windows spawn windows and show queued attachments * fix(web): preserve attachment-only queued edit text	2026-06-01 18:50:16 +08:00
3 people	02d4e93178	fix(acp): drop mid-stream usage emit; OpenCode only sends usage_update at end-of-turn (#760) ... PR #756 added a mid-turn emit in captureUsageUpdate to surface live context usage via the web status bar. Testing against OpenCode 1.15.11 on a real session shows OpenCode emits a single usage_update per turn, within ~1ms of session/prompt resolving — never during streaming. That makes the mid-turn path dead code for OpenCode (and for any other ACP agent that follows the same pattern). It also persists a useless inputTokens:0/outputTokens:0 token_count message that gets immediately overwritten by the finalize emit, churning the session history. Drop the mid-stream emit and the activeOnUpdate plumbing it required. Keep the finalize fallback for agents that don't return a usage block on session/prompt (slash-handled turns, errored turns). The persistent "live" counter requires the agent to emit usage_update during streaming; filed upstream against anomalyco/opencode. Refs #750 via [HAPI](https://hapi.run) Co-authored-by: HAPI <noreply@hapi.run>	2026-06-01 12:07:40 +08:00
SSU-WEI HUANGandGitHub	994a820e43	fix(opencode): surface ACP context usage live to web status bar (#756)	2026-05-31 19:36:13 +08:00
3 people	4b24528362	fix(acp): flush straggler chunks promptly after session/prompt returns (#730) ... * fix(acp): flush straggler chunks promptly after session/prompt returns After session/prompt returns, HAPI drains buffered agentMessageChunk text and marks the turn complete, but leaves the message handler alive. Models with long streaming tails (DeepSeek, GPT-5.5) continue to push chunks after that drain, causing text to accumulate in the buffer and only appear when the next user prompt triggers the pre-prompt drain — showing up in the wrong turn with broken markdown. Start a 50ms interval timer after the post-prompt drain that keeps calling drainBuffers() on the live handler for up to 6 seconds, so straggler chunks are emitted within one poll tick instead of waiting for the next prompt. The timer is cancelled when the next prompt starts (pre-prompt drain replaces the handler) or on disconnect. Fixes #609. Also applies to Gemini and Kimi which share the same AcpSdkBackend code path. via [HAPI](https://hapi.run) Co-Authored-By: HAPI <noreply@hapi.run> * fix(acp): gate next turn's handler swap on previous turn's late drain Addresses the github-actions review on #730: the fire-and-forget late-flush timer let `prompt()` resolve while stragglers were still possibly arriving, so a rapid follow-up prompt could either drop those chunks (during the old null-handler gap) or leak them into the new turn's onUpdate. Pre-prompt phase now keeps the previous turn's handler alive across the quiet wait (bounded by LATE_FLUSH_WINDOW_MS) and swaps in a single phase immediately before sending the new session/prompt. The post-prompt late flush timer is unchanged — it still emits idle-window stragglers promptly without delaying the ready signal or `setModel` / `setConfigOption`. Adds three regression tests: late-chunk flushing within the window, pre-prompt straggler attribution to the previous turn's onUpdate, and disconnect cancelling the timer. Removes now-unused PRE_PROMPT_UPDATE_DRAIN_TIMEOUT_MS. via [HAPI](https://hapi.run) Co-Authored-By: HAPI <noreply@hapi.run> * fix(acp): await late drain so ready never fires before stragglers emit Follow-up to bot's repeated MAJOR on #730: even with the pre-prompt gate, the fire-and-forget late-flush timer let `prompt()` resolve before slow tails finished, so the launcher's `ready` signal (and any user follow-up queued against it) raced with text still being emitted to the current turn's onUpdate. Replace the setInterval timer with a synchronous `drainLateBuffers()` awaited in `prompt()`'s finally before turn_complete is sent. It polls drainBuffers every LATE_FLUSH_INTERVAL_MS so the UI keeps streaming smoothly during the wait, and exits early once the model has been quiet for LATE_FLUSH_QUIET_PERIOD_MS (250 ms — adds negligible latency to fast models like Claude whose tail is typically <100 ms) or the LATE_FLUSH_WINDOW_MS upper bound (6 s) elapses. Side effects: - Restore PRE_PROMPT_UPDATE_DRAIN_TIMEOUT_MS (1200 ms): the pre-prompt drain is now just a safety net since the post-prompt wait guarantees the previous turn is quiet by the time the next prompt starts. - Drop the `lateFlushTimer` field, `startLateFlushTimer`, `stopLateFlushTimer`, and their disconnect/pre-prompt cleanup calls. - Update the "emits straggler chunks" test to assert ordering before turn_complete, and add a fast-path test confirming the drain exits promptly when the model is quiet. via [HAPI](https://hapi.run) Co-Authored-By: HAPI <noreply@hapi.run> * fix(acp): anchor late-flush quiet window to entry, not stale lastSessionUpdateAt Bot's third MAJOR on #730: drainLateBuffers() compared elapsed time against lastSessionUpdateAt, which can already be older than LATE_FLUSH_QUIET_PERIOD_MS by the time the method starts — e.g. when the model emits chunks early in the turn, pauses, then sends stopReason. In that case the first loop iteration sees a stale "quiet" reading and returns immediately, missing any straggler that arrives just after session/prompt resolves; the chunk then sits in the buffer until the next prompt's pre-prompt drain. Anchor the quiet check to max(lastSessionUpdateAt, entry time) so we always observe at least one quiet period from method entry regardless of when the last chunk was. Adds a regression test that fires a chunk early, awaits a 200ms pause, schedules a post-resolution straggler, and asserts it lands before turn_complete. via [HAPI](https://hapi.run) Co-Authored-By: HAPI <noreply@hapi.run> * docs(acp): correct LATE_FLUSH_QUIET_PERIOD_MS comment after entry-anchor fix The previous note claimed the 250ms quiet check "exits early for fast models, adding negligible latency". That was true before commit 512d6a4 when the check compared against lastSessionUpdateAt; with the entry-time anchor, drainLateBuffers always observes at least one full quiet period. Document that this minimum wait is the price of catching post-resolution stragglers from paused-mid-turn models. via [HAPI](https://hapi.run) Co-Authored-By: HAPI <noreply@hapi.run> --------- Co-authored-by: HAPI <noreply@hapi.run>	2026-05-31 10:13:00 +08:00
3 people	6f2bb7d32b	feat(opencode): add plan mode, reasoning effort, and status telemetry (#688) ... * feat(opencode): support plan mode * feat(opencode): support reasoning effort * feat(opencode): surface context usage in web Bridge OpenCode ACP usage updates into the existing token-count pipeline so the web status bar can show live context and cache information without a separate UI path. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(opencode): restrict plan mode to remote, rollback reasoning effort on failure - Block local OpenCode plan startup (tools not enforced in local path) - Allow remote OpenCode plan only (ACP permission handler denies tools) - Guard web /permission-mode endpoint for local OpenCode plan sessions - Rollback session reasoning effort when OpenCode rejects set_config_option - Wire rollback callback through opencodeLoop to runOpencode closure - Add tests: local plan rejected, remote plan allowed, web guard, effort rollback * fix(web): auto-retry OpenCode models query to populate model selector without refresh - Retry early failures (RPC may still be registering on new sessions) - Poll briefly until availableModels is non-empty - Stop polling once model options are discovered - Add tests for retry/poll/stop policy * fix(opencode): cap model discovery polling --------- Co-authored-by: Cursor <cursoragent@cursor.com>	2026-05-27 11:17:24 +08:00
3 people	763f45acdd	feat: add support for Kimi Code CLI and fixed some bugs (#659) ... * Add Kimi agent support via ACP protocol Add full integration for the Kimi Code CLI agent using the standard Agent Client Protocol (ACP). Includes: - kimi command and CLI registry wiring - Local launcher spawning kimi directly - Remote launcher with ACP stdio transport via AcpSdkBackend - Session management with resume support - Permission handler supporting all Kimi permission modes - Terminal UI display component - Runtime config resolving model from env and ~/.kimi/config.toml via [HAPI](https://hapi.run) Co-Authored-By: HAPI <noreply@hapi.run> * Fix Kimi ACP tool call input decoding on web Kimi streams tool arguments as JSON text inside the content array (e.g. {\"command\": \"df -h\"}) instead of rawInput/kind. The handler now extracts input from three sources in priority order: 1. rawInput (Claude/Codex path) 2. kind + title fallback (Gemini path) 3. content JSON text (Kimi path) Also handles: - rawInput: null no longer blocks the kind+title fallback - Title prefixes like \"Shell: free -h\" are stripped to extract args - Stale placeholder inputs are re-derived when the title updates - Normalized kind aliases (shell, run, read_file, write, etc.) via [HAPI](https://hapi.run) Co-Authored-By: HAPI <noreply@hapi.run> * Add kimi support to web UI * Fix some bugs * fix(kimi): dedupe repeated tool_call display in terminal UI * fix(web): keep tool block immutable so React detects input/state changes * fix(web): recognise Kimi subagent titles like 'Agent: ...' as subagent tools * fix(web): allow-for-session for ACP agents (kimi, cursor) PermissionFooter treated all non-codex sessions as Claude, sending Claude-specific acceptEdits/allowTools to ACP agents that don't support them. Hub rejected acceptEdits for kimi, and the ACP PermissionAdapter ignored allowTools. - Only show 'allow all edits' for Claude sessions - Send decision: approved_for_session for non-Claude ACP agents - Update status display to check decision field * fix(web): lookup subagent sidechains by tool-call id instead of msg id * fix(web): don't trim newest messages when loading older history fetchOlderMessages was using trimVisible(merged, 'prepend') which kept the oldest 400 messages and dropped the newest ones. This caused: 1. Latest messages to disappear when user loaded older history 2. User to see no visible change when new old messages were drowned in the 400-message window. Remove the incorrect trim so all fetched older messages are retained alongside the current window. Subsequent ingestIncomingMessages (append mode) will naturally keep the window bounded when new agent messages arrive. * fix(cli): route Kimi session resume to runKimi instead of runCursor Kimi was present in AGENT_FLAVORS but dispatchLocalResume had no branch for it, so resuming a Kimi session fell through to the Cursor launcher. via [HAPI](https://hapi.run) Co-Authored-By: HAPI <noreply@hapi.run> * fix(cli): pass selected model to Kimi ACP backend via KIMI_MODEL env createKimiBackend was ignoring opts.model and only setting KIMI_PROJECT_DIR. Use buildKimiEnv so the selected model reaches the subprocess as KIMI_MODEL. via [HAPI](https://hapi.run) Co-Authored-By: HAPI <noreply@hapi.run> * fix(web): bound message window on older loads with dedicated larger cap fetchOlderMessages was keeping all messages unbounded, causing sessionStorage bloat on repeated pagination. Reintroduce trimming with OLDER_LOAD_WINDOW_SIZE (800) so growth is capped while the newest messages are still preserved for far longer than before. via [HAPI](https://hapi.run) Co-Authored-By: HAPI <noreply@hapi.run> * fix(web): revert sidechain lookup to message id, matching tracer/grouping pipeline tracer.ts sets sidechainId to the parent message id, and reducer.ts groups by sidechainId. A prior commit changed reducerTimeline.ts to look up by tool-call id (c.id), which broke sidechain attachment. Revert to msg.id so the lookup matches the actual grouping key end-to-end. via [HAPI](https://hapi.run) Co-Authored-By: HAPI <noreply@hapi.run> * fix(cli): gate ACP title prefix stripping to known tool-kind labels extractTitleArgument stripped at the first colon unconditionally, corrupting commands/paths like curl http://localhost:3000 or Windows paths. Now it only strips when the prefix normalizes to the same tool kind as the event, verified via regex. via [HAPI](https://hapi.run) Co-Authored-By: HAPI <noreply@hapi.run> * fix(shared): include kimi in isCodexFamilyFlavor for ACP permission UI Kimi is an ACP-style agent that supports the abort decision, but isCodexFamilyFlavor excluded it, so PermissionFooter rendered the non-Codex Allow/Deny UI without the Abort button. via [HAPI](https://hapi.run) Co-Authored-By: HAPI <noreply@hapi.run> --------- Co-authored-by: HAPI <noreply@hapi.run>	2026-05-22 10:08:14 +08:00
3 people	b06251bd53	fix: stream opencode reasoning updates (#661) ... Emit throttled ACP reasoning snapshots with stable stream ids so OpenCode reasoning updates render live without one row per token. Collapse matching reasoning snapshots in the web timeline and avoid stale session 404 redirects during refetch. Tests: targeted Vitest suite and bun typecheck. Co-authored-by: twshe <twshe@outlook.com>	2026-05-22 08:57:50 +08:00
weishu	b0a3397601	refactor: share session config RPC handling	2026-05-21 14:40:00 +08:00
weishu	b79f50f815	Share RPC method constants	2026-05-21 10:53:31 +08:00
weishu	9324598cd5	chore: remove dead UI and agent entrypoints	2026-05-20 17:32:08 +08:00
lekoandGitHub	197f327590	feat: add hapi resume command (#647)	2026-05-20 06:18:42 +08:00
lekoandGitHub	ce2e76a42e	Add Windows remote terminal support (#642)	2026-05-19 07:54:12 +08:00
lekoandGitHub	bb04247127	Fix CLI tests on Windows paths (#643)	2026-05-19 07:53:28 +08:00
Junmo KimandGitHub	c5e80e9a66	fix: restore opencode hook plugin channel and coalesce ACP reasoning chunks across all consumers (#631)	2026-05-17 20:04:14 +08:00
SmallSpiderandGitHub	293f944724	fix: omit reasoning summary for codex spark subagents (#594)	2026-05-07 16:44:56 +08:00
junesandGitHub	0006d04f9e	feat: support multiple workspace roots (#584)	2026-05-07 08:30:52 +08:00
Junmo KimandGitHub	8185f0287e	feat(web,hub): cancel queued messages (#568)	2026-05-06 13:32:45 +08:00
Junmo KimandGitHub	de69027926	fix(acp): hoist Gemini edit/write content into Claude-shaped input (#575)	2026-05-06 13:31:25 +08:00
Junmo KimandGitHub	136badb86e	fix(gemini): surface tool_call input on Gemini ACP cards (#562) ... * fix(acp): derive tool_call input from kind+title fallback Gemini 2.5 Flash and 3 Flash Preview omit rawInput entirely on tool_call events while emitting prose (non-JSON) thoughts. Neither the existing rawInput path nor JSON-thought hoisting fires, so the UI shows "Input: null" alongside a perfectly readable title like "README.md" or "ls -la /tmp". Add a conservative fallback that maps known kinds to a minimal input shape: read -> { file_path: title } execute -> { command: title } search -> { pattern: title } think -> null (topic-update prose has no clean arg mapping) unknown -> null (no guessing on shapes we have not verified) Priority: rawInput > hoisted JSON thought > kind+title derive. Lock the new behaviour with synthetic unit tests (8 cases) and a real-Gemini fixture suite captured from gemini-3-flash-preview and gemini-2.5-flash via ACP stdio (4 fixtures, 33/27/13/4 raw sessionUpdate events). The fixtures double as regression guards against future ACP handler changes. * fix(web): suppress duplicate subtitle when equal to tool title Gemini ACP emits a tool_call whose title field is a human-readable summary (often the verbatim shell command or file path). Combined with the kind+title input fallback, an unknown-tool card ends up with the same string in both the title and subtitle slots — e.g. title "cat /tmp/hello.txt" over subtitle "cat /tmp/hello.txt". Add a guard in getToolPresentation's unknown-tool branch: emit subtitle only when it differs from toolName. The known-tool and mcp__* branches are unaffected. * test(acp): align Gemini fixtures to current model set - Drop gemini-2.5-flash fixtures: the captures came from a model that is not part of the PR's evidence model set, and re-running the capture is gated on quota that is not currently available. - Refresh gemini-3-flash-preview read_file / run_shell fixtures with a fresh live capture so they reflect the latest ACP shape (e.g. a `kind: think` tool_call expressing reasoning when the model emits no agent_thought_chunk). - Update fixture-replay expectations: read_file no longer requires reasoning chunks (zero are emitted on this path) and now requires >= 2 tool_calls (think + read). * feat(web): promote semantic title for Gemini ACP tool cards When the unknown-tool ToolCard would render the same string as both the title and the subtitle, promote a semantic label to the title slot so the card reads like a sentence: cat /tmp/hello.txt → Run shell / cat /tmp/hello.txt README.md → Read file / README.md *.ts → Search / *.ts This is a web-only ergonomic change; the underlying ACP message shape (tool_name = title, input = derived from kind+title) is unchanged. Builds on the dedup guard so the title-equals-subtitle case is now handled by promotion rather than by hiding the subtitle. * fix(acp): derive tool_call.input for kind=edit from locations[0].path Gemini's write_file and replace tools both surface as ACP tool_call with kind="edit" and rawInput omitted. The path lives on locations[0] from the very first event; the title is prose like "Writing to foo.txt" or "foo.txt: old => new", which is not safely usable as a file_path. Extend the kind+title fallback to read locations[0].path when kind is "edit", and synthesize { file_path } from it. Title fallback is intentionally not used here so we never feed prose into file_path. Lock the behaviour in with two new fixtures captured live from gemini-3-flash-preview (write_file and replace) plus two synthetic unit tests covering the locations-present and locations-empty paths. * test(acp): add gemini-3.1-pro-preview fixtures for regression coverage Captured 4 raw ACP `sessionUpdate` sequences from a live `gemini-3.1-pro-preview` session via the same isolated hub + runner + spawn pattern used for the existing flash captures (read_file 31 events / run_shell 83 events / write_file 4 events / edit_file 11 events). The pro tier reuses the same kind/title shape as flash: `rawInput` is omitted on every tool_call across read / execute / edit kinds, so the kind+title (and locations[0].path for edit) fallback is exactly what derives the modal Input. Locking these fixtures in guards against future regressions on a second model. The fixture-based regression test gains 4 entries (read / shell / write / edit) mirroring the flash matrix; assertions are unchanged. ACP handler suite: 53 -> 57 pass.	2026-05-05 18:20:54 +08:00
Junmo KimandGitHub	9ee014098a	feat(opencode): support model selection and mid-session model change (#558) ... * refactor(opencode): declare ModelChange capability and add model field to OpencodeMode Mark opencode flavor as supporting model change by adding Capabilities.ModelChange to FLAVOR_CAPS.opencode. Add optional `model` field to OpencodeMode so the set-session-config handler can carry a model alongside the existing permissionMode. Pure structural change: no behavior change yet. The mid-session model change RPC and UI wiring follow in subsequent commits, gated by this capability. * feat(acp): branch setModel by flavor, capture session models metadata, expose getSessionModelsMetadata on AgentBackend interface Adds an optional `flavor` argument to `AcpSdkBackend.setModel` so it can dispatch the right `session/*` RPC for each agent flavor without changing the call site Gemini already uses. Both Gemini and OpenCode wire to `session/set_model`; the OpenCode response only carries `_meta.opencode`, so the backend updates the cached `currentModelId` optimistically while preserving the previously captured `availableModels`. Captures `availableModels` and `currentModelId` from `session/new` / `session/load` / `session/set_model` responses into per-session metadata, exposed as `getSessionModelsMetadata(sessionId)` on the `AgentBackend` interface so the hub can forward the snapshot to the web client. * feat(opencode): accept model in set-session-config RPC and forward to launcher Mirror the Gemini set-session-config handler so the web UI can change the OpenCode model mid-session. Validates incoming model strings, persists null ("Default") for keepalive metadata, and pushes a keepAlive immediately so the hub UI reflects the change without waiting for the next 2s tick. Forward the model through opencodeLoop and into queued OpencodeMode entries so the launcher can detect a per-batch model change. Add a setModel helper on OpencodeSession to store the chosen model on the shared session base. Wire --model up the runner path: parse --model <value> in commands/opencode.ts and stop excluding opencode in buildCliArgs so the runner spawns OpenCode with the user-selected initial model. * feat(opencode): switch model mid-session via ACP RPC Mirror the Gemini pattern from PR #543: when a user picks a different model between turns, call backend.setModel with flavor='opencode' so the ACP backend sends session/set_session_config_option (configId='model') to the running OpenCode CLI. The next turn then runs against the new model. The first batch on a fresh session seeds currentBackendModel without firing the RPC — the OpenCode CLI was launched with that model via --model and there is nothing to switch yet. If the running build does not implement the RPC we learn that from the first method-not-found response, latch inline switching off, and notify the user once. Other errors fall back to the previous model and surface a one-line failure message. * feat(hub): expose model selection and discovery for OpenCode sessions Generalize the /sessions/:id/model guard via supportsModelChange so any flavor that advertises the ModelChange capability becomes accepted automatically. This piggybacks on the capability SSOT introduced in PR #400 and turns OpenCode on without listing flavors inline. Add a /sessions/:id/opencode-models endpoint that mirrors the existing codex-models pattern. The endpoint forwards a per-session listOpencodeModels RPC to the running OpenCode launcher, which returns the availableModels and currentModelId metadata captured from the ACP session/new and session/set_session_config_option responses. The web UI consumes this to render the model dropdown without round-tripping ACP itself. * feat(web): render OpenCode model dropdown in the chat composer Mirror the Codex pattern in SessionChat: query /sessions/:id/opencode-models via a new useOpencodeModels hook and feed the result into the composer's availableModelOptions. The AssistantChat model dropdown now lists the user's ollama / mlx / OpenCode Zen models with the same provider/model label that the ACP server reports, so the picker matches the OpenCode TUI. Stop falling back to the Claude composer model list when the flavor is opencode and no custom options are supplied — that fallback briefly surfaced unrelated Claude models in OpenCode sessions before the RPC response landed. The NewSession flow keeps an empty MODEL_OPTIONS.opencode for now: model discovery requires an active OpenCode ACP session, so the dropdown becomes available once the session boots and stays empty (and hidden) at creation time. * feat(cli,hub): add cwd-based OpenCode model discovery RPC Adds a short-lived `opencode acp` probe that runs `initialize` + `session/new` against a target cwd to read the `availableModels` / `currentModelId` snapshot, then tears the subprocess down. Results are cached for 60s per cwd and concurrent probes coalesce into a single spawn. Exposes the probe through: - `listOpencodeModelsForCwd` JSON-RPC handler on the CLI - `RpcGateway.listOpencodeModelsForCwd` / `SyncEngine.listOpencodeModelsForCwd` - `GET /api/machines/:id/opencode-models?cwd=...` on the hub This lets the web NewSession form discover OpenCode models for a chosen directory before any session is spawned. * feat(web): add OpenCode model selector to NewSession with loading and default highlight Adds a `OpencodeModelSelector` panel that the NewSession form swaps in when the OpenCode flavor is selected. The panel: - queries the new `GET /api/machines/:id/opencode-models?cwd=...` endpoint via `useOpencodeModelsForCwd` (TanStack Query, 60s staleTime, no retry), - shows a labelled spinner + skeleton rows while discovering, - renders an inline error with a Retry button when probing fails, - renders an empty-state message when the directory yields no models, - highlights the OpenCode-reported `currentModelId` with a "Default" badge and auto-selects it (or the first option) so the form has a sensible value if the user hits Enter without scrolling. Selection is reset whenever the agent / machine / directory changes so a new probe can establish a fresh default. Directory input is wrapped in `useDeferredValue` so per-keystroke edits do not spawn a fresh `opencode acp` probe. The chosen model is forwarded on session spawn via the existing OpenCode `model` parameter. Adds en + zh-CN locale strings for the loading / failure / empty / retry / default-badge labels. * fix(cli): guard /machines/:id/opencode-models handler with workspace root check The machine-scoped `listOpencodeModelsForCwd` RPC handler was registered by `registerCommonHandlers` without any workspace-root check, so a web client could pass an arbitrary `cwd` and have the runner spawn an `opencode acp` subprocess plus a `session/new` against that path. That broke runner isolation, since peer machine-scoped handlers (`list-directory`, `spawn-happy-session`) already enforce the configured workspace root. Re-register the handler in `ApiMachineClient` so it reuses the existing `resolveForWorkspaceCheck` (realpath-based, with missing-tail walking) and `isWithinWorkspaceRoot` helpers before delegating to the lower-level probe. The resolved cwd is forwarded down so symlinked-but-contained paths still work, while traversal attempts are rejected with the same error shape the peer handlers use. Added unit tests around the new dispatch path. Addresses HAPI Bot review on PR #558. * fix(web): gate opencode model discovery on cwd existence The new-session form previously enabled `useOpencodeModelsForCwd` as soon as the OpenCode agent, machine, and any non-empty directory string were present. Because that hook calls `/machines/:id/opencode-models` and the CLI handler starts an `opencode acp` probe for that cwd, normal typing through partial paths could launch expensive 30s OpenCode subprocesses for non-existent directories before the path-existence result had validated the final cwd. Reorder NewSession so `useMachinePathsExists` runs before `useOpencodeModelsForCwd`, then gate the discovery hook on the directory having been positively confirmed to exist (`pathExistence[deferredDirectory] === true`). The decision is factored into a small pure helper `shouldEnableOpencodeModelDiscovery` so the contract can be unit-tested without provider scaffolding. * fix(web): keep current opencode model on shortcut without dynamic options `getNextModelForFlavor` is invoked by the global Ctrl/Cmd+M shortcut in `HappyComposer`, which is now active for OpenCode sessions because the agent backend declares the `ModelChange` capability. When the dynamic OpenCode model list has not yet been loaded — e.g. the user presses the shortcut before `/opencode-models` returns — the function received an `undefined`/empty `customOptions` and fell through to the Claude preset cycler, which would emit `sonnet`/`opus` for an OpenCode session. The following turn then attempted `session/set_model` with a Claude model id that no OpenCode provider can serve. Add an `opencode` branch that returns the (normalized) current model unchanged when no dynamic options are available, mirroring the existing empty-list policy of `getModelOptionsForFlavor`. Unit tests cover the undefined / empty / null-current-model variants and lock the no-Claude-fallback contract. Addresses HAPI Bot review on PR #558.	2026-05-03 12:50:22 +08:00
Junmo KimandGitHub	0160da4bb5	fix(gemini): switch model mid-session via ACP RPC (#543) ... When a user selects a different Gemini model from the Web UI mid-session, the running `gemini --experimental-acp` process kept using the model it was launched with. The Web UI reflected the new selection, but the next response was still produced by the original model. Changes: - AcpSdkBackend: add `setModel` wrapping the `session/set_model` RPC. Errors propagate as standard rejections, matching every other `sendRequest` call in this file. - geminiRemoteLauncher: detect model changes between turns and call `backend.setModel` on the live ACP session — no process restart, no MCP reload. If the running gemini-cli build returns method-not-found, the launcher learns once, surfaces a single advisory message, then silently honors the previous model for the rest of the session. - AgentSessionBase.pushKeepAlive: small helper used by runGemini to broadcast new config to the hub immediately after `set-session-config`. - Both layers serialize the switch — the launcher attempts `setModel` only between batches, and `AcpSdkBackend.setModel` defensively awaits `waitForResponseComplete()` before issuing the RPC. Tests: - New `geminiRemoteLauncher.test.ts` covers: setModel called between turns when the model differs; not called when unchanged; the method-not-found capability latch; transient errors continue with the previous model; setModel is serialized after the prior prompt. - `runGemini.test.ts` asserts pushKeepAlive fires from the `set-session-config` handler.	2026-04-29 09:22:50 +08:00
3 people	010dc41369	feat: workspace browser with --workspace-root opt-in scoping (#526) ... * feat(web): add workspace browser for multi-directory navigation Add /browse route with a folder browser that lets users navigate filesystem directories on connected machines and launch sessions from any folder. Supports saved workspace paths and direct path input. The "Start Session" action pre-fills the NewSession form. - CLI: register machine-level `list-directory` RPC handler - Hub: add POST /machines/:id/list-directory route - Web: add WorkspaceBrowser component with git repo detection - Web: add /browse route with navigation from sessions sidebar - Web: support initialDirectory/initialMachineId in NewSession Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: add --workspace-root opt-in scoping for /browse and session spawn Adds a single new flag, \`--workspace-root <path>\` (with \`~\` / \`~/foo\` expansion), on \`hapi runner start\` and \`hapi runner start-sync\`. When set: - The runner reports the path in machine metadata. - The list-directory and spawn-session RPC handlers reject paths outside the root, so the web UI can't escape the configured tree even if someone crafts a request manually. - The /browse page in the web UI auto-opens that root, restricts the breadcrumb / go-up to its subtree, and shows directory entries with git-repo annotations. - The /sessions/new form keeps its existing free-text directory input plus autocomplete + recent-paths chips, and gains a small "Browse" button (next to the input) that opens /browse for picking a folder. - Reconnect-time metadata sync ensures stale records get the field filled in (or cleared when the flag is dropped on a later restart), so the hub state matches the CLI's intent. When unset: - Runner behaves like the legacy hapi (no scoping, no browse feature). - /browse renders an informative state pointing at the flag instead of blocking the user. - The /sessions/new form looks identical to the pre-change behavior; the "Browse" button is hidden. Includes a startup banner so \`runner start-sync\` no longer looks like it hung, and surfaces the workspace-root sync result on stdout. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(hub): preserve workspaceRoot when rehydrating machines from store MachineCache.refreshMachine() rebuilt the metadata object from an explicit field allowlist, so any field not in the list (including the new workspaceRoot) was silently dropped on every read — even though it was correctly written to the store. Add workspaceRoot to the zod schema, the Machine interface, and the hand-rolled projection. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(web): friendlier empty state on /sessions When there are zero sessions the page used to be a vast blank rectangle with just the "0 sessions in 0 projects" caption. Render a centered empty state instead: a calendar/agenda icon, a short heading and hint, and two buttons — "Start a session" (→ /sessions/new) and "Browse workspace" (→ /browse). SessionList gains an optional onBrowse prop. Router wires it on the sessions page so the secondary button resolves; other callers can leave it unset to hide that button. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * docs: document --workspace-root flag in cli/README and root README Add a short paragraph under "Runner management" in cli/README.md explaining what \`--workspace-root\` enables (scoped /browse tree, list/spawn enforcement, tilde expansion) and that omitting it keeps the legacy behavior. Mention the workspace browser in the top-level README's Features list. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: address PR #526 review feedback Three findings from the review bot: 1. [Major] Workspace-scope check was lexical only. With workspaceRoot = /safe, a symlink such as /safe/out -> /etc would pass the relative- path test and let list-directory / spawn-happy-session reach paths outside the configured root. realpath the workspaceRoot at construction time, and resolve every incoming path through realpath (walking up to the nearest existing parent for spawn targets that haven't been created yet) before the containment check. 2. [Minor] \`hapi runner start --workspace-root\` with no value used to drop the flag silently and start the runner unscoped. Now treats a missing or flag-shaped next argument as an error. 3. [Minor] /sessions/new's "Browse" button always opened /browse using localStorage's last-used machine, ignoring the user's current selection. NewSession already passes machineId in its callback; forward it through the /browse search params and seed WorkspaceBrowser with it. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(cli): gate list-directory RPC behind --workspace-root opt-in Without a configured workspaceRoot, isWithinWorkspaceRoot() returns true unconditionally, leaving the new list-directory RPC able to enumerate any path on the runner. The Web UI already hides Browse for these machines, but the backend should enforce the opt-in too. Refuse the RPC up front when no workspace root is configured. --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-26 09:59:18 +08:00
xiaobaifly7andGitHub	4ec9537e4a	feat(hub): add ServerChan task notifications (#515) ... * fix(hub): 修复发送后状态显示延迟 * feat(hub): 接入Server酱任务通知 * fix(hub): 仅在会话结束时发送完成通知 * fix(hub): avoid reviving inactive queued sessions * fix(hub): address notification review feedback * fix(hub): expire queued thinking on hub clock * fix(hub): 修复任务通知 review 反馈	2026-04-25 22:01:02 +08:00
Junmo KimandGitHub	82703b85fb	fix(acp): normalize tool_call_update content for agents without rawOutput (#521)	2026-04-24 08:13:34 +08:00