Server-level title/body templates with {variable} placeholders for web
push notifications, configured via settings.json `notificationCopy` and
an admin-only editing section on the Notifications settings page with
live preview and variable chips. Empty templates fall back to the
hardcoded defaults; the channel also now delivers session-completion
pushes, which the existing preference toggle previously had no web push
effect for.
via [HAPI](https://hapi.run)
Co-Authored-By: HAPI <noreply@hapi.run>
Co-Authored-By: Claude <noreply@anthropic.com>
Add per-namespace notification preferences so users can choose which
event types trigger push notifications (permission requests, session
ready, task notifications, session completion). Adds the
notification_preferences table (schema v20), GET/PUT
/api/notification-preferences, POST /api/push/test for test pushes, and
a Notifications settings page in the web app with a confirm dialog for
disabling permission requests. Defaults keep all event types enabled.
via [HAPI](https://hapi.run)
Co-Authored-By: HAPI <noreply@hapi.run>
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(web): drop Idle session-list badge (keep working/pending)
Quiet active rows already read as the default via full opacity vs faded
archived; labeling Idle was badge inflation. Pin-in-progress now only
surfaces working/pending so the section does not advertise lack-of-state.
Fixes#1362
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): include deliveryMode on abort send-error restore
Unblocks web typecheck: RawSendError requires deliveryMode, and the
abort-restore path was omitting it (already red on upstream/main CI).
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat(web): FUE + placeholder for rich composer session @-mentions
Discover session @-mentions via composer-grounded FUE and always-on
placeholder copy when rich composer is active (#1273).
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): notify onFocus after programmatic rich-composer autofocus
Playwright headless (and some engines) skip the DOM focus event for
element.focus(), so FUE engage never ran. Call the onFocus prop after
autofocus so discovery still works.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): engage rich-composer FUE on mount
DOM focus events are unreliable for programmatic autofocus (and in
Playwright). Treat the live rich composer as the affordance and open
the callout when the rich path mounts.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): measure FueCallout height; ellipsis rich placeholder
Bot review on #1274: position from real panel height (ResizeObserver)
so multi-line FUE bodies clear the composer, and keep long mention
placeholders on one ellipsized line in the input row.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): Escape dismisses rich-composer FUE; keep expand flex chain
Escape while the mention FUE is engaging only dismisses the callout
(no abort/collapse). FUE anchor is a flex container so expanded
RichComposerInput still fills height. Mock resolveComposerPlaceholderKey
in sendError tests.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat(pi): complete RPC interaction parity
* feat(pi): integrate native conversation history
* fix(pi): harden RPC lifecycle boundaries
* fix(pi): address review lifecycle and upload boundaries
* fix(pi): release history transaction on rollback deadline
* fix(pi): isolate preflight and timed-out mutations
* fix(pi): preserve retry and editor boundaries
* fix(pi): disable unavailable history synchronization
* fix(pi): gate fallback readiness on history baseline
* fix(pi): bind uploads and retire extension requests
* fix(pi): preserve canceled and legacy stream boundaries
* fix(pi): preserve native fork runtime state
* fix(pi): persist dialogs and preserve select values
* fix(pi): keep upload authorization path-stable
* feat(pi): preserve native steer semantics
Route ordinary sends during an active Pi main turn through native steer while keeping explicit queue delivery on the existing composer gestures. Persist the delivery contract across Hub replay and Web retries, and guard stale steer dispatch with streaming generations and ordered prompt fallback.
* fix(pi): queue deferred steer deliveries
Keep native steer only for the initial live emit. Reconnect replay, CLI backfill, clear-gate release, and mature delivery now downgrade turn-scoped steer intent to the durable HAPI queue without mutating stored provenance.
* fix(pi): retain abort guard through preflight miss
Treat an immediate no-active abort rejection as a possible async-preflight race. Keep the existing abort boundary alive so a late agent_start receives the compensating abort before queued work is released.
* fix(pi): queue stale steer retries
A failed send no longer reuses turn-scoped steer intent after its original Pi generation is lost. Text restoration, attachment retry, and legacy retry provenance all enter the durable HAPI queue while fresh ordinary sends retain native steer behavior.
* fix(pi): invalidate rejected abort generation
After a no-active preflight abort waits through late-start compensation, mark the target stream idle while the runtime mutation lease is still held. Waiting native steers therefore fall back instead of entering the aborted generation.
* fix(pi): queue idempotent steer retries
Track whether a localId insert created a new row. Initial inserts may retain live Pi steer, while duplicate-localId retries deliver a queue-safe view of the stored row without overwriting its original provenance.
* fix(pi): sync command-only history before fallback
Read the Pi append log before retiring a successful prompt that produced no agent lifecycle. Preserve FIFO history associations across missing entry events, and fail the wrapper closed if that mandatory synchronization cannot be completed.
* perf(hub,web): emit structured patches for session todos/teamState/metadata/agentState writes (#895, closes second half of #884)
Today the four CLI handlers in `sessionHandlers.ts` that write session-scoped
state (TodoWrite messages -> setSessionTodos; team-state deltas ->
setSessionTeamState; update-metadata RPC; update-state RPC) emit
`session-updated` events with no `data` payload. `syncEngine.handleRealtimeEvent`
intercepts each one, re-reads the row from SQLite, and broadcasts the entire
~5KB Session via SSE. That works (the web client's `isSessionRecord` shortcut
keeps the cache patched), but it costs a DB read and a full-payload SSE
fan-out per write, and any failure mode that drops the broadcast data falls
through to `useSSE.ts:509-512` and triggers per-session REST refetches - the
storm vector documented in #884.
This is the architectural follow-up to #885. #885 added `staleTime` on the
detail query (eliminates focus / mount refetches inside a 30s window). This
PR removes the structural reason these four writes touch the REST path at all.
`SessionPatchSchema` learns four optional structured fields:
- `todos` (array)
- `teamState` (object)
- `metadata` (versioned `{ version, value }` wrapper)
- `agentState` (versioned `{ version, value }` wrapper)
`.strict()` preserved so unknown keys still throw. The versioned wrappers
mirror the existing socket.io `update-session` broadcast at lines 211 / 259 so
metadata and agentState always travel as an atomic (version, value) pair -
caches need the version to reject stale patches.
Each of the four emit-sites now carries a structured `data` payload with the
delta it just wrote. `syncEngine.handleRealtimeEvent` for `session-updated`
events with non-empty patch data: applies the patch to the in-memory Session
in place via the new `sessionCache.applySessionPatch`, then forwards the event
as-is. Empty patches, no-data events, and patches against uncached sessions
all fall back to the legacy `refreshSession` path so behavior for other
emitters (e.g. `cursor/codexDesktop.ts`) is unchanged. Dedup hook against
agent-session-id changes preserved on the fast path.
`patchSessionDetail` is no longer a blanket spread - it enumerates each field
explicitly so the versioned metadata / agentState patches can be unwrapped
into the Session's flat (metadata, metadataVersion) and (agentState,
agentStateVersion) pairs. Spreading the patch wholesale would have written a
`{ version, value }` object into `session.metadata` and corrupted the cache.
`patchSessionSummary` recomputes the touched derivations - `todoProgress` from
todos, `pendingRequestsCount` / `pendingRequestKinds` from agentState,
SessionSummaryMetadata from metadata - via three new pure helpers exposed
from `shared/src/sessionSummary.ts` (`computeTodoProgress`,
`computePendingRequestKinds`, `toSessionSummaryMetadata`). `toSessionSummary`
is refactored to use these helpers - identical output, single source of
truth.
- shared: `SessionPatchSchema` parses each new patch shape, stays strict,
rejects empty metadata without `version`, rejects full Session payloads
(those go through `isSessionRecord`).
- shared: summary derivation helpers covered against bare AgentState /
Metadata inputs (the shape the SSE patch path provides).
- hub: each emit-site asserted to carry the expected structured payload.
- hub: `applySessionPatch` unit-tests cover todos / metadata / agentState
application, empty-patch rejection (forces caller back to refreshSession),
cross-namespace guard, and missing-session fallback.
Empirical wire round-trip verifies each patch shape survives `JSON.stringify`
intact and routes the web client through `getSessionPatch` (non-empty result)
instead of the REST invalidation fallback.
Per #884 expectation: with this fix on top of #885, idle GET /api/sessions/<id>
rate is expected to drop to near-zero on the reporter's 100+ session install.
Operator (heavygee) will attach the live-measured before / after to the PR
post-merge.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(hub): snapshot metadata reference before applySessionPatch mutation so dedup-on-id-change fires
The structured-patch fast path added in 05147a6a (closes#884 second half)
broke the dedup-on-metadata-change trigger in handleRealtimeEvent.
Root cause: applySessionPatch MUTATES the cached Session in place
(reassigns session.metadata = patch.metadata.value). The dedup check
compares before vs after agent session IDs, but `before = getSession(id)`
and `after = getSession(id)` returned the SAME object reference, so
before.metadata had already been overwritten by the time the check ran.
hasSameAgentSessionIds always returned true and dedup silently never
fired on the fast path.
The legacy refreshSession path got dedup for free because it REPLACES
the cache map entry with a new Session object, leaving the pre-refresh
reference intact for the comparator.
Fix: capture beforeMetadata before applySessionPatch runs; use it for
both branches so the comparison contract is identical.
Adds syncEngineHandleRealtimeEvent.test.ts with three regression guards:
- structured metadata patch with changed cursorSessionId fires dedup
- todos-only patch does NOT fire dedup (no false positives)
- legacy refresh path (no patch data) still fires dedup
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(schemas): reorder SessionPatchSchema fields so soup-merge with codex-usage layer conflicts cleanly
Pure reorder (no semantic change). feat/codex-usage-indicator-rebased adds
a flat `metadata: MetadataSchema.nullable().optional()` + `metadataVersion`
to SessionPatchSchema in the same line range upstream/main has the model/
modelReasoningEffort fields. My branch added the versioned `metadata` field
at the END of the object, so git 3-way merge silently auto-merged both,
producing an invalid object literal with duplicate `metadata` keys.
By placing my `metadata` / `agentState` / `todos` / `teamState` insertions
in the SAME line range codex inserts (between updatedAt and model), git
now raises an explicit CONFLICT during the soup merge, which can be
resolved correctly once and replayed by rerere. No behavior change on a
clean upstream/main merge.
Pure cosmetic; no test or runtime impact.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(sse): propagate TeamDelete clear through structured patch path
Closes PR #897 Major review (HAPI Bot, 2026-06-13): TeamDelete events
drove `applyTeamStateDelta` to return `null`, but the emit-site
coalesced that to `undefined`. JSON serialization then dropped the key,
the hub cache skipped its assignment branch (`patch.teamState !==
undefined` was false), and the web client saw an empty patch and fell
back to REST invalidation — exactly the storm path this PR was supposed
to close. Sidebar / NotificationHub / dedup all served stale team state
until the next full refresh.
Fix in four coordinated places (wire ↔ cache contract):
- shared/src/schemas.ts: `teamState: TeamStateSchema.nullable().optional()`
so `null` is a valid wire shape meaning "cleared". Comment documents
the discriminator contract for consumers.
- hub/src/socket/handlers/cli/sessionHandlers.ts: drop the
`?? undefined` coalesce so `null` survives JSON serialization.
- hub/src/sync/sessionCache.ts (applySessionPatch): use
`Object.prototype.hasOwnProperty.call(patch, 'teamState')` to
discriminate "field absent" from "field is null", then map null →
undefined to match the cached `Session.teamState` type.
- web/src/hooks/useSSE.ts (patchSessionDetail): same
hasOwnProperty discriminator + null → undefined mapping.
Regression tests:
- schemas.sessionPatch.test.ts: `{ teamState: null }` parses
successfully (locks the wire contract).
- sessionCache.applySessionPatch.test.ts: TeamDelete clears cached
teamState; todos-only patch leaves teamState untouched (guards the
hasOwnProperty branch against a regression back to `!== undefined`).
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(sse): version-gate metadata/agentState patches against cache regression
Closes PR #897 follow-up Major review (HAPI Bot, 2026-06-16): the new
structured SSE patch path unwraps versioned metadata/agentState fields
without checking the cached metadataVersion/agentStateVersion. SSE
reconnects + the existing per-query invalidation can leave a detail
cache repopulated by a fresh REST refetch BEFORE a buffered older patch
replays. Without the gate the older patch overwrites the newer cache,
regressing resume / session-id / pending-requests state.
Mirrors the hub-side CLI room handler contract (`incoming.version >
currentVersion`, `web/src/hooks/useSSE.ts`):
- `patchSessionDetail`: gate metadata/agentState assignment behind
`isNewerVersionedPatch(patch.version, nextSession.<field>Version)`.
The pre-patch version is captured by `{ ...previous.session }` so
the comparison is against the cache-at-write-time.
- `patchSessionSummary`: read the detail cache (via queryClient) for
the canonical metadataVersion / agentStateVersion. Use `>=` (not `>`)
because the callsite runs `patchSessionDetail` first — when detail
accepts a newer patch the cache already holds the new version, so
matching `>=` keeps summary aligned with detail's acceptance; when
detail rejects, `>=` aligns summary with detail's rejection.
- Exported `isNewerVersionedPatch(patchVersion, currentVersion)` as a
pure helper so the rule is unit-testable in isolation.
- Test: `useSSE.test.ts` pins the 4 cases (newer ✓ / older ✗ /
same-version ✗ / first-write currentVersion=0 ✓).
Hub-side `applySessionPatch` does NOT need the same gate: in-process
events from `handleUpdateMetadata` / `handleUpdateState` are emitted
only AFTER the optimistic-concurrency check at the store layer
succeeds, and `syncEngine.handleRealtimeEvent` consumes them
synchronously in order. The vulnerability is the SSE
reconnect/replay window on the web client.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(sse): include updatedAt in structured patches + pendingRequests summary
Closes PR #897 post-rebase bot review (HAPI Bot, 2026-06-18):
Major — structured patches dropped session.updatedAt. TodoWrite,
teamState, metadata, and agentState DB writes all touch sessions.updated_at,
but the fast path forwarded only field deltas. Hub/web caches and session
list ordering stayed stale until a full refresh. All four emit-sites in
sessionHandlers now reload the stored row after a successful write and
include updatedAt in the SSE patch payload (applySessionPatch already
applies it via Math.max).
Minor — agentState summary patches updated pendingRequestsCount/kinds but
left pendingRequests stale, so SessionAttentionIndicator tooltips showed
old request tools after an SSE patch. patchSessionSummary now uses
computePendingRequestsCount + computePendingRequests alongside the
existing kinds helper.
Tests: sessionHandlers.test.ts asserts updatedAt on todos/metadata/agentState
patches.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web,hub): apply serviceTier in structured session patch path
Closes PR #897 bot Minor (2026-06-18): field-by-field patchSessionDetail
stopped copying serviceTier after the spread refactor, so Codex Fast/
Standard could show stale tier until a full refetch. Mirror nullable
hasOwnProperty handling in patchSessionDetail and hub applySessionPatch.
Co-authored-by: Cursor <cursoragent@cursor.com>
* test(hub): allow same-ms updatedAt on structured patch emit asserts
Date.now() resolution makes create+update land on the same millisecond in
unit tests; the store still touches updated_at. Use >= so CI is not flaky.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): refuse versioned summary SSE patches without detail version source
When session detail is not cached, defaulting metadata/agentState versions to
0 let stale buffered patches overwrite a freshly refetched list and suppress
list invalidation. Bail out so the list refetches instead.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): keep updatedAt monotonic when applying SSE session patches
Stale versioned metadata/agentState replays can still carry an older
updatedAt. Use Math.max on detail and summary paths so rejected replays
cannot rewind list/detail clocks while patched=true suppresses invalidation.
Co-authored-by: Cursor <cursoragent@cursor.com>
* chore: retrigger Codex PR review after infra stream failure
Prior pr-review run died on reconnect (stream closed before
response.completed); no code findings. Empty commit to re-fire
pull_request_target.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): compare all summary metadata fields in keep-alive skip
isRenderIrrelevantPatch omitted path/machineId/flavor/worktree, so a
same-ms metadata patch could be dropped while summaryPatched stayed true
and list invalidation never repaired grouping/icon/path.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(sse): version-wrap todos/teamState patches for dual-SSE races
Global + session EventSources can deliver out of order. Carry store
todos_updated_at / team_state_updated_at as patch versions, gate web
applies, and tighten keep-alive skip compares (metadata + request tool/kind).
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): put SSE version watermarks on SessionSummary
Requiring a detail query to apply versioned list patches forced O(N)
/sessions invalidation on every global SSE write. Gate against summary
watermarks instead; skip no-op detail clones on duplicate deliveries.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(hub): ratchet todosUpdatedAt on rewind rebuild
replaceSessionTodos was stamping the remaining TodoWrite's older
createdAt, so a lagged pre-rewind structured SSE patch could resurrect
deleted todos. Advance the watermark on force-replace instead.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): apply copilotAgentMode in structured detail SSE patches
Field-by-field detail mapper dropped the new Copilot keep-alive field,
so detailPatched suppressed invalidation and SessionChat kept a stale mode.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Debian <heavygee@oos-linux.in.lockhouse>
* feat(web): in-place cursor variant drill-down (closes#48)
Rebased onto upstream/main: iOS-style nested picker keeps overlay open on
multi-variant base pick, applies default variant immediately, dismisses on
variant selection; preserves upstream Pi model panels and Codex Fast mode.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web+cli): accept bare Cursor ACP model ids in picker catalog
Current Cursor ACP returns bare bases (composer-2.5, …) with empty
cliModelSkus. The bracket-only wire gate emptied the catalog so the
picker showed only Default. Treat bare non-default ACP ids as catalog
rows, keep CLI effort/speed SKUs as variants, and widen SKU enrichment
the same way. Closes#1129.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): ignore stale selectedModelVariant during Cursor base drill-down
Only highlight a session variant when it is still among the visible
rows, so a multi-variant base switch uses the new default until parent
state catches up (Codex Minor on #947).
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(cli+shared): do not attach CLI variant SKUs to bare ACP catalogs
Bare ACP bases cannot express effort/speed (apply is model+fast on
parameterized wires). Drop suffixed SKUs unless a base has bracket
wires, and refuse matchCliSkuToAcpWireId collapse onto bare-only rows.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): serialize Cursor model applies across base/variant picks
Drill-down default apply and a quick variant click could race setModel
RPCs; last-finisher wins. Queue Cursor applies in SessionChat so the
explicit variant cannot be overwritten by a late default.
Co-authored-by: Cursor <cursoragent@cursor.com>
* test(web): align cursor picker auto-row label with upstream Auto
Rebase onto main picked up Default→Auto rename; keep #1129 coverage.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Debian <heavygee@oos-linux.in.lockhouse>
* feat(cli): add GitHub Copilot CLI agent support via ACP
Wrap `copilot --acp --stdio` for remote sessions and spawn the native TUI locally, with full hub/web integration for spawn, resume, and permissions.
Fixestiann/hapi#362
Co-Authored-By: HAPI <noreply@hapi.run>
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat(copilot): agent modes, models, slash/file UX, local session sync
Add Interactive/Plan/Autopilot (fleet is slash-only), subscription-aware
model discovery, web StatusBar/permission UX, @ file mentions, and fix
local Safe Yolo plus session-id locator for handoff/resume.
Co-authored-by: Cursor <cursoragent@cursor.com>
* chore: re-trigger Codex PR review after auth outage
Co-authored-by: Cursor <cursoragent@cursor.com>
* chore: retry Codex PR review
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(copilot): preserve agent mode on resume and apply via ACP set_mode
Resume was dropping copilotAgentMode so Plan/Autopilot reset to interactive.
Also switch local/remote mode application to --mode / session set_mode instead of slash prompts.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(copilot): wake remote loop when agent mode changes
Empty isolated queue tick lets setMode apply without inventing a user prompt.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(copilot): confirm mode changes before persisting
Await Copilot mode changes and expose discovered models so session state reflects backend acceptance.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(copilot): guard mode discovery and slash updates
Keep model probes within runner roots and preserve active sessions when mode switching is unavailable or rejected.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(copilot): preserve resume and auto semantics
Deduplicate Copilot resume rows, apply Auto explicitly, and fail closed on denied permissions.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(copilot): close permission and model discovery gaps
Keep write-capable commands pending in read-only mode, extend model probe RPCs, and preserve explicit model validation before session creation.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(copilot): persist runtime model and agent mode
Fallback to ACP model options when direct model switching is unavailable and retain Copilot agent mode across hub restarts.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(copilot): normalize composer auto selection
Use the null session sentinel for Copilot Auto so the composer selects and resets default models consistently.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(copilot): reject local permission mode changes
* style(copilot): remove trailing blank line
* fix(copilot): secure local config handoffs
* fix(copilot): reject local agent mode slashes
* fix(copilot): reject mode changes during turns
* fix(copilot): consume rejected slash updates
* fix(copilot): preserve thinking across slash handling
* fix(copilot): stabilize async config changes
* fix(copilot): roll back rejected startup model
* fix(copilot): preserve cancellation and file mentions
* fix(copilot): hide local permission controls
* fix(deps): support clean workspace installs
* test(copilot): account for spawn mode argument
* fix(copilot): attribute usage to active model
---------
Co-authored-by: HAPI <noreply@hapi.run>
Co-authored-by: Cursor <cursoragent@cursor.com>
Restores directory glanceability by default after #1315. Settings → Display
adds a toggle next to Active sessions only that re-enables the pinned section.
Fixes#1347
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat: add cache-aware token usage dashboard
Track normalized Claude, Codex, and ACP usage with incremental SQLite backfill. Exclude imported transcript history, rebuild usage after history rewrites, and expose an owner-only dashboard with cache-aware totals and breakdowns.
via [HAPI](https://hapi.run)
Co-Authored-By: HAPI <noreply@hapi.run>
* fix: preserve usage model and local dates
via [HAPI](https://hapi.run)
Co-Authored-By: HAPI <noreply@hapi.run>
* fix: normalize cached usage and timezone buckets
via [HAPI](https://hapi.run)
Co-Authored-By: HAPI <noreply@hapi.run>
---------
Co-authored-by: HAPI <noreply@hapi.run>
ElevenLabs only passed bootstrap context through dynamicVariables without
a matching {{initialConversationContext}} prompt placeholder, so Brief me
connected with no session history. Stream deferred chunks then push bootstrap
on all backends; add the placeholder for newly created ConvAI agents.
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat(web): show hidden directories in workspace browser
Add optional includeHidden param to the machine list-directory RPC so the
WorkspaceBrowser can toggle hidden (dot-prefixed) entries. Default remains
filtered for backward compatibility; the toggle persists via localStorage.
* fix(web): disable show-hidden toggle while directory loading
Prevent overlapping list-directory requests with opposite includeHidden
values; the toggle is now disabled while a directory load is active.
* fix(web): migrate chat-path attachments on scratchlist park (#1226)
When an image is attached via the normal upload adapter before scratchlist
mode is enabled, toggling mode swapped adapters and send() dropped the
metadata — park stored text-only and cleared chips. Migrate pending
chat-path files into hub scratchlist storage on send, and fail closed if
non-hub paths still reach the park wrapper.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): defer chat-path cleanup until scratchlist park succeeds
send() migrates before scratchlist.add; deleting the original upload
there left retries pointing at a missing chat blob when park failed.
Stamp migratedFromPath and clean up only after the park attempt result.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): park scratchlist before composer.send clears chips
assistant-ui empties text/attachments before onNew, so return false from
park could not restore retryable state and rejected cleanup deleted the
migrated hub blob. Intercept park from a live snapshot; clear only after
accept; releaseWithoutDelete so clearAttachments keeps parked hubs.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): lock composer while scratchlist park is in flight
Disable input/send and hide chip remove during migrate+add so mid-flight
edits are not wiped on success and hub blobs are not deleted out from
under the accepted entry.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): do not clear composer if park snapshot changed mid-flight
Compare post-await composer state to the pre-park snapshot before
clearing; disable DragDropZone and scratchlist promote while parking
so parent paths cannot add chips the clear would silently drop.
Addresses Codex Major on #1227 (preserve post-snapshot composer changes).
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): defer migrated chat-path cleanup until park snapshot clears
Return ScratchlistParkResult.beforeClear from onParkScratchlist so
finalizeMigratedScratchlistParkCleanup runs only after HappyComposer
confirms the composer was unchanged mid-flight.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): flush rich mentions before scratchlist park snapshot
Park snapshots composer.text after flushSerializedText so session
@-mention chips serialize to markdown links before scratchlist add.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): validate park snapshot before scratchlist add
Split prepare/commit/abort so mid-flight composer edits abort orphan
hub blobs instead of parking a duplicate. Reuse restored hub paths in
prepareScratchlistParkAttachments so remounted chips do not re-upload.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): ignore scratchlist toggle hotkey while park is in flight
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat: add message-level conversation fork and rewind
Expose native Codex/Grok/Claude history controls through hub REST+RPC and web ConfirmDialog actions, without file rewind or composed forks. Also reconcile the duplicate hub V14→V15 migration so typecheck can pass.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: hydrate fork transcript and consume Claude --fork-session
Forked HAPI children now copy the source transcript prefix so navigation is not a blank thread, and Claude drops --fork-session after the first launch so relaunches do not branch again.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: harden fork/rewind concurrency and durable history points
Skip pending scheduled rows when hydrating fork transcripts, serialize fork/rewind per session, and persist conversation history points/indexes across existing-session bootstrap and Grok relaunches.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: close remaining fork/rewind races and UI anchoring
Block sends and scheduled maturation while history actions run, order fork prefixes by invocation time, inherit history locators into children, and only offer Fork current on the live tail boundary.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: address remaining fork/rewind bot findings
Materialize Claude --fork-session before the first child prompt, validate
HAPI history boundaries before native RPC, expose forkCurrent on a latest
user boundary, fully demote unsupported conversationHistory capabilities,
and fix the truncate test setup order.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: align fork-current ids and Claude fork bootstrap
Compare the latest fork boundary in assistant-ui threadMessageId space,
spawn Claude forks with the persisted session mode, and preserve
forkedFrom across existing-session bootstrap.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: close fork/rewind consistency holes at the contract layer
Hold the source history lock until Claude child binds a distinct native
id, persist Codex localId→turnId locators, and mark/block diverged
sessions when native rewind outruns HAPI truncate.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: use Codex stable lastTurnId for historical fork
Map HAPI's exclusive boundary to the previous turn's inclusive
lastTurnId so native fork context matches the hydrated transcript.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: require exact Grok native resume for fork children
Reject newSession fallback when forkedFrom is set, and keep the hub
history lock until the child binds the forked grokSessionId.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: kill active fork children before failed-fork cleanup
Bind/readiness failures can leave the child process running; deleteSession
rejects active rows, so terminate first then remove the HAPI session.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: close remaining fork lock, hydrate, and todos gaps
Reject mode switches during history actions, batch-copy fork
transcripts in one SQLite transaction, and rebuild todos after
fork hydrate / rewind truncate.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: allow Codex historical fork before the first turn
Use experimental beforeTurnId when there is no previous turn for the
stable inclusive lastTurnId boundary.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: mark Grok history busy immediately after dequeue
Hub idle checks clear once messages-consumed fires; hold the busy flag
across permission sync and rewind-points lookup before prompt starts.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: encode copied conversation history content
* fix(web): hide local conversation history actions
* style(codex): remove trailing whitespace
* fix(fork): preserve children when cleanup is unconfirmed
* fix(history): confirm cleanup and guard rewind divergence
* fix(history): probe capabilities before advertising
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat(web): pin running sessions in an 'in progress' section with a live badge
* feat(web): show project name on pinned running session rows
* feat(web): make the pinned 'in progress' section collapsible
* fix(web): don't auto-expand directory groups when opening pinned running sessions
* fix(web): keep running section open while searching; clear auto-expand guard when selection leaves a group
* feat(web): show machine label on pinned running session rows
* fix(web): make running-section toggle keyboard-accessible with correct filtered state
* feat(web): split pinned running section into working/pending/idle groups with distinct badges
Remove the refresh icon button from the session list toolbar and make
the list itself the refresh affordance via a touch pull gesture.
Gesture (SessionList):
- Touch listeners on the scrollable list container; pull engages only
at scrollTop 0, with 16px feedback / 64px trigger thresholds, and
fires on release past the trigger. Mirrors the established
pull-to-load-older pattern in HappyThread.
- Touch-only by design: desktop has no overscroll bounce, so a wheel
pull feels broken; desktop keeps relying on SSE live updates and
query focus refetch.
- onRefresh widened to () => Promise<unknown> | void so the indicator
tracks the in-flight refetch and ignores re-entrant pulls.
Feedback:
- Status pill over the list (role=status, aria-live) shows
pull/release/refreshing states with a spinner while refreshing; it
also covers the initial useSessions load (isLoading), which lost its
only busy indication when the toolbar button was removed.
- The success toast is dropped (the pill is the feedback); the failure
toast is kept. handleRefresh now returns its promise.
Empty states (review P2s):
- SessionsEmptyState and the no-results message move from the shrink-0
header container into the scroll container, so the gesture works on
the visible empty state (retry path after a failed initial fetch)
and short viewports scroll instead of crushing the gesture area.
- SessionsEmptyState is gated on !isLoading so a slow initial request
no longer flashes the final empty state with active actions.
i18n: add sessions.refresh.pull/release/refreshing (en + zh-CN),
remove now-unused button.refresh and sessions.refresh.success.*.
Desktop wheel pull was implemented and then reverted after review.
* fix(web): show Auto instead of Default for Cursor model picker
Cursor CLI uses `auto` for automatic model selection; labeling it
"Default" in HAPI was confusing and inconsistent with `agent --list-models`.
Fixes#1247
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): align Cursor unavailable copy with Auto label
Co-authored-by: Cursor <cursoragent@cursor.com>
* chore: re-trigger Codex PR review
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs(web): update Cursor catalog JSDoc for Auto label
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Move the session-list search out of its dedicated full-width row and
into the sidebar toolbar, so the sidebar gets one compact header row
instead of two stacked rows.
Behavior:
- Collapsed by default: a search icon sits at the left of the toolbar
row, on the same line as the existing tool icons (codex import,
refresh, browse, settings, new session).
- Clicking the icon expands the input to fill the entire row width
(tool icons hide) and focuses the input; when focus leaves the
search container the input collapses back to the icon.
- Query and date range stay applied while collapsed; the icon shows
an indicator dot whenever any filter is active.
- The date-range picker stays inside the expanded input.
Implementation:
- SessionList gains a headerActions prop and renders a single header
row: [collapsible search] [spacer] [optional renderHeader plus]
[headerActions].
- SessionsPage drops its own toolbar wrapper and passes its five
buttons through headerActions instead.
- The safe-area top inset moves to the router container wrapping both
the error banner and the list, so iOS PWA error text no longer sits
beneath the status bar/notch.
Focus handling (review follow-ups):
- Controls that unmount themselves on click (clear-query X, picker
backdrop, range-end selection, picker footer Clear) silently moved
focus to <body>, leaving the search expanded but no longer
collapsible via blur. Each now returns focus to the input; the
picker footer Clear is wired through a dedicated onClear prop.
- Header actions can no longer be suppressed by a stale expanded
state: they render whenever the search control itself is absent
(e.g. the session list empties via SSE), and the expansion resets
when the list becomes empty.
i18n: add sessions.search.open (en / zh-CN).
Tests: adapt existing search/date-filter tests to expand the search
before interacting; add regressions for collapse-on-blur query
persistence, focus restore after clearing the query and after
clearing the date range, and header actions surviving an emptied
session list.
* feat(web): feature-flagged rich composer for inline session @ mentions
Custom segmented contenteditable (not TipTap) inserts caret-local session
atoms from the existing @ picker and serializes to markdown links on send.
Textarea path remains default until flag parity dogfood.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): rich composer mention boundary + #1215 refs
Treat U+FFFC mirror atoms as word boundaries so @ after a session
token still opens autocomplete. Point comments at Fixes#1215.
Co-authored-by: Cursor <cursoragent@cursor.com>
* test(web): peer-stack e2e for rich composer session @ mentions (#1215)
Smoke: flag on, @ picker inserts inline session atom chip (not prose dump).
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): preserve newlines in rich composer Enter-newline mode
Chromium splits contenteditable on Enter into block divs; serialize those
as \\n and insert <br> when parent leaves Enter unhandled (Shift+Enter /
enter-inserts-newline).
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): show @ badge when rich composer mentions flag is on
Dogfood was invisible: flag-off looks like a normal textarea, and flag-on
had no chrome. Surface a small @ badge when enabled.
* fix(web): rich session composer on by default (not a user setting)
The plan dual-path was an engineering kill-switch, not an opt-in. Default
to the segmented composer; only richMentions=0 disables. Drop the flag
badge and record a peer-stack motion proof covering chips + baseline UX.
* fix(web): make rich composer Shift+Enter create a visible newline
Trailing <br>+empty text node was a silent no-op at EOL. Use
insertLineBreak (ZWSP pad fallback), assert real \\n in peer e2e.
* feat(web): hover tooltips on rich composer session chips
Show full title, status, short id, and path on chip hover via a portal
bubble fed by live useSessions lookup (drafts fall back to title + id).
* fix(web): dismiss rich composer chip tooltips on mouse leave
contenteditable pointerout/relatedTarget was flaky so tips stuck after
leaving the chip. Hit-test on pointermove, clear on prose/input/leave.
* fix(web): address cold-review Blocker/Majors on rich composer
Exclude peer e2e from default Playwright; force plain-text paste; restore
newline hard-stop in findActiveWord; fix root-anchored selection mapping
and nested-block serialize; cover with unit tests.
* chore: drop accidental .cursor files from rich-composer tip
* fix(web): close remaining cold-review gaps on rich composer
Drop absolute peer e2e tooling imports, prove chip→markdown send, and
harden paste/EOL/focus/tooltip/Enter edges before Meta rematerialize.
Co-authored-by: Cursor <cursoragent@cursor.com>
* chore: absorb soup playwright.config union for clean remat
Keep fork peer-stack timeouts/annotated-video wiring and add testIgnore
for e2e/peer so the next driver rematerialize does not conflict.
Co-authored-by: Cursor <cursoragent@cursor.com>
* revert: drop fork playwright tooling from upstreamable tip
Peer-stack annotated-video + HAPI_PEER wiring stay on fork main / soup.
Product tip only needs testIgnore for e2e/peer (see docs/tooling/peer-stack.md).
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): fix rich composer Shift+Enter double newline and paste space
Prefer manual newline+pad over execCommand insertLineBreak, and stop
applying autocomplete trailing-space on paste/drop paths.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): pad EOL Shift+Enter after Range.insertNode split
insertNode always leaves an empty text sibling, so !nextSibling never
saw EOL; detect meaningful trailing content and cover with jsdom tests.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): drop custom onDrop from rich composer
Intercepting drop without caretRangeFromPoint landed text at EOF or
no-oped in-editor moves. Native CE drop is enough for #1215; paste
still forces plain text.
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat(web): sidebar-parity tooltips on rich composer session chips
Reuse SessionRowSummary (flavor, thinking/attention, schedule, todos,
relative ago, path) for chip hover so the tip matches the session list.
Co-authored-by: Cursor <cursoragent@cursor.com>
* chore: keep peer-stack e2e off the upstreamable tip
Peer specs and playwright.peer.config stay on fork main per
docs/tooling/peer-stack.md; default config still testIgnore's e2e/peer.
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat: cite sessions with UUID wire + inspect_peer for agent/overseer
Rich composer chips already serialize to [title](/sessions/<id>); flush
before send so the agent prompt never gets title-only chip text. Add
inspect_peer (MCP + hapi inspect-peer) as the read twin of ping_peer so
that same id is immediately usable for overseer/agent peer lookup, with
system-prompt glue from citations to inspect/ping.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(cli): gate inspect_peer behind permission approval
Cross-session history reads need the same prompt path as ping_peer:
keep inspect_peer off Claude --allowedTools and treat it as sensitive
in ACP/OpenCode read-only mode so prompt injection cannot silently
enumerate peer transcripts.
Co-authored-by: Cursor <cursoragent@cursor.com>
* chore: clarify playwright peer testIgnore is upstream-safe
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): keep session UUIDs on rich composer copy/cut/paste
Copy/cut write wire markdown so chips do not collapse to @title-only
clipboard text; paste reparses session links back into atoms.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): count unseen messages by rendered block, not raw message
The "N new messages" pill counted raw DecryptedMessages while the
timeline renders folded blocks, so the two never agreed. A subagent run
is dozens of sidechain messages but a single Task card; a tool_use and
its tool_result are two messages and one card; consecutive tools collapse
into one group. The pill could read "47 new messages" when scrolling down
revealed two new rows.
collectNewUnseenIds never inspected isSidechain, and it could not: the
reducer's grouping is stateful (it needs the Task tool_use before it can
map parentToolUseId), so a per-message predicate in the store cannot
reproduce it. Adding an isSidechain check there would also invert the
error for orphan sidechain messages, which tracer.ts falls back to
emitting at the top level.
Instead, drop the store's unseen bookkeeping entirely and count what the
renderer actually produced. Watermark the visible blocks when the user
scrolls away from the tail, then count the blocks past the last one they
had seen.
The count is anchor-based rather than timestamp-based because the blocks
array is not monotonic in createdAt: messages sort by invokedAt ??
createdAt, so a queued message carries an old createdAt while sitting at
the end. Anchoring also makes prepended history free, since older blocks
land before the anchor.
Known limit, documented at the call site: once the history window fills
up, mergeIntoWindow trims incoming messages off the tail, so the pill
reports 0 instead of a count. Under-reporting is preferable here, and
returning to the tail force-refetches the latest page anyway.
* fix(web): keep unseen watermark stable across optimistic id replacement
The watermark snapshotted only block.id, but that id is not stable for
the user's own messages: mergeMessages replaces an optimistic row with a
stored row that keeps localId under a new server id, and the user block
renders with the message id. Scrolling into history while an own message
was still optimistic meant its echo anchored one block earlier and bumped
the pill by one, with no new rendered row.
Track localId alongside id in the watermark and match on either.
Reported by HAPI Bot on #1255.
* fix(web): count joined assistant cards, not pre-join blocks
visibleBlocks is still not one-to-one with rendered rows: assistant-ui
joins a run of adjacent assistant-role blocks into a single card, so a
response made of reasoning + text + a tool call was reported as three new
messages instead of one, and appending another block to an in-flight
response bumped the pill without adding a row.
Walk the blocks after the anchor and only start a new row where the
assistant run breaks.
Role assignment is the part that would drift, so rather than restating it,
visibleBlockRole moves from assistant-runtime.ts to toolGroups.ts (next to
the VisibleChatBlock definition it describes) and both the runtime and the
counter import the one copy.
Reported by HAPI Bot on #1255.
Bump export schema to v2 with scratchlist text and attachment metadata
so operators keep notes when they export-then-delete. Markdown gets a
Scratchlist section; attachment bytes stay out of the JSON.
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat(web): show machine and last-active in session header
Multi-machine estates lose the machine signal after leaving list filter
chips; surface machine label + relative age in SessionHeader meta row.
Fixes#1241.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): keep session-header age fresh under keep-alive
Treat detail-cache activeAt keep-alives as render-relevant now that the
header reads them, and tick relative age every minute so labels advance
without a session prop change.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): skip sub-minute activeAt keep-alives in detail cache
Relative age only changes at 60s boundaries; accepting every ~10s
heartbeat replaced the Session object and re-rendered the chat tree
for no visible header change.
Co-authored-by: Cursor <cursoragent@cursor.com>
* chore: retrigger Codex PR review after stream disconnect
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
The /share route used a local getSessionTitle that preferred summary.text
over metadata.name, so Android share-target rows disagreed with the
session sidebar. Reuse @/lib/sessionTitle and lock the precedence with a
unit test. Closestiann/hapi#1218 once upstream PR lands after dogfood.
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat(hub,shared): scratchlist v2.2 hub attachment storage foundation (#921)
Hub stores scratchlist attachment bytes on filesystem; SQLite holds
AttachmentMetadata[] JSON via session_scratchlist.attachments (v11→v12).
Upstream ladder: v10→v11 text-only scratchlist table (#896), v11→v12
attachments column. Configurable limits via HAPI_SCRATCHLIST_* env vars.
Upload, serve, and limits REST routes; delete entry cleans hub files.
Web promote/rehydrate still TODO. Soup renumber branch follows.
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat(web): scratchlist v2.2 attachment UX (#921)
Route scratchlist-mode composer submits with attachments to hub storage,
show image thumbnails in the drawer, and rehydrate attachments on promote
to composer or queue (hub fetch → CLI upload for send).
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): scratchlist attach submit, float thumbs, copy tooltip (#921)
Hub upload adapter now sets path on ready attachments so the composer send
button unlocks in scratchlist mode; routing label matches attachments too.
Entry thumbnails float left with text wrap; copy tooltip clarifies text-only.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(hub): adapt scratchlist update tests to patch API (#921)
update() now takes { text?, attachments? }; v12 CRUD tests still passed a string.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(hub,web): harden scratchlist attachment ownership and orphan cleanup
Resolve claimed hub paths against the current session before persist,
count on-disk session bytes for upload caps, delete blobs dropped on
entry update, and DELETE pending uploads when composer remove runs.
Co-authored-by: Cursor <cursoragent@cursor.com>
* chore: drop accidental .cursor files from attachment PR
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): exit scratchlist mode before rehydrate; delete raced uploads
Promote-to-composer flushes mode exit so attachments use the chat adapter.
Cancel-during-upload deletes the hub blob once upload returns.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(hub,web): exact UUID delete match; stage hub paths on chat send
Reject partial attachment ids on disk delete, and restage scratchlist hub
attachments through uploadFile when sending after leaving scratchlist mode.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(hub): skip text-only PUT resolve; cleanup session attachment dirs
Text-only edits keep existing attachment metadata after session-id transfer.
Require full UUID on resolve. Delete scratchlist attachment files when a
session is deleted.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(hub,web): scratchlist attach route, PUT bytes, orphan deletes
Park only hub-resident attachments; subtract removed blobs from the PUT
session cap; delete attachment files only when no other entry still
references them.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(hub): canonicalize scratchlist attachment filenames
Resolve stores the on-disk sanitized name (not claimed.filename) and
hardens Content-Disposition against CR/LF/quote injection.
Co-authored-by: Cursor <cursoragent@cursor.com>
* test(hub): cover toxic filename canonicalize on resolve
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(hub,web): serialize scratchlist uploads; drop hub blobs after chat stage
Per-session upload lock keeps disk byte caps honest under concurrency.
After a successful toggle-off chat send, delete the staged hub copies so
they no longer count against the session attachment budget.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(shared,web): allow clearing scratchlist attachments; cleanup staged uploads
PUT may send attachments:[] without a text change. Staging to chat rolls
back partial normal-upload copies on failure.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(hub): re-key scratchlist attachment files on session merge
Move hub blobs when scratchlist rows transfer between session ids so
quota and path ownership stay correct. Reject PUT that would leave an
empty textless entry after clearing attachments.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): reuse restored scratchlist hub attachments without re-upload
Composer draft remount was re-uploading blobs that already had a
hapi-hub:scratchlist path, orphaning the originals against session quota.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Machines are labelled by hostname with no way to give them a friendlier
name. `MachineMetadataSchema` has declared `displayName` all along and the
whole read path already honours it (`displayName → host → id`), but nothing
could ever write it: the CLI never sends the field, the hub exposed no route
that sets it, and the web UI had no editor.
Add the missing write path:
- `PATCH /api/machines/:id` with `{ displayName }`, guarded by the existing
`requireMachine`. An empty value removes the key so the label falls back to
the hostname; the empty string is never stored.
- `machineCache.renameMachine` merges that one key into the stored metadata
and lets `refreshMachine` publish `machine-updated`, which `useSSE` already
invalidates on — so every connected client relabels without new plumbing.
- A `/settings/machines` page listing online machines with inline rename,
placed between Voice and About so the existing preference pages keep their
order. Each row keeps the hostname visible, so a renamed machine is still
identifiable.
The merge reads the raw stored metadata rather than the cached `Machine`
view. That view is narrowed by `MachineMetadataSchema`, which strips unknown
keys and yields `null` for a row that fails validation — reachable, since the
CLI's `machine-update-metadata` handler accepts `z.unknown()`. Merging
against it would have written those fields out of existence.
The row's save is guarded by a ref rather than `isPending`: disabling the
focused input forces a blur, so Enter otherwise reaches `save` twice and
fires two PATCHes, the second of which can lose the version race and report
a failure for a rename that succeeded.
`mergeMachineMetadata` already preserves hub-side fields on CLI
re-registration, so a reconnect does not clobber the name.
Closes#1210
* feat(web): @ autocomplete to cite other sessions by title
Composer @ ranks fleet session titles (and id prefixes), inserting the
same Copy-reference citation grammar. Codex file @ mentions remain and
follow session hits. Bare /sessions/<id> paths autolink for in-app nav.
Closestiann/hapi#1213.
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat(web): show session @ picks as composer chips
Selecting a session from @ autocomplete adds an attachment-style chip
(flavor + title + active dot) instead of expanding prose in the textarea.
On send, chips serialize to markdown session links that render as chips
in the transcript.
Part of tiann/hapi#1213 dogfood.
Co-authored-by: Cursor <cursoragent@cursor.com>
* revert(web): v1 session @ mentions use plain-text expansion
Attachment-style composer chips cannot express positional
"this → session A / that → session B" intent. Keep @ autocomplete
and Copy-reference text insert for v1; rich segmented composer is v2.
Part of tiann/hapi#1213.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): do not autolink source paths under sessions/
Reject dotted session-id tails and stop treating `.ext` as a soft path
end so citations like `routes/sessions/chat.tsx` stay file-path links.
Part of tiann/hapi#1213.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): keep Vite BASE_URL on session citation anchors
SessionPathAnchor href now uses buildSessionReferencePath so copy /
open-in-new-tab stay in the PWA subpath scope.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(web): @ session mention search uses sessionMatchesQuery
Reuse the share/sidebar matcher (name + summary + path + id + machine)
while still labeling and inserting getSessionTitle (name before summary).
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
