Push payloads do not name a hub, so a tap always opened the session
against the active hub. With several paired hubs, a session from
another hub then failed to load until the user switched hubs by hand.
When the active hub's list does not know the session, the tap now
looks it up with GET /api/sessions/:id. Hubs are tried in the same
active-first order, and 404/403 have the same meaning, as for the
notification actions. If another hub owns the session, the app
switches to it first; the new home screen then opens the chat. A miss
or an unreachable hub opens against the active hub, as before.
Single-hub installs skip the lookup.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The API wrappers existed but iOS had no UI for these actions, while
web and Android did. The session row's context menu and the chat's …
menu now offer Rename for every session. Active sessions keep Archive.
Inactive sessions get Reopen and a confirmed Delete instead of
Archive, which the hub rejects with 409 for them.
The store applies renames and deletes optimistically. A failed rename
refetches server state; a failed delete restores the row and the
cached detail. Reopen marks the returned session active right away.
When reopen returns a superseding id, the chat seeds the new window,
moves the draft and navigates to it, as send-resume already does. A
reopen from the list also moves the draft and opens the session. A
422 shows the hub's message with the missing fields.
On iPhone, an authoritative removal (delete, or archive elsewhere) now
pops that chat, matching the iPad split, which already clears the
selection.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Replace the single-column settings screen with a category directory
whose rows come from a declarative catalog (SettingsHubCatalog: one
entry = route + title + summary + icon + visibility lambda), so adding
a category later (Display, Chat, Voice, Machines) is a list element,
not layout surgery. Mirrors the web settings IA at the category level.
- General subpage (settings/general) inherits the uncategorized
sections: Appearance (theme + Material You), Language, About
(versions + hub health). Zero behavior change per item.
- The owner-only Insights section dissolves into hub-level rows:
Usage/Storage render only for the owner (same ns=default gate) and
route to their existing dashboards, matching the web's owner-only
nav categories (SettingsNav OWNER_ONLY_CATEGORIES).
- Flat settings/... route pattern with per-hub ViewModelHolder, same
as the existing usage/storage precedents; back from a subpage lands
on the hub. The hub's holder passes probeHealth=false so opening the
hub itself fires no /health request; the General holder keeps it.
- Previews: hub owner/non-owner gating + General body. JVM tests pin
catalog order, the owner gate, route uniqueness, and row summaries.
- Strings: settings_category_general(+_summary) in en/ru/zh; relocate
three zh keys (chat_tool_resolved, chat_plan_implement,
chat_plan_continue) that had drifted to the file tail and broke the
three-language key order (KEYSYNC) — pure moves, values untouched.
via [HAPI](https://hapi.run)
Co-authored-by: Claude Code <noreply@anthropic.com>
Co-authored-by: HAPI <noreply@hapi.run>
* ci: merge owner-approved PRs automatically after checks pass
Approval by the repo owner on a PR should be the only manual step before
merge. The auto-merge workflow squash-merges open PRs the owner approved
at their current head once every required check's latest run on that
head has passed (test, integration, windows-codex-mcp).
Fork PR review events receive no secrets, so a no-op signal workflow
runs on pull_request_review and its completion triggers the privileged
workflow, which runs default-branch code. Merges use AUTO_MERGE_TOKEN, a
user token, so the resulting pushes to main trigger push workflows; the
workflow refuses to merge if that secret is missing.
* ci: load the auto-merge script from main on every trigger
workflow_dispatch checks out the ref chosen by the caller, so a manual
run from a topic branch would execute unmerged merge logic with the
owner's token. Pin the checkout to main.
New Session treated a disabled availability query (empty agents, not
loading) as "this machine has no CLIs." That painted the same string as
a real empty probe, next to "No machines available."
Co-authored-by: Cursor <cursoragent@cursor.com>
A session's keepalive is emitted over a volatile socket channel, so any
transport outage longer than the 30s expiry window flips the session
offline even though the CLI process is alive mid-turn and its outbound
messages are buffered for delivery on reconnect — the session comes back
the instant the socket reconnects, which surfaces to clients as a
spurious "offline during thinking" state.
Give sessions with thinking=true a 5-minute expiry grace instead. The
grace is bounded, resets to the plain 30s timeout as soon as a keepalive
reports thinking=false, and genuinely dead processes still expire on the
extended timeout.
via [HAPI](https://hapi.run)
Co-authored-by: HAPI <noreply@hapi.run>
* feat(cli): add diff-shape tool input canonicalization helper
* fix(cli): canonicalize ACP diff-shaped tool inputs for the Edit/Write views
* fix(opencode): normalize local-mode edit/write tool parts to the diff view shapes
* fix(opencode): preserve replaceAll and fix id-less hook pairing
- canonicalizeDiffToolInput now carries OpenCode's optional replaceAll through
to the canonical Edit input as replace_all, so persisted history keeps
whether an edit replaced one occurrence or all.
- opencodeLocalLauncher computes the execute-hook pairing signature from the
raw name/input BEFORE canonicalizing, so an id-less 'before' with empty or
partial args shares a queue key with the full 'after'.
* fix(opencode): preserve snake_case replace_all in edit canonicalization
canonicalizeDiffToolInput accepts already-canonical snake_case edit inputs
(file_path/old_string/new_string), but only read camelCase replaceAll. Read
replace_all too so the execution argument survives every call site.
* fix(opencode): upgrade partial local edit/write calls when full args arrive
A partial native before ({filePath}) was emitted as-is and recorded as sent,
so the later canonical full input was deduped and the web Edit/Write view never
received the complete arguments. Track the emitted input per callId and, when
a partial native edit/write call is superseded by a canonical full input, emit
a replacement tool-call (same callId) before the result. Applies to both the
message.part.updated and tool.execute.* local event paths.
* fix(opencode): release completed tool inputs from upgrade tracking
emittedToolInputs retained the full emitted Write content and Edit old/new
strings for the whole launcher lifetime. Once a call is completed
(sentToolResults), later upgrades are already blocked, so drop the stored
payload in both result paths. Add a lifecycle test that a stale part for a
completed callId neither re-emits nor emits a duplicate result.
* style(opencode): restore 4-space indentation on local launcher tracking decls
The per-session tracking declarations (sentTextParts, sentToolCalls,
sentToolResults, emittedToolInputs) were flush-left inside opencodeLocalLauncher,
violating the repo's 4-space indentation rule.
* fix(opencode): gate diff canonicalization on edit/write semantics
canonicalizeDiffToolInput now takes the tool's semantic name/kind and only
normalizes known edit/write aliases (edit, write, write_file, replace, modify,
file_edit). The Edit shape (path + both old/new) is unambiguous on its own, but
Write is just {path, content} — a shape many non-edit MCP tools also accept —
so without the gate those tools were renamed to Write and their extra args
dropped. OpenCode maps both edit and write to kind 'edit', which stays in the
allow-list, so the native-shape cases keep working. ACP callers pass the update
kind (falling back to the derived name); local callers pass the tool name.
* fix(opencode): re-emit canonical edit/write when the input changes
shouldEmit only handled the null->canonical transition, so a shape-complete
Write/Edit that already canonicalizes (e.g. {content: ""}) was suppressed
when the final content arrived, leaving the web diff with stale input. Emit on
first usable input and re-emit whenever the canonical input value changes,
across both message.part.updated and tool.execute.* paths.
* test(opencode): cover changed-input re-emit on the message.part.updated path
The execute-hook path already had a regression for canonical inputs changing
from empty to final content; add the matching case for message.part.updated so
both local emit paths are covered.
* fix(web): render opencode native read output as a file content code block
OpenCode's lowercase read tool fell through to the generic markdown
result view, collapsing the whole file into a soft-wrapped paragraph
and dropping the <path>/<type>/<content> markup. Register the read
alias, unwrap the opencode payload (including the trailing
"(End of file ...)" trailer), parse its 1-indexed line numbering into
the code block gutter, and resolve the camelCase filePath key in the
card title.
* fix(web): only unwrap complete opencode read envelopes
Anchor the envelope match to the full <path>/<type>file/<content>
structure so plain Read results whose file text contains a literal
<content> element are left untouched, capture the body greedily so an
embedded </content> survives, and stop trimming real trailing
whitespace.
A failed `result` envelope still carries the turn's answer in `response` —
agy decodes that field from the complete buffer regardless of status. The
driver used it as the failure text, so a failed turn delivered the whole
answer a second time as an error event, right under the streamed copy.
Read the reason from `error` instead, which is what agy actually reports
there (e.g. "timeout waiting for response"), and keep the existing
`agy turn failed: <status>` fallback when the envelope carries none.
* feat(web): open a session in a separate window
* test(web): cover session sidebar restore control
* fix(web): preserve hidden sidebar across session navigation
* fix(web): retain hidden sidebar on session routes
* feat(hub): generate fallback titles after the first completed turn
* fix(hub): recognize batched first-turn title prompts
* fix(hub): track heartbeat-only first turns for title fallback
* fix(hub): preserve title turn identity across restarts
* feat(cli): report claude compact completion with token delta
Replace the plain 'Compaction completed' line with a pi-style
'📦 Compacted (<before> → <after> tokens)' fallback built from the
system/compact_boundary metadata, and prefix the start notice with 📦.
The SDK stream carries no summary body (measured), so the delta line is
the terminal state of the completion event.
* fix(cli): hide local-command tag user messages from chat
Claude Code echoes slash-command bookkeeping back over the SDK as plain
user-role messages wrapped in <local-command-*> tags. Flag them isMeta so
the existing downstream filters drop them instead of leaking raw stdout.
* feat(web): collapse compact summary card by default
Keep the header (title, token delta, timestamp) always visible and hide
the summary body behind a chevron toggle. Toggle state is component-local
and non-persistent.
* feat(cli): promote claude compact summary from the local transcript
* fix(cli): don't double-render the manual /compact boundary as a status line
* fix(cli): detect later-turn /compact and ignore stale transcript summaries
* fix(cli): establish the compact transcript baseline before the result can race it
* fix(cli): narrow the local-command meta filter to the compact stdout echo
* fix(cli): range-read only the transcript tail when polling for the compact summary
* fix(cli): complete the transcript tail read before parsing the compact summary
* fix(cli): refresh the context bar with post-compaction tokens after /compact
* fix(cli): scope the Compacted stdout suppression to the active compact turn
* fix(cli): make compact lifecycle ownership race-safe
* fix(cli): publish compact outcome before accepting the next turn
* fix(cli): cancel compact completion with its failed stream attempt
* fix(cli): propagate deferred compact completion failures
* refactor(cli): coordinate compact completion in the response loop
* fix(cli): correlate compact completion with its stream signal
* fix(cli): commit compact ownership when its result arrives
* refactor(cli): name the manual compact stream suppression predicates
* fix(cli): suppress the compact echo even when hook output is appended
* fix(cli): carry the resolved context window into the compact usage refresh
* feat(cli): list local OpenCode sessions over machine RPC
* feat(hub): import OpenCode sessions into HAPI
* feat(web): import OpenCode history from new-session picker
* fix(cli): derive OpenCode imported message ids from part ids
Random ids made every scan differ, so delta classification flagged
unchanged transcripts as diverged on re-import.
* fix(cli): surface unreadable OpenCode db as rpc error
A locked or unopenable opencode.db now fails the listing instead of
reporting an empty success; summaries normalize timestamps and the web
import toast counts only created or actually-appended sessions.
* fix(hub): fail closed on opencode re-import past live HAPI continuation
Imported entries must remain a strict prefix of the native transcript.
Insertions ahead of the imported boundary or new native messages after
the session continued in HAPI now fail closed instead of appending
duplicated or reordered history.
* fix(web,hub): apply selected launch config when importing OpenCode history
Pass the model, reasoning effort, and permission mode chosen in the
new-session picker through the import request and persist them on the
imported HAPI session via applySessionConfig, so reopen launches with
the visible selection instead of stale or default values.
* fix(hub,cli): preserve explicit launch resets and skip streaming parts on import
- Launch config keys are applied by presence, so explicit null/default
selections from the picker must reach applySessionConfig to clear
stale model, effort, or permission values on re-import. Requests that
omit the fields entirely still leave persisted config untouched.
- Assistant text parts are mutable while a response streams. Mirror the
live scanner gate and import only finished (time.end set), synthetic,
or user text so an in-progress row can never be stored and later
finalized as transcript_diverged.
* test(hub): fix launch-config reset assertions to satisfy strict types
* fix(cli): fail opencode transcript reads on query errors instead of partial snapshots
Swallowed SQLite errors could return a truncated message list that the
hub later rejects as transcript_diverged with no repair path. Full
transcript reads now propagate query failures; summary lastUserMessage
extraction stays resilient per message.
* test(cli): cover unreadable-part-table transcript read stays non-partial
* fix(hub): scope launch-config failures to the per-session import result
A thrown applySessionConfig call used to escape the bulk handler as an
unstructured 500 even though transcripts were already persisted. Catch
it per session and report it as a config_failed result so remaining
sessions in a bulk request still import.
Also cover the mid-transcript part-query failure with an injected
opener that rejects instead of returning a holey transcript.
* fix(cli): read opencode transcripts inside a deferred snapshot transaction
Messages and their parts were read in separate statements, so a
concurrent OpenCode write could leave a hole in the imported sequence
that positional re-import checks then reject forever. Wrap each full
transcript read in BEGIN DEFERRED/COMMIT with rollback on failure.
* fix(cli): follow machine path policy for OpenCode imports
* fix(web): use unified permission mode for OpenCode imports
* fix(opencode): harden session import consistency
* fix(hub): preserve metadata on rejected OpenCode imports
* fix(hub): refresh OpenCode import state under lock
* fix(hub): resolve OpenCode imports after locking
* fix(opencode): bind imported resume to source machine
* feat(web): persist and send voice input message across session navigation (#1435)
* fix(web): address bot review findings for voice send across session switch (#1435)
* fix(web): resolve teardown, inactive session, send error recovery and mention serialization findings (#1435)
* fix(web): preserve draft initialText on error and handle async cross-session permission lookup (#1435)
* fix(web): preserve session draft on background failure and send via composer delivery policy (#1435)
* fix(web): send dictation directly via API and fix standard dictation language and recording support (#1435)
* trigger CI rerun for voice dictation session switch fixes (#1435)
* fix(web): prevent failed voice sends from clobbering replacement composer text (#1435)
* fix(web): prevent zero-byte recording failure from clobbering replacement composer draft (#1435)
* fix(web): prevent unmount voice transcription, clear draft on send success, and clear partial transcript (#1435)
* fix(web): stop button transcribes into composer without auto-sending; only send button triggers stopAndSend (#1435)
* ci: rerun CI for flaky claudeRemote test timeout (#1435)
* ci: retry flaky claudeRemote test (#1435)
* fix(web): guard dictation send path against attachments/schedule/connecting and protect newer drafts from late overwrite (#1435)
* fix(web): preserve Pi steer delivery mode for background dictation sends (#1435)
* fix(web): include active state in handleSend dependency array (#1435)
* fix(voice): surface MediaRecorder failures instead of transcribing partial audio
A MediaRecorder error can still be followed by dataavailable and stop
with partial bytes, so the previous onstop-only flow could transcribe
and auto-send corrupt audio. Track recorder.onerror and short-circuit
the stop handler: restore the draft and surface an error instead of
transcribing. Add a regression test for error -> dataavailable -> stop.
* fix(web): resume inactive sessions for voice dictation direct-sends
A voice dictation direct-send (mic -> send) posts the transcribed message
straight to the session, bypassing the text pipeline's inactive-session
resume. The hub rejects message POSTs to inactive sessions with 409
session_inactive, so sending to an archived session always failed (while
reopening it first made the same send succeed).
- stopAndSend now accepts { resolveSessionId, onSessionResolved } and
resolves the target session after transcription, before the POST
- HappyComposer allows direct voice sends on inactive sessions when a
resolver is provided (instead of downgrading to a plain stop), and
threads SessionPage's canonical resolveSessionId + handleSessionResolved
(the same ones the text send path uses) into the dictation hooks
- after the message is delivered to the resumed session, the UI
navigates/seeds the live session; failed sends keep the existing
draft-restore + error surfacing
- realtime dictation sends apply the same resolution
* fix(web): satisfy HappyChatContextValue in markdown-a test helper
Upstream 51ae260a added the required showSessionSummaryInChat field to
HappyChatContextValue but missed the markdown-a test helper, so web
typecheck (part of CI) fails at the upstream tip. Provide the field like
the sibling test helpers do.
* fix(web): expose a Send action during connected dictation
The visible composer button becomes Stop-only while dictation is
connected, so mouse/touch users could never reach the session-bound
stopAndSend path in handleSend (keyboard Enter was the only entry
point). Add an explicit Send button next to Stop when dictation is
connected; it routes through onSend('default') so the transcript is
captured to the target session and survives navigation (per #1435),
while Stop keeps its stop-without-sending semantics.
Addresses HAPI bot review on #1436.
* fix(web): hide dictation Send button when direct send is not eligible
The Send button shown during connected dictation only performs a real
send when handleSend's direct-send path runs; with attachments, a
pending schedule, or scratchlist mode it silently falls back to
dictation.toggle() (stop + transcribe). Gate the button on the same
eligibility conditions as handleSend so a visible Send control always
actually submits.
Addresses HAPI bot review (Minor) on #1436.
* fix(web): drop superseded markdown-a test context fix
Upstream merged its own showSessionSummaryInChat fix for the markdown-a
test helper; the duplicate property added for the pre-merge CI break is
no longer needed.
* fix(web): gate dictation direct-send on full attachment state and guard late navigation
- dictationDirectSendEligible now uses blocksScheduling (visible + hidden
persisted + still-hydrating attachment drafts) instead of only the
visible attachments array. An inactive composer keeps persisted
attachment blobs out of the visible array, so the previous check could
expose direct Send, resume the session, and POST only the voice text,
stranding the blobs on the obsolete source session. handleSend's
canDirectSend and the Send-button gate share one helper so they can
never disagree.
- The voice send survives unmount by design (#1435); a send that finishes
after the operator left the source session no longer navigates them
back. handleVoiceSessionResolved only navigates when still on the
source session's page.
Addresses HAPI bot review (Major + Minor) on #1436.
* fix(web): read live route state when a background voice send completes
The previous guard captured the render-time pathname; once the source
SessionPage unmounts, that captured value still points at the source
route, so a voice send that finishes after the operator left would still
navigate them back. Read router.state.location.pathname at callback time
instead (the router instance is stable; its state is always current).
Addresses HAPI bot review (Minor) on #1436.
* fix(web): recover post-resume send failures under the resumed session id
When a voice dictation send fails after the inactive session was already
resumed, the catch path persisted the retryable transcript under the
archived source session id — which the hub has superseded — so the
recovery was invisible on the live session. Save the draft under the
resumed id, and fire onSessionResolved so the operator is taken to the
live session where the retryable text lives. Applies to both standard
and realtime dictation.
Addresses HAPI bot review (Major) on #1436.
* fix(web): snapshot resumed-session draft before the post-resume send
The previous recovery guard read getDraft(targetSessionId) inside the
catch — after the send already rejected — so it compared the current
draft to itself and always overwrote text the operator typed into the
resumed composer while the request was in flight. Snapshot the resumed
session's draft at resolve time instead, so a newer draft is never
clobbered. Applies to both standard and realtime dictation.
Addresses HAPI bot review (Major) on #1436.
* fix(web): preserve both drafts when a post-resume send fails
When the operator typed a newer draft into the resumed composer while
the voice send was in flight and the send then failed, the recovery
guard correctly refused to overwrite the newer draft — but that dropped
the failed voice text entirely. Merge instead: append the failed message
after the newer draft so both remain recoverable. Applies to both
standard and realtime dictation.
Addresses HAPI bot review (Major) on #1436.
* fix(web): merge live composer text into failed voice-send recovery
Failure recovery previously read only the persisted draft store, but
while the composer is mounted its edits live in memory (session storage
is written only on unmount). If the operator typed replacement text
while transcription or delivery was pending, recovery either skipped the
composer restore (persisting only the voice text, which the later unmount
then overwrote) or clobbered the replacement. Recovery now reads the live
composer text when mounted and appends the failed voice text after it,
reseating the composer to the merged draft; the unmounted case merges a
persisted draft written since the snapshot. Applies to recording,
zero-byte, transcription, send, and realtime failure paths in both
dictation implementations.
Addresses HAPI bot review (Major) on #1436.
* fix(web): preserve dictation audio constraints
* fix(web): transfer follow-up drafts after voice resume
* fix(web): merge source drafts on failed voice resume
* Preserve resumed voice drafts and replace recovered composer text
Sample destination/source draft merges at persistence time; use a replacement callback for realtime recovery. Six regressions fail before the fix; 66 focused tests, all five package suites, typecheck and 16 Playwright checks pass.
* Recover delayed voice failures into the current composer mount
Resolve live recovery targets by session identity and update the draft ref synchronously before later unmount. Both standard/realtime remount regressions fail before the fix. 85 focused tests, full package suites, typecheck and 16 Playwright checks pass.
* fix: preserve live composer drafts after background voice success
Use shared transfer sampling for standard and realtime sends; update the mounted destination before navigation and unmount. Verified focused voice/transfer tests, typecheck, all five full package suites (CLI rerun serially), and 16 browser checks.
* fix: retain resumed voice follow-ups and destination attachments
Verified focused regressions, root typecheck, all five complete package suites (environment-sensitive failures rerun serially), and 16 browser checks.
* fix: preserve independent destination drafts during voice recovery
Cross-session recovery always retains destination text and independently merges source follow-ups. Remove destination baseline replacement from both hooks. Verified 72 focused regressions, root typecheck, all five full package suites (Hub rerun serially), and 16 browser checks.
* fix: preserve voice recovery drafts before composer hydration
Expose persisted draft text until hydration and update the text ref synchronously when restoring. Cover both voice modes with a held animation frame and intentional empty text after hydration. Verified 94 focused checks, full package suites, root typecheck, and 16 browser checks.
* fix(web): retain ElevenLabs finalization across navigation
* fix(web): preserve new same-text drafts across pending voice sends
* fix(web): refresh voice send callback after draft hydration
* fix(web): resolve voice destinations from current session activity
* fix(web): give voice direct-sends a localId so agent echoes dedupe
Voice dictation, realtime dictation and the cross-session voice tool sent
through api.sendMessage with localId null. Shared Codex then minted a
random clientUserMessageId for the turn and echoed the user message back
with it; the hub dedupes only on (session, localId), so every voice
message was stored and shown twice.
Route all voice sends through sendVoiceMessage, which mints the same
local-* id useSendMessage uses.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The ComposerAttachments harness left the constructor default
encodeDispatcher (Dispatchers.Default, a real thread pool) in place.
With two uploads in flight the second-launched one can finish encoding
first, reach FakeUploadApi.uploadFile first, and consume the scripted
results deque out of launch order — the queued failure gets stolen by
the upload meant to succeed, so the robbed chip never settles to its
scripted state and items.first {} hangs until runTest's dispatch
timeout (UncompletedCoroutinesError, intermittent under suite load).
Pin the encode hop to the scope's own dispatcher (the runTest scheduler
in every test), making upload arrival order equal launch order
deterministically; upload still hops dispatchers as in production. Add
a regression-lock test scripting two results over two concurrent adds.
Product code is untouched: upload() keys results by attachment id and
is arrival-order independent — the ordering dependency lives purely in
the test fake's deque.
via [HAPI](https://hapi.run)
Co-authored-by: Claude Code <noreply@anthropic.com>
Co-authored-by: HAPI <noreply@hapi.run>
* fix(codex): drop safe-yolo from Codex permission modes
Every Codex session runs on the native shared runtime (runCodex is
runSharedCodex), which rejects safe-yolo. The mode stayed in
CODEX_PERMISSION_MODES and six filters hid it again in the web picker,
composer, hub permission-mode route, hapi set-mode and both native
apps. API callers that validate against the flavor catalog (e.g. a
spawn with permissionMode: 'safe-yolo') still passed it through and
only failed inside the runner.
Remove it from the Codex catalog (shared, iOS, Android, fixture) and
delete the filters. autoReview is the native replacement. Safe Yolo
stays for Gemini, Kimi and Copilot.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(ios): Codex option list now has four modes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: list Claude background tasks from the snapshot instead of guessing
The status panel only had a count from `background_tasks_changed` and
reconstructed commands by regex-matching Bash results in loaded chat
history, so tasks whose start message was unloaded, auto-backgrounded
("moved to the background (ID: …)"), or non-Bash showed
"N running · exact command unavailable".
The hub now keeps the snapshot's tasks (id, type, description) on the
session alongside the count. The web panel lists them directly, using
the exact task ID to look up the Bash command when loaded and the
snapshot description otherwise.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(web): only attribute a Bash command from its background launch result
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(native): accept backgroundTasks in strict session patch decoders
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(claude): apply mid-turn switches to auto/plan in the running process
Claude enforces auto and plan natively, so switching a remote session from
Manual to Auto during a turn only took effect after the next message
restarted Claude; the running turn kept asking for approval. Send
set_permission_mode to the live process whenever the native mode changes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(claude): surface refused or fallen-back permission modes
Claude rejects set_permission_mode when auto is unavailable (e.g. disabled
by settings) and silently starts in default when launched with an
unavailable auto/plan. Both left the UI showing a mode that was not in
effect. Revert the session to the mode Claude actually runs and post the
reason in the chat.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(claude): ignore permission mode rejections superseded by later switches
A delayed rejection of auto could restore an older mode after the user had
switched away and back again, because staleness was checked by mode value.
Track each transition with a sequence number instead.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
ping-peer now sends a ping-peer- localId and reports hub-accepted instead
of delivered; the hub exempts those rows from the session-end synthetic
sweep so only a real runtime ACK confirms them; web shows pending vs
delivered badges only on peer rows, excluding failed, indeterminate and
scheduled states.
* fix(runner): prevent Windows process probes from blocking session lifecycle
* perf(cli): reduce Windows process probes during session shutdown
* test(cli): update PowerShell fixtures for complete process snapshots
Content growth and mobile-keyboard resizes increase the distance from the
bottom without any user gesture. handleScroll treated that as the user
leaving the tail and disabled auto-follow, so the session feed stopped
following new messages until it was scrolled down manually.
While tail-follow is active, treat a non-upward scroll as layout churn
and re-pin to the newest message instead of dropping out of tail mode.
Add regression tests for transcript growth and viewport shrink.
GET /api/sessions runs countFutureScheduledBySessionIds and
minFutureScheduledAtBySessionIds over every session id in the
namespace. No existing index matches the full predicate set
(invoked_at IS NULL AND local_id IS NOT NULL AND scheduled_at IS
NOT NULL AND scheduled_at > ? AND delivery_state = 'queued'), so
SQLite probes idx_messages_local_id — one pass over every local
message, twice per session-list refresh, even though the matching
set is almost always empty.
Add a partial index on (session_id, scheduled_at) covering every
constant predicate (schema v26→v27, base schema + step migration),
turning both lookups into a near-empty index range scan that also
serves the single-session variant. Measured on a long-lived hub
DB (~20k messages, 37 sessions): ~8-10ms per query → ~0.04ms.
Co-authored-by: Claude Code <noreply@anthropic.com>
* feat(shared): derive Claude model choices from the CLI catalog
The choices are the rows of the claude CLI's own /model picker, in its
order and with its display names. The stored value is what
claude --model receives: an alias is resolved again each time the
session's claude process starts, a full id stays on its model, so
following and staying need no new field.
Effort support is read per model so a model switch can drop an effort
level the next model does not offer.
* feat(cli): discover Claude models from the CLI's initialize response
A machine RPC starts claude in stream-json mode, sends only an
initialize control request and reads the models it reports, so no turn
runs and no transcript is written.
claude --print runs a directory's project hooks and .mcp.json servers
without a trust prompt, so the probe starts from the home directory
with user settings only, no MCP servers and hooks disabled.
Successful catalogs are cached per claude executable for five minutes
and concurrent requests share one probe; failures are not cached.
* feat(hub): expose the Claude model catalog per machine
GET /machines/:id/claude-models forwards to the runner's
listClaudeModels RPC. A runner that predates the handler answers with
the stable rpc_target_missing code so clients can keep their built-in
list.
* feat(web): offer the machine's Claude models in the model pickers
The composer and the create-session form list the rows the machine's
claude CLI shows in its own /model picker, as it shows them. Built-in
presets the catalog does not list remain selectable after it.
Until the catalog arrives, or on a runner without discovery, the
built-in presets are shown as before. A saved Claude model is no longer
reset to Default when the built-in list lacks it; the create-session
form keeps it and marks it as no longer listed when the catalog
dropped it.
* feat(hub,web): keep Claude effort within what the selected model offers
For Claude sessions the model endpoint accepts an optional effort, so a
model switch and the effort it keeps reach the session as one config
change. Other flavors are refused: Pi, for one, commits the model
before its thinking level. When the machine's catalog says the next
Claude model does not offer the current effort, the composer clears it
in that same request. The create-session form drops such an effort
however the model was set, including a restored preference or draft.
Effort choices in both places narrow to the selected model's levels;
without a catalog every level stays available as before.
* fix(web): retry Claude model discovery after a failed probe
The machine answers a failed probe with success:false over HTTP 200.
The query cached that as an answer for its stale time, so a user who
signed in and reopened a picker within a minute still saw only the
built-in models. A failed probe is now a query error, which is not
kept, and the next picker to mount asks the machine again.
* fix(web): list only the Claude CLI's models once its catalog is known
The built-in presets were kept after the catalog so that a partial list
could not hide Opus. The catalog is the CLI's own /model list, though,
not a partial one, and the presets added entries the CLI does not show
(Sonnet 1M, Opus 1M, Fable 1M). With a catalog the list is now exactly
its rows; a saved model it does not list stays as the current model,
and New Session marks it as no longer listed. Without a catalog the
built-in presets are shown as before.
* fix(shared,web): list earlier Claude versions under Other models
Claude Code's model sheet shows each family's newest model first and
every earlier version under an "Other models" heading. The CLI's
catalog lists models in that order but does not say where the split
is, so the first row of each family is taken as its newest and later
rows of the same family as earlier versions.
The composer's model list and New Session's model select now show the
same two groups, keeping the CLI order within each. Nothing is folded:
every row stays one click away, as it does in Claude Code.
* test(web): pin that Claude 1M variants come from the CLI catalog
Claude Code 2.1.105, 2.1.200, 2.1.240 and 2.1.274 list a 1M choice as
its own catalog row (opus[1m], claude-fable-5[1m]); 2.1.303 and 2.1.310
list none, and on 2.1.310 opus and sonnet run with a 1M context window.
The catalog-only list therefore offers a 1M variant exactly when the CLI
does. Pin that and record why the built-in [1m] presets are not appended.
* feat(cli): report the CLI process start marker in session metadata
The session webhook only names hostPid. A PID alone does not tell the
runner which process generation reported it: once the CLI exits, the OS
can hand the same PID to any other process, including another
runner-spawned CLI.
Add metadata.hostStartMarker, the reporting process's own start marker
(getProcessStartMarker(process.pid), the same probe the runner uses for
its resume records and the stop-session generation check).
buildSessionMetadata is the only place that sets hostPid, so every
bootstrap path (fresh, existing, lazy, shared Codex) reports it. The
runner uses it to decide whether an untracked runner webhook may be
adopted (decideUntrackedRunnerWebhook).
* fix(runner): adopt untracked runner webhooks only from the reporting process generation
Since #1911 the runner adopts an untracked `startedBy: 'runner'` webhook
(runner restart before the webhook; Claude has no HAPI id on argv) and
persists getProcessStartMarker(pid) of whatever currently owns hostPid,
so that a later stopSession can tree-kill that generation.
If the webhook is late - the reporting CLI has exited and the OS has
already reused its PID - the persisted marker belongs to a foreign
process, possibly another runner-spawned CLI. The generation check in
stopSession then passes and the foreign process tree is killed.
The webhook now has to prove the generation itself: the CLI reports its
own marker as metadata.hostStartMarker and decideUntrackedRunnerWebhook
adopts only when it matches the live PID. A marker that names another
generation, or a failed probe, is ignored without killing anything,
also on the webhook-timeout path: a proven mismatch means the PID is not
the ghost. A webhook without a marker (older CLI) is left untracked
instead of adopted blindly; the timeout kill for those CLIs is unchanged.
The integration test drives a real runner over its control server: a
webhook carrying the live marker is adopted, listed and stoppable; a
webhook with a stale or missing marker leaves the PID untracked and
alive, and stop-session reports unknown.
Follow-up to #1911 (#1910).
* fix(cli): probe the process start marker only for runner-started sessions
buildSessionMetadata probed getProcessStartMarker(process.pid) on every
bootstrap, terminal starts included. The runner reads
metadata.hostStartMarker only in the untracked `startedBy: 'runner'`
path (decideUntrackedRunnerWebhook); a terminal webhook never consumes
it, and neither do hub or web.
The probe is a synchronous spawn: `ps` on POSIX, `tasklist` plus a
PowerShell Get-CimInstance call on Windows, each with a 10 s timeout.
A terminal `hapi` start on Windows therefore blocked on a PowerShell
cold start before the session row existed, for a value nobody reads.
With shared Codex the probe also ran per /new and /fork on the event
loop shared by all sibling roots.
Set hostStartMarker only when startedBy is 'runner'; that is the one
case the runner evaluates. This narrows the earlier commit: every
bootstrap path reports the marker for runner-started sessions, not for
terminal ones.
* fix(codex): keep hostStartMarker in the shared runtime's runner webhook
The shared Codex runtime bootstraps its roots with reportStarted: false
and reports them to the runner itself, from root.session.getMetadata().
That is the hub's view of the metadata: the hub parses stored metadata
through MetadataSchema, so a hub that predates hostStartMarker strips
the field and the webhook arrives without it. The hub's update-metadata
merge never returns it either, so the loss lasts for the root's
lifetime.
With the generation check, an untracked runner-started webhook without
a marker is ignored instead of adopted. A runner restart (for example
the version handoff of a single-host upgrade, where the hub process
keeps running the old code) followed by /new or /fork in a long-lived
shared root therefore left the root unlisted and untracked, the very
situation the adoption from #1911 addresses. The Claude and lazy
bootstrap paths are unaffected: they report the local metadata.
Take the marker from the local bootstrap metadata instead. The opt-in
runtime integration test models the stripped hub view in its session
mock and asserts the reported payload still carries the marker. The
mock also gains the `on` subscription that SharedCodexRoot requires
since #1911, without which the suite's bind test could not run.
* test(runner): run the late-webhook suite in the serial integration project
lateRunnerWebhook.integration.test.ts starts a real runner and a
detached child process per case, but the default vitest project picked
it up and `bun run test` ran it in a parallel worker. Tests that spawn
runner process trees belong to the serial integration project
(vitest.integration.config.ts, CI job `integration`), as the config
comments and .github/workflows/test.yml require.
Include the file in the integration project, exclude it from the
default one, and remove the temporary HAPI_HOME of each case, which
was left behind in the temp directory.
---------
Co-authored-by: Benedict Groppe <195190800+BGGBTAC@users.noreply.github.com>
* fix(cli): release stdin before handing terminal to local-mode child
hapi ships as a Bun-compiled executable, and Bun's tty.ReadStream keeps
an in-flight read on fd 0 even after process.stdin.pause()
(https://github.com/oven-sh/bun/issues/29126).
Remote mode reads stdin (Ink UI in raw mode, for the double-space
switch-to-local gesture). When switching back to local mode,
spawnWithTerminalGuard only paused stdin before spawning the agent TUI
with stdio:'inherit'. The parent's stale pending read kept racing the
child for console input and won: after a remote -> local switch the
agent TUI rendered but received no keystrokes at all — the input box
was dead and even Ctrl-C never reached it. Instrumented at local spawn
time: dataListeners=0, isPaused=true, but _readableState.reading=true.
Fix: destroy stdin outright before spawning the local child
(releaseStdinForChild) — destroy reliably stops the pending read where
pause() does not — and re-create process.stdin via
`new tty.ReadStream(0)` when remote mode starts again
(ensureLiveStdin, called from RemoteLauncherBase.setupTerminal).
hasTTY is now computed lazily since stdin may legitimately be
destroyed at launcher construction time.
Verified end-to-end on Windows with `hapi kimi` by injecting console
input via WriteConsoleInput and checking the agent session wire log:
remote -> double-space -> local -> typed message reaches the agent;
switch to remote again (double-space detection works on the
re-created stdin) -> local -> input works again. Direct local launch
unaffected. `bun run typecheck:cli` and the cli vitest suite pass.
* fix(cli): preserve piped stdin when releasing terminal for local child
Addresses review feedback on #1932: releaseStdinForChild() destroyed
stdin unconditionally, but destroying a piped stdin closes fd 0 and
starves the child spawned with stdio:'inherit'. The Bun stale-read
workaround is only needed for a TTY, so skip destroy() when stdin is
not a terminal; pause() suffices for pipes. Adds regression coverage
for the piped case.
---------
Co-authored-by: Naitian LIU <Liunaitian@users.noreply.github.com>
For the `dsh` flavor HAPI's `$` skill menu only scanned `~/.agents/skills`
and `<dir>/.agents/skills`, so skills installed under the DeepSeek Harness
home (for example `~/.dsh/skills/<skill>`, where the clawhub CLI installs
them) never appeared in the completion list even though DSH's own
skill-filesystem provider loads them.
Add the roots that provider uses, plus the `$DSH_HOME` override the other
supported agents already have: `$DSH_HOME/skills` for user skills and
`<project>/.dsh/skills` for project skills. The DSH integration (#1632) did
not extend the per-flavor skill roots, unlike the earlier per-agent
additions (#288/#482/#487 Claude and Codex, #1030 Grok, #1245 Copilot).
Verified with a temporary-home Red/Green check, three new unit tests, a real
DSH session in a Full test environment (its skills endpoint now returns the
previously missing skill), typecheck, build, and the Root
terminal-wrap-fidelity Playwright suite.
via [HAPI](https://hapi.run)
Co-authored-by: Claude Code <noreply@anthropic.com>
Co-authored-by: HAPI <noreply@hapi.run>
* fix(cursor): in-place relaunch when switching live session to Auto
When ACP does not advertise literal auto, switch to Auto by respawning
the same hub session under --model auto + session/load instead of
rejecting. Keeps #1819 CLI Auto pin semantics. Fixes#1908.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(cursor): widen in-place relaunch spawn model typing
Allow null/undefined rollback spawn models from resolveCursorSpawnModel.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(cursor): re-pin ACP session id after in-place relaunch load
If session/load returns a different agent id, update hub metadata the
same way as a fresh session so resume stays recoverable.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(cursor): coordinate message loop with in-place Auto relaunch
Await relaunch completion before prompting, re-read the live backend
after model apply, and publish this.backend only after session/load.
Addresses tip bot Majors on #1909.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(cursor): harden Auto relaunch against prompt races and cleanup
Hold promptInFlight before mode apply, end the loop if backend restore
fails instead of requeue-spinning, and discard late replacement backends
when session teardown has started. Addresses tip bot Majors on #1909.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(cursor): avoid continue-in-try circular typing; finish relaunch harden
Refactor mismatch requeue off continue-inside-try so typecheck passes,
keeping promptInFlight hold and teardown discard for #1909 tip bot Majors.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(cursor): preserve queued turns and Auto-review across relaunch failure
Requeue dequeued batches before ending when restore fails, and still
record Auto-review (slash after publish) when mode flips while backend
is null mid-relaunch. Addresses tip bot Majors on #1909 @ 9e5f241f1.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(cursor): defer hub ack until Auto relaunch has a live backend
Avoid acknowledging queued turns before a usable ACP process exists, and
reset Auto-review slash bookkeeping on in-place process replacement.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(cursor): recompute Auto-review spawn flag for replacement ACP
Slash bookkeeping after in-place relaunch must use the replacement
process's --auto-review arg, not the prior process's sticky flag.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(cursor): drop queued Auto-review slash when replacement has --auto-review
Cursor treats /auto-review as a toggle; leave no leftover slash for a
spawn that already enabled Auto-review via the CLI flag.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(cursor): discard held Auto-review toggle after --auto-review relaunch
Mark internal toggles so queue reconcile and post-relaunch dispatch drop
only HAPI-generated /auto-review slashes, preserving user-sent commands.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
A pending permission whose sidechain tool_use never makes it into the
rendered block tree leaves the session blocked with no answerable UI: the
attention indicator shows a pending request, but no card renders anywhere.
Root cause: the tracer drops sidechain messages it cannot attribute to a
parent Task/Agent call — no parentToolUseId on the message and no
prompt-holding sidechain root in the window (observed with background
subagents whose transcripts live in separate subagents/*.jsonl files and
whose initial prompt message never reaches the hub). The orphan-card
fallback in reduceChatBlocks then checked *raw transcript* tool ids, so
the dropped message still suppressed synthesis.
Check the final rendered tree instead (recursively, including blocks
nested under Task/Agent cards): any pending permission that is not
rendered anywhere gets exactly one synthesized, answerable card. This is
the approach suggested in #1073 itself.
Verified against a live session where 48 of 69 messages were dropped by
the tracer, including the pending WebFetch tool_use; with this change the
request renders as an orphan card and can be approved from the chat.
Refs #1073, refs #587.
Co-authored-by: zx-shi <shi@users.noreply.github.com>
Co-authored-by: Claude Code <noreply@anthropic.com>
* fix(cli): flush buffered ACP assistant text after an idle gap
ACP gives no "text segment finished" signal for a turn's last text segment and AcpMessageHandler only emits buffered text at explicit boundaries or through the prompt-lifecycle drains. When neither arrives - a text-only turn whose prompt() never returns - the answer is held until the next user prompt.
Emit buffered text once the stream has been silent for TEXT_IDLE_FLUSH_INTERVAL_MS (1000ms). The idle flush defers while a reasoning block is open (keeps Reasoning above the answer) and while the buffer may be an unfinished control envelope (keeps the internal-event filter complete). A later boundary emits only the remainder, so no character is emitted twice.
* fix(cli): stream idle ACP text as snapshots under one stream id
An id-less idle emission could render a reordered or duplicated answer when a dedupe agent rewrites its buffer with a prefix, and a pause inside an open Markdown fence split the rendered answer into separate blocks.
Stream idle emissions as full-text snapshots under a stable stream id and finalize with the same id at the boundary, mirroring flushReasoning; the partial-watermark computation is removed. The control-envelope guard no longer assumes type is the first JSON key.
* fix(cli): skip interim idle text snapshots in local launcher displays
* fix(test): use portable `ps axeww` in test-process audit
The audit ran `ps eww` which is terminal-scoped on macOS (and exits 1
without a controlling terminal, failing the whole CLI suite via the
global-teardown audit). The previously suggested `-eww` also breaks the
scan: macOS treats `-e` in SysV form as "all processes" and silently
omits the environment dump, so a marked test child is never detected.
Use the BSD full-dump form `ps axeww` (all users + tty-less + env +
unlimited width), which ports across darwin and procps-ng. Add a
regression test that spawns a real marked child and asserts the audit
finds it.
* test(audit): skip live-process detection test on Windows
The scan function short-circuits to an empty list on win32 where ps
axeww is unavailable, so the assertion that finds a live child can
never pass on that platform. Skip it conditionally.
Every assistant message that ends with an AGENT_NOTIFY_SUMMARY footer
re-ingests the work_ad cause from the session message store. When a
session runs many turns without a new invoked inbound (automation-style
runners), the sticky path copied the previous cause verbatim, which also
froze the resume point (causeSeq + causeCursorMessageId) at the original
inbound. Each subsequent notify then re-loaded and re-parsed the entire
session tail since that inbound — content decode is zstd + JSON.parse
per row, so the cost grows without bound as the session grows and
blocks the hub event loop for seconds per notify.
Measured on a self-hosted hub with a ~10k-message session whose last
consumed inbound sat at seq 891 (v0.29.1): every notify footer stalled
/health for ~4.7s and cost ~5000 page reads, repeating per notify. With
this change the first notify pays a one-time catch-up scan; the resume
point then advances past each assistant turn and subsequent notifies
complete in the low milliseconds.
- resolveWorkAdCause: on the sticky path, advance causeSeq and
causeCursorMessageId to the current assistant message while keeping
the cause identity (messageId/text/kind). The advance is skipped
while unconsumed queued or unmatured-scheduled inbounds still sit
below the watermark — those can mature into a later cause and must
stay inside the scan window.
- loadMessagesForCause: when the cursor row was trimmed away by
retention, resume after the numeric causeSeq watermark (validated
against the session's current minimum seq) instead of degrading to a
full session read on every later notify. A history move
(mergeSessionHistory) empties the session and restarts its seq
space, so a stale low watermark still selects the full read there.
- ingestNotifySummaryFromMessage: resolve the assistant seq by message
id instead of scanning the loaded window, which after the watermark
advance no longer contains the notify-bearing row.
- store: add getMinSeq helper for the watermark validation.
Co-authored-by: HAPI <noreply@hapi.run>
* docs(agents): add a bounded PR review-wait and auto-fix loop
Document how an agent should behave after opening or updating a PR:
wait on a per-HEAD window (30 min, 60s poll) for checks, reviews and
comments; auto-fix clear local feedback and push to the same branch;
stop and ask before product/scope/security/force-push changes; and
report honestly when a wait times out instead of burning context.
* docs(agents): clarify loop entry condition and unresolved-feedback carryover
---------
Co-authored-by: HongChenGG <HongChenGG@users.noreply.github.com>
