/permissions, /status, /config, /mcp, /agents, /hooks, /memory, and
/help move from the TUI-only notice catalog to clide-owned commands
with real behavior:
- /permissions <mode> sets the mode over set_permission_mode; bare
/permissions opens a picker in the interaction zone — the same card
/model and /effort use (kPermissionModes, bypass last and explicit
per T-181).
- /status → Claude sidebar Activity tab; /config, /mcp, /agents,
/hooks → Config tab. The pane activates the claude.meta sidebar tab
and publishes a meta.tab message; the sidebar subscribes and switches
its sub-tab — the same MessageBus addressing `clide ui open` uses
(D-6), so the CLI can drive it too.
- /memory opens the workspace CLAUDE.md via editor.open.
- /help renders a local summary card (clide-owned + advertised
commands) — the CLI's TUI help doesn't exist headless.
The catalog keeps empty-hint entries for these tokens as safety nets if
they're ever removed from owned.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Spike result (probed claude 2.1.175 over stream-json): there is NO
set_effort/set_thinking_effort control subtype — both are rejected. The
lever is the `--effort <level>` spawn flag (low/medium/high/xhigh/max;
settings.json effortLevel is the persisted default). So changing effort
restarts the process: respawn-with-resume keeps the conversation and
carries the flag — the same continuity /clear and /resume already rely on.
- SpawnSpec.effort → orchestrator appends `--effort <level>`.
- claude_pane: /effort <level> validates and respawns (toast explains the
restart); bare /effort opens a picker; the pane re-applies its effort on
every later respawn. Invalid level → local notice listing levels.
- ModelPickerCard generalised minimally (title + isCurrent predicate) so
the effort picker reuses it; effort needs exact matching because `high`
is a substring of `xhigh` and alias-containment would mis-mark it.
- SessionStatus.effort + StreamJsonSession.noteEffort: the wire never
reports effort, so the spawner records what it set; status/sidebar read
it from the normal status stream.
- Routing: effort moves from the TUI-only catalog to kClideOwnedCommands.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
clide forwards composer input to a headless (stream-json) CLI, where the
TUI's interactive commands don't exist. A known-but-TUI-only command
errored raw ("/x isn't available in this environment", rendered as fake
claude prose); an un-advertised one (e.g. /effort on 2.1.175) was worse —
bracket-pasted to the model as literal text, burning a real turn.
Probed claude 2.1.175 for ground truth: the initialize handshake's
slash_commands advertises skills + the headless builtins only; forwarded
local-command output comes back as an assistant message with model
"<synthetic>"; set_effort is not a control subtype; /usage works headless.
- slash_commands.dart: SlashRoute routing table (owned > advertised >
TUI-only catalog > forward) + kTuiOnlyCommands with clide-native hints
+ tuiOnlyNotice(). One source of truth replacing ad-hoc checks.
- claude_pane._send routes 'unavailable' to a local notice card; nothing
reaches the session.
- transcript_reader: AssistantTextMessage.synthetic ("<synthetic>" model)
so CLI-local output is distinguishable; "<synthetic>" no longer
clobbers the tracked model in SessionStatus (latent /usage bug).
- conversation_view: synthetic output renders as a muted framed "clide"
card (T-306 styling), never coral Claude prose.
- kFallbackSlashCommands trimmed to the genuinely-headless builtin set —
it doubles as the router's advertised fallback, and the old list's
TUI-only entries would have routed to a raw CLI error.
Board (rides this commit): T-414 gains the user's sidebar styling-pass
note; T-416 filed — surface Claude Code Workflow runs in convo/status.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Design: capture every TUI-only harness slash command properly instead of
leaking the CLI's raw "isn't available in this environment" error, and
grow the Claude sidebar into an interactive control panel.
Grounded in the version-keyed initialize probes (~/.config/clide/claude):
the advertised slash_commands list is the authoritative "forwards safely"
set; TUI-only builtins are absent from it. Three layers: a declarative
routing table (forward/owned/unavailable) replacing kClideOwnedCommands,
a reactive catch-all that renders unknown TUI-command errors as hint
cards, and D-6 parity controls in the sidebar Config/Activity tabs
(model/effort/permission pickers, session controls, usage block).
T-411 routing+capture, T-412 /effort spike, T-413 open-in-clide family,
T-414 Config-tab controls, T-415 Activity controls + usage (revisits
T-158).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Typed into the conversation view, /model was forwarded to the session's
stdin as message text — the CLI's interactive picker only exists in its
own TUI, so nothing happened. clide now owns it like /clear//resume//fork
(T-156).
/model <name> sends a set_model control_request (verified against
claude 2.1.175: subtype accepted alongside set_permission_mode;
"default" resets to the CLI's configured model) with an optimistic
status merge, rolled back with a toast if the CLI rejects the name.
Bare /model swaps a picker card into the interaction zone (D-78) —
numbers / arrows + Enter / Esc, mirroring the prompt card's shortcuts.
The model list comes from the `initialize` handshake response, which
the session now always sends — the spike verified it is side-effect-
free, and it previously went out only when MCP servers were hosted.
Until the response lands the picker falls back to the stable aliases.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Patch release: double-Shift quick-open (new in 2.4.0) no longer fires
on chorded Shift, so Shift+; types a colon again in the editor and the
Claude composer (T-409).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Typing Shift+; opened quick-open instead of a colon. Two flaws in the
T-341 detector: it counted a tap on the Shift keydown (so a chorded
press could complete the gesture before the chord key arrived), and it
relied on the chorded key bubbling to the root KeyboardListener to
break the gesture — but a focused editor or text field consumes that
event, so the tracker never saw it.
The tracker now models press/release: a tap is a press with no other
key going down while the modifier is held, and the gesture fires on
the second clean release. The root shell feeds it from a
HardwareKeyboard handler, which observes every event before focus
dispatch regardless of who consumes it, and treats a modifier pressed
while a non-modifier is already held as a chord.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Minor release. Adds live tail inside expanded Bash activity cards
(T-325) and double-tap-modifier shortcuts with double-Shift quick-open
across all keymap presets (T-341); each spawned subagent now gets its
own activity card (T-342). Carries a large stability sweep — PTY fd
and process leaks, IPC framing, settings durability, UTF-8 decoding
across chunk boundaries, transactional extension lifecycle — plus two
security fixes: the MCP HTTP server now requires a per-start auth
token (T-362) and editor.open/save are workspace-confined (T-363).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The pre-commit hook staged the ticket/history tables but left the
deps + idmap exports (the T-398..T-402 and T-403..T-407 blocker
links) unstaged on the previous commit; sweep them in.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Review outcome: the vim layer (T-65) is editor-only today — the mode
flags are global but every binding drives the focused editor, and the
tree/board/git/conversation panes have no keyboard handling at all.
T-403 carries the findings; children map vim idioms onto existing
panel commands (ctrl+w family incl. ctrl+w o → focus mode), add the
missing workspace tab cycling (gt/gT + ctrl+pgup/pgdn for every
preset), introduce nav intents for pane-local j/k navigation, and the
minimal ex command line the mode service already reserved space for.
Also sweeps in the regenerated governance index (D-96..D-99 listed,
Q-23 moved to resolved) from the decisions sync.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The user picked the zero-footprint model for SSH-remote workspaces:
stock OpenSSH only, nothing clide-specific installed on the remote.
- D-96 — footprint: ssh -tt PTYs, ControlMaster exec channels, polling
watcher, RemoteExecutionContext seam; D-56's single-process rule is
strengthened (no clide process anywhere but the local app).
- D-97 — ssh://[user@]host[:port]/path naming; auth delegates wholly
to system ssh in BatchMode; Windows is a known v1 gap.
- D-98 — remote-tool contract: shell+git required, pql/claude degrade
behind banners, one batched connect preflight.
- D-99 — session + per-workspace state identity re-keys on
(host, repo), amending D-41/D-77; local keeps its identity.
T-330 closes; T-336 expands into T-398..T-402 (connection manager,
ExecutionContext sweep, remote PTY, polling watcher, preflight) with
the blocker graph encoded in the board.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The model-independent half of the ssh:// open scheme. WorkspaceRef is
the value type for "where a workspace lives" — a local path or
ssh://[user@]host[:port]/abs/path, with parse/uri round-tripping and a
host:path display form. RecentProject carries host/port/user
(back-compatible JSON: absent keys deserialize as local) so remote
recents survive restarts and render with their host badge.
The remaining T-332 scope — ProjectManager.current off bare Directory,
open() branching, remote resolveProject — is gated on the execution
layer (T-336), which is itself blocked on the T-330 footprint pick;
the epic's blocker graph now encodes that gating.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The Phase-0 spike's core pick — no-install ssh-exec vs auto-pushed
remote agent — is the user's call (they've said they don't want to
manage remote installs; the agent model buys inotify + a stateful
backend). Q-23 now carries the 2026-06-12 triage block with both
options, the agent-model sub-questions, the remote-tool-contract
D-record need, and the latency-probe evidence gap (no sshd reachable
from the dev box). T-330 is annotated blocked-on-user; the
model-independent backbone phases proceed meanwhile.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The UI's backend client connected straight to the workspace unix
socket, hard-coding the local shape. It now talks JSON-lines through a
DaemonTransport (new lib/src/ipc/transport.dart, Flutter-free), with
LocalSocketTransport reproducing today's connect byte-for-byte — zero
behavior change, proven by the untouched client test suite plus new
seam tests driving the client over an in-memory transport.
This is the slot the SSH-remote backend (T-329/Q-23) plugs into:
request correlation, reconnect/backoff, and event forwarding live
above the seam and won't change when the endpoint is remote.
main.dart's swapIpcServer becomes swapBackend per the same plan.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
_consumeCsi silently discarded intermediate bytes (0x20-0x2f), so an
intermediate-bearing sequence dispatched on its bare final byte —
`CSI 5 SP @` (VT420 scroll-left) ran as "insert 5 blank characters",
and `CSI Ps SP q` (DECSCUSR) could collide with any future bare-q
handler. The parser now records intermediates on the CSI scratch
object and routes any sequence carrying them to unknownCSI, since no
intermediate form is implemented yet.
Implementing DECSCUSR itself (cursor shape + renderer support) is
filed as T-397.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
parser.dart (1139 LOC) now keeps only the core — byte queue, dispatch
tables, ESC/CSI consumers — at 373 LOC. The handler groups move to
mixins in part files of the same library, so every private member
stays library-scoped and no public surface is added:
- csi_handlers.dart — cursor/erase/scroll ops, DA/DSR, margins, tab
clear, repeat, window manipulation
- sgr_handlers.dart — SGR incl. the guarded 38/48 extended-color path
(T-369)
- mode_handlers.dart — ANSI + DEC private mode set/reset
- osc_handlers.dart — OSC string parsing + dispatch
An abstract _EscapeParserBase carries the shared state (handler sink,
queue, token bookkeeping, the reusable _Csi scratch) the mixins are
`on`. All 76 parser tests (and the rest of the terminal suite) pass
unchanged.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The 1192-LOC sidebar monolith now keeps only its lifecycle — stats
polling, team membership streams, primary-session binding, broker
subscription, inject + accordion state — and switches between
stateless, props-driven tab views under meta_sidebar/:
- models.dart — SidebarTab/ConfigSection/ConfigPermKind enums, the
MetaSection/MetaRow models, and the shared table geometry both
Activity and Config render on
- activity_tab.dart / team_tab.dart / config_tab.dart — the three
bodies; accordion expansion stays in the parent (survives tab
switches) and arrives as prop + callback
- roster_row.dart, permission_badge.dart, task_row.dart,
tab_strip.dart, icon_button.dart, inject_field.dart — the widgets
Public API unchanged: ClaudeMetaSidebar stays put and SidebarTab is
re-exported from the root file, so all 44 sidebar tests (and
extension.dart) pass without a single edit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
app.dart was 1187 LOC mixing five concerns. It now keeps ClideApp +
the WidgetsApp root (~60 LOC); the shell moved to lib/src/shell/:
- root_shell.dart — keyboard/intent routing (keymap resolution,
double-tap modifiers, menu mnemonics), the overlay stack, and the
welcome overlay
- hat_bar.dart + project_switcher.dart — the window-chrome bar and
its recents/file-actions dropdown (now in src/shell, not builtin/ —
they're app chrome, not extension-shaped contributions)
- slot_host.dart — slot mounting, focus-scope integration, the
per-slot bodies incl. the workspace split + editor drag handle;
_SlotBody's static title resolver became the shared resolveTabTitle
- layout.dart — the three-column grid, status bar, collapse toggles,
bottom icon rails
app.dart re-exports RootLayout, SlotHost, StatusbarHost, and
StatusbarCollapseToggle, so every existing import (incl. the three
app-level test files) is unchanged. Pure move + minimal publics
(RootShell, HatBar, ProjectSwitcherButton); full suite green with no
test edits.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
mocktail was pinned and documented as the IO-mocking strategy, but
after the T-91 coverage drive it had zero imports — every IO seam
ended up with an injected hand-rolled fake instead. D-25 is amended
to record that the hand-rolled-fakes rule covers IO seams too;
licenses.yaml and the lockfile follow. The ptyc binary removal noted
in this sweep landed with the git-API commit (it was already staged).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
No production code constructed it since the stream-json pivot (D-77)
— only its own test did. The ClaudeConversation bus-addressing
constants stay; the meta sidebar and team panel host still consume
them for member-status messages. The companion finding — the team
roster surfaces listening to TeamMemberJoined events nothing emits —
is real rewiring work, split out as T-396 (drive the roster from
TeamBroker membership, then delete the ghost event types).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
ColumnHat was superseded by the hat bar in app.dart and survived only
through a zero-coverage smoke test. Its file also carried the live
hatHeight constant (D-57's 24px hats) consumed by the hat bar and the
menu bar — that moves to widgets/src/chrome_metrics.dart.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The fd-passing-era surface — recvmsg with the msghdr/cmsghdr/iovec
struct family, raw read/write, ioctl/winsize, the fcntl non-blocking
helpers — had no callers since the daemon dissolution (D-56);
NativePty binds its own symbols. What remains is what's actually
consumed: socketpair + close (the ClideTestApp harness), errno, the
poll event bits, and the two signal numbers.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
ToolCheck had zero callers. GraphView was unreachable — the graph
builtin contributes nothing, so no surface ever built it; the flat
pql-connections ListView it held was never the owned-canvas graph
anyway (T-7 cancelled). The Governance Graph idea (Q-46/Q-49) starts
fresh if it lands.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
operations.dart carried a full second git operation surface
(gitStage/gitCommit/gitStash/gitPush/...) that duplicated GitClient
verb-for-verb, was kept alive only by its own tests, and hid a latent
pipe deadlock in _applyPatch (stdin written without draining stderr).
The file keeps the genuinely shared plumbing — gitBin resolution,
GitException, validateGitRef, GitLogEntry — which GitClient, the
status/diff readers, and the git command handlers consume.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
claude extension lifecycle
make test-integration failed at widget-tree finalization: the
palette's dispose() clears its scope flag, which during app teardown
runs AFTER KernelServices.dispose() has disposed the KeymapService —
notifyListeners asserted. Scope-flag mutations now use the same
fire-and-forget guard SettingsStore established. Same family in
ClaudeConfig: activation's unawaited load() could notify (and start
watchers on) a disposed notifier when a teardown raced it.
The claude extension's activation lifecycle and command success paths
are now exercised end-to-end through the kernel fixture — the file
entered the coverage denominator with the T-391 failure-path tests,
so per the ratchet discipline the rest of it gets covered too.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
tools/ui/build.sh and serve.sh still cd'd into the app/ directory the
flattening removed, so make test-e2e / ui-dev / ui-smoke died at the
first line. The staged Gitea workflow had the same stale cd in every
job, plus a coverage gate with no coverage run before it — it now
goes through the make targets (tooling discipline: the make layer owns
env setup) with make test-coverage feeding make coverage-gate.
Fixing the paths exposed the real break: flutter build web --wasm
cannot compile the tree since the dart:ffi pivot (tree-sitter, native
PTY) — dart:ffi does not exist on the wasm target. Fence vs park vs
drop is filed as Q-50; the workflow's e2e job is withheld with a
pointer there, and T-384 sits in review until Q-50 resolves.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Three lifecycle gaps, benign among curated builtins but hazardous the
day Tier-6 Lua extensions land: a throw mid-contribution left earlier
contributions mounted while the extension recorded as failed (a retry
then double-applied them); deactivate ignored active dependents; and
the panel/command registries silently clobbered on id collision.
Activation now tracks what it mounted and unwinds it all on failure
(including the extension's own deactivate when its activate had
succeeded); deactivate refuses with a logged warning while active
dependents exist — disable the dependents first; duplicate
contribution/command ids throw, which the transactional path turns
into a clean failed activation with first-wins semantics.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The terminal's only ingestion API was write(String), so both byte
consumers decoded per chunk — a multi-byte rune split across PTY
reads (or a tail window starting mid-character, which FileTailFollower
does by construction) rendered as U+FFFD garbage. writeBytes feeds a
per-instance chunked Utf8Decoder that carries partial-rune state
across calls; the terminal pane and the Bash live-tail follower now
use it, and write(String) stays for tests and programmatic writes.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Sixteen claude.* handlers reported ok with an `error` field buried in
the payload — `clide claude.agent.set-permission-mode bogus` exited 0,
so scripts could not detect failure, drifting from the D-6 exit-code
contract every other subsystem honors. Missing/invalid args are now
userError, missing sessions notFound, a missing orchestrator
toolError, and a failed task reassign no longer reports ok:false as a
success. No UI consumer read the old payloads. Table-driven test
walks every failure path asserting non-zero codes.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Clone-from-git and Start-a-Claude-session were inert onTap: () {}
stubs whose printed shortcuts were never registered — dead UI on the
first screen a new user sees. No advertised dead ends: the tiles are
removed until their flows exist. The tips card was also fiction
(four of six shortcuts unregistered, ⌘ glyphs for a ctrl-based
default keymap) — it now lists six bindings that exist in the shipped
default preset / contributed commands, and the Open-folder glyph
matches the real ctrl+o binding.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The Notifications service had zero widget consumers — anything pushed
through ctx.notify (cli_install's dogfood warnings, install results)
accumulated in a list nothing rendered. The service now takes the
kernel MessageBus and publishes each notification to the toast
channel with mapped severity, so the existing ToastOverlay renders
them; the active list stays for API compatibility. Chose routing over
building a notifications tray nobody asked for.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Both node types fell through the inline-span switch to an empty
textContent span: words on either side of a hard break glued
together, and images vanished with no trace. A br now emits a
newline; an img renders a muted italic "[image: alt]" placeholder
(falling back to the src) — no inline network loading in the owned
renderer; live-pane images keep going through clide image show.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Three failure modes in the YAML store: maps nested inside lists (the
documented keymap-overlay shape) fell through _emitScalar to
toString() and corrupted on the next read; writes went straight to
the live file, so a crash mid-write truncated every setting; and a
parse failure silently returned an empty map that the next set()
wrote over the user's file. Maps in lists now emit as YAML flow
mappings, writes are temp-file + rename, and an unparseable file is
preserved as .broken with a warning through the kernel Logger (new
onError hook, wired in the facade).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The async onData handler never paused its subscription, so pipelined
requests interleaved mid-handler — violating D-72's serial-dispatch
contract — while the shared StringBuffer could re-frame underneath an
in-flight await and the per-chunk utf8.decode corrupted runes split
across reads. One `await for` over a persistent Utf8Decoder +
LineSplitter fixes framing, decoding, and serialization at once.
Tests: two frames pipelined in one write dispatch strictly in order;
a frame split mid-rune across writes decodes intact.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
widget.forkSourceId took precedence over the fresh/resume logic on
EVERY (re)bind, so /clear in a fork pane re-forked the original
conversation instead of clearing, and /resume re-forked the same way.
The source is now copied into one-shot pane state and cleared after
the first successful fork spawn; later respawns operate on the pane's
own session.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Orchestrator.spawn() check-then-acts on the session registry across
two awaits (transcript-tail read, process start) — two racing callers
for the same id both passed the check and the loser's live claude
process was orphaned, never killed, never observed. The first caller
now installs the spawn future synchronously; later callers await the
same future, and a failed spawn clears the entry so a retry proceeds.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The shell spawned with Directory.current — $HOME for desktop-entry
launches, and stale after a project switch since the process CWD
never moves. Use the kernel project root, falling back to the
process CWD only when no project is open.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Broadcast streams drop the current value for late subscribers — the
shape behind T-274: the init event fires while spawn() is still
awaiting the transcript-tail read, before the pane subscribes, so the
status bar stayed blank. New pure-Dart ValueStream<T> (no rxdart —
prefer-zero-deps) replays the latest value to each new subscriber;
statusStream, busyStream, and pendingPromptStream in the claude
builtin now use it. busyStream subscribers see the current state
first (seeded false), which the busy test now asserts.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
D-71's threat model — another user on the same host must not drive my
IDE — was enforced with 0600 on the unix socket and then bypassed
wholesale by the unauthenticated localhost SSE port, which since D-86
serves every clide verb as a tool. The server now mints 32 bytes of
CSPRNG token per start, publishes it via the /ide discovery lock
file's authToken slot (the field Claude Code's client reads), chmods
the lock to 0600, and rejects any request that doesn't present the
token in x-claude-code-ide-authorization with 401.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The session observed its child only via stdout. Two failure modes:
with --verbose the CLI chats on stderr, and an undrained 64KB pipe
blocks the child mid-turn with zero diagnostics; and nothing watched
the exit code, so a crashed process just looked thoughtful forever.
ClaudeStreamJsonProcess now drains stderr from construction into a
bounded tail buffer, and StreamJsonSession watches exitCode: on death
it flips busy off, clears any unanswerable pending prompt, and emits
a SessionEnd (exit code + stderr tail) — replayed via session.end for
late binders. The pane reports the exit in its status line and logs
the stderr tail; a deliberate dispose suppresses the watch so /clear
and teardown don't read as crashes. Test fakes extend the process
base instead of implementing it, so its defaults carry.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The summarized button semantics (label, expanded/collapsed state)
wrapped the entire card with excludeSemantics, so every expanded
child vanished from the a11y tree — a screen-reader user could expand
a run and hear nothing inside it. The exclusion now wraps only the
header (ticker when collapsed, header row when expanded); inner item
cards stay readable, and the redundant background-toggle tappable is
explicitly excluded so the header stays the single AT stop.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
buildDispatcher composed a fresh PaneRegistry, FilesService,
SearchService, and EditorRegistry per workspace, but their shutdown()
methods had zero callers — every project switch left the old set's
file watcher emitting into the new workspace's bus and its PTYs
alive. The dispatcher now pairs with a teardown closure that the
serialized swap invokes after the old server stops; the same-path
reuse fast-path drops the unused new set without teardown since its
services are inert until a command starts them. SearchService gains
the shutdown() it was missing (cancels in-flight searches).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The editor registry resolved buffer paths with a string join that
passed absolute paths through verbatim and never normalized `..` —
an unconfined read and write primitive over IPC while files.read was
carefully guarded. Buffer paths now resolve through
resolveUnderRootFollowingSymlinks: traversal, absolute escapes, and
symlinks-out are rejected at open, and re-checked at save so a
symlink swapped in under an open buffer's path can't redirect the
write. D-80's extra read roots deliberately do not apply — a buffer
is a write surface. Handlers map PathOutsideRoot to the same error
files.read uses. Also merges a duplicate Added heading that had crept
into the Unreleased changelog section.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
computeReplacements accepted the query's glob filters and silently
dropped them — replace could rewrite files the equivalent search
would never have matched. The grep engine's glob helpers are now
public and shared, so search and replace can't disagree on scope;
both the preview and the apply path go through the filtered list.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
stat() follows links, so `stat.type == link` was always false: every
FileEntry reported isSymlink=false and walkFiles happily descended
symlinked directories — an escape hatch out of the workspace and a
cycle risk for the search engine built on the walk. The lister already
runs with followLinks: false, so the Link entity itself is the signal.
listDir keeps reporting the target type for the UI; walkFiles skips
descent into symlinked dirs and still emits file symlinks as entries.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
printf '\e[38m' was a RangeError inside Terminal.write — the
extended-color branches indexed params[i+1..i+4] unguarded. An
emulator must never throw on hostile bytes. Both branches now share a
bounds-checked helper that ignores truncated sequences.
Colons were silently dropped mid-CSI, fusing 38:2:255:0:0 into one
bogus parameter; the consumer now records ECMA-48 sub-parameter
links, so ITU T.416 colon-form truecolor/256-color (with or without
the colorspace slot) parses identically to the semicolon form, and a
malformed colon group is dropped whole instead of bleeding into
neighbouring SGR codes.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
New items arrive on every streamed token, and _onChanged jumped to
maxScrollExtent unconditionally — so a reader who scrolled up was
dragged back to the tail continuously for the whole reply. The
_atBottom pin already existed for viewport resizes (T-297); apply it
to the new-item path too, re-checking after layout since the user can
scroll during the frame. Twin tests added beside the T-297 pair:
pinned view keeps following, scrolled-up view stays put.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
ClideKernel.of(context) is an illegal ancestor lookup inside
dispose(); both panes wrapped it in catch (_) and silently did
nothing. The terminal pane therefore never sent pane.close (backend
PTY + daemon pane leaked per closed pane) and the Claude pane never
removed its settings listener. Both now cache KernelServices in
didChangeDependencies and the swallow-everything helpers are gone.
New terminal_pane_test covers the close-on-dispose path; note in it
why the whole tree must unmount (harness Overlay keeps
initialEntries across rebuilds).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
_reap() flipped _dead without releasing the master fd, and close()
short-circuits on _dead — so every naturally-exited child leaked its
fd and pty device for the life of the app. The reader isolate sends
EOF only after leaving its poll loop, so releasing the fd inside
_reap() cannot race the reader. Regression test counts /dev/ptmx
entries in /proc/self/fd across a natural exit; verified to fail
against the unfixed code.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
New governance/questions/design.md holds one open question per Part IV
feature proposal — Tier 1 (agent blame, context x-ray, trust ledger,
activity HUD, active-ticket chip), Tier 2 (twin-timeline rewind, visual
dialog, immortal terminals, cost ledger, ticket dispatch), Tier 3
(semantic terminal, codebase map, live mixed documents, sealed
workspace) — plus one batch record for the honorable mentions, so each
can resolve into a D-record + initiative or an R-record. Remote Claude
over SSH got a context append on existing Q-23 instead of a duplicate
record. README index regenerated by pql decisions sync.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Commit fable-ous.md (13-reviewer multi-agent assessment of the whole
tree) and the ticket tree it produced: epic T-359 with 26 children
covering the dragon bugs (PTY fd leak, undrained claude stderr,
unauthenticated MCP HTTP, path-confinement gaps, dispose-path leaks,
SGR crash, a11y semantics), the medium scorpions, a dead-code sweep,
the systemic-pattern work, and split plans for app.dart and the claude
meta sidebar. Root causes appended to existing T-274, T-283 context,
and the parser split plan to T-123. One review claim (ColumnHat
duplicated in app.dart) was refuted during verification and is
annotated on T-385/T-394.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The T-325 and T-342 entries leaked commit-body detail into the changelog;
shorten to user-facing impact per the changelog-gate cap.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Wire the detection + follower core into the Bash tool card. A Bash card
with a follow intent (`tail -f …`) gains a "live tail" segment below the
result: an embedded read-only TerminalView fed by FileTailFollower on the
file the command follows, resolved against the open workspace.
Lazy lifecycle for free: the collapser builds its children only when
expanded (clide_collapser_card.dart), so _BashLiveTail starts the follower
in didChangeDependencies on expand and stops it in dispose on collapse —
no follower runs until the card is expanded. No resolvable file-backed
source → a muted "no independent source to follow" note, never an empty
terminal. The workspace root comes from kernel.project.current, so no new
plumbing through the conversation widget tree.
Tests: a tail Bash card surfaces the segment (+ the muted note when no
project/source); an ordinary `ls` card gets no segment; the segment only
builds on expand.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The detection/follow core for the live-tail sub-card, with the UI wiring
to follow. Claude Code runs every Bash tool itself and clide only sees the
final tool_result block — we can't mirror the running process, so instead
we detect a file-backed source the command follows and open our own
read-only follower on the same file.
- bash_tail_source.dart: detectBashTailSource() parses a Bash command for a
single, safe, file-backed source (tail/cat/less with one file arg, inside
the workspace via resolveUnderRoot). Returns null for a pipe-into-tail, a
redirect, two files, or a path outside the repo — the caller then shows a
"nothing to follow" note. bashHasTailIntent() gates WHEN the segment
appears: v1 triggers on `tail`/follow-flags only, so ordinary cat/ls/git
cards stay clean (cat/less remain detectable for later).
- file_tail_follower.dart: a polling, read-only `tail -f`-style follower
(no subprocess, no touching Claude's command) that emits the trailing
window then appended deltas, and re-reads from the top on truncation.
Tested: 19 parser cases (incl. the `git push | tail -25` and outside-
workspace null cases), the intent predicate, and the follower (initial
window / appended delta / missing file / rotation / start / stop).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Fleshed out the self-update story with grounded constraints, a blocking
prerequisite, decisions, and a phased breakdown:
- D-64 ("no auto-update checks without user action") is stricter than the
original "opt-in or gated" wording → the check must be explicitly
user-initiated every time (palette / About button), not a startup poll.
- POLICY.md grudging-allowance criteria apply to the explicit fetch.
- Hard prereq: no release channel exists (2 stale tags, no CI, no signed
artifacts) → recommended splitting a "release channel" sibling under T-46.
- Phases P0 prereq → P1 check+notify → P2 download+verify → P3 apply+relaunch
(tmux sessions survive, D-41) → P4 macOS/deltas.
Moved back to backlog pending the release-channel prerequisite.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
A fan-out of N agents (Task/Agent) merged into one shared "Activity / N
steps" cluster — groupConversation folded an Agent spawn like any Bash/
Read call. Now an Agent spawn is a cluster boundary, rendering as its own
first-class collapsing card (reusing the existing sticky-agent path: folded
prompt T-263 + nested run T-264), while adjacent non-agent foldables keep
clustering into the normal Activity card.
Two changes:
- activity_cluster: a shared isAgentTool() predicate; _isFoldable returns
false for agent spawns at every level (incl. L3), so parallel agents
never merge. Only the grouping boundary changes; fold mechanics are
unchanged.
- conversation_view: harden resolveOwner. Its nearest-preceding-agent
fallback is safe with one agent but mis-routes under a parallel fan-out
(an unattributable item lands in whichever agent was emitted last —
a sibling's card). With >1 agent, drop the fallback so the item orphans
(rendered inline) instead of cross-attributed. The T-338 direct route
(parent_tool_use_id) still attributes interleaved items correctly.
Tests: two consecutive agents → two cards (not one cluster); agent breaks
a sibling cluster; agents first-class at L3; regression — consecutive
Bash still one cluster; interleaved parallel-agent runs route to their own
card; an unattributable item orphans instead of being swept into the last
agent.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ExitPlanMode arrives as a can_use_tool permission prompt and was approved
like any other tool — the control_response was sent but the tracked
SessionStatus.permissionMode never changed, so the mode indicator and
composer stayed on "plan" after the plan was accepted.
On approving an ExitPlanMode prompt, sync the tracked mode to 'default'
(the CLI performs the transition itself, so no set_permission_mode control
request is sent — we only mirror it). The change rides the existing
statusStream → claude_pane._status plumbing, so the permission-mode
control and status indicator update with no extra wiring. Deny, and any
non-ExitPlanMode tool, leave the mode untouched.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The chord matcher couldn't represent a bare or double-tapped modifier:
KeyChord.parse required a base key, so `shift shift` failed, and JetBrains
"Search Everywhere" (double-Shift) was unbindable.
Design decision: search-everywhere aliases clide's existing quick-open
finder (not a new overlay) — bound across all four presets per the user.
Changes:
- KeyChord: a bare modifier name (`shift`, `ctrl`, `cmd`, …) parses as a
modifier-free chord on that modifier's logical key, so parseSequence(
'shift shift') yields a two-chord double-tap. Adds KeyChord.bareModifier
and modifierForLogicalKey.
- ModifierTapTracker: headless, clock-injected double-tap detector. A bare
modifier never forms a single chord; an intervening key breaks the gesture.
- app.dart global handler feeds bare-modifier KeyDowns to the tracker and,
on a double-tap, resolves the 2-chord sequence via the new
KeymapService.resolveSequence. The existing single-chord path is untouched
(zero behavioural risk to normal keys).
- Presets: default/vim/vscode/jetbrains add `shift shift` → quickOpen.open.
jetbrains header updated (the gesture is now expressible).
Tests: bare-modifier parse/equality/round-trip; tracker window/reset/
different-modifier/consume; each shipped preset resolves double-Shift to
QuickOpenIntent.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Patch release: the daemon boots its pql/git/files workspace at the last
opened project instead of the launch directory (HOME) on a desktop
launch, so the ticket/decision sidebars load on first open instead of
erroring against a stale ~/.pql/pql.db (T-352). Also raises the toolchain
floor to Flutter 3.35 / Dart 3.9 and refreshes dependencies after a clean
CVE audit (T-353).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Confirmed root cause of the sidebar failure: a desktop launch starts in
HOME, which isn't a git repo, so resolveWorkspaceRoot returns HOME and
the daemon's pql/git/files all target HOME. pql then finds a stale
~/.pql/pql.db (left from earlier HOME-workdir runs) and errors
"pql.db is from an earlier schema" — exactly what the sidebars showed.
A manual refresh worked only because by then the workspace had swapped
to the repo. (Verified directly: `cd $HOME && pql ticket list` reproduces
the schema error against ~/.pql/pql.db.)
Settings confirmed the user is in the picker path (no startupSticky on
any recent), so nothing auto-opens the repo at boot and the daemon sits
on HOME until the project is opened.
Fix: resolve the startup workspace before boot — prefer the launch CWD
when it's a git repo, else fall back to app.lastProject (the repo). The
daemon now points at the real workspace from its first request, so the
sidebars load immediately without depending on swap/refetch timing. The
ProjectOpened refetch and swap serialization from 2.3.x stay in place for
genuine mid-session project switches.
Pure resolveStartupWorkspace() helper is unit-tested; app boot green.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Now that the SDK floor is Dart 3.9 (markdown 7.3.1 requires ^3.9.0), take
the bump. 7.3.0/7.3.1 are bug-fixes + perf with no breaking AST/Node
changes (we walk the parsed tree in our own renderer); only API-level
deprecations (LinkContext, BlockParser.standardBlockSyntaxes) we don't
use. licenses.yaml updated in the same commit; markdown goldens green.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Raise the declared minimums in pubspec.yaml to what our deps already
require: Flutter >=3.35.0 / Dart >=3.9.0 (was 3.19.0 / 3.5.0). alchemist
0.12 needs Flutter 3.32; Dart 3.9 first ships in Flutter 3.35, so 3.35 is
the binding floor. Pin the exact build toolchain in .fvmrc (Flutter
3.44.1).
Moving to the Dart 3.9 language level switches `dart format` to the new
"tall" style and enables two new lints. This commit is the resulting
mechanical churn, isolated from any behaviour change:
- whole-tree `dart format` reformat (tall style)
- `dart fix` for unnecessary_underscores + use_null_aware_elements
No runtime behaviour change; `make test` green.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Keep the security gate out of the local pre-push path so dev machines
don't need osv-scanner installed. The `make security` target and
ci/osv_scan.sh stay for the CI PR-merge pipeline (and on-demand local
runs); only the push-check prerequisite is removed, with a NOTE in the
Makefile explaining where it runs instead.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
`make push-check` now runs a `security` step (ci/osv_scan.sh) that scans
pubspec.lock with osv-scanner and fails the push if any resolved
dependency has a known advisory. This is a hard, fail-closed gate on top
of `dart pub get`'s passive (non-failing) advisory print.
Replaces the old manual-review `security` no-op target. Slots in among
the instant fail-fast gates, before the coverage suite. Resolves the
osv-scanner binary from PATH, falling back to a brew prefix so the gate
works under the pre-push hook's leaner PATH; if absent it fails with an
install hint (brew install osv-scanner). Native deps (dugite,
tree-sitter, wasmtime) are vendored by SHA and reviewed separately on
bump (D-42), so they're out of scope for the lockfile scan.
Verified clean against the current lockfile (80 packages, no issues).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Reviewed every direct and transitive dependency against the GitHub
Advisory Database / OSV (Pub ecosystem). No advisory affects any
dependency at its current pin or upgrade target — the "N packages have
newer versions" noise is freshness, not security. (Consistent with
`dart pub get` printing no advisory warnings.)
Bumped the safe pins + their licenses.yaml entries in the same commit:
- ffi 2.1.3 -> 2.2.0
- jovial_svg 1.1.26 -> 1.1.30 (pulls jovial_misc 0.10.0 + xml 7.0.1)
- mocktail 1.0.4 -> 1.0.5
Held, with the reason recorded inline in pubspec.yaml:
- markdown 7.2.2: 7.3.1 requires Dart ^3.9.0 — defer to an SDK-floor bump
- alchemist 0.12.1: 0.13.0 disabled text anti-aliasing -> golden churn
- test 1.31.0: flutter_test SDK-locks the resolvable ceiling
make test green (incl. SVG/xml goldens — the xml 6->7 major didn't churn
rendering).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Patch release: the real fix for the ticket/decision sidebars failing on
first load — IPC-server swaps are now serialized so the repo workspace
bind always wins over the boot launch-CWD bind (T-352). Supersedes the
partial 2.3.1 re-fetch-on-open, which is kept for mid-session switches.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The 2.3.1 fix (re-fetch the pql sidebars on ProjectOpened) only helped
the picker-first path, where the project opens after the window is up.
With sticky-startup the project opens during boot, before the panes
mount and subscribe, so they never received the event — the sidebars
stayed broken.
Root cause is a race in the IPC-server lifecycle. The boot factory fires
swapIpcServer(launchCwd) with unawaited(); the project-open flow then
fires swapIpcServer(repo). Each swap stops the live server, binds a new
one, and reconnects the daemon client. Unserialized, the two interleave
and the late-finishing boot swap can clobber the repo bind, reconnecting
the client to the launch-CWD (HOME) socket. The daemon's PqlClient (and
git/files) then run against the wrong workspace, so the first
pql.tickets.list hits a stale/global pql.db and errors
("ticket_deps.blocker_record_id missing — pql.db is from an earlier
schema"). A manual refresh worked because by then things had settled.
Chain every swap on a serialization Future so they apply in call order;
the repo swap is issued last and therefore wins. Kept the pane re-fetch
from 2.3.1 — it still covers genuine mid-session project switches.
Verified app boot is unaffected (test/app_test.dart green).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Patch release: ticket/decision sidebars load on first open (T-352), plus
the KWin frameless-chrome map fix (T-351) and the transient pql-failure
retry (T-350) that landed since 2.3.0.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
On a desktop launch the daemon's PqlClient boots with workDir set to the
launch CWD (e.g. HOME), not the repo — swapIpcServer only rewires it once
the project opens. The tickets and decisions panes fire their first pql
fetch before that swap, so pql runs in the wrong directory against a
stale/global pql.db and the pane errors (observed:
"ticket_deps.blocker_record_id missing — pql.db is from an earlier
schema"). A manual refresh worked because by then the workspace was open.
This is a wrong-workDir timing issue, not db-busy, so the T-350 retry
doesn't catch it. Both panes now re-fetch on ProjectOpened, which fires
after the IPC server swaps to the project workRoot.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
On KDE Plasma 6 / KWin 6 the frameless chrome still showed the native
title bar even with the decoration code compiled in. The KDE
server-decoration request ran on the GtkWidget "realize" signal, but
GTK's Wayland backend only creates the wl_surface on map — so at realize
gdk_wayland_window_get_wl_surface() was null and the request bailed,
leaving KWin (which defaults to server-side decorations on Wayland) to
draw its title bar.
Also connect the handler to "map", where the surface is live. The realize
pass still does the X11 gdk_window_set_decorations hint and bails harmlessly
on the Wayland part, so no duplicate decoration object is created.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The pql-backed sidebar panes fetch once on first build. If that fetch
fired too early — the planning DB still settling at startup, or a db-busy
SQLite lock under concurrent pql writes (pql exits 69) — the pane showed
"pql … failed" and stayed there until a manual refresh re-fired it.
Retry transient failures at the single chokepoint, PqlClient._run: on a
busy/locked signal (exit 69, or stderr mentioning database is locked /
busy) retry a few times with short backoff before throwing. Genuine
errors aren't busy, so they still surface immediately.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Cut the accumulated Unreleased entries under a dated 2.3.0 heading and
bump pubspec + licenses self.version. Minor bump: the batch adds features
(file references, task dock, deny-simplify, ticket pick-up, type-filter
chips, VS Code/JetBrains keymaps) alongside the fixes.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The frameless custom chrome (D-057) is gated on HAS_WAYLAND_CLIENT, which
was only defined when CMake's non-required wayland-client check happened
to find it. A build host/container without the Wayland client dev headers
(plausible on Bazzite/immutable distros that build in a distrobox) silently
compiled the decoration-suppression out, so the rebuilt app shipped the
compositor's native title bar (double title bar on KDE Plasma Wayland).
Make wayland-client a hard requirement: fail the configure with an
actionable message (Fedora wayland-devel / Debian libwayland-dev) rather
than drop a core feature. Fix the stale "xdg-decoration" comment — the
code uses the KDE server-decoration protocol.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The hook ran the full ~2min push-check on every push, even one touching
only docs, changelog, pql data, tests, or assets. Diff the pushed range
(from the hook's stdin) and run the full gate only when lib/ (app/runtime
source) or pubspec.* (deps/version) changed; otherwise run just the
instant decisions + changelog gates.
Other changes ride along with a lib change in practice, the full suite
stays available via `make push-check`, and the release CI runs it forced
on a tagged version. A state we can't classify (unfetched remote sha, new
branch) falls back to the full gate.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The ticket_idmap export was uncommitted working-tree churn that a rebase
DB-rebuild dropped, so pql could not resolve T-347 by id. Re-export the
mappings from the rebuilt DB.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
A desktop launcher gives the app a minimal PATH (e.g. /usr/bin:/bin) with
no ~/.local/bin, where pql installs — so _findOnPath('pql') returned null,
clide spawned the literal 'pql', and Process.start failed with ENOENT;
the pql pane errored. The PATH re-expansion that re-adds ~/.local/bin +
/usr/local/bin ran on macOS only; Linux GUI launches hit the same wall.
Extend it to Linux (homebrew dirs stay macOS-only). Extract the logic
into a pure expandToolPath() so the platform gating is unit-tested.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The two coverage passes shared fixed paths (coverage/lcov.info →
lcov.parallel.info → merge → rm -f), so a concurrent flutter test
--coverage — a second push gate, or a `make test` during a push — raced
and deleted this run's intermediate mid-merge, crashing merge_lcov with
FileNotFoundError.
Each pass now writes to a per-run mktemp dir via --coverage-path; the
merge runs from there and only the final result lands in coverage/lcov.info
via an atomic rename within coverage/. No shared intermediates, so
concurrent runs can't corrupt each other.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ClideCollapserCard and ConversationCard sat adjacent but used different
tokens for the same roles, so labels/summaries rendered 1-2px apart.
Standardise both on label = clideFontCaption (14), collapsed summary =
clideFontMeta (13): bump ConversationCard's label up from clideFontSmall,
bring the collapser's summary down from clideFontCaption. Goldens
regenerated for the affected card images.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
A row of toggle chips below the filter box — one per pql ticket type,
ordered large→small (Initiative, Epic, Story, Task, Bug), each with its
TicketTypeColors dot + border. Single-click toggles a type; double-click
isolates it (chart-legend solo, fully reversible); disabling the last
enabled type snaps all back on so the list is never blank. ANDed with the
text filter; all on by default, nothing persisted.
One GestureDetector owns both onTap + onDoubleTap so Flutter disambiguates
single vs double. Wireframe updated + approved.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bug / Ticket / Epic / Initiative toggle chips at the top of the tickets
panel, all on by default. Single-click toggles a type; double-click solos
it (chart-legend pattern), double-click again restores all; last-off
resets to all-on. Filed under the UI epic T-276 with a Frame0 wireframe.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The T-339 pick-up test was the only importer of the ~450-line claude
extension.dart, pulling its (mostly UI-wiring, untestable) lines into
the coverage denominator and dropping the suite below the 95% floor.
Move applyTicketPickUp into its own ticket_pick_up.dart and the T-300
path resolver into a pure resolveWorkspaceFilePath() — both small, fully
covered, and imported by the tests instead of the whole extension. No
behavior change.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
dart format was missed on this file in the T-300 commit; the pre-push
gate's --set-exit-if-changed caught it.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Found by a docs/ staleness audit:
- architecture.md: Claude no longer runs under tmux — it's driven over
the stream-json control protocol with --resume (D-75/D-77/D-78); and
the IPC socket server is implemented, not "currently unimplemented".
- testing/README.md + claude-ui-workflow.md: drop the dissolved app/
two-package paths (D-56) — tests live at test/ and the web build at
build/web/.
- design/multitab-pane.md: the Claude pane spawns a stream-json session,
not a tmux one; ClaudeSessionRef carries the session id.
Frozen historical snapshots (initial-plan.md, the HISTORICAL pty docs,
dated spikes/audits) left as-is.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Scope clarification: each per-agent card must pull that agent's full
nested run (prompt + prose/thinking/tool cards/results), correctly
attributed under parallel fan-out. Flags the resolveOwner nearest-lastAgent
fallback (conversation_view.dart:228) as a mis-routing hazard for
concurrent agents. Also pins that existing grouping is preserved: non-agent
foldables still cluster into the Activity card, intra-agent folding
(T-263/T-264/T-338) is reused not rebuilt.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Investigated whether spawned subagents get their own collapsing card.
They don't: groupConversation/_isFoldable (activity_cluster.dart) treats
Task/Agent tool-uses like any non-diff tool, so consecutive spawns merge
into one "Activity / N steps" cluster. T-263/T-264/T-338 only shaped what
renders INSIDE one agent card. Filed T-342 (under T-276) for the
complement: break distinct Agent spawns out into their own labelled cards.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The catch-all "dispatch threw" log omitted the request command, so a
handler exception couldn't be correlated to what caused it (PTY/IPC
audit item #26). Track the resolved cmd across the request handler and
include it in the error log.
The audit's other two items were already satisfied: errno/signal magic
numbers are centralized in PosixErrno + ffi/libc.dart, and the IPC
server already logs through the kernel Logger (no stderr.writeln left).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Tell the git-commit skill and CLAUDE.md not to hand-stage .pql/changelog
— the pre-commit hook exports and stages it on every commit. The only
caveat: a ticket-only turn must make at least one commit to fire the hook.
Already documented in the pql skill.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Persist the T-57 note append that a prior commit's stale export missed;
also carries a re-serialized row for an existing backlog ticket.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- T-45 cancelled: tmux detect/install gate is obsolete — D-77/D-78 moved
the Claude pane off tmux to the stream-json control protocol + --resume.
- T-57: noted it applies to both the left sidebar and right context-bar
rails, and that the left-most item opens by default.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- test: 1.30.0 → 1.31.0 (matches pubspec dev_dependencies)
- tree-sitter purpose: stale app/native/ path → native/linux-x64/
Surfaced by the T-25 audit and the 2026-05-14 security review. The
"phantom lints entry" that review also flagged is already gone.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add a "Tooling discipline" note to CLAUDE.md — run gates via the make
targets (e.g. make changelog-gate), not the ci/ scripts they wrap; the
Bash working dir is the repo root (no cd / git -C); one command per
invocation. Point the git-commit skill at make changelog-gate for the
60-word cap instead of naming the raw script.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
A user-initiated denial (Deny & simplify) came back as an isError
tool_result and rendered as a prominent expanded-red "Bash · error"
block — pure noise, since the user chose it. It now folds to a muted,
collapsed "denied" card.
Built as a reusable filter rather than string-matching the note: DenyTool
carries a `quiet` flag, the session collects quiet denials' tool_use_ids,
and ConversationView renders any error whose id is in that set folded +
muted. Genuine tool failures (ids not in the set) keep the expanded-red
treatment. Adding future "expected error" cases is just adding ids.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
When a ticket is handed to a live Claude pane (T-327), advance it to
in_progress on the receiving side of the bus — gated on acceptance, so a
pick-up with no live session stays a quiet no-op and never mutates state.
Only a not-yet-started ticket (backlog/ready) transitions, so re-picking
up a review/done ticket doesn't drag it backwards. On success it publishes
(builtin.tickets, changed) so the sidebar refreshes.
The handler logic moves into a testable applyTicketPickUp() seam; the
sidebar button now carries the current status in the pick-up payload.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
