Completes the account settings surface with the global Accounts list under the
Claude category: each registered account shows a sign-in dot, name, and config
dir, with re-login and remove affordances plus an inline add-account field.
- Sign-in status: accountIsSignedIn, a read-only probe (a .credentials.json, or
an oauthAccount marker in .claude.json; under-reports on macOS keychain).
- Add: registers ~/.claude-<name> and publishes a login action (T-485 opens the
pane).
- Remove: registry-remove, guarded while a workspace is bound — matching the CLI
`account remove`. --purge dir deletion stays on the CLI flag.
All management routes through the AccountRegistry + accountActionChannel, and
the list rebuilds live off the settings notifier. en/nl strings + widget/probe
tests added. Closes T-482.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
A custom settings control under the Claude category: a dropdown of the
registered accounts plus Default. Picking one binds (or unbinds) this
workspace via the AccountRegistry and publishes set/unset on
accountActionChannel — the same channel the CLI verbs use, so the session
respawns onto the account (T-480) and the IDE lock re-syncs (T-479). It reads
live off the shared settings notifier, so a CLI `account set` updates the
dropdown too. Empty states cover no-workspace and no-accounts, each pointing at
the CLI.
Registry writes set the in-memory binding synchronously then flush, so the
control publishes the bus event before the disk write completes.
Part 2 (the global Accounts registry CRUD list + sign-in probe) is still open
on T-482. en/nl strings added; widget test covers the states + bind/unbind.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
A `claude` started with CLAUDE_CONFIG_DIR=<dir> looks for clide's /ide
discovery lock under <dir>/ide, not ~/.claude/ide — so today a per-repo
account session (T-476) can't reach clide's IDE bridge.
McpServer now reconciles a SET of lock paths instead of one: the default
~/.claude/ide always, plus the bound account's <dir>/ide when this workspace
is bound (boundConfigDir, injected from main.dart via the AccountRegistry).
syncDiscoveryLocks() writes/removes locks to match the active set; it runs on
start, once post-boot when the registry becomes resolvable, and on every
accountActionChannel event, so binding/unbinding adds/removes the account lock
at runtime. stop() sweeps every path written — no orphans. Lock content +
0600 are identical across dirs.
Acceptance 1-4 and 6 are covered by mcp_server_test (multi-dir write, no-binding
regression, dynamic add/remove, full cleanup); #5 (a live claude resolving the
bridge end-to-end) is manual.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The extension consumer for the per-repo account verbs, making set/unset
fully functional. The Claude extension subscribes to accountActionChannel:
- set / unset → ClaudeSessionOrchestrator.respawnForWorkspace(cwd): closes the
workspace's solo sessions (awaiting real process death, T-437) and re-spawns
each on the same id with --resume, so the conversation continues under the
newly-bound CLAUDE_CONFIG_DIR (resolved at spawn by agentBootstrap). Team and
forked sessions are skipped — re-joining the broker / re-forking on an account
swap is out of scope; they adopt the account on their next natural spawn.
- remove --purge → deletes the config dir behind isPurgeableAccountDir, a strict
guard that only ever removes a ~/.claude-* directory that is a direct child of
$HOME. The purge payload now carries the dir (the account is gone from the
registry by publish time).
login still only publishes its action — spawning the `claude login` terminal
pane needs argv+env terminal-pane support and is split to T-485.
Covered: respawnForWorkspace (respawn solo, skip fork/other-repo) and the purge
guard's accept/reject matrix.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The CLI half of the multi-account feature (epic T-476; D-6 parity). A new
`claude.account` dispatcher command multiplexes the six sub-verbs over an
injected, Flutter-free AccountStore port (runs under `dart test`):
- add <name> [--dir] register (default ~/.claude-<name>); idempotent, clear
conflict error
- list {accounts, boundAccount (this workspace), detected}
- set <name> bind this workspace (persists)
- unset clear this workspace's binding
- remove <name> [--purge] registry-remove; refuses while any workspace is
bound
- login <name> (publishes the login action)
Registry reads/writes go through the user-scope SettingsStore; side-effects
that only the UI layer can do — respawn on set/unset, the `claude login`
terminal pane, and the --purge rm — are published on accountActionChannel for
the Claude extension to consume (that consumer is T-480 part 2). main.dart
adapts the real AccountRegistry to the port and registers the command alongside
image.show / status.
Adds SettingsStore.keysAt (binding enumeration) and AccountRegistry.boundName /
boundAccountNames. No changelog yet — set/unset don't auto-respawn until part 2,
so the feature isn't user-complete. Verb behaviour + payloads + the in-use
guard are unit-tested against a fake store.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The load-bearing piece of the multi-account epic (T-476): a bound workspace's
hosted claude now spawns with CLAUDE_CONFIG_DIR set to that account's dir, so
it runs under the bound account end-to-end. Every hosted session (primary /
secondary / fork / teammate) inherits it — the orchestrator already routes all
spawns through agentBootstrap.
- New pure resolver claudeConfigDirForWorkspace(cwd, boundConfigDir, env):
bound account dir > parent CLAUDE_CONFIG_DIR (respect the launcher) > null
(Claude defaults to ~/.claude). The registry is injected as a plain lookup
so agent_bootstrap stays Flutter-free (its tests run under `dart test`).
- agentBootstrap merges CLAUDE_CONFIG_DIR BEFORE base, so an explicit
SpawnSpec.env override still wins (override > binding > parent > unset); the
key is omitted entirely when the resolver returns null.
- Orchestrator carries an optional AccountRegistry; the claude extension builds
it from ctx.settings. Null in tests → no injection (unchanged behaviour).
No way to SET a binding yet (that's the CLI T-480 / settings UI T-482), so no
changelog entry — the mechanism is in place, the surface lands next. Unit tests
cover the resolver's four states and the envDelta precedence.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Foundation for the multi-account epic (T-476): a Flutter-free AccountRegistry
over the app-scope SettingsStore (per-user, never committed to a repo).
- `app.claude.accounts` — the {name, dir} account list (dir = CLAUDE_CONFIG_DIR).
- `app.claude.account.<hash>` — per-workspace binding to an account name; the
hash is the SAME FNV-1a 64-bit hex D-70 uses for the socket path, trailing
separators stripped so /repo and /repo/ map alike.
- accountForWorkspace(cwd) resolves an account or null (a binding to a removed
account degrades to null = Claude's default, never errors).
- probeExistingAccountDirs(home): read-only bootstrap probe for adoptable
~/.claude-* config dirs (welcome-view UX is T-481).
Keys are app.-prefixed because SettingsStore requires a scope prefix; app scope
already provides the per-user persistence T-483 wants (T-356 will consolidate
more state later but isn't a hard blocker). No spawn/UI/CLI — downstream
tickets. Unit tests cover CRUD, the disk round-trip, hash/trailing-slash
mapping, independent bindings, and probe filtering.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
`build` ran `flutter build $(FLUTTER_OS)` inline while build-linux/-macos/
-windows ran the same command separately — two places to keep in sync. Make
`build` depend on `build-$(FLUTTER_OS)` so the per-OS target is the single
source of the flutter-build command; `build` just adds the C-client bundling
on top. `make install` → build → build-<os>, and `make build-linux` still
works standalone (release.sh + CI reference it).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Closes the observability half of T-247: a way to find and identify running
clides. `clide instances` scans the runtime socket dir, probes each live
*.sock, and prints its identity (version/pid/workspace/socketPath) as jsonl;
dead sockets are skipped. `clide instance` reports the one you're connected
to. Combined with CLIDE_SOCK honoring (this same ticket), you can now list
instances and pin the CLI to a chosen one.
Server: a new `instance` dispatcher command (registered in buildDispatcher
with the live workspace/pid/socket) returns the identity map; added to the
argv translator's umbrella set so a bare `instance` token routes to it.
Client: a POSIX dir-scan in clide.c (Windows stub until it ships).
Tests: e2e `instances` lists the live test server with its identity; a
cc-free unit test covers the `instance` command shape.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The runtime socket dir accumulated orphaned *.sock nodes from crashed
instances — only the current workspace's own path was ever cleaned. Add a
best-effort startup sweep that probes every *.sock in the dir and unlinks
only the dead ones; live instances (something answers) and unresponsive
nodes (possibly hung) are left alone. Runs before bind, alongside the
existing per-workspace stale-unlink. Never blocks our own startup on a
sweep failure.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The `clide` shell client only ever computed the socket path from the
workspace's FNV-1a hash — it never read CLIDE_SOCK, so the var the app
exports to spawned agents was a no-op and a bogus CLIDE_SOCK was silently
ignored (it still hit the discovered instance). Now: when CLIDE_SOCK is set
the client connects to it directly, beating discovery, and a dead socket
aborts with EX_UNAVAILABLE rather than falling back to a different instance
(the split-brain footgun). Unset → the deterministic per-workspace path
(D-70) as before. The server keeps deterministic binding; this is a
client-side targeting override only.
Also fixes a pre-existing -Wstringop-truncation warning in
find_workspace_root (strncpy+manual-null → snprintf).
Tests: the e2e suite now clears the inherited CLIDE_SOCK so discovery tests
stay hermetic (the suite may run inside a clide instance), plus two new
tests — a valid CLIDE_SOCK pins from a non-git dir, a dead one fails loudly
and returns no data.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
After live review: the shared account /usage budget read as redundant on
both the Activity and Team tabs. Usage is per-account and can't be split per
member, so one place is enough — it lives only on the Activity tab, next to
the refresh control that fetches it (T-415). Removes the Team-tab account
card, its usage prop wiring, the team.section.usage/team.usage.shared i18n
keys, and the now-obsolete team_tab test. The three-tab card facelift stays.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The merged T-476 breakdown reused T-477/T-478 (already held by the
window-size fix + Summer Night theme). Relabel the two per-repo-account
children to T-483/T-484 (identities/record_ids unchanged), preserving the
labels already referenced in CHANGELOG and pushed commits.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Union-resolved the .pql/changelog logs (append-only, idempotent INSERT … ON
CONFLICT DO UPDATE — latest-updated wins on replay), keeping both sides:
this session's T-158 changes and origin's T-476 6-child breakdown. pql.db
rebuilt clean (2785 statements).
NOTE — label collision to reconcile (record_ids intact, labels only):
the breakdown reused T-477 and T-478, already held by the window-size bug
and the Summer Night theme. Reconcile with `pql ticket relabel`.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Implements T-158 option A: the forwarded /usage budget (already parsed for
the Activity tab, T-415) now also renders in the Team tab as a single
ACCOUNT card, captioned "shared across the team". Usage is per-account —
every team session shares one ~/.claude login — so it's shown once, not
split per member (which would just repeat identical numbers).
Facelift: the Activity, Team, and Config tabs now render their sections as
elevated cards (panelHeader fill, dividerColor hairline, 6px radius) under
small-caps mono headers, matching the settings overlay's card design
(settings_category_view). Shared helpers — metaSectionHeader / metaCard /
metaCardRow — live in meta_sidebar/models.dart; the SESSION control strip
and the pinned Config SETTINGS block adopt the same card. The shared
ClideAccordion (also used by decisions/tickets) is left untouched.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Locks scope to the single account-wide budget section in the team tab; declines
the per-member split (not meaningful under one shared account) and the
close-as-done option. Not started.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Grounded against the current tree: T-415 already ships the account budget
(parseUsageText/ClaudeUsage + Activity tab). Key finding — usage is
per-ACCOUNT (one shared ~/.claude login across all sessions), so a literal
per-member split would repeat identical numbers and isn't meaningful even
under T-476 (per-repo, not per-session, login). Refinement recommends a
single shared-account section in the team tab (resolves Q-34), lists the
exact files to touch, alternatives, and acceptance. No code yet.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The "Cutting a release" ritual moved the changelog and bumped pubspec but
never mentioned tagging — which is how tags silently lapsed from v2.2.0
through v2.8.0. Add step 6: run `make release` (verify + gate + annotated
tag), then push with --follow-tags, and state the rule that every released
version must have a matching git tag.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The fast-path regex matched only `^(lib/|pubspec\.)`, so a push that ONLY
changed a test, a ci/ gate script, or the pre-push hook itself skipped the
entire ~2min suite — exactly the paths most able to break the suite or the
gate went unchecked. Widen the trigger to include test/, ci/, and
.githooks/, and extract it to a single `trigger_re` variable. Also drop the
header comment's false claim that "release CI runs it forced on a tagged
version" — there is no release CI.
Add test/tooling/pre_push_hook_test.dart: it reads the live trigger_re from
the hook and asserts the load-bearing dirs force the full gate while
docs/assets ride along — so the regex can't be silently narrowed again.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ci/release.sh was a stub that printed a goreleaser/sidecar TODO and
exited 64 — both the sidecar and goreleaser are dissolved (D-56), so it
could never run. Replace it with a finalizer for the single-process app:
read the version from pubspec, assert CHANGELOG has a dated section for it
and the tree is clean, run the full gate (make push-check), then create
the annotated vX.Y.Z tag if missing. Never pushes — prints the
--follow-tags push + build commands. Add a `make release` wrapper so it's
driven through the Makefile like the other gates (CLAUDE.md tooling rule).
This closes the loop that left releases untagged: running `make release`
after the release commit can no longer forget the tag.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The bundled-theme list and the Tier-0 i18n namespace list were each
hand-maintained in 3+ places that had drifted: the testmode harness loaded
8 themes (catppuccin silently unvalidated) while the app and contrast gate
loaded 10, and the i18n gate checked 4 of the shipped namespaces. Export
one canonical const each — kBundledThemePaths and kTier0Namespaces — and
have the app, the testmode harness, and the a11y gates iterate them.
Drift-proof meta-assertions:
- contrast gate fails if any theme YAML on disk is absent from
kBundledThemePaths (so a theme can't sit unvalidated).
- i18n gate derives its subjects from assets/i18n/en_us/ at test time and
asserts en/nl key parity for every shipped catalog (26, was 4), plus that
every kTier0Namespaces entry has a shipped catalog.
Surfaced summer-night.yaml: a legacy-ported palette on disk, unbundled and
never contrast-checked. Per the maintainer's call, ship it: flesh the
palette to full token + syntax coverage (honouring the v1.2 colours, clide
derivation pattern for the new keys) and add a structurally identical
summer-night-hc sibling that clears the strict extended gate. Both pass.
No licenses.yaml change: summer-night is clide's own (ported from legacy
clide v1.2 under legacy/, MIT); the only third-party palette, Catppuccin,
is already acknowledged; no fonts added.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
EditorRegistry.close() guarded its active-changed emit on `_activeId !=
null`, so closing the LAST buffer (active clears to null) emitted only
editor.closed — never the active-changed(id:null) the editor extension
listens for to call closeEditor(). editorOpen stayed true and the top
split sat orphaned over the Claude pane. Always emit active-changed when
the active buffer is removed, including the cleared-to-null case; the
slot renderer already collapses correctly once editorOpen flips false.
The existing extension test fabricated the null active-changed event, so
it passed despite the registry never emitting it — that gap is why the
bug shipped. Add a registry test that drives the real close() path, plus
a slot_host widget test asserting the split (drag handle) drops out and
the primary pane fills the column.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
At the 720p default the vertically-centred welcome content slid under the
floating version/theme status line (Positioned bottom:24), overlapping the
tips card. The taller default gives the centred block clear bottom margin
and matches the macOS default size.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Completes i18n coverage of the conversation surface — the strings the
T-464 migration left as "decorative" English:
- running-indicator verbs (Pondering/Conjuring/… → catalog, Dutch added)
- pane chrome title (primary / secondary N) and banner role
- tool-card titles (Edit → Bewerken) via a tool.name.* key set, with
command/proper-name tools (Bash, Grep, Glob, LS) falling back to the
raw name
- collapser step/edit/agent counters
- the folded-activity ticker (result/error/thinking/image + tool name)
English degrades to the placeholder where a key is absent, so untranslated
or MCP tool names render unchanged. en_us and nl_nl stay at key parity.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The i18n epic (T-462): every user-facing label — panels, dialogs, command
palette, menus, settings, framework chrome — now resolves through the i18n
catalog instead of a hardcoded string. Catalogs are bundled per locale under
assets/i18n/<locale>/<namespace>.json. Adds a live UI-language selector
(Settings → Appearance → Language) and a full Dutch (nl-NL) pack; English
stays the default. Architecture in D-102.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Tests for the epic's new code so the 95% floor holds: ClideSettings.i18n
string/interpolated null-safe + localizedCommandTitle; settings-renderer
localization (section/field/help/select/file, project-scope tag, didUpdateWidget);
extension-activation rollback + settings-contribution unregister; the Dutch
gate check; RootShell applying app.locale on boot; and prompt/conversation
tool-body + file-ref coverage. Also harden the menu toggle re-tap (capture the
button point while stable, then tapAt) so it no longer throws getCenter under
the serial coverage load.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
A full nl_NL catalog set under assets/i18n/nl_nl/ — all 26 namespaces, key-for-
key parity with en_us. Proper nouns (clide, Claude, Git, font names) and the
Vim mode names stay as-is; everything else is translated. Selectable via
Settings → Appearance → Language. The a11y i18n gate now also asserts the
Dutch pack covers every Tier-0 key, so a locale switch never falls back to
English for a built-in label.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Make the localization usable: an app.locale select (English / Nederlands) in
the Appearance category, applied live by root_shell — it parses app.locale and
calls i18n.setLocale on boot + on settings change (setLocale is a no-op when
unchanged). nl_NL registered in availableLocales. The ui-design skill now
documents the locale-dir config and the rule to design for string-length
variation (translations run ~20% longer; never hard-size to the English label).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Document the T-462 i18n architecture: ext-id namespaces auto-loaded on
activation, a 'core' catalog for framework chrome, the null-safe
ClideSettings.i18n read facade, contribution titleKey/labelKey fields, and the
assets/i18n/<locale>/<namespace>.json locale-dir layout. Add the "route
user-facing strings through the catalog" rule to the ui-design skill.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Move the catalogs out of lib/kernel/src/i18n/catalog/ into assets/i18n/, and
switch the layout from a `{namespace}_{locale}.json` filename to a per-locale
DIRECTORY: assets/i18n/en_us/{namespace}.json. Adding a language is now just a
new folder (assets/i18n/nl_nl/, nl_be, en_eu, …) of the same namespace files —
no renames — which is cleaner to maintain and mirrors how an external
extension ships its own catalog. AssetCatalogLoader/FileCatalogLoader resolve
`<root>/<locale>/<namespace>.json`; pubspec bundles the locale folder.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Apply the manifest-i18n foundation across every extension: each
CommandContribution (45, command-palette + menu) gains titleKey + i18nNamespace,
and each SettingsCategory/section/field/option gains its key — with the English
text added to the owning extension's catalog. The settings renderer
(settings_category_view + settings_modal) threads the category's i18nNamespace
down and resolves every label/help/option through it; new catalogs created for
view, cli-install, keybindings-ui. No en_US behaviour change — the command
palette, menus, and settings panel now localize from the catalog (D-21).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Lets manifest labels (command-palette/menu titles, settings labels) localize,
not just displayed widget strings. Adds optional titleKey/i18nNamespace to
CommandContribution and labelKey/helpKey/titleKey + a category i18nNamespace to
the settings schema. The command palette and menu bar now resolve titles via a
shared localizedCommandTitle helper — and the palette's fuzzy search matches
the localized title too (PaletteController.titleResolver). No behaviour change
until the per-extension keys + catalog entries land (placeholder == English).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Framework strings outside any extension — widget primitives (collapser, toast,
lightbox, multitab, ex-line, spine, pane chrome), the shared reader chrome, the
markdown 'Open in editor' tooltip, and the drag-resize handle a11y labels — now
resolve under a new 'core' namespace (preloaded at boot). Settles the T-469
namespace question: framework chrome gets one 'core' catalog.
Makes ClideSettings.i18n.string/.interpolated null-safe (ClideKernel.maybeOf):
primitives render kernel-less in isolated tests, returning the placeholder —
matching the D-101 fallback contract for fonts. The markdown tooltip threads
via the ClideMarkdownHooks carrier like mono/ui; drag_resize reads the kernel
i18n directly to avoid a kernel→widgets layering inversion. No en_US change.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The "tapping the same top button toggles closed" case re-tapped File before
the open overlay finished laying out, so getCenter intermittently threw on a
not-yet-positioned hit box under load. Settle first.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Migrate the user-facing strings in menubar, output, search, deeplink, editor,
files, terminal, markdown, and vim to ClideSettings.i18n.string/.interpolated;
extend the existing catalogs and create the missing ones (deeplink, output,
search, markdown, menubar, vim). vim mode labels now resolve through
builtin.vim (default still `-- NORMAL --`, now localizable). A dock-status test
seeds builtin.output so the widget's own i18n lookups resolve instead of
warning into the logRing it counts. No en_US behaviour change (D-21).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Migrate the user-facing strings in builtin.tickets, builtin.pql,
builtin.decisions, and builtin.problems (list/detail views, section headers,
filters, empty/loading/error states, type chips) to ClideSettings.i18n; extend
each extension's catalog. The detail/links tabs that had a bare title now wire
titleKey + i18nNamespace so the tab title resolves too. Context threaded into
the static label helpers. No en_US behaviour change (D-21).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Migrate the user-facing strings in builtin.git (panel, status groups, commit
bar, branch picker, discard dialog, row a11y) and builtin.diff (toolbar,
empty states, file meta) to ClideSettings.i18n.string/.interpolated; extend
both catalogs. _stateLabel threaded a BuildContext from its caller. No en_US
behaviour change (D-21).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Migrate the hardcoded user-facing strings across builtin.claude — composer,
conversation cards/segments, permission + AskUserQuestion prompts, task dock,
meta-sidebar (activity/config/team/roster), session/model pickers — to
ClideSettings.i18n.string/.interpolated, English kept as the placeholder;
builtin.claude_en_us.json extended to cover them. Context threaded into the
context-free render helpers (toolInputBody chain, _ConversationTurn) the same
way the mono family already is. No en_US behaviour change (D-21).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ClideSettings.i18n.interpolated takes I18nReplacer, but the type didn't travel
with the facade — every templated-lookup call site had to separately import it
from the kernel. Re-export it from clide_settings so it ships via the widgets
barrel alongside ClideSettings; the interpolated API is now self-contained.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Migrate the ~25 hardcoded user-facing strings in builtin.welcome (section
headers, tips, action + status lines, both dialogs) to
ClideSettings.i18n.string(...), keeping the English as the placeholder; extend
builtin.welcome_en_us.json to cover them. The _tips const widened to carry
(key, English, glyph) so the labels resolve at render. No en_US behaviour
change — strings now resolve through the catalog so they can be localized
(D-21).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
theme-picker referenced section.appearance + toggle.highContrast with no
catalog entries (silently fell to the placeholder); add both. builtin.diff
contributes a localized tab but shipped no catalog file at all; create it with
tab.title. Both namespaces now resolve from the catalog.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Foundation for routing hardcoded UI labels through the catalog (D-21). Two
enablers:
- ExtensionManager now eagerly loads each activated extension's own-id catalog
namespace, not just the namespaces of localized tabs. An extension's id IS
its catalog namespace (ClideExtension.t), so labels resolve through the
catalog even for extensions that contribute no tab; a missing catalog file
loads as an empty map, so it's harmless.
- ClideSettings.i18n gains string()/interpolated() lookups so widget call
sites route through the one D-101 facade (like theme/fonts) instead of each
re-deriving ClideKernel.of(context).i18n.
No user-visible change yet — placeholders equal the en_US catalog values; the
per-extension label migrations follow.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Patch on 2.7.0: Josefin Sans is the default UI font again (Inter stays
selectable), and Claude's markdown-rendered prose + links now honour the
live UI-font setting instead of pinning the bundled default (T-475).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Reverts the Inter default introduced in 2.7.0 — Josefin Sans (Light, w300) is
the default UI face again. Inter stays bundled and selectable in Settings →
Appearance; JetBrains Mono remains the default monospace with Fira Mono
selectable. Flips clideUiFamily/default weight, the picker's default + option
order, and the licenses.yaml purpose notes.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The markdown span builders are context-free statics, so they pinned the
bundled clideUiFamily const and ignored the Appearance UI-font setting —
Claude's conversation prose stayed on the default face regardless of the
pick. Thread the resolved UI family through the same ClideMarkdownHooks
carrier already used for mono (T-472): build() resolves it from context and
every prose/link span reads hooks.ui. Adds a regression test asserting prose
and inline code follow the families from the ClideSettingsScope.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Settings panel epic: schema-driven settings engine (modal shell, category
rail, per-field scope tags, cross-category search) with Activity, Keymap,
Appearance, Extensions, and Claude categories; Inter as the default UI font
plus live UI + monospace font pickers (Inter, Fira Mono bundled). Backed by
the ClideSettings facade (D-101) unifying theme, i18n, and fonts behind one
widget-facing read entry, with consumer reads migrated onto it.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The "persists project.theme into that repo" case asserted the .clide
settings file existed after a single pumpEventQueue, but the write is
fire-and-forget real I/O — one event-queue drain doesn't guarantee the disk
flush, so it flaked in the loaded coverage pool. Poll for the file (bounded)
instead.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Exercise the previously-untested branches of the settings category renderer:
number-field commit/clamp/unparseable-revert, text-field commit, the file
control's command button, the select raw-value fallback, scope move-to-app,
field help text, and the cross-category search empty state. Restores the
coverage floor after the D-101 facade migration shifted the ratio.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The breadcrumb unit test (T-434) pulled package:flutter_test, which imports
dart:ui — unavailable under plain `dart test`. That broke the flutter-free
core batch (ci/test_core.sh) for every file compiled after it. It uses only
package:test APIs, so the import was simply wrong; siblings already use
package:test.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Migrate ClideTheme.of(context) reads across the widget, feature, and shell
layers to the unified ClideSettings.theme.of(context) facade (D-101), so
theme/i18n/fonts/settings share one widget-facing entry. The facade delegates
straight to ClideTheme, so behaviour is unchanged — goldens are unmoved.
The low-level theme provider keeps its direct ClideTheme.of: the facade is
built on it, and the two kernel sites (ClideTheme's own definition + the
panels drag-resize widget) stay direct to avoid a widgets→kernel import cycle.
Dead controller.dart/kernel.dart imports left by the sweep removed.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Migrate widget i18n reads from ClideKernel.of(context).i18n to the unified
ClideSettings.i18n.of(context) facade (D-101), so settings/theme/fonts/i18n
share one widget-facing entry point. The facade delegates to the same I18n
service, so behaviour is unchanged. Infra plumbing (KernelServices /
ExtensionManager fields, the slot-host Listenable.merge) keeps its direct
kernel reference.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Eleven leaf sites rendered monospace text from top-level/static helpers that
take no BuildContext, so they hard-coded clideMonoFamily and ignored the
Settings → Appearance Monospace choice that the D-101 facade made live
everywhere else.
Thread the resolved family in from the nearest context-bearing caller:
- claude tool bodies/results: a required `mono` field on _ConversationTurn +
a `mono` arg on the shared toolInputBody chain;
- markdown inline `code`/record/file-ref spans: carried on ClideMarkdownHooks,
which build() already constructs from context and threads to every static;
- search preview styles and welcome tips: a `mono` parameter on the helpers.
No behaviour change when the setting is default; these surfaces now switch
live with the rest.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Settings → Appearance gains a Monospace font select (JetBrains Mono / Fira
Mono) on the schema engine, writing app.mono.font. It applies live: root_shell
resolves the family into the ClideSettingsScope (D-101) and rebuilds on the
settings change, so the ~93 migrated mono sites — terminal, diffs, code, IDs —
re-read the new family at once.
Vendor Fira Mono (Regular + Bold, OFL) under assets/fonts/fira_mono/ with the
pubspec font family + licenses.yaml entry per D-42; JetBrains Mono stays the
default.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Introduce ClideSettings, a single widget-facing facade for the app's live
user preferences, namespaced by concern: ClideSettings.fonts.monoOf(context)
/ .fonts.uiOf(context), ClideSettings.theme.of(context),
ClideSettings.i18n.of(context). "Plumb once, use many."
Fonts are carried by a new root-provided ClideSettingsScope (resolved from the
font settings in root_shell, rebuilt on change); theme and i18n delegate to
their existing live providers (ClideTheme / the I18n service) so there's one
source of truth and their many consumers migrate incrementally rather than in
a big-bang. Reads outside a scope fall back to the bundled font defaults, so a
widget renders without a provider (isolated tests).
Migrate ~93 monospace-font call sites across 33 files from the clideMonoFamily
const to ClideSettings.fonts.monoOf(context) — pure refactor, identical family
when no override is set. 11 context-less helper sites (markdown static spans,
a few top-level/static builders) keep the const for now and are tracked in
T-472. Records D-101; updates the ui-design skill's font-family rule.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Vendor Inter (variable + italic, OFL) under assets/fonts/inter/ and make it
the default application UI face, replacing Josefin Sans (which stays bundled
as a selectable option). pubspec font family + licenses.yaml entry per D-42.
Settings → Appearance gains a UI-font select (Inter / Josefin Sans). The root
DefaultTextStyle reads app.ui.font (kUiFontSettingKey) over the default and
re-applies live on settings change, so a pick takes effect immediately. Bump
the default UI weight to w400 — Inter reads better at Regular than Josefin's
Light.
The monospace picker is deferred to T-471: clideMonoFamily is a const at ~38
call sites (not inherited), so a live mono picker needs the family routed
through context first.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
A Settings → Claude category sets per-user defaults for NEW sessions: model,
effort, and permission mode (generic schema selects persisting
app.claude.default*). The pane reads them at spawn — effort flows through the
existing --effort flag (SpawnSpec.effort); model and permission mode are sent
as control requests right after a fresh (non-resume, non-fork) session starts.
'default'/unset values are no-ops, leaving the CLI's own defaults.
The optional "settings changed — apply to current sessions?" prompt is filed
as T-470: it needs a custom control (a generic select can't prompt), so it's
a clean follow-up on the T-452 escape hatch.
Tests: defaultEffortFlag sentinel handling; the category contributes the three
default fields. The thin pane-side applySessionDefaults is covered by the gate.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Reflow lines `dart format` collapses — the T-451/T-452 test additions were
committed before `make format` ran, so the committed copies were unformatted.
No behavior change; keeps the push format gate green.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Built-in extensions are always on and there's no third-party install path yet,
so the Extensions tab is a notice rather than a toggle list — a toggle list
would let users brick the app by disabling load-bearing builtins. It explains
that installing/enabling/disabling arrives with third-party (Lua) extensions
and points at the records that pick it up (D-16 / T-8).
Fleshes out the builtin.extensions-ui stub via the custom-control hatch. Adds
two renderer guards — empty section/field labels render no chrome — so a
notice-only category shows just its card.
Tests: contributes the Extensions category + notice control; the notice renders.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add the one bespoke control the schema engine defers to. New
SettingsControlContribution routes a WidgetBuilder into a kernel
SettingsControlRegistry under a customId; a SettingsFieldKind.custom field
names that id, and the renderer draws the registered widget full-width
(label on top, no scope tag — the control owns its own apply + scope).
The theme-picker extension uses it: an Appearance category whose theme field
is custom, backed by AppearanceThemeControl — base-theme chips + a
high-contrast toggle that apply live through ThemeController (persisted by
theme_persistence). Reuses the shared theme_families helpers.
Tests: control registry (register/dup/unregister), the renderer's custom-field
path, and the Appearance contribution + live theme apply.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The keybindings-ui extension contributes a Keymap SettingsCategory: a preset
select (Default / Vim / VS Code / JetBrains) reading the active preset from
kKeymapPresetSetting. Picking one routes through a new schema affordance —
SettingsField.applyCommandPrefix — running `keymap.preset.<value>`, which calls
KeymapService.setPreset to persist and reload the layered keymap live. The
prefix path keeps the engine generic: settings a subsystem applies via a
command (rather than a bare key write) declare the prefix; the scope tag and
current-value read still use the key.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Deny Bash(git add -A*), Bash(git add --all*), and Bash(git add .) so the
bulk-stage forms can't run; deny overrides the existing git add * allow. The
git-commit skill mandates specific-path staging, and a shared working tree
makes -A actively dangerous (it sweeps another agent's files into the commit).
Exact-match the bare dot rather than git add .* so git add .gitignore and
other dotfile paths still work.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The first real settings tab. The Claude extension contributes an Activity
SettingsCategory whose fold-level select binds to app.claude.activityFoldLevel;
the activity panes already rebuild off the settings notifier, so a pick applies
live. Proves the schema-driven engine end to end with a production setting —
opening Settings now shows a populated, working category.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
A concurrent session's `git add -A` swept this turn's uncommitted doc
edits into unrelated feat(settings) commits (f56ad88, f643d6e). Add an
explicit-staging guardrail to the Git workflow section and route all
commits through the git-commit skill.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
A search box (ClideFilterBox) atop the rail filters fields across every
registered category. While searching, the panel swaps to a results view that
groups the matching fields under category subheaders — rendered with the same
carded rows and editable inline — and each rail row shows its match count with
zero-match categories dimmed. Completes the settings-UI infra spine (T-444):
shell, engine, rail, scope tags, search.
Tests: search filters across categories, hides non-matches, and surfaces the
per-category rail count.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Each settings field gains a scope tag showing where its value lives — folder
= Project (.clide), globe = Always (~/.clide), circle-dashed = Default/unset —
colour-coded (statusSuccess / statusWarning / muted) with a tooltip. Tapping
opens a menu to move the value between the scopes the key supports, or reset
to default; the tag's menu replaces the interim reset button.
Backs it with scope-explicit SettingsStore access — rawAt / setAt / removeAt /
effectiveLayer / writableLayers — over the two storage files (app ~/.clide,
project .clide). ext.* keys layer project-over-app; app.*/project.* keys live
only in their prefix's file, so their menu offers that one scope + reset.
Tests: store scope ops (layering, reload, guards) and the tag (Default vs
All-clide rendering, menu reset).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The settings modal's left rail now lists the registered categories (icon +
title, data-driven from the SettingsRegistry) with an accent left-stripe +
surfaceHi selection per ui-design surface.md. Selecting a category drives the
modal's selection state and swaps the right panel; the rail scrolls when the
set exceeds the height. The cross-category search box atop the rail lands in
T-450.
Tests: rail lists categories and selecting one swaps the panel.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The core of the settings panel (epic T-444). Subsystems describe a category
as data — a SettingsCategory of carded SettingsSections of SettingsFields
(toggle / select / text / number / opens-external-file), each bound to a
SettingsStore key with help text, a default, and reset-to-default.
Registration is declarative: a new SettingsCategoryContribution carries the
category; the extension manager routes it into a new kernel SettingsRegistry
(exposed on KernelServices), which the panel reads via ClideKernel. Adding a
category is now pure data + a contribution — no widget code.
SettingsCategoryView renders a category into carded sections per ui-design
surface.md: panelHeader card fill, dividerColor border, inputs receding to
panelBackground; select reuses the anchored-overlay menu, text/number commit
on Enter or blur (numeric clamps to bounds). The modal panel now shows the
selected/first registered category, falling back to the empty state.
Tests: registry (sort / dedup / notify), contribution routing on activation,
renderer (render + toggle/select write-through + reset), modal-with-category.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Lay the foundation for the schema-driven settings UI (epic T-444). A new
`settings.open` command (⌘`,`, plus a File-menu and command-palette entry)
opens a centered Settings modal over the dimmed app via the dialog router,
built from the modalSurface* tokens (D-7, no Material). The shell frames the
two regions later tickets fill in — the category rail (T-447) and the
scrolling carded panel (T-448) — and dismisses on ✕, Esc, or barrier tap.
With no category registered yet it shows its empty state, which is the
correct runtime state.
Flesh out the `builtin.settings-ui` stub (was 0.0.0-stub) into a real
extension; ship its en-US i18n catalog. Relabel the theme picker's
`theme.pick` command title from "Settings…" to "Theme…" so the two no
longer collide in the palette (the picker folds into the new panel's
Appearance category in T-452).
Tests: command + ⌘`,` binding registered, shell renders, Esc and close
both dismiss.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Flag API-error conversation cards with a red statusError border (the card
already has an error status + bordered variant; just needs wiring). UI
tracker T-276.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
UI + monospace font pickers in the Appearance settings tab; bundle Inter
(SIL OFL) as the default UI font. Child of the settings-UI epic T-444,
renders alongside the theme picker (T-452).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
self.version is auto-synced from pubspec by make gen-build-info; pubspec
is already at 2.6.0 but the generated value had lagged at 2.5.0. Commit
the regenerated file so the working tree matches.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Both filed under the T-276 UI epic.
T-458: the editor records neither the original EOL style nor the
trailing-newline state when it reads a file (registry.dart), and only
normalizes on save when .editorconfig asks. Any layer that rewrites
newlines therefore produces cross-platform commit churn with no
.gitattributes backstop. Ticket captures the record-on-read /
preserve-on-save / gitattributes plan.
T-459: closing the last editor panel in the main column's top split
does not collapse it. Suspect the asymmetric top/bottom split logic in
slot_host.dart and closeEditor() not moving the active tab off
editor.active. Root cause not yet confirmed.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bump pubspec 2.5.0 -> 2.6.0 and move the Unreleased entries under a dated
2.6.0 heading. Minor (not patch) — the cut includes new features (vim
ex-line + gt/gT, crash-survivable logging, watchdog) alongside the fixes.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The push race created two T-440s: the remote tree-sitter.dll task and our
local Playwright-e2e follow-up. Kept the already-shared remote one as T-440;
renumbered our local one to T-443 via pql ticket relabel (record_id stable).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Closes out the T-403 cross-pane vim layer. gt/gT bind to the existing
workspace.tab.next/previous commands (also on ctrl+pagedown/up for every
preset), resolved by the focused editor's matcher or a pane's PaneKeyNav —
bare-g sequences stay editor/pane-local (T-404's global matcher only engages
on modified-chord prefixes), so no global-matcher surgery.
- vim.yaml: g t -> command:workspace.tab.next, g shift+t -> .previous
(vim.normal); shares the `g` prefix with `g g` (docStart / nav.top),
distinguished by the final chord.
- PaneKeyNav now EXECUTES non-editor.vim.* command intents (e.g.
workspace.tab.*) instead of swallowing all command intents, so gt/gT work
from a focused pane; editor.vim.* buffer edits stay blocked in panes.
Tests: vim-preset resolution (gt/gT bind, gg intact), PaneKeyNav executes
the command from a pane, and editor.vim.* is never run from a pane. make
test green; analyze + format clean.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
User opted to skip the live GUI review; improvement tickets will be filed
if anything needs polish. Completes all built children of T-403; only
T-405 part 2 (gt/gT) remains.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Under the Vim preset, `:` opens a transient one-line ex overlay running a
fixed v1 table; ZZ runs :wq directly. Completes the last built child of the
T-403 cross-pane vim layer (T-405 part 2 gt/gT still open).
- ExLineController + parseExCommand grammar + editor-targeted executors
(lib/kernel/src/ex_line.dart); the overlay (lib/widgets/src/ex_line_overlay
.dart) reuses the quick-open chrome, mounts in the root_shell Stack, and
publishes the exline.open scope flag. Unknown commands flash + stay open;
with no active buffer every command no-ops (2026-06-13 decision).
- :q closes the active tab via editor.close on its id — the registry promotes
the next buffer and the split self-collapses on the last (2026-06-12
decision); :w/:wq/:x/ZZ save (+close) the active buffer.
- :e <path> seeds quick-open (new QuickOpenController.open(seed:)); :N adds the
editor.goto-line IPC/CLI verb (reuses _offsetForLine). Goto needs caret sync:
EditorController now handles editor.selection-changed and the editor view
moves the caret on a selection-only change.
- `:` and ZZ are typed intents; the editor matcher and PaneKeyNav now bubble
unhandled typed intents to the app-root Actions, so they fire from any focus.
vim.yaml binds `:`, ZZ (shift+z shift+z), and Esc-dismiss.
Tests: parser/controller/executors, editor.goto-line daemon tests,
selection-changed (controller + view), full overlay widget test. make test
green; analyze + format clean.
Also files T-441 (drop bold from the ticket-id card label) and T-442
(sub-agent renders as 3 cards instead of one bundle) under the T-276 UI epic.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Acceptance gap confirmed closed: a make-install build launched from the
Linux application menu (not a terminal) resolves the login-shell PATH —
pql/git/claude/PTY children find user-installed tools. macOS Homebrew
path remains code-correct; a separate bug will be filed if it surfaces.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Live-confirmed on CLI 2.1.177: /clear clears the primary pane to an
empty conversation without exiting code 1. The await-death teardown fix
(081678e) holds in the running app.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Desktop/dock-launched clide inherits a sparse PATH (no ~/.local/bin, brew,
nvm, …), so pql/git/claude and PTY tools went missing. T-347 fixed only the
toolchain/pql path on Linux; env.dart's expander was still macOS-only and
claude/PTY/git used the raw PATH — the breakage recurred per spawn site
because there were three divergent expanders.
Consolidate into one resolver (lib/src/env/shell_env.dart):
- primeLoginShellPath(): probe the user's real login shell once at startup
(`$SHELL -l -c`, sentinel-framed, bounded timeout, graceful fallback to the
process PATH). Captures the user's actual PATH, not a hardcoded guess.
- expandToolPath(): the canonical merge (moved from toolchain_paths, which
re-exports it for its tests) — unions the well-known user/local bin dirs.
- resolvedToolPath(): currentSearchPath() + expandToolPath, the single call
every spawn site uses.
Routed through it: PTY children (registry.dart now overrides PATH), git
(env.dart → operations.dart), the toolchain probe (toolchain_paths), and
hosted claude (agent_bootstrap). Primed in main.dart's !kIsWeb boot. Deleted
the macOS-only env.dart copy and the cli_install copy.
Tests: new shell_env_test (probe + every fallback + merge); env_test and
cli_install_test updated to the consolidated surface. analyze clean, web wasm
build still green, make test green.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
`flutter build web --wasm` had been broken since the tree-sitter/PTY dart:ffi
pivot. Per D-100 (resolving Q-50: keep the web "happy accident" alive), every
native binding now sits behind a `dart.library.ffi` conditional import with a
graceful web stub. Desktop builds are unchanged — no fidelity loss; the web
target degrades (no terminal, native git, or syntax highlighting).
Discriminator is `dart.library.ffi`, not `dart.library.io` — dart2wasm provides
dart:io, so FFI is the only blocker.
Fences:
- PTY: pty_session → pty_backend_io / pty_backend_web (stub throws).
- tree-sitter: pure types → syntax_result.dart; tree_sitter_service is now a
facade over _ffi/_stub; tree_sitter_boot_io/stub fences TreeSitterLib.init().
- watchdog: watchdog_windows_stub (all -1 sampler).
- claude ABI probe: native_abi_io/stub (was `dart:ffi show Abi`).
- testmode fd-check: fd_check_io/stub.
Also dart2js-safe: the 64-bit FNV literals in session_naming.dart + paths.dart
(the dual JS fallback rejected them) — split into 32-bit halves, dropped a
no-op 64-bit mask. Desktop/wasm hash values unchanged.
CI: added a `web-wasm` job (flutter build web --wasm) so the fence can't rot.
Two FFI-constructing tree-sitter tests import _ffi.dart directly (the analyzer
resolves the conditional facade to the stub branch).
Verified: `flutter build web --wasm` → built; `flutter analyze` clean;
`make test` green. Full Playwright e2e harness wiring is the tracked follow-on.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Regenerated governance/README.md index (pql decisions sync): D-32
retitled, D-100 added, Q-50 moved to Resolved. Belongs with 4bba2ef.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- D-32 amended: Gitea-primary/not-activated → GitHub Actions, active
(Linux test + Windows ConPTY/soak + release; web-WASM e2e withheld).
The staged Gitea pipeline was never activated and is gone.
- Q-50 resolved → D-100: FENCE the web/WASM target. Every dart:ffi
importer goes behind a conditional-import facade with a web stub so
`flutter build web --wasm` compiles; desktop fidelity untouched. Keeps
the web "happy accident" alive as a hopeful future target per user.
- T-438 filed for the fence implementation (12 ffi importers + CI wasm
compile gate + re-enable e2e/ui targets).
- T-384 closed (done): Gitea premise OBE, scripts repointed (2026-06-12),
D-32 reconciled; the dead e2e targets delegated to T-438.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
/clear tore the session down and respawned on the same deterministic
--session-id BEFORE the old claude process had actually exited. The
orchestrator's close() ran conversation.dispose() unawaited and kill()
only sent SIGTERM without awaiting exitCode, so the respawn raced a
still-alive holder of the id — claude 2.1.177 rejects it as "Session ID
… is already in use" and exits 1.
Root cause confirmed from clide's own crash log + isolated probes against
2.1.177: the id frees the instant the holder dies (SIGTERM cleans the new
~/.claude/sessions/<pid>.json registry), so awaiting real death is the
fix — and it preserves T-268's deterministic-id continuity (chosen over
minting a fresh id, which would change the continuity model).
- stream_json_session: kill() awaits exitCode (SIGTERM → 2s → SIGKILL →
await); dispose() idempotent (shared cached future); new
SessionEnd.reason getter (last non-empty stderr line, capped).
- session_orchestrator: close() awaits session.dispose() so teardown
returns only once the process is truly dead, before clear + respawn.
- claude_pane: surface end.reason in the status line — no more opaque
"code 1".
- session_naming: correct the stale clearSessionTranscript doc (real
sidecar is the shared memory/ dir) + the await-death precondition.
- tests: close() blocks until process exit; SessionEnd.reason.
CLI 2.1.177 re-probe (folded-in scope): sessions/ registry characterized
(PID-keyed, cleaned on exit); init cache auto-refreshes; advertised
slash_commands show no routing-table drift. No further code change needed.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The init-cache/routing-table refresh and sessions/ registry
characterization are now explicit deliverables of T-437, not a
separate follow-up, with updated acceptance criteria.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Regression of T-268's /clear mechanism. /clear deletes the transcript and
respawns with the same deterministic --session-id, but claude 2.1.177 now
tracks session ids in ~/.claude/sessions/<pid>.json (+history.jsonl) beyond
the per-project transcript clide purges, so the id reads as in-use and
claude exits 1 at startup validation. Codebase only probed <=2.1.175.
Hypothesis is strong but unconfirmed: the pane shows an opaque "code 1" and
swallows claude's stderr — capturing it is fix step 1. Filed high with
ranked fixes (mint fresh id on clear; or clean the registry; surface stderr).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
T-425 had a pre-existing breakdown (T-426-430) I didn't check for and
re-filed as T-432-436, which is what got implemented. Cancelled T-426-430 as
duplicates (each notes its implemented twin) and closed the epic — the
crash-survivable logging / observability work is complete.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The boot-time toggle (CLIDE_LOG / app.log.level) existed; this makes it
adjustable at runtime, from the two surfaces that fit — D-6 parity — and NOT a
Claude-composer slash command (log verbosity isn't a Claude-session concept).
- Output dock Level chip: was a view-only filter; now also drives the kernel
Logger.minLevel and persists app.log.level, so the choice is real (changes
what's captured) and survives restart. Initialized from the logger's current
level so it reflects a CLI change. A null callback keeps it a pure view
filter (tests / no kernel).
- `clide log level [<level>]` (lib/src/daemon/log_commands.dart): no arg reports
the level + vocabulary; a valid level sets the live logger and persists;
unknown → bad_arg (code 64), logger untouched. Wired in buildDispatcher with
the kernel logger + settings (captured post-boot).
Tested: the command (get/set/case-insensitive/bad-arg, live + persist) and the
controller (initial level, callback fires, same-level no-op, filter-only when
unwired). Coverage gate 95.05%.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The T-436 soak run came back green but produced no conpty-kill-crumbs artifact:
IsolateCrumbFile opened its append handle without creating the parent dir, and
the standalone orphan probe points it at a fresh CLIDE_LOG_DIR that nothing
else had made — so openSync failed, the crumb file was disabled, and no crumbs
were written. In the app this was masked because FileLogSink already creates
logDirectory() at boot. Create the parent ourselves (no-op when it exists).
Verified by the bundle-smoke artifact, which DID capture a real watchdog sample
(threads=31, handles=25, rssMB=175) because the release app makes the dir.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
