Records D-83 answering Gap 5 of docs/self-analysis.md: clide commits to
both "Claude inside clide" models, with the clide-HOSTED stream-json
session (D-77/D-78) as the PRIMARY dogfood target — the process clide
spawns, hence the one Epic B (T-214) bootstraps (CLIDE_SOCK/CLIDE_WORKSPACE
+ PATH + context note + Bash(clide *) allow rule). The EXTERNAL CLI driver
(D-68) stays a first-class but SECONDARY, best-effort integration: manual
install (T-212), no promise to observe its non-clide tool use.
Scopes the D-6 parity contract (Epic C / T-218) to clide's own surfaces
reflected through the CLI in both directions; an external agent's
side-channel reads/tests/git are explicitly out of parity scope.
Closes T-224 (under T-208 "Give Claude hands").
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Documents the decision behind T-205: keymap sequences are space-
separated (list still alternates, + still joins a chord), repeat counts
apply by firing N times, and sequence matching is a reusable stateless
query + stateful matcher consumed at the interception point — because
the global KeyboardListener can't swallow events, so the editor's
Focus.onKeyEvent (T-206) is where normal-mode keys get consumed.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Documents why the markdown/decisions readers load from a retained
per-reader nav-history (grab-current-on-mount + single 'load' path)
rather than per-view state (dies with the widget — the T-196 bug) or
MessageBus retention (wrong layer). The user chose the nav-history
helper over a bus fix.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The reader opened repo-local .claude markdown but rejected user-scope
files under ~/.claude with "path outside workspace" — that dir is
global, outside the repo, and files.read was repo-confined (T-102).
Per D-76 the Claude config surface is clide-managed, so files.read now
resolves a path under an allow-list: the workspace root plus trusted
extra read roots (FilesService.extraReadRoots), wired in main.dart to
~/.claude when present. Reads widen; writes stay repo-confined, and the
symlink re-check still refuses a config-root symlink that escapes. Off-
root paths and `..` traversal are rejected as before.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Find-in-files / replace (T-52/T-53) run as an in-process isolate-pool
grep engine behind an engine-agnostic search.grep verb — not pql (its
search is a ranked document index, with no line numbers, regex, or
glob) and not a ripgrep shell-out (unvendored, not guaranteed
cross-platform). ripgrep is kept as a future optional accelerator
behind the same verb. Clarifies the D-3 wrap-pql boundary: content
grep is a code-navigation primitive pql does not offer.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Regenerated by `pql decisions sync` — moves resolved questions (Q-6, Q-19,
Q-21, Q-22) into a Resolved section.
Co-Authored-By: Claude <noreply@anthropic.com>
Empirical spike against claude 2.1.150 (driving the real CLI over
stdin/stdout + reading the shipped binary's zod schemas) pinned the
wire shapes for the stream-json control protocol: the can_use_tool
permission request, the control_response envelope, the
--permission-prompt-tool stdio enabler (without it "ask" tools silently
auto-deny), the allow-requires-updatedInput quirk, and AskUserQuestion
answered via updatedInput.answers. Captured in a version-pinned spike
note with a resilience section (detection canaries + a ranked fallback
menu) so a future Anthropic change to this undocumented contract doesn't
leave us at a blank slate.
D-78 records the decision: permissions ride the stdio control channel,
not MCP (MCP is reserved for capability/tool provision); refines D-77.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
test / unit + widget + golden + a11y (push) Failing after 29s
test / integration_test (xvfb) (push) Has been skipped
test / bundle smoke (xvfb 5s) (push) Has been skipped
test / daemon subprocess + web WASM smoke (push) Has been skipped
test / dart doc (lib API) (push) Failing after 27s
Accepted (phased). Pivot the Claude pane from the interactive tmux TUI to
the stream-json control protocol: structured events instead of transcript
tailing, permissions + AskUserQuestion handled natively via canUseTool,
persistence via --resume. Claude's tmux agent-team mode is headless-
incompatible, so teams become clide-orchestrated — N managed sessions
coordinated by a clide-hosted MCP broker, with team-awareness injected via
--append-system-prompt/--agents.
Captures the unified-session-model upside: teammate / secondary tab /
forked branch / inline subagent collapse into one primitive (a managed
session rendered as a pane), with the sidebar as the cockpit. Amends D-41
(persistence) and evolves D-75 (rendering source). Phase 1 single-agent
first; phase 2 the unified model.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Extends D-75's accepted CC-internals coupling from the transcript/team
schema to the config layout: a builtin-owned ClaudeConfig service is the
app-wide source of truth for skills, commands, settings, and permissions
(global + local, layered), watched and refreshable. Built-in slash
commands come from a stream-json probe cached per claude version id.
Kernel stays Claude-agnostic — Claude is a non-disableable extension but
still an extension. Implemented by T-151..T-154.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Decision for epic T-132: clide renders the Claude conversation as native
Flutter widgets driven by Claude Code's transcript JSONL, not by scraping
the PTY/TUI. Claude still runs under tmux for process persistence (D-41),
but its content is sourced from the transcript. The terminal emulator is
retained as a general IDE tool only. Records the Claude-centric > CLI-first
ordering (D-6 surfaces preserved) and the accepted, version-pinned coupling
to Claude Code internal contracts, isolated behind one reader/observer.
Co-Authored-By: Claude <noreply@anthropic.com>
Captures the T-120 design decision: the typed argument schema travels
with each command (built-in modules and extension contributions both
register their own) rather than living in a central static map, which
would be blind to extension-contributed commands and fight the plugin
model (D-46). The dispatcher accumulates a cmd->schema registry and
validates req.args before invoking the handler. The T-104 git
validators stay as defense-in-depth because the git client is also
reachable directly from the UI. MCP tools/list generation deferred to
the T-130 track.
Co-Authored-By: Claude <noreply@anthropic.com>
test / unit + widget + golden + a11y (push) Failing after 27s
test / integration_test (xvfb) (push) Has been skipped
test / bundle smoke (xvfb 5s) (push) Has been skipped
test / daemon subprocess + web WASM smoke (push) Has been skipped
test / dart doc (lib API) (push) Failing after 28s
D-56 and D-68 gain dated implementation-notes amendments pointing at
the eight T-99 slices (T-124 server through T-131 wrap-up) and the
D-70/71/72/73 records the work spawned. D-68's main Decision text
swaps "Transport deferred to Q-33" for the closed reference to D-73.
CONTRIBUTING.md gains a "Running clide from the shell" section
covering the verb surface, exit-code contract per D-68, and
`/ide` MCP discovery via `~/.claude/ide/<pid>.lock`. governance/
README.md picks up the D-73 entry it was missing.
T-119 moves out of backlog (its IPC dispatch path now exists);
T-120 gains a 2026-05-19 re-scope note pointing the typed schema
framework at the now-real argv grammar / wire contract. T-99
itself transitions to done.
Co-Authored-By: Claude <noreply@anthropic.com>
test / unit + widget + golden + a11y (push) Failing after 26s
test / integration_test (xvfb) (push) Has been skipped
test / bundle smoke (xvfb 5s) (push) Has been skipped
test / daemon subprocess + web WASM smoke (push) Has been skipped
test / dart doc (lib API) (push) Failing after 1m0s
Three architectural commitments T-124 needs settled before any code:
* D-70 — socket path is per-workspace and deterministic
(`$XDG_RUNTIME_DIR/clide/<sha256(workspace)[:16]>.sock`). No env
override; matches the per-repo tmux socket pattern (D-41) so users
see one consistent shape across clide's process boundaries.
* D-71 — file permissions are the only gate: `0600` on the socket,
`0700` on the parent. Capability-token auth stays a Tier-6 concern
tracked by Q-1.
* D-72 — multi-connection accept loop, serial dispatch on the main
Flutter isolate. Per-handler isolate offload (the NativePty /
SchedulerService pattern) is available where it matters; the IPC
layer doesn't impose isolate-safety across every subsystem.
T-124's description updated to inline the three decisions so the
implementer starts with the contract, not a discovery pass.
Co-Authored-By: Claude <noreply@anthropic.com>
The expanded canonicalPairs from T-114 (muted text, status chips,
syntax tokens on the code-block surface, panel focus border) made the
four named themes fail WCAG-AA. Retuning their palettes to pass would
have changed the look users picked them for, so the gate is split
instead.
`canonicalPairs` shrinks back to the baseline every named theme passes;
the new `extendedPairs` carries the stricter set and only runs against
themes whose name ends `-hc` or `-cb`. Sibling files (`clide-hc`,
`midnight-hc`, `paper-hc`, `terminal-hc`) ship today; the policy lives
in D-69 with a back-ref from D-22.
Co-Authored-By: Claude <noreply@anthropic.com>
D-68 (dual integration surface — Bash CLI primary, MCP secondary)
landed in 8074bf4 inadvertently; this lands its index pointer in
README.md and the two open questions D-68 spawned.
- Q-32: tool surface — minimum /ide vs extended `mcp__clide__*`.
- Q-33: transport — SSE / WebSocket / stdio / all.
No behavior change. Governance bookkeeping only.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
test / unit + widget + golden + a11y (push) Failing after 35s
test / integration_test (xvfb) (push) Has been skipped
test / bundle smoke (xvfb 5s) (push) Has been skipped
test / daemon subprocess + web WASM smoke (push) Has been skipped
test / dart doc (lib API) (push) Failing after 1m3s
Two open questions have been answered by reality and should be
formally resolved:
- Q-21 (pql planning home): pql 1.4.30 ships the full surface and
clide consumes it via shell-out. Resolves to D-3 + D-39, which
already encoded the intent.
- Q-22 (ticket persistence): pql 1.4.x's append-only per-month SQL
changelog with inline LWW guards is option (3) of Q-22 evolved
into a form that merges by default. Clide migrated to it on
2026-05-09.
Adds D-67 to formalise clide's adoption: which directories carry
changelog data, what stays gitignored, which hooks run when. Q-22
points at D-67; Q-21 points at the pre-existing D-3 + D-39.
Pql state: 106 decisions → 107 (D-67 added); 134 refs → 139; 0
broken; validate ok.
Co-Authored-By: Claude <noreply@anthropic.com>
test / unit + widget + golden + a11y (push) Failing after 31s
test / integration_test (xvfb) (push) Has been skipped
test / bundle smoke (xvfb 5s) (push) Has been skipped
test / daemon subprocess + web WASM smoke (push) Has been skipped
test / dart doc (lib API) (push) Failing after 1m2s
pql 1.4.30 introduces a per-type subdirectory layout for decision
records: governance/{decisions,questions,rejected}/<domain>.md. The
parser infers record type from the parent subdir and domain from
the filename stem, replacing the flat decisions/<file>.md layout
with questions-X and rejected prefixes.
Moves:
- 6 D-files to governance/decisions/ (accessibility, architecture,
extensions, process, testing, tooling)
- 5 Q-files to governance/questions/ (stripped the questions- prefix)
- rejected.md split by domain to governance/rejected/{architecture
(5), process (4), accessibility (1), testing (1)}.md — split per
cross-reference target.
Drops:
- decisions/README.md (auto-regenerated as governance/README.md by
pql init below the records marker)
- decisions/questions.md (hand-curated index pointing at the per-
domain files; redundant once pql generates the index, and the
"load-bearing" curation was already present in each Q-record's
Context field).
Convention-driven; not a clide-specific change. Counts unchanged
across migration: 106 decisions, 95 tickets, 134 refs, 0 broken.
Co-Authored-By: Claude <noreply@anthropic.com>
