Repository navigation
ci(browser): per-script timings and kept screenshots for the browser lane - #627
Merged
Merged
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configuration
📒 Files selected for processing (2)
Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 5 remain after this review. 📝 SummarySummary by CodeRabbit
WalkthroughThe browser CI lane reports each script’s elapsed time and exit code, stops after the first failure, and configures browser-evidence output. CI failure artifacts include browser evidence PNGs and the herdr test-server log. Tests cover lane outcomes and evidence conditions. ChangesBrowser CI Evidence
Priority: ⬇️ Low Estimated code review effort: 3 (Moderate) | ~20 minutes Change: Other Suggested reviewers:
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files. | Write docstrings for the functions missing them to satisfy the coverage threshold. |
✅ Passed checks (4 passed)
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title clearly identifies the browser-lane timing and screenshot changes. It is concise and directly related to the main changes. |
| Description check | |
The description includes both required sections, explains the problem and resulting behavior, and provides detailed validation results. It also documents scope, evidence handling, cleanup, and remaini… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
- Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
📝 Generate docstrings 💡
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
- Commit to this branch
- Create a new PR
- Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
Owner
Author
|
Codex adversarial pass completed on ff93373 (gpt-6-astra, read-only, no network/full suites). Confirmed High/Medium findings: none. Lows: none. I independently verified the failure/success summaries, first-failure stop, directory cleanup, evidence filtering, and original exits 0/7 even when cleanup reports a failure. Bash 3.2 syntax was inspected; runtime tests used Linux Bash, not macOS. Captures are isolated CI fixtures; terminal prompts and paths are not generally redacted, so this does not promise sanitized screenshots from arbitrary local sessions. No fix commit or commit after the Codex pass. Required CI checks and real lane timing evidence are still pending. |
Owner
Author
|
CodeRabbit completed its review of ff93373 with no actionable comments and no review threads. I am declining the generic docstring-coverage suggestion: its report says all three analyzed functions were skipped as unsupported, so the reported 0% is not usable coverage evidence. This repository does not require an 80% docstring threshold. The shell behavior, evidence limits, and tests are documented in the changed files; no code change is warranted. |
Owner
Author
|
Lead review at ff93373: CI-only change (per-script timings and kept screenshots for the browser lane), Codex astra pass with no findings, all checks green (run 37878106595), and no slowdown measured (lane 430 s vs 420.6-433.4 s on main). Leaving it open, ready to merge after main is merged in, for the maintainer's call: it improves diagnostics for the flaky browser lane but is neither a serious bug fix nor clearly necessary, which is this round's merge bar. #552 stays open (this PR covers part of it: no trace, no all-page capture, no server-line timestamps). |
…gs-evidence # Conflicts: # scripts/ci-browser.sh
main added scripts/terminal-arrows-clicks-regression.ts to the lane (#634); the summary test counted the 18 before it.
Merged
jiunshinn
added a commit
to jiunshinn/herdr-web-ui
that referenced
this pull request
Oct 9, 2026
…swha#625, devswha#627, devswha#632, devswha#646, devswha#647, devswha#648, devswha#658) (#5) * fix(terminal): recheck the sender's right to type right before herdr is written to (devswha#624) Fixes devswha#545. Refs devswha#589 (both points in the issue body; the window in its follow-up comment is left as is, see below). ## Problem - **devswha#545**: a queued terminal chord or text passed its attachment, claim and authorization checks inside `serialize(...)`, then waited for `herdrRpc`'s Unix-socket connect. If the sender detached, switched to observe or had its device revoked during that wait, the request was still written when the connection resolved. - **devswha#589**: the `secret` handler re-checked the connection, attachment, claim and readiness after its live-screen read, but not (1) whether the pane's pty had been replaced under the same attachment (a live handoff), or (2) whether the sender had switched interact → observe → interact while the read was pending. ## Change - `herdrRpc(method, params, socketPath, timeoutMs, guard?)`: an optional guard asked once more right before `sock.write`. False sends nothing and rejects with `cancelled`. `paneSendText` / `paneSendKeys` pass it through. Callers without a guard are unchanged. - `keys` handler: the checks it already makes become the guard; a cancelled send is answered `input_failed` (as the existing cancel paths are, per `server/AGENTS.md`). - `input` handler (mirrored and queued branches): the same, through the existing `.catch(inputFailed)`. - `SocketData.roles` counts mode changes. The secret handler captures it and the attachment's pty when it accepts the secret, and refuses after the screen read with `read_only` (role changed) or `input_not_ready` (pty replaced). On a mirrored pane the secret's text also carries the guard. **Left as is (devswha#589 comment):** on a mirrored pane, once the secret's text is in, its Enter follows without another check. Withholding the Enter would leave the secret on the prompt line for the next Enter anyone presses, and no single key clears a line in every shell herdr mirrors (Ctrl+U for a POSIX tty, Escape for PowerShell/cmd). This matches the devswha#588 review's call. The issue stays open for that decision. **Cost to a legitimate user:** none found. The guard only refuses what the existing checks already refuse, evaluated a moment later. The app never sends `role` on its own (`src/AGENTS.md`), so the role count changes only for a client that switches roles itself. ## Validation - `server/rpc-guard.test.ts` (new, unit, a stand-in herdr on a Unix socket): a guard that turns false while the connect is pending writes nothing and rejects `cancelled`. Passes with the fix; fails with the guard check replaced by `if (false)` (1 fail). - `server/submit.contract.test.ts`: new case, a secret whose screen read is held while the sender switches to observe and back, answers `read_only` and types nothing. With the fix it passes, together with the two devswha#588 rejoin cases (3 pass). With the role check removed it fails (the secret was entered). Run through `bun run check run` on its own herdr. - `bun run typecheck` clean. - Not covered by a test: the pty-replaced branch (it needs a live handoff mid-read). It is one identity comparison next to the existing attachment check. No protocol change. `server/` changes, so a remote PC gets this with the next `REMOTE_BUNDLE_VERSION` bump. * fix(machines): a remote PC tells its connection server of a new agent at once (devswha#625) Fixes devswha#555. ## Problem On a remote PC, a pane whose agent has just been named could stay listed as a shell for up to 5 s. The connection server reads a remote PC's snapshot every 5 s and on each `pane-status` / `pane-exited` / `session-changed` frame from its bridge (`server/machines.ts`, `observe`). An agent herdr names **in a status event** therefore reaches it with that event's frame. An agent the bridge's collector first sees **in a snapshot it reconciles from** (a pane created a moment ago that got its agent after the roster's own read, or an agent that starts without a status change) has no frame behind it, so nothing asks for the roster until the next 5 s read. devswha#537 fixed the local PC with `MachineManager.localAgents`; a bridge runs with `machines: false`, so that call did nothing there. ## Change - `AgentNews` (`server/machines.ts`): the "is this news" test `localAgents` had (an agent named anew or another one; a pane first heard of as a shell is not), with `forget` / `keepOnly`. `MachineManager` uses it unchanged in behaviour. - `bridgeAgentNews(tell)`: a bridge's record. A status event's agent is recorded with no frame of its own, because its `pane-status` frame already makes the connection server read the roster. An agent first seen in a reconciled snapshot calls `tell`, which `createServer` wires to `broadcastAll({ type: "session-changed" })`. It never prunes on a reconcile's payload, which leaves out panes heard of while its snapshot was read. Panes that end are forgotten through `onPaneEnded`. No wire change: `session-changed` already exists and every connection server reads the roster on it. **Remote bundle:** the bridge's behaviour changes, so remote PCs get this only after `REMOTE_BUNDLE_VERSION` is raised at the next release. ## Validation - `server/machines-refresh.test.ts`, four new cases for `bridgeAgentNews`: news first seen in a reconcile tells once; a status event's agent tells nothing; a pane left out of a reconcile is not forgotten; an ended pane's id is news again. With the fix: 19 pass. With the `tell` removed: 3 fail. With the first version of this PR (tell on status, prune on reconcile): 2 fail. - The devswha#537 `localAgents` cases still pass after the refactor. - `bun run typecheck` clean. - Not run end to end: a live herdr reconcile that names an agent with no status event. I found no deterministic way to make herdr do that in a contract test. The first version's contract case went through a status event, a path the connection server already covered, so it was removed (see the Codex comment). * ci(browser): per-script timings and kept screenshots for the browser lane (devswha#627) ## Change A failed browser lane kept herdr's server log, but no page screenshots and no reliable per-script timings. This adds wall-second timing and exit-code lines for all 17 browser scripts plus the shared demo build, and an EXIT summary of every script run so far. The first failure still stops the lane; the trap preserves its exit code and removes the temporary demo build. Order, checks, and retries are unchanged. With CI or CHECK_DIR set, existing screenshots go under `${CHECK_DIR:-.ci}/browser-evidence`. The failure artifact includes those PNGs and the existing herdr logs, with hidden files explicitly enabled for the narrowly scoped `.ci` paths. Evidence is deliberately restricted to sticky-modifier and file-viewer checkpoints (eight viewport PNGs on a complete passing run). The UI suite has evidence-only assertions and viewport changes, and the key-bar demo adds viewport changes and font waits, so their evidence branches remain off in the lane. No live user session is captured: these scripts use isolated test panes and synthetic transcripts. Outside CI/CHECK_DIR, explicit local UI_EVIDENCE_DIR behavior is preserved. Remaining devswha#552 work: - Capture every open page at the exact failure point; the scripts have no common browser launcher/failure handler. - Playwright traces of failing contexts. - Timestamps on the web UI test servers' own lines; there is no common test-server output wrapper across these scripts. - Recording browser-received frames. - Multiple-run measurement for devswha#548 and decisions on devswha#553; this PR does not split the lane. - Investigating the seven historical fork runs with no jobs/logs. No CHANGELOG entry: CI/test-only changes are not user-visible, following devswha#548, devswha#581, and devswha#590. ## Validation - Four cheap `scripts/ci-browser.test.ts` tests exercise the real shell lane against stub commands: passing and failing summaries, exact exit 7, first-failure stop, temporary-directory cleanup, evidence filtering, and CI/CHECK_DIR/local behavior. The first three failed on the unchanged lane before implementation, then all four passed. - Captured a failing stub run: both passing steps and the failing step print numeric seconds, the EXIT summary includes all three, and the process exits 7. - `bash -n scripts/ci-browser.sh` and `git diff --check` passed. - `dori heavy tri-client3 -- bun run check fast` passed: actionlint, generated types, typecheck, build, and 1,932 unit tests passed, 0 failed (six existing skips). - The PR's CI browser lane will provide the real-surface timing proof and comparison against recent main runs. Refs devswha#552 * fix(alerts): one chime per alert across open tabs (devswha#632) ## What was wrong With the alert sound on and the app open in two tabs, every tab chimed for the same alert: each tab played its own audio and nothing told one tab what the other played (devswha#439 left the cross-tab half out because a Web Lock alone could drop a question no tab told). ## The rule (`src/lib/alertTurns.ts`) BroadcastChannel only, so it works on plain-HTTP LAN addresses where Web Locks do not exist. All times are this tab's own receive times, never a sender's. - A tab claims an alert (machine + pane + kind) only when it would chime it itself: alerts and sound on, not the pane in front of a visible tab, and its audio context running (`canPlayAlertSound`). A tab that would not chime never claims, so another tab chimes alone. - After a 150 ms window the lowest tab id among live claims plays and posts `chimed`; `chimed` cancels the others and settles that alert's claims. Only a `chimed` heard up to 400 ms before a tab's own alert counts as telling it, so the same pane can ask again soon after, and a tab ignores a late duplicate `chimed` for an alert it played itself. A `chimed` is sent only once the audio actually starts, also for a question queued behind another chime (`playAlertSound` now resolves when its notes begin). - No alert is dropped on a guess: a tab that deferred a question or a finish chimes it itself if no `chimed` arrives within 600 ms per lower claimant (so a third tab waits for the second), and at once when the winner withdraws (its audio could not play, or the tab is closing: `pagehide` withdraws its claims; `pageshow` reopens the channel). - No BroadcastChannel: chime at once, as before. A chime before the first tap or key is still skipped, never queued. Costs: an alert now waits about 150 ms for the window (up to a timer tick longer in a background tab). If timers in both tabs run more than 1.5 s late, both may chime: a double chime, never a lost question. ## Reproduction on b82584d The new two-tab case in `scripts/alert-sound-regression.ts` (which can now also run on its own) against the unchanged app: ```text $ dori heavy … bun run check run bun scripts/alert-sound-regression.ts PASS no alert sound before the page was tapped … (4 more PASS) two-tab shared alert: 2 chimes (4 notes) AssertionError: exactly one chime across two tabs for the same alert 4 !== 2 ``` The updated `src/lib/alertSound.test.ts` against the unchanged `alertSound.ts`: 10 pass, 4 fail (a queued question is confirmed only once it starts; an interrupted one is not). ## After - `HERDR_TEST_MODE=unit bun test ./src/lib/alertTurns.test.ts ./src/lib/alertSound.test.ts`: 28 pass, 0 fail. `bun run typecheck` clean. `bun run check fast` passed locally (1950 tests, 0 fail). - Browser, through `bun run check run bun scripts/alert-sound-regression.ts`: all 7 steps pass, including `two-tab shared alert: 1 chimes (2 notes)`, "two open tabs chime once for a shared alert" and "the other tab tells a question in front of the first tab". It passed twice: once in this worktree, and once with only the `src/` change applied to a clean checkout of b82584d. ## Test setup change The script's primer now waits (bounded) for each `working` event before reporting again. In one worktree under heavy load, two runs timed out at the first existing step, waiting for a `blocked` event that never reached the page. The same fix with the old primer passed in a clean checkout, so the fix did not cause it. The cause was not confirmed; the pacing is a robustness change only. Review rounds: see the Codex comments below (fixes bbb9f9f, 76450d2, 18ee46a and 1efe181; Lows listed there). ## Finishes get the safety net too (1efe181) A tab that deferred a finish used to drop it at the claim deadline, so a winning tab whose audio did not start, or that froze, left the finish unheard in every tab, where before this PR every tab chimed. A finish now waits like a question: the winner's withdraw redecides at once and the 600 ms rescue plays it if no `chimed` arrives. The winner confirms a finish as soon as it plays (`playAlertSound("done")` answers synchronously), so the rescue does not double it. The unit test "does not give a finish a question safety net", which pinned the old behavior, is replaced by "chimes a finish in another tab when the winning tab cannot play it", "chimes a finish once when the winning tab played it" and "rescues a finish when the winning tab never answers". Fixes devswha#449 ## A slow winner, and the pane's next question (after the CI failure on 1efe181) Run 37886117774 chimed one question twice in "two open tabs chime once for a shared alert". Two ways lead there, both fixed here: - The winner's `chimed` can come late: its audio waits behind a chime its tab still plays (a finish, a Settings preview), or the runner is slow. The other tab's 600 ms rescue then chimed the alert again. The winner now posts `playing` before its audio starts; a tab deferring that alert then waits for its `chimed` or `withdraw` (a withdraw still redecides at once), up to 5 s, after which it rescues. A winner that freezes mid-play therefore costs a late chime, never a lost one. - A tab that chimed the pane's previous question less than 1.5 s ago ignored every `chimed` for that pane and kind as a late duplicate, also the genuine one for the next question it was deferring (Codex's M2), and its rescue chimed again. A `chimed` now settles an alert this tab is waiting on; it is ignored as a duplicate only when nothing is pending. Tests: unit tests "takes another tab's chime of the pane's next question although it chimed the first one itself", "waits for a winner that is playing, however long its audio waits, and chimes once" (question and finish), "still rescues an alert whose winner said it was playing and then went silent" and "redecides at once when a winner that said it was playing withdraws". `scripts/alert-sound-regression.ts` gains "a winner that confirms late is not chimed over by the other tab", which holds every `chimed` back by a second in both tabs. * docs(readme): re-shoot the hero and the six feature clips on v0.4.0 (devswha#647) Re-shoots the README's hero video and all six feature clips on **v0.4.0**. That release reworked the UI: the two-list sidebar (Workspaces and Agents), the single status column, the composer with its + button, the greeting on an empty chat, and the key bar's Enter key. The old clips still showed v0.3.49 and the sidebar's Needs you list, which v0.4.0 removed. Docs only: WebPs, the four READMEs, `site/index.html`, and the hero's upload link in `scripts/build-site.ts`. No app code, no CHANGELOG, no version change. ## What changed | | Upload | Length | Change from the current README | |---|---|---|---| | Hero | [herdr-web-ui.mp4](https://github.com/user-attachments/assets/d854dbb6-64bd-4eba-81c7-fbd3f525726b) | 26.5 s | New story (see below) | | Switch to the live terminal | [upload](https://github.com/user-attachments/assets/32ca9aa4-960f-4629-9fb5-17c12ba35c80) | 11.5 s | The phone uses the key bar's new Enter | | Your herdr layout, in the browser | [upload](https://github.com/user-attachments/assets/22d10639-9aa6-4953-a5f3-a1b743f4053b) | 12.5 s | Status column replaces the READY/RUN/DONE badges; two-line rows | | Know when an agent needs you | [upload](https://github.com/user-attachments/assets/b228a2b8-6db5-4546-a15b-972056000cab) | 11.3 s | The Needs you list is gone; the desk shows the red ? and the card in the chat | | Send a screenshot from your phone | [upload](https://github.com/user-attachments/assets/a193b426-259c-47d9-bd73-10acc2594265) | 13.8 s | + replaces the paperclip; starts on the greeting | | Open what the agent made | [upload](https://github.com/user-attachments/assets/bc419d3e-ebda-4fb5-acc5-e498609559fe) | 10.0 s | Same beats on v0.4.0 | | Branch off a second agent | [upload](https://github.com/user-attachments/assets/150a4c9d-7667-4f63-ba56-8f91e6a25878) | 11.7 s | Reframed: the phone beside the browser's sidebar, ending on the nested row | **The hero, in order:** 1. herdr's own TUI, with Claude Code at work in checkout-api. 2. A dissolve into the browser's Terminal view of the same pane. Claude Code's screen stays still: both grids are 98x35 in the same cells. 3. The turn finishes in the browser, and a click on Chat shows the same session as a chat. 4. The camera pulls back to the phone, which shows the same chat. 5. On the phone: ⋯ → New worktree → Claude Code → Create. The browser's sidebar nests the new checkout. 6. It ends on the phone's greeting, "What should Claude do in worktree-…?". Both apps use their default themes: herdr's catppuccin and the web's amber. **Text changes:** - The hero's caption, `site/index.html`'s aria-label and show-note, and the site poster time (`at: "11.8"`, where both screens show the same chat). - All six alts in all four languages. Each one matches what its loop shows; attach's alt names the step that only the full video shows. - Two captions: the terminal one ("Enter beside it") and the attach one ("The + button"). - The footnote ("live recording … no cuts") still holds and is unchanged. **Checks:** - Each upload was fetched back: 200, a ranged GET gives 206, and its SHA-256 matches the local render. - `bun run build:site` passes. The hero downloaded at full size (3,964,804 B) and the poster was cut at 11.8 s. ## How it was made (disclosure) - **Real:** - herdr-web-ui **v0.4.0** (built `dist/`) on herdr 0.9.0, in the separate `herdr-web-ui-demo` session. - Real Claude Code 2.1.294 turns on a real account: 4 in the hero, 0–3 per clip take (worktree needs none). - Real git worktrees made by herdr, and real clicks and taps. - Recorded at the same moment on one clock (herdr's TUI, a 1280×800 desktop page and a 390×844 phone page) and played back 1:1, with no speed change and no time cuts. - The latest release is now v0.4.2; these videos were shot on v0.4.0. - **Staged:** - `checkout-api` is a small demo repo. web-dashboard (Codex · working), infra and release are props: their agent states are set through herdr's API. - Warm-up questions and tasks were sent through herdr's API off camera, not typed. Warm-ups also scroll Claude Code's header (plan line) off the screen. - Claude Code ran with acceptEdits, the publishing tools denied and spinner tips off. Bash and AskUserQuestion were denied where a clip doesn't need them (alerts keeps the question; attach's two later Bash prompts were approved off camera, after its cut ends). - The attach screenshot was rendered from the repo's own receipt page. - The phone is an emulated page on the same machine. - The host name reads "workstation", and paths read `~`. - **Composited:** - The wallpaper, the window and phone frames, and the camera moves. - The arrow and the tap disc, drawn at the recorded pointer or touch. - The hero's dissolve, a crossfade of two recordings of the same moment. For the film, herdr's terminal is xterm.js in a 1210×775 page and the browser's terminal font is 16 px (default 13), so the grids match. - **Privacy:** every frame of every render and its source takes passed the OCR check against the account, machine and network names. The flagged hits were OCR misreads of motion-blurred UI text, checked frame by frame. ## Known, left as the app does it - After Send, "No conversation yet" shows for about 0.2 s. - Switching to Chat shows "Loading conversation…" for 4–7 frames. - A new worktree's pane goes through its shell and terminal before its chat. In the hero this happens small, during a camera move. - Chat bubbles show a clock time. These could be app issues, but this PR does not touch the app. ## For the README session picking this up - Text that is translated by hand and worth a native read: the ko/ja/zh-CN alts and captions in README.ko.md, README.ja.md and README.zh-CN.md. - Source material lives in the film worktree, `_film/renders/herdr-web-ui-<clip>.mp4`. The film tooling (`scripts/film/…`) is uncommitted there and is not part of this PR. - Re-cutting a loop: `bun scripts/film/webp.ts scripts/film/cut-<clip>.ts --q 85 --out docs/media/readme/<clip>.webp`, run in that worktree. 🤖 Generated with [Claude Code](https://claude.com/claude-code) ## Chinese page (57f0d64) `site/zh/index.html` gets the same update as `site/index.html`: the six clips link to their new uploads with the alts and captions from `README.zh-CN.md`, and the hero's aria-label and note tell the new story. Before this, the Chinese page would have kept the old upload links, the Needs you and paperclip alts, and the health.ts hero text. `bun scripts/build-site.ts` passes; `/zh/` renders the new clips with no 4xx or page errors. --------- Co-authored-by: e2e <e2e@example.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(chat): read a Claude pane's session on a Mac whose locale puts the day first (devswha#646) ## Change On a Mac whose language puts the day before the month (English (UK), for one), every Claude pane's chat showed "Conversation unavailable — show terminal output" when herdr's Claude integration is not installed. Without the hook, the server finds the session through Claude's native PID record (`~/.claude/sessions/<pid>.json`) and accepts it only when its `procStart` equals `ps -o lstart` for that PID. Claude Code records the start in the C locale's order, but the server ran `ps` in its own locale: | | | |---|---| | `procStart` Claude 2.1.285 wrote | `Fri Oct 9 04:43:00 2026` | | `ps -o lstart` under `LANG=en_GB.UTF-8` | `Fri 9 Oct 04:43:00 2026` | So the record looked like a reused PID's, the pane had no session (`no_session_id`) and the chat fell back to the scrollback. `darwinProcessStart` now runs `ps` with `LC_ALL=C`, as `gjc-runtime.ts` already does since devswha#484. Linux (`/proc` ticks) and Windows (FILETIME) compare numbers and are unaffected. The test fixture built `procStart` with the same locale-dependent `ps` call as the code, so it passed in every locale. It now writes the record as Claude does, and a new macOS test runs the check under `en_GB.UTF-8`. ## Validation - `HERDR_TEST_MODE=unit bun test ./server/claude-store.test.ts` on macOS with `LANG=en_GB.UTF-8`: before the fix, "reads an exact live PID's session" and the new "reads it on a Mac whose locale puts the day first" fail (`Received: null`); after it, 35 pass. CI runs no unit tests on macOS, so these two skip there. - Against a live Claude Code 2.1.285 pane with no herdr hook: `claudeProcessSession` now returns the session and `claudeTranscriptFile` finds its `.jsonl`. - `bun run check fast`: generated types, typecheck and build pass. `test:unit` has 1926 pass and 3 fail, all in `scripts/check.test.ts` > `isolate`. They fail the same way on unchanged `main` on this Mac, because the temp directory makes the herdr socket path too long (120 > 100). * fix(plugin): discover Bun when launched with a minimal PATH (devswha#648) ## Change Closes devswha#637 - Unix build/start/action/phone 명령과 preflight가 같은 Bun 탐색을 사용합니다. - 기존 PATH 우선순위와 인자 경계를 보존하며 Windows 명령과 Bun 최소 버전 검사는 유지합니다. ## Validation 경로·인자·manifest 테스트 11개, 타입·빌드·생성 타입 검사 및 실제 Phone entrypoint 계약 검사 통과. 실제 `env -i HOME="$HOME" PATH=/usr/bin:/bin sh scripts/with-bun.sh --version`은 `1.4.2`를 반환했습니다. 전체 단위 실행은 1938 통과·33 생략·1 실패였습니다. 실패는 변경하지 않은 `server/collector.test.ts`의 recovery 타이밍 테스트이며, 분리 실행한 해당 파일 27개는 통과했습니다. 같은 collector의 다른 브랜치 전체 실행도 통과했으며 이 PR에서 해당 테스트를 바꾸지 않았습니다. Windows 실제 실행은 검증하지 않았습니다. 모든 검증은 별도 작업 공간과 소유한 테스트/demo 환경에서 수행했습니다. 사용자의 실행 중 앱·terminal은 변경하지 않았습니다. --------- Co-authored-by: studiood <253281802+od-studio-webagency@users.noreply.github.com> Co-authored-by: Hako <devswha@gmail.com> * fix(terminal): a tab you are not using leaves the pane's size alone (devswha#658) ## Problem A herdr-web-ui tab left open on a desktop took a shared pane's size even while nobody was using it. The terminal lens re-asserts its grid on `visibilitychange`, on `role-ack` (every reconnect), from its ResizeObserver, and through the attach a reconnect replays. A window that only turned visible behind another app counted, for example when the screen woke. So did one that reconnected in the background. Seen on a MacBook running herdr's own TUI in Ghostty, with the pane split to about 105 columns: 1. The phone opened the pane in the terminal lens (54×62). 2. The user came back to herdr in Ghostty. 3. A Chrome tab on the same pane, sitting behind Ghostty, turned visible and resized the pane to its own 202×54. 4. Herdr's TUI then drew the 202-column pane inside its 105-column split, cut off at the edge. The sidecar's argv (`pty-host.mjs 202 54 …`) showed the size came from that tab. Herdr 0.9.3 keeps an attach's size after it leaves, so the pane stayed that way. ## Change `PaneTerminal` drives the shared grid only while the tab is in use, meaning `document.visibilityState === "visible"` and `document.hasFocus()`: - `visibilitychange` refits only when the tab is visible with the focus. The window's `focus` still refits, so going back to a tab takes the pane back as before. - `role-ack` refits only in use. Out of use, the refit waits for the user. - The ResizeObserver still fits xterm, but sends `resize` only in use, so a window the system moves or resizes in the background does not take the pane. - Out of use (window `blur`, or a hidden or unfocused `visibilitychange`), the pane is marked `keepSize`. A reconnect in the background then attaches with `keep_size` and adopts the pane's size, as the chat lens already does. The next refit clears it. - A pane attach out of use (a reload behind another app, or the next pane after the one shown closed in herdr) goes with `keep_size` too. The lens effect, which runs on every load, and a chosen font's load resize the pty only in use, so they don't take the pane right after that attach. Out of use they fit only xterm. There are no server or protocol changes. Not addressed here: after a phone uses a pane, herdr's TUI still shows it at the phone's size until something resizes it. Giving a pane back to herdr's layout size when no tab is in use would need a new frame. The server also can't tell whether a native TUI is attached, so on a headless herdr that would resize panes to herdr's default layout. I left that for a separate discussion. ## Validation - New browser check `checkBackgroundTabKeepsTerminalSize` (`scripts/chat-size-regression.ts`, run from `ui-regression.ts`). It uses a desktop page and a phone page on one owned pane, and a second pane the desktop moves on to: - The phone takes the grid. - The desktop turns visible without the focus: no `resize`, and the pane keeps the phone's size (`stty size`). - The desktop reconnects in the background: the only frame is `attach` with `keep_size: true`, and the pane keeps the phone's size. - The desktop reloads in the background, with a chosen terminal font: the only frame is `attach` with `keep_size: true`, and the pane keeps the phone's size. - The pane closes in herdr while the desktop is in the background (the phone has left): the desktop moves on to herdr's focused pane with an `attach` with `keep_size: true`, and that pane keeps its size. - The desktop takes the focus: that pane goes to the desktop's size. - The check fails on the previous `PaneTerminal.tsx` ("a window shown without the focus sends no resize") and passes with this change. Each later step fails with its own fix undone (the attach, the font load, the lens effect). - `checkChatKeepsTerminalSize` and `checkPaneSwitchKeepsTerminalSize` still pass. `document.hasFocus()` is `true` in Playwright pages (focus emulation), so the existing browser checks keep their behavior. - `bun run check fast`: generated types, typecheck and build pass. Unit tests (with current `main` merged): 1964 pass, 3 fail. The 3 failures are `scripts/check.test.ts > isolate`, which fail on unchanged `main` on this Mac because the macOS temp dir makes the socket path too long (120 > 100). - `scripts/ui-regression.ts` via `bun run check run`: exit 0, 93 PASS lines. - I haven't tried it on a real iPhone. Returning to the app there should refit through `visibilitychange` with the focus, or through the window's `focus`. A page opened fresh while `document.hasFocus()` is `false` attaches with `keep_size` and waits for that `focus` too. --------- Co-authored-by: Hako <devswha@gmail.com> --------- Co-authored-by: Hako <devswha@gmail.com> Co-authored-by: e2e <e2e@example.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: studiood <studio-od@naver.com> Co-authored-by: studiood <253281802+od-studio-webagency@users.noreply.github.com>
devswha
added a commit
that referenced
this pull request
Oct 9, 2026
Release v0.4.3 (fixes). Stops before merge; the lead merges and releases. ## PRs since v0.4.2 #618 #613 #614 #628 #631 #635 #634 #623 #624 #625 #627 #632 #647 #646 #648 #658, plus #661 (docs, merged in). ## Changes in this PR - `version` 0.4.3 in package.json and herdr-plugin.toml. - CHANGELOG: Unreleased cut into `## [0.4.3] - 2026-10-09`, compare links updated. PR links and outside credits checked against `gh pr view --json author`: #618 @frankjoshua, #613 @Kinetic27, #614 @Haeminway1, #646 #658 @jiunshinn, #648 @od-studio-webagency. #627 (CI) and #647/#661 (docs) have no entry. - release-summaries.json 0.4.3: improved 2, fixed 8 in en/ko/ja/zh. The last fixed line tells existing installs to reinstall the plugin through herdr to get #648's Bun discovery (also stated in its CHANGELOG entry). - Remote bundle: `REMOTE_BUNDLE_VERSION` 22 -> 23. scripts/build-remote-bundle.ts ships server/ and shared/, and 19 files there changed since v0.4.2 (#618 #614 #628 #635 #634 #624 #625 #646 ...). `remote-v23` must be published on the merge commit before the app release. ## Checks - `bun run check fast` locally: 2009 pass, 0 fail. ## Whole-release review Codex (gpt-6.1-sol, xhigh) over v0.4.2..HEAD, output verified by hand. **No release blocker.** Two findings, both left as follow-ups: 1. *High (Codex) / pre-existing:* pending-message delivery (`dispatchPendingText`, server/index.ts ~646/652) calls `paneSendText`/`paneSendKeys` without the write-time guard #624 added to the WS paths. `authorizePending` runs synchronously just before, so a disconnect, role switch or revoke during the RPC's connect still lets the paste or Enter through. Verified: v0.4.2 had the same unguarded calls (lines 593/599), so this release does not regress it; #624 just did not extend to this path. Fix: pass a lease-aware guard to both RPCs, treat a cancel before the paste as unsent and one after it as uncertain, with tests at both connect boundaries. 2. *Medium:* a click replayed (#634) while a key RPC is queued for the pane takes the queued `input` path, so the mouse report goes out as literal `pane.send_text` bytes instead of through the attach. Verified in code: the click is only replayed when xterm's mouse tracking is on (`term.modes.mouseTrackingMode !== "none"`), so the program asked for the mouse, and queued typing and wheel reports already took this path in v0.4.2. #634 makes the window more common (arrows are now queued RPC keys). Fix needs attach-path ordering for queued mouse reports plus a click-while-key-pending regression; not small enough for a release PR. Known and accepted, not re-reported: #662, #629, #632 M-a residual.
jiunshinn
added a commit
to jiunshinn/herdr-web-ui
that referenced
this pull request
Oct 9, 2026
…o not squash) (#13) * chore(release): 0.4.3 (#664) Release v0.4.3 (fixes). Stops before merge; the lead merges and releases. ## PRs since v0.4.2 #618 #613 #614 #628 #631 #635 #634 #623 #624 #625 #627 #632 #647 #646 #648 #658, plus #661 (docs, merged in). ## Changes in this PR - `version` 0.4.3 in package.json and herdr-plugin.toml. - CHANGELOG: Unreleased cut into `## [0.4.3] - 2026-10-09`, compare links updated. PR links and outside credits checked against `gh pr view --json author`: #618 @frankjoshua, #613 @Kinetic27, #614 @Haeminway1, #646 #658 @jiunshinn, #648 @od-studio-webagency. #627 (CI) and #647/#661 (docs) have no entry. - release-summaries.json 0.4.3: improved 2, fixed 8 in en/ko/ja/zh. The last fixed line tells existing installs to reinstall the plugin through herdr to get #648's Bun discovery (also stated in its CHANGELOG entry). - Remote bundle: `REMOTE_BUNDLE_VERSION` 22 -> 23. scripts/build-remote-bundle.ts ships server/ and shared/, and 19 files there changed since v0.4.2 (#618 #614 #628 #635 #634 #624 #625 #646 ...). `remote-v23` must be published on the merge commit before the app release. ## Checks - `bun run check fast` locally: 2009 pass, 0 fail. ## Whole-release review Codex (gpt-6.1-sol, xhigh) over v0.4.2..HEAD, output verified by hand. **No release blocker.** Two findings, both left as follow-ups: 1. *High (Codex) / pre-existing:* pending-message delivery (`dispatchPendingText`, server/index.ts ~646/652) calls `paneSendText`/`paneSendKeys` without the write-time guard #624 added to the WS paths. `authorizePending` runs synchronously just before, so a disconnect, role switch or revoke during the RPC's connect still lets the paste or Enter through. Verified: v0.4.2 had the same unguarded calls (lines 593/599), so this release does not regress it; #624 just did not extend to this path. Fix: pass a lease-aware guard to both RPCs, treat a cancel before the paste as unsent and one after it as uncertain, with tests at both connect boundaries. 2. *Medium:* a click replayed (#634) while a key RPC is queued for the pane takes the queued `input` path, so the mouse report goes out as literal `pane.send_text` bytes instead of through the attach. Verified in code: the click is only replayed when xterm's mouse tracking is on (`term.modes.mouseTrackingMode !== "none"`), so the program asked for the mouse, and queued typing and wheel reports already took this path in v0.4.2. #634 makes the window more common (arrows are now queued RPC keys). Fix needs attach-path ordering for queued mouse reports plus a click-while-key-pending regression; not small enough for a release PR. Known and accepted, not re-reported: #662, #629, #632 M-a residual. * test(terminal): separate latency diagnostics from delivery assertions (#678) ## Change Closes #668. Remove the shared-runner-sensitive 150 ms assertion while preserving p50/p95/max latency output, bounded delivery waits, ordered autorepeat delivery, exact burst bytes and mouse checks. This changes the CI criterion, not terminal behavior; no user-facing changelog entry is needed. ## Validation On the combined verification checkout: `bun run check fast` passed (2,034 passed, 7 skipped), and the isolated `terminal-arrows-clicks-regression.ts` passed. Observed held-arrow p50 2.1 ms, p95 70.8 ms, max 103.0 ms; the 200-arrow burst arrived in order in 55.1 ms. Full `ui-regression.ts` also passed. CI verifies this PR's exact revision. * fix(chat): refuse immediate sends over Claude input drafts (#677) ## Change Closes #629. Immediate Claude Chat Send reuses the queued-delivery input-box check. Existing drafts, bash mode and clipped boxes return the existing `input_draft` error without typing, preserving composer text. Empty inputs and non-Claude/terminal paths are retained. The pre-read is not atomic with herdr's paste; input typed in that interval can still race. ## Validation On a verification checkout combining this change with #668 and reconciled #649/#650: - `bun run check fast`: 2,034 unit tests passed, 7 skipped; workflow syntax, generated types, typecheck and build passed. - Isolated `server/submit.contract.test.ts`: 34 passed. - xterm disposal, terminal arrows/clicks, and full `scripts/ui-regression.ts` passed. Tests used owned temporary state and isolated herdr sessions, not user terminals. CI on this PR verifies its own exact revision. * fix(terminal): dispose xterm after pending render callbacks (#649) ## Change Closes #638 - 소켓·리스너 정리와 입력 차단, 이전 DOM 분리는 즉시 수행합니다. - renderer disposal만 이미 예약된 frame과 task 뒤로 미루고, 늦은 write callback은 ACK 후 종료된 terminal을 건드리지 않습니다. - 실제 patched xterm 브라우저 재현을 CI에 등록합니다. ## Validation 타입·빌드·생성 타입 검사와 전체 단위 1932 통과·33 생략·0 실패. 실제 xterm의 동일한 open/reset 시나리오를 브라우저에서 실행했습니다. ```text Immediate: Cannot read properties of undefined (reading 'dimensions') Deferred: errors=[], disposed=1 ``` 결정론적 scheduler 테스트 4개도 통과했습니다. 테스트는 소유한 브라우저만 사용하며 사용자 terminal에 접근하지 않습니다. 모든 검증은 별도 작업 공간과 소유한 테스트/demo 환경에서 수행했습니다. 사용자의 실행 중 앱·terminal은 변경하지 않았습니다. Co-authored-by: studiood <253281802+od-studio-webagency@users.noreply.github.com> Co-authored-by: Hako <devswha@gmail.com> * fix(codex): resolve short sessions without guessing by recency (#650) ## Change Closes #639 - 기존 경로·열린 파일·긴 답변 매칭으로 확인되지 않는 경우에만, 프로세스 시작 이후의 유일한 interactive thread와 전체 첫 프롬프트를 대조합니다. - 누락된 후보도 모호성에 포함하고 cwd 최신 파일 추측이나 지속적인 잘못된 binding을 만들지 않습니다. - 디렉터리 없는 AGENTS 주입 형식도 숨기되 유사한 사용자 문장은 유지합니다. 최신 CODEX_HOME·PID·Windows 경로 보호는 보존했습니다. ## Validation 생성 타입·타입·빌드·전체 단위 검사 통과(1975 tests, 0 failures). Codex/process 관련 집중 실행은 92 통과·기존 Linux 전용 3 생략·0 실패였습니다. 임시 SQLite/rollout과 자체 프로세스·소켓으로 초/밀리초 schema, Windows cwd, 32개를 넘는 후보, unreadable 후보, exec/subagent 제외 및 화면 증거 소실을 검증했습니다. 실제 사용자 Codex나 유료 모델은 실행하지 않았습니다. 모든 검증은 별도 작업 공간과 소유한 테스트/demo 환경에서 수행했습니다. 사용자의 실행 중 앱·terminal은 변경하지 않았습니다. --------- Co-authored-by: studiood <253281802+od-studio-webagency@users.noreply.github.com> Co-authored-by: Hako <devswha@gmail.com> * feat(telemetry): keep the country an event came from (#663) ## What The telemetry receiver stores the country a request came from beside each install/update event: the two characters Cloudflare works out (`request.cf.country`, such as `KR`), and nothing finer (no city, region, network or address). Rows from before stay `NULL`. The sender (`server/telemetry.ts`) and the message are unchanged. ## Wording that changed with it - The one-time notice no longer says "Nothing else"; it says the receiver also notes the country, never the address. - Settings → About → Anonymous usage counts: the description says the same, and a line under **What is sent** states that the receiver adds the country, since it is not part of the message shown there. - `docs/guide.md`, `telemetry/README.md`, `shared/telemetry.ts`, `telemetry/schema.sql` and the Worker's header. - ko / ja / zh translations for the changed and new strings. ## Decisions (maintainer) - **The notice is not shown again.** Installs that already saw the one-time notice keep their acknowledgement; the change is told through the changelog, the guide and Settings → About. - **Deploy order.** The live D1 table gets `ALTER TABLE events ADD COLUMN country TEXT` before `wrangler deploy`; the other order makes every INSERT fail. `telemetry/worker.test.ts` runs both orders against SQLite. ## Review Codex adversarial review: Tor (`T1`) and unknown (`XX`) markers are stored as no country, the README's country query counts an install once, the guide's opening sentence was corrected, and the receiver's tests run against the real schema (b2fac4a). ## Checks `bun run check fast` passes locally (2019 tests, 0 fail). `telemetry/worker.test.ts` covers: country stored, finer `cf` fields never stored, a missing or malformed country stored as `NULL`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(prompt): a Claude approval is a card while background agents run (#659) ## Change A follow-up to #614. While background agents run, Claude Code 2.1.29x ends an approval's hint with the chord that stops them: ``` Do you want to proceed? 1. Yes ❯ 2. Yes, and don't ask again for: … 3. No Esc to cancel · ctrl+x ctrl+k twice to stop background agents ``` The approval is often a subagent's (`Bash command · from the general-purpose agent`). `parseClaudeApproval` reads it, but the tail check takes only a bare `Esc to cancel` (#614), so the pane falls to the numbered fallback card, which answers by typing the option's number. The tail check now takes a hint that starts with `Esc to cancel`. ## Validation - `server/prompt.test.ts`: a test with that screen shape; 225 pass. - `bun run generate:types --check`, `bun run typecheck`, `bun run build` pass. `bun run test:unit`: 1994 pass, 1 fail (`voice transcribe > streams deltas and the done text from a split SSE answer`), which fails the same way on `main` here. - CHANGELOG line under `### Fixed`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Hako <devswha@gmail.com> * fix(ui): show one decimal for a size under 10 MB (#670) ## Change Split out of #429, as asked in its review. `formatBytes` (`src/lib/bridgeProgress.ts`) rounded megabytes to a whole number. A 1.3 MB file read as 1 MB, and the file viewer's note for a file cut short said "Showing the first 256 KB of 1 MB". Below 10 MB it now keeps one decimal (`1.3 MB`). A whole number keeps none (`2 MB`), and 10 MB and up stay whole. The Files list (`src/components/DirectoryBrowser.tsx`) and the bridge update's progress use the same function, so their sizes change the same way. ## Validation - `bun run typecheck` and `bun run build` pass. - `bun run test:unit`: 2009 pass, 0 fail, with new cases in `src/lib/bridgeProgress.test.ts`. --------- Co-authored-by: Hako <devswha@gmail.com> * fix(settings): keep slow history traversal ownership (#630) ## What was wrong Settings forgot ownership of its own history traversal after a 1000 ms deadline. A delayed landing was then treated as the user's Back, so the key bar editor could close during width changes. If no landing arrived, reconciliation issued another traversal every second. ## What changed - Keep the pending destination after the deadline and recognize its late landing as the module's own. - Do not automatically retry an unanswered traversal or issue another from its unchanged source entry. Reconcile the latest requested Settings levels when the traversal lands. - Add deterministic stack-history and clock tests without a DOM or real sleeps. - Wait for Voice's status-dependent key form before measuring it. Extend demo geometry checks to ko/ja/zh at 320px and the key bar editor. The nearest-card comparison already existed at b82584d. The production history change is 15 added and 7 removed lines. There is no App listener change, contract change, new fixture, or history-module redesign. ## Reproduction on b82584d Before editing production code: ```text $ HERDR_TEST_MODE=unit bun test ./src/lib/settingsHistory.test.ts REPRO A: markerless popstate closes Settings; cleanup requests no traversal; Back restores depth 3 (fail) history traversal races > keeps a late width-change traversal its own after the landing deadline Expected: [true] Received: [false] (fail) history traversal races > does not retry a traversal every second when no landing arrives Expected length: 1 Received length: 11 8 pass 2 fail ``` The baseline transcript is retained locally in `/tmp/tri-client3-564-baseline.log`. `settingsHistory.test.ts` already existed on the baseline; the reproduction cases were added there. ## Remaining from #564 Part A is reproduced and intentionally left. `src/App.tsx:237-242` closes Settings on every non-own markerless landing. `src/lib/settingsHistory.ts:43-50` cannot distinguish a base entry from another markerless entry, and reconciliation at `src/lib/settingsHistory.ts:81-90` derives the held depth solely from that marker. A real Back to the base and a new fragment entry therefore carry the same observable markerless state. Ignoring all markerless events would break normal dialog Back; stepping over all of them could leave the app on a legitimate Back. Correct cleanup needs explicit base/entry identity, which is the redesign excluded from this assignment. The characterization test preserves evidence of the unresolved behavior instead of claiming it is fixed. For C, the original nearest-card allegation is not confirmed: it already used `.closest(".settings-card")`. Voice readiness, localized pages and key-bar geometry are covered by this change. No translation or demo fixture changes are needed. Refs #564 * fix(a11y): the terminal announces its pane (#633) ## Summary The terminal is the product's central surface, and it is invisible to a screen reader: xterm draws the screen to a canvas, so a reader reaching it found an unnamed control. Its host element is now a labelled `role="region"` (`aria-roledescription="terminal"`) named after the pane — **"Terminal for Idempotent payments"** — so a reader names the pane before its content. This is the A1 half of the 2026-10-06 audit that rode in #569, which closed on the access-gate decision rather than this code. You asked for the pieces that do not change the default on their own, and this is one of them: two attributes and a translated string. - No `tabIndex`: xterm's helper textarea takes the keyboard here on attach, so a stop on the wrapper would only be an empty one ahead of it. - The label falls back to the pane id while a pane has no title, and to "Terminal" while no pane is attached. - `screenReaderMode` stays out of scope. The bundled xterm patch's Gboard backspace guard is disabled while that mode is on, so it is its own investigation rather than a flag flip. ## Test plan - [x] `HERDR_TEST_MODE=unit bun run check fast` on `upstream/main` — typecheck, build and the unit suite green (1928 pass, 6 skip, 0 fail) - [x] `src/lib/i18n.test.ts` — the new `t("Terminal for {title}")` key is present in ko, ja and zh - [x] Browser check on the demo harness, run as a throwaway and **kept out of the tree** per your earlier note that `scripts/` sits outside typecheck and CI. With the fix the host reads `hasRegion: true, roledescription: "terminal", accessibleName: "Terminal for Idempotent payments"`, no page errors, and the label persists across a workspace open. Reverting only the host attributes makes the same check fail — `hasRegion: false, label: null` — so it discriminates rather than passing on any non-empty constant. - [ ] CI: Fast checks, Integration and browser — awaiting approval for the fork run Rebased onto current `main` (v0.4.2) and merges cleanly. No endpoint, frame or contract change. --------- Co-authored-by: radicor <211192474+radicor@users.noreply.github.com> Co-authored-by: Hako <devswha@gmail.com> * feat(chat): fuzzy-match slash commands beyond the prefix (#617) ## Change The composer's `/` (and `$`) list only matched the start of a command's name, so a plugin or skill named `superpowers:brainstorming` needed its namespace typed first. `rankSlashCommands` (`src/lib/compose.ts`) now ranks by kind of match: 1. name starts with the query (as before) 2. a word of the name starts with it (words split on `: - _ . /`) 3. the name contains it 4. its letters appear in order (`spbr`) 5. the description contains it (query of 2+ characters) Within a kind, the most-used commands come first, then name order. A better kind of match always beats a more frequently used one; an empty query still lists everything. ## Validation - `bun run typecheck`, unit tests (`src/lib/compose.test.ts` has the new ranking test; 811 pass on a branch that also holds #616). - Not tried by hand in the composer; matched letters are not highlighted. --------- Co-authored-by: radicor <211192474+radicor@users.noreply.github.com> Co-authored-by: Hako <devswha@gmail.com> * feat(voice): choose the dictation language, auto from the browser (#612) ## Change Closes #611. Dictation used to listen only in the UI language. The UI exists in English, Korean, Japanese and Chinese, so a Hungarian or German speaker got an English UI, and their speech was recognized as English. - A new setting, **Settings → Voice input → Dictation language** (`voiceLanguage`, default `auto`), appears while the microphone button is not Off. - **Auto** behaves as before, with one exception. When the UI language is System and the browser's first language is not English, Korean, Japanese or Chinese, Auto uses that tag (`navigator.languages[0]`, e.g. `hu-HU`). In every other case it uses the UI language's locale, as today: `ko` and `ko-KR` → `ko-KR`, `en-GB` → `en-US`, `zh-TW` → `zh-CN`, and a UI language picked by hand. A malformed first tag (e.g. `*`) falls back to the UI language. - A language can also be picked from `DICTATION_LANGUAGES`, a list of 32 BCP 47 tags. Their names come from `Intl.DisplayNames` in the UI language, sorted by name. Someone who wants `en-GB` or `zh-TW` can choose it here. - Browser engine: `SpeechRecognition.lang` is the resolved tag. - Server engine: the form's `language` is the tag's two-letter subtag (`hu`). A tag without one (`fil-PH`) sends the UI language, so `server/voice.ts` and its `^[a-z]{2}$` check are unchanged. - `speechLang` is replaced by `dictationLocale` and `transcribeLanguage` (both pure, unit-tested). - `sanitizeSettings` accepts only `auto` or a tag from the list. - The three new UI strings have ko, ja and zh entries. I wrote them without a native speaker's check, so please correct them if they read wrong. - Also updated: `docs/guide.md#voice-input` and the `CHANGELOG.md` Unreleased section. ## Validation - `bun run check fast`: generated types fresh, typecheck, build, and unit tests (0 fail). - New unit tests cover: - `dictationLocale`: Auto keeps today's locale for every browser language the UI is translated into, takes the browser's tag for one it is not, and respects a hand-picked UI language and a chosen dictation language. - `transcribeLanguage`. - `sanitizeSettings` for `voiceLanguage`. - I compared the old and new Auto locale on `ko-KR`, `ko`, `en`, `en-GB`, `ja`, `zh-TW`, `zh-Hant-TW` and `en-US,ko`: they are identical. They differ only on `de-DE,ko-KR` (before `ko-KR`, now `de-DE`) and `hu-HU`, which are the intended changes. - I checked the UI in the demo built by `bun run build:site`, with `navigator.languages` set to `["hu-HU", "en-US"]`. The Voice input page shows **Dictation language** with **Auto (Hungarian (Hungary))** selected, followed by the named list. A screenshot is in the first comment. The row's description has been reworded since that screenshot. - I did not run `bun run check full`, because the change touches neither herdr nor any HTTP/WS contract. I did not test live dictation in a real browser. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01HZmZBAnd4XuEHQUuHxPcQi --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: lyonbot <lyonbot@gmail.com> Co-authored-by: radicor <211192474+radicor@users.noreply.github.com> Co-authored-by: Hako <devswha@gmail.com> * fix(sidebar): draw the working arc thirty times a second, not five (#622) ## Change The sidebar's working arc turned with `steps(8, end)` over `--dur-pulse` — a pulse's 1600 ms. That is five 45° jumps a second, 200 ms apart. The icon is 16px across, so the arc's radius is 6px and each jump moves its ends about 4.7px: a working agent reads as a stutter, not as work in progress. The turn gets its own `--dur-spin` — a pulse period says how long a dot takes to come back, not how fast an arc should spin — and steps 48 times over the same 1600 ms: 33 ms and 7.5° apart, under a pixel of travel each. The arc, its size and the length of the turn are unchanged, and the animation keeps `steps()`, so `src/motion.test.ts` still holds. | before — `steps(8)` over `--dur-pulse` | after — `steps(48)` over `--dur-spin` | | --- | --- | |  |  | Both are 30 fps captures of the repo's own demo session — the client `scripts/demo-build.ts` builds, over the committed fixture transport, loopback only, with the demo's 4500 ms timer held so the turn stays running. They come from one page load, so the two differ in the one declaration under test and nothing else. The still is that session: [`demo-still.png`](https://raw.githubusercontent.com/iwangjie/herdr-web-ui/evidence/sidebar-working-arc/pr-evidence/demo-still.png). The recordings live on a branch of my fork, `evidence/sidebar-working-arc`, not in this branch. ## Validation - `bun run check fast`: green — generated types, typecheck, build, and the unit suite (1902 pass, 32 skip, 0 fail). The 3 `isolate` tests in `scripts/check.test.ts` need a TMPDIR whose socket path fits; this Mac's default is too long for it, and they fail the same way on `main`, so I ran the suite with `TMPDIR=/tmp`. - Frames the browser actually drew, counted with `Page.startScreencast` over the demo session, one page load, every variant twice and interleaved so a page that quiets down or speeds up hits each of them: | the arc's declaration | frames the browser drew | | --- | --- | | `animation: none` (the page's own damage) | 4.8/s | | `steps(8)` | 8.8/s | | `steps(48)` | 31.0/s | A stepped rotation draws its steps and nothing else, so this count is the frame rate: thirty a second, still a fraction of what the display refreshes, which is what the rule in `src/motion.test.ts` protects. - The two 30 fps recordings: 13 distinct frames per turn before, with 35 of the 48 slots repeating the frame before them; 47 after. - Sampled from the built stylesheet: 0 ms 0°, 33 ms 7.5°, 100 ms 22.5°, 200 ms 45°. Before it was 0 ms 0°, 200 ms 45°. ## Notes - `--dur-spin` is 1600 ms, the turn the arc always took. Only the number of frames it is drawn in changed, so nothing but the smoothness moves. - `UsageMeters.css` spins its own arc at `0.8s steps(8)`: 45° a step, ten a second. That one is behind a popover over a still page, so I left it alone; it has the same shape of problem if you want it in a follow-up. --------- Co-authored-by: Hako <devswha@gmail.com> * feat(pwa): name the installed app with HERDR_WEB_APP_NAME (#684) <!-- See CONTRIBUTING.md for checks, translations, contract tests and the changelog. --> ## Change Option 1 from #476. Each PC is its own origin, so two PCs installed on one phone are two apps, and both are called "herdr". When `HERDR_WEB_APP_NAME` is set (plugin `.env` or the environment, like the other settings), `server/static.ts` serves: - `/manifest.webmanifest` with `name` and `short_name` set to it. Every other field stays as built, `id` included, so the app's identity does not change. - the shell (`/`, unknown paths, `/index.html`) with `apple-mobile-web-app-title` set to it, HTML-escaped, so an iOS home-screen install gets the same label. Unset or blank, both are served byte for byte as built. Cache headers and the CSP are unchanged, and the manifest and shell already revalidate on every load, so an installed app picks the name up at the browser's next manifest update without a reinstall. Docs: a row in the guide's *Configuration* table, plus one sentence at the phone-install step. Changelog: one line under *Added*. There is no HTTP/WS contract change and no new endpoint. Static files are not proxied for remote PCs, so the remote bundle is not affected. Closes #476 ## Validation - `bun run check fast`: workflow syntax, generated types, typecheck and build pass. In the unit tests, 2044 pass and the same 18 fail in `server/codex-processes.test.ts` on this branch and on unmodified `main`: the fixture spawns `/bin/bash`, which this NixOS machine does not have (`ENOENT: posix_spawn '/bin/bash'`). Nothing else fails. - New `server/static.test.ts` (4 tests). It runs against the source `public/manifest.webmanifest` and `index.html`, so it also fails if someone renames or reshapes the meta tag later. It covers: unset or blank is off; the manifest is renamed and every other field kept; the shell changes only the meta; HTML escaping, including `$&`-style replacement patterns. - Built server, `HERDR_WEB_APP_NAME=midgard`: `/manifest.webmanifest?v=2` returned `name`/`short_name` `midgard`, `id` `/`, `Cache-Control: no-cache`, content type `application/manifest+json`. `/`, `/index.html` and an unknown path returned `content="midgard"`. `sw.js` was byte-identical. - Built server, variable unset: the manifest and `/` were byte-identical to `dist/`. - Not yet checked on a phone, so the rename of an app that is already installed is untested. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01HkqShU9QB6wV4SgX8JTxQB * feat(sidebar): a finger reorders workspaces with a long press and a drag (#679) ## Change On iOS (Safari and the home-screen PWA), a long press on a workspace row lifted the system's drag preview, but the HTML drag and drop it started never dropped on the page, so workspaces could not be reordered on a phone at all. - On a touch screen (`pointer: coarse`) the row's `draggable` is off, so the misleading preview no longer appears. - `src/lib/touchReorder.ts` handles the finger instead. A 400 ms press held within 8 px lifts the row (`.is-lifted`), it follows the finger, the list scrolls near its edges, and a 2px `--accent` line (`data-drop`) shows where it lands. Letting go uses the same `dropIndex` / `reorderWorkspace` path as the mouse drag, so worktree groups stay packed and a failed move rolls back. - A stroke that moves before the hold is still a scroll or a drawer swipe. Once a row is lifted, its moves never reach the drawer swipe (`lib/edgeSwipe.ts`, which the window-capture listener runs before), and the lift's touchend does not click the row. - The row's ⋯ menu gains **Move up** / **Move down**, shown only when the move is possible, with ko/ja/zh entries. - Desktop mouse drag and Alt+↑/↓ are unchanged. - DESIGN.md, docs/guide.md and the CHANGELOG (`Unreleased → Added`) are updated. ## Validation - `src/lib/touchReorder.test.ts` (new, unit) covers the hold slop, hit-testing between rows and past the ends, and the edge-scroll speed. - `scripts/workspace-touch-reorder-demo-regression.ts` (new, added to `ci-browser.sh`, with the `ci-browser.test.ts` count updated) runs the demo transport at 390×844 with `isMobile` + `hasTouch` and CDP touch events. It checks that: - rows are not `draggable` - a quick stroke lifts nothing - a long press + drag moves the first workspace after the third, both in the sidebar and in the server's order, with nothing left lifted and the drawer still open - ⋯ → Move up moves it back one step - Passed locally on this branch (based on `main` at 0.4.3): the demo regression, the new unit tests, `i18n.test.ts`, `motion.test.ts`, `ci-browser.test.ts`, `bun run build` and `bun run typecheck`. - The same change passed Fast checks, Integration and browser, and Native Windows install on my fork (jiunshinn/herdr-web-ui#9). - Tested by hand on an iPhone in the home-screen PWA: long-press, drag and drop reorder workspaces, and Move up/down works. 🤖 Generated with [Claude Code](https://claude.com/claude-code) * feat(chat): show a task list's boxes (#669) ## Change Split out of #429, as asked in its review: a task list in the chat. - A list item that starts with a GitHub task box (`- [x] done`, `- [ ] open`, `- [X]`) is parsed with its state (`ListItem.checked` in `src/lib/markdown.ts`). Anything else after the bullet (`[y]`, no space) stays text. - `src/components/Markdown.tsx` draws a checked or empty box in place of the bullet instead of the brackets: - The box is not clickable, because the agent's text owns the state. - It is a drawn `<span role="checkbox" aria-checked aria-disabled>`, labelled by the item's text, so a screen reader says "done, checkbox, checked". A disabled `<input>` would be greyed by the browser and ignore the accent. - Styles are in `src/components/ChatView.css` (`.markdown-task*`), tokens only. `DESIGN.md` describes it. - A file viewer's Markdown preview (#429) uses the same renderer, so it gets the boxes too once both have landed. ## Validation - `bun run typecheck` and `bun run build` pass. - `bun run test:unit`: 2010 pass, 0 fail. The new test in `src/lib/markdown.test.ts` covers the parse (checked, open, `[X]`, an empty item, `[y]` as text) and the rendered markup, including the box's label. ## Screenshots <img width="1736" height="286" alt="image" src="https://github.com/user-attachments/assets/3af005cd-4d25-40f8-a583-313bb7269e80" /> <img width="1736" height="286" alt="image" src="https://github.com/user-attachments/assets/e2ac698a-0db2-408e-9117-eb601b0f6e5c" /> * fix(terminal): a tab you are not using lets go of the pane, so herdr's TUI shows it whole (#660) > Builds on #658: the first commit on this branch is #658's (rebased on today's `main`), because this change edits the focus handling #658 adds. Please review the second commit, `74c0350`. I'll rebase this onto `main` once #658 is in. ## Change <img width="1707" height="1016" alt="Screenshot 2026-10-09 at 14 58 10" src="https://github.com/user-attachments/assets/20bfbaea-0dee-4332-87f3-d3c4f267971e" /> **Problem.** While a desktop web UI tab has a pane open, herdr's own TUI (in Ghostty here) shows that pane cut off at its split's edge, with the bottom rows (the prompt box) out of reach, even after scrolling. It lasts as long as the tab stays open. A phone does not do this. **Cause.** The bridge keeps a `herdr terminal attach` on every pane a tab shows. While an attach is connected, herdr 0.9.3 holds the pane at that attach's size, and its own TUI cannot resize it (herdrdev/herdr#5006, herdrdev/herdr#985: `direct_attach_resize_lock`). A desktop tab left open kept the pane at the browser's size (219x72 in my case) while the TUI's split was 51 columns. A phone hides this: it disconnects in the background, and its grid is narrower than the split. #658 stops a background tab from *taking* the size again, but it does not *give it back*. Measured in a throwaway herdr session with a real TUI client: a split pane at 44x37 became 150x50 while an attach was connected, and returned to 44x37 the moment the attach ended. The layout `rect` includes the border (a 47x39 rect was a 44x37 pty), so the TUI's size cannot be computed and handed back through the API. Ending the attach is the only way back. **Fix.** - A tab out of use (window blurred or hidden) for `RELEASE_AFTER_MS` (1 s) detaches its pane. The attach ends with the pane's last client, and herdr restores its TUI's size. The terminal lens shows "Paused while you use another window". - On focus, or on any pointerdown, the tab attaches again at its own size. The screen restarts from the new attach, as on a pane switch. - The tab keeps the pane while a message it queued waits for delivery (that goes through its attach), and lets go once the message is out. It never releases a mirrored pane (no attach to give back) or an embedded page (the site's demo iframe, which has the focus only while clicked into). - A pane switch while released attaches nothing until the user is back. The cleanup still detaches whichever pane is attached at the next switch. - `HerdrSocket.resize` sends nothing for a pane the socket is not attached to: the server would apply it to the holder's attach. - No protocol change. The demo transport already replays a pane's screen on every attach. Trade-off: a desktop window that is visible but not focused (e.g. on a second monitor) stops updating until it is clicked. ## Validation - `scripts/chat-size-regression.ts` `checkBackgroundTabKeepsTerminalSize`, rewritten for the new behavior. A window out of use sends no resize, then detaches and shows the paused banner. A background reconnect attaches nothing. Once the phone leaves too, no `herdr terminal attach` runs for the pane. Focus attaches again at the window's size. It fails on the old client (no detach) and passes with this change, as do `checkChatKeepsTerminalSize` and `checkPaneSwitchKeepsTerminalSize` (run against a `bun run check run` herdr). - `src/lib/ws.test.ts`: no resize and no reconnect attach for a pane the socket let go of. - End to end, with a real herdr TUI client on a throwaway session, `stty size` in the pane: TUI only `37 44` → browser tab in use `47 120` → user back in the TUI `37 44` → back in the browser `47 120`. - Typecheck, build and `bun run test:unit` on this branch. The only failures are 3 `isolate` tests in `scripts/check.test.ts`, which also fail on an unchanged `main` on my Mac (herdr socket path too long under the macOS temp dir), and 3 `server/prompt.test.ts` timing failures under full-suite load that pass alone (217/217, twice). - New string translated in `i18n.ko.ts`, `i18n.ja.ts` and `i18n.zh.ts`. `CHANGELOG.md` has an `[Unreleased]` entry, and `src/AGENTS.md` and `server/AGENTS.md` record the attach lock. - I have been running this from my fork (herdr 0.9.3, macOS, Ghostty) since today: the TUI pane comes back whole a second after leaving the browser. --------- Co-authored-by: Hako <devswha@gmail.com> * feat(chat): show Claude Code subagents as background tasks (#527) ## What A Claude Code pane's subagents (the `Agent` tool) were invisible in the chat: - **The call:** a collapsed work row whose output is only "Async agent launched successfully…". - **The finish:** the `<task-notification>` that carries the agent's answer was hidden on purpose. - **Running agents:** shown only in the terminal footer (`◯ reviewer Review … 4m 6s · ↓ 57k tokens`). This PR reuses OmO's background-task UI for them instead of adding new UI: - **Status line list:** `GET /api/pane/omo-tasks` lists a Claude pane's subagents. Each row shows type, description, model, elapsed time, turns, tool calls and tokens. The title falls back from the description to the teammate name, agent type and id. The list holds the running ones, then the newest ten that ended in the last day, the same rule as OmO's list. An agent is `lost` once the pane no longer runs that session, or when it was last written more than 60 s before the pane's current Claude process started (an agent orphaned by an exit, then `--continue`). - **Badge and count:** the pane's `background_tasks` counts the running ones. It is set in the snapshot and pushed in a `pane-status` frame that keeps the pane's status and sends no alert or web push. - **Result card:** an agent's task notification becomes a `task_result` card in the chat, showing title, agent type, status and the answer, cut at the existing 16,000-character limit. A notification is counted once, though Claude records it up to three times: a user entry, a `queue-operation` and a `queued_command` attachment. A notification that shares a user entry with a tool's result is drawn as well. Background Bash notifications stay hidden as before. - **Docs:** `server/AGENTS.md` described a `taskNotice` that does not exist on main; that row now describes this code. CHANGELOG, DESIGN.md and docs/guide.md are updated. ## Where the data comes from (Claude Code 2.1.29x) - `<config>/projects/<project>/<session>/subagents/agent-<id>.meta.json`: `agentType`, `description`, `toolUseId`. - `agent-<id>.jsonl`: the subagent's own transcript. It gives the model, turns, tool calls and tokens. Tokens are the last entry's input + cache + output, which matches the `totalTokens` Claude reports for a finished agent. - The parent transcript: `<task-notification>` blocks (status and result), and for a synchronous agent the `tool_result` of its call. An "Async agent launched" acknowledgement is never taken for an answer. - Agent-team teammates get no notification and no `toolUseId`. An agent whose own file ends with an assistant entry that stopped with `end_turn`, and has no user entry after it, has ended at that entry's time. The newest of notification, answer and end of turn wins. An agent resumed after it ended reads as running again once its own file has newer entries. - An agent's status, last write and start come from the last and first 64 KB of its file, outside the read budget, so a large session reads right on the first call. What it did (model, turns, tool calls, tokens) is filled in once its whole file has been read. An agent whose end cannot be told yet is left out rather than shown as running. ## Cost and safety - **Polling:** a 2 s poller reads only Claude panes, and skips a pane whose `subagents/` mtime, parent size and the mtimes of the ended agents it watches are unchanged. - **Read limits:** files are read incrementally from their last offset, with an 8 MB per-call budget. The first parent read covers its newest 16 MB window in full, so the first answer is already right. A line longer than the budget is skipped only to its next newline. Caches evict one entry at a time. - **Paths:** agent ids are checked against `/^[A-Za-z0-9_-]+$/` wherever an id becomes a path. On a page, ids come only from parsed notifications, never from tool output. Final-component symlinks are refused. - **Request time:** `/api/pane/omo-tasks` waits at most 1 s for a pane it has not resolved yet, then answers with what it knows. The client asks again when the count changes, and asks an empty answer again up to three times, 3 s apart, so that agents which ended before the lookup finished are still found. - **Cards:** they depend only on the transcript bytes plus the meta file, which does not change after launch. A cached page and a cold read therefore agree. ## Tests - **`server/claude-subagents.test.ts` (new), covering:** - running, completed, failed and cancelled; - the three carriers of one notification counted once; - an agent resumed after its notification, and with only its own file writing; - synchronous answers, and a launch acknowledgement that is not an answer; - a teammate ended by its own `end_turn`, then messaged again, and status from the file's tail before the whole file is read; - lost by session, and lost by process start (60 s slack); - the ten-ended and one-day limits; - read budgets: a leftover smaller than a line, a 9 MB line, a 10 MB line before a 7 MB notification, a starved file; - the 16 MB window, a 30 MB append, traversal ids, a torn meta; - `/clear` to a session with no agents, and pid changes. - **`server/conversation.test.ts`:** an agent notification becomes one card and a Bash notification stays hidden. A notification that shares an entry with a tool's result becomes one card too. A notice quoted inside a tool result is ignored. Cards stay the same when the subagent file grows. - **`server/claude-session.contract.test.ts` (live herdr):** the list from `/api/pane/omo-tasks`, the snapshot count going 1 then 0, a count-only `pane-status` frame with the pane's own status, and no web push for it. ``` bun run typecheck ✓ bun run generate:types --check ✓ bun scripts/ci-tests.ts unit 1518 pass, 0 fail bun scripts/ci-tests.ts integration 226 pass, 0 fail, 6 skip (macOS) bun scripts/ui-regression.ts 76 PASS ``` Checked on a live server (macOS, Claude Code 2.1.290): - A real 27 MB session transcript with six subagents. The list was right from the first read, with running and finished agents told apart, and later reads took 0 ms. - A pane that read nine agents as running before the end-of-turn and tail fixes, all of them idle teammates or ended agents, now counts 0. - A subagent started for the check made the pane's count go from 1 to 0. Its row went from running to completed, with model, turns, tool calls and tokens. 🤖 Assisted by [kilhyeonjun-harness](https://github.com/kilhyeonjun/kilhyeonjun-harness) --------- Co-authored-by: Hako <devswha@gmail.com> * feat(chat): highlight code blocks by their language (#671) ## Change Split out of #429, as asked in its review: syntax highlighting for code blocks in the chat. #429's file viewer is rebuilt on top of this PR. - **Highlighter.** A fenced block is colored by role with [TanStack Highlight](https://github.com/TanStack/highlight) (`@tanstack/highlight` 1.0). `src/lib/highlight.ts` maps a fence word to one of 28 registered languages. Tokens render as React spans with no `innerHTML`. The colors are `--syntax-*` tokens for every palette (`src/styles.css`, table in `DESIGN.md`). - **Nothing a reply holds can freeze the page.** TanStack is quadratic on some shapes: a line of dashes in YAML takes 3.8 s at 64 KB. - Only code up to 2 KB is highlighted while the page draws. The worst shape measured at that size takes under 5 ms. - Longer code is highlighted in a worker (`src/lib/highlightOffThread.ts` on `src/lib/offThread.ts`). It shows plain until the worker answers. - A worker that runs past 2 s is ended and replaced. Its block stays plain with "Too long to highlight" under it. - A block over 100 KB is not tried. - A block over 20 000 lines (`LINE_ELEMENT_LIMIT`) is drawn as one text, as on `main`, and not highlighted. Each line is an element of its own, and in Chromium 256 KB of line breaks (262 144 lines) held the page for 4 s. - While a reply grows, it keeps its colors and only its new end shows plain until highlighted. - **Copy.** The text of the `<pre>` is the code itself: lines are inline spans joined by `\n`, so a copied selection keeps blank lines. - **Setting.** **Settings → Chat → Highlight code** turns it off. The code is then plain, with no "too long" note. - **Bundle.** Against `main` (gzip -6) the main script grows by 13.0 KB, from 359.8 KB to 372.8 KB. The worker chunk (11.3 KB) loads on first use. ## Validation - `bun run typecheck` and `bun run build` pass. `bun install --frozen-lockfile` passes on the committed `bun.lock`. - `bun run test:unit`: 2077 pass, 0 fail (on `main` at `3a0254e`). - `src/lib/highlight.test.ts` covers roles across lines, CRLF, blank lines, the sync limit and failure. - `src/lib/offThread.test.ts` runs real Bun workers: budget, termination and replacement, cancel, and a failed spawn. - Browser, `bun run check run bun scripts/<script>.ts` in Chromium: - `file-viewer-regression`: 16 PASS. Long tasks are recorded from the first paint. It now also checks that a 30 000-line block opens with Show all as one text with no task of a second, that chat code is highlighted, keeps its blank line, that a 90 KB YAML block the highlighter is slow on stays plain with its note while the others are colored, and that Highlight code off leaves the chat plain. - `settings-pages-demo-regression` 7 PASS, `chat-history-browser-qa` 6 PASS, `math-browser-qa` OK, `file-viewer-mobile-regression` 16 PASS. - `ui-regression`: 78 PASS, then it stops at the startup prompt card ("1. Yes, continue") in my container, the same as on `main`. ## Screenshots <img width="1640" height="664" alt="image" src="https://github.com/user-attachments/assets/17990018-7d70-4a48-a6b1-13ad2e4b75a3" /> <img width="1640" height="664" alt="image" src="https://github.com/user-attachments/assets/09581af7-d10a-4c15-9477-f8453a19e0e7" /> <img width="780" height="1688" alt="image" src="https://github.com/user-attachments/assets/b97430e3-d149-4879-a543-2a1210279bd1" /> * fix(status): hold a Claude turn that ended on its background work (#534) > Stacked on #533 (step detail), which is stacked on #531 and #527. Please review only the last commit: **fix(status): hold a Claude turn that ended on its background work**. > Rebased onto #520/#521: BG is a read-only word in the composer, hidden like every other state word since #520; in the sidebar's compact cell it is the running arc held still, in the working colour; and the roll-up is blocked, done, working, BG, ready, after herdr's order (#521). Sending, queueing and Stop, #520's queue of pending messages included, still go by the agent's own status. ## Problem A Claude Code turn can end while work it started is still running in the background, such as a test suite run with `run_in_background` or a background subagent. Claude says something like "the suite is running; I'll ship when it's done", and when the work's `<task-notification>` arrives it starts the next turn on its own. herdr reads the end of that turn as `idle`, or `done` while nobody has looked. So the sidebar and the composer said **DONE** and push sent "work finished", while the work kept going. Seen live: a pane read DONE for about 6 minutes while its suite ran. That suite had been started by a subagent, so its launch was only in the subagent's transcript, and the status line counted no running subagent. ## What changes - **Background commands are counted with subagents.** A `Bash` call whose answer carries `toolUseResult.backgroundTaskId` is a background command. That covers `run_in_background`, Ctrl+B, and commands moved to the background by their timeout, whether the session or a subagent ran them. - It ends with its notice (in any transcript of the session) or with a `TaskStop` answer (`KillShell` in older Claude Code). No notice follows a `TaskStop`. - It is lost when it was started before the pane's Claude process. - These commands join the status line's list (category `shell`) and the pane's count. - **A pane at rest whose turn's work still runs reads BG.** - "The turn's work" means what started at or after the person's last prompt, read from the transcript: `origin.kind: "human"`, or only a `permissionMode` in older Claude Code. The turn that a notice starts is not a new prompt, so the work of the original turn still counts after it resumes. A dev server started in an earlier turn holds nothing. - Such a pane carries `background_wait: true` on every `pane-status` frame and in the snapshot. A missing flag means it is not waiting. - The sidebar's workspace and agent rows, the palette and the tab dot say **BG** instead of DONE or READY, and the composer's hidden state word reads BG to assistive tech. The composer still uses the agent's own status for send, queue and Stop, because Claude takes input while it waits. - **Alerts see a waiting pane as working.** `alertStatus` in `shared/notify-policy.ts` applies to push, its seed and resync, the remote-PC relay, and the browser's tab alerts and droplet. - herdr reports the turn a notice starts as `working` about 2 s after the work ends (live log below). Push sees `working` → `working`, so the turn's start is kept, and the finish is alerted once, when that turn ends, with the whole span as its length. - **Bounds:** - **Grace:** a pane is still held for 60 s after its turn's work ends, in case Claude goes on with the notice. - **Limit:** a pane is held for at most 30 min from when it came to rest. Nothing in the transcript tells a turn waiting on its suite from one that left a server running, so a turn that only started a server reads BG for up to 30 min before its finish alert. - **When a turn ends, the status event reads the pane's files first**, while the pane is still taken for working, and sends one frame with all of it. So no frame says the pane finished first, and work that ended before the turn did holds nothing. Live check that herdr reports a resumed turn: a Claude pane with `sleep 35` in the background. ``` 06:45:31 working 06:45:36 done ← the turn ended on the sleep (bg=0 before this change) 06:46:08 working ← its notice started the next turn, ~2 s after the sleep ended 06:46:12 done ``` ## Tests - **`server/claude-subagents.test.ts`:** - A command found with no `subagents/` folder. - Ends by notice (completed, failed, killed → cancelled), by `TaskStop`, and by `KillShell`. - A subagent's command, ended in its own file or by the session's notice. - Lost with the process. - `turnRunning` across a typed prompt, a notice's turn, an older prompt with no `origin`, a queued prompt, another session's message and an interruption. - `onChange` firing when either count changes. - **`server/background-wait.test.ts`:** - Held and released by a resume. - The grace, the limit, and work that ended before the turn. - A snapshot only filling a gap. - `forget`. - **`server/claude-session.contract.test.ts`** (real herdr, Claude stand-in): - The launch is written as the turn ends, and every frame at rest carries the flag. - No alert goes out while the pane waits. - With a "long turns only" device, exactly one "work finished" goes out for a resume whose own turn is short, so the whole span counted. - A wait that ends with no resume sends one frame without the flag and one alert. - Breaking the alert rule in `onStatus` fails both tests. - **Client:** `alertStatus`, `paneStatus` with the rollup, composer words, `paneAfterStatus`. - **`scripts/ui-regression.ts`:** a waiting pane reads BG in the sidebar's agent row (the arc, held still) and in the composer's hidden word, and its own status again after the wait. ``` bun run typecheck ✓ bun run generate:types --check ✓ bun scripts/ci-tests.ts unit 1567 pass, 0 fail bun scripts/ci-tests.ts integration 229 pass, 0 fail, 6 skip (macOS) bun scripts/ui-regression.ts 79 PASS ``` Reading cost: a cold read of a real 43 MB Claude Code transcript takes 130 ms. Parent lines are parsed only when they can hold a launch, an end, a notice or a prompt. ## Not covered - **Monitor tasks.** Their notices are events with no status, and a persistent monitor runs for the whole session. - **OmO and Codex panes.** OmO counts its own tasks, and Codex does not resume when background work ends. - **herdr's own TUI**, which is another project. 🤖 Assisted by [kilhyeonjun-harness](https://github.com/kilhyeonjun/kilhyeonjun-harness) --------- Co-authored-by: Hako <devswha@gmail.com> * fix(worktree): start a worktree asked from a linked checkout at the repository's workspace (#685) ## Problem **New worktree** and **Open worktree…** could fail in the web UI with herdr's own message: > New and open worktree actions start from the repo parent workspace. herdr starts a worktree only from the workspace on the repository's main checkout (`linked_worktree_source` otherwise). The sidebar hides both menu items on a worktree row, but it can only tell from `workspace.worktree.is_linked_worktree`, and herdr sets that only on a workspace whose checkout it opened itself. A plain workspace opened on a folder that is a git worktree carries no `worktree` info, so the row offers the actions and herdr refuses them. Measured on herdr 0.9.3 in an isolated session: | workspace | `worktree` in `workspace.list` | `worktree.create` | |---|---|---| | on the main checkout | absent until its first worktree | created | | plain, on a linked checkout | absent | `linked_worktree_source` | `worktree.list` asked from the linked workspace does name the repository's workspace in `source.source_workspace_id` (absent when that workspace is not open). ## Fix `POST /api/worktree/create` and `/api/worktree/open`: when herdr answers `linked_worktree_source`, the server reads `worktree.list` for the asked workspace and sends the same request to `source_workspace_id`. With no such workspace open, or when the listing fails, herdr's original refusal is returned unchanged. The normal path makes no extra RPC. No wire shape changes, so `shared/protocol.ts` and the demo transport are untouched. ## Notes - "Start from" left empty means HEAD of the repository's main checkout, as it does in herdr's own form, not the HEAD of the worktree the action was asked from. - A remote PC answers through its own bridge, so it gets this with its next runtime bundle. - When the repository's main checkout is not open as a workspace, the action still fails with herdr's message. Not changed here. ## Tests - New contract test in `server/api.contract.test.ts`: a plain workspace on a `git worktree add` checkout gets `404 linked_worktree_source` while the repository's workspace is closed, then `200` for create and for open once it is open. It fails with `Expected: 200 Received: 404` without the server change. - `bun run check fast` passes (2069 pass, 0 fail). * fix(chat): keep keys typed around a slash completion (#688) ## Change `main` CI failed at 26ccec01 ([run 37939818475](https://github.com/devswha/herdr-web-ui/actions/runs/37939818475), Integration and browser): `scripts/settings-pages-demo-regression.ts` timed out at 320px waiting for `release-notes` after `fill("/rln")`. The test steps are ordinary input; the composer had two product races, both reproduced deterministically and both user-visible. 1. **Stale caret after a completion** (`setTextAndCaret`). The caret was placed in a `requestAnimationFrame`, so input landing before that frame was overwritten. Playwright's `fill` selects all and inserts in two protocol calls. When the frame fell between them, `/rln` was appended to `/pr-comments `, and no slash menu opened (the CI failure). For a user: typing `a` then `b` right after Tab on a busy phone gave `/pr-comments ba`. Fix: commit with `flushSync` and place the caret in the same task. 2. **Swallowed Enter/Tab after narrowing the list.** A passive effect clamped `selectedIndex`, and its update lands in a later render. Enter or Tab in that window read `choices[old index]`, which is `undefined`: the key was prevented and nothing happened. It surfaced on the rebased tree as `"/comments"` left in the box with the menu open. Fix: derive the clamped index during render, and step the arrows from it. No timeout raised, no retry added. ## Validation - Deterministic repros (throwaway, removed): before the fix, `"/pr-comments /rln"` with no menu, `"/pr-comments ba"`, and Tab/Enter leaving `"/comments"`. After the fix, `"/rln"` + `release-notes`, `"/pr-comments ab"`, `"/pr-comments "`. - Two new deterministic steps in `settings-pages-demo-regression.ts`. With each fix reverted, its step fails (`'/pr-comments ba'` / 30 s timeout); with the fixes, both pass. - After the fixes: `settings-pages-demo-regression.ts` passed 10 of 10 runs on the rebased tree, the full `bun run check browser` and `bun run check fast` exit 0, and `integration` exit 0 (before the second fix). Remaining: the reset to row 0 on a new query is still an effect. In that window, Enter picks `min(old index, last row)`, which matches the behaviour before this change. * fix(ci): gate deployment on source-bound verification (#692) ## Change - Require reusable CI and the site build to succeed for the same SHA before Pages publishes the website, demo, or installers. Pin checkouts, keep deployment serialization, and fail closed on stale-main/API errors, including manual runs. - Strengthen existing `bun run check`: durable source-bound JSON and command logs, source/dist invalidation, interrupted/not-run/skipped states, shared lock for `run`, and `run --build` for browser prerequisites. - Retain reports on success and failure. Capture isolated failure screenshots, bounded console errors, and optional traces without DOM/network capture in the main UI and prompt-dock regressions. - Typecheck six critical tooling/demo entrypoints without relaxing strictness. Document parallel ownership, genuine-dependency-only stacks, squash/restack validation and explicit authority. ## Validation - `bun run check fast`: passed after lifecycle fixes; 2242 tests passed, 7 skipped, 0 failed (before the final fail-closed correction, which has focused coverage below). Includes workflow syntax, generated types, both typechecks and app build. - Final focused check/report/browser-evidence/Pages/browser-runner tests: 39 passed, 233 assertions; both typechecks passed. - Actual CLI lifecycle smoke: success/failure logs, build provenance, source/dist mutation invalidation, competing-run lock refusal, SIGTERM report and subsequent lock release passed in a disposable fixture repository with a fake herdr executable. - Actual Playwright synthetic failure: PNG, console metadata, private artifact modes and trace without DOM/network capture captured from an isolated fixture. - Independent policy, deployment/evidence and report reviews completed. Fixed interrupt cleanup ordering, inherited-output draining, shared-report overwrite, unavailable source/build identities, and bounded trace teardown. Actual CLI smoke also covered stubborn descendants, shared-report lock refusal and source-identity loss. Required GitHub CI remains authoritative for final SHA f44e9cc. ## Repository settings and remaining credential boundary - Added `Native Windows install` to required main checks; retained strict checks, admin enforcement, conversation resolution and optional approval count. Latest 30 completed CI runs had 27 Windows successes, one cancellation, and two fork runs awaiting approval without jobs. - This PR does not provision an agent account or GitHub App credential. Non-admin implementation credentials require separate operator provisioning; no claim that current administrator credentials have been replaced. ## Coordination record Owner: coordinating maintainer session. Scope: verification/deployment tooling and operating documentation. Start SHA: b87d9d50019cdb87422415f7650ad29285a832cc. Branch/worktree: worktree/rapid-stone-f62b. Dependencies: existing ci.yml/check entrypoints only; no stacked PR dependency. Integration and release are explicitly authorized by the user, subject to required checks and unresolved-review blocking. * chore(release): prepare 0.4.4 (#694) ## Change Prepare app release 0.4.4 from main after #692, using the existing release process only. - Bump package.json and herdr-plugin.toml together. - Move the existing Unreleased entries under 0.4.4 (2026-10-09 UTC), preserving all PR links and external contributor credits. - Add matching English, Korean, Japanese and Chinese release highlights (3 new, 1 improved, 4 fixed; every line <=90 characters). - No tags are created by this PR. The existing Release workflow must validate the exact main SHA before publishing. ## Validation and review - `bun scripts/release-notes.ts 0.4.4`: passed, generated expected release body. - Release-notes tests: 27 passed, 397 assertions, 0 failures. - `bun install --frozen-lockfile`: passed without dependency changes. - Reviewed the release metadata diff; all prior summary entries are unchanged. The only non-metadata change is the one-line recorder synchronization fix documented below. - Audited release-range PR authors and existing changelog credits; implementation PR #692 is linked. - Required CI must pass on this PR before squash merge; no administrator bypass. Owner: release coordinator (explicitly authorized by user). Start SHA: ceae7a259fa6f0d16ece3e56abb2178e752541dd. Scope: four release metadata files and one release-blocking contract-test synchronization line. Branch: chore/release-0.4.4. Dependencies: merged #692; no open stack. ## Observed release blocker Website run [37973801948](https://github.com/devswha/herdr-web-ui/actions/runs/37973801948) correctly skipped deployment when the existing pending-input contract test read `barrier` before the recorder observed its final Enter. A WebSocket receipt is not a receipt from the separate recorder process. Commit fe09359 adds the existing bounded `waitBytes("barrier\r")` before the exact-byte and no-enqueue assertions, matching adjacent tests. No production behavior, expectation, timeout, or skip condition changed. This tiny prerequisite stays in the release PR rather than creating an artificial release stack; it is a separate commit for review. No changelog entry is needed for an internal test synchronization correction. Verification on the isolated herdr: full pending-input file **37 passed**, then the affected case **10/10 passed** with `--rerun-each 10`. Source-bound reports were preserved. Required CI is rerunning for the new PR SHA; no failed check is bypassed or blindly rerun. * fix(terminal): keep a tab out of use updating; pausing it is a setting (#699) ## Change **Problem.** Since 0.4.4 (#660), a desktop tab detaches its pane one second after the user switches to another window, so that herdr's own TUI gets the pane's size back. The tab then stops updating until it is clicked again. To someone who does not run herdr's TUI next to the browser, this looks like the terminal froze. It also happens on a second monitor where the tab stays in view. **Change.** - A tab that is out of use keeps its pane and its output again, as in 0.4.3. It still sends no resize and reconnects with `keep_size`. Only the release is affected. - **Settings → Terminal → Pause in another window** (`releasePaneAway`, off by default) turns #660's release back on, unchanged, for people who also work in herdr's own TUI on the same PC. - The herdr API has no read-only way to tell whether a TUI client shows the pane: the snapshot has no client field, and `no_foreground_client` comes only from `client.window_title.set/clear`, which change the user's title. So the choice stays with the user. @jiunshinn: #660 made a desktop tab stop updating a second after the user switches windows, and we had a report that this reads as a frozen terminal. This PR makes that release opt-in, off by default. A follow-up will make the setting switch the tab to a read-only `herdr terminal session observe` stream instead of pausing. I measured on 0.9.3 that the observer leaves herdr's TUI at its own size (44x37 stays 44x37, while an attach makes it 150x50), so the tab keeps updating and the TUI is not cut off. Feedback welcome. ## Validation - `scripts/chat-size-regression.ts` against a `bun run check run --build` herdr: 20/20 PASS. The new check (default settings, window blurred, clock run past the 1 s release delay) confirms there is no `detach`, no paused banner, and the pane's `pty-data` still arrives. The existing #660 checks run with the setting on and still pass. - `bun run check fast`: workflow syntax, generated types, typecheck, build, unit tests all ok. - `src/lib/settings.test.ts`: the setting is off by default and only a boolean `true` turns it on. - Settings → Terminal opened in a browser against the isolated test session: the toggle shows up off, turns on, and is saved to `herdr-web-ui:settings`. Korean, Japanese and Chinese strings were added, and `i18n.test.ts` passes. * feat(terminal): a tab out of use watches its pane read-only instead of pausing (#700) ## Change **Problem.** #699 made #660's release opt-in: with the setting on, a desktop tab out of use detaches its pane so that herdr's own TUI gets the pane's size back, and then the tab freezes until it is clicked. People who run herdr's TUI next to the browser had to pick one of two problems: a frozen web terminal, or a TUI cut off at the browser's size. **Fix.** herdr ≥ 0.7.2 has a read-only observer, `herdr terminal session observe <pane> --cols --rows`. Unlike `terminal attach`, it does not take ownership of the pane's size. I measured this on 0.9.3 with a real TUI client and a split pane at 44 columns: | state | pane size (`stty size`) | |---|---| | TUI only | 37 44 | | browser tab in use (attach) | 37 145 | | browser tab out of use, **watching** | **37 44** | | browser back in use | 37 145 | With the setting on, the tab now detaches as before, then watches the pane instead of pausing. The terminal shows "View only while you use another window · click to type". Focus or a pointerdown unwatches and attaches again at the tab's size. A grid change starts the view again at the new grid. A released tab that moves to another pane watches that one. - **Wire** (`shared/protocol.ts`, feature `"watch"`): client `watch {pane_id, cols, rows}` / `unwatch {pane_id}`; server `watch-data {pane_id, data}` / `watch-end {pane_id}`. A watch is not an attach: there is no input, resize, ACK or input-ready, and it never touches `attachments`, claims or `pane-geometry`, …
jiunshinn
added a commit
to jiunshinn/herdr-web-ui
that referenced
this pull request
Oct 9, 2026
…y, no file changes) (#14) * chore(release): 0.4.3 (#664) Release v0.4.3 (fixes). Stops before merge; the lead merges and releases. ## PRs since v0.4.2 #618 #613 #614 #628 #631 #635 #634 #623 #624 #625 #627 #632 #647 #646 #648 #658, plus #661 (docs, merged in). ## Changes in this PR - `version` 0.4.3 in package.json and herdr-plugin.toml. - CHANGELOG: Unreleased cut into `## [0.4.3] - 2026-10-09`, compare links updated. PR links and outside credits checked against `gh pr view --json author`: #618 @frankjoshua, #613 @Kinetic27, #614 @Haeminway1, #646 #658 @jiunshinn, #648 @od-studio-webagency. #627 (CI) and #647/#661 (docs) have no entry. - release-summaries.json 0.4.3: improved 2, fixed 8 in en/ko/ja/zh. The last fixed line tells existing installs to reinstall the plugin through herdr to get #648's Bun discovery (also stated in its CHANGELOG entry). - Remote bundle: `REMOTE_BUNDLE_VERSION` 22 -> 23. scripts/build-remote-bundle.ts ships server/ and shared/, and 19 files there changed since v0.4.2 (#618 #614 #628 #635 #634 #624 #625 #646 ...). `remote-v23` must be published on the merge commit before the app release. ## Checks - `bun run check fast` locally: 2009 pass, 0 fail. ## Whole-release review Codex (gpt-6.1-sol, xhigh) over v0.4.2..HEAD, output verified by hand. **No release blocker.** Two findings, both left as follow-ups: 1. *High (Codex) / pre-existing:* pending-message delivery (`dispatchPendingText`, server/index.ts ~646/652) calls `paneSendText`/`paneSendKeys` without the write-time guard #624 added to the WS paths. `authorizePending` runs synchronously just before, so a disconnect, role switch or revoke during the RPC's connect still lets the paste or Enter through. Verified: v0.4.2 had the same unguarded calls (lines 593/599), so this release does not regress it; #624 just did not extend to this path. Fix: pass a lease-aware guard to both RPCs, treat a cancel before the paste as unsent and one after it as uncertain, with tests at both connect boundaries. 2. *Medium:* a click replayed (#634) while a key RPC is queued for the pane takes the queued `input` path, so the mouse report goes out as literal `pane.send_text` bytes instead of through the attach. Verified in code: the click is only replayed when xterm's mouse tracking is on (`term.modes.mouseTrackingMode !== "none"`), so the program asked for the mouse, and queued typing and wheel reports already took this path in v0.4.2. #634 makes the window more common (arrows are now queued RPC keys). Fix needs attach-path ordering for queued mouse reports plus a click-while-key-pending regression; not small enough for a release PR. Known and accepted, not re-reported: #662, #629, #632 M-a residual. * test(terminal): separate latency diagnostics from delivery assertions (#678) ## Change Closes #668. Remove the shared-runner-sensitive 150 ms assertion while preserving p50/p95/max latency output, bounded delivery waits, ordered autorepeat delivery, exact burst bytes and mouse checks. This changes the CI criterion, not terminal behavior; no user-facing changelog entry is needed. ## Validation On the combined verification checkout: `bun run check fast` passed (2,034 passed, 7 skipped), and the isolated `terminal-arrows-clicks-regression.ts` passed. Observed held-arrow p50 2.1 ms, p95 70.8 ms, max 103.0 ms; the 200-arrow burst arrived in order in 55.1 ms. Full `ui-regression.ts` also passed. CI verifies this PR's exact revision. * fix(chat): refuse immediate sends over Claude input drafts (#677) ## Change Closes #629. Immediate Claude Chat Send reuses the queued-delivery input-box check. Existing drafts, bash mode and clipped boxes return the existing `input_draft` error without typing, preserving composer text. Empty inputs and non-Claude/terminal paths are retained. The pre-read is not atomic with herdr's paste; input typed in that interval can still race. ## Validation On a verification checkout combining this change with #668 and reconciled #649/#650: - `bun run check fast`: 2,034 unit tests passed, 7 skipped; workflow syntax, generated types, typecheck and build passed. - Isolated `server/submit.contract.test.ts`: 34 passed. - xterm disposal, terminal arrows/clicks, and full `scripts/ui-regression.ts` passed. Tests used owned temporary state and isolated herdr sessions, not user terminals. CI on this PR verifies its own exact revision. * fix(terminal): dispose xterm after pending render callbacks (#649) ## Change Closes #638 - 소켓·리스너 정리와 입력 차단, 이전 DOM 분리는 즉시 수행합니다. - renderer disposal만 이미 예약된 frame과 task 뒤로 미루고, 늦은 write callback은 ACK 후 종료된 terminal을 건드리지 않습니다. - 실제 patched xterm 브라우저 재현을 CI에 등록합니다. ## Validation 타입·빌드·생성 타입 검사와 전체 단위 1932 통과·33 생략·0 실패. 실제 xterm의 동일한 open/reset 시나리오를 브라우저에서 실행했습니다. ```text Immediate: Cannot read properties of undefined (reading 'dimensions') Deferred: errors=[], disposed=1 ``` 결정론적 scheduler 테스트 4개도 통과했습니다. 테스트는 소유한 브라우저만 사용하며 사용자 terminal에 접근하지 않습니다. 모든 검증은 별도 작업 공간과 소유한 테스트/demo 환경에서 수행했습니다. 사용자의 실행 중 앱·terminal은 변경하지 않았습니다. Co-authored-by: studiood <253281802+od-studio-webagency@users.noreply.github.com> Co-authored-by: Hako <devswha@gmail.com> * fix(codex): resolve short sessions without guessing by recency (#650) ## Change Closes #639 - 기존 경로·열린 파일·긴 답변 매칭으로 확인되지 않는 경우에만, 프로세스 시작 이후의 유일한 interactive thread와 전체 첫 프롬프트를 대조합니다. - 누락된 후보도 모호성에 포함하고 cwd 최신 파일 추측이나 지속적인 잘못된 binding을 만들지 않습니다. - 디렉터리 없는 AGENTS 주입 형식도 숨기되 유사한 사용자 문장은 유지합니다. 최신 CODEX_HOME·PID·Windows 경로 보호는 보존했습니다. ## Validation 생성 타입·타입·빌드·전체 단위 검사 통과(1975 tests, 0 failures). Codex/process 관련 집중 실행은 92 통과·기존 Linux 전용 3 생략·0 실패였습니다. 임시 SQLite/rollout과 자체 프로세스·소켓으로 초/밀리초 schema, Windows cwd, 32개를 넘는 후보, unreadable 후보, exec/subagent 제외 및 화면 증거 소실을 검증했습니다. 실제 사용자 Codex나 유료 모델은 실행하지 않았습니다. 모든 검증은 별도 작업 공간과 소유한 테스트/demo 환경에서 수행했습니다. 사용자의 실행 중 앱·terminal은 변경하지 않았습니다. --------- Co-authored-by: studiood <253281802+od-studio-webagency@users.noreply.github.com> Co-authored-by: Hako <devswha@gmail.com> * feat(telemetry): keep the country an event came from (#663) ## What The telemetry receiver stores the country a request came from beside each install/update event: the two characters Cloudflare works out (`request.cf.country`, such as `KR`), and nothing finer (no city, region, network or address). Rows from before stay `NULL`. The sender (`server/telemetry.ts`) and the message are unchanged. ## Wording that changed with it - The one-time notice no longer says "Nothing else"; it says the receiver also notes the country, never the address. - Settings → About → Anonymous usage counts: the description says the same, and a line under **What is sent** states that the receiver adds the country, since it is not part of the message shown there. - `docs/guide.md`, `telemetry/README.md`, `shared/telemetry.ts`, `telemetry/schema.sql` and the Worker's header. - ko / ja / zh translations for the changed and new strings. ## Decisions (maintainer) - **The notice is not shown again.** Installs that already saw the one-time notice keep their acknowledgement; the change is told through the changelog, the guide and Settings → About. - **Deploy order.** The live D1 table gets `ALTER TABLE events ADD COLUMN country TEXT` before `wrangler deploy`; the other order makes every INSERT fail. `telemetry/worker.test.ts` runs both orders against SQLite. ## Review Codex adversarial review: Tor (`T1`) and unknown (`XX`) markers are stored as no country, the README's country query counts an install once, the guide's opening sentence was corrected, and the receiver's tests run against the real schema (b2fac4a). ## Checks `bun run check fast` passes locally (2019 tests, 0 fail). `telemetry/worker.test.ts` covers: country stored, finer `cf` fields never stored, a missing or malformed country stored as `NULL`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(prompt): a Claude approval is a card while background agents run (#659) ## Change A follow-up to #614. While background agents run, Claude Code 2.1.29x ends an approval's hint with the chord that stops them: ``` Do you want to proceed? 1. Yes ❯ 2. Yes, and don't ask again for: … 3. No Esc to cancel · ctrl+x ctrl+k twice to stop background agents ``` The approval is often a subagent's (`Bash command · from the general-purpose agent`). `parseClaudeApproval` reads it, but the tail check takes only a bare `Esc to cancel` (#614), so the pane falls to the numbered fallback card, which answers by typing the option's number. The tail check now takes a hint that starts with `Esc to cancel`. ## Validation - `server/prompt.test.ts`: a test with that screen shape; 225 pass. - `bun run generate:types --check`, `bun run typecheck`, `bun run build` pass. `bun run test:unit`: 1994 pass, 1 fail (`voice transcribe > streams deltas and the done text from a split SSE answer`), which fails the same way on `main` here. - CHANGELOG line under `### Fixed`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Hako <devswha@gmail.com> * fix(ui): show one decimal for a size under 10 MB (#670) ## Change Split out of #429, as asked in its review. `formatBytes` (`src/lib/bridgeProgress.ts`) rounded megabytes to a whole number. A 1.3 MB file read as 1 MB, and the file viewer's note for a file cut short said "Showing the first 256 KB of 1 MB". Below 10 MB it now keeps one decimal (`1.3 MB`). A whole number keeps none (`2 MB`), and 10 MB and up stay whole. The Files list (`src/components/DirectoryBrowser.tsx`) and the bridge update's progress use the same function, so their sizes change the same way. ## Validation - `bun run typecheck` and `bun run build` pass. - `bun run test:unit`: 2009 pass, 0 fail, with new cases in `src/lib/bridgeProgress.test.ts`. --------- Co-authored-by: Hako <devswha@gmail.com> * fix(settings): keep slow history traversal ownership (#630) ## What was wrong Settings forgot ownership of its own history traversal after a 1000 ms deadline. A delayed landing was then treated as the user's Back, so the key bar editor could close during width changes. If no landing arrived, reconciliation issued another traversal every second. ## What changed - Keep the pending destination after the deadline and recognize its late landing as the module's own. - Do not automatically retry an unanswered traversal or issue another from its unchanged source entry. Reconcile the latest requested Settings levels when the traversal lands. - Add deterministic stack-history and clock tests without a DOM or real sleeps. - Wait for Voice's status-dependent key form before measuring it. Extend demo geometry checks to ko/ja/zh at 320px and the key bar editor. The nearest-card comparison already existed at b82584d. The production history change is 15 added and 7 removed lines. There is no App listener change, contract change, new fixture, or history-module redesign. ## Reproduction on b82584d Before editing production code: ```text $ HERDR_TEST_MODE=unit bun test ./src/lib/settingsHistory.test.ts REPRO A: markerless popstate closes Settings; cleanup requests no traversal; Back restores depth 3 (fail) history traversal races > keeps a late width-change traversal its own after the landing deadline Expected: [true] Received: [false] (fail) history traversal races > does not retry a traversal every second when no landing arrives Expected length: 1 Received length: 11 8 pass 2 fail ``` The baseline transcript is retained locally in `/tmp/tri-client3-564-baseline.log`. `settingsHistory.test.ts` already existed on the baseline; the reproduction cases were added there. ## Remaining from #564 Part A is reproduced and intentionally left. `src/App.tsx:237-242` closes Settings on every non-own markerless landing. `src/lib/settingsHistory.ts:43-50` cannot distinguish a base entry from another markerless entry, and reconciliation at `src/lib/settingsHistory.ts:81-90` derives the held depth solely from that marker. A real Back to the base and a new fragment entry therefore carry the same observable markerless state. Ignoring all markerless events would break normal dialog Back; stepping over all of them could leave the app on a legitimate Back. Correct cleanup needs explicit base/entry identity, which is the redesign excluded from this assignment. The characterization test preserves evidence of the unresolved behavior instead of claiming it is fixed. For C, the original nearest-card allegation is not confirmed: it already used `.closest(".settings-card")`. Voice readiness, localized pages and key-bar geometry are covered by this change. No translation or demo fixture changes are needed. Refs #564 * fix(a11y): the terminal announces its pane (#633) ## Summary The terminal is the product's central surface, and it is invisible to a screen reader: xterm draws the screen to a canvas, so a reader reaching it found an unnamed control. Its host element is now a labelled `role="region"` (`aria-roledescription="terminal"`) named after the pane — **"Terminal for Idempotent payments"** — so a reader names the pane before its content. This is the A1 half of the 2026-10-06 audit that rode in #569, which closed on the access-gate decision rather than this code. You asked for the pieces that do not change the default on their own, and this is one of them: two attributes and a translated string. - No `tabIndex`: xterm's helper textarea takes the keyboard here on attach, so a stop on the wrapper would only be an empty one ahead of it. - The label falls back to the pane id while a pane has no title, and to "Terminal" while no pane is attached. - `screenReaderMode` stays out of scope. The bundled xterm patch's Gboard backspace guard is disabled while that mode is on, so it is its own investigation rather than a flag flip. ## Test plan - [x] `HERDR_TEST_MODE=unit bun run check fast` on `upstream/main` — typecheck, build and the unit suite green (1928 pass, 6 skip, 0 fail) - [x] `src/lib/i18n.test.ts` — the new `t("Terminal for {title}")` key is present in ko, ja and zh - [x] Browser check on the demo harness, run as a throwaway and **kept out of the tree** per your earlier note that `scripts/` sits outside typecheck and CI. With the fix the host reads `hasRegion: true, roledescription: "terminal", accessibleName: "Terminal for Idempotent payments"`, no page errors, and the label persists across a workspace open. Reverting only the host attributes makes the same check fail — `hasRegion: false, label: null` — so it discriminates rather than passing on any non-empty constant. - [ ] CI: Fast checks, Integration and browser — awaiting approval for the fork run Rebased onto current `main` (v0.4.2) and merges cleanly. No endpoint, frame or contract change. --------- Co-authored-by: radicor <211192474+radicor@users.noreply.github.com> Co-authored-by: Hako <devswha@gmail.com> * feat(chat): fuzzy-match slash commands beyond the prefix (#617) ## Change The composer's `/` (and `$`) list only matched the start of a command's name, so a plugin or skill named `superpowers:brainstorming` needed its namespace typed first. `rankSlashCommands` (`src/lib/compose.ts`) now ranks by kind of match: 1. name starts with the query (as before) 2. a word of the name starts with it (words split on `: - _ . /`) 3. the name contains it 4. its letters appear in order (`spbr`) 5. the description contains it (query of 2+ characters) Within a kind, the most-used commands come first, then name order. A better kind of match always beats a more frequently used one; an empty query still lists everything. ## Validation - `bun run typecheck`, unit tests (`src/lib/compose.test.ts` has the new ranking test; 811 pass on a branch that also holds #616). - Not tried by hand in the composer; matched letters are not highlighted. --------- Co-authored-by: radicor <211192474+radicor@users.noreply.github.com> Co-authored-by: Hako <devswha@gmail.com> * feat(voice): choose the dictation language, auto from the browser (#612) ## Change Closes #611. Dictation used to listen only in the UI language. The UI exists in English, Korean, Japanese and Chinese, so a Hungarian or German speaker got an English UI, and their speech was recognized as English. - A new setting, **Settings → Voice input → Dictation language** (`voiceLanguage`, default `auto`), appears while the microphone button is not Off. - **Auto** behaves as before, with one exception. When the UI language is System and the browser's first language is not English, Korean, Japanese or Chinese, Auto uses that tag (`navigator.languages[0]`, e.g. `hu-HU`). In every other case it uses the UI language's locale, as today: `ko` and `ko-KR` → `ko-KR`, `en-GB` → `en-US`, `zh-TW` → `zh-CN`, and a UI language picked by hand. A malformed first tag (e.g. `*`) falls back to the UI language. - A language can also be picked from `DICTATION_LANGUAGES`, a list of 32 BCP 47 tags. Their names come from `Intl.DisplayNames` in the UI language, sorted by name. Someone who wants `en-GB` or `zh-TW` can choose it here. - Browser engine: `SpeechRecognition.lang` is the resolved tag. - Server engine: the form's `language` is the tag's two-letter subtag (`hu`). A tag without one (`fil-PH`) sends the UI language, so `server/voice.ts` and its `^[a-z]{2}$` check are unchanged. - `speechLang` is replaced by `dictationLocale` and `transcribeLanguage` (both pure, unit-tested). - `sanitizeSettings` accepts only `auto` or a tag from the list. - The three new UI strings have ko, ja and zh entries. I wrote them without a native speaker's check, so please correct them if they read wrong. - Also updated: `docs/guide.md#voice-input` and the `CHANGELOG.md` Unreleased section. ## Validation - `bun run check fast`: generated types fresh, typecheck, build, and unit tests (0 fail). - New unit tests cover: - `dictationLocale`: Auto keeps today's locale for every browser language the UI is translated into, takes the browser's tag for one it is not, and respects a hand-picked UI language and a chosen dictation language. - `transcribeLanguage`. - `sanitizeSettings` for `voiceLanguage`. - I compared the old and new Auto locale on `ko-KR`, `ko`, `en`, `en-GB`, `ja`, `zh-TW`, `zh-Hant-TW` and `en-US,ko`: they are identical. They differ only on `de-DE,ko-KR` (before `ko-KR`, now `de-DE`) and `hu-HU`, which are the intended changes. - I checked the UI in the demo built by `bun run build:site`, with `navigator.languages` set to `["hu-HU", "en-US"]`. The Voice input page shows **Dictation language** with **Auto (Hungarian (Hungary))** selected, followed by the named list. A screenshot is in the first comment. The row's description has been reworded since that screenshot. - I did not run `bun run check full`, because the change touches neither herdr nor any HTTP/WS contract. I did not test live dictation in a real browser. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01HZmZBAnd4XuEHQUuHxPcQi --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: lyonbot <lyonbot@gmail.com> Co-authored-by: radicor <211192474+radicor@users.noreply.github.com> Co-authored-by: Hako <devswha@gmail.com> * fix(sidebar): draw the working arc thirty times a second, not five (#622) ## Change The sidebar's working arc turned with `steps(8, end)` over `--dur-pulse` — a pulse's 1600 ms. That is five 45° jumps a second, 200 ms apart. The icon is 16px across, so the arc's radius is 6px and each jump moves its ends about 4.7px: a working agent reads as a stutter, not as work in progress. The turn gets its own `--dur-spin` — a pulse period says how long a dot takes to come back, not how fast an arc should spin — and steps 48 times over the same 1600 ms: 33 ms and 7.5° apart, under a pixel of travel each. The arc, its size and the length of the turn are unchanged, and the animation keeps `steps()`, so `src/motion.test.ts` still holds. | before — `steps(8)` over `--dur-pulse` | after — `steps(48)` over `--dur-spin` | | --- | --- | |  |  | Both are 30 fps captures of the repo's own demo session — the client `scripts/demo-build.ts` builds, over the committed fixture transport, loopback only, with the demo's 4500 ms timer held so the turn stays running. They come from one page load, so the two differ in the one declaration under test and nothing else. The still is that session: [`demo-still.png`](https://raw.githubusercontent.com/iwangjie/herdr-web-ui/evidence/sidebar-working-arc/pr-evidence/demo-still.png). The recordings live on a branch of my fork, `evidence/sidebar-working-arc`, not in this branch. ## Validation - `bun run check fast`: green — generated types, typecheck, build, and the unit suite (1902 pass, 32 skip, 0 fail). The 3 `isolate` tests in `scripts/check.test.ts` need a TMPDIR whose socket path fits; this Mac's default is too long for it, and they fail the same way on `main`, so I ran the suite with `TMPDIR=/tmp`. - Frames the browser actually drew, counted with `Page.startScreencast` over the demo session, one page load, every variant twice and interleaved so a page that quiets down or speeds up hits each of them: | the arc's declaration | frames the browser drew | | --- | --- | | `animation: none` (the page's own damage) | 4.8/s | | `steps(8)` | 8.8/s | | `steps(48)` | 31.0/s | A stepped rotation draws its steps and nothing else, so this count is the frame rate: thirty a second, still a fraction of what the display refreshes, which is what the rule in `src/motion.test.ts` protects. - The two 30 fps recordings: 13 distinct frames per turn before, with 35 of the 48 slots repeating the frame before them; 47 after. - Sampled from the built stylesheet: 0 ms 0°, 33 ms 7.5°, 100 ms 22.5°, 200 ms 45°. Before it was 0 ms 0°, 200 ms 45°. ## Notes - `--dur-spin` is 1600 ms, the turn the arc always took. Only the number of frames it is drawn in changed, so nothing but the smoothness moves. - `UsageMeters.css` spins its own arc at `0.8s steps(8)`: 45° a step, ten a second. That one is behind a popover over a still page, so I left it alone; it has the same shape of problem if you want it in a follow-up. --------- Co-authored-by: Hako <devswha@gmail.com> * feat(pwa): name the installed app with HERDR_WEB_APP_NAME (#684) <!-- See CONTRIBUTING.md for checks, translations, contract tests and the changelog. --> ## Change Option 1 from #476. Each PC is its own origin, so two PCs installed on one phone are two apps, and both are called "herdr". When `HERDR_WEB_APP_NAME` is set (plugin `.env` or the environment, like the other settings), `server/static.ts` serves: - `/manifest.webmanifest` with `name` and `short_name` set to it. Every other field stays as built, `id` included, so the app's identity does not change. - the shell (`/`, unknown paths, `/index.html`) with `apple-mobile-web-app-title` set to it, HTML-escaped, so an iOS home-screen install gets the same label. Unset or blank, both are served byte for byte as built. Cache headers and the CSP are unchanged, and the manifest and shell already revalidate on every load, so an installed app picks the name up at the browser's next manifest update without a reinstall. Docs: a row in the guide's *Configuration* table, plus one sentence at the phone-install step. Changelog: one line under *Added*. There is no HTTP/WS contract change and no new endpoint. Static files are not proxied for remote PCs, so the remote bundle is not affected. Closes #476 ## Validation - `bun run check fast`: workflow syntax, generated types, typecheck and build pass. In the unit tests, 2044 pass and the same 18 fail in `server/codex-processes.test.ts` on this branch and on unmodified `main`: the fixture spawns `/bin/bash`, which this NixOS machine does not have (`ENOENT: posix_spawn '/bin/bash'`). Nothing else fails. - New `server/static.test.ts` (4 tests). It runs against the source `public/manifest.webmanifest` and `index.html`, so it also fails if someone renames or reshapes the meta tag later. It covers: unset or blank is off; the manifest is renamed and every other field kept; the shell changes only the meta; HTML escaping, including `$&`-style replacement patterns. - Built server, `HERDR_WEB_APP_NAME=midgard`: `/manifest.webmanifest?v=2` returned `name`/`short_name` `midgard`, `id` `/`, `Cache-Control: no-cache`, content type `application/manifest+json`. `/`, `/index.html` and an unknown path returned `content="midgard"`. `sw.js` was byte-identical. - Built server, variable unset: the manifest and `/` were byte-identical to `dist/`. - Not yet checked on a phone, so the rename of an app that is already installed is untested. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01HkqShU9QB6wV4SgX8JTxQB * feat(sidebar): a finger reorders workspaces with a long press and a drag (#679) ## Change On iOS (Safari and the home-screen PWA), a long press on a workspace row lifted the system's drag preview, but the HTML drag and drop it started never dropped on the page, so workspaces could not be reordered on a phone at all. - On a touch screen (`pointer: coarse`) the row's `draggable` is off, so the misleading preview no longer appears. - `src/lib/touchReorder.ts` handles the finger instead. A 400 ms press held within 8 px lifts the row (`.is-lifted`), it follows the finger, the list scrolls near its edges, and a 2px `--accent` line (`data-drop`) shows where it lands. Letting go uses the same `dropIndex` / `reorderWorkspace` path as the mouse drag, so worktree groups stay packed and a failed move rolls back. - A stroke that moves before the hold is still a scroll or a drawer swipe. Once a row is lifted, its moves never reach the drawer swipe (`lib/edgeSwipe.ts`, which the window-capture listener runs before), and the lift's touchend does not click the row. - The row's ⋯ menu gains **Move up** / **Move down**, shown only when the move is possible, with ko/ja/zh entries. - Desktop mouse drag and Alt+↑/↓ are unchanged. - DESIGN.md, docs/guide.md and the CHANGELOG (`Unreleased → Added`) are updated. ## Validation - `src/lib/touchReorder.test.ts` (new, unit) covers the hold slop, hit-testing between rows and past the ends, and the edge-scroll speed. - `scripts/workspace-touch-reorder-demo-regression.ts` (new, added to `ci-browser.sh`, with the `ci-browser.test.ts` count updated) runs the demo transport at 390×844 with `isMobile` + `hasTouch` and CDP touch events. It checks that: - rows are not `draggable` - a quick stroke lifts nothing - a long press + drag moves the first workspace after the third, both in the sidebar and in the server's order, with nothing left lifted and the drawer still open - ⋯ → Move up moves it back one step - Passed locally on this branch (based on `main` at 0.4.3): the demo regression, the new unit tests, `i18n.test.ts`, `motion.test.ts`, `ci-browser.test.ts`, `bun run build` and `bun run typecheck`. - The same change passed Fast checks, Integration and browser, and Native Windows install on my fork (jiunshinn/herdr-web-ui#9). - Tested by hand on an iPhone in the home-screen PWA: long-press, drag and drop reorder workspaces, and Move up/down works. 🤖 Generated with [Claude Code](https://claude.com/claude-code) * feat(chat): show a task list's boxes (#669) ## Change Split out of #429, as asked in its review: a task list in the chat. - A list item that starts with a GitHub task box (`- [x] done`, `- [ ] open`, `- [X]`) is parsed with its state (`ListItem.checked` in `src/lib/markdown.ts`). Anything else after the bullet (`[y]`, no space) stays text. - `src/components/Markdown.tsx` draws a checked or empty box in place of the bullet instead of the brackets: - The box is not clickable, because the agent's text owns the state. - It is a drawn `<span role="checkbox" aria-checked aria-disabled>`, labelled by the item's text, so a screen reader says "done, checkbox, checked". A disabled `<input>` would be greyed by the browser and ignore the accent. - Styles are in `src/components/ChatView.css` (`.markdown-task*`), tokens only. `DESIGN.md` describes it. - A file viewer's Markdown preview (#429) uses the same renderer, so it gets the boxes too once both have landed. ## Validation - `bun run typecheck` and `bun run build` pass. - `bun run test:unit`: 2010 pass, 0 fail. The new test in `src/lib/markdown.test.ts` covers the parse (checked, open, `[X]`, an empty item, `[y]` as text) and the rendered markup, including the box's label. ## Screenshots <img width="1736" height="286" alt="image" src="https://github.com/user-attachments/assets/3af005cd-4d25-40f8-a583-313bb7269e80" /> <img width="1736" height="286" alt="image" src="https://github.com/user-attachments/assets/e2ac698a-0db2-408e-9117-eb601b0f6e5c" /> * fix(terminal): a tab you are not using lets go of the pane, so herdr's TUI shows it whole (#660) > Builds on #658: the first commit on this branch is #658's (rebased on today's `main`), because this change edits the focus handling #658 adds. Please review the second commit, `74c0350`. I'll rebase this onto `main` once #658 is in. ## Change <img width="1707" height="1016" alt="Screenshot 2026-10-09 at 14 58 10" src="https://github.com/user-attachments/assets/20bfbaea-0dee-4332-87f3-d3c4f267971e" /> **Problem.** While a desktop web UI tab has a pane open, herdr's own TUI (in Ghostty here) shows that pane cut off at its split's edge, with the bottom rows (the prompt box) out of reach, even after scrolling. It lasts as long as the tab stays open. A phone does not do this. **Cause.** The bridge keeps a `herdr terminal attach` on every pane a tab shows. While an attach is connected, herdr 0.9.3 holds the pane at that attach's size, and its own TUI cannot resize it (herdrdev/herdr#5006, herdrdev/herdr#985: `direct_attach_resize_lock`). A desktop tab left open kept the pane at the browser's size (219x72 in my case) while the TUI's split was 51 columns. A phone hides this: it disconnects in the background, and its grid is narrower than the split. #658 stops a background tab from *taking* the size again, but it does not *give it back*. Measured in a throwaway herdr session with a real TUI client: a split pane at 44x37 became 150x50 while an attach was connected, and returned to 44x37 the moment the attach ended. The layout `rect` includes the border (a 47x39 rect was a 44x37 pty), so the TUI's size cannot be computed and handed back through the API. Ending the attach is the only way back. **Fix.** - A tab out of use (window blurred or hidden) for `RELEASE_AFTER_MS` (1 s) detaches its pane. The attach ends with the pane's last client, and herdr restores its TUI's size. The terminal lens shows "Paused while you use another window". - On focus, or on any pointerdown, the tab attaches again at its own size. The screen restarts from the new attach, as on a pane switch. - The tab keeps the pane while a message it queued waits for delivery (that goes through its attach), and lets go once the message is out. It never releases a mirrored pane (no attach to give back) or an embedded page (the site's demo iframe, which has the focus only while clicked into). - A pane switch while released attaches nothing until the user is back. The cleanup still detaches whichever pane is attached at the next switch. - `HerdrSocket.resize` sends nothing for a pane the socket is not attached to: the server would apply it to the holder's attach. - No protocol change. The demo transport already replays a pane's screen on every attach. Trade-off: a desktop window that is visible but not focused (e.g. on a second monitor) stops updating until it is clicked. ## Validation - `scripts/chat-size-regression.ts` `checkBackgroundTabKeepsTerminalSize`, rewritten for the new behavior. A window out of use sends no resize, then detaches and shows the paused banner. A background reconnect attaches nothing. Once the phone leaves too, no `herdr terminal attach` runs for the pane. Focus attaches again at the window's size. It fails on the old client (no detach) and passes with this change, as do `checkChatKeepsTerminalSize` and `checkPaneSwitchKeepsTerminalSize` (run against a `bun run check run` herdr). - `src/lib/ws.test.ts`: no resize and no reconnect attach for a pane the socket let go of. - End to end, with a real herdr TUI client on a throwaway session, `stty size` in the pane: TUI only `37 44` → browser tab in use `47 120` → user back in the TUI `37 44` → back in the browser `47 120`. - Typecheck, build and `bun run test:unit` on this branch. The only failures are 3 `isolate` tests in `scripts/check.test.ts`, which also fail on an unchanged `main` on my Mac (herdr socket path too long under the macOS temp dir), and 3 `server/prompt.test.ts` timing failures under full-suite load that pass alone (217/217, twice). - New string translated in `i18n.ko.ts`, `i18n.ja.ts` and `i18n.zh.ts`. `CHANGELOG.md` has an `[Unreleased]` entry, and `src/AGENTS.md` and `server/AGENTS.md` record the attach lock. - I have been running this from my fork (herdr 0.9.3, macOS, Ghostty) since today: the TUI pane comes back whole a second after leaving the browser. --------- Co-authored-by: Hako <devswha@gmail.com> * feat(chat): show Claude Code subagents as background tasks (#527) ## What A Claude Code pane's subagents (the `Agent` tool) were invisible in the chat: - **The call:** a collapsed work row whose output is only "Async agent launched successfully…". - **The finish:** the `<task-notification>` that carries the agent's answer was hidden on purpose. - **Running agents:** shown only in the terminal footer (`◯ reviewer Review … 4m 6s · ↓ 57k tokens`). This PR reuses OmO's background-task UI for them instead of adding new UI: - **Status line list:** `GET /api/pane/omo-tasks` lists a Claude pane's subagents. Each row shows type, description, model, elapsed time, turns, tool calls and tokens. The title falls back from the description to the teammate name, agent type and id. The list holds the running ones, then the newest ten that ended in the last day, the same rule as OmO's list. An agent is `lost` once the pane no longer runs that session, or when it was last written more than 60 s before the pane's current Claude process started (an agent orphaned by an exit, then `--continue`). - **Badge and count:** the pane's `background_tasks` counts the running ones. It is set in the snapshot and pushed in a `pane-status` frame that keeps the pane's status and sends no alert or web push. - **Result card:** an agent's task notification becomes a `task_result` card in the chat, showing title, agent type, status and the answer, cut at the existing 16,000-character limit. A notification is counted once, though Claude records it up to three times: a user entry, a `queue-operation` and a `queued_command` attachment. A notification that shares a user entry with a tool's result is drawn as well. Background Bash notifications stay hidden as before. - **Docs:** `server/AGENTS.md` described a `taskNotice` that does not exist on main; that row now describes this code. CHANGELOG, DESIGN.md and docs/guide.md are updated. ## Where the data comes from (Claude Code 2.1.29x) - `<config>/projects/<project>/<session>/subagents/agent-<id>.meta.json`: `agentType`, `description`, `toolUseId`. - `agent-<id>.jsonl`: the subagent's own transcript. It gives the model, turns, tool calls and tokens. Tokens are the last entry's input + cache + output, which matches the `totalTokens` Claude reports for a finished agent. - The parent transcript: `<task-notification>` blocks (status and result), and for a synchronous agent the `tool_result` of its call. An "Async agent launched" acknowledgement is never taken for an answer. - Agent-team teammates get no notification and no `toolUseId`. An agent whose own file ends with an assistant entry that stopped with `end_turn`, and has no user entry after it, has ended at that entry's time. The newest of notification, answer and end of turn wins. An agent resumed after it ended reads as running again once its own file has newer entries. - An agent's status, last write and start come from the last and first 64 KB of its file, outside the read budget, so a large session reads right on the first call. What it did (model, turns, tool calls, tokens) is filled in once its whole file has been read. An agent whose end cannot be told yet is left out rather than shown as running. ## Cost and safety - **Polling:** a 2 s poller reads only Claude panes, and skips a pane whose `subagents/` mtime, parent size and the mtimes of the ended agents it watches are unchanged. - **Read limits:** files are read incrementally from their last offset, with an 8 MB per-call budget. The first parent read covers its newest 16 MB window in full, so the first answer is already right. A line longer than the budget is skipped only to its next newline. Caches evict one entry at a time. - **Paths:** agent ids are checked against `/^[A-Za-z0-9_-]+$/` wherever an id becomes a path. On a page, ids come only from parsed notifications, never from tool output. Final-component symlinks are refused. - **Request time:** `/api/pane/omo-tasks` waits at most 1 s for a pane it has not resolved yet, then answers with what it knows. The client asks again when the count changes, and asks an empty answer again up to three times, 3 s apart, so that agents which ended before the lookup finished are still found. - **Cards:** they depend only on the transcript bytes plus the meta file, which does not change after launch. A cached page and a cold read therefore agree. ## Tests - **`server/claude-subagents.test.ts` (new), covering:** - running, completed, failed and cancelled; - the three carriers of one notification counted once; - an agent resumed after its notification, and with only its own file writing; - synchronous answers, and a launch acknowledgement that is not an answer; - a teammate ended by its own `end_turn`, then messaged again, and status from the file's tail before the whole file is read; - lost by session, and lost by process start (60 s slack); - the ten-ended and one-day limits; - read budgets: a leftover smaller than a line, a 9 MB line, a 10 MB line before a 7 MB notification, a starved file; - the 16 MB window, a 30 MB append, traversal ids, a torn meta; - `/clear` to a session with no agents, and pid changes. - **`server/conversation.test.ts`:** an agent notification becomes one card and a Bash notification stays hidden. A notification that shares an entry with a tool's result becomes one card too. A notice quoted inside a tool result is ignored. Cards stay the same when the subagent file grows. - **`server/claude-session.contract.test.ts` (live herdr):** the list from `/api/pane/omo-tasks`, the snapshot count going 1 then 0, a count-only `pane-status` frame with the pane's own status, and no web push for it. ``` bun run typecheck ✓ bun run generate:types --check ✓ bun scripts/ci-tests.ts unit 1518 pass, 0 fail bun scripts/ci-tests.ts integration 226 pass, 0 fail, 6 skip (macOS) bun scripts/ui-regression.ts 76 PASS ``` Checked on a live server (macOS, Claude Code 2.1.290): - A real 27 MB session transcript with six subagents. The list was right from the first read, with running and finished agents told apart, and later reads took 0 ms. - A pane that read nine agents as running before the end-of-turn and tail fixes, all of them idle teammates or ended agents, now counts 0. - A subagent started for the check made the pane's count go from 1 to 0. Its row went from running to completed, with model, turns, tool calls and tokens. 🤖 Assisted by [kilhyeonjun-harness](https://github.com/kilhyeonjun/kilhyeonjun-harness) --------- Co-authored-by: Hako <devswha@gmail.com> * feat(chat): highlight code blocks by their language (#671) ## Change Split out of #429, as asked in its review: syntax highlighting for code blocks in the chat. #429's file viewer is rebuilt on top of this PR. - **Highlighter.** A fenced block is colored by role with [TanStack Highlight](https://github.com/TanStack/highlight) (`@tanstack/highlight` 1.0). `src/lib/highlight.ts` maps a fence word to one of 28 registered languages. Tokens render as React spans with no `innerHTML`. The colors are `--syntax-*` tokens for every palette (`src/styles.css`, table in `DESIGN.md`). - **Nothing a reply holds can freeze the page.** TanStack is quadratic on some shapes: a line of dashes in YAML takes 3.8 s at 64 KB. - Only code up to 2 KB is highlighted while the page draws. The worst shape measured at that size takes under 5 ms. - Longer code is highlighted in a worker (`src/lib/highlightOffThread.ts` on `src/lib/offThread.ts`). It shows plain until the worker answers. - A worker that runs past 2 s is ended and replaced. Its block stays plain with "Too long to highlight" under it. - A block over 100 KB is not tried. - A block over 20 000 lines (`LINE_ELEMENT_LIMIT`) is drawn as one text, as on `main`, and not highlighted. Each line is an element of its own, and in Chromium 256 KB of line breaks (262 144 lines) held the page for 4 s. - While a reply grows, it keeps its colors and only its new end shows plain until highlighted. - **Copy.** The text of the `<pre>` is the code itself: lines are inline spans joined by `\n`, so a copied selection keeps blank lines. - **Setting.** **Settings → Chat → Highlight code** turns it off. The code is then plain, with no "too long" note. - **Bundle.** Against `main` (gzip -6) the main script grows by 13.0 KB, from 359.8 KB to 372.8 KB. The worker chunk (11.3 KB) loads on first use. ## Validation - `bun run typecheck` and `bun run build` pass. `bun install --frozen-lockfile` passes on the committed `bun.lock`. - `bun run test:unit`: 2077 pass, 0 fail (on `main` at `3a0254e`). - `src/lib/highlight.test.ts` covers roles across lines, CRLF, blank lines, the sync limit and failure. - `src/lib/offThread.test.ts` runs real Bun workers: budget, termination and replacement, cancel, and a failed spawn. - Browser, `bun run check run bun scripts/<script>.ts` in Chromium: - `file-viewer-regression`: 16 PASS. Long tasks are recorded from the first paint. It now also checks that a 30 000-line block opens with Show all as one text with no task of a second, that chat code is highlighted, keeps its blank line, that a 90 KB YAML block the highlighter is slow on stays plain with its note while the others are colored, and that Highlight code off leaves the chat plain. - `settings-pages-demo-regression` 7 PASS, `chat-history-browser-qa` 6 PASS, `math-browser-qa` OK, `file-viewer-mobile-regression` 16 PASS. - `ui-regression`: 78 PASS, then it stops at the startup prompt card ("1. Yes, continue") in my container, the same as on `main`. ## Screenshots <img width="1640" height="664" alt="image" src="https://github.com/user-attachments/assets/17990018-7d70-4a48-a6b1-13ad2e4b75a3" /> <img width="1640" height="664" alt="image" src="https://github.com/user-attachments/assets/09581af7-d10a-4c15-9477-f8453a19e0e7" /> <img width="780" height="1688" alt="image" src="https://github.com/user-attachments/assets/b97430e3-d149-4879-a543-2a1210279bd1" /> * fix(status): hold a Claude turn that ended on its background work (#534) > Stacked on #533 (step detail), which is stacked on #531 and #527. Please review only the last commit: **fix(status): hold a Claude turn that ended on its background work**. > Rebased onto #520/#521: BG is a read-only word in the composer, hidden like every other state word since #520; in the sidebar's compact cell it is the running arc held still, in the working colour; and the roll-up is blocked, done, working, BG, ready, after herdr's order (#521). Sending, queueing and Stop, #520's queue of pending messages included, still go by the agent's own status. ## Problem A Claude Code turn can end while work it started is still running in the background, such as a test suite run with `run_in_background` or a background subagent. Claude says something like "the suite is running; I'll ship when it's done", and when the work's `<task-notification>` arrives it starts the next turn on its own. herdr reads the end of that turn as `idle`, or `done` while nobody has looked. So the sidebar and the composer said **DONE** and push sent "work finished", while the work kept going. Seen live: a pane read DONE for about 6 minutes while its suite ran. That suite had been started by a subagent, so its launch was only in the subagent's transcript, and the status line counted no running subagent. ## What changes - **Background commands are counted with subagents.** A `Bash` call whose answer carries `toolUseResult.backgroundTaskId` is a background command. That covers `run_in_background`, Ctrl+B, and commands moved to the background by their timeout, whether the session or a subagent ran them. - It ends with its notice (in any transcript of the session) or with a `TaskStop` answer (`KillShell` in older Claude Code). No notice follows a `TaskStop`. - It is lost when it was started before the pane's Claude process. - These commands join the status line's list (category `shell`) and the pane's count. - **A pane at rest whose turn's work still runs reads BG.** - "The turn's work" means what started at or after the person's last prompt, read from the transcript: `origin.kind: "human"`, or only a `permissionMode` in older Claude Code. The turn that a notice starts is not a new prompt, so the work of the original turn still counts after it resumes. A dev server started in an earlier turn holds nothing. - Such a pane carries `background_wait: true` on every `pane-status` frame and in the snapshot. A missing flag means it is not waiting. - The sidebar's workspace and agent rows, the palette and the tab dot say **BG** instead of DONE or READY, and the composer's hidden state word reads BG to assistive tech. The composer still uses the agent's own status for send, queue and Stop, because Claude takes input while it waits. - **Alerts see a waiting pane as working.** `alertStatus` in `shared/notify-policy.ts` applies to push, its seed and resync, the remote-PC relay, and the browser's tab alerts and droplet. - herdr reports the turn a notice starts as `working` about 2 s after the work ends (live log below). Push sees `working` → `working`, so the turn's start is kept, and the finish is alerted once, when that turn ends, with the whole span as its length. - **Bounds:** - **Grace:** a pane is still held for 60 s after its turn's work ends, in case Claude goes on with the notice. - **Limit:** a pane is held for at most 30 min from when it came to rest. Nothing in the transcript tells a turn waiting on its suite from one that left a server running, so a turn that only started a server reads BG for up to 30 min before its finish alert. - **When a turn ends, the status event reads the pane's files first**, while the pane is still taken for working, and sends one frame with all of it. So no frame says the pane finished first, and work that ended before the turn did holds nothing. Live check that herdr reports a resumed turn: a Claude pane with `sleep 35` in the background. ``` 06:45:31 working 06:45:36 done ← the turn ended on the sleep (bg=0 before this change) 06:46:08 working ← its notice started the next turn, ~2 s after the sleep ended 06:46:12 done ``` ## Tests - **`server/claude-subagents.test.ts`:** - A command found with no `subagents/` folder. - Ends by notice (completed, failed, killed → cancelled), by `TaskStop`, and by `KillShell`. - A subagent's command, ended in its own file or by the session's notice. - Lost with the process. - `turnRunning` across a typed prompt, a notice's turn, an older prompt with no `origin`, a queued prompt, another session's message and an interruption. - `onChange` firing when either count changes. - **`server/background-wait.test.ts`:** - Held and released by a resume. - The grace, the limit, and work that ended before the turn. - A snapshot only filling a gap. - `forget`. - **`server/claude-session.contract.test.ts`** (real herdr, Claude stand-in): - The launch is written as the turn ends, and every frame at rest carries the flag. - No alert goes out while the pane waits. - With a "long turns only" device, exactly one "work finished" goes out for a resume whose own turn is short, so the whole span counted. - A wait that ends with no resume sends one frame without the flag and one alert. - Breaking the alert rule in `onStatus` fails both tests. - **Client:** `alertStatus`, `paneStatus` with the rollup, composer words, `paneAfterStatus`. - **`scripts/ui-regression.ts`:** a waiting pane reads BG in the sidebar's agent row (the arc, held still) and in the composer's hidden word, and its own status again after the wait. ``` bun run typecheck ✓ bun run generate:types --check ✓ bun scripts/ci-tests.ts unit 1567 pass, 0 fail bun scripts/ci-tests.ts integration 229 pass, 0 fail, 6 skip (macOS) bun scripts/ui-regression.ts 79 PASS ``` Reading cost: a cold read of a real 43 MB Claude Code transcript takes 130 ms. Parent lines are parsed only when they can hold a launch, an end, a notice or a prompt. ## Not covered - **Monitor tasks.** Their notices are events with no status, and a persistent monitor runs for the whole session. - **OmO and Codex panes.** OmO counts its own tasks, and Codex does not resume when background work ends. - **herdr's own TUI**, which is another project. 🤖 Assisted by [kilhyeonjun-harness](https://github.com/kilhyeonjun/kilhyeonjun-harness) --------- Co-authored-by: Hako <devswha@gmail.com> * fix(worktree): start a worktree asked from a linked checkout at the repository's workspace (#685) ## Problem **New worktree** and **Open worktree…** could fail in the web UI with herdr's own message: > New and open worktree actions start from the repo parent workspace. herdr starts a worktree only from the workspace on the repository's main checkout (`linked_worktree_source` otherwise). The sidebar hides both menu items on a worktree row, but it can only tell from `workspace.worktree.is_linked_worktree`, and herdr sets that only on a workspace whose checkout it opened itself. A plain workspace opened on a folder that is a git worktree carries no `worktree` info, so the row offers the actions and herdr refuses them. Measured on herdr 0.9.3 in an isolated session: | workspace | `worktree` in `workspace.list` | `worktree.create` | |---|---|---| | on the main checkout | absent until its first worktree | created | | plain, on a linked checkout | absent | `linked_worktree_source` | `worktree.list` asked from the linked workspace does name the repository's workspace in `source.source_workspace_id` (absent when that workspace is not open). ## Fix `POST /api/worktree/create` and `/api/worktree/open`: when herdr answers `linked_worktree_source`, the server reads `worktree.list` for the asked workspace and sends the same request to `source_workspace_id`. With no such workspace open, or when the listing fails, herdr's original refusal is returned unchanged. The normal path makes no extra RPC. No wire shape changes, so `shared/protocol.ts` and the demo transport are untouched. ## Notes - "Start from" left empty means HEAD of the repository's main checkout, as it does in herdr's own form, not the HEAD of the worktree the action was asked from. - A remote PC answers through its own bridge, so it gets this with its next runtime bundle. - When the repository's main checkout is not open as a workspace, the action still fails with herdr's message. Not changed here. ## Tests - New contract test in `server/api.contract.test.ts`: a plain workspace on a `git worktree add` checkout gets `404 linked_worktree_source` while the repository's workspace is closed, then `200` for create and for open once it is open. It fails with `Expected: 200 Received: 404` without the server change. - `bun run check fast` passes (2069 pass, 0 fail). * fix(chat): keep keys typed around a slash completion (#688) ## Change `main` CI failed at 26ccec01 ([run 37939818475](https://github.com/devswha/herdr-web-ui/actions/runs/37939818475), Integration and browser): `scripts/settings-pages-demo-regression.ts` timed out at 320px waiting for `release-notes` after `fill("/rln")`. The test steps are ordinary input; the composer had two product races, both reproduced deterministically and both user-visible. 1. **Stale caret after a completion** (`setTextAndCaret`). The caret was placed in a `requestAnimationFrame`, so input landing before that frame was overwritten. Playwright's `fill` selects all and inserts in two protocol calls. When the frame fell between them, `/rln` was appended to `/pr-comments `, and no slash menu opened (the CI failure). For a user: typing `a` then `b` right after Tab on a busy phone gave `/pr-comments ba`. Fix: commit with `flushSync` and place the caret in the same task. 2. **Swallowed Enter/Tab after narrowing the list.** A passive effect clamped `selectedIndex`, and its update lands in a later render. Enter or Tab in that window read `choices[old index]`, which is `undefined`: the key was prevented and nothing happened. It surfaced on the rebased tree as `"/comments"` left in the box with the menu open. Fix: derive the clamped index during render, and step the arrows from it. No timeout raised, no retry added. ## Validation - Deterministic repros (throwaway, removed): before the fix, `"/pr-comments /rln"` with no menu, `"/pr-comments ba"`, and Tab/Enter leaving `"/comments"`. After the fix, `"/rln"` + `release-notes`, `"/pr-comments ab"`, `"/pr-comments "`. - Two new deterministic steps in `settings-pages-demo-regression.ts`. With each fix reverted, its step fails (`'/pr-comments ba'` / 30 s timeout); with the fixes, both pass. - After the fixes: `settings-pages-demo-regression.ts` passed 10 of 10 runs on the rebased tree, the full `bun run check browser` and `bun run check fast` exit 0, and `integration` exit 0 (before the second fix). Remaining: the reset to row 0 on a new query is still an effect. In that window, Enter picks `min(old index, last row)`, which matches the behaviour before this change. * fix(ci): gate deployment on source-bound verification (#692) ## Change - Require reusable CI and the site build to succeed for the same SHA before Pages publishes the website, demo, or installers. Pin checkouts, keep deployment serialization, and fail closed on stale-main/API errors, including manual runs. - Strengthen existing `bun run check`: durable source-bound JSON and command logs, source/dist invalidation, interrupted/not-run/skipped states, shared lock for `run`, and `run --build` for browser prerequisites. - Retain reports on success and failure. Capture isolated failure screenshots, bounded console errors, and optional traces without DOM/network capture in the main UI and prompt-dock regressions. - Typecheck six critical tooling/demo entrypoints without relaxing strictness. Document parallel ownership, genuine-dependency-only stacks, squash/restack validation and explicit authority. ## Validation - `bun run check fast`: passed after lifecycle fixes; 2242 tests passed, 7 skipped, 0 failed (before the final fail-closed correction, which has focused coverage below). Includes workflow syntax, generated types, both typechecks and app build. - Final focused check/report/browser-evidence/Pages/browser-runner tests: 39 passed, 233 assertions; both typechecks passed. - Actual CLI lifecycle smoke: success/failure logs, build provenance, source/dist mutation invalidation, competing-run lock refusal, SIGTERM report and subsequent lock release passed in a disposable fixture repository with a fake herdr executable. - Actual Playwright synthetic failure: PNG, console metadata, private artifact modes and trace without DOM/network capture captured from an isolated fixture. - Independent policy, deployment/evidence and report reviews completed. Fixed interrupt cleanup ordering, inherited-output draining, shared-report overwrite, unavailable source/build identities, and bounded trace teardown. Actual CLI smoke also covered stubborn descendants, shared-report lock refusal and source-identity loss. Required GitHub CI remains authoritative for final SHA f44e9cc. ## Repository settings and remaining credential boundary - Added `Native Windows install` to required main checks; retained strict checks, admin enforcement, conversation resolution and optional approval count. Latest 30 completed CI runs had 27 Windows successes, one cancellation, and two fork runs awaiting approval without jobs. - This PR does not provision an agent account or GitHub App credential. Non-admin implementation credentials require separate operator provisioning; no claim that current administrator credentials have been replaced. ## Coordination record Owner: coordinating maintainer session. Scope: verification/deployment tooling and operating documentation. Start SHA: b87d9d50019cdb87422415f7650ad29285a832cc. Branch/worktree: worktree/rapid-stone-f62b. Dependencies: existing ci.yml/check entrypoints only; no stacked PR dependency. Integration and release are explicitly authorized by the user, subject to required checks and unresolved-review blocking. * chore(release): prepare 0.4.4 (#694) ## Change Prepare app release 0.4.4 from main after #692, using the existing release process only. - Bump package.json and herdr-plugin.toml together. - Move the existing Unreleased entries under 0.4.4 (2026-10-09 UTC), preserving all PR links and external contributor credits. - Add matching English, Korean, Japanese and Chinese release highlights (3 new, 1 improved, 4 fixed; every line <=90 characters). - No tags are created by this PR. The existing Release workflow must validate the exact main SHA before publishing. ## Validation and review - `bun scripts/release-notes.ts 0.4.4`: passed, generated expected release body. - Release-notes tests: 27 passed, 397 assertions, 0 failures. - `bun install --frozen-lockfile`: passed without dependency changes. - Reviewed the release metadata diff; all prior summary entries are unchanged. The only non-metadata change is the one-line recorder synchronization fix documented below. - Audited release-range PR authors and existing changelog credits; implementation PR #692 is linked. - Required CI must pass on this PR before squash merge; no administrator bypass. Owner: release coordinator (explicitly authorized by user). Start SHA: ceae7a259fa6f0d16ece3e56abb2178e752541dd. Scope: four release metadata files and one release-blocking contract-test synchronization line. Branch: chore/release-0.4.4. Dependencies: merged #692; no open stack. ## Observed release blocker Website run [37973801948](https://github.com/devswha/herdr-web-ui/actions/runs/37973801948) correctly skipped deployment when the existing pending-input contract test read `barrier` before the recorder observed its final Enter. A WebSocket receipt is not a receipt from the separate recorder process. Commit fe09359 adds the existing bounded `waitBytes("barrier\r")` before the exact-byte and no-enqueue assertions, matching adjacent tests. No production behavior, expectation, timeout, or skip condition changed. This tiny prerequisite stays in the release PR rather than creating an artificial release stack; it is a separate commit for review. No changelog entry is needed for an internal test synchronization correction. Verification on the isolated herdr: full pending-input file **37 passed**, then the affected case **10/10 passed** with `--rerun-each 10`. Source-bound reports were preserved. Required CI is rerunning for the new PR SHA; no failed check is bypassed or blindly rerun. * fix(terminal): keep a tab out of use updating; pausing it is a setting (#699) ## Change **Problem.** Since 0.4.4 (#660), a desktop tab detaches its pane one second after the user switches to another window, so that herdr's own TUI gets the pane's size back. The tab then stops updating until it is clicked again. To someone who does not run herdr's TUI next to the browser, this looks like the terminal froze. It also happens on a second monitor where the tab stays in view. **Change.** - A tab that is out of use keeps its pane and its output again, as in 0.4.3. It still sends no resize and reconnects with `keep_size`. Only the release is affected. - **Settings → Terminal → Pause in another window** (`releasePaneAway`, off by default) turns #660's release back on, unchanged, for people who also work in herdr's own TUI on the same PC. - The herdr API has no read-only way to tell whether a TUI client shows the pane: the snapshot has no client field, and `no_foreground_client` comes only from `client.window_title.set/clear`, which change the user's title. So the choice stays with the user. @jiunshinn: #660 made a desktop tab stop updating a second after the user switches windows, and we had a report that this reads as a frozen terminal. This PR makes that release opt-in, off by default. A follow-up will make the setting switch the tab to a read-only `herdr terminal session observe` stream instead of pausing. I measured on 0.9.3 that the observer leaves herdr's TUI at its own size (44x37 stays 44x37, while an attach makes it 150x50), so the tab keeps updating and the TUI is not cut off. Feedback welcome. ## Validation - `scripts/chat-size-regression.ts` against a `bun run check run --build` herdr: 20/20 PASS. The new check (default settings, window blurred, clock run past the 1 s release delay) confirms there is no `detach`, no paused banner, and the pane's `pty-data` still arrives. The existing #660 checks run with the setting on and still pass. - `bun run check fast`: workflow syntax, generated types, typecheck, build, unit tests all ok. - `src/lib/settings.test.ts`: the setting is off by default and only a boolean `true` turns it on. - Settings → Terminal opened in a browser against the isolated test session: the toggle shows up off, turns on, and is saved to `herdr-web-ui:settings`. Korean, Japanese and Chinese strings were added, and `i18n.test.ts` passes. * feat(terminal): a tab out of use watches its pane read-only instead of pausing (#700) ## Change **Problem.** #699 made #660's release opt-in: with the setting on, a desktop tab out of use detaches its pane so that herdr's own TUI gets the pane's size back, and then the tab freezes until it is clicked. People who run herdr's TUI next to the browser had to pick one of two problems: a frozen web terminal, or a TUI cut off at the browser's size. **Fix.** herdr ≥ 0.7.2 has a read-only observer, `herdr terminal session observe <pane> --cols --rows`. Unlike `terminal attach`, it does not take ownership of the pane's size. I measured this on 0.9.3 with a real TUI client and a split pane at 44 columns: | state | pane size (`stty size`) | |---|---| | TUI only | 37 44 | | browser tab in use (attach) | 37 145 | | browser tab out of use, **watching** | **37 44** | | browser back in use | 37 145 | With the setting on, the tab now detaches as before, then watches the pane instead of pausing. The terminal shows "View only while you use another window · click to type". Focus or a pointerdown unwatches and attaches again at the tab's size. A grid change starts the view again at the new grid. A released tab that moves to another pane watches that one. - **Wire** (`shared/protocol.ts`, feature `"watch"`): client `watch {pane_id, cols, rows}` / `unwatch {pane_id}`; server `watch-data {pane_id, data}` / `watch-end {pane_id}`. A watch is not an attach: there is no input, resize, ACK or input-ready, and it never touches `attachments`, claims or `pan…
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change
A failed browser lane kept herdr's server log, but no page screenshots and no reliable per-script timings. This adds wall-second timing and exit-code lines for all 17 browser scripts plus the shared demo build, and an EXIT summary of every script run so far. The first failure still stops the lane; the trap preserves its exit code and removes the temporary demo build. Order, checks, and retries are unchanged.
With CI or CHECK_DIR set, existing screenshots go under
${CHECK_DIR:-.ci}/browser-evidence. The failure artifact includes those PNGs and the existing herdr logs, with hidden files explicitly enabled for the narrowly scoped.cipaths.Evidence is deliberately restricted to sticky-modifier and file-viewer checkpoints (eight viewport PNGs on a complete passing run). The UI suite has evidence-only assertions and viewport changes, and the key-bar demo adds viewport changes and font waits, so their evidence branches remain off in the lane. No live user session is captured: these scripts use isolated test panes and synthetic transcripts. Outside CI/CHECK_DIR, explicit local UI_EVIDENCE_DIR behavior is preserved.
Remaining #552 work:
No CHANGELOG entry: CI/test-only changes are not user-visible, following #548, #581, and #590.
Validation
scripts/ci-browser.test.tstests exercise the real shell lane against stub commands: passing and failing summaries, exact exit 7, first-failure stop, temporary-directory cleanup, evidence filtering, and CI/CHECK_DIR/local behavior. The first three failed on the unchanged lane before implementation, then all four passed.bash -n scripts/ci-browser.shandgit diff --checkpassed.dori heavy tri-client3 -- bun run check fastpassed: actionlint, generated types, typecheck, build, and 1,932 unit tests passed, 0 failed (six existing skips).Refs #552