* feat(plugins): add chat-input-actions slot for plugin toolbar icons
Let plugins render icon buttons into the chat composer toolbar, beside
the model picker, mic, and send button, via the existing named-slot
mechanism (registerComponent). The host mounts the slot in both the
desktop and mobile toolbars and forwards { taskId, taskTitle,
activeSessionId, sessionIds } as slotProps — the active session plus
every kandev session id on the task. Resolving a session id to an
agent/ACP transcript id is left to the plugin (server-side, via the Host
data API); the host only propagates ids.
Docs (PLUGIN-API.md, public plugins/plugins-authoring) document the new
slot and its props.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(plugins): read store optionally in chat-input-actions slot
ChatInputPluginActions read the app store via useAppStore, which throws
outside a StateProvider — breaking existing toolbar tests that render the
composer in isolation. Switch to useOptionalAppStore (fallback to no
sessions) so the slot never hard-requires a provider.
Also: gate the slot behind hideAgentControls to match the other
session-specific toolbar controls, drop a redundant String() coercion,
tidy a dangling docs reference, and cover the taskId=null path.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(scripts): launch dev-isolated backend via __backend subcommand
The kandev binary became a bundle launcher with the restart supervisor
(ADR 0019) and exits without KANDEV_BUNDLE_DIR when invoked bare; the
isolated dev instance must run the backend entrypoint directly.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(mcp): session spawning, sibling messaging, and renameable tabs
- spawn_session_kandev spawns an additional agent session on an existing
task (default: the caller's own) via LaunchSession(IntentStart), with
optional agent_profile_id (defaults to the spawner's profile) and a
session name; the initial prompt carries spawner attribution and reply
instructions.
- message_task_kandev accepts an optional session_id to target a specific
session, enabling same-task sibling messaging. Explicit targets are
pinned through dispatch so the idle-path primary-session re-resolution
cannot reroute a sibling message back to its sender (regression-tested).
- task_sessions gains a name column (migration ordered after the
agent_execution_id-drop rebuild), a session.rename WS action, and inline
tab rename UI; custom names take precedence over derived agent/model
labels across the tab, agents dropdown, mobile list, chat header, and
dockview panel titles.
- Inter-session messages stamp sender_session_name into metadata so the
sender badge shows which session sent the message.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(mcp): address review findings on session spawn/rename/messaging
- include name in task-session DTOs (list + full, no omitempty) so
persisted tab names survive list hydration and clears propagate
- sanitize sender task/session ids embedded in <kandev-system> blocks
- reject cross-workspace spawn targets; require sender_task_id
- truncate session names by runes, not bytes
- distinguish not-found from internal errors in message target lookup
- guard TabRenameInput blur-commit after Enter/Escape resolution
- cap optimistic rename length client-side and toast on rename failure
- add tests: spawn launch-failure and cross-workspace paths, renameSession
API client
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(mcp): round-two review fixes for spawn/rename lint and hardening
- extract spawn validation/authorization helpers (cyclop/nestif limits)
- make stripSystemTag replace until stable to block nested tag evasion
- load session before rename so a durable rename can never skip its
broadcast; surface lookup failures to the caller instead
- drop redundant sessionLauncher nil check (guarded registration)
- add maxLength to the rename input matching the server cap
- add tests: nested sanitizer evasion, spawn rename-failure tolerance
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat: surface agent subscription usage in settings and chat tooltip
Adds live subscription rate-limit visibility for Claude Code and Codex:
- GET /api/v1/agents/usage lists per-agent utilization windows (plan, percent,
reset time) for host agents with subscription credentials; ?fresh=true
bypasses the 5-minute cache with a 15s per-provider clamp.
- Fixes both existing usage clients: Claude parsed float utilization as int
(decode failure) and now reads the richer limits[] array incl. per-model
weekly windows; Codex read a nonexistent auth.json field and response
headers - now reads tokens.access_token, parses the body windows, and
refreshes OAuth tokens on 401. Token refresh persists without dropping
unknown credential fields.
- Settings > Agents gains a Subscription Usage section; the chat context
doughnut tooltip shows the session agent's windows, fetched fresh on hover.
- Shared UsageWindowRows component (bars, Good/High/Critical status,
reset countdowns) keeps settings, tooltip, and office surfaces consistent.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix: recompute agent billing type on every read
Subscription billing detection for Claude and Codex was cached with
sync.OnceValue for the process lifetime, so logging in with OAuth after
the backend started never flipped billing badges or office usage checks
until restart. Detection now re-reads the credential files on each call
and reuses the usage clients' HasSubscriptionCredentials checks. Also
adds a regression assertion that fractional-second resets_at timestamps
parse under the RFC3339 layout.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix: address subscription usage review feedback
- serialize empty utilization windows as arrays, not null
- sanitize per-agent usage errors in the API (raw provider errors are
logged server-side; they can carry credential paths/response bodies)
- persist refreshed CLI credentials via atomic temp-file rename
- keep previous settings usage on transient refresh failure; drop stale
tooltip usage (and its memo) when a fresh fetch fails
- add controller tests for SubscriptionUsage mapping and fresh propagation
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix: coalesce concurrent usage fetches and guard codex token refresh
- serialize usage-cache fetches per key with a double-checked lock so
concurrent fresh requests make one provider call instead of a burst
- reject codex refresh responses with an empty access_token instead of
persisting them and wiping working credentials
- pin the usage-rows reset fixture 30s under the day boundary so the
formatted value is deterministic on fast runners
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix: coalesce failed usage fetches with short negative caching
Concurrent lookups after a fetch error each retried the provider once
the per-key lock rotated. Failures are now cached for 15 seconds (never
longer than the caller's staleness bound), so bursts share one error
result and the provider gets a breather before the next retry.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix: keep stale usage through failed refreshes and skip caching cancellations
Track the last success and last failure independently in the usage
cache: a failed fresh refresh no longer evicts a still-valid success
(non-fresh callers keep the stale value while fresh callers share the
recent error), and a caller-cancelled context no longer records a
negative entry that would penalize other callers.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* test: synchronize concurrent usage-cache tests with a channel barrier
Replaces the sleep-widened race window in the coalescing tests with a
started/release barrier per the backend testing guidelines, and dedupes
the two concurrent-caller tests into one helper.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* fix(web): require confirmation before archiving from PR merged/closed banners
The Archive link in the PR merged/closed status-bar banners archived the
task immediately, unlike every other archive surface. Route it through the
shared TaskArchiveConfirmDialog (cleanup summary + subtask cascade), and
move the banners into pr-archive-banners.tsx since chat-input-area.tsx was
over the file-size lint limit.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* test(web): cover cascade passthrough in banner archive confirmation
Review follow-up: the subtask cascade checkbox is an acceptance criterion
for the banner archive flow, but tests only asserted cascade: false.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* test(e2e): verify cancel path of PR banner archive confirmation
QA follow-up: exercise the dialog cancel path in a real browser — cancel
must close the dialog, keep the banner, and archive nothing.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(web): expose pending state on banner archive confirmation
Thread isPending from useBannerArchiveConfirm into
TaskArchiveConfirmDialog as isArchiving, matching the other archive
surfaces. Guards double-submit when the dialog is reopened while an
archive is still in flight on a slow connection.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* test(e2e): scope archive-cancel click to the alertdialog
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* feat: allow multiline custom answers in clarification overlay
Swap the single-line custom-answer input for an auto-growing textarea so users
can type multi-line replies to ask_user_question. Enter submits, Shift+Enter
inserts a newline; the box grows to ~6 lines then scrolls. Adds unit and e2e
coverage.
* fix: address review feedback on multiline clarification input
- Always preventDefault on desktop plain Enter so an empty draft can't leak a
stray newline before the trim guard (Claude/CodeRabbit).
- On coarse-pointer devices let Enter insert a newline and submit via the
existing Submit button; hide the keyboard hints on touch (mobile parity).
- Preserve newlines in the resolved clarification history message via
whitespace-pre-wrap + items-start.
- Strengthen e2e to guard against fused lines; add Ctrl+Enter and touch tests.
* fix: touch submit button and IME guard for clarification input
- Guard against submitting on the Enter that confirms an IME candidate
(e.nativeEvent.isComposing) on CJK keyboards.
- Add an inline Send button on coarse-pointer devices so single-question custom
answers (which have no overlay Submit button) have a touch-reachable send
path. Fixes the regression from switching touch Enter to newline.
* refactor: extract clarification custom-input controls
- Pull the Enter/⇧↵ hints and touch Send button into a CustomInputControls
subcomponent to shrink ClarificationCustomInput.
- Compute the trimmed draft once and reuse it across the keydown handler and the
Send button (disabled state, click, styling) so the conditions can't drift.
- Add a test asserting the touch Send button is disabled while isSubmitting.
* fix: ignore auto-repeat Enter in clarification custom input
A held Enter key emits auto-repeat keydown events; guard the handler with
e.repeat so it can't fire onSubmit more than once. Adds a regression test.
* fix: suppress newline on repeat Enter and add mobile clarification e2e
- Repeat Enter on desktop now calls preventDefault before bailing, so a held key
can't leak newlines into the current or next question's textarea after the
carousel advances; it still never re-fires onSubmit/finalize.
- Add a mobile-chrome (Pixel 5) e2e covering the touch path: Enter inserts a
newline and the inline Send button submits the multiline answer.
* test: consolidate clarification e2e seed helper
Extract the shared seed → navigate → waitForLoad flow into
e2e/helpers/clarification.ts and delegate from the clarification, resize, and
mobile specs instead of duplicating it in each.
Carlos Florêncio