Commit Graph

11 Commits

Author SHA1 Message Date
Carlos Florêncio d8e0507d17 fix(web): destroy terminal shells on tab close with busy confirmation (#1203) 2026-05-31 23:04:55 +01:00
Daniel Brown c0eaafaf29 fix(mobile): isPassthroughMode falls back to TaskChatPanel when snapshot is missing (closes #1031) (#1034)
* fix(mobile): passthrough TUI rendering + touch-scroll

Two related mobile-UI fixes for cli_passthrough sessions, both
filed in #1031.

1. task-center-panel.tsx: align isPassthroughMode with the rest
   of the codebase by checking session.is_passthrough first. The
   memo previously only consulted agent_profile_snapshot.cli_passthrough,
   which can be undefined in the Redux store on re-mount (the snapshot
   isn't always present on the leaner session-list responses). When
   that happened on mobile, the chat panel rendered the persisted-
   messages TaskChatPanel fallback instead of the live PassthroughTerminal.
   Desktop was immune because dockview-desktop-layout.tsx already uses
   the session.is_passthrough field directly. is_passthrough is the
   source of truth used by manager_startup.go's StartAgentProcess
   routing — keeping the frontend consistent with that invariant.

2. passthrough-terminal.tsx: wire touch-drag scrolling on the xterm
   viewport. xterm.js handles mouse wheel natively but not touch
   gestures, so swiping inside the terminal on mobile bubbled up
   and scrolled the page instead of the terminal scrollback —
   effectively making everything that scrolled off-screen unreachable
   on mobile. The new hook attaches touchstart/touchmove/touchend
   handlers that map vertical drag delta to term.scrollLines(),
   gated on (pointer: coarse) so desktop xterm behaviour stays
   identical. Row-height comes from xterm's internal render dimensions
   with a measured fallback (xterm 5.x layout) and a 16px constant
   fallback if both fail.

Closes #1031

* fix(mobile): also fix useSessionLayoutState's isPassthroughMode + tighten touch-handling

Three follow-on fixes after Dan's mobile QA surfaced more cases:

1. apps/web/hooks/use-session-layout-state.ts — the mobile layout actually
   uses THIS hook's isPassthroughMode memo (not the one in
   task-center-panel.tsx that I previously fixed). It had the identical
   snapshot-only bug. Aligned with the same is_passthrough-first priority.

2. apps/web/components/task/passthrough-terminal.tsx — always preventDefault
   on touchmove (was only doing so when the row-delta calculation rounded
   to non-zero, so sub-row drags slipped through to parent scroll). Added
   touch-action: none + overscroll-behavior: contain inline on the terminal
   element so the browser never claims the gesture.

3. apps/web/app/globals.css — overscroll-behavior: none on body to block
   pull-to-refresh. iOS Safari ignores this in some configurations but
   blocking it where possible reduces the page-reload race that was
   triggering the stuck-on-loading-messages state.

* fix(mobile): trim PR to minimum required changes

After QA showed the user-visible mobile bug is fully addressed by the
useSessionLayoutState memo fix alone, revert the parallel changes to
the desktop hook (task-center-panel.tsx's useSessionApprove) and the
body-level overscroll-behavior — neither was required for the
reported bug, and Dan asked for the smallest possible diff.

Remaining changes:
- apps/web/hooks/use-session-layout-state.ts — actual mobile fix
- apps/web/components/task/passthrough-terminal.tsx — touch-scroll feature

* fix(mobile): tighten isPassthroughMode + drop terminal touch-scroll from this PR

Adversarial-review feedback applied:
- Change `is_passthrough === true` to `!== undefined` so an explicit
  server-side false isn't overridden by a stale snapshot.
- Comment now cites the specific WS handler quirk in
  ws/handlers/agent-session.ts where snapshot writes are truthy-guarded
  but is_passthrough writes are !== undefined-guarded — that's the
  concrete path where partial events land one without the other.

Dropped: the useMobileTouchScroll hook. Terminal scroll on mobile is a
separate feature that deserves its own discussion (xterm renders the
canvas above the scrollable viewport so native scroll doesn't reach the
viewport; the right fix likely lives in xterm itself or a small
event-redirect addon). Keeping this PR scoped to the rendering bug.

* fix(mobile): add minimal touch-scroll fallback for xterm viewport

xterm.js renders .xterm-screen (canvas) above .xterm-viewport, so iOS /
Android native scroll on the viewport never sees the touches and the
terminal is unscrollable on mobile.

useTouchScrollFallback wires touchstart/touchmove/touchend to
Terminal.scrollLines via an accumulated fractional-row delta. No
inertia — the proper fix is upstream in xterm-js. Gated on
(pointer: coarse) so desktop xterm behaviour is unchanged.

Sets touch-action: none + overscroll-behavior: contain inline on the
terminal element so the browser doesn't claim the gesture for
pull-to-refresh.

* fix(mobile): inertia decay on touch-scroll release for native-scroll feel

* fix(mobile): address adversarial review of touch-scroll hook

- Read xterm from ref inside each handler so renderer recreate doesn't
  strand the handlers on a stale Terminal instance (React refs are
  stable so dep array doesn't catch .current swaps).
- Drop the internal _core._renderService private-API path for row
  height in favor of public term.rows + measured element height. The
  internal path was API-unstable across xterm majors.
- Velocity window 80ms → 50ms so a direction reversal at the tail of
  the gesture is the release velocity, not averaged against the early
  motion.
- Reset pendingRows fractional accumulator on direction reversal — was
  causing perceptible stickiness when reversing from slow-up to fast-down.
- Style restoration now uses removeProperty when the inline style was
  never set, rather than leaking an empty string in its place.

* fix(mobile): revert touch-scroll hook from this PR — separate concern

After several iterations the touch-scroll fallback kept surfacing new
issues (iOS pull-to-refresh leaking through preventDefault, scroll
direction reversal edge cases) that suggest a more involved upstream
discussion is needed about whether to ship a workaround in
PassthroughTerminal at all vs fixing xterm.js's mobile story upstream.

Splitting that work out so this PR can land the rendering bug fix
cleanly. Will file a separate issue for the touch-scroll work with
the diagnosis + alternatives we explored.

* fix(mobile): honor is_passthrough when snapshot missing

---------

Co-authored-by: Carlos Florêncio <carlosmflorencio@gmail.com>
2026-05-25 22:09:17 +01:00
José Almeida 3bc092bf20 feat(terminal): first-class user terminals — stable seq, rename, park/resume (#1009)
* feat(terminal): persist user terminals with stable seq + park state

Ordinary user shells now have a DB-backed `user_terminals` row keyed by
the agentctl PTY id, carrying a per-task monotonic seq (gaps preserved on
delete), custom_name override, and open/parked state. The terminal
service owns the create/list/rename/park/resume/destroy surface and
guards reject `bottom-panel` (cmd+J) + `script-*` ids so passthrough
flows are untouched. Closing a tab now parks (PTY keeps running);
destroy kills the PTY and removes the row.

* feat(web): expose terminal seq badge, rename, and parked-terminals menu

Wires the right-panel strip and SSR page state to the new task-keyed
terminals endpoint and discriminated UserShell union, adds the `#N`
badge for ordinary terminals, plumbs context-menu / double-click rename,
and renders a "Parked" submenu so closed-but-running terminals can be
resumed. Closing a managed tab now parks instead of destroying so the
PTY (and its buffer) survives accidental closes.

* test(terminal): e2e coverage for first-class persistent entities

Covers the persistence guarantees the user explicitly called out:
monotonic seqs, refresh-survives-rename-and-park, gap-preserving destroy,
park+resume cycle, and bottom-panel/script guards. Exercises the new
user_shell.{create,list,rename,park,resume,destroy} WS actions through
the shared ApiClient.wsRequest helper.

* fix(terminal): atomic seq allocation + propagate destroy errors

- Repository.Create folds MAX(seq) read + INSERT into a single
  `INSERT … SELECT` statement so concurrent creates can no longer pick
  the same seq. Locked in with TestCreate_ConcurrentSeqAllocation (25
  parallel creates, all unique).
- wsUserShellStop now propagates the service-Destroy error so the
  frontend stops optimistically removing a row the backend failed to
  delete.
- Service.Destroy / CleanupTask log PTY-stop failures at Warn (instead
  of silently swallowing) while keeping the proceed-on-failure semantics
  intentional — the DB row is the source of truth for "user expects
  this terminal gone".
- IsUserShellAlive copies ProcessID under the read lock before calling
  r.Get(), removing the post-unlock pointer-deref race.
- Get-not-found test asserts errors.Is(err, ErrNotFound) so it locks to
  the repository contract.

* fix(web): close-tab waits for backend ack + className undefined guard

- handleCloseTab defers `removeTerminal` into the `.then()` of the
  park/destroy promise. A failed backend call leaves the tab visible
  rather than vanishing it optimistically; the next `user_shell.list`
  poll reconciles state.
- session-tabs guards `tab.className` with `?? ""` so an undefined value
  no longer produces "undefined group relative..." in the rendered
  class string.
- user-shells.test simplification: `createSessionRuntimeSlice` only
  consumes `set`, so the test passes the slice creator straight to
  `immer()` instead of wrapping it in an adapter with unused args.

* fix(terminal): task-scoped mutations + legacy-shell list + UI hardening

Round-2 review feedback (cubic P1/P2, claude, coderabbit):

Backend:
- Rename/Park/Resume/Destroy now require a task_id and verify the
  terminal belongs to that task via a shared requireOwnership helper.
  Cross-task mutations return ErrTaskMismatch instead of silently
  succeeding by raw terminal id.
- wsUserShellList no longer drops managed-shaped agentctl shells when
  the terminal service is disabled or task_id is missing — legacy
  passthrough callers see their existing shells again. `managedCovered`
  flag scopes the orphan filter to the DB-backed path.
- service_test.go uses the shared-cache in-memory SQLite + MaxOpenConns(1)
  setup, matching repository_test.go and removing the flake-one-race-away
  warning.
- New cross-task guard tests: TestRename_RejectsCrossTask,
  TestPark_RejectsCrossTask, TestDestroy_RejectsCrossTask, plus a
  TestRename_EmptyTaskIDSkipsOwnership for internal callers.

Frontend:
- updateUserShell patch type narrowed to Partial<Omit<UserShellInfo,
  "terminalId">> so the row key can't be silently mutated.
- destroyUserShell now throws on a missing WS client instead of silently
  resolving — handleCloseTab's .then() no longer fires prematurely.
- rename/park/resume/destroy API client + useTerminals hook plumb the
  active task id through every mutating call.

E2E:
- New "cross-task mutating ops are rejected" spec creates a terminal
  under task A and verifies task B can't rename/park/destroy it by raw
  id.
- Existing specs updated to send task_id with their mutating calls.

* fix(terminal): require task_id on all mutators + wire taskID into hooks

Round-3 review feedback (cubic P1, claude blocker, coderabbit):

Backend:
- requireOwnership no longer skips the ownership check when taskID is
  empty. The previous carve-out was reachable from the WS layer (where
  task_id is user-controlled), so an attacker who guessed a terminal id
  could omit task_id and mutate any row. CleanupTask walks the repo
  directly and never touched the bypass.
- TestRename_EmptyTaskIDRejected pins the new contract.

Frontend (the real bug claude caught):
- useUserShells now accepts a taskId parameter and forwards it on the
  user_shell.list WS call. Without it the backend's DB-backed ordinary-
  shell path was skipped and the Zustand store wiped the SSR-hydrated
  panel strip on the first WS fetch.
- Response mapping switched to a discriminated union: id (new field)
  falls back to terminal_id (legacy), and kind/seq/state/pty_status/
  display_name/custom_name flow into the store so the parked-terminals
  submenu actually populates.
- useTerminals + useMobileTerminals read the active task id from the
  store and pass it through to useUserShells.
- destroyUserShell now retries with user_shell.stop when the server
  returns an unknown-action error — keeps the rollout-window
  compatibility intact for older backends that only know the legacy
  action name.

* fix(terminal): list parked, rollout-safe kind default, helper extraction

Round-4 review feedback (claude + greptile P1):

- useUserShells now sends include_parked: true so the "Parked terminals"
  submenu populates after a page reload. Previously the WS list returned
  only state=open rows; parked terminals were invisible until the user
  parked something in the same session. The main strip still hides
  parked entries via buildTerminalsFromShells.
- useAddTerminal stops blindly defaulting kind to "ordinary" — that
  misclassified legacy passthrough payloads (terminal_id without seq)
  during a rollout where the frontend is newer than the backend. The
  managed-tab path then called parkUserShell on a server that didn't
  know the action. Now only tags as ordinary when kind is explicit or
  the row carries a seq.
- handleCloseTab extracted into a standalone useCloseTab + helpers
  hoisted into use-terminals-build.ts / use-terminals-types.ts. Brings
  use-terminals.ts back under the 600-line file limit and the
  useTerminalActions wrapper inside the 100-line function limit.

* fix(terminal): scope-keyed shell cache + null-task guard + tighter rollout default

Round-5 review feedback (cubic P1, coderabbit x4):

- useUserShells now keys its fetch cache on env+task (`${env}:${task}`),
  not just env. An earlier load without a task id (e.g. before the
  active task hydrated) no longer pins the store on a legacy-only shell
  list and blocks the task-scoped refetch.
- useMobileTerminals delays auto-create until a real taskID is
  available. Previously a null taskID could bootstrap a legacy
  non-persistent shell, mark the env as auto-created, and starve the
  real task of its first-class terminal. Guard key is now env:task, and
  releaseAutoCreatedEnvironment clears every scope on that env.
- useAddTerminal tightens the rollout check: a row is "ordinary" only
  when `seq !== undefined`. A bare `kind: "ordinary"` without seq from
  an older backend stays legacy so close → destroy on the first click.
- useRemoveTerminal reads the current activeTab from a ref instead of
  closing over the value captured when handleCloseTab first ran. Async
  park/destroy resolves after a user tab-switch no longer clobber the
  newer selection with the stale fallback shift.

Tests:
- New "waits for taskID before auto-creating — null taskID is a no-op"
  case in use-mobile-terminals.test.ts confirms the null-task guard.
- All existing mobile-terminal + slice + E2E tests pass.

* fix(terminal): live activeTab lookup + selectable-tab guard

Round-6 review feedback (cubic P2 x2):

- getActiveTab now reads the active tab from the Zustand store via
  storeApi.getState() instead of a useRef/useEffect pair. Closes the
  post-render race where an async close handler could resolve between
  the new render's commit and the effect-driven ref sync.
- computeTerminalTabValue requires activeTab to be selectable
  (present in `terminals` or === "commands") before honoring it. A
  stale id left over from a parked/destroyed terminal no longer pins
  the panel on a nonexistent tab and blocks the fallback shift to a
  real shell.

* chore(terminal): inline savedTabFromStorage to drop file under line cap

Round-7 review feedback (claude suggestion): the useMemo around the
synchronous getSessionStorage call was zero-value memoisation that
pushed use-terminals.ts three lines over the 600-line max-lines limit.
Inlined; file now at 600 lines.

* chore(terminal): drop savedTabExists local + comment to land under 600 lines

Round-8 follow-up (claude): the previous commit's two-line comment block
held the file at 603 lines (still over the 600-line cap). Inline
savedTabExists at the only call site and remove the redundant comment —
the round-7 PR thread already explains why the useMemo was removed. File
now at 599 lines.

* fix(terminal): plumb task_id through dockview + tolerate legacy destroys

Manual-test feedback: clicking X on a dockview terminal panel surfaced
"destroy terminal: terminal does not belong to the supplied task" because
the dockview path was creating + destroying terminals without sending
task_id at all. The new requireOwnership guard then correctly rejected
the empty task_id against a non-empty term.TaskID.

Frontend:
- addTerminalPanel grows task_id + title parameters; stamps both into
  panel params at creation time so the destroy cleanup can pass them
  back to user_shell.destroy / .stop.
- Every dockview-side createUserShell call site now passes the active
  task_id, so the backend creates a DB-backed ordinary terminal (with
  seq + displayName) instead of a legacy passthrough shell.
- destroyUserShell + stopUserShell already accepted an optional task_id;
  dockview-layout-setup.onDidRemovePanel now reads the stamped task id
  from panel params and forwards it.

Backend:
- wsUserShellStop now requires both terminalSvc and a non-empty
  req.TaskID before routing through the managed service. An empty
  task_id falls through to the legacy passthrough StopUserShell so older
  clients (and dockview panels persisted before task_id was stamped)
  keep working.

Known follow-ups (separate task): the #N badge, rename context menu,
and parked-terminals dropdown still only show on the mobile/tablet
right-panel strip. Desktop dockview shows the seq inside the panel
title text but doesn't expose the badge/rename/parked-list UI yet.

* feat(terminal): dockview tab badges + rename context menu + existing-terminals list

Manual-test feedback round 2:

- Custom dockview tab component (TerminalTab) renders the #N pill
  only when the active env has more than one ordinary terminal —
  mirrors the session-tab badge semantics. Right-click on any ordinary
  terminal tab now exposes Rename / Park / Destroy.
- Dockview + menu picks up a new "Terminals" section listing every
  ordinary terminal for the active task (open and parked). Clicking a
  row focuses the existing dockview panel if one is mounted, otherwise
  re-opens it; parked rows are auto-resumed via user_shell.resume
  before the panel is added. The base "Terminal" action was renamed
  to "New Terminal" so the existing-terminals list is distinguishable
  in the menu.
- Reopen menu uses a stable EMPTY_SHELLS sentinel for its store
  selector to avoid Zustand infinite re-renders when the env has no
  shells.

E2E:
- terminal-new-tab.spec uses getByRole("menuitem", { name: "New
  Terminal", exact: true }) to disambiguate from the new "Terminals"
  submenu label.
- Full terminal suite still passes (26/26).

* fix(terminal): tab title shows "Terminal" with seq as badge, populate store on session page

Re-reading the user feedback: the title text was rendering as
"Terminal 1" (backend's displayName), and the dockview "+" menu's
Terminals section was empty because nothing on desktop was calling
useUserShells to populate the store.

- TerminalTab.pickDisplayName now returns the literal "Terminal" for
  ordinary terminals (custom names still override). The seq lives only
  in the sibling badge — same split as session-tab where the agent
  name is the title and the seq is a pill before it. Reading "Terminal
  1" out of "[1] Terminal" instead of "[1] Terminal 1".
- LeftHeaderActions (dockview "+") now calls useUserShells on mount.
  Without this the desktop layout never triggered the WS list fetch,
  so the Terminals submenu and the badge "count > 1" check both saw
  an empty store and silently disappeared.
- TerminalReopenMenuItems also calls useUserShells defensively (cheap
  thanks to scope-keyed cache) so it works when mounted in isolation.

* feat(terminal): "New X" rows live inside their section labels

User feedback: move "New Agent" under the Agents section header and
"New Terminal" under the Terminals section header so the dockview "+"
menu reads top-to-bottom as Agents → New Agent → existing sessions →
Terminals → New Terminal → existing terminals → other panels.

- SessionReopenMenuItems accepts an optional onNewSession prop and
  renders the "New Agent" row as the first item under the "Agents"
  label. Render gate now keeps the section visible whenever the create
  handler is supplied, even with zero existing sessions.
- TerminalReopenMenuItems gets a matching onNewTerminal prop with
  the same behaviour ("New Terminal" row under the "Terminals" label).
- dockview-add-panel-items drops its standalone "New Agent" and "New
  Terminal" rows since both now live inside their sections.

* feat(terminal): auto-migrate default panel to DB-backed ordinary terminal

The legacy `terminal-default` dockview panel was hard-wired to a
non-managed `shell-default` PTY so it never picked up an ordinary
seq/customName/parked state — the new "Terminal N" badge UX could
only show a badge once the user had explicitly created a second
terminal. With useEnsureDefaultTerminalOrdinary the default panel is
upgraded into a real `shell-<uuid>` row on session-page mount, so
every visible tab is now a first-class ordinary terminal.

Plus a UI-level e2e spec asserting the multi-terminal title + badge
contract, and an expectation bump on the existing rename+park spec
since visiting the session page now mints 1 extra ordinary terminal.

* fix(terminal): park ordinary terminals on tab close so they survive refresh

Dockview's tab X close button routed straight to stopUserShell (an
alias for destroyUserShell), wiping the DB row on close — after a
refresh the user had no way to resume a still-running PTY they had
just tucked away.

The X is now a "hide for now" affordance: ordinary terminals get
parked (PTY survives, row stays in DB, reappears in the "+" →
Terminals menu with a `parked` pill), while scripts / bottom-panel /
legacy passthrough shells stay on the destroy path because they have
no resume story.

Permanent delete still lives on the right-click Destroy menu item
and (in the next commit) on each reopen-menu row.

* fix(terminal): preserve DB-backed terminal panel ids across layout restore

The serializer's normalizePanel rewrote every user-created terminal
panel id to `terminal-saved-N` and dropped environmentId/taskID from
params, so after a reload that panel couldn't be matched back to its
live PTY or its store record — the tab rendered with no badge and a
stale fallback title.

Treat `shell-<uuid>` panel ids the same way we already treat
`terminal-default`: preserve id and params on restore. Legacy
ephemeral `terminal-saved-*` ids still mint a fresh PTY on restore.
Also force tabComponent=terminalTab and title="Terminal" for any
restored terminal panel so layouts persisted before the badge UX
land on the new presentation.

* feat(terminal): destroy button on reopen-menu rows for permanent delete

Destroy used to live only on the tab's right-click menu — useless once
the tab was already closed. Each ordinary terminal row in the dockview
"+" → Terminals submenu now ends with an × button that confirms-then
calls destroyUserShell, killing the PTY and dropping the DB row so the
terminal does not reappear after reload.

Pairs with the previous close-to-park change: closing the tab parks
(soft, resumable), the × button on the menu row destroys (hard,
permanent).

* fix(terminal): reopen-menu focuses existing tab, drops parked pill, says Terminate

Three small fixes to the dockview "+" → Terminals submenu:

1. Clicking a row whose terminal is already mounted now FOCUSES the
   existing panel instead of duplicating it. The default-migrated
   panel keeps its registry id `terminal-default` even after the
   migration to a `shell-<uuid>` PTY, so a direct getPanel(uuid) miss
   would fall through to addTerminalPanel and create a second tab for
   the same PTY. Fall back to scanning `params.terminalId` so the
   lookup catches that case.

2. Drop the "parked" pill from the row — parking is now an internal
   detail (close = park) that the user doesn't need to read off the
   menu. Clicking the row brings the terminal back into view either
   way, so distinguishing it visually is noise.

3. Rename the row × tooltip + confirm copy from "Destroy" / "Permanently
   delete" to "Terminate" to match the new tab-context-menu label.

Spec: add a test that asserts no duplicate tab when reopening an
already-open terminal, and drop the parked-pill assertion from the
existing close+reload test.

* feat(terminal): empty-group watermark uses the rich + menu

When a user splits a group (split-right / split-down) the new half is
empty and dockview renders the watermark. Before this, the watermark
showed a hard-coded Agent/Plan/Terminal/Browser row and clicking
"Terminal" called createUserShell without a taskId — so it spawned a
legacy passthrough shell that never appeared in the user-shell list,
and clicking "Agent" only ever focused the singleton chat panel
(invisible if the task had multiple sessions).

The watermark now renders the same AddPanelMenuItems content the
header "+" uses, so the user gets:
- The Agents list (existing sessions, greyed when already open)
- The Terminals list (existing terminals, greyed when already open)
- The Browser/Plan/VS Code/Changes/Files/PR options

…served behind a single "Add panel" dropdown trigger centered on the
empty group.

* feat(terminal): inline rename on the tab; drop Park, rename Destroy → Terminate

The tab title is now editable in place — picking Rename from the
right-click context menu swaps the title for an input. Enter commits,
Escape / blur-with-no-change cancels, and the new name is pushed
through renameUserShell + the user-shell store so the API and badge
list stay in sync. Replaces the previous window.prompt which felt
out of place in the dockview chrome.

While here:
- Drop the "Park (hide, keep PTY)" context-menu item. Tab close
  already parks ordinary terminals, so the explicit Park action was
  redundant and broke the "one obvious affordance per outcome" rule.
- Rename "Destroy" → "Terminate" in the context menu. Matches the
  reopen-menu × tooltip and reads more like a system action than a
  destructive UI primitive.

Spec adds an inline-rename test asserting the input appears, accepts
typed text, and commits the new title to the tab.

* fix(terminal): right-click Terminate closes the tab; drop displayName DOM warning

Two unrelated fixes both landing in terminal-tab.tsx:

- Terminate used to fire the WS destroy and update the store, but left
  the dockview panel mounted with a dead PTY underneath. Now it
  optimistically drops the shell row from the store, closes the panel
  via api.close(), then sends the destroy — same effect as the X close
  but routed to the hard-destroy path (the onDidRemovePanel cleanup
  sees no shell entry and skips its park branch).

- TerminalTabBody typed `displayName` as a prop but never destructured
  it, so {...props} spread it into DockviewDefaultTab and on into a DOM
  div, triggering "React does not recognize the `displayName` prop on
  a DOM element". Drop it from the spread.

* feat(terminal): polish + menu — badge-style indices, flush-left New rows, terminate closes panel

Polish pass on the dockview "+" → Agents / Terminals submenus:

- Replace the plain `#N` text with the same pill-style badge the tabs
  use (small bg, rounded, 11px). Agents and terminals both pick this
  up — so the menu row reads "[N] label" matching the tab style.
- Drop the empty index-column placeholder span on the "New X" rows so
  the icon + label sit flush-left under the section header instead of
  awkwardly indented.
- Strip the backend "Terminal {seq}" suffix from row labels — the
  badge already carries the number, so showing "Terminal 1" next to
  the "1" pill duplicated it. Custom-renamed terminals still show
  their name.
- The row × button now also closes the dockview panel if the terminal
  is currently open, mirroring the right-click → Terminate flow.

Spec: switch the row-by-seq lookups from `hasText: "#N"` (now stale
since the `#` prefix is gone) to a `has:` filter against the new
`reopen-terminal-seq-N` badge testid, and add a regression test for
right-click → Terminate closing the tab and removing the row in one
gesture.

* fix: address terminal review feedback

* fix: resolve terminal review suggestions

* fix: catch terminal close stop failures

* fix: harden terminal terminate failures

* fix: use pinned pnpm docker arg

* fix: satisfy backend lint after main merge

* fix: stabilize e2e after layout merge
2026-05-24 12:59:30 +01:00
João Salavisa 78609c005e feat(terminal): scroll mobile passthrough terminal scrollback via touch (#1046)
* feat(terminal): add touch-scroll helper for xterm scrollback

Pure helper that translates single-finger vertical drags into
`terminal.scrollLines(n)` calls. Handles threshold gating so taps still
reach xterm, ignores multi-touch, yields to horizontal-dominant drags.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* feat(terminal): wire mobile touch scrollback into passthrough terminal

Adds an `enableTouchScroll` prop on PassthroughTerminal and a thin hook
that calls `attachTouchScroll` while the terminal is mounted. The two
mobile mount points (terminal panel + chat-panel passthrough embed) opt
in; desktop callers are unaffected. Fixes the bug where xterm.js's
canvas absorbed touch gestures and left the scrollback unreachable.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* test(terminal): mobile e2e for passthrough touch-scroll

Pixel 5-emulated Playwright spec: produce 200 lines of output, simulate
a single-finger down-swipe, assert `terminal.buffer.active.viewportY`
moved into the scrollback, then swipe back to return. Extends the e2e
buffer reader to expose viewportY alongside `__xtermReadBuffer`.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* test(terminal): relax mobile swipe-back assertion against late shell output

Replace the exact `.toBe(bottomViewportY)` check with
`.toBeGreaterThanOrEqual` so the test doesn't flake if shell echo
arrives between the snapshot and the post-swipe read. xterm clamps at
the buffer boundary, so overshooting back-to-bottom is impossible.

Addresses PR #1046 Claude review thread 3293258085.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* docs(terminal): document useTouchScroll's isTerminalReady invariant

Adds a comment next to the eslint-disable explaining why the deps
array can safely omit terminalRef/xtermRef: useTerminalInit only flips
isTerminalReady false→true once per mount. A future refactor that
recreates the terminal mid-mount must add a new dep.

Addresses PR #1046 Claude review thread 3293258175.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* chore(terminal): clear all exposed buffer-reader fields on dispose

clearBufferReader now nulls `__xtermGetFontFamily` and
`__xtermGetFontSize` alongside the buffer readers. The two predated
this PR and were never cleaned up; keeping the teardown symmetric with
exposeBufferReader prevents stale references if the container is ever
reused.

Addresses PR #1046 Claude review thread 3293274674.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* test(terminal): reset document.body between touch-scroll cases

Adds an afterEach to wipe jsdom's body so orphan divs from one test
don't bleed into the next. Avoids cross-test pollution if a future
case queries document.body for containers.

Addresses PR #1046 Claude review thread 3293274769.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-23 19:27:49 +01:00
Carlos Florêncio 0b2085688b feat(office): autonomous agent management layer (#914) 2026-05-16 20:07:57 +01:00
José Almeida 6fa38cd62c fix(terminal): re-key user-shell RPCs to task_environment_id (#770)
* refactor(backend): re-key user-shell RPCs to task_environment_id

user_shell.list/create/stop now take task_environment_id directly
instead of session_id with a session→env translation. Sessions in the
same task share one shell list, so the env is the natural scope.
HTTP route /api/v1/sessions/:id/terminals → /api/v1/environments/:id/terminals.
shell.status/subscribe/input (agent passthrough) stay session-keyed.

* fix(backend): heal task_sessions.task_environment_id on boot

Sessions created via paths that didn't write the FK left shell ops
broken — every env-keyed user-shell RPC failed to resolve the env and
the frontend silently swallowed the error. The boot heal links each
orphan session to its task's existing env (idempotent, runs after
backfillTaskEnvironments + healDuplicateTaskEnvironments).

* refactor(web): drop session_id from user-shell API, hooks, and slice

createUserShell/stopUserShell/fetchTerminals take environmentId.
useUserShells takes envId directly (no environmentIdBySessionId
translation). useTerminals takes both (env for shell ops, session for
tab UX persistence). Slice actions key writes by env id directly,
removing the silent no-op when the session→env mapping wasn't set yet.

* refactor(web): wire env id through dockview, right-panel, and SSR call sites

Dockview "+" menu, terminal scripts dropdown, dev-preview button,
right-panel "+" button, Ctrl+\` toggle, watermark, and panel-close
cleanup all source the env id from useEnvironmentId() / store and pass
it to createUserShell/stopUserShell. Shell-mode passthrough terminal
no longer blocks on session id — env id is sufficient. SSR resolves
the active session's task_environment_id from the session list and
calls fetchTerminals with the env id.

* test(e2e): cover env-keyed terminal new-tab flows + WS payload guard

New spec exercises the right-panel "+" button and the dockview "+ →
Terminal" menu, asserts the new tab connects, and intercepts outgoing
user_shell.create WS frames to verify the payload carries
task_environment_id and never session_id. A heal-coverage assertion
checks every listed session has task_environment_id populated post-boot.

* fix(e2e): drop right-panel '+' test, dockview is the only '+' path on desktop

The mobile TaskRightPanel SessionTabs aren't rendered at desktop
viewports — the dockview '+' menu is the sole new-tab affordance, so
testing the mobile path on chromium just timed out clicking a button
that never mounted. Consolidate into a single dockview '+ → Terminal'
test that asserts the new panel gets the backend-assigned 'Terminal 2'
label (proving env-shared shell list) plus the WS-payload regression guard.

* fix(e2e): assert dockview terminal-tab count, not 'Terminal 2' label

Dockview hardcodes the panel title to 'Terminal' for every tab — only
the mobile right-panel SessionTabs surface the backend's 'Terminal N'
label. Switch the assertion to count tabs to keep the e2e green.

* test(backend): cover SQL NULL branch of healSessionTaskEnvironmentIDs

Adds insertSessionWithNullEnvID and TestHealSessionTaskEnvironmentIDs_LinksNullOrphans
so the WHERE-clause IS NULL predicate is exercised — the existing tests only
seeded empty-string FKs. Also adds LIMIT 1 to the heal subquery as a
defensive measure: the unique index already guarantees ≤1 row per task at
runtime, but the SQL now reads as deterministic in isolation.

* refactor(web): drop dead taskGateOk on agent terminal WS gate

Agent passthrough routes by sessionId, not taskId — taskId was only used
for logging. Gating the WS effect on taskId forced agent terminals to
wait for useSession() to hydrate, adding a refresh-race window that
didn't guard any real precondition. connectionKey + canConnect already
cover the meaningful preconditions.

* fix(web): stamp env id on terminal panels for accurate cleanup

addTerminalPanel now bakes environmentId into the panel's params at
creation time. The dockview-layout-setup onDidRemovePanel handler
prefers the stamped env over re-deriving from the active session, so
closing a terminal that was opened under a different task no longer
calls stopUserShell with the wrong env (which silently no-ops on the
backend and leaks the shell process until session teardown). Falls back
to the active session's env for legacy panels persisted before the
param existed.

* fix(web): keep task id logging out of terminal reconnect deps
2026-05-02 15:19:02 +01:00
José Almeida c0ce55ff9d fix: unblock terminals stuck on Connecting and heal task_environments (#769)
* fix(gateway): snapshot agentctl status and env id on session subscribe

Late-subscribing clients (page reload, task switch, WS reconnect) miss
the agentctl_ready and task_environment_id events fired during the
original launch. Without them, the env-routed shell terminal gate stays
stuck and the panel hangs forever on "Connecting terminal...".

- appendSessionStateMessage now carries task_environment_id so the
  frontend can seed environmentIdBySessionId for the active session.
- New appendAgentctlStatusMessage snapshots current agentctl readiness
  via a bounded Health probe and emits session.agentctl_ready /
  _starting to flip the client gate out of `undefined`.
- GetOrEnsureExecutionForEnvironment now publishes AgentctlStarting to
  mirror EnsureWorkspaceExecutionForSession and keep gate transitions
  monotonic.

* fix(web): drop shell-mode agentctl gate to unblock env-routed terminals

The shell terminal gate required agentctlStatus.isReady to flip to ready
before opening the WS, but that event may have fired before the client
subscribed (page reload, task switch, local-executor task switch). The
lazy create-on-terminal-connect path on the backend never fires either,
because the WS never opens — chicken-egg.

Backend env handler already waits for remote workspace readiness
server-side (waitForRemoteExecutionReadyWithTimeout), so the client
just needs the routing keys (env id + session id). Agent-mode terminals
still gate on readiness — the agent process must be wired before
passthrough I/O is meaningful.

Extract computeCanConnect helper to keep PassthroughTerminal under the
complexity ceiling.

* test: cover terminal-hang on subscribe snapshot and env-routed gating

Adds a backend unit test asserting appendSessionStateMessage carries
task_environment_id (the deterministic RED for the env-map seed bug),
plus E2E scenarios for the user-facing repros: cold load, kanban switch,
hard reload, sidebar switch, and a local-executor task switch that used
to poison the terminal for every subsequent task. Adds an
expectTerminalConnected helper to SessionPage to detect the
"Connecting terminal..." overlay.

* fix(repo): heal task_environments on boot and enforce one env per task

Live DB audit on the user's machine surfaced two corrupt-data classes that
manifest as the user-facing "terminal doesn't appear / Failed to fetch
terminals: 503" symptoms:

- 15 worktree-mode envs with worktree_path set but workspace_path empty.
  GetOrEnsureExecutionForEnvironment returns ErrSessionWorkspaceNotReady
  forever, the env terminal handler 503s.
- 3 tasks with two task_environments rows (race in lazy create — pairs
  4-6 s apart, both ready, distinct workspace_path).

healTaskEnvironmentWorkspacePaths backfills workspace_path = worktree_path
on the affected rows, and healDuplicateTaskEnvironments collapses each
duplicated task to its most recently updated env (re-pointing any sessions
still on the loser, then dropping the loser row).

ensureTaskEnvironmentTaskUniqueIndex adds a UNIQUE index on
task_environments(task_id) so a future race fails loud. Order matters:
heal must run first to drop duplicates before the unique index is created.

* fix(repo): reject empty workspace_path on worktree envs

The orchestrator's persistTaskEnvironment update branch previously left
workspace_path untouched, so an env created with empty workspace_path
would stay corrupt forever — terminals 503 with ErrSessionWorkspaceNotReady.

Tighten the repository boundary: CreateTaskEnvironment refuses worktree-mode
inserts without workspace_path, and UpdateTaskEnvironment refuses to clear
it back to empty. A future writer regression now fails loud at the boundary
instead of producing a row that breaks the env terminal handler.

* fix(executor): refresh paths on env update and dedupe by task

The persistTaskEnvironment update branch only mutated AgentExecutionID +
Status, so envs created earlier with an empty workspace_path stayed
permanently broken across launches. Refresh worktree + workspace fields
on update via a shared computeWorkspacePath helper used by both branches.

Concurrent launches for the same task previously raced inside this
function — each saw existingEnv == nil and each called
CreateTaskEnvironment, producing duplicate rows ~4-6 s apart in the live
DB. Hold a per-task mutex (mirroring sessionLocks) and re-fetch the env
inside the critical section so siblings reuse the row the first launch
persisted. The repo's unique index on task_environments(task_id) is the
durable guarantee; the lock just closes the window before the constraint
trips.

* test(repo): cover task_environments heal, validation, unique index

Repository unit tests for the new heal steps and writer guards:
- HealTaskEnvironmentWorkspacePaths_BackfillsEmpty / LeavesPopulatedAlone /
  Idempotent
- HealDuplicateTaskEnvironments_KeepsMostRecent (asserts session re-link to
  winner) / NoOpWhenSingle
- EnsureTaskEnvironmentTaskUniqueIndex_BlocksFutureDuplicates
- CreateTaskEnvironment_RejectsEmptyWorkspaceForWorktree /
  AllowsNonWorktreeWithEmptyWorkspace
- UpdateTaskEnvironment_RejectsClearingWorkspaceForWorktree

Tests live in the sqlite package so they can exercise the unexported
heal* helpers directly, mirroring how the boot path calls them.

* fix: address PR review feedback

- helpers.go: drop the 2 s blocking Health probe in
  appendAgentctlStatusMessage. sendSessionData runs in the WS read loop, so
  the probe was delaying every subscribe/focus ACK by up to 2 s. Use
  GetWorkspaceStream() != nil as the cached readiness signal — the stream
  manager only attaches it after Health succeeds, so its presence is a
  free, non-blocking proxy. Subsequent waitForAgentctlReady events still
  correct the snapshot if it picks the wrong one.

- manager_execution.go: publish AgentctlStarting INSIDE createExecution,
  before spawning waitForAgentctlReady. The previous order published it
  after createExecution returned, which let the goroutine race past on
  fast Health and deliver Ready before Starting. Drop the now-redundant
  publishes in EnsureWorkspaceExecutionForSession and the env lazy-create
  path.

- task_environment.go: replace the local executorTypeWorktree constant
  with models.ExecutorTypeWorktree (canonical) so a future rename of the
  type is caught by the compiler.

- base.go: heal_workspace_path now respects the kandev path layout —
  task-dir-mode envs (.../.kandev/tasks/<name>/<repo>) get
  Dir(worktree_path) as workspace_path, mirroring computeWorkspacePath
  in the orchestrator. Plain worktree mode unchanged.

- heal_test.go: tighten unique-constraint assertion to require a UNIQUE
  error string so the test fails loudly if a different DB error masks
  the constraint violation. Add task-dir-mode heal coverage.
2026-05-02 11:50:53 +01:00
José Almeida aa70b7dfa4 feat(web): mobile terminal key-bar — Ctrl/Shift modify OS-keyboard input + iOS keyboard fixes (#741)
* feat(web): add mobile terminal key-bar with sticky Ctrl modifier

Mobile software keyboards lack Ctrl, Esc, Tab, arrows, and shell symbols,
so users had no way to interrupt a running command (Ctrl+C), escape an
editor, or navigate the shell. Adds a horizontally scrolling key-bar
above the virtual keyboard — sticky Ctrl modifier, dedicated Ctrl+C /
Ctrl+D buttons, and visualViewport-based docking so the bar tracks the
OS keyboard as it opens and closes.

* test(web): add E2E coverage for mobile terminal key-bar

Nine Playwright tests on the mobile-chrome project cover visibility
gating, key emission verified via captured WS frames, the sticky Ctrl
state machine, dedicated Ctrl+C / Ctrl+D buttons, keyboard-aware
docking, accessibility, and an end-to-end ^C echo to prove the shell
path works. Adds a reusable shell.input frame capture helper and a
small page-object for the key-bar.

* feat(web): shared shell input helpers for the mobile terminal

Introduces a small toolkit the next commit will wire into the mobile
key-bar:

- `refocusXtermTextarea` — re-focuses xterm's hidden textarea after a
  virtual-key tap so iOS Safari doesn't dismiss the soft keyboard.
- `suppressIOSKeyboardAssists` — strips name/autocomplete/data-* hints
  on the textarea so iOS / 1Password / LastPass / Bitwarden skip the
  AutoFill suggestion bar.
- `useShellModifiersStore` (Zustand) — module-level Ctrl/Shift latch
  state with toggle (off → latched → sticky → off) and consume actions.
- `applyShellModifiers` — pure transform: ctrl + a-z → control byte;
  shift + tab → CSI Z (reverse tab); single-char only.
- `sendShellInput` — single entry point that reads the store, applies
  the transform, sends over WS, and consumes latched modifiers.

`useShellKeySender` and the xterm `onData` path in `shell-terminal.tsx`
now route through `sendShellInput` so any future modifier state
propagates uniformly. `suppressIOSKeyboardAssists` is wired into
`useTerminalInit` immediately after `terminal.open()`.

* feat(web): mobile key-bar pivots to OS-keyboard input + pins to keyboard

Reworks the mobile terminal key-bar around two insights:

1. The OS soft keyboard already provides letters — duplicating them
   in-bar was confusing and didn't address the real problem (Ctrl
   couldn't modify what the user typed via the OS keyboard, because
   that input went straight to xterm and bypassed React state).

2. iOS Safari `position: fixed; bottom:` drifts during visual-viewport
   scroll while the keyboard is open. Anchoring via `top` tied to the
   visual viewport's bottom edge stays glued.

Changes:

- `MobileTerminalKeybar` reads Ctrl/Shift state from the shared
  `useShellModifiersStore` and toggles it on tap. The actual chord
  transform now happens in `sendShellInput`, which both the bar and
  xterm's `onData` path call — so a Ctrl latch set from the bar
  modifies the next character typed on the OS keyboard.
- Drops `LETTER_KEYS` and `chordChar` from the bar; adds a Shift
  toggle (Shift+Tab → reverse-tab from the bar; pairs with the
  modifier transform for OS-keyboard taps).
- Latched state now shows the same ring as sticky (with sticky using
  a stronger `ring-primary`), so the first tap is visibly active.
- `touch-action: manipulation` on each button so taps in the
  `overflow-x-auto` row don't get reinterpreted as scroll.
- `useVisualViewportOffset` exports `viewportBottom = offsetTop +
  height`. When the keyboard is open the bar uses `top: viewportBottom
  - KEYBAR_HEIGHT_PX` and `bottom: auto`; closed, it keeps the
  `bottom`-based positioning so it sits above the bottom nav.
- `SessionMobileLayout` computes the terminal panel's
  `paddingBottom` so terminal content's bottom edge sits exactly at
  the bar's top edge whether the keyboard is up or not.

Tests cover the new modifier flow, Shift+Tab, the absence of
in-bar letter buttons, and the `top`-anchored positioning when the
keyboard is reported as open.

* test(web): rewrite mobile key-bar e2e around real user flows

The prior e2e leaned on in-bar letter buttons that no longer exist.
Rewrites the spec around the journeys a mobile user actually performs:
tap ^C to cancel, latch Ctrl + type a letter on the OS keyboard, sticky
Ctrl across multiple chords, Shift+Tab from the bar, history nav with
the arrow button, Esc, symbol keys, and the iOS positioning fixes
(top-anchored when the keyboard opens, tracks visual viewport scroll,
terminal panel reserves space for the bar). Adds a `shift` getter to
the page object.

* style(web): apply prettier formatting

* fix(web): keep modifiers armed on dropped sends + tighten input handler

Addresses bot review on PR #741:

- `sendShellInput` no longer consumes Ctrl/Shift when the WS client
  isn't available — the chord stays armed so the user can retry once
  reconnected instead of seeing the latch silently clear.
- Adds `send-shell-input.test.ts` with the matrix the helper needs:
  empty data, ctrl chord + auto-release, sticky retention, shift+tab
  → CSI Z, shift passthrough on non-tab, and the WS-disconnected
  no-send/no-consume path.
- Removes dead `ctrlChord` export and its tests — the only consumer
  was its own test, and `applyShellModifiers` covers the same
  transform end-to-end.
- Drops the unused `send` parameter from `useShellInputHandler` (the
  effect now goes through `sendShellInput` directly), removing a
  spurious dep that would otherwise re-fire the effect on identity
  changes.
- Documents that `KEY_SEQUENCES.home`/`end` are intentionally readline
  shortcuts (Ctrl+A/E), not VT Home/End sequences, so future readers
  don't mistake it for a bug.

* refactor(web): split mobile key-bar helpers, tighten null-viewport test

Addresses two non-blocking suggestions from PR #741 review:

- Move `KeyDef`, `KEYS`, `ModifierButton`, and `KeybarButton` out of
  `mobile-terminal-keybar.tsx` into a sibling helpers file. The main
  component drops from 213 to 115 lines, comfortably under the 200-line
  component convention.
- Assert `viewportBottom === 0` in the null-viewport branch of
  `use-visual-viewport-offset.test.ts` so all three return-shape fields
  are covered there.
2026-04-30 14:05:35 +01:00
Carlos Florêncio 1cd3a6b800 feat(web): rename sidebar sections to "Turn Finished" and "Running" (#506) 2026-03-31 21:01:51 +01:00
Carlos Florêncio 59ee830d71 feat(web): unified commit list and dockview panel fix (#500) 2026-03-30 22:44:10 +01:00
Carlos Florêncio be1b3a41db refactor(web): reorganize E2E tests into feature-based subdirectories (#499) 2026-03-30 14:34:24 +01:00