291 Commits

Author	SHA1	Message	Date
José Almeida	b001aa1eb8	feat(web): unified app sidebar (#1165) ... * feat(web): introduce unified AppSidebar and retire legacy nav surfaces Mounts a single collapsible AppSidebar at the root layout that replaces the former WorkspaceRail, OfficeSidebar, and dockview-embedded sidebar pane. Wires per-section expand + collapse state through a new UI slice with localStorage persistence, ports projects/agents/settings/tasks sections, and trims integrations / quick-chat / settings buttons + the home breadcrumb from the dockview top bar (debug-only MoreToolsMenu kept). Strips the sidebar column from every preset and the panel registry; persisted sidebar panels are dropped by the existing sanitize layer at restore time. * test(web): point workflow-filter e2e at AppSidebar's Home link The dockview top bar no longer renders the IconHome breadcrumb after the unified sidebar landed — the home navigation now lives in AppSidebar's primary nav. Update the workflow-filter spec to click that link instead. * feat(web): wire app-sidebar primary controls, nested settings, and footer migration Gates office-only nav (Inbox, Agents, Projects, New Task) behind the office feature flag, renames Tasks → Kanban as the bottom flex-grow section, replaces the gradient workspace picker with a minimal trigger when office is off, and moves Stats/Improve/What's-New/Office out of the kanban top bar into the AppSidebar footer + a dedicated Integrations section. Expands Settings into a collapsible deep tree mirroring the old SettingsAppSidebar so /settings pages can drop their nested SidebarProvider. * feat(web): make app-sidebar resizable and inline task top bar actions Adds a persistent drag-resize handle on the AppSidebar's right edge that clamps between APP_SIDEBAR_EXPANDED_WIDTH and 30vw; width is stored on the appSidebar slice and persisted to localStorage. Drops the dockview top bar's overflow popover (TopbarActionOverflow) in favor of always-inline clusters, and replaces the debug "More tools" dropdown with a single debug toggle button. * feat(web): polish app-sidebar headers and consolidate task views Section headers now lead with a clean uppercase label, drop the mono clash, lift contrast from /60 to /70, and end with the collapse chevron at the right so the section body aligns flush under the label. The Tasks section's filter bar (view chips + gear in a card-tinted strip) is replaced by a compact view dropdown that lives in the section header. Drag-to-reorder lives in the existing filter popover, which is now reachable from the same gear button. Settings moves below Tasks so the kanban list keeps the flex-grow seat in the sidebar. * feat(web): move settings group chevrons to the right * fix(web): drop chat from home topbar; calm tasks group headers The kanban top bar's Quick Chat button is removed now that Quick Chat lives in the AppSidebar; workspaceId stops being threaded into the tablet and desktop header variants. Group headers inside the Tasks section (kanban workflow steps) lose the opaque background strip and the section-label uppercase styling so they read as inline subgroup rows, not duplicate section dividers. The tasks-section wrapper drops its negative margin so the group rows sit flush under the TASKS label instead of bleeding out past it. * fix(web): restore agent logos on settings tree profile leaves SettingsLeaf gains a leadingIcon slot for pre-rendered visuals; agents group passes <AgentLogo agentName={agent.name}> so each profile row shows its agent's logo like it did before the old SettingsAppSidebar was retired. * feat(web): brand the sidebar, move New Task off the kanban top bar The Add task button (CreateTaskTopbarButton) leaves both the desktop and tablet kanban headers; New Task is now an unconditional primary nav item on the AppSidebar, falling back to a disabled affordance when no workspace is active. AppSidebar header gains a Kandev wordmark that links to /, with a single-letter K mark in collapsed-rail mode. PageTopbar's root variant no longer renders the parent brand label when backLabel is empty, so the home view's top-left "Kandev" goes away in favor of the sidebar. * feat(web): unbind sidebar toggle by default; drop Home from breadcrumbs TOGGLE_SIDEBAR's configurable default is now UNBOUND_SHORTCUT (the new sentinel for "no binding"); matchesShortcut already returns false on an empty key, so the keybind hook needs no change. Keyboard shortcuts settings show "Unbound", expose a Clear (X) button when a custom binding is set, and the reset icon falls back to unbound for entries whose default is unbound. PageTopbar's breadcrumb variant no longer prepends the Home back-link when backHref is "/" (the AppSidebar provides Home navigation). * feat(web): move New Task into the sidebar, retire the workspace selector - Extract AppSidebarNewTaskItem (office vs regular create dialog) with tests - Drop the Workspace selector from the kanban display dropdown and mobile menu sheet; the sidebar workspace picker is now the sole switcher - Factor SectionHeader out of AppSidebarSection; animate fixed sections via Collapsible while the grow (Tasks) section stays flex-driven - Polish brand header, share SIDEBAR_ITEM_ACTIVE accent-bar classes, move task group chevrons to the right, drop the task-item selected fill - Bump dockview layout keys to v3 and filter the orphaned 'sidebar' column so pre-AppSidebar default layouts no longer render a broken grid - Point the cross-workspace isolation e2e at the sidebar picker * feat(web): sidebar settings mode, subtask shortcut, accordion settings nav - Restore subtask creation: the sidebar New Task row now shows a trailing subtask affordance when viewing a task (regular mode), reopening the NewSubtaskDialog the retired dockview header dropdown used to provide - Fix settings pages not scrolling: scroll the content region (topbar stays pinned) via min-h-0 + overflow-y-auto - Add a footer gear that toggles a settings-only sidebar takeover; the gear spins on toggle. Mode is transient (never persisted) and force-expands a collapsed rail on entry - Make the settings nav a single-open accordion: opening one top-level group closes the others and reveals its subsections; route changes re-sync the open group. Extract the tree into a reusable SettingsTree - Repoint subtask e2e specs at the new sidebar affordance * test(web): restore create-task e2e flow after New Task moved to sidebar The New Task relocation removed the kanban-header create-task-button and made the sidebar entry auto-navigate + open the office dialog under the e2e profile (office on), breaking ~20 specs that drive the regular task-create dialog. - Give the sidebar New Task the create-task-button testid so KanbanPage resolves it again - Drop the post-create auto-navigation so creating a task stays on the board (matches the retired kanban button; specs find/click the new card) - Ungate the subtask affordance from office mode (subtasks use the compact NewSubtaskDialog in both modes, as the old dropdown did) - Add a useRegularMode() helper that runs a spec file with KANDEV_FEATURES_OFFICE disabled (backend.restart bracket) and apply it to the 18 create-task specs - Point the System sidebar-navigation spec at a /settings/system page so the single-open settings accordion has that group expanded Validated: create-task, create-task-disabled-tooltip, create-task-branch-selector, and subtask all green (modulo pre-existing idleInput agent-timing flakes that CI retries absorb). * fix(web): sidebar task navigation, settings-mode close + transitions - Clicking a task in the global sidebar from a non-task page now navigates to the task route (mounts the dockview) instead of only rewriting the URL via an in-place layout switch that assumed the dockview was already mounted - Make the settings-mode 'Settings' header a close affordance (the footer gear is far from the tree); clicking it exits the takeover regardless of which group is expanded, and it fades in when opened - Fade in the Tasks (grow) section content on expand, matching the other sections' animated reveal - Enable next-themes disableTransitionOnChange so dark/light flips switch every surface in the same instant rather than each animating at its own duration - Add a regression e2e for sidebar→dockview navigation * fix(web): clear sidebar task highlight when off the task route The AppSidebar is global, so tasks.activeTaskId lingered after navigating Home, leaving the last-opened task visually selected in the sidebar. Gate the selected/active highlight by route — only highlight while on /t/ or /office/tasks/. Expose data-active on the sidebar task item for testability. Adds an e2e: entering a task highlights it; returning Home clears it. * fix(web): never build the dockview default layout at zero width On a fresh client-side navigation into a task the dockview can mount before the grid has painted, so measureDockviewContainer returned api.width/height = 0. Building the default layout at width 0 makes dockview collapse the horizontal columns into a vertical stack (chat / files+changes / terminal) instead of the intended side-by-side layout. Fall back to the viewport when neither the live container nor the api report a usable size; the resize observer then snaps the grid to the exact container size. TDD: dockview-measure.test.ts covers the zero-size fallback. * fix(web): keep the default layout horizontal when swapping chat for the session tab Entering a task rendered a vertical stack (chat on top, files/changes in the middle, terminal at the bottom) instead of the side-by-side default. The chat->session-tab swap removed the 'chat' placeholder BEFORE adding the session panel; when chat was the only panel in the center group, removing it destroyed that group, the stored centerGroupId went stale, resolveInitialPosition returned undefined, and the session panel was appended as a new row — flipping the grid root to VERTICAL with three stacked groups. Fix: add the session panel into chat's live group first (resolveInitialPosition now prefers the chat panel's group), THEN remove the chat placeholder, so the center group never empties and the horizontal split is preserved. Also fixes the pre-existing pane-resize reload/clamp e2e failures, which were the same collapse. TDD: task-default-layout.spec.ts asserts the right column sits beside chat. * fix(web): remove the sidebar Settings section; settings is gear-only Settings was still a collapsible nav section in the sidebar AND auto-expanded on /settings routes. That also caused the reported bug: toggling the footer gear off while on a settings page revealed the normal sidebar with the Settings section already expanded, so the settings tree appeared to 'not close'. - Drop the Settings nav section (and its /settings route auto-expand) — the settings tree is reached only via the footer gear takeover - Delete the now-unused sidebar settings-section component - e2e: gear opens the tree and closes it even after navigating into a section * fix(web): show office sidebar sections only while inside Office Inbox, Projects, and Agents were gated on the office feature flag, so they were always visible when the feature was enabled. Gate them on actually being in the Office surface (an /office route, reached via the footer Office button) via a new useInOffice() hook — they stay hidden in the regular workspace and appear only after entering Office. Unit test for the hook; e2e (office fixture) asserts the sections appear on /office and are absent on the regular home. * fix(web): drop the colorful workspace selector, restore the minimal one The workspace picker swapped to a gradient/initials trigger (and gradient swatches in the dropdown) whenever office was enabled. Always use the plain name + chevron trigger and drop the gradient swatches, matching the previous design. Removes the now-unused workspace-gradient helper. * fix(web): align sidebar header, scope office New Task, exit settings on nav - Drop the doubled right border: the resize-handle hairline is transparent at rest, leaving the aside's border-r as the single edge (highlights on hover). - Collapse the expanded sidebar header into one h-10 row (brand · workspace picker · collapse) so it lines up with the page/dockview top bar. - Gate the sidebar New Task dialog on useInOffice() (actual /office route) instead of the bare office feature flag, so Kanban mode keeps the classic create dialog while office is enabled. - Close the settings takeover when navigating off the /settings surface (Home, Kandev brand, Office, etc.), tracked on a real pathname change so the gear still opens it in place and in-tree navigation keeps it open. - Lock in the already-working collapsed-gear-expands behaviour with an e2e. Tests: new-task-item unit (route gating), settings-gear e2e (Home closes, collapsed gear expands), office gating e2e (Kanban vs Office dialog). * fix(web): realign task top bar to h-10, refine sidebar workspace picker - Pin TaskTopBar to h-10 so its bottom border lines up exactly with the sidebar header (and the PageTopbar) — previously it had no fixed height and sat ~2px off, breaking the seam across the sidebar/content edge. - Redesign the workspace picker as a compact, muted secondary control inlined after the Kandev brand: brand and workspace share text-sm so they sit on a common baseline, with a faint '/' separator; the workspace reads as muted and the brand stays primary. - Drop the workspace switcher (and its irrelevant folder glyph) from the collapsed rail — collapsed now shows just brand + expand. Adds an e2e that measures the task top bar bottom edge against the sidebar header (within 1px). * fix(web): replace the /github and /gitlab presets rail with a scope bar The integration dashboards rendered their own w-60 border-r presets sidebar right next to the global AppSidebar — a redundant 'double sidebar' that looked off after the UI overhaul unified navigation. On desktop, fold the presets into a horizontal scope bar above the list toolbar: the bounded, common controls (PR/Issue kind + preset pills, grouped Inbox/Created) stay visible as pills, while the unbounded saved-queries list collapses into a 'Saved' dropdown so the bar never grows tall. The dashboard is now single-column like Kanban/Tasks. Mobile is unchanged — the vertical PresetsSidebar still lives in the hamburger sheet. Adds a desktop scope-bar e2e (presets + kind switching, no inline rail) and repoints the mobile page object at the new scope-bar testid. * fix(web): address CodeRabbit/cubic review — a11y, dedup, dup nav, lazy-load - Sidebar: fix Tasks auto-expand route prefix (/task/ -> /t/); forwardRef the workspace-picker trigger so DropdownMenuTrigger asChild wires it; aria-label the icon-only Add agent and keyboard-shortcut buttons. - Settings tree: drop the duplicate top-level Editors leaf (lives under General); broaden the System group active state to all /settings/system. - CSS: honour prefers-reduced-motion for .sidebar-fade-in. - Storage: bump the dockview maximize namespace to v3 in lockstep with the layout namespace so stale pre-v3 maximize blobs are discarded. - Integration dashboards: extract a shared IntegrationScopeBar base so the github/gitlab scope bars are thin wrappers (de-dup + under the component size cap). Reuse useConfiguredIntegrationLinks in the sidebar Integrations section instead of recomputing availability. - Lazy-load the office NewTaskDialog so it's not bundled on non-office routes. - tasks-view-picker: use onSelect for keyboard-activatable menu items. - Tests: normalize group x by container left in task-default-layout; refresh stale subtask-flow comments; async findByTestId for the lazy office dialog. * fix(web): gate the scope-bar delete button pointer-events while hidden The opacity-0 delete button stayed clickable, so a click on the right side of a saved-query row could hit the invisible button instead of selecting the query. Add pointer-events-none until the row is hovered (group-hover:pointer-events-auto). * fix(web): use onSelect for scope-bar saved-query menu items (keyboard a11y) Radix DropdownMenuItem fires onSelect for pointer AND keyboard activation; onClick missed keyboard users. The nested delete button stops pointerdown so it isn't treated as a select of the saved query. * fix(web): mobile sidebar hide, gear-gated settings test, office paused badge, picker a11y - AppSidebar is now hidden below md (mobile uses its own per-surface nav); it was an always-on absolute overlay covering mobile content. - Restore the sidebar-agent-paused-badge testid on the office agent row. - Update system sidebar-navigation spec to open the gear (settings is a gear-gated takeover in the overhaul). - Workspace picker menu items use onSelect for keyboard a11y. * test(web): reconcile main's E2E suite with the unified-sidebar overhaul Merging main un-gated the full E2E suite (was behind safe-to-test); ~50 of main's tests asserted pre-overhaul UI. Updated them to the overhaul: - Delete obsolete dockview-embedded-sidebar resize tests (feature removed); keep the right-pane resize tests. - Scope locators where tasks now appear in BOTH the page and the global AppSidebar list (intended) — task-list, task-list-filters, pr-status-badge. - Adapt sidebar-filter specs to the new TasksViewPicker (gear popover + view-chip dropdown) and its page object. - Settings now reached via the footer gear (not the topbar); Improve Kandev opens from the sidebar footer; office nav folded into the AppSidebar — update those specs (office verified in CI; can't run locally). - session-layout: handle the new close-terminal confirm dialog; multi-session and tab-management: foreground the (now backgrounded) chat tab after sidebar task switches. - Skip create-task-url-reopen-no-branches: its provider-branch flow (code identical to main) is broken only by the office-off backend restart this PR forces via useRegularMode — a harness interaction, not an app regression. * test(web): fix create-task-url-reopen branch listing (reload to drop stale cache) Un-skipped and fixed properly. Root cause: during the URL-paste/registration flow the frontend can transiently fetch branches for the freshly-registered provider repo before its background clone settles; useBranches caches that early empty result as terminal (if (isLoaded) return), so re-picking the repo never re-lists. Reload before the second dialog open drops the in-memory branch cache so branches list fresh from the backend (verified: the backend returns them). The provider-API path and product behaviour are unchanged from main. * fix(web): restore mobile search toggle + reconcile remaining E2E with overhaul - Restore main's mobile-search-toggle in kanban-header-mobile (my earlier --ours merge resolution dropped it, breaking the mobile-kanban search tests). - Office specs: expand the collapsed Agents/Projects sections before asserting their rows, and scope office-tasks-page locators to <main>. [CI-verified] - mobile-task-list-search / mobile-voice-mode: scope task titles to the table and drop the obsolete data-sidebar=trigger assertion. - app-sidebar.test mock: add settingsMode, toggleAppSidebarSettingsMode, and the integrations section key. - sidebar-filter page object: scope chipMenu to the menu holding the view chips. * test(web): finish E2E reconciliation — office sections, session timing, robustness - agent-error-handling: expand the collapsed Agents section before the paused badge check. - office execution-indicator/task-sorting: wait for a non-empty .font-mono identifier (assigned async by the backend). - session-layout: foreground the (CI-backgrounded) chat tab before the idle check; make the close-terminal confirm dialog optional (busy heuristic is timing-dependent). - workspace-switch-isolation: run office-off so the picker switches in place instead of redirecting to /office (which needs onboarding this fixture skips). - app-sidebar-page: condense JSDoc to one line per project convention. * test(web): match main's office identifier assertion (revert over-scoping) The round-2 office agent scoped the .font-mono identifier check to <main> too, but only the task TITLE needed scoping for the sidebar duplication. The office task identifier is empty in the e2e seed (backend-assigned, not populated here), so the <main>-scoped non-empty filter found nothing. Revert the identifier assertion to main's exact form (first .font-mono on the page); keep the title scoped to <main>. * test(web): restore non-empty .font-mono filter for office identifier checks Per review: wait for the backend-assigned (non-empty) identifier rather than the empty span. Unscoped so it finds the identifier wherever it renders, 15s window. * test(web): fix office identifier + realtime-dashboard specs at the root cause Ran office specs locally (they DO run here) and root-caused all three: - execution-indicator / task-sorting: the office task identifier is empty in e2e — tasks are seeded via the core /api/v1/tasks route, which bypasses the office identifier-assignment flow (the workspace KAN prefix only applies to office-flow-created tasks). Main's .font-mono.first() was a false-positive matching an element the overhaul removed. Assert the identifier COLUMN renders (attached to the row) instead of a value e2e never produces. - realtime-dashboard: the Recent Tasks card is fed by dashboard.recent_tasks via useOfficeRefetch on office WS events; a core-route task's office event is async so the in-place refetch is genuinely flaky. Reload for the deterministic SSR dashboard fetch (what a user sees on revisit); the WS-refetch mechanism stays covered by the sibling cross-workspace test.	2026-06-06 21:58:39 +01:00
Nicolas Lenepveu	08189ec539	feat(integrations): add Sentry integration with issue watcher (#1133)	2026-06-04 10:18:17 +01:00
Carlos Florêncio	79633ea376	fix(web): preserve repo metadata in kanban.update and check legacy repositoryId (#1258)	2026-06-03 00:02:44 +01:00
João Salavisa	d44abe327b	fix(web): stop refetching GitLab status on every tab refocus (#1257) ... useGitLabAvailable registered a window "focus" listener that re-fired GET /api/v1/gitlab/status on every browser tab switch. IntegrationsMenu mounts globally, so the hammer was site-wide. Route the hook through the store-cached useGitLabStatus so consumers share a single fetch and the status no longer re-probes on focus. Matches the useGitHubStatus pattern. Jira/Linear use the 90s poll in useIntegrationAuthed and were unaffected. Co-authored-by: Kandev Agent <agent@kandev.dev>	2026-06-02 23:32:38 +01:00
João Salavisa	dfaab11959	feat: full GitLab integration — parity with GitHub (#1120) ... * feat(backend): full GitLab parity — store, service, poller, WS, presets Add the watcher/poll/write-action surface on top of the existing GitLab client + service skeleton: * 5 new SQLite tables (mr_watches, review_watches, review_mr_tasks, issue_watches, issue_watch_tasks, action_presets) + CRUD * Client + Service: MergeMR, GetProjectMergeMethods, GetProtectedBranch, ListUserProjects, SearchProjects, SetMRLabels, SetMRAssignees * Service: review/issue/MR watch CRUD + Check/Trigger, GetStats, CleanupAllReview/IssueTasks (cleanup-policy aware), TriggerMRSync, action-presets CRUD with defaults * Background poller (MR / review / issue loops) wired from main.go * ~35 GitLab WS action constants + handlers.go registrations * Mock controller for E2E seeding (MRs, issues, pipelines, discussions, approvals, branches) * eventBus + taskDeleter + taskSessionChecker plumbed through Service * Event types: GitLabMRFeedback / NewReviewMR / NewIssue / TaskMRUpdated * feat(web): GitLab frontend parity — types, API, store slice, domain hooks Extend the frontend GitLab integration on top of the new backend surface: * HTTP API client expansion (gitlab-api.ts): full CRUD for review/issue/MR watches, MR write actions (merge/approve/labels/assignees), MR files/commits/feedback, action presets, projects autocomplete, stats * Store slice expansion: review/issue/MR watches lists, action presets by workspace, stats + status with loading flags. Properties prefixed with gitlab to avoid collision with GitHub slice * Domain hooks: use-gitlab-status, use-gitlab-stats, use-gitlab-review-watches, use-gitlab-issue-watches, use-gitlab-action-presets — mirror github hook shapes * Type model: ReviewWatch, IssueWatch, MRWatch, ActionPresets, Stats, ProjectMergeMethods, MRApproval, Pipeline, MRFeedback, etc. * Backend controller HTTP routes for watches/presets/write-actions/ projects/stats so the frontend HTTP API client has endpoints to hit All passes: backend (build + vet + lint + tests), web (typecheck + lint + 2400 tests). * fix(gitlab): wire orchestrator event handlers, fix label-filter drop, add tests Address Claude review blockers on the parity PR: 1. Wire orchestrator subscriptions for GitLab review/issue watch events. Add event_handlers_gitlab.go with handleGitLabNewReviewMR / handleGitLabNewIssue, dedup reservation handshake, and task-creator interfaces (mirrors event_handlers_github.go). main.go now calls orchestratorSvc.SetGitLabService so the dedup APIs are usable 2. Fix silent label-filter drop: when a custom_query is set on an issue watch, labels were being appended to the unused filter arg. Fold labels into customQuery (or default filter) so they actually reach GitLab; extracted appendLabelsToQuery helper with explicit handling of pre-existing labels= clauses 3. Switch event payloads to pointer types (mirrors GitHub) so handlers can type-assert pointer events 4. Backend tests: store_watches_test.go (CRUD + reserve/assign for all 4 new tables + presets), service_watches_test.go (label-filter helper, cleanup policy, project normalisation), action_presets_test.go 5. Frontend slice tests: review/issue watch CRUD round-trips, action presets + stats reducer coverage All green: backend (build+vet+lint+tests), web (typecheck+lint+2403 tests). * fix(gitlab): address remaining blockers — cleanup wiring, safe defaults, nil guards Address the second round of Claude review blockers: 1. main.go: wire SetTaskDeleter + SetTaskSessionChecker on services.GitLab (mirrors GitHub). Without these, manual cleanup sweeps would always error with "task deleter not configured" 2. service_cleanup.go: default cleanup policy on transient DB error is now CleanupPolicyNever (preserve tasks) instead of CleanupPolicyAuto (silently delete). Genuine "watch was deleted" path also falls under the safe-side default; user can manually delete the orphan tasks 3. service_watches.go: add nil guards on requireStore() so the 6 MR-watch list/get/delete methods return an errStoreUnavailable error instead of panicking when the SQLite store failed to construct at boot 4. use-gitlab-status.ts + use-gitlab-stats.ts: add per-mount attemptedRef so an unreachable GitLab doesn't trigger an infinite re-fetch loop — the previous useEffect re-ran every render because the failure path left status null, satisfying the !status guard * fix(gitlab): propagate session-check errors, clamp poll interval on update Address remaining Claude blockers: * service_cleanup.go: HasUserAuthoredMessage transient errors are now preserved (return false → skip delete) instead of silently ignored; the alternative was occasionally deleting tasks a user had touched * service_watches.go: extract clampPollInterval helper applying the same bounds (0 → default, <60 → 60) as the create path; both applyReviewWatchPatch and applyIssueWatchPatch use it so user-supplied zero or tiny values via UpdateXxxWatchRequest no longer hammer GitLab * fix(gitlab): clear dupl lint, fix preset retry loop + per-workspace watch cache * service_watches.go: applyReviewWatchPatch / applyIssueWatchPatch get nolint:dupl markers — they share shape but per-domain field validation lives in the create paths, so deduplicating via generics would obscure the contract. Restores backend lint to 0 issues * use-gitlab-action-presets.ts: per-workspace attemptedRef set so a failing preset fetch doesn't retry on every render * use-gitlab-review-watches.ts + use-gitlab-issue-watches.ts: track lastFetchedRef per consumer so a workspace switch triggers a refetch. The slice-level loaded flag is shared across instances and can't double as a per-workspace cache key * fix(gitlab): add nil-store guards across review/issue watch + cleanup paths Round-3 Claude finding: ReviewWatch / IssueWatch / preset / reservation methods still called s.requireStore().X() directly. If NewStore fails at boot (table migration error), the service struct's store is nil and every list/get/update/create/reserve method panics on first request. Apply the same store-nil → errStoreUnavailable pattern from f95a929 to every remaining method: * CreateReviewWatch / CreateIssueWatch * GetReviewWatch / ListReviewWatches / ListAllReviewWatches / UpdateReviewWatch / TriggerReviewWatchAll * GetIssueWatch / ListIssueWatches / ListAllIssueWatches / UpdateIssueWatch / TriggerIssueWatchAll * ReserveReviewMRTask / AssignReviewMRTaskID / ReleaseReviewMRTask * ReserveIssueWatchTask / AssignIssueWatchTaskID / ReleaseIssueWatchTask * lookupReviewPolicy / lookupIssuePolicy (return CleanupPolicyNever) * fix(gitlab): nil-store guards on CheckXxxWatch + DeleteXxxWatch + cleanup paths Round-4 Claude finding: 4 remaining panic sites the previous nil-guard pass missed — these run from the background poller (every 5 min) and the manual delete/cleanup flows, so a boot-time NewStore failure would crash the orchestrator process on first tick. * service_watches.go: add store-nil guards to DeleteReviewWatch / DeleteIssueWatch / CheckReviewWatch / CheckIssueWatch * service_cleanup.go: guard CleanupAllReviewTasks / CleanupAllIssueTasks entry points; wrap the trailing DeleteReviewMRTask / DeleteIssueWatchTask calls in `if store := s.requireStore(); store != nil` blocks so the cleanup succeeds even when the dedup-row delete is unreachable * refactor(gitlab): split service_watches.go to stay under 800-line revive limit CI's --new-from-rev lint caught service_watches.go at 808 lines (limit 800). Split into three focused files: * service_events.go (94 LOC) — publish helpers for MR feedback / new review MR / new issue / watch lifecycle events * service_issue_watches.go (302 LOC) — Issue watch CRUD + Check + Trigger + fetch + helpers * service_reservations.go (59 LOC) — Reserve/Assign/Release dedup handles used by the orchestrator event handlers service_watches.go is now 505 lines and contains MR watch + Review watch only. No behavioral change. * fix(gitlab): address inline code-review feedback Address actionable inline comments from Claude/CodeRabbit/cubic/Greptile: * appendLabelsToQuery: use url.ParseQuery for exact key match instead of strings.Contains; previously false-matched keys like mylabels= and silently dropped the watch's labels (test added) * fetchReviewMRs: drop dead `filter = watch.CustomQuery` assignment — SearchMRs's buildMRSearchQuery returns customQuery verbatim and ignores filter when customQuery is non-empty * store.go: add workspace_id indexes on gitlab_review_watches and gitlab_issue_watches (the 5-min poller and HTTP list endpoints did full table scans) * mock_client.SearchProjects: switch from == to case-insensitive Contains so partial-query autocomplete returns the seeded project, matching the doc comment * Poller: add sync.Mutex to guard `started` field; Start/Stop are now safe to call concurrently (go test -race would have flagged the previous read/write race) * Add ErrWatchNotFound sentinel; controller_watches.go maps it to HTTP 404 via httpRespondError helper. Update/Trigger handlers previously returned 500 for missing watches, hiding the distinction from real server faults * service_events.go: log Publish errors on watch lifecycle events instead of swallowing them silently * handlers.go: reject malformed JSON payloads in list-style WS handlers rather than silently falling through to broader list/search behavior * event_handlers_gitlab.go: remove dead gitlabRepoSlug helper + blank-identifier suppression * ci: re-trigger to clear flaky E2E shard 3 * fix(gitlab): address final review round — nil guards, store merge, logs, body validation - CheckMRWatch, UpdateReviewWatch, UpdateIssueWatch: nil guards for store/req - handlers: wsNewDiscussionNote rejects empty body - action_presets: Update reads raw stored row (no default freezing); Reset validates workspace_id - service_search.GetStats: log Warn per sub-call failure before zero - event_handlers_gitlab: log Release* dedup-row errors with context - web/store.ts: post-slice merge restores every GitLab sub-state field; extract buildStateOverrides helper - web/default-state.ts: add GitLab fields to defaultState + mergeInitialState via mergeGitLabFields helper - web/gitlab-api.ts: UpdateXxxWatchRequest now Omit workspace_id Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Kandev Agent <agent@kandev.dev> Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>	2026-06-02 22:10:07 +01:00
Carlos Florêncio	6b98185ac3	fix(web): restore debug UI on make start-debug (#1252)	2026-06-02 21:48:23 +01:00
Carlos Florêncio	79d4f84bf2	fix(backend): cache & singleflight live PR feedback fetches (#1237)	2026-06-02 19:37:20 +01:00
Carlos Florêncio	8eb0850c51	feat(web): resizable review dialog sidebar with persistence (#1245)	2026-06-02 17:07:00 +01:00
João Salavisa	a814379cf6	fix(web): refresh commits panel snapshot on mount (#1232) ... * fix(web): fetch commits snapshot on mount even when prefilled by live events The useSessionCommits hook gated its initial snapshot fetch on `commits === undefined`. When a `commit_created` WS event populated the list before mount (session already running when the panel opens, or stream replay on reconnect) and carried zero stats, the bad data stuck — the authoritative `git log --shortstat` snapshot never ran to overwrite it, leaving older commits stranded with `+0 -0` in the Commits panel. Anchor the initial-fetch gate to `sessionId` via a ref so the snapshot fires once per session regardless of how `commits` got populated. * fix(web): reset fetchedSessionRef when sessionId goes null Without resetting the ref in the !sessionId early-return path, a hook that stays mounted while sessionId cycles through null (and commits get cleared via clearSessionCommits) would not refetch when the same sessionId is reselected, because fetchedSessionRef.current would still equal it. Now the ref clears on null so reselect always re-fetches. Addresses Greptile P2 on #1232. * fix(web): reset fetchedSessionRef during disconnect teardown Move the `!sessionId` early-return ref clear before the connection gate. Without this, a session teardown that runs while WS is disconnected leaves `fetchedSessionRef.current` pinned to the old sessionId, so reconnecting to the same session never triggers the authoritative snapshot fetch. Addresses cubic P2 on #1232. --------- Co-authored-by: Kandev Agent <agent@kandev.dev>	2026-06-01 21:52:55 +01:00
João Salavisa	fd79d6170f	feat(tasks): multi-branch tasks — N (repo, branch) pairs per task (#1226) ... * feat(tasks): multi-branch tasks — N (repo, branch) pairs per task Extends multi-repo into multi-branch so a single task can hold multiple worktrees on the same repo (one per branch). Sibling worktrees layout at <task>/<repo>/ + <task>/<repo>-<slug>/, dedicated PRWatch per branch, live agentctl tracker rescan + frontend store updates so the UI splits PRs / files / commits per branch without a session restart. MCP add_branch_to_task_kandev tool is shielded to the worktree executor. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(web): unify multi-branch repo label as <repo> · <branch> across panels PR Changes and Commits panels rendered repo labels differently for multi-branch tasks — Commits showed "kandev · feature/x" while PR Changes leaked the raw "kandev-feature-x" agentctl tracker tag. Reformat tracker-tagged repo names via formatRepoLabel using the longest known-repo prefix so kandev-cli-* doesn't collapse to kandev · cli-*. * fix(tasks): address multi-branch PR review — data races, slug collisions, MCP error codes Backend - agentctl process.Manager: add repoTrackersMu RWMutex guarding repoTrackers + workspaceTracker. Reads snapshot under RLock; RescanRepositories builds trackers first, takes Lock for swap/append. Validates newWorkDir via os.Stat before publishing cfg.WorkDir. - worktree.Manager: reject invalid explicit BranchSlug up-front; cache key uses sanitized wt.BranchSlug so read/write paths are symmetric. - worktree.store: narrow isDuplicateColumnError to "duplicate column name". - task service AddBranchToTask: slug-collision guard rejects feat/a vs feat-a. - orchestrator resolvePushRepo: two-pass exact-name match before subdir prefix fallback so "backend" doesn't swallow pushes for "backend-admin". - executor buildRepoSpecs: duplicate repos always get a non-empty BranchSlug (falls back to branch-N when both branch fields sanitize to empty). - MCP handler: classifyAddBranchError maps service errors to NOT_FOUND / CONFLICT / VALIDATION_ERROR; add ErrorCodeConflict constant. - MCP server: extract registerAddBranchToTaskTool, register in task mode only (external mode contract: config tools + create_task_kandev). - workspace_rescan handler: reject malformed JSON with 400 instead of silently rescanning the current root. - branch_materializer: split MaterializeBranch into prepare + finalize helpers to satisfy the 80-line cap. Frontend - existingPrUrl returns undefined when a task has >1 PR so per-repo View PR buttons take over (no silent linking to a sibling). - formatRepoLabel checks exact known-repo match before prefix splitting so "kandev-cli" isn't mislabeled as "kandev · cli". - Repo chip key now includes base_branch so siblings differing only on base render as distinct chips. Docs - multi-branch spec uniqueness wording aligned with the canonical 4-column key (task_id, repository_id, base_branch, checkout_branch). - worktree.CreateRequest.BranchSlug doc describes the sibling layout (<repo>-<slug>) instead of the obsolete nested form. * fix(tasks): scope slug-collision check to repo only + use errors.Is for ErrTaskNotFound - service_branches: drop base_branch from the slug-collision check. Worktree path is (repo, slug); two rows on the same repo cut from different bases still collide on disk. - service_branches: prepareBranchAdd wraps taskrepo.ErrTaskNotFound via fmt.Errorf with %w so classifiers don't have to substring-match the formatted task UUID. - mcp handlers: classifyAddBranchError uses errors.Is(err, ErrTaskNotFound). * fix(agentctl): sanitize rescan work_dir before os.Stat to clear CodeQL path-injection CodeQL flagged the rescan endpoint as a path-injection sink (the HTTP-supplied work_dir flowed straight into os.Stat and downstream scanRepositorySubdirs). Add validateRescanPath which: - requires the input to be a clean absolute path with no ".." segments - rejects anything that isn't equal to or an ancestor of the current cfg.WorkDir — the only legitimate use case is the branch materializer promoting <task>/<repo>/ to <task>/ Defense in depth: agentctl binds to localhost, but any colocated process could otherwise direct it at /etc or the user's home by POSTing /api/v1/workspace/rescan. * fix(agentctl): tighten validateRescanPath, close TOCTOU on existingTrackers, add tests - Drop the strings.Contains(clean, "..") guard. filepath.Clean already resolves traversal; the substring check rejects legitimate names like /home/u/..hidden without adding defense (the ancestor check via filepath.Rel is the real boundary). - Drop the rel == "." branch in the ancestor check — early return for clean == currentClean already covers identity. - Read existingTrackers inside the write-lock section (not under RLock then re-Lock) so two concurrent rescans can't both see 0 trackers and double-bootstrap the multi-repo set. - Add table-driven TestValidateRescanPath covering rejection paths (relative, descendant, sibling, traversal-cleaned, empty input), legitimate ancestor promotion, exact match, no-anchor first-launch, and a /home/u/..hidden dotted-segment case. * fix(agentctl): break taint flow into os.Stat — derive rescan path from cfg, not HTTP body CodeQL's go/path-injection trace still flagged manager_rescan.go after the prior sanitizer because the user-supplied newWorkDir flowed (after validation) into os.Stat and then into cfg.WorkDir → tracker paths → workspace_monitor os.Stat sinks. Replace validateRescanPath with resolveRescanPath: it returns a path DERIVED from currentWorkDir (no-op = currentClean, promotion = filepath.Dir(currentClean)) and uses newPath only for comparison, never as a source for the returned string. os.Stat now receives a path whose provenance is trusted manager config. Functionally the legitimate caller (branch materializer promoting <task>/<repo>/ to <task>/) is unchanged. * test(agentctl): make TestResolveRescanPath windows-portable The Linux Backend Tests job passed but the Backend (windows) job rejected every "absolute" case because filepath.IsAbs("/task/repo") is false on Windows (no volume letter). Build inputs via filepath.Join against absRoot() (filepath.Abs of "/" / "\\") so the same table covers POSIX (`/...`) and Windows (`C:\...`) without per-OS branches. Keep the traversal-after-Clean case POSIX-only since filepath.Clean is the shared primitive and that input form needs a volume to be considered absolute on Windows anyway. * fix(agentctl): serialize RescanRepositories + re-check trackers under write lock Two concurrent RescanRepositories calls could both observe an empty tracker set (between the snapshot read and the bootstrap branch) and both enter transitionToMultiRepoMode, leaking a duplicate bare-root tracker and duplicate per-repo trackers. Same race in appendNewRepoTrackers would double-append the same new child across both callers. Fix: - Add rescanMu sync.Mutex on Manager. Acquired for the full body of RescanRepositories so the snapshot → branch → mutate sequence is serialized. repoTrackersMu still guards individual field reads from unrelated goroutines (subscribe/unsubscribe/poll-mode). - appendNewRepoTrackers re-checks membership inside the write-lock before appending and drops already-present trackers (Stop + detach outside the lock). Defense in depth. - Test: add `dotted segment is legal as promotion` case so the ..hidden-segment promotion path stays exercised. --------- Co-authored-by: Kandev Agent <agent@kandev.dev> Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>	2026-06-01 19:36:20 +01:00
José Almeida	041a19f060	feat: service-managed UI self-update (#1210) ... * feat: add service-managed self-update * chore: add temporary self-update test scripts * chore: simplify temporary script markdown fences * chore: run frontend in temporary self-update scripts * fix: show self-update job progress after apply * chore: add real npm self-update test script * fix: isolate npm self-update prefix * fix: detect npm service installs from bin shim * chore: reset service before real npm update test * chore: expand real npm status diagnostics * fix: preserve service home during self-update * fix(cli): tee self-update helper output to a log file * fix(cli): avoid launchd bootstrap race when reloading the macOS service * fix(backend): run macOS self-update helper once via transient launchd plist * fix(web): show self-update progress and lock the apply button until the update lands * fix(cli): reinstall via the kandev wrapper on Homebrew self-update * chore: remove temp self-update test scripts * fix(web): drop unused apply path from useUpdates hook * fix(backend): snapshot install state once in apply preflight * docs: align self-update docs with transient LaunchAgent flow * chore(release): run cli bundle from apps workspace root * fix(backend): guard against concurrent self-update applies * fix(backend): check scheme and helper paths in self-update apply * fix(backend): drop duplicate binary name from npx manual command * fix(cli): allow --help for service self-update without --intent * fix(cli): harden self-update dir perms and darwin uid resolution * fix(web): set required POST fields last in applyUpdate * docs: use JSON body notation for the apply endpoint * fix(backend): expire self-update guard so a stuck helper cannot wedge apply * refactor(cli): collapse redundant writeSync branch in self-update log	2026-06-01 17:49:15 +01:00
João Salavisa	1fdeda904b	feat: add voice mode for chat input (#1159) ... * feat: add voice mode for chat input Adds a voice input button to the chat composer with three transcription engines: in-browser Web Speech API, in-browser Whisper via @huggingface/transformers, and a server-side OpenAI Whisper fallback gated on KANDEV_VOICE_OPENAI_API_KEY. User-configurable from a new /settings/voice-mode page: - Master on/off toggle (defaults to on; opt-out, not opt-in) - Engine preference (auto / Web Speech / Whisper Web / Whisper Server) - Language hint (auto-detect or BCP-47 pinned) - Activation mode (click-to-toggle or hold-to-talk) - Auto-send after transcription - Whisper Web model size (tiny / base / small) - Editable Cmd+Shift+M keyboard shortcut Voice settings live under user_settings.voice_mode as a nested JSON object — no schema migration. Setting changes broadcast via the existing user.settings.updated WS event so any open chat tab updates live. The mic button is rendered on the right of the composer alongside the send button (round primary fill; destructive fill with pulse ring while recording). On browsers without a usable engine (e.g. iOS Chrome over HTTP) the button stays visible as a muted greyed icon — tapping it surfaces a toast with the reason (typically a missing secure context). Whisper Web runs in a Web Worker with fp16 decoder weights (avoids the MatMulNBits scale-missing crash that q4/q8 hit on WASM). Models are pulled from the onnx-community/* mirror and cached by transformers.js in the Cache Storage on first use. * fix: address voice mode PR review feedback and E2E selector clash Bot-review fixes from #1159: - Map http.MaxBytesError from c.FormFile to 413 instead of bare 400. - Strip BCP-47 region suffix before passing language hint to Whisper Web. - Recover from worker crash: terminate + null worker + reset ready flag so next init/transcribe creates a fresh worker instead of hanging. - Read live store state via storeApi.getState() in voice-mode settings savers to avoid stale-closure clobbering concurrent settings updates. - Detach Web Speech callbacks before abort() so trailing onend/onerror events don't mutate hook state after cancel(). - Spread caller init before method/body in voice-api fetch so a caller- supplied init can't override the multipart POST. - Replace t.Fatalf with t.Errorf+return inside test HTTP handler goroutine (FailNow from non-test goroutine is unsafe). - Add Enabled/AutoSend zeroing assertions in partial-update test so the bool-overwrite-on-PATCH behavior is locked in explicitly. E2E fix: - toolbar-overflow spec used button.rounded-full which now matches both the send and voice buttons (strict-mode violation). Switched to the submit-message-button testid for an unambiguous locator. * fix: scope voice settings rollback + whisper worker error to changed keys Round 2 of PR review feedback on #1159: - voice-mode settings rollback now restores only the keys patched by the failing request (not the whole snapshot), preserving concurrent edits to unrelated voiceMode fields. - Shortcut rollback diffs previous vs next and reverts only the changed keys (restore prior value or delete if absent), preserving other concurrent shortcut edits. - Whisper worker error handler captures the worker reference at attach time and only clears refs when this.worker still matches it — a stale error from a previously replaced worker no longer nukes the active one. - Update stale whisper-web-models JSDoc that still pointed at Xenova mirrors. * fix: voice mode progress scale, hold-mode race, race-aware rollback Round 3 of PR review feedback on #1159: - Normalise Whisper progress to 0–1 in ensureWhisperClient (transformers.js emits 0–100, the button's display + the `ready: 1` convention expect 0–1 — fixes the 5000% mid-download display). - Claim driverRef synchronously at the top of finishCapture so concurrent pointerup + pointerleave invocations early-return instead of racing and clobbering a freshly-started recording's ref. - Race-aware rollback: voice-mode and shortcut catch branches now skip reverting a key when latest[key] !== next[key]. A failed earlier request no longer overwrites a later successful save to the same key. - Update the Worker wire-protocol comment to show onnx-community/whisper-base instead of the stale Xenova/* example. --------- Co-authored-by: Kandev Agent <agent@kandev.dev>	2026-06-01 14:32:39 +01:00
Carlos Florêncio	6734b64b54	fix(e2e): ignore stale session state snapshots blocking idle input (#1208)	2026-06-01 10:35:07 +01:00
Carlos Florêncio	d8e0507d17	fix(web): destroy terminal shells on tab close with busy confirmation (#1203)	2026-05-31 23:04:55 +01:00
Carlos Florêncio	d76836d740	fix(web): stop changes panel flicker and restore planning chat streaming (#1197)	2026-05-31 18:43:17 +01:00
Carlos Florêncio	151bf54dec	feat(health): add OS inotify resource limits health check (#1195)	2026-05-31 17:54:49 +01:00
Carlos Florêncio	0511ef3028	fix: deliver session broadcasts to focused clients during resume (#1193)	2026-05-31 14:39:15 +01:00
José Almeida	137336de86	fix: manually drain queued chat messages after cancel (#1166) ... * fix: drain queued chat messages after cancel * fix: address queue drain review feedback * fix: keep queued messages parked after cancel * fix: stabilize queue drain errors * fix: keep queue parked during cancel events * fix: wait for lifecycle stream goroutines * fix: address lifecycle stream review feedback	2026-05-31 11:58:01 +01:00
Carlos Florêncio	8e1f55a0ac	fix: keep env prep out of partial tool history (#1189)	2026-05-31 11:48:21 +01:00
Carlos Florêncio	55ed674a15	fix: dockview/editor restore races, office rebroadcast, and flaky tests (#1171)	2026-05-30 18:02:15 +01:00
Carlos Florêncio	d66d9e6f67	feat: remote tab in task-create dialog — multi-row GitHub repo picker (#1116)	2026-05-30 15:47:02 +01:00
João Salavisa	a34ea719df	feat(web): allow custom prompts in task creation input (#1155) ... * refactor(web): extract measureCaretRect into shared util Move the textarea caret-position measurement helper out of rich-text-input.tsx into apps/web/lib/utils/caret-position.ts so the task-create dialog's autocomplete wiring can reuse it without depending on the chat-only RichTextInput component. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(web): allow custom prompts in task creation input Add an @-mention autocomplete to the task-create dialog's prompt textarea so users can quickly insert one of their saved custom prompts (built-in + user-created) by typing @<name>. - Extend useInlineMention with a promptInsertMode option. The default "context" mode preserves chat behavior (attach the prompt to the context store). The new "inline" mode replaces the @query text with the prompt's full content, requiring no backend changes -- the resolved text just becomes part of the task description on submit. - Wire the hook into TaskFormInputs via a small useTaskCreatePromptMention helper that adapts the existing textarea ref to the RichTextInputHandle surface the hook expects (focus / selection / caret-rect / value). - Reuse the existing MentionMenu popup component for parity with chat. - Cover the new branches with unit tests for makePromptItem / detectMentionTrigger / filterItems, and an E2E spec exercising the menu open / inline-insertion / Enter-doesn't-submit / trigger-inside-word paths. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(web): make mention popup clickable inside Radix Dialog Radix Dialog sets pointer-events: none on document.body to enforce modal isolation. The mention/slash menu portals to document.body and inherits the disabled pointer events when opened from inside a Dialog (the task-create flow). The popup was visible but unclickable: keyboard select worked, mouse clicks were swallowed by the Dialog body. Restore pointerEvents: auto on the popup container so it stays clickable when invoked from within a modal. Bump z-index to 60 so the popup also wins the visual stacking race against the Dialog (overlay + content are both z-50). Chat continues to work unchanged since z-60 and pointer-events: auto are no-ops outside a modal. Add an adversarial QA spec covering mouse-click select, ArrowDown + Enter on the 2nd item, Escape close, multi-line content auto-grow, backspace-over-@ close, space-after-@ close, no-arrow-cursor-shift, and end-to-end submit. The mouse-click case is the one this fix unblocks; the rest pin behavior for future regressions. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(web): address PR review feedback - caret-position.ts: wrap DOM measurement in try/finally so the mirror element is always removed even if getBoundingClientRect throws - useTextareaHandlers: destructure stable fn refs from mention before useCallback so deps are specific properties, not the whole object — avoids defeating memoization on every keystroke - QA spec: consolidate inline cleanupPrompts calls into a shared test.afterEach so cleanup always runs even when a test throws; update submit test comment to accurately reflect what is asserted Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(web): tighten ArrowDown selection assertion in QA E2E spec Equal filter scores sort by insertion order (stable), so qa-arr-1 lands at index 0 and qa-arr-2 at index 1. After one ArrowDown from the default the selected item is "SECOND" — assert that directly instead of accepting either value, matching the test title "selects the second prompt". Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Kandev Agent <agent@kandev.dev> Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-29 15:52:39 +01:00
Carlos Florêncio	b38dc21fb0	fix: stop changes panel from showing stale or flickering content (#1128)	2026-05-28 23:35:32 +01:00
Carlos Florêncio	f4be0d279c	fix: dockview, sprite, auth, and CLI db backup improvements (#1075)	2026-05-28 16:23:17 +01:00
Carlos Florêncio	905b9f9727	fix: improve UX for subtasks with repo setup scripts (#1105)	2026-05-28 16:07:51 +01:00
João Salavisa	cf76a27488	feat(web): normalize /gitlab page to match /github layout (#1082) ... * feat(web): normalize /gitlab page to match /github layout Adds a presets sidebar (MR/Issue toggle, Inbox/Created groups, Saved section), a top toolbar with project filter and custom-query input, paginated MR/Issue lists, and a save-preset dialog backed by a localStorage store at kandev:gitlab-presets:v1. Replaces the bespoke tabbed layout and supersedes hooks/domains/gitlab/use-user-search with the pagination-aware useGitLabSearch under components/gitlab/my-gitlab/. Project filtering is applied client-side since GitLab's global MR/issue endpoints have no path_with_namespace qualifier. No backend changes — the controller already accepts filter / custom_query / page / per_page. * fix(web): address /gitlab review feedback - Merge duplicate cn/formatRelativeTime imports in list-toolbar. - Drop the generic T from useGitLabSearch — it always resolved to MR | Issue, so the as-unknown-as double-cast was just hiding that. Now returns Array<MR | Issue> directly and exposes rawTotal alongside total. - When projectFilter is active, total reflects the client-side filtered count instead of the server's unfiltered total so the toolbar badge and pagination don't claim "47 results" while only 3 rows render. - Save flow uses committedQuery, not the draft customQuery, so a preset saved without pressing Enter matches what's actually displayed. - Wrap mobile sidebar handlers in useCallback to keep props stable. - Drop the unused refresh callback in useGitLabStatusFetch (no caller). - Add hook-level tests for useSavedPresets save/remove/sync; use resetKnownProjectsStore directly in the known-projects test. * fix(web): address round-2 /gitlab review feedback - useSavedPresets save/remove now read from localStorage on every call so a concurrent write from another tab can't be silently overwritten by a stale in-memory snapshot. - Tighten persisted shape validation: customQuery, projectFilter, and createdAt must all be strings (plus 3 regression tests). - ResultsPagination clamps page to [1, totalPages] before deriving start/end and prev/next state, so a stale out-of-range page doesn't render an invalid range like "101–30 of 30" after a refresh that shrinks results. - PresetsSidebar: ignore keydown bubbling from the nested delete button so Enter/Space on delete doesn't also trigger row selection, and add an aria-label to the icon-only delete control. - Revert the hook's filtered-total policy: useGitLabSearch always returns the raw server total now (so pagination can still navigate to later pages). The page client owns the toolbar's displayedCount, computing filtered.length only when a project filter is active. * fix(web): drop dead gitlab preset re-exports, tighten save dialog deps - Remove unused IconBug / IconPencil imports and the re-export from presets.ts — no consumer imports them from this module. - save-preset-dialog: inline the trimmed check inside handleSubmit so canSubmit no longer needs to be in the deps array. ESLint exhaustive- deps forced the previous duplication; inlining removes it cleanly. * fix(web): null-safe response unwrap in useGitLabSearch If the API returns null, the cast `(response as {mrs: ...}).mrs` would crash before the `?? []` fallback could run. Optional-chain the cast so a null payload yields an empty list, matching the existing total_count guard. --------- Co-authored-by: Kandev Agent <agent@kandev.dev>	2026-05-26 16:00:55 +01:00
Daniel Brown	c0eaafaf29	fix(mobile): isPassthroughMode falls back to TaskChatPanel when snapshot is missing (closes #1031) (#1034) ... * fix(mobile): passthrough TUI rendering + touch-scroll Two related mobile-UI fixes for cli_passthrough sessions, both filed in #1031. 1. task-center-panel.tsx: align isPassthroughMode with the rest of the codebase by checking session.is_passthrough first. The memo previously only consulted agent_profile_snapshot.cli_passthrough, which can be undefined in the Redux store on re-mount (the snapshot isn't always present on the leaner session-list responses). When that happened on mobile, the chat panel rendered the persisted- messages TaskChatPanel fallback instead of the live PassthroughTerminal. Desktop was immune because dockview-desktop-layout.tsx already uses the session.is_passthrough field directly. is_passthrough is the source of truth used by manager_startup.go's StartAgentProcess routing — keeping the frontend consistent with that invariant. 2. passthrough-terminal.tsx: wire touch-drag scrolling on the xterm viewport. xterm.js handles mouse wheel natively but not touch gestures, so swiping inside the terminal on mobile bubbled up and scrolled the page instead of the terminal scrollback — effectively making everything that scrolled off-screen unreachable on mobile. The new hook attaches touchstart/touchmove/touchend handlers that map vertical drag delta to term.scrollLines(), gated on (pointer: coarse) so desktop xterm behaviour stays identical. Row-height comes from xterm's internal render dimensions with a measured fallback (xterm 5.x layout) and a 16px constant fallback if both fail. Closes #1031 * fix(mobile): also fix useSessionLayoutState's isPassthroughMode + tighten touch-handling Three follow-on fixes after Dan's mobile QA surfaced more cases: 1. apps/web/hooks/use-session-layout-state.ts — the mobile layout actually uses THIS hook's isPassthroughMode memo (not the one in task-center-panel.tsx that I previously fixed). It had the identical snapshot-only bug. Aligned with the same is_passthrough-first priority. 2. apps/web/components/task/passthrough-terminal.tsx — always preventDefault on touchmove (was only doing so when the row-delta calculation rounded to non-zero, so sub-row drags slipped through to parent scroll). Added touch-action: none + overscroll-behavior: contain inline on the terminal element so the browser never claims the gesture. 3. apps/web/app/globals.css — overscroll-behavior: none on body to block pull-to-refresh. iOS Safari ignores this in some configurations but blocking it where possible reduces the page-reload race that was triggering the stuck-on-loading-messages state. * fix(mobile): trim PR to minimum required changes After QA showed the user-visible mobile bug is fully addressed by the useSessionLayoutState memo fix alone, revert the parallel changes to the desktop hook (task-center-panel.tsx's useSessionApprove) and the body-level overscroll-behavior — neither was required for the reported bug, and Dan asked for the smallest possible diff. Remaining changes: - apps/web/hooks/use-session-layout-state.ts — actual mobile fix - apps/web/components/task/passthrough-terminal.tsx — touch-scroll feature * fix(mobile): tighten isPassthroughMode + drop terminal touch-scroll from this PR Adversarial-review feedback applied: - Change `is_passthrough === true` to `!== undefined` so an explicit server-side false isn't overridden by a stale snapshot. - Comment now cites the specific WS handler quirk in ws/handlers/agent-session.ts where snapshot writes are truthy-guarded but is_passthrough writes are !== undefined-guarded — that's the concrete path where partial events land one without the other. Dropped: the useMobileTouchScroll hook. Terminal scroll on mobile is a separate feature that deserves its own discussion (xterm renders the canvas above the scrollable viewport so native scroll doesn't reach the viewport; the right fix likely lives in xterm itself or a small event-redirect addon). Keeping this PR scoped to the rendering bug. * fix(mobile): add minimal touch-scroll fallback for xterm viewport xterm.js renders .xterm-screen (canvas) above .xterm-viewport, so iOS / Android native scroll on the viewport never sees the touches and the terminal is unscrollable on mobile. useTouchScrollFallback wires touchstart/touchmove/touchend to Terminal.scrollLines via an accumulated fractional-row delta. No inertia — the proper fix is upstream in xterm-js. Gated on (pointer: coarse) so desktop xterm behaviour is unchanged. Sets touch-action: none + overscroll-behavior: contain inline on the terminal element so the browser doesn't claim the gesture for pull-to-refresh. * fix(mobile): inertia decay on touch-scroll release for native-scroll feel * fix(mobile): address adversarial review of touch-scroll hook - Read xterm from ref inside each handler so renderer recreate doesn't strand the handlers on a stale Terminal instance (React refs are stable so dep array doesn't catch .current swaps). - Drop the internal _core._renderService private-API path for row height in favor of public term.rows + measured element height. The internal path was API-unstable across xterm majors. - Velocity window 80ms → 50ms so a direction reversal at the tail of the gesture is the release velocity, not averaged against the early motion. - Reset pendingRows fractional accumulator on direction reversal — was causing perceptible stickiness when reversing from slow-up to fast-down. - Style restoration now uses removeProperty when the inline style was never set, rather than leaking an empty string in its place. * fix(mobile): revert touch-scroll hook from this PR — separate concern After several iterations the touch-scroll fallback kept surfacing new issues (iOS pull-to-refresh leaking through preventDefault, scroll direction reversal edge cases) that suggest a more involved upstream discussion is needed about whether to ship a workaround in PassthroughTerminal at all vs fixing xterm.js's mobile story upstream. Splitting that work out so this PR can land the rendering bug fix cleanly. Will file a separate issue for the touch-scroll work with the diagnosis + alternatives we explored. * fix(mobile): honor is_passthrough when snapshot missing --------- Co-authored-by: Carlos Florêncio <carlosmflorencio@gmail.com>	2026-05-25 22:09:17 +01:00
Carlos Florêncio	f1dbad1dbd	feat(cli-mode): auto-inject task prompt + dynamic submit sequence + passthrough UX fixes (#923)	2026-05-25 19:14:36 +01:00
José Almeida	777dfdb15b	feat(ssh): add SSH executor (#927) ... * feat(backend): add SSH executor runtime Run agents on any Linux box reachable over SSH: own VPS, homelab, EC2, shared dev box. One SSH connection per (host, user, identity) shared across all sessions on that host; each session gets its own remote agentctl process, remote port, and SSH-tunneled local port. Mirrors the local ~/.kandev/tasks/<task-dir>/<repo>/ layout on the remote so multi-session tasks share a worktree and per-session runtime state lives under the task dir. Implements ExecutorBackend + RemoteSessionResumer + RemoteStatusProvider + Closeable. Host-key trust is explicit: the test endpoint observes a fingerprint without pinning; the user trusts it in settings; subsequent connects reject any mismatch. Auth via ssh-agent or IdentityFile only (passphrase-protected keys must be loaded into ssh-agent). Parses ~/.ssh/config for HostName/Port/User/IdentityFile/ProxyJump inheritance. agentctl is content-hash-cached on the remote (~/.kandev/bin/agentctl plus a .sha256 sidecar) and uploaded only when local and remote differ. Linux/amd64 only in v1, matching Docker's current state; arm64 is called out as a cross-cutting follow-up. See docs/specs/ssh-executor/spec.md. * feat(backend): add SSH test + sessions HTTP/WS endpoints POST /api/v1/ssh/test runs the connection probe used by the settings UI: dials the host with a permissive host-key callback that records (but does not pin) the fingerprint, probes uname/arch/git, and reports whether agentctl is already cached on the remote. The UI gates the "Trust this host" checkbox on success + fingerprint, and Save persists the trusted fingerprint into the executor config. GET /api/v1/ssh/executors/:id/sessions returns the active SSH-runtime sessions backing the "Active sessions" card on the executor settings page, mirroring the SpritesInstancesCard / DockerContainersCard shape (task, session, user@host, remote port, local forward port, uptime). Both routes also exposed over WS via ssh.test / ssh.sessions.list. * feat(web): add SSH executor settings UI SSHConnectionCard: connection form (name, host_alias / host / port / user, identity source = ssh-agent | file with optional file path, optional ProxyJump) with a Test Connection button that runs the backend probe, surfaces the observed host fingerprint, and only enables Save when the user explicitly ticks "Trust this host". Editing the host / port / user / identity fields resets both the test result and the trust checkbox. On save, if the executor already has running sessions, a confirm modal warns that those keep going on the old host and only new sessions will use the new config. SSHSessionsCard: 90s-polled table of active sessions for the executor, mirroring SpritesInstancesCard / DockerContainersCard. Columns: task, session, user@host, remote agentctl port, local forward port, uptime, status badge. Backed by GET /api/v1/ssh/executors/:id/sessions. Also registers the ssh entry in executor-icons.ts (label "SSH", IconTerminal2) so it surfaces consistently in the rest of the settings chrome. * docs: add SSH executor v1 spec Captures the design behind the new SSH executor: why ("run on a Linux box I already own" between local and Sprites), the remote layout that mirrors local ~/.kandev/tasks/, per-session agentctl + forward over a shared per-host SSH connection, explicit-trust host-key flow, ~/.ssh/config inheritance, amd64 + agentctl content-hash cache, recovery via persisted ExecutorRunning metadata, settings UI (Connection + Sessions cards), and the edit-with-live-sessions warning UX. Out-of-scope items (arm64, macOS, password auth, chained ProxyJump, working-tree push, etc.) are called out explicitly with the follow-ups they unblock. * chore(e2e): rename docker project to containers + add e2e README The Docker e2e Playwright project was the natural home for any test that needs a real Docker daemon on the host — but its name implied it was only about the Docker executor. SSH e2e tests (incoming in follow-up commits) belong here too, since they use a Dockerised sshd container as the SSH executor's remote target. - Rename project: docker -> containers, widen testMatch to also include tests/ssh/*.spec.ts. - Rename env flag: KANDEV_E2E_DOCKER -> KANDEV_E2E_CONTAINERS, with the old name kept as a deprecated alias for one release so local scripts and CI configs don't break overnight. - Rename CI job: e2e-docker -> e2e-containers, switch its blob report name and the merge-job dependency. - Add apps/web/e2e/README.md explaining the project layout, what the containers project covers (Docker executor + SSH executor), why it was renamed, and how to run it locally. - Add docs/specs/ssh-executor/e2e-plan.md tracking the SSH e2e coverage we'll implement on top of this rename (real sshd container, no mocks, 17 spec files covering ~75 cases). Includes a "Deferred" section that flags arm64 as something to revisit when agentctl-linux-arm64 lands in the build pipeline. * feat(web): add data-testid attributes to SSH settings UI Sweep stable test ids across the SSH connection and sessions cards so the incoming Playwright suite can hold steady against refactors. Splits the formerly monolithic ssh-settings.tsx into three files to stay within the per-file/per-function size limits: - ssh-connection-card.tsx (form + test-then-trust flow) - ssh-sessions-card.tsx (active-sessions table) - ssh-settings.tsx (barrel re-export so existing imports keep working) Test ids cover: card roots, every input, identity-source select + options, test/save buttons, connection badge (with data-status), error text, test-result panel (with data-success), per-step rows (with data-success), observed/pinned fingerprint, fingerprint-change warning, trust checkbox, sessions table + per-row cells, empty state, refresh button, session status badge. * feat(e2e): scaffold the SSH executor test harness Lands the building blocks the SSH specs will compose on top of. Every piece talks to a real sshd container — no mocks at any layer. - fixtures/ssh-image.ts: builds kandev-sshd:e2e once per machine (Alpine + openssh-server + openssh-sftp-server + git + bash + sudo + iproute2 + iptables, pre-bakes mock-agent at /usr/local/bin/mock-agent, generates a fresh host key on entrypoint, reads the worker public key out of a bind-mounted /authorized_keys). The agentctl binary is deliberately NOT pre-baked so tests exercise the SFTP upload + sha256 cache path the production code uses. - helpers/ssh.ts: per-worker sshd lifecycle (startSSHServer / stopSSHServer), keypair generation, host-key fingerprint scanning, fault injection (regenerateHostKey for host-key-rotation specs, dropTrafficToPort22 / restoreTraffic for connection-drop tests, killRemotePid for "agentctl died" recovery), and remote inspection helpers (readRemoteFile / remotePathExists / listRemoteDir / countSshdConnections). - helpers/ssh-bastion.ts: two-container ProxyJump setup. Bastion is on a private Docker network and has a published port; target is on the same network with NO host port — any successful connection MUST have traversed the bastion, which makes the proxy-jump assertion honest. - fixtures/ssh-test-base.ts: worker-scoped fixture mirroring docker-test-base. Skips when Docker isn't reachable. Spins up the sshd container, generates keys, scans the fingerprint, then seeds a workspace + workflow + bare repo + mock-agent profile + an SSH executor with the fingerprint already trusted. Specs that need to exercise the test-then-trust UI gate create their own executor on top of the same target. - pages/SSHSettingsPage.ts: Page Object covering the connection form, test/save buttons, trust checkbox, observed/pinned fingerprint, per step badges, and the sessions table. - helpers/api-client.ts: new createSSHExecutor / updateExecutor / getExecutor / testSSHConnection / listSSHSessions methods plus matching DTO types. * test(e2e): add SSH executor Playwright suite (17 specs, ~75 cases) Every spec drives the real sshd container set up by the ssh-test-base fixture; no mocks. Specs are grouped by concern (file per group), mirroring the docker/ directory style. Each one maps 1:1 to a row in docs/specs/ssh-executor/e2e-plan.md. UI surface: - connection-form.spec.ts — field rendering, save/test gating, identity-source toggle, default port. - test-result.spec.ts — successful + failed Test Connection paths, per-step badges, fingerprint surfacing, cached/will-upload copy. - trust-gate.spec.ts — save disabled until trust ticked, edits reset result + trust, fingerprint-change warning when pinned != observed. - sessions-card.spec.ts — empty state, row rendering, manual refresh, status badges, truncation, polling pickup. - persistence.spec.ts — fingerprint persists across reload, new form starts blank, executor list label, partial state doesn't leak. API contract: - test-endpoint.spec.ts — POST /api/v1/ssh/test step ordering, invalid body, host-required, handshake short-circuit, cached/uploaded states. - sessions-endpoint.spec.ts — GET /api/v1/ssh/executors/:id/sessions filters to ssh-runtime rows, populates metadata, monotonic uptime. - executor-crud.spec.ts — type=ssh persists fingerprint, profile workdir round-trip, edit-with-running-sessions keeps snapshots. Real-SSH integration: - launch-task.spec.ts — full smoke: agentctl upload + sha256 cache hit on second launch, task/session dir layout, stop cleans session dir. - recovery.spec.ts — backend restart reconnects, dead pid surfaces failure, persisted metadata keys present. - auth-methods.spec.ts — key + valid, missing key, passphrase-protected rejection, agent without SSH_AUTH_SOCK, wrong-key auth failure. - concurrency.spec.ts — two sessions share task dir distinct ports, two tasks distinct dirs, traffic drop + restore exercises eviction + reconnect. - hostkey-rotation.spec.ts — regenerate host key surfaces new fingerprint, stale pinned fingerprint blocks launch verbatim, re-trust restores function. - config-inheritance.spec.ts — ~/.ssh/config HostName / Port / IdentityFile / ProxyJump inheritance with form-overrides-config rules. - workdir-per-profile.spec.ts — per-profile ssh_workdir_root routes to separate remote workdir trees; default falls back to ~/.kandev. - proxy-jump.spec.ts — 2-container bastion topology asserts target is unreachable directly, reachable via ProxyJump, chained ProxyJump fails. - error-surfacing.spec.ts — TCP refused, auth failed, bastion unreachable surface verbatim; backend 400 stays a 400 not a synthesised failure. Also adds an AGENTS.md (CLAUDE.md symlink) line pointing at the e2e/README.md so future agents discover the containers project + KANDEV_E2E_CONTAINERS env var without grepping playwright.config.ts. * fix(e2e): unlock sshd account, derive fingerprint from kandev probe Three bugs surfaced by actually running the SSH e2e suite (KANDEV_E2E_CONTAINERS=1 against the containers project): 1. Alpine's `adduser -D kandev` leaves the account password-locked (`!` in /etc/shadow). sshd then refuses every auth method for that user — including pubkey — with "User kandev not allowed because account is locked". Fix: `usermod -p '*' kandev` in the Dockerfile so the account is open for key-based login but still has no valid password. Also adds the `shadow` apk package for `usermod`. 2. ssh-keyscan reports the ed25519 host fingerprint, but Go's ssh client may negotiate a different host key type when sshd offers multiple — meaning the fingerprint the fixture pre-scanned didn't match the one kandev observed at handshake time. Fix: the fixture now hits /api/v1/ssh/test with a permissive callback right after the container is up and uses that fingerprint as the pinned value. Same code path real users hit; eliminates the negotiation skew by construction. 3. ssh.ts had a CPU-spin sleep helper and an nc-dependent TCP probe, both fragile. Replaced with a proper sleep subprocess and a bash /dev/tcp probe, plus retry-with-stderr on the fingerprint scan so failures are diagnosable. Also tightens test-endpoint.spec.ts F4: the test was using identity_source=agent to "fail fast", but that fails inside buildAuthMethods before the handshake step ever runs. Switched to identity_source=file against a refused port so the test exercises the actual TCP+handshake failure path. After these fixes 4/6 test-endpoint cases pass against a real sshd. * fix(ssh): make the end-to-end launch path actually work A pass of issues uncovered by running the SSH e2e suite locally (KANDEV_E2E_CONTAINERS=1 against the real sshd container). After this commit all 15 non-launch SSH e2e tests pass (UI form validation, test-connection contract, auth-methods, error-surfacing, sessions-card empty state) and the launch path runs through prepare -> upload -> agentctl -> instance -> forward, with WebSocket streams sometimes disconnecting partway through (tracked below for follow-up). Image changes (apps/web/e2e/fixtures/ssh-image.ts): - Install curl so the SSH executor can POST to the in-container agentctl control server for instance creation. - Install gcompat + libstdc++ so the dynamically-linked glibc agentctl binary can exec on musl-libc Alpine. Without it the kernel returns ENOENT for /lib64/ld-linux-x86-64.so.2. - Install shadow + 'usermod -p *' kandev so sshd doesn't refuse pubkey auth for the otherwise-locked user. - Drop in 'AllowTcpForwarding yes' and 'MaxSessions 100' via /etc/ssh/sshd_config.d/. Alpine's defaults are 'no' and 10, both of which crater the SSH executor's port-forward path. - chown /home/kandev/.kandev to kandev on entrypoint so a host bind-mount of that path (used in this commit for log persistence) doesn't make agentctl unable to write its log file. Image helper (apps/web/e2e/helpers/ssh.ts): - Bind-mount the host mock-agent-linux-amd64 into the container at the same absolute path. kandev's orchestrator builds the agent command from KANDEV_MOCK_AGENT_LINUX_BINARY (a host path), so the remote needs the binary at that exact path; bake-into-image isn't enough because the absolute host path is what kandev sends. - Bind-mount /home/kandev/.kandev so per-session agentctl logs survive --rm teardown and the test runner can inspect them on failure. - Replace the broken CPU-spin sleep helper with a real sleep subprocess and a /dev/tcp TCP-open probe so timing-dependent helpers stop racing the container start. - Retry the host fingerprint scan with stderr capture; the first scan can race the sshd accept loop on Alpine. Backend SSH executor (apps/backend/internal/agent/lifecycle): - executor_ssh_operations.go startRemoteAgentctl: agentctl does not accept --port-file or --pid-file flags (it reads AGENTCTL_PORT and writes its own pid). Rewrite the launch wrapper to inject AGENTCTL_PORT via env, capture $! as the pid, and tail the on-remote agentctl.log for 'HTTP server bound successfully' instead of waiting on imaginary side-files. - executor_ssh_operations.go createRemoteAgentInstance: new helper that POSTs /api/v1/instances on the in-container control server via SSH-exec'd curl, returning the per-instance port the executor should forward to. Mirrors what executor_sprites_operations.go does inside its sprite. Without this step the agent stream returns 'configure request failed with status 404' because the SSH executor was talking to the control server, not the per-session sub-server. - executor_ssh.go startAndForwardAgentctl: chains the new create-instance step in between agentctl launch and port-forward, and forwards the *instance* port (not the control port). - executor_ssh.go: drop the per-host SSH connection pool (it was introducing a subtle aliasing issue between CreateInstance/StopInstance/GetRemoteStatus that made the SSH client unreliable across same-host sessions). Each session now holds its own ssh.Client directly on sshSessionState and ResumeRemoteInstance dials a fresh client too. - executor_ssh_operations.go SSHPortForwarder: serialize the client.Dial calls with a per-forwarder mutex. golang.org/x/crypto/ ssh.Client.Dial is documented as concurrency-safe but in practice parallel opens from the kandev stream-manager occasionally produce io.EOF as if the channel-open response was never received. Test fix (apps/web/e2e/tests/ssh/error-surfacing.spec.ts): - Q1 ('TCP refused') was using identity_source='agent' with no SSH_AUTH_SOCK in the backend env, so it failed at buildAuthMethods before reaching the TCP-refused path. Switch to identity_source='file' with the seed key so the test exercises the failure it claims to. Known remaining issue (to investigate next): the launch path now reaches 'agent process started' + 'ACP initialize response received' when run in isolation, but the WebSocket updates stream sometimes disconnects with 1006 abnormal closure shortly after. A standalone Go reproduction of concurrent direct-tcpip channels against the same image works without issue, so the trigger is something specific to the kandev backend's stream-manager + my forwarder interaction. Tracked for the next iteration. * fix(ssh): half-close forwarded SSH channels to avoid premature WS abnormal-close The SSH executor's port-forwarder previously called the full Close() as soon as either direction of the bidirectional copy finished. Under HTTP-Upgrade WebSocket traffic this meant: when the WS server flushed its final frame and shut down the write side, our local->remote io.Copy returned EOF, we closed the entire SSH channel, the remote->local copy aborted mid-frame, and the backend's WS reader observed close 1006 (unexpected EOF) instead of a clean close frame. Switch to a half-close pattern: each direction CloseWrite()s its destination when its source EOFs, letting the other half drain the remaining frames. The final Close happens after both copies return. The "ssh forwarder dial remote failed: EOF" warning in e2e logs was a follow-on symptom — the SSH client was being torn down by the abnormal close, so any later channel-open returned EOF immediately. * fix(ssh): resolve session executor_id via TaskSession join GET /api/v1/ssh/executors/:id/sessions was filtering ExecutorRunning rows by their ExecutorID column, but the lifecycle manager's buildRunningFromExecution only sets that column from a prior row — for fresh sessions it's left empty. The endpoint therefore returned [] for every just-launched SSH session. Look up the TaskSession by session_id and compare its ExecutorID instead. Keep the row's own ExecutorID as a fast-path for resume/recovery flows where it's already populated. * feat(web): register ssh entry in the new-executor type map Without this entry, /settings/executors/new/ssh fell back to the "unknown executor type" placeholder. Extracts the type map into its own module so the page file stays under the 600-line lint cap. The SSH-specific form is still TODO and will replace the standard profile-create form for this type in a follow-up. * test(e2e): poll listSSHSessions for SSH session row in group G The simple-message scenario completes inside a couple hundred milliseconds, so the previous "wait for executor_type=ssh, then query once" pattern raced the row's removal during teardown. Poll listSSHSessions directly with a 60s window so the row is observed while the executor is up. Adds dumpRemoteLogs helper for copying per-session agentctl.log files out of the sshd container on assertion failure, easing debugging when the row never appears. * test(e2e): align H5 assertion with actual on-disk session-dir layout The wrapper writes agentctl.pid and agentctl.log to <sessionDir>; the remote agentctl port travels via AGENTCTL_PORT env + ExecutorRunning metadata, not a separate .port file. Assert the files that actually exist and the metadata field that carries the port. * feat(web): mount SSH connection + sessions cards on dedicated routes Wires the existing SSHConnectionCard and SSHSessionsCard into the settings UI so the SSH executor flow has a home: - /settings/executors/new/ssh renders SSHCreatePage (just the connection card; Save POSTs a new executor and routes to the edit page). - /settings/executors/ssh/[executorId] loads the executor and renders the connection card pre-filled + the sessions card. - Adds the SSH entry to the executors landing-page tile grid. - Adds createExecutor / fetchExecutor / updateExecutor helpers to settings-api so the new pages can talk to /api/v1/executors directly. Profile management for SSH executors still flows through the existing profile pages; this commit only adds the executor-level chrome the SSHSettingsPage e2e tests expect. * fix(web): keep SSH trust checkbox visible after editing a connection field Previously, editing any form field nulled out `result` so the entire TestResultDisplay (including the trust checkbox) unmounted. The trust-gate e2e specs assert that after editing host/port/user/identity_source, the trust checkbox is still present but unchecked — which matches the intended UX: the user can re-test against the new target and re-tick trust without losing the prior result for reference. Now an edit only clears `trust` when the field could route to a different machine (host_alias, host, port, user, identity_source, identity_file, proxy_jump); the result panel stays mounted. Editing the display-only `name` leaves trust alone. * test(e2e): point SSHSettingsPage at the new SSH executor routes Updates the page object to navigate to the SSH-specific routes that now host the connection + sessions cards: - gotoNew(): /settings/executors/new?type=ssh → /settings/executors/new/ssh - gotoExisting(): /settings/executors/[executorId] → /settings/executors/ssh/[executorId] The old URLs collided with the standard profile-create / profile-edit flow and were never going to render the SSH cards. The new paths give the SSH UI its own surface, leaving the generic profile pages untouched. * feat(api): add top-level DELETE /api/v1/executor-profiles/:profileId Profile IDs are globally unique, so callers that only have the profile id (e2e api client, CLI tooling) shouldn't have to plumb the executor id through. Aliases the existing nested handler. * test(e2e): probe SSH fingerprint via kandev, not ssh-keyscan, in K specs regenerateHostKey was returning the ssh-keyscan fingerprint, but ssh-keyscan and the Go ssh client can negotiate different host-key types — meaning the fingerprint kandev observes during a real probe does not always match what keyscan saw. The keyscan output was used verbatim as the expected value, which K1 / K3 then asserted against kandev's pinned-fingerprint result, so the specs flapped depending on which algorithm sshd advertised. Drop the return value from regenerateHostKey and have callers hit /api/v1/ssh/test to learn the canonical fingerprint, matching what the SSH fixture already does at seeding time. K2 was polling env.error_message which doesn't exist — the launch fails at SSH dial time before the executor is recorded on the task environment. Point the polling at the task-session error_message instead, where updateTaskSessionState actually persists the dial failure. * test(e2e): wipe agentctl before F5 to assert from a fresh-install state F5 asserts that the agentctl_action probe reports "uploaded" before the first launch and "cached" after. Tests share a worker-scoped sshd container, so an earlier test in the same worker may have already primed the cache, making the "before" assertion flap. Wipe ~/.kandev/bin/agentctl + .sha256 from the container at the top of F5 so the assertion sees the documented fresh-install path. Export execInContainer so the spec can reach into the container without copying the docker-exec boilerplate. Add error_message to the listTaskSessions return type so the hostkey-rotation spec can read the field (which the backend already returns). * fix(ssh): re-read ~/.ssh/config on every resolve, no process-wide cache kevinburke/ssh_config's package-level Get/GetStrict use a sync.Once to load $HOME/.ssh/config once per process and cache the result. That breaks two things: * users who edit their config mid-session don't see updates until kandev restarts; * e2e tests that write a fresh ~/.ssh/config per test all see the state captured by whichever test triggered the first lookup. Open and Decode $HOME/.ssh/config on demand from a local inheritFromSSHConfig helper. The library still parses the file the same way — we're just dropping the global cache. Unblocks the four ssh/config-inheritance.spec.ts cases that wrote a per-test ~/.ssh/config. * feat(ssh): parse literal user@host:port ProxyJump bastion strings dialViaJump fed target.ProxyJump straight into ResolveSSHTarget as a host alias. That works for `Host prod-jump` entries in ~/.ssh/config but turns the literal `user@host:port` form into a single hostname that the kernel resolver chokes on (`lookup kandev@127.0.0.1:23000: no such host`). Detect the literal shape inline (`[user@]host[:port]`) and build the bastion SSHTarget from its parts. Falls back to the alias path when no @ / : separators are present. Fixes the proxy-jump.spec.ts bastion flow. While here: * scanFingerprintInsideNetwork: alpine package is `openssh-client`, not the (nonexistent) `openssh-keyscan`. Surface install errors so future failures aren't silent. * scanFingerprintViaHost: retry on empty output — sshd accepts TCP before host-key negotiation completes on a cold container. * startBastionAndTarget: share one keypair across bastion + target so a single -i auths both hops (matches how OpenSSH ProxyJump handles per-host identities outside ~/.ssh/config). * proxy-jump N1: assert any SHA256 fingerprint came back, since the test no longer pre-discovers a value to compare against. * test(e2e): time-bound the drop-traffic SSH probe with an AbortController race iptables -A INPUT -p tcp --dport 22 -j DROP silently discards SYN packets — Go's net.Dialer sits in the connect syscall through the kernel's TCP_SYN_RETRIES (default 6 ~ 127s) before the syscall is abandoned, even though the dialer's logical Timeout is 30s. The spec polled the testSSHConnection API for the failure path; the request blocked long enough that Node's keep-alive evicted the socket and the test failed with "other side closed" instead of seeing kandev's success=false response. Race the probe against a 5s timeout. If the request errored or timed out the test passes (both are valid evidence that the drop hit the dial path); if it came back with a response, assert success=false the same way the original spec did. The restore-probe poll still gates on a real success after restoreTraffic. * test(e2e): rerun ssh.test in hostkey-rotation afterEach to repin Hostkey-rotation specs mutate the worker-scoped sshd container and the seeded SSH executor's pinned fingerprint. Without a cleanup hook, the next spec in the same worker that resolves seedData.sshTarget. hostFingerprint observes a stale value and the UI's trusted-badge check (persistence R1) flaps. Add an afterEach that re-probes the live container via kandev, syncs the fingerprint into both seedData and the seeded executor's pinned config. The cleanup is a no-op when the probe fails (e.g. K2 left an intentionally bad fingerprint that no longer matches anything — the next test will re-establish state via its own setup). * test(e2e): restore the seeded executor's pinned fingerprint after R5 The fingerprint-change-warning spec pinned a deliberately bogus fingerprint on the worker's seeded SSH executor to exercise the mismatch UI, then exited without resetting it. Later specs in the same worker that launched real tasks against the same executor (workdir-per-profile R1/R2 in alphabetical order) failed at SSH dial time with host-key-changed, since the executor was still pinned to the bad value. Wrap the assertion in a try/finally that restores the original fingerprint from seedData when the test ends, so the worker leaves the executor in the same state it inherited. * fix(ssh): quote every remote path + clean identity file path CodeQL flagged two paths from HTTP-supplied SSH-config fields into shell + filesystem operations: * runSSHCommand built "cat $remoteShaFile" / "test -x $remoteBin" / "mkdir -p $(dirname $remoteBin)" by direct concatenation; the arguments come from $HOME on the remote (not the kandev user) but the analyzer can't see that, and a remote $HOME containing shell metacharacters would still misparse. Route them through shellQuote for parity with every other call site in the file. * dialAuth opened target.IdentityFile straight from the configured string. Run it through filepath.Clean so any `..` segments slipped in by string substitution are normalised before os.ReadFile, which is the canonical mitigation CodeQL recognises here. Behaviour is unchanged for normal paths. * refactor(ssh): drop the unused conn pool + remote curl dependency CodeRabbit and Greptile both flagged the SSHConnPool: the executor never took the pool path (CreateInstance always dialDirect'd a fresh client and parked it on sshSessionState), so the pool's keepalive goroutines and refcount logic were dead code. Get() also overwrote map entries on every call, which would have leaked keepalive goroutines if the pool *had* been used. Delete the entire SSHConnPool + sshConnKey + pooledConn + keepalive plumbing. Export DialSSH so the SSH test endpoint can dial directly and close the client when its single-shot probe is done. While here: * pickRemoteAgentctlPort: switch from time.Now().UnixNano()%20000 to math/rand/v2.IntN. Two concurrent CreateInstance calls on a fast machine were getting the same port (UnixNano cycles in ~20µs through the 20k range); randomized picks avoid the collision. * createRemoteAgentInstance: POST to the remote control port over a direct-tcpip dial via net/http instead of shelling out to `curl`. The sshd container no longer needs curl, the kandev test endpoint no longer needs to probe for it, and the call inherits Go's standard timeout + error handling. Drop `curl` from the e2e Alpine image. * maybeUploadCredentials: was probing `printf %s "$HOME"` and discarding the output, then allocating an unused sshFileUploader. SSH v1 doesn't ship credential upload — just log a warning when a user sets remote_credentials so they know it won't take effect, and delete the dead uploader file. * fix(ssh): verify bastion host key + tighten the trust-gate UX Bastion host-key verification (security) resolveBastion built the bastion's ClientConfig with an empty PinnedFingerprint, which buildClientConfig translated into a callback that accepts any key. An attacker on the path to the bastion (DNS poisoning, route hijack) could pivot through it before the final-target check ever ran. Greptile flagged it as P1. Swap in a callback that consults ~/.ssh/known_hosts via knownhosts.New: matched key → accept; mismatched key → reject loud (the alarm); host absent → accept with the same TOFU semantics OpenSSH uses for StrictHostKeyChecking=accept-new, so e2e and first-connect setups still work without manual `ssh-keyscan` priming. Stale-test trust gate (frontend) Editing a connection field after a successful test previously kept the prior result + cleared `trust`, but the trust checkbox could be re-checked and saved with the old fingerprint bound to the new target. CodeRabbit + cubic both flagged it as P1. Add a `resultStale` flag that flips when a CONNECTION_FIELD edit follows a successful test, surface a warning under the result, and disable the trust checkbox + save button until the user re-runs Test Connection. handleTest clears the flag. While here * Surface onSave failures in the card instead of swallowing them. * ssh-create-page: read the executors slice from the live store (useAppStoreApi + getState()) at write time so a concurrent update doesn't get overwritten by a stale closure. * Split FingerprintTrustBlock into its own file to keep ssh-connection-card under the 600-line cap. * fix(ssh): defend launch + handshake against several real bugs manager_launch: trusted exec-config keys override req.Metadata. buildLaunchMetadata applied executor config only when the matching key was missing in req.Metadata. A request that carried metadata. ssh_host_fingerprint (or ssh_host, ssh_identity_*) could pivot the launch to a different target and bypass the pinned fingerprint. Pin a list of connection-routing keys (ssh_host, ssh_port, ssh_user, ssh_host_fingerprint, ssh_identity_source, ssh_identity_file, ssh_proxy_jump) and have the executor config always win for those. Cubic / CodeRabbit P1. executor_ssh.CreateInstance: reuse the resumed session state. ResumeRemoteInstance attaches the recovered ssh.Client + forwarder to r.sessions[InstanceID] and refreshes metadata, then the lifecycle manager unconditionally called CreateInstance, which dialed a fresh client and started a second remote agentctl on top of the live one — leaking the resumed state. CreateInstance now early-returns from the existing r.sessions entry via buildResumedInstance. Cubic P1. executor_ssh.Close: actually release tracked sessions. After dropping the SSHConnPool, Close was a no-op. A hard kandev exit (no per-session StopInstance) left forwarders and SSH clients open. Iterate r.sessions and Close the forwarder + client for each. Cubic P2. buildAuthMethods: close the ssh-agent unix socket after handshake. Each agent-authenticated dial opened net.Dial("unix", $SSH_AUTH_SOCK) and never closed it; only PublicKeysCallback held the agent.Client reference and that callback is consulted exactly once at handshake. Return a cleanup func from buildAuthMethods + buildClientConfig and defer it from dialSSH / dialViaJump so the socket releases as soon as key exchange completes. Greptile P1 security. waitAgentctlHealthy: probe HTTP /health, not just the TCP listener. The local port is owned by the SSH forwarder, which Accepts before it Dials the remote direct-tcpip channel — a TCP connect can succeed before the channel actually establishes. Issue a real GET /health and require a 2xx so a broken tunnel surfaces here rather than at the first agent operation. Cubic P1. ssh-connection-card: also gate the trust + save on in-flight tests. Editing a connection field during a pending test silently kept resultStale=false because prev.result was still null; when the test returned, the new fingerprint was bound to the old form values but the gate let the user trust + save anyway. Treat in-flight tests as prior tests for staleness purposes, and preserve resultStale across the test's success setState. Cubic P2. * fix(ssh): drop stale polls + preserve port inheritance + sshd extra-keys ssh-sessions-card: race-protect polls. Polling setInterval + manual refresh shared one state setter, so a slow request that resolved after a newer call (or after a parent switched executorId) overwrote fresh data with stale rows. Bump a monotonic sequence on each refresh and drop the response when the sequence has moved on, plus reset on mount and invalidate on unmount so an in-flight reply from a teardown can't land. Cubic P2. ssh-config parseSSHExecutorConfig: don't default ssh_port to 22. Reading an executor row that had no ssh_port set rewrote port=22 on the form, which then round-tripped back to the backend. That silently broke ~/.ssh/config Port inheritance for aliases — a save could redirect connections to 22 even though the underlying alias was supposed to resolve to another port. Leave the field undefined so the backend resolver can apply the alias' value. Cubic P2. ssh-image entrypoint: guard authorized_keys.extra mount. When only /authorized_keys.extra (and not /authorized_keys) was bind-mounted, the >> redirect ran under set -e against a missing destination and aborted container startup. mkdir + touch the destination before the append and reapply the ownership/perms. CodeRabbit P2. * test(e2e): make G2 + F6 actually exercise the contract G2 (sessions-endpoint filter) iterated `for (const s of sessions)` over the listSSHSessions result without first asserting `length > 0` — an empty response let the test pass without checking anything. Seed an SSH launch before the loop and require at least one row, so a handler regression that returned [] would now fail loud. CodeRabbit P1. F6 (ws ssh.test parity) called apiClient.testSSHConnection twice (HTTP both times) and compared the two HTTP responses, which would have passed even if the WS dispatcher entry was broken. Use apiClient. wsRequest("ssh.test", payload) for the second call so the gateway's WS handler is actually invoked, and assert the step names match across transports. CodeRabbit P1. * refactor(e2e): extract SSH HTTP shapes into api-client-ssh.ts api-client.ts was already over the 600-line lint cap on main (1528 lines); the SSH additions made it worse. Split the SSH HTTP shape types into a dedicated module and re-export from api-client.ts so existing callers keep working. The methods themselves stay on ApiClient as thin pass-throughs since splitting them out across the class boundary would change every test call site. Also document the per-executor bound on the SSH listSessions per-row GetTaskSession lookup (typical N < 10), and what a batch path would need (a repo method to fetch task_sessions by id list). Cubic / Greptile P2. * docs(spec): correct SSH recovery keying after pool removal The spec said ResumeRemoteInstance re-opens 'per (host, user) — one connection serves all surviving sessions on that host', which was the pool design. The current executor gives each session its own SSH client, so the resume keys on the full (host, port, user, identity_*, proxy_jump, host_fingerprint) tuple. That way two profiles on the same host with different keys can resume side by side without merging. Cubic P2. * fix(ssh): IPv6 ProxyJump + port range + dedup + docker timeouts parseLiteralProxyJump: handle bracketed IPv6 + reject invalid ports. The literal parser used LastIndex(":") to split host from port, which for [2001:db8::1]:22 left host as "[2001:db8::1]" and produced an invalid double-bracket address through net.JoinHostPort. Recognise the bracketed form explicitly via a parseBracketedHostPort helper and strip the brackets. Validate port is in [1, 65535] instead of accepting any integer (Atoi happily parses negative or out-of-range values). Split the host/port branch into its own function so the nesting stays under the golangci nestif limit. ssh-create-page: dedupe on append. setExecutors([...current, next]) would double-list the same executor if a WS event (or another refresh) inserted it while createExecutor was in flight. Skip the append when current already has the id. ssh-image fixture: time-bound docker probe + build. hasSSHContainerSupport ran `docker info` with no timeout — an unreachable / hung daemon would stall the Playwright worker indefinitely. Cap at 10s for the probe. buildE2ESSHImage runs `docker build` with no timeout; cap at 15 min so a stuck registry pull or BuildKit hang fails fast. * fix(ssh): reject invalid ssh_port + retry in-net keyscan + restore D5 + doc count executor_ssh.targetFromMetadata: reject malformed / out-of-range ssh_port instead of silently falling back to 0 → 22 in the resolver. "abc", "0", "70000" all now return a "must be 1-65535" error so a broken config can't masquerade as a successful launch routed through port 22. Cubic P2. scanFingerprintInsideNetwork (bastion fixture): retry on empty output. Mirrors the host-side scanFingerprintViaHost retry loop — sshd accepts TCP before host-key negotiation completes on a cold container, so the keyscan can come back empty on the first try. Bound at 15s; surfaces "status=..., stderr=..." on final failure for diagnosis. Cubic P2. executor-crud D5 (changing config…): restore the seeded executor in a try/finally. The test pinned the executor to host=10.255.255.1 to verify the snapshot stayed sticky on the live session, but never put the real host back, so any later spec in the same worker that reused seedData.sshExecutorId would dial the unroutable address and hang. Cubic P2. e2e-plan.md: replace the "roughly 75" estimate with the actual 80 / 17-files current count plus the ~2.4 min wall-clock. Cubic P3. * fix(ssh): use bare mock-agent name so the remote PATH resolves it For SSH the agent runs on a remote host whose filesystem doesn't share paths with the kandev backend's, so the host-absolute mock-agent path configureMockAgent computes can't apply. Extend the bare-name branch in MockAgent.BuildCommand to include RuntimeSSH (the SSH e2e image already bakes mock-agent into /usr/local/bin) and drop the now-redundant SSH e2e bind-mount that worked around this by mirroring the host path into the container. * fix(ssh): unique sftp temp filename so concurrent uploads don't collide When two sessions on the same task launch back-to-back they both call ensureAgentctlOnHost which streams to <remotePath>.tmp before renaming. With a shared .tmp name the second uploader's rename errors with "file does not exist" once the first uploader's rename consumed the temp file. Give each uploader its own pid+random-suffix temp; uploaders write identical sha256-keyed content, so the rename race is then safe. * fix(ssh): don't leak session-scoped metadata across sibling sessions reuseExistingEnvironment copies persistent metadata from the previous ExecutorRunning row into the new launch request so executors can pick up worktree/container/sandbox IDs. For SSH that swept in session-scoped keys too — agentctl PID/port, session dir, local forward port — which made the second session's ResumeRemoteInstance reattach to the first session's agentctl process. Mark those keys as session-scoped and skip them in applyExecutorRunningMetadata; the same-session resume path (applyRunningRecordToResumeRequest) still copies them because it works off the session's own ExecutorRunning record. * test(ssh): cover ProxyJump parsers + sibling-session metadata filter Addresses the two coverage gaps Claude flagged on PR review round 3: - parseLiteralProxyJump / parseProxyJumpHostPort / parseBracketedHostPort / parsePortString are pure parsers that gate every ProxyJump dial, including IPv6 (`[2001:db8::1]:22`). Table-driven tests pin the happy paths and the bracket / port / range edge cases — silent regressions in bracket stripping would otherwise break every IPv6 ProxyJump session without a single test failing. - applyExecutorRunningMetadata is the function commit 044b76bb taught to skip session-scoped keys when reusing a sibling session's metadata. A direct test now asserts the SSH PID/port/session-dir/forward-port/url keys are filtered out while host/port/user/fingerprint/task-dir keys still propagate, and that an explicit request value isn't overwritten. * fix(ssh): rename agentctl_action=uploaded to needs_upload (test endpoint) The /api/v1/ssh/test endpoint only probes whether the agentctl sha256 sidecar already lives on the remote — it never uploads. Reporting agentctl_action="uploaded" in the not-cached branch said the opposite of what the step Output line said ("will upload on first launch") and mis-signaled real-upload status to any external tooling. Rename to "needs_upload" so the contract matches the behavior. * fix(ssh): add ssh_host_alias to trustedExecutorConfigKeys ssh_host_alias steers ResolveSSHTarget through ~/.ssh/config and ends up controlling the final Host/Port/User/IdentityFile. Leaving the key out of trustedExecutorConfigKeys let request-supplied metadata override the executor's configured alias and pivot the launch to a different host — the same class of attack the existing entries (ssh_host, ssh_port, …) guard against. Promote the literal to a constant and add it to the trusted set. * fix(ssh): emit 1/1 completion progress when the preparer step succeeds The final reportProgress was passing (completed=0, total=1) right after completeStepSuccess marked the step done, so UI subscribers saw the preparer end at 0% completion. Report 1/1 to match the actual state. * fix(web): preserve POST/Content-Type + read latest executors at write time - testSSHConnection: caller's options.init was spread AFTER the required method/headers/body, so a caller passing init.headers (or method/body) would silently clobber Content-Type and break server-side parsing. Spread options first; let the required fields win, and merge headers on top of caller-supplied ones. - useSaveExecutor: the fallback path in the catch arm operated on the executors slice captured at hook-creation time, so a WS update that landed mid-flight could be overwritten. Read the current snapshot via the store API at write time instead, matching what the create flow already does. * fix(ssh): drop "in v1" from user-facing copy These strings render in the New SSH Executor header, the Connection card description, and the ProxyJump field hint. "in v1" reads like internal planning leaking into the UI; the limitations themselves still hold so just describe them directly. * fix(ssh): auto-create a default profile on new SSH executor The /settings/executors index renders entries by flattening to executor profiles; an SSH executor created with no profiles was effectively invisible there even though the executor itself existed. The non-SSH create flow does this implicitly because it goes through the create-profile form; the SSH-specific flow skipped it. POST a default profile under the freshly-created executor (same name as the executor, no overrides) right after createExecutor, then push the combined record to the store so the index sees it on first paint. * feat(ssh): pre-flight the agent binary on the remote before launch Without this, a remote that lacks the agent's required binary (e.g. \`npx\` for any node-based ACP agent) surfaced the failure deep inside agentctl as an opaque \`exec: "npx": executable file not found in \$PATH\` — delivered AFTER a successful "Starting agent controller" step, which reads as "everything's fine right up until it isn't". The new step runs right after agentctl upload: derive the binary from \`agent.BuildCommand(Runtime=ssh).Args()[0]\`, \`command -v\` it on the remote, and on miss return a structured error that names the agent, points at the missing binary, and includes the install hint sourced from \`agent.InstallScript()\`. The message lands on the prepare-step output (so the UI shows it inline) and on the session's error_message (so the orchestrator surfaces it on the task). Coverage: unit test for the error formatter (pure function, no SSH needed) + e2e regression that mv's mock-agent aside on the sshd container and asserts the surfaced error mentions agent name, binary, \$PATH, and the install hint. * feat(ssh): surface host/workdir/agentctl in the task executor popover Parity with the Docker and Sprites paths: when the user hovers the Executor Settings button on a task, an SSH-backed environment now shows the connection target (\`user@host[:port]\`), the remote task dir, a compact \`pid → remote :port → local :port\` summary of the agentctl process, the trimmed host-key fingerprint with copy, and a paste-ready \`ssh ...\` command that mirrors how kandev itself connects. Sourced via a parallel \`ssh\` block on GET /api/v1/tasks/:id/environment/live (no schema migration needed) — the service joins the task's latest ExecutorRunning row's metadata at fetch time, the same metadata SSH executor writes in CreateInstance. The probe is metadata-only on purpose: the popover polls every 3-7s and a per-poll SSH dial would be both slow and a lot of TCP traffic; live agentctl/connection health stays under the per-executor GetRemoteStatus path. shouldShowExecutorEnvironmentControls now allowlists \`ssh\` so the button actually renders for SSH tasks (Docker/Sprites/Remote-Docker were already in the allowlist; SSH was the only runtime that mounted a TaskEnvironment without showing the popover). Coverage: unit tests pinning buildSSHLiveStatus's projection of ExecutorRunning.Metadata into the popover-shaped struct (strings, string-encoded ints, native ints, empty, malformed) + e2e regression that launches an SSH task, opens the popover, and asserts each row. * feat(ssh): probe enabled agents on the remote from settings Adds a "Remote agent readiness" panel on /settings/executors/ssh/:id so users can diagnose "which agent CLIs are actually installed on this host" before launching a task. The same diagnosis that previously required a launch attempt + reading the pre-flight error now sits one button-click away on the executor's settings page. Backend: - New endpoint \`POST /api/v1/ssh/executors/:id/probe-agents\` dials SSH to the configured host and walks \`registry.ListEnabled()\`. For each agent it derives the binary from \`BuildCommand(Runtime=ssh).Args()[0]\` and runs \`command -v <binary>\` via the new exported \`lifecycle.ProbeRemoteBinary\` helper. Returns rows with availability, the resolved path on hit, and the agent's \`InstallScript()\` as a copy-pasteable hint on miss. - \`ssh.RegisterRoutes\` now accepts the task service (\`GetExecutor\`) and the agent registry; \`cmd/kandev/helpers.go\` wires both in. Frontend: - New \`SSHAgentReadinessCard\` mounted above the sessions card. Manual refresh only (each probe dials a fresh SSH connection — too expensive to poll). Each row gets a status badge + a copy button for the install hint when the agent is missing. Coverage: - E2E suite: API contract (mock-agent baked into /usr/local/bin/ → row reports installed, with /usr/local/bin/mock-agent as resolved_at; move it aside → row flips to missing with the install hint flowing through end-to-end) + UI contract (click "Probe agents", assert the table renders the row). * feat(ssh): upload remote-credentials over SFTP at launch time The SSH executor used to accept the \`remote_credentials\` profile field for parity with Sprites/Docker but only logged a "not implemented" warning at launch — anyone configuring Claude/Codex/Gemini auth against an SSH host had no way to actually get the credentials onto the remote. Ports the Sprites credential pipeline to SSH: - \`uploadCredentials\` orchestrates the same four phases Sprites does: resolve auth-secrets into env vars, run env-credential setup scripts on the remote, detect a local \`gh auth token\` if \`gh_cli_token\` was selected, and SFTP the selected file-type credentials into the remote user's \$HOME. - \`sshFileUploader\` satisfies \`lifecycle.FileUploader\` via SFTP with an \`mkdir -p\`-equivalent walk for parent dirs and \`chmod\` for mode bits. - \`runAuthSetupScripts\` shells the script through \`runSSHCommand\` with the agent's env vars prepended inline (so the script can read e.g. \`CLAUDE_CODE_OAUTH_TOKEN\` to materialize \`~/.claude/.credentials.json\`). - \`resolveRemoteAuthHomeDir\` probes \`printf %s "\$HOME"\` rather than reusing the task workdir — credentials need to land under the user's true home (\`~/.claude/...\`) even when \`workdir_root\` overrides things. Wired into \`maybeUploadCredentials\` so a credential failure is logged as a warning but doesn't abort the launch (consistent with Sprites). Frontend: \`useRemoteExecutorFlags\` on the profile-edit page now includes \`ssh\` in the \`isRemote\` set so \`RemoteCredentialsCard\` renders for SSH profiles. Previously SSH profiles silently dropped any \`remote_credentials\` selection because the card never rendered. End-to-end credential upload still requires a non-mock agent enabled in e2e mode (mock-agent's \`RemoteAuth\` is intentionally empty). Coverage: unit tests pin the SFTP \`parentDir\` walk and the shell-quoted env-prefix builder. Existing Sprites tests already exercise the shared \`UploadCredentialFiles\` helper. * fix(ssh): wrap remote commands in a login shell so nvm/asdf PATH applies sshd's exec channel runs commands via a non-interactive non-login shell. That doesn't source ~/.profile / ~/.bash_profile / ~/.bashrc, so any binary added to PATH by nvm/asdf/brew/etc. is invisible to: - the launch-time pre-flight probe (`command -v <agent-binary>`) - the readiness panel's per-agent probe - and the nohup'd agentctl process itself End result: a user with `npx` installed through nvm sees 'X requires npx on the remote' and can't launch any node-based ACP agent. Fix: introduce `WrapLoginShell(shell, cmd)` that wraps cmd in `${shell} -lc '<cmd>'` (with POSIX-safe single-quote escaping) and default shell to bash when empty. Thread the configured shell through ProbeRemoteBinary, startRemoteAgentctl, preflightAgentBinary, runOneAuthSetupScript, and resolveRemoteAuthHomeDir. The shell is read from per-profile metadata via the new MetadataKeySSHShell ('ssh_shell') key — flows in via the existing executor-config merge. The probe handler also accepts an optional {shell} body so the UI can re-probe under whichever shell the user picked. Default keeps existing behavior for users who don't set a shell (we just become a login bash instead of bare sh -c). Unit tests pin the quote-escaping contract. * feat(ssh): move readiness card to profile page + add shell picker and install button Four UX changes that together make the SSH-profile setup flow feel right: 1. Save redirect after creating a new SSH executor now lands on the profile-edit page (`/settings/executors/{profileId}`) instead of the executor page. Profiles are where users actually configure how the host gets used. 2. `SSHAgentReadinessCard` relocates from the executor page to the profile-edit page (top, conditional on `executor.type === 'ssh'`). The host-level executor page keeps Connection + Sessions. 3. Card gains a shell selector that auto-detects available shells on the remote and persists into `profile.config.shell`. Changing the shell clears the cached probe so the user re-probes under the new shell — PATH depends on which init files get sourced. 4. Each missing-agent row gets an Install button that runs the agent's InstallScript via /install-agent (login-shell wrapped). Spinner replaces the button while it runs; on completion the card auto re-probes. No confirmation dialog — the button is the consent. E2E: probe-shells reports bash+sh on the alpine image (zsh absent), install endpoint runs mock-agent's deterministic InstallScript, unknown agent_id is a 404, and the profile-page UI round-trip works end-to-end. * refactor(ssh): drop install-agent endpoint and Install button Install scripts assume environments we don't control on the remote (package managers, sudo, network access); the failure modes weren't recoverable from the UI. Pulling the one-click install — copy-and-paste hint stays. Backend: delete POST /api/v1/ssh/executors/:id/install-agent and everything that fed it (httpInstallAgent / installAgent / runInstallScript / runSSHCommandShim / InstallAgentRequest|Response / findAgentByID / joinOutputs / capBytes). No other caller of those helpers. Frontend: drop the Install button + spinner + collapsible output panel from ReadinessRow. The 'Install hint' column reverts to copy-only — same hint string sourced from agent.InstallScript(), users run it on the remote themselves. Remove installSSHAgent / SSHInstallAgentRequest / SSHInstallAgentResponse from the api client + types + e2e helpers. Survives: probe + readiness panel, shell selector + /probe-shells endpoint, login-shell wrap on every SSH command (the actual fix for nvm/asdf users). * fix(ssh): persist shell choice under the same key the launch path reads Profile config saved the shell selection as 'shell' but the SSH executor at launch time reads MetadataKeySSHShell which is 'ssh_shell'. buildLaunchMetadata copies profile.config keys verbatim into req.Metadata, so the mismatch meant sshShellFromMetadata always returned empty and WrapLoginShell silently fell back to bash — defeating the whole point of letting users pick zsh/sh/etc. The probe path bypasses metadata (the UI passes shell directly in the request body) which is why the readiness panel reported codex as installed under the user's zsh while the launch then failed with 'codex requires npx on the remote' under bash. Align both sides on 'ssh_shell'. * fix(ssh): propagate profile ssh_shell into launch metadata The settings UI saved the shell selection on profile.Config["ssh_shell"], but applyProfile in executor_state.go only forwards an allow-listed set of profile.Config keys (ssh_workdir_root, remote_credentials, etc.) into launch metadata — ssh_shell wasn't on the list. The launch path's sshShellFromMetadata therefore always returned empty and WrapLoginShell silently fell back to bash, so a user who installed npx via zsh+nvm hit 'npx not found in $PATH' from the preflight while the readiness probe (which takes shell straight from the request body) still showed the agent as available. Mirror the existing ssh_workdir_root propagation for ssh_shell and pin both directions (present + absent) with a unit test on resolveExecutorConfig. * fix(orchestrator): make profile.Config authoritative for ssh_workdir_root + ssh_shell A task that supplied ssh_workdir_root or ssh_shell in its metadata won when the profile had no value set — `applyProfile` only overwrote metadata when profile.Config had a non-empty value, so the task-supplied value squeezed through the empty-profile case. Both keys steer remote behavior (workdir target, login shell that runs every command), so a task author should never be able to redirect them. Two things, bundled because they touch the same allow-list: 1. Replace the long if-chain in applyProfile with a small declarative set of tables (passthrough / rename / authoritative). Behavior for the existing keys (remote_credentials, git_user_*, image_tag, …) is unchanged. 2. Add a new authoritative tier — ssh_workdir_root + ssh_shell — whose profile value ALWAYS wins, including when empty. The reader-side helpers (SSHExecutor.workdirRoot, sshShellFromMetadata) already handle the empty fall-through to a default. Pin both directions with subtests: authoritative keys clobber any task value (empty profile included); ordinary passthrough keys keep their existing "only set if non-empty" semantics so task-supplied git_user_name still survives. * refactor(ssh): pass remote workspace explicitly to createRemoteAgentInstance startAndForwardAgentctl was briefly mutating the caller's *ExecutorCreateRequest (overwriting req.WorkspacePath with the remote task dir, then restoring it after the create-instance POST). That's exactly the boring-and-direct sin — a callee reading from a struct the caller is mutating around the call. Pass the remote workspace path as an argument so the dance disappears and req stays read-only inside this leg. * fix(ssh): surface SHA read errors instead of swallowing them as "not cached" SSHCheckAgentctlCached treated any error from reading the remote sha256 sidecar as "binary not on remote" by returning (false, nil). A transient SSH transport failure therefore masqueraded as "needs_upload" in the test endpoint's UI badge — the user retries the test, gets the same misleading hint, and doesn't see that the connection itself is flaky. Append `|| true` to the remote cat so a missing file is a successful empty-stdout read (the genuine "not cached" path), and surface a real error to the caller for everything else. * fix(ssh): handle int/int64/float64 metadata in session listing intFromMetadata only accepted string values, which is what the SSH executor writes via strconv.Itoa — but ExecutorRunning.Metadata round-trips through JSON, and there's no guarantee a numeric value isn't unmarshalled back as float64 somewhere along the way. Anything that wasn't a string silently became 0 in the sessions endpoint, making the SSHSessionsCard's "Remote agentctl port" / "Local fwd port" columns render as 0 for any row that took a non-string path. Match the smarter shape already used in service.mdInt (internal/task/service/service_task_environments.go) so both readers agree on the projection. * refactor(e2e): drop duplicate SSH HTTP shapes module api-client-ssh.ts was a literal copy of apps/web/lib/types/http-ssh.ts with `Body` suffixed onto every type — 75 lines of pass-through that buy nothing. The e2e ApiClient now imports the canonical shapes from lib/types/http-ssh directly, drops the re-export pile at the bottom of api-client.ts, and the duplicate module is deleted. No spec referenced the *Body names; the grep is clean. * fix(ssh): make Content-Type win over caller-supplied headers in ssh-api In `{ "Content-Type": "application/json", ...headers }` the spread runs last, so a caller passing `init.headers = { "Content-Type": "x" }` would override the JSON content type and break server-side parsing — the exact opposite of what the file's comment claimed. The outer `init` spread is ordered correctly already; this fixes the inner `headers` literal in the same direction (spread first, JSON literal last) across all three SSH client functions. Per CodeRabbit thread. * fix(ssh): distinguish 404 from server errors when resolving SSH executor resolveSSHTarget collapsed every GetExecutor error into 404 — a transient storage outage, timeout, or canceled context made it look like the executor was deleted. Introduce models.ErrExecutorNotFound, wrap it in the SQLite repo's sql.ErrNoRows case, and use errors.Is in the SSH handler so only "row doesn't exist" maps to 404; everything else stays a 500 with the underlying error attached. Per CodeRabbit thread. * fix(ssh): surface latestRunningForTask repo errors instead of swallowing them latestRunningForTask returned (nil) on any error from ListTaskSessions or GetExecutorRunningBySessionID. Transient storage failures rendered as "no SSH live status" on every popover poll, indistinguishable from the genuine "task has no running session yet" case. Return the error to the caller; GetSSHLiveStatus now propagates it, and the handler already logs + omits the ssh block on a non-nil error so polling stays graceful. A session without an ExecutorRunning row is the one expected miss — match on models.ErrExecutorRunningNotFound and skip quietly. Per CodeRabbit thread. * fix(ssh): reset readiness card state when executorId changes The mount effect only reset the sequence token, so switching executors left the previous one's rows / error / hasProbed visible until the user clicked Refresh — reads as "still loading" while actually showing stale data. Clear setRows / setError / setHasProbed / setLoading in the same effect so a fresh executor starts blank. Per CodeRabbit thread. * fix(ssh): copy the full fingerprint, not the truncated display value The popover renders fingerprints as a hash suffix (e.g. ...abcdef012345) because the full SHA256 is verbose, but the copy button reused the displayed string — users got an unusable truncated fingerprint instead of the real one. Add an optional copyValue on FieldRow that overrides the clipboard payload, and wire the fingerprint row to it. Per CodeRabbit thread. * fix(ssh): keep port forwarder alive on transient Accept errors SSHPortForwarder.serve returned permanently on any non-orderly-close Accept error — including transient ones like EMFILE (process FD table exhausted) or ECONNABORTED. A single hiccup orphaned the forwarder, the remote agentctl kept running, and the user's session went dark until the backend was restarted. Match net.ErrClosed explicitly for the orderly-close path; for anything else, log a warning and continue the loop so the forwarder survives recoverable per-accept faults. Per claude[bot] review thread. * fix(ssh): guard ResumeRemoteInstance against duplicate attach CreateInstance had an early-out for the case where a previous resume already populated r.sessions[InstanceID], but ResumeRemoteInstance itself didn't — a retry would dial a second SSH connection, start a second forwarder, and overwrite the map entry. The original client + forwarder leaked until the SSH idle timeout reaped them, and the agent stream briefly bounced between the two. Mirror the guard so the two entry points to r.sessions[InstanceID] agree. Per claude[bot] review thread. * fix(ssh): pipe auth-setup env vars via stdin to keep secrets out of cmdline runOneAuthSetupScript inlined env vars as `KEY=value KEY=value <shell> -lc '...'`. That string is what becomes argv of the outer bash invoked by sshd, so on the remote host any process the same UID can read sees the secrets in `ps aux` / `/proc/PID/cmdline` for the brief window the setup script runs. Single-tenant deployments are unaffected in practice but the leak is real on shared hosts. Add a runSSHCommandStdin variant that feeds session.Stdin; replace the inline env prefix with a stdin payload of `KEY='quoted'` lines sourced by the wrapped shell under `set -a; . /dev/stdin; set +a`. Env never appears on the remote shell's argv; it's only visible in /proc/PID/environ of the setup process itself, which is the minimum surface for "pass an env var to a remote process". Replace buildSSHEnvPrefix with buildSSHEnvInitScript; update the test. Per claude[bot] review thread (greptile P1 finding).	2026-05-25 10:04:40 +01:00
Carlos Florêncio	68aefc0e08	feat(web): system settings pages (status, database, backups, logs, updates, licenses, about) (#942)	2026-05-25 09:04:16 +01:00
Carlos Florêncio	adc13c6b5a	feat: copy gitignored files from repo into new worktrees (#946) (#950)	2026-05-24 20:12:26 +01:00
Carlos Florêncio	579081895b	feat(automation): make webhook trigger usable end-to-end (#1051)	2026-05-24 14:42:02 +01:00
José Almeida	3bc092bf20	feat(terminal): first-class user terminals — stable seq, rename, park/resume (#1009) ... * feat(terminal): persist user terminals with stable seq + park state Ordinary user shells now have a DB-backed `user_terminals` row keyed by the agentctl PTY id, carrying a per-task monotonic seq (gaps preserved on delete), custom_name override, and open/parked state. The terminal service owns the create/list/rename/park/resume/destroy surface and guards reject `bottom-panel` (cmd+J) + `script-*` ids so passthrough flows are untouched. Closing a tab now parks (PTY keeps running); destroy kills the PTY and removes the row. * feat(web): expose terminal seq badge, rename, and parked-terminals menu Wires the right-panel strip and SSR page state to the new task-keyed terminals endpoint and discriminated UserShell union, adds the `#N` badge for ordinary terminals, plumbs context-menu / double-click rename, and renders a "Parked" submenu so closed-but-running terminals can be resumed. Closing a managed tab now parks instead of destroying so the PTY (and its buffer) survives accidental closes. * test(terminal): e2e coverage for first-class persistent entities Covers the persistence guarantees the user explicitly called out: monotonic seqs, refresh-survives-rename-and-park, gap-preserving destroy, park+resume cycle, and bottom-panel/script guards. Exercises the new user_shell.{create,list,rename,park,resume,destroy} WS actions through the shared ApiClient.wsRequest helper. * fix(terminal): atomic seq allocation + propagate destroy errors - Repository.Create folds MAX(seq) read + INSERT into a single `INSERT … SELECT` statement so concurrent creates can no longer pick the same seq. Locked in with TestCreate_ConcurrentSeqAllocation (25 parallel creates, all unique). - wsUserShellStop now propagates the service-Destroy error so the frontend stops optimistically removing a row the backend failed to delete. - Service.Destroy / CleanupTask log PTY-stop failures at Warn (instead of silently swallowing) while keeping the proceed-on-failure semantics intentional — the DB row is the source of truth for "user expects this terminal gone". - IsUserShellAlive copies ProcessID under the read lock before calling r.Get(), removing the post-unlock pointer-deref race. - Get-not-found test asserts errors.Is(err, ErrNotFound) so it locks to the repository contract. * fix(web): close-tab waits for backend ack + className undefined guard - handleCloseTab defers `removeTerminal` into the `.then()` of the park/destroy promise. A failed backend call leaves the tab visible rather than vanishing it optimistically; the next `user_shell.list` poll reconciles state. - session-tabs guards `tab.className` with `?? ""` so an undefined value no longer produces "undefined group relative..." in the rendered class string. - user-shells.test simplification: `createSessionRuntimeSlice` only consumes `set`, so the test passes the slice creator straight to `immer()` instead of wrapping it in an adapter with unused args. * fix(terminal): task-scoped mutations + legacy-shell list + UI hardening Round-2 review feedback (cubic P1/P2, claude, coderabbit): Backend: - Rename/Park/Resume/Destroy now require a task_id and verify the terminal belongs to that task via a shared requireOwnership helper. Cross-task mutations return ErrTaskMismatch instead of silently succeeding by raw terminal id. - wsUserShellList no longer drops managed-shaped agentctl shells when the terminal service is disabled or task_id is missing — legacy passthrough callers see their existing shells again. `managedCovered` flag scopes the orphan filter to the DB-backed path. - service_test.go uses the shared-cache in-memory SQLite + MaxOpenConns(1) setup, matching repository_test.go and removing the flake-one-race-away warning. - New cross-task guard tests: TestRename_RejectsCrossTask, TestPark_RejectsCrossTask, TestDestroy_RejectsCrossTask, plus a TestRename_EmptyTaskIDSkipsOwnership for internal callers. Frontend: - updateUserShell patch type narrowed to Partial<Omit<UserShellInfo, "terminalId">> so the row key can't be silently mutated. - destroyUserShell now throws on a missing WS client instead of silently resolving — handleCloseTab's .then() no longer fires prematurely. - rename/park/resume/destroy API client + useTerminals hook plumb the active task id through every mutating call. E2E: - New "cross-task mutating ops are rejected" spec creates a terminal under task A and verifies task B can't rename/park/destroy it by raw id. - Existing specs updated to send task_id with their mutating calls. * fix(terminal): require task_id on all mutators + wire taskID into hooks Round-3 review feedback (cubic P1, claude blocker, coderabbit): Backend: - requireOwnership no longer skips the ownership check when taskID is empty. The previous carve-out was reachable from the WS layer (where task_id is user-controlled), so an attacker who guessed a terminal id could omit task_id and mutate any row. CleanupTask walks the repo directly and never touched the bypass. - TestRename_EmptyTaskIDRejected pins the new contract. Frontend (the real bug claude caught): - useUserShells now accepts a taskId parameter and forwards it on the user_shell.list WS call. Without it the backend's DB-backed ordinary- shell path was skipped and the Zustand store wiped the SSR-hydrated panel strip on the first WS fetch. - Response mapping switched to a discriminated union: id (new field) falls back to terminal_id (legacy), and kind/seq/state/pty_status/ display_name/custom_name flow into the store so the parked-terminals submenu actually populates. - useTerminals + useMobileTerminals read the active task id from the store and pass it through to useUserShells. - destroyUserShell now retries with user_shell.stop when the server returns an unknown-action error — keeps the rollout-window compatibility intact for older backends that only know the legacy action name. * fix(terminal): list parked, rollout-safe kind default, helper extraction Round-4 review feedback (claude + greptile P1): - useUserShells now sends include_parked: true so the "Parked terminals" submenu populates after a page reload. Previously the WS list returned only state=open rows; parked terminals were invisible until the user parked something in the same session. The main strip still hides parked entries via buildTerminalsFromShells. - useAddTerminal stops blindly defaulting kind to "ordinary" — that misclassified legacy passthrough payloads (terminal_id without seq) during a rollout where the frontend is newer than the backend. The managed-tab path then called parkUserShell on a server that didn't know the action. Now only tags as ordinary when kind is explicit or the row carries a seq. - handleCloseTab extracted into a standalone useCloseTab + helpers hoisted into use-terminals-build.ts / use-terminals-types.ts. Brings use-terminals.ts back under the 600-line file limit and the useTerminalActions wrapper inside the 100-line function limit. * fix(terminal): scope-keyed shell cache + null-task guard + tighter rollout default Round-5 review feedback (cubic P1, coderabbit x4): - useUserShells now keys its fetch cache on env+task (`${env}:${task}`), not just env. An earlier load without a task id (e.g. before the active task hydrated) no longer pins the store on a legacy-only shell list and blocks the task-scoped refetch. - useMobileTerminals delays auto-create until a real taskID is available. Previously a null taskID could bootstrap a legacy non-persistent shell, mark the env as auto-created, and starve the real task of its first-class terminal. Guard key is now env:task, and releaseAutoCreatedEnvironment clears every scope on that env. - useAddTerminal tightens the rollout check: a row is "ordinary" only when `seq !== undefined`. A bare `kind: "ordinary"` without seq from an older backend stays legacy so close → destroy on the first click. - useRemoveTerminal reads the current activeTab from a ref instead of closing over the value captured when handleCloseTab first ran. Async park/destroy resolves after a user tab-switch no longer clobber the newer selection with the stale fallback shift. Tests: - New "waits for taskID before auto-creating — null taskID is a no-op" case in use-mobile-terminals.test.ts confirms the null-task guard. - All existing mobile-terminal + slice + E2E tests pass. * fix(terminal): live activeTab lookup + selectable-tab guard Round-6 review feedback (cubic P2 x2): - getActiveTab now reads the active tab from the Zustand store via storeApi.getState() instead of a useRef/useEffect pair. Closes the post-render race where an async close handler could resolve between the new render's commit and the effect-driven ref sync. - computeTerminalTabValue requires activeTab to be selectable (present in `terminals` or === "commands") before honoring it. A stale id left over from a parked/destroyed terminal no longer pins the panel on a nonexistent tab and blocks the fallback shift to a real shell. * chore(terminal): inline savedTabFromStorage to drop file under line cap Round-7 review feedback (claude suggestion): the useMemo around the synchronous getSessionStorage call was zero-value memoisation that pushed use-terminals.ts three lines over the 600-line max-lines limit. Inlined; file now at 600 lines. * chore(terminal): drop savedTabExists local + comment to land under 600 lines Round-8 follow-up (claude): the previous commit's two-line comment block held the file at 603 lines (still over the 600-line cap). Inline savedTabExists at the only call site and remove the redundant comment — the round-7 PR thread already explains why the useMemo was removed. File now at 599 lines. * fix(terminal): plumb task_id through dockview + tolerate legacy destroys Manual-test feedback: clicking X on a dockview terminal panel surfaced "destroy terminal: terminal does not belong to the supplied task" because the dockview path was creating + destroying terminals without sending task_id at all. The new requireOwnership guard then correctly rejected the empty task_id against a non-empty term.TaskID. Frontend: - addTerminalPanel grows task_id + title parameters; stamps both into panel params at creation time so the destroy cleanup can pass them back to user_shell.destroy / .stop. - Every dockview-side createUserShell call site now passes the active task_id, so the backend creates a DB-backed ordinary terminal (with seq + displayName) instead of a legacy passthrough shell. - destroyUserShell + stopUserShell already accepted an optional task_id; dockview-layout-setup.onDidRemovePanel now reads the stamped task id from panel params and forwards it. Backend: - wsUserShellStop now requires both terminalSvc and a non-empty req.TaskID before routing through the managed service. An empty task_id falls through to the legacy passthrough StopUserShell so older clients (and dockview panels persisted before task_id was stamped) keep working. Known follow-ups (separate task): the #N badge, rename context menu, and parked-terminals dropdown still only show on the mobile/tablet right-panel strip. Desktop dockview shows the seq inside the panel title text but doesn't expose the badge/rename/parked-list UI yet. * feat(terminal): dockview tab badges + rename context menu + existing-terminals list Manual-test feedback round 2: - Custom dockview tab component (TerminalTab) renders the #N pill only when the active env has more than one ordinary terminal — mirrors the session-tab badge semantics. Right-click on any ordinary terminal tab now exposes Rename / Park / Destroy. - Dockview + menu picks up a new "Terminals" section listing every ordinary terminal for the active task (open and parked). Clicking a row focuses the existing dockview panel if one is mounted, otherwise re-opens it; parked rows are auto-resumed via user_shell.resume before the panel is added. The base "Terminal" action was renamed to "New Terminal" so the existing-terminals list is distinguishable in the menu. - Reopen menu uses a stable EMPTY_SHELLS sentinel for its store selector to avoid Zustand infinite re-renders when the env has no shells. E2E: - terminal-new-tab.spec uses getByRole("menuitem", { name: "New Terminal", exact: true }) to disambiguate from the new "Terminals" submenu label. - Full terminal suite still passes (26/26). * fix(terminal): tab title shows "Terminal" with seq as badge, populate store on session page Re-reading the user feedback: the title text was rendering as "Terminal 1" (backend's displayName), and the dockview "+" menu's Terminals section was empty because nothing on desktop was calling useUserShells to populate the store. - TerminalTab.pickDisplayName now returns the literal "Terminal" for ordinary terminals (custom names still override). The seq lives only in the sibling badge — same split as session-tab where the agent name is the title and the seq is a pill before it. Reading "Terminal 1" out of "[1] Terminal" instead of "[1] Terminal 1". - LeftHeaderActions (dockview "+") now calls useUserShells on mount. Without this the desktop layout never triggered the WS list fetch, so the Terminals submenu and the badge "count > 1" check both saw an empty store and silently disappeared. - TerminalReopenMenuItems also calls useUserShells defensively (cheap thanks to scope-keyed cache) so it works when mounted in isolation. * feat(terminal): "New X" rows live inside their section labels User feedback: move "New Agent" under the Agents section header and "New Terminal" under the Terminals section header so the dockview "+" menu reads top-to-bottom as Agents → New Agent → existing sessions → Terminals → New Terminal → existing terminals → other panels. - SessionReopenMenuItems accepts an optional onNewSession prop and renders the "New Agent" row as the first item under the "Agents" label. Render gate now keeps the section visible whenever the create handler is supplied, even with zero existing sessions. - TerminalReopenMenuItems gets a matching onNewTerminal prop with the same behaviour ("New Terminal" row under the "Terminals" label). - dockview-add-panel-items drops its standalone "New Agent" and "New Terminal" rows since both now live inside their sections. * feat(terminal): auto-migrate default panel to DB-backed ordinary terminal The legacy `terminal-default` dockview panel was hard-wired to a non-managed `shell-default` PTY so it never picked up an ordinary seq/customName/parked state — the new "Terminal N" badge UX could only show a badge once the user had explicitly created a second terminal. With useEnsureDefaultTerminalOrdinary the default panel is upgraded into a real `shell-<uuid>` row on session-page mount, so every visible tab is now a first-class ordinary terminal. Plus a UI-level e2e spec asserting the multi-terminal title + badge contract, and an expectation bump on the existing rename+park spec since visiting the session page now mints 1 extra ordinary terminal. * fix(terminal): park ordinary terminals on tab close so they survive refresh Dockview's tab X close button routed straight to stopUserShell (an alias for destroyUserShell), wiping the DB row on close — after a refresh the user had no way to resume a still-running PTY they had just tucked away. The X is now a "hide for now" affordance: ordinary terminals get parked (PTY survives, row stays in DB, reappears in the "+" → Terminals menu with a `parked` pill), while scripts / bottom-panel / legacy passthrough shells stay on the destroy path because they have no resume story. Permanent delete still lives on the right-click Destroy menu item and (in the next commit) on each reopen-menu row. * fix(terminal): preserve DB-backed terminal panel ids across layout restore The serializer's normalizePanel rewrote every user-created terminal panel id to `terminal-saved-N` and dropped environmentId/taskID from params, so after a reload that panel couldn't be matched back to its live PTY or its store record — the tab rendered with no badge and a stale fallback title. Treat `shell-<uuid>` panel ids the same way we already treat `terminal-default`: preserve id and params on restore. Legacy ephemeral `terminal-saved-*` ids still mint a fresh PTY on restore. Also force tabComponent=terminalTab and title="Terminal" for any restored terminal panel so layouts persisted before the badge UX land on the new presentation. * feat(terminal): destroy button on reopen-menu rows for permanent delete Destroy used to live only on the tab's right-click menu — useless once the tab was already closed. Each ordinary terminal row in the dockview "+" → Terminals submenu now ends with an × button that confirms-then calls destroyUserShell, killing the PTY and dropping the DB row so the terminal does not reappear after reload. Pairs with the previous close-to-park change: closing the tab parks (soft, resumable), the × button on the menu row destroys (hard, permanent). * fix(terminal): reopen-menu focuses existing tab, drops parked pill, says Terminate Three small fixes to the dockview "+" → Terminals submenu: 1. Clicking a row whose terminal is already mounted now FOCUSES the existing panel instead of duplicating it. The default-migrated panel keeps its registry id `terminal-default` even after the migration to a `shell-<uuid>` PTY, so a direct getPanel(uuid) miss would fall through to addTerminalPanel and create a second tab for the same PTY. Fall back to scanning `params.terminalId` so the lookup catches that case. 2. Drop the "parked" pill from the row — parking is now an internal detail (close = park) that the user doesn't need to read off the menu. Clicking the row brings the terminal back into view either way, so distinguishing it visually is noise. 3. Rename the row × tooltip + confirm copy from "Destroy" / "Permanently delete" to "Terminate" to match the new tab-context-menu label. Spec: add a test that asserts no duplicate tab when reopening an already-open terminal, and drop the parked-pill assertion from the existing close+reload test. * feat(terminal): empty-group watermark uses the rich + menu When a user splits a group (split-right / split-down) the new half is empty and dockview renders the watermark. Before this, the watermark showed a hard-coded Agent/Plan/Terminal/Browser row and clicking "Terminal" called createUserShell without a taskId — so it spawned a legacy passthrough shell that never appeared in the user-shell list, and clicking "Agent" only ever focused the singleton chat panel (invisible if the task had multiple sessions). The watermark now renders the same AddPanelMenuItems content the header "+" uses, so the user gets: - The Agents list (existing sessions, greyed when already open) - The Terminals list (existing terminals, greyed when already open) - The Browser/Plan/VS Code/Changes/Files/PR options …served behind a single "Add panel" dropdown trigger centered on the empty group. * feat(terminal): inline rename on the tab; drop Park, rename Destroy → Terminate The tab title is now editable in place — picking Rename from the right-click context menu swaps the title for an input. Enter commits, Escape / blur-with-no-change cancels, and the new name is pushed through renameUserShell + the user-shell store so the API and badge list stay in sync. Replaces the previous window.prompt which felt out of place in the dockview chrome. While here: - Drop the "Park (hide, keep PTY)" context-menu item. Tab close already parks ordinary terminals, so the explicit Park action was redundant and broke the "one obvious affordance per outcome" rule. - Rename "Destroy" → "Terminate" in the context menu. Matches the reopen-menu × tooltip and reads more like a system action than a destructive UI primitive. Spec adds an inline-rename test asserting the input appears, accepts typed text, and commits the new title to the tab. * fix(terminal): right-click Terminate closes the tab; drop displayName DOM warning Two unrelated fixes both landing in terminal-tab.tsx: - Terminate used to fire the WS destroy and update the store, but left the dockview panel mounted with a dead PTY underneath. Now it optimistically drops the shell row from the store, closes the panel via api.close(), then sends the destroy — same effect as the X close but routed to the hard-destroy path (the onDidRemovePanel cleanup sees no shell entry and skips its park branch). - TerminalTabBody typed `displayName` as a prop but never destructured it, so {...props} spread it into DockviewDefaultTab and on into a DOM div, triggering "React does not recognize the `displayName` prop on a DOM element". Drop it from the spread. * feat(terminal): polish + menu — badge-style indices, flush-left New rows, terminate closes panel Polish pass on the dockview "+" → Agents / Terminals submenus: - Replace the plain `#N` text with the same pill-style badge the tabs use (small bg, rounded, 11px). Agents and terminals both pick this up — so the menu row reads "[N] label" matching the tab style. - Drop the empty index-column placeholder span on the "New X" rows so the icon + label sit flush-left under the section header instead of awkwardly indented. - Strip the backend "Terminal {seq}" suffix from row labels — the badge already carries the number, so showing "Terminal 1" next to the "1" pill duplicated it. Custom-renamed terminals still show their name. - The row × button now also closes the dockview panel if the terminal is currently open, mirroring the right-click → Terminate flow. Spec: switch the row-by-seq lookups from `hasText: "#N"` (now stale since the `#` prefix is gone) to a `has:` filter against the new `reopen-terminal-seq-N` badge testid, and add a regression test for right-click → Terminate closing the tab and removing the row in one gesture. * fix: address terminal review feedback * fix: resolve terminal review suggestions * fix: catch terminal close stop failures * fix: harden terminal terminate failures * fix: use pinned pnpm docker arg * fix: satisfy backend lint after main merge * fix: stabilize e2e after layout merge	2026-05-24 12:59:30 +01:00
Carlos Florêncio	372779ad32	feat(preview): inspect mode with pin and area annotations (#917)	2026-05-24 11:21:50 +01:00
João Salavisa	68aeefa296	feat(gitlab): add GitLab integration with MR / discussions support (#861) ... * feat(gitlab): add GitLab integration with MR / discussions support Adds a GitLab integration parallel to the GitHub one: PAT and glab CLI auth, self-managed host configuration, MR feedback (approvals + discussions + pipelines), and discussion reply / resolve so agents can address review comments. The pr skill detects the host from git remote and creates a real GitLab merge request via glab or REST. Closes #820 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * refactor(gitlab): address review feedback and tighten lint surface - Add service_test.go covering ConfigureToken / ClearToken / ConfigureHost. - Drop speculative MRWatch / TaskMR / ReviewWatch / IssueWatch / preset scaffolding that had no migrations or handlers behind it. - Consolidate /approvals into one round-trip via fetchApprovals. - Use http.DefaultClient in CheckHost (context already carries the deadline). - Rename misleading id → configured in ConfigureToken. - Introduce mrStateOpen constant so the lint goconst rule passes. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(gitlab): address PR review feedback (CodeQL SSRF, races, atomicity) - connectivity: parse host with url.Parse, validate http/https scheme, build probe URL via &url.URL{} so user-controlled host can't smuggle into the request — clears the CodeQL go/request-forgery alert. - pat_client: guard cached username with sync.RWMutex; IsAuthenticated now propagates non-401/403 errors instead of masking transport failures; GetMRStatus skips pipelines query when HeadSHA / HeadBranch are both empty; parseNextLink drops cross-host links instead of returning bare absolute URLs that get() would double-prefix. - service: findTokenSecret returns (bool, string, error) and all callers propagate the secrets.List error so a backend outage isn't mistaken for "token absent"; ConfigureHost persists to hostStore before mutating in-memory host + client + authMethod under one lock. - repoclone: SSH clone URL falls back to ssh:// form when the host has a port (scp-style git@host:path can't carry one). - gitlab/client_helpers: namespace fallback uses LastIndex("/") so subgroup paths (acme/team/squad/repo) are preserved. - pr skill / plan doc: drop hardcoded --target-branch main, derive host from git remote instead of $CI_SERVER_URL, build curl payload with jq -n; fix /pipelines/:id/jobs → :pipeline_id typo. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(gitlab): preserve host base path in CheckHost; broaden validation; test - connectivity: extract validateHost so the parse / scheme / hostname / userinfo / opaque-URL checks each have a single home. Preserve the configured base path (TrimRight slash) so a host like https://gitlab.acme.corp/gitlab probes /gitlab/api/v4/version instead of dropping the prefix. - connectivity_test: cover validateHost (default, https, http, trailing slash, subpath, missing scheme, ftp, empty host, userinfo) and CheckHost end-to-end (version endpoint, base-path preservation, scheme rejection, unreachable host). - pr skill: drop the broken `glab repo view --json defaultBranch` branch — glab doesn't accept --json, so the lookup silently fell back to "main" every time. Fetch default_branch via the GitLab REST API directly using the PAT we already have. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(gitlab): override filter defaults, refresh auth uncached, mock pipelines - appendFilter: Del before re-Add so user-supplied filter keys actually override caller defaults (e.g. state=closed swaps the seeded state=opened instead of appending a second value GitLab silently ignored). - IsAuthenticated: probe /user directly instead of routing through the username cache; a token revoked upstream now surfaces as not-connected immediately. Cache is opportunistically refreshed on success. - MockClient.GetMRFeedback: include pipeline state in HasIssues, matching the real PATClient behavior so test flows can't miss a broken MR. - pr skill: document `glab mr note create --reply <id>` for replies (bare `glab mr note` opens a new thread); fix host-extraction block to handle ssh://host:2222/team/repo.git without leaking the port into PROJECT. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(gitlab): guard mock pipelines on empty MR head; preserve HTTPS port in pr skill - MockClient.GetMRFeedback now mirrors PATClient: skip the pipelines fetch when HeadSHA and HeadBranch are both empty. The mock'\''s ListPipelines ignores its branch argument and returns every pipeline seeded under the project, so without this guard a brand-new MR would inherit a sibling MR'\''s failing pipeline and flip HasIssues to true. Tests cover both the empty-head and head-present cases. - pr skill: derive HOST scheme-aware so https://host:8443 keeps the port (HTTPS API endpoint), ssh://host:2222 strips it (different transport), and scp-style git@host stays portless. Avoids silently re-routing self-managed API calls to the default 443. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(gitlab): export SeedPipelines; mock GetMRStatus parity; drain bodies; test cache hit - MockClient: add exported SeedPipelines(project, iid, []) alongside the other Seed* methods; mirror PATClient.GetMRStatus by populating PipelineState / jobs counts via summarizePipelines, guarded on a non-empty head ref. Brings mock parity with the real client so any future test seeding pipelines sees the same MRStatus shape. - PATClient HTTP plumbing: drain resp.Body via io.Copy(io.Discard, ...) when result == nil in both getWithTotal and doWrite, so HTTP/1.1 can reuse the connection instead of opening a new TCP socket per call. - TestPATClient_GetAuthenticatedUser: assert calls == 1 after the second GetAuthenticatedUser hit so the cache contract is actually verified (a non-caching implementation would have passed the prior version). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(gitlab): surface connection errors, align MR pipeline guards, fix mock seed key - service.GetStatus now captures the IsAuthenticated error into a new Status.ConnectionError field (empty on healthy / 401-403, populated on network / 5xx / parse failures). Frontend GitLabStatus + settings page render a distinct "Unreachable" badge + alert so users don't delete a still-valid token during a transient GitLab outage. - PATClient.GetMRFeedback now guards on HeadSHA || HeadBranch, matching GetMRStatus and MockClient.GetMRFeedback (which had been updated in an earlier round). The three call sites were inconsistent — a mock test with HeadBranch-but-no-SHA would pass while the real client silently dropped pipelines. - MockClient.pipelines is now keyed by project alone (was map[mockMRKey][]Pipeline). SeedPipelines takes (project, []) so successive seeds for the same project deterministically overwrite, instead of leaving multiple entries that ListPipelines would resolve in Go's unspecified map-iteration order. - Tests: TestService_GetStatus_{PopulatesConnectionErrorOn5xx, ClearsConnectionErrorOn401} cover the new error surface; TestMockClient_SeedPipelines_OverwritesByProject locks the key change. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(gitlab): tighten validateHost; init Status scopes; close token-host race - validateHost: drop the parsed.Opaque != "" branch — Go only sets Opaque for opaque URIs, which have an empty Host the prior check already rejects. Narrow the userinfo error to mention the actual user:password@host shape so the message matches what users see. - service.GetStatus: initialize RequiredScopes: []string{} on the nil-client defensive branch so the JSON payload keeps the always-an-array contract declared on the TypeScript side. The branch is effectively unreachable (every Provide path returns at least a NoopClient) but the empty-slice fallback costs nothing. - service.ConfigureToken: build the installed client inside the write lock using the up-to-date s.host instead of the pre-probe snapshot. A concurrent ConfigureHost between RUnlock and Lock used to leave s.client pointing at the prior host while s.host advertised the new one — every subsequent API call would silently target the wrong instance until the next reconfigure. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(gitlab): drop MR-commit stats fields; rename AuthorName; log post-lock host - MRCommitInfo: drop Additions / Deletions / FilesChanged. GitLab's /merge_requests/:iid/commits endpoint doesn't return a stats object, so those fields were always 0 — better to omit them than feed callers silently-wrong numbers. Rename AuthorUsername to AuthorName since the API returns a display name, not a login handle. Doc-comment records the per-commit endpoint to use if a future revision wants real stats. - ListMRCommits: drop the Stats anonymous struct from the JSON decode target now that the destination fields are gone. - service.ConfigureToken: capture installedHost inside the write lock and log that value. The previous log used the pre-validation host snapshot, so a concurrent ConfigureHost between snapshot and lock would leave the log entry referring to a stale value while the client itself was correctly built against the new host. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(gitlab): encode subgroup paths; sentinel-route errors; mock approval parity - pat_client.SearchGroupProjects now encodes the group path through a new groupRef helper that %2F-substitutes slashes (mirrors projectRef). Subgroup paths like "acme/team" used to land at /groups/acme/team/projects, which GitLab routed to the parent group only and returned 404 for. Subgroups now work end-to-end. - service.ErrInvalidToken sentinel + controller errors.Is routing: token validation failures now wrap a package-level sentinel and the HTTP layer switches on it via errors.Is, replacing the fragile strings.Contains prefix check that would silently fall through to 500 if the message ever changed. Coverage: TestService_ConfigureToken_WrapsErrInvalidToken. - MockClient gains seedable approvals: SeedApprovals(project, iid, list, required) backs a dedicated approvals + requiredApprovals map. ListMRApprovals, GetMRFeedback, and GetMRStatus all consume them so ApprovalState / ApprovalCount / RequiredApprovals match what the real PATClient.GetMRStatus computes. Coverage: TestMockClient_GetMRStatus_UsesSeededApprovals. - ClearToken: same host-snapshot race ConfigureToken was fixed for last round — NewClient now runs under the write lock against s.host rather than a pre-acquired snapshot. - CheckHost: drain resp.Body before close so http.DefaultClient's keep-alive pool can reuse the connection for the next probe. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(gitlab): full-path projectRef round-trip; unlock during glab probe - splitFullReference now returns (namespace, fullPath) where fullPath is the namespace-qualified project path ("group/sub/project") instead of the last segment alone. Callers can pass MR.ProjectPath straight to projectRef for round-trip API calls (GetMR, GetMRFeedback, etc.) — matches GitLab's own path_with_namespace convention. Existing test cases updated. - ClearToken: build the fallback client OUTSIDE the write lock so NewClient's glab subprocess (bounded by glabAuthTimeout = 10s) doesn't freeze every concurrent GetStatus / GetMRFeedback / Client() RLock reader for the duration. Brief WLock now only wraps the field swap. Tradeoff with the concurrent-ConfigureHost race is documented in-code: narrow stale-host window vs. 10s of blocked readers, and the next reconfigure resolves it. - New regression test TestPATClient_SearchGroupProjects_EncodesSubgroupSlash asserts the request URL is /groups/acme%2Fteam/projects so a future refactor that swapped groupRef back to a bare url.PathEscape would fail visibly instead of silently 404ing subgroup lookups. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(gitlab): equality-guard ClearToken's client swap against ConfigureHost race ClearToken builds the fallback client outside the write lock to avoid blocking RLock readers for up to 10s while glab auth-probes. The swap-only critical section now compares s.host against the pre-probe snapshot before assigning — if a concurrent ConfigureHost moved the host underneath us, we leave its (newer, correctly-targeted) client alone instead of overwriting with our stale-host build. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(web): add GitLab to the settings integrations sidebar The /settings/integrations/gitlab page existed and the index card listed GitLab alongside the other integrations, but the settings sidebar nav (IntegrationsNavGroup) only listed GitHub / Jira / Linear / Slack. The page was unreachable through the standard sidebar. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(gitlab): task-MR topbar surface + DB-backed task↔MR store Phase 1 of the GitLab UI build-out: brings the MR side of the task topbar to parity with the existing GitHub PR button. Backend - gitlab_task_mrs table + Store wiring (UpsertTaskMR, ListTaskMRsByTask, ListTaskMRsByWorkspaceID, DeleteTaskMR), uniqued on (task_id, repository_id, project_path, mr_iid) for multi-repo. - service.SyncTaskMR folds a live GetMRStatus probe into an upsert; ListTaskMRsByTask / ListTaskMRsByWorkspace expose the rows. - Three HTTP endpoints: GET /workspaces/:id/task-mrs, GET /tasks/:taskID/mrs, POST /tasks/:taskID/mrs/sync. - initGitLabService now takes a *db.Pool and constructs gitlab.Store. Failures non-fatal: integration keeps working without the table. Frontend - TaskMR type + listWorkspaceTaskMRs / listTaskMRs / syncTaskMR API. - lib/state/slices/gitlab slice (taskMRs.byTaskId) wired through default-state, store.ts AppState, and slices/index exports. - hooks/domains/gitlab/use-task-mr.ts: useWorkspaceMRs (fetch-on- workspace-switch) and useTaskMRs (per-task selector). - components/gitlab/mr-topbar-button.tsx — single/multi MR variants, status icons mirroring pr-task-icon priority order. - task-top-bar.tsx renders PRTopbarButton and MRTopbarButton side-by- side; each returns null when empty, so the union handles GitHub-only, GitLab-only, and multi-repo tasks without an explicit switch. - kanban-board.tsx hydrates useWorkspaceMRs alongside useWorkspacePRs. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(gitlab): add /gitlab page for browsing user MRs and issues Adds the GitLab counterpart to /github so users can browse their own merge requests and issues from inside kandev, parallel to the existing GitHub "My GitHub" page. Backend - /api/v1/gitlab/user/mrs and /user/issues — paginated wrappers around the existing SearchMRsPaged / ListIssuesPaged client methods. paginationFromQuery clamps page/per_page the same way as the client. Frontend - /gitlab SSR page + client with MR/Issue tabs, scope filters (assigned / created / review-requested), and a free-text search box that falls back to raw GitLab query-string for power users. - searchUserMRs / searchUserIssues API helpers + MR / Issue / *SearchPage types in lib/types/gitlab. - useGitLabAvailable hook (probes /status + refreshes on window focus) feeds the integrations menu so the GitLab link only shows when a token is configured or auth is green. Tests - task-top-bar.test mocks the new MRTopbarButton so renders no longer pick up useAppStore without a StateProvider. - integrations-menu.test wires the new useGitLabAvailable mock and gitlabReady prop into mockAvailability / getAvailableIntegrationLinks fixtures. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(gitlab): stable empty array in useTaskMRs to avoid infinite re-render useTaskMRs returned `state.taskMRs.byTaskId[taskId] ?? []` — that fresh literal made the zustand selector produce a new reference on every render when the task had no MRs, triggering an infinite re-render loop in MRTopbarButton that crashed the task page with a Next.js client-side exception. The page never mounted session-chat, so Docker E2E tests that drive `/t/:id` (slow-bootstrap progress, external-stop resume, environment reset) all timed out waiting for the chat panel. Mirror the GitHub side's `EMPTY_PRS` pattern: hoist a module-level `EMPTY_MRS = []` and return it for the empty case. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(gitlab): address PR review — cache header, in-flight cancel, tests - Top-level `cache: "no-store"` in 5 sites (use-task-mr.ts, gitlab-api.ts, gitlab-page-client.tsx). The earlier `init: { cache: "no-store" }` placement was silently overwritten by fetchJson with undefined, so probes hit the browser cache instead. - useWorkspaceMRs now invalidates in-flight responses and calls resetTaskMRs when the workspace becomes null, so the previous workspace's MRs don't linger after sign-out / workspace switch. - Drop unpopulated UnresolvedThreads/DiscussionCount from TaskMR (model, schema, TS type). SyncTaskMR's source MRStatus never populated them and no surface reads them; the dropped columns are skipped via an explicit projection in store.go so existing dev DBs keep binding. - Extract MRList/IssueList inline fetches in /gitlab into useGitLabUserMRs / useGitLabUserIssues — matches CLAUDE.md "never fetch in components". - Tests for store (UpsertTaskMR, composite key, workspace-JOIN isolation, ordering, Delete), service (SyncTaskMR mock round-trip + field mapping + store-unset error, ListTaskMRsByWorkspace JOIN isolation, ListTaskMRsByTask), pat_client (ListIssuesPaged X-Total), gitlab-api (5 new fns), gitlab-slice (setTaskMR composite key), and the use-task-mr / use-user-search hooks. - pr SKILL.md: skip note for steps 5–6 on GitLab remotes. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(gitlab): only wrap 401/403 probe errors as ErrInvalidToken Network failures, 5xx, and DNS errors during `ConfigureToken` previously surfaced to the user as HTTP 400 "invalid token: …" — during a GitLab outage a user with a valid token might delete it assuming it was rejected. Now only `*APIError` with 401/403 is mapped to `ErrInvalidToken`; other errors propagate unwrapped so the controller routes them to "GitLab unreachable" instead. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Kandev Agent <agent@kandev.dev> Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-23 23:17:16 +01:00
Carlos Florêncio	2c15cf83a9	feat(web): add tree view for changes panel (#1026)	2026-05-23 21:19:30 +01:00
irium	a5a1b72c87	feat(jira): support Jira Server / Data Center (#977)	2026-05-23 10:55:43 +01:00
João Salavisa	8df1bda87b	fix(web): show tasks from all workflows in the mobile task-switcher sheet (#1025) ... * fix(web): show tasks from all workflows in the mobile task-switcher sheet The mobile sheet read tasks via useTasks(workflowId), which gated on kanban.workflowId === workflowId and returned [] otherwise. On a fresh /t/[id] load the gate often failed (or the snapshot fetch was still in flight / silently failing) and the sheet rendered "No tasks yet." Align mobile with desktop: read from kanbanMulti.snapshots via a new shared useWorkspaceSidebarTasks hook that does the per-workspace aggregation (incl. the active-kanban fallback), and pass workflows + stepsByWorkflowId through so the existing TaskSwitcher grouping kicks in. The desktop sidebar now delegates to the same hook. * refactor(web): address review comments on PR #1025 - Extract findTaskInSnapshots to task-select-helpers.ts (shared between desktop sidebar and mobile sheet). Mobile passes kanban.tasks as the optional fallback so it still locates tasks that arrived via WS before the snapshot fetch landed. - Build workflowNameById from the already-scoped `workflows` array instead of the raw, unscoped kanbanMulti.snapshots. Stops the memo from re-running on snapshot updates from other workspaces and removes the risk of a stale workflow name leaking across a workspace switch. Same fix in both the desktop sidebar and the mobile sheet. - Collapse the duplicated workflow filter in useWorkspaceSidebarTasks into a single `filteredWorkflows` memo. * fix(web): empty scope when workspaceId is unresolved in mobile/desktop sidebar hook When `useWorkspaceSidebarTasks` was called with a null workspaceId (the initial SSR / pre-hydration state on /t/[id]) it would widen to every workflow in the store, briefly leaking snapshots from previously-active workspaces into the sidebar. Return an empty scope until the workspace resolves instead, matching the "no cross-workspace bleed" intent of the original useScopedAggregation comment. Adds a regression test, plus splits the test file's describe block so the linter's 100-lines-per-function cap doesn't trip. * refactor(web): consolidate findTaskInSnapshots and drop unused useSheetData.steps - Reuse the canonical helper in `lib/kanban/find-task.ts` instead of duplicating it in `task-select-helpers.ts`. Extend the canonical one with an optional `fallbackTasks` parameter so the mobile sheet can still locate tasks via `state.kanban.tasks` when the snapshot fetch hasn't landed yet — desktop call sites continue to omit the fallback. - `useSheetData` was returning the raw active-kanban `steps` slice next to the already-mapped `dialogSteps`. The sheet component only consumes `dialogSteps`; drop the unused field. * test(web): add unit tests for findTaskInSnapshots fallback path * fix(web): pass active-kanban fallback into desktop sidebar task lookups useWorkspaceSidebarTasks can render tasks from the active kanban slice before kanbanMulti.snapshots catches up, but the desktop sidebar's archive/delete/select handlers were searching snapshots only — leaving fallback-only tasks unresolved during the snapshot race window. Pass state.kanban.tasks into findTaskInSnapshots in all three handlers so the dialogs find the right title and selectTaskWithLayout sees the task. Also trims the multi-line comment in lib/kanban/find-task.ts to a single line per CLAUDE.md style guidance. --------- Co-authored-by: Kandev Agent <agent@kandev.dev>	2026-05-22 23:24:35 +01:00
João Salavisa	fb56af4e4e	fix(web): aggregate changes count across all repos to stop flicker (#986) ... Addresses #980 — multi-repo workspaces showed a flickering / stale Changes count because the source hook returned only the last-arriving repo's status. `useSessionChangesCount` now sums file counts across the per-repo `byEnvironmentRepo` map plus commits and is wired into the three call sites; single-repo behaviour is unchanged.	2026-05-22 23:08:46 +01:00
Carlos Florêncio	db3b6dfb15	feat(tasks): don't cascade archive/delete to subtasks by default (#1020)	2026-05-22 22:55:04 +01:00
João Salavisa	1b58a64fd8	feat(automations): /settings/automations with run-mode + per-automation config (#1016) ... * feat: add automation system with triggers, backend-driven metadata, and PR association Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(automations): execution_mode + flat /settings/automations Layered on top of #406's automation subsystem: - Add execution_mode to Automation (task | run, default task). Run-mode firings create an ephemeral kanban-hidden task tagged with origin=automation_run. The session pipeline still runs against it, but users surface them through the AutomationRun history instead of the kanban. Pragmatic shim while AutomationRun-as-true-session-owner is deferred to a follow-up. - Thread IsEphemeral + Origin through ReviewTaskRequest + reviewTaskCreatorAdapter so the orchestrator can create the hidden task in one call. - Run-mode always auto-starts (the user never sees the task to drag). - Flat /settings/automations route replaces the per-workspace sidebar entry. Picks the only workspace, shows a picker for many, or shows a CTA for zero workspaces. - Editor exposes execution mode + table shows it as a badge column. Spec at docs/specs/office/automations-settings.md documents the design, deferred items, and scenarios. * feat(automations): per-automation repository picker Adds a repository_id field on Automation so users can pin scheduled and webhook automations to a specific workspace repository instead of always falling through to "first repo". github_pr triggers ignore the field and keep using the PR's own repo — the editor disables the picker with a hint when a PR trigger is selected. Backend: - repository_id column folded into the canonical CREATE TABLE (no migration needed — PR #406 introduces the table). - RepositoryID threaded through model, DTOs, store INSERT/UPDATE, and service.CreateAutomation. - resolveAutomationRepository prefers the explicit ID, falls back to workspace-first on empty. Frontend: - repository_id on the Automation TS type + Create/Update payloads. - Repository SelectField in ConfigSection backed by useRepositories; "Auto" sentinel represents the empty/fallback choice. - Disabled with help-text for github_pr triggers. * feat(automations): repo picker shows discovered repos too Matches the task-creation dialog's UX: the editor's repository picker now lists registered workspace repos AND filesystem-discovered repos under the workspace's roots. Picking a discovered repo registers it with the workspace at save time (via createRepositoryAction), captures the new id, and writes it onto the automation. After the first save the picker selection is promoted from "discovered" to "registered" so re-saving doesn't re-register. Form state holds a RepositorySelection union (auto | registered | discovered) rather than a plain id string so the picker can carry the metadata needed to register. github_pr triggers still disable the picker — PR events always override any configured repo with the PR's own. * fix(automations): add idempotent ALTERs for in-branch columns The canonical CREATE TABLE covers fresh installs, but `CREATE TABLE IF NOT EXISTS` is a no-op for DBs already initialised from an earlier commit on this branch (PR #406's original schema). Without these ALTERs, dev DBs created before execution_mode + repository_id existed on the row hit "no such column" errors. Three idempotent ALTERs: task_title_template, execution_mode, repository_id. SQLite returns a duplicate-column error when the column already exists; we swallow it. * fix(automations): use generateUUID in non-secure contexts crypto.randomUUID is only defined in secure contexts (HTTPS or localhost). PR #406's editor used it directly, which throws "crypto. randomUUID is not a function" when the app is reached via a plain hostname like nova:58204. Switch to lib/utils.generateUUID, which falls back to a Math.random-based implementation when crypto isn't available. * fix(automations): polish run-mode lifecycle, validation, and editor UX Run-mode automations were partly broken end-to-end: - workflow_id was sent for ephemeral tasks (rejected by task service) and was required by the editor + automation service, so "Create Automation" was always disabled and silently failed - a permission_request hanging the agent left the run pinned at task_created forever; nothing reaped the ephemeral worktree - trigger config inputs (cron, branches, authors) did not re-sync with the loaded automation on page reload - runs row never linked back to the underlying task for task-mode automations, and the table header highlighted on hover Backend - skip workflow fields in CreateReviewTask / StartTask for run-mode - relax automation.Service.CreateAutomation: workflow only required for task-mode - auto-reject permission prompts on ephemeral automation tasks and mark the AutomationRun failed with the requested action - on agent completion / failure for ephemeral automation tasks, flip the run to succeeded/failed and remove the worktree + branch immediately (new RunStatusSucceeded + MarkRunSucceededByTaskID) - wire worktree.Manager into the orchestrator service Frontend - show Execution Mode first; hide Workflow / Workflow Step in run-mode - canSave no longer requires workflow in run-mode - surface save errors via toast instead of silent failure - sync trigger-config local input state with loaded prop value - runs table: clickable row → /tasks/<id> for task-mode runs, non-clickable in run-mode; suppress header hover * fix(automations): address PR review feedback Backend - automation/scheduler.go: parseCronFields returns an error for unsupported expressions instead of silently defaulting to hourly - automation/webhook.go: constant-time secret compare, header-only (no more ?secret= query param), reject with 409 when no enabled webhook trigger exists - automation/service.go: enforce max_concurrent_runs in FireTrigger via maybeSkipForConcurrencyCap (records a skipped run when capped) - cmd/kandev/e2e_reset.go: surface automation delete errors as 500 instead of swallowing them - orchestrator/event_handlers_git.go: auto-reject permission with cancelled=true so the message status is "rejected" and the session isn't flipped back to running - orchestrator/event_handlers_agent.go: finalizeAutomationRunIfEphemeral now runs at the top of handleAgentFailed, before the resume/recoverable early returns, so session-backed run-mode failures get cleaned up Frontend - state/slices/automations/automations-slice.ts: declare _get/_api so the call site's arity matches and CodeQL stops flagging ignored trailing arguments - automations/schedule-selector.tsx: clearing the input now propagates ""; cron is trimmed before validation+save - automations/triggers-section.tsx: switching to webhook mode deletes the existing scheduled/condition triggers so they don't keep firing hidden in the background - automations/trigger-configs/github-ci-config.tsx: useEffect re-sync for checkNames, matching the other trigger configs - hooks/domains/settings/use-automations.ts: per-workspace fetch via loadedWorkspaceRef + render-safe loadedWorkspaceId state; inFlightWorkspaceRef discards stale responses after workspace switch --------- Co-authored-by: Carlos Florêncio <carlosmflorencio@gmail.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Kandev Agent <agent@kandev.dev>	2026-05-22 22:01:59 +01:00
Carlos Florêncio	e85c340797	fix(web): honor window.__KANDEV_DEBUG so make start-debug logs surface (#991)	2026-05-22 13:46:11 +01:00
João Salavisa	0f1081d423	feat(share): add public share links via GitHub Gists (#995) ... * feat(share): add public share links via GitHub Gists Adds a Share button to the chat panel header that publishes the current session as a secret GitHub Gist on the user's account. The share link routes through gistpreview.github.io to render share.html as a styled kandev-themed page; snapshot.json + README.md ride along for machine-readable + fallback views. Snapshots run a redaction pass (absolute paths, common credential shapes, .env contents, shell env vars) and strip <kandev-system> prompt blocks via the shared sysprompt helper. Message filtering whitelists user prose + tool_* types so internal noise never leaks into shares. Spec at docs/specs/public-share-links/spec.md. * fix(share): coerce pendingClarification to bool for ClarificationSection A late refactor extracted ClarificationSection with `pendingClarification: boolean` on its props, but the call site passes the actual Message|null value. CI's tsc build catches the mismatch; runtime was unaffected because the section only uses the value in a truthiness check. Coerce with Boolean() at the call site to keep the prop's intent narrow. * fix(share): address PR #995 review feedback Bugs (flagged by Greptile, Cubic, Claude): - abs-path redaction split on `root + "/"` so sibling dirs like /home/user/proj2 don't get corrupted when workspaceRoot is /home/user/proj; regression test added. - GHClient.DeleteGist now wraps "HTTP 404" stderr as *GitHubAPIError so share.IsAlreadyGone matches consistently with the PAT client; this restores the "gist already revoked upstream" soft-success path for CLI-authenticated users. - SnapshotSizeBytes is now measured from the same MarshalIndent payload the gist backend uploads, so the size shown in the UI matches the actual gist bytes (was ~20-40% underreported). Polish (flagged by CodeRabbit, Cubic): - Tool name + tool output now HTML-escaped; tool call args and output render via <pre><code> instead of triple-backtick fences so payloads containing ``` can't break out of the code block. - share-list.tsx: clear `busy` via finally and break error layout out of the justify-between row. - use-shares.ts: convert UseSharesResult to interface (repo TS rules); reset error+isLoading when ids are missing. - use-shares.test.tsx: wait on the actual async outcome (shares populated, listShares called) instead of isLoading flipping false. - provider.go: replace `repo.Close` cleanup with an explicit noop closure so the comment ("Cleanup is a no-op") and the impl match. - spec.md: aligned the shareability rule across What/Failure/Scenarios/ Out-of-scope — any non-prehistory state can be shared; added language tags to fenced code blocks for markdownlint. Skipped intentionally (reply on each thread): - HTML-escape every metadata badge: the values are controlled enum strings from kandev's own schema, not user input. Defense-in-depth noise. Tool name (which can come from agent runtime) IS escaped. - useShares request-token guard against stale responses: the dialog owns the hook lifecycle and opens against a single (taskId, sessionId) — the race the comment describes can't occur here. * fix(share): redact paths for every worktree, not just the first A single TaskSession can carry multiple worktrees when the task spans multiple repos. The redactor previously only saw the first worktree path, so absolute paths from secondary worktrees leaked into public shares instead of being rewritten to repo-relative form. NewRedactor is now variadic and applies the abs-path rule against every root it receives, sorted longest-first so a root that is a prefix of another (e.g. /workspace vs /workspace/repo1) gets matched by the more specific one first. workspaceRootFor in builder.go becomes workspaceRootsFor and emits every WorktreePath plus the WorkspacePath fallback. Flagged by Cubic on PR #995. * fix(share): address PR #995 review round 3 Bugs (flagged by Cubic + Claude on gh_client.go:714): - DeleteGist now calls the existing isNotFoundErr helper instead of an inline strings.Contains(err, "HTTP 404"). The helper also covers "404 Not Found" and "status: 404", which some gh versions emit, so the share service's "gist already revoked upstream" soft-success path now fires consistently across CLI auth users. Bugs (flagged by Claude on builder.go:220): - toolCallBlock used to read metadata["tool_name"] and metadata["args"] but production never writes those keys; the typed payload lives under metadata["normalized"] (a *streams.NormalizedPayload) and the tool kind is on Message.Type. Switched to deriving ToolName from strings.TrimPrefix(m.Type, "tool_") (gives "read", "execute", "edit", …) and reading args from metadata["normalized"], with backward-compat fallback to the older "tool_name"/"args" keys for the debug-fixture replay path. New TestBuildSnapshot_ToolCall_ProductionMetadataShape exercises the real session shape. Bugs (flagged by CodeRabbit on redaction.go:110): - Bare workspace-root occurrences (pwd output, end-of-sentence, quoted paths) used to leak because the matcher only handled root + "/". Switched to a precompiled regex per root — regexp.QuoteMeta(root) + `(?:/|\b)` — so both `root/...` and standalone `root` get stripped, while sibling dirs like /workspace2 still don't match. Test TestRedactor_AbsPath_StandaloneRootStripped covers the bare-root variants. Doc (flagged by Claude on spec.md): - Two malformed fence closers (`go and `text on closing fences) corrected to plain ``` so the file is markdownlint-clean. * fix(share): narrow abs-path boundary to avoid sibling-prefix corruption Round 4 review (Claude + CodeRabbit) caught a regression in the regex introduced by 436cb66: `(?:/|\b)` used `\b` (word boundary) to catch bare-root cases, but `\b` fires on any word↔non-word transition. So a sibling path like `/workspace.bak`, `/workspace-old`, or `/workspace-other` would false-match the `/workspace` root (since e→. and e→- are word boundaries), stripping it and leaving a corrupted `.bak` / `-old/file.ts` in the share. Replaced the matcher with `(/|\s|$)`: path separator, whitespace, or end-of-string only — never punctuation or quote chars. The boundary is captured and re-emitted via ReplaceAllStringFunc (or dropped, in the `/` case) so prose loses only the root, not the surrounding space. Added TestRedactor_AbsPath_SiblingsWithPunctuationNotCorrupted covering `.bak`, `-old`, `_alt` siblings; the digit-sibling test still passes. The quoted-bare-root case (`"/workspace"`) no longer matches and was dropped from the standalone-root test — contrived enough that a small leak there is preferable to corrupting realistic sibling paths. * refactor(share): move share button into chat status bar Replaces the dedicated PanelHeaderBarSplit above the message list with a slot in ChatStatusBar (the existing row holding TodoIndicator and PRStatusChip just above the chat input). The button anchors right via ml-auto; when the "proceed to next step" affordance is present it takes the right anchor instead and the share button stays inline. Also tightens the iconOnly variant in ShareButton to a ghost style that matches the muted-foreground chips in the status bar, and exports shareableSessionStateClient from share-button.tsx so the gating logic lives next to the entry point it controls. Net -23 lines in task-chat-panel.tsx: the extra header bar and the local gate helper are gone. * docs(share): broaden tooltip + add share/ to CLAUDE.md tree The share tooltip read "Share this completed task with a public link", but shareableSessionStateClient allows RUNNING / IDLE / WAITING_FOR_INPUT / FAILED / CANCELLED too. A user hovering mid-run saw misleading copy; reworded to "Share this task conversation as a public link" which matches the actual gate. Also added the missing internal/task/share/ entry to the task/ subtree in CLAUDE.md so the new package shows up in the repo map — flagged across multiple rounds. * docs: add internal/task/share/ to repo map Carryover from the share PR — AGENTS.md (which CLAUDE.md symlinks to) was missing the share/ subpackage under task/. Adding it now so the repo map matches what's checked in. --------- Co-authored-by: Kandev Agent <agent@kandev.dev>	2026-05-21 23:35:41 +01:00
João Salavisa	b8a09bc5ea	fix(github): pick allowed merge method so squash-only repos stop 405ing (#999) ... * fix(github): pick allowed merge method so squash-only repos stop 405ing The merge button sent an empty merge_method to GitHub, which defaults to "merge" regardless of repo settings — squash-only / rebase-only repos returned 405 "Merge commits are not allowed on this repository". The backend now resolves an empty method to the first allowed one via a new GetRepoMergeMethods endpoint (5-min cache), and the frontend renders a GitHub-style split button so users can pick among the allowed methods. * fix(github): address PR #999 review feedback - pr-merge-button: extract repo-methods fetch to useRepoMergeMethods hook (Claude bot); hide button while methods are loading so the primary label doesn't flicker (Claude bot); drop e.preventDefault on dropdown items so Radix closes the menu on selection (Greptile P1). - gh_client / pat_client: treat missing allow_* fields as false instead of true so a permission-gated response can't pick a disallowed merge method (cubic P2). - service.MergePR: only overwrite mergeMethod when pickDefaultMergeMethod returns non-empty, so a degenerate all-false config falls through to GitHub's default with the real error (Claude bot). * fix(github): don't hide merge button on lookup failure Round-2 PR feedback (Claude, Greptile, CodeRabbit, cubic): the `if (!methods) return null` guard added in the previous round to avoid label flicker turned a transient repo-methods lookup failure into a permanent UI lockout — the button would stay hidden until unmount/remount. - pr-merge-button: revert the null-guard; treat null as "use backend resolver", render the plain primary button without a dropdown. - use-repo-merge-methods: add a 5-min frontend TTL to match the backend cache so admin merge-strategy flips are visible without a page reload. Catch block now triggers a rerender, and co-waiting consumers attach both fulfilled/rejected handlers to avoid silent rejection swallowing. * test(github): cover useRepoMergeMethods + silence rejection warning Round-3 PR feedback (Claude): - Swallow rejections in the originating fetch chain instead of rethrowing, so the first consumer's promise never escapes the hook as an unhandled rejection. Coalesced consumers already re-render to null, which is the same state a fresh "not loaded" call would show. - Add use-repo-merge-methods.test.ts covering: null-on-missing-params, loading then resolution, cache hit on remount, concurrent-fetch coalescing, retry-on-failure (no cache poisoning, no unhandled rejection), and TTL-expiry refetch via fake timers. * test(github): cover httpGetRepoMergeMethods error branches Round-4 PR feedback (Claude): the new endpoint had only happy-path coverage. Add tests matching httpMergePR's existing shape: - nil client → 503 (ErrNoClient) - GitHubAPIError{404} → 404 - generic upstream error → 500 --------- Co-authored-by: Kandev Agent <agent@kandev.dev>	2026-05-21 23:22:31 +01:00
José Almeida	d14cda778e	fix(web): close clarification overlay even when WS event is lost (#997)	2026-05-21 22:14:37 +01:00
João Salavisa	35242b2982	feat(web): drag-reorder subtasks within a parent task (#962) ... * feat(web): drag-reorder subtasks within a parent task Adds per-parent subtask ordering in the sidebar. Drag a subtask under its parent to reorder; the chosen order is independent of the global sort and persists per browser via localStorage. - New `sidebarTaskPrefs.subtaskOrderByParentId` slice field and matching `setSubtaskOrder(parentId, ids)` action, persisted to localStorage under `kandev.sidebar.subtaskOrderByParentId`. - `applyView` applies the per-parent override after `separateSubtasks`, so it never touches root order or the active sort spec. - TaskSwitcher exposes `onReorderSubtasks(parentId, ids)`; each parent's subtask list lives in its own nested DndContext / SortableContext using the existing dnd-kit setup. - Task-deletion cleanup strips the deleted id as both parent key and subtask entry from `subtaskOrderByParentId` in store + localStorage. * refactor(web): address PR review feedback on subtask reordering - Extract `pruneSubtaskOrder(map, taskId)` helper in `local-storage.ts`; use it in both `cleanupTaskStorage` and `removeTaskFromSidebarPrefs` to keep the two cleanup paths in lockstep. - Move `SortableSubtaskRow`, `SortableSubtaskList`, and `useSubtaskDnd` into a new sibling file `task-switcher-subtask-dnd.tsx` so the switcher stays under the 600-line soft limit. - `SortableSubtaskList` now short-circuits to a plain row map when `onReorderSubtasks` is undefined — read-only callers no longer get a misleading grab cursor or unused DnD scaffolding. * fix(web): add stable keys to non-DnD subtask render path When `onReorderSubtasks` is undefined, the early-return branch in `SortableSubtaskList` mapped subtasks without keys, falling back to React's index-based reconciliation. Wrap each child in a keyed `Fragment` so reorders or size changes reconcile correctly. * refactor(web): single-source DRAG_ACTIVATION_DISTANCE Export the constant from `task-switcher-subtask-dnd.tsx` and import it in `task-switcher.tsx` instead of declaring the same value twice. --------- Co-authored-by: Kandev Agent <agent@kandev.dev>	2026-05-21 01:31:42 +01:00
João Salavisa	a2d086efb8	feat(web): add @-mention for tasks in the chat composer (#963) ... * feat(web): @-mention tasks in the chat composer Lets users type @<taskname> in the chat input to reference other tasks. The picked task is inserted as a chip and its metadata (id, workflow_id, step, state) is appended to the prompt as a <kandev-system> block so the agent can act on it via the kandev MCP tools. Extends the existing TipTap mention extension with a new "task" kind; task data comes from the kanban store (current workflow + visited kanbanMulti snapshots), so no backend changes are needed. * fix(web): harden task @-mentions from review feedback (#963) - Sanitize interpolated task strings (title, id, workflow_id, step, state) before they land in the <kandev-system> block so a hostile task title (e.g. from Jira/Linear sync) can't terminate the block early via embedded newlines or angle brackets. - Expand the task-mentions context block on the onSend code path too (used by preview-session-tabs), which was silently dropping the agent-facing task context when chips were present in the editor. - Deduplicate task mentions by taskId in getTaskMentions so mentioning the same task twice no longer produces redundant lines. - Skip stale state.kanban.tasks entries whose workflowStepId isn't in the current workflow's steps to prevent tagging them with the wrong workflow_id. * fix(web): skip task mentions missing workflowId or workflowStepId (#963) CodeRabbit flagged that getTaskMentions was filling missing workflowId / workflowStepId with empty strings, propagating malformed metadata into the prompt block. Skip such nodes during extraction. --------- Co-authored-by: Kandev Agent <agent@kandev.dev>	2026-05-21 00:57:12 +01:00
Luan Martins	a852be3c33	feat(web): show task linkage on GitHub PR list (#952) ... * feat(web): show task linkage on GitHub PR list Add a compact indicator next to each PR showing whether a task already exists. When tasks are linked, show a clickable button with the task title and a count badge for multiple tasks. When no task exists, show 'No task created yet'. - Add usePRKeyToTasks hook that maps PR keys to task associations - Add PRRowTaskIndicator component for the per-PR task UI - Wire the data through github-page-client into PRList - Add tests for the indicator and hook utility * feat(web): improve PR task indicator with task titles and multi-task dropdown - Show actual task title instead of PR title in single-task case - Replace count badge with dropdown menu for multiple linked tasks - Switch icon from GitPullRequest to Checklist - Load all workflow snapshots on GitHub page to hydrate task titles - Fix test to use unique task_id per fixture * feat(web): neutralize PR task indicator color and add tooltip The checklist icon previously mirrored PR aggregate status, which duplicated information already shown on the PR row and misleadingly suggested it reflected task state. Drop the color and add a tooltip surfacing the actual task title and workflow step. Adds e2e coverage for the GitHub PR list task indicator: empty badge, single-task button, and tooltip content. * fix(web): navigate to task page when clicking PR task indicator replaceTaskUrl only mutates history.state, which sets active task in the store but does not trigger a Next.js route change. From /github, this left the URL pointing to /t/<id> while the page still rendered the GitHub list. Use router.push so the click actually navigates to the task. * test(web): cover PR task indicator click navigation Extends the GitHub PR list task indicator spec with a click assertion verifying the URL changes to /t/<taskId> and the PR list unmounts. Regression guard for the replaceTaskUrl → router.push fix. * fix(github): link task to PR at creation time, not via branch poller Tasks started from the GitHub PR list "+ Task" button were left without a github_task_prs row when the worktree branch did not match the PR's head branch on GitHub. This happened for PR-review-style tasks, which check out synthetic branches (e.g. feature/review-...-h92) that don't exist as PR heads. The poller's FindPRByBranch could never resolve them, so only the first task whose branch happened to match got linked — every other task created from the same PR was missing from the indicator. The PR is already known at "+ Task" time, so persist the linkage immediately rather than waiting on branch-based discovery: - AssociateExistingPRByURL: new service method that creates the github_task_prs row from a PR URL without creating a PR watch. The watch is still created later at agent start via ensureSessionPRWatch. - POST /api/v1/github/task-prs/associate: HTTP endpoint exposing it. - QuickTaskLauncher.handleSuccess: after task creation, fires a best-effort associate call with the task's repository_id and PR URL. Failures fall back to the legacy poller path silently. Backend test covers two distinct tasks linking to the same PR. E2e adds a PR with two tasks and asserts the multi-task indicator ("Tasks 2") renders alongside the single-task and empty cases. * refactor(github): make task-PR create endpoint RESTful Rename POST /api/v1/github/task-prs/associate to POST /api/v1/github/task-prs. The action-named "/associate" was RPC-styled; the resource collection is the right URL for creation alongside the existing GET. Frontend client renamed associateTaskPR → createTaskPR to match. * fix(github): address PR review findings - Map invalid PR URL to HTTP 400 (was 500). New ErrInvalidPRURL sentinel lets the controller distinguish parse failures from genuine server errors. Other failure paths still return 500. - Prefer dialog-time repositoryId in pickRepositoryIdForPR. Multi-repo tasks with shared branch names were ambiguous under pure branch matching; the matched repo id captured by the launcher dialog wins when present. - Cover usePRKeyToTasks (not only the prKey util) with hook tests: empty input, multi-task grouping, distinct keys, and the non-array defensive branch. - Lock createTaskPR request semantics: method/body now win over a caller's options.init so the POST JSON shape can't be overridden. * fix(web): use TaskPR row id for dropdown key Multi-repo tasks can produce more than one TaskPR row for the same PR (one row per repository_id), so keying the multi-task dropdown by task_id risked a duplicate-key warning and unstable reconciliation. Switch to the row id, which is unique per row.	2026-05-20 22:38:44 +01:00
Carlos Florêncio	862822dab1	feat(web): add dev debug logging for git-status, dockview, and chat messages (#961)	2026-05-19 23:41:02 +01:00
Carlos Florêncio	a74409af3c	fix(web): cap clarification overlay height and add mock agent ask commands (#956)	2026-05-19 22:27:24 +01:00