Rework per hermes-sweeper review (keep_open, salvageability=medium):
- Capture moves out of the render body into the session-switch layout-effect
cleanup, so only committed switches persist state (no uncommitted render
can write localStorage).
- Live state is fed by both scroll events and a ResizeObserver on the
content element, so distance-from-bottom stays fresh under async
relayout that changes height without a scroll event (the staleness gap
#70478's own review threads flagged).
- State is distance-from-bottom (or sticky-bottom), not raw scrollTop:
the render-budget backfill prepends older turns and main anchors by
distance-from-bottom, so an absolute offset no longer identifies the
same reading location after the height change.
- Restore integrates with main's hasGroups/settle/anchor lifecycle: the
settle loop re-applies the remembered target, defers on a clamped offset
(content still arriving), hands back locked only for sticky-bottom, and
leaves mid-read sessions escaped at their offset.
- anchorBeforePrepend no longer records 0 mid-load, which would clobber a
restored offset once the backfill lands; the settle loop owns the target
every frame until settled.
- Storage is scoped per profile with the session.ts .profile.<encoded>
key pattern (no cross-profile bleed, #67709 pattern) and LRU-capped at
120 sessions per profile.
- Regression tests: state classification, target math, profile isolation,
LRU eviction, corrupt/invalid payload handling.
Related to #45562 (partial; no automatic closure)
(cherry picked from commit 1d79bef93f63d7b190b471bf652b5109b4288a8e)
Preserve producer descriptions without identity wrappers and size the existing themed tooltip to the viewport. Replace skipped and structural tests with two behavioral invariants. Native Electron before/after hover, click and keyboard verification passed; campaign suite validation remains queued.
Salvage #104301 error presentation and translations. Keep drill-in outcome local to its mounted scope, ignore stale responses, retain existing rows, and show retry even when cached lanes exist.
Co-authored-by: elvindu <dumanxiang@qq.com>
Providers → API Keys was reading the active gateway profile instead of
the shared Settings 'Applies to' override used by Model and Tools & Keys.
Navigating from Model (profile B) to Providers silently switched back to
active profile A, making credential configuration ambiguous.
Now passes $settingsRequestProfile to useEnvCredentials and renders
SettingsProfileScope for visual parity with KeysSettings.
Fixes#103993
Reuse the focused pane derivation for visible sidebar activity rather than trusting a stale workspace route. Live Electron reproduction: Kanban stayed highlighted while a resumed session tab was visible; the highlight now clears without changing the retained route. Adapted the rendered sidebar invariant and focus derivation from MarcoFernstaedt's PR #88691 for #88517. Directory suite queued under the campaign test lock.
Preserve profile ownership proven at the secondary socket boundary rather
than trusting arbitrary wire profile fields. Retire transient local owners
with the profile pool, while keeping durable and exact remote ownership first.
Salvage #103774 with two invariant tests and routing documentation. The
profile-only fallback was also identified in the earlier #103770; this
version retains the producer provenance and retirement boundary.
Live Desktop renderer with two isolated serve backends: Reject previously
failed after clearing durable bindings, leaving approval pending. With this
change, the same action sends deny to the owning backend and pending clears.
Existing-binding controls pass on both sides. No vendor inference used.
Fixes#103755
Salvaged-from: 8a3c545e255b66b6ca4bc4b99cd725c5f7a08632
Recognize the full producer task header when a batch goal spans lines,
so the next task goal and preceding transcript footer cannot become part
of the displayed result. Extend the existing invariant and real SQLite
producer probe with that case.
Make the live probe artifact path explicit, run Chromium headlessly, and
document its synthetic fixtures and integration fidelity limits.
Keep compact completion labels while rendering only result and job output bodies, including legacy and batch deliveries. Credit Gyarados4157's #101083 investigation; avoid rendering its full model instruction envelope.
Remove whole-document whitespace cleanup that erased hard breaks and fenced-code spacing across all five ingestion paths. Limit generated-image gap joining to the removed image itself. Keep soft newlines as soft breaks.
Investigated #97117 and the approaches in #97431 (@wooyongbin3-cpu) and #97175 (@Jackal991); both leave fenced-code whitespace and sibling ingestion paths exposed, so remove the destructive normalization instead.
Salvage #99095 (e7ea53074ab2b64a1530641659399d9f1bb4b435), completing one-time migration for both boolean values and using the existing storage helpers. Hydration and local toggles never edit backend configuration. Fixes#99076.
Desktop AGENTS.md requires a compat fallback to be 'tied to an identified
older runtime' so a future cleanup knows when it can be deleted. The
original comment said only 'older backend plugins'; name the actual
boundary: backends before #35395 (May 2026) omit the attachments key.
Review follow-up on the salvage of #104529.
#96269 and #102465 fixed the same blank-sidebar symptom with the same
"narrow the persisted filter to ids the live tree names" mechanism.
resolveLiveProjectFilter (the earlier PR) is the single resolver; the
duplicate sanitizeProjectFilter is removed. What #102465 adds beyond it stays:
detached rows file under NO_PROJECT_ID, so filtering to Home keeps Home's rows.
The sidebar's persisted project filter is a membership whitelist over tree node
ids. Ids that the active profile's tree does not resolve (picked in another
profile, or left over after a project was deleted / an update rebuilt the tree)
used to filter every row out — headers rendered, zero sessions, until Local
Storage was cleared. Narrow the persisted filter to ids the live tree resolves;
dead ids are inert, never fatal. Memo-only, never written back.
Salvage of #96269 (three commits: fix + two lint passes, folded).
`persistSshConnectionToken()` writes the per-serve session token adopted for
an SSH connection onto its v2 registry entry, but the registry never read it
back: `normalizeRegistry()` rebuilt an `kind === 'ssh'` entry from
`normalizeSshConfig()` alone, which describes only the DIAL (host, user, port,
keyPath, remoteHermesPath, remoteProfile). The sibling remote/cloud branch
preserves `entry.token`; the ssh branch did not.
The token therefore survived only in the mtime-keyed in-process cache. On the
next cold read — an app restart, or any process that re-parses
connections.json — it was silently dropped, so `resolveRemoteBackend()`
decrypted an empty value and dialed with `reuseToken = ''`. That fails the
`Boolean(reuseToken)` clause of remote-lifecycle's `reusable` gate, so a
HEALTHY owned backend was classified not-reusable, reaped by `cleanupStale()`
and respawned on a new port behind a new tunnel — while the renderer kept
dialing its cached `wsUrl?token=` at the old credential and got 403 forever.
`normalizeConnectionInput()` had the same omission: `saveRegistryConnection()`
resolves the surviving envelope via `resolvePersistedRemoteToken()` and passes
it in, but the ssh branch dropped it, so a plain label rename wiped the live
backend's reuse credential and re-armed the same loop.
Both branches now carry the token exactly the way the remote branch does.
There is no auth-mode choice on an ssh entry that could invalidate the
envelope, so no drop condition is needed.
Fixes#103795
- The placeholder ("assistant response not persisted") is removed: it turned a
wholly-empty persisted row into TEXT, which in reconcileResumeMessages could
replace a text-only live stream row at the same ordinal until the turn
settled. The sidecar fallback alone covers the #68321 field repro.
- Phase filter matches the backend (codex_responses_adapter _OutputScan._message):
commentary AND analysis are reasoning-channel narration, not the reply.
- Tests trimmed to the two contracts that are red on main; six that passed on
main (pre-existing reasoning-part behaviour) are gone. File renamed for what
it now covers.
Field-level reproduction (2026-09-02, v0.21.0, in the issue thread): an
assistant row with content length 0 whose user-visible response exists
only in reasoning / reasoning_content / codex_message_items renders
live, then disappears from the transcript after a session/profile
switch-back. DB intact - the row is still there on every re-read; only
the rehydrated render loses it. Six independent confirmations across
macOS and Windows since 2026-07-22; all prior fixes (#68329 envelope
normalization, closed implemented_on_main; #77644 mid-turn reconcile;
#101470 compaction-display projections) addressed adjacent producers,
not this one.
Two producers in toChatMessages hydration, both pinned by the new
chat-messages.reasoning-survival.test.ts (fails 9/9 on current main):
1. codex_message_items never read. Responses-API turns can persist with
`content` empty while the reply the user saw lives only in the
message-items sidecar ({type:'message', role:'assistant', phase,
content:[{type:'output_text', text}]}). The live stream painted that
text; hydration ignored the sidecar, so the rehydrated bubble came
back blank - and the blank chatMessageText at the same role-ordinal
then made reconcileResumeMessages drop the cached row's parts
(sameText/extension/isLiveTailRow all fail), erasing the reply on
every switch-back. Fix: codexMessageItemText() extracts
non-commentary assistant output_text as the bubble's text when
content and reasoning produced no parts. Persisted content still
wins when present; commentary narration is never promoted.
2. the zero-parts drop. An assistant row hydrating to no parts at all
returned early and vanished from the transcript entirely - the
"all assistant messages gone; user messages remain" shape. Fix: a
wholly empty assistant row (display_kind != 'hidden') paints a
_(assistant response not persisted)_ placeholder instead of
disappearing. Hidden scaffolding rows keep dropping as designed
(pinned by a test).
Also adds codex_message_items to the SessionMessage type (the gateway
has shipped it since the branch-copy lane; the type never declared it).
Verification (native Windows, node 24.17):
- new file: 9 passed (fails 9/9 without the hydration changes)
- src/lib full dir: 1243 passed
- reconcile suites (utils + resume-structural-parts): 115 passed
- streaming/timeline reasoning-part suites: 25 passed
- tsc --build tsconfig.json: clean
Fixes#68321
- session-control-goal.tsx: a 'send' dispatch against a busy session now
parks the kickoff on the composer queue (the backend already resumed the
goal) instead of reporting continuationFailed. Shared helper
queueKickoffIfSessionBusy() extracted from slash.ts so both paths agree.
- gateway-switch.ts: wipeSessionListsForGatewaySwitch clears
$sessionControlBySession (runtime-id keyed; new backend re-mints ids).
Dead resetSessionControlAfterGatewayRebind removed; clearSessionControl
now called from the session delete path beside clearQueuedPrompts.
- session-control.tsx: read/hydration failures use controlUnavailable copy,
not actionFailed.
- i18n: heartbeatDueWaitingForIdle added to ja/ru/zh-hant; new
continuationQueued/continuationBusy/controlUnavailable in all locales.
- Sidebar: the entry joins SIDEBAR_NAV (same chrome, active state, data-tour
handle as the other rows) instead of a one-off Button below the rail;
i18n moves to sidebar.nav['session-import'].
- Reuse common.retry / common.refresh / common.back instead of duplicating them
under sessionImport in six locales.
- hermes_cli/foreign_session_browser.py -> foreign_sessions_browser.py so it
sorts as a sibling of the foreign_sessions module it extends.
David Metcalfe