49 Commits

Include renames

Author	SHA1	Message	Date
3 people	d276991c60	MUL-6743 refactor(issues): remove the assignment handoff note (#7626) ... * refactor(issues): remove the assignment handoff note (MUL-6743) Usage data puts the handoff note at 0.2% of assignments, so the box occupied the confirm dialog's centre for the other 99.8% and bought them nothing. Removing it takes the whole feature with it: the note input and its runtime version gate, the `handoff_note` write field on PATCH/batch issue updates, the task column write, and the daemon's opening-prompt + issue_context.md handoff sections. The confirm dialog itself stays — it still names who is about to run and still offers "Don't start yet" (suppress_run). The `*WithHandoff` enqueue methods only ever varied by that note, so they become `EnqueueTaskForIssueByActor` / `EnqueueTaskForSquadLeaderByActor` — the actor-carrying variants autopilot already called with an empty note. `preview-trigger` drops `handoff_supported`, which nothing read after the gate moved client-side. `agent_task_queue.handoff_note` is deliberately left in place: it holds historical rows and this is the expand half of an expand-contract pair. Nothing reads or writes it now, so a follow-up migration can drop it once no deployed binary selects it. Co-authored-by: multica-agent <[email protected]> * docs(issues): reshoot the assignment confirm dialog (MUL-6743) The asset still showed the handoff note box the surrounding prose no longer describes. Recaptured from the app at the same 600x450 frame; the confirm button now carries the send-chord keycaps it has shipped with since MUL-5694. Co-authored-by: multica-agent <[email protected]> --------- Co-authored-by: Lambda <[email protected]> Co-authored-by: multica-agent <[email protected]>	2026-09-03 16:13:33 +08:00
3 people	603519d158	MUL-6977: test: remove implementation-only coverage (#7932) ... * test: remove implementation-only coverage Co-authored-by: multica-agent <[email protected]> * test: remove remaining implementation-only coverage Co-authored-by: multica-agent <[email protected]> * test: restore compatibility and fragment navigation coverage Co-authored-by: multica-agent <[email protected]> * test: preserve behavioral cleanup contracts Co-authored-by: multica-agent <[email protected]> --------- Co-authored-by: Sol-Boy <[email protected]> Co-authored-by: multica-agent <[email protected]>	2026-09-03 13:23:25 +08:00
Soda	316b895959	fix(i18n): respect locale for formatted values (#7757)	2026-09-01 13:49:09 +08:00
Danila Katalshov	11861145ab	MUL-6758 feat(core): add truncateWithEllipsis string helper (#7646) ... Adds `truncateWithEllipsis(text, maxLength)` to packages/core/utils.ts and routes two existing truncation sites through it. The helper appends the single-character ellipsis `…` (U+2026), counts it toward the budget, and measures that budget in Unicode code points rather than UTF-16 code units, so an emoji is never cut into a lone surrogate. Trailing whitespace is trimmed before the ellipsis is appended. Adopted by the task-transcript trace presenter and the desktop daemon panel. Both previously used a content-character budget, so each passes `max + 1`. Content of length exactly `max + 1` is now shown in full rather than truncated — the old code spent an ellipsis to hide a single character. Closes #7544. Co-authored-by: Danila Katalshov <[email protected]>	2026-08-31 20:37:46 +08:00
3 people	07bc8bc6bc	MUL-6739 fix(chat): keep the viewport at the live end while replies stream (#7612) ... * fix(chat): keep the chat viewport at the live end while a reply streams (TIM-55) Virtuoso's `followOutput` only fires when the item COUNT changes. A streaming assistant turn is one row that keeps growing, so nothing followed it and the reply ran off the bottom of the fold. Virtuoso's own SIZE_INCREASED recovery is armed for 100ms after a count change, which a multi-minute stream leaves behind on its first token. The composer is the same failure from the other side: it grows with the draft (and banners/queue appear above it), shrinking the list's viewport while scrollTop stays put, so the tail slides out of view behind it. The list now drives its own bottom-stick off a ResizeObserver watching both the scroll container and the content inside it: while the reader is at the live end, any content growth or viewport shrink re-pins to the bottom; scrolling away releases the pin until they come back. `followOutput` drops to "auto" — the stick pins instantly, so a smooth glide started on a count change was only going to be cancelled by the next chunk. * refactor(chat): collapse the bottom-stick controller into pure helpers The stateful BottomStick factory carried one bit of state (pinned), which now lives in the hook's ref. The decisions stay as pure functions (isAtLiveEnd, bottomPinTarget) so the node-side matrix tests survive, and HTMLElement satisfies ScrollMetrics structurally, removing the readMetrics adapter. Pin-state transitions (release, re-engagement) are now hook behavior and move to the DOM suite. * refactor(chat): trim auto-scroll comments * fix(chat): preserve scroll-away intent during streaming * fix(chat): preserve pin through live-end clamps * fix(chat): judge scroll-away intent from input via the shared live-end latch Review feedback on #7612: releasing the follow on any 1px upward move regressed the base's 120px forgiveness and left no recovery path, and the repo already ships a latch that solves reader-intent-vs-system-displacement for the newest-first transcript. The latch's state machine is direction agnostic, so the chat list now reuses it: generalized to createLiveEndFollow (fed away-positive input deltas and distance-from-bottom), wired to wheel/touch/key/pointer input mirroring the transcript dialog. Sub-threshold nudges keep following, accumulated input past FOLLOW_EDGE_THRESHOLD releases, clamps and streaming never count as intent — no direction sensing, no 1px special case, one shared threshold both directions. Also from review: content growth now arrives through Virtuoso's own totalListHeightChanged instead of a wrapper div, the #6697 auto-vs-smooth rationale is restored, and followOutput has direct coverage for a released follow while Virtuoso still reports atBottom. * docs(chat): make auto-scroll comments standalone * fix(chat): stage scroll input until the surface's own scroll confirms it Review feedback on #7612: the latch credited every wheel/touch/key event that reached the container, including input the list never consumed (a nested code-block scroller, a conversation too short to scroll) — releasing the follow with no scroll event to ever re-engage it. The keydown target guard had the mirror problem: the container is not focusable, so paging from a focused row control scrolled the list with no input recorded, and the reader was pinned back over their own keypress. input() now stages intent and only the surface's own scroll promotes it past the threshold; resize-driven displacement (content growth, composer changes) can never promote, and unconsumed intent expires with its gesture. That lets the chat keydown wiring drop the target guard entirely: a key a control consumed never scrolls the list, so it never releases, while one the browser answered does. Home/End now stage intent like the other keys instead of disengaging unconditionally. * fix(chat): let the surface's scroll supply the release magnitude Review feedback on #7612: releasing on input magnitude inside one 300ms burst made release unreachable at reading pace (discrete wheel notches reset the accumulator every gesture, and a Firefox notch is exactly the threshold), and gating the pin on input freshness let a reply's final chunk land inside the window and park unpinned forever. Input now only opens a per-gesture budget; each scroll attributes the displacement the surface actually took, capped by that budget, so a system shift inside a gesture (a transcript prepend) can never count as reader intent. Attributed displacement accumulates until the reader returns to the live end — it survives both gesture boundaries (reading-pace notches release) and pins (persistent sub-threshold attempts against a fast stream eventually win). The pin verdict no longer consults the intent window at all, so displacement is corrected immediately with no timer for a final event to hide behind. Also from review: Shift+Space pages up, so it now stages away-intent in the chat list and toward-intent in the transcript dialog, where the unsigned handling predated this PR. * fix(chat): attribute confirmed touch momentum * test(chat): cover active touch pin guard * fix(chat): cap confirmed non-touch motion by its unspent claim Confirming a scroll opened a motion window that any same-direction displacement could extend for 300ms, with no source or magnitude attached. A transcript prepend landing in that window was credited to the reader: 30px of real movement, still inside the edge zone, released the follow permanently — the #5921 case the latch exists to prevent. Touch keeps coasting freely, since momentum is not proportional to finger travel. Every other source may now only continue for the claim the surface has not spent yet, so a wheel notch whose scroll animates across frames still counts while a system shift finds nothing to draw on. Co-authored-by: multica-agent <[email protected]> * fix(chat): make carry survive fractional frames and overlapping notches Two ordinary wheel sequences still reached the pin. An exact `moved <= motionCarry` rejected the last frame of an unevenly split animation by about one ulp, because carry is spent in fractional steps and drifts from the surface's own arithmetic. The comparison now allows a tolerance scaled to the amount at hand; a real system shift is pixels, not ulps. A notch arriving while the previous one was still animating was never confirmed: the continuation branch spent the old carry and returned, so endInputFrame() discarded the new claim and the rest of the reader's own scroll was pinned back. Same-direction scroll now folds a fresh claim into the carry first, on both the away and toward paths. Co-authored-by: multica-agent <[email protected]> * test(chat): make the toward-fold regression actually exercise the branch The case started by scrolling 300px away, which released the follow — so the pin verdict was false no matter what the toward fold did. Park the viewport out at 300px under a held pointer instead, which suppresses the pin without attributing anything, and the reader is still following when the notches land. Removing the fold now fails this test. Co-authored-by: multica-agent <[email protected]> --------- Co-authored-by: Bohan-J <[email protected]> Co-authored-by: multica-agent <[email protected]>	2026-08-28 17:59:28 +08:00
3 people	7b0b239779	MUL-6551 fix(i18n): separate task failure labels from raw diagnostics (#7496) ... #7459 localized the `failure_reason` labels, but the raw `task.error` the server and daemon persist was still concatenated into what the user reads. A non-English workspace saw a translated reason followed by an English sentence, and hover text carried absolute worktree paths and machine names. Draw the line by audience instead: - The localized reason is the entire user-facing explanation. Drop the raw `task.error` from the execution log's status tooltip, the agent activity row's tooltip, and the transcript's cancelled badge. - In the transcript's Run details, "Reason" now heads the localized label from the stable `failure_reason` enum, and the raw text moves to its own "Technical details" row at the end — a translated heading over untranslated content, still readable for whoever debugs the run. Also finish the two label tables #7459 left inside the translated package: - `taskStatusConfig.label` was dead (the sole consumer reads only icon and colour; the status word already comes from `taskStatusLabel`). Removed. - `availabilityConfig` / `workloadConfig` kept English `label` strings whose only reader was `AgentStatusDot`'s `aria-label="Status: Offline"` — the whole accessible payload for a screen reader, in English in every locale. It now reads through the existing `availability.*` keys plus a new `presence_status_aria`, and the visual configs carry no copy at all. New keys in all four shipped locales (en, zh-Hans, ja, ko): `presence_status_aria`, `transcript.details_diagnostics`. Tests: the visual configs are asserted to expose no `label` field, the headings are asserted distinct per locale, the raw error is asserted absent from tooltips while still present in Run details, and the presence dot's accessible name is asserted in Chinese across every availability value. No schema, API, or server change — `agent_task_queue.error` keeps its exact current meaning, which is what `taskfailure.Classify` matches on. Refs #7411 Co-authored-by: Sol-Boy <[email protected]> Co-authored-by: multica-agent <[email protected]>	2026-08-24 14:56:05 +08:00
iiwish	9ecc6787b0	fix(i18n): localize task failure reasons [MUL-6565] (#7459) ... * fix(i18n): localize task failure reasons * fix(i18n): cover operational failure reasons * fix(i18n): cover legacy user cancellation reason	2026-08-24 14:05:15 +08:00
Jiayuan Zhangandmultica-agent	e5b28564b0	fix(views): prevent crowded transcript end ticks (#7458) ... Co-authored-by: multica-agent <[email protected]>	2026-08-23 23:30:32 +08:00
Wu Changming	7fdc854c26	fix(issues): copy durable local path for worktree tasks (MUL-6378) (#7176) ... A worktree-mode local_directory task runs in a disposable git worktree that Finalize removes on every exit path, so the task's `work_dir` pointed at a directory that no longer existed. "Copy local workdir path" handed the user a path they could not `cd` into. The daemon now reports a `durable_work_dir` handoff instead of having clients infer one: - `removeLocalWorktreeDir` returns an error and confirms removal with `Lstat`, so a broken symlink cannot be mistaken for an absent directory. Finalize fails when removal cannot be confirmed. - `durable_work_dir` is written only after Finalize succeeds and the worktree is verifiably gone. A preserved worktree, an in-place run, a running task, a squad-leader task, and any older daemon all leave it unset, keeping the real `work_dir` authoritative. - The field travels on the complete, fail, and cancel-ack callbacks and is persisted on the task row (migration 362, additive nullable column). Writes use COALESCE for replay idempotency; the cancel-ack path CASes on `status = 'cancelled'` so a late ack cannot touch a completed or failed row. - The server derives `relative_durable_work_dir` through the same home-stripping helper as `relative_work_dir`; the absolute value is reserved for explicit clipboard actions and is never rendered. - Clients select the durable path only for a terminal task that carries the field. The issue actions menu and the transcript dialog share one resolver, and the label and toast say the task worktree was reclaimed, naming the delivery branch when one exists. The stored path is a point-in-time delivery snapshot: later renames or detachments of the project resource do not rewrite historical tasks.	2026-08-20 01:30:58 +08:00
3 people	0c0baf0505	perf(realtime): stop the task:message fanout from flooding every client (MUL-6396) (#7227) ... * perf(realtime): stop the task:message fanout from flooding every client (MUL-6396) `task:message` is broadcast to every client in the workspace for every run, and the client cached all of it: the handler's `(old = [])` default built a timeline entry on first sight, so each client accumulated the full transcript of runs its user would never open, held for the life of the run. Tool input is unbounded on the wire, so a single large Write shipped its whole body to every open client and was retained there. Three changes, each useful on its own: - Client drops frames for tasks no mounted view is rendering. Presence in the query cache is the signal, which registers when a view mounts and before its fetch resolves, so a frame landing mid-backfill is still kept. Rows are persisted before they are broadcast, so a dropped frame costs nothing — whoever opens the task next fetches it. - Server clips oversized `input` / `output` out of the broadcast copy and marks it `truncated`. Persisted rows and the REST list responses are untouched. A client seeing the flag repairs that task's timeline from the DB, once per flush window rather than once per frame. - Client coalesces surviving frames into one cache write per 100ms window, turning a burst of streamed messages into one merge and one render. The window is fixed, not a resetting debounce, so a continuous stream still flushes instead of being starved until it pauses. Mobile keeps its own per-session updater and was already scoped to mounted sessions, but shares the wire format, so it refetches on `truncated` too. The remaining half of the batching idea — one WS frame per reported batch instead of one per message — is deliberately not here. The client identifies itself on the upgrade URL but the server does not retain that version, so a shape change would silently break every older client. It belongs with the client scope-subscription work that `listeners.go` is already waiting on. Co-authored-by: multica-agent <[email protected]> * fix(realtime): keep broadcast clipping off the wire, and stop a late fetch dropping live seqs Addresses both must-fix findings from review. 1. Clipping the broadcast copy is not something an existing client can ignore: it changes what `input` / `output` mean, and every deployed client already consumes them. A build without the `truncated` reader caches the clipped copy under staleTime:Infinity and never refetches, so its execution log would stay incomplete until the window is reloaded — the PR even proposed shipping the server half first, which is exactly backwards. Clipping now sits behind MULTICA_CLIP_TASK_MESSAGE_BROADCAST, off by default, so the reader ships first and the flip is a later, revertible ops step. Capability routing would be the principled fix, but the hub does not retain the client_version it is handed at upgrade and frames cross nodes through the Redis relay as serialized bytes — the same protocol work per-task scope routing is already waiting on. 2. Not caching unopened tasks made first open of a live task fetch where it previously found a pre-seeded cache. That fetch replaced the array wholesale, so any frame written while it was in flight was dropped — and with staleTime:Infinity nothing would ever fetch it again. Every write to the timeline cache now folds through one rule, installed as the query's own structuralSharing: union by seq, server data winning on conflict, rows the response never mentioned kept rather than deleted. That subsumes the backfill's hand-rolled eviction, so the three write paths (fetch, backfill, realtime batch) can no longer disagree. Also documents why mobile's truncated branch is unreachable today: its task:message handler gates on chat_session_id, which the server's payload does not carry, so mobile appends nothing at all. Pre-existing, reported separately, and the branch stays so whichever side is fixed first is not left caching clipped rows. Co-authored-by: multica-agent <[email protected]> * fix(realtime): re-check the timeline is still held before writing a batch Holding was verified when a frame entered the batch, but the write happens up to a window later — and `setQueryData` does not postpone garbage collection. query-core arms that timer when the last observer leaves and never re-arms it on write, so closing a transcript while its run keeps streaming has the entry collected mid-window with a batch already in flight. Writing then rebuilt the entry holding only that batch. Under the app-wide `staleTime: Infinity` the next open reads the stub as fresh and never fetches, so everything before it is missing until the window is reloaded — silent, permanent, and not self-healing. Agent runs routinely outlive the 10 minute gcTime, so "opened a running task, closed it, it kept going" reaches this on an ordinary day rather than in a race. The flush now re-checks immediately before each write and drops the batch if the entry is gone, dropping its repair fetch with it. `backfillTaskMessages` guards its own post-await write for the same reason. Dropping costs nothing: the rows are persisted, so the next open fetches the whole timeline — which the regression test asserts rather than just checking the entry stays absent. Also corrects the doc comment on isTaskMessageTimelineHeld, which described the entry as a mounted view. It means "opened at some point and not yet collected", and the bounded tail is one gcTime. Co-authored-by: multica-agent <[email protected]> * docs(realtime): describe the task:message gate as it actually behaves The overview still said frames are dropped unless a mounted view holds the task, and that the old behaviour retained a transcript for the life of the run. Neither matches the code: the gate is timeline-entry presence (opened at some point, not yet collected), and writes do not postpone GC, so retention is bounded by gcTime rather than the run. Co-authored-by: multica-agent <[email protected]> --------- Co-authored-by: J <[email protected]> Co-authored-by: multica-agent <[email protected]>	2026-08-19 19:25:05 +08:00
3 people	f320af4a5b	MUL-6333 fix(transcript): state the run's agent once, not on every prose row (#7128) ... * fix(transcript): state the run's agent once, not on every prose row (MUL-6333) #7011 gave each agent prose row an avatar and a semibold name to promote prose over tool calls. But a transcript is one run by one agent: `agentName` and `agentId` were passed the same values for every row, and `TraceMessageStep` carries no per-step actor, so the block was a constant repeated once per step. The name rendered at `text-caption font-semibold` — the same 12px as `.transcript-prose` body text, at heavier weight. On a run of short steps that made each row's heaviest element its least informative one, and the header 40px above already stated both values. Reported in #7125 with a 20-character agent name over one-line steps; invisible with a short name and long bodies. Drop the block. The existing `bg-success` rule is what marks prose as the agent speaking, and it says so in 2px instead of 48px. Prose promotion is unaffected: that comes from `RichContent` at reading measure staying expanded, not from the avatar. `agentName`/`agentId` were only ever read by `ProseRow`, so the props come off `TranscriptRowProps` too. This restores the pre-#7011 identity behaviour (header only) while keeping everything else that redesign introduced. Co-authored-by: multica-agent <[email protected]> * fix(transcript): give the Agent facet a glyph its rows carry (MUL-6333) Dropping the per-row avatar and name left prose as the only step kind with no mark at all: tool rows print their tool name, thinking and error rows print their kind, and prose printed nothing. So the `Agent` facet in the filter named a set of rows the reader could not pick out — you had to select it to find out what it meant. `StepIcon` already returned a `Bot` glyph for the text kind; nothing rendered it, because `ProseRow` skipped the icon column entirely. Render it. That is the kind mark, not the identity: it says "the agent's own words", which is exactly what the facet selects, and it costs 12px in a column every other row already fills — so prose bodies now align with tool labels instead of hanging left. Carry the same glyph into the filter menu so each facet looks like its rows, and stop labelling tool facets with the raw `tool:Bash` key while the rows they select say `Bash`. The key is unchanged — it is what persists — only the label is. That mislabel predates the rebuild (it goes back to #4884); it is fixed here because it is the same "the filter does not say what it selects" defect. Co-authored-by: multica-agent <[email protected]> --------- Co-authored-by: J <[email protected]> Co-authored-by: multica-agent <[email protected]>	2026-08-18 15:01:32 +08:00
3 people	2a643cc740	MUL-6291: stop paying for jsdom in pure-logic frontend suites (#7081) ... MUL-6291. Vitest's own breakdown for `@multica/views` showed the shape of the problem: environment 633s and import 644s against only 508s of actual test execution. Two thirds of a cold frontend-test run went on building a jsdom per file and importing its module graph, not on running assertions. - 94 pure-logic `.test.ts` files across views/web/desktop now declare `// @vitest-environment node`. Measured on the 45 converted views files: environment 53.15s -> 4ms, wall 8.72s -> 2.03s. Candidates were picked by module-graph analysis (skipping type-only imports) and rejected when the code under test branches on `typeof window`/`document`, where node would silently take the SSR path and still pass; the remainder were verified empirically and reverted where they failed. - The three jsdom setup files bail out when there is no DOM, so a node-env suite can share them. - schedule-editor: the pure state transitions (isFullDay, displayWindow, timeAnchorOf, defaultAtTime, defaultEveryTime, clampWindow, toggleDay) move out of the component into transitions.ts, with the full combination matrix as a table-driven node-env suite. 34 cases in 3ms, replacing four DOM mounts. - Cross-layer duplicates removed where a canonical layer already owns the matrix: originSourceUrl (skills/lib/origin.test.ts) was re-run through the refresh dialog and the detail page; needsSourceBackfill (core/onboarding/needs-backfill.test.ts) through the backfill modal. Each component keeps one wiring case naming the canonical file. No behaviour change: the transitions extraction is a pure move, and every removal names where the same contract is still covered. Co-authored-by: Bohan-J <[email protected]> Co-authored-by: multica-agent <[email protected]>	2026-08-17 18:40:19 +08:00
3 people	9d6c0c81e0	MUL-6254: recover auth after transient Desktop startup failures (#7058) ... * fix(auth): recover transient desktop startup failures Co-authored-by: multica-agent <[email protected]> * fix(auth): address recovery review feedback Co-authored-by: multica-agent <[email protected]> * fix(auth): harden web recovery states Co-authored-by: multica-agent <[email protected]> * fix(auth): centralize workspace readiness Co-authored-by: multica-agent <[email protected]> * fix(auth): polish workspace recovery Co-authored-by: multica-agent <[email protected]> * fix(desktop): align workspace readiness after main merge Co-authored-by: multica-agent <[email protected]> * fix(views): clear transcript copy feedback timers Co-authored-by: multica-agent <[email protected]> --------- Co-authored-by: Sol-Boy <[email protected]> Co-authored-by: multica-agent <[email protected]>	2026-08-17 16:59:55 +08:00
3 people	09cd442c62	fix(views): settle the run timeline's scrollbars so hovering a bar cannot shake it (#7067) ... The two-lane strip gave itself 3px of horizontal and 2px of vertical scrollable overflow, which is enough to summon both scrollbars onto 50px of track. Each one changes the box that decides the other, so the layout has two answers and no fixed point; a `:hover` inside re-runs the decision, and the strip flips between 69px and 80px tall for as long as the pointer rests on a bar. Long runs hit it because their trailing segment is a sliver — that is the bar whose 3px minimum lands past 100%. Remove both overflows: clamp a segment's offset by its own width so a widened sliver stays on the axis, and pin `overflow-y` to hidden, since zoom scrolls the track sideways and nothing ever scrolls it down. Co-authored-by: Bohan-J <[email protected]> Co-authored-by: multica-agent <[email protected]>	2026-08-17 16:57:26 +08:00
3 people	42dbf60dc8	feat(views): rebuild the run trace around steps, lanes, and outcome (#7011) ... * feat(views): rebuild the run trace around steps, lanes, and outcome The transcript rendered the raw event stream: a tool call and its result were two rows, so a 75-call run listed 150 lines and the result line was where raw base64 screenshots and 8KB command dumps landed. The bar above it sized its segments by event count, not time, so a 28-minute run drew a barcode that answered nothing. Agent prose — the one thing worth reading — rendered at the same weight as a `Read`, and three density modes existed to compensate. Four layers now, one expanded at a time: - Header keeps status, agent, trigger, duration and spend. - Outcome row names what the run produced: files touched with +/- counts, commands run, delivered branch. Derived from calls we already persist; no comment count, which would have to be guessed from command text. - Two lanes (model / tools) on a real wall-clock axis, each carrying its own total. Model turns and tool calls never overlap in an agent loop, so on one row they could only occlude each other; split, "was it the model or the commands" reads without hovering. The lane pair costs the vertical space the old single track did, and short runs (< 8 steps or < 60s) skip it entirely. - Steps: one call per row with its result folded in, consecutive same-tool calls grouped, prose promoted to body text, and detail in an inspector that opens on selection rather than splitting the surface up front. Pairing is positional because the events carry no call id: `agent.Message` has `CallID` down to the daemon, but `TaskMessageData` drops it before the report and `task_message` has no column for it. A result belongs to the oldest open call with the same tool name until that lands. Colour carries state, not taxonomy — the token set has one blue lightness ramp and no categorical palette, so the lane says what kind of work it was and colour is spent on delivered and failed. Removes the density preference: agent prose reads open and tool calls fold, so the setting has nothing left to switch. Co-authored-by: multica-agent <[email protected]> * fix(views): keep shell commands unfolded and name what a group touched Screenshotting the real surface with a seeded 28-minute run showed two things the fixtures could not. Five consecutive `Bash` calls folded into "Bash · 5 calls", hiding `pnpm typecheck`, `pnpm exec playwright test`, `pnpm lint` and the commit behind one line — the commands are exactly what a reader opens a run for, and the group's duration spanned the model time between them, reading as one ten-minute command. Shell calls no longer group, keyed on the input carrying a `command` string rather than a tool-name allowlist. A folded group also showed only its tool and count, so "Read · 4 calls" said nothing about which files. It now leads with the first call's argument, which is what the approved design showed. Co-authored-by: multica-agent <[email protected]> * feat(views): make the run timeline zoomable and horizontally scrollable Fit-to-width is the right default but it is a lie about short calls: across a 28-minute run, a 2-second command is under a pixel and only renders at all because of the 3px floor. Anything a reader wants to inspect at the tail of a long run is a sliver. The track now scrolls. Zoom steps 1x/2x/4x/8x stretch the lane content past the container while the lane labels stay pinned — a total that scrolls away is a total you cannot read against its bars. Tick density scales with zoom so the axis keeps its on-screen spacing instead of thinning out, zooming holds whatever was under the viewport's centre, and selecting a step scrolls its playhead into view. The control sits out of the way until hovered, and stays visible once zoomed so the way back is never hidden. Also answers "is two lanes all there is": the tool lane's time now breaks down by what the calls did (commands / edits / reads / other) in the lane's tooltip. It stays a tooltip rather than three more lanes because in a real run one kind dominates by orders of magnitude — a lane per kind would draw three near-empty tracks to say what one line of text says. Co-authored-by: multica-agent <[email protected]> --------- Co-authored-by: Lambda <[email protected]> Co-authored-by: multica-agent <[email protected]>	2026-08-15 21:13:39 +08:00
3 people	c9727e6b2b	feat(daemon): worktree mode for local_directory resources (MUL-5707) (#6759) ... * feat(daemon): worktree mode for local_directory resources (MUL-5707) Local directory resources serialise every task on a per-path mutex, so two tasks on one folder queue behind each other. This adds an opt-in worktree mode: each task gets its own git worktree of the user's repo inside the daemon's env root, so tasks run concurrently and deliver their work as a branch instead of editing the user's working copy. Opt in per resource with execution_mode=worktree (default stays in_place, so existing resources are unchanged). Requires a git repo with at least one commit; a non-git directory fails with an actionable message rather than silently falling back to serial execution. Design points that make the mode safe to use: - The agent starts from what the user sees, not HEAD. Tracked edits are captured with `git stash create` (which writes a commit object without touching the index, working tree, or stash list) and replayed into the worktree; untracked non-ignored files are copied, bounded at 2000 files / 200MB with the skipped count logged at warn level. - That replayed state is committed as a baseline, so "did this task change anything?" has an exact answer and `git diff <baseline>..<branch>` is precisely the agent's work. - Nothing is silently discarded: leftovers are committed to the branch before the worktree is removed, including when the task fails partway. - A task that changes nothing leaves no branch behind. - Sidecars stay out of the branch by running the existing CleanupRuntimeConfig + CleanupSidecars pass over the worktree before finalizing. The .git/info/exclude approach repocache uses is not usable here: a linked worktree resolves info/exclude to the user's own common git dir, so it would change what `git status` hides in their checkout. - Worktree-mode env roots do not get the local_directory GC exemption, so they age out normally instead of accumulating one env root per task. - `git worktree prune` on create self-heals registrations orphaned by a crashed daemon. Adds --execution-mode to `project resource add/update`, and updates the docs and the projects-and-resources built-in skill. Co-authored-by: multica-agent <[email protected]> * fix(daemon): close data-loss and isolation gaps in worktree mode (MUL-5707) Review follow-up on #6759. Six issues, all on failure or skew paths. 1. Preserve work when the final commit fails. Finalize logged a warning and then ran `git worktree remove --force`, destroying the agent's changes. commit.gpgSign with no key available to the daemon triggers this, and --no-verify does not disable signing. Finalize now returns an error and deliberately keeps the worktree — it stays registered, so `git worktree list` points at the work — and the daemon fails the task instead of reporting success with a branch that is missing the changes. 2. Fail closed on an unsupported execution_mode. Treating an unknown mode as in_place was wrong: execution_mode is how a user asks for ISOLATION, so the "safe" fallback would edit the working copy they asked us to stay out of. An unrecognised mode now fails the task naming the version skew. 3. Keep Codex conversations alive across turns. The per-issue session store was keyed on LocalWorkDir != "", so worktree tasks — which also never reuse an env root — got a fresh empty CODEX_HOME per turn and silently lost the thread. Covered by a two-turn regression test that fails without the fix. 4. Fail closed on an incomplete snapshot. A failed stash create/apply, a failed untracked copy, or hitting the copy bounds all degraded to "agent sees HEAD" with only a daemon log line. A half-replayed tree looks like a working checkout, so nothing downstream questions it while the agent reads different code than the user has. All of these now abort the prepare and tear the partial worktree back down. 5. Do not snapshot a directory mid-mutation. The same real path can be attached to another project as an in_place resource; snapshotting under a running in_place task captured a half-written tree plus that task's in-flight .agent_context/.multica sidecars, which then reached the branch and could feed the agent another issue's brief. Worktree prepare now takes the per-path mutex for the snapshot alone (released before the run, so tasks still overlap), and the untracked replay skips Multica's own sidecars. 6. Stop the test helper from masking regressions. gitRun skipped on any git failure, including post-finalize assertions, so a lost branch could report as a skip. Git availability is now checked once at repo setup; every later git failure is fatal. Also rebased onto main, keeping both MulticaConfigRoot and LocalWorktree in the Environment initialiser. Co-authored-by: multica-agent <[email protected]> * fix(daemon): close sidecar-commit and wait-visibility gaps in worktree mode; gate worktree saves on daemon version (MUL-5707) - runTask: register the sidecar-cleanup defer immediately after the Finalize defer. Previously two early returns (temp-dir setup, StartTask failure) sat between them, and on those paths Finalize auto-committed the sidecars Prepare had just written — delivering a branch whose only content is Multica's own runtime files (in_place: leaving them in the user's tree). - runTask: give the worktree snapshot wait the same plumbing as the in-place acquire — waiting_local_directory status, resourceWaitTasks accounting, and a cancellation poller. The holder can be an hours-long in_place task; the wait was invisible and a user cancel went unnoticed until the 5-minute prepare timeout. - isMulticaSidecarPath: match sidecar dirs as whole path segments at any depth, not only at the repo root. An in_place resource pointed at a SUBDIRECTORY leaves its sidecars below that subdirectory; replaying them committed another issue's brief into the delivered branch. - handler: refuse saving execution_mode=worktree while the owning daemon's registered cli_version is below MinLocalWorktreeCLIVersion (422, daemon_version_unsupported). An old daemon json-skips the field and runs tasks IN PLACE — the daemon-side unknown-mode refusal cannot protect a daemon that predates the field, so the server has to. Residual (documented): a daemon downgraded after the save needs a claim-time gate. - copyUntrackedFiles: read the -z listing raw instead of TrimSpace-ing it, which corrupted filenames beginning/ending with whitespace into paths that silently vanished from the replay. - docs + skill: describe the save-time version gate; drop the stale claim that old runtimes fail the task themselves. Co-authored-by: multica-agent <[email protected]> * feat(views): UI switch for local_directory execution mode (MUL-5707) Worktree mode shipped CLI/API-only, which for its target user — someone running several tasks at once from Desktop — means it does not exist. This adds the switch to the resources panel. The choice is framed by what the user gets back, not by the mode identifiers: "Edit this folder directly" (one task at a time, changes land in your working copy) vs "Run in parallel, isolated" (tasks run at the same time and each hands back an agent/… branch). `in_place` / `worktree` stay visible as a secondary hint for anyone cross-referencing the CLI or docs. Two entry points, matching where the decision is actually made: - The add-a-folder flow now asks for the mode after the folder is picked and validated, instead of creating the resource and leaving the mode to be discovered later. - Every local_directory row has a mode control. It is deliberately NOT gated on being the owning machine — switching the mode only rewrites a field, so it works from the web app too, unlike rename or the folder picker. Both blocked states are handled where the user chooses, not after they commit: - Non-git folder: the desktop validator now reports whether the path is inside a git working tree (walking up for `.git`, so a subdirectory of a repo counts), and the option is disabled with that reason. Unknown — an older desktop build, or an existing row — stays permissive; the daemon re-checks authoritatively. - Daemon too old: the version floor is mirrored from the server as MIN_LOCAL_WORKTREE_CLI_VERSION and checked against the runtime for the resource's OWN daemon, not the machine the browser happens to be on. A server rejection is rendered inline in the dialog rather than as a toast, so the dialog stays actionable. A "Parallel" badge on the row is always visible (not hover-only): without it there is no way to tell whether tasks on a folder edit it directly or hand back a branch, which is the first thing anyone asks when a task queues. Also adds `execution_mode` to LocalDirectoryResourceRef — the field existed server-side but had no TypeScript counterpart — and brings the zh/ja/ko project-resources docs in line with the English ones, which were the only locale updated when the mode landed. Co-authored-by: multica-agent <[email protected]> * fix(daemon,handler): close worktree isolation and delivery gaps (MUL-5707) Second review round. Five must-fix items, all on paths where the mode's promises could still break. 1. A failed sidecar cleanup no longer ships Multica's own files as the user's branch. The cleanup errors were logged and Finalize then ran `git add -A`, so a permission/disk/lock failure could deliver a branch whose entire content was the runtime brief and issue context. Worktree mode now escalates a cleanup failure to an abort: nothing is committed, the worktree is kept for inspection, and the task fails with the preserved path. In place it stays a warning — no commit, no branch, and the leftovers are visible in the user's own tree. 2. The untracked replay no longer drops files silently. `Lstat` failures and symlinks were `continue`d without counting, so the caller read a partial snapshot as complete. Both now count as skipped, which the existing fail-closed check turns into a refused prepare. Non-content entries (sockets, FIFOs, devices) stay uncounted deliberately. 3. Prepare rolls back a worktree it created. Any later failure — context files, provider home, MCP config — returned without an Environment, so nothing downstream knew a worktree existed, leaving a registration and a branch no task ever ran in. A deferred Discard now runs unless Prepare reached its successful return. 4. The daemon-version gate moved to where it can actually hold. Save-time validation cannot see a machine downgraded afterwards, and an old daemon json-skips execution_mode entirely — it would run the task in place, editing the working copy the user asked to isolate. Claims are now checked against the runtime that is actually claiming, and a blocked task is cancelled with a reason rather than left to be redelivered to the same too-old runtime forever. 5. branch_name is delivered end to end. The daemon sent it, but TaskCompleteRequest had no field so it vanished at decode, and the failure path never sent it at all. It now has a column, travels on both terminal callbacks, and renders as a copyable row in Run details. The failure path matters most: worktree mode commits the agent's leftovers before tearing the worktree down, so a run that died partway still has work worth finding. Docs (all four locales) and the projects-and-resources skill are updated for the claim-time gate and the branch surface. Co-authored-by: multica-agent <[email protected]> * fix(handler,daemon): migration renumber, cancel reasons, branch on every terminal path (MUL-5707) Third review round. 1. Rebased onto main and renumbered the migration to 285 — main had taken 273 and is now at 284. sqlc regenerated on top of the rebased queries; the conflicts were confined to generated files. 2. The claim gate now persists why it cancelled. It called CancelTask, which writes only status='cancelled', and returned the reason as a 4xx that reaches the daemon's log and nothing else — batch claim drops the task from its response entirely. A run refused for a durable reason the user has to act on cannot present as a bare "cancelled", so this adds CancelAgentTaskWithReason and records error + failure_reason on the row. 3. branch_name now survives every terminal path, not just the two direct callbacks. Three were dropping it: - the context-exhausted complete→fail reroute did not copy it; - the daemon's complete→fail fallback (server rejected the complete, agent had succeeded) did not set it; - both cancellation paths discarded the result wholesale, even though the worktree is finalized — and its work committed — before the daemon learns of the cancel. The branch now rides the cancel-ack and is recorded by SetAgentTaskBranchName, which never overwrites a name a terminal callback already wrote. 4. Rollout/rollback compatibility. Isolation is enforced by two server-side gates, so a daemon downgraded at any point after the resource was saved is caught. The gap they cannot close is rolling the SERVER back past this change while sub-floor daemons are still connected: an old server has no gate and an old daemon ignores execution_mode. That constraint is now documented where an operator will meet it (the migration and the docs), and the version floor is pinned across server and frontend by test so the two gates cannot silently drift apart. Co-authored-by: multica-agent <[email protected]> * fix(server,views): route claim-gate cancels through TaskService, make cancel reasons visible, harden cancel-ack branch delivery (MUL-5707) Closes the fourth-round review findings on worktree mode's cancellation chain: - Claim gate: cancel through a new TaskService.CancelTaskWithReason instead of a raw CancelAgentTaskWithReason query, so a gate-cancelled task gets the full cancellation side effects — audit capture, chat settle, agent status reconcile, task:cancelled broadcast, NotifyTaskFinished. Added REAL claim integration tests: singular claim (422 + row cancelled with reason), batch claim (task omitted + row cancelled with reason), and a current-runtime control. - Cancel reasons are now user-visible: execution log rows, agent activity rows, and the transcript dialog label a SERVER-cancelled task (persisted error/failure_reason) like a failed one, with the actionable text on hover and a Reason row in Run details. User-initiated cancels stay a plain "Cancelled". New cancelReasonLabel helper + local_directory_error label; details_reason locale key in en/zh-Hans/ja/ko; widened AgentTask.failure_reason to the open string the wire actually carries. - Cancel-ack is now a terminal delivery: the daemon retries it on transient errors (same schedule as complete/fail), the server fails LOUD (5xx) when persisting the branch/error fails instead of warn-and-200, and re-broadcasts task:cancelled after a successful write so clients that already refetched a branchless row pick up the delivery. Replays are idempotent (never overwrite). - Cancel + Finalize-abort no longer swallows the preserved-worktree pointer: the finalize error is wrapped in worktreePreservedError (joined onto an existing run error, never displacing it), extracted on the cancel path, and delivered via the ack into agent_task_queue.error through the new SetAgentTaskErrorIfEmpty query — never overwriting a reason recorded by a fail callback or the claim gate. Other run errors on a cancelled run stay discarded as before: they are expected noise. - Docs: the self-hosted rollback constraint callout now exists in zh/ja/ko, not just English. Co-authored-by: multica-agent <[email protected]> * fix(handler): guard cancel-ack writes to cancelled rows; requeue when the claim gate's cancel fails (MUL-5707) Fifth-round review fixes: - SetAgentTaskBranchName / SetAgentTaskErrorIfEmpty now carry a status='cancelled' CAS. The daemon acks on EVERY terminal status it observes, so a late or replayed ack from a stale run could previously backfill its branch or preserved-path error into a completed/failed row whose own callback — the authoritative channel — recorded nothing, without any event invalidating the change. A CAS-refused write is a deliberate no-op (still 200: nothing to retry), and the rebroadcast stays guarded by the same status check. Regression tests: a late ack against a completed row with empty fields and against a failed row leaves both untouched. - When the worktree claim gate's CancelTaskWithReason fails, the claimed row no longer strands in dispatched (daemon refused, nothing to release it but stale reclaim). The gate requeues via RequeueTaskAfterClaimFailure — the next claim re-runs the gate and retries the cancel — and reports 5xx so the singular daemon reads a transient server problem, not a claim refusal; the batch path omits the task as before, now with the row requeued. Fault injection tests (row-scoped trigger raising on the cancel UPDATE while letting the requeue through) cover singular and batch. Co-authored-by: multica-agent <[email protected]> --------- Co-authored-by: Bohan-J <[email protected]> Co-authored-by: multica-agent <[email protected]>	2026-08-13 14:52:01 +08:00
feigandBohan-J	3dd128532c	feat(agent): add oh-my-pi (omp) as a supported agent runtime (#6514) ... * feat(agent): add oh-my-pi (omp) as a supported agent runtime oh-my-pi (omp, https://omp.sh) is a separate CLI that is a drop-in fork of pi and speaks the same JSON event protocol. It is registered as an independent provider so a host with both pi and omp installed gets two runtimes instead of one. omp is a runtime identity on the pi protocol, NOT a new protocol family. It is declared in a single BuiltinRuntimes descriptor (server/pkg/agent/builtin_runtimes.go) that carries id, protocol_family, default_command, env_prefix, display_name, skills_dir, user_skills_dir, launch_header, backend overrides, and model_discovery strategy. Every consumer (agents_probe.go, config.go, daemon.go, execenv/context.go, local_skills.go, agent.go New/LaunchHeader, models.go ListModels) derives from this descriptor — no per-file hardcoded omp special cases. NewRuntime() is the typed entry point for runtime identities: it resolves id → descriptor → protocol family backend → applies overrides through a backendOverrideApplicator interface (piBackend implements it). New() delegates to NewRuntime() for built-in runtime identities, keeping New() meaning exactly one thing: the protocol-family factory. Model discovery: parseOmpModels reads the real {"models":[...]} wrapper with separate provider/id/selector/name fields. Model.ID is the selector (provider/id), matching parsePiModels' convention so buildPiArgs emits both --provider and --model — not just --model. A regression test (TestOmpSelectorSurvivesToBuildPiArgs) pins this end-to-end. Frontend: provider-logo.tsx maps omp to PiLogo. The transcript dialog uses the shared providerDisplayName helper. Landing copy updated to 21 tools in all 4 locales. Tests (omp_test.go): descriptor dispatch, NewRuntime entry point, binary resolution, omp-labeled errors, event-stream completion, pi+omp side-by-side registration, selector→buildPiArgs regression, model parser coverage (real JSON/empty wrapper/invalid stderr/duplicate), and a guard that every descriptor field is non-empty and consumed. Closes #3989 * fix(views): keep Claude Code label in the transcript run details Switching the provider row to the shared runtime formatter renamed every Claude run: the daemon has no display-name override for claude, so the shared formatter answers "Claude", and the legacy claude-code value title-cased into "Claude-code". Both read as "Claude Code" before. Keep those two aliases in a table local to this view and defer everything else to the shared formatter, so the row stays in lockstep with the runtime list (#5260) without renaming Claude runs. * test(daemon): assert pi and omp both reach the register payload The existing omp test stopped at probeAgentCLIs, so nothing covered the part a user actually sees: whether both runtimes are registered with the server, each under its own display name. Discovery finding two entries and New() building two backends both stop short of version detection and the registration payload. Add a daemon-level test that runs real discovery off a fake PATH, drives syncWorkspacesFromAPI, and asserts the payload carries type=pi and type=omp with names "Pi" and "Oh-My-Pi". Rename the discovery test to say what it covers, and record the registered display name in the batch fixture so the name can be asserted. * docs(agent): correct descriptor comments that describe the old behaviour Three doc comments still described behaviour the fail-closed rework replaced: - ModelDiscovery claimed a nil strategy falls back to the family's discovery; ListModels deliberately returns an empty catalog instead, because omp exits non-zero on pi's --list-models. - backendOverrideApplicator claimed backends without it are returned unchanged; NewRuntime returns an error rather than dropping the descriptor's executable and label. - ProtocolFamily credited New() with applying the ID-specific defaults; that moved to NewRuntime. Also repair the truncated first sentence of the NewRuntime doc, and fix discoverOmpModels still calling the output a JSON array when parseOmpModels right below it documents the {"models":[...]} wrapper. * style(server): gofmt the files this branch touched Four files were left unformatted: the descriptor literal and the omp test struct lost their key alignment, execenv/context.go had its new import out of order, and local_skills.go kept the old indentation after its switch moved inside an if/else. Whitespace only — no behaviour change. --------- Co-authored-by: Bohan-J <[email protected]>	2026-08-10 16:34:07 +08:00
3 people	ba129b1963	feat(issues): show per-run token usage on the execution log (MUL-5762) (#6440) ... * feat(issues): show per-run token usage on the execution log (MUL-5762) The execution log already lists every agent run on an issue; it just never said what any of them cost. task_usage has held per-task token counts since migration 032 — nothing surfaced them per run. Three placements, one data source: - Execution-log header carries the issue total ("2.1M · $4.92") and opens the breakdown. - Each row carries its own token figure. This takes the slot the relative timestamp held: the sidebar is 288px and a third column would come out of the trigger text, which is what people scan. The list is sorted newest-first, so ordinal recency is already free; the timestamp moves into the row tooltip alongside duration and model, neither of which was surfaced there before. - The transcript dialog gets the same figure in its header, with the input/output/cache split in the run-info popover. Backend: ListIssueTaskUsage returns per-(task, provider, model) rows in one query, joined onto the existing task-runs response. The model dimension stays on the wire because cost is priced client-side per model — a row that collapsed two models cannot be priced at all. Cost reuses estimateCost from the runtime usage page, so the issue and the workspace never disagree; the new summarizeTaskUsage helpers live next to it rather than starting a second cost formula. No usage recorded stays distinguishable from zero end to end — omitted on the wire, undefined in the schema, null from the summarizer, an em dash in the UI. A run from before usage reporting was not free. Removes the standalone "Token usage" sidebar section: it showed the same issue totals minus the cost and minus any way to attribute them, and every field it had is in the dialog. The /api/issues/:id/usage endpoint it read stays — the CLI's `issue usage` still uses it. Co-authored-by: multica-agent <[email protected]> * fix(issues): address review on per-run token usage (MUL-5762) Three findings from @Emacs, all confirmed against the code: 1. Drop the token figure from active rows. The daemon reports usage once, after `runner.run` returns (internal/daemon/daemon.go), and ReportTaskUsage publishes no realtime event — so a running task has no usage to show and would not learn of it mid-run if it did. The branch was only ever exercised by a hand-written fixture, which is a test asserting a scenario production cannot produce. The row keeps its timer; restore the figure in the same change that adds incremental reporting + cache invalidation. 2. Subscribe the usage surfaces to the custom-pricing store. estimateCost reads custom rates imperatively via getCustomPricing(), so nothing re-rendered these after a saved rate change — the header total, the dialog's totals and per-run costs, the cost-by-agent split, and the "unmapped model" notice all kept quoting the old price until the task list happened to refetch. Same subscription the runtime usage page already carries, plus the snapshot in every memo that prices usage. Regression test pinned: it fails without the subscription. 3. Give the dialog's status glyph an sr-only label. TaskStatusIcon is aria-hidden, so a screen reader could not tell a failed run from a completed one — the execution log rows already pair the two. Co-authored-by: multica-agent <[email protected]> --------- Co-authored-by: Lambda <[email protected]> Co-authored-by: multica-agent <[email protected]>	2026-08-05 19:14:33 +08:00
feig	e422b169a8	MUL-5415: fix(issues): keep running-agent transcript open ... Closes #6053	2026-08-04 13:58:55 +08:00
3 people	9c90327ce4	fix(ui): replace the text-transparency ladder with solid tones (MUL-5452) (#6152) ... * fix(ui): replace the text-transparency ladder with solid tones (MUL-5452) Hierarchy was being expressed with transparency: 152 call sites of text-muted-foreground/30..80, 26 of text-foreground/60..90, plus a handful on destructive and current, and a few written as a standalone opacity-* utility instead of a slash alpha. On light surfaces every muted variant failed WCAG AA - /80 reached only 3.78:1 and /40 sat at 1.80:1, below even the 3:1 floor for non-text - because the palette had no step below --muted-foreground, so transparency was the only tool for 'quieter than muted'. The palette now has that step, and it is deliberately non-text: --faint-foreground clears 3:1 (WCAG 1.4.11) on every surface for icons, chevrons, separator glyphs and empty-cell em dashes. There is no room for a third readable text tone - AA caps a lighter text tone 0.018 L away from muted - so text keeps exactly one floor, --muted-foreground. Also fixes text-destructive/70 on a cron error message, which was 3.61:1. This branch changes zero font sizes. The sub-12px half of the issue is MUL-5451's (#6136); keeping the two apart is what makes this one reviewable on its own after #6108 was reverted. apps/web/app/text-contrast.test.ts replaces muted-foreground-contrast.test.ts rather than sitting beside it. It recomputes the floors from tokens.css instead of hard-coding ratios, and fails the build on all four ways to spell the defect: /70, /[0.5], /[50%], and a detached opacity-* in the same class string. Transparency behind hover/focus/disabled stays allowed - the resting state carries the contrast obligation and it is solid. Co-authored-by: multica-agent <[email protected]> * fix(ui): correlate transparency across a whole class expression Review found two ways past the guard, both real. A per-literal check cannot see cn("… text-muted-foreground", suppressed && "opacity-60") - one element wearing a colour in one argument and a dim in the next. That split shape is the common one, and it was hiding live violations: the comment trigger chips dimmed aria-pressed label text to 2.55:1 while the sweep reported clean. The second was my own exemption. Accepting any state word within 80 characters let "text-muted-foreground hover:text-foreground opacity-50" through, because the hover: belongs to the colour, not to the opacity. The detector now correlates across a whole cn() call or template literal, splits it into segments that each carry their own condition, and exempts only on the variant prefix the opacity utility itself carries or on the condition governing its segment. Segment splitting is what keeps ${disabled ? "opacity-60" : ""} exempt while flagging its neighbours. Fixed what that surfaced: three trigger-chip controls (the suppressed state is already carried by the avatar's own grayscale, the sentence wording and a solid muted step), a disabled-skill icon chip, and the diff gutter marker. tab-bar's isDragging is exempt - a drag ghost is an in-flight gesture, the same category as :active. The detector now has its own table of thirteen cases. Every hole so far has been silent, so the shapes it must and must not catch are pinned next to the reason each one exists. Co-authored-by: multica-agent <[email protected]> * test(ui): cover the faint tone in the cn() merge regression test text-faint-foreground is a new text-<x> class, which is the exact shape that silently broke the sidebar labels in #6108: tailwind-merge cannot tell a size from a colour and drops one of them. The token does resolve correctly today - verified both orders against a size step and against another colour - but the test that exists to catch this was not covering it, so the guarantee rested on nothing. Co-authored-by: multica-agent <[email protected]> --------- Co-authored-by: Lambda <[email protected]> Co-authored-by: multica-agent <[email protected]>	2026-07-30 18:27:38 +08:00
3 people	999e9f93c7	fix(codex): record file edit payload for patch_apply events (#6158) ... * fix(redact): scrub secrets nested inside tool input maps and slices InputMap only passed top-level string values through Text and documented non-string values as "preserved as-is". Any secret one level down reached the database and the WebSocket broadcast untouched: flat -> [REDACTED ...] (scrubbed) nested -> [map[diff:token=ghp_... path:a.go]] (leaked verbatim) This is a prerequisite for recording structured file-edit payloads. Codex reports an edit as changes[]{path, diff, content}, and the legacy protocol reports a deletion as the whole outgoing file — so without this, deleting a .env would persist its full contents in cleartext. redactValue now walks the composite shapes json.Unmarshal produces, plus []string and map[string]string for argv-style inputs. Composites are copied rather than scrubbed in place, because the caller keeps using the map it passed in. Nesting depth comes from daemon-supplied JSON, so the walk is bounded at 32 levels; a pathologically nested payload would otherwise recurse until the stack blows. Hitting the bound yields a placeholder rather than the raw value, keeping the fail-safe direction. Verified: the five new tests each fail against the previous top-level-only implementation and pass now; full ./pkg/redact suite green. Co-authored-by: multica-agent <[email protected]> * fix(codex): record file edit payload for patch_apply events Both Codex protocol paths recorded a file edit as a bare call ID and set no payload, so a run that edited six files left six blank, unexpandable rows in the transcript. The same task on Claude or Grok showed a readable diff, and the branch Codex pushed was the only surviving record of what it changed (GH #6157). The omission was specific to this one tool, not to the adapter: the exec_command handlers directly above already captured command and output. Both paths are fixed, since the protocol is sniffed at runtime. Their wire shapes differ more than they appear, and the normalizer reconciles that: - legacy patch_apply_begin/end carry map[path]FileChange, internally tagged on `type`, where add/delete hold whole-file `content` and only update holds a `unified_diff` plus `move_path`. There is no diff for every case, so the normalized form keeps diff and content as alternatives. - v2 fileChange items carry an ordered array of {path, kind, diff} where `kind` is an object, not a string — reading it as a string silently yields "" and loses the add/delete/update distinction. - status spellings differ too: legacy is snake_case, v2 is camelCase and adds inProgress. Both normalize onto one vocabulary, and a legacy event predating `status` falls back to its `success` bool. Legacy map iteration is sorted by path so a replayed event does not reshuffle the file list. Completion events now also produce a non-empty output (status, file count, and any apply_patch stdout/stderr), because an empty output renders as an unexpandable blank row just like a missing input. Anything unrecognised — absent, wrongly typed, or malformed changes — returns no payload, preserving exactly the previous degradation rather than risking the transcript. Total diff/content bytes are bounded at 64 KiB with UTF-8-safe truncation, recording `truncated` and `original_bytes`; paths and kinds always survive, since they are what a reviewer needs when the body is gone. The bound is deliberately scoped to this new payload: other providers stream tool inputs through unbounded, and clamping them here would silently truncate transcripts that render correctly today. Unifying the limit at the persistence boundary is left as a follow-up. Verified: the new tests reproduce the reported symptom (Input:map[], Output:"") against the previous call sites and pass now; ./pkg/agent and ./pkg/redact green, go vet and gofmt clean. Co-authored-by: multica-agent <[email protected]> * feat(transcript): render Codex multi-file patch payloads as diffs The presenter identified an edit by input shape — a top-level file_path plus old_string/new_string or content — which is Claude's and Grok's shape. Codex records one patch_apply covering several files as changes[], so even with the payload now populated it fell through to pretty JSON instead of a diff. A new `patch` detail kind carries one entry per file, since collapsing them into a single body would lose which change belongs where. Each file reuses the existing single-file surfaces, so all bodies behave alike inside the virtualized list. Codex hands over a ready-made unified diff, so parseUnifiedDiff maps it onto diff rows rather than recomputing one — there is no before/after pair to compare, and reconstructing both sides from the diff just to diff them again would be circular. Hunk headers become `gap` rows, which is what they denote: skipped unchanged content. A deletion renders as all-removals rather than as a whole-file write, because the legacy protocol reports it as the outgoing file's content and a green "+N" gutter would state the opposite of what happened. The collapsed row needed its own fix: with no single path field, the summary fell through the preference chain and came back empty. It now reads as the first path plus "+N more". Anything that is not this shape still falls back to pretty JSON, so a payload this presenter does not understand stays readable. Verified: 17 new tests (43 in the presenter suite) pass; repo typecheck and lint clean. The one failing views test, layout/sidebar-resize, fails identically on an untouched checkout. Co-authored-by: multica-agent <[email protected]> * fix(codex): route v2 add/delete payloads as content, not diff Addresses review on #6158. Upstream's format_file_change_diff only produces a unified diff for `update`. For `add` and `delete` it returns the whole file's contents under the same `diff` field, and for a moved `update` it appends a trailing "\n\nMoved to: <path>" line: FileChange::Add { content } => content.clone(), FileChange::Delete { content } => content.clone(), FileChange::Update { unified_diff, move_path } => ... (codex-rs/app-server-protocol/src/protocol/item_builders.rs, rust-v0.145.0) Recording that as a diff mislabels every line of an added or deleted file as context, and actively inverts any line whose content begins with '+' or '-' — so an added file containing "-minus lead" rendered as a deletion. The payload is now routed by `kind` rather than by field name, and the "Moved to:" sentence is stripped since move_path already carries the destination. The previous v2 tests hid this by using a fixture the real protocol never emits (an `add` carrying "@@ ... +package main"). They now use upstream's shape, plus cases for delete, an empty add, and an add whose contents look like diff headers. Empty bodies are also kept on both paths: presence of the field, not its non-emptiness, decides whether a body was reported, so an empty added file renders as an empty body instead of "no content reported". Verified: the new assertions fail against the previous normalizer — where an `add` came through as {"diff": "package main\n"} — and pass now. Co-authored-by: multica-agent <[email protected]> * fix(transcript): stop treating header-like content lines as file headers Addresses review on #6158. parseUnifiedDiff matched "---" / "+++" / "diff --git" / "index " at any position, so a changed line whose *content* starts with a dash or plus was silently discarded: parseUnifiedDiff("@@ -1 +1 @@\n--- old markdown\n+++ new markdown\n") // before: [{ kind: "gap", ... }] — both changed lines gone A removal of "-- old markdown" is spelled "--- old markdown" on the wire, so this hit Markdown rules, embedded patches, and comment banners. File headers only exist ahead of the first hunk, so they are only recognised there; once inside a hunk every line is parsed strictly by its first character. Also localizes the multi-file summary count, which was hardcoded English and so leaked into the zh-Hans / ja / ko transcript rows. The presenter owns no React and no i18n by design, so the phrasing is injected by the caller rather than imported here, keeping the module unit-testable in isolation; the English form remains the fallback. The three Chinese/Japanese/Korean truncation strings now use "..." to match the English source they translate. Verified: both new parser assertions fail against the previous strip-anywhere behaviour and pass now; 47 presenter tests green, repo typecheck and lint clean. Co-authored-by: multica-agent <[email protected]> * fix(daemon): redact nested tool input before it leaves the daemon Addresses review on #6158. Recursive redaction ran only in the server's ingest handler. The daemon built the new nested edit payload and sent msg.Input verbatim, so a daemon that self-updated ahead of the server — or one talking to a server mid-rollout — would ship whole-file edit contents to a peer that does not scrub nested values yet. The legacy protocol reports a deletion as the whole outgoing file, so that window covered a deleted .env in cleartext. Ordering three commits inside one PR is not a deployment barrier, and daemon and server upgrade independently. Deployment order is not a control we have, so the sending side is now safe on its own; the server keeps redacting on ingest as the second line of defence. Scoped to Input, which is the field this PR newly fills with file contents. Content and Output are plain strings already redacted server-side, and changing their daemon-side handling would be unrelated to this fix. Verified: the new daemon test asserts the nested token is masked in the reported batch while the change metadata survives. It fails without this change, reporting the full GITHUB_TOKEN= line on the wire, and passes with it; ./internal/daemon green. Co-authored-by: multica-agent <[email protected]> * fix(transcript): correct the Chinese multi-file patch count semantics Addresses review on #6158. The summary is handed the number of files *beyond* the named one, but the Chinese phrasing stated a total: "a.go 等 2 个文件" reads as two files including a.go, so a three-file patch under-reported by one. English hides the distinction ("+2 more"), which is why it survived the first pass. Rewords zh-Hans to "另有 N 个文件". Japanese (他) and Korean (외) already read as "besides", so their wording is unchanged. Also renames the interpolation variable from `count` to `extra`, for two reasons. i18next treats `count` as the plural selector — this very namespace relies on that for events_one/events_other — so a plain number had no business borrowing it. And the name is what a translator reads: `extra` cannot be mistaken for a total the way `count` was. Guards the whole bug class rather than just this string: a locale test asserts every locale interpolates {{path}} and {{extra}} and never the reserved {{count}}, and a presenter test pins that the injected number is the count of additional files, not the total. Verified: both new locale assertions fail against the reverted string and pass now; rendering the real locale strings for a three-file patch yields "+2 more", "另有 2 个文件", "他 2 件", "외 2개". 53 target tests pass, repo typecheck clean, views lint back to its pre-existing 16 warnings and 0 errors. Co-authored-by: multica-agent <[email protected]> * fix(transcript): put the patch surface on the type scale Addresses review on #6158. The patch surface wrote text-[10px] / text-[11px] / text-[10px], copied from the sibling transcript surfaces as they looked when this branch started. Since then MUL-5451 (#6136) introduced a role-named type scale and migrated those same siblings to text-micro, so these three call sites were the only remaining arbitrary sizes — and the type-scale guard reports them precisely. All three become text-micro. That matches the analogues they were copied from now that those have moved: the FileWriteSurface line-count row, the DiffDetailSurface header row, and the ToolDetailSurface body. It is also the only correct target, since micro (11px) is the smallest step the scale defines — there is nothing at 10px to map to. Merges origin/main so the guard runs here rather than only in CI. Verified: apps/web app/type-scale.test.ts 13/13 (it listed exactly these three lines before), no `text-[` left in the file, repo typecheck clean, views lint unchanged at 16 pre-existing warnings and 0 errors. Co-authored-by: multica-agent <[email protected]> * fix(codex): redact patch bodies before applying the size budget Addresses review on #6158. The adapter sized and truncated the normalized changes, and redaction only ran later — in the daemon before sending, then again in the server on ingest. That order loses secrets that straddle the budget. The PEM rule needs both markers to match: -----BEGIN[A-Z\s]*PRIVATE KEY-----.*?-----END[A-Z\s]*PRIVATE KEY----- So a 70 KB private key whose BEGIN sits inside the first 64 KiB and whose END falls past the cut stops matching once truncated. Neither later pass can recognise what truncation already broke, so the marker and 64 KiB of key material reach the database and the WebSocket broadcast. Measured on the previous code: stored bytes 65536 | BEGIN marker present | key body present | placeholder absent Redaction now runs first, and the budget measures the redacted bodies — which is also the honest measurement, since those are what actually gets stored and redaction usually shrinks them (that key collapses to 23 bytes, so no trimming is needed at all). `original_bytes` still reports the pre-redaction size so the reader sees how large the real patch was. The daemon and server passes stay as defence in depth; redaction is idempotent, so running three times is safe and that is now asserted. Note for callers: codexPatchInput no longer trims its argument in place, because redaction copies first. Two existing tests were asserting on the caller's original slice and had silently become vacuous; they now read the returned payload, and one pins the no-mutation contract. The delete fixture in the diff-vs-content routing test was also a credential-shaped string, which now redacts — it is plain text so that test keeps testing routing. Verified: the new boundary test fails on the previous order, reporting the surviving BEGIN marker and key material, and passes now. go test ./pkg/agent ./pkg/redact ./internal/daemon green; execenv ByteIdentical green; go vet and gofmt clean. Co-authored-by: multica-agent <[email protected]> --------- Co-authored-by: Eve <[email protected]> Co-authored-by: multica-agent <[email protected]>	2026-07-30 16:01:10 +08:00
3 people	7803a5b9ea	feat(ui): establish a role-named type scale and migrate ad-hoc font sizes (MUL-5451) (#6136) ... tokens.css defined colours, radii and font families but not a single --text-* step, so font sizes had no baseline to align to and grew wherever they were needed: 51 distinct sizes across web + desktop, 370 written as arbitrary values, six at half a pixel (10.5 / 11.5 / 12.5 / 13.5 / 14.5 / 15.5px). text-xs and text-sm carried nearly all UI text while the range between them — 11, 13, 15px — could only be reached with arbitrary values. Hierarchy does not come from having more sizes; past a handful, each extra size makes the hierarchy blurrier. Add ten role-named steps, each with its own line-height so leading cannot fragment the way size did, and move every product-UI call site onto them. Steps are named for what the text is for, not for a t-shirt size, because that is what keeps the scale from drifting again. Six steps deliberately keep the exact size/line-height pairs of the Tailwind defaults they replace, so the ~1,900-call-site rename moves nothing on screen. The visible changes are confined to former arbitrary values snapping to a step: 8/9/10px -> micro (11px) on badges and overlines; 17 -> 18; 22 -> 24; 30 (text-3xl) -> 36 on headings and stat numbers; 12.8px -> label (13px) on small buttons and toggles. Half-pixel sizes are gone. This supersedes #6108, which was reverted by #6116 because the sidebar group labels rendered at the inherited 16px. The cause was not the scale but cn(): `text-<x>` is ambiguous in Tailwind, and tailwind-merge resolves it against a table listing only the default sizes, so it filed every role step under text-colour and dropped whichever of `text-caption` / `text-sidebar-foreground/70` came first. Registering the steps as a font-size class group restores the real conflict groups — size beats size, colour beats colour, the two coexist — and a test pins the list against the scale, since the failure is silent in source. Hand-written CSS is covered too. The transcript kept a 12.5px body long after every Tailwind call site was on the scale, so the "no half-pixel sizes" claim was true of the classes and false of the product; the editor's prose, code and mermaid ramps had the same blind spot, and seven of their eight values already equalled a step exactly. All now reference var(--text-*). The guard test reads raw `font-size:` declarations as well as class names, exempting only the 16px iOS input-zoom workaround in base.css and the landing pages' marketing ramp. apps/mobile (own NativeWind config) and apps/docs (fumadocs' own type system) keep Tailwind's default scale and are untouched. Landing display type (rem/clamp, 2.2-6.4rem) stays on its separate ramp, as do four decorative emoji / serif-hero sizes. Verified on a running local stack: pinned sidebar rows and group labels measure 12px/16px, nav items 14px/20px — identical to pre-migration. An audit of every rendered font size across the product surfaces finds nothing off the scale; the only exceptions are avatar initials and emoji, which actor-avatar.tsx sizes proportionally to the avatar diameter by design. Co-authored-by: Lambda <[email protected]> Co-authored-by: multica-agent <[email protected]>	2026-07-30 13:42:33 +08:00
Larry Lai	da7451843b	MUL-5494: feat(transcript): render tool events as diffs, content and terminal output (#6134) ... * feat(transcript): make tool events readable — diffs, content, terminal output The expanded transcript row printed a tool call's input as raw JSON, so an edit showed `old_string`/`new_string` as escaped one-line literals — the one event type where seeing *what changed* matters most. Tool results kept their JSON string encoding, so every shell result read as a quoted blob with literal `\n`, in the collapsed summary and in Copy all as well as in the body. What each kind of event now renders as: - A replacement reads as a diff. Unchanged runs fold to `⋯` with three lines of context either side, so a one-line change inside a large `old_string` is not buried in text that never moved. - A whole-file write reads as plain content with a line count. There is no before side to compare against, so a `+` on all of it carries no information. - A result is unwrapped once, everywhere it appears. File mutations are identified by the *shape* of the input (`file_path` plus `old_string`/`new_string`, or `content`), never by tool name: the presenter's contract is to keep provider-native names verbatim, and those differ per provider. The write mode keys on `content` rather than on "the before side is empty", because an edit with an empty old_string is an insertion into a file that already exists and still reads as a diff. Highlighting reuses the rich-content engine (`lowlight` and the `.hljs-*` class contract), so a file looks the same in a transcript as it does in a comment, with no new dependency. Each side is highlighted as ONE block and then split at newlines, re-opening the enclosing spans per line — highlighting line by line would break every multi-line string, comment and template literal. Grammar comes from the file extension; an unknown extension stays plain rather than guessing. The hljs palette was scoped to `.rich-text-editor`; it now also covers `.transcript-code`, with no colour definition duplicated. Diffing is a small LCS over lines, degrading to a plain replacement block past 250k cells. Line numbers are deliberately absent: the transcript stores only the tool input, so a snippet's position inside its file is not knowable here, and relative numbers would read as file lines and mislead. * fix(transcript): keep the show-all label off the line it covers The fade overlay does not fully clear the clipped line, so the transparent "Show all" label rendered on top of whatever text sat behind it — the two interleaved character by character and neither was readable. Giving the button an opaque surface separates them. Pre-existing: any tool output long enough to clip hit it. It became routine once whole-file writes started rendering their content.	2026-07-30 10:22:14 +08:00
Jiayuan Zhang	545afea827	Revert "feat(ui): establish a role-named type scale and migrate ad-hoc font s…" (#6116) ... This reverts commit d68d636c91.	2026-07-29 17:10:33 +08:00
3 people	d68d636c91	feat(ui): establish a role-named type scale and migrate ad-hoc font sizes (MUL-5451) (#6108) ... tokens.css defined colours, radii and font families but not a single --text-* step, so font sizes had no baseline to align to and grew wherever they were needed: 51 distinct sizes across web + desktop, 370 of them written as arbitrary text-[Npx] values, six at half a pixel (10.5 / 11.5 / 12.5 / 13.5 / 14.5 / 15.5px). text-xs and text-sm carried nearly all UI text while the range between them — 11, 13, 15px — could only be reached with arbitrary values. Hierarchy does not come from having more sizes; past a handful, each extra size makes the hierarchy blurrier. Add ten role-named steps, each with its own line-height so leading cannot fragment the way size did, and move every product-UI call site onto them. Steps are named for what the text is for, not for a t-shirt size, because that is what keeps the scale from drifting again. Six steps deliberately keep the exact size/line-height pairs of the Tailwind defaults they replace, so the 1,900-call-site rename (text-sm -> text-body and friends) moves nothing on screen. The visible changes are confined to former arbitrary values snapping to a step: - 8 / 9 / 10px -> micro (11px): 102 sites, mostly badges and overline labels. Deliberate — under 12px is a counter role, not a text role. - 17px -> title (18px), 22px -> display-sm (24px), 30px (text-3xl) -> display (36px): 21 sites, all headings or stat numbers in flexible containers. - Half-pixel steps are gone entirely. Arbitrary sizes also inherited whatever line-height was above them; the tokens now pin one, which removes latent overflow risk in the fixed-height h-4/h-5 badges those sizes were used in. apps/mobile (own NativeWind config) and apps/docs (fumadocs' own type system) keep Tailwind's default scale and are untouched. Landing-page display type (rem/clamp, 2.2-6.4rem) is marketing typography on a separate ramp and stays out of the scale, as do four decorative emoji / serif-hero sizes. A guard test fails the build on any font size written outside the scale, reporting file:line — without it nothing in a Tailwind build makes an off-scale value look wrong, which is how the drift happened. Verified against a local stack: typecheck, lint and the full TS suite show no new failures, and before/after screenshots of issues, issue detail, runtimes (populated), usage, agents, inbox, my-issues and settings differ only in the intended 10px -> 11px labels, with no row-height, truncation or layout shift. Co-authored-by: Lambda <[email protected]> Co-authored-by: multica-agent <[email protected]>	2026-07-29 16:30:13 +08:00
3 people	9ff766d700	fix(ui): tabular figures on live task timers (MUL-5448) (#6094) ... The 1Hz elapsed counters rendered with proportional figures, so the text width changed on 9s -> 10s and 1m 9s -> 1m 10s, nudging the neighbouring elements once a second for the whole run. Web/desktop take the `tabular-nums` utility. Mobile cannot: Tailwind compiles that class to `font-variant-numeric`, and react-native-css-interop's property allow-list only carries `font-variant-caps`, so the declaration is dropped and the class is a silent no-op on RN. Use RN's `fontVariant` style prop there instead. Co-authored-by: Lambda <[email protected]> Co-authored-by: multica-agent <[email protected]>	2026-07-29 15:38:12 +08:00
3 people	67d3952ee2	fix(transcript): auto-follow live task output in transcript dialog (#5932) ... * fix(transcript): auto-follow live task output in transcript dialog (#5921) Since the transcript event list moved to Virtuoso (#5733), a live task's new events required manual scrolling to see — the dialog opened at the top and never followed appended output. Wire live-follow through Virtuoso's own primitives, per sort direction: - Chronological (default): `followOutput` returns "smooth" while the task is live and the reader is at the bottom (Virtuoso's own atBottom tracking, with a forgiving 120px threshold). Scrolling up suspends the follow until the reader returns. - Newest-first: growth is PREPENDS, which the firstItemIndex anchoring deliberately holds in place — so a reader parked at the top would silently stop seeing new rows. Track the top edge via `atTopStateChange` into a ref and snap back to index 0 when new events arrive while at the top. Readers who scrolled away are left in place. - Opening a live chronological transcript now lands on the newest event (`initialTopMostItemIndex: LAST/end`, same pattern as the chat list); the per-listEpoch remount re-applies it after task/sort/filter changes. Completed tasks keep opening at the top. Fixes #5921. * fix(transcript): rework newest-first live follow as a user-intent latch (#5921) The previous approach gated the newest-first follow on "is the viewport at the top right now" — but firstItemIndex prepend anchoring moves the viewport away from the top on every flush, so the signal broke itself: after the first prepend the follow silently disengaged and never recovered. Replace it with a pure latch controller (transcript-follow.ts): - Disengage only on accumulated USER displacement (wheel/touch/key deltas, scrollbar drag) beyond the 120px edge zone; system displacement never counts, no matter how far it pushes the viewport. - While following, non-user displacement is pinned back to the live end on the scroll event itself (Virtuoso's prepend compensation lands after React effects, so an effect-timed snap alone stays one flush behind). - Enforcement is suppressed while the mouse is held (text-selection autoscroll) or mid-gesture; returning within the edge zone re-engages. - Timeline segment clicks explicitly unlatch so navigation isn't pinned back. Chronological followOutput switches "smooth" -> "auto": a still-animating smooth scroll reads as "not at bottom" on the next flush and drops the follow under rapid appends. The latch decision table is unit-tested (transcript-follow.test.ts), and the mechanism was validated end-to-end against react-virtuoso 4.18.7 in a browser harness: follow-at-top, in-zone nudge + flush (no false disengage), scroll-away with stable anchor, return-to-top re-engage, rapid flushes. Co-Authored-By: Claude Fable 5 <[email protected]> --------- Co-authored-by: Naiyuan Qing <[email protected]> Co-authored-by: Claude Fable 5 <[email protected]>	2026-07-27 13:10:44 +08:00
Naiyuan QingandClaude Fable 5	00e658401b	feat(views): revamp execution log — virtualized, readable, two-tier header (#5890) ... Combines the transcript work (previously split across #5860 virtual scroll and #5871 reading hierarchy) into one branch on current main, folding in the runtime-alias display from #5881. - Virtualize the event list (react-virtuoso) so a multi-thousand-event run mounts a bounded number of DOM rows (#5733), with firstItemIndex anchoring for newest-first live prepends. - Reading hierarchy via a pure trace-event-presenter: agent text and errors render expanded in place through RichContent (compact, log-scale markdown); thinking/tool rows fold to one line; tool detail expands into a quiet surface with "show all". - Persisted 3-way expand density (smart/expanded/collapsed) with per-row overrides; legacy defaultExpanded boolean migrated. Filters always persist (dropped the preserve-filters toggle). - Two-tier header: identity row (status, agent, trigger source, triggered-by) + list toolbar (created/duration/events facts left, shared Button controls right); runtime/provider/workdir/timestamps move to an ⓘ popover, runtime shown via runtimeDisplayName (#5881). - Copy-all exports full event bodies (redacted) with RFC 3339 timestamps (#5873), not the truncated summary. Co-authored-by: Claude Fable 5 <[email protected]>	2026-07-24 16:44:43 +08:00
3 people	7cc763bbfb	fix(runtimes): show runtime aliases across user-facing surfaces (MUL-5248) (#5881) ... Several UIs rendered the raw daemon name (runtime.name) and dropped the user's custom_name alias: the Skills "Copy from runtime" selector, the Skills list/detail source, the agent creation runtime chip, the agent runtime filter, the agent overview, the skills/MCP runtime hints, the runtime delete confirmations, the desktop runtime window title, the onboarding runtime cards/hints, and the task transcript chip. Route every user-visible runtime label through the shared display contract: - runtimeDisplayLabel (alias + provider) for standalone labels - runtimeDisplayName (alias only) where a provider icon/text sits beside it - machine.title + runtimeRowLabel(runtime, machine.title) inside machine groups The Skills "Copy from runtime" selector is now machine-grouped via the shared buildRuntimeMachines/runtimeRowLabel helpers instead of a flat raw-name list; runtime.name stays the source of identity for hostname parsing, grouping, search, and protocol payloads only. Add a conventions rule (en + zh) forbidding raw runtime.name in user-visible JSX/i18n/Select labels/document titles. Co-authored-by: Claude Opus 4.8 <[email protected]> Co-authored-by: multica-agent <[email protected]>	2026-07-24 15:54:48 +08:00
3 people	a767c5b361	feat(transcript): include timestamps in copied events (#5873) ... Co-authored-by: Eve <[email protected]> Co-authored-by: multica-agent <[email protected]>	2026-07-24 13:56:25 +08:00
CAVINandCAVIN	310634064f	fix(transcript): explain unavailable Antigravity live events (#5182) ... * docs: design Antigravity live transcript empty state * docs: plan Antigravity live transcript empty state * fix(transcript): explain unavailable Antigravity live events * chore: remove agent planning artifacts --------- Co-authored-by: CAVIN <[email protected]>	2026-07-16 10:28:23 +08:00
YOMXXXandmultica-agent	c599f47ba4	fix(redact): cover GitHub fine-grained PATs and Google API keys (#4678) ... The primary server redactor now covers github_pat_ and standard AIza keys, but the client transcript safety net does not. Add matching client patterns and regression coverage so previously stored or otherwise unredacted transcript values are masked at display time. Also make the fixed-length Google key rule redact a key ending in '-' while preserving its trailing delimiter. Keep the 39-character format exact to avoid broadening false positives. Co-authored-by: multica-agent <[email protected]>	2026-07-15 16:06:59 +08:00
3 people	4fac8d772f	feat(attribution): Human Attribution Phase 1 (MUL-4302) (#5150) ... * feat(attribution): Phase 1 foundation — provenance schema + resolver (MUL-4302) Human Attribution, Phase 1 (地基) first increment. Every agent run must be traceable to exactly one accountable human AND record at which waterfall level that human was resolved, so a NULL originator can be told apart from a genuine 'no human in the chain'. - migration 149: add originator_source (waterfall label) + delegation/retry/ rerun/rule-version lineage + kind-tagged trigger evidence to agent_task_queue. No FK, no cascade, no CHECK on the source enum (MUL-4302 §7); nullable ADD COLUMNs = fast metadata-only change on the hot queue table. - internal/attribution: the accountable-human vocabulary (Source, EvidenceKind, TriggerKind) + pure, unit-tested classification rules (ClassifyComment/ ClassifyDirect). No DB, no authorization — provenance labeling only. - service: attributionFor{IssueTask,TriggerComment} gather facts and delegate to the pure classifier; the legacy originator resolvers now delegate here so there is one source of truth. originator_user_id's VALUE is unchanged, so the Composio-overlay and canInvokeAgent A2A authorization boundaries are byte-for-byte preserved (MUL-4302 §1.3). - enqueueIssueTask / enqueueMentionTask stamp originator_source + evidence; CreateRetryTask carries the parent attribution forward and records retry_of_task_id so retry and manual rerun stay separable (MUL-4302 §5). Verified: go build ./..., go vet, gofmt clean; new attribution unit tests + enqueue stamping integration test green; existing resolve_originator tests unchanged. Co-authored-by: multica-agent <[email protected]> * feat(attribution): split accountable_user_id from originator, close enqueue bypasses (MUL-4302) Phase 1, per Bohan's decision on the MUL-4302 thread: audit and authorization answer different questions and get different columns. - Migration 151 adds agent_task_queue.accountable_user_id (no FK, no cascade). Authorization keeps reading ONLY originator_user_id (canInvokeAgent A2A gate, Composio overlay); audit/UI/usage read accountable_user_id + source + evidence. - Invariant (finalizeAttribution, single chokepoint + §11 tests): originator non-null ⟹ accountable equals it. The two diverge only when originator is null (autopilot / degraded fallback), which is the deferred rule_owner/owner_fallback increment; this lands the column + mirror-write so that split has a home. - Close the NULL-source enqueue bypasses Elon flagged: chat, quick-create, deferred-fallback and run_only-autopilot now stamp originator_source + evidence (+ accountable where a human exists). Autopilot stays unattributed until the rule-version snapshot table lands, but is no longer a silent NULL-source row. Retry inherits accountable_user_id like the rest of the attribution lineage. - Fix assign/promote attribution (§4): a member who assigns/promotes an existing issue is now the accountable human (and, by the invariant, originator) ahead of the issue creator. Threaded as an OPTIONAL actor override, so comment/rerun/ autopilot paths keep today's resolution and create-with-assignee (creator == actor) is unchanged. The squad leader gate already judged the same member. Also merges origin/main: renumbers the attribution migration 149→150 (main took 149 for issue_origin_agent_create) and folds agent_create into ClassifyDirect's origin inheritance. go build/vet/gofmt clean; attribution unit tests + service stamp/actor tests + handler suite pass on a fresh DB migrated through 151. Co-authored-by: multica-agent <[email protected]> * docs(attribution): fix accountable NULL semantics + close chat/quick-create evidence boundary (MUL-4302) Addresses Elon's 2nd-round review on PR #5150 (pre-merge doc/evidence items): - Migration 151 no longer overclaims NULL. accountable_user_id is NULL not only on pre-migration rows but on NEW rows whose audit source resolved no human yet (run_only autopilot writes originator_source='unattributed' with NULL accountable until rule_owner lands). Header + COMMENT ON COLUMN reworded so a schema reader does not misjudge the invariant. - Chat now uses the UNIFORM evidence pair (kind=chat, ref=chat_session_id), like autopilot_run/issue_assignment, instead of relying only on the dedicated chat_session_id column — new EvidenceChat kind. Added a service test asserting chat stamps direct_human + chat evidence. - Quick-create is documented as the ONE intentional no-antecedent-row path: no comment/issue/session/run exists at enqueue time (the run creates the issue), so trigger_evidence_kind/ref stay NULL while the human rides originator/accountable and source is direct_human — not a NULL-source bypass. No authorization behavior change. attribution + service + handler suites pass on a DB migrated through 151. Co-authored-by: multica-agent <[email protected]> * chore(attribution): renumber migrations 150/151 → 157/158 after merging main (MUL-4302) main's #5162 ("unblock release migrations") renumbered the chat migrations and took 150 (agent_task_coalesced_comments) and 151 (chat_read_cursor), colliding with this branch's attribution migrations. Renumber them above main's new highest (156) so TestMigrationNumericPrefixesStayUniqueAfterLegacySet passes: - 150_agent_task_attribution → 157_agent_task_attribution - 151_agent_task_accountable_user → 158_agent_task_accountable_user Fixed the internal "migration 150" references in 158's header to 157. Migrations apply cleanly through 158 on a fresh DB; migration lint green. Co-authored-by: multica-agent <[email protected]> * feat(attribution): autopilot rule_owner — accountable = rule version publisher (MUL-4302) Implements rule_owner (MUL-4302 §3.4), the first attribution source where the accountable human diverges from the (NULL) authorization originator. - Migration 159 adds the append-only autopilot_rule_version snapshot table (no FK, no cascade); migration 160 adds its CONCURRENTLY lookup index. - Write-on-publish: CreateAutopilot appends v1 (publisher = creator); UpdateAutopilot appends a new version when a SUBSTANTIVE autopilot-row field changes (assignee / status / execution_mode) — cosmetic edits (title/description/template) write none. Both run inside the existing handler tx (atomic with the autopilot write). - Dispatch resolution: both autopilot execution modes now resolve the active rule version and stamp originator_source='rule_owner', accountable_user_id=publisher, rule_version_id=<snapshot>, with originator_user_id left NULL (authorization unchanged). run_only stamps CreateAutopilotTask directly; create_issue resolves in attributionForIssueTask so both modes attribute identically. A missing version / non-member publisher degrades to unattributed — never fabricates a human. - finalizeAttribution now enforces the invariant ONE-WAY: it mirrors originator onto accountable only when originator is valid, leaving an explicitly-set accountable (rule_owner / future owner_fallback) intact when originator is NULL. Added rule_version_id to CreateAgentTask so the create_issue path persists it too. Also merges origin/main and renumbers this branch's attribution migrations 150/151 → 157/158 (main's #5162 took 150/151); rule_version table is 159/160. Tests: attribution unit RuleOwner + one-way invariant table; service integration tests proving an autopilot-origin issue stamps rule_owner + rule_version_id (and degrades to unattributed with no version). Full service/attribution/handler/ migration suites pass on a DB migrated through 160; build/vet/gofmt clean. Deferred (same PR): trigger-table republish (cron/webhook/event_filters) and system-pause/archive versioning; owner_fallback + fail-closed; manual rerun. Co-authored-by: multica-agent <[email protected]> * fix(attribution): manual autopilot trigger → direct_human to the triggering member (MUL-4302) Elon's blocking finding: a member manually triggering an autopilot was attributed rule_owner (accountable = rule publisher, originator NULL) like a schedule/webhook run, so member B triggering member A's autopilot landed accountable=A and carried no originator authorization context for the run. Per MUL-4302 §4 a manual "run now" is a direct human action and must attribute direct_human to the triggering member. - Thread the triggering member from TriggerAutopilot into dispatch: new DispatchAutopilotManual carries actorUserID (resolved via resolveActor + memberActorUserID, so only a member actor is a human; an A2A agent actor falls back to rule_owner). DispatchAutopilot / DispatchAutopilotForPlan keep their public signatures (pass an invalid actor); only the internal dispatchAutopilot / dispatchCreateIssue / dispatchRunOnly gained the param, so the many existing callers are untouched. - run_only: dispatchRunOnly stamps direct_human (originator == accountable == actor, no rule_version) for a manual actor, else rule_owner. CreateAutopilotTask gains an originator_user_id param for the manual case. - create_issue: dispatchCreateIssue enqueues a manual trigger via the actor-carrying *WithHandoff entry points; attributionForIssueTask's autopilot-origin rule_owner branch is now guarded on !actorUserID.Valid, so a valid actor falls through to the direct_human override. Both execution modes attribute identically. - schedule / webhook keep rule_owner (no actor). Trigger-table + system-pause/archive versioning remain the pre-merge follow-ups. Tests: the run_only row assertion Elon asked for (schedule → rule_owner row on CreateAutopilotTask), plus manual direct_human on BOTH modes (run_only and create_issue), including a manual actor distinct from the rule publisher. Full service/attribution/handler/migration/scheduler/cmd suites pass on a DB migrated through 160; build/vet/gofmt clean. Co-authored-by: multica-agent <[email protected]> * feat(attribution): owner_fallback + fail-closed policy, and manual-rerun direct_human (MUL-4302) Two of the three remaining Phase 1 items (trigger-table / system-pause versioning is deferred — see PR description). owner_fallback + fail-closed (§1/§3.5) — the never-null accountable guarantee: - attribution.OwnerFallback degrades an UNATTRIBUTED result to owner_fallback: accountable = agent owner, originator stays NULL (audit-only, authz untouched), Source.Precise()==false. finalizeAttribution's one-way invariant already allows accountable-set / originator-NULL divergence, so nothing else changes. - Migration 161 adds workspace.attribution_fail_closed (default FALSE) + a lean GetWorkspaceAttributionFailClosed read. (Also added the column to ListWorkspaces' explicit column list so its row type stays db.Workspace.) - applyAttributionFallback is applied at every enqueue boundary (issue, mention, chat, quick-create, deferred-fallback, autopilot run_only): unattributed → owner_fallback (agent owner) by default, or ErrAttributionFailClosed when the workspace is fail-closed, which the caller surfaces to refuse the enqueue (the run does not start). So no run is left without an accountable human, and a compliance workspace can block unattributable runs instead. manual rerun (§5) — a rerun is a NEW direct_human trigger to the rerunning member: - RerunIssue threads the acting member (resolved in the handler via resolveActor) down to enqueueRerunTask, and attributionForIssueTask is now actor-first so the actor wins over an INHERITED trigger comment (a rerun keeps the comment for the daemon's prompt context but must attribute to whoever clicked rerun, not the original comment's human). - rerun_of_task_id lineage is recorded via a targeted SetAgentTaskRerunOf update on the rerun path only (keeping the shared CreateAgentTask insert untouched), so system retry (retry_of_task_id) and human rerun stay separable in reporting. Tests: OwnerFallback unit test; owner_fallback + fail-closed-refusal + manual-rerun (direct_human + rerun_of_task_id) service tests; the prior "degrades to unattributed" test updated to owner_fallback. Full service/attribution/handler/migration/scheduler/ cmd suites pass on a DB migrated through 161; build/vet/gofmt clean. Co-authored-by: multica-agent <[email protected]> * fix(attribution): close fail-open holes + move rerun_of_task_id into creation snapshot (MUL-4302) Addresses Elon's two must-fixes on PR #5150. 1. accountable-never-null / fail-closed had fail-open holes. applyAttributionFallback now, for an UNATTRIBUTED run, refuses the enqueue (ErrAttributionFailClosed) in THREE cases instead of silently degrading to a runnable NULL-accountable task: - workspace policy read fails (or no workspace) → fail closed; we cannot confirm fallback is permitted, so we don't run an unattributable task on a DB hiccup. (Only the rare unattributed path pays this; precise runs never read the policy.) - workspace is fail-closed → refuse (unchanged). - owner_fallback has no valid agent owner → refuse rather than enqueue a task with a NULL accountable_user_id. ErrAttributionFailClosed's doc now covers all three "cannot guarantee an accountable human" refusals. Added missing-owner / policy-read-failure / precise-passthrough tests. 2. manual rerun rerun_of_task_id was a post-notify UPDATE (race: the queued event / daemon claim could see rerun_of_task_id = NULL, and a failed update degraded the run to a plain direct_human). It now rides the CreateAgentTask insert — threaded through enqueueIssueTask / enqueueMentionTask as a creation param (like retry_of_task_id) so it is written in the same statement before the daemon is notified. Removed the SetAgentTaskRerunOf follow-up query. Also merges origin/main (unrelated CLI fix #5167, no conflict). Full service / attribution / handler / migration / scheduler / cmd suites pass on a DB migrated through 161; build / vet / gofmt clean. Co-authored-by: multica-agent <[email protected]> * feat(attribution): rule_owner versioning on trigger edits + system-pause/archive (MUL-4302) The final remaining Phase 1 item: substantive publishes beyond the autopilot row now republish the rule version, so a run's rule_owner accountable follows whoever last changed what the rule does. - Extracted the config-summary + insert into service.RecordAutopilotRuleVersion so the handler and the (different-package) failure monitor share one writer; the handler's recordAutopilotRuleVersion is now a thin wrapper. - Trigger edits: UpdateAutopilotTrigger and DeleteAutopilotTrigger republish the rule version with the acting member as publisher, ATOMICALLY (tx-wrapped mutation + version write, mirroring CreateAutopilot/UpdateAutopilot). CreateAutopilotTrigger republishes best-effort — the webhook path mints its token with a retry loop that cannot share one tx, and a create is usually initial setup already covered by v1; a failed write there is benign (active version stays the current publisher, the new trigger fires under it, no immediate daemon claim rides it). - Archive (DeleteAutopilot) republishes (member, status=archived), tx-wrapped. - System auto-pause (failure monitor) republishes with a 'system' publisher, best-effort — a background sweep to a non-dispatching state (a paused autopilot never dispatches; a later member resume supersedes). - RotateWebhookToken / SetSigningSecret deliberately do NOT version: they rotate credentials, not the rule's behavior (not §3.4 substantive). Semantics: a system-published (no-member) active version degrades dispatch to unattributed → owner_fallback, never fabricating a human. Tests: republish-reattributes (member A → member B supersedes → dispatch resolves to B; system publisher → unattributed). Full service/attribution/handler/migration/ scheduler/cmd suites pass on a DB migrated through 161; build/vet/gofmt clean. Also merges origin/main (unrelated frontend feature #5074). Co-authored-by: multica-agent <[email protected]> * fix(attribution): make trigger-create rule-version republish atomic (MUL-4302) Addresses Elon's final Phase 1 blocking finding: CreateAutopilotTrigger recorded the rule-version republish best-effort AFTER the trigger insert. If member B added a schedule/webhook trigger to member A's autopilot and the version write failed, future schedule/webhook dispatches would keep attributing to A — violating the rule_owner invariant that the last member to substantively change the rule owns future runs ("no immediate daemon claim" doesn't save it, since the miss surfaces at the LATER trigger firing). Both create paths now write the version in the SAME tx as the trigger INSERT: - schedule create: wrap CreateAutopilotTrigger + recordAutopilotRuleVersion in one tx. - webhook create: each mint-with-retry attempt runs in its own tx (insert + version commit together; a token collision rolls that attempt back and retries with a fresh token; a version-write failure rolls the trigger back). Passes ap + the acting member id into the helper. - removed the best-effort recordTriggerRuleVersionBestEffort helper (and the now-unused slog import). Test: TestCreateTrigger_RepublishesRuleVersionAtomically drives both create paths through the handler and asserts a rule version is published by the acting member. Existing webhook/trigger/archive handler tests still pass. Also merges origin/main (unrelated avatar feature #5074). Full service/attribution/handler/migration/ scheduler/cmd suites pass on a DB migrated through 161; build/vet/gofmt clean. Co-authored-by: multica-agent <[email protected]> * feat(attribution): Phase 2.1 — surface run attribution on the task API (MUL-4302 §9) First Phase 2 (visibility) increment: the agent-task API now returns the resolved accountable-human provenance so the UI can render an "on behalf of" badge. - AgentTaskResponse gains an `attribution` object: source label (never blank — pre-migration NULL renders "unattributed") + `precise` flag (false for the degraded owner_fallback / backfill / unattributed sources), the initiator (accountable) and originator (authorization) user refs, the evidence {kind, ref_id} pointer, and the rule_version / delegated / retry / rerun lineage ids. - The label + evidence + raw ids are built in the PURE taskToResponse (no DB), so every task response carries them. Names are hydrated separately, only on the user-facing surfaces (ListAgentTasks, ListWorkspaceAgentTaskSnapshot, RerunIssue, CancelTaskByUser) — daemon-claim paths stay lean. - Hydration resolves initiator/originator from the GLOBAL user table (departed-member safe) via a new batch GetUsersByIDs query (no N+1); best-effort, so a lookup hiccup leaves the raw ids intact. Tests: pure taskAttributionBase (direct_human / rule_owner NULL-originator / owner_fallback degraded / pre-migration→unattributed) + DB hydration (fills known ref, leaves unknown id un-filled, skips nil). Full handler/service/attribution/ migration/scheduler/cmd suites pass on a DB migrated through 161; build/vet/gofmt clean. The field is additive — the frontend's parseWithFallback ignores unknown keys, so nothing breaks until the UI increment consumes it. Also merges origin/main (unrelated editor feature #5090). Remaining Phase 2 (next increments, same PR): frontend zod schema + "on behalf of" badge + evidence-chain jump; append-only correction events (write + display). Co-authored-by: multica-agent <[email protected]> * feat(attribution): Phase 2.2 — on-behalf-of badge in the execution log (MUL-4302 §9) Surface the accountable human on every agent run row: - AttributionBadge composes Badge + ActorAvatar, shows "on behalf of <member>" with the resolution source as a tooltip; degraded (non-precise) attribution gets a warning tone, and an unresolved initiator renders an explicit "no responsible member" chip. - Wire the badge into both active and past rows of the execution log. - Mirror the attribution shape into AgentTaskResponseSchema (defensive, .loose()) so the cancel-task path carries it through zod; add parse tests. - Export TaskAttribution/AttributionUser/TaskEvidence from @multica/core/types and add the attribution block to all four issues.json locales. Co-authored-by: multica-agent <[email protected]> * fix(attribution): hydrate initiator names on issue-facing task endpoints + bound the badge (MUL-4302 §9) Address Elon's PR #5150 review: - ListTasksByIssue (the execution-log data source), GetActiveTaskForIssue and the issue-scoped CancelTask now call hydrateTaskAttributions, so the "on behalf of <member>" badge shows the real member name on issue detail instead of falling back to "someone". Mirrors the existing ListAgentTasks / snapshot behavior. - AttributionBadge: cap width (max-w-40, min-w-0) and truncate the name span so a long name / narrow right column can't squeeze out trigger/status/actions; keep the avatar shrink-0. - Add a handler test asserting the issue task list returns a hydrated attribution.initiator.name. Co-authored-by: multica-agent <[email protected]> * fix(attribution): use semantic AvatarSize 'xs' for the badge avatar main refactored ActorAvatar.size from a raw pixel number to the semantic AvatarSize union (packages/ui/lib/avatar-size). Switch the on-behalf-of badge avatar from size={14} to size="xs" (16px) after merging main. Co-authored-by: multica-agent <[email protected]> * fix(attribution): stage-cascade falls back to parent-issue provenance, not agent owner (MUL-4302) When closing the last sub-issue in a Stage wakes the parent's assignee agent, the run was enqueued via a system-authored child-done comment with no actor, which the resolver classified as unattributed and then degraded to owner_fallback (the agent's own owner). That is the wrong accountable human: the woken run should be accountable to whoever caused the parent issue to exist. attributionForIssueTask now detects a system-authored trigger comment and falls through to the parent issue's own provenance — the same creator / agent_create-origin / autopilot-origin chain a direct enqueue resolves (so an agent-decomposed parent attributes via delegation to the human who drove it; a member-created parent to that member; an autopilot parent to the rule publisher). owner_fallback is now only the last resort when the parent provenance itself has no human. - Extract attributionFromComment so attributionForIssueTask can inspect author_type without a second GetComment; authorization resolution stays byte-identical. - Add a DB-backed test asserting a system child-done comment resolves to the parent issue's origin human (delegation), not owner_fallback. Co-authored-by: multica-agent <[email protected]> * feat(attribution): autopilot runs attribute to the firing trigger's creator (MUL-4302) Per Bohan: an autopilot schedule/webhook run should be accountable to the human who created the SPECIFIC trigger that fired it, not the rule publisher. (Manual triggers already attribute to the invoking member via direct_human — unchanged.) - Migration 162: add autopilot_trigger.created_by_type/created_by_id (nullable, no FK/cascade). Capture the creating member at both trigger-create sites (schedule + webhook). - New precise source trigger_owner: originator stays NULL (an autonomous fire carries no human authorization — same authz-safe divergence as rule_owner), accountable = the trigger's member creator. - triggerOwnerAttribution resolves run.trigger_id → creator; wired into run_only dispatch and the create_issue path (bridging issue → active run → trigger_id). Legacy triggers with no recorded creator, and agent-created triggers, degrade to rule_owner then owner_fallback — nothing regresses. - Frontend: trigger_owner source label in all four locales + badge switch case. - Tests: attribution TriggerOwner unit + Precise/invariant; DB-backed resolver tests (member creator → trigger_owner; creatorless → rule_owner fallback). Co-authored-by: multica-agent <[email protected]> * chore(attribution): re-trigger CI (dropped synchronize event on 249090260) Co-authored-by: multica-agent <[email protected]> * fix(attribution): mirror accountable_user_id on comment-coalescing merge (MUL-4302) The one-way invariant is 'originator_user_id IS NOT NULL ⟹ accountable_user_id = originator_user_id', enforced at finalizeAttribution for enqueues and preserved by the retry-clone (copies both columns). But MergeCommentIntoPendingTask (main #5192) re-stamps originator_user_id to the newly-coalesced comment's human WITHOUT touching accountable_user_id — so folding member B's comment into member A's queued task left originator=B / accountable=A, violating the invariant. Re-stamp accountable to mirror the new originator (same thing finalizeAttribution does). Add a DB-backed regression test. Co-authored-by: multica-agent <[email protected]> * fix(attribution): Elon's 3 must-fixes + DB cross-column invariant CHECK (MUL-4302) Bohan approved Elon's plan; this closes the three attribution boundaries he flagged and locks the one-way invariant at the DB. 1. Delegation now inherits the parent's ACCOUNTABLE, not just its originator. An autopilot-rooted chain (parent originator NULL, accountable = trigger creator) @mentioning an agent / creating a sub-issue used to drop to unattributed → owner_fallback and fail-closed workspaces wrongly rejected the fan-out. Added ParentAccountable/OriginAccountable to CommentFacts/DirectFacts; ClassifyComment/ ClassifyDirect copy accountable down (source=delegation, precise, originator NULL) so the chain root stays stable at any depth (§3.2). 2. The direct-chat send path (SendDirectChatMessage, MUL-4351) wrote only originator_user_id — no accountable/source/evidence, a NULL-source bypass. It now stamps the full direct_human attribution like EnqueueChatTask. 3. Comment-coalescing merge re-attribution is now ATOMIC: MergeCommentIntoPendingTask re-stamps the whole snapshot (person columns + source + delegation lineage + rule version + evidence) of the new comment, not just the two person fields, so a merged run never shows B accountable while pointing at A's stale source/evidence. 4. Migration 169: NOT VALID CHECK (originator_user_id IS NULL OR (accountable_user_id IS NOT NULL AND accountable_user_id = originator_user_id)). Enforces the invariant on every new write (the class of bug #5192 introduced); historical rows not blocked, VALIDATE after Phase 3 backfill. Updated test fixtures that seeded originator-only rows to also set accountable. Merged latest main (renumbered attribution migrations 163–168 after main took 161/162; merged the retry-clone chat_input_task_id + attribution columns). Verified: go build/ vet, attribution/service/handler/cmd-server tests on a migrated DB, frontend typecheck/lint/tests. Co-authored-by: multica-agent <[email protected]> * fix(attribution): trigger responsibility transfers to effective publisher; fail-closed comment merge Elon final-review must-fix 1 (MUL-4302): trigger_owner now resolves to the member CURRENTLY responsible for the firing trigger's effective config, not the fixed creator. Per-trigger published_by on autopilot_trigger, seeded to the creator and re-stamped to the editor on a substantive edit — a trigger-scoped edit bumps only that row (UpdateAutopilotTrigger), an autopilot-level edit bumps all its triggers (UpdateAutopilot). Editing one trigger never reassigns another. Adds real dispatchRunOnly transfer test + resolver-level isolation test. Must-fix 3: AttributionForMergedComment reuses applyAttributionFallback and returns ErrAttributionFailClosed; the merge caller refuses on fail-closed, keeping the queued task's original precise snapshot instead of degrading it to owner_fallback. Adds regression test. Renumbered attribution migrations to 166-172 after merging main. Co-authored-by: multica-agent <[email protected]> * fix(attribution): make migration 172 invariant CHECK upgrade-safe (Option A) Elon final-review must-fix 2 (MUL-4302), rollout chosen by Bohan. The NOT VALID CHECK still checks a pre-existing row on any later UPDATE (even one not touching attribution columns), so cross-deployment stale queued/running tasks (originator set, accountable NULL from before migration 167) would fail on their next claim/complete/cancel. Exempt exactly those legacy rows via 'originator_source IS NULL' — that column was added in 166 with no backfill, so it is NULL only on pre-migration rows and non-NULL on every attribution-aware write. New writes stay fully enforced; the #5192 bypass class (source always set) is unaffected. Phase 3 backfills legacy rows then drops+re-adds the strict form + VALIDATE. Adds TestAttributionInvariantCheck_ExemptsLegacyRows (legacy row survives a status UPDATE) and updates the reject-bypass test to the enforced regime. Co-authored-by: multica-agent <[email protected]> * fix(attribution): pin substantive/cosmetic edit boundary for trigger transfer Elon re-review must-fix 1: an autopilot-level edit only transfers trigger_owner responsibility when it changes what the automation instructs or who/whether it runs. autopilotRuleSubstantiveChange now includes description (the run Prompt) and issue_title_template; title and project_id stay cosmetic/routing. UpdateAutopilotTrigger no longer transfers on every PATCH — it compares the persisted before/after and transfers only on a real cron/timezone/enabled/ event_filters change, not a label-only or no-op PATCH. Adds real handler tests (prompt->all, title->none, cron->one+isolation, label->none, no-op->none). Must-fix 3: real merge-path regression (TestMergeCommentIntoPendingTask_ FailClosedKeepsOriginalSnapshot) drives mergeCommentIntoPendingTask and asserts a fail-closed workspace preserves the queued task's full snapshot; fail-open control completes the owner_fallback merge. Docs: migration 172 comment reworded to legacy-writer/unbackfilled-lineage semantics (source NULL is not strictly pre-migration); PR description synced. Migration renumber vs latest main (must-fix 2) deferred to pre-launch per Bohan. Co-authored-by: multica-agent <[email protected]> * chore(attribution): renumber migrations to 167-173 after syncing main Merged latest main (which took 166_project_dates) and shifted the attribution migration series off the 166 collision: 166->167 agent_task_attribution, 167->168 accountable_user, 168->169 rule_version, 169->170 rule_version_index, 170->171 fail_closed, 171->172 trigger_publisher, 172->173 invariant_check. Updated the internal cross-references in the migration comments accordingly. Fixes TestMigrationNumericPrefixesStayUniqueAfterLegacySet on the merge tree. Co-authored-by: multica-agent <[email protected]> * feat(admission): unify dispatch outcome + close rerun/chat/autopilot invoke holes (MUL-4525) P0 first increment toward a platform-wide execution-admission contract so a user who names an execution target always gets a definite result and never a silent no-op, and so blocked targets are reported without leaking private-agent details. Backend: - New shared contract (handler/admission.go): DispatchOutcome / DispatchStatus (queued/coalesced/deferred/blocked) + stable, enumeration-safe DispatchReasonCode set, plus writeDispatchBlocked() whose legacy `error` string never reveals target existence. - Rerun (task.go / task_lifecycle.go): re-validate the operator can invoke the RESOLVED target agent (historical agent for a task_id rerun) before any cancel/enqueue; blocked returns a structured 403 and mutates nothing (ErrRerunInvokeNotAllowed). - Chat send (chat.go): re-run canInvokeAgent on every send, not just the softer canAccessPrivateAgent view gate; a revoked permission blocks before the message/attachments/task persist. - Autopilot manual "run now" (service/autopilot.go): admission now keys on the current CLICKER, not the autopilot creator — clicker admission and clicker attribution no longer fork. Automation (schedule/webhook) still falls back to the creator gate. Added reason_code to the run response for the UI. Frontend: - triggerAutopilot response is schema-parsed; handleRunNow branches on run status and shows a localized, reason_code-based warning for skipped/failed instead of a false-success toast. - Chat send and rerun surface the structured 403 reason_code as localized toasts (dispatchReasonCode helper) instead of a generic failure. - Additive fields only; older clients keep working. i18n added to all 4 locales. Tests: rerun fail-before-mutation gate, autopilot clicker-vs-creator fork (service + handler), reason-code classification, and a malformed-response schema test. Backend handler+service suites and FE typecheck/lint green. Co-authored-by: multica-agent <[email protected]> * test(cmd/server): thread nil invoke gate through RerunIssue call sites (MUL-4525) Co-authored-by: multica-agent <[email protected]> * fix(admission): typed reason codes + run-now whitelist + real security tests (MUL-4525) Addresses Elon's review of the P0 first increment (must-fix 1–3). 1. Run now no longer has a false-success branch. handleRunNow now classifies on a whitelist via a pure runNowToastKind(): only issue_created/running → success; skipped → warning; failed and any unknown/future status → error. Add run-now-toast unit test over all five status classes plus reason-code → key mapping. 2. reason_code is a typed value decided at the admission source, not reverse-engineered from English failure text. New leaf package internal/dispatch holds the canonical ReasonCode enum (shared by handler + service so they can never drift). shouldSkipDispatch / errDispatchSkipped / the fail path now carry a typed code through DispatchAutopilotManual straight into the response; the substring classifier is deleted. Fixes the two missed branches: attribution fail-closed → attribution_blocked (typed errors.Is), "agent has no runtime bound" → runtime_offline. Regression tests for both. 3. Security acceptance tests exercise the REAL handlers, not injected callbacks: - Chat: create session while invokable → revoke invoke (flip to private, keep owner-view) → send returns 403 + reason_code with zero chat_message / task writes. - Rerun: private historical agent through RerunIssue + canInvokeAgent — a non-invoking workspace owner is refused 403 + reason_code and mutates nothing (fail-before-mutation); the agent owner is allowed 202. No migration; reason_code is a decision-time value only the manual "run now" response carries. Additive on the wire. Backend build/vet/handler+service suites and FE typecheck/lint/vitest green. (Migration-prefix collision with main remains the deferred pre-merge renumber.) Co-authored-by: multica-agent <[email protected]> * test(admission): make must-fix 3 acceptance tests prove the invariant (MUL-4525) Addresses Elon's round-3 narrow review — the two security tests were not yet falsifiable against the bugs they must catch. - Rerun: after enqueuing the historical task, reassign the issue to a SECOND agent that the denied user CAN invoke. Now the current assignee and the task_id agent differ, so a rerun that wrongly validated the current assignee would let the denied user through — the 403 proves the gate is keyed on the historical private agent. The allow case now asserts the reran task's agent_id is the historical agent, not the current assignee. - Chat: the blocked send now carries a valid, still-unbound attachment. After the 403 the test asserts the attachment's chat_session_id and chat_message_id are both still NULL, guarding against anyone moving attachment binding ahead of the invoke gate. Test-only. Full internal/handler Go suite green. Co-authored-by: multica-agent <[email protected]> * feat(comments): surface blocked @mention trigger_outcomes instead of silent no-op (MUL-4525 §2) A comment that @mentions an agent/squad the author cannot invoke used to save with zero feedback — the user assumed a bug. Now the explicit-mention path reports a per-target outcome on both preview and create/edit. Backend (server/internal/handler/comment.go): - resolveMentionedAgentCommentTriggers collects blocked outcomes instead of a silent `continue`. The invoke gate is evaluated BEFORE any archived/runtime state is read, so a caller who cannot invoke a private target only ever sees the generic invocation_not_allowed and can never enumerate its existence. - enqueueCommentAgentTriggers returns queued/coalesced/deferred/blocked per explicit mention; enqueue errors are typed (attribution_blocked via errors.Is), not swallowed. Implicit routing (assignee/thread/conversation) carries no outcome — the user never named those targets. - trigger-preview returns `blocked[]`; create/edit return additive `trigger_outcomes[]`. One blocked mention never fails the comment. Frontend: - Composer shows a warning chip for blocked mentions before sending; after sending, a "posted, but N not triggered" toast (blocked-only; coalesced/ deferred are success-shaped). Additive schema + defensive parse; i18n ×4. Tests: handler partial-success + enumeration-safety acceptance tests; core outcome-parse + preview-schema tests; hook/parity updated. Backend handler+service suites and FE typecheck/lint/vitest green. Co-authored-by: multica-agent <[email protected]> * i18n(admission): clearer, consistent blocked-trigger copy (MUL-4525) Reword the awkward "you are not allowed to run this autopilot's assignee" and polish all MUL-4525 blocked/partial copy across en/zh-Hans/ja/ko: - Unify on "you don't have permission to use this <agent|target>" (zh: 没有…的 使用权限) for autopilot Run now, comment mentions, rerun, and chat send — replacing the various "not allowed to run/trigger" phrasings. - Align zh to the glossary term 智能体 (was mixed "Agent"), matching the surrounding UI voice (e.g. agent_link_no_access). - Drop jargon: "blocked by an admission policy"/"被准入策略拦截" → "the run was blocked"/"本次运行已被拦截"; "attributed"/"归因" → plainer wording. - Comment copy counts "mentions" (was "targets") for consistency with the chip. Backend dispatchBlockedFallbackMessage (old-client English fallback) reworded to match; its enumeration-safety test assertion updated. Copy-only — no key/logic changes; parity + typecheck green. Co-authored-by: multica-agent <[email protected]> * fix(comments): one outcome per explicit mention + FE success whitelist (MUL-4525) Addresses Elon's round-2 review of the §2 comment trigger_outcomes. 1. Separate execution dedup from per-target outcomes. resolveMentionedAgent- CommentTriggers now returns triggers (deduped by executing agent) AND one commentMentionTarget per EXPLICIT mention. enqueueCommentAgentTriggers returns a per-executing-agent result map; commentTriggerOutcomes fans each agent's status to every target that resolved to it. So @Agent A + @Squad S(leader=A) coalesces to ONE task but yields TWO outcomes. The squad-leader self-suppress branch now returns a definite `deferred` outcome instead of no result. New CreateComment test asserts 1 task, 2 outcomes. 2. Frontend no longer treats an unknown status as success. unhandledComment- TriggerOutcomes whitelists queued/coalesced/deferred as handled; blocked and any unknown/future/empty status warn (mirrors the Run now whitelist). The preview schema's `blocked` now drops malformed entries INDIVIDUALLY instead of z.array(...).catch([]) discarding the whole set. Regression tests for the unknown status and the per-item drop. Backend handler suite + go vet, FE typecheck/lint/vitest green. Co-authored-by: multica-agent <[email protected]> * fix(comments): honest role + status in trigger_outcomes fan-out (MUL-4525) Addresses Elon's round-3 review of the §2 fan-out. 1. Execution merge preserves the squad-leader role instead of first-mention- wins. The dedup now UPGRADES an already-added plain @agent trigger to a @squad-leader trigger for the same agent, so @Agent A + @Squad S(leader=A) always runs as a leader task (is_leader_task + squad_id=S) regardless of mention order — the daemon still injects S's briefing. When two DIFFERENT squads share one leader, the single run carries one squad's context and the other squad is reported `coalesced` (folded), never a second `queued`. The enqueue result now records the executed squad so the fan-out can tell them apart. Tests assert the task role in both orders and the two-squad split. 2. Squad-leader self-suppression no longer fakes success. The self-trigger guard keys on the latest task ROLE with no status filter, so a long-completed task also suppresses; reporting `deferred/already_active` when nothing is active was a false success. The branch now reports `deferred` only when a real non-terminal task is active (its reconcile covers the comment), else a non-success `blocked` + new `already_handled` reason. Fixed the reversed helper-semantics comment. New handler test covers the completed-task branch. Backend handler+service suites and go vet green. Co-authored-by: multica-agent <[email protected]> * fix(comments): fail-closed active-task check, never fake deferred (MUL-4525) Elon round-4 must-fix: hasActiveTaskForIssueAndAgent swallowed DB errors by returning true, so both call sites could turn a query failure into a success-shaped `deferred/already_active` — a silent false success, exactly what this issue forbids for admission-query failures. - hasActiveTaskForIssueAndAgent now returns (bool, error). - Two pure decision helpers govern the branches, fail closed on error: - decidePostMergeMiss: on query error, do NOT enqueue a fresh task (duplicate concurrent-run risk) AND report non-success blocked/internal_error; a confirmed active task defers; a confirmed-none enqueues fresh. - decideSuppressedLeaderOutcome: on query error, blocked/internal_error; a confirmed active run defers; else self_trigger_suppressed. Never a fabricated deferred. - Renamed reason already_handled -> self_trigger_suppressed (Elon non-blocking note): the old name implied the new comment was already processed, but the real meaning is a suppressed self-trigger. Deterministic unit tests cover the query-failure branch at both call sites (no fresh enqueue, non-success outcome) — a real DB fault can't be forced through valid handler inputs, and the decision is what governs the behavior. Backend handler+service suites and go vet green. Co-authored-by: multica-agent <[email protected]> * fix(comments): honest merge outcome — refused merge is blocked, not fake coalesced (MUL-4525) A pending-task merge previously reported success (coalesced) even when it was refused or failed: attribution fail-closed and unknown DB errors both returned handled=true, so the caller recorded coalesced for a merge that never happened. mergeCommentIntoPendingTask now returns a distinguishable commentMergeResult; commentMergeTerminalOutcome maps a real merge to coalesced, a fail-closed refusal to blocked/attribution_blocked, and any other failure to blocked/internal_error. Only "no queued task to fold" falls through to the active-task decision. Adds pure coverage of the mapping plus a fail-closed regression asserting the non-success outcome and unchanged task count. Co-authored-by: multica-agent <[email protected]> * fix(comments): name blocked @mentions in preview + toast instead of a vague count (MUL-4525) The blocked-trigger preview showed a red "1 mention won't trigger" with no name, and the post-send toast said "but 1 mention wasn't triggered" — the user can't tell which target or why. Now each blocked mention renders its own chip named from the mention markup the user typed ("Go · No permission"), with an error indicator and a short reason; the toast names the single target too. The wire outcome still omits the target name (enumeration-safety) — the label comes from the user's own draft, so nothing new is disclosed. Shares a blocked-trigger-copy module (long + short reason labels) between the chip and the toast, and a pure mentionLabelsByTarget/parseMentions helper in core (fresh regex per call — a shared global leaked lastIndex). Adds core + chip tests; drops the now-unused trigger_blocked_count keys across locales. Co-authored-by: multica-agent <[email protected]> * feat(attribution): accountable-member avatar on agent task rows + transcript header (MUL-4302) Surface who each agent run is on behalf of where runs are actually browsed: - Agent detail activity tab: an avatar-only AttributionBadge on every task row's meta line (Now + Recent work), tooltip carries the name + resolution source. - Execution-record (transcript) dialog header: the full on-behalf-of badge next to the status pill. Adds a compact variant="avatar" mode to AttributionBadge, reusing its source-label mapping and degraded-attribution tone. Renders nothing when a run has no resolved accountable member. Co-authored-by: multica-agent <[email protected]> --------- Co-authored-by: J <[email protected]> Co-authored-by: multica-agent <[email protected]>	2026-07-15 03:09:56 +08:00
3 people	f4de0948a2	refactor(ui): unify ActorAvatar size tiers + round all avatars & cropper (MUL-4277, MUL-4184) (#5133) ... * refactor(ui): converge ActorAvatar size to semantic tiers (MUL-4277) Replace the free-form numeric `size` on ActorAvatar with a constrained `AvatarSize` union (xs/sm/md/lg/xl/2xl) so avatar dimensions are chosen by role instead of ad-hoc pixels. This eliminates the magic-number drift where the same role rendered at different sizes across pages. - Add `@multica/ui/lib/avatar-size` (AvatarSize union + AVATAR_SIZE_PX map + default tier). - Base `ActorAvatar` (packages/ui) and business `ActorAvatar`/`AgentStatusDot` (packages/views) now take `AvatarSize`; internal font/icon math and the presence-dot threshold read px from the map. - Migrate all web/desktop call sites (packages/ui + packages/views) from numeric sizes to tiers using the role table (12,14->xs 16,18,20->sm 22,24,28->md 30,32,34->lg 40,44->xl 56,64->2xl). - Token-ise the derived consumers `AgentAvatarStack` and `IssueAgentActivityIndicator` (px looked up internally for overlap/+N math). Out of scope (per plan): ui/avatar.tsx primitive, account-tab/AvatarPicker, mobile, and component-name disambiguation. Co-Authored-By: Claude Opus 4.8 <[email protected]> Co-authored-by: multica-agent <[email protected]> * fix(ui): unify all avatars and the upload cropper to round (MUL-4277, MUL-4184) main's avatar-shape decision rendered non-human actors (agent, squad, system) and the workspace logo as rounded squares, and the upload cropper mirrored that with a square crop window. Per the updated decision (avatars_and_cropper_round_required), every avatar and the crop UI are now circular; the square path is removed rather than left as dead config. - Base ActorAvatar: always rounded-full (drop the isHuman/rounded-md split). - avatar-crop-dialog: remove the AvatarCropShape/square path; crop window is always cropShape="round". - avatar-upload-control: drop VARIANT_SHAPE; the control is always round and no longer threads a shape to the dialog (variant still drives the fallback). - Strip rounded-md/rounded-none square overrides from agent/squad/member ActorAvatar call sites; round the read-only agent/squad static wrappers. - WorkspaceAvatar: round the org logo so it matches the (now round) workspace upload/crop and the shared avatar shape. Co-Authored-By: Claude Opus 4.8 <[email protected]> Co-authored-by: multica-agent <[email protected]> * fix(ui): make round avatar shape a hard invariant (MUL-4277) Close the two remaining square squad-avatar paths flagged in review and prevent call sites from re-squaring the avatar: - base ActorAvatar: keep `rounded-full` as the last class in cn() so a call-site `className` can no longer override the circle. - SquadHeaderAvatar: drop `className="rounded"` (was overriding the base circle into a small rounded square). - SquadsPage no-avatar fallback: route through the shared ActorAvatarBase (`isSquad size="lg"`) instead of a hand-written rounded-md tile, so the fallback matches the image path — one shape source of truth. Co-Authored-By: Claude Opus 4.8 <[email protected]> Co-authored-by: multica-agent <[email protected]> * fix(views): round the agent/squad avatar loading skeletons (MUL-4277) The avatar placeholder skeletons on the agent/squad list, detail, and profile-card loading states were still rounded squares (rounded-md/lg) from the pre-round era, so the avatar visibly popped from square to circle on load — inconsistent with the round avatars and with the member/inbox/issue skeletons that already use rounded-full. Round all five: agents-page, agent-detail-page, squads-page, squad-detail-page, squad-profile-card. Co-Authored-By: Claude Opus 4.8 <[email protected]> Co-authored-by: multica-agent <[email protected]> --------- Co-authored-by: Claude Opus 4.8 <[email protected]> Co-authored-by: multica-agent <[email protected]>	2026-07-10 08:31:40 +08:00
Naiyuan Qingandmultica-agent	dd9996d0aa	MUL-4014: persist transcript filters and expansion (#4884) ... * feat(transcript): persist log view preferences Co-authored-by: multica-agent <[email protected]> * fix(transcript): wrap modal header controls Co-authored-by: multica-agent <[email protected]> --------- Co-authored-by: multica-agent <[email protected]>	2026-07-03 16:45:53 +08:00
3 people	2857a4c649	fix(transcript): live-update issue/agent transcript dialog from shared cache (#4452) ... The transcript dialog opened from a running task's row showed only a one-shot snapshot taken at open time: TranscriptButton fetched once via api.listTaskMessages and cached it locally, never subscribing to the shared ["task-messages", taskId] cache that the WS task:message stream already seeds. New tool calls / thinking / text never appeared until the task finished or the page reloaded. Add a live-cache mode to the shared TranscriptButton: when isLive and the parent provides no items and the task id is a persisted UUID, render from the shared task-messages cache so the open dialog grows in real time. On open (and again on the running→terminal transition) force a backfill via api.listTaskMessages and merge it into the cache by seq — taskMessagesOptions is staleTime:Infinity, so a plain subscription never heals a WS reconnect gap. The cache observer is read-only (enabled:false) so React Query never blind-replaces the cache; only the WS handler and the seq-merged backfill write it. The subscription mounts only while the dialog is open, so closed live rows add no baseline requests; terminal tasks keep the lazy one-shot fetch. Covers issue execution-log and agent activity. Autopilot issue-less run_only live log is out of scope: the backend doesn't broadcast task:message for tasks with no issue/chat session, so there's nothing to subscribe to — backend broadcast unchanged. Extract mergeTaskMessagesBySeq into packages/core/chat/queries.ts and route both the realtime task:message handler and the new backfill through it, so there is one seq-merge semantics for that cache instead of two. Co-authored-by: Claude Opus 4.8 <[email protected]> Co-authored-by: multica-agent <[email protected]>	2026-06-23 16:35:29 +08:00
3 people	72179d1145	refactor(transcript): reuse payload helper + cover coalesce timestamps (MUL-3174) (#3958) ... * refactor(transcript): reuse taskMessageToPayload in WS broadcast The ReportTaskMessages WebSocket broadcast hand-built the payload and duplicated the created_at formatting that taskMessageToPayload already does. Reuse the helper with the just-inserted row, which carries the same redacted values and the DB-assigned timestamp. Co-authored-by: multica-agent <[email protected]> * test(transcript): cover coalesce created_at behavior Lock in that coalescing streaming fragments carries the latest created_at, and falls back to the previous timestamp when the merged fragment has none. Co-authored-by: multica-agent <[email protected]> --------- Co-authored-by: J <[email protected]> Co-authored-by: multica-agent <[email protected]>	2026-06-10 12:15:50 +08:00
Antoine GIRARD	9f21d0b634	feat(transcript): add timestamps to run transcript entries (MUL-3174) (#3951) ... Threads the existing task_message.created_at column through the full stack (Go protocol -> REST/WS handlers -> TS types -> transcript dialog) so agent run transcripts show per-entry timestamps, helping users spot stalled runs. Additive, no migration.	2026-06-09 19:53:30 +08:00
Qiang Zhang	1abd0e33a6	fix(transcript): close dialog on desktop navigation (#2903)	2026-06-08 15:15:44 +08:00
3 people	d6540a1869	fix(clipboard): support copy over http:// via execCommand fallback (#3810) ... navigator.clipboard is only exposed in a secure context (https or localhost). On self-hosted instances served over plain http:// it is undefined, so every copy / "copy all" / export button silently failed and left the clipboard empty (GitHub #3781). Add a shared copyText(text): Promise<boolean> helper in @multica/ui/lib/clipboard that prefers the async Clipboard API and falls back to a hidden <textarea> + document.execCommand('copy') for non-secure contexts. Migrate all direct navigator.clipboard.writeText call sites (code blocks, agent transcript copy-all, token / webhook / issue-link copy, etc.) to it, gating success side-effects on the returned boolean, and remove the now-redundant copyMarkdown wrapper. Secure-context users keep the native path unchanged. MUL-3068 Co-authored-by: J <[email protected]> Co-authored-by: multica-agent <[email protected]>	2026-06-05 14:55:23 +08:00
Bohan Jiang	72e0cb70aa	fix(transcript): truncate workdir chip + click-to-copy (#3440) ... Real workdir paths are routinely long enough to push every other chip off the transcript-dialog metadata row, leaving the row scrolling or wrapping awkwardly. Turn the chip into a fixed-width button: - max-w-[16rem] + truncate so the path tail gets a clean ellipsis no matter the depth - title attribute carries the full relative_work_dir for a hover peek - click copies relative_work_dir to clipboard, icon flips to a green Check for 2s as feedback - swap FolderTree icon for the simpler Folder mark The pre-existing privacy invariant is preserved unchanged: only the server-cleaned relative_work_dir reaches the DOM / title / clipboard; the absolute task.work_dir still never leaves the server response.	2026-05-28 16:14:50 +08:00
3 people	1195255e43	MUL-2771: feat(transcript): server-derived relative work_dir chip (#3428) ... * MUL-2771: feat(transcript): server-derived relative work_dir chip Adds a privacy-safe `relative_work_dir` field to the agent task wire shape so the transcript dialog can show where a task ran without leaking the user's home directory. Standard tasks strip the daemon's workspaces root to `<wsUUID>/<taskShort>/workdir`; local_directory tasks fall back to the trailing two path segments (`repos/foo`), which keeps enough context for the user to recognise the directory without exposing $HOME or the username. The derivation lives in `taskToResponse` so every endpoint that serves a task — list, snapshot, claim, rerun, cancel, complete, fail — fills the field consistently. taskToResponse now also populates `workspace_id`, which the prior shape declared but never set. shortTaskID mirrors execenv.shortID; a colocated test pins the two helpers together so future daemon-side layout changes don't silently degrade the chip into the local_directory fallback. Replaces the front-end stripping attempt in PR #3379, which passed issue_id where workspace_id was required and therefore rendered the full absolute path on every standard task. Co-authored-by: multica-agent <[email protected]> * MUL-2771: harden privacy guards on transcript work_dir chip Address second-round review feedback from PR #3428: 1. Drop the `title={task.work_dir}` tooltip in the transcript dialog. The visible chip was safe but native browser tooltips re-rendered the absolute `/Users/<name>/...` on hover, leaking into screen shares, screenshots, and recordings — defeating the stated goal of the chip. The absolute path now never reaches the DOM (no title, aria, or data attribute). 2. Replace the "tail two segments" fallback for local_directory paths with explicit home-prefix stripping plus a basename-only final fallback. The old behaviour leaked the username on shallow paths like `/Users/alice/foo`, `/home/alice/project`, and `C:\Users\alice\foo`. The new behaviour recognises common per-user home layouts on macOS, Linux, and Windows (case-insensitive), strips them down to the remainder, and falls back to the basename for any path under an unrecognised root — a single segment can never carry the home prefix. 3. Align the Go and TypeScript field comments with the real fallback policy so future readers see "strip home / basename" instead of the outdated "tail two segments" description. Tests: expanded `TestRelativeWorkDir` to cover shallow `/Users/...`, `/home/...`, and `C:\Users\...` paths, the exact-home edge cases, case-insensitive matching, and the non-home basename-only fallback. Co-authored-by: multica-agent <[email protected]> --------- Co-authored-by: J <[email protected]> Co-authored-by: multica-agent <[email protected]>	2026-05-28 15:53:16 +08:00
Dmitry Rybalka	7722a98a6a	fix(ui): coalesce split task transcript messages (#3097)	2026-05-28 12:34:51 +08:00
Naiyuan QingandClaude Opus 4.7	bd1fb10afa	chore: react-doctor cleanup — button types, useContext→use(), toSorted, error fixes (#3350) ... - Add explicit type="button" to 61 <button> elements missing the attribute - Replace useContext() with React 19 use() across 16 context consumers - Replace [...arr].sort() with arr.toSorted() in 12 web/desktop files (mobile excluded — Hermes lacks toSorted support) - Fix rules-of-hooks violation: useSidebar try/catch → useSidebarSafe null check - Fix nested component definition: useMemo wrapping HeaderRight → useCallback - Fix missing ARIA: add aria-expanded + aria-controls to combobox in create-squad React Doctor score: 23 → 30. No behavioral changes, no business logic modified. Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]>	2026-05-27 14:57:07 +08:00
Bohan Jiangandmultica-agent	7be3838ada	feat(transcript): add sort direction toggle to agent transcript dialog (MUL-2368) (#2848) ... Adds a header toggle that lets users flip the agent transcript between chronological (oldest first, current behavior) and newest-first. The preference is persisted via a small Zustand store. Default stays chronological so existing readers see no behavior change. Sort is a pure presentation concern — the underlying timeline (seq numbers, filter keys, segment navigation) is untouched. Toggling resets the scroll container to the top so the user lands on the newest end of the chosen direction. Copy-all respects the displayed order so the exported text matches what's on screen. Scope is limited to the task transcript dialog per the MVP plan; the issue execution log and agent activity tab are out of scope and may be revisited once this interaction validates. Closes GH #2736. Co-authored-by: multica-agent <[email protected]>	2026-05-19 16:03:31 +08:00
Kerim IncedayiandKerim Incedayi	9418d2a2c1	feat(autopilots): webhook triggers (server + CLI + UI + docs) MUL-2049 (#2348) ... * feat(server): add webhook trigger DB migration + sqlc queries Lays the foundation for webhook autopilot triggers: - partial unique index on autopilot_trigger.webhook_token (kind=webhook only) so the public ingress route can resolve a trigger in O(1) - GetWebhookTriggerByToken / TouchAutopilotTriggerFiredAt / RotateAutopilotTriggerWebhookToken / SetAutopilotTriggerWebhookToken queries, regenerated with sqlc * feat(server): webhook token generator + payload normalizer Two pure helpers for the webhook autopilot work: - generateWebhookToken: 32 random bytes -> base64-url, "awt_" prefix. 256 bits of entropy keeps brute-force off the table; the prefix makes leaked tokens recognisable in logs. - normalizeWebhookPayload: turns arbitrary JSON into the WebhookEnvelope shape (event/eventPayload/request) used by trigger_payload. Header- and body-based event inference covers GitHub, GitLab, X-Event-Type, and caller-provided envelopes; scalar/empty/invalid bodies are rejected so the handler can answer 400. * feat(server): generate webhook tokens and expose rotate endpoint - New handler.Config.PublicURL fed by MULTICA_PUBLIC_URL env so /api/autopilots/.../triggers responses can include an absolute webhook_url alongside the always-present webhook_path. - CreateAutopilotTrigger now mints a webhook_token via crypto/rand for kind=webhook and ignores cron/timezone for non-schedule kinds. api triggers stay accepted-but-inert per PLAN.md. - New POST /api/autopilots/{id}/triggers/{triggerId}/rotate-webhook-token protected by the existing workspace auth group; old tokens stop working immediately because the unique-index lookup keys on the current row value. * feat(server): public webhook ingress route + per-token rate limiter - New POST /api/webhooks/autopilots/{token} route, mounted outside the authenticated group: the path token is the credential. Workspace context is derived from the joined autopilot row, never headers. - Body capped at 256 KiB via http.MaxBytesReader; oversized payloads return 413 mid-read instead of being fully buffered. - Disabled triggers / paused / archived autopilots return 200 {"status":"ignored"} so providers stop retrying. - Skipped-runtime dispatches surface 200 {"status":"skipped"} with the reason from the autopilot service's pre-flight admission check. - WebhookRateLimiter interface with sliding-window in-memory + Redis Lua-script implementations. Default 60 req/min per token. Test coverage on the in-memory path; Redis variant fails open on cache errors so a Redis hiccup never blocks ingress. - Integration tests exercise token generation, dispatch, payload envelope persistence, GitHub-header inference, paused/disabled short-circuits, oversized rejection, and rotate-then-old-token-404. * feat(server): include webhook payload in create_issue description When an autopilot run is triggered by a webhook and execution_mode is create_issue, the agent only sees the issue body — never the run's trigger_payload. Append a 'Webhook event:' line and a fenced JSON block with the normalized eventPayload so the agent has the inbound context inline. Schedule / manual runs are unchanged. Tests cover: - schedule path keeps existing italic note, no webhook block - webhook path emits event line + payload block, italic before block - non-envelope JSON falls back to raw body (defensive) - non-webhook source with payload still gets no webhook block * feat(core): types, API client and mutations for webhook triggers - AutopilotRunStatus gains 'skipped' so the run-list UI handles the admission-skipped state explicitly instead of falling through to a generic case (the backend already emits it via MUL-1899). - AutopilotTrigger picks up optional webhook_path / webhook_url. Both are optional so older self-hosted servers that pre-date this change still parse cleanly. - buildAutopilotWebhookUrl helper composes a usable absolute URL with the priority webhook_url > apiBaseUrl + path > origin + path > path. Tested with seven cases covering each branch. - ApiClient.rotateAutopilotTriggerWebhookToken posts to /api/autopilots/{id}/triggers/{triggerId}/rotate-webhook-token; the HTTP-contract test pins URL + method. - useRotateAutopilotTriggerWebhookToken mutation invalidates autopilotKeys.detail on settle, mirroring the existing trigger-mutation pattern. * feat(views): webhook trigger UI in Add Trigger dialog and trigger row Add Trigger dialog gains a Schedule/Webhook segmented toggle: - Schedule reuses TriggerConfigSection unchanged. - Webhook hides the cron config and shows a help line; the trigger is created with kind=webhook and the URL is generated server-side. - Toast text differentiates schedule vs webhook on success. TriggerRow grows a webhook branch: - Webhook icon, kind translated via trigger_kind. - URL shown in a truncating monospace pill, with copy + rotate buttons. Copy uses navigator.clipboard with toast feedback; rotate uses an AlertDialog confirm because the old URL stops working immediately. - api triggers render a Deprecated badge and skip URL/copy/rotate affordances. RunRow gains a 'skipped' RUN_VISUAL entry (muted dash) so admission- skipped runs don't fall through to a generic case. Source label uses the new run_source i18n key instead of capitalize. Locales: en + zh-Hans gain run_status.skipped, run_source.*, trigger_kind.*, trigger_row.{copy_url,rotate_url,*_confirm_*,toast_*}, add_trigger_dialog.{type_*,webhook_help,toast_added_{schedule,webhook}}. * feat(cli): support webhook trigger creation and URL rotation - multica autopilot trigger-add now takes --kind schedule|webhook (default schedule for backward compatibility). For webhook it skips --cron / --timezone validation and prints the resulting webhook URL, preferring the server-provided webhook_url and falling back to client.BaseURL + webhook_path. - New multica autopilot trigger-rotate-url <autopilot-id> <trigger-id> command for rotating the bearer URL of a webhook trigger. * docs(autopilots): add webhook trigger guide (en + zh) Replaces the 'Webhook and API triggers are not available yet' section with end-to-end webhook documentation: how the URL is generated, what payload shapes are accepted, the inferred-event rules, the bearer-secret warning + rotate flow, status-code semantics for accepted/skipped/ ignored/4xx/5xx outcomes, and the MULTICA_PUBLIC_URL self-host configuration. Run history list now mentions skipped status. The 'unavailable features' section narrows to api-kind triggers, HMAC signing, IP allowlists, and provider presets. * feat(views): add Schedule/Webhook toggle to the create autopilot dialog Closes the gap where a brand-new autopilot could only be created with a schedule trigger. The right-column config now has a Trigger section with a segmented Schedule/Webhook control: - Schedule keeps the existing cron/timezone UI. - Webhook hides the cron UI and shows a help line; on submit, a kind=webhook trigger is created right after the autopilot. In edit mode the toggle is intentionally hidden (PLAN.md treats trigger- type changes as delete-old + create-new, not in-place updates), but the panel still picks the right kind based on props.triggers[0].kind so a webhook autopilot doesn't render an irrelevant cron form. Locales: section_trigger_kind, trigger_kind_{schedule,webhook}, section_webhook, webhook_help_{create,edit} added in en + zh-Hans. * feat(views): show webhook URL inline after creating a webhook autopilot After a successful create with kind=webhook, the dialog stays open and swaps to a confirmation panel showing the freshly minted URL with a copy button + 'Treat this URL like a password' warning + Done button. Avoids the friction of "create the autopilot, then go find it in the list, click in, scroll to triggers, copy URL." Locales: dialog.webhook_created_{title,description,warning,done} added in en + zh-Hans. Schedule create flow is unchanged (toast + close). The success panel is gated on the trigger returned from the create mutation, so a partial failure (autopilot created, trigger creation errored) still falls through to the toast_create_partial path. * feat(views): show webhook payload in run detail dialog The agent transcript dialog now accepts an optional headerSlot that sits above the event list. The autopilot RunRow drops a WebhookPayloadPreview into that slot when the run came from a webhook and trigger_payload is non-empty. The preview is collapsed by default (the transcript itself is the main event), shows the inferred event name + receivedAt in the header, and reveals the eventPayload as pretty-printed JSON with a copy button on expand. Falls back gracefully if the row's trigger_payload doesn't match the WebhookEnvelope shape — the whole value is shown instead so nothing is hidden. Closes the "agent didn't echo the payload, now I can't see what triggered the run" gap. PLAN.md tracked this as "Payload preview in run history" under follow-ups. Locales: webhook_payload.{label, unknown_event, payload, content_type, copy, copied, copied_short, copy_failed} added in en + zh-Hans. * chore(server): wire MULTICA_PUBLIC_URL through self-host compose Two small follow-ups split out of the webhook trigger PR: - docker-compose.selfhost.yml passes MULTICA_PUBLIC_URL into the backend container so a self-hosted deployment behind a real domain gets absolute webhook URLs in the trigger response. Documented in .env.example with the rationale for not deriving the public host from request headers. - Drop a duplicated 'invalid json:' prefix in the webhook ingress 400 error path. normalizeWebhookPayload already prefixes its errors, so the handler doesn't need to re-prefix. * fix(migrations): renumber webhook trigger migration 081 → 089 to avoid collision The branch's 081_autopilot_webhook_triggers.{up,down}.sql collided numerically with 081_runtime_timezone.{up,down}.sql that landed on main, making migration apply order undefined. Renumber to 089 so the file slots after the latest main migration (088_squad_instructions). The SQL itself doesn't conflict — it only creates a partial unique index on autopilot_trigger.webhook_token — but the duplicate prefix is what the migration runner sees, so the filename must move. * fix(autopilot-webhook): address PR review blocking issues - Redact bearer tokens from request logs: paths matching /api/webhooks/autopilots/<token> now log "[redacted]" instead of the token. The resolved trigger ID is plumbed via context so audit lines stay useful for debugging. (Review item Blocking #1.) - Distinguish pgx.ErrNoRows from transient DB errors in token lookup: no-row stays 404 (so providers don't retry on a deleted webhook), other errors return 500 (which providers DO retry, avoiding silent drops on DB blips). (Review item Blocking #2.) - Add per-IP sliding-window rate limiter that runs BEFORE the token lookup, so spraying random tokens can no longer probe the autopilot_trigger index unboundedly. Reuses the existing Lua script with a separate Redis key namespace; falls open on Redis errors. Default budget 30 req/min/IP. (Review item Blocking #3.) The webhook handler now applies the gates in the order: per-IP rate limit → token lookup → per-token rate limit → handler logic. * fix(autopilot): atomic webhook trigger creation + strict kind/timezone validation - Mint the webhook bearer token BEFORE the INSERT and pass it via CreateAutopilotTriggerParams so the row never exists in a half-written kind=webhook + webhook_token=NULL state. On the (vanishingly rare) unique-index collision the whole INSERT is retried with a fresh token — no UPDATE second step. Removes the now-dead attachFreshWebhookToken helper. (Review item Recommended #4.) - Add new GET /api/autopilots/{id}/runs/{runId} endpoint that returns a single run including the full trigger_payload. The list response is now slim (omits trigger_payload) so worst-case payload size drops from ~5 MB to ~5 KB. (Review item Recommended #5, server side.) - Reject kind=api with 400 ("kind=api is deprecated; use schedule or webhook") and reject kind=webhook with --timezone with 400 — both surfaces stragglers loudly instead of silently dropping fields. CLI mirrors the check so --timezone with --kind webhook errors client-side. (Review nits.) - Add --yes (-y) flag and an interactive y/N confirmation prompt to `multica autopilot trigger-rotate-url` so the destructive rotate matches the UI's AlertDialog safety. (Review item Recommended #6.) * fix(views): fetch webhook payload on-demand and truncate at 4 KiB - Add useAutopilotRun query hook + getAutopilotRun API client method paired with the new server endpoint. The run-detail dialog now mounts a WebhookPayloadSlot that fetches the full run (incl. trigger_payload) lazily — list responses no longer carry up to 256 KiB × N runs of envelope data. - WebhookPayloadPreview truncates its in-DOM <pre> at 4 KiB with a localized marker so jank-y machines aren't asked to render a 256 KiB JSON blob. The Copy button still yields the full string. - Adds the truncated_marker i18n string to en + zh-Hans. Review items Recommended #5 (frontend) and a nit on the preview's unbounded <pre>. * test(autopilot-webhook): close coverage gaps flagged in PR review - request_logger: redactWebhookPath unit tests + integration test proving the bearer token never lands in slog output, plus the webhook_trigger_id context plumbing. - autopilot_webhook_handler: empty body → 400, archived autopilot → 200 ignored, per-IP rate limiter trips before DB lookup, kind=api and webhook+timezone are rejected at 400, slim list + full detail endpoint round-trip. - webhook_rate_limiter: Lua script structure guard (catches reordering even without a live Redis), plus live-Redis tests for both per-token and per-IP limiters (REDIS_TEST_URL gated, matching the existing Redis test pattern in the package). - WebhookPayloadPreview: envelope rendering, fallback shape, and the >4 KiB truncation path with full-payload-on-Copy guarantee. Two branches are documented as code-review-protected rather than covered by tests: the 500-on-DB-error path requires injecting a stub Queries (no interface here), and the cross-workspace defense-in-depth check is unreachable from valid SQL state. * fix(middleware): SetWebhookTriggerID must mutate request in place The round-1 helper returned a fresh *http.Request from WithContext, and the webhook handler did `r = SetWebhookTriggerID(r, ...)`. That swaps the handler's local pointer but doesn't propagate the new context back to RequestLogger, which is still holding the original *http.Request — so the audit line never actually included webhook_trigger_id in production. The round-1 test happened to pass because it pre-stashed the value on the request before calling ServeHTTP, bypassing the bug it was meant to verify. Switch to in-place mutation via `*r = *r.WithContext(...)` so the wrapping middleware sees the new context after next.ServeHTTP returns, and update the test to exercise the real call pattern (set the context from inside the handler, assert the surrounding logger reads it). Verified live: an accepted webhook now logs path=/api/webhooks/autopilots/[redacted] webhook_trigger_id=<uuid> * fix(autopilot-webhook): symmetric ErrNoRows split + trusted-proxy gate Round-2 review (Bohan-J, PR #2348 follow-up): - Must-fix #1: the second lookup at autopilot_webhook.go:258 (GetAutopilot after the token resolves) was folding every error into 404. A transient DB blip would tell a webhook sender "not found" and it would never retry. Apply the same errors.Is(err, pgx.ErrNoRows) → 404 / else → 500 split as the first lookup got in round 1. - Must-fix #2: clientIPForRateLimit was honoring X-Forwarded-For / X-Real-IP from any caller. An attacker spraying random tokens could just rotate the XFF header and the per-IP bucket became per-request, so the limiter that's specifically supposed to gate spraying before it hits the DB unique index was bypassed. New shape — matches Bohan's suggestion exactly: * Default: r.RemoteAddr only, headers ignored. * Operator opt-in via MULTICA_TRUSTED_PROXIES (comma-separated CIDRs). XFF/X-Real-IP are honored only when r.RemoteAddr is inside one of the listed prefixes; otherwise they're dropped. Wired through .env.example and docker-compose.selfhost.yml so self-host operators can configure their reverse-proxy's CIDR. Invalid CIDRs in the env var are dropped with a single slog.Warn at startup rather than crashing the server. Uses net/netip (stdlib, value-typed) for parsing and containment checks. Verified live on the rebuilt self-host backend: a 35-request spray from one source with rotating XFF gets the expected 30× 404 + 5× 429, proving the per-IP bucket is keyed on the real connection IP. * fix(autopilot): reject cron/timezone PATCH on non-schedule triggers Round-2 review should-fix. CreateAutopilotTrigger already 400s on kind=webhook + timezone/cron_expression, but UpdateAutopilotTrigger silently wrote those fields regardless of prev.Kind. The values then sat in the DB visible to nobody and read by nothing — a back door that left the API contract fuzzy across create vs update. Mirror the create-path discipline: after loading prev, if prev.Kind != "schedule" and the PATCH body sets cron_expression or timezone, return 400 with a clear message. enabled and label remain accepted on every kind. The existing prev.Kind == "schedule" guard on next_run_at recompute stays as belt-and-braces, but with this gate in place the recompute branch is now reachable only for the kind it was meant for. * test(autopilot-webhook): close round-2 coverage gaps - IPRateLimitNotBypassedByXFFSpoof: drives the must-fix #2 invariant by rotating XFF across three calls from the same RemoteAddr and asserting the third gets 429. Pre-round-2 this test would have passed for the wrong reason (limiter trusted XFF, so per-bucket collision was incidental); now it pins the bypass-closed property. - IPRateLimitReturns429BeforeDBLookup: updated to set RemoteAddr explicitly and drop the XFF header it was leaning on. With TrustedProxies empty (test default) the limiter keys on the real connection IP, which is what the test wants to assert anyway. - UpdateAutopilotTrigger_RejectsCronExpressionOnWebhookKind + UpdateAutopilotTrigger_RejectsTimezoneOnWebhookKind: drive the round-2 should-fix from the handler boundary. - UpdateAutopilotTrigger_AcceptsEnabledAndLabelOnWebhookKind: counter test so a regression to a blanket reject is caught. * fix(migrations): bump webhook trigger migration 089 → 091 origin/main added 089_squad_no_action_activity_index (and 090_task_is_leader) since our last rebase, re-colliding with our 089_autopilot_webhook_triggers. Bump to 091 so the filename ordering is unambiguous again. The SQL is unchanged — same partial unique index on autopilot_trigger.webhook_token — only the filename moves. * fix(views): dedupe skipped icon in autopilot RUN_VISUAL after rebase The rebase against origin/main merged main's add of `Ban` for the skipped status next to our round-1 `MinusCircle` entry, leaving the RUN_VISUAL map with two `skipped` keys (only the last would have been read at runtime, and MinusCircle had been dropped from the imports during conflict resolution — so the file would not compile). Keep main's `Ban` icon (latest design) and a single `skipped` entry. Carry over the round-1 comment about why the muted styling matters for failure-ratio readability. --------- Co-authored-by: Kerim Incedayi <[email protected]>	2026-05-18 12:17:39 +08:00
Jiayuan Zhangandmultica-agent	c3832302b9	fix(transcript): expand long single-line Agent messages (multica#2282) (#2308) ... Agent text rows in the run-records dialog only got a chevron when the message had a newline; a long single-line reply was rendered with truncate and the trailing content was unreachable. Other event types (tool_use, tool_result, thinking, error) are expandable on any non-empty content — bring text in line. Also lead the collapsed summary with the first non-empty line instead of the last, so multi-paragraph replies preview the lede rather than the closing remark and the row stays stable while messages stream. Co-authored-by: multica-agent <[email protected]>	2026-05-09 07:53:45 +02:00
Naiyuan QingandClaude Opus 4.7	3447764b03	feat(i18n): full rollout — 21 namespaces translated (en + zh-Hans) (#1853) ... * feat(i18n): rollout phase — translate 9 namespaces (WIP) Phase 1 complete (基建 + login + Settings language switcher), phase 2 partial (Wave 4 done, search done). Pending namespaces documented inline; another developer can pick up from here. Infrastructure -------------- - server: add users.language column + extend PATCH /api/me (TestUpdateMeAcceptsLanguage / TestUpdateMePreservesLanguage) - packages/core/i18n: types / pickLocale (intl-localematcher) / browser-cookie-adapter / createI18n (initAsync false + useSuspense false) / I18nProvider / LocaleAdapterProvider - Split server-safe vs React entries: @multica/core/i18n — for proxy/RSC/middleware (no React) @multica/core/i18n/react — for client trees (createContext) (RSC vendored React lacks createContext; mixed import would crash proxy.ts at module load.) - packages/views/i18n: useT hook + selector API augmentation (i18next v26 default; auto-propagates to apps via the side-effect import in use-t.ts). - apps/web: proxy.ts (Next 16 renamed middleware) merges existing legacy/root redirects with x-multica-locale header forwarding; layout.tsx reads locale via headers() and pre-loads RSC resources. - apps/desktop: webPreferences.additionalArguments injects systemLocale (no sendSync — avoids main-thread blocking IPC); renderer adapter reads via process.argv. - ESLint: i18next/no-literal-string at file-scope for translated files via packages/views/eslint.config.mjs TRANSLATED_FILES. - glossary.md (packages/views/locales/) freezes term policy: Issue / Workspace / Agent / Skill / Autopilot / Daemon / Runtime stay English; Inbox / Project / Comment / Member translate. Translated namespaces (9 / 19) ------------------------------ - auth: login page (web wrapper含 desktop-handoff 文案) + Settings Appearance language switcher - editor: 9 .tsx (bubble-menu / link-hover-card / readonly-content / title-editor / extensions: code-block / file-card / image-view / mention-suggestion) + 32 keys - invite: 25 keys - labels / members / my-issues: Wave 4 全部 - search: command palette 35 keys - navigation: no user-facing strings (no-op) Pending (10 / 19) ----------------- issues (46 files / ~210 keys) agents (29 files / ~155 keys; presence.ts + config.ts label maps 允许进 i18n) onboarding (22 files / ~150 keys) settings rest / skills / modals / workspace / chat / inbox / projects / autopilots / layout Workflow for picking up ----------------------- - Glossary: packages/views/locales/glossary.md (mandatory read) - Reference impls: auth/login-page.tsx + editor/* (selector API + i18n-provider test wrapper pattern) - Per namespace: 1. create locales/{en,zh-Hans}/{ns}.json 2. add to packages/views/i18n/resources-types.ts 3. useT('{ns}') + t($ => $.foo) in components 4. add files to TRANSLATED_FILES in eslint.config.mjs 5. typecheck + test + lint must pass - Subagents currently CANNOT write files (sandbox deny). Run as hybrid: subagent researches + outputs full JSON + tsx diff, controller writes. Other ----- - scripts/init-worktree-env.sh: default MULTICA_DEV_VERIFICATION_CODE=888888 in dev for deterministic login (gated by isProductionEnv). Verified: pnpm typecheck (6 pkgs ok), pnpm test (232 pass), make test (Go). Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * docs(i18n): rewrite glossary aligned with docs zh voice Switch translation policy to match the canonical CN voice already established in apps/docs/content/docs/*.zh.mdx (20+ files). The new rule splits product nouns into two classes: - Typed entities (issue / project / skill / autopilot / task) — kept as lowercase English in CN text, visually marking them as system types. - Concepts (workspace / agent / daemon / runtime / inbox) — fully translated (工作区 / 智能体 / 守护进程 / 运行时 / 收件箱). Previous glossary kept Workspace / Agent / Daemon / Runtime as English on "工程惯例" grounds, but docs zh and CN AI ecosystem (Coze / 腾讯元器 / 百度) consistently translate these. App UI now matches docs voice so users don't see split personality between the app and its own docs. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * fix(i18n): register 6 namespaces and retrofit zh strings to new glossary Two fixes that were blocking the previously-translated namespaces from actually rendering in CN: 1. RESOURCES gap — locales/index.ts only loaded common/auth/settings, but resources-types.ts declared 12 namespaces and 6 of them had real translation content. At runtime i18next would fall back to raw keys for editor / invite / labels / members / my-issues / search. Register all 9 currently-translated namespaces. 2. Retrofit zh strings to the docs-aligned glossary: - "Issue" → "issue" (lowercase entity) - "Workspace" → "工作区" - "Agent" → "智能体" - "Runtime" → "运行时" - "Skill" → "skill" (lowercase) - "项目" → "project" (lowercase) Touched: editor.json (sub_issue + mention.group_issues), invite.json (3 Workspace occurrences), members.json (agents_section / more_agents), my-issues.json (8 retrofits across page/header/errors), search.json (13 retrofits across groups/pages/commands/empty). Verified: pnpm typecheck (6/6) + pnpm test (238/238) all green. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * feat(i18n): translate inbox namespace First namespace through the sub-agent → main-agent integration pipeline. JSON: en/inbox.json + zh-Hans/inbox.json — 60 keys across page / menu / list / detail / types / labels / errors. Time-formatter labels are kept compact in EN ("5m" / "3h" / "2d") and use full units in zh ("5 分钟" / "5 小时" / "5 天") since raw "5 分" reads as "5 marks/points" in CN. Component changes converted two module-level statics into hooks so the strings can flow through i18next: - inbox-list-item.tsx: `timeAgo` (pure fn) → `useTimeAgo` (hook returning a fn). The local copy is a duplicate of @multica/core/utils `timeAgo` that is only used by inbox-page; other consumers across chat/agents/skills/issues stay on the core util for now and will be translated when their namespaces land. - inbox-detail-label.tsx: `typeLabels` (static const Record) → `useTypeLabels` (hook returning the same Record shape). Call sites keep the existing `typeLabels[type]` access pattern. inbox-page.tsx now uses both hooks and `useT('inbox')` selector calls for all hardcoded strings (~24 sites: header / dropdown menu / list empty state / detail panel / mobile back / quick-create-failed flow / all error toasts). Wired up: resources-types.ts, locales/index.ts RESOURCES, ESLint TRANSLATED_FILES (3 inbox tsx files now lint-protected). Verified: pnpm typecheck (6/6) + pnpm --filter @multica/views test (238/238) + ESLint clean on inbox/. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * feat(i18n): translate workspace namespace Translates the three workspace shell views: create-workspace-form, new-workspace-page, no-access-page. Also fixes the prior-art no-unescaped-entities lint errors in no-access-page.tsx — the apostrophes in "doesn't" / "don't" were JSX text literals that move into JSON values after translation, so the lint rule no longer fires. Tests wrapped: workspace/create-workspace-form.test.tsx, workspace/no-access-page.test.tsx, modals/create-workspace.test.tsx all now wrap render() with <I18nProvider locale="en"> so the en values in workspace.json drive the rendered text and the existing assertions continue to match. Slug constants kept: WORKSPACE_SLUG_FORMAT_ERROR / WORKSPACE_SLUG_CONFLICT_ERROR exports in workspace/slug.ts are still imported by onboarding/steps/step-workspace.tsx (out of scope here). The workspace shell now reads its strings from workspace.json directly. Multica.ai brand prefix in the slug input affordance is wrapped with an inline `// eslint-disable-next-line i18next/no-literal-string` per glossary policy on brand names. Renamed sign_in_other → sign_in_different to avoid colliding with i18next's `_other` plural-suffix convention which the selector-API typings treated as a plural form of `sign_in`. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * feat(i18n): translate projects namespace Translates the projects list page, project detail page, project picker dropdown, and project chip — all four user-facing surfaces under packages/views/projects/components/. New file: projects/components/labels.ts exposes three hooks that replace the static `.label` field on PROJECT_STATUS_CONFIG / PROJECT_PRIORITY_CONFIG and the previous module-level `formatRelativeDate` helper. Core's `.label` stays untouched (it's still consumed by search and the create-project modal, both out-of-scope for this namespace) — those will flip when their respective namespaces translate. In zh, the "project" entity stays lowercase English per glossary (`新建 project`, `还没有 project`, `从 project 移除`). Status / priority / table column labels translate fully. The cancelled / done / paused etc. status labels duplicate per- namespace as `projects.status.*` rather than reading from a future shared status namespace. This matches the auth/inbox/workspace pattern of self-contained namespaces. If a generic "issue/project status" pool emerges later, these can collapse. Verified: pnpm --filter @multica/views typecheck (clean) + test (238/238) + ESLint clean on projects/ (1 pre-existing warning about useEffect/sidebarRef dep, unrelated to i18n). Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * feat(i18n): translate autopilots namespace Six tsx files: autopilots-page (list + 6 templates), autopilot-detail-page (properties / triggers / run history / delete), autopilot-dialog (create + edit dialog), trigger-config (cron form), and the agent / timezone pickers. Hook conversions for module-level helpers that need t(): - summarizeTrigger / describeTrigger → useSummarizeTrigger / useDescribeTrigger (no external callers, removed the plain exports) - formatRelativeDate → useFormatRelativeDate (per-component hook) - formatCountdown → useFormatCountdown (per-component hook) - TEMPLATES array now keyed by id; titles + summaries pull from templates/{id}/{title,summary} JSON. Prompts stay raw EN since they're injected directly into the agent task — translating them would translate the agent's instructions, not the user's UI. Status / execution-mode / run-status enums render via t($ => $.status[k]) with k typed against the core type (no separate hook needed). Verified: pnpm --filter @multica/views typecheck (clean) + test (238/238) + ESLint clean on autopilots/. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * feat(i18n): translate skills namespace Seven tsx files: skills-page (list + filters + intro banner), skill-detail-page (the giant — properties + file tree + sidebar + conflict banner + delete dialog, ~963 lines), create-skill-dialog (chooser + manual + URL forms), runtime-local-skill-import-panel (local runtime browse + import), skill-columns, file-tree, file-viewer. Notable patterns: - `createSkillColumns` factory → `useSkillColumns` hook so column headers flow through useT. Column identity changes per render is fine — DataTable handles it. - `validateNewFilePath` (pure helper) → `useValidateNewFilePath` hook so the 5 validation error messages can be translated. - skill_files / used_by / description_with_agents use i18next plural keys (`_one` / `_other`) — the type system collapses these into a single PluralValue access, so call sites use `t($ => $.foo, { count })` and i18next picks the form. - Per glossary, "skill" stays lowercase EN in zh ("新建 skill", "已删除 skill", "未找到该 skill"). Test wrapper: runtime-local-skill-import-panel.test.tsx now wraps render() with <I18nProvider> so the assertion on /Import to Workspace/i matches the EN translation. Verified: pnpm --filter @multica/views typecheck (clean) + test (238/238) + ESLint clean on skills/. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * feat(i18n): translate chat namespace Translates all 10 chat surfaces: FAB tooltip, input placeholders, message list (replied-in / failed-after / tools group / show-details / tool result preview), session history (header + time-ago labels), chat window (new-chat / restore / expand / minimize / agent + session dropdowns / starter prompts / empty states), context-anchor button + card tooltips, no-agent banner, offline / unstable banner, and the task-status pill (queued / starting up / thinking / typing + tool labels: running command / reading files / searching code / making edits / searching web). Hook conversions: - formatTimeAgo (chat-session-history) → useFormatTimeAgo - ElapsedCaption now takes a typed `variant` ("replied" | "failed") instead of a free-text `verb` so the i18n key is enumerable - pickStage (task-status-pill) refactored: pure pickStageKeys returns StageKey + optional ToolKey; useResolveStage maps to localized labels Translation policy notes: - Starter prompts ("List my open tasks by priority", etc.) are user UI when displayed AND the user's input when clicked — translating them sends the agent the user's locale-native phrasing, which is the right UX for a CN user using a CN agent. - buildAnchorMarkdown (chat-window) stays in English: it's an agent-bound markdown prefix injected into the outgoing message, not user-facing UI. Verified: pnpm --filter @multica/views typecheck (clean) + test (238/238). Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * feat(i18n): translate modals namespace Translates all 11 modal sources: registry (no UI text), backlog-agent-hint, set-parent-issue, add-child-issue, delete-issue-confirm, feedback, issue-picker, create-workspace, create-project, create-issue (manual), quick-create-issue (agent panel). Notable patterns: - create-project re-uses useProjectStatusLabels / useProjectPriorityLabels hooks from views/projects/components/labels — same translation source as the projects list / detail, no duplication. - create-issue.tsx: renamed `toast.custom((t) => ...)` callback param to `toastId` to avoid shadowing the closure-captured useT() `t` function. - Test wrapper added to modals/create-issue.test.tsx so the two assertions on rendered modal text (success toast + Create another) match the EN bundle. modals/create-workspace.test.tsx was already wrapped (workspace ns commit). Verified: pnpm --filter @multica/views typecheck (clean) + test (238/238). Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * feat(i18n): translate settings namespace (rest of tabs) Builds on the appearance-tab + language switcher already shipped in Phase 0. Translates the remaining 8 settings surfaces: settings-page shell (left nav + tab keys), account / profile, notifications-tab (5 group labels + descriptions), tokens-tab (create / list / revoke / created dialog), workspace-tab (general fields + danger zone + leave/delete confirmations), members-tab (invite + role config + revoke / remove flows), repositories-tab, labs-tab, delete-workspace-dialog. Hook conversion: members-tab `roleConfig` static const → `useRoleLabels` hook returning a Record<MemberRole, {label, description, icon}>. The icon stays as a typed React component (Crown / Shield / User), so rendering pattern is unchanged at call sites. Test wrapper: settings/components/delete-workspace-dialog.test.tsx now wraps render() with <I18nProvider> (custom render() helper) because the test asserts on rendered button labels ("Delete workspace", "Cancel", "Deleting..."). Verified: pnpm --filter @multica/views typecheck (clean) + test (238/238). Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * feat(i18n): translate runtimes namespace (entry surfaces) Translates the user-facing runtime list page surfaces: runtimes-page (header / search / filters / chips / empty / no-matches / bootstrapping), runtime-detail (topbar + delete dialog + delete toasts), runtime-detail-page (not-found state), shared.tsx (4-state HealthBadge labels). Hook conversion: shared `healthLabel(health)` was a pure module-level function. Added `useHealthLabel` hook for translated call sites; kept `healthLabel` as an EN-only fallback for non-component callers (column factory in runtime-columns). Deferred: - runtime-list / runtime-columns (data table column headers + cell bodies) — large surface, not in the page-load critical path. - connect-remote-dialog / update-section / usage-section — secondary flows, English remains acceptable until a focused pass. - charts/* — primarily numeric tooltips and axes; minimal user-visible text. Verified: pnpm --filter @multica/views typecheck (clean) + test (238/238). Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * feat(i18n): translate layout namespace (sidebar nav, help, loader) Translates the cross-cutting layout chrome: - 9 sidebar nav labels (inbox / my issues / issues / projects / autopilots / agents / runtimes / skills / settings) — driven by labelKey instead of inline strings, resolved via useT at render. - HelpLauncher dropdown (trigger aria + 3 items: Docs / Change log / Feedback) - WorkspaceLoader (named + unnamed loading states) - SortablePinItem unpin tooltip Pattern shift in app-sidebar.tsx: nav arrays carry `labelKey: NavLabelKey` (typed against the layout JSON) instead of `label: string`. The string comparison checks (`item.label === "Inbox"`) became cleaner ID-based checks (`item.key === "inbox"`). Deferred: deeper sidebar surfaces — workspace switcher dropdown, "New Issue" CTA, "Pinned" / "Workspace" / "Configure" group labels — remain English. The 9 nav labels are the ones that read in every session. Verified: pnpm --filter @multica/views typecheck (clean) + test (238/238). Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * feat(i18n): translate onboarding namespace (welcome + step header) Translates the user-first-impression surfaces of the onboarding flow: - step-welcome.tsx (the wordmark, headline, lede paragraphs, all CTAs: Download Desktop / Continue on web / Start exploring / I've done this before, illustration caption) - step-header.tsx ("Step N of M" counter + matching aria-label) - onboarding-flow.tsx (skip-onboarding error toast) Test wrapper added to onboarding/components/step-header.test.tsx — custom render() helper wraps with <I18nProvider> so the "Step 2 of 5" assertions match the EN bundle. Deferred (acceptable English fallback for now): step-questionnaire, step-workspace, step-runtime-connect, step-platform-fork, step-agent, step-first-issue, cli-install-instructions, option-card, runtime aside panels, starter-content-prompt, cloud-waitlist-expand. These are deeper steps with significant copy that would benefit from a focused dedicated pass — voice on each is more nuanced (questionnaire options, runtime install instructions, agent template recommendations). Verified: pnpm --filter @multica/views typecheck (clean) + test (238/238). Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * test(i18n): add EN/zh-Hans key parity guard Schema-level vitest that walks RESOURCES.en and RESOURCES["zh-Hans"] namespace by namespace and asserts both bundles cover the same key set. i18next plural rule is normalized before compare (`_one` / `_other` collapse to a single logical key) so EN's plural pair matches zh's `_other`-only form. Catches retrofit drift where a new EN key lands without zh — previously this would silently fall back to the English string in production. Cheap to keep green: 39 tests across 21 namespaces in under a second. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * feat(i18n): translate issues namespace Translates the entire issues surface — list / board / detail / comments / sub-issues / activity feed / batch toolbar / pickers / context menu / backlog-agent hint dialog / labels panel. Component coverage: - issues-page (page header, empty state, move-failed toast) - issues-header (scope tabs, filter dropdowns w/ status/priority/ assignee/creator/project/label, display settings, sort, view toggle) - issue-detail (page header, breadcrumb, properties / parent issue / details / token usage sections, sub-issues, activity timeline, formatActivity for status/priority/assignee/title/due-date changes, subscribe/subscriber popover) - comment-card + comment-input + reply-input (delete dialog, edit/save, copy/edit/delete row, reply count, placeholders, expand/collapse) - agent-live-card (is-working banner, tool count, stop / transcript) - execution-log-section (section header, show/hide past runs, trigger text builder, status labels, cancel-task) - batch-action-toolbar (selected count, delete dialog with plurals) - backlog-agent-hint-dialog (full dialog content) - labels-panel (intro, create form, list, delete dialog) - pickers (status / priority / assignee / due-date / label / property search placeholder + no-results) - issue-actions-menu-items (all dropdown / context menu items) - use-issue-actions / use-issue-timeline (toast strings) STATUS_CONFIG / PRIORITY_CONFIG label rendering routed through $.status[enum] / $.priority[enum] at every call site; the core config keeps its English fallback for non-i18n consumers but UI never reads .label directly anymore. Tests retrofitted: issues-page, issue-detail, and issue-actions-menu RTL specs now wrap renders in <I18nProvider> with the EN bundle, so their string assertions match the bundle (not hardcoded literals). ESLint i18next allow-list extended to 24 issues files. Verified: pnpm --filter @multica/views typecheck + test (277/277) all green. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * feat(i18n): translate agents namespace Translates the agents listing + detail surface and the create/duplicate flow. Covers the high-frequency surfaces; deeper sub-tab editors (activity / instructions / skills / env / custom-args bodies, and the hooks-buggy runtime/model/concurrency pickers) are deferred — they have their own pre-existing react-hooks rule violations and benefit from a focused dedicated pass. Component coverage: - agents-page (page header w/ tagline + new button, scope segment, search, sort dropdown, availability chips, archived toolbar, empty state, no-matches messaging w/ search interpolation, list-load error) - agent-detail-page (back link, archived banner, archive dialog, not-found state, all 4 toast strings) - agent-detail-inspector (avatar editor, name + description popover, description dialog, every PropRow label, validation message, presence badge label sourced from $.availability[enum]) - agent-overview-pane (tab labels, discard-unsaved-changes dialog) - create-agent-dialog (title / description / labels / placeholders / duplicate-suffix / runtime filter buttons / runtime status copy) - agent-row-actions (full dropdown items + cancel-tasks dialog with pluralized "N running + M queued" summary + archive dialog + 6 toasts) - agent-columns (every header cell, You / Archived chips, runtime fallback labels, availability + workload labels via $.availability / $.workload, activity tooltip body w/ created_today / created_days_ago / runs / failed-percent interpolation) - inspector/skill-attach (Attach trigger label + aria) availabilityConfig and workloadConfig now keep colors only — the display label lives in the bundle, sourced via $.availability[enum] and $.workload[enum] at every call site. Same pattern as STATUS_CONFIG/PRIORITY_CONFIG in the issues namespace. ESLint i18next allow-list extended to 8 agents files. Verified: pnpm --filter @multica/views typecheck + test (277/277) all green. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * fix(i18n): clear 30 stray EN strings in translated files Tail of literal strings missed in earlier passes — the ESLint i18next allow-list flagged them but they slipped through review. Files touched: - layout/app-sidebar.tsx (10 keys: Workspaces / Pending invitations / Create workspace / Join / Decline / Log out / New Issue + shortcut / Pinned / Workspace / Configure) - runtimes/components/runtime-detail.tsx (Serving header + serving_count pluralization, no_agents copy, running/queued chips with count interpolation, Diagnostics header, CLI label, Delete runtime button, Technical details toggle, last seen interpolation) - onboarding/steps/step-welcome.tsx (entire WelcomeIllustration mock — 5 cards × actor names + body copy + 3 mention chips + 2 timestamps; zh translation reads naturally instead of leaving the demo English) - settings/components/labs-tab.tsx (`Co-authored-by: ...` git trailer wrapped in {} so linter sees a JS string, not JSX text — magic identifier git relies on, must not translate) - settings/components/members-tab.tsx (✓ glyph wrapped in {}) - modals/feedback.tsx (⌘↵ shortcut wrapped in {}) ServingAgentsCard now reads availability/workload labels from `agents` namespace (cross-namespace useT) so the bundle-truth pattern holds: presenceConfig keeps colours only, label text comes from the shared bundle. Verified: typecheck + 277/277 tests + lint (only the pre-existing react-hooks rule-of-hooks errors remain, which task #6 addresses). Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * fix(agents): rules-of-hooks + translate 4 model/runtime pickers Three pre-existing react-hooks/rules-of-hooks violations + one missing useMemo dep cleared, then the four pickers wired through useT. Hook order fixes: - concurrency-picker: useEffect now runs before the !canEdit early return. Stale-draft reset still works the same way. - runtime-picker: useMemo for the filtered list moved above the !canEdit branch. - model-dropdown: `models = data?.models ?? []` was minting a fresh array each render and tripping the deps lint of the downstream useMemo. Wrap in useMemo so the reference is stable. Translation coverage: - concurrency-picker: tooltip ("Concurrency · N max..."), range helper text, Save button. - runtime-picker: trigger label fallback ("No runtime"), tooltip text composed from {{name}} + status, Mine/All filter buttons, empty-list copy, "owned by {{name}}" + status fragments in row tooltip, Cloud badge, online/offline aria. - model-picker: trigger label, tooltip, "Managed by runtime" fallback, search placeholder, "Discovering models…", default badge, "No models available", "Use \"X\"" custom-id flow, Clear button + its title. - model-dropdown: every label string including the "Select a runtime first" / "Default (provider)" / "Runtime offline — enter manually" trigger fallbacks, the supported=false explanation block, discovery failed badge, all popover items. ESLint allow-list extended to 4 picker files. Verified: typecheck + 277/277 tests + lint (0 errors, only pre-existing react-hooks warnings in unrelated files). Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * feat(i18n): translate runtimes list + connect dialog + CLI updater Three deep runtime surfaces wired through useT, with the agents namespace doing double duty for shared availability/workload labels. runtime-columns: - 7 column headers via t-augmented createRuntimeColumns({ t }). - HealthCell now reads from useHealthLabel() (already translation-aware) instead of the EN-only healthLabel() helper. - WorkloadCell sources the label from $.workload[enum] (cross-namespace to agents) — colour stays via workloadConfig. - CostCell delta "flat" copy + CLI cell "Desktop" badge + update- available aria/tooltip + RowMenu's full delete dialog (title / description with {{name}} interpolation / cancel / confirm / deleting state) plus its admin-permission hint. connect-remote-dialog: - Three steps fully translated: instructions (header + 4 numbered steps + security warning + troubleshooting list with mono code snippets escaped as JS strings), waiting (loader + hint), success (CTA pair). - Mono CLI commands wrapped in {} so linter sees JS strings — those are literal commands that must stay untranslated for the user to paste into a terminal. update-section: - statusConfig collapsed to icon+colour only; labels move to $.update.status[enum] for proper translation per-state. - "CLI Version:" / "Latest" / "available" / "Update" / "Retry" copy + the "Managed by Desktop" tooltip and disabled hint. Layout helpers tagged: runtime-list passes `t` through to the column factory the same way agent-columns does. ESLint allow-list extended with the 4 wired files. Verified: typecheck + 277/277 tests + 0 i18n lint errors. usage-section.tsx (KPI cards / WhenChart / TopUsageBreakdown / receipt table) is the remaining runtimes surface — chart-heavy and benefits from a focused pass next. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * feat(i18n): translate 5 agent detail tabs + skill-add dialog The 5 tabs that fill the agent detail right pane plus the shared skill picker dialog. Agents bundle gains a `tab_body` block with sub-namespaces per tab + a `common` slot for save/add/unsaved. Tab coverage: - instructions-tab: intro paragraph, multi-line example placeholder (full 18-line zh translation), Save / Unsaved. - env-tab: read-only intro / empty state, editable intro with two inline `<code>` env-var examples kept English (mono terminal payloads), KEY / value placeholders, Show/Hide value aria, Add / Remove aria, all 3 toasts (duplicate keys / saved / save failed). - custom-args-tab: intro about whitespace splitting, launch-mode prefix line + `<your args>` placeholder, --flag value placeholder, Add, Remove aria, both toasts. - skills-tab: intro, Add skill button, import-hint callout, empty state title + hint + add-CTA, remove-failed toast. - activity-tab: 3 section titles (Now / Last 30 days / Recent work), active-task pluralization, performance subtitle, all 3 empty states, runs/success%/avg-duration/failed pluralization with interpolation, source labels (Issue / Chat / Autopilot / Untracked), source fallbacks (Quick create / Creating issue / Chat session / Autopilot run), issue-short fallback, "Triggered by" tooltip header, open-issue / transcript / cancel-task tooltips and ARIAs, cancelling state, started/dispatched/queued time prefixes, show more. - skill-add-dialog: dialog title + description, empty list copy, Cancel button, add-failed toast. skills-tab.test.tsx wrapped in <I18nProvider> with the EN bundle so its `Local runtime skills are always available` assertion still matches the resolved translation instead of the raw key path. ESLint allow-list extended with the 6 wired files. Verified: typecheck + 277/277 tests + 0 i18n lint errors. Only the per-test mock for skills-tab needed wrapping; the other 4 tabs ship without test files of their own and inherit the I18nProvider chain via agent-overview-pane / agent-detail-page test renders (when those exist later). Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * feat(i18n): translate onboarding step-questionnaire + option-card The user-profile step (3 questions) is the first deferred onboarding deep step now wired through useT. step-questionnaire: - Eyebrow + headline + answered-progress counter with {{count}} interpolation - All 3 questions and their option labels (team size / role / use case) - All 3 "Other" placeholders for free-text fallback - Right-rail "Why three questions" / "What you get" panel: 2 eyebrow rows, 2 unlock-item title+body pairs, learn-more link - Back / Continue buttons via shared `common` block option-card: shared "Other" radio label and aria. Test wrapped in <I18nProvider>. EN value of `other_label` kept as "Other" so the existing /^other$/i regex in step-questionnaire.test keeps matching after the rendering pipeline switched from a hardcoded literal to a bundle lookup. ESLint allow-list extended with these 2 files. The remaining 4 deep steps (workspace / runtime-connect / platform-fork / agent), the 2 ancillary surfaces (cli-install-instructions / starter-content- prompt), and the 3 side panels (runtime-aside-panel / cloud-waitlist- expand / compact-runtime-row) will be surfaced + swept by the global ESLint switch (next commit). Verified: typecheck + 277/277 tests + 0 i18n lint errors. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * feat(i18n): flip ESLint to glob + drain remaining hardcoded EN ESLint i18next/no-literal-string now applies to **/*.tsx by default instead of an explicit allow-list. Files that genuinely still need hardcoded EN are listed in STILL_HARDCODED — concrete, finite, and the goal is to drain that list to zero. Tail strings translated in this commit (surfaced by the global flip): - common/task-transcript/agent-transcript-dialog.tsx — full dialog: status badge (Running / Completed / Failed), sr-only DialogTitle, Filter dropdown trigger + Clear filters, Copy all / Copy filtered / Copied, tool-calls + events metadata chips with pluralization, events-filtered "{{shown}} of {{total}}" interpolation, "Waiting for events..." live state, "No execution data recorded." past state. New `transcript` block in agents namespace. - runtimes/components/charts/activity-heatmap.tsx — Less / More legend labels around the contribution-style heat squares. - search/search-trigger.tsx — sidebar Search... button label. ⌘ glyph wrapped in {} to satisfy the linter (mono shortcut symbol, not translatable). Holdouts (STILL_HARDCODED, ~14 files): the deep onboarding steps (workspace / runtime-connect / platform-fork / agent / first-issue / cli-install-instructions, plus 4 ancillary panels), the runtimes usage-section + KPI cards, and 5 minor agent visual primitives (sparkline / agent-presence-indicator / agent-profile-card / visibility-badge / char-counter). Each one gets a dedicated future pass; the global rule prevents new hardcoded strings from landing elsewhere. Verified: typecheck + 277/277 tests + 0 i18n lint errors. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * feat(i18n): drain agent visual primitives + onboarding small components 8 files removed from STILL_HARDCODED: agents/components/: - char-counter — over-limit text with {{count}} interpolation - visibility-badge — uses new agents.visibility.{private,workspace}. {label,tooltip} block; drops VISIBILITY_LABEL/TOOLTIP imports from core in favour of bundle-driven copy - agent-presence-indicator — availability + workload labels via $.availability[enum] / $.workload[enum] (cross-namespace), queue-badge "+N queued" with pluralization - agent-profile-card — Agent unavailable / Detail link / Owner / Skills / Runtime / Unknown runtime / Archived chip / availability line via cross-namespace lookup agents.json: new presence + visibility + profile_card + char_counter blocks. onboarding/components/: - compact-runtime-row — online/offline aria via agents.availability - runtime-aside-panel — full content (What's a runtime / Good to know / Swap anytime / Add more later / docs link) - starter-content-prompt — full dialog (title / description with inline emphasis / both buttons / 3 toasts) - cloud-waitlist-expand — intro paragraph + warning span / email + reason labels + placeholders + Optional badge / Join + on-list states / both toasts onboarding/steps/: - cli-install-instructions — copy aria + intro + 2 step labels onboarding.json: new runtime_aside / cli_install / starter_content / cloud_waitlist blocks. Tests for step-platform-fork + step-runtime-connect wrapped in <I18nProvider> with EN bundle so /you're on the list/i etc. still matches the resolved translations. Verified: typecheck + 277/277 tests + 0 i18n lint errors. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * feat(i18n): translate onboarding deep steps The 5 large onboarding steps that were deferred from earlier passes, plus their support helpers, all wired through useT. step-first-issue (final beat — flips onboarded_at): - error_title / Retry / retry_failed toast / finishing / opening states. step-agent (creates the user's first agent): - Templates moved from a module-level const to a useT-driven useAgentTemplates() hook. Names + emoji stay constant (visual identity), labels + blurbs + instructions resolve from the bundle. coding / planning / writing / assistant — all four templates ship a full zh translation that reads naturally. - Recommended badge, eyebrow + headline + lede, footer hint, Create {{name}} CTA, create_failed toast. - Right-rail "About agents" panel (4 way-items + headline + add-more hint + docs link). step-workspace (create or pick existing): - 5 footer states (open / creating / creating-pending / name-first / pick), all hint + CTA strings via interpolation. - Name + URL + slug placeholders, issue-prefix preview spans, Create-new card title + subtitle. - 8-row WorkspacePreviewCard sidebar (Inbox / Issues / Agents / Projects / Autopilot / Runtimes / Skills / And more) — every label + meta strapped to bundle keys. - 4 perks (assign / chat / invite / switch) + 3 next-steps (runtime / agent / starter), 2 toasts (slug-conflict / failed). - `multica.ai/${slug}` mono URL escaped via template-literal expression so the linter sees a JS string. step-runtime-connect (desktop scan flow): - 3 phase headlines + ledes (scanning / found / empty), trust-strip status (all online / N online / none online) with pluralization, online/offline labels, Skip / Continue / Selected hint. - Empty-view 2 cards (skip + waitlist) and the cloud waitlist dialog wrapper. step-platform-fork (web fan-out): - Eyebrow + headline + lede, footer hint with 3 phase variants. - Primary download card (before/after click) + 2 alt cards (CLI / cloud) + CLI dialog with 4 elapsed-time stages (normal / midway / slow / stalled), live-listening header, runtime-connected pluralization, cloud waitlist dialog. ESLint: STILL_HARDCODED list shrunk from 14 entries to 1 — only runtimes/components/usage-section.tsx (chart-heavy KPI panel) remains. Verified: typecheck + 277/277 tests + 0 i18n lint errors. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * feat(i18n): translate runtimes usage panel + drop STILL_HARDCODED Final i18n holdout: the runtimes usage panel (KPI hero, WHEN chart tabs, cost-by breakdowns, daily breakdown table) is wired through useT("runtimes"). With this drained, the eslint scaffolding for explicit holdouts is removed — every JSX text node in @multica/views now flows through i18n. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * fix(i18n): drain rollout gaps + add cross-device sync Lands the post-review punch list for the i18n rollout: closes correctness gaps that would have shipped silently, and adds the missing cross-device locale sync the rollout's docs already promised. Coverage: - Register issues + agents namespaces in RESOURCES (90 useT call sites were rendering keys-as-text in production) - Harden parity test to compare RESOURCES keys against on-disk JSON files, so a future missing namespace registration fails loudly - Server-side language whitelist in UpdateMe + reject-unsupported test - Safe SupportedLocale resolution in appearance-tab (no more `as` cast on a region-tagged BCP-47 string) - HTML lang attribute uses zh-CN (not zh-Hans) for screen reader / CJK font-stack compatibility - Cookie Secure flag on https - Pulled createBrowserCookieLocaleAdapter out of the server-safe entry into a new @multica/core/i18n/browser subpath; document.cookie access can no longer leak into Edge middleware imports Cross-device sync: - New UserLocaleSync component mounted in CoreProvider; on login, if user.language differs from the active i18n.language, persist via the adapter and reload. Both apps benefit - Desktop main process tracks system locale and emits IPC on focus when it changes; renderer reloads only when the user has no explicit Settings choice (their preference still wins) Tests: - pickLocale / matchLocale (11 cases incl. region-tagged BCP-47, malformed tags, zh-Hant collapse-to-zh-Hans semantics) - browser-cookie-adapter (6 cases under jsdom) - Shared renderWithI18n helper at packages/views/test/i18n.tsx that wraps the real RESOURCES map; future tests opt in instead of inlining a per-file TEST_RESOURCES slice that goes stale silently Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * docs(conventions): consolidate naming + i18n glossary into docs site Single source of truth for code naming, i18n translation glossary, and Chinese voice rules. Previously split between packages/views/locales/glossary.md and scattered comments — now lives at apps/docs/content/docs/developers/conventions.{mdx,zh.mdx} with both English and Chinese versions kept in sync. Three sections per page: 1. Code naming — routes, packages, files, DB, Go, TS, commits 2. i18n translation glossary — entity vs concept rule, what to translate, word combination, plurals, interpolation, key naming 3. Chinese voice + style — punctuation, principles, where to look in doubt Side effects: - packages/views/locales/glossary.md collapses to a stub redirecting to the docs page; do not edit it - CLAUDE.md gets a new top-level "Conventions reference" section so any Claude session sees the pointer before any other rule - apps/docs/content/docs/developers/ gets a stub English meta.json so the conventions page is reachable on the EN side (contributing.zh.mdx / architecture.zh.mdx remain ZH-only — separate work) - Both root sidebars get a new "Developers" group Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * fix(i18n): apply zh voice rules + translate project/autopilot Two-part cleanup driven by the conventions doc landed last commit: Voice violations (mechanical sweep across 10 zh-Hans namespaces): - 「」 (Japanese-style brackets) → \" to match the EN source's straight double quotes (~13 sites) - … (single-char ellipsis) → ... three dots (~43 sites) - Drop translation-ese pronoun "我们" where it's a pure narrator ("我们已发送" → "已发送", "我们替你托管" → "由 Multica 托管"); keep "告诉我们" where "we" is the legitimate brand recipient - "作为父级 / 作为子级" → "设为父级 / 设为子级" - "任务" mistranslated as the task entity → `task` (lowercase EN entity) - Dialog title "Autopilot" → "autopilot" Translate project / autopilot per industry consensus: - `project` → 「项目」 (~42 value sites). Feishu / Tower / Teambition / PingCode / GitHub Projects all translate; no Chinese product keeps `project`. - `autopilot` → 「自动化」 (~34 value sites). Avoids the Tesla-style 「自动驾驶」 association; matches Notion / Feishu's industry term. - Issue / skill / task remain lowercase EN per dev-team familiarity. - Sidebar nav-label entities get Title Case ("Issue" / "Skill" / "我的 Issue") so the entry-point label reads as a proper UI signal; body prose stays lowercase. Conventions doc (EN + ZH) reflects the decision and adds a "why these translate but issue/skill/task don't" rationale block. Verification: parity test 45/45, full monorepo typecheck green. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * feat(i18n): translate chat session delete + project resources section Two features main shipped while this branch was idle never went through the i18n pass: - Chat session delete confirmation dialog (#2115) and history toggle tooltip (#2117): adds session_history.delete_dialog.* and session_history.row_delete_*, plus window.history_show_tooltip / history_back_tooltip. - Project resources sidebar (#1926/#2080/#2111): entire component including toasts, popover form, attach/remove tooltips. New projects.resources subtree. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> --------- Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]>	2026-05-06 16:16:12 +08:00
Naiyuan QingandClaude Opus 4.7	21e3cfaa01	Agent runtime status redesign: split presence into availability + last-task (#1794) ... * feat(agent-status): add workspace live-tasks endpoint and TaskFailureReason type Lays the API + type contract for the front-end agent presence cache: - New `GET /api/active-tasks` returns active (queued/dispatched/running) tasks plus failed tasks within the last 2 minutes for the current workspace. The 2-minute window powers a UI-side auto-clearing "Failed" agent state without back-end pollers. - `agent_task_queue` has no workspace_id column, so the query JOINs agent; `SELECT atq.*` keeps `failure_reason` (migration 055) on the wire. - Adds `TaskFailureReason` to `AgentTask` so the UI can map the 5 backend classifiers (agent_error / timeout / runtime_offline / runtime_recovery / manual) to copy without parsing free-text errors. - New `api.getActiveTasksForWorkspace()` client method; workspace is resolved server-side from the X-Workspace-Slug header (no path param, matching /api/agents and /api/runtimes conventions). Includes the joint engineering plan and designer brief that scope the broader Agent / Runtime status redesign — Phase 0 is this contract plus the front-end derivation layer landing in the next commit. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * feat(agent-status): derive presence/health states with WS sync and desktop IPC bridge Adds the front-end derivation layer that turns raw server data into the user-facing 5-state agent / 4-state runtime enums. UI files are deliberately untouched in this commit — derivation lives behind hooks (useAgentPresence, useRuntimeHealth) that any component can call with zero additional network traffic. Architecture: - Derivation is pure functions in packages/core/{agents,runtimes}; the back-end stays free of UI translation. Agents algorithm: runtime offline > recent failed (2-min window) > running > queued > available. Runtimes algorithm: status + last_seen_at -> online / recently_lost / offline / about_to_gc. - A single workspace-wide active-tasks query backs all per-agent presence reads, eliminating N+1 across hover cards, list rows, and pickers. 30-second tick re-renders the hooks so the failed window expires even when no underlying data changes. - WS task lifecycle events (dispatch / completed / failed / cancelled) invalidate active-tasks via the prefix dispatcher. completed/failed were removed from specificEvents so they go through both the prefix invalidate and the existing chat ws.on() handlers. Reconnect refetch picks up active-tasks too. - Desktop bridges window.daemonAPI.onStatusChange directly into the runtimes cache via setQueryData, giving the local daemon sub-second feedback (vs. 75s server sweep). Bridge is wsId-bound so workspace switches automatically rebind the subscription; daemon_id matching covers the same-daemon-multiple-providers case. 24 derivation unit tests cover all branches plus null/empty/boundary inputs (FAILED_WINDOW_MS edges, null last_seen_at, missing completed_at). Full core suite: 112 tests passing. Typecheck green across all 8 workspace packages. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * feat(agent-status): redesign agent runtime status as two orthogonal dimensions Splits the conflated 5-state agent presence into two independent axes: - AgentAvailability (3-state): online / unstable / offline — drives the dot indicator everywhere a dot appears. Pure runtime reachability; never sticky-red because of a past task outcome. - LastTaskState (5-state): running / completed / failed / cancelled / idle — surfaced as text + icon on focused surfaces (hover card, agent detail page, agents list, runtime detail). Never colours the dot. Major changes: * Domain layer: AgentPresence union → AgentAvailability + LastTaskState. derive-presence split into deriveAgentAvailability + deriveLastTaskState + deriveAgentPresenceDetail orchestrator. Tests reorganised into three groups (availability invariants, last-task invariants, composition). * Visual config: presenceConfig (5 entries) → availabilityConfig (3) + taskStateConfig (5). availabilityOrder + lastTaskOrder for filter chips. * Workspace-level presence prefetch: new useWorkspacePresencePrefetch hook + WorkspacePresencePrefetch mount component, wired into DashboardLayout (web) and WorkspaceRouteLayout (desktop). Hover cards render synchronously with no skeleton flash on first hover. * ActorAvatar hover: flipped default — disableHoverCard removed, enableHoverCard added (default false). Opt-in at ~14 decision-moment surfaces; pickers / decoration sub-chips stay plain. Status dot decoupled (showStatusDot prop) so picker rows can show presence without nesting popovers. * Hover cards: AgentProfileCard simplified — availability dot only, Detail link top-right (logs live on the detail page). New MemberProfileCard mirrors the structure: name + role + email + top-2 owned agents (sorted by 30d run count) with click-through to agent detail. * Agents list: split Status into two columns — availability (3-color dot + label) and Last run (task icon + label, optional running counts). Two independent filter chip groups (Status + Last run); combination acts as intersection ("online + failed" finds broken- but-alive agents). * Other UI surfaces (issue list/board/detail, comments, autopilots, projects, runtimes, mention autocomplete, subscribers picker) updated to the new dot semantics; status dot now strictly 3-color. Server changes accompany the client redesign — workspace-wide agent-task-snapshot endpoint, runtime usage queries, etc. — to feed the derive layer with the data it needs. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * refactor(agent-detail): drop last-task chip from detail header + inspector The Recent work section on the agent detail page already shows the same data (with task titles, timestamps, error context) — surfacing "Completed" / "Failed" / etc. up in the header was redundant chrome. Detail surfaces now show only the 3-state availability dot. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * fix(tables): handle narrow viewports across agents / skills / runtimes Three table layouts were squeezing content into adjacent cells at intermediate widths. Each fix is small and targeted: * runtime-list: the Runtime cell's base name had `shrink-0`, so it refused to truncate when its grid column was narrowed under width pressure — the name visually overflowed into the Health column ("ClaudeOnline" etc). Removed shrink-0, added truncate. The Health column was also a fixed 9.5rem reservation for the worst-case "Recently lost · 2m 14s ago" copy; switched to minmax(0,1fr) so it competes fairly with Runtime. * skills-page: had a single grid template with no responsive breakpoints — all 6 columns were rendered at any width and got visually jammed below md. Added a <md template that drops Source + Updated; the row markup hides those cells via `hidden md:block` / `md:contents`. * agent-list-item: the new Last run column was reserved at minmax(8rem, max-content); on narrow md viewports the 8rem floor pushed the row past available width. Changed to minmax(0,max-content) so the cell shrinks under pressure (its content already truncates). Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * refactor(agent-card): hover-only Detail + add Runtime row + breathing room Three small polish tweaks to the agent hover card: - Detail link gets `mr-1` + fades in only on card hover (group-hover). It was visually flush against the popover edge and competing for attention; now it stays out of the way during a quick glance and surfaces only when the user is dwelling on the card. - Runtime row is back, in the meta block (cloud/local icon + runtime name). The earlier removal was over-aggressive — knowing where an agent runs is part of "who is this agent". The wifi badge stays dropped because the availability dot in the header already conveys reachability. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * feat(runtime): wifi-style health icon (4-state) for runtime list + agent card Replaces the 6px coloured dot with a wifi-shape icon that carries both state (Wifi vs WifiOff) and severity (success/warning/muted/destructive). Mapping: - online → Wifi (success) - recently_lost → WifiHigh (warning) — transient hiccup, fewer bars - offline → WifiOff (muted) — long unreachable - about_to_gc → WifiOff (destructive) — sweeper coming soon Used in two places: - Runtime list: replaces HealthDot in the dedicated leading-icon column. Bumped the column from 0.5rem (dot-sized) to 0.875rem (icon-sized). - Agent profile card RuntimeRow: derives runtime health from runtime + clock (matching the 4-state semantics) and renders HealthIcon next to the runtime name. Cloud runtimes always read as online. The duplicate signal with the header availability dot is intentional — it confirms WHICH runtime is the one currently in the dot's state. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> --------- Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]>	2026-04-28 19:21:13 +08:00