* fix(daemon,web): forward pure plugin applies and honor persisted capability grants
Pure apply returns snapshotId "" for existing projects, so the web run
path now forwards pluginId and pluginInputs when no snapshot id exists.
The daemon trust vocabulary now accepts pipeline:* and applyPlugin honors
stored capabilitiesGranted with prompt:inject floor.
Fixes#6186
* test(web): cover pure-apply plugin identity fallback in run requests
* fix(web): allow custom model entry in onboarding BYOK dropdown
The onboarding wizard's BYOK model picker (OnboardingDropdown) always
showed the static SUGGESTED_MODELS_BY_PROTOCOL list with no way to type
an arbitrary model id, unlike the equivalent Settings dialog picker
(ByokModelField/SearchableModelSelect) which has a Custom sentinel
option. This blocked selecting any locally-installed model (e.g. an
Ollama model) that isn't in the hardcoded suggestion list.
Add an allowCustomValue prop to OnboardingDropdown: when enabled and
the search query doesn't match an existing option, a 'Use "<query>"'
entry is offered that sets the value directly. Enabled it for the BYOK
model field in OnboardingByokSetupPanel.
* fix(i18n): add settings.onboardingModelUseCustom to Dict and all locales
* add allowCustomValue tests; place custom entry last; single-quote CJK locale strings
The update restart-safety preflight called the unscoped
`GET /api/runs?status=active`, which answers 400 PROJECT_SCOPE_REQUIRED as
soon as any run belongs to a Workspace-bound project. Workspace users
therefore always got `active-runs-unknown` and could not install or quit
into an update without forcing it.
Add a loopback-only `GET /api/runs/active-count` that returns only
`{ activeRunCount }` and switch the preflight to it. The unscoped listing
keeps refusing, so Workspace-bound runs still cannot be enumerated.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(web): kick the compositor on a chat scroll freeze, then take the wheel and keyboard over by default
When the freeze probe calls the chat log frozen, apply one frame of
`will-change: transform` so Blink rebuilds the scroller's compositing state
from the current layout, let the next downward wheel through natively and
measure it against what it asked for (the detector's own normalisation and
8px yardstick), and only if it stuck, fell short or snapped back answer the
wheel and the scrolling keys from JavaScript. The takeover is on by default
now; `open-design:chat-scroll-takeover = '0'` is the escape hatch.
`ChatPane` releases the takeover — and asks the probe to start a fresh
surface — when `activeConversationId` changes, because the log node is
reused across conversations. A healed surface is released the same way so a
recurrence can be judged again.
One new event, `client_chat_scroll_heal`, carries the outcome, the kick
geometry and the notch arithmetic, joined to the freeze by `probe_id`;
`client_chat_scroll_frozen` is untouched.
* fix(web): keep Home/End finite and let the takeover go when the chat log is removed
Home and End were ±Infinity folded into the same pixel accumulator as the
arrows, so Home-then-End in one frame (or key repeat) summed to NaN and the
browser read the NaN scrollTop as 0 — End could not reach the bottom. Edge
jumps now live in their own `pendingEdge` slot: the last edge pressed wins,
pressing one discards the steps queued before it, and steps pressed after it
apply on top; applyPending refuses to write a non-finite value.
A tab or route unmount removes the chat log without a conversation change,
and the probe only notices on a scroll the missing node never sends, so the
takeover stayed engaged with its document-level keydown listener cancelling
arrows and paging with nothing to scroll. Every input path (wheel, keydown,
frame) now checks `isConnected` and disengages, and ChatPane's release effect
also releases in its cleanup.
* fix(od-next): restore production follow-up host instructions
Compose production host instructions with the same fresh key persisted on the run, including native resume, cold-start input, and UI locale. Keep the instructions independent of retired model state declarations and exclude the nonce-bearing text from internal continuation retry identity.
Verify optional suggestions, message persistence, and repeated preparation through the real server and run registry. Validated with main red specs, focused regression tests, guard, and the workspace typecheck.
* test(od-next): preserve production test entry points
Keep the existing production test header and fixture setup while sharing host-protocol assertions with a separate suggestions case. This avoids adding a conflict with the pending agent rollout tests.
Validated with the focused real-server regressions, guard, and the full workspace typecheck.
* fix(cms): fence offline replay across revocation and process death
* feat(cms): define paginated Test catalog and immutable runtime context
* fix(cms): synchronize Test and Production host presentation lifecycles
* test(cms): retain cross-host lifecycle and browser acceptance regressions
* fix(cms): retain request tickets through body classification
---------
Co-authored-by: heggria <bshengtao@gmail.com>
Co-authored-by: ivy-tinggg <986810707@qq.com>
* fix(daemon): resolve the AMR default model from the caller's catalog
A run that asked for `default` before the caller's `vela model list` had
arrived was concretized from the bundled `vela model preset` seed. The
seed is the same for every plan and OD orders deepseek-v4-flash first, so
free-tier callers (entitled only to deepseek-v4.1-flash since 09-24) had
Vela reject `session/set_model` before any work began. On 0.24.1 that was
22 runs from 21 users in the last 7 days, 13 of 16 bundled runs showing
the user's choice as `default`.
- When `default` is requested and only the preset is cached, wait up to
12s for the caller's remote catalog (`getAuthoritative`).
- Remember remote catalogs separately; a later preset seed never displaces
one when a default model is chosen.
- Order deepseek-v4.1-flash first: it is the one chat model every plan,
including free, is entitled to, so a flagless list still lands on it.
* fix(daemon): bound the AMR default-model catalog wait per refresh
CI follow-up. A `default` run looked the catalog up twice (the resume probe
and the run itself) and each lookup waited up to 12 s for the caller's
remote catalog, so a slow or broken `vela model list` held the run queued
for up to 24 s. The AMR e2e runs timed out at 20 s that way.
- The wait is counted from the start of the remote refresh, so one run, or
several concurrent runs, share a single wait.
- When the last refresh failed, the preset is used at once; the next
refresh still starts in the background.
- e2e fake vela: answer `model list --all --format json`, the form the
daemon actually sends. It only matched the flag-less form and hung.
* test(e2e): let the fake vela answer the daemon's `model list --all` probe
The catalog probe spawns `vela model list --all --format json`. The matcher
stripped `--all` with its preceding space only, so `' --format json'` never
equalled `'--format json'`: the probe fell through to the login check, the
cache recorded a failed refresh, and default runs settled on the preset. Match
the subcommand and the `--format json` flags in any order, as fake-vela.mjs and
turn.test.ts already do, and cover the exact daemon argv for both the catalog
and the 401 path.
* feat: add Motion Design skill and OD Next task route
* fix(web): rename motion design entry and place it second
* fix(web): reconcile motion design catalog consumers
* feat(web): add motion design templates to Home and Community
Five motion design example templates (3D procedural island, explainer,
product launch, showreel, data story), chosen by community reach, under the
Home motion-design chip and a new Community "Motion design" type.
Each template follows the bundled example layout: an OD-generated
example.html with its runtime libraries under assets/, an HTML preview baked
by the existing preview pipeline, and a SKILL.md that carries example.html
as the reference when the card is picked on the OD Next motion-design route.
Home cards ship curated copy for every UI locale. Motion templates stay off
the Video and HyperFrames chips.
* fix(skills): keep motion-design procedural layers visible in video export
The MP4 exporter seeks timelines with callbacks suppressed
(renderSeek(t, { suppressEvents: true })), so content drawn only from a GSAP
onUpdate callback is missing from exported video. Recommend a per-frame draw
loop that reads the timeline clock, and state that visible content must not
depend on timeline callbacks. The OD Next task asset is re-synced with
scripts/sync-motion-design-skill.ts.
* fix(motion): preserve reference assets and exported animation frames
* feat(skills): integrate curated motion helpers with complete runtime files
* feat(skills): add Huashu, Oil Motion and Motion.Lab adapters
* test: classify animate design guidance in narration guard
* feat(motion): refine five community templates and portable previews
* fix(motion): refine launch transitions and center gallery previews
* fix: allow free-form briefs on automatic motion task route
* feat(motion): add template soundtracks and audio export
* fix(motion): require rendered MP4 alongside editable video source
* test(motion): align strategy activation expectation with package version
* fix: scope motion delivery and make editable sources playable
* fix(motion): bundle source dependencies and valid closing protocol
* feat(motion): rebuild the five templates on the most-viewed community posts
Re-select topics by single-post views in the latest awesome-opus-5.5-video
snapshot and anchor each template to the top eligible post of its genre:
camera-focus explainer, showreel, product launch, procedural island and a
new wordless animated short that replaces the data story.
All five example.html files are hand-authored canvas/Three.js films drawn by
one render(t) from the GSAP master timeline, so preview, scrubbing and MP4
export produce identical frames. Each ships an original procedural
soundtrack, updated SKILL.md and 19-locale copy; Home order follows reach.
* fix(plugins): load bundled fonts in plugin previews
Plugin previews blocked every bundled font: the preview CSP had no font-src,
and relative url() references inside inline <style> blocks kept pointing at
the preview URL instead of the plugin folder. Allow same-origin fonts, map
inline-style url() references through the existing asset route (escapes,
absolute and data: URLs stay untouched), and serve font files with font
MIME types.
* feat(community): make motion template Use match the Home example pick
Community 「做同款」 on a motion design template now binds it as that type's
own example card, carrying the type's project metadata, so the run takes the
same OD Next motion-design route as a pick from Home's motion design list and
delivers the MP4 together with the editable source. Other task types keep
the existing plugin-pinning hand-off.
Community use clicks now record use_source (card | detail_modal) and
use_action (use | use_with_query); the details modal Use is tracked for the
first time. The Home hand-off no longer records a second community_gallery
click for uses Community already tracked.
* fix(plugins): count the five motion templates in the official registry metadata
* fix(media): keep HyperFrames audio filters compatible with FFmpeg 4.1
CI's bundled Linux FFmpeg 4.1 rejects adelay all=1 and amix normalize=0.
Make each track stereo and delay both channels explicitly, skip amix for a
single track, and undo amix averaging with a gain for several tracks.
* fix(motion): keep template previews bakeable on slow CI renderers
CI's software-GL baker skipped the 3D island (preview readiness timeout):
under slow frames GSAP lag smoothing slowed the timeline, so the 8 s
poster frame never arrived within the baker's 15 s wait. Play every
template on the wall clock and move the island poster to 6 s. With
simulated 300 ms frames all five now report ready within 10 s.
* feat(motion): add the kinetic typography template
Template selection now follows the motion design spec's four content types
(brand and product films, kinetic typography, explainer animation, procedural
art). Kinetic typography takes the fifth slot, replacing the animated short.
The new template is a 15-second, 120 BPM type film with an original
soundtrack and 19-locale copy.
* fix(motion): let the project motion player fit template stages
Inside a project the motion source player wraps the composition, fits it and
adds its own controls. The templates also scaled their stage, so editable
sources from Remix and Community use rendered at a fraction of the preview.
Templates now keep their own fit and controls only outside that player.
* feat(motion): restage the 3D island as a midday lagoon
The island moves from golden hour to a bright tropical midday closer to its
anchor post: a shader lagoon coloured by a baked depth map with ripples,
shallow-water shimmer and shore foam, a wide white-sand beach, palms and
instanced bushes, a village with a pier, soft sun shadows and a lower
camera path. The CPU wave mesh is gone, so frames cost no more than before.
Copy is updated in all 19 locales.
* fix(motion): keep each soundtrack inside the composition root
A Community use regenerated the island source tail and dropped the root
<audio> element, so its MP4 had no sound. Templates now place the element
inside the composition root next to the stage.
* docs(motion): state the template selection rule as complete works
* fix(motion): enforce video clocks and bound content verification
* feat(motion): replace the motion templates with remakes of viral posts
The five Motion design templates are now frame-faithful remakes of viral
motion posts, so each preview shows the look users came for: the 15-second
motion designer showreel, a high-energy motion reel (copy set in English), a
one-shape UI motion piece, a pixel-art wizard and a 20-second electric-blue
tech reel. Each ships open-licensed fonts, an original soundtrack, the
creator's published prompt where one exists, and credits its source post.
The explainer, product launch, 3D island and kinetic type templates are
removed. Tests follow the new set; a backward-seek check now covers hidden
WebGL layers.
* feat(motion): feature The Future Is Already Here first and start preview sound with the film
* chore: ensure PR CI
* fix(motion): match The Future Is Already Here controls and reorder the motion templates
* fix(motion): make the one-shape UI preview controls legible
* fix(motion): hide The Future Is Already Here controls inside the project player
* fix(motion): plan suitable sound and synchronize source audio playback
* feat(motion): keep remake soundtracks by default and fade exported audio where it stops
* test(motion): cover audible source controls in Chromium
* fix(test): use explicit ESM imports in audio player regression
* fix(motion): align preview track discovery with video export
* feat(motion): autoplay looping HTML without a player bar
* fix(test): consume the built motion playback contract
* docs(motion): state explicit soundtrack rules for make-same and the music line in replies
* chore(motion): version the audible looping delivery profile
* docs(motion): let template sound rules lead the general policy and freeze the audio contract
* fix(motion): scope autoplay to declared video motion sources
* fix(motion): reject audible MP4s under an explicit silent contract
* docs(motion): drop the routine music note from make-same replies
* test(motion): align delivery regressions with looping source playback
* fix(motion): isolate preview and audio export from legacy HyperFrames
* test(motion): retain the existing desktop legacy audio limitation
* fix(motion): suspend audio when previews leave the active workspace
* feat(motion): replace two motion templates with a product promo and a visual lesson; sign the showreel as Open Design
* feat(motion): give the showreel the Open Design palette and a full-size stacked wordmark
* feat(motion): give the product promo a livelier mascot girl
* refactor(motion): rebuild The Future Is Already Here as readable, editable scene code
* fix(motion): pick gallery cover frames that survive the baker's capture delay
* feat(motion): sharpen the showreel opener, depth, truchet and end card
* feat(motion): make the product promo mascot talk, add a speaking score and the flow pop
* feat(motion): give the visual lesson the original's paper-collage texture
* fix(motion): bundle gallery covers for fresh branch checkouts
* feat(motion): feature and refine Bring Ideas to Life
Adapt the paper story around OpenDesign capabilities, with short rounded hands, clearer timing, continuous paper actions, and a larger audience invitation. Feature it first in Motion and synchronize localized names, metadata, cover, guidance, and regressions.
Keep product promo audio music-only with sparse percussion.
* fix(motion): stabilize artifact cards and capture declared covers
* fix(web): share creation type order with community
* test(motion): exercise audio controls through project UI lifecycle
* fix(motion): scope live cover behavior to actual video sources
* test(motion): use real HEAD responses in cover regressions
---------
Co-authored-by: bone3deep1962-collab <bone3deep1962@gmail.com>
Co-authored-by: William <zhouhaoran@refly.ai>
Co-authored-by: open-design-crew[bot] <4197780+open-design-crew[bot]@users.noreply.github.com>
Co-authored-by: NJUHua <113895241+NJUHua@users.noreply.github.com>
Co-authored-by: Amy <1184569493@qq.com>
On AMR 0.24.1, 9 runs from 7 users (10/5 to 10/7) ended with "session/set_model
modelId is not available": the model the user had picked (deepseek-v4-flash,
claude-opus-4.8, claude-sonnet-5, gemini-3.1-pro-preview) had left the AMR
catalog. The daemon forwards such a model on purpose, because its cached catalog
can lag the live one, and vela's set_model is the authoritative check.
Act on that rejection instead of ending the turn: the daemon passes the catalog
default as fallbackModel, and the ACP session switches to it once when vela
rejects the selected model, then tells the user with a model_fallback status.
If vela rejects the fallback too, the turn fails as before.
* fix(od-next): continue plans with keyed markers and honor explicit deliverables
* fix(od-next): retire output contracts and hand off continued tasks
* fix(od-next): record round settlement and recover production cold
* fix(od-next): resume marker sessions with context deltas
* fix(od-next): separate completion facts and honor plan-only intent
* fix(od-next): preserve physical failures and legacy chat compatibility
* test(web): align run recovery fixtures and await campaign mount
* fix(od-next): tolerate terminal production marker formatting
* fix(od-next): unblock follow-ups after a stop or unreadable history (#8423)
Treat a previous task this build cannot read as absent so the follow-up starts a new task, and stop counting a Run with a pending cancel as holding its conversation. Add end-to-end coverage for the marker continuation flow and restore the remote Workspace directory gate cases.
* docs: clarify focused local validation
Keep local daemon and web validation scoped to affected files and integration boundaries. Reserve full suites for PR CI unless the user explicitly requests them.
* fix(web): scope folded task completion to its final run
Keep the final physical Run key and conclusion together when OD Next history is folded or accumulated live. Reuse the existing predecessor offsets while retaining the full display history and remaining Todo snapshot.
Add regression coverage for completed and unfinished production, live continuation, multiple Runs, legacy history, wrong and quoted markers, question handoff, and failed or canceled Runs.
Validated the parent regression before the fix, 165 focused Web tests, workspace typecheck, and guard.
* fix(od-next): compact historical context without restricting clarification
Reuse confirmed artifact summaries for old assistant history, preserve cross-agent plans and original requests, and represent earlier questionnaires as neutral historical information without inferring answers.
Keep user replies, skips, changed answers, unpersisted bodies, examples, and unfamiliar content intact. Do not add question repetition checks, output gates, repair rounds, or limits on clarification.
Validated red regressions, shared context and Web provider tests, focused handoff/resume/cold-production coverage, real server and fake CLI input, workspace typecheck, and guard. The repeated-question server fixture remains successful.
---------
Co-authored-by: bone3deep1962-collab <bone3deep1962@gmail.com>
Co-authored-by: Cheems <hihicheems@gmail.com>
Co-authored-by: Cheems <94773058+itscheems@users.noreply.github.com>
MarqueeLabel read the computed direction only when its text changed or a box
resized. I18nProvider writes <html dir> in a passive effect, so on first mount
in Arabic and on an English -> Arabic switch the label kept the LTR sign and
slid the workspace name the wrong way. Watch the dir attribute as well.
Refs OPEND-3112
The bundled OpenCode is a Bun binary and Bun requires Windows 10 1809
(build 17763). On older builds it exits with STATUS_ENTRYPOINT_NOT_FOUND
(0xc0000139) before readiness, which was classified as a retryable
fatal_rpc_error and shown as a generic failure. Classify it as a
non-retryable os_unsupported when the host build is below 17763 and show
a card telling the user to update Windows.
* fix(web): keep empty Home content reachable in short windows
Use safe centering when the empty Home hero exceeds the scroll viewport, and let wheel input continue from the examples list to Home at its boundaries.
Add CLI and BYOK browser regression coverage for short windows, responsive boundaries, scrolling, and centering when content fits. Validated with the focused Playwright cases, pnpm guard, and pnpm typecheck.
* test(web): align Home acceptance with safe centering
Update the existing empty-Home style acceptance to expect safe center while preserving its padding checks. The accepted layout change keeps content reachable when the hero exceeds the viewport.
Verified the CI assertion fails before the test update and all 8 cases in acceptance-visual-fixes.test.ts pass afterward. Also passed pnpm guard, pnpm typecheck, focused TypeScript diagnostics, and git diff --check.
* test(web): cover safe Home scroll boundaries
---------
Co-authored-by: PerishCode <perishcode@gmail.com>
A desktop run that dies without a clean shutdown is reported as
desktop_unclean_exit, but the report could not tell a crash from the
machine shutting down, sleeping, or a quit whose teardown never finished.
In production 26 of 28 recent unclean exits behind AMR runs failed with
DAEMON_RESTARTED carried no exit evidence at all.
- session-lifecycle: the run's marker keeps the last 8 host events
(suspend, resume, shutdown, session-end with its reasons,
quit-requested), written synchronously so they land before the OS ends
the process. Repeats of the same event within a second (one per window)
are kept once. An unclean run carries its events into the next launch.
- observability: desktop_unclean_exit adds exit_hint (system_shutdown,
user_logoff, closed_by_system, system_suspend, quit_incomplete or
unknown), ended_suspended, quit_requested and the last host event.
attachDesktopHostLifecycleRecorder wires powerMonitor suspend/resume/
shutdown and the Windows window session-end event.
- main: the recorder is attached once the session marker exists, and a
quit records quit-requested when its cleanup starts.
* fix(daemon): keep ACP turns succeeded when the daemon force-closes the agent
After a clean ACP end_turn the daemon waits 500ms and then terminates the
agent. On Windows a child killed by pid reports exit code 1 with no signal,
so the close classifier (which only forgave SIGTERM or code 130) marked
the completed turn failed with exit_nonzero and suppressed retry. In the
last 7 days this hit 143 AMR runs from 65 Windows users on 0.24.1; every
sampled bundle (76/76) had already returned stopReason end_turn.
Treat any exit as succeeded once the daemon itself began shutting down a
cleanly completed ACP attempt.
* fix(daemon): only forgive a completed ACP exit the daemon itself caused
Review follow-up. terminateProcessTree waits gracefulWaitMs before it
signals anything, so a vela that exits 1 on its own during that wait
used to count as a daemon shutdown and was reclassified as succeeded.
terminateProcessTree now takes onChildSignal, called just before the
first signal to a direct child that is still alive (POSIX group,
pid-less and Windows pid-tree paths). server.ts sets
acpCompletionShutdownRequested from it for the completed-turn
termination only, so a non-zero exit during the grace wait stays failed.
* fix(daemon): report a daemon close only after the signal was delivered
Review follow-up. `onChildSignal` ran before the stop helpers dispatched
anything. If that dispatch then failed (a non-ESRCH error from the Windows
stop path) or found the child already gone (ESRCH), the flag was still set,
and a child that later exited 1 on its own was reported as succeeded.
- platform: `stopProcesses` takes `onSignal`, called for each PID a signal
was actually delivered to. ESRCH and thrown dispatches are not reported.
- runs: the completion-shutdown callback fires once, after the first
delivered signal to the still-owned direct child, on the Windows pid-tree,
POSIX group and pid-less paths alike.
* fix(od-next): recover planning replies that repeat the runtime state block
OD Next treats a reply with more than one open-design-runtime-state block
as non-repairable, so the task ends before anything is produced. On AMR
0.24.1 that surfaced as OD_NEXT_CONTINUATION_FAILED ("The parsed response
was not eligible for contract repair.") on 16 design-mode prototype runs
from 15 users in the last 7 days, 15 of them with no artifact. Most of the
daemon logs we could read show `Expected at most one
open-design-runtime-state block, received 2.`
- Collapse runtime state blocks that carry the same JSON value (key order
aside) into one declaration and record a normalization.
- Let disagreeing runtime state blocks take the existing one-time
serialization repair. Nothing has been written at this point. When every
block agrees on executionIntent, that intent counts as the reply's
explicit intent for the repair gate; otherwise the gate stays closed.
- Plan Contract duplicates still fail closed.
* fix(od-next): send agreed-produce duplicate runtime states straight to repair
Review follow-up. A duplicate Runtime State reply has no strict runtimeState,
so requiresStrategyIntentResolution treated a new task's intent as missing
and spent an intent-resolution turn before the serialization repair: two
provider turns where one was promised.
When every duplicate block declares `produce`, the intent is already
explicit, so the automatic continuation now claims the contract repair Run
directly. An agreed `plan_only` still takes the intent-resolution turn,
because only that turn can complete a planning-only task; the repair gate
would block it.
* test(od-next): cover duplicate runtime states that go through intent resolution
On AMR 0.24.1, 19 of 20 duplicate runtime-state failures asked the intent
supplement first. The model answered produce with one clean block, then the
original reply, still carrying the duplicate, was refused with "The parsed
response was not eligible for contract repair." This path already repairs
on this branch; the test fails with that exact error on the parent commit.
* fix(od-next): let the supplement complete a duplicate-state planning-only task
A planning reply whose two Runtime State blocks both declare plan_only goes
through intent resolution, but the source keeps no state of its own, so the
validated plan_only reply could not be copied anywhere and the task was blocked
on the duplicate. When the duplicate is the source's only defect, the
supplement's schema-validated plan_only state now completes the task and the
source Plan Contract is kept. Any other source defect stays fail-closed.
* fix(daemon): deliver Antigravity prompt on stdin to avoid Windows ENAMETOOLONG
agy received the full composed OD prompt as the -p argument. On Windows
that routinely exceeds CreateProcess's 32,767-char command line, so the
spawn failed with ENAMETOOLONG before agy started and users saw a generic
"This task failed to run" (OPEND-3495).
Pass a short fixed pointer as the -p value and deliver the prompt on stdin,
which agy print mode reads (verified on agy 1.3.1).
* fix(daemon): drive Antigravity through agy's stream-json stdin channel
The previous attempt passed `-p "Follow the instructions provided on
stdin."` and wrote the prompt to stdin, but agy ignores stdin whenever a
prompt is given with `-p` (agy 1.1.1), so the model never received the
OpenDesign prompt. Earlier "successes" came from the model reading files
in its working directory on its own.
agy's documented headless stdin channel is
`--input-format stream-json --output-format stream-json`, which reads
one NDJSON `{"event":"user","message":{"content":...}}` message per
turn. The prompt now travels only through that frame, handed over as a
complete file-backed stdin at spawn, so argv no longer grows with the
prompt (fixes Windows `spawn ENAMETOOLONG`, OPEND-3495).
- add an `encodeStdinPrompt` runtime hook used by the chat-run spawn and
the connection test
- parse agy stream-json events (text deltas, tool steps, terminal
result, usage) in json-event-stream, falling back to the Gemini JSONL
branch for frames without `event`
- drop the antigravity-only plain-stdout buffering, Gemini re-parse and
log-file empty-output classification
- recognise agy's headless signed-out output as AGENT_AUTH_REQUIRED and
keep the per-model quota guidance for `Individual quota reached`
- fixtures recorded from agy 1.3.1 plus the samples in agy's headless docs
* fix(web): show Antigravity quota guidance instead of the generic run-failure copy
The Antigravity RATE_LIMITED card had no message key, so it rendered
chat.runError.fallbackMessage ("This task failed to run. Please retry")
-- the exact sentence in the OPEND-3495 report -- with no hint that the
per-model quota was the cause. Give it its own copy (switch model in the
model menu or via agy /model) and the quotaExhausted title, in all 19
locales.
* Revert "fix(web): show Antigravity quota guidance instead of the generic run-failure copy"
This reverts commit 68a84c3ff3.
The Antigravity rate-limit card intentionally uses the generic approved
copy (#8140, product copy supplement rev 96): blank product rows get no
invented copy, and the P0 e2e 'antigravity rate limits keep
classification and use only the Cloud switch' pins that behavior.
* fix(chat): clear the composer on submit instead of after the send gate settles
The host paints the sent turn and flips to Working before the OpenDesign
Cloud balance preflight settles, but the composer only reset after onSend
resolved, so the sent prompt lingered in the input for the preflight round
trip. Snapshot the composer at submit, clear it immediately, and restore the
snapshot only when the host hands the send back ('restore-draft' or a
throw) and the user has not started typing a new prompt.
Refs OPEND-3392
* test(chat): type the deferred onSend mock so its call args typecheck
* fix(chat): skip restoring a handed-back send over any new composer content
Review follow-up: the restore guard only looked at editor text, so an
attachment, visual comment, skill, MCP server, connector, workspace
context, plugin or quote staged while the send was pending was
overwritten by the old snapshot. Mirror committed composer content in a
ref and restore only when nothing new appeared since reset().
* fix(od-next): bound prototype SVG icon geometry
* fix(od-next): classify prototype SVGs by role, not canvas size
The icon contract listed example glyphs on each side but gave no rule for
anything outside those lists, so a logo inside a button or a deliberately
large UI glyph had to be guessed. State the basis: classify by the role the
SVG plays, not by canvas size or the presence of a viewBox.
---------
Co-authored-by: bone3deep1962-collab <bone3deep1962@gmail.com>
* feat(web): land sign-in on Hosted and pitch free credits across entry points
- Onboarding: drop the "Choose your model source" step. Signing in from the
welcome screen finishes onboarding on OpenDesign Hosted; Local AI and API Key
stay reachable from the welcome screen. Hosted select_runtime now reports
step `connect` instead of `model_source`.
- Welcome screen: the pending sign-in shows one quiet "Sign-in page didn't
open? Reopen" line (after 5s, or at once when the browser failed to open)
instead of a nested card with two cancels, and the primary button no longer
moves between idle and pending states.
- Home rail card: "Get free credits" pitch with a sparkle mark; the pending
state turns the call to action into "Signing in…" with a single cancel and
the same delayed reopen line. Dark mode keeps the button visible.
- Settings → Local CLI: callout reuses the free-credits copy; selecting a
signed-out OpenDesign row selects it in place and offers Sign up / Sign in
(no bounce to onboarding), committing the CLI once a session exists. Both
buttons share the solid pill and show "Signing in… | Cancel".
- Fix the selected CLI card flashing on hover, and make the Home @ picker
tabs clickable where they overlap the desktop window's drag strip.
* fix(web): drop pending OpenDesign pick when DeepSeek Harness setup commits
Installing DeepSeek Harness from its setup dialog committed agentId without
clearing amrPendingSelect, so the OpenDesign card stayed highlighted and a
later sign-in overwrote the DeepSeek choice with 'amr'. Clear the pending
intent alongside that commit and cover the sequence with a regression test.
---------
Co-authored-by: elifive555555 <296440099+elifive555555@users.noreply.github.com>
* fix(web): align export and update-check error copy with product (OPEND-2849)
- S26a: a generic export failure now shows the product title + body
("导出失败" / "本次导出未完成，请重新尝试。") through the same Toast
message + details shape as S26c. fileViewer.exportFailed is split into
fileViewer.exportFailedTitle / fileViewer.exportFailedDescription in all
19 locales; the old key is removed.
- S31b: drop the sentence-final period from the title line of
updater.dialogCheckFailed (zh-CN and 17 other locales; th had none).
* fix(web): never surface raw exporter errors on export failure (OPEND-2849)
Product copy S26: an export failure shows the S26a title + body by default;
only an already-localized, user-facing reason may replace it. Raw exporter
strings (HTTP status lines, renderer/daemon errors, internal exceptions)
no longer reach the toast.
- New export-failure-toast module: LocalizedExportError marks errors whose
message comes from an i18n key; exportFailureToast passes only those
through and falls back to S26a for everything else.
- Localized reasons now thrown as LocalizedExportError: PPTX daemon
unreachable / PPTX not available, version image capture failed.
- Image export catch-all uses the same rule instead of echoing err.message.
- The original error object is unchanged, so console.warn and
exportErrorCode analytics still see the raw message.
* fix(web): align disk-write failure and browser-open hint copy with product (OPEND-2849)
- chat.runError.localStorageFailureMessage now matches the product supplement
row 13 verbatim in zh-CN ("…请确认有足够的剩余空间后，再重新尝试。"); the
old "permission to save to the current folder" clause is dropped and all
19 locales are retranslated to the new meaning.
- settings.amrActivationBrowserFailed (S32 browser not opened): half-width
comma replaced by a full-width one in zh-CN and zh-TW; wording unchanged.
* fix(web): align S03/S04/S06/S09a/S15/S24/S28a/S31c/S32a error copy with product (OPEND-2849)
zh-CN copied verbatim from the product error-copy doc; all 19 locales translated.
- S04 pre-send signed out (balance gate dialog): "Open Design 尚未登录" + body.
- S06 pre-send insufficient allowance: owner dialog "可用额度不足" + body (no
balance figure); member dialog "团队额度不足" + body. Benefits list and
buttons unchanged.
- S15 mid-run allowance exhausted: the turn-anchored upgrade card's $0 state
shows title + body, personal vs. member chosen by the billing audience
ProjectView already resolves. Low-balance tier, amount and Upgrade button
unchanged; the pre-send tail card keeps "现在无法开始新任务".
- S24a unfinished todos: "任务尚未完成" + "本次任务仍有 {n} 项内容未完成。" with the
real unfinished count; S24c user stop: "任务已停止" + body. Buttons kept.
- S03 / S28a Home send failures: the optimistic create's rollback toast (the
surface users actually see) and HomeView's inline block now map
AMR_AUTH_REQUIRED to S03 and transport failures to S28a, as title + body.
- S31c update download failed (updater error code download-failed): update
dialog shows "更新下载未完成" + body; Settings status shows the title.
- S32a browser not opened during sign-in: title + body via one shared
component for the three sign-in surfaces; the sign-in page link is kept.
- S09a rate-limit auto retry: run_retry_attempted now carries
failure_category in the SSE contract; a rate_limit retry row reads
"模型服务请求繁忙" + body, other retries keep "正在重试".
The error card has shipped with a fixed set of three actions since #8140,
but that ruling was never written down: `git grep -i 2807 -- specs docs`
returns nothing. Two documents still describe the world before it.
`chat-panel-decisions-sheet.md` still reads "稿子 2 颗, 产品 4 颗" and
points at `run-error-catalog.md:421-430` for "A/B 两案仍挂着等产品挑".
Neither is true: the catalog's three candidates were all overruled, and
the card has three actions in both environments. `run-error-catalog.md`
§6.ZB still carries that candidate table as live, and §6.T still frames
the mapping as a ranking of secondary actions that no longer exists.
This records the ruling from main's own behaviour, not from the proposal
that lost: the criteria are quoted from `showCloudRetry` and
`showCloudSwitchCta` as they exist today, and the three exceptions
(a host that cannot take the handoff, `git_bash_missing`, a zero balance)
are the ones main actually ships. Historical passages stay; each one now
carries a pointer to the outcome.
The comment above `withCloudSwitchCta` pointed readers at `ChatPane`'s
`errorActionVariant`, a symbol #8140 deleted. It now describes the two
branches that exist.
No behaviour change: every `.ts` line in this diff is a comment.
Refs OPEND-2807
* fix(chat): retain live thinking when older history arrives
* test(web): cover full replay through the actual recovery host
---------
Co-authored-by: lefarcen <935902669@qq.com>
resolveChatExtraAllowedDirs built the allowlist from SKILLS_DIR only, so a
skill installed under the daemon data dir or loaded from a bundled plugin
folder resolved to a root outside it. withSkillRootPreamble still advertises
that root as the absolute fallback path, so OpenCode asked for
external_directory approval on files OD itself pointed the agent at, and a
headless run reported the ask as a rejected tool call.
Pass the turn's active skill dirs so the allowlist is keyed on the roots
actually in play. Codex stays excluded: it treats allowlisted dirs as
writable and skill roots are read-only resources.
When two local processes race to refresh the same stored OAuth credential,
the agent aborts its refresh and reports the condition as transient:
Failed to refresh OAuth token: another Claude Code process is refreshing
it or exited mid-refresh. This is usually transient; retry in a minute...
The classifier had no branch for this text, so it fell to the generic
process-exit fallback as `exit_nonzero`, which `transientSuppressedReason`
refuses for `process_exit` with `non_retryable_category`. The safe-retry
path was suppressed and the run died on a dead-end failure card, for a
condition that clears as soon as the contending holder releases the lock.
Name it `credential_refresh_contention` and wire it the way
`session_resume_expired` already is: classified at `session_init` as
retryable with `user_action: 'retry'`, and added to the `process_exit`
transient allowlist.
The branch is claimed ahead of the auth verdicts on purpose. The message
ends "...or sign in again", and `auth` is fixed at `retryable: false` /
`user_action: 'login'` — reaching it would prescribe re-authenticating a
credential that never expired. The detector is anchored on the contention
itself rather than on the word "refresh", so a genuinely spent or replayed
refresh token keeps its non-retryable auth verdict; a test pins that
direction.
Retry is safe without further gating: the failure is raised before a
request is sent, so nothing streamed, no tool ran and no artifact was
written, leaving the side-effect gates in `decideSafeRunRetry` satisfied.
* fix(web): reveal full model names on hover in model pickers
Long model ids in the model pickers ellipsise to a shared prefix (e.g.
openrouter/google/gemini-...), so rows become indistinguishable and no title
was available to confirm a choice. Add the full label as the hover title on
every model-selection surface named in the report:
- the shared SearchableModelSelect option rows and trigger;
- the compact home list in InlineModelSwitcher;
- the composer/sidebar AvatarMenu lists (daemon and BYOK).
A locked row keeps its upgrade reason as its title, and accessible names are
unchanged. Adds regression tests using two same-prefix long OpenRouter ids on
each surface.
Fixes#8407
* chore(ci): retrigger web workspace tests after flaky artifact-tab shard
The ProjectView.auto-open-turn-artifacts spec timed out on shard 2/2; it
passes locally and is unrelated to the model-picker title change.
Electron net.fetch reports ENOBUFS as net::ERR_NO_BUFFER_SPACE. The existing
guard only matched the POSIX name, so the proxy fell through to undici and
kept retrying on an already-exhausted T2 Intel Mac.
Co-authored-by: leoric <leoricchen@tencent.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: remove duplicate web-clone chip in HOME_HERO_CHIPS
HOME_HERO_CHIPS defined two objects with id: 'web-clone'. They were identical
except the second lacked automaticDefault: true. A duplicate id collides as a
React key and makes findChip/orderedCreateChips lookups ambiguous, and the
second copy silently dropped the automatic-default binding. Remove the second
duplicate, keeping the canonical entry that carries automaticDefault: true.
* test(home-hero): assert HOME_HERO_CHIPS ids are unique
Existing findChip and rail tests only observe the first match for an id, so
they passed while two web-clone chips were present. Add a catalog-wide
uniqueness invariant that fails on a reused id, so a duplicate cannot silently
return with its React-key and lookup ambiguity.
`agentCliEnv` is validated against a per-agent allowlist on every save, and
pi exposed only `PI_BIN`. `PI_CODING_AGENT_DIR` — pi's own override for its
config directory, default `~/.pi/agent` — was therefore dropped on every save
cycle, leaving no way to isolate a pi config but a wrapper script that sets
the variable and is pointed at by `PI_BIN`.
This extends pi's contract by the one key rather than turning the allowlist
into a pass-through: `PI_CODING_AGENT_DIR` is the same kind of entry
`CLAUDE_CONFIG_DIR` and `CODEX_HOME` already are for their CLIs, and nothing
else about pi's environment exposure changes.
Persistence is half the fix, so the tests follow the value the rest of the
way: one cell writes the config, reads it back and hands
`agentCliEnvForAgent`'s projection to `spawnEnvForAgent`, asserting the
variable arrives in the env pi is launched with; two more pin the launch env
directly, including `~` expansion. A neighbouring key that is NOT part of the
contract (`PI_CODING_AGENT_SESSION_DIR`) is asserted to still be dropped.
lefarcen