ConnectionPool.reconcileViews re-focused a repaired connection whenever
focusedId named it, but a same-tab sidebar preview moves the keyboard
into the sidebar without ever calling setFocus (multiview.ts's
syncFocus skips it while previewing) — so focusedId keeps naming the
pane the operator was in before the preview, even though the DOM
doesn't agree. Replacing that pane's connection during exactly that
window called onMount({focus:true}) and yanked the keyboard back out
of the sidebar mid-navigation.
Capture existing.el.contains(document.activeElement) before dispose()/
el.remove() detach it (afterward the browser has already moved
activeElement to <body>, too late to tell), and require both that and
focusedId===id to re-focus. document.body and a null activeElement
both naturally fail .contains(), so "nothing focused" and "focus
elsewhere" both correctly skip.
Regression tests: 3 new (real-focus requirement, same-tab preview
race, descendant focus, body-as-unfocused) — 498 tests total.
Three more fixes from acceptance review:
- structured.ts's header omitted the .sessions-btn attach.ts's terminal
header carries. The sidebar is off-canvas on mobile, so a structured
session had no way to reach it — add the same button and
requestToggleDrawer wiring.
- ConnectionPool.reconcileViews always remounted a repaired connection
with focus:false. If the mistyped pane was the one actually focused,
disposing it dropped DOM focus while `focusedId` still named it. Pass
`focus: this.focusedId === id` instead — `focusedId` only ever names a
real focus (multiview.ts skips setFocus while previewing), so a
preview or a merely-visible split neighbour still comes back
unfocused.
- onMount's deferred requestAnimationFrame focus had no way to tell it
had been superseded by an unmount (or a remount elsewhere) before it
fired, so a parked pane could steal focus a frame later. A token
bumped on every mount/unmount lets the callback recognize it's stale
and no-op.
Regression tests: 7 new (structured.test.ts, connections.test.ts). 495
tests total.
Three fixes from acceptance review:
- ConnectionPool.mount cached a connection's kind (terminal/structured)
permanently from whatever `info` it saw first. A deep link or restored
layout mounts before the catalog snapshot names a session's view, so
`info` is undefined and a structured session got an xterm connection
forever. The pool now tracks the view each cached connection was built
for, subscribes to the catalog itself, and replaces a mistyped
connection in place the moment the real view resolves — without
downgrading a resolved connection just because a later caller couldn't
resolve the session, and without treating a session merely absent from
a snapshot (mid-removal) as "Terminal".
- The approval card offered all three decisions unconditionally. Per
the daemon's decision mapping (session.rs's permission_outcome), a
decision with no matching PermissionOptionKind in the request's own
options resolves Cancelled silently — so "Allow for session" could
look like it worked while the daemon withdrew it. Buttons are now
gated on the options actually offered.
- Clicking a decision disabled the buttons and never re-enabled them if
the POST failed. The decision path is async now: a rejection restores
the buttons and surfaces the error only if the approval is still the
pending one — a superseded/resolved approval's stale rejection is a
no-op, not a wrongly revived control.
Regression tests: 12 new (connections.test.ts, structured.test.ts,
structuredRender.test.ts). 488 tests total.
Adds a transcript surface for a Structured-view session alongside the
existing xterm attach view: a WS /api/structured/:id connection
(structured.ts) mounted by ConnectionPool whenever a session's `view`
is `"Structured"`, and pure per-row/rail renderers (structuredRender.ts,
structuredDiff.ts) covering all eight transcript row kinds.
Hierarchy follows the design reference (artifact 88ecd690): the
approval is the only lifted, card-like element; a user turn is a
tinted block with an accent rail; agent prose is plain text; tool
calls are compact bordered rows expanding to output or a coloured,
horizontally-scrolling diff computed from ACP's full old/new text.
The client renders `reduced_state` and rows exactly as received, with
no raw-event folding or turn tracking of its own.
Extracted attach.ts's pane-header title building into paneTitle.ts and
its connection interface into pane.ts (PaneConnection) so both
connection kinds share one contract and one header.
A SessionUpdate variant gated behind an unstable ACP feature this build
doesn't enable is compiled out of the enum, not decoded into a Notice.
It fails deserialization the same as a genuinely unknown future tag.
Notice only covers SessionUpdate variants the agent-client-protocol
dependency already decodes but the projection doesn't special-case.
SessionUpdate is an internally-tagged enum with no unknown-variant
fallback, so a genuinely new wire variant fails deserialization before
the projection ever sees it, rather than becoming a Notice. A new
variant needs the dependency upgraded first.
Adds a projection test asserting that an unrecognised sessionUpdate
tag is a deserialization error.
Refs #186
write() reported Ok(partial) and Err from the same call, which Write
forbids. Defer the error to the following call so write_all observes
a genuine short write, then a failure — matching what a real fd does.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
A write_all that errors mid-line, or a flush that errors after a full
write, could leave last_seq and the log's on-disk line count out of
sync: a well-formed but uncounted line, or a partial one, would corrupt
every later cursor once the next append landed beside it. append now
captures the pre-append length and truncates back to it on either
failure, so the same EventLog can be appended to again immediately. If
the rollback itself can't restore that length, append returns a Fatal
variant so callers kill the session instead of promising consistency
they can no longer keep — record_permission_request and its pump now
route this through the session-death path used elsewhere.
Adds deterministic fault injection (a seekable/truncatable LogSink
double) to prove the same EventLog recovers with valid JSONL and
live/replay agreement, rather than swapping in a healthy handle. Fixes
the row-index rollback test to actually shift a later row, and
tightens the persistence-failure wording in STRUCTURED-VIEW.md.
request_approval() appended the Approval row to the live projection
before the daemon tried to persist it. On append failure the pending
nonce was cancelled but the row stayed in the in-memory transcript, so
a WebSocket snapshot taken afterward showed a row durable replay could
never reproduce.
Add Projection::rollback_row to undo the append and call it alongside
the existing cancel_pending_approvals on failure. Extract the pump's
per-request handling into record_permission_request so the failure
path is directly testable without a live ACP connection.
Fault-injection regression tests use a read-only file handle
(EventLog::for_test, cfg(test)) to force append() to fail
deterministically, then assert the live snapshot and durable replay
agree (both empty) and a subsequent request still persists and
replays correctly.
Fixes#184.
INSTALL.md conflated event-log replay with ACP session/load resume.
STRUCTURED-VIEW.md overstated death-on-append-failure: only notification
appends kill the session, approval-row append failures just cancel the
pending approval.
- replay: since=0 returns the first page (still limit-bounded), not the
whole log; clients page forward from the last returned cursor
- PR_SET_PDEATHSIG is Linux-only; other platforms depend on the
terminate() ladder running to completion
- approval nonce is minted before cancelling the prior pending approval,
not after
Contracts the eight transcript row kinds, daemon-vs-client decisions, the
transcript/reduced-state projections and their cursor/replay semantics, the
ACP handshake and declined capabilities, the adapter install command, and
the approval nonce rules (generation, live-only placement, secrecy from the
agent and durable history, single-use/duplicate resolution) and bounded
prompt/cancel liveness.
Amends RESTART.md to state plainly that a structured session's agent is a
daemon child, not tmux-backed: a restart ends the active turn, the
transcript survives in the event log, and pending approvals/nonces do not.
Refs #137
Miguel Palhas