Revert efe5cae19 so existing sessions remain usable and models can be
switched without protocol admission checks. Retain the additive index
schema for already-upgraded caches and rebuild their summaries.
Add a persistent isolated JavaScript worker for native app actions and batch
known operations without a model round trip between each input. Preserve
per-cell context, native errors, screenshot coordinates, and image types.
Align macOS gesture, key, inventory, capture, scroll, and clipboard behavior;
include a signed native receiver fixture and compiled sidecar regression tests.
Keep the Windows pixel route and fix cancellation with session-owned mouse
cleanup, lock revalidation, and portable signing-fixture tests.
Transcripts now default to a 365-day retention and can be changed from
Settings > General, where a change previews how many files the new window
removes and requires confirmation before anything is deleted. Plans, file
history, debug logs, pastes and agent worktrees keep the previous 30-day
window instead of inheriting the transcript setting.
Also cleans subagent transcripts together with their parent session, and
restricts the bulk cleanup endpoint to the desktop process token so an H5
token cannot wipe every transcript in one request.
Keep historical conversations reachable beyond the recent sidebar limit, hydrate only opened sessions, and restore old tabs through metadata-only lookups. Preserve newer metadata across history and restore races. Refs #1287.
Normalize a terminal API version at Anthropic request boundaries while
preserving gateway prefixes and saved provider settings. Cover SDK messages,
token counting, proxy streams, connectivity, titles, files, and recovery CLI.
Fixes#1279
Use the shared model identity rules for capability matching and cache keys.
Preserve Fable overrides and explicit capability opt-outs across 1M aliases.
Adapt structured policy-error handling and Astra model metadata from sub2api's recent compatibility updates. Preserve rejection codes through HTTP and SSE, stop retry and non-streaming replay, and add Astra's effective context to the official runtime.
Reference: https://github.com/Wei-Shaw/sub2api/pull/6636 and https://github.com/Wei-Shaw/sub2api/pull/6572. Implementation uses the existing TypeScript runtime and local regression harnesses.
Cover MCP connection-close lifecycle, automatic retry outcomes, headless reconnect and toggle flows, stale OAuth results, and MCP state replacement with deterministic mocks. Configure the headless tests with an isolated placeholder credential so they exercise no live provider.
Stale connections closed by the disabled-state guard now go through
client.cleanup() so their caches are cleared by the close handler at
close time, never by a post-close invalidation that could hit a
connection created by a concurrent re-enable. The post-OAuth reconnect
gets the same disabled check, with the config check and disabled state
write kept synchronous (no await in between) so a later enable cannot
be overwritten by the stale OAuth result.
A reconnect request that completes after the server was disabled no
longer overwrites the disabled state. Connection attempts fold into
disabled when the config no longer allows the server, closing any
fresh connection and clearing its caches; the mcp_toggle enable and
mcp_reconnect handlers apply the same check before writing their
results, and the reconnect failure path keeps disabled when the server
was disabled mid-flight.
A single onclose registered at connection creation now clears caches
and notifies a session-registered handler that updates AppState and
decides whether to reconnect; it is unregistered on unmount so shutdown
closes never reconnect. Disabling a connected server clears its caches
and updates AppState directly, so the disabled state never depends on
the close handler firing (headless sessions and cleanup failures
included). Queued disabled updates are dropped when the server was
re-enabled before the batch flush.
Connecting Feishu meant creating a bot by hand on the open platform and
pasting an App ID and App Secret back. Feishu also exposes an RFC 8628
device-authorization flow, so the desktop can now render a QR code, and
confirming it in the app creates the bot and stores its credentials
directly. `adapters/feishu/registration.ts` implements that protocol
rather than importing `registerApp` from `@larksuiteoapi/node-sdk@1.73`:
the repository pins 1.60 for the chat client, and the SDK runs the whole
poll inside one un-cancellable promise where the desktop needs the
stateless begin/poll pair the DingTalk registration already uses. The
scan is create-only, so it can never rewrite the configuration of a bot
the user already runs, and it pre-fills exactly the scopes, events and
callbacks this adapter calls. International tenants finish on Lark's
domain, which is now persisted and honoured by the client.
WeCom, QQ and Slack join the same session model. WeCom and QQ bind by
scanning; Slack has no scan flow, so it uses an app manifest that
pre-fills the scopes and Socket Mode. All three run over long
connections, so no public callback URL is needed, and all three accept
private chats only — pairing authorizes one person, and answering in a
group would extend that authorization to everyone else in the room.
They are built on a new `adapters/common/chat-runtime.ts` instead of a
fourth copy of the loop the five existing adapters each carry. A platform
supplies a `ChatPort` — how to say something, how to open a streaming
reply, optionally how to send an image — and the runtime owns pairing,
command routing, session restore, permission bookkeeping and the
translation of the server's stream. The existing five are deliberately
left on their own copies; migrating them is a separate change with its
own regression surface.
Attachments are downloaded through a deferred loader that runs after the
pairing gate and inside the per-chat queue. Resolving them eagerly would
let an unpaired stranger make the adapter fetch bytes and write them
under ~/.claude/im-downloads — on Slack with the bot token attached —
and would let a slow attachment overtake a text message sent after it.
The sidecar launcher's per-adapter branches become one table. It is
declared above the mode dispatch on purpose: `runAdapters` is hoisted and
runs at module top level, so a table declared below it is still in its
temporal dead zone when the adapters mode reads it — which type checks,
lints and unit tests all miss, and only the compiled binary reveals.
Verified with the checks `check:impact` selects: adapters, server,
desktop, electron, policy, chat-contract, agent-flow, docs, native
(sidecar compile, packaging and an adapters-mode smoke against the real
binary) and coverage. The scan flows themselves are not verified against
live platforms — that needs real WeCom, QQ and Slack accounts and would
create real bots.
Claude-Session: https://claude.ai/code/session_01CCGoP316AK7wdQG3Ms6Uwq
Add claude-fable-5-1 (Fable 5.1) to the official model catalog and the
server fallback model list, with reasoning effort enabled
(low/medium/high/xhigh/max, default high) to match Opus 4.8 / Sonnet 5.
Previously only Fable 5 was selectable.
Update the affected fixtures in ModelSelector and settings API tests.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019MxSMcKdN6WWQjtJEUhLGR
程序员阿江(Relakkes)