Add mobile provider and General settings while preserving desktop behavior.
Harden remote credential handling, ngrok session ownership and consent upgrades.
Use a native Electron menu with validated host actions and lifecycle cancellation. Preserve browser state, persistent annotations, and disabled page actions on blank tabs.
Replaces the two-mode right-side panel (files ↔ browser) with one controller
that owns layout, navigation and resource lifetime for four content kinds:
files, browser pages, Git review and terminals. Follows the Codex desktop
reference captured in the workspace-refactor plan.
The old panel conflated three things that have different lifetimes: a UI tab,
the content it shows, and the process behind it. That is why switching modes
destroyed a live page, why a second link overwrote the first, and why the
toolbar button reported "show workspace" while the workspace was already open.
Splitting them is the whole change:
- workspaceStore layout, docks, tab order, preview/pinned, focus
- workspaceContentStore / workspaceReviewStore file and diff data
- host services webContents and PTYs, keyed by resource id, never by tab id
Consequences that fall out of the split:
- Hiding the panel, switching tabs and switching tasks keep every page and PTY
alive; only closing a tab releases them.
- A terminal moves between the side and bottom docks without restarting.
- Pages live in a shared persistent partition with native navigation history;
popups become sibling tabs in the task that opened them.
- Review names both sides of every comparison and performs real index and
working-tree writes, guarded by a snapshot token and a backup-first revert.
Also adds versioned workspace persistence with a forward migration: terminals
come back stopped and restartable, pages reload lazily, and nothing holding
content, cookies or handles is written to storage.
The previous implementation is no longer reachable but is left in place: the new
file tab does not yet reproduce workspace search, quick-open or the changed-file
view, so removing it now would lose those. Real three-platform Electron
acceptance (plan item A10) has not been performed; all evidence here is
deterministic tests, type checks and a packaging smoke.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Approving a plan only sent the plan's addRules, so the CLI restored the mode
from prePlanMode and fell back to default when a session had nothing to
restore (it was launched in plan mode) — implementation then asked for
permission on every tool call. The desktop plan dialog now offers "Approve &
auto-accept edits" and "Approve & bypass permissions", mirroring the official
terminal dialog, and pins the chosen mode through a setMode permission update.
A mode delivered through a permission update also skipped the plan exit
transition: ExitPlanMode's cleanup only ran while the mode was still plan, so
the exit flags, the exit/re-entry reminders, the auto-mode teardown and the
rules stripped on entry were left half-applied. That path now reuses the same
transition the CLI runs for its own switches, and refuses bypassPermissions
when the session cannot use it.
Fixes#1254
Validation: new PermissionUpdate regressions plus the plan dialog tests;
src/utils/permissions + src/services/tools + src/cli 103 passed; check:policy
330 passed; desktop suite 330 files passed; compiled claude-sidecar smoke
passed; real-CLI A/B keeps the exit state identical with and without the pinned
mode.
Remove getAttributionTexts/getEnhancedPRAttribution and the three prompt
injection sites (BashTool system prompt, /commit, /commit-push-pr) so commit
messages and PR bodies no longer carry Co-Authored-By or "Generated with
Claude Code".
attribution and includeCoAuthoredBy stay in the settings schema as
deprecated, ignored fields: validateSettingsFileContent() parses with
.strict(), and dropping them outright would make existing settings files
invalid and silently disable the settings edit guard for those users.
The desktop injects CLAUDE_STREAM_MAX_DURATION_MS=600000, a wall-clock cap
that no incoming chunk resets. Slow local models (LM Studio / qwen3) and very
large generations legitimately keep streaming thinking_delta past ten minutes,
so the stream was killed mid-response even though it was alive and producing
content (#1307, #1275). Raising "请求超时" could not help: the cap was
hardcoded, and the first-token budget it was meant to raise was silently
bounded by that same 600s.
Derive the cap from the user's request timeout, never below the existing 600s
default so the #766 trickle protection is not tightened when a short first-byte
budget is configured. Push the derived value through the per-turn env hot
update as well — otherwise a session that is already running keeps its spawn
time 600s no matter what the user configures, which is exactly the retry path
the reports describe.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Prevent carried-forward checkpoints from attributing old edits to later
chat-only turns while retaining legacy snapshot evidence. Default file
summaries to collapsed and preserve disclosure state and return focus.
Fixes#1305
(cherry picked from commit d03898d5203fa73d3c6c9ac66ca8c1c23ee36a59)
Route native-only changes through macOS checks and verify relocated cursor resources in final packages. Reject resources that escape the app and exercise visible click feedback against a disposable native receiver.
Connect the regressions to required checks and capture shell fixture output through temporary files.
Resolve optional click animation assets from the running helper bundle.
Avoid SwiftPM Bundle.module's fatal fallback to a build-machine path so
visible clicks can return successfully and keep the daemon alive.
Keep procedural feedback when optional frames are absent or unreadable.
Add an input-free resource probe and run it against relocated release and
staged helper apps. Cover standard Resources copying and reject probes
that load from an external build directory.
Validation: 524 XCTest and 15 Swift Testing cases passed, including eight
new resource regressions. Build fixtures, compiled sidecar smoke, Electron
checks, local packaging and final relocated-package probes passed.
Preserve optional function arguments with explicit non-strict schemas.
Send stable session and thread identities, retain routing state through
one user turn and dispose it on completion or cancellation.
Compress Codex OAuth request bodies with zstd when supported, retaining
readable request audit data and a local compatibility opt-out without
replaying submitted requests.
Validation: 352 focused offline API/provider tests passed. The real query
loop regression covers tool continuation, next-turn reset and cleanup.
Selected repository verification passed with mocked transports.
Route coordinate clicks through the exact AX hit, reuse render-local
attributes and keep keyboard macros within validated native boundaries.
Preserve lossless capture evidence while returning bounded model images,
and propagate cancellation through daemon and lock acquisition.
Remove legacy per-app restrictions after feature-wide consent on both
platforms while retaining global disablement and target validation.
Include native helpers, regression tests and a stable receiver fixture.
Validation: 224 focused TypeScript tests, 516 XCTest cases and 15 Swift
Testing cases passed. Local sidecar and Electron builds, development
package creation and package smoke checks passed.
Revert efe5cae19 so existing sessions remain usable and models can be
switched without protocol admission checks. Retain the additive index
schema for already-upgraded caches and rebuild their summaries.
Add a persistent isolated JavaScript worker for native app actions and batch
known operations without a model round trip between each input. Preserve
per-cell context, native errors, screenshot coordinates, and image types.
Align macOS gesture, key, inventory, capture, scroll, and clipboard behavior;
include a signed native receiver fixture and compiled sidecar regression tests.
Keep the Windows pixel route and fix cancellation with session-owned mouse
cleanup, lock revalidation, and portable signing-fixture tests.
Transcripts now default to a 365-day retention and can be changed from
Settings > General, where a change previews how many files the new window
removes and requires confirmation before anything is deleted. Plans, file
history, debug logs, pastes and agent worktrees keep the previous 30-day
window instead of inheriting the transcript setting.
Also cleans subagent transcripts together with their parent session, and
restricts the bulk cleanup endpoint to the desktop process token so an H5
token cannot wipe every transcript in one request.
Keep historical conversations reachable beyond the recent sidebar limit, hydrate only opened sessions, and restore old tabs through metadata-only lookups. Preserve newer metadata across history and restore races. Refs #1287.
Normalize a terminal API version at Anthropic request boundaries while
preserving gateway prefixes and saved provider settings. Cover SDK messages,
token counting, proxy streams, connectivity, titles, files, and recovery CLI.
Fixes#1279
程序员阿江(Relakkes)