codeg v0.36.0-fix1

CodeG 0.36.0-fix1

Based on the published upstream v0.36.0, commit
c8f921378461df0c244d9c3452b7caa26e3a5b86, with the fork's previous fixes preserved.

The Codex composer now offers 直接执行 / 先规划 / 目标执行
(Direct / Plan first / Execute goal). Plan selects the native
collaboration_mode=plan. Goal uses the published ACP AIR _session/goal
capability and Codex's actual thread/goal/* mechanism, with an objective,
authoritative status, token usage, pause, resume and end controls.

Completed tasks show their most recent execution duration on board cards,
list rows and the detail sheet. The duration comes from persisted execution
start and review timestamps; later acceptance/merge waiting is excluded.
Retries and follow-ups have separate runs. Missing or invalid timestamps are
left unavailable. Native Goal controls and collapsed historical Goal cards
show the runtime's own cumulative elapsed time in hours, minutes and seconds;
completed/paused values do not tick locally or grow merely because the page
is reopened. The installed Setup and Server Web checks exercise persisted
task timing across reload and upgrade and native tool-driven Goal completion.

Switching from an active Goal to Direct or Plan waits for a successful native
pause, then cancels its in-flight continuation before changing collaboration
mode. A rejected pause keeps Goal selected and reports the error. The goal is
retained in paused state for review; selecting Goal again does not resume it.
Resume requires the explicit button. End clears the native goal, and a paused
goal's removal does not cancel an unrelated user turn. Unsupported adapters do
not offer simulated Goal execution. Workspace and canvas share these controls.
If status reads fail, the last observed Goal remains visible and switching is
disabled until authoritative state is available again.
Starting a Goal in an empty composer first creates and binds a durable
conversation to the native session. Its output is visible immediately and
remains available after reload. Read-only child transcripts cannot inherit
their parent's Goal controls.
Restored and shared conversation clients keep the same native execution
controls as Send and Stop; their non-owning connection flag only prevents
them from terminating another client's process during teardown.
Native Goal continuations arrive outside ACP session/prompt. Visible Goal
sessions coalesce their persisted output through the existing bounded history
reader, preserving loaded history pages. Quiet sessions perform no transcript
reads once transitions settle. Reads wait for ongoing history/foreground work,
back off on errors, and stop on hidden/inactive surfaces; pause/end also drain
trailing records. Other out-of-turn activity keeps its existing manual reload.
Native pause/completion snapshots appended after an answer leave that answer
visible outside the settled process card, including after history reload.

Protocol behavior was checked against published ACP 2.2.2 and both the pinned
Codex CLI 0.162.1 and CLI 0.163.0 in separate synthetic homes with a loopback model.
The regression sends native RPCs and asserts no session/prompt simulation.
An isolated CodeG HTTP integration exposed ACP 2.2.2's missing initial Goal
snapshot. An exact-version, anchor-checked derived adapter reads the native
thread/goal/get after creation and publishes it before acknowledging the
action. It leaves the installed ACP/CLI unchanged. Unverified adapters retain
stop controls but cannot start/resume invisible work.
The official Codex app-server documentation
describes native collaboration presets and thread goal APIs.

Scroll diagnosis recorded conflicting writes from the old exact-bottom guard,
use-stick-to-bottom's rounded target, and virtua's measured offsets. Following
could escape with the viewport already at its physical end; delayed content then
left more than 1,000px below the fold. A pending target could exceed the newly
measured end and be misclassified by the library's delayed direction check.
The old guard also rescheduled itself indefinitely for an unreachable sentinel.

The guard now uses the library's scroll controller and target, observes replaced
last rows correctly, ignores subpixel margin churn and stops scheduling without
real geometry changes. Geometry corrections within the existing bottom lock no
longer masquerade as reader intent. Explicit upward wheel, touch, keyboard and
scrollbar input still releases the lock immediately. Browser anchoring remains
disabled for the virtualized transcript; normal following and virtualization
remain enabled.
Ctrl/Cmd+Home also releases the lock outside editable fields. The added browser
case reproduced an immediate pull back to the bottom with the old modifier
filter; the fix retains editor navigation and the programmatic-scroll shield.
Turn-end composer autofocus also preserves focus within the reading viewport,
so native Goal continuations cannot take its Home/PageUp keyboard navigation.

Validation is recorded by the release workflow:

• Frontend lint, unit tests and static export; Rust tests/clippy in desktop and
  server modes; native pinned CLI/ACP Plan and Goal protocol regression.
• Production transcript components with 2,000 virtual rows, streaming completion,
  delayed image/iframe content, composer growth/shrink, smooth scrolling, multiple
  text scales and trusted upward scrolling. Position, final-line visibility,
  animation-frame convergence and mounted row counts are asserted.
• Windows Server startup and real packaged frontend; Setup installation,
  desktop launch and real frontend through isolated WebView2, followed by an
  upgrade from v0.35.1-fix2 that preserves a seeded conversation and data markers.
• Complete frontend SHA256 inventory and every source migration checked against
  SQLite's applied migration table and integrity check. Migrations are embedded
  in the executable, rather than separate SQL installation files.
• Downloaded Setup and Server ZIP checksums before publication, then fresh
  independent downloads and the same verification after publication. The Server
  package requires matching codeg-mcp and verifies its private runtime/helpers.
• Windows application binaries link the C runtime statically. Ordinary and
  delay-loaded PE imports are checked for every installed/packaged executable
  and DLL; external redistributables cannot pass by merely existing on the runner.

Only Windows x64 Setup, Windows x64 Server ZIP and their SHA256 files are released.
All application startup/installation tests use disposable CI directories and
profiles. They do not install, replace, restart or connect to a user's running
CodeG. Final workflow results, exact release commit and hashes are reported with
the delivered release, rather than inferred from the presence of a tag.

Warning

This fork release is built without the upstream signing and notarization credentials. Desktop installers and server archives are unsigned; server archives include SHA-256 checksums. Use manual installation instead of the signed automatic updater.