feat(backlog): finish GitHub sync — TriggerSync/GetSyncHistory RPCs, tests, settings UI - #138
Merged
Merged
Conversation
…tests, settings UI Wires the plugin registry and encryption key provider into BacklogService so manual sync actually works, adds SyncByID for on-demand (vs. periodic) sync, and adds the previously-missing test coverage for the sync/merge engine and GitHub Issues/PRs plugins. Adds a minimal /settings/backlog-sources page to add sources, toggle them, trigger a sync, and view history. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Implements full backlog GitHub sync support end-to-end by wiring plugin registry + token decryption into the backend, adding real TriggerSync/GetSyncHistory RPC behavior, and providing a settings UI to manage sources and view sync history.
Changes:
- Backend: implement TriggerSync/GetSyncHistory, add SyncLoop.SyncByID and ent-backed ListSourceSyncEvents storage access.
- Frontend: add
/settings/backlog-sourcespage with source CRUD, enable/disable, manual sync, and history UI. - Tests/registry: add Go tests for sync behavior and GitHub plugins, plus Jest coverage for the settings UI and registry metadata updates.
Reviewed changes
Copilot reviewed 21 out of 21 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| web-app/src/lib/routes.ts | Adds a route constant for the new backlog sources settings page. |
| web-app/src/lib/hooks/useBacklogSourcesService.ts | New Connect-RPC client hook for managing item sources and sync history. |
| web-app/src/components/settings/BacklogSourcesSettings.tsx | New settings UI to manage GitHub backlog sources and sync runs. |
| web-app/src/components/settings/BacklogSourcesSettings.test.tsx | Jest coverage for the new settings UI behaviors. |
| web-app/src/components/settings/BacklogSourcesSettings.css.ts | Styling for the new settings UI. |
| web-app/src/app/settings/page.tsx | Adds navigation link from main Settings page to backlog sources. |
| web-app/src/app/settings/backlog-sources/page.tsx | New Next.js settings route/page for backlog sources. |
| session/storage.go | Exposes sync history listing at the storage facade layer. |
| session/ent_repository_backlog.go | Implements ent query to list SourceSyncEvent rows for a source. |
| session/backlog_sync_test.go | Adds SyncOne/SyncByID and token decryption test coverage. |
| session/backlog_sync.go | Adds SyncByID to sync a source regardless of Enabled flag. |
| session/backlog_plugin_github_test.go | Adds httptest coverage for GitHub issues/PRs plugins. |
| session/backlog_plugin_github_prs.go | Switches PR plugin endpoints to use overridable GitHub base URL. |
| session/backlog_plugin_github.go | Switches issues plugin endpoint to use overridable GitHub base URL. |
| session/backlog_plugin.go | Introduces overridable githubAPIBaseURL for tests. |
| server/services/backlog_service_test.go | Adds RPC tests for TriggerSync/GetSyncHistory behavior and error mapping. |
| server/services/backlog_service.go | Implements TriggerSync/GetSyncHistory and wires plugin registry + key func. |
| server/dependencies.go | Wires registry/key func into BacklogService for manual sync. |
| docs/registry/features/frontend/ui/settings-backlog-sources.json | Registers the new UI feature and its test IDs. |
| docs/registry/features/backend/backlog/trigger-sync.json | Marks TriggerSync as tested and lists test IDs. |
| docs/registry/features/backend/backlog/get-sync-history.json | Marks GetSyncHistory as tested and lists test IDs. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Contributor
✅ Registry ValidationTest Coverage: 4/151 features have
|
Contributor
E2E RPC Latency |
Contributor
📊 Feature E2E CoverageFeature coverage report unavailable
|
Contributor
Go Benchmarks (Tier 1) |
Contributor
UX Analysis
|
…events Code review surfaced (independently, across 3 reviewers) a real cross-source data-corruption bug: GetBacklogItemByExternalID matched purely on external_id, but GitHub issue/PR numbers are only unique within their repo — two sources would silently overwrite each other's items once external_id collided. Scopes the lookup by source_id and adds a regression test. Also: sync events are now recorded on Fetch failure (previously vanished with no history row), items_errored/error_message/started_at are actually populated instead of being structurally dead fields, GetSyncHistory is capped at 200 rows, TriggerSync is bounded by a 2-minute timeout, the "Sync now" button is disabled for a disabled source, and the githubAPIBaseURL test seam moved out of the plugin-agnostic file it didn't belong in. Fixes the golangci-lint failure in the new plugin test file (tagged switch). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Contributor
🎬 E2E Feature Demos2 shard(s) recorded feature flows for this PR. recordings shard 1 Demo preview opens directly in browser (single-file HTML). Raw WebM recordings in ZIP. Expires after 30 days. |
…ent order - Reject malformed (non-UUID) source_id as CodeInvalidArgument instead of letting it fall through to CodeInternal in TriggerSync/GetSyncHistory. - Use ent.Desc(...) instead of the dialect-specific sql.OrderDesc() for ListSourceSyncEvents, matching the rest of the file's ordering convention. - Guard GitHub plugin URL construction against a trailing slash on githubAPIBaseURL via a small join helper. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Contributor
✅ Registry ValidationTest Coverage: 4/151 features have
|
Contributor
Frontend Terminal Throughput |
tstapler
added a commit
that referenced
this pull request
Jul 3, 2026
#138) * feat(onboarding): offer to install Claude Code hooks during onboarding Adds a final onboarding step that asks whether to install the global Claude Code hooks, with two independent toggles: - Rule enforcement (PreToolUse -> `ssq-hooks check`) - Notifications (Notification/Stop -> `ssq-hook-handler`) Previously these hooks were discoverable only via docs / a manual `ssq-hooks install` invocation; nothing prompted the user. Backend: - New internal/claudehooks package: idempotent, atomic install + detection of the two global hooks in ~/.claude/settings.json. cmd/ssq-hooks now reuses it (InstallRules) instead of its private patchClaudeSettings. - New SessionService RPCs GetHookStatus and InstallHooks. InstallHooks resolves the ssq-hooks binary and ssq-hook-handler from ~/.local/bin (then $PATH / exe-relative scripts); when a binary is unavailable it returns a manual-fallback message rather than failing. - `make install` now also copies ssq-hook-handler to ~/.local/bin so the server can register a stable path. Frontend: - OnboardingModal gains step 5: prefilled from GetHookStatus (a toggle is pre-checked only when its hook is available and not already installed), installs via InstallHooks, and disables toggles whose binary is missing. Tests: unit tests for the package and the two handlers; Jest tests for the onboarding step. Feature registry updated (GetHookStatus, InstallHooks, onboarding-hook-install). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(onboarding): address review — concurrency, async guards, e2e - claudehooks.mutate: serialize read-modify-write with a package mutex and write via a unique temp file (os.CreateTemp) so two concurrent installs (double-click) can't corrupt or clobber settings.json. Add a -race test. - OnboardingModal: guard async setState with a mounted ref (removes the after-unmount update / act warning) and seed the toggle defaults only once so navigating Back→forward no longer discards the user's toggle edits; reset the seed guard on a fresh open. - Jest: await the status fetch in gotoHooksStep to remove flakiness. - Add Playwright e2e (tests/e2e/onboarding-hook-install.spec.ts) covering the hooks step render + finish-without-install (does not mutate global settings). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(sdd): add planning artifacts for github-work-continuity Supersedes docs/tasks/github-pr-status.md (planning complete, absorbed into this unified plan). Adds requirements, research (4 domains), plan, adversarial review, and validation for the GitHub Work Continuity feature. ADRs 020-022 record key decisions: GraphQL for user PR list, enrichment at service layer not scanner, WorktreePRPoller extends PRStatusPoller. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: Epic 1+2 GitHub work continuity — bug fixes + WorktreePRPoller Epic 1 — Pre-flight bug fixes: - BUG-021: CheckGHAuth() → direct GET /user (no subprocess, no forkExec) - BUG-022: ETagCache sync.Map replaces RWMutex+map (lock-free reads) - BUG-023: PRStatusPoller auth state → atomic.Value (pollerAuthResult) - Story 1.3: checkRateLimitHeaders() monitors X-RateLimit-Remaining, Retry-After, and X-GitHub-Sso on every GitHub API response - ADR-020 updated: direct HTTP API, no gh subprocess Epic 2 — WorktreePRPoller (session/worktree_pr_poller.go): - Polls GitHub PR data for worktrees that have no active session - sync.Map for cache (lock-free reads); atomic.Value for auth + callback - WorktreeSource interface breaks import cycle via scannerSource adapter - GetOwnerRepoFromRemote() added to github/client.go - Wired into server: started after UnfinishedWork scanner Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: Epic 3 Story 3.1 — UserPRCache with direct GraphQL API Add github/user_pr_cache.go: lock-free background cache of all open PRs authored by the authenticated GitHub user. - Uses POST /graphql (newGHPostRequest) directly — no gh subprocess - atomic.Value COW snapshot for lock-free reads - singleflight.Group coalesces concurrent manual Refresh() calls - GetCurrentUserLogin added to github/client.go via GET /user - loginState also cached with atomic.Value + singleflight - checkRateLimitHeaders called on every response - Wired into ServerDependencies / RuntimeDeps; Start(ctx) called in server.go Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: Epic 3 Story 3.2 — Annotate UserPR with session IDs and worktree paths - Add PRAnnotationSession / PRAnnotationWorktree value types to github pkg (avoids import cycle: github is imported by session, not vice-versa) - Add UserPRCache.Annotate() — COW: load snapshot → copy+annotate → store matching by owner+branch, O(n + m) via map lookups - Add PRStatusPoller.GetInstances() — defensive copy under RLock - Wire annotateUserPRCache() helper in server/dependencies.go: called in UserPRCache.SetOnUpdated callback, reads sessions from PRStatusPoller and worktrees from unfinished.Scanner Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: Epic 3 Story 3.3 — UserPR proto + GitHubUserService proto + generated bindings Add proto/session/v1/github_user.proto: - GitHubUserService with ListUserPRs, WatchUserPRs, GetGitHubAuthState RPCs - GitHubAuthState, ListUserPRs*, WatchUserPRs*, GetGitHubAuthState* messages Add UserPR message to types.proto (fields 1-17: owner, repo, number, title, html_url, state, head_ref, base_ref, is_draft, check_conclusion, approved_count, changes_req_count, updated_at, closed_at, merged_at, session_ids, local_worktree_path) Regenerate Go + TypeScript bindings via make proto-gen. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: Epic 3 Story 3.4 — GitHubUserService ConnectRPC handler Implement server/services/github_user_service.go: - ListUserPRs: returns cached open PRs + GitHubAuthState - WatchUserPRs: sends initial snapshot then streams on each UserPRCache refresh (buffered channel of size 4; callback set atomically via SetOnUpdated) - GetGitHubAuthState: calls GetCurrentUserLogin directly, degrades gracefully - userPRToProto: converts github.UserPR → sessionv1.UserPR with timestamp handling Wire into server/dependencies.go and registered in server/server.go at /api/session.v1.GitHubUserService/. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(registry): prune stale RPC files in generation; reconcile after merge Backend registry generation was additive — it wrote/updated per-feature files but never deleted ones whose RPC was removed or renamed in the proto. That left 5 orphaned files after the upstream merge (ArchiveWorkflowSessions, DeleteWorkflowFailedSessions, GetDetectionEvents, backlog:spawn-session- autonomous, upload:image), pushing registry-validation divergence to 3.29% (> 2% gate). - Add tools/scanner/prune-stale-backend.sh: regenerates the authoritative id-set into a temp dir and removes committed files whose id is absent. - Wire it into `make registry-generate-backend` so generation now stays in sync with deletions while still preserving human-edited testIds/tested (the in-place scanner pass runs first). - Reconcile the committed backend set to match (0.0% divergence) and restore tested=true on GetHookStatus / InstallHooks. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(bugs): add open bug reports for mutex/cache concurrency issues BUG-022 ETagCache RWMutex-over-map (Low), BUG-023 PRStatusPoller mutex churn → atomic.Value (Medium), BUG-024 SearchService branch/history cache → singleflight + atomic.Value (Low). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(a11y): remove invalid aria-selected from session row The session row is a generic div inside role="listitem"; aria-selected is not an allowed attribute there, which Axe flags as a critical WCAG 2.1 AA violation (aria-allowed-attr) and blocked the UX Analysis check. Selection state is already conveyed accessibly by the row's role="checkbox" aria-checked and the rowSelected style, so the attribute was redundant. Pre-existing issue surfaced by this PR triggering the web UX workflow. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(unfinished): detect racy-clean same-size working-tree edits in DiffShortstat DiffShortstat treated a tracked file as unchanged whenever its size matched the index entry and its truncated-to-second mtime equaled the index entry's recorded mtime. A file rewritten with identical byte size within the same wall-clock second as the index update (the classic "racy git" problem) thus looked clean by stat alone, yielding 0 files/insertions/deletions. For only these racy same-size candidates, fall back to a git blob content hash comparison (plumbing.ComputeHash) against the index entry hash, as real git does. Files exceeding maxUntrackedFileSize are conservatively treated as changed without being read, preserving the existing large-file caps and the batch-blob-read performance optimization (no hashing of every tracked file). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(proto-gen): regenerate when output files are missing despite valid stamp If generated files (gen/ or web-app/src/gen/) are deleted while the stamp file still exists (e.g. after merging a commit that untracks them), the stamp check would skip regeneration and leave the build broken. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(registry): map GetHookStatus/InstallHooks RPCs in scanner The scanner's methodToID map lacked entries for the two new hook RPCs, so TestMethodToIDCompleteness / TestScanProto_NoUnmappedMethods failed. Add GetHookStatus→hooks:status and InstallHooks→hooks:install, and regenerate the registry (moves them to backend/hooks/{status,install}.json with the canonical ids, pruning the old method-name-keyed flat files). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…feature-gate manual sync Addresses the follow-up items deferred from the earlier review round: - Per-source lock (syncSourceLocks) serializes SyncOne calls for the same source across every SyncLoop instance, so a manual TriggerSync racing the periodic tick can no longer both miss the same not-yet-created item's external_id lookup and both create it. Regression test included. - FinishSourceSync wraps the cursor-advance + SourceSyncEvent-creation in one transaction, closing the gap where a crash between the two writes left the cursor moved forward with no corresponding history row. - TriggerSync now refuses to run while the backlog feature is disabled (SetSyncFeatureEnabledCheck, wired to BacklogController.IsEnabled), matching the periodic loop's behavior instead of silently bypassing it. - Fixed a real bug found while adding e2e coverage: useBacklogSourcesService never cleared a stale error banner once a later call succeeded, so a single transient RPC hiccup on page load could permanently mask a working page. - Added tests/e2e/backlog-sources-settings.spec.ts (add/toggle/delete/history) — verified passing against the isolated sandboxed test server. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
7 tasks
main was broken (unrelated to this branch) until #140 landed. Merging to pick up the fix and re-validate CI against the actual current main.
Contributor
✅ Registry ValidationTest Coverage: 4/151 features have
|
tstapler
added a commit
that referenced
this pull request
Jul 3, 2026
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* chore(demos): update E2E feature GIFs [skip ci]
* refactor(session): apply type-driven design to buildLaunchCommand
Replace the 8x isClaudeProgram bool check with a sealed programKind sum
type (claudeProgram / plainProgram). classifyProgram() parses once at the
boundary; holding claudeProgram is proof the program invokes claude, so
buildClaudeCommand needs zero isClaude guards — they are enforced by the
type system, not by runtime checks.
- Add programKind interface with claudeProgram / plainProgram variants
- Add classifyProgram() smart constructor (parses once; trust downstream)
- buildLaunchCommand: switches on type, delegates to buildClaudeCommand or
returns plain cmd unchanged
- buildClaudeCommand: no guards — the type makes invalid states
unrepresentable (a plainProgram can never reach this function)
- Extract claudeMCPConfigFlag() helper for the MCP config flag string
- TestClassifyProgram: table test for the sum type classification
- TestBuildLaunchCommand_PlainProgramIgnoresClaudeFlags: proves that a
non-claude program with all claude-related Instance fields set still
returns the bare program, enforced by the type routing
* feat(backlog): implement CancelTriage RPC and session delete button
Adds CancelTriage endpoint that stops any active triage sessions for a
backlog item. Wires up the previously-TODO cancel button in
BacklogItemDetail and adds a per-session delete button in the session list.
* fix(install): skip FDA prompt for non-admin users with cert-signed binary
Non-admin users cannot read either TCC database (authorization denied),
causing fda_is_granted() to always return false and show the 15s prompt
on every reinstall even when FDA is already granted.
When all TCC databases exist but are unreadable, fall back to a heuristic:
if the installed binary is cert-signed (designated requirement includes
"certificate root"), assume FDA was previously granted. The TCC grant is
tied to the signing identity (com.stapler-squad + cert), which is stable
across rebuilds, so no new grant is needed on reinstall.
* perf(tmux): add semaphore to cap concurrent capture-pane subprocesses
capturePaneSem (size 8) limits concurrent CapturePaneContent calls to
avoid circuit-breaker lock contention and OS process table pressure.
Control-mode fast path bypasses the semaphore entirely.
* perf(vcs): cache reachableSet results and batch-read blobs under single lock
- reachableSetCache (sync.Map, 30s TTL) eliminates O(N) commit walk on
repeated calls — was the #1 pprof hotspot (47.4B cycles, 38 events)
- diffShortstatUnderLock batch-reads all needed blobs in one lock hold,
replacing N lock-acquire/release cycles — was the #2 hotspot (9.87B
cycles, 1641 events)
* chore(proto): regenerate types bindings after rebase
Types were out of sync (DetectedStatus missing from Go/TS bindings)
after the CancelTriage commit was rebased onto upstream.
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* chore(demos): update E2E feature GIFs [skip ci]
* fix(terminal): repair escape code pipeline for new Claude Code renderer (#139)
* feat(onboarding): offer to install Claude Code hooks during onboarding
Adds a final onboarding step that asks whether to install the global
Claude Code hooks, with two independent toggles:
- Rule enforcement (PreToolUse -> `ssq-hooks check`)
- Notifications (Notification/Stop -> `ssq-hook-handler`)
Previously these hooks were discoverable only via docs / a manual
`ssq-hooks install` invocation; nothing prompted the user.
Backend:
- New internal/claudehooks package: idempotent, atomic install + detection
of the two global hooks in ~/.claude/settings.json. cmd/ssq-hooks now
reuses it (InstallRules) instead of its private patchClaudeSettings.
- New SessionService RPCs GetHookStatus and InstallHooks. InstallHooks
resolves the ssq-hooks binary and ssq-hook-handler from ~/.local/bin
(then $PATH / exe-relative scripts); when a binary is unavailable it
returns a manual-fallback message rather than failing.
- `make install` now also copies ssq-hook-handler to ~/.local/bin so the
server can register a stable path.
Frontend:
- OnboardingModal gains step 5: prefilled from GetHookStatus (a toggle is
pre-checked only when its hook is available and not already installed),
installs via InstallHooks, and disables toggles whose binary is missing.
Tests: unit tests for the package and the two handlers; Jest tests for the
onboarding step. Feature registry updated (GetHookStatus, InstallHooks,
onboarding-hook-install).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(onboarding): address review — concurrency, async guards, e2e
- claudehooks.mutate: serialize read-modify-write with a package mutex and
write via a unique temp file (os.CreateTemp) so two concurrent installs
(double-click) can't corrupt or clobber settings.json. Add a -race test.
- OnboardingModal: guard async setState with a mounted ref (removes the
after-unmount update / act warning) and seed the toggle defaults only once
so navigating Back→forward no longer discards the user's toggle edits;
reset the seed guard on a fresh open.
- Jest: await the status fetch in gotoHooksStep to remove flakiness.
- Add Playwright e2e (tests/e2e/onboarding-hook-install.spec.ts) covering the
hooks step render + finish-without-install (does not mutate global settings).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore(sdd): planning artifacts for new-renderer terminal fix
Research, implementation plan, adversarial/architecture reviews, validation
plan, and architecture-performance deep-dive for fixing escape code stripping
caused by the new Claude Code renderer.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(terminal): repair escape code pipeline for new Claude Code renderer
The new Ink-based renderer emits escape sequences that exposed four latent
bugs in the terminal streaming pipeline, causing garbled output in xterm.js:
1. TextDecoder reuse without {stream:true}: multi-byte UTF-8 characters
(é, €, CJK, emoji) split across consecutive proto frames emitted U+FFFD.
Fix: StateApplicator and useTerminalStream now pass {stream:true} on
all streaming decode calls; separate lineDecoder for complete line content.
2. EscapeSequenceParser lookback too short (20→256): OSC window titles and
DCS payloads from the new renderer exceed 20 bytes, causing incomplete
sequences to be flushed as garbage.
3. ED2+ED3 stripping: parser stripped \x1b[3J when paired with \x1b[2J,
bleed-through of previous session history. xterm.js v6 handles this
correctly without intervention.
4. RedrawThrottler over-classification: any \x1b[\d+A was treated as a
full-screen redraw; Ink emits cursor-up on every incremental line
update, causing most progress/spinner frames to be dropped.
Fix: only classify cursor-up + erase-screen as a genuine redraw.
Also: 100→33ms cap (30fps) to match Ink render cadence.
Adds 84 tests including a combined pipeline integration suite covering
the full TerminalDiff→StateApplicator→EscapeSequenceParser→TerminalStreamManager
chain.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(terminal): address code review - decoder isolation, test ESC prefix, timer cleanup
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(registry): regenerate after merge with main
* fix(a11y): remove aria-selected from listitem div; aria-checked on checkbox is correct
* chore(registry): remove stale entries for RPCs removed from main
---------
Co-authored-by: Tyler Stapler <tystapler@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* feat(rules): auto-suggest rule name from criteria inputs (#140)
* feat(rules): auto-suggest rule name from criteria inputs
Generates a "Allow/Block/Escalate {target}" name as the user fills
in tool target, category, pattern, or programs. The suggestion only
applies when the name field is empty or still matches the previous
auto-suggestion, so manual edits are never overwritten.
Also scopes golangci-lint to the current module root to avoid
scanning files in external workspace paths (../../../../../WorkProjects).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(tests): resolve TypeScript errors in ArtifactsTab tests and tighten RuleBuilderForm auto-suggest
- Add makeArtifacts() cast helper in ArtifactsTab.test.tsx to satisfy
protobuf Message<> type requirements without importing the full runtime
- Fix computeSuggestedName category branch: check cat existence, not
cat?.value (avoids truthiness trap on empty-string values)
- Move nameRef sync to useLayoutEffect to avoid render-phase ref mutation
in React concurrent mode
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: resolve CI failures in multiblobworktree test and accessibility violation
- vcsreader_test.go: fix TestDiffShortstat_MultiBlobWorktree by using a modified
content string with different byte length (4 bytes vs 18 bytes original). The
dirty-check in diffShortstatUncached uses size+mtime; when both sides had the
same 18-byte content the file was not detected as changed.
- SessionRow.tsx: remove aria-selected from the session row div, which has
role="listitem" — ARIA spec disallows aria-selected on that role. Selection
state is already communicated by the inner checkbox button's aria-checked.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: add CancelTriage to scanner methodToID map
TestMethodToIDCompleteness enforces that every RPC method in proto files
has a matching entry. CancelTriage (backlog.proto) was missing.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: add GetHookStatus and InstallHooks to scanner methodToID map
Merge from main brought new hooks RPCs into session.proto.
TestMethodToIDCompleteness requires every proto RPC to be mapped.
Feature IDs match the +api: markers in the proto file.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Tyler Stapler <tystapler@gmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* chore(demos): update E2E feature GIFs [skip ci]
* feat(onboarding): offer to install Claude Code hooks during onboarding (#138)
* feat(onboarding): offer to install Claude Code hooks during onboarding
Adds a final onboarding step that asks whether to install the global
Claude Code hooks, with two independent toggles:
- Rule enforcement (PreToolUse -> `ssq-hooks check`)
- Notifications (Notification/Stop -> `ssq-hook-handler`)
Previously these hooks were discoverable only via docs / a manual
`ssq-hooks install` invocation; nothing prompted the user.
Backend:
- New internal/claudehooks package: idempotent, atomic install + detection
of the two global hooks in ~/.claude/settings.json. cmd/ssq-hooks now
reuses it (InstallRules) instead of its private patchClaudeSettings.
- New SessionService RPCs GetHookStatus and InstallHooks. InstallHooks
resolves the ssq-hooks binary and ssq-hook-handler from ~/.local/bin
(then $PATH / exe-relative scripts); when a binary is unavailable it
returns a manual-fallback message rather than failing.
- `make install` now also copies ssq-hook-handler to ~/.local/bin so the
server can register a stable path.
Frontend:
- OnboardingModal gains step 5: prefilled from GetHookStatus (a toggle is
pre-checked only when its hook is available and not already installed),
installs via InstallHooks, and disables toggles whose binary is missing.
Tests: unit tests for the package and the two handlers; Jest tests for the
onboarding step. Feature registry updated (GetHookStatus, InstallHooks,
onboarding-hook-install).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(onboarding): address review — concurrency, async guards, e2e
- claudehooks.mutate: serialize read-modify-write with a package mutex and
write via a unique temp file (os.CreateTemp) so two concurrent installs
(double-click) can't corrupt or clobber settings.json. Add a -race test.
- OnboardingModal: guard async setState with a mounted ref (removes the
after-unmount update / act warning) and seed the toggle defaults only once
so navigating Back→forward no longer discards the user's toggle edits;
reset the seed guard on a fresh open.
- Jest: await the status fetch in gotoHooksStep to remove flakiness.
- Add Playwright e2e (tests/e2e/onboarding-hook-install.spec.ts) covering the
hooks step render + finish-without-install (does not mutate global settings).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore(sdd): add planning artifacts for github-work-continuity
Supersedes docs/tasks/github-pr-status.md (planning complete, absorbed
into this unified plan). Adds requirements, research (4 domains), plan,
adversarial review, and validation for the GitHub Work Continuity feature.
ADRs 020-022 record key decisions: GraphQL for user PR list, enrichment
at service layer not scanner, WorktreePRPoller extends PRStatusPoller.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat: Epic 1+2 GitHub work continuity — bug fixes + WorktreePRPoller
Epic 1 — Pre-flight bug fixes:
- BUG-021: CheckGHAuth() → direct GET /user (no subprocess, no forkExec)
- BUG-022: ETagCache sync.Map replaces RWMutex+map (lock-free reads)
- BUG-023: PRStatusPoller auth state → atomic.Value (pollerAuthResult)
- Story 1.3: checkRateLimitHeaders() monitors X-RateLimit-Remaining,
Retry-After, and X-GitHub-Sso on every GitHub API response
- ADR-020 updated: direct HTTP API, no gh subprocess
Epic 2 — WorktreePRPoller (session/worktree_pr_poller.go):
- Polls GitHub PR data for worktrees that have no active session
- sync.Map for cache (lock-free reads); atomic.Value for auth + callback
- WorktreeSource interface breaks import cycle via scannerSource adapter
- GetOwnerRepoFromRemote() added to github/client.go
- Wired into server: started after UnfinishedWork scanner
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat: Epic 3 Story 3.1 — UserPRCache with direct GraphQL API
Add github/user_pr_cache.go: lock-free background cache of all open PRs
authored by the authenticated GitHub user.
- Uses POST /graphql (newGHPostRequest) directly — no gh subprocess
- atomic.Value COW snapshot for lock-free reads
- singleflight.Group coalesces concurrent manual Refresh() calls
- GetCurrentUserLogin added to github/client.go via GET /user
- loginState also cached with atomic.Value + singleflight
- checkRateLimitHeaders called on every response
- Wired into ServerDependencies / RuntimeDeps; Start(ctx) called in server.go
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat: Epic 3 Story 3.2 — Annotate UserPR with session IDs and worktree paths
- Add PRAnnotationSession / PRAnnotationWorktree value types to github pkg
(avoids import cycle: github is imported by session, not vice-versa)
- Add UserPRCache.Annotate() — COW: load snapshot → copy+annotate → store
matching by owner+branch, O(n + m) via map lookups
- Add PRStatusPoller.GetInstances() — defensive copy under RLock
- Wire annotateUserPRCache() helper in server/dependencies.go: called in
UserPRCache.SetOnUpdated callback, reads sessions from PRStatusPoller and
worktrees from unfinished.Scanner
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat: Epic 3 Story 3.3 — UserPR proto + GitHubUserService proto + generated bindings
Add proto/session/v1/github_user.proto:
- GitHubUserService with ListUserPRs, WatchUserPRs, GetGitHubAuthState RPCs
- GitHubAuthState, ListUserPRs*, WatchUserPRs*, GetGitHubAuthState* messages
Add UserPR message to types.proto (fields 1-17: owner, repo, number, title,
html_url, state, head_ref, base_ref, is_draft, check_conclusion, approved_count,
changes_req_count, updated_at, closed_at, merged_at, session_ids, local_worktree_path)
Regenerate Go + TypeScript bindings via make proto-gen.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat: Epic 3 Story 3.4 — GitHubUserService ConnectRPC handler
Implement server/services/github_user_service.go:
- ListUserPRs: returns cached open PRs + GitHubAuthState
- WatchUserPRs: sends initial snapshot then streams on each UserPRCache refresh
(buffered channel of size 4; callback set atomically via SetOnUpdated)
- GetGitHubAuthState: calls GetCurrentUserLogin directly, degrades gracefully
- userPRToProto: converts github.UserPR → sessionv1.UserPR with timestamp handling
Wire into server/dependencies.go and registered in server/server.go at
/api/session.v1.GitHubUserService/.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(registry): prune stale RPC files in generation; reconcile after merge
Backend registry generation was additive — it wrote/updated per-feature
files but never deleted ones whose RPC was removed or renamed in the proto.
That left 5 orphaned files after the upstream merge (ArchiveWorkflowSessions,
DeleteWorkflowFailedSessions, GetDetectionEvents, backlog:spawn-session-
autonomous, upload:image), pushing registry-validation divergence to 3.29%
(> 2% gate).
- Add tools/scanner/prune-stale-backend.sh: regenerates the authoritative
id-set into a temp dir and removes committed files whose id is absent.
- Wire it into `make registry-generate-backend` so generation now stays in
sync with deletions while still preserving human-edited testIds/tested
(the in-place scanner pass runs first).
- Reconcile the committed backend set to match (0.0% divergence) and restore
tested=true on GetHookStatus / InstallHooks.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs(bugs): add open bug reports for mutex/cache concurrency issues
BUG-022 ETagCache RWMutex-over-map (Low), BUG-023 PRStatusPoller mutex
churn → atomic.Value (Medium), BUG-024 SearchService branch/history cache
→ singleflight + atomic.Value (Low).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(a11y): remove invalid aria-selected from session row
The session row is a generic div inside role="listitem"; aria-selected is
not an allowed attribute there, which Axe flags as a critical WCAG 2.1 AA
violation (aria-allowed-attr) and blocked the UX Analysis check. Selection
state is already conveyed accessibly by the row's role="checkbox"
aria-checked and the rowSelected style, so the attribute was redundant.
Pre-existing issue surfaced by this PR triggering the web UX workflow.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(unfinished): detect racy-clean same-size working-tree edits in DiffShortstat
DiffShortstat treated a tracked file as unchanged whenever its size matched
the index entry and its truncated-to-second mtime equaled the index entry's
recorded mtime. A file rewritten with identical byte size within the same
wall-clock second as the index update (the classic "racy git" problem) thus
looked clean by stat alone, yielding 0 files/insertions/deletions.
For only these racy same-size candidates, fall back to a git blob content
hash comparison (plumbing.ComputeHash) against the index entry hash, as real
git does. Files exceeding maxUntrackedFileSize are conservatively treated as
changed without being read, preserving the existing large-file caps and the
batch-blob-read performance optimization (no hashing of every tracked file).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(proto-gen): regenerate when output files are missing despite valid stamp
If generated files (gen/ or web-app/src/gen/) are deleted while the stamp
file still exists (e.g. after merging a commit that untracks them), the
stamp check would skip regeneration and leave the build broken.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(registry): map GetHookStatus/InstallHooks RPCs in scanner
The scanner's methodToID map lacked entries for the two new hook RPCs, so
TestMethodToIDCompleteness / TestScanProto_NoUnmappedMethods failed. Add
GetHookStatus→hooks:status and InstallHooks→hooks:install, and regenerate
the registry (moves them to backend/hooks/{status,install}.json with the
canonical ids, pruning the old method-name-keyed flat files).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Tyler Stapler <tystapler@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* chore: gitignore macOS _CodeSignature/ codesign artifact
`make install-service` re-signs the binary, producing _CodeSignature/CodeResources
(~33MB) in the repo root. It's a build byproduct, never committed.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat: GitHub work continuity — UserPRCache, GitHubUserService, and Unfinished Tab integration (#141)
* feat: GitHub work continuity — UserPRCache, GitHubUserService, and Unfinished Tab integration
- github/user_pr_cache.go: COW atomic.Value + singleflight PR cache with session annotations
- github/client.go + http_client.go: GetCurrentUserLogin, rate-limit header helper
- proto/session/v1/github_user.proto: GitHubUserService RPC (ListUserPRs, WatchUserPRs, GetGitHubAuthState)
- proto/session/v1/types.proto: UnfinishedWorktree gets github_pr_number/url/state/priority fields
- server/services/github_user_service.go: ConnectRPC handler with streaming + +api: markers
- server/services/unfinished_work_service.go: enriches scanResultToProto with PR metadata
- server/services/search_service.go (BUG-024): replace sync.RWMutex with atomic.Value + singleflight
- server/dependencies.go: wires UserPRCache + GitHubUserService into runtime deps
- server/server.go: registers GitHubUserService handler and starts cache lifecycle
- session/pr_status_poller.go: use deadlock.RWMutex for lock-order tracking
- web-app: GitHubPRsSection + useGitHubPRs hook stream open PRs into Unfinished tab
- Makefile + docs/registry: add github_user.proto to backend scanner; 149 features registered
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: address code review findings - subscriber fan-out, ctx leak, auth caching, CSS tokens
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* test(vcs): fix TestDiffShortstat_MultiBlobWorktree same-size collision
TestDiffShortstat_MultiBlobWorktree added in main used 'modified' content
same byte count as 'original' (both 18 bytes). DiffShortstat uses
size-based unstaged-change detection, so same-size + fast-running test
(mtime equal within 1s) produced 0 changed files.
Fix: use 'a\nb\n' (4 bytes) as modified content so size always differs.
LCS diff: 2 new lines vs 3 old lines, no overlap → 2 ins + 3 del per file.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(scanner): add missing methodToID entries for CancelTriage, GetHookStatus, InstallHooks
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: remove duplicate GitHubUserService registration, fix registry prune for github_user proto
- server/server.go: remove second GitHubUserService handler registration (caused panic on startup)
- tools/scanner/prune-stale-backend.sh: add github_user to proto list so ListUserPRs/WatchUserPRs/GetGitHubAuthState files are not pruned as stale
- docs/registry: move GitHub user service features to github-user/ subdirectory
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Tyler Stapler <tystapler@gmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(demos): update E2E feature GIFs [skip ci]
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* fix(tmux): flush stale exists-cache in RestoreWithWorkDir and add --tmux-keep-server to plist
RestoreWithWorkDir was checking DoesSessionExist() (cached) on entry,
returning a stale true even when the caller's DoesSessionExistNoCache()
had just returned false. This caused the PTY attach to silently fail —
the reconnect loop in the frontend would spin up to 5 times per session
and startup recovery (Step 6) would also silently no-op for sessions
whose tmux died during a crash loop.
Fix: invalidate the cache at the top of RestoreWithWorkDir so the first
existence check always hits tmux directly.
Also explicitly add --tmux-keep-server to the LaunchAgent plist so the
intent is clear (the flag already defaults to true in the binary).
* chore: save backlog UX planning artifacts and serena config
* fix(triage): silent storage error, hung session timeout, and Claude detection false positives
- submit_triage_result now returns an MCP error to Claude when the DB write
fails instead of silently succeeding (invisible data loss)
- TriggerTriage orphan guard tombstones sessions older than 2h so a hung
Claude session cannot permanently block re-trigger
- batchIsClaudeProcess and isClaudeCommand now use exact basename match
instead of substring match, preventing false positives from paths like
/home/claude/... or wrappers like claude-wrapper
* chore(backlog): review triage-validation-1779863260384 — all 3 criteria done
Fixed three triage pipeline bugs: (1) submit_triage_result now returns an MCP
error on storage failure instead of silently succeeding; (2) TriggerTriage
orphan guard tombstones sessions older than 2h so a hung session cannot block
re-trigger indefinitely; (3) batchIsClaudeProcess and isClaudeCommand switched
from substring to exact basename match, preventing false positives from paths
or wrappers containing "claude".
* chore: sync personal fork → upstream (20260629) (#142)
* refactor(session-types): unify SessionType, promote one_off to proto enum, split config
Eliminates three sources of type duplication:
1. config/types.go + config/executor.go extracted from the 1031-line config/config.go
(SRP fix — config.go now contains only factory functions and the Config struct)
2. session.SessionType is now a Go type alias for config.SessionType, removing the
duplicate type that required aliasSessionTypeToSessionType no-op conversions
3. bool one_off = 14 promoted to SESSION_TYPE_ONE_OFF = 5 in the SessionType proto enum;
field 14 is reserved for wire compatibility. All call sites updated: backend handler,
workflow scheduler, alias defaults service, and all frontend contexts/hooks/tests.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(headless): use Setsid instead of Noctty for headless runner subprocess
WithNoControllingTerminal() sets SysProcAttr.Noctty=true on Linux, which
calls ioctl(0, TIOCNOTTY) in the child after fork. This returns ENOTTY when
the parent process has no controlling terminal — the case when stapler-squad
runs as a systemd service — causing every headless triage call to fail with
"fork/exec .../claude: inappropriate ioctl for device" (exit code 1).
Replace WithNoControllingTerminal() with WithNewSession() in ProcessRunner.Run.
Setsid creates a new process session (implying no controlling terminal) without
invoking TIOCNOTTY, so it works regardless of whether the parent has a TTY.
Also corrects the misleading comment in managed_process_linux.go that claimed
Noctty was safe without a controlling terminal.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(omnibar): replace Create shortcut hint with clickable Create Session button
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(alias): add name_prefix field + fix session name oscillation
- Add `name_prefix` to AliasConfig (Go), AliasProto (proto field 12),
and AliasEntry (TypeScript) — wired through the full stack
- In the detection effect, skip the generic suggestedName update for
aliases; the alias block now derives the session name as
namePrefix + typedLabel, falling back to namePrefix alone or the
alias name — eliminates the oscillation between alias name and
prefix+label on each keystroke
- AliasesManager settings form now has a Name prefix field with a live
preview hint
- Create Session button in shortcuts bar uses compact styling on desktop
and expands to touch-friendly size on coarse-pointer (mobile) devices
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(detection): detect dynamic workflows + expand turn-marker to ✦
- Add "dynamic workflow" alternate to waiting_for_background_agent pattern
so "✻ Waiting for N dynamic workflow(s) to finish" → StatusWaitingForAgent
- Expand [✻◉] → [✻◉✦] in verb_duration_completion and
waiting_for_background_agent to cover ✦ (U+2726, Claude Code primary spinner)
- Add test cases for all three bullet variants on both waiting and completion lines
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(review-queue): show INPUT_REQUIRED items + UX improvements
- Fix invisible INPUT_REQUIRED/APPROVAL_PENDING items: deriveWorkingState
maps these to PROCESSING, which was being filtered out; now always
passes items through when their reason requires user action
- Fix workingCount to exclude INPUT_REQUIRED/APPROVAL_PENDING from the
"working" tally (they need attention, not patience)
- Fix summaryCount grammar ("input neededs", "task completes", "timed outs")
by replacing tuple pluralization with per-reason formatter functions
- Fix filter empty state: show "no items match" when a filter is active,
not the generic "all done" message
- Move auto-advance checkbox into the panel title row (was orphaned above
the card in page.tsx toolbar div)
- Hide floating help button on mobile (keyboard shortcuts are irrelevant
on touch devices)
- Increase filter button / toggle touch targets to 44px on mobile
- Downgrade oldest-item callout from alarming orange to neutral muted style
- Show filter toggle whenever any items exist (not only when server
totalItems > 0)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(alias): default session type + name oscillation
- Fix session type not applying for aliases configured as
"Default (directory)": that option stores SessionType.UNSPECIFIED,
which the detection effect was explicitly skipping — form stayed at
the initial "new_worktree" value instead. Now maps UNSPECIFIED → "directory".
- Fix session name oscillating every other keystroke: the generic
suggestedName block was running for InputType.Alias results and
resetting lastSuggestedNameRef to the alias slug (e.g. "pw"),
causing the alias-specific name block to fail its staleness check
and alternate on each input event. Fixed by skipping the generic
block for Alias inputs entirely — the alias block below handles naming.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* chore(demos): update E2E feature GIFs [skip ci]
* chore(sdd): planning artifacts for review-queue-jump-fix
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(review-queue): suppress auto-advance on session status transitions
The "deleted externally" effect in ReviewQueueContent used reviewQueueItems
(the filtered visible list) to check if the selected session still existed.
When a session transitioned to ACTIVE/PROCESSING, it was filtered from the
visible list but remained in the Redux store — the effect incorrectly fired
handleAutoAdvance(id, true), jumping to the next queue item immediately after
the user opened a session and clicked into the terminal.
Fix: use allQueueItems from useReviewQueueContext().items (the unfiltered
Redux store) as the existence oracle. A session filtered from the visible queue
due to status transition stays in the store and no longer triggers auto-advance.
Genuine removals (removeItem Redux events) still fire auto-advance correctly.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(sessions): prevent Claude process orphaning after server restart
Three-part fix for tmux session / Claude process accumulation:
**Fix 1 — DeleteSession fallback (session_service.go)**
When FindLiveInstance returns nil (e.g. server restarted since the session
was created, so the in-memory poller is empty), fall back to
KillTmuxSessionByTitle which kills by the deterministic tmux session name.
Previously the DB record was deleted but the Claude process kept running
indefinitely.
**Fix 2 — Startup orphan sweep (session/orphan_sweep.go)**
ReconcileOrphanedTmuxSessions runs as Step 6d of BuildRuntimeDeps, after
the re-adoption passes (6/6b) that hot-attach DB sessions to their live
tmux panes. It enumerates all staplersquad_* tmux sessions, reads the
STAPLER_SESSION_UUID env var from each, and kills any whose UUID (or
sanitized title) has no match in the current workspace DB. The keepalive
sentinel is always preserved.
**Fix 3 — MCPServerURL backfill (session_service.go)**
loadInstancesWithWiring now backfills inst.MCPServerURL from the server's
configured URL for sessions created before MCP integration was wired up.
Without this, buildLaunchCommand omits --mcp-config entirely and Claude
restarts without a session UUID, making it impossible to identify from the
process list or MCP request headers.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* fix(lint): return empty map instead of nil in GetAllInstanceArtifacts
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* fix(backlog): harden triage parser and add repoPath UI gate
ParseHeadlessTriageResult now uses brace-scan (strings.Index/LastIndex)
to tolerate natural-language preamble before the JSON block, fixing
silent parse failures on multi-step triage runs. The "Trigger Triage"
button in BacklogItemDetail and BacklogItemCard is now disabled with a
tooltip when repoPath is not set, preventing the confusing
CodeFailedPrecondition server error.
Adds 3 new unit tests for the parser and a Playwright e2e gate test
that creates an item without repoPath and asserts the button is
disabled.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(demos): update E2E feature GIFs [skip ci]
* feat(harness): headless triage test harness + alias kebab-case fix
Adds a build-tagged Go harness (go:build harness) that exercises the
backlog triage feature end-to-end via the ConnectRPC HTTP layer with no
browser or UI. Four sub-tests cover distinct phases runnable individually:
Gate (repoPath precondition), TriggerAndPoll (async completion), ParserRobust
(preamble tolerance), and FullFlow (full user journey). Makefile targets
added for each phase.
Also converts alias namePrefix label to kebab-case lowercase
(spaces/underscores → hyphens) before concatenating with the prefix, so
"@ssq My New Feature" produces "ssq-my-new-feature" instead of
"ssq-My New Feature". Two new tests added to Omnibar.alias.test.tsx.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(sdd): planning artifacts for nav-redesign
Navigation redesign: group 16+ flat nav items into 4 sections (Work,
Automation, Insights, Settings & Tools), restore mobile access for 8
currently-hidden routes, and consolidate Settings/Config Files/Features.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(nav): group navigation into 4 sections, restore mobile access
Reorganise the 15 nav pages into Work / Automation / Insights / Settings
groups rendered in both DrawerNav (desktop sidebar) and BottomNav More
sheet (mobile). All 8 routes that were hidden from mobile (Settings,
Insights, Logs, Errors, Help, Escape Analytics, Files, Workflows/Rules)
are now reachable on every screen size. Removes the redundant Config
Files and Features top-level entries; fixes a DrawerNav bug where items
were shown regardless of feature-flag state.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* chore(demos): update E2E feature GIFs [skip ci]
* chore: commit in-progress work from previous sessions
Includes executor fixes (WithProcessDir support, Linux setsid/Setpgid
EPERM fix), backlog triage harness test expansions, rate-limit
integration test, Makefile test-triage-real target, and planning
artifacts for backlog-triage-e2e-hardening and
put-backlog-behind-a-feature-flag-by-default.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat: support Antigravity CLI hooks.json format in ssq-hooks
* fix(pane): restore session peek modal integration in pane picker
* feat(files): wire up the premium LocalFileBrowser component to the files page
* chore: commit in-progress work from previous sessions
- ssq-hooks: Antigravity CommandLine/Cwd normalization, workspace-aware
DB path resolution from cwd, WorkspacePaths fallback
- session service: ForkSession fully wired (callbacks, hook config,
controller, driver, autonomous mode); ResumeHibernated wires review
queue poller and autonomous driver
- ent schema: autonomous_mode bool field + generated ORM files
- instance_hibernate: start controller + session driver on resume
- omnibar: initialTitle prop pre-populates session name; OmnibarContext
threads title through openOmnibar(); page.tsx passes ?title param
- LocalFileBrowser: CSS and component updates
- scripts: find-orphaned-features.py, find-unmerged-commits.py
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(omnibar): replace Create shortcut hint with clickable Create Session button
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(settings): add UpsertAlias and DeleteAlias RPCs with AliasesManager UI
Implements full CRUD for alias session presets in Settings > General, removing
the need to manually edit config.json. Adds UpsertAlias/DeleteAlias ConnectRPC
handlers (case-insensitive name matching, slice-scan upsert, validation via
aliasNameRE) and a React AliasesManager component with inline 3-second delete
confirmation, env-var editor, tag management, and ARIA accessibility.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(registry): add alias RPCs to scanner methodToID map
UpsertAlias, DeleteAlias, ListAliases were missing from the methodToID
map, causing the scanner to use fallback raw-name IDs (UpsertAlias,
DeleteAlias, ListAliases) instead of canonical kebab-case IDs
(alias:upsert, alias:delete, alias:list). This caused Registry
Validation CI to fail with 3.36% divergence.
Removes the duplicate fallback JSON files from the registry root that
were generated under the old behavior.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(analytics): program detail panel with subcommand drill-down
Add DB-backed time-windowed analytics queries and an inline program
detail panel so operators can see exactly which sub-operations are
causing escalations before writing a rule.
Backend (Go):
- Add compound index on (command_program, created_at) to ent schema
- Replace full-table-scan ListAnalytics with time-windowed
ListAnalyticsSince (WHERE created_at >= ?) — AC-1, AC-2
- Add GetSubcommandBreakdown aggregation query using ent GroupBy — AC-4
- Add ListRecentCommandsByProgram returning last N command previews — AC-5
- Add GetSubcommandTrend returning per-day counts — AC-6
- Add GetProgramAnalytics ConnectRPC method returning SubcommandBreakdown,
ExampleCommands, RuleCoverage, DailyTrend — AC-7
Frontend (React/TypeScript):
- New ProgramDetailPanel component with subcommand frequency table
(count, %, decision breakdown), example commands, rule coverage
summary, trend sparklines, and "Add rule →" links — AC-8 through AC-13
- New useProgramAnalytics hook with AbortController cleanup
- ApprovalAnalyticsPanel: clicking program row opens inline detail panel
- ApprovalRulesPanel: fix panel crush in flex container (flexShrink: 0),
use window.location.search in useEffect for URL param pre-fill
(avoids useSearchParams/Suspense issues in Next.js static export)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(backlog): gate backlog behind feature flag on all layers
- Frontend layout guard: backlog/layout.tsx redirects to / when flag off
- Backend interceptor: FeatureFlagInterceptor wired to BacklogService only
- E2E tests: beforeAll/afterAll enable+restore the backlog flag
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: address copilot review comments on analytics drill-down
- Fix 1: exclude NULL command_subcategory rows in GetSubcommandBreakdown
to avoid sql.ScanSlice scan errors on nullable GROUP BY columns
- Fix 2: replace strings.Fields tokenizer in coveredSubcommands() with
regexp.Compile + synthetic "<program> <subcommand>" matching so
regex-style patterns (e.g. \bgit\b.*\bpush\b) work correctly
- Fix 3: add TestGetProgramAnalytics_ReturnsExpectedFields unit test
covering window_days=7 and non-nil response fields
- Fix 4: add escapeRegex() helper in ApprovalRulesPanel and use it when
prefilling commandPattern to avoid metacharacter injection; switch word
boundaries from \b to (?:^|\s)/(?:\s|$) for hyphenated program names
- Fix 5: add e.stopPropagation() on Suggest Rule button and "add manually"
link so clicking them does not toggle the parent <tr> drill-down row
- Fix 6: add tabIndex, role=button, aria-expanded, aria-label, and
onKeyDown (Enter/Space) to the clickable <tr> for keyboard accessibility
- Fix 7: call setData(null) before setIsLoading(false) in error path of
useProgramAnalytics to clear stale data on refresh failure
- Fix 8: render per-program daily trend sparkline in ProgramDetailPanel;
note that trend data is per-program not per-subcommand (backend limit)
- Fix 9: thread caller context through LoadProgramWindow,
GetSubcommandBreakdown, and ListRecentCommands instead of context.Background()
* fix(review-queue): resolve UUID→Title before Remove so approved/deleted sessions leave the queue
Queue items are keyed by inst.Title but approval-response and session-deleted
events arrive with UUID. resolveQueueKey() looks up the instance via FindInstance
(which handles both UUID and Title) and returns Title, falling back to the raw
value if the instance is no longer loaded.
Also removes duplicate SubcommandDecisionCount declaration in repository.go
introduced by the analytics cherry-pick merge.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(bench): update go tier1 baseline [skip ci]
* fix(web): resolve post-merge TypeScript and lint errors
- ApprovalAnalyticsPanel: add missing imports (useGenerateRule, SuggestionSource,
addRuleManualLink) and state (activeRowKey, generateLoading, isGenerating)
for the 'Suggest Rule' button in the programs coverage-gap table
- ApprovalRulesPanel: restore missing RuleFormState interface, emptyForm constant,
useEffect/useRef imports, and URL-param pre-fill state aliases that were
dropped during the merge resolution
- feature_flag_interceptor_test: fix nilnil lint violation by returning a
non-nil connect.Response instead of (nil, nil)
* fix(web): resolve all 102 pre-existing test failures (2811/2811 pass)
jest.setup.js: add global stubs for window.matchMedia, next/navigation,
@xterm/addon-serialize, useAvailablePrograms, and useSlashCommands so
jsdom-based tests don't fail at module load time.
Source fixes:
- ApprovalRulesPanel: replace inline form with dialog modal; add
add-rule-button testid, Escape handler, second useGenerateRule instance
for cmd-sample generation, URL-param prefill via RuleBuilderPrefill
- ApprovalAnalyticsPanel: add Suggest Rule buttons + inline suggestion cards
to the uncovered-tools table (data-testid: suggest-rule-tool-{toolName})
- RuleBuilderForm: add testids for all form fields, advanced-regex-separator,
generate-from-command-details, command-sample sections; add cmdSuggestions
and cmdClear props
- OmnibarCreationPanel: update hint to 'typed into the session terminal'
- XtermTerminal: optional-chain terminal.element, attachCustomKeyEventHandler,
onScroll, onWriteParsed, and Disposable.dispose() for mock environments
- SubStatusChip: guard switch on undefined/null subStatus
- NotificationContext/ThemeContext: return no-op fallback outside Provider
- useShells: guard createAuthInterceptor in test environments
- SessionActionsOverflow: call onClearConversationState directly (no dialog)
- OmnibarResultList/QuickOpenPalette: guard scrollIntoView calls
- useAvailablePrograms: guard fetch in jest.fn() environments
- SessionCard: fix truncateGoal max to produce correct char count
- ruleBuilderPrefill: add commandPattern, initialName, isAiGenerated fields
* chore: update feature registry after merge
make registry-generate removes stale get-program-analytics entry that
was superseded during the fork→upstream sync.
---------
Co-authored-by: Tyler Stapler <tystapler@gmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* feat: GitHub work continuity — persistence, annotation fallback, and type-safe RepoRef
**GitHub owner/repo persistence (ent schema migration)**
- Add github_owner and github_repo columns to sessions table so these
fields survive service restarts (previously lost on reload)
- Wire SaveSession / UpdateSession / loadSession in ent_repository.go
**PR annotation fallback matching**
- Add PRNumber field to PRAnnotationSession for number-based fallback
when local branch name doesn't match GitHub headRef (common for
worktree-style sessions like "pr-1255-...")
- Annotate() builds two maps: primary by owner/branch, secondary by
owner/#number; falls back to number key when branch key misses
- annotateUserPRCache: 3-tier owner resolution — DB fields → PR URL
parse → git remote inference; title regex as last-resort PR number
extraction
**RepoRef value object (type-driven design)**
- New github.RepoRef: unexported fields, smart constructor NewRepoRef,
IsValid(), BranchKey(branch), PRKey(n), String()
- GetOwnerRepoFromRemote returns (RepoRef, error) instead of
(owner, repo string, err error); non-GitHub remotes return zero RepoRef
- PRAnnotationSession.GitHubOwner string → Repo RepoRef (holding a
RepoRef proves both owner and repo are non-empty at compile time)
- PRAnnotationWorktree.GitHubOwner string → Repo RepoRef
- Annotate() uses s.Repo.BranchKey() / s.Repo.PRKey() throughout;
worktree_pr_poller and dependencies.go callers updated
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(session-driver): add live output check before prompt injection
Adds outputShowsConversationStarted() to detect active/completed
conversations from live PTY buffer content before injecting the initial
prompt — no disk I/O, no JSONL flush latency.
Wired as the first gate in both the startup pre-flight and the main
injection guard, with FindConversationFilePath kept as fallback for
the post-idle case.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* chore(demos): update E2E feature GIFs [skip ci]
* fix: publish session update event on controller status change
wireStatusChangeCallback was only notifying the review queue manager
on detection state transitions. WatchSessions clients never received
these changes, so the session list stayed stale until the next
explicit RPC call (update/pause/resume) triggered an event.
Now publishes NewSessionUpdatedEventWithDetection alongside the
existing review queue signal, so the frontend session list reflects
Idle/Processing/NeedsApproval transitions in real time.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* fix: skip shell sourcing in test mode to prevent service test timeout
DefaultConfig's GetClaudeCommand and GetAvailablePrograms each source
~/.zshrc for up to 5 program candidates (5s timeout each), adding 17–22s
to the server/services test suite and causing timeouts.
Inject lookPathOnlyExecutor when IsTestMode() is true and no custom
executor is provided. This executor returns ErrNotFound from Output()
(bypassing shell sourcing) and falls through to exec.LookPath for program
discovery — same result, no shell startup cost.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* chore(demos): update E2E feature GIFs [skip ci]
* chore(main): release 1.32.0 (#126)
* chore(demos): update E2E feature GIFs [skip ci]
* fix(codesign): correct otool byte-order in verify-codesign plist decode
otool -s displays 4-byte words in little-endian integer form on ARM64, so
the bytes appear reversed relative to their in-memory order. The original
awk concatenated groups as-is, causing xxd to decode them in the wrong
order (e.g. "mx?<" instead of "<?xm"), which made plutil fail and
verify-codesign always report "no embedded plist" even when the plist was
present and valid.
The fix reverses each 8-hex-char group byte-by-byte before piping to xxd,
restoring the correct byte sequence.
* chore(demos): update E2E feature GIFs [skip ci]
* fix(css): enable scroll on unfinished tab container
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: review queue auto-advance respects preference after approve/deny
The "deleted externally" useEffect called handleAutoAdvance with force=true,
bypassing the auto-advance preference when a session was removed from the
queue (e.g. after approving/denying a permission request). Users couldn't
stay on the current session to continue watching even with auto-advance off.
Removes force=true so the toggle is fully respected on all removal paths.
Adds T-AA-008 to document and guard this behavior.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(lint): suppress norawexec on lookPathOnlyExecutor stub
lookPathOnlyExecutor.Command satisfies the CommandExecutor interface but
its Output always returns ErrNotFound — the returned cmd is never executed.
Using safeexec.CommandContext here would be misleading since the command
never runs; nolint with justification is appropriate.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(lint): use correct nolint directives for lookPathOnlyExecutor stub
Needs both //nolint:norawexec (custom linter) and //nolint:forbidigo
(golangci-lint forbidigo rule) since two separate lint passes check this.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* fix(unfinished): stack GitHub auth banner vertically so Connect button is always visible
Button was pushed off-screen on narrow viewports due to flex-row layout with
flexGrow:1 on the text. Switch to column direction so the button always renders
below the error message.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(demos): update E2E feature GIFs [skip ci]
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* feat(pr-status): show PR badge in row mode and use go-git for branch detection
Show GitHubBadge inline in SessionRow (row/list view) so PR status is
visible without switching to card view. Previously the badge only
rendered in SessionCard (card view).
Switch getCurrentBranchName from subprocess (git rev-parse) to go-git
direct file read — no subprocess overhead. Add exported
GetCurrentBranchName wrapper and CurrentBranch() method on Instance
that falls back to live git read for directory sessions (Branch field
is always empty for non-worktree sessions). Add UpdatePRStatus() helper
for atomic in-memory PR status updates from PRStatusPoller.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* chore(demos): update E2E feature GIFs [skip ci]
* fix: repair broken release pipeline and build-from-source path (#147)
* fix: repair broken release pipeline and build-from-source path
Every GoReleaser release since v1.9.0 has failed with "found 3 builds
with the ID 'stapler-squad'" because none of the three build entries
in .goreleaser.yaml declared an explicit id, so GoReleaser assigned
them all the same default. This is why brew install pulls the ancient
1.9.0 build (Formula/stapler-squad.rb hasn't updated since) and why
install.sh's release-asset download has had nothing to fetch for
every tag from v1.20.1 through v1.32.0. Give each build block an
explicit unique id.
Also fixes two things blocking the build-from-source path:
- config/executor.go: lookPathOnlyExecutor.Command used a raw
exec.Command instead of safeexec.CommandContext, tripping the
norawexec custom lint rule and failing `make build` outright.
- Makefile: `go build` never set the version ldflag, so both
`make build` and plain `go build .` reported the stale hardcoded
"1.1.2" regardless of what was actually built. Derive VERSION from
`git describe` and pass it via -ldflags, matching what GoReleaser
already does for tagged releases.
Verified locally: `make build` now succeeds end-to-end and
`./stapler-squad version` reports the real git-described version.
`goreleaser check` and a full `goreleaser release --snapshot --clean`
(with the GITHUB_* env vars CI provides) both succeed, including
Homebrew formula generation.
Fixes #143
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* fix: isolate TestGetConfigDir from ambient STAPLER_SQUAD_* env vars
GetConfigDir() checks STAPLER_SQUAD_TEST_DIR and STAPLER_SQUAD_INSTANCE
before falling through to test-mode auto-detection. When the test
process inherits either from its environment (e.g. running inside a
stapler-squad-managed session), the "uses test mode isolation for
tests" subtest short-circuits on the ambient value instead of
exercising auto-detection, and fails. Clear both for the duration of
the subtest and restore them afterward.
Verified with `go test ./config/... -run TestGetConfigDir -count=3`
and a full `go test ./config/... -count=1`.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* fix: sanitize VERSION and wire it into build-embedded too
Code review on this branch surfaced two real gaps in the version-ldflag
fix:
1. Security: git tag names may legally contain shell metacharacters
(backtick, $()). Make's $(VERSION) substitution is pure text
substitution done before the shell parses the recipe line, so those
characters land as live shell syntax inside the double-quoted
`-ldflags` argument — anyone who can get a maliciously-tagged ref
fetched into a checkout gets command execution on `make build` /
`make install-service`. Strip VERSION to a safe charset before it
ever reaches the shell.
(Checked whether the analogous `VERSION=$(git describe ...)` in
.github/workflows/build.yml has the same problem: it doesn't. That's
a bash variable expansion of an already-computed string, not a
macro substitution before the shell parses the command — bash does
not re-evaluate `$()`/backticks embedded in an expanded variable's
value. Verified empirically. Left that file alone.)
2. Completeness: `build-embedded` (the tmux-bundled single-binary
target used by `make build-tmux` -> `make build-embedded`) builds
the same stapler-squad binary as the primary `stapler-squad` target
but wasn't wired to the new LDFLAGS, so it would have kept shipping
the exact stale "1.1.2" version string issue #143 complains about.
Verified: `make build` still succeeds and reports a correct, sanitized
version. `make -n build-embedded` confirms the ldflags now appear in
that target's go build invocation.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* ci: add goreleaser check as a regression guard for .goreleaser.yaml
The build-ID collision this PR fixes broke every release for 15+
months with zero visibility: the only place it ever surfaced was a
failed Action run on a tag push (release.yml only runs `goreleaser
release` on `push: tags: v*`), which nobody was watching closely
enough to catch. Add a small, fast, dedicated workflow that runs
`goreleaser check` on every change to .goreleaser.yaml, so a config
mistake like this one fails a PR check immediately instead of silently
breaking every subsequent release.
`goreleaser check` also fails non-zero for known-but-accepted
deprecation warnings, not just genuine invalidity, so a naive `args:
check` step would have gone red on day one against this repo's
existing config (it still uses the classic `brews` publisher, which
GoReleaser wants migrated to `homebrew_casks` — a real behavioral
change for end users, not a syntax rename: casks use different install
semantics, code-signing/Gatekeeper expectations, and app-bundle
lifecycle hooks that don't apply to a plain CLI binary, and would very
likely break the `brew install` command this repo's README documents.
That migration needs its own careful, tested PR, not a blind swap
bundled into an install-bug fix). Fixed the two safe, pure-syntax
deprecations in the same commit (`archives.format`/
`format_overrides.format` -> `formats`, now a list — verified via a
full snapshot build that archive naming/extension per-OS is
unchanged) and left `brews` alone. The new workflow's check step
distinguishes "configuration is invalid" (hard fail) from "valid, but
uses deprecated properties" (pass, tracked separately) by output
content rather than exit code, so it stays a real regression guard
instead of either being permanently red on accepted debt or silently
disabled.
Verified locally:
- `goreleaser check` on the current config: valid, only the accepted
`brews` deprecation remains.
- Simulated the exact original bug (duplicate build ids) against a
scratch copy of the config: the same check logic correctly reports
"configuration is invalid" and would fail CI.
- Full `goreleaser release --snapshot --clean` still succeeds
end-to-end after the formats-list migration, archive names/
extensions unchanged.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* fix: sync registry validation with github_user.proto and add missing feature files
CI's Registry Validation check was failing on this PR (unrelated to the
actual fix, but blocking it from going green): `tools/scanner/validate-registry.sh`
never scans `proto/session/v1/github_user.proto`, even though the
Makefile's `registry-generate-backend` target does. Both were last
touched independently, and the validation script's hardcoded proto
list was never updated when github_user.proto's RPCs (added in
3be7e0902, well before this branch existed) were registered. The
result: `docs/registry/features/backend/*.json` never had entries for
ListGitHubAccounts/PollGitHubDeviceAuth/RevokeGitHubToken/
StartGitHubDeviceAuth, and the validation script would report them as
"Removed RPCs" (154 committed vs. 147 generated, 4.55% divergence)
forever, regardless of whether the per-feature files existed — the
scanner it runs simply never looks at that proto file.
- Added the missing `github_user.proto` scan step to
validate-registry.sh, matching the Makefile.
- Ran `make registry-generate` to create the 4 missing per-feature
JSON files these RPCs were always supposed to have.
Verified: `./tools/scanner/validate-registry.sh` now reports
"Committed: 154 Generated: 154 Divergence: 0.0%" and exits 0.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---------
Co-authored-by: Tyler Stapler <tystapler@gmail.com>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
* chore(main): release 1.33.0 (#145)
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* Brew formula update for stapler-squad version v1.33.0
* chore(demos): update E2E feature GIFs [skip ci]
* fix: backlog/triage sessions die on launch (shell injection + flag-parsing crash) (#150)
* fix: shell-quote claude launch args to stop injection and flag-parsing crash
Backlog/triage spawned sessions died on launch: the prompt is interpolated
into a shell command (tmux launches programs through a shell), and Go's %q
produces double quotes, which do not suppress backtick/$(...)/$VAR
expansion. Backlog prompts are full of backtick-wrapped tokens
(`/backlog/done-N`, etc.), so the shell executed each as a command instead
of passing it to claude. Separately, backlog prompts begin with
"--- BACKLOG ITEM DATA ---", which claude's arg parser rejected as an
unrecognized flag once quoting was fixed.
Add shellQuote (POSIX single-quoting, the same style already used for
--mcp-config) and apply it to every claude flag value that gets
interpolated into the shell command: --append-system-prompt, --allowedTools,
--permission-mode, and the positional prompt. Insert a bare "--" before the
prompt so a leading "--" in the prompt text is treated as data, not flags.
Verified against the real claude CLI that both -- as an end-of-options
separator and --append-system-prompt-file are accepted, and confirmed via
a real shell execution that a $(...) payload in a backlog-shaped prompt no
longer executes.
Fixes #148
* fix: close remaining shell-injection gaps found by review
Multi-agent review of the shellQuote fix found the same vulnerability
class still present two call sites over:
- --resume value: claudeSessionID traces back to the client-supplied
resume_id field on CreateSessionRequest with no format validation, and
was still interpolated unquoted into the shell-executed launch command
in the same function that was just patched.
- claudeMCPConfigFlag hand-rolled its own shell single-quoting (a literal
'...' wrapper) instead of reusing shellQuote, leaving a second,
untested implementation of the same job living next to the new one.
Not currently exploitable (MCPServerURL/UUID aren't attacker-supplied
today) but a latent gap in the same file that just added the primitive
meant to prevent this.
Also add regression tests the review flagged as missing: --allowedTools
and --permission-mode had zero shell-safety coverage even though
shellQuote was applied to both, so a partial revert of just those two
lines would have passed the full suite silently. Reworked the two
existing Prompt/AppendSystemPrompt regression tests to assert against
hand-written expected literals instead of calling shellQuote() again,
so they don't just verify the function against itself. Added
only-single-quote, embedded-newline, and combined backtick+quote cases
to TestShellQuote's table.
Confirmed session/claude_command_builder.go's separate --resume path is
not affected: it validates the session ID against a strict UUID v4
regex before use, and is not wired into any production call site today.
---------
Co-authored-by: Tyler Stapler <tystapler@gmail.com>
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* fix(analytics…
main advanced again since the last merge (upstream-fanatics -> personal fork sync). Merging to resolve the reported conflict before shipping. # Conflicts: # server/services/backlog_service.go # session/ent_repository_backlog.go
Contributor
✅ Registry ValidationTest Coverage: 4/158 features have
|
tstapler
added a commit
that referenced
this pull request
Jul 4, 2026
PR #138 finished the GitHub sync feature (TriggerSync/GetSyncHistory RPCs, settings UI, e2e coverage) rather than cutting it — updates gaps-and-risks.md and the triage-order list to reflect that, plus the cross-source external_id collision bug found and fixed during review. Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
5 tasks
TylerStaplerAtFanatics
added a commit
that referenced
this pull request
Jul 10, 2026
* refactor(session-types): unify SessionType, promote one_off to proto enum, split config
Eliminates three sources of type duplication:
1. config/types.go + config/executor.go extracted from the 1031-line config/config.go
(SRP fix — config.go now contains only factory functions and the Config struct)
2. session.SessionType is now a Go type alias for config.SessionType, removing the
duplicate type that required aliasSessionTypeToSessionType no-op conversions
3. bool one_off = 14 promoted to SESSION_TYPE_ONE_OFF = 5 in the SessionType proto enum;
field 14 is reserved for wire compatibility. All call sites updated: backend handler,
workflow scheduler, alias defaults service, and all frontend contexts/hooks/tests.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(headless): use Setsid instead of Noctty for headless runner subprocess
WithNoControllingTerminal() sets SysProcAttr.Noctty=true on Linux, which
calls ioctl(0, TIOCNOTTY) in the child after fork. This returns ENOTTY when
the parent process has no controlling terminal — the case when stapler-squad
runs as a systemd service — causing every headless triage call to fail with
"fork/exec .../claude: inappropriate ioctl for device" (exit code 1).
Replace WithNoControllingTerminal() with WithNewSession() in ProcessRunner.Run.
Setsid creates a new process session (implying no controlling terminal) without
invoking TIOCNOTTY, so it works regardless of whether the parent has a TTY.
Also corrects the misleading comment in managed_process_linux.go that claimed
Noctty was safe without a controlling terminal.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(omnibar): replace Create shortcut hint with clickable Create Session button
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(alias): add name_prefix field + fix session name oscillation
- Add `name_prefix` to AliasConfig (Go), AliasProto (proto field 12),
and AliasEntry (TypeScript) — wired through the full stack
- In the detection effect, skip the generic suggestedName update for
aliases; the alias block now derives the session name as
namePrefix + typedLabel, falling back to namePrefix alone or the
alias name — eliminates the oscillation between alias name and
prefix+label on each keystroke
- AliasesManager settings form now has a Name prefix field with a live
preview hint
- Create Session button in shortcuts bar uses compact styling on desktop
and expands to touch-friendly size on coarse-pointer (mobile) devices
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(detection): detect dynamic workflows + expand turn-marker to ✦
- Add "dynamic workflow" alternate to waiting_for_background_agent pattern
so "✻ Waiting for N dynamic workflow(s) to finish" → StatusWaitingForAgent
- Expand [✻◉] → [✻◉✦] in verb_duration_completion and
waiting_for_background_agent to cover ✦ (U+2726, Claude Code primary spinner)
- Add test cases for all three bullet variants on both waiting and completion lines
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(review-queue): show INPUT_REQUIRED items + UX improvements
- Fix invisible INPUT_REQUIRED/APPROVAL_PENDING items: deriveWorkingState
maps these to PROCESSING, which was being filtered out; now always
passes items through when their reason requires user action
- Fix workingCount to exclude INPUT_REQUIRED/APPROVAL_PENDING from the
"working" tally (they need attention, not patience)
- Fix summaryCount grammar ("input neededs", "task completes", "timed outs")
by replacing tuple pluralization with per-reason formatter functions
- Fix filter empty state: show "no items match" when a filter is active,
not the generic "all done" message
- Move auto-advance checkbox into the panel title row (was orphaned above
the card in page.tsx toolbar div)
- Hide floating help button on mobile (keyboard shortcuts are irrelevant
on touch devices)
- Increase filter button / toggle touch targets to 44px on mobile
- Downgrade oldest-item callout from alarming orange to neutral muted style
- Show filter toggle whenever any items exist (not only when server
totalItems > 0)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(alias): default session type + name oscillation
- Fix session type not applying for aliases configured as
"Default (directory)": that option stores SessionType.UNSPECIFIED,
which the detection effect was explicitly skipping — form stayed at
the initial "new_worktree" value instead. Now maps UNSPECIFIED → "directory".
- Fix session name oscillating every other keystroke: the generic
suggestedName block was running for InputType.Alias results and
resetting lastSuggestedNameRef to the alias slug (e.g. "pw"),
causing the alias-specific name block to fail its staleness check
and alternate on each input event. Fixed by skipping the generic
block for Alias inputs entirely — the alias block below handles naming.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* chore(demos): update E2E feature GIFs [skip ci]
* chore(sdd): planning artifacts for review-queue-jump-fix
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(review-queue): suppress auto-advance on session status transitions
The "deleted externally" effect in ReviewQueueContent used reviewQueueItems
(the filtered visible list) to check if the selected session still existed.
When a session transitioned to ACTIVE/PROCESSING, it was filtered from the
visible list but remained in the Redux store — the effect incorrectly fired
handleAutoAdvance(id, true), jumping to the next queue item immediately after
the user opened a session and clicked into the terminal.
Fix: use allQueueItems from useReviewQueueContext().items (the unfiltered
Redux store) as the existence oracle. A session filtered from the visible queue
due to status transition stays in the store and no longer triggers auto-advance.
Genuine removals (removeItem Redux events) still fire auto-advance correctly.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(sessions): prevent Claude process orphaning after server restart
Three-part fix for tmux session / Claude process accumulation:
**Fix 1 — DeleteSession fallback (session_service.go)**
When FindLiveInstance returns nil (e.g. server restarted since the session
was created, so the in-memory poller is empty), fall back to
KillTmuxSessionByTitle which kills by the deterministic tmux session name.
Previously the DB record was deleted but the Claude process kept running
indefinitely.
**Fix 2 — Startup orphan sweep (session/orphan_sweep.go)**
ReconcileOrphanedTmuxSessions runs as Step 6d of BuildRuntimeDeps, after
the re-adoption passes (6/6b) that hot-attach DB sessions to their live
tmux panes. It enumerates all staplersquad_* tmux sessions, reads the
STAPLER_SESSION_UUID env var from each, and kills any whose UUID (or
sanitized title) has no match in the current workspace DB. The keepalive
sentinel is always preserved.
**Fix 3 — MCPServerURL backfill (session_service.go)**
loadInstancesWithWiring now backfills inst.MCPServerURL from the server's
configured URL for sessions created before MCP integration was wired up.
Without this, buildLaunchCommand omits --mcp-config entirely and Claude
restarts without a session UUID, making it impossible to identify from the
process list or MCP request headers.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* fix(lint): return empty map instead of nil in GetAllInstanceArtifacts
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* fix(backlog): harden triage parser and add repoPath UI gate
ParseHeadlessTriageResult now uses brace-scan (strings.Index/LastIndex)
to tolerate natural-language preamble before the JSON block, fixing
silent parse failures on multi-step triage runs. The "Trigger Triage"
button in BacklogItemDetail and BacklogItemCard is now disabled with a
tooltip when repoPath is not set, preventing the confusing
CodeFailedPrecondition server error.
Adds 3 new unit tests for the parser and a Playwright e2e gate test
that creates an item without repoPath and asserts the button is
disabled.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(demos): update E2E feature GIFs [skip ci]
* feat(harness): headless triage test harness + alias kebab-case fix
Adds a build-tagged Go harness (go:build harness) that exercises the
backlog triage feature end-to-end via the ConnectRPC HTTP layer with no
browser or UI. Four sub-tests cover distinct phases runnable individually:
Gate (repoPath precondition), TriggerAndPoll (async completion), ParserRobust
(preamble tolerance), and FullFlow (full user journey). Makefile targets
added for each phase.
Also converts alias namePrefix label to kebab-case lowercase
(spaces/underscores → hyphens) before concatenating with the prefix, so
"@ssq My New Feature" produces "ssq-my-new-feature" instead of
"ssq-My New Feature". Two new tests added to Omnibar.alias.test.tsx.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(sdd): planning artifacts for nav-redesign
Navigation redesign: group 16+ flat nav items into 4 sections (Work,
Automation, Insights, Settings & Tools), restore mobile access for 8
currently-hidden routes, and consolidate Settings/Config Files/Features.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(nav): group navigation into 4 sections, restore mobile access
Reorganise the 15 nav pages into Work / Automation / Insights / Settings
groups rendered in both DrawerNav (desktop sidebar) and BottomNav More
sheet (mobile). All 8 routes that were hidden from mobile (Settings,
Insights, Logs, Errors, Help, Escape Analytics, Files, Workflows/Rules)
are now reachable on every screen size. Removes the redundant Config
Files and Features top-level entries; fixes a DrawerNav bug where items
were shown regardless of feature-flag state.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* chore(demos): update E2E feature GIFs [skip ci]
* chore: commit in-progress work from previous sessions
Includes executor fixes (WithProcessDir support, Linux setsid/Setpgid
EPERM fix), backlog triage harness test expansions, rate-limit
integration test, Makefile test-triage-real target, and planning
artifacts for backlog-triage-e2e-hardening and
put-backlog-behind-a-feature-flag-by-default.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat: support Antigravity CLI hooks.json format in ssq-hooks
* fix(pane): restore session peek modal integration in pane picker
* feat(files): wire up the premium LocalFileBrowser component to the files page
* chore: commit in-progress work from previous sessions
- ssq-hooks: Antigravity CommandLine/Cwd normalization, workspace-aware
DB path resolution from cwd, WorkspacePaths fallback
- session service: ForkSession fully wired (callbacks, hook config,
controller, driver, autonomous mode); ResumeHibernated wires review
queue poller and autonomous driver
- ent schema: autonomous_mode bool field + generated ORM files
- instance_hibernate: start controller + session driver on resume
- omnibar: initialTitle prop pre-populates session name; OmnibarContext
threads title through openOmnibar(); page.tsx passes ?title param
- LocalFileBrowser: CSS and component updates
- scripts: find-orphaned-features.py, find-unmerged-commits.py
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(omnibar): replace Create shortcut hint with clickable Create Session button
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(settings): add UpsertAlias and DeleteAlias RPCs with AliasesManager UI
Implements full CRUD for alias session presets in Settings > General, removing
the need to manually edit config.json. Adds UpsertAlias/DeleteAlias ConnectRPC
handlers (case-insensitive name matching, slice-scan upsert, validation via
aliasNameRE) and a React AliasesManager component with inline 3-second delete
confirmation, env-var editor, tag management, and ARIA accessibility.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(registry): add alias RPCs to scanner methodToID map
UpsertAlias, DeleteAlias, ListAliases were missing from the methodToID
map, causing the scanner to use fallback raw-name IDs (UpsertAlias,
DeleteAlias, ListAliases) instead of canonical kebab-case IDs
(alias:upsert, alias:delete, alias:list). This caused Registry
Validation CI to fail with 3.36% divergence.
Removes the duplicate fallback JSON files from the registry root that
were generated under the old behavior.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(analytics): program detail panel with subcommand drill-down
Add DB-backed time-windowed analytics queries and an inline program
detail panel so operators can see exactly which sub-operations are
causing escalations before writing a rule.
Backend (Go):
- Add compound index on (command_program, created_at) to ent schema
- Replace full-table-scan ListAnalytics with time-windowed
ListAnalyticsSince (WHERE created_at >= ?) — AC-1, AC-2
- Add GetSubcommandBreakdown aggregation query using ent GroupBy — AC-4
- Add ListRecentCommandsByProgram returning last N command previews — AC-5
- Add GetSubcommandTrend returning per-day counts — AC-6
- Add GetProgramAnalytics ConnectRPC method returning SubcommandBreakdown,
ExampleCommands, RuleCoverage, DailyTrend — AC-7
Frontend (React/TypeScript):
- New ProgramDetailPanel component with subcommand frequency table
(count, %, decision breakdown), example commands, rule coverage
summary, trend sparklines, and "Add rule →" links — AC-8 through AC-13
- New useProgramAnalytics hook with AbortController cleanup
- ApprovalAnalyticsPanel: clicking program row opens inline detail panel
- ApprovalRulesPanel: fix panel crush in flex container (flexShrink: 0),
use window.location.search in useEffect for URL param pre-fill
(avoids useSearchParams/Suspense issues in Next.js static export)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(backlog): gate backlog behind feature flag on all layers
- Frontend layout guard: backlog/layout.tsx redirects to / when flag off
- Backend interceptor: FeatureFlagInterceptor wired to BacklogService only
- E2E tests: beforeAll/afterAll enable+restore the backlog flag
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: address copilot review comments on analytics drill-down
- Fix 1: exclude NULL command_subcategory rows in GetSubcommandBreakdown
to avoid sql.ScanSlice scan errors on nullable GROUP BY columns
- Fix 2: replace strings.Fields tokenizer in coveredSubcommands() with
regexp.Compile + synthetic "<program> <subcommand>" matching so
regex-style patterns (e.g. \bgit\b.*\bpush\b) work correctly
- Fix 3: add TestGetProgramAnalytics_ReturnsExpectedFields unit test
covering window_days=7 and non-nil response fields
- Fix 4: add escapeRegex() helper in ApprovalRulesPanel and use it when
prefilling commandPattern to avoid metacharacter injection; switch word
boundaries from \b to (?:^|\s)/(?:\s|$) for hyphenated program names
- Fix 5: add e.stopPropagation() on Suggest Rule button and "add manually"
link so clicking them does not toggle the parent <tr> drill-down row
- Fix 6: add tabIndex, role=button, aria-expanded, aria-label, and
onKeyDown (Enter/Space) to the clickable <tr> for keyboard accessibility
- Fix 7: call setData(null) before setIsLoading(false) in error path of
useProgramAnalytics to clear stale data on refresh failure
- Fix 8: render per-program daily trend sparkline in ProgramDetailPanel;
note that trend data is per-program not per-subcommand (backend limit)
- Fix 9: thread caller context through LoadProgramWindow,
GetSubcommandBreakdown, and ListRecentCommands instead of context.Background()
* fix(review-queue): resolve UUID→Title before Remove so approved/deleted sessions leave the queue
Queue items are keyed by inst.Title but approval-response and session-deleted
events arrive with UUID. resolveQueueKey() looks up the instance via FindInstance
(which handles both UUID and Title) and returns Title, falling back to the raw
value if the instance is no longer loaded.
Also removes duplicate SubcommandDecisionCount declaration in repository.go
introduced by the analytics cherry-pick merge.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(bench): update go tier1 baseline [skip ci]
* chore: sync upstream → personal fork (20260629) (#132)
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* chore(demos): update E2E feature GIFs [skip ci]
* refactor(session): apply type-driven design to buildLaunchCommand
Replace the 8x isClaudeProgram bool check with a sealed programKind sum
type (claudeProgram / plainProgram). classifyProgram() parses once at the
boundary; holding claudeProgram is proof the program invokes claude, so
buildClaudeCommand needs zero isClaude guards — they are enforced by the
type system, not by runtime checks.
- Add programKind interface with claudeProgram / plainProgram variants
- Add classifyProgram() smart constructor (parses once; trust downstream)
- buildLaunchCommand: switches on type, delegates to buildClaudeCommand or
returns plain cmd unchanged
- buildClaudeCommand: no guards — the type makes invalid states
unrepresentable (a plainProgram can never reach this function)
- Extract claudeMCPConfigFlag() helper for the MCP config flag string
- TestClassifyProgram: table test for the sum type classification
- TestBuildLaunchCommand_PlainProgramIgnoresClaudeFlags: proves that a
non-claude program with all claude-related Instance fields set still
returns the bare program, enforced by the type routing
* feat(backlog): implement CancelTriage RPC and session delete button
Adds CancelTriage endpoint that stops any active triage sessions for a
backlog item. Wires up the previously-TODO cancel button in
BacklogItemDetail and adds a per-session delete button in the session list.
* fix(install): skip FDA prompt for non-admin users with cert-signed binary
Non-admin users cannot read either TCC database (authorization denied),
causing fda_is_granted() to always return false and show the 15s prompt
on every reinstall even when FDA is already granted.
When all TCC databases exist but are unreadable, fall back to a heuristic:
if the installed binary is cert-signed (designated requirement includes
"certificate root"), assume FDA was previously granted. The TCC grant is
tied to the signing identity (com.stapler-squad + cert), which is stable
across rebuilds, so no new grant is needed on reinstall.
* perf(tmux): add semaphore to cap concurrent capture-pane subprocesses
capturePaneSem (size 8) limits concurrent CapturePaneContent calls to
avoid circuit-breaker lock contention and OS process table pressure.
Control-mode fast path bypasses the semaphore entirely.
* perf(vcs): cache reachableSet results and batch-read blobs under single lock
- reachableSetCache (sync.Map, 30s TTL) eliminates O(N) commit walk on
repeated calls — was the #1 pprof hotspot (47.4B cycles, 38 events)
- diffShortstatUnderLock batch-reads all needed blobs in one lock hold,
replacing N lock-acquire/release cycles — was the #2 hotspot (9.87B
cycles, 1641 events)
* chore(proto): regenerate types bindings after rebase
Types were out of sync (DetectedStatus missing from Go/TS bindings)
after the CancelTriage commit was rebased onto upstream.
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* chore(demos): update E2E feature GIFs [skip ci]
* fix(terminal): repair escape code pipeline for new Claude Code renderer (#139)
* feat(onboarding): offer to install Claude Code hooks during onboarding
Adds a final onboarding step that asks whether to install the global
Claude Code hooks, with two independent toggles:
- Rule enforcement (PreToolUse -> `ssq-hooks check`)
- Notifications (Notification/Stop -> `ssq-hook-handler`)
Previously these hooks were discoverable only via docs / a manual
`ssq-hooks install` invocation; nothing prompted the user.
Backend:
- New internal/claudehooks package: idempotent, atomic install + detection
of the two global hooks in ~/.claude/settings.json. cmd/ssq-hooks now
reuses it (InstallRules) instead of its private patchClaudeSettings.
- New SessionService RPCs GetHookStatus and InstallHooks. InstallHooks
resolves the ssq-hooks binary and ssq-hook-handler from ~/.local/bin
(then $PATH / exe-relative scripts); when a binary is unavailable it
returns a manual-fallback message rather than failing.
- `make install` now also copies ssq-hook-handler to ~/.local/bin so the
server can register a stable path.
Frontend:
- OnboardingModal gains step 5: prefilled from GetHookStatus (a toggle is
pre-checked only when its hook is available and not already installed),
installs via InstallHooks, and disables toggles whose binary is missing.
Tests: unit tests for the package and the two handlers; Jest tests for the
onboarding step. Feature registry updated (GetHookStatus, InstallHooks,
onboarding-hook-install).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(onboarding): address review — concurrency, async guards, e2e
- claudehooks.mutate: serialize read-modify-write with a package mutex and
write via a unique temp file (os.CreateTemp) so two concurrent installs
(double-click) can't corrupt or clobber settings.json. Add a -race test.
- OnboardingModal: guard async setState with a mounted ref (removes the
after-unmount update / act warning) and seed the toggle defaults only once
so navigating Back→forward no longer discards the user's toggle edits;
reset the seed guard on a fresh open.
- Jest: await the status fetch in gotoHooksStep to remove flakiness.
- Add Playwright e2e (tests/e2e/onboarding-hook-install.spec.ts) covering the
hooks step render + finish-without-install (does not mutate global settings).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore(sdd): planning artifacts for new-renderer terminal fix
Research, implementation plan, adversarial/architecture reviews, validation
plan, and architecture-performance deep-dive for fixing escape code stripping
caused by the new Claude Code renderer.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(terminal): repair escape code pipeline for new Claude Code renderer
The new Ink-based renderer emits escape sequences that exposed four latent
bugs in the terminal streaming pipeline, causing garbled output in xterm.js:
1. TextDecoder reuse without {stream:true}: multi-byte UTF-8 characters
(é, €, CJK, emoji) split across consecutive proto frames emitted U+FFFD.
Fix: StateApplicator and useTerminalStream now pass {stream:true} on
all streaming decode calls; separate lineDecoder for complete line content.
2. EscapeSequenceParser lookback too short (20→256): OSC window titles and
DCS payloads from the new renderer exceed 20 bytes, causing incomplete
sequences to be flushed as garbage.
3. ED2+ED3 stripping: parser stripped \x1b[3J when paired with \x1b[2J,
bleed-through of previous session history. xterm.js v6 handles this
correctly without intervention.
4. RedrawThrottler over-classification: any \x1b[\d+A was treated as a
full-screen redraw; Ink emits cursor-up on every incremental line
update, causing most progress/spinner frames to be dropped.
Fix: only classify cursor-up + erase-screen as a genuine redraw.
Also: 100→33ms cap (30fps) to match Ink render cadence.
Adds 84 tests including a combined pipeline integration suite covering
the full TerminalDiff→StateApplicator→EscapeSequenceParser→TerminalStreamManager
chain.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(terminal): address code review - decoder isolation, test ESC prefix, timer cleanup
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(registry): regenerate after merge with main
* fix(a11y): remove aria-selected from listitem div; aria-checked on checkbox is correct
* chore(registry): remove stale entries for RPCs removed from main
---------
Co-authored-by: Tyler Stapler <tystapler@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* feat(rules): auto-suggest rule name from criteria inputs (#140)
* feat(rules): auto-suggest rule name from criteria inputs
Generates a "Allow/Block/Escalate {target}" name as the user fills
in tool target, category, pattern, or programs. The suggestion only
applies when the name field is empty or still matches the previous
auto-suggestion, so manual edits are never overwritten.
Also scopes golangci-lint to the current module root to avoid
scanning files in external workspace paths (../../../../../WorkProjects).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(tests): resolve TypeScript errors in ArtifactsTab tests and tighten RuleBuilderForm auto-suggest
- Add makeArtifacts() cast helper in ArtifactsTab.test.tsx to satisfy
protobuf Message<> type requirements without importing the full runtime
- Fix computeSuggestedName category branch: check cat existence, not
cat?.value (avoids truthiness trap on empty-string values)
- Move nameRef sync to useLayoutEffect to avoid render-phase ref mutation
in React concurrent mode
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: resolve CI failures in multiblobworktree test and accessibility violation
- vcsreader_test.go: fix TestDiffShortstat_MultiBlobWorktree by using a modified
content string with different byte length (4 bytes vs 18 bytes original). The
dirty-check in diffShortstatUncached uses size+mtime; when both sides had the
same 18-byte content the file was not detected as changed.
- SessionRow.tsx: remove aria-selected from the session row div, which has
role="listitem" — ARIA spec disallows aria-selected on that role. Selection
state is already communicated by the inner checkbox button's aria-checked.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: add CancelTriage to scanner methodToID map
TestMethodToIDCompleteness enforces that every RPC method in proto files
has a matching entry. CancelTriage (backlog.proto) was missing.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: add GetHookStatus and InstallHooks to scanner methodToID map
Merge from main brought new hooks RPCs into session.proto.
TestMethodToIDCompleteness requires every proto RPC to be mapped.
Feature IDs match the +api: markers in the proto file.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Tyler Stapler <tystapler@gmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* chore(demos): update E2E feature GIFs [skip ci]
* feat(onboarding): offer to install Claude Code hooks during onboarding (#138)
* feat(onboarding): offer to install Claude Code hooks during onboarding
Adds a final onboarding step that asks whether to install the global
Claude Code hooks, with two independent toggles:
- Rule enforcement (PreToolUse -> `ssq-hooks check`)
- Notifications (Notification/Stop -> `ssq-hook-handler`)
Previously these hooks were discoverable only via docs / a manual
`ssq-hooks install` invocation; nothing prompted the user.
Backend:
- New internal/claudehooks package: idempotent, atomic install + detection
of the two global hooks in ~/.claude/settings.json. cmd/ssq-hooks now
reuses it (InstallRules) instead of its private patchClaudeSettings.
- New SessionService RPCs GetHookStatus and InstallHooks. InstallHooks
resolves the ssq-hooks binary and ssq-hook-handler from ~/.local/bin
(then $PATH / exe-relative scripts); when a binary is unavailable it
returns a manual-fallback message rather than failing.
- `make install` now also copies ssq-hook-handler to ~/.local/bin so the
server can register a stable path.
Frontend:
- OnboardingModal gains step 5: prefilled from GetHookStatus (a toggle is
pre-checked only when its hook is available and not already installed),
installs via InstallHooks, and disables toggles whose binary is missing.
Tests: unit tests for the package and the two handlers; Jest tests for the
onboarding step. Feature registry updated (GetHookStatus, InstallHooks,
onboarding-hook-install).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(onboarding): address review — concurrency, async guards, e2e
- claudehooks.mutate: serialize read-modify-write with a package mutex and
write via a unique temp file (os.CreateTemp) so two concurrent installs
(double-click) can't corrupt or clobber settings.json. Add a -race test.
- OnboardingModal: guard async setState with a mounted ref (removes the
after-unmount update / act warning) and seed the toggle defaults only once
so navigating Back→forward no longer discards the user's toggle edits;
reset the seed guard on a fresh open.
- Jest: await the status fetch in gotoHooksStep to remove flakiness.
- Add Playwright e2e (tests/e2e/onboarding-hook-install.spec.ts) covering the
hooks step render + finish-without-install (does not mutate global settings).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore(sdd): add planning artifacts for github-work-continuity
Supersedes docs/tasks/github-pr-status.md (planning complete, absorbed
into this unified plan). Adds requirements, research (4 domains), plan,
adversarial review, and validation for the GitHub Work Continuity feature.
ADRs 020-022 record key decisions: GraphQL for user PR list, enrichment
at service layer not scanner, WorktreePRPoller extends PRStatusPoller.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat: Epic 1+2 GitHub work continuity — bug fixes + WorktreePRPoller
Epic 1 — Pre-flight bug fixes:
- BUG-021: CheckGHAuth() → direct GET /user (no subprocess, no forkExec)
- BUG-022: ETagCache sync.Map replaces RWMutex+map (lock-free reads)
- BUG-023: PRStatusPoller auth state → atomic.Value (pollerAuthResult)
- Story 1.3: checkRateLimitHeaders() monitors X-RateLimit-Remaining,
Retry-After, and X-GitHub-Sso on every GitHub API response
- ADR-020 updated: direct HTTP API, no gh subprocess
Epic 2 — WorktreePRPoller (session/worktree_pr_poller.go):
- Polls GitHub PR data for worktrees that have no active session
- sync.Map for cache (lock-free reads); atomic.Value for auth + callback
- WorktreeSource interface breaks import cycle via scannerSource adapter
- GetOwnerRepoFromRemote() added to github/client.go
- Wired into server: started after UnfinishedWork scanner
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat: Epic 3 Story 3.1 — UserPRCache with direct GraphQL API
Add github/user_pr_cache.go: lock-free background cache of all open PRs
authored by the authenticated GitHub user.
- Uses POST /graphql (newGHPostRequest) directly — no gh subprocess
- atomic.Value COW snapshot for lock-free reads
- singleflight.Group coalesces concurrent manual Refresh() calls
- GetCurrentUserLogin added to github/client.go via GET /user
- loginState also cached with atomic.Value + singleflight
- checkRateLimitHeaders called on every response
- Wired into ServerDependencies / RuntimeDeps; Start(ctx) called in server.go
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat: Epic 3 Story 3.2 — Annotate UserPR with session IDs and worktree paths
- Add PRAnnotationSession / PRAnnotationWorktree value types to github pkg
(avoids import cycle: github is imported by session, not vice-versa)
- Add UserPRCache.Annotate() — COW: load snapshot → copy+annotate → store
matching by owner+branch, O(n + m) via map lookups
- Add PRStatusPoller.GetInstances() — defensive copy under RLock
- Wire annotateUserPRCache() helper in server/dependencies.go: called in
UserPRCache.SetOnUpdated callback, reads sessions from PRStatusPoller and
worktrees from unfinished.Scanner
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat: Epic 3 Story 3.3 — UserPR proto + GitHubUserService proto + generated bindings
Add proto/session/v1/github_user.proto:
- GitHubUserService with ListUserPRs, WatchUserPRs, GetGitHubAuthState RPCs
- GitHubAuthState, ListUserPRs*, WatchUserPRs*, GetGitHubAuthState* messages
Add UserPR message to types.proto (fields 1-17: owner, repo, number, title,
html_url, state, head_ref, base_ref, is_draft, check_conclusion, approved_count,
changes_req_count, updated_at, closed_at, merged_at, session_ids, local_worktree_path)
Regenerate Go + TypeScript bindings via make proto-gen.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat: Epic 3 Story 3.4 — GitHubUserService ConnectRPC handler
Implement server/services/github_user_service.go:
- ListUserPRs: returns cached open PRs + GitHubAuthState
- WatchUserPRs: sends initial snapshot then streams on each UserPRCache refresh
(buffered channel of size 4; callback set atomically via SetOnUpdated)
- GetGitHubAuthState: calls GetCurrentUserLogin directly, degrades gracefully
- userPRToProto: converts github.UserPR → sessionv1.UserPR with timestamp handling
Wire into server/dependencies.go and registered in server/server.go at
/api/session.v1.GitHubUserService/.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(registry): prune stale RPC files in generation; reconcile after merge
Backend registry generation was additive — it wrote/updated per-feature
files but never deleted ones whose RPC was removed or renamed in the proto.
That left 5 orphaned files after the upstream merge (ArchiveWorkflowSessions,
DeleteWorkflowFailedSessions, GetDetectionEvents, backlog:spawn-session-
autonomous, upload:image), pushing registry-validation divergence to 3.29%
(> 2% gate).
- Add tools/scanner/prune-stale-backend.sh: regenerates the authoritative
id-set into a temp dir and removes committed files whose id is absent.
- Wire it into `make registry-generate-backend` so generation now stays in
sync with deletions while still preserving human-edited testIds/tested
(the in-place scanner pass runs first).
- Reconcile the committed backend set to match (0.0% divergence) and restore
tested=true on GetHookStatus / InstallHooks.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs(bugs): add open bug reports for mutex/cache concurrency issues
BUG-022 ETagCache RWMutex-over-map (Low), BUG-023 PRStatusPoller mutex
churn → atomic.Value (Medium), BUG-024 SearchService branch/history cache
→ singleflight + atomic.Value (Low).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(a11y): remove invalid aria-selected from session row
The session row is a generic div inside role="listitem"; aria-selected is
not an allowed attribute there, which Axe flags as a critical WCAG 2.1 AA
violation (aria-allowed-attr) and blocked the UX Analysis check. Selection
state is already conveyed accessibly by the row's role="checkbox"
aria-checked and the rowSelected style, so the attribute was redundant.
Pre-existing issue surfaced by this PR triggering the web UX workflow.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(unfinished): detect racy-clean same-size working-tree edits in DiffShortstat
DiffShortstat treated a tracked file as unchanged whenever its size matched
the index entry and its truncated-to-second mtime equaled the index entry's
recorded mtime. A file rewritten with identical byte size within the same
wall-clock second as the index update (the classic "racy git" problem) thus
looked clean by stat alone, yielding 0 files/insertions/deletions.
For only these racy same-size candidates, fall back to a git blob content
hash comparison (plumbing.ComputeHash) against the index entry hash, as real
git does. Files exceeding maxUntrackedFileSize are conservatively treated as
changed without being read, preserving the existing large-file caps and the
batch-blob-read performance optimization (no hashing of every tracked file).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(proto-gen): regenerate when output files are missing despite valid stamp
If generated files (gen/ or web-app/src/gen/) are deleted while the stamp
file still exists (e.g. after merging a commit that untracks them), the
stamp check would skip regeneration and leave the build broken.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(registry): map GetHookStatus/InstallHooks RPCs in scanner
The scanner's methodToID map lacked entries for the two new hook RPCs, so
TestMethodToIDCompleteness / TestScanProto_NoUnmappedMethods failed. Add
GetHookStatus→hooks:status and InstallHooks→hooks:install, and regenerate
the registry (moves them to backend/hooks/{status,install}.json with the
canonical ids, pruning the old method-name-keyed flat files).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Tyler Stapler <tystapler@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* chore: gitignore macOS _CodeSignature/ codesign artifact
`make install-service` re-signs the binary, producing _CodeSignature/CodeResources
(~33MB) in the repo root. It's a build byproduct, never committed.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat: GitHub work continuity — UserPRCache, GitHubUserService, and Unfinished Tab integration (#141)
* feat: GitHub work continuity — UserPRCache, GitHubUserService, and Unfinished Tab integration
- github/user_pr_cache.go: COW atomic.Value + singleflight PR cache with session annotations
- github/client.go + http_client.go: GetCurrentUserLogin, rate-limit header helper
- proto/session/v1/github_user.proto: GitHubUserService RPC (ListUserPRs, WatchUserPRs, GetGitHubAuthState)
- proto/session/v1/types.proto: UnfinishedWorktree gets github_pr_number/url/state/priority fields
- server/services/github_user_service.go: ConnectRPC handler with streaming + +api: markers
- server/services/unfinished_work_service.go: enriches scanResultToProto with PR metadata
- server/services/search_service.go (BUG-024): replace sync.RWMutex with atomic.Value + singleflight
- server/dependencies.go: wires UserPRCache + GitHubUserService into runtime deps
- server/server.go: registers GitHubUserService handler and starts cache lifecycle
- session/pr_status_poller.go: use deadlock.RWMutex for lock-order tracking
- web-app: GitHubPRsSection + useGitHubPRs hook stream open PRs into Unfinished tab
- Makefile + docs/registry: add github_user.proto to backend scanner; 149 features registered
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: address code review findings - subscriber fan-out, ctx leak, auth caching, CSS tokens
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* test(vcs): fix TestDiffShortstat_MultiBlobWorktree same-size collision
TestDiffShortstat_MultiBlobWorktree added in main used 'modified' content
same byte count as 'original' (both 18 bytes). DiffShortstat uses
size-based unstaged-change detection, so same-size + fast-running test
(mtime equal within 1s) produced 0 changed files.
Fix: use 'a\nb\n' (4 bytes) as modified content so size always differs.
LCS diff: 2 new lines vs 3 old lines, no overlap → 2 ins + 3 del per file.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(scanner): add missing methodToID entries for CancelTriage, GetHookStatus, InstallHooks
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: remove duplicate GitHubUserService registration, fix registry prune for github_user proto
- server/server.go: remove second GitHubUserService handler registration (caused panic on startup)
- tools/scanner/prune-stale-backend.sh: add github_user to proto list so ListUserPRs/WatchUserPRs/GetGitHubAuthState files are not pruned as stale
- docs/registry: move GitHub user service features to github-user/ subdirectory
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Tyler Stapler <tystapler@gmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(demos): update E2E feature GIFs [skip ci]
* fix(web): resolve post-merge TypeScript and lint errors
- ApprovalAnalyticsPanel: add missing imports (useGenerateRule, SuggestionSource,
addRuleManualLink) and state (activeRowKey, generateLoading, isGenerating)
for the 'Suggest Rule' button in the programs coverage-gap table
- ApprovalRulesPanel: restore missing RuleFormState interface, emptyForm constant,
useEffect/useRef imports, and URL-param pre-fill state aliases that were
dropped during the merge resolution
- feature_flag_interceptor_test: fix nilnil lint violation by returning a
non-nil connect.Response instead of (nil, nil)
* fix(web): resolve all 102 pre-existing test failures (2811/2811 pass)
jest.setup.js: add global stubs for window.matchMedia, next/navigation,
@xterm/addon-serialize, useAvailablePrograms, and useSlashCommands so
jsdom-based tests don't fail at module load time.
Source fixes:
- ApprovalRulesPanel: replace inline form with dialog modal; add
add-rule-button testid, Escape handler, second useGenerateRule instance
for cmd-sample generation, URL-param prefill via RuleBuilderPrefill
- ApprovalAnalyticsPanel: add Suggest Rule buttons + inline suggestion cards
to the uncovered-tools table (data-testid: suggest-rule-tool-{toolName})
- RuleBuilderForm: add testids for all form fields, advanced-regex-separator,
generate-from-command-details, command-sample sections; add cmdSuggestions
and cmdClear props
- OmnibarCreationPanel: update hint to 'typed into the session terminal'
- XtermTerminal: optional-chain terminal.element, attachCustomKeyEventHandler,
onScroll, onWriteParsed, and Disposable.dispose() for mock environments
- SubStatusChip: guard switch on undefined/null subStatus
- NotificationContext/ThemeContext: return no-op fallback outside Provider
- useShells: guard createAuthInterceptor in test environments
- SessionActionsOverflow: call onClearConversationState directly (no dialog)
- OmnibarResultList/QuickOpenPalette: guard scrollIntoView calls
- useAvailablePrograms: guard fetch in jest.fn() environments
- SessionCard: fix truncateGoal max to produce correct char count
- ruleBuilderPrefill: add commandPattern, initialName, isAiGenerated fields
* chore: update feature registry after merge
make registry-generate removes stale get-program-analytics entry that
was superseded during the fork→upstream sync.
---------
Co-authored-by: Tyler Stapler <tystapler@gmail.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(session): bidirectional session history transfer between Claude and Antigravity (#130)
* chore: commit in-progress work from previous sessions
Includes executor fixes (WithProcessDir support, Linux setsid/Setpgid
EPERM fix), backlog triage harness test expansions, rate-limit
integration test, Makefile test-triage-real target, and planning
artifacts for backlog-triage-e2e-hardening and
put-backlog-behind-a-feature-flag-by-default.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(session): add session history transfer between Claude and Antigravity
* refactor(session): type-driven design for robust history transfer
- Introduce UnifiedTurn interface with UserMessage, AssistantMessage,
and SkippedTurn sum type — illegal states are unrepresentable
- Replace bufio.Scanner (64KB limit) with bufio.NewReader for
arbitrarily large JSONL lines
- Add UUID validation to prevent path traversal on conversation IDs
- Wrap SQLite INSERT OR REPLACE in transactions for atomicity
- Add tool_result block parsing so round-trips through Claude format
are lossless
- Update tests to cover tool_result turns and verify step counts;
live tests pass against real session logs (36 turns from current session)
* fix(session): complete SQLite schema + scanner bug + e2e fork tests
SQLite schema (history_transfer.go):
- Match real Antigravity DB exactly: 7 tables, not 2
- Add idx_steps_status and idx_steps_step_type indexes — without these
every USER_INPUT / PLANNER_RESPONSE query is a full table scan
- Add gen_metadata, executor_metadata, parent_references,
trajectory_metadata_blob, battle_mode_infos tables that Antigravity
expects to exist before opening the database
- Fix has_subtrajectory type: NUMERIC NOT NULL DEFAULT false (not INTEGER)
- Add NOT NULL constraints to match real schema
Scanner bug (instance_checkpoint.go):
- Replace bufio.Scanner (64 KB MaxScanTokenSize) with bufio.NewReader
ReadBytes for counting JSONL lines in CreateCheckpoint — Claude tool
results and image blocks can exceed 64 KB, causing ConvLineCount to
be wrong and forks to truncate at the wrong turn
New tests:
- TestPortClaudeToAgy_SchemaMatchesRealDB: queries sqlite_master and
asserts all 7 tables + 2 indexes are present
- TestForkFromCheckpoint_ForkedFileHasCorrectContent: opens the forked
JSONL file and verifies line count, valid JSON, ParseClaudeTurn compat
- TestForkFromCheckpoint_ConvLineCount_AccurateForLargeLines: regression
test for the scanner bug using a 128 KB line
* feat(credentials): pluggable credential source abstraction
Adds a CredentialSource interface and four concrete implementations:
EnvVarCredentialSource
Reads ANTHROPIC_API_KEY, GEMINI_API_KEY / GOOGLE_API_KEY, OPENAI_API_KEY.
Highest priority in the default chain — always wins when set.
ConfigFileCredentialSource
Reads the existing config.AnthropicAPIKey field from config.json.
ClaudeOAuthCredentialSource
Reads ~/.claude/.credentials.json (claudeAiOauth.accessToken).
Supports Claude Pro/Max subscription users who have no API key —
uses Authorization: Bearer instead of x-api-key.
AgyCredentialSource
Reads ~/.gemini/oauth_creds.json (written by 'agy auth login').
Falls back to ~/.config/gcloud/application_default_credentials.json
(gcloud ADC); sets Credential.IsADC=true so callers use the Google
SDK token exchange path instead of setting a header manually.
CredentialChain
Walks sources in priority order, returning the first valid credential.
NewDefaultChain() wires all four in the standard order.
NewChain() accepts explicit sources for tests and custom overrides.
AnthropicAIClient updated:
- Constructor now takes Credential instead of raw apiKey string.
- authHeaders() picks x-api-key vs Authorization: Bearer based on
which field is populated — transparent to callers.
- NewAnthropicAIClientFromKey() shim preserved for legacy callers.
- cli_ai_client.go updated to use the shim.
24 new/updated tests covering all sources, chain priority, header
selection, expired token handling, ADC fallback, and edge cases.
* feat: implement canonical session history adapters, capacity tracking, and TDD smart constructors
* feat(session): finish history transfer implementation and fix tests
* fix(tests): require.Eventually for goroutine sync, fix os.Unsetenv cleanup, fix instance fixture Path field
- Replace time.Sleep(100ms) with require.Eventually in TestCapacityMonitor_AutoTransition to eliminate flakiness under CI load
- Add LookupEnv-based cleanup for all four os.Unsetenv call sites in anthropic_client_test.go so env vars are restored after each test
- Add Path: workspace to Instance fixture in TestPortClaudeToAgy_SchemaMatchesRealDB so GetWorkingDirectory() returns the correct path
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(review): address code review MAJOR issues
M-2: Check f.Write errors in Export methods (claude_adapter.go, agy_adapter.go)
M-3: Check json.Marshal + f.Write errors in history_transfer.go history.jsonl writes
M-4: Add BlockKindImage case to Validate() in canonical.go and claude_adapter.go Export
M-5: Use uuid.New().String() instead of fmt.Sprintf for turnUUID in claude_adapter.go
M-6: Replace filepath.Walk with direct path computation in claude_adapter.go Import
M-7: Remove dead shim types (UnifiedTurn, SkippedTurn, shimUserMessage, shimAssistantMessage,
ParseClaudeTurn) from history_transfer.go; update instance_fork_test.go to use
rawClaudeTurn directly
M-8: Move resp.Body read before lock in gemini_limits_client.go QueryLimits
M-9: Extract parseIntHeader/parseTimeHeader to package-level functions in provider_limits.go;
remove local closure versions from anthropic_limits_client.go and gemini_limits_client.go
Also fix TestPortSessionHistory_LiveClaude to copy live log to ClaudeProjectDirName(inst.Path)
path (consequence of M-6 direct path computation).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(lint): resolve pre-existing golangci-lint issues
- Delete unused portAgyToClaude shim from session/history_transfer.go
- Convert if/else chain on provider to tagged switch in capacity_monitor.go (QF1003)
- Replace strings.ToLower comparison with strings.EqualFold in capacity_monitor.go (SA6005)
- Convert if/else chain on block.Kind to tagged switch in agy_adapter.go (QF1003)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(interceptors): add feature flag interceptor and fix nilnil lint error
alwaysNext in the test helper returned nil, nil which triggers the
golangci-lint nilnil rule. Return a valid non-nil response instead.
Also bring the implementation file into the branch so CI lint pass
on the merged result sees a consistent package.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore: trigger CI for nilnil fix
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(interceptors): add package doc comment
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(analytics): add missing CSS imports for rowActions, suggestRuleButton, rowGeneratingText
These symbols were exported from ApprovalAnalyticsPanel.css.ts but not
imported in the TSX file, causing a TypeScript build error.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(web): resolve TypeScript build errors from main branch merge
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(ci): fix recursive mutex deadlock, aria-selected WCAG violation, registry divergence
- session/instance_checkpoint.go: move adapter.Import() call before
stateMutex.Lock() — Import calls GetClaudeConversationUUID which does
stateMutex.RLock(), causing a recursive non-reentrant lock acquisition
and a deadlock detected by linkdata/deadlock in CI
- web-app/src/components/sessions/SessionRow.tsx: remove aria-selected
from bare div element (no role that supports it); aria-checked on the
child checkbox button already conveys selection state correctly
- docs/registry/features/backend: sync per-feature files — add
GetProviderLimits.json (new RPC), remove 3 stale entries that the
scanner no longer generates (reduces divergence from 2.03% to 0%)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(registry): remove 3 stale per-feature entries not generated by scanner
backlog:spawn-session-autonomous, program:analytics, and upload:image
were manually-added entries that the scanner no longer generates from
proto files (reducing divergence from 2.03% to 0%).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore: add CI status helper script
* fix(scanner): add GetProviderLimits to methodToID map, fix registry file
The scanner test TestScanProto_NoUnmappedMethods requires every proto RPC
to have a methodToID entry. GetProviderLimits was added to the proto but
not to the map, causing the Build CI job to fail.
Also renames the per-feature registry file from the raw method name to
the canonical kebab-case ID (session:get-provider-limits).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* chore(demos): update E2E feature GIFs [skip ci]
* feat(analytics): bulk rule creation + page density improvements
- Add checkboxes + inline review panel to CommandDistributionTable,
UncoveredToolsTable, UncoveredProgramsTable for bulk rule creation
via BulkUpsertRules RPC
- Add bulkUpsertRules to useApprovalRules hook
- Remove redundant "Top Bash Programs" section (covered by Command Distribution)
- Move window selector inline with header row; save avg/day in Total card
- Inline manual outcome % into Manual review card; remove 5th jank card
- Put Top Tools + Top Triggered Rules in 2-col side-by-side grid
- Replace plain volume bar with stacked allow/deny/manual composition bar
- Replace large Coverage Gaps banner with compact inline badge
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(session): program switching now saves correctly for all cases
- Remove erroneous `&& *req.Msg.Program != ""` guard that silently dropped
"System default" (empty string) saves in session_service.go
- Resolve empty program to cfg.DefaultProgram before persisting to satisfy
the ent NotEmpty constraint
- Pre-save instance before Restart() so program change is durable even if
the restart fails (fixes RC4 ordering race)
- Add useEffect in SessionDetailView to re-sync programValue from
session.program when WatchSessions pushes an update (fixes stale state)
- Add "Change Program" entry to SessionActionsOverflow with inline program
picker dialog; wired in SessionCard and SessionRow via useSessionActions
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(ux): address 8 UX review findings from 2026-06-30
Critical accessibility + mobile fixes:
- primaryActionWrapper: (hover: none) override so pause/resume is visible
on touch devices where CSS :hover never fires
- inlineActionButton: (pointer: coarse) override raises touch target to
44px minimum (WCAG 2.5.5)
- Window selector buttons: aria-pressed + role="group" aria-label
- Bar/StackedBar components: aria-hidden="true" (data in adjacent cells)
- Error banner in analytics: role="alert" for screen reader announcement
High priority:
- RuleBuilderForm: replace window.confirm() with inline pendingMode state
+ "Confirm / Keep" banner (no native dialog)
- OmnibarCreationPanel: collapse 6 session types to 3 primary + "More"
expand (auto-expands when an advanced type is already selected)
Medium:
- BulkReviewPanel: remove setTimeout auto-dismiss; show explicit "Done"
button so users control when the confirmation clears
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* feat(analytics): unify activity tables into single filterable view
Replaces three separate tables (CommandDistributionTable, UncoveredToolsTable,
UncoveredProgramsTable) with one UnifiedActivityTable that has filter chips:
All | Needs rule | Has manual. Also wires in the pre-existing Suggest Rule /
SuggestedRuleCard integration that was tested but never connected.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* chore(demos): update E2E feature GIFs [skip ci]
* docs(rules): audit and fix .claude/rules — bugs, missing rules, stale examples (#131)
* docs(rules): audit and fix .claude/rules — bugs, missing rules, stale examples
- feature-registry.md: rewrite to describe per-feature files in
docs/registry/features/{backend,frontend}/ (the three monolithic JSONs
are generated artifacts, not editable files)
- feature-testing-registry.md: update OmnibarAction union to all 11 types;
add CommandDetector(5), WorkflowDetector(25), AliasDetector(36) to
detector priority table; document dynamic vs static registration
- session-creation-registry.md: fix one_off→SessionType.ONE_OFF (was
DIRECTORY); add new_project and autonomous modes; update SESSION_TYPES
example; fix generate-proto→proto-gen (wrong make target)
- CLAUDE.md: fix generate-proto→proto-gen (2 occurrences)
- new: ent-schema-generation.md — always pass --feature sql/upsert
- new: go-double-checked-locking.md — return locally-computed value
- new: e2e-test-conventions.md — 4 CI-enforced Playwright conventions
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(rules): add seed rules for bazel/firebase/pulumi/proextract and sentinel tests
- 8 new AutoAllow rules: zcat/gzcat, journalctl, golangci-lint, bazel
build ops, firebase (programs-only, colon-subcommands bypass), pulumi
read ops, proextract, sshpass
- 3 new Escalate-500 rules: bazel run/shutdown, firebase deploy/serve/init
(regex, since isSubcommandLike rejects colons), pulumi up/destroy/cancel
- 11 sentinel tests covering: python heredoc, cat|python stdlib (known
limitation doc), bazel+grep compounds, firebase read vs deploy split,
pulumi preview vs up split, journalctl/zcat pipelines
- Fix TestClassify_ShellExpansion_PathStripped: golangci-lint now has a
seed rule, changed test case to unknown-custom-linter
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(rules): externalize user-specific rules to ~/.config/ssq-hooks/user-rules.yaml
Removes proextract and sshpass from SeedRules() — they're personal tools
not generally applicable to all users. Adds a YAML config loader:
- loadUserRulesFile() reads ~/.config/ssq-hooks/user-rules.yaml on startup
- Supports the same fields as DB rules: programs, subcommands, flags,
command_pattern, decision (allow/escalate/deny), risk_level, priority
- Silently skips if the file doesn't exist; warns on parse errors
- Source field set to "user" for analytics distinction from "seed"/"db"
The file is loaded before DB rules in loadClassifier() so DB rules
(edited via UI) can still override user-file rules if desired.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: resolve TS errors in ApprovalRulesPanel/AnalyticsPanel + code review findings
ApprovalRulesPanel.tsx:
- Add missing useRef/useEffect imports (TS2304)
- Rewrite URL-param pre-fill useEffect to use RuleBuilderPrefill instead of
the deleted inline form state (setShowForm/setForm/emptyForm/etc. no longer
exist since form was extracted to RuleBuilderForm in a prior refactor)
- Add urlPrefill state + effectivePrefill computed value; attach formSectionRef
to the form section div for scroll-into-view behavior
- Remove unused escapeRegex helper (programs/subcommands passed as arrays now)
ApprovalAnalyticsPanel.tsx:
- Add missing CSS imports: rowActions, rowGeneratingText, suggestRuleButton,
addRuleManualLink (TS2304)
- Import useGenerateRule hook + SuggestionSource proto enum
- Wire activeRowKey state, generateLoading, isGenerating for the per-row
"Suggest Rule" button
cmd/ssq-hooks/main.go (code review findings):
- Enabled field: use *bool so nil defaults to enabled=true; omitting
enabled: in YAML no longer silently disables the rule
- os.IsNotExist → errors.Is(err, os.ErrNotExist) (deprecated since Go 1.13)
- Add errors import
pkg/classifier/classifier.go:
- Fix seed-escalate-bazel-run reason: mention bazel shutdown kills the
build daemon (not "executes a binary"), per code review finding
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(test): use create(SessionArtifactsSchema) in ArtifactsTab tests
Plain object literals don't satisfy the protobuf MessageShape type
(missing $typeName). Use @bufbuild/protobuf create() with a helper
type alias for the init parameter to keep tests concise.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(merge): restore ApprovalRulesPanel.tsx dropped during merge conflict resolution
The file was resolved during git merge origin/main but wasn't included in the
merge commit. CI was failing with "Module not found" because the file only
existed on disk, not in the git tree.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(review): address copilot review comments — type safety, error handling, test assertions
- ArtifactsTab.test.tsx: replace Parameters<typeof create<...>> with MessageInitShape
- main.go loadClassifier: guard os.UserHomeDir() error, skip user rules if home unavailable
- main.go toClassifierRule: validate risk_level — default RiskLow when empty, error on unknown
- classifier.go: fix inline comments claiming priority 60 for bazel run / pulumi up (actual: 500)
- classifier_test.go: strengthen 5 sentinel tests from != AutoAllow to != Escalate
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(e2e): increase axe timeout + wait for networkidle to prevent browser-crash flakes
Axe scans are CPU-heavy under SwiftShader (CI headless). Two root causes:
1. 30s global timeout was too short — axe scan on a full React app can take 60-90s
2. Using domcontentloaded meant axe fired while async data was still loading,
overwhelming the browser context mid-scan
Fix: per-describe test.setTimeout(120_000) and waitForLoadState('networkidle')
before scanning so the browser is idle when axe starts.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(bench): update go tier1 baseline [skip ci]
* chore(bench): update e2e latency baseline [skip ci]
* chore(bench): update frontend throughput baseline [skip ci]
* chore(demos): update E2E feature GIFs [skip ci]
* chore(sdd): backlog cross-platform audit + agent protocol research (#133)
* fix(session): release stateMutex before calling Start() in SwitchWorkspace
Start() acquires stateMutex itself (instance.go ~900). SwitchWorkspace was
holding the lock across its entire body, causing a reentrant deadlock on
all three call sites that invoke Start(). Introduces an idempotent unlock()
helper so the lock is released early at each Start() call site and deferred
for all other return paths.
Adds a regression test that runs SwitchWorkspace in a goroutine and asserts
it returns within 10s; pre-fix this test hangs forever (not detectable by
-race since it's a deadlock, not a data race).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(approval): inject PermissionRequest hook on CreateSession and RestartSession
The hook was only injected via the MCP/headless code path (tools_lifecycle.go),
so sessions created through the normal web UI never got the PermissionRequest
hook wired into .claude/settings.local.json. This caused Claude Code to fall
through to its native terminal approval dialog instead of routing through the
stapler-squad rule engine.
Now InjectHooksConfig is also called after a successful Start() in CreateSession
and after Restart() in RestartSession. The call is best-effort (warn on failure,
don't fail the session).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* revert: remove incorrect per-session hook injection in session_service
The global ssq-hooks PreToolUse hook already handles approval routing.
When no rule matches a command, it correctly escalates to Claude Code's
native dialog — that's the expected behavior, not a missing hook.
The dialog for ./gradlew appears because there's no matching rule,
not because the hook isn't wired. Fix: add a rule for gradlew.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore(sdd): backlog cross-platform audit + agent protocol research
Documents the "why doesn't backlog work reliably" investigation: user journey,
implementation inventory, cross-platform risk analysis, test co…
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
BacklogService, and implementsTriggerSync/GetSyncHistoryfor real (previously stubs).SyncLoop.SyncByIDfor on-demand sync of a single source regardless of its enabled flag, plusListSourceSyncEventson the ent repo/storage layer.SyncOnemerge/local-wins logic, encrypted-token decryption path, and the GitHub Issues/PRs plugins (viahttptest)./settings/backlog-sourcessettings page: add a GitHub source (issues or PRs), enable/disable, delete, trigger a manual sync, and view sync history — linked from the main Settings page.This closes out item #3 ("GitHub sync: finish vs. cut") from the backlog cross-platform audit's ranked gap list — full finish per prior discussion.
Test plan
go build ./...go test ./session/... ./server/services/...(new + existing tests green)cd web-app && npx tsc --noEmitcd web-app && npx jest --no-coverage --testPathPatterns="BacklogSourcesSettings"make registry-generaterun, no diff to committed aggregate since it's gitignored)/settings/featuresand/settings/unfinishedsibling pages which also lack e2e coverage)🤖 Generated with Claude Code