chore: remove CLA and rename Claude Squad to Stapler Squad by tstapler · Pull Request #2 · tstapler/stapler-squad

tstapler · 2026-03-29T05:17:02Z

What?

Removes the CLA (Contributor License Agreement) — CLA.md and the CLA assistant GitHub Actions workflow
Renames remaining Claude Squad strings to Stapler Squad in source code

Changes

Deleted:

CLA.md — CLA document with old maintainer contacts
.github/workflows/cla.yml — CLA assistant bot automation

Renamed Claude Squad → Stapler Squad:

server/tls.go — TLS certificate Organization and CommonName fields
session/git/util.go — git commit Author name for worktree initial commits
server/auth/user.go — WebAuthn display name

Not changed:

docs/upstream/ — historical references to the original upstream claude-squad project (accurate as-is)
tuitest/integration/claude_squad/ — test package path (separate refactor if desired)

🤖 Generated with Claude Code

- Delete CLA.md and the CLA assistant GitHub Actions workflow - Rename "Claude Squad" to "Stapler Squad" in TLS cert fields, git commit author name, and WebAuthn display name Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Copilot

Pull request overview

Removes the project CLA gate (document + CLA Assistant workflow) and continues the rebrand by renaming a few remaining Claude Squad strings to Stapler Squad in runtime-generated artifacts (TLS cert subject), git metadata, and WebAuthn display name.

Changes:

Deleted CLA.md and the .github/workflows/cla.yml CLA Assistant workflow.
Updated TLS certificate subject fields to Stapler Squad.
Updated initial git commit author and WebAuthn display name strings to Stapler Squad.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
`session/git/util.go`	Renames initial commit author name to `Stapler Squad`.
`server/tls.go`	Updates generated CA/server certificate subject organization/common name strings.
`server/auth/user.go`	Updates WebAuthn display name string.
`CLA.md`	Deletes CLA document.
`.github/workflows/cla.yml`	Deletes CLA Assistant GitHub Actions workflow.

Comments suppressed due to low confidence (2)

CLA.md:1

After removing CLA.md, there are still internal docs referencing it (e.g., docs/tasks/stapler-squad-rebrand.md mentions CLA.md). Consider updating/removing those references to avoid stale/broken documentation pointers.
.github/workflows/cla.yml:1
With the CLA Assistant workflow removed, the repo likely no longer needs the CLA_REPO_SECRET secret or any branch protection requirement tied to the CLA status check. Consider cleaning those up in GitHub settings to avoid retaining unused credentials/required checks.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-29T05:19:52Z

 func (u *localUser) WebAuthnDisplayName() string {
-	return "Claude Squad Owner"
+	return "Stapler Squad Owner"
 }


The PR description says the remaining Claude Squad strings were renamed, but scripts/nil_safety_check.sh still contains Claude Squad (header + output). Either update that script too or clarify in the description/scope exceptions list.

@copilot apply changes based on this feedback

Updated scripts/nil_safety_check.sh to rename both "Claude Squad" references to "Stapler Squad" (header comment and echo output) in f240162.

tstapler · 2026-04-06T18:39:54Z

@claude can you please address the comments?

Agent-Logs-Url: https://github.com/tstapler/stapler-squad/sessions/233ef675-a8ac-4957-a2df-86b348c680cd Co-authored-by: tstapler <3860386+tstapler@users.noreply.github.com>

Copilot · 2026-04-11T22:35:51Z

@claude can you please address the comments?

Addressed the review feedback — renamed "Claude Squad" → "Stapler Squad" in scripts/nil_safety_check.sh in f240162.

…nd/CommitMessages, pool blob buffer (#130) * feat(session): add StatusRestoring transient status and proto wire - Add Restoring Status = 5 to session/instance.go (in-memory only, never persisted) - Add SESSION_STATUS_RESTORING = 9 to proto/session/v1/types.proto - Update StatusToProto and StatusStringToProto in instance_adapter.go - Also fix pre-existing gap: add Hibernated case to StatusStringToProto - Regenerate Go and TypeScript proto bindings * feat(session): make ExternalDiscovery scan async and fix approval wiring order - Wrap ScanFromUserOptions() in a goroutine so Start() returns immediately (~2s saved) - Move IntegrateWithDiscoveryTmux before ExternalDiscovery.Start() to close Race 2b (approval monitor now wired before scan goroutine can fire session callbacks) * feat(ui): add Restoring session state to SessionCard and SessionDetailView - Add isRestoring flag, getStatusColor/getStatusText cases for RESTORING status - Dim card opacity (cardPaused) and show "Restoring…" label for restoring sessions - Add data-restoring attribute for CSS targeting - Add Restoring overlay in SessionDetailView (parallel to Paused overlay) - Add getStatusLabel case for Restoring * feat(server): make analytics DB open async via atomic.Pointer late-bind - Delete synchronous OpenAnalyticsDB (~11s blocker from HTTP bind path) - Add AnalyticsClientPtr atomic.Pointer[ent.Client] to RuntimeDeps and ServerDependencies, propagated via ToServerDeps() as pointer-to-atomic - Launch dedicated analytics goroutine concurrent with session restore loop - Add late-bind goroutine in wireDepsIntoServer: polls atomic pointer, upgrades to SQLite provider, starts RetentionEnforcer + EscapeWriter, calls SetAnalyticsClient/SetAnalyticsProvider on SessionService - Add AnalyticsHandler.SetClient() and SessionService.SetAnalyticsProvider() setters to support the late upgrade from log-only to SQLite fallback * feat(server): Epic 4 — startup restore loop with Restoring state + build fixes - Add startup safety guard that resets any persisted Restoring → Creating - Mark non-Stopped sessions as Restoring before inst.Start(); revert to Creating on failure so WatchSessions clients see the transient state - Remove 200 ms per-session stagger (hot-attach forks no new processes) - Move analytics goroutine launch after rt := &RuntimeDeps{...} so the closure captures a valid pointer (fixes "undefined: deps" compile error) - Fix S1021: merge analyticsHandler var decl + assignment in server.go - Add .claude path exclusion to golangci.yml to stop lint scanning agent worktrees under .claude/worktrees/ (was producing 61 spurious issues) - Move pnpm onlyBuiltDependencies from package.json to pnpm-workspace.yaml (pnpm v10+ no longer reads the "pnpm" field in package.json) * fix(terminal): use prependScrollbackBatch for initial scrollback to preserve snapshot Initial scrollback load was calling writeInitialContent() which clears the terminal before writing. The server already sends a clean snapshot via the TerminalOutput message, so clearing it produced stacked status bars — TUI cursor-up sequences replayed against position 0 instead of the expected cursor position from the live render. Switch initial scrollback path to prependScrollbackBatch(), which serialises the existing snapshot and re-writes history+snapshot so the viewport is preserved. Also reset isInitialScrollbackDoneRef on session switch so the next connection's first ScrollbackResponse is treated as an initial load. On the server side, extract formatSnapshotForClient() to centralise cursor-sync and line-ending normalisation across control-mode and capture-pane streaming paths. Fix the early quiescence subscription in streamViaControlMode so waitForQuiescence receives signals during the resize nudge (without it the 500 ms timeout always burned fully). * chore: ignore _CodeSignature/ (macOS codesign artifact, 260 MB binary) * test: add quiescence unit test, live playwright config, triage pipeline e2e spec * chore(sdd): add triage-validation task artifacts and rules-management plan * fix(server): eliminate data races in startup restore loop and analytics handler Replace bare inst.Status assignments in the startup restore goroutine with inst.ForceStatus() calls so all writes go through stateMutex, preventing the data race against concurrent readers in request handlers. Switch AnalyticsHandler.client from a plain *ent.Client pointer to an atomic.Pointer[ent.Client] so the late-bind goroutine in server.go can call SetClient() concurrently with HandleSummary without a data race. Add a clarifying comment to the early quiescence goroutine in connectrpc_websocket.go confirming that UnsubscribeControlModeUpdates closes the channel, causing the goroutine to exit cleanly via range. * fix(a11y): resolve aria-required-parent violation on session group headers Remove role="listitem" from virtualized row-mode group header elements. Group headers are headings, not list items — the role caused an axe aria-required-parent critical violation (WCAG 2.1 AA) because there was no ancestor with role="list". Dropping the wrapper div fixes the violation without changing visual output. * perf: batch HistoryLinker PIDs, guard hot debug logs, pool blob buf, cache AheadBehind/CommitMessages - HistoryLinker: call batchPTYInfo("") once per scan pass instead of N GetPanePID() subprocess calls (one per unlinked session). Passes the resulting map[string]paneEntry into correlateSession so each session does an O(1) map lookup. Reduces N subprocesses to 1 per 5s poll tick. - backlog_lifecycle: guard two unguarded log.DebugLog.Printf calls with if log.IsDebugEnabled(). In production with debug disabled the stdlib log mutex is no longer acquired at those call sites. - gogit_vcs_reader (blob buf): replace io.ReadAll(r) inside readBlobUnderLock with a single bytes.Buffer declared in the enclosing scope, reused via Reset+ReadFrom. Eliminates one heap allocation per changed file during diff computation. - gogit_vcs_reader (AheadBehind cache): add aheadBehindCache (same sync.Map pattern as diffStatCache) with 30s TTL. Eliminates all packfile-reader lock contention on repeated calls within the TTL — was #1 mutex hotspot at 8.8T cycles / 19740 events. - gogit_vcs_reader (CommitMessages cache): add commitMessagesCache with 30s TTL. Same pattern. Eliminates lock hold during full commit log iteration — was #2 at 3.4T cycles / 16936 events. * fix: correct blobBuf aliasing and CommitMessages cache key --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com>

* chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * refactor(session): apply type-driven design to buildLaunchCommand Replace the 8x isClaudeProgram bool check with a sealed programKind sum type (claudeProgram / plainProgram). classifyProgram() parses once at the boundary; holding claudeProgram is proof the program invokes claude, so buildClaudeCommand needs zero isClaude guards — they are enforced by the type system, not by runtime checks. - Add programKind interface with claudeProgram / plainProgram variants - Add classifyProgram() smart constructor (parses once; trust downstream) - buildLaunchCommand: switches on type, delegates to buildClaudeCommand or returns plain cmd unchanged - buildClaudeCommand: no guards — the type makes invalid states unrepresentable (a plainProgram can never reach this function) - Extract claudeMCPConfigFlag() helper for the MCP config flag string - TestClassifyProgram: table test for the sum type classification - TestBuildLaunchCommand_PlainProgramIgnoresClaudeFlags: proves that a non-claude program with all claude-related Instance fields set still returns the bare program, enforced by the type routing * feat(backlog): implement CancelTriage RPC and session delete button Adds CancelTriage endpoint that stops any active triage sessions for a backlog item. Wires up the previously-TODO cancel button in BacklogItemDetail and adds a per-session delete button in the session list. * fix(install): skip FDA prompt for non-admin users with cert-signed binary Non-admin users cannot read either TCC database (authorization denied), causing fda_is_granted() to always return false and show the 15s prompt on every reinstall even when FDA is already granted. When all TCC databases exist but are unreadable, fall back to a heuristic: if the installed binary is cert-signed (designated requirement includes "certificate root"), assume FDA was previously granted. The TCC grant is tied to the signing identity (com.stapler-squad + cert), which is stable across rebuilds, so no new grant is needed on reinstall. * perf(tmux): add semaphore to cap concurrent capture-pane subprocesses capturePaneSem (size 8) limits concurrent CapturePaneContent calls to avoid circuit-breaker lock contention and OS process table pressure. Control-mode fast path bypasses the semaphore entirely. * perf(vcs): cache reachableSet results and batch-read blobs under single lock - reachableSetCache (sync.Map, 30s TTL) eliminates O(N) commit walk on repeated calls — was the #1 pprof hotspot (47.4B cycles, 38 events) - diffShortstatUnderLock batch-reads all needed blobs in one lock hold, replacing N lock-acquire/release cycles — was the #2 hotspot (9.87B cycles, 1641 events) * chore(proto): regenerate types bindings after rebase Types were out of sync (DetectedStatus missing from Go/TS bindings) after the CancelTriage commit was rebased onto upstream. * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * fix(terminal): repair escape code pipeline for new Claude Code renderer (#139) * feat(onboarding): offer to install Claude Code hooks during onboarding Adds a final onboarding step that asks whether to install the global Claude Code hooks, with two independent toggles: - Rule enforcement (PreToolUse -> `ssq-hooks check`) - Notifications (Notification/Stop -> `ssq-hook-handler`) Previously these hooks were discoverable only via docs / a manual `ssq-hooks install` invocation; nothing prompted the user. Backend: - New internal/claudehooks package: idempotent, atomic install + detection of the two global hooks in ~/.claude/settings.json. cmd/ssq-hooks now reuses it (InstallRules) instead of its private patchClaudeSettings. - New SessionService RPCs GetHookStatus and InstallHooks. InstallHooks resolves the ssq-hooks binary and ssq-hook-handler from ~/.local/bin (then $PATH / exe-relative scripts); when a binary is unavailable it returns a manual-fallback message rather than failing. - `make install` now also copies ssq-hook-handler to ~/.local/bin so the server can register a stable path. Frontend: - OnboardingModal gains step 5: prefilled from GetHookStatus (a toggle is pre-checked only when its hook is available and not already installed), installs via InstallHooks, and disables toggles whose binary is missing. Tests: unit tests for the package and the two handlers; Jest tests for the onboarding step. Feature registry updated (GetHookStatus, InstallHooks, onboarding-hook-install). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(onboarding): address review — concurrency, async guards, e2e - claudehooks.mutate: serialize read-modify-write with a package mutex and write via a unique temp file (os.CreateTemp) so two concurrent installs (double-click) can't corrupt or clobber settings.json. Add a -race test. - OnboardingModal: guard async setState with a mounted ref (removes the after-unmount update / act warning) and seed the toggle defaults only once so navigating Back→forward no longer discards the user's toggle edits; reset the seed guard on a fresh open. - Jest: await the status fetch in gotoHooksStep to remove flakiness. - Add Playwright e2e (tests/e2e/onboarding-hook-install.spec.ts) covering the hooks step render + finish-without-install (does not mutate global settings). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(sdd): planning artifacts for new-renderer terminal fix Research, implementation plan, adversarial/architecture reviews, validation plan, and architecture-performance deep-dive for fixing escape code stripping caused by the new Claude Code renderer. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(terminal): repair escape code pipeline for new Claude Code renderer The new Ink-based renderer emits escape sequences that exposed four latent bugs in the terminal streaming pipeline, causing garbled output in xterm.js: 1. TextDecoder reuse without {stream:true}: multi-byte UTF-8 characters (é, €, CJK, emoji) split across consecutive proto frames emitted U+FFFD. Fix: StateApplicator and useTerminalStream now pass {stream:true} on all streaming decode calls; separate lineDecoder for complete line content. 2. EscapeSequenceParser lookback too short (20→256): OSC window titles and DCS payloads from the new renderer exceed 20 bytes, causing incomplete sequences to be flushed as garbage. 3. ED2+ED3 stripping: parser stripped \x1b[3J when paired with \x1b[2J, bleed-through of previous session history. xterm.js v6 handles this correctly without intervention. 4. RedrawThrottler over-classification: any \x1b[\d+A was treated as a full-screen redraw; Ink emits cursor-up on every incremental line update, causing most progress/spinner frames to be dropped. Fix: only classify cursor-up + erase-screen as a genuine redraw. Also: 100→33ms cap (30fps) to match Ink render cadence. Adds 84 tests including a combined pipeline integration suite covering the full TerminalDiff→StateApplicator→EscapeSequenceParser→TerminalStreamManager chain. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(terminal): address code review - decoder isolation, test ESC prefix, timer cleanup Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(registry): regenerate after merge with main * fix(a11y): remove aria-selected from listitem div; aria-checked on checkbox is correct * chore(registry): remove stale entries for RPCs removed from main --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * feat(rules): auto-suggest rule name from criteria inputs (#140) * feat(rules): auto-suggest rule name from criteria inputs Generates a "Allow/Block/Escalate {target}" name as the user fills in tool target, category, pattern, or programs. The suggestion only applies when the name field is empty or still matches the previous auto-suggestion, so manual edits are never overwritten. Also scopes golangci-lint to the current module root to avoid scanning files in external workspace paths (../../../../../WorkProjects). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(tests): resolve TypeScript errors in ArtifactsTab tests and tighten RuleBuilderForm auto-suggest - Add makeArtifacts() cast helper in ArtifactsTab.test.tsx to satisfy protobuf Message<> type requirements without importing the full runtime - Fix computeSuggestedName category branch: check cat existence, not cat?.value (avoids truthiness trap on empty-string values) - Move nameRef sync to useLayoutEffect to avoid render-phase ref mutation in React concurrent mode Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: resolve CI failures in multiblobworktree test and accessibility violation - vcsreader_test.go: fix TestDiffShortstat_MultiBlobWorktree by using a modified content string with different byte length (4 bytes vs 18 bytes original). The dirty-check in diffShortstatUncached uses size+mtime; when both sides had the same 18-byte content the file was not detected as changed. - SessionRow.tsx: remove aria-selected from the session row div, which has role="listitem" — ARIA spec disallows aria-selected on that role. Selection state is already communicated by the inner checkbox button's aria-checked. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: add CancelTriage to scanner methodToID map TestMethodToIDCompleteness enforces that every RPC method in proto files has a matching entry. CancelTriage (backlog.proto) was missing. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: add GetHookStatus and InstallHooks to scanner methodToID map Merge from main brought new hooks RPCs into session.proto. TestMethodToIDCompleteness requires every proto RPC to be mapped. Feature IDs match the +api: markers in the proto file. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * feat(onboarding): offer to install Claude Code hooks during onboarding (#138) * feat(onboarding): offer to install Claude Code hooks during onboarding Adds a final onboarding step that asks whether to install the global Claude Code hooks, with two independent toggles: - Rule enforcement (PreToolUse -> `ssq-hooks check`) - Notifications (Notification/Stop -> `ssq-hook-handler`) Previously these hooks were discoverable only via docs / a manual `ssq-hooks install` invocation; nothing prompted the user. Backend: - New internal/claudehooks package: idempotent, atomic install + detection of the two global hooks in ~/.claude/settings.json. cmd/ssq-hooks now reuses it (InstallRules) instead of its private patchClaudeSettings. - New SessionService RPCs GetHookStatus and InstallHooks. InstallHooks resolves the ssq-hooks binary and ssq-hook-handler from ~/.local/bin (then $PATH / exe-relative scripts); when a binary is unavailable it returns a manual-fallback message rather than failing. - `make install` now also copies ssq-hook-handler to ~/.local/bin so the server can register a stable path. Frontend: - OnboardingModal gains step 5: prefilled from GetHookStatus (a toggle is pre-checked only when its hook is available and not already installed), installs via InstallHooks, and disables toggles whose binary is missing. Tests: unit tests for the package and the two handlers; Jest tests for the onboarding step. Feature registry updated (GetHookStatus, InstallHooks, onboarding-hook-install). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(onboarding): address review — concurrency, async guards, e2e - claudehooks.mutate: serialize read-modify-write with a package mutex and write via a unique temp file (os.CreateTemp) so two concurrent installs (double-click) can't corrupt or clobber settings.json. Add a -race test. - OnboardingModal: guard async setState with a mounted ref (removes the after-unmount update / act warning) and seed the toggle defaults only once so navigating Back→forward no longer discards the user's toggle edits; reset the seed guard on a fresh open. - Jest: await the status fetch in gotoHooksStep to remove flakiness. - Add Playwright e2e (tests/e2e/onboarding-hook-install.spec.ts) covering the hooks step render + finish-without-install (does not mutate global settings). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(sdd): add planning artifacts for github-work-continuity Supersedes docs/tasks/github-pr-status.md (planning complete, absorbed into this unified plan). Adds requirements, research (4 domains), plan, adversarial review, and validation for the GitHub Work Continuity feature. ADRs 020-022 record key decisions: GraphQL for user PR list, enrichment at service layer not scanner, WorktreePRPoller extends PRStatusPoller. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: Epic 1+2 GitHub work continuity — bug fixes + WorktreePRPoller Epic 1 — Pre-flight bug fixes: - BUG-021: CheckGHAuth() → direct GET /user (no subprocess, no forkExec) - BUG-022: ETagCache sync.Map replaces RWMutex+map (lock-free reads) - BUG-023: PRStatusPoller auth state → atomic.Value (pollerAuthResult) - Story 1.3: checkRateLimitHeaders() monitors X-RateLimit-Remaining, Retry-After, and X-GitHub-Sso on every GitHub API response - ADR-020 updated: direct HTTP API, no gh subprocess Epic 2 — WorktreePRPoller (session/worktree_pr_poller.go): - Polls GitHub PR data for worktrees that have no active session - sync.Map for cache (lock-free reads); atomic.Value for auth + callback - WorktreeSource interface breaks import cycle via scannerSource adapter - GetOwnerRepoFromRemote() added to github/client.go - Wired into server: started after UnfinishedWork scanner Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: Epic 3 Story 3.1 — UserPRCache with direct GraphQL API Add github/user_pr_cache.go: lock-free background cache of all open PRs authored by the authenticated GitHub user. - Uses POST /graphql (newGHPostRequest) directly — no gh subprocess - atomic.Value COW snapshot for lock-free reads - singleflight.Group coalesces concurrent manual Refresh() calls - GetCurrentUserLogin added to github/client.go via GET /user - loginState also cached with atomic.Value + singleflight - checkRateLimitHeaders called on every response - Wired into ServerDependencies / RuntimeDeps; Start(ctx) called in server.go Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: Epic 3 Story 3.2 — Annotate UserPR with session IDs and worktree paths - Add PRAnnotationSession / PRAnnotationWorktree value types to github pkg (avoids import cycle: github is imported by session, not vice-versa) - Add UserPRCache.Annotate() — COW: load snapshot → copy+annotate → store matching by owner+branch, O(n + m) via map lookups - Add PRStatusPoller.GetInstances() — defensive copy under RLock - Wire annotateUserPRCache() helper in server/dependencies.go: called in UserPRCache.SetOnUpdated callback, reads sessions from PRStatusPoller and worktrees from unfinished.Scanner Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: Epic 3 Story 3.3 — UserPR proto + GitHubUserService proto + generated bindings Add proto/session/v1/github_user.proto: - GitHubUserService with ListUserPRs, WatchUserPRs, GetGitHubAuthState RPCs - GitHubAuthState, ListUserPRs*, WatchUserPRs*, GetGitHubAuthState* messages Add UserPR message to types.proto (fields 1-17: owner, repo, number, title, html_url, state, head_ref, base_ref, is_draft, check_conclusion, approved_count, changes_req_count, updated_at, closed_at, merged_at, session_ids, local_worktree_path) Regenerate Go + TypeScript bindings via make proto-gen. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: Epic 3 Story 3.4 — GitHubUserService ConnectRPC handler Implement server/services/github_user_service.go: - ListUserPRs: returns cached open PRs + GitHubAuthState - WatchUserPRs: sends initial snapshot then streams on each UserPRCache refresh (buffered channel of size 4; callback set atomically via SetOnUpdated) - GetGitHubAuthState: calls GetCurrentUserLogin directly, degrades gracefully - userPRToProto: converts github.UserPR → sessionv1.UserPR with timestamp handling Wire into server/dependencies.go and registered in server/server.go at /api/session.v1.GitHubUserService/. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(registry): prune stale RPC files in generation; reconcile after merge Backend registry generation was additive — it wrote/updated per-feature files but never deleted ones whose RPC was removed or renamed in the proto. That left 5 orphaned files after the upstream merge (ArchiveWorkflowSessions, DeleteWorkflowFailedSessions, GetDetectionEvents, backlog:spawn-session- autonomous, upload:image), pushing registry-validation divergence to 3.29% (> 2% gate). - Add tools/scanner/prune-stale-backend.sh: regenerates the authoritative id-set into a temp dir and removes committed files whose id is absent. - Wire it into `make registry-generate-backend` so generation now stays in sync with deletions while still preserving human-edited testIds/tested (the in-place scanner pass runs first). - Reconcile the committed backend set to match (0.0% divergence) and restore tested=true on GetHookStatus / InstallHooks. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(bugs): add open bug reports for mutex/cache concurrency issues BUG-022 ETagCache RWMutex-over-map (Low), BUG-023 PRStatusPoller mutex churn → atomic.Value (Medium), BUG-024 SearchService branch/history cache → singleflight + atomic.Value (Low). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(a11y): remove invalid aria-selected from session row The session row is a generic div inside role="listitem"; aria-selected is not an allowed attribute there, which Axe flags as a critical WCAG 2.1 AA violation (aria-allowed-attr) and blocked the UX Analysis check. Selection state is already conveyed accessibly by the row's role="checkbox" aria-checked and the rowSelected style, so the attribute was redundant. Pre-existing issue surfaced by this PR triggering the web UX workflow. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(unfinished): detect racy-clean same-size working-tree edits in DiffShortstat DiffShortstat treated a tracked file as unchanged whenever its size matched the index entry and its truncated-to-second mtime equaled the index entry's recorded mtime. A file rewritten with identical byte size within the same wall-clock second as the index update (the classic "racy git" problem) thus looked clean by stat alone, yielding 0 files/insertions/deletions. For only these racy same-size candidates, fall back to a git blob content hash comparison (plumbing.ComputeHash) against the index entry hash, as real git does. Files exceeding maxUntrackedFileSize are conservatively treated as changed without being read, preserving the existing large-file caps and the batch-blob-read performance optimization (no hashing of every tracked file). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(proto-gen): regenerate when output files are missing despite valid stamp If generated files (gen/ or web-app/src/gen/) are deleted while the stamp file still exists (e.g. after merging a commit that untracks them), the stamp check would skip regeneration and leave the build broken. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(registry): map GetHookStatus/InstallHooks RPCs in scanner The scanner's methodToID map lacked entries for the two new hook RPCs, so TestMethodToIDCompleteness / TestScanProto_NoUnmappedMethods failed. Add GetHookStatus→hooks:status and InstallHooks→hooks:install, and regenerate the registry (moves them to backend/hooks/{status,install}.json with the canonical ids, pruning the old method-name-keyed flat files). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore: gitignore macOS _CodeSignature/ codesign artifact `make install-service` re-signs the binary, producing _CodeSignature/CodeResources (~33MB) in the repo root. It's a build byproduct, never committed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat: GitHub work continuity — UserPRCache, GitHubUserService, and Unfinished Tab integration (#141) * feat: GitHub work continuity — UserPRCache, GitHubUserService, and Unfinished Tab integration - github/user_pr_cache.go: COW atomic.Value + singleflight PR cache with session annotations - github/client.go + http_client.go: GetCurrentUserLogin, rate-limit header helper - proto/session/v1/github_user.proto: GitHubUserService RPC (ListUserPRs, WatchUserPRs, GetGitHubAuthState) - proto/session/v1/types.proto: UnfinishedWorktree gets github_pr_number/url/state/priority fields - server/services/github_user_service.go: ConnectRPC handler with streaming + +api: markers - server/services/unfinished_work_service.go: enriches scanResultToProto with PR metadata - server/services/search_service.go (BUG-024): replace sync.RWMutex with atomic.Value + singleflight - server/dependencies.go: wires UserPRCache + GitHubUserService into runtime deps - server/server.go: registers GitHubUserService handler and starts cache lifecycle - session/pr_status_poller.go: use deadlock.RWMutex for lock-order tracking - web-app: GitHubPRsSection + useGitHubPRs hook stream open PRs into Unfinished tab - Makefile + docs/registry: add github_user.proto to backend scanner; 149 features registered Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: address code review findings - subscriber fan-out, ctx leak, auth caching, CSS tokens Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * test(vcs): fix TestDiffShortstat_MultiBlobWorktree same-size collision TestDiffShortstat_MultiBlobWorktree added in main used 'modified' content same byte count as 'original' (both 18 bytes). DiffShortstat uses size-based unstaged-change detection, so same-size + fast-running test (mtime equal within 1s) produced 0 changed files. Fix: use 'a\nb\n' (4 bytes) as modified content so size always differs. LCS diff: 2 new lines vs 3 old lines, no overlap → 2 ins + 3 del per file. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(scanner): add missing methodToID entries for CancelTriage, GetHookStatus, InstallHooks Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: remove duplicate GitHubUserService registration, fix registry prune for github_user proto - server/server.go: remove second GitHubUserService handler registration (caused panic on startup) - tools/scanner/prune-stale-backend.sh: add github_user to proto list so ListUserPRs/WatchUserPRs/GetGitHubAuthState files are not pruned as stale - docs/registry: move GitHub user service features to github-user/ subdirectory Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(demos): update E2E feature GIFs [skip ci] * fix(web): resolve post-merge TypeScript and lint errors - ApprovalAnalyticsPanel: add missing imports (useGenerateRule, SuggestionSource, addRuleManualLink) and state (activeRowKey, generateLoading, isGenerating) for the 'Suggest Rule' button in the programs coverage-gap table - ApprovalRulesPanel: restore missing RuleFormState interface, emptyForm constant, useEffect/useRef imports, and URL-param pre-fill state aliases that were dropped during the merge resolution - feature_flag_interceptor_test: fix nilnil lint violation by returning a non-nil connect.Response instead of (nil, nil) * fix(web): resolve all 102 pre-existing test failures (2811/2811 pass) jest.setup.js: add global stubs for window.matchMedia, next/navigation, @xterm/addon-serialize, useAvailablePrograms, and useSlashCommands so jsdom-based tests don't fail at module load time. Source fixes: - ApprovalRulesPanel: replace inline form with dialog modal; add add-rule-button testid, Escape handler, second useGenerateRule instance for cmd-sample generation, URL-param prefill via RuleBuilderPrefill - ApprovalAnalyticsPanel: add Suggest Rule buttons + inline suggestion cards to the uncovered-tools table (data-testid: suggest-rule-tool-{toolName}) - RuleBuilderForm: add testids for all form fields, advanced-regex-separator, generate-from-command-details, command-sample sections; add cmdSuggestions and cmdClear props - OmnibarCreationPanel: update hint to 'typed into the session terminal' - XtermTerminal: optional-chain terminal.element, attachCustomKeyEventHandler, onScroll, onWriteParsed, and Disposable.dispose() for mock environments - SubStatusChip: guard switch on undefined/null subStatus - NotificationContext/ThemeContext: return no-op fallback outside Provider - useShells: guard createAuthInterceptor in test environments - SessionActionsOverflow: call onClearConversationState directly (no dialog) - OmnibarResultList/QuickOpenPalette: guard scrollIntoView calls - useAvailablePrograms: guard fetch in jest.fn() environments - SessionCard: fix truncateGoal max to produce correct char count - ruleBuilderPrefill: add commandPattern, initialName, isAiGenerated fields * chore: update feature registry after merge make registry-generate removes stale get-program-analytics entry that was superseded during the fork→upstream sync. --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…le lock - reachableSetCache (sync.Map, 30s TTL) eliminates O(N) commit walk on repeated calls — was the #1 pprof hotspot (47.4B cycles, 38 events) - diffShortstatUnderLock batch-reads all needed blobs in one lock hold, replacing N lock-acquire/release cycles — was the #2 hotspot (9.87B cycles, 1641 events)

* chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * refactor(session): apply type-driven design to buildLaunchCommand Replace the 8x isClaudeProgram bool check with a sealed programKind sum type (claudeProgram / plainProgram). classifyProgram() parses once at the boundary; holding claudeProgram is proof the program invokes claude, so buildClaudeCommand needs zero isClaude guards — they are enforced by the type system, not by runtime checks. - Add programKind interface with claudeProgram / plainProgram variants - Add classifyProgram() smart constructor (parses once; trust downstream) - buildLaunchCommand: switches on type, delegates to buildClaudeCommand or returns plain cmd unchanged - buildClaudeCommand: no guards — the type makes invalid states unrepresentable (a plainProgram can never reach this function) - Extract claudeMCPConfigFlag() helper for the MCP config flag string - TestClassifyProgram: table test for the sum type classification - TestBuildLaunchCommand_PlainProgramIgnoresClaudeFlags: proves that a non-claude program with all claude-related Instance fields set still returns the bare program, enforced by the type routing * feat(backlog): implement CancelTriage RPC and session delete button Adds CancelTriage endpoint that stops any active triage sessions for a backlog item. Wires up the previously-TODO cancel button in BacklogItemDetail and adds a per-session delete button in the session list. * fix(install): skip FDA prompt for non-admin users with cert-signed binary Non-admin users cannot read either TCC database (authorization denied), causing fda_is_granted() to always return false and show the 15s prompt on every reinstall even when FDA is already granted. When all TCC databases exist but are unreadable, fall back to a heuristic: if the installed binary is cert-signed (designated requirement includes "certificate root"), assume FDA was previously granted. The TCC grant is tied to the signing identity (com.stapler-squad + cert), which is stable across rebuilds, so no new grant is needed on reinstall. * perf(tmux): add semaphore to cap concurrent capture-pane subprocesses capturePaneSem (size 8) limits concurrent CapturePaneContent calls to avoid circuit-breaker lock contention and OS process table pressure. Control-mode fast path bypasses the semaphore entirely. * perf(vcs): cache reachableSet results and batch-read blobs under single lock - reachableSetCache (sync.Map, 30s TTL) eliminates O(N) commit walk on repeated calls — was the #1 pprof hotspot (47.4B cycles, 38 events) - diffShortstatUnderLock batch-reads all needed blobs in one lock hold, replacing N lock-acquire/release cycles — was the #2 hotspot (9.87B cycles, 1641 events) * chore(proto): regenerate types bindings after rebase Types were out of sync (DetectedStatus missing from Go/TS bindings) after the CancelTriage commit was rebased onto upstream. * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * fix(terminal): repair escape code pipeline for new Claude Code renderer (#139) * feat(onboarding): offer to install Claude Code hooks during onboarding Adds a final onboarding step that asks whether to install the global Claude Code hooks, with two independent toggles: - Rule enforcement (PreToolUse -> `ssq-hooks check`) - Notifications (Notification/Stop -> `ssq-hook-handler`) Previously these hooks were discoverable only via docs / a manual `ssq-hooks install` invocation; nothing prompted the user. Backend: - New internal/claudehooks package: idempotent, atomic install + detection of the two global hooks in ~/.claude/settings.json. cmd/ssq-hooks now reuses it (InstallRules) instead of its private patchClaudeSettings. - New SessionService RPCs GetHookStatus and InstallHooks. InstallHooks resolves the ssq-hooks binary and ssq-hook-handler from ~/.local/bin (then $PATH / exe-relative scripts); when a binary is unavailable it returns a manual-fallback message rather than failing. - `make install` now also copies ssq-hook-handler to ~/.local/bin so the server can register a stable path. Frontend: - OnboardingModal gains step 5: prefilled from GetHookStatus (a toggle is pre-checked only when its hook is available and not already installed), installs via InstallHooks, and disables toggles whose binary is missing. Tests: unit tests for the package and the two handlers; Jest tests for the onboarding step. Feature registry updated (GetHookStatus, InstallHooks, onboarding-hook-install). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(onboarding): address review — concurrency, async guards, e2e - claudehooks.mutate: serialize read-modify-write with a package mutex and write via a unique temp file (os.CreateTemp) so two concurrent installs (double-click) can't corrupt or clobber settings.json. Add a -race test. - OnboardingModal: guard async setState with a mounted ref (removes the after-unmount update / act warning) and seed the toggle defaults only once so navigating Back→forward no longer discards the user's toggle edits; reset the seed guard on a fresh open. - Jest: await the status fetch in gotoHooksStep to remove flakiness. - Add Playwright e2e (tests/e2e/onboarding-hook-install.spec.ts) covering the hooks step render + finish-without-install (does not mutate global settings). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(sdd): planning artifacts for new-renderer terminal fix Research, implementation plan, adversarial/architecture reviews, validation plan, and architecture-performance deep-dive for fixing escape code stripping caused by the new Claude Code renderer. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(terminal): repair escape code pipeline for new Claude Code renderer The new Ink-based renderer emits escape sequences that exposed four latent bugs in the terminal streaming pipeline, causing garbled output in xterm.js: 1. TextDecoder reuse without {stream:true}: multi-byte UTF-8 characters (é, €, CJK, emoji) split across consecutive proto frames emitted U+FFFD. Fix: StateApplicator and useTerminalStream now pass {stream:true} on all streaming decode calls; separate lineDecoder for complete line content. 2. EscapeSequenceParser lookback too short (20→256): OSC window titles and DCS payloads from the new renderer exceed 20 bytes, causing incomplete sequences to be flushed as garbage. 3. ED2+ED3 stripping: parser stripped \x1b[3J when paired with \x1b[2J, bleed-through of previous session history. xterm.js v6 handles this correctly without intervention. 4. RedrawThrottler over-classification: any \x1b[\d+A was treated as a full-screen redraw; Ink emits cursor-up on every incremental line update, causing most progress/spinner frames to be dropped. Fix: only classify cursor-up + erase-screen as a genuine redraw. Also: 100→33ms cap (30fps) to match Ink render cadence. Adds 84 tests including a combined pipeline integration suite covering the full TerminalDiff→StateApplicator→EscapeSequenceParser→TerminalStreamManager chain. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(terminal): address code review - decoder isolation, test ESC prefix, timer cleanup Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(registry): regenerate after merge with main * fix(a11y): remove aria-selected from listitem div; aria-checked on checkbox is correct * chore(registry): remove stale entries for RPCs removed from main --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * feat(rules): auto-suggest rule name from criteria inputs (#140) * feat(rules): auto-suggest rule name from criteria inputs Generates a "Allow/Block/Escalate {target}" name as the user fills in tool target, category, pattern, or programs. The suggestion only applies when the name field is empty or still matches the previous auto-suggestion, so manual edits are never overwritten. Also scopes golangci-lint to the current module root to avoid scanning files in external workspace paths (../../../../../WorkProjects). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(tests): resolve TypeScript errors in ArtifactsTab tests and tighten RuleBuilderForm auto-suggest - Add makeArtifacts() cast helper in ArtifactsTab.test.tsx to satisfy protobuf Message<> type requirements without importing the full runtime - Fix computeSuggestedName category branch: check cat existence, not cat?.value (avoids truthiness trap on empty-string values) - Move nameRef sync to useLayoutEffect to avoid render-phase ref mutation in React concurrent mode Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: resolve CI failures in multiblobworktree test and accessibility violation - vcsreader_test.go: fix TestDiffShortstat_MultiBlobWorktree by using a modified content string with different byte length (4 bytes vs 18 bytes original). The dirty-check in diffShortstatUncached uses size+mtime; when both sides had the same 18-byte content the file was not detected as changed. - SessionRow.tsx: remove aria-selected from the session row div, which has role="listitem" — ARIA spec disallows aria-selected on that role. Selection state is already communicated by the inner checkbox button's aria-checked. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: add CancelTriage to scanner methodToID map TestMethodToIDCompleteness enforces that every RPC method in proto files has a matching entry. CancelTriage (backlog.proto) was missing. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: add GetHookStatus and InstallHooks to scanner methodToID map Merge from main brought new hooks RPCs into session.proto. TestMethodToIDCompleteness requires every proto RPC to be mapped. Feature IDs match the +api: markers in the proto file. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * feat(onboarding): offer to install Claude Code hooks during onboarding (#138) * feat(onboarding): offer to install Claude Code hooks during onboarding Adds a final onboarding step that asks whether to install the global Claude Code hooks, with two independent toggles: - Rule enforcement (PreToolUse -> `ssq-hooks check`) - Notifications (Notification/Stop -> `ssq-hook-handler`) Previously these hooks were discoverable only via docs / a manual `ssq-hooks install` invocation; nothing prompted the user. Backend: - New internal/claudehooks package: idempotent, atomic install + detection of the two global hooks in ~/.claude/settings.json. cmd/ssq-hooks now reuses it (InstallRules) instead of its private patchClaudeSettings. - New SessionService RPCs GetHookStatus and InstallHooks. InstallHooks resolves the ssq-hooks binary and ssq-hook-handler from ~/.local/bin (then $PATH / exe-relative scripts); when a binary is unavailable it returns a manual-fallback message rather than failing. - `make install` now also copies ssq-hook-handler to ~/.local/bin so the server can register a stable path. Frontend: - OnboardingModal gains step 5: prefilled from GetHookStatus (a toggle is pre-checked only when its hook is available and not already installed), installs via InstallHooks, and disables toggles whose binary is missing. Tests: unit tests for the package and the two handlers; Jest tests for the onboarding step. Feature registry updated (GetHookStatus, InstallHooks, onboarding-hook-install). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(onboarding): address review — concurrency, async guards, e2e - claudehooks.mutate: serialize read-modify-write with a package mutex and write via a unique temp file (os.CreateTemp) so two concurrent installs (double-click) can't corrupt or clobber settings.json. Add a -race test. - OnboardingModal: guard async setState with a mounted ref (removes the after-unmount update / act warning) and seed the toggle defaults only once so navigating Back→forward no longer discards the user's toggle edits; reset the seed guard on a fresh open. - Jest: await the status fetch in gotoHooksStep to remove flakiness. - Add Playwright e2e (tests/e2e/onboarding-hook-install.spec.ts) covering the hooks step render + finish-without-install (does not mutate global settings). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(sdd): add planning artifacts for github-work-continuity Supersedes docs/tasks/github-pr-status.md (planning complete, absorbed into this unified plan). Adds requirements, research (4 domains), plan, adversarial review, and validation for the GitHub Work Continuity feature. ADRs 020-022 record key decisions: GraphQL for user PR list, enrichment at service layer not scanner, WorktreePRPoller extends PRStatusPoller. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: Epic 1+2 GitHub work continuity — bug fixes + WorktreePRPoller Epic 1 — Pre-flight bug fixes: - BUG-021: CheckGHAuth() → direct GET /user (no subprocess, no forkExec) - BUG-022: ETagCache sync.Map replaces RWMutex+map (lock-free reads) - BUG-023: PRStatusPoller auth state → atomic.Value (pollerAuthResult) - Story 1.3: checkRateLimitHeaders() monitors X-RateLimit-Remaining, Retry-After, and X-GitHub-Sso on every GitHub API response - ADR-020 updated: direct HTTP API, no gh subprocess Epic 2 — WorktreePRPoller (session/worktree_pr_poller.go): - Polls GitHub PR data for worktrees that have no active session - sync.Map for cache (lock-free reads); atomic.Value for auth + callback - WorktreeSource interface breaks import cycle via scannerSource adapter - GetOwnerRepoFromRemote() added to github/client.go - Wired into server: started after UnfinishedWork scanner Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: Epic 3 Story 3.1 — UserPRCache with direct GraphQL API Add github/user_pr_cache.go: lock-free background cache of all open PRs authored by the authenticated GitHub user. - Uses POST /graphql (newGHPostRequest) directly — no gh subprocess - atomic.Value COW snapshot for lock-free reads - singleflight.Group coalesces concurrent manual Refresh() calls - GetCurrentUserLogin added to github/client.go via GET /user - loginState also cached with atomic.Value + singleflight - checkRateLimitHeaders called on every response - Wired into ServerDependencies / RuntimeDeps; Start(ctx) called in server.go Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: Epic 3 Story 3.2 — Annotate UserPR with session IDs and worktree paths - Add PRAnnotationSession / PRAnnotationWorktree value types to github pkg (avoids import cycle: github is imported by session, not vice-versa) - Add UserPRCache.Annotate() — COW: load snapshot → copy+annotate → store matching by owner+branch, O(n + m) via map lookups - Add PRStatusPoller.GetInstances() — defensive copy under RLock - Wire annotateUserPRCache() helper in server/dependencies.go: called in UserPRCache.SetOnUpdated callback, reads sessions from PRStatusPoller and worktrees from unfinished.Scanner Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: Epic 3 Story 3.3 — UserPR proto + GitHubUserService proto + generated bindings Add proto/session/v1/github_user.proto: - GitHubUserService with ListUserPRs, WatchUserPRs, GetGitHubAuthState RPCs - GitHubAuthState, ListUserPRs*, WatchUserPRs*, GetGitHubAuthState* messages Add UserPR message to types.proto (fields 1-17: owner, repo, number, title, html_url, state, head_ref, base_ref, is_draft, check_conclusion, approved_count, changes_req_count, updated_at, closed_at, merged_at, session_ids, local_worktree_path) Regenerate Go + TypeScript bindings via make proto-gen. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: Epic 3 Story 3.4 — GitHubUserService ConnectRPC handler Implement server/services/github_user_service.go: - ListUserPRs: returns cached open PRs + GitHubAuthState - WatchUserPRs: sends initial snapshot then streams on each UserPRCache refresh (buffered channel of size 4; callback set atomically via SetOnUpdated) - GetGitHubAuthState: calls GetCurrentUserLogin directly, degrades gracefully - userPRToProto: converts github.UserPR → sessionv1.UserPR with timestamp handling Wire into server/dependencies.go and registered in server/server.go at /api/session.v1.GitHubUserService/. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(registry): prune stale RPC files in generation; reconcile after merge Backend registry generation was additive — it wrote/updated per-feature files but never deleted ones whose RPC was removed or renamed in the proto. That left 5 orphaned files after the upstream merge (ArchiveWorkflowSessions, DeleteWorkflowFailedSessions, GetDetectionEvents, backlog:spawn-session- autonomous, upload:image), pushing registry-validation divergence to 3.29% (> 2% gate). - Add tools/scanner/prune-stale-backend.sh: regenerates the authoritative id-set into a temp dir and removes committed files whose id is absent. - Wire it into `make registry-generate-backend` so generation now stays in sync with deletions while still preserving human-edited testIds/tested (the in-place scanner pass runs first). - Reconcile the committed backend set to match (0.0% divergence) and restore tested=true on GetHookStatus / InstallHooks. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(bugs): add open bug reports for mutex/cache concurrency issues BUG-022 ETagCache RWMutex-over-map (Low), BUG-023 PRStatusPoller mutex churn → atomic.Value (Medium), BUG-024 SearchService branch/history cache → singleflight + atomic.Value (Low). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(a11y): remove invalid aria-selected from session row The session row is a generic div inside role="listitem"; aria-selected is not an allowed attribute there, which Axe flags as a critical WCAG 2.1 AA violation (aria-allowed-attr) and blocked the UX Analysis check. Selection state is already conveyed accessibly by the row's role="checkbox" aria-checked and the rowSelected style, so the attribute was redundant. Pre-existing issue surfaced by this PR triggering the web UX workflow. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(unfinished): detect racy-clean same-size working-tree edits in DiffShortstat DiffShortstat treated a tracked file as unchanged whenever its size matched the index entry and its truncated-to-second mtime equaled the index entry's recorded mtime. A file rewritten with identical byte size within the same wall-clock second as the index update (the classic "racy git" problem) thus looked clean by stat alone, yielding 0 files/insertions/deletions. For only these racy same-size candidates, fall back to a git blob content hash comparison (plumbing.ComputeHash) against the index entry hash, as real git does. Files exceeding maxUntrackedFileSize are conservatively treated as changed without being read, preserving the existing large-file caps and the batch-blob-read performance optimization (no hashing of every tracked file). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(proto-gen): regenerate when output files are missing despite valid stamp If generated files (gen/ or web-app/src/gen/) are deleted while the stamp file still exists (e.g. after merging a commit that untracks them), the stamp check would skip regeneration and leave the build broken. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(registry): map GetHookStatus/InstallHooks RPCs in scanner The scanner's methodToID map lacked entries for the two new hook RPCs, so TestMethodToIDCompleteness / TestScanProto_NoUnmappedMethods failed. Add GetHookStatus→hooks:status and InstallHooks→hooks:install, and regenerate the registry (moves them to backend/hooks/{status,install}.json with the canonical ids, pruning the old method-name-keyed flat files). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore: gitignore macOS _CodeSignature/ codesign artifact `make install-service` re-signs the binary, producing _CodeSignature/CodeResources (~33MB) in the repo root. It's a build byproduct, never committed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat: GitHub work continuity — UserPRCache, GitHubUserService, and Unfinished Tab integration (#141) * feat: GitHub work continuity — UserPRCache, GitHubUserService, and Unfinished Tab integration - github/user_pr_cache.go: COW atomic.Value + singleflight PR cache with session annotations - github/client.go + http_client.go: GetCurrentUserLogin, rate-limit header helper - proto/session/v1/github_user.proto: GitHubUserService RPC (ListUserPRs, WatchUserPRs, GetGitHubAuthState) - proto/session/v1/types.proto: UnfinishedWorktree gets github_pr_number/url/state/priority fields - server/services/github_user_service.go: ConnectRPC handler with streaming + +api: markers - server/services/unfinished_work_service.go: enriches scanResultToProto with PR metadata - server/services/search_service.go (BUG-024): replace sync.RWMutex with atomic.Value + singleflight - server/dependencies.go: wires UserPRCache + GitHubUserService into runtime deps - server/server.go: registers GitHubUserService handler and starts cache lifecycle - session/pr_status_poller.go: use deadlock.RWMutex for lock-order tracking - web-app: GitHubPRsSection + useGitHubPRs hook stream open PRs into Unfinished tab - Makefile + docs/registry: add github_user.proto to backend scanner; 149 features registered Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: address code review findings - subscriber fan-out, ctx leak, auth caching, CSS tokens Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * test(vcs): fix TestDiffShortstat_MultiBlobWorktree same-size collision TestDiffShortstat_MultiBlobWorktree added in main used 'modified' content same byte count as 'original' (both 18 bytes). DiffShortstat uses size-based unstaged-change detection, so same-size + fast-running test (mtime equal within 1s) produced 0 changed files. Fix: use 'a\nb\n' (4 bytes) as modified content so size always differs. LCS diff: 2 new lines vs 3 old lines, no overlap → 2 ins + 3 del per file. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(scanner): add missing methodToID entries for CancelTriage, GetHookStatus, InstallHooks Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: remove duplicate GitHubUserService registration, fix registry prune for github_user proto - server/server.go: remove second GitHubUserService handler registration (caused panic on startup) - tools/scanner/prune-stale-backend.sh: add github_user to proto list so ListUserPRs/WatchUserPRs/GetGitHubAuthState files are not pruned as stale - docs/registry: move GitHub user service features to github-user/ subdirectory Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(demos): update E2E feature GIFs [skip ci] * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * fix(tmux): flush stale exists-cache in RestoreWithWorkDir and add --tmux-keep-server to plist RestoreWithWorkDir was checking DoesSessionExist() (cached) on entry, returning a stale true even when the caller's DoesSessionExistNoCache() had just returned false. This caused the PTY attach to silently fail — the reconnect loop in the frontend would spin up to 5 times per session and startup recovery (Step 6) would also silently no-op for sessions whose tmux died during a crash loop. Fix: invalidate the cache at the top of RestoreWithWorkDir so the first existence check always hits tmux directly. Also explicitly add --tmux-keep-server to the LaunchAgent plist so the intent is clear (the flag already defaults to true in the binary). * chore: save backlog UX planning artifacts and serena config * fix(triage): silent storage error, hung session timeout, and Claude detection false positives - submit_triage_result now returns an MCP error to Claude when the DB write fails instead of silently succeeding (invisible data loss) - TriggerTriage orphan guard tombstones sessions older than 2h so a hung Claude session cannot permanently block re-trigger - batchIsClaudeProcess and isClaudeCommand now use exact basename match instead of substring match, preventing false positives from paths like /home/claude/... or wrappers like claude-wrapper * chore(backlog): review triage-validation-1779863260384 — all 3 criteria done Fixed three triage pipeline bugs: (1) submit_triage_result now returns an MCP error on storage failure instead of silently succeeding; (2) TriggerTriage orphan guard tombstones sessions older than 2h so a hung session cannot block re-trigger indefinitely; (3) batchIsClaudeProcess and isClaudeCommand switched from substring to exact basename match, preventing false positives from paths or wrappers containing "claude". * chore: sync personal fork → upstream (20260629) (#142) * refactor(session-types): unify SessionType, promote one_off to proto enum, split config Eliminates three sources of type duplication: 1. config/types.go + config/executor.go extracted from the 1031-line config/config.go (SRP fix — config.go now contains only factory functions and the Config struct) 2. session.SessionType is now a Go type alias for config.SessionType, removing the duplicate type that required aliasSessionTypeToSessionType no-op conversions 3. bool one_off = 14 promoted to SESSION_TYPE_ONE_OFF = 5 in the SessionType proto enum; field 14 is reserved for wire compatibility. All call sites updated: backend handler, workflow scheduler, alias defaults service, and all frontend contexts/hooks/tests. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(headless): use Setsid instead of Noctty for headless runner subprocess WithNoControllingTerminal() sets SysProcAttr.Noctty=true on Linux, which calls ioctl(0, TIOCNOTTY) in the child after fork. This returns ENOTTY when the parent process has no controlling terminal — the case when stapler-squad runs as a systemd service — causing every headless triage call to fail with "fork/exec .../claude: inappropriate ioctl for device" (exit code 1). Replace WithNoControllingTerminal() with WithNewSession() in ProcessRunner.Run. Setsid creates a new process session (implying no controlling terminal) without invoking TIOCNOTTY, so it works regardless of whether the parent has a TTY. Also corrects the misleading comment in managed_process_linux.go that claimed Noctty was safe without a controlling terminal. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(omnibar): replace Create shortcut hint with clickable Create Session button Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(alias): add name_prefix field + fix session name oscillation - Add `name_prefix` to AliasConfig (Go), AliasProto (proto field 12), and AliasEntry (TypeScript) — wired through the full stack - In the detection effect, skip the generic suggestedName update for aliases; the alias block now derives the session name as namePrefix + typedLabel, falling back to namePrefix alone or the alias name — eliminates the oscillation between alias name and prefix+label on each keystroke - AliasesManager settings form now has a Name prefix field with a live preview hint - Create Session button in shortcuts bar uses compact styling on desktop and expands to touch-friendly size on coarse-pointer (mobile) devices Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(detection): detect dynamic workflows + expand turn-marker to ✦ - Add "dynamic workflow" alternate to waiting_for_background_agent pattern so "✻ Waiting for N dynamic workflow(s) to finish" → StatusWaitingForAgent - Expand [✻◉] → [✻◉✦] in verb_duration_completion and waiting_for_background_agent to cover ✦ (U+2726, Claude Code primary spinner) - Add test cases for all three bullet variants on both waiting and completion lines Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(review-queue): show INPUT_REQUIRED items + UX improvements - Fix invisible INPUT_REQUIRED/APPROVAL_PENDING items: deriveWorkingState maps these to PROCESSING, which was being filtered out; now always passes items through when their reason requires user action - Fix workingCount to exclude INPUT_REQUIRED/APPROVAL_PENDING from the "working" tally (they need attention, not patience) - Fix summaryCount grammar ("input neededs", "task completes", "timed outs") by replacing tuple pluralization with per-reason formatter functions - Fix filter empty state: show "no items match" when a filter is active, not the generic "all done" message - Move auto-advance checkbox into the panel title row (was orphaned above the card in page.tsx toolbar div) - Hide floating help button on mobile (keyboard shortcuts are irrelevant on touch devices) - Increase filter button / toggle touch targets to 44px on mobile - Downgrade oldest-item callout from alarming orange to neutral muted style - Show filter toggle whenever any items exist (not only when server totalItems > 0) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(alias): default session type + name oscillation - Fix session type not applying for aliases configured as "Default (directory)": that option stores SessionType.UNSPECIFIED, which the detection effect was explicitly skipping — form stayed at the initial "new_worktree" value instead. Now maps UNSPECIFIED → "directory". - Fix session name oscillating every other keystroke: the generic suggestedName block was running for InputType.Alias results and resetting lastSuggestedNameRef to the alias slug (e.g. "pw"), causing the alias-specific name block to fail its staleness check and alternate on each input event. Fixed by skipping the generic block for Alias inputs entirely — the alias block below handles naming. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * chore(sdd): planning artifacts for review-queue-jump-fix Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(review-queue): suppress auto-advance on session status transitions The "deleted externally" effect in ReviewQueueContent used reviewQueueItems (the filtered visible list) to check if the selected session still existed. When a session transitioned to ACTIVE/PROCESSING, it was filtered from the visible list but remained in the Redux store — the effect incorrectly fired handleAutoAdvance(id, true), jumping to the next queue item immediately after the user opened a session and clicked into the terminal. Fix: use allQueueItems from useReviewQueueContext().items (the unfiltered Redux store) as the existence oracle. A session filtered from the visible queue due to status transition stays in the store and no longer triggers auto-advance. Genuine removals (removeItem Redux events) still fire auto-advance correctly. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(sessions): prevent Claude process orphaning after server restart Three-part fix for tmux session / Claude process accumulation: **Fix 1 — DeleteSession fallback (session_service.go)** When FindLiveInstance returns nil (e.g. server restarted since the session was created, so the in-memory poller is empty), fall back to KillTmuxSessionByTitle which kills by the deterministic tmux session name. Previously the DB record was deleted but the Claude process kept running indefinitely. **Fix 2 — Startup orphan sweep (session/orphan_sweep.go)** ReconcileOrphanedTmuxSessions runs as Step 6d of BuildRuntimeDeps, after the re-adoption passes (6/6b) that hot-attach DB sessions to their live tmux panes. It enumerates all staplersquad_* tmux sessions, reads the STAPLER_SESSION_UUID env var from each, and kills any whose UUID (or sanitized title) has no match in the current workspace DB. The keepalive sentinel is always preserved. **Fix 3 — MCPServerURL backfill (session_service.go)** loadInstancesWithWiring now backfills inst.MCPServerURL from the server's configured URL for sessions created before MCP integration was wired up. Without this, buildLaunchCommand omits --mcp-config entirely and Claude restarts without a session UUID, making it impossible to identify from the process list or MCP request headers. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * fix(lint): return empty map instead of nil in GetAllInstanceArtifacts Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * fix(backlog): harden triage parser and add repoPath UI gate ParseHeadlessTriageResult now uses brace-scan (strings.Index/LastIndex) to tolerate natural-language preamble before the JSON block, fixing silent parse failures on multi-step triage runs. The "Trigger Triage" button in BacklogItemDetail and BacklogItemCard is now disabled with a tooltip when repoPath is not set, preventing the confusing CodeFailedPrecondition server error. Adds 3 new unit tests for the parser and a Playwright e2e gate test that creates an item without repoPath and asserts the button is disabled. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(demos): update E2E feature GIFs [skip ci] * feat(harness): headless triage test harness + alias kebab-case fix Adds a build-tagged Go harness (go:build harness) that exercises the backlog triage feature end-to-end via the ConnectRPC HTTP layer with no browser or UI. Four sub-tests cover distinct phases runnable individually: Gate (repoPath precondition), TriggerAndPoll (async completion), ParserRobust (preamble tolerance), and FullFlow (full user journey). Makefile targets added for each phase. Also converts alias namePrefix label to kebab-case lowercase (spaces/underscores → hyphens) before concatenating with the prefix, so "@ssq My New Feature" produces "ssq-my-new-feature" instead of "ssq-My New Feature". Two new tests added to Omnibar.alias.test.tsx. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(sdd): planning artifacts for nav-redesign Navigation redesign: group 16+ flat nav items into 4 sections (Work, Automation, Insights, Settings & Tools), restore mobile access for 8 currently-hidden routes, and consolidate Settings/Config Files/Features. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(nav): group navigation into 4 sections, restore mobile access Reorganise the 15 nav pages into Work / Automation / Insights / Settings groups rendered in both DrawerNav (desktop sidebar) and BottomNav More sheet (mobile). All 8 routes that were hidden from mobile (Settings, Insights, Logs, Errors, Help, Escape Analytics, Files, Workflows/Rules) are now reachable on every screen size. Removes the redundant Config Files and Features top-level entries; fixes a DrawerNav bug where items were shown regardless of feature-flag state. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * chore: commit in-progress work from previous sessions Includes executor fixes (WithProcessDir support, Linux setsid/Setpgid EPERM fix), backlog triage harness test expansions, rate-limit integration test, Makefile test-triage-real target, and planning artifacts for backlog-triage-e2e-hardening and put-backlog-behind-a-feature-flag-by-default. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: support Antigravity CLI hooks.json format in ssq-hooks * fix(pane): restore session peek modal integration in pane picker * feat(files): wire up the premium LocalFileBrowser component to the files page * chore: commit in-progress work from previous sessions - ssq-hooks: Antigravity CommandLine/Cwd normalization, workspace-aware DB path resolution from cwd, WorkspacePaths fallback - session service: ForkSession fully wired (callbacks, hook config, controller, driver, autonomous mode); ResumeHibernated wires review queue poller and autonomous driver - ent schema: autonomous_mode bool field + generated ORM files - instance_hibernate: start controller + session driver on resume - omnibar: initialTitle prop pre-populates session name; OmnibarContext threads title through openOmnibar(); page.tsx passes ?title param - LocalFileBrowser: CSS and component updates - scripts: find-orphaned-features.py, find-unmerged-commits.py Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(omnibar): replace Create shortcut hint with clickable Create Session button Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(settings): add UpsertAlias and DeleteAlias RPCs with AliasesManager UI Implements full CRUD for alias session presets in Settings > General, removing the need to manually edit config.json. Adds UpsertAlias/DeleteAlias ConnectRPC handlers (case-insensitive name matching, slice-scan upsert, validation via aliasNameRE) and a React AliasesManager component with inline 3-second delete confirmation, env-var editor, tag management, and ARIA accessibility. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(registry): add alias RPCs to scanner methodToID map UpsertAlias, DeleteAlias, ListAliases were missing from the methodToID map, causing the scanner to use fallback raw-name IDs (UpsertAlias, DeleteAlias, ListAliases) instead of canonical kebab-case IDs (alias:upsert, alias:delete, alias:list). This caused Registry Validation CI to fail with 3.36% divergence. Removes the duplicate fallback JSON files from the registry root that were generated under the old behavior. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(analytics): program detail panel with subcommand drill-down Add DB-backed time-windowed analytics queries and an inline program detail panel so operators can see exactly which sub-operations are causing escalations before writing a rule. Backend (Go): - Add compound index on (command_program, created_at) to ent schema - Replace full-table-scan ListAnalytics with time-windowed ListAnalyticsSince (WHERE created_at >= ?) — AC-1, AC-2 - Add GetSubcommandBreakdown aggregation query using ent GroupBy — AC-4 - Add ListRecentCommandsByProgram returning last N command previews — AC-5 - Add GetSubcommandTrend returning per-day counts — AC-6 - Add GetProgramAnalytics ConnectRPC method returning SubcommandBreakdown, ExampleCommands, RuleCoverage, DailyTrend — AC-7 Frontend (React/TypeScript): - New ProgramDetailPanel component with subcommand frequency table (count, %, decision breakdown), example commands, rule coverage summary, trend sparklines, and "Add rule →" links — AC-8 through AC-13 - New useProgramAnalytics hook with AbortController cleanup - ApprovalAnalyticsPanel: clicking program row opens inline detail panel - ApprovalRulesPanel: fix panel crush in flex container (flexShrink: 0), use window.location.search in useEffect for URL param pre-fill (avoids useSearchParams/Suspense issues in Next.js static export) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(backlog): gate backlog behind feature flag on all layers - Frontend layout guard: backlog/layout.tsx redirects to / when flag off - Backend interceptor: FeatureFlagInterceptor wired to BacklogService only - E2E tests: beforeAll/afterAll enable+restore the backlog flag Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: address copilot review comments on analytics drill-down - Fix 1: exclude NULL command_subcategory rows in GetSubcommandBreakdown to avoid sql.ScanSlice scan errors on nullable GROUP BY columns - Fix 2: replace strings.Fields tokenizer in coveredSubcommands() with regexp.Compile + synthetic "<program> <subcommand>" matching so regex-style patterns (e.g. \bgit\b.*\bpush\b) work correctly - Fix 3: add TestGetProgramAnalytics_ReturnsExpectedFields unit test covering window_days=7 and non-nil response fields - Fix 4: add escapeRegex() helper in ApprovalRulesPanel and use it when prefilling commandPattern to avoid metacharacter injection; switch word boundaries from \b to (?:^|\s)/(?:\s|$) for hyphenated program names - Fix 5: add e.stopPropagation() on Suggest Rule button and "add manually" link so clicking them does not toggle the parent <tr> drill-down row - Fix 6: add tabIndex, role=button, aria-expanded, aria-label, and onKeyDown (Enter/Space) to the clickable <tr> for keyboard accessibility - Fix 7: call setData(null) before setIsLoading(false) in error path of useProgramAnalytics to clear stale data on refresh failure - Fix 8: render per-program daily trend sparkline in ProgramDetailPanel; note that trend data is per-program not per-subcommand (backend limit) - Fix 9: thread caller context through LoadProgramWindow, GetSubcommandBreakdown, and ListRecentCommands instead of context.Background() * fix(review-queue): resolve UUID→Title before Remove so approved/deleted sessions leave the queue Queue items are keyed by inst.Title but approval-response and session-deleted events arrive with UUID. resolveQueueKey() looks up the instance via FindInstance (which handles both UUID and Title) and returns Title, falling back to the raw value if the instance is no longer loaded. Also removes duplicate SubcommandDecisionCount declaration in repository.go introduced by the analytics cherry-pick merge. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update go tier1 baseline [skip ci] * fix(web): resolve post-merge TypeScript and lint errors - ApprovalAnalyticsPanel: add missing imports (useGenerateRule, SuggestionSource, addRuleManualLink) and state (activeRowKey, generateLoading, isGenerating) for the 'Suggest Rule' button in the programs coverage-gap table - ApprovalRulesPanel: restore missing RuleFormState interface, emptyForm constant, useEffect/useRef imports, and URL-param pre-fill state aliases that were dropped during the merge resolution - feature_flag_interceptor_test: fix nilnil lint violation by returning a non-nil connect.Response instead of (nil, nil) * fix(web): resolve all 102 pre-existing test failures (2811/2811 pass) jest.setup.js: add global stubs for window.matchMedia, next/navigation, @xterm/addon-serialize, useAvailablePrograms, and useSlashCommands so jsdom-based tests don't fail at module load time. Source fixes: - ApprovalRulesPanel: replace inline form with dialog modal; add add-rule-button testid, Escape handler, second useGenerateRule instance for cmd-sample generation, URL-param prefill via RuleBuilderPrefill - ApprovalAnalyticsPanel: add Suggest Rule buttons + inline suggestion cards to the uncovered-tools table (data-testid: suggest-rule-tool-{toolName}) - RuleBuilderForm: add testids for all form fields, advanced-regex-separator, generate-from-command-details, command-sample sections; add cmdSuggestions and cmdClear props - OmnibarCreationPanel: update hint to 'typed into the session terminal' - XtermTerminal: optional-chain terminal.element, attachCustomKeyEventHandler, onScroll, onWriteParsed, and Disposable.dispose() for mock environments - SubStatusChip: guard switch on undefined/null subStatus - NotificationContext/ThemeContext: return no-op fallback outside Provider - useShells: guard createAuthInterceptor in test environments - SessionActionsOverflow: call onClearConversationState directly (no dialog) - OmnibarResultList/QuickOpenPalette: guard scrollIntoView calls - useAvailablePrograms: guard fetch in jest.fn() environments - SessionCard: fix truncateGoal max to produce correct char count - ruleBuilderPrefill: add commandPattern, initialName, isAiGenerated fields * chore: update feature registry after merge make registry-generate removes stale get-program-analytics entry that was superseded during the fork→upstream sync. --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * feat: GitHub work continuity — persistence, annotation fallback, and type-safe RepoRef **GitHub owner/repo persistence (ent schema migration)** - Add github_owner and github_repo columns to sessions table so these fields survive service restarts (previously lost on reload) - Wire SaveSession / UpdateSession / loadSession in ent_repository.go **PR annotation fallback matching** - Add PRNumber field to PRAnnotationSession for number-based fallback when local branch name doesn't match GitHub headRef (common for worktree-style sessions like "pr-1255-...") - Annotate() builds two maps: primary by owner/branch, secondary by owner/#number; falls back to number key when branch key misses - annotateUserPRCache: 3-tier owner resolution — DB fields → PR URL parse → git remote inference; title regex as last-resort PR number extraction **RepoRef value object (type-driven design)** - New github.RepoRef: unexported fields, smart constructor NewRepoRef, IsValid(), BranchKey(branch), PRKey(n), String() - GetOwnerRepoFromRemote returns (RepoRef, error) instead of (owner, repo string, err error); non-GitHub remotes return zero RepoRef - PRAnnotationSession.GitHubOwner string → Repo RepoRef (holding a RepoRef proves both owner and repo are non-empty at compile time) - PRAnnotationWorktree.GitHubOwner string → Repo RepoRef - Annotate() uses s.Repo.BranchKey() / s.Repo.PRKey() throughout; worktree_pr_poller and dependencies.go callers updated Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(session-driver): add live output check before prompt injection Adds outputShowsConversationStarted() to detect active/completed conversations from live PTY buffer content before injecting the initial prompt — no disk I/O, no JSONL flush latency. Wired as the first gate in both the startup pre-flight and the main injection guard, with FindConversationFilePath kept as fallback for the post-idle case. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * fix: publish session update event on controller status change wireStatusChangeCallback was only notifying the review queue manager on detection state transitions. WatchSessions clients never received these changes, so the session list stayed stale until the next explicit RPC call (update/pause/resume) triggered an event. Now publishes NewSessionUpdatedEventWithDetection alongside the existing review queue signal, so the frontend session list reflects Idle/Processing/NeedsApproval transitions in real time. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * fix: skip shell sourcing in test mode to prevent service test timeout DefaultConfig's GetClaudeCommand and GetAvailablePrograms each source ~/.zshrc for up to 5 program candidates (5s timeout each), adding 17–22s to the server/services test suite and causing timeouts. Inject lookPathOnlyExecutor when IsTestMode() is true and no custom executor is provided. This executor returns ErrNotFound from Output() (bypassing shell sourcing) and falls through to exec.LookPath for program discovery — same result, no shell startup cost. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * chore(main): release 1.32.0 (#126) * chore(demos): update E2E feature GIFs [skip ci] * fix(codesign): correct otool byte-order in verify-codesign plist decode otool -s displays 4-byte words in little-endian integer form on ARM64, so the bytes appear reversed relative to their in-memory order. The original awk concatenated groups as-is, causing xxd to decode them in the wrong order (e.g. "mx?<" instead of "<?xm"), which made plutil fail and verify-codesign always report "no embedded plist" even when the plist was present and valid. The fix reverses each 8-hex-char group byte-by-byte before piping to xxd, restoring the correct byte sequence. * chore(demos): update E2E feature GIFs [skip ci] * fix(css): enable scroll on unfinished tab container Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: review queue auto-advance respects preference after approve/deny The "deleted externally" useEffect called handleAutoAdvance with force=true, bypassing the auto-advance preference when a session was removed from the queue (e.g. after approving/denying a permission request). Users couldn't stay on the current session to continue watching even with auto-advance off. Removes force=true so the toggle is fully respected on all removal paths. Adds T-AA-008 to document and guard this behavior. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(lint): suppress norawexec on lookPathOnlyExecutor stub lookPathOnlyExecutor.Command satisfies the CommandExecutor interface but its Output always returns ErrNotFound — the returned cmd is never executed. Using safeexec.CommandContext here would be misleading since the command never runs; nolint with justification is appropriate. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(lint): use correct nolint directives for lookPathOnlyExecutor stub Needs both //nolint:norawexec (custom linter) and //nolint:forbidigo (golangci-lint forbidigo rule) since two separate lint passes check this. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * fix(unfinished): stack GitHub auth banner vertically so Connect button is always visible Button was pushed off-screen on narrow viewports due to flex-row layout with flexGrow:1 on the text. Switch to column direction so the button always renders below the error message. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(demos): update E2E feature GIFs [skip ci] * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * feat(pr-status): show PR badge in row mode and use go-git for branch detection Show GitHubBadge inline in SessionRow (row/list view) so PR status is visible without switching to card view. Previously the badge only rendered in SessionCard (card view). Switch getCurrentBranchName from subprocess (git rev-parse) to go-git direct file read — no subprocess overhead. Add exported GetCurrentBranchName wrapper and CurrentBranch() method on Instance that falls back to live git read for directory sessions (Branch field is always empty for non-worktree sessions). Add UpdatePRStatus() helper for atomic in-memory PR status updates from PRStatusPoller. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * fix: repair broken release pipeline and build-from-source path (#147) * fix: repair broken release pipeline and build-from-source path Every GoReleaser release since v1.9.0 has failed with "found 3 builds with the ID 'stapler-squad'" because none of the three build entries in .goreleaser.yaml declared an explicit id, so GoReleaser assigned them all the same default. This is why brew install pulls the ancient 1.9.0 build (Formula/stapler-squad.rb hasn't updated since) and why install.sh's release-asset download has had nothing to fetch for every tag from v1.20.1 through v1.32.0. Give each build block an explicit unique id. Also fixes two things blocking the build-from-source path: - config/executor.go: lookPathOnlyExecutor.Command used a raw exec.Command instead of safeexec.CommandContext, tripping the norawexec custom lint rule and failing `make build` outright. - Makefile: `go build` never set the version ldflag, so both `make build` and plain `go build .` reported the stale hardcoded "1.1.2" regardless of what was actually built. Derive VERSION from `git describe` and pass it via -ldflags, matching what GoReleaser already does for tagged releases. Verified locally: `make build` now succeeds end-to-end and `./stapler-squad version` reports the real git-described version. `goreleaser check` and a full `goreleaser release --snapshot --clean` (with the GITHUB_* env vars CI provides) both succeed, including Homebrew formula generation. Fixes #143 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix: isolate TestGetConfigDir from ambient STAPLER_SQUAD_* env vars GetConfigDir() checks STAPLER_SQUAD_TEST_DIR and STAPLER_SQUAD_INSTANCE before falling through to test-mode auto-detection. When the test process inherits either from its environment (e.g. running inside a stapler-squad-managed session), the "uses test mode isolation for tests" subtest short-circuits on the ambient value instead of exercising auto-detection, and fails. Clear both for the duration of the subtest and restore them afterward. Verified with `go test ./config/... -run TestGetConfigDir -count=3` and a full `go test ./config/... -count=1`. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix: sanitize VERSION and wire it into build-embedded too Code review on this branch surfaced two real gaps in the version-ldflag fix: 1. Security: git tag names may legally contain shell metacharacters (backtick, $()). Make's $(VERSION) substitution is pure text substitution done before the shell parses the recipe line, so those characters land as live shell syntax inside the double-quoted `-ldflags` argument — anyone who can get a maliciously-tagged ref fetched into a checkout gets command execution on `make build` / `make install-service`. Strip VERSION to a safe charset before it ever reaches the shell. (Checked whether the analogous `VERSION=$(git describe ...)` in .github/workflows/build.yml has the same problem: it doesn't. That's a bash variable expansion of an already-computed string, not a macro substitution before the shell parses the command — bash does not re-evaluate `$()`/backticks embedded in an expanded variable's value. Verified empirically. Left that file alone.) 2. Completeness: `build-embedded` (the tmux-bundled single-binary target used by `make build-tmux` -> `make build-embedded`) builds the same stapler-squad binary as the primary `stapler-squad` target but wasn't wired to the new LDFLAGS, so it would have kept shipping the exact stale "1.1.2" version string issue #143 complains about. Verified: `make build` still succeeds and reports a correct, sanitized version. `make -n build-embedded` confirms the ldflags now appear in that target's go build invocation. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * ci: add goreleaser check as a regression guard for .goreleaser.yaml The build-ID collision this PR fixes broke every release for 15+ months with zero visibility: the only place it ever surfaced was a failed Action run on a tag push (release.yml only runs `goreleaser release` on `push: tags: v*`), which nobody was watching closely enough to catch. Add a small, fast, dedicated workflow that runs `goreleaser check` on every change to .goreleaser.yaml, so a config mistake like this one fails a PR check immediately instead of silently breaking every subsequent release. `goreleaser check` also fails non-zero for known-but-accepted deprecation warnings, not just genuine invalidity, so a naive `args: check` step would have gone red on day one against this repo's existing config (it still uses the classic `brews` publisher, which GoReleaser wants migrated to `homebrew_casks` — a real behavioral change for end users, not a syntax rename: casks use different install semantics, code-signing/Gatekeeper expectations, and app-bundle lifecycle hooks that don't apply to a plain CLI binary, and would very likely break the `brew install` command this repo's README documents. That migration needs its own careful, tested PR, not a blind swap bundled into an install-bug fix). Fixed the two safe, pure-syntax deprecations in the same commit (`archives.format`/ `format_overrides.format` -> `formats`, now a list — verified via a full snapshot build that archive naming/extension per-OS is unchanged) and left `brews` alone. The new workflow's check step distinguishes "configuration is invalid" (hard fail) from "valid, but uses deprecated properties" (pass, tracked separately) by output content rather than exit code, so it stays a real regression guard instead of either being permanently red on accepted debt or silently disabled. Verified locally: - `goreleaser check` on the current config: valid, only the accepted `brews` deprecation remains. - Simulated the exact original bug (duplicate build ids) against a scratch copy of the config: the same check logic correctly reports "configuration is invalid" and would fail CI. - Full `goreleaser release --snapshot --clean` still succeeds end-to-end after the formats-list migration, archive names/ extensions unchanged. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix: sync registry validation with github_user.proto and add missing feature files CI's Registry Validation check was failing on this PR (unrelated to the actual fix, but blocking it from going green): `tools/scanner/validate-registry.sh` never scans `proto/session/v1/github_user.proto`, even though the Makefile's `registry-generate-backend` target does. Both were last touched independently, and the validation script's hardcoded proto list was never updated when github_user.proto's RPCs (added in 3be7e0902, well before this branch existed) were registered. The result: `docs/registry/features/backend/*.json` never had entries for ListGitHubAccounts/PollGitHubDeviceAuth/RevokeGitHubToken/ StartGitHubDeviceAuth, and the validation script would report them as "Removed RPCs" (154 committed vs. 147 generated, 4.55% divergence) forever, regardless of whether the per-feature files existed — the scanner it runs simply never looks at that proto file. - Added the missing `github_user.proto` scan step to validate-registry.sh, matching the Makefile. - Ran `make registry-generate` to create the 4 missing per-feature JSON files these RPCs were always supposed to have. Verified: `./tools/scanner/validate-registry.sh` now reports "Committed: 154 Generated: 154 Divergence: 0.0%" and exits 0. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> * chore(main): release 1.33.0 (#145) * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * Brew formula update for stapler-squad version v1.33.0 * chore(demos): update E2E feature GIFs [skip ci] * fix: backlog/triage sessions die on launch (shell injection + flag-parsing crash) (#150) * fix: shell-quote claude launch args to stop injection and flag-parsing crash Backlog/triage spawned sessions died on launch: the prompt is interpolated into a shell command (tmux launches programs through a shell), and Go's %q produces double quotes, which do not suppress backtick/$(...)/$VAR expansion. Backlog prompts are full of backtick-wrapped tokens (`/backlog/done-N`, etc.), so the shell executed each as a command instead of passing it to claude. Separately, backlog prompts begin with "--- BACKLOG ITEM DATA ---", which claude's arg parser rejected as an unrecognized flag once quoting was fixed. Add shellQuote (POSIX single-quoting, the same style already used for --mcp-config) and apply it to every claude flag value that gets interpolated into the shell command: --append-system-prompt, --allowedTools, --permission-mode, and the positional prompt. Insert a bare "--" before the prompt so a leading "--" in the prompt text is treated as data, not flags. Verified against the real claude CLI that both -- as an end-of-options separator and --append-system-prompt-file are accepted, and confirmed via a real shell execution that a $(...) payload in a backlog-shaped prompt no longer executes. Fixes #148 * fix: close remaining shell-injection gaps found by review Multi-agent review of the shellQuote fix found the same vulnerability class still present two call sites over: - --resume value: claudeSessionID traces back to the client-supplied resume_id field on CreateSessionRequest with no format validation, and was still interpolated unquoted into the shell-executed launch command in the same function that was just patched. - claudeMCPConfigFlag hand-rolled its own shell single-quoting (a literal '...' wrapper) instead of reusing shellQuote, leaving a second, untested implementation of the same job living next to the new one. Not currently exploitable (MCPServerURL/UUID aren't attacker-supplied today) but a latent gap in the same file that just added the primitive meant to prevent this. Also add regression tests the review flagged as missing: --allowedTools and --permission-mode had zero shell-safety coverage even though shellQuote was applied to both, so a partial revert of just those two lines would have passed the full suite silently. Reworked the two existing Prompt/AppendSystemPrompt regression tests to assert against hand-written expected literals instead of calling shellQuote() again, so they don't just verify the function against itself. Added only-single-quote, embedded-newline, and combined backtick+quote cases to TestShellQuote's table. Confirmed session/claude_command_builder.go's separate --resume path is not affected: it validates the session ID against a strict UUID v4 regex before use, and is not wired into any production call site today. --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * fix(analytics…

* refactor(session-types): unify SessionType, promote one_off to proto enum, split config Eliminates three sources of type duplication: 1. config/types.go + config/executor.go extracted from the 1031-line config/config.go (SRP fix — config.go now contains only factory functions and the Config struct) 2. session.SessionType is now a Go type alias for config.SessionType, removing the duplicate type that required aliasSessionTypeToSessionType no-op conversions 3. bool one_off = 14 promoted to SESSION_TYPE_ONE_OFF = 5 in the SessionType proto enum; field 14 is reserved for wire compatibility. All call sites updated: backend handler, workflow scheduler, alias defaults service, and all frontend contexts/hooks/tests. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(headless): use Setsid instead of Noctty for headless runner subprocess WithNoControllingTerminal() sets SysProcAttr.Noctty=true on Linux, which calls ioctl(0, TIOCNOTTY) in the child after fork. This returns ENOTTY when the parent process has no controlling terminal — the case when stapler-squad runs as a systemd service — causing every headless triage call to fail with "fork/exec .../claude: inappropriate ioctl for device" (exit code 1). Replace WithNoControllingTerminal() with WithNewSession() in ProcessRunner.Run. Setsid creates a new process session (implying no controlling terminal) without invoking TIOCNOTTY, so it works regardless of whether the parent has a TTY. Also corrects the misleading comment in managed_process_linux.go that claimed Noctty was safe without a controlling terminal. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(omnibar): replace Create shortcut hint with clickable Create Session button Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(alias): add name_prefix field + fix session name oscillation - Add `name_prefix` to AliasConfig (Go), AliasProto (proto field 12), and AliasEntry (TypeScript) — wired through the full stack - In the detection effect, skip the generic suggestedName update for aliases; the alias block now derives the session name as namePrefix + typedLabel, falling back to namePrefix alone or the alias name — eliminates the oscillation between alias name and prefix+label on each keystroke - AliasesManager settings form now has a Name prefix field with a live preview hint - Create Session button in shortcuts bar uses compact styling on desktop and expands to touch-friendly size on coarse-pointer (mobile) devices Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(detection): detect dynamic workflows + expand turn-marker to ✦ - Add "dynamic workflow" alternate to waiting_for_background_agent pattern so "✻ Waiting for N dynamic workflow(s) to finish" → StatusWaitingForAgent - Expand [✻◉] → [✻◉✦] in verb_duration_completion and waiting_for_background_agent to cover ✦ (U+2726, Claude Code primary spinner) - Add test cases for all three bullet variants on both waiting and completion lines Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(review-queue): show INPUT_REQUIRED items + UX improvements - Fix invisible INPUT_REQUIRED/APPROVAL_PENDING items: deriveWorkingState maps these to PROCESSING, which was being filtered out; now always passes items through when their reason requires user action - Fix workingCount to exclude INPUT_REQUIRED/APPROVAL_PENDING from the "working" tally (they need attention, not patience) - Fix summaryCount grammar ("input neededs", "task completes", "timed outs") by replacing tuple pluralization with per-reason formatter functions - Fix filter empty state: show "no items match" when a filter is active, not the generic "all done" message - Move auto-advance checkbox into the panel title row (was orphaned above the card in page.tsx toolbar div) - Hide floating help button on mobile (keyboard shortcuts are irrelevant on touch devices) - Increase filter button / toggle touch targets to 44px on mobile - Downgrade oldest-item callout from alarming orange to neutral muted style - Show filter toggle whenever any items exist (not only when server totalItems > 0) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(alias): default session type + name oscillation - Fix session type not applying for aliases configured as "Default (directory)": that option stores SessionType.UNSPECIFIED, which the detection effect was explicitly skipping — form stayed at the initial "new_worktree" value instead. Now maps UNSPECIFIED → "directory". - Fix session name oscillating every other keystroke: the generic suggestedName block was running for InputType.Alias results and resetting lastSuggestedNameRef to the alias slug (e.g. "pw"), causing the alias-specific name block to fail its staleness check and alternate on each input event. Fixed by skipping the generic block for Alias inputs entirely — the alias block below handles naming. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * chore(sdd): planning artifacts for review-queue-jump-fix Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(review-queue): suppress auto-advance on session status transitions The "deleted externally" effect in ReviewQueueContent used reviewQueueItems (the filtered visible list) to check if the selected session still existed. When a session transitioned to ACTIVE/PROCESSING, it was filtered from the visible list but remained in the Redux store — the effect incorrectly fired handleAutoAdvance(id, true), jumping to the next queue item immediately after the user opened a session and clicked into the terminal. Fix: use allQueueItems from useReviewQueueContext().items (the unfiltered Redux store) as the existence oracle. A session filtered from the visible queue due to status transition stays in the store and no longer triggers auto-advance. Genuine removals (removeItem Redux events) still fire auto-advance correctly. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(sessions): prevent Claude process orphaning after server restart Three-part fix for tmux session / Claude process accumulation: **Fix 1 — DeleteSession fallback (session_service.go)** When FindLiveInstance returns nil (e.g. server restarted since the session was created, so the in-memory poller is empty), fall back to KillTmuxSessionByTitle which kills by the deterministic tmux session name. Previously the DB record was deleted but the Claude process kept running indefinitely. **Fix 2 — Startup orphan sweep (session/orphan_sweep.go)** ReconcileOrphanedTmuxSessions runs as Step 6d of BuildRuntimeDeps, after the re-adoption passes (6/6b) that hot-attach DB sessions to their live tmux panes. It enumerates all staplersquad_* tmux sessions, reads the STAPLER_SESSION_UUID env var from each, and kills any whose UUID (or sanitized title) has no match in the current workspace DB. The keepalive sentinel is always preserved. **Fix 3 — MCPServerURL backfill (session_service.go)** loadInstancesWithWiring now backfills inst.MCPServerURL from the server's configured URL for sessions created before MCP integration was wired up. Without this, buildLaunchCommand omits --mcp-config entirely and Claude restarts without a session UUID, making it impossible to identify from the process list or MCP request headers. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * fix(lint): return empty map instead of nil in GetAllInstanceArtifacts Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * fix(backlog): harden triage parser and add repoPath UI gate ParseHeadlessTriageResult now uses brace-scan (strings.Index/LastIndex) to tolerate natural-language preamble before the JSON block, fixing silent parse failures on multi-step triage runs. The "Trigger Triage" button in BacklogItemDetail and BacklogItemCard is now disabled with a tooltip when repoPath is not set, preventing the confusing CodeFailedPrecondition server error. Adds 3 new unit tests for the parser and a Playwright e2e gate test that creates an item without repoPath and asserts the button is disabled. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(demos): update E2E feature GIFs [skip ci] * feat(harness): headless triage test harness + alias kebab-case fix Adds a build-tagged Go harness (go:build harness) that exercises the backlog triage feature end-to-end via the ConnectRPC HTTP layer with no browser or UI. Four sub-tests cover distinct phases runnable individually: Gate (repoPath precondition), TriggerAndPoll (async completion), ParserRobust (preamble tolerance), and FullFlow (full user journey). Makefile targets added for each phase. Also converts alias namePrefix label to kebab-case lowercase (spaces/underscores → hyphens) before concatenating with the prefix, so "@ssq My New Feature" produces "ssq-my-new-feature" instead of "ssq-My New Feature". Two new tests added to Omnibar.alias.test.tsx. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(sdd): planning artifacts for nav-redesign Navigation redesign: group 16+ flat nav items into 4 sections (Work, Automation, Insights, Settings & Tools), restore mobile access for 8 currently-hidden routes, and consolidate Settings/Config Files/Features. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(nav): group navigation into 4 sections, restore mobile access Reorganise the 15 nav pages into Work / Automation / Insights / Settings groups rendered in both DrawerNav (desktop sidebar) and BottomNav More sheet (mobile). All 8 routes that were hidden from mobile (Settings, Insights, Logs, Errors, Help, Escape Analytics, Files, Workflows/Rules) are now reachable on every screen size. Removes the redundant Config Files and Features top-level entries; fixes a DrawerNav bug where items were shown regardless of feature-flag state. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * chore: commit in-progress work from previous sessions Includes executor fixes (WithProcessDir support, Linux setsid/Setpgid EPERM fix), backlog triage harness test expansions, rate-limit integration test, Makefile test-triage-real target, and planning artifacts for backlog-triage-e2e-hardening and put-backlog-behind-a-feature-flag-by-default. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: support Antigravity CLI hooks.json format in ssq-hooks * fix(pane): restore session peek modal integration in pane picker * feat(files): wire up the premium LocalFileBrowser component to the files page * chore: commit in-progress work from previous sessions - ssq-hooks: Antigravity CommandLine/Cwd normalization, workspace-aware DB path resolution from cwd, WorkspacePaths fallback - session service: ForkSession fully wired (callbacks, hook config, controller, driver, autonomous mode); ResumeHibernated wires review queue poller and autonomous driver - ent schema: autonomous_mode bool field + generated ORM files - instance_hibernate: start controller + session driver on resume - omnibar: initialTitle prop pre-populates session name; OmnibarContext threads title through openOmnibar(); page.tsx passes ?title param - LocalFileBrowser: CSS and component updates - scripts: find-orphaned-features.py, find-unmerged-commits.py Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(omnibar): replace Create shortcut hint with clickable Create Session button Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(settings): add UpsertAlias and DeleteAlias RPCs with AliasesManager UI Implements full CRUD for alias session presets in Settings > General, removing the need to manually edit config.json. Adds UpsertAlias/DeleteAlias ConnectRPC handlers (case-insensitive name matching, slice-scan upsert, validation via aliasNameRE) and a React AliasesManager component with inline 3-second delete confirmation, env-var editor, tag management, and ARIA accessibility. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(registry): add alias RPCs to scanner methodToID map UpsertAlias, DeleteAlias, ListAliases were missing from the methodToID map, causing the scanner to use fallback raw-name IDs (UpsertAlias, DeleteAlias, ListAliases) instead of canonical kebab-case IDs (alias:upsert, alias:delete, alias:list). This caused Registry Validation CI to fail with 3.36% divergence. Removes the duplicate fallback JSON files from the registry root that were generated under the old behavior. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(analytics): program detail panel with subcommand drill-down Add DB-backed time-windowed analytics queries and an inline program detail panel so operators can see exactly which sub-operations are causing escalations before writing a rule. Backend (Go): - Add compound index on (command_program, created_at) to ent schema - Replace full-table-scan ListAnalytics with time-windowed ListAnalyticsSince (WHERE created_at >= ?) — AC-1, AC-2 - Add GetSubcommandBreakdown aggregation query using ent GroupBy — AC-4 - Add ListRecentCommandsByProgram returning last N command previews — AC-5 - Add GetSubcommandTrend returning per-day counts — AC-6 - Add GetProgramAnalytics ConnectRPC method returning SubcommandBreakdown, ExampleCommands, RuleCoverage, DailyTrend — AC-7 Frontend (React/TypeScript): - New ProgramDetailPanel component with subcommand frequency table (count, %, decision breakdown), example commands, rule coverage summary, trend sparklines, and "Add rule →" links — AC-8 through AC-13 - New useProgramAnalytics hook with AbortController cleanup - ApprovalAnalyticsPanel: clicking program row opens inline detail panel - ApprovalRulesPanel: fix panel crush in flex container (flexShrink: 0), use window.location.search in useEffect for URL param pre-fill (avoids useSearchParams/Suspense issues in Next.js static export) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(backlog): gate backlog behind feature flag on all layers - Frontend layout guard: backlog/layout.tsx redirects to / when flag off - Backend interceptor: FeatureFlagInterceptor wired to BacklogService only - E2E tests: beforeAll/afterAll enable+restore the backlog flag Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: address copilot review comments on analytics drill-down - Fix 1: exclude NULL command_subcategory rows in GetSubcommandBreakdown to avoid sql.ScanSlice scan errors on nullable GROUP BY columns - Fix 2: replace strings.Fields tokenizer in coveredSubcommands() with regexp.Compile + synthetic "<program> <subcommand>" matching so regex-style patterns (e.g. \bgit\b.*\bpush\b) work correctly - Fix 3: add TestGetProgramAnalytics_ReturnsExpectedFields unit test covering window_days=7 and non-nil response fields - Fix 4: add escapeRegex() helper in ApprovalRulesPanel and use it when prefilling commandPattern to avoid metacharacter injection; switch word boundaries from \b to (?:^|\s)/(?:\s|$) for hyphenated program names - Fix 5: add e.stopPropagation() on Suggest Rule button and "add manually" link so clicking them does not toggle the parent <tr> drill-down row - Fix 6: add tabIndex, role=button, aria-expanded, aria-label, and onKeyDown (Enter/Space) to the clickable <tr> for keyboard accessibility - Fix 7: call setData(null) before setIsLoading(false) in error path of useProgramAnalytics to clear stale data on refresh failure - Fix 8: render per-program daily trend sparkline in ProgramDetailPanel; note that trend data is per-program not per-subcommand (backend limit) - Fix 9: thread caller context through LoadProgramWindow, GetSubcommandBreakdown, and ListRecentCommands instead of context.Background() * fix(review-queue): resolve UUID→Title before Remove so approved/deleted sessions leave the queue Queue items are keyed by inst.Title but approval-response and session-deleted events arrive with UUID. resolveQueueKey() looks up the instance via FindInstance (which handles both UUID and Title) and returns Title, falling back to the raw value if the instance is no longer loaded. Also removes duplicate SubcommandDecisionCount declaration in repository.go introduced by the analytics cherry-pick merge. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update go tier1 baseline [skip ci] * chore: sync upstream → personal fork (20260629) (#132) * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * refactor(session): apply type-driven design to buildLaunchCommand Replace the 8x isClaudeProgram bool check with a sealed programKind sum type (claudeProgram / plainProgram). classifyProgram() parses once at the boundary; holding claudeProgram is proof the program invokes claude, so buildClaudeCommand needs zero isClaude guards — they are enforced by the type system, not by runtime checks. - Add programKind interface with claudeProgram / plainProgram variants - Add classifyProgram() smart constructor (parses once; trust downstream) - buildLaunchCommand: switches on type, delegates to buildClaudeCommand or returns plain cmd unchanged - buildClaudeCommand: no guards — the type makes invalid states unrepresentable (a plainProgram can never reach this function) - Extract claudeMCPConfigFlag() helper for the MCP config flag string - TestClassifyProgram: table test for the sum type classification - TestBuildLaunchCommand_PlainProgramIgnoresClaudeFlags: proves that a non-claude program with all claude-related Instance fields set still returns the bare program, enforced by the type routing * feat(backlog): implement CancelTriage RPC and session delete button Adds CancelTriage endpoint that stops any active triage sessions for a backlog item. Wires up the previously-TODO cancel button in BacklogItemDetail and adds a per-session delete button in the session list. * fix(install): skip FDA prompt for non-admin users with cert-signed binary Non-admin users cannot read either TCC database (authorization denied), causing fda_is_granted() to always return false and show the 15s prompt on every reinstall even when FDA is already granted. When all TCC databases exist but are unreadable, fall back to a heuristic: if the installed binary is cert-signed (designated requirement includes "certificate root"), assume FDA was previously granted. The TCC grant is tied to the signing identity (com.stapler-squad + cert), which is stable across rebuilds, so no new grant is needed on reinstall. * perf(tmux): add semaphore to cap concurrent capture-pane subprocesses capturePaneSem (size 8) limits concurrent CapturePaneContent calls to avoid circuit-breaker lock contention and OS process table pressure. Control-mode fast path bypasses the semaphore entirely. * perf(vcs): cache reachableSet results and batch-read blobs under single lock - reachableSetCache (sync.Map, 30s TTL) eliminates O(N) commit walk on repeated calls — was the #1 pprof hotspot (47.4B cycles, 38 events) - diffShortstatUnderLock batch-reads all needed blobs in one lock hold, replacing N lock-acquire/release cycles — was the #2 hotspot (9.87B cycles, 1641 events) * chore(proto): regenerate types bindings after rebase Types were out of sync (DetectedStatus missing from Go/TS bindings) after the CancelTriage commit was rebased onto upstream. * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * fix(terminal): repair escape code pipeline for new Claude Code renderer (#139) * feat(onboarding): offer to install Claude Code hooks during onboarding Adds a final onboarding step that asks whether to install the global Claude Code hooks, with two independent toggles: - Rule enforcement (PreToolUse -> `ssq-hooks check`) - Notifications (Notification/Stop -> `ssq-hook-handler`) Previously these hooks were discoverable only via docs / a manual `ssq-hooks install` invocation; nothing prompted the user. Backend: - New internal/claudehooks package: idempotent, atomic install + detection of the two global hooks in ~/.claude/settings.json. cmd/ssq-hooks now reuses it (InstallRules) instead of its private patchClaudeSettings. - New SessionService RPCs GetHookStatus and InstallHooks. InstallHooks resolves the ssq-hooks binary and ssq-hook-handler from ~/.local/bin (then $PATH / exe-relative scripts); when a binary is unavailable it returns a manual-fallback message rather than failing. - `make install` now also copies ssq-hook-handler to ~/.local/bin so the server can register a stable path. Frontend: - OnboardingModal gains step 5: prefilled from GetHookStatus (a toggle is pre-checked only when its hook is available and not already installed), installs via InstallHooks, and disables toggles whose binary is missing. Tests: unit tests for the package and the two handlers; Jest tests for the onboarding step. Feature registry updated (GetHookStatus, InstallHooks, onboarding-hook-install). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(onboarding): address review — concurrency, async guards, e2e - claudehooks.mutate: serialize read-modify-write with a package mutex and write via a unique temp file (os.CreateTemp) so two concurrent installs (double-click) can't corrupt or clobber settings.json. Add a -race test. - OnboardingModal: guard async setState with a mounted ref (removes the after-unmount update / act warning) and seed the toggle defaults only once so navigating Back→forward no longer discards the user's toggle edits; reset the seed guard on a fresh open. - Jest: await the status fetch in gotoHooksStep to remove flakiness. - Add Playwright e2e (tests/e2e/onboarding-hook-install.spec.ts) covering the hooks step render + finish-without-install (does not mutate global settings). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(sdd): planning artifacts for new-renderer terminal fix Research, implementation plan, adversarial/architecture reviews, validation plan, and architecture-performance deep-dive for fixing escape code stripping caused by the new Claude Code renderer. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(terminal): repair escape code pipeline for new Claude Code renderer The new Ink-based renderer emits escape sequences that exposed four latent bugs in the terminal streaming pipeline, causing garbled output in xterm.js: 1. TextDecoder reuse without {stream:true}: multi-byte UTF-8 characters (é, €, CJK, emoji) split across consecutive proto frames emitted U+FFFD. Fix: StateApplicator and useTerminalStream now pass {stream:true} on all streaming decode calls; separate lineDecoder for complete line content. 2. EscapeSequenceParser lookback too short (20→256): OSC window titles and DCS payloads from the new renderer exceed 20 bytes, causing incomplete sequences to be flushed as garbage. 3. ED2+ED3 stripping: parser stripped \x1b[3J when paired with \x1b[2J, bleed-through of previous session history. xterm.js v6 handles this correctly without intervention. 4. RedrawThrottler over-classification: any \x1b[\d+A was treated as a full-screen redraw; Ink emits cursor-up on every incremental line update, causing most progress/spinner frames to be dropped. Fix: only classify cursor-up + erase-screen as a genuine redraw. Also: 100→33ms cap (30fps) to match Ink render cadence. Adds 84 tests including a combined pipeline integration suite covering the full TerminalDiff→StateApplicator→EscapeSequenceParser→TerminalStreamManager chain. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(terminal): address code review - decoder isolation, test ESC prefix, timer cleanup Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(registry): regenerate after merge with main * fix(a11y): remove aria-selected from listitem div; aria-checked on checkbox is correct * chore(registry): remove stale entries for RPCs removed from main --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * feat(rules): auto-suggest rule name from criteria inputs (#140) * feat(rules): auto-suggest rule name from criteria inputs Generates a "Allow/Block/Escalate {target}" name as the user fills in tool target, category, pattern, or programs. The suggestion only applies when the name field is empty or still matches the previous auto-suggestion, so manual edits are never overwritten. Also scopes golangci-lint to the current module root to avoid scanning files in external workspace paths (../../../../../WorkProjects). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(tests): resolve TypeScript errors in ArtifactsTab tests and tighten RuleBuilderForm auto-suggest - Add makeArtifacts() cast helper in ArtifactsTab.test.tsx to satisfy protobuf Message<> type requirements without importing the full runtime - Fix computeSuggestedName category branch: check cat existence, not cat?.value (avoids truthiness trap on empty-string values) - Move nameRef sync to useLayoutEffect to avoid render-phase ref mutation in React concurrent mode Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: resolve CI failures in multiblobworktree test and accessibility violation - vcsreader_test.go: fix TestDiffShortstat_MultiBlobWorktree by using a modified content string with different byte length (4 bytes vs 18 bytes original). The dirty-check in diffShortstatUncached uses size+mtime; when both sides had the same 18-byte content the file was not detected as changed. - SessionRow.tsx: remove aria-selected from the session row div, which has role="listitem" — ARIA spec disallows aria-selected on that role. Selection state is already communicated by the inner checkbox button's aria-checked. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: add CancelTriage to scanner methodToID map TestMethodToIDCompleteness enforces that every RPC method in proto files has a matching entry. CancelTriage (backlog.proto) was missing. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: add GetHookStatus and InstallHooks to scanner methodToID map Merge from main brought new hooks RPCs into session.proto. TestMethodToIDCompleteness requires every proto RPC to be mapped. Feature IDs match the +api: markers in the proto file. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * feat(onboarding): offer to install Claude Code hooks during onboarding (#138) * feat(onboarding): offer to install Claude Code hooks during onboarding Adds a final onboarding step that asks whether to install the global Claude Code hooks, with two independent toggles: - Rule enforcement (PreToolUse -> `ssq-hooks check`) - Notifications (Notification/Stop -> `ssq-hook-handler`) Previously these hooks were discoverable only via docs / a manual `ssq-hooks install` invocation; nothing prompted the user. Backend: - New internal/claudehooks package: idempotent, atomic install + detection of the two global hooks in ~/.claude/settings.json. cmd/ssq-hooks now reuses it (InstallRules) instead of its private patchClaudeSettings. - New SessionService RPCs GetHookStatus and InstallHooks. InstallHooks resolves the ssq-hooks binary and ssq-hook-handler from ~/.local/bin (then $PATH / exe-relative scripts); when a binary is unavailable it returns a manual-fallback message rather than failing. - `make install` now also copies ssq-hook-handler to ~/.local/bin so the server can register a stable path. Frontend: - OnboardingModal gains step 5: prefilled from GetHookStatus (a toggle is pre-checked only when its hook is available and not already installed), installs via InstallHooks, and disables toggles whose binary is missing. Tests: unit tests for the package and the two handlers; Jest tests for the onboarding step. Feature registry updated (GetHookStatus, InstallHooks, onboarding-hook-install). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(onboarding): address review — concurrency, async guards, e2e - claudehooks.mutate: serialize read-modify-write with a package mutex and write via a unique temp file (os.CreateTemp) so two concurrent installs (double-click) can't corrupt or clobber settings.json. Add a -race test. - OnboardingModal: guard async setState with a mounted ref (removes the after-unmount update / act warning) and seed the toggle defaults only once so navigating Back→forward no longer discards the user's toggle edits; reset the seed guard on a fresh open. - Jest: await the status fetch in gotoHooksStep to remove flakiness. - Add Playwright e2e (tests/e2e/onboarding-hook-install.spec.ts) covering the hooks step render + finish-without-install (does not mutate global settings). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(sdd): add planning artifacts for github-work-continuity Supersedes docs/tasks/github-pr-status.md (planning complete, absorbed into this unified plan). Adds requirements, research (4 domains), plan, adversarial review, and validation for the GitHub Work Continuity feature. ADRs 020-022 record key decisions: GraphQL for user PR list, enrichment at service layer not scanner, WorktreePRPoller extends PRStatusPoller. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: Epic 1+2 GitHub work continuity — bug fixes + WorktreePRPoller Epic 1 — Pre-flight bug fixes: - BUG-021: CheckGHAuth() → direct GET /user (no subprocess, no forkExec) - BUG-022: ETagCache sync.Map replaces RWMutex+map (lock-free reads) - BUG-023: PRStatusPoller auth state → atomic.Value (pollerAuthResult) - Story 1.3: checkRateLimitHeaders() monitors X-RateLimit-Remaining, Retry-After, and X-GitHub-Sso on every GitHub API response - ADR-020 updated: direct HTTP API, no gh subprocess Epic 2 — WorktreePRPoller (session/worktree_pr_poller.go): - Polls GitHub PR data for worktrees that have no active session - sync.Map for cache (lock-free reads); atomic.Value for auth + callback - WorktreeSource interface breaks import cycle via scannerSource adapter - GetOwnerRepoFromRemote() added to github/client.go - Wired into server: started after UnfinishedWork scanner Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: Epic 3 Story 3.1 — UserPRCache with direct GraphQL API Add github/user_pr_cache.go: lock-free background cache of all open PRs authored by the authenticated GitHub user. - Uses POST /graphql (newGHPostRequest) directly — no gh subprocess - atomic.Value COW snapshot for lock-free reads - singleflight.Group coalesces concurrent manual Refresh() calls - GetCurrentUserLogin added to github/client.go via GET /user - loginState also cached with atomic.Value + singleflight - checkRateLimitHeaders called on every response - Wired into ServerDependencies / RuntimeDeps; Start(ctx) called in server.go Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: Epic 3 Story 3.2 — Annotate UserPR with session IDs and worktree paths - Add PRAnnotationSession / PRAnnotationWorktree value types to github pkg (avoids import cycle: github is imported by session, not vice-versa) - Add UserPRCache.Annotate() — COW: load snapshot → copy+annotate → store matching by owner+branch, O(n + m) via map lookups - Add PRStatusPoller.GetInstances() — defensive copy under RLock - Wire annotateUserPRCache() helper in server/dependencies.go: called in UserPRCache.SetOnUpdated callback, reads sessions from PRStatusPoller and worktrees from unfinished.Scanner Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: Epic 3 Story 3.3 — UserPR proto + GitHubUserService proto + generated bindings Add proto/session/v1/github_user.proto: - GitHubUserService with ListUserPRs, WatchUserPRs, GetGitHubAuthState RPCs - GitHubAuthState, ListUserPRs*, WatchUserPRs*, GetGitHubAuthState* messages Add UserPR message to types.proto (fields 1-17: owner, repo, number, title, html_url, state, head_ref, base_ref, is_draft, check_conclusion, approved_count, changes_req_count, updated_at, closed_at, merged_at, session_ids, local_worktree_path) Regenerate Go + TypeScript bindings via make proto-gen. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: Epic 3 Story 3.4 — GitHubUserService ConnectRPC handler Implement server/services/github_user_service.go: - ListUserPRs: returns cached open PRs + GitHubAuthState - WatchUserPRs: sends initial snapshot then streams on each UserPRCache refresh (buffered channel of size 4; callback set atomically via SetOnUpdated) - GetGitHubAuthState: calls GetCurrentUserLogin directly, degrades gracefully - userPRToProto: converts github.UserPR → sessionv1.UserPR with timestamp handling Wire into server/dependencies.go and registered in server/server.go at /api/session.v1.GitHubUserService/. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(registry): prune stale RPC files in generation; reconcile after merge Backend registry generation was additive — it wrote/updated per-feature files but never deleted ones whose RPC was removed or renamed in the proto. That left 5 orphaned files after the upstream merge (ArchiveWorkflowSessions, DeleteWorkflowFailedSessions, GetDetectionEvents, backlog:spawn-session- autonomous, upload:image), pushing registry-validation divergence to 3.29% (> 2% gate). - Add tools/scanner/prune-stale-backend.sh: regenerates the authoritative id-set into a temp dir and removes committed files whose id is absent. - Wire it into `make registry-generate-backend` so generation now stays in sync with deletions while still preserving human-edited testIds/tested (the in-place scanner pass runs first). - Reconcile the committed backend set to match (0.0% divergence) and restore tested=true on GetHookStatus / InstallHooks. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(bugs): add open bug reports for mutex/cache concurrency issues BUG-022 ETagCache RWMutex-over-map (Low), BUG-023 PRStatusPoller mutex churn → atomic.Value (Medium), BUG-024 SearchService branch/history cache → singleflight + atomic.Value (Low). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(a11y): remove invalid aria-selected from session row The session row is a generic div inside role="listitem"; aria-selected is not an allowed attribute there, which Axe flags as a critical WCAG 2.1 AA violation (aria-allowed-attr) and blocked the UX Analysis check. Selection state is already conveyed accessibly by the row's role="checkbox" aria-checked and the rowSelected style, so the attribute was redundant. Pre-existing issue surfaced by this PR triggering the web UX workflow. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(unfinished): detect racy-clean same-size working-tree edits in DiffShortstat DiffShortstat treated a tracked file as unchanged whenever its size matched the index entry and its truncated-to-second mtime equaled the index entry's recorded mtime. A file rewritten with identical byte size within the same wall-clock second as the index update (the classic "racy git" problem) thus looked clean by stat alone, yielding 0 files/insertions/deletions. For only these racy same-size candidates, fall back to a git blob content hash comparison (plumbing.ComputeHash) against the index entry hash, as real git does. Files exceeding maxUntrackedFileSize are conservatively treated as changed without being read, preserving the existing large-file caps and the batch-blob-read performance optimization (no hashing of every tracked file). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(proto-gen): regenerate when output files are missing despite valid stamp If generated files (gen/ or web-app/src/gen/) are deleted while the stamp file still exists (e.g. after merging a commit that untracks them), the stamp check would skip regeneration and leave the build broken. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(registry): map GetHookStatus/InstallHooks RPCs in scanner The scanner's methodToID map lacked entries for the two new hook RPCs, so TestMethodToIDCompleteness / TestScanProto_NoUnmappedMethods failed. Add GetHookStatus→hooks:status and InstallHooks→hooks:install, and regenerate the registry (moves them to backend/hooks/{status,install}.json with the canonical ids, pruning the old method-name-keyed flat files). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore: gitignore macOS _CodeSignature/ codesign artifact `make install-service` re-signs the binary, producing _CodeSignature/CodeResources (~33MB) in the repo root. It's a build byproduct, never committed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat: GitHub work continuity — UserPRCache, GitHubUserService, and Unfinished Tab integration (#141) * feat: GitHub work continuity — UserPRCache, GitHubUserService, and Unfinished Tab integration - github/user_pr_cache.go: COW atomic.Value + singleflight PR cache with session annotations - github/client.go + http_client.go: GetCurrentUserLogin, rate-limit header helper - proto/session/v1/github_user.proto: GitHubUserService RPC (ListUserPRs, WatchUserPRs, GetGitHubAuthState) - proto/session/v1/types.proto: UnfinishedWorktree gets github_pr_number/url/state/priority fields - server/services/github_user_service.go: ConnectRPC handler with streaming + +api: markers - server/services/unfinished_work_service.go: enriches scanResultToProto with PR metadata - server/services/search_service.go (BUG-024): replace sync.RWMutex with atomic.Value + singleflight - server/dependencies.go: wires UserPRCache + GitHubUserService into runtime deps - server/server.go: registers GitHubUserService handler and starts cache lifecycle - session/pr_status_poller.go: use deadlock.RWMutex for lock-order tracking - web-app: GitHubPRsSection + useGitHubPRs hook stream open PRs into Unfinished tab - Makefile + docs/registry: add github_user.proto to backend scanner; 149 features registered Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: address code review findings - subscriber fan-out, ctx leak, auth caching, CSS tokens Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * test(vcs): fix TestDiffShortstat_MultiBlobWorktree same-size collision TestDiffShortstat_MultiBlobWorktree added in main used 'modified' content same byte count as 'original' (both 18 bytes). DiffShortstat uses size-based unstaged-change detection, so same-size + fast-running test (mtime equal within 1s) produced 0 changed files. Fix: use 'a\nb\n' (4 bytes) as modified content so size always differs. LCS diff: 2 new lines vs 3 old lines, no overlap → 2 ins + 3 del per file. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(scanner): add missing methodToID entries for CancelTriage, GetHookStatus, InstallHooks Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: remove duplicate GitHubUserService registration, fix registry prune for github_user proto - server/server.go: remove second GitHubUserService handler registration (caused panic on startup) - tools/scanner/prune-stale-backend.sh: add github_user to proto list so ListUserPRs/WatchUserPRs/GetGitHubAuthState files are not pruned as stale - docs/registry: move GitHub user service features to github-user/ subdirectory Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(demos): update E2E feature GIFs [skip ci] * fix(web): resolve post-merge TypeScript and lint errors - ApprovalAnalyticsPanel: add missing imports (useGenerateRule, SuggestionSource, addRuleManualLink) and state (activeRowKey, generateLoading, isGenerating) for the 'Suggest Rule' button in the programs coverage-gap table - ApprovalRulesPanel: restore missing RuleFormState interface, emptyForm constant, useEffect/useRef imports, and URL-param pre-fill state aliases that were dropped during the merge resolution - feature_flag_interceptor_test: fix nilnil lint violation by returning a non-nil connect.Response instead of (nil, nil) * fix(web): resolve all 102 pre-existing test failures (2811/2811 pass) jest.setup.js: add global stubs for window.matchMedia, next/navigation, @xterm/addon-serialize, useAvailablePrograms, and useSlashCommands so jsdom-based tests don't fail at module load time. Source fixes: - ApprovalRulesPanel: replace inline form with dialog modal; add add-rule-button testid, Escape handler, second useGenerateRule instance for cmd-sample generation, URL-param prefill via RuleBuilderPrefill - ApprovalAnalyticsPanel: add Suggest Rule buttons + inline suggestion cards to the uncovered-tools table (data-testid: suggest-rule-tool-{toolName}) - RuleBuilderForm: add testids for all form fields, advanced-regex-separator, generate-from-command-details, command-sample sections; add cmdSuggestions and cmdClear props - OmnibarCreationPanel: update hint to 'typed into the session terminal' - XtermTerminal: optional-chain terminal.element, attachCustomKeyEventHandler, onScroll, onWriteParsed, and Disposable.dispose() for mock environments - SubStatusChip: guard switch on undefined/null subStatus - NotificationContext/ThemeContext: return no-op fallback outside Provider - useShells: guard createAuthInterceptor in test environments - SessionActionsOverflow: call onClearConversationState directly (no dialog) - OmnibarResultList/QuickOpenPalette: guard scrollIntoView calls - useAvailablePrograms: guard fetch in jest.fn() environments - SessionCard: fix truncateGoal max to produce correct char count - ruleBuilderPrefill: add commandPattern, initialName, isAiGenerated fields * chore: update feature registry after merge make registry-generate removes stale get-program-analytics entry that was superseded during the fork→upstream sync. --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(session): bidirectional session history transfer between Claude and Antigravity (#130) * chore: commit in-progress work from previous sessions Includes executor fixes (WithProcessDir support, Linux setsid/Setpgid EPERM fix), backlog triage harness test expansions, rate-limit integration test, Makefile test-triage-real target, and planning artifacts for backlog-triage-e2e-hardening and put-backlog-behind-a-feature-flag-by-default. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(session): add session history transfer between Claude and Antigravity * refactor(session): type-driven design for robust history transfer - Introduce UnifiedTurn interface with UserMessage, AssistantMessage, and SkippedTurn sum type — illegal states are unrepresentable - Replace bufio.Scanner (64KB limit) with bufio.NewReader for arbitrarily large JSONL lines - Add UUID validation to prevent path traversal on conversation IDs - Wrap SQLite INSERT OR REPLACE in transactions for atomicity - Add tool_result block parsing so round-trips through Claude format are lossless - Update tests to cover tool_result turns and verify step counts; live tests pass against real session logs (36 turns from current session) * fix(session): complete SQLite schema + scanner bug + e2e fork tests SQLite schema (history_transfer.go): - Match real Antigravity DB exactly: 7 tables, not 2 - Add idx_steps_status and idx_steps_step_type indexes — without these every USER_INPUT / PLANNER_RESPONSE query is a full table scan - Add gen_metadata, executor_metadata, parent_references, trajectory_metadata_blob, battle_mode_infos tables that Antigravity expects to exist before opening the database - Fix has_subtrajectory type: NUMERIC NOT NULL DEFAULT false (not INTEGER) - Add NOT NULL constraints to match real schema Scanner bug (instance_checkpoint.go): - Replace bufio.Scanner (64 KB MaxScanTokenSize) with bufio.NewReader ReadBytes for counting JSONL lines in CreateCheckpoint — Claude tool results and image blocks can exceed 64 KB, causing ConvLineCount to be wrong and forks to truncate at the wrong turn New tests: - TestPortClaudeToAgy_SchemaMatchesRealDB: queries sqlite_master and asserts all 7 tables + 2 indexes are present - TestForkFromCheckpoint_ForkedFileHasCorrectContent: opens the forked JSONL file and verifies line count, valid JSON, ParseClaudeTurn compat - TestForkFromCheckpoint_ConvLineCount_AccurateForLargeLines: regression test for the scanner bug using a 128 KB line * feat(credentials): pluggable credential source abstraction Adds a CredentialSource interface and four concrete implementations: EnvVarCredentialSource Reads ANTHROPIC_API_KEY, GEMINI_API_KEY / GOOGLE_API_KEY, OPENAI_API_KEY. Highest priority in the default chain — always wins when set. ConfigFileCredentialSource Reads the existing config.AnthropicAPIKey field from config.json. ClaudeOAuthCredentialSource Reads ~/.claude/.credentials.json (claudeAiOauth.accessToken). Supports Claude Pro/Max subscription users who have no API key — uses Authorization: Bearer instead of x-api-key. AgyCredentialSource Reads ~/.gemini/oauth_creds.json (written by 'agy auth login'). Falls back to ~/.config/gcloud/application_default_credentials.json (gcloud ADC); sets Credential.IsADC=true so callers use the Google SDK token exchange path instead of setting a header manually. CredentialChain Walks sources in priority order, returning the first valid credential. NewDefaultChain() wires all four in the standard order. NewChain() accepts explicit sources for tests and custom overrides. AnthropicAIClient updated: - Constructor now takes Credential instead of raw apiKey string. - authHeaders() picks x-api-key vs Authorization: Bearer based on which field is populated — transparent to callers. - NewAnthropicAIClientFromKey() shim preserved for legacy callers. - cli_ai_client.go updated to use the shim. 24 new/updated tests covering all sources, chain priority, header selection, expired token handling, ADC fallback, and edge cases. * feat: implement canonical session history adapters, capacity tracking, and TDD smart constructors * feat(session): finish history transfer implementation and fix tests * fix(tests): require.Eventually for goroutine sync, fix os.Unsetenv cleanup, fix instance fixture Path field - Replace time.Sleep(100ms) with require.Eventually in TestCapacityMonitor_AutoTransition to eliminate flakiness under CI load - Add LookupEnv-based cleanup for all four os.Unsetenv call sites in anthropic_client_test.go so env vars are restored after each test - Add Path: workspace to Instance fixture in TestPortClaudeToAgy_SchemaMatchesRealDB so GetWorkingDirectory() returns the correct path Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(review): address code review MAJOR issues M-2: Check f.Write errors in Export methods (claude_adapter.go, agy_adapter.go) M-3: Check json.Marshal + f.Write errors in history_transfer.go history.jsonl writes M-4: Add BlockKindImage case to Validate() in canonical.go and claude_adapter.go Export M-5: Use uuid.New().String() instead of fmt.Sprintf for turnUUID in claude_adapter.go M-6: Replace filepath.Walk with direct path computation in claude_adapter.go Import M-7: Remove dead shim types (UnifiedTurn, SkippedTurn, shimUserMessage, shimAssistantMessage, ParseClaudeTurn) from history_transfer.go; update instance_fork_test.go to use rawClaudeTurn directly M-8: Move resp.Body read before lock in gemini_limits_client.go QueryLimits M-9: Extract parseIntHeader/parseTimeHeader to package-level functions in provider_limits.go; remove local closure versions from anthropic_limits_client.go and gemini_limits_client.go Also fix TestPortSessionHistory_LiveClaude to copy live log to ClaudeProjectDirName(inst.Path) path (consequence of M-6 direct path computation). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(lint): resolve pre-existing golangci-lint issues - Delete unused portAgyToClaude shim from session/history_transfer.go - Convert if/else chain on provider to tagged switch in capacity_monitor.go (QF1003) - Replace strings.ToLower comparison with strings.EqualFold in capacity_monitor.go (SA6005) - Convert if/else chain on block.Kind to tagged switch in agy_adapter.go (QF1003) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(interceptors): add feature flag interceptor and fix nilnil lint error alwaysNext in the test helper returned nil, nil which triggers the golangci-lint nilnil rule. Return a valid non-nil response instead. Also bring the implementation file into the branch so CI lint pass on the merged result sees a consistent package. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: trigger CI for nilnil fix Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(interceptors): add package doc comment Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(analytics): add missing CSS imports for rowActions, suggestRuleButton, rowGeneratingText These symbols were exported from ApprovalAnalyticsPanel.css.ts but not imported in the TSX file, causing a TypeScript build error. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(web): resolve TypeScript build errors from main branch merge Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(ci): fix recursive mutex deadlock, aria-selected WCAG violation, registry divergence - session/instance_checkpoint.go: move adapter.Import() call before stateMutex.Lock() — Import calls GetClaudeConversationUUID which does stateMutex.RLock(), causing a recursive non-reentrant lock acquisition and a deadlock detected by linkdata/deadlock in CI - web-app/src/components/sessions/SessionRow.tsx: remove aria-selected from bare div element (no role that supports it); aria-checked on the child checkbox button already conveys selection state correctly - docs/registry/features/backend: sync per-feature files — add GetProviderLimits.json (new RPC), remove 3 stale entries that the scanner no longer generates (reduces divergence from 2.03% to 0%) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(registry): remove 3 stale per-feature entries not generated by scanner backlog:spawn-session-autonomous, program:analytics, and upload:image were manually-added entries that the scanner no longer generates from proto files (reducing divergence from 2.03% to 0%). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: add CI status helper script * fix(scanner): add GetProviderLimits to methodToID map, fix registry file The scanner test TestScanProto_NoUnmappedMethods requires every proto RPC to have a methodToID entry. GetProviderLimits was added to the proto but not to the map, causing the Build CI job to fail. Also renames the per-feature registry file from the raw method name to the canonical kebab-case ID (session:get-provider-limits). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * feat(analytics): bulk rule creation + page density improvements - Add checkboxes + inline review panel to CommandDistributionTable, UncoveredToolsTable, UncoveredProgramsTable for bulk rule creation via BulkUpsertRules RPC - Add bulkUpsertRules to useApprovalRules hook - Remove redundant "Top Bash Programs" section (covered by Command Distribution) - Move window selector inline with header row; save avg/day in Total card - Inline manual outcome % into Manual review card; remove 5th jank card - Put Top Tools + Top Triggered Rules in 2-col side-by-side grid - Replace plain volume bar with stacked allow/deny/manual composition bar - Replace large Coverage Gaps banner with compact inline badge Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(session): program switching now saves correctly for all cases - Remove erroneous `&& *req.Msg.Program != ""` guard that silently dropped "System default" (empty string) saves in session_service.go - Resolve empty program to cfg.DefaultProgram before persisting to satisfy the ent NotEmpty constraint - Pre-save instance before Restart() so program change is durable even if the restart fails (fixes RC4 ordering race) - Add useEffect in SessionDetailView to re-sync programValue from session.program when WatchSessions pushes an update (fixes stale state) - Add "Change Program" entry to SessionActionsOverflow with inline program picker dialog; wired in SessionCard and SessionRow via useSessionActions Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(ux): address 8 UX review findings from 2026-06-30 Critical accessibility + mobile fixes: - primaryActionWrapper: (hover: none) override so pause/resume is visible on touch devices where CSS :hover never fires - inlineActionButton: (pointer: coarse) override raises touch target to 44px minimum (WCAG 2.5.5) - Window selector buttons: aria-pressed + role="group" aria-label - Bar/StackedBar components: aria-hidden="true" (data in adjacent cells) - Error banner in analytics: role="alert" for screen reader announcement High priority: - RuleBuilderForm: replace window.confirm() with inline pendingMode state + "Confirm / Keep" banner (no native dialog) - OmnibarCreationPanel: collapse 6 session types to 3 primary + "More" expand (auto-expands when an advanced type is already selected) Medium: - BulkReviewPanel: remove setTimeout auto-dismiss; show explicit "Done" button so users control when the confirmation clears Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * feat(analytics): unify activity tables into single filterable view Replaces three separate tables (CommandDistributionTable, UncoveredToolsTable, UncoveredProgramsTable) with one UnifiedActivityTable that has filter chips: All | Needs rule | Has manual. Also wires in the pre-existing Suggest Rule / SuggestedRuleCard integration that was tested but never connected. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * docs(rules): audit and fix .claude/rules — bugs, missing rules, stale examples (#131) * docs(rules): audit and fix .claude/rules — bugs, missing rules, stale examples - feature-registry.md: rewrite to describe per-feature files in docs/registry/features/{backend,frontend}/ (the three monolithic JSONs are generated artifacts, not editable files) - feature-testing-registry.md: update OmnibarAction union to all 11 types; add CommandDetector(5), WorkflowDetector(25), AliasDetector(36) to detector priority table; document dynamic vs static registration - session-creation-registry.md: fix one_off→SessionType.ONE_OFF (was DIRECTORY); add new_project and autonomous modes; update SESSION_TYPES example; fix generate-proto→proto-gen (wrong make target) - CLAUDE.md: fix generate-proto→proto-gen (2 occurrences) - new: ent-schema-generation.md — always pass --feature sql/upsert - new: go-double-checked-locking.md — return locally-computed value - new: e2e-test-conventions.md — 4 CI-enforced Playwright conventions Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(rules): add seed rules for bazel/firebase/pulumi/proextract and sentinel tests - 8 new AutoAllow rules: zcat/gzcat, journalctl, golangci-lint, bazel build ops, firebase (programs-only, colon-subcommands bypass), pulumi read ops, proextract, sshpass - 3 new Escalate-500 rules: bazel run/shutdown, firebase deploy/serve/init (regex, since isSubcommandLike rejects colons), pulumi up/destroy/cancel - 11 sentinel tests covering: python heredoc, cat|python stdlib (known limitation doc), bazel+grep compounds, firebase read vs deploy split, pulumi preview vs up split, journalctl/zcat pipelines - Fix TestClassify_ShellExpansion_PathStripped: golangci-lint now has a seed rule, changed test case to unknown-custom-linter Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(rules): externalize user-specific rules to ~/.config/ssq-hooks/user-rules.yaml Removes proextract and sshpass from SeedRules() — they're personal tools not generally applicable to all users. Adds a YAML config loader: - loadUserRulesFile() reads ~/.config/ssq-hooks/user-rules.yaml on startup - Supports the same fields as DB rules: programs, subcommands, flags, command_pattern, decision (allow/escalate/deny), risk_level, priority - Silently skips if the file doesn't exist; warns on parse errors - Source field set to "user" for analytics distinction from "seed"/"db" The file is loaded before DB rules in loadClassifier() so DB rules (edited via UI) can still override user-file rules if desired. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: resolve TS errors in ApprovalRulesPanel/AnalyticsPanel + code review findings ApprovalRulesPanel.tsx: - Add missing useRef/useEffect imports (TS2304) - Rewrite URL-param pre-fill useEffect to use RuleBuilderPrefill instead of the deleted inline form state (setShowForm/setForm/emptyForm/etc. no longer exist since form was extracted to RuleBuilderForm in a prior refactor) - Add urlPrefill state + effectivePrefill computed value; attach formSectionRef to the form section div for scroll-into-view behavior - Remove unused escapeRegex helper (programs/subcommands passed as arrays now) ApprovalAnalyticsPanel.tsx: - Add missing CSS imports: rowActions, rowGeneratingText, suggestRuleButton, addRuleManualLink (TS2304) - Import useGenerateRule hook + SuggestionSource proto enum - Wire activeRowKey state, generateLoading, isGenerating for the per-row "Suggest Rule" button cmd/ssq-hooks/main.go (code review findings): - Enabled field: use *bool so nil defaults to enabled=true; omitting enabled: in YAML no longer silently disables the rule - os.IsNotExist → errors.Is(err, os.ErrNotExist) (deprecated since Go 1.13) - Add errors import pkg/classifier/classifier.go: - Fix seed-escalate-bazel-run reason: mention bazel shutdown kills the build daemon (not "executes a binary"), per code review finding Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(test): use create(SessionArtifactsSchema) in ArtifactsTab tests Plain object literals don't satisfy the protobuf MessageShape type (missing $typeName). Use @bufbuild/protobuf create() with a helper type alias for the init parameter to keep tests concise. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(merge): restore ApprovalRulesPanel.tsx dropped during merge conflict resolution The file was resolved during git merge origin/main but wasn't included in the merge commit. CI was failing with "Module not found" because the file only existed on disk, not in the git tree. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(review): address copilot review comments — type safety, error handling, test assertions - ArtifactsTab.test.tsx: replace Parameters<typeof create<...>> with MessageInitShape - main.go loadClassifier: guard os.UserHomeDir() error, skip user rules if home unavailable - main.go toClassifierRule: validate risk_level — default RiskLow when empty, error on unknown - classifier.go: fix inline comments claiming priority 60 for bazel run / pulumi up (actual: 500) - classifier_test.go: strengthen 5 sentinel tests from != AutoAllow to != Escalate Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(e2e): increase axe timeout + wait for networkidle to prevent browser-crash flakes Axe scans are CPU-heavy under SwiftShader (CI headless). Two root causes: 1. 30s global timeout was too short — axe scan on a full React app can take 60-90s 2. Using domcontentloaded meant axe fired while async data was still loading, overwhelming the browser context mid-scan Fix: per-describe test.setTimeout(120_000) and waitForLoadState('networkidle') before scanning so the browser is idle when axe starts. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * chore(sdd): backlog cross-platform audit + agent protocol research (#133) * fix(session): release stateMutex before calling Start() in SwitchWorkspace Start() acquires stateMutex itself (instance.go ~900). SwitchWorkspace was holding the lock across its entire body, causing a reentrant deadlock on all three call sites that invoke Start(). Introduces an idempotent unlock() helper so the lock is released early at each Start() call site and deferred for all other return paths. Adds a regression test that runs SwitchWorkspace in a goroutine and asserts it returns within 10s; pre-fix this test hangs forever (not detectable by -race since it's a deadlock, not a data race). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(approval): inject PermissionRequest hook on CreateSession and RestartSession The hook was only injected via the MCP/headless code path (tools_lifecycle.go), so sessions created through the normal web UI never got the PermissionRequest hook wired into .claude/settings.local.json. This caused Claude Code to fall through to its native terminal approval dialog instead of routing through the stapler-squad rule engine. Now InjectHooksConfig is also called after a successful Start() in CreateSession and after Restart() in RestartSession. The call is best-effort (warn on failure, don't fail the session). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * revert: remove incorrect per-session hook injection in session_service The global ssq-hooks PreToolUse hook already handles approval routing. When no rule matches a command, it correctly escalates to Claude Code's native dialog — that's the expected behavior, not a missing hook. The dialog for ./gradlew appears because there's no matching rule, not because the hook isn't wired. Fix: add a rule for gradlew. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(sdd): backlog cross-platform audit + agent protocol research Documents the "why doesn't backlog work reliably" investigation: user journey, implementation inventory, cross-platform risk analysis, test co…

* chore(bench): update frontend throughput baseline [skip ci] * feat: GitHub work continuity — persistence, annotation fallback, and type-safe RepoRef **GitHub owner/repo persistence (ent schema migration)** - Add github_owner and github_repo columns to sessions table so these fields survive service restarts (previously lost on reload) - Wire SaveSession / UpdateSession / loadSession in ent_repository.go **PR annotation fallback matching** - Add PRNumber field to PRAnnotationSession for number-based fallback when local branch name doesn't match GitHub headRef (common for worktree-style sessions like "pr-1255-...") - Annotate() builds two maps: primary by owner/branch, secondary by owner/#number; falls back to number key when branch key misses - annotateUserPRCache: 3-tier owner resolution — DB fields → PR URL parse → git remote inference; title regex as last-resort PR number extraction **RepoRef value object (type-driven design)** - New github.RepoRef: unexported fields, smart constructor NewRepoRef, IsValid(), BranchKey(branch), PRKey(n), String() - GetOwnerRepoFromRemote returns (RepoRef, error) instead of (owner, repo string, err error); non-GitHub remotes return zero RepoRef - PRAnnotationSession.GitHubOwner string → Repo RepoRef (holding a RepoRef proves both owner and repo are non-empty at compile time) - PRAnnotationWorktree.GitHubOwner string → Repo RepoRef - Annotate() uses s.Repo.BranchKey() / s.Repo.PRKey() throughout; worktree_pr_poller and dependencies.go callers updated Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(session-driver): add live output check before prompt injection Adds outputShowsConversationStarted() to detect active/completed conversations from live PTY buffer content before injecting the initial prompt — no disk I/O, no JSONL flush latency. Wired as the first gate in both the startup pre-flight and the main injection guard, with FindConversationFilePath kept as fallback for the post-idle case. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * fix: publish session update event on controller status change wireStatusChangeCallback was only notifying the review queue manager on detection state transitions. WatchSessions clients never received these changes, so the session list stayed stale until the next explicit RPC call (update/pause/resume) triggered an event. Now publishes NewSessionUpdatedEventWithDetection alongside the existing review queue signal, so the frontend session list reflects Idle/Processing/NeedsApproval transitions in real time. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * fix: skip shell sourcing in test mode to prevent service test timeout DefaultConfig's GetClaudeCommand and GetAvailablePrograms each source ~/.zshrc for up to 5 program candidates (5s timeout each), adding 17–22s to the server/services test suite and causing timeouts. Inject lookPathOnlyExecutor when IsTestMode() is true and no custom executor is provided. This executor returns ErrNotFound from Output() (bypassing shell sourcing) and falls through to exec.LookPath for program discovery — same result, no shell startup cost. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * chore(main): release 1.32.0 (#126) * chore(demos): update E2E feature GIFs [skip ci] * fix(codesign): correct otool byte-order in verify-codesign plist decode otool -s displays 4-byte words in little-endian integer form on ARM64, so the bytes appear reversed relative to their in-memory order. The original awk concatenated groups as-is, causing xxd to decode them in the wrong order (e.g. "mx?<" instead of "<?xm"), which made plutil fail and verify-codesign always report "no embedded plist" even when the plist was present and valid. The fix reverses each 8-hex-char group byte-by-byte before piping to xxd, restoring the correct byte sequence. * chore(demos): update E2E feature GIFs [skip ci] * fix(css): enable scroll on unfinished tab container Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: review queue auto-advance respects preference after approve/deny The "deleted externally" useEffect called handleAutoAdvance with force=true, bypassing the auto-advance preference when a session was removed from the queue (e.g. after approving/denying a permission request). Users couldn't stay on the current session to continue watching even with auto-advance off. Removes force=true so the toggle is fully respected on all removal paths. Adds T-AA-008 to document and guard this behavior. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(lint): suppress norawexec on lookPathOnlyExecutor stub lookPathOnlyExecutor.Command satisfies the CommandExecutor interface but its Output always returns ErrNotFound — the returned cmd is never executed. Using safeexec.CommandContext here would be misleading since the command never runs; nolint with justification is appropriate. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(lint): use correct nolint directives for lookPathOnlyExecutor stub Needs both //nolint:norawexec (custom linter) and //nolint:forbidigo (golangci-lint forbidigo rule) since two separate lint passes check this. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * fix(unfinished): stack GitHub auth banner vertically so Connect button is always visible Button was pushed off-screen on narrow viewports due to flex-row layout with flexGrow:1 on the text. Switch to column direction so the button always renders below the error message. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(demos): update E2E feature GIFs [skip ci] * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * feat(pr-status): show PR badge in row mode and use go-git for branch detection Show GitHubBadge inline in SessionRow (row/list view) so PR status is visible without switching to card view. Previously the badge only rendered in SessionCard (card view). Switch getCurrentBranchName from subprocess (git rev-parse) to go-git direct file read — no subprocess overhead. Add exported GetCurrentBranchName wrapper and CurrentBranch() method on Instance that falls back to live git read for directory sessions (Branch field is always empty for non-worktree sessions). Add UpdatePRStatus() helper for atomic in-memory PR status updates from PRStatusPoller. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * fix: repair broken release pipeline and build-from-source path (#147) * fix: repair broken release pipeline and build-from-source path Every GoReleaser release since v1.9.0 has failed with "found 3 builds with the ID 'stapler-squad'" because none of the three build entries in .goreleaser.yaml declared an explicit id, so GoReleaser assigned them all the same default. This is why brew install pulls the ancient 1.9.0 build (Formula/stapler-squad.rb hasn't updated since) and why install.sh's release-asset download has had nothing to fetch for every tag from v1.20.1 through v1.32.0. Give each build block an explicit unique id. Also fixes two things blocking the build-from-source path: - config/executor.go: lookPathOnlyExecutor.Command used a raw exec.Command instead of safeexec.CommandContext, tripping the norawexec custom lint rule and failing `make build` outright. - Makefile: `go build` never set the version ldflag, so both `make build` and plain `go build .` reported the stale hardcoded "1.1.2" regardless of what was actually built. Derive VERSION from `git describe` and pass it via -ldflags, matching what GoReleaser already does for tagged releases. Verified locally: `make build` now succeeds end-to-end and `./stapler-squad version` reports the real git-described version. `goreleaser check` and a full `goreleaser release --snapshot --clean` (with the GITHUB_* env vars CI provides) both succeed, including Homebrew formula generation. Fixes #143 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix: isolate TestGetConfigDir from ambient STAPLER_SQUAD_* env vars GetConfigDir() checks STAPLER_SQUAD_TEST_DIR and STAPLER_SQUAD_INSTANCE before falling through to test-mode auto-detection. When the test process inherits either from its environment (e.g. running inside a stapler-squad-managed session), the "uses test mode isolation for tests" subtest short-circuits on the ambient value instead of exercising auto-detection, and fails. Clear both for the duration of the subtest and restore them afterward. Verified with `go test ./config/... -run TestGetConfigDir -count=3` and a full `go test ./config/... -count=1`. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix: sanitize VERSION and wire it into build-embedded too Code review on this branch surfaced two real gaps in the version-ldflag fix: 1. Security: git tag names may legally contain shell metacharacters (backtick, $()). Make's $(VERSION) substitution is pure text substitution done before the shell parses the recipe line, so those characters land as live shell syntax inside the double-quoted `-ldflags` argument — anyone who can get a maliciously-tagged ref fetched into a checkout gets command execution on `make build` / `make install-service`. Strip VERSION to a safe charset before it ever reaches the shell. (Checked whether the analogous `VERSION=$(git describe ...)` in .github/workflows/build.yml has the same problem: it doesn't. That's a bash variable expansion of an already-computed string, not a macro substitution before the shell parses the command — bash does not re-evaluate `$()`/backticks embedded in an expanded variable's value. Verified empirically. Left that file alone.) 2. Completeness: `build-embedded` (the tmux-bundled single-binary target used by `make build-tmux` -> `make build-embedded`) builds the same stapler-squad binary as the primary `stapler-squad` target but wasn't wired to the new LDFLAGS, so it would have kept shipping the exact stale "1.1.2" version string issue #143 complains about. Verified: `make build` still succeeds and reports a correct, sanitized version. `make -n build-embedded` confirms the ldflags now appear in that target's go build invocation. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * ci: add goreleaser check as a regression guard for .goreleaser.yaml The build-ID collision this PR fixes broke every release for 15+ months with zero visibility: the only place it ever surfaced was a failed Action run on a tag push (release.yml only runs `goreleaser release` on `push: tags: v*`), which nobody was watching closely enough to catch. Add a small, fast, dedicated workflow that runs `goreleaser check` on every change to .goreleaser.yaml, so a config mistake like this one fails a PR check immediately instead of silently breaking every subsequent release. `goreleaser check` also fails non-zero for known-but-accepted deprecation warnings, not just genuine invalidity, so a naive `args: check` step would have gone red on day one against this repo's existing config (it still uses the classic `brews` publisher, which GoReleaser wants migrated to `homebrew_casks` — a real behavioral change for end users, not a syntax rename: casks use different install semantics, code-signing/Gatekeeper expectations, and app-bundle lifecycle hooks that don't apply to a plain CLI binary, and would very likely break the `brew install` command this repo's README documents. That migration needs its own careful, tested PR, not a blind swap bundled into an install-bug fix). Fixed the two safe, pure-syntax deprecations in the same commit (`archives.format`/ `format_overrides.format` -> `formats`, now a list — verified via a full snapshot build that archive naming/extension per-OS is unchanged) and left `brews` alone. The new workflow's check step distinguishes "configuration is invalid" (hard fail) from "valid, but uses deprecated properties" (pass, tracked separately) by output content rather than exit code, so it stays a real regression guard instead of either being permanently red on accepted debt or silently disabled. Verified locally: - `goreleaser check` on the current config: valid, only the accepted `brews` deprecation remains. - Simulated the exact original bug (duplicate build ids) against a scratch copy of the config: the same check logic correctly reports "configuration is invalid" and would fail CI. - Full `goreleaser release --snapshot --clean` still succeeds end-to-end after the formats-list migration, archive names/ extensions unchanged. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix: sync registry validation with github_user.proto and add missing feature files CI's Registry Validation check was failing on this PR (unrelated to the actual fix, but blocking it from going green): `tools/scanner/validate-registry.sh` never scans `proto/session/v1/github_user.proto`, even though the Makefile's `registry-generate-backend` target does. Both were last touched independently, and the validation script's hardcoded proto list was never updated when github_user.proto's RPCs (added in 3be7e0902, well before this branch existed) were registered. The result: `docs/registry/features/backend/*.json` never had entries for ListGitHubAccounts/PollGitHubDeviceAuth/RevokeGitHubToken/ StartGitHubDeviceAuth, and the validation script would report them as "Removed RPCs" (154 committed vs. 147 generated, 4.55% divergence) forever, regardless of whether the per-feature files existed — the scanner it runs simply never looks at that proto file. - Added the missing `github_user.proto` scan step to validate-registry.sh, matching the Makefile. - Ran `make registry-generate` to create the 4 missing per-feature JSON files these RPCs were always supposed to have. Verified: `./tools/scanner/validate-registry.sh` now reports "Committed: 154 Generated: 154 Divergence: 0.0%" and exits 0. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> * chore(main): release 1.33.0 (#145) * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * Brew formula update for stapler-squad version v1.33.0 * chore(demos): update E2E feature GIFs [skip ci] * fix: backlog/triage sessions die on launch (shell injection + flag-parsing crash) (#150) * fix: shell-quote claude launch args to stop injection and flag-parsing crash Backlog/triage spawned sessions died on launch: the prompt is interpolated into a shell command (tmux launches programs through a shell), and Go's %q produces double quotes, which do not suppress backtick/$(...)/$VAR expansion. Backlog prompts are full of backtick-wrapped tokens (`/backlog/done-N`, etc.), so the shell executed each as a command instead of passing it to claude. Separately, backlog prompts begin with "--- BACKLOG ITEM DATA ---", which claude's arg parser rejected as an unrecognized flag once quoting was fixed. Add shellQuote (POSIX single-quoting, the same style already used for --mcp-config) and apply it to every claude flag value that gets interpolated into the shell command: --append-system-prompt, --allowedTools, --permission-mode, and the positional prompt. Insert a bare "--" before the prompt so a leading "--" in the prompt text is treated as data, not flags. Verified against the real claude CLI that both -- as an end-of-options separator and --append-system-prompt-file are accepted, and confirmed via a real shell execution that a $(...) payload in a backlog-shaped prompt no longer executes. Fixes #148 * fix: close remaining shell-injection gaps found by review Multi-agent review of the shellQuote fix found the same vulnerability class still present two call sites over: - --resume value: claudeSessionID traces back to the client-supplied resume_id field on CreateSessionRequest with no format validation, and was still interpolated unquoted into the shell-executed launch command in the same function that was just patched. - claudeMCPConfigFlag hand-rolled its own shell single-quoting (a literal '...' wrapper) instead of reusing shellQuote, leaving a second, untested implementation of the same job living next to the new one. Not currently exploitable (MCPServerURL/UUID aren't attacker-supplied today) but a latent gap in the same file that just added the primitive meant to prevent this. Also add regression tests the review flagged as missing: --allowedTools and --permission-mode had zero shell-safety coverage even though shellQuote was applied to both, so a partial revert of just those two lines would have passed the full suite silently. Reworked the two existing Prompt/AppendSystemPrompt regression tests to assert against hand-written expected literals instead of calling shellQuote() again, so they don't just verify the function against itself. Added only-single-quote, embedded-newline, and combined backtick+quote cases to TestShellQuote's table. Confirmed session/claude_command_builder.go's separate --resume path is not affected: it validates the session ID against a strict UUID v4 regex before use, and is not wired into any production call site today. --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * fix(analytics): escape analytics session_id mismatch and dead mangle detection (#149) * fix(analytics): escape analytics session_id mismatch and dead mangle detection Escape event rows were tagged with the tmux session name instead of the stable session UUID, so the web UI (which queries by stable UUID) never found any data even though capture itself was working (185K+ rows in the live DB). Mangle detection was fully implemented and unit-tested but never wired into production — SetCorrelator was never called, emitEventWithStageAndSeq always recorded Stage 1 observations instead of checking Stage 2 against them, and the Stage 2 tap computed session_seq from the wrong buffer offset. - Thread instance.GetStableID() into the escape parser via a new ResponseStream.SetStableSessionID, scoped narrowly so cc.sessionName's other use sites (PTY naming, persistence dirs, rate limiting) are untouched - Wire MangleCorrelator per-parser with its eviction loop tied to stream lifetime; branch RecordStage1 vs CheckStage2 by stage instead of always recording - Fix Stage 2 session_seq to use the coalesced frame's start offset, not its end offset, so it aligns with Stage 1's numbering - Convert totalSequences/totalMangled to atomic.Int64 (both stages write through the same parser instance from different goroutines) - Mirror escape analytics defaults into DefaultConfig() to match LoadConfigFromPath, per the existing "must mirror" comment Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(analytics): redesign mangle correlation to be offset-independent Code review on PR #149 found the byte-offset arithmetic fix for Stage 2 correlation couldn't work regardless of the arithmetic: streamViaControlMode's data comes from a separate tmux control-mode client, not the same producer as Stage 1's raw PTY read, so the two sides have no shared byte-offset numbering. Verified empirically (live tmux experiment with two simultaneous client attachments) that the two streams carry identical content in the same order, just offset by a constant that resets on each client's own connect/resize redraw — a calibration problem, not a content mismatch. Redesigned MangleCorrelator to correlate ordinally per (session, sequence type) instead of by byte position, which is robust to that offset entirely. Also addresses the review's MAJOR findings: sessionID is now atomic.Pointer[string] instead of an unsynchronized plain string; the parser setter is renamed SetStableSessionID to stop colliding with a tmux-name-keyed SetSessionID called 4 lines away; the correlator eviction goroutine is now tracked by ResponseStream's WaitGroup (so Stop() actually blocks on it) and panic-recovered; and the production wiring line in ClaudeController.Start() now has a test that would catch a regression back to the tmux name. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * chore: restore .claude/scheduled_tasks.lock accidentally deleted in prior commit Unrelated to this PR's changes — an environment-local lock file got staged as deleted before this session started and was swept up by a non-path-scoped git commit. Restoring it to match origin/main. --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> * fix(backlog): GitHub URL repo-path support, first-visit tour, and two related bugs (#152) * fix(backlog): resolve GitHub URLs in repo path, add first-visit tour The Repository Path field silently accepted a GitHub URL and used it verbatim as a filesystem path, producing garbage paths and silent triage failures (stapler-squad#148's "Related" section). It also had no guidance on what it expected, so users had no way to know a URL wasn't a valid local path. - BacklogService now resolves GitHub URLs/shorthand in repo_path to a local clone (same machinery CreateSession already uses for the Omnibar), or returns a clear validation error instead of storing garbage. Covers both CreateBacklogItem and the UpdateBacklogItem fix-up path. - RepoPathInput gained an optional hint line and live GitHub-URL detection ("Will clone owner/repo to ~/.stapler-squad/repos/..."). - BacklogItemForm explains the two previously-unlabeled checkboxes and shows "Cloning repository…" while a fresh clone is in flight. - New BacklogTourModal walks first-time visitors through the item lifecycle, the repo-path gotcha explicitly, and what the skip flags do; reopenable via a "?" button in the page header. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix: shell-quote claude launch prompts, stop triage poll from losing edits Two backlog-adjacent bugs Carl filed while debugging the repo-path issue above: - stapler-squad#148: backlog/triage session prompts were interpolated into the shell command with Go's %q (double quotes), so backtick- wrapped tokens and $(...) in the auto-generated prompt were executed by the shell, and a leading "--" was parsed as a claude CLI flag — spawned sessions died on launch. Now single-quoted (shellQuote, which suppresses all shell expansion) with a "--" separator before the prompt. - stapler-squad#146: BacklogItemDetail's full-screen loading guard unmounted <BacklogItemForm> on every 5s triage-status poll, so any unsaved acceptance criteria typed during triage were silently discarded. The loader now only shows on the initial load, and the poll is suspended while the edit form is open. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * chore(e2e): install missing test deps, extend server-boot timeout allure-playwright (declared in package.json) was missing from the committed node_modules, breaking `npx playwright test` outright. Installed it and its transitive deps. Also bumped the test-server health-check timeout from 30s to 90s: a cold test-mode boot (DB init + demo seeding) was observed taking ~30-45s before /health responds, right at the old cap. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * revert(e2e): don't commit node_modules lock manifest without the packages The previous commit updated .package-lock.json (npm's per-tree manifest) after `npm install` pulled in allure-playwright and ~350 transitive deps, but those package directories are gitignored and weren't force-added — committing just the manifest without the actual files would claim the tree is in sync when it isn't. tests/e2e/node_modules is vendored (git-tracked despite .gitignore), so fully fixing the missing-dependency gap means force-adding ~thousands of new files, which is out of scope for this PR. Leaving the test-server.ts timeout bump from the previous commit in place since that's independently correct; flagging the vendoring gap separately. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix: address code review findings (shell-quote gap, tour checkbox bug, path traversal) Multi-dimension code review (Testing, Code Quality, Architecture, Security) on PR #152 surfaced two CRITICALs, both cross-validated by 2-3 independent reviewers, plus several MAJOR issues: - CRITICAL: AllowedTools/PermissionMode in instance_tmux.go still used Go's %q instead of the new shellQuote — the exact same shell-injection class this PR fixes for AppendSystemPrompt/Prompt, just on two sibling fields populated directly from client RPC input. - CRITICAL: BacklogTourModal's "Don't show this again" checkbox was a no-op — onClose (mapped to setTourComplete) unconditionally persisted onboarded=true regardless of the checkbox state. Fixed by changing the modal's callback contract to onComplete(persist: boolean), with a new hideTour() on the hook for the non-persisting path. - MAJOR (security): GitHub owner/repo regexes in repo_path.go didn't reject "." / ".." segments, so a crafted repo_path could resolve the clone directory outside ~/.stapler-squad/repos/github.com/. Added an isTraversalSegment guard across all 4 parse branches. - MAJOR: hardcoded 24px margin replaced with the vars.space token; extracted BacklogTourModal's reused modal-chrome styles out of OnboardingModal's own CSS module into a new shared components/ui/ModalTour.css.ts (OnboardingModal re-exports from it, so OnboardingModal.tsx needed no changes). - MAJOR (testing): replaced two circular shellQuote()-derived test oracles with hardcoded literals, added a message-content assertion the Update-path resolver-error test was missing, and strengthened the poll-suspended-while- editing test to assert the actual unsaved acceptance criterion survives rather than just checking a fetch call count. Deferred (documented, not blocking): DRY duplication between backlog_service.go/session_service.go's GitHub resolution, a matching hardcoded path format in the frontend hint text, and the pre-existing synchronous-clone-in-RPC-handler pattern this PR extends to a second call site (mirrors existing CreateSession behavior). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * fix: web-build target doesn't generate proto bindings on a clean clone (#155) * fix: make web-build generate proto bindings on a fresh clone `make web-build` builds `web-app/out` without depending on `proto-gen`, so a clean checkout fails with "Module not found: '@/gen/session/v1/session_pb'" because the TypeScript protobuf bindings were never generated. `make build` was unaffected since it lists `proto-gen` as a direct prerequisite of the top-level target. Add `proto-gen` as a prerequisite of `web-app/out` so the TS bindings exist before the Next.js build runs, regardless of which entry point is used. `proto-gen` is a no-op when the bindings are already up to date, so this doesn't slow down repeat builds. Fixes #144 (Bug 1). Bug 2 (go-m1cpu SIGSEGV) is already resolved — the repo depends on gopsutil/v4, which dropped the go-m1cpu cgo dependency. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * test: add CI smoke test for standalone `make web-build` The existing CI pipeline never exercises the Makefile's own dependency graph: `.github/actions/prepare` hand-runs `buf generate` and `pnpm run build` directly, bypassing `make` entirely. That's exactly why the missing `proto-gen` prerequisite on `web-app/out` (previous commit, fixes #144) went undetected - no CI job ever invoked `make web-build` or `make build` as a fresh clone would. Add a standalone job that checks out cleanly (no shared artifacts, no manual buf/pnpm pre-steps) and runs `make web-build` directly, then asserts the generated TS proto bindings exist. Verified this job's steps fail against the pre-fix Makefile with the exact reported error ("Module not found: '@/gen/session/v1/session_pb'") and pass against the fix. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * chore: untrack stale generated proto files that were force-committed gen/, web-app/src/gen/, and .proto-gen.stamp are already in .gitignore, but 19 generated files under gen/proto/go/session/v1/ and web-app/src/gen/session/v1/ were force-committed into git anyway (going back through at least PR #60, #51, #54) and never cleaned up. The tracked set was also incomplete/stale - e.g. session.pb.go and session_pb.ts (generated from session.proto, the largest proto file) were never committed at all, while sessionv1connect/session.connect.go (which references types defined in session.pb.go) was. This is exactly what produced the "undefined: v1.CreateSessionRequest" compile errors and "Module not found '@/gen/session/v1/session_pb'" webpack errors in #144 on any workflow that skipped `proto-gen` - the stale committed files gave inconsistent partial signals instead of a clean "not generated yet" failure. `git rm --cached` only removes them from the index; the working-tree copies (freshly regenerated by `make web-build` in the previous commits) are untouched, and .gitignore now actually takes effect for this tree going forward. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> * chore(main): release 1.33.1 (#153) * chore(demos): update E2E feature GIFs [skip ci] * Brew formula update for stapler-squad version v1.33.1 * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update go tier2 baseline [skip ci] * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * fix: autonomous sessions rejected with "path is required" via omnibar (#157) * fix: autonomous sessions rejected with "path is required" via omnibar The omnibar sends autonomous sessions as SessionType=DIRECTORY with an empty path, relying on the server to generate a scratch directory (same pattern as one-off sessions). CreateSession's path-required guard and its directory-generation logic only special-cased SESSION_TYPE_ONE_OFF, so every autonomous session request was rejected with "path is required" before any autonomous-specific logic ran. Exempt AutonomousMode from the path guard and extend the one-off directory-generation block to also fire when AutonomousMode is true and no path was provided. * fix: guard autonomous-mode sessions from clobbering an explicit path Code review on PR #157 surfaced an asymmetry: the path-required guard exempts AutonomousMode unconditionally, but the directory-generation block only fires when resolvedPath == "". Add a regression test proving an autonomous request with an explicit path keeps that path rather than having it silently replaced by a generated scratch directory, and a one-line comment explaining the guard's AutonomousMode clause. --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update go tier2 baseline [skip ci] * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * feat(backlog): add hard delete for backlog items Adds DeleteBacklogItem RPC that permanently removes an item and all its child records (ReviewVerdicts → ItemSessions → BacklogItem; status_events cascade automatically). Previously only archive (soft-delete) existed. Frontend gets a red Delete button in BacklogItemDetail, always visible regardless of status, with a confirm dialog that closes the panel on success. * chore: update serena project config * chore(sdd): planning artifacts for perf-mutex-hotspots-2026-07 Adds full SDD planning artifacts for the GoGitVCSReader singleflight thundering-herd fix: requirements, 5 research docs, implementation plan, architecture review, adversarial review, pre-mortem, validation, and consistency report. Key decisions recorded: - Separate singleflight.Group per method (diffStatSF, aheadBehindSF, hasUncommittedSF) - entry.mu acquired with defer inside Do body — required for panic safety - Named returns on Do closures so recover() can set the error return - HasUncommitted inner-helper extraction mandatory (eliminates 8 explicit unlocks) - CircularBuffer and IsDirty fixes already shipped; scope reduced to Fix 1 only * feat(perf): add singleflight + hasUncommitted TTL cache to GoGitVCSReader Wraps AheadBehind, DiffShortstat, and HasUncommitted slow paths in per-method singleflight.Group to eliminate thundering-herd entry.mu contention when 4 scanner workers hit the same repo simultaneously. Adds hasUncommittedCache (30s TTL, mirroring diffStatCache) and extracts hasUncommittedGoGitPhase helper to avoid deferred-unlock deadlock on panic. * feat(perf): invalidate IsDirty cache on session Pause and Resume Adds InvalidateDirtyCache() to GitWorktreeManager and the GitManager interface, then calls it on Pause (via defer) and after successful transitionTo(Active) on Resume so the UI always reflects actual worktree dirty state rather than a stale 15s-TTL cached value. * test(perf): add singleflight concurrency and cache tests for GoGitVCSReader Adds three white-box tests to session/unfinished/gogit_vcs_reader_limits_test.go covering Epic 1.3 of perf-mutex-hotspots-2026-07: singleflight collapse of 4 parallel AheadBehind callers, panic-safe error return on bad path, and HasUncommitted cache-hit fast path via pre-populated hasUncommittedCache. * test(perf): rename PanicDoesNotCrashCaller to PanicRecovery per spec * fix(perf): release entry.mu before OS stat walk in HasUncommitted; typed nil returns in Do bodies - hasUncommittedGoGitPhase now returns []trackedFile instead of map[string]bool, releasing entry.mu (via defer) before any os.Lstat calls - OS stat walk moved into HasUncommitted's singleflight.Do body after the lock is released; each early dirty=true return stores to hasUncommittedCache before returning to avoid recomputing within the 30s TTL - trackedFile type promoted to package scope so it can cross the function boundary - All return nil, err in HasUncommitted and AheadBehind Do closures replaced with typed zero values (false / abResult{}) to satisfy singleflight's any return - HasUncommitted doc comment relocated to sit immediately above the function - Removed misleading "lock still held here" comment from hasUncommittedGoGitPhase * fix(perf): rename misleading panic test, add scope comment, move InvalidateDirtyCache post-transition * refactor(perf): generic sfDo helper, defer tw.Close, fix silent walker error, map[string]struct{} - Extract generic sfDo[T] package-level helper that wraps singleflight.Do with panic recovery, replacing identical boilerplate in AheadBehind, DiffShortstat, and HasUncommitted - Wrap CommitMessages slow path in sfDo with commitMessagesSF field to deduplicate concurrent calls and use defer for lock release - Replace explicit tw.Close() calls with defer tw.Close() in hasUncommittedGoGitPhase and diffShortstatUncached - Propagate TreeWalker errors in diffShortstatUncached instead of silently breaking (was swallowed as a no-op) - Change indexedMap and hasUntrackedFiles parameter from map[string]bool to map[string]struct{} for consistency with walkUntracked and to save memory - Add non-re-entrancy comment above diffShortstatUncached call in DiffShortstat * chore(sdd): update validation.md with Phase 4 and spec compliance findings * fix(service): fall back to launchctl load when bootstrap fails on macOS launchctl bootstrap can fail with I/O error (exit 5) on some macOS versions even when the service is not loaded. Mirror the existing bootout→unload fallback pattern for the start path. * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update go tier2 baseline [skip ci] * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * fix(terminal): correctly scan OSC/DCS escape sequences to stop render artifacts (#156) * fix(terminal): correctly scan OSC/DCS escape sequences to stop render artifacts stripANSIBytes and sanitizeUTF8Bytes treated any ASCII letter as the end of an escape sequence. That's only true for CSI (ESC[...letter); OSC (ESC]...BEL or ESC\) and DCS/PM/APC/SOS (ESC{P,^,_,X}...ESC\ or 0x9C) terminate differently, and their payloads (window titles, hyperlink URLs, shell-integration marks) almost always contain a letter before the real terminator. Claude Code's newer renderer emits more of these OSC sequences, so their payload tails were leaking through as literal text in the web terminal and throwing off cursor-column math. Add a shared scanEscapeSequence helper (mirrors the correct boundary logic already used by pkg/analytics/escape_code_parser.go) and rewire both duplicated stripANSIBytes definitions plus sanitizeUTF8Bytes to consume whole sequences atomically instead of stopping at the first letter. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(terminal): widen CSI final-byte range to 0x40-0x7E, cap OSC/DCS scan size Code review on PR #156 found that the new scanCSI only accepted A-Z/a-z as CSI terminators, missing real ECMA-48-valid final bytes like '@' (0x40, Insert Character) and '~' (0x7E, used by many real xterm sequences e.g. function/navigation keys). Confirmed empirically: stripANSIBytes("\x1b[5@Hello") leaked "@Hello" instead of "Hello" — the exact bug class this PR exists to eliminate, just for a different final byte. Widened to the full 0x40-0x7E range and aligned the malformed-CSI fallback with pkg/analytics' semantics (give up and consume only the ESC, rather than swallowing partially-scanned params). Also: - Widened pkg/analytics/escape_code_parser.go's parseCSI terminator range to match (it was cited as the reference implementation for this fix but had the same narrower gap for '~' and other non-letter finals in 0x5B-0x60/0x7B-0x7E). - Added a size cap (mirroring escape_code_parser.go's existing 65536 bound) to scanUntilTerminator so an unterminated/adversarial OSC or DCS payload can't force an unbounded scan. - Pre-size the bytes.Buffer in stripANSIBytes/sanitizeUTF8Bytes with Grow(len(b)) to avoid reallocation growth in this hot path. - Removed the now-vestigial (*StateGenerator).stripANSIBytes wrapper method now that its only caller can use the shared free function directly. - Added regression tests for all of the above, including a mid-buffer (start > 0) case and the new size-cap behavior. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update go tier2 baseline [skip ci] * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * fix(nav): add Feature Flags to navigation menu settingsFeatures route existed but was never registered in NAV_PAGES, making the /settings/features page unreachable from the sidebar. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * docs(claude): prune CLAUDE.md and rule files for token efficiency - CLAUDE.md: removed inline bundling-tmux and concurrency patterns code blocks; replaced with reference links to new .claude/docs/ files - feature-testing-registry.md: removed illustrative TS code blocks (~51% reduction); kept checklists and decision tree - session-creation-registry.md: minor condensation - .claude/docs/bundling-tmux.md: extracted bundling commands - .claude/docs/concurrency-patterns.md: extracted double-checked locking pattern Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update go tier2 baseline [skip ci] * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * feat(backlog): import backlog items from GitHub issues Adds an ImportGitHubIssue RPC that shells out to `gh issue view` to populate title, description, labels, and URL from any GitHub issue, then creates a BacklogItem and optionally triggers auto-triage. Frontend adds a mode toggle to the "New Backlog Item" modal: - Manual: existing BacklogItemForm (unchanged) - Import from GitHub Issue: URL field → ImportGitHubIssue RPC Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update go tier2 baseline [skip ci] * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * chore(main): release 1.34.0 (#158) * Brew formula update for stapler-squad version v1.34.0 * chore(demos): update E2E feature GIFs [skip ci] * chore(sdd): planning artifacts for github-issue-picker * feat(backlog): GitHub issue picker — browse repos and issues to import Adds an interactive two-phase picker (repo selection → issue list) to the backlog import flow, powered by native Go GitHub HTTP client calls instead of gh CLI subprocess invocations. Backend (Epic 1): - github/http_client.go: export GhBaseURL for test injection - github/repos.go: SearchUserRepos, ListRepoIssues domain functions - proto/session/v1/backlog.proto: SearchGitHubRepos + ListGitHubIssues RPCs and supporting message types - server/services/backlog_service.go: handler implementations with input validation and ownerRepoPattern guard - server/services/backlog_github_rpc_test.go: 9 handler tests via httptest.Server interception Frontend (Epics 2–3): - useBacklogService.ts: GitHubRepo, GitHubIssue, GitHubAuthError types and searchGitHubRepos / listGitHubIssues hook methods - lib/utils/issuePickerCache.ts: localStorage TTL cache (5 min) for repos and issues, origin-scoped keys, last-used repo - lib/hooks/useGitHubIssuePicker.ts: two-phase picker state — debounce, generation counter, AbortController, local-repo tier from Redux - components/backlog/GitHubIssuePicker.css.ts: vanilla-extract styles - components/backlog/GitHubIssuePicker.tsx: RepoSelector + IssueList with keyboard nav, ARIA attrs, two-level Escape, auth error state - backlog/page.tsx: replaces URL text input with GitHubIssuePicker Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update go tier2 baseline [skip ci] * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * chore: merge tstapler/main → upstream (20260702) (#159) * refactor(session-types): unify SessionType, promote one_off to proto enum, split config Eliminates three sources of type duplication: 1. config/types.go + config/executor.go extracted from the 1031-line config/config.go (SRP fix — config.go now contains only factory functions and the Config struct) 2. session.SessionType is now a Go type alias for config.SessionType, removing the duplicate type that required aliasSessionTypeToSessionType no-op conversions 3. bool one_off = 14 promoted to SESSION_TYPE_ONE_OFF = 5 in the SessionType proto enum; field 14 is reserved for wire compatibility. All call sites updated: backend handler, workflow scheduler, alias defaults service, and all frontend contexts/hooks/tests. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(headless): use Setsid instead of Noctty for headless runner subprocess WithNoControllingTerminal() sets SysProcAttr.Noctty=true on Linux, which calls ioctl(0, TIOCNOTTY) in the child after fork. This returns ENOTTY when the parent process has no controlling terminal — the case when stapler-squad runs as a systemd service — causing every headless triage call to fail with "fork/exec .../claude: inappropriate ioctl for device" (exit code 1). Replace WithNoControllingTerminal() with WithNewSession() in ProcessRunner.Run. Setsid creates a new process session (implying no controlling terminal) without invoking TIOCNOTTY, so it works regardless of whether the parent has a TTY. Also corrects the misleading comment in managed_process_linux.go that claimed Noctty was safe without a controlling terminal. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(omnibar): replace Create shortcut hint with clickable Create Session button Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(alias): add name_prefix field + fix session name oscillation - Add `name_prefix` to AliasConfig (Go), AliasProto (proto field 12), and AliasEntry (TypeScript) — wired through the full stack - In the detection effect, skip the generic suggestedName update for aliases; the alias block now derives the session name as namePrefix + typedLabel, falling back to namePrefix alone or the alias name — eliminates the oscillation between alias name and prefix+label on each keystroke - AliasesManager settings form now has a Name prefix field with a live preview hint - Create Session button in shortcuts bar uses compact styling on desktop and expands to touch-friendly size on coarse-pointer (mobile) devices Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(detection): detect dynamic workflows + expand turn-marker to ✦ - Add "dynamic workflow" alternate to waiting_for_background_agent pattern so "✻ Waiting for N dynamic workflow(s) to finish" → StatusWaitingForAgent - Expand [✻◉] → [✻◉✦] in verb_duration_completion and waiting_for_background_agent to cover ✦ (U+2726, Claude Code primary spinner) - Add test cases for all three bullet variants on both waiting and completion lines Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(review-queue): show INPUT_REQUIRED items + UX improvements - Fix invisible INPUT_REQUIRED/APPROVAL_PENDING items: deriveWorkingState maps these to PROCESSING, which was being filtered out; now always passes items through when their reason requires user action - Fix workingCount to exclude INPUT_REQUIRED/APPROVAL_PENDING from the "working" tally (they need attention, not patience) - Fix summaryCount grammar ("input neededs", "task completes", "timed outs") by replacing tuple pluralization with per-reason formatter functions - Fix filter empty state: show "no items match" when a filter is active, not the generic "all done" message - Move auto-advance checkbox into the panel title row (was orphaned above the card in page.tsx toolbar div) - Hide floating help button on mobile (keyboard shortcuts are irrelevant on touch devices) - Increase filter button / toggle touch targets to 44px on mobile - Downgrade oldest-item callout from alarming orange to neutral muted style - Show filter toggle whenever any items exist (not only when server totalItems > 0) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(alias): default session type + name oscillation - Fix session type not applying for aliases configured as "Default (directory)": that option stores SessionType.UNSPECIFIED, which the detection effect was explicitly skipping — form stayed at the initial "new_worktree" value instead. Now maps UNSPECIFIED → "directory". - Fix session name oscillating every other keystroke: the generic suggestedName block was running for InputType.Alias results and resetting lastSuggestedNameRef to the alias slug (e.g. "pw"), causing the alias-specific name block to fail its staleness check and alternate on each input event. Fixed by skipping the generic block for Alias inputs entirely — the alias block below handles naming. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * chore(sdd): planning artifacts for review-queue-jump-fix Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(review-queue): suppress auto-advance on session status transitions The "deleted externally" effect in ReviewQueueContent used reviewQueueItems (the filtered visible list) to check if the selected session still existed. When a session transitioned to ACTIVE/PROCESSING, it was filtered from the visible list but remained in the Redux store — the effect incorrectly fired handleAutoAdvance(id, true), jumping to the next queue item immediately after the user opened a session and clicked into the terminal. Fix: use allQueueItems from useReviewQueueContext().items (the unfiltered Redux store) as the existence oracle. A session filtered from the visible queue due to status transition stays in the store and no longer triggers auto-advance. Genuine removals (removeItem Redux events) still fire auto-advance correctly. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(sessions): prevent Claude process orphaning after server restart Three-part fix for tmux session / Claude process accumulation: **Fix 1 — DeleteSession fallback (session_service.go)** When FindLiveInstance returns nil (e.g. server restarted since the session was created, so the in-memory poller is empty), fall back to KillTmuxSessionByTitle which kills by the deterministic tmux session name. Previously the DB record was deleted but the Claude process kept running indefinitely. **Fix 2 — Startup orphan sweep (session/orphan_sweep.go)** ReconcileOrphanedTmuxSessions runs as Step 6d of BuildRuntimeDeps, after the re-adoption passes (6/6b) that hot-attach DB sessions to their live tmux panes. It enumerates all staplersquad_* tmux sessions, reads the STAPLER_SESSION_UUID env var from each, and kills any whose UUID (or sanitized title) has no match in the current workspace DB. The keepalive sentinel is always preserved. **Fix 3 — MCPServerURL backfill (session_service.go)** loadInstancesWithWiring now backfills inst.MCPServerURL from the server's configured URL for sessions created before MCP integration was wired up. Without this, buildLaunchCommand omits --mcp-config entirely and Claude restarts without a session UUID, making it impossible to identify from the process list or MCP request headers. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * fix(lint): return empty map instead of nil in GetAllInstanceArtifacts Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * fix(backlog): harden triage parser and add repoPath UI gate ParseHeadlessTriageResult now uses brace-scan (strings.Index/LastIndex) to tolerate natural-language preamble before the JSON block, fixing silent parse failures on multi-step triage runs. The "Trigger Triage" button in BacklogItemDetail and BacklogItemCard is now disabled with a tooltip when repoPath is not set, preventing the confusing CodeFailedPrecondition server error. Adds 3 new unit tests for the parser and a Playwright e2e gate test that creates an item without repoPath and asserts the button is disabled. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(demos): update E2E feature GIFs [skip ci] * feat(harness): headless triage test harness + alias kebab-case fix Adds a build-tagged Go harness (go:build harness) that exercises the backlog triage feature end-to-end via the ConnectRPC HTTP layer with no browser or UI. Four sub-tests cover distinct phases runnable individually: Gate (repoPath precondition), TriggerAndPoll (async completion), ParserRobust (preamble tolerance), and FullFlow (full user journey). Makefile targets added for each phase. Also converts alias namePrefix label to kebab-case lowercase (spaces/underscores → hyphens) before concatenating with the prefix, so "@ssq My New Feature" produces "ssq-my-new-feature" instead of "ssq-My New Feature". Two new tests added to Omnibar.alias.test.tsx. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(sdd): planning artifacts for nav-redesign Navigation redesign: group 16+ flat nav items into 4 sections (Work, Automation, Insights, Settings & Tools), restore mobile access for 8 currently-hidden routes, and consolidate Settings/Config Files/Features. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(nav): group navigation into 4 sections, restore mobile access Reorganise the 15 nav pages into Work / Automation / Insights / Settings groups rendered in both DrawerNav (desktop sidebar) and BottomNav More sheet (mobile). All 8 routes that were hidden from mobile (Settings, Insights, Logs, Errors, Help, Escape Analytics, Files, Workflows/Rules) are now reachable on every screen size. Removes the redundant Config Files and Features top-level entries; fixes a DrawerNav bug where items were shown regardless of feature-flag state. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * chore: commit in-progress work from previous sessions Includes executor fixes (WithProcessDir support, Linux setsid/Setpgid EPERM fix), backlog triage harness test expansions, rate-limit integration test, Makefile test-triage-real target, and planning artifacts for backlog-triage-e2e-hardening and put-backlog-behind-a-feature-flag-by-default. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: support Antigravity CLI hooks.json format in ssq-hooks * fix(pane): restore session peek modal integration in pane picker * feat(files): wire up the premium LocalFileBrowser component to the files page * chore: commit in-progress work from previous sessions - ssq-hooks: Antigravity CommandLine/Cwd normalization, workspace-aware DB path resolution from cwd, WorkspacePaths fallback - session service: ForkSession fully wired (callbacks, hook config, controller, driver, autonomous mode); ResumeHibernated wires review queue poller and autonomous driver - ent schema: autonomous_mode bool field + generated ORM files - instance_hibernate: start controller + session driver on resume - omnibar: initialTitle prop pre-populates session name; OmnibarContext threads title through openOmnibar(); page.tsx passes ?title param - LocalFileBrowser: CSS and component updates - scripts: find-orphaned-features.py, find-unmerged-commits.py Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(omnibar): replace Create shortcut hint with clickable Create Session button Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(settings): add UpsertAlias and DeleteAlias RPCs with AliasesManager UI Implements full CRUD for alias session presets in Settings > General, removing the need to manually edit config.json. Adds UpsertAlias/DeleteAlias ConnectRPC handlers (case-insensitive name matching, slice-scan upsert, validation via aliasNameRE) and a React AliasesManager component with inline 3-second delete confirmation, env-var editor, tag management, and ARIA accessibility. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(registry): add alias RPCs to scanner methodToID map UpsertAlias, DeleteAlias, ListAliases were missing from the methodToID map, causing the scanner to use fallback raw-name IDs (UpsertAlias, DeleteAlias, ListAliases) instead of canonical kebab-case IDs (alias:upsert, alias:delete, alias:list). This caused Registry Validation CI to fail with 3.36% divergence. Removes the duplicate fallback JSON files from the registry root that were generated under the old behavior. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(analytics): program detail panel with subcommand drill-down Add DB-backed time-windowed analytics queries and an inline program detail panel so operators can see exactly which sub-operations are causing escalations before writing a rule. Backend (Go): - Add compound index on (command_program, created_at) to ent schema - Replace full-table-scan ListAnalytics with time-windowed ListAnalyticsSince (WHERE created_at >= ?) — AC-1, AC-2 - Add GetSubcommandBreakdown aggregation query using ent GroupBy — AC-4 - Add ListRecentCommandsByProgram returning last N command previews — AC-5 - Add GetSubcommandTrend returning per-day counts — AC-6 - Add GetProgramAnalytics ConnectRPC method returning SubcommandBreakdown, ExampleCommands, RuleCoverage, DailyTrend — AC-7 Frontend (React/TypeScript): - New ProgramDetailPanel component with subcommand frequency table (count, %, decision breakdown), example commands, rule coverage summary, trend sparklines, and "Add rule →" links — AC-8 through AC-13 - New useProgramAnalytics hook with AbortController cleanup - ApprovalAnalyticsPanel: clicking program row opens inline detail panel - ApprovalRulesPanel: fix panel crush in flex container (flexShrink: 0), use window.location.search in useEffect for URL param pre-fill (avoids useSearchParams/Suspense issues in Next.js static export) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(backlog): gate backlog behind feature flag on all layers - Frontend layout guard: backlog/layout.tsx redirects to / when flag off - Backend interceptor: FeatureFlagInterceptor wired to BacklogService only - E2E tests: beforeAll/afterAll enable+restore the backlog flag Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: address copilot review comments on analytics drill-down - Fix 1: exclude NULL command_subcategory rows in GetSubcommandBreakdown to avoid sql.ScanSlice scan errors on nullable GROUP BY columns - Fix 2: replace strings.Fields tokenizer in coveredSubcommands() with regexp.Compile + synthetic "<program> <subcommand>" matching so regex-style patterns (e.g. \bgit\b.*\bpush\b) work correctly - Fix 3: add TestGetProgramAnalytics_ReturnsExpectedFields unit test covering window_days=7 and non-nil response fields - Fix 4: add escapeRegex() helper in ApprovalRulesPanel and use it when prefilling commandPattern to avoid metacharacter injection; switch word boundaries from \b to (?:^|\s)/(?:\s|$) for hyphenated program names - Fix 5: add e.stopPropagation() on Suggest Rule button and "add manually" link so clicking them does not toggle the parent <tr> drill-down row - Fix 6: add tabIndex, role=button, aria-expanded, aria-label, and onKeyDown (Enter/Space) to the clickable <tr> for keyboard accessibility - Fix 7: call setData(null) before setIsLoading(false) in error path of useProgramAnalytics to clear stale data on refresh failure - Fix 8: render per-program daily trend sparkline in ProgramDetailPanel; note that trend data is per-program not per-subcommand (backend limit) - Fix 9: thread caller context through LoadProgramWindow, GetSubcommandBreakdown, and ListRecentCommands instead of context.Background() * fix(review-queue): resolve UUID→Title before Remove so approved/deleted sessions leave the queue Queue items are keyed by inst.Title but approval-response and session-deleted events arrive with UUID. resolveQueueKey() looks up the instance via FindInstance (which handles both UUID and Title) and returns Title, falling back to the raw value if the instance is no longer loaded. Also removes duplicate SubcommandDecisionCount declaration in repository.go introduced by the analytics cherry-pick merge. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update go tier1 baseline [skip ci] * chore: sync upstream → personal fork (20260629) (#132) * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * refactor(session): apply type-driven design to buildLaunchCommand Replace the 8x isClaudeProgram bool check with a sealed programKind sum type (claudeProgram / plainProgram). classifyProgram() parses once at the boundary; holding claudeProgram is proof the program invokes claude, so buildClaudeCommand needs zero isClaude guards — they are enforced by the type system, not by runtime checks. - Add programKind interface with claudeProgram / plainProgram variants - Add classifyProgram() smart constructor (parses once; trust downstream) - buildLaunchCommand: switches on type, delegates to buildClaudeCommand or returns plain cmd unchanged - buildClaudeCommand: no guards — the type makes invalid states unrepresentable (a plainProgram can never reach this function) - Extract claudeMCPConfigFlag() helper for the MCP config flag string - TestClassifyProgram: table test for the sum type classification - TestBuildLaunchCommand_PlainProgramIgnoresClaudeFlags: proves that a non-claude program with all claude-related Instance fields set still returns the bare program, enforced by the type routing * feat(backlog): implement CancelTriage RPC and session delete button Adds CancelTriage endpoint that stops any active triage sessions for a backlog item. Wires up the previously-TODO cancel button in BacklogItemDetail and adds a per-session delete button in the session list. * fix(install): skip FDA prompt for non-admin users with cert-signed binary Non-admin users cannot read either TCC database (authorization denied), causing fda_is_granted() to always return false and show the 15s prompt on every reinstall even when FDA is already granted. When all TCC databases exist but are unreadable, fall back to a heuristic: if the installed binary is cert-signed (designated requirement includes "certificate root"), assume FDA was previously granted. The TCC grant is tied to the signing identity (com.stapler-squad + cert), which is stable across rebuilds, so no new grant is needed on reinstall. * perf(tmux): add semaphore to cap concurrent capture-pane subprocesses capturePaneSem (size 8) limits concurrent CapturePaneContent calls to avoid circuit-breaker lock contention and OS process table pressure. Control-mode fast path bypasses the semaphore entirely. * perf(vcs): cache reachableSet results and batch-read blobs under single lock - reachableSetCache (sync.Map, 30s TTL) eliminates O(N) commit walk on repeated calls — was the #1 pprof hotspot (47.4B cycles, 38 events) - diffShortstatUnderLock batch-reads all needed blobs in one lock hold, replacing N lock-acquire/release cycles — was the #2 hotspot (9.87B cycles, 1641 events) * chore(proto): regenerate types bindings after rebase Types were out of sync (DetectedStatus missing from Go/TS bindings) after the CancelTriage commit was rebased onto upstream. * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs…

Add a "Group by" control that bridges ReviewItem to a minimal Session and reuses the existing groupSessions() grouping engine (Category/Tag/Branch/ Program/Status), instead of building a parallel grouping implementation. Filter/sort/group state is now seeded from and persisted to URL query params via the existing useFilterState hook, making the review queue's filtered view shareable/bookmarkable. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* feat(review-queue): combinable multi-select filters, search, and sort Replace mutually-exclusive priority/reason filters with independently toggleable multi-select filters, and add Program/Category/Tag/PR/diverged filter dimensions, free-text search, and sort (priority/age/diff size/name) to ReviewQueuePanel — all client-side over the already-loaded queue. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * feat(review-queue): reuse groupSessions() and useFilterState per AC #2 Add a "Group by" control that bridges ReviewItem to a minimal Session and reuses the existing groupSessions() grouping engine (Category/Tag/Branch/ Program/Status), instead of building a parallel grouping implementation. Filter/sort/group state is now seeded from and persisted to URL query params via the existing useFilterState hook, making the review queue's filtered view shareable/bookmarkable. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(review-queue): debounce search URL writes handleSearchTextChange previously called setUrlFilter (router.replace()) on every keystroke, causing UX jank. Local searchText state still updates immediately for responsive filtering; only the URL write is now debounced ~300ms via a useRef+setTimeout pattern, cleared on unmount and on clearAllFilters to avoid a stale write after clearing. * test(review-queue): cover category/tag/no-pr/diverged filters Category and Tag multi-select filters had zero test coverage. The "No PR" and "Diverged from base" filters were also untested — only "Has PR" was covered previously. * test(review-queue): cover remaining sort fields and grouped action rendering Only ascending name-sort was tested previously. Adds descending direction toggle plus priority/age/diffSize sort fields. Also adds a grouped-rendering test asserting that action buttons (Create PR) and current-item highlighting survive when items are grouped. * test(review-queue): expand URL-persistence coverage Hydration and write-through tests previously covered only 2 of the 11 FILTER_URL_KEYS (priority, q). Extends both tests to also assert category, tag, sort, and group round-trip correctly through the URL. * fix(review-queue): drop NaN values when parsing numeric URL filters parseNumSet() previously kept NaN when hydrating from a non-numeric URL value (e.g. ?priority=abc), producing a non-empty Set(NaN). Since no item's priority ever equals NaN, priorityFilter.size > 0 then filtered out every item instead of ignoring the bad value. Filter to Number.isFinite(n) after parsing so non-numeric input is dropped. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(review-queue): count sort/group-by in active-filter indicator activeFilterCount only summed the filter-dimension sets, so changing Sort or Group-by while leaving all filters untouched showed no active indicator and offered no way to reset via Clear, even though both values are persisted to the URL and reset by clearAllFilters(). Count sortField !== "default" and groupingStrategy !== GroupingStrategy.None so the Clear affordance appears for view-setting changes too. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * perf(review-queue): avoid rebuilding Session objects on every keystroke reviewItemToSession() was invoked for every item in the post-filter/sort `items` array inside groupedItems' useMemo, so the full protobuf Session conversion re-ran on every search keystroke or filter toggle whenever grouping was enabled. Cache the conversion in a Map keyed on the stable unfiltered `allItems` array (only changes on queue refresh), and have groupedItems look up from that cache instead of rebuilding from scratch. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

… and surface an empty-pipeline-modes hint (#178) Closes the two remaining wiring gaps from docs/tasks/backlog-feature-improvement.md's 2026-07-19 audit (bucket [3], Recommended Next Actions #2/#3): - ReviewGateRunner.Run built its prompt via BuildReviewPrompt directly, bypassing PipelineEngine entirely — so a custom PipelineMode's ReviewPromptTemplate had zero effect on the automatic work->review transition most items actually go through (TriagePromptFor/InitialPromptFor/ReviewPromptFor were already wired; this was the one documented, acknowledged gap). Adds PipelineEngine.InteractiveReviewPromptFor, a tool-call-style ("submit_review_verdict") counterpart to the existing JSON-output ReviewPromptFor used by headless callers, and threads pipelineEngine through ReviewGateRunner/NewReviewGateRunner the same way triage/build already route through s.pipelineEngine, with the same nil-safe fallback to BuildReviewPrompt. - BacklogItemForm's pipeline-mode picker and the Settings nav link to /settings/pipeline-modes (commit 54a34cc) were already wired to the real ListPipelineModes RPC, but the fetch-succeeded-with-zero-modes state rendered identically to a broken/unfetched picker — a single "Default" button with nothing to compare it against, exactly the "clicking it does nothing" symptom the audit described from a live deployment with no modes yet authored. Adds a hint + link to Settings when zero enabled modes exist, so the empty state points at the fix. Claude-Session: https://claude.ai/code/session_01BxNAMeGteuzNyN46Q4zAn1 Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

@feature

…detail panel (#208) * chore(sdd): planning artifacts for backlog-item-detail-ux Adds Phase 3 (plan.md) and ADR-027 (Radix Accordion for the shared Collapsible primitive) to the existing requirements.md + research/ artifacts, plus stages the prior phases' outputs that hadn't been committed yet. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H4RHh88D6ax9iUW8vdycg7 * chore(sdd): UX design artifact for backlog-item-detail-ux Phase 3 UX design deliverable: wireframes (desktop + mobile), interaction flows, error/edge-case handling, and 24 testable UX acceptance criteria for the redesigned BacklogItemDetail panel, SessionDiagnosticPanel's 3 synthetic- session sub-states, and the BacklogItemCard blocker chip — consistent with implementation/plan.md's exact component names and behavior. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H4RHh88D6ax9iUW8vdycg7 * chore(sdd): phase 3-4 review artifacts + repair pass for backlog-item-detail-ux Architecture review, adversarial review, pre-mortem, and validation plan, plus plan.md/ADR-027/ux.md edits resolving the 4 blockers, 2 pre-mortem P1s, and triad-review UX gaps found along the way. * feat(backlog): shared primitives for item detail redesign — Collapsible, currentWorkSession, sessionKind, BlockerChip Epic 1.1 of the backlog-item-detail-ux plan: the four reusable building blocks later epics depend on. - Collapsible.tsx: CollapsibleGroup + CollapsibleSection built on @radix-ui/react-accordion (ADR-027) — real <button aria-expanded> headers, collapsed content removed from the DOM, Home/End/Arrow roving-tabindex nav across sibling headers sharing one CollapsibleGroup. - useSectionExpandState: localStorage-backed per-item/per-section expand state, defensive try/catch per RecentFilesSection.tsx's precedent. - currentWorkSession.ts: single getLatestWorkSession()/useCurrentWorkSession() helper replacing 4 independent inline re-derivations in BacklogItemDetail.tsx (D3) that could previously drift out of sync. - sessionKind.ts: closed classifySessionKind() classifier, wired into the Sessions row — fixes the pre-existing dead-link bug where a manual-review-*/diff-error-* session fell through to a clickable <a href="/?session=..."> that was never Instance-backed. - BlockerChip.tsx: shared full/compact "waiting on X" indicator reusing stuckReason.ts's icon/label/duration formatting verbatim. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H4RHh88D6ax9iUW8vdycg7 * feat(backlog): board card status label + blocker chip consistency (Epic 5.1) Give BacklogItemCard.tsx the same "waiting on X" signal the detail view's LifecycleSummary has and the same canonical status vocabulary the Stage Tracker uses: - Story 5.1.0: add a status label (getStatusLabel(item.status)) to the card header, distinct from and in addition to the existing action-button text (getActionSpec() is unchanged). - Story 5.1.1: wire useStuckBacklogItems() once at board/page.tsx level and thread the resolved StuckBacklogItem per item down through BacklogBoard to each BacklogItemCard, which renders the compact BlockerChip in its footer when the item is flagged stuck. cardFooter gains flex-wrap so the chip doesn't overflow on narrow widths. - Story 5.1.2: measured BacklogItemBadge.tsx's list-row width (260px max, single-line, already 3 packed inline elements) and decided to DEFER the compact BlockerChip there — no width budget for a 4th element without truncating the title further. Reasoning recorded in a code comment above the badge's status chip, with a regression test guarding the deferred decision. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H4RHh88D6ax9iUW8vdycg7 * feat(backlog): lifecycle summary header (Epic 2.1) Add StageTracker, BlockerChip integration, and LivenessLine, composed into a single always-visible LifecycleSummary that replaces the old standalone status badge in BacklogItemDetail's header — the single authoritative place lifecycle status is shown (D1). - StageTracker: pure deriveStageDisplay(status) + 5-node stepper. queued/ pr_pending render as modifier badges (never a 6th node); refining folds into Idea; archived renders a dimmed neutral tracker with an "Archived" ribbon overlay rather than guessing the pre-archive stage. - LifecycleSummary: BlockerChip (full variant) renders only when useStuckBacklogItems() flags this item — the hook's own loading-starts- empty and error-retains-last-known contracts mean no special-casing is needed to satisfy "absent = not blocked" and "never a false all-clear." - LivenessLine: deriveLastActivity() picks the max timestamp across linked sessions, statusEvents, and progressNotes, falling back to item.createdAt. Deliberately plain static text (no aria-live) per design/ux.md, since re-announcing on every 5s poll tick would be noise, not help. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H4RHh88D6ax9iUW8vdycg7 * fix(backlog): remount item detail panel on itemId change (Story 3.1.1) Add key={selectedItemId} to BacklogItemDetail's call site in backlog/page.tsx so switching items fully resets per-item UI state (e.g. an open manual-review form) instead of leaking into the next item. board/page.tsx reuses the same route/component and needed no separate fix. Adds regression coverage proving the remount fires on itemId change but not on a same-itemId poll-driven rerender. Epic 3.1, Story 3.1.1 of project_plans/backlog-item-detail-ux. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H4RHh88D6ax9iUW8vdycg7 * refactor(backlog): extract Planning/Reviewing/PullRequest sections (Story 3.1.2) Split BacklogItemDetail.tsx's Planning record, Reviewing (work-session context + GateVerdictBox), and Pull Request blocks into their own sibling components under components/backlog/detail/. Reviewing and Pull Request are Collapsible-wrapped, default-expanded only when the item is in the matching status; Planning stays always-visible (primary content). Also lands the D4 fix: VcsWidgetGithubRow/VcsWidget gain an opt-out showPrLink prop (default true) so PullRequestSection can be the single data source for PR URL text once VersionControlSection wires it up in Story 3.1.4. VcsPanel.tsx and UnfinishedItemDetail.tsx are untouched and keep the default true; regression tests added confirming their rendering is unaffected. Epic 3.1, Story 3.1.2 of project_plans/backlog-item-detail-ux. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H4RHh88D6ax9iUW8vdycg7 * refactor(backlog): extract Description/Actions sections, fix polling gaps (Story 3.1.3) Split DescriptionSection (Collapsible, collapsed by default) and ActionsSection (always-expanded, includes the manual-review form) out of BacklogItemDetail.tsx, preserving every action/manual-review data-testid verbatim. Extends the polling-suspend guard beyond editMode to also cover showManualReview and actionLoading !== null (pre-mortem P1 #4) — a poll firing while the manual-review form is open or an Approve/Override request is in flight could otherwise clobber unsaved input or unmount a section mid-request, risking a double-submit. Also relabels GateVerdictBox's per-criterion list ("Review outcome per criterion") to resolve D2 — it no longer reads as a second, competing acceptance-criteria checklist alongside AcCriteriaList. Epic 3.1, Story 3.1.3 of project_plans/backlog-item-detail-ux. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H4RHh88D6ax9iUW8vdycg7 * refactor(backlog): extract remaining secondary sections, D6 pipeline badge, shared CollapsibleGroup (Story 3.1.4) Splits PlanArtifacts, VersionControl, Sessions, WorkflowHistory, ProgressHistory, and Notes out of BacklogItemDetail.tsx into their own Collapsible sibling components. Adds the shared, localStorage-backed useShowMore hook (Blocker C fix + pre-mortem finding #2 — the "show all" choice persists per item/section across re-opens, not a plain useState that re-collapses on every mount) and applies it to Sessions (cap 5), WorkflowHistory (cap 8), and ProgressHistory (cap 8). Extracts resolvePipelineModeDisplay() to lib/backlog/pipelineModeDisplay.ts so both SessionsSection and the new LifecycleSummary Pipeline badge (D6) share one implementation. Wraps every sibling CollapsibleSection (Reviewing/PullRequest from 3.1.2, Description from 3.1.3, and this story's six) in one shared CollapsibleGroup, with a controlled value/onValueChange backed by useSectionExpandState per section — this is what actually delivers ADR-027's cross-header Home/End/Arrow keyboard-nav justification. ActionsSection/PlanningSection stay outside the group as always- visible primary content; Actions is repositioned before the group (rather than its original position between Description and Plan Artifacts) so the group's Radix Root can be contiguous. Also lands Story 3.1.5's auto-expand-once guard: a status-dependent section's default only applies once, the first time an item's data loads, and never again on a later poll-driven status change — a one-time effect checks for an existing localStorage preference before applying the computed default so a prior visit's collapse choice is never clobbered. Adds beforeEach(() => localStorage.clear()) to BacklogItemDetail's test suites — the new per-section/show-more persistence otherwise leaks expand state across tests reusing the same itemId. Epic 3.1, Story 3.1.4 of project_plans/backlog-item-detail-ux. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H4RHh88D6ax9iUW8vdycg7 * test(backlog): verify auto-expand-once guard survives poll-driven status changes (Story 3.1.5) The initialExpandAppliedRef one-shot effect landed as part of Story 3.1.4's CollapsibleGroup wiring (each status-dependent section's default only applies once, right after an item's first successful load). This adds the three regression tests validation.md calls for directly against the composed BacklogItemDetail tree: - VersionControlSection auto-expands on first mount for an in_progress-status item - a user's manual collapse survives a same-itemId poll tick that returns a fresh item object - ReviewingSection's one-shot default does not retroactively fire when status transitions from idea to review mid-poll without an itemId/key change (the documented "known, intentional exception") Epic 3.1, Story 3.1.5 of project_plans/backlog-item-detail-ux. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H4RHh88D6ax9iUW8vdycg7 * docs(backlog-ux): resolve Story 4.1.1 security review of RunPreGateSecurityCheck Confirmed RunPreGateSecurityCheck's error string only ever embeds a fixed pattern-name label from secretPatterns, never the raw diff or matched secret substring, and that review_gate.go's Sprintf consumer does no further string surgery that could reintroduce it. Adds an automated regression test proving this end-to-end so Story 4.1.3's BlockedNotice can safely render reviewVerdict.summary verbatim. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H4RHh88D6ax9iUW8vdycg7 * feat(backlog): add readOnly mode to TriageReviewPanel and GateVerdictBox Story 4.1.2 (Structured Diagnostic renderer). Adds a readOnly prop to both components that omits their action-button rows (Apply/Skip/Refine and Approve/Reopen/Override/Skip Gate/Re-review respectively) from the DOM while preserving all informational content (summary, suggestions, task list, per-criterion outcomes) — the read-only historical-record presentation Epic 4.1's SessionDiagnosticPanel dispatches Headless Diagnostic Sessions to. TriageReviewPanel's readOnly mode also ignores any pre-existing localStorage dismissal for the item, since a headless diagnostic session's readOnly render shares the same dismissed-flag key as the live interactive panel for that item — a historical record should never be dismissible in the first place. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H4RHh88D6ax9iUW8vdycg7 * feat(backlog): add SessionDiagnosticPanel dispatcher and BlockedNotice Stories 4.1.2 (headless branch) and 4.1.3 (blocked/manual-review branches). SessionDiagnosticPanel routes a classified Synthetic Session to the correct read-only presentation: - headless_diagnostic with triageResult -> TriageReviewPanel readOnly - headless_diagnostic with reviewVerdict -> GateVerdictBox readOnly - headless_diagnostic with neither populated (malformed/partial data) -> BlockedNotice, so this edge case can't reproduce the original inert-row bug for a new case (architecture-review-flagged gap) - blocked_guardrail / manual_review_marker -> BlockedNotice BlockedNotice is the plain-text Blocked-Before-Start Notice (ux.md Surface 4 & 5): role="status", renders reviewVerdict.summary verbatim (safe per Story 4.1.1's security review) with a distinct icon/label per kind, falling back to "No summary recorded." / "No diagnostic data recorded." rather than an empty box. Neither surface offers an "open session" affordance -- there was never a session to open. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H4RHh88D6ax9iUW8vdycg7 * fix(backlog): wire SessionDiagnosticPanel into SessionsSection, fix dead session rows Story 4.1.4. Replaces the inert-span / dead-anchor row-kind branching with a classifySessionKind() switch: "work"/"review" rows keep their existing <a href="/?session=...">, and the 3 synthetic kinds now render as a Collapsible header expanding inline to SessionDiagnosticPanel (fixes the manual-review-*/diff-error-* dead-link bug the Story 1.1.3 classifier identified but Epic 3's mechanical swap left un-wired to a real renderer). Per-row Collapsibles get their own local, uncontrolled CollapsibleGroup rather than joining SessionsSection's ancestor page-level CollapsibleGroup (Task 3.1.4i): that outer group is a controlled Accordion.Root whose `value` only tracks the fixed top-level section-key set, so a row's ephemeral sectionKey would be immediately forced closed again by the controlled prop, and would incorrectly merge dozens of row headers into the page-level Home/End/Arrow nav loop ADR-027 scoped to top-level siblings only. Also drops the old always-visible reviewVerdict preview block for synthetic rows now that the same content renders inside the collapsed diagnostic panel -- it was both a duplicate and defeated the progressive-disclosure default. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H4RHh88D6ax9iUW8vdycg7 * test(backlog): add e2e spec for redesigned item detail panel (Story 6.1.2) Adds backlog-item-detail-redesign.spec.ts covering: Lifecycle Summary visible with zero prior clicks, expanding a top-level Collapsible section, and revealing a synthetic headless-triage session row's TriageReviewPanel readOnly diagnostic. Follows e2e-test-conventions.md: @feature header, data-testid/ARIA locators only, no waitForTimeout. No existing fixture covered a headless-triage-* ItemSession (checked BacklogPage.ts and backlog_debug_seed_handler.go per plan.md's Unresolved Question #3), so adds a minimal handleSeedHeadlessTriageSession debug endpoint mirroring the existing handleSeedQueued/handleSeed pattern, gated to STAPLER_SQUAD_INSTANCE=e2e-local. Type-checked in isolation against the two new files (zero errors); the spec was NOT run against a live server in this environment. * chore(registry): register LifecycleSummary/SessionDiagnosticPanel, mark BacklogItemCard tested (Story 6.1.3) Adds `// +feature:` markers to LifecycleSummary.tsx and SessionDiagnosticPanel.tsx, and per-feature registry files for both under docs/registry/features/frontend/ui/, each with tested:true and testIds populated from their existing test suites. Flips docs/registry/features/frontend/ui/backlog-item-card.json's tested flag to true with Epic 5's new BacklogItemCard.test.tsx case names. make registry-generate: unmatchedBackend unchanged (59 vs 59 pre-change); unmatchedFrontend grows by 2 (37 -> 39), both new entries being the two components just registered here. This growth is a known false-positive in gap-reporter.ts's advisory domain-matching heuristic (it token-splits on "-" and fails to recognize the "domain:feature" marker convention already used throughout this codebase, e.g. the pre-existing "backlog:item-card"/"backlog:item-detail" entries suffer the same false-positive) — not a real untested-feature gap. Every per-feature JSON touched by this change has tested:true with populated testIds; verified via a stash/regen A-B comparison (pre-change: 59/37, post-change: 59/39). * fix(ui): warn when defaultExpanded is silently ignored inside a CollapsibleGroup CollapsibleSectionProps.defaultExpanded had no caveat noting it's a no-op when the section is rendered inside a CollapsibleGroup (the group's defaultValue controls initial open state there instead). Add a JSDoc caveat matching onExpandedChange's existing one, and a dev-mode console warning when a grouped CollapsibleSection sets defaultExpanded and/or onExpandedChange so the silent no-op is caught during development. * fix(backlog): dedupe seed constant, add pipelineModeDisplay tests, fix e2e feature tag - server/services/backlog_debug_seed_handler.go: remove the duplicated headlessTriageSeedUUIDPrefix constant and reference the canonical headlessTriageUUIDPrefix from backlog_service_triage.go instead, so the seed handler can't silently drift from the real prefix. - web-app/src/lib/backlog/pipelineModeDisplay.test.ts: add missing test coverage for resolvePipelineModeDisplay's 4 branches (default snapshot, unrecognized slug, drifted hash, not-drifted with both empty and matching hash). - tests/e2e/backlog-item-detail-redesign.spec.ts: replace the ad hoc `backlog:item-detail` @feature tag with the actual registered kebab-case frontend feature ids (backlog-item-detail-lifecycle-summary, backlog-item-detail-diagnostic-panel) and register this spec's test names in both features' testIds arrays. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H4RHh88D6ax9iUW8vdycg7 * refactor(backlog): dedupe ActionButtonLabel/formatDate/showMoreButton, trim ActionsSection props Code review follow-ups from the backlog-item-detail-ux Epic 3 extraction: - Remove BacklogItemDetail.tsx's now-dead local ActionButtonLabel — every JSX call site moved into extracted sibling components. - Extract the 3x-duplicated ActionButtonLabel into a single detail/ActionButtonLabel.tsx, imported by ActionsSection, PullRequestSection, and NotesSection. - Extract the 4x-duplicated formatDate helper into lib/backlog/formatDate.ts (verified no existing datetime/timestamp util has a compatible ISO-string signature), imported by BacklogItemDetail, SessionsSection, WorkflowHistorySection, and ProgressHistorySection. - Extract the byte-identical showMoreButton vanilla-extract style, triplicated across ProgressHistorySection.css.ts, SessionsSection.css.ts, and WorkflowHistorySection.css.ts, into a shared detailShared.css.ts. - Move ActionsSection's 4 pure item-derivations (canSpawnSession, canRunAutonomously, canShipPR, acAllComplete) from the parent into local consts inside ActionsSection itself, dropping its prop count from 15 to 11 (under the 12-prop lint threshold) with no behavior change. All 9 tracked data-testids preserved verbatim. tsc --noEmit and the targeted Jest suite (BacklogItemDetail|ActionsSection|PullRequestSection| NotesSection|SessionsSection|WorkflowHistorySection|ProgressHistorySection) pass. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H4RHh88D6ax9iUW8vdycg7 * refactor(backlog): remove dead ActionButtonLabel and import shared helpers Second half of the code-review-follow-up commit (0830114 already added the shared detail/ActionButtonLabel.tsx, lib/backlog/formatDate.ts, and detail/detailShared.css.ts) — this wires the consumer files to use them instead of their local copies: - BacklogItemDetail.tsx: delete dead local ActionButtonLabel, use shared formatDate. - ActionsSection.tsx, PullRequestSection.tsx, NotesSection.tsx: import shared ActionButtonLabel instead of each defining their own copy. - SessionsSection.tsx, WorkflowHistorySection.tsx, ProgressHistorySection.tsx: import shared formatDate. - Their .css.ts files: re-export showMoreButton from detailShared.css.ts instead of redefining the byte-identical style block. - ActionsSection.tsx: compute canSpawnSession/canRunAutonomously/ canShipPR/acAllComplete locally from the item prop instead of taking them from the parent, dropping its prop count from 15 to 11. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H4RHh88D6ax9iUW8vdycg7 * refactor(backlog): readOnly as discriminated union on GateVerdictBox/TriageReviewPanel GateVerdictBoxProps and TriageReviewPanelProps kept readOnly?: boolean as a flag while their write-mode callback props (onApprove/onReopen/onOverride/ onSkipGate, onApply/onSkip) stayed required. This forced the sole readOnly consumer, SessionDiagnosticPanel, to fabricate never-called noopSync/ noopAsync/noopAsyncWithArg stand-ins just to satisfy the type checker, leaving the "wire a real callback through the readOnly branch" mistake uncaught at compile time. Convert both prop types to a discriminated union on readOnly: true (no callbacks) vs readOnly?: false (callbacks required). SessionDiagnosticPanel now passes zero callback props in its readOnly branch — the compiler enforces it instead of noop props masking it. Internal handlers narrow via an isReadOnlyProps type guard and early-return when a callback isn't present, mirroring the existing optional-onReReview pattern. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H4RHh88D6ax9iUW8vdycg7 * fix(ui): stop defaultExpanded-in-group warning from firing on BacklogItemDetail's own correct usage 1d8b6cd added a dev-mode console.warn in CollapsibleSection for any grouped section receiving a truthy defaultExpanded, but every one of BacklogItemDetail's 8 grouped sections legitimately passes defaultExpanded={<key>Expanded} — the same state that also drives the CollapsibleGroup's own `value` via sectionExpandEntries/openSectionKeys. That made the warning fire on every normal render, crying wolf and burying genuine misuse in noise. CollapsibleGroup now threads its resolved open-key set (value, or defaultValue when uncontrolled) through context, and CollapsibleSection only warns when a truthy defaultExpanded actually diverges from what the group says that section's state is — redundant-but-consistent usage (this codebase's actual pattern) no longer warns; genuine mismatches still do. Adds a regression test rendering BacklogItemDetail with every optional grouped section mounted (status "review", VCS data present) and asserting console.warn is never called, including after a toggle. * test(backlog): add coverage for GateVerdictBox's UNVERIFIABLE verdict PR #208 review flagged that no test exercised verdict="UNVERIFIABLE" — neither the conditional "Re-run Gate" button (gated on onReReview), its click handler, nor the Reopen/Override affordances for that verdict. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H4RHh88D6ax9iUW8vdycg7 * fix(backlog): useShowMore now shows the most recent N items, not the oldest items.slice(0, cap) returned the FIRST cap elements, but every caller (SessionsSection, WorkflowHistorySection, ProgressHistorySection) passes data in ascending createdAt order from the backend (ent.Asc(FieldCreatedAt) in session/ent_repository_backlog.go and session/storage_backlog.go), so the default view showed the OLDEST triage/event/note noise instead of the most recent work — the exact inverse of Epic 3.4 / Blocker C's intent for chronically-stuck items. Switch to items.slice(-cap) to take the tail while preserving ascending display order. Strengthens regression tests across useShowMore and its three consumers to assert the IDENTITY of visible items (most-recent present, oldest absent pre-expand; oldest present post-expand), not just their count, since a count-only assertion is exactly what let the head/tail bug ship silently. * docs(backlog): correct BlockedNotice's security-review scope claim, add diff-error test BlockedNotice.tsx's doc comment claimed a blanket "confirmed security review" for all blocked_guardrail summaries, but classifySessionKind maps two distinct backend paths to that kind: review-blocked-* (built from RunPreGateSecurityCheck, actually covered by Story 4.1.1's test) and diff-error-* (built from GetGitDiffRef's wrapped command error, never audited or tested). Names both paths explicitly and adds a regression test proving GetGitDiffRef's error never embeds command stderr/diff content, so a future change to its error wrapping would be caught before reaching this now-more-discoverable UI surface. * test(backlog): replace tautological mapBacklogItem tests with real coverage TriageReviewPanel.test.tsx's mapBacklogItem_triageStatus_* tests hardcoded triageStatus on a hand-built BacklogItem literal and then asserted against that same literal — a tautology that could never fail regardless of what mapBacklogItem actually does. Export mapBacklogItem from useBacklogService.ts and add useBacklogService.test.ts, which feeds it realistic proto-shaped BacklogItem/ItemSession/TriageResult fixtures and asserts on the derived output, covering: no triage session, running, orphan-detected failed (item advanced past "idea" without endedAt), ended-without-result failed, ended-with-empty-summary failed, completed, and most-recent-session selection when multiple triage sessions exist. * refactor(backlog): LifecycleSummary receives stuckItem as a prop instead of polling independently LifecycleSummary called useStuckBacklogItems() directly, standing up its own transport/client and 60s poll on every render. Since BacklogItemDetail remounts via key={selectedItemId} on every backlog item click, this fired a fresh ListStuckBacklogItems RPC unrelated to the clicked item, and would duplicate polling if a future page ever rendered BacklogBoard and BacklogItemDetail together. BacklogItemDetail now calls useStuckBacklogItems() once, resolves the .find(i => i.itemId === item.id) match itself, and passes the result down to LifecycleSummary as a plain stuckItem prop — mirroring the single-fetch pattern board/page.tsx -> BacklogItemCard already establishes for the board view. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H4RHh88D6ax9iUW8vdycg7 * fix(web): sync pnpm-lock.yaml with @radix-ui/react-accordion dependency The dependency was added via npm (package.json + package-lock.json) but this repo's CI uses `pnpm install --frozen-lockfile`, which fails immediately when pnpm-lock.yaml doesn't match package.json — breaking every frontend CI job (Build, Lint, UX Analysis, Registry Validation, Frontend Bundle Size). --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

…ck (#272) * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * fix(unfinished): stack GitHub auth banner vertically so Connect button is always visible Button was pushed off-screen on narrow viewports due to flex-row layout with flexGrow:1 on the text. Switch to column direction so the button always renders below the error message. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(demos): update E2E feature GIFs [skip ci] * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * feat(pr-status): show PR badge in row mode and use go-git for branch detection Show GitHubBadge inline in SessionRow (row/list view) so PR status is visible without switching to card view. Previously the badge only rendered in SessionCard (card view). Switch getCurrentBranchName from subprocess (git rev-parse) to go-git direct file read — no subprocess overhead. Add exported GetCurrentBranchName wrapper and CurrentBranch() method on Instance that falls back to live git read for directory sessions (Branch field is always empty for non-worktree sessions). Add UpdatePRStatus() helper for atomic in-memory PR status updates from PRStatusPoller. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * fix: repair broken release pipeline and build-from-source path (#147) * fix: repair broken release pipeline and build-from-source path Every GoReleaser release since v1.9.0 has failed with "found 3 builds with the ID 'stapler-squad'" because none of the three build entries in .goreleaser.yaml declared an explicit id, so GoReleaser assigned them all the same default. This is why brew install pulls the ancient 1.9.0 build (Formula/stapler-squad.rb hasn't updated since) and why install.sh's release-asset download has had nothing to fetch for every tag from v1.20.1 through v1.32.0. Give each build block an explicit unique id. Also fixes two things blocking the build-from-source path: - config/executor.go: lookPathOnlyExecutor.Command used a raw exec.Command instead of safeexec.CommandContext, tripping the norawexec custom lint rule and failing `make build` outright. - Makefile: `go build` never set the version ldflag, so both `make build` and plain `go build .` reported the stale hardcoded "1.1.2" regardless of what was actually built. Derive VERSION from `git describe` and pass it via -ldflags, matching what GoReleaser already does for tagged releases. Verified locally: `make build` now succeeds end-to-end and `./stapler-squad version` reports the real git-described version. `goreleaser check` and a full `goreleaser release --snapshot --clean` (with the GITHUB_* env vars CI provides) both succeed, including Homebrew formula generation. Fixes #143 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix: isolate TestGetConfigDir from ambient STAPLER_SQUAD_* env vars GetConfigDir() checks STAPLER_SQUAD_TEST_DIR and STAPLER_SQUAD_INSTANCE before falling through to test-mode auto-detection. When the test process inherits either from its environment (e.g. running inside a stapler-squad-managed session), the "uses test mode isolation for tests" subtest short-circuits on the ambient value instead of exercising auto-detection, and fails. Clear both for the duration of the subtest and restore them afterward. Verified with `go test ./config/... -run TestGetConfigDir -count=3` and a full `go test ./config/... -count=1`. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix: sanitize VERSION and wire it into build-embedded too Code review on this branch surfaced two real gaps in the version-ldflag fix: 1. Security: git tag names may legally contain shell metacharacters (backtick, $()). Make's $(VERSION) substitution is pure text substitution done before the shell parses the recipe line, so those characters land as live shell syntax inside the double-quoted `-ldflags` argument — anyone who can get a maliciously-tagged ref fetched into a checkout gets command execution on `make build` / `make install-service`. Strip VERSION to a safe charset before it ever reaches the shell. (Checked whether the analogous `VERSION=$(git describe ...)` in .github/workflows/build.yml has the same problem: it doesn't. That's a bash variable expansion of an already-computed string, not a macro substitution before the shell parses the command — bash does not re-evaluate `$()`/backticks embedded in an expanded variable's value. Verified empirically. Left that file alone.) 2. Completeness: `build-embedded` (the tmux-bundled single-binary target used by `make build-tmux` -> `make build-embedded`) builds the same stapler-squad binary as the primary `stapler-squad` target but wasn't wired to the new LDFLAGS, so it would have kept shipping the exact stale "1.1.2" version string issue #143 complains about. Verified: `make build` still succeeds and reports a correct, sanitized version. `make -n build-embedded` confirms the ldflags now appear in that target's go build invocation. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * ci: add goreleaser check as a regression guard for .goreleaser.yaml The build-ID collision this PR fixes broke every release for 15+ months with zero visibility: the only place it ever surfaced was a failed Action run on a tag push (release.yml only runs `goreleaser release` on `push: tags: v*`), which nobody was watching closely enough to catch. Add a small, fast, dedicated workflow that runs `goreleaser check` on every change to .goreleaser.yaml, so a config mistake like this one fails a PR check immediately instead of silently breaking every subsequent release. `goreleaser check` also fails non-zero for known-but-accepted deprecation warnings, not just genuine invalidity, so a naive `args: check` step would have gone red on day one against this repo's existing config (it still uses the classic `brews` publisher, which GoReleaser wants migrated to `homebrew_casks` — a real behavioral change for end users, not a syntax rename: casks use different install semantics, code-signing/Gatekeeper expectations, and app-bundle lifecycle hooks that don't apply to a plain CLI binary, and would very likely break the `brew install` command this repo's README documents. That migration needs its own careful, tested PR, not a blind swap bundled into an install-bug fix). Fixed the two safe, pure-syntax deprecations in the same commit (`archives.format`/ `format_overrides.format` -> `formats`, now a list — verified via a full snapshot build that archive naming/extension per-OS is unchanged) and left `brews` alone. The new workflow's check step distinguishes "configuration is invalid" (hard fail) from "valid, but uses deprecated properties" (pass, tracked separately) by output content rather than exit code, so it stays a real regression guard instead of either being permanently red on accepted debt or silently disabled. Verified locally: - `goreleaser check` on the current config: valid, only the accepted `brews` deprecation remains. - Simulated the exact original bug (duplicate build ids) against a scratch copy of the config: the same check logic correctly reports "configuration is invalid" and would fail CI. - Full `goreleaser release --snapshot --clean` still succeeds end-to-end after the formats-list migration, archive names/ extensions unchanged. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix: sync registry validation with github_user.proto and add missing feature files CI's Registry Validation check was failing on this PR (unrelated to the actual fix, but blocking it from going green): `tools/scanner/validate-registry.sh` never scans `proto/session/v1/github_user.proto`, even though the Makefile's `registry-generate-backend` target does. Both were last touched independently, and the validation script's hardcoded proto list was never updated when github_user.proto's RPCs (added in 3be7e0902, well before this branch existed) were registered. The result: `docs/registry/features/backend/*.json` never had entries for ListGitHubAccounts/PollGitHubDeviceAuth/RevokeGitHubToken/ StartGitHubDeviceAuth, and the validation script would report them as "Removed RPCs" (154 committed vs. 147 generated, 4.55% divergence) forever, regardless of whether the per-feature files existed — the scanner it runs simply never looks at that proto file. - Added the missing `github_user.proto` scan step to validate-registry.sh, matching the Makefile. - Ran `make registry-generate` to create the 4 missing per-feature JSON files these RPCs were always supposed to have. Verified: `./tools/scanner/validate-registry.sh` now reports "Committed: 154 Generated: 154 Divergence: 0.0%" and exits 0. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> * chore(main): release 1.33.0 (#145) * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * Brew formula update for stapler-squad version v1.33.0 * chore(demos): update E2E feature GIFs [skip ci] * fix: backlog/triage sessions die on launch (shell injection + flag-parsing crash) (#150) * fix: shell-quote claude launch args to stop injection and flag-parsing crash Backlog/triage spawned sessions died on launch: the prompt is interpolated into a shell command (tmux launches programs through a shell), and Go's %q produces double quotes, which do not suppress backtick/$(...)/$VAR expansion. Backlog prompts are full of backtick-wrapped tokens (`/backlog/done-N`, etc.), so the shell executed each as a command instead of passing it to claude. Separately, backlog prompts begin with "--- BACKLOG ITEM DATA ---", which claude's arg parser rejected as an unrecognized flag once quoting was fixed. Add shellQuote (POSIX single-quoting, the same style already used for --mcp-config) and apply it to every claude flag value that gets interpolated into the shell command: --append-system-prompt, --allowedTools, --permission-mode, and the positional prompt. Insert a bare "--" before the prompt so a leading "--" in the prompt text is treated as data, not flags. Verified against the real claude CLI that both -- as an end-of-options separator and --append-system-prompt-file are accepted, and confirmed via a real shell execution that a $(...) payload in a backlog-shaped prompt no longer executes. Fixes #148 * fix: close remaining shell-injection gaps found by review Multi-agent review of the shellQuote fix found the same vulnerability class still present two call sites over: - --resume value: claudeSessionID traces back to the client-supplied resume_id field on CreateSessionRequest with no format validation, and was still interpolated unquoted into the shell-executed launch command in the same function that was just patched. - claudeMCPConfigFlag hand-rolled its own shell single-quoting (a literal '...' wrapper) instead of reusing shellQuote, leaving a second, untested implementation of the same job living next to the new one. Not currently exploitable (MCPServerURL/UUID aren't attacker-supplied today) but a latent gap in the same file that just added the primitive meant to prevent this. Also add regression tests the review flagged as missing: --allowedTools and --permission-mode had zero shell-safety coverage even though shellQuote was applied to both, so a partial revert of just those two lines would have passed the full suite silently. Reworked the two existing Prompt/AppendSystemPrompt regression tests to assert against hand-written expected literals instead of calling shellQuote() again, so they don't just verify the function against itself. Added only-single-quote, embedded-newline, and combined backtick+quote cases to TestShellQuote's table. Confirmed session/claude_command_builder.go's separate --resume path is not affected: it validates the session ID against a strict UUID v4 regex before use, and is not wired into any production call site today. --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * fix(analytics): escape analytics session_id mismatch and dead mangle detection (#149) * fix(analytics): escape analytics session_id mismatch and dead mangle detection Escape event rows were tagged with the tmux session name instead of the stable session UUID, so the web UI (which queries by stable UUID) never found any data even though capture itself was working (185K+ rows in the live DB). Mangle detection was fully implemented and unit-tested but never wired into production — SetCorrelator was never called, emitEventWithStageAndSeq always recorded Stage 1 observations instead of checking Stage 2 against them, and the Stage 2 tap computed session_seq from the wrong buffer offset. - Thread instance.GetStableID() into the escape parser via a new ResponseStream.SetStableSessionID, scoped narrowly so cc.sessionName's other use sites (PTY naming, persistence dirs, rate limiting) are untouched - Wire MangleCorrelator per-parser with its eviction loop tied to stream lifetime; branch RecordStage1 vs CheckStage2 by stage instead of always recording - Fix Stage 2 session_seq to use the coalesced frame's start offset, not its end offset, so it aligns with Stage 1's numbering - Convert totalSequences/totalMangled to atomic.Int64 (both stages write through the same parser instance from different goroutines) - Mirror escape analytics defaults into DefaultConfig() to match LoadConfigFromPath, per the existing "must mirror" comment Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(analytics): redesign mangle correlation to be offset-independent Code review on PR #149 found the byte-offset arithmetic fix for Stage 2 correlation couldn't work regardless of the arithmetic: streamViaControlMode's data comes from a separate tmux control-mode client, not the same producer as Stage 1's raw PTY read, so the two sides have no shared byte-offset numbering. Verified empirically (live tmux experiment with two simultaneous client attachments) that the two streams carry identical content in the same order, just offset by a constant that resets on each client's own connect/resize redraw — a calibration problem, not a content mismatch. Redesigned MangleCorrelator to correlate ordinally per (session, sequence type) instead of by byte position, which is robust to that offset entirely. Also addresses the review's MAJOR findings: sessionID is now atomic.Pointer[string] instead of an unsynchronized plain string; the parser setter is renamed SetStableSessionID to stop colliding with a tmux-name-keyed SetSessionID called 4 lines away; the correlator eviction goroutine is now tracked by ResponseStream's WaitGroup (so Stop() actually blocks on it) and panic-recovered; and the production wiring line in ClaudeController.Start() now has a test that would catch a regression back to the tmux name. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * chore: restore .claude/scheduled_tasks.lock accidentally deleted in prior commit Unrelated to this PR's changes — an environment-local lock file got staged as deleted before this session started and was swept up by a non-path-scoped git commit. Restoring it to match origin/main. --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> * fix(backlog): GitHub URL repo-path support, first-visit tour, and two related bugs (#152) * fix(backlog): resolve GitHub URLs in repo path, add first-visit tour The Repository Path field silently accepted a GitHub URL and used it verbatim as a filesystem path, producing garbage paths and silent triage failures (stapler-squad#148's "Related" section). It also had no guidance on what it expected, so users had no way to know a URL wasn't a valid local path. - BacklogService now resolves GitHub URLs/shorthand in repo_path to a local clone (same machinery CreateSession already uses for the Omnibar), or returns a clear validation error instead of storing garbage. Covers both CreateBacklogItem and the UpdateBacklogItem fix-up path. - RepoPathInput gained an optional hint line and live GitHub-URL detection ("Will clone owner/repo to ~/.stapler-squad/repos/..."). - BacklogItemForm explains the two previously-unlabeled checkboxes and shows "Cloning repository…" while a fresh clone is in flight. - New BacklogTourModal walks first-time visitors through the item lifecycle, the repo-path gotcha explicitly, and what the skip flags do; reopenable via a "?" button in the page header. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix: shell-quote claude launch prompts, stop triage poll from losing edits Two backlog-adjacent bugs Carl filed while debugging the repo-path issue above: - stapler-squad#148: backlog/triage session prompts were interpolated into the shell command with Go's %q (double quotes), so backtick- wrapped tokens and $(...) in the auto-generated prompt were executed by the shell, and a leading "--" was parsed as a claude CLI flag — spawned sessions died on launch. Now single-quoted (shellQuote, which suppresses all shell expansion) with a "--" separator before the prompt. - stapler-squad#146: BacklogItemDetail's full-screen loading guard unmounted <BacklogItemForm> on every 5s triage-status poll, so any unsaved acceptance criteria typed during triage were silently discarded. The loader now only shows on the initial load, and the poll is suspended while the edit form is open. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * chore(e2e): install missing test deps, extend server-boot timeout allure-playwright (declared in package.json) was missing from the committed node_modules, breaking `npx playwright test` outright. Installed it and its transitive deps. Also bumped the test-server health-check timeout from 30s to 90s: a cold test-mode boot (DB init + demo seeding) was observed taking ~30-45s before /health responds, right at the old cap. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * revert(e2e): don't commit node_modules lock manifest without the packages The previous commit updated .package-lock.json (npm's per-tree manifest) after `npm install` pulled in allure-playwright and ~350 transitive deps, but those package directories are gitignored and weren't force-added — committing just the manifest without the actual files would claim the tree is in sync when it isn't. tests/e2e/node_modules is vendored (git-tracked despite .gitignore), so fully fixing the missing-dependency gap means force-adding ~thousands of new files, which is out of scope for this PR. Leaving the test-server.ts timeout bump from the previous commit in place since that's independently correct; flagging the vendoring gap separately. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix: address code review findings (shell-quote gap, tour checkbox bug, path traversal) Multi-dimension code review (Testing, Code Quality, Architecture, Security) on PR #152 surfaced two CRITICALs, both cross-validated by 2-3 independent reviewers, plus several MAJOR issues: - CRITICAL: AllowedTools/PermissionMode in instance_tmux.go still used Go's %q instead of the new shellQuote — the exact same shell-injection class this PR fixes for AppendSystemPrompt/Prompt, just on two sibling fields populated directly from client RPC input. - CRITICAL: BacklogTourModal's "Don't show this again" checkbox was a no-op — onClose (mapped to setTourComplete) unconditionally persisted onboarded=true regardless of the checkbox state. Fixed by changing the modal's callback contract to onComplete(persist: boolean), with a new hideTour() on the hook for the non-persisting path. - MAJOR (security): GitHub owner/repo regexes in repo_path.go didn't reject "." / ".." segments, so a crafted repo_path could resolve the clone directory outside ~/.stapler-squad/repos/github.com/. Added an isTraversalSegment guard across all 4 parse branches. - MAJOR: hardcoded 24px margin replaced with the vars.space token; extracted BacklogTourModal's reused modal-chrome styles out of OnboardingModal's own CSS module into a new shared components/ui/ModalTour.css.ts (OnboardingModal re-exports from it, so OnboardingModal.tsx needed no changes). - MAJOR (testing): replaced two circular shellQuote()-derived test oracles with hardcoded literals, added a message-content assertion the Update-path resolver-error test was missing, and strengthened the poll-suspended-while- editing test to assert the actual unsaved acceptance criterion survives rather than just checking a fetch call count. Deferred (documented, not blocking): DRY duplication between backlog_service.go/session_service.go's GitHub resolution, a matching hardcoded path format in the frontend hint text, and the pre-existing synchronous-clone-in-RPC-handler pattern this PR extends to a second call site (mirrors existing CreateSession behavior). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * fix: web-build target doesn't generate proto bindings on a clean clone (#155) * fix: make web-build generate proto bindings on a fresh clone `make web-build` builds `web-app/out` without depending on `proto-gen`, so a clean checkout fails with "Module not found: '@/gen/session/v1/session_pb'" because the TypeScript protobuf bindings were never generated. `make build` was unaffected since it lists `proto-gen` as a direct prerequisite of the top-level target. Add `proto-gen` as a prerequisite of `web-app/out` so the TS bindings exist before the Next.js build runs, regardless of which entry point is used. `proto-gen` is a no-op when the bindings are already up to date, so this doesn't slow down repeat builds. Fixes #144 (Bug 1). Bug 2 (go-m1cpu SIGSEGV) is already resolved — the repo depends on gopsutil/v4, which dropped the go-m1cpu cgo dependency. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * test: add CI smoke test for standalone `make web-build` The existing CI pipeline never exercises the Makefile's own dependency graph: `.github/actions/prepare` hand-runs `buf generate` and `pnpm run build` directly, bypassing `make` entirely. That's exactly why the missing `proto-gen` prerequisite on `web-app/out` (previous commit, fixes #144) went undetected - no CI job ever invoked `make web-build` or `make build` as a fresh clone would. Add a standalone job that checks out cleanly (no shared artifacts, no manual buf/pnpm pre-steps) and runs `make web-build` directly, then asserts the generated TS proto bindings exist. Verified this job's steps fail against the pre-fix Makefile with the exact reported error ("Module not found: '@/gen/session/v1/session_pb'") and pass against the fix. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * chore: untrack stale generated proto files that were force-committed gen/, web-app/src/gen/, and .proto-gen.stamp are already in .gitignore, but 19 generated files under gen/proto/go/session/v1/ and web-app/src/gen/session/v1/ were force-committed into git anyway (going back through at least PR #60, #51, #54) and never cleaned up. The tracked set was also incomplete/stale - e.g. session.pb.go and session_pb.ts (generated from session.proto, the largest proto file) were never committed at all, while sessionv1connect/session.connect.go (which references types defined in session.pb.go) was. This is exactly what produced the "undefined: v1.CreateSessionRequest" compile errors and "Module not found '@/gen/session/v1/session_pb'" webpack errors in #144 on any workflow that skipped `proto-gen` - the stale committed files gave inconsistent partial signals instead of a clean "not generated yet" failure. `git rm --cached` only removes them from the index; the working-tree copies (freshly regenerated by `make web-build` in the previous commits) are untouched, and .gitignore now actually takes effect for this tree going forward. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> * chore(main): release 1.33.1 (#153) * chore(demos): update E2E feature GIFs [skip ci] * Brew formula update for stapler-squad version v1.33.1 * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update go tier2 baseline [skip ci] * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * fix: autonomous sessions rejected with "path is required" via omnibar (#157) * fix: autonomous sessions rejected with "path is required" via omnibar The omnibar sends autonomous sessions as SessionType=DIRECTORY with an empty path, relying on the server to generate a scratch directory (same pattern as one-off sessions). CreateSession's path-required guard and its directory-generation logic only special-cased SESSION_TYPE_ONE_OFF, so every autonomous session request was rejected with "path is required" before any autonomous-specific logic ran. Exempt AutonomousMode from the path guard and extend the one-off directory-generation block to also fire when AutonomousMode is true and no path was provided. * fix: guard autonomous-mode sessions from clobbering an explicit path Code review on PR #157 surfaced an asymmetry: the path-required guard exempts AutonomousMode unconditionally, but the directory-generation block only fires when resolvedPath == "". Add a regression test proving an autonomous request with an explicit path keeps that path rather than having it silently replaced by a generated scratch directory, and a one-line comment explaining the guard's AutonomousMode clause. --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update go tier2 baseline [skip ci] * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * feat(backlog): add hard delete for backlog items Adds DeleteBacklogItem RPC that permanently removes an item and all its child records (ReviewVerdicts → ItemSessions → BacklogItem; status_events cascade automatically). Previously only archive (soft-delete) existed. Frontend gets a red Delete button in BacklogItemDetail, always visible regardless of status, with a confirm dialog that closes the panel on success. * chore: update serena project config * chore(sdd): planning artifacts for perf-mutex-hotspots-2026-07 Adds full SDD planning artifacts for the GoGitVCSReader singleflight thundering-herd fix: requirements, 5 research docs, implementation plan, architecture review, adversarial review, pre-mortem, validation, and consistency report. Key decisions recorded: - Separate singleflight.Group per method (diffStatSF, aheadBehindSF, hasUncommittedSF) - entry.mu acquired with defer inside Do body — required for panic safety - Named returns on Do closures so recover() can set the error return - HasUncommitted inner-helper extraction mandatory (eliminates 8 explicit unlocks) - CircularBuffer and IsDirty fixes already shipped; scope reduced to Fix 1 only * feat(perf): add singleflight + hasUncommitted TTL cache to GoGitVCSReader Wraps AheadBehind, DiffShortstat, and HasUncommitted slow paths in per-method singleflight.Group to eliminate thundering-herd entry.mu contention when 4 scanner workers hit the same repo simultaneously. Adds hasUncommittedCache (30s TTL, mirroring diffStatCache) and extracts hasUncommittedGoGitPhase helper to avoid deferred-unlock deadlock on panic. * feat(perf): invalidate IsDirty cache on session Pause and Resume Adds InvalidateDirtyCache() to GitWorktreeManager and the GitManager interface, then calls it on Pause (via defer) and after successful transitionTo(Active) on Resume so the UI always reflects actual worktree dirty state rather than a stale 15s-TTL cached value. * test(perf): add singleflight concurrency and cache tests for GoGitVCSReader Adds three white-box tests to session/unfinished/gogit_vcs_reader_limits_test.go covering Epic 1.3 of perf-mutex-hotspots-2026-07: singleflight collapse of 4 parallel AheadBehind callers, panic-safe error return on bad path, and HasUncommitted cache-hit fast path via pre-populated hasUncommittedCache. * test(perf): rename PanicDoesNotCrashCaller to PanicRecovery per spec * fix(perf): release entry.mu before OS stat walk in HasUncommitted; typed nil returns in Do bodies - hasUncommittedGoGitPhase now returns []trackedFile instead of map[string]bool, releasing entry.mu (via defer) before any os.Lstat calls - OS stat walk moved into HasUncommitted's singleflight.Do body after the lock is released; each early dirty=true return stores to hasUncommittedCache before returning to avoid recomputing within the 30s TTL - trackedFile type promoted to package scope so it can cross the function boundary - All return nil, err in HasUncommitted and AheadBehind Do closures replaced with typed zero values (false / abResult{}) to satisfy singleflight's any return - HasUncommitted doc comment relocated to sit immediately above the function - Removed misleading "lock still held here" comment from hasUncommittedGoGitPhase * fix(perf): rename misleading panic test, add scope comment, move InvalidateDirtyCache post-transition * refactor(perf): generic sfDo helper, defer tw.Close, fix silent walker error, map[string]struct{} - Extract generic sfDo[T] package-level helper that wraps singleflight.Do with panic recovery, replacing identical boilerplate in AheadBehind, DiffShortstat, and HasUncommitted - Wrap CommitMessages slow path in sfDo with commitMessagesSF field to deduplicate concurrent calls and use defer for lock release - Replace explicit tw.Close() calls with defer tw.Close() in hasUncommittedGoGitPhase and diffShortstatUncached - Propagate TreeWalker errors in diffShortstatUncached instead of silently breaking (was swallowed as a no-op) - Change indexedMap and hasUntrackedFiles parameter from map[string]bool to map[string]struct{} for consistency with walkUntracked and to save memory - Add non-re-entrancy comment above diffShortstatUncached call in DiffShortstat * chore(sdd): update validation.md with Phase 4 and spec compliance findings * fix(service): fall back to launchctl load when bootstrap fails on macOS launchctl bootstrap can fail with I/O error (exit 5) on some macOS versions even when the service is not loaded. Mirror the existing bootout→unload fallback pattern for the start path. * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update go tier2 baseline [skip ci] * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * fix(terminal): correctly scan OSC/DCS escape sequences to stop render artifacts (#156) * fix(terminal): correctly scan OSC/DCS escape sequences to stop render artifacts stripANSIBytes and sanitizeUTF8Bytes treated any ASCII letter as the end of an escape sequence. That's only true for CSI (ESC[...letter); OSC (ESC]...BEL or ESC\) and DCS/PM/APC/SOS (ESC{P,^,_,X}...ESC\ or 0x9C) terminate differently, and their payloads (window titles, hyperlink URLs, shell-integration marks) almost always contain a letter before the real terminator. Claude Code's newer renderer emits more of these OSC sequences, so their payload tails were leaking through as literal text in the web terminal and throwing off cursor-column math. Add a shared scanEscapeSequence helper (mirrors the correct boundary logic already used by pkg/analytics/escape_code_parser.go) and rewire both duplicated stripANSIBytes definitions plus sanitizeUTF8Bytes to consume whole sequences atomically instead of stopping at the first letter. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(terminal): widen CSI final-byte range to 0x40-0x7E, cap OSC/DCS scan size Code review on PR #156 found that the new scanCSI only accepted A-Z/a-z as CSI terminators, missing real ECMA-48-valid final bytes like '@' (0x40, Insert Character) and '~' (0x7E, used by many real xterm sequences e.g. function/navigation keys). Confirmed empirically: stripANSIBytes("\x1b[5@Hello") leaked "@Hello" instead of "Hello" — the exact bug class this PR exists to eliminate, just for a different final byte. Widened to the full 0x40-0x7E range and aligned the malformed-CSI fallback with pkg/analytics' semantics (give up and consume only the ESC, rather than swallowing partially-scanned params). Also: - Widened pkg/analytics/escape_code_parser.go's parseCSI terminator range to match (it was cited as the reference implementation for this fix but had the same narrower gap for '~' and other non-letter finals in 0x5B-0x60/0x7B-0x7E). - Added a size cap (mirroring escape_code_parser.go's existing 65536 bound) to scanUntilTerminator so an unterminated/adversarial OSC or DCS payload can't force an unbounded scan. - Pre-size the bytes.Buffer in stripANSIBytes/sanitizeUTF8Bytes with Grow(len(b)) to avoid reallocation growth in this hot path. - Removed the now-vestigial (*StateGenerator).stripANSIBytes wrapper method now that its only caller can use the shared free function directly. - Added regression tests for all of the above, including a mid-buffer (start > 0) case and the new size-cap behavior. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update go tier2 baseline [skip ci] * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * fix(nav): add Feature Flags to navigation menu settingsFeatures route existed but was never registered in NAV_PAGES, making the /settings/features page unreachable from the sidebar. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * docs(claude): prune CLAUDE.md and rule files for token efficiency - CLAUDE.md: removed inline bundling-tmux and concurrency patterns code blocks; replaced with reference links to new .claude/docs/ files - feature-testing-registry.md: removed illustrative TS code blocks (~51% reduction); kept checklists and decision tree - session-creation-registry.md: minor condensation - .claude/docs/bundling-tmux.md: extracted bundling commands - .claude/docs/concurrency-patterns.md: extracted double-checked locking pattern Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update go tier2 baseline [skip ci] * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * feat(backlog): import backlog items from GitHub issues Adds an ImportGitHubIssue RPC that shells out to `gh issue view` to populate title, description, labels, and URL from any GitHub issue, then creates a BacklogItem and optionally triggers auto-triage. Frontend adds a mode toggle to the "New Backlog Item" modal: - Manual: existing BacklogItemForm (unchanged) - Import from GitHub Issue: URL field → ImportGitHubIssue RPC Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update go tier2 baseline [skip ci] * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * chore(main): release 1.34.0 (#158) * Brew formula update for stapler-squad version v1.34.0 * chore(demos): update E2E feature GIFs [skip ci] * chore(sdd): planning artifacts for github-issue-picker * feat(backlog): GitHub issue picker — browse repos and issues to import Adds an interactive two-phase picker (repo selection → issue list) to the backlog import flow, powered by native Go GitHub HTTP client calls instead of gh CLI subprocess invocations. Backend (Epic 1): - github/http_client.go: export GhBaseURL for test injection - github/repos.go: SearchUserRepos, ListRepoIssues domain functions - proto/session/v1/backlog.proto: SearchGitHubRepos + ListGitHubIssues RPCs and supporting message types - server/services/backlog_service.go: handler implementations with input validation and ownerRepoPattern guard - server/services/backlog_github_rpc_test.go: 9 handler tests via httptest.Server interception Frontend (Epics 2–3): - useBacklogService.ts: GitHubRepo, GitHubIssue, GitHubAuthError types and searchGitHubRepos / listGitHubIssues hook methods - lib/utils/issuePickerCache.ts: localStorage TTL cache (5 min) for repos and issues, origin-scoped keys, last-used repo - lib/hooks/useGitHubIssuePicker.ts: two-phase picker state — debounce, generation counter, AbortController, local-repo tier from Redux - components/backlog/GitHubIssuePicker.css.ts: vanilla-extract styles - components/backlog/GitHubIssuePicker.tsx: RepoSelector + IssueList with keyboard nav, ARIA attrs, two-level Escape, auth error state - backlog/page.tsx: replaces URL text input with GitHubIssuePicker Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update go tier2 baseline [skip ci] * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * chore: merge tstapler/main → upstream (20260702) (#159) * refactor(session-types): unify SessionType, promote one_off to proto enum, split config Eliminates three sources of type duplication: 1. config/types.go + config/executor.go extracted from the 1031-line config/config.go (SRP fix — config.go now contains only factory functions and the Config struct) 2. session.SessionType is now a Go type alias for config.SessionType, removing the duplicate type that required aliasSessionTypeToSessionType no-op conversions 3. bool one_off = 14 promoted to SESSION_TYPE_ONE_OFF = 5 in the SessionType proto enum; field 14 is reserved for wire compatibility. All call sites updated: backend handler, workflow scheduler, alias defaults service, and all frontend contexts/hooks/tests. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(headless): use Setsid instead of Noctty for headless runner subprocess WithNoControllingTerminal() sets SysProcAttr.Noctty=true on Linux, which calls ioctl(0, TIOCNOTTY) in the child after fork. This returns ENOTTY when the parent process has no controlling terminal — the case when stapler-squad runs as a systemd service — causing every headless triage call to fail with "fork/exec .../claude: inappropriate ioctl for device" (exit code 1). Replace WithNoControllingTerminal() with WithNewSession() in ProcessRunner.Run. Setsid creates a new process session (implying no controlling terminal) without invoking TIOCNOTTY, so it works regardless of whether the parent has a TTY. Also corrects the misleading comment in managed_process_linux.go that claimed Noctty was safe without a controlling terminal. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(omnibar): replace Create shortcut hint with clickable Create Session button Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(alias): add name_prefix field + fix session name oscillation - Add `name_prefix` to AliasConfig (Go), AliasProto (proto field 12), and AliasEntry (TypeScript) — wired through the full stack - In the detection effect, skip the generic suggestedName update for aliases; the alias block now derives the session name as namePrefix + typedLabel, falling back to namePrefix alone or the alias name — eliminates the oscillation between alias name and prefix+label on each keystroke - AliasesManager settings form now has a Name prefix field with a live preview hint - Create Session button in shortcuts bar uses compact styling on desktop and expands to touch-friendly size on coarse-pointer (mobile) devices Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(detection): detect dynamic workflows + expand turn-marker to ✦ - Add "dynamic workflow" alternate to waiting_for_background_agent pattern so "✻ Waiting for N dynamic workflow(s) to finish" → StatusWaitingForAgent - Expand [✻◉] → [✻◉✦] in verb_duration_completion and waiting_for_background_agent to cover ✦ (U+2726, Claude Code primary spinner) - Add test cases for all three bullet variants on both waiting and completion lines Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(review-queue): show INPUT_REQUIRED items + UX improvements - Fix invisible INPUT_REQUIRED/APPROVAL_PENDING items: deriveWorkingState maps these to PROCESSING, which was being filtered out; now always passes items through when their reason requires user action - Fix workingCount to exclude INPUT_REQUIRED/APPROVAL_PENDING from the "working" tally (they need attention, not patience) - Fix summaryCount grammar ("input neededs", "task completes", "timed outs") by replacing tuple pluralization with per-reason formatter functions - Fix filter empty state: show "no items match" when a filter is active, not the generic "all done" message - Move auto-advance checkbox into the panel title row (was orphaned above the card in page.tsx toolbar div) - Hide floating help button on mobile (keyboard shortcuts are irrelevant on touch devices) - Increase filter button / toggle touch targets to 44px on mobile - Downgrade oldest-item callout from alarming orange to neutral muted style - Show filter toggle whenever any items exist (not only when server totalItems > 0) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(alias): default session type + name oscillation - Fix session type not applying for aliases configured as "Default (directory)": that option stores SessionType.UNSPECIFIED, which the detection effect was explicitly skipping — form stayed at the initial "new_worktree" value instead. Now maps UNSPECIFIED → "directory". - Fix session name oscillating every other keystroke: the generic suggestedName block was running for InputType.Alias results and resetting lastSuggestedNameRef to the alias slug (e.g. "pw"), causing the alias-specific name block to fail its staleness check and alternate on each input event. Fixed by skipping the generic block for Alias inputs entirely — the alias block below handles naming. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * chore(sdd): planning artifacts for review-queue-jump-fix Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(review-queue): suppress auto-advance on session status transitions The "deleted externally" effect in ReviewQueueContent used reviewQueueItems (the filtered visible list) to check if the selected session still existed. When a session transitioned to ACTIVE/PROCESSING, it was filtered from the visible list but remained in the Redux store — the effect incorrectly fired handleAutoAdvance(id, true), jumping to the next queue item immediately after the user opened a session and clicked into the terminal. Fix: use allQueueItems from useReviewQueueContext().items (the unfiltered Redux store) as the existence oracle. A session filtered from the visible queue due to status transition stays in the store and no longer triggers auto-advance. Genuine removals (removeItem Redux events) still fire auto-advance correctly. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(sessions): prevent Claude process orphaning after server restart Three-part fix for tmux session / Claude process accumulation: **Fix 1 — DeleteSession fallback (session_service.go)** When FindLiveInstance returns nil (e.g. server restarted since the session was created, so the in-memory poller is empty), fall back to KillTmuxSessionByTitle which kills by the deterministic tmux session name. Previously the DB record was deleted but the Claude process kept running indefinitely. **Fix 2 — Startup orphan sweep (session/orphan_sweep.go)** ReconcileOrphanedTmuxSessions runs as Step 6d of BuildRuntimeDeps, after the re-adoption passes (6/6b) that hot-attach DB sessions to their live tmux panes. It enumerates all staplersquad_* tmux sessions, reads the STAPLER_SESSION_UUID env var from each, and kills any whose UUID (or sanitized title) has no match in the current workspace DB. The keepalive sentinel is always preserved. **Fix 3 — MCPServerURL backfill (session_service.go)** loadInstancesWithWiring now backfills inst.MCPServerURL from the server's configured URL for sessions created before MCP integration was wired up. Without this, buildLaunchCommand omits --mcp-config entirely and Claude restarts without a session UUID, making it impossible to identify from the process list or MCP request headers. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * fix(lint): return empty map instead of nil in GetAllInstanceArtifacts Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * fix(backlog): harden triage parser and add repoPath UI gate ParseHeadlessTriageResult now uses brace-scan (strings.Index/LastIndex) to tolerate natural-language preamble before the JSON block, fixing silent parse failures on multi-step triage runs. The "Trigger Triage" button in BacklogItemDetail and BacklogItemCard is now disabled with a tooltip when repoPath is not set, preventing the confusing CodeFailedPrecondition server error. Adds 3 new unit tests for the parser and a Playwright e2e gate test that creates an item without repoPath and asserts the button is disabled. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(demos): update E2E feature GIFs [skip ci] * feat(harness): headless triage test harness + alias kebab-case fix Adds a build-tagged Go harness (go:build harness) that exercises the backlog triage feature end-to-end via the ConnectRPC HTTP layer with no browser or UI. Four sub-tests cover distinct phases runnable individually: Gate (repoPath precondition), TriggerAndPoll (async completion), ParserRobust (preamble tolerance), and FullFlow (full user journey). Makefile targets added for each phase. Also converts alias namePrefix label to kebab-case lowercase (spaces/underscores → hyphens) before concatenating with the prefix, so "@ssq My New Feature" produces "ssq-my-new-feature" instead of "ssq-My New Feature". Two new tests added to Omnibar.alias.test.tsx. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(sdd): planning artifacts for nav-redesign Navigation redesign: group 16+ flat nav items into 4 sections (Work, Automation, Insights, Settings & Tools), restore mobile access for 8 currently-hidden routes, and consolidate Settings/Config Files/Features. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(nav): group navigation into 4 sections, restore mobile access Reorganise the 15 nav pages into Work / Automation / Insights / Settings groups rendered in both DrawerNav (desktop sidebar) and BottomNav More sheet (mobile). All 8 routes that were hidden from mobile (Settings, Insights, Logs, Errors, Help, Escape Analytics, Files, Workflows/Rules) are now reachable on every screen size. Removes the redundant Config Files and Features top-level entries; fixes a DrawerNav bug where items were shown regardless of feature-flag state. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * chore: commit in-progress work from previous sessions Includes executor fixes (WithProcessDir support, Linux setsid/Setpgid EPERM fix), backlog triage harness test expansions, rate-limit integration test, Makefile test-triage-real target, and planning artifacts for backlog-triage-e2e-hardening and put-backlog-behind-a-feature-flag-by-default. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: support Antigravity CLI hooks.json format in ssq-hooks * fix(pane): restore session peek modal integration in pane picker * feat(files): wire up the premium LocalFileBrowser component to the files page * chore: commit in-progress work from previous sessions - ssq-hooks: Antigravity CommandLine/Cwd normalization, workspace-aware DB path resolution from cwd, WorkspacePaths fallback - session service: ForkSession fully wired (callbacks, hook config, controller, driver, autonomous mode); ResumeHibernated wires review queue poller and autonomous driver - ent schema: autonomous_mode bool field + generated ORM files - instance_hibernate: start controller + session driver on resume - omnibar: initialTitle prop pre-populates session name; OmnibarContext threads title through openOmnibar(); page.tsx passes ?title param - LocalFileBrowser: CSS and component updates - scripts: find-orphaned-features.py, find-unmerged-commits.py Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(omnibar): replace Create shortcut hint with clickable Create Session button Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(settings): add UpsertAlias and DeleteAlias RPCs with AliasesManager UI Implements full CRUD for alias session presets in Settings > General, removing the need to manually edit config.json. Adds UpsertAlias/DeleteAlias ConnectRPC handlers (case-insensitive name matching, slice-scan upsert, validation via aliasNameRE) and a React AliasesManager component with inline 3-second delete confirmation, env-var editor, tag management, and ARIA accessibility. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(registry): add alias RPCs to scanner methodToID map UpsertAlias, DeleteAlias, ListAliases were missing from the methodToID map, causing the scanner to use fallback raw-name IDs (UpsertAlias, DeleteAlias, ListAliases) instead of canonical kebab-case IDs (alias:upsert, alias:delete, alias:list). This caused Registry Validation CI to fail with 3.36% divergence. Removes the duplicate fallback JSON files from the registry root that were generated under the old behavior. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(analytics): program detail panel with subcommand drill-down Add DB-backed time-windowed analytics queries and an inline program detail panel so operators can see exactly which sub-operations are causing escalations before writing a rule. Backend (Go): - Add compound index on (command_program, created_at) to ent schema - Replace full-table-scan ListAnalytics with time-windowed ListAnalyticsSince (WHERE created_at >= ?) — AC-1, AC-2 - Add GetSubcommandBreakdown aggregation query using ent GroupBy — AC-4 - Add ListRecentCommandsByProgram returning last N command previews — AC-5 - Add GetSubcommandTrend returning per-day counts — AC-6 - Add GetProgramAnalytics ConnectRPC method returning SubcommandBreakdown, ExampleCommands, RuleCoverage, DailyTrend — AC-7 Frontend (React/TypeScript): - New ProgramDetailPanel component with subcommand frequency table (count, %, decision breakdown), example commands, rule coverage summary, trend sparklines, and "Add rule →" links — AC-8 through AC-13 - New useProgramAnalytics hook with AbortController cleanup - ApprovalAnalyticsPanel: clicking program row opens inline detail panel - ApprovalRulesPanel: fix panel crush in flex container (flexShrink: 0), use window.location.search in useEffect for URL param pre-fill (avoids useSearchParams/Suspense issues in Next.js static export) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(backlog): gate backlog behind feature flag on all layers - Frontend layout guard: backlog/layout.tsx redirects to / when flag off - Backend interceptor: FeatureFlagInterceptor wired to BacklogService only - E2E tests: beforeAll/afterAll enable+restore the backlog flag Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: address copilot review comments on analytics drill-down - Fix 1: exclude NULL command_subcategory rows in GetSubcommandBreakdown to avoid sql.ScanSlice scan errors on nullable GROUP BY columns - Fix 2: replace strings.Fields tokenizer in coveredSubcommands() with regexp.Compile + synthetic "<program> <subcommand>" matching so regex-style patterns (e.g. \bgit\b.*\bpush\b) work correctly - Fix 3: add TestGetProgramAnalytics_ReturnsExpectedFields unit test covering window_days=7 and non-nil response fields - Fix 4: add escapeRegex() helper in ApprovalRulesPanel and use it when prefilling commandPattern to avoid metacharacter injection; switch word boundaries from \b to (?:^|\s)/(?:\s|$) for hyphenated program names - Fix 5: add e.stopPropagation() on Suggest Rule button and "add manually" link so clicking them does not toggle the parent <tr> drill-down row - Fix 6: add tabIndex, role=button, aria-expanded, aria-label, and onKeyDown (Enter/Space) to the clickable <tr> for keyboard accessibility - Fix 7: call setData(null) before setIsLoading(false) in error path of useProgramAnalytics to clear stale data on refresh failure - Fix 8: render per-program daily trend sparkline in ProgramDetailPanel; note that trend data is per-program not per-subcommand (backend limit) - Fix 9: thread caller context through LoadProgramWindow, GetSubcommandBreakdown, and ListRecentCommands instead of context.Background() * fix(review-queue): resolve UUID→Title before Remove so approved/deleted sessions leave the queue Queue items are keyed by inst.Title but approval-response and session-deleted events arrive with UUID. resolveQueueKey() looks up the instance via FindInstance (which handles both UUID and Title) and returns Title, falling back to the raw value if the instance is no longer loaded. Also removes duplicate SubcommandDecisionCount declaration in repository.go introduced by the analytics cherry-pick merge. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(bench): update go tier1 baseline [skip ci] * chore: sync upstream → personal fork (20260629) (#132) * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * refactor(session): apply type-driven design to buildLaunchCommand Replace the 8x isClaudeProgram bool check with a sealed programKind sum type (claudeProgram / plainProgram). classifyProgram() parses once at the boundary; holding claudeProgram is proof the program invokes claude, so buildClaudeCommand needs zero isClaude guards — they are enforced by the type system, not by runtime checks. - Add programKind interface with claudeProgram / plainProgram variants - Add classifyProgram() smart constructor (parses once; trust downstream) - buildLaunchCommand: switches on type, delegates to buildClaudeCommand or returns plain cmd unchanged - buildClaudeCommand: no guards — the type makes invalid states unrepresentable (a plainProgram can never reach this function) - Extract claudeMCPConfigFlag() helper for the MCP config flag string - TestClassifyProgram: table test for the sum type classification - TestBuildLaunchCommand_PlainProgramIgnoresClaudeFlags: proves that a non-claude program with all claude-related Instance fields set still returns the bare program, enforced by the type routing * feat(backlog): implement CancelTriage RPC and session delete button Adds CancelTriage endpoint that stops any active triage sessions for a backlog item. Wires up the previously-TODO cancel button in BacklogItemDetail and adds a per-session delete button in the session list. * fix(install): skip FDA prompt for non-admin users with cert-signed binary Non-admin users cannot read either TCC database (authorization denied), causing fda_is_granted() to always return false and show the 15s prompt on every reinstall even when FDA is already granted. When all TCC databases exist but are unreadable, fall back to a heuristic: if the installed binary is cert-signed (designated requirement includes "certificate root"), assume FDA was previously granted. The TCC grant is tied to the signing identity (com.stapler-squad + cert), which is stable across rebuilds, so no new grant is needed on reinstall. * perf(tmux): add semaphore to cap concurrent capture-pane subprocesses capturePaneSem (size 8) limits concurrent CapturePaneContent calls to avoid circuit-breaker lock contention and OS process table pressure. Control-mode fast path bypasses the semaphore entirely. * perf(vcs): cache reachableSet results and batch-read blobs under single lock - reachableSetCache (sync.Map, 30s TTL) eliminates O(N) commit walk on repeated calls — was the #1 pprof hotspot (47.4B cycles, 38 events) - diffShortstatUnderLock batch-reads all needed blobs in one lock hold, replacing N lock-acquire/release cycles — was the #2 hotspot (9.87B cycles, 1641 events) * chore(proto): regenerate types bindings after rebase Types were out of sync (DetectedStatus missing from Go/TS bindings) after the CancelTriage commit was rebased onto upstream. * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * chore(demos): update E2E feature GIFs [skip ci] * fix(terminal): repair escape code pipeline for new Claude Code renderer (#139) * feat(onboarding): offer to install Claude Code hooks during onboarding Adds a final onboarding step that asks whether to install the global Claude Code hooks, with two independent toggles: - Rule enforcement (PreToolUse -> `ssq-hooks check`) - Notifications (Notification/Stop -> `ssq-hook-handler`) Previously these hooks were discoverable only via docs / a manual `ssq-hooks install` invocation; nothing prompted the user. Backend: - New internal/claudehooks package: idempotent, atomic install + detection of the two global hooks in ~/.claude/settings.json. cmd/ssq-hooks now reuses it (InstallRules) instead of its private patchClaudeSettings. - New SessionService RPCs GetHookStatus and InstallHooks. InstallHooks resolves the ssq-hooks binary and ssq-hook-handler from ~/.local/bin (then $PATH / exe-relative scripts); when a binary is unavailable it returns a manual-fallback message rather than failing. - `make install` now also copies ssq-hook-handler to ~/.local/bin so the server can register a stable path. Frontend: - OnboardingModal gains step 5: prefilled from GetHookStatus (a toggle is pre-checked only when its hook is available and not already installed), installs via InstallHooks, and disables toggles whose binary is missing. Tests: unit tests for the package and the two handlers; Jest tests for the onboarding step. Feature registry updated (GetHookStatus, InstallHooks, onboarding-hook-install). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(onboarding): address review — concurrency, async guards, e2e - claudehooks.mutate: serialize read-modify-write with a package mutex and write via a unique temp file (os.CreateTemp) so two concurrent installs (double-click) can't corrupt or clobber settings.json. Add a -race test. - OnboardingModal: guard async setState with a mounted ref (removes the after-unmount update / act warning) and seed the toggle defaults only once so navigating Back→forward no longer discards the user's toggle edits; reset the seed guard on a fresh open. - Jest: await the status fetch in gotoHooksStep to remove flakiness. - Add Playwright e2e (tests/e2e/onboarding-hook-install.spec.ts) covering the hooks step render + finish-without-install (does not mutate global settings). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(sdd): planning artifacts for new-renderer terminal fix Research, implementation plan, adversarial/architecture reviews, validation plan, and architecture-performance deep-dive for fixing escape code stripping caused by the new Claude Code renderer. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(terminal): repair escape code pipeline for new Claude Code renderer The new Ink-based renderer emits escape sequences that exposed four latent bugs in the terminal streaming pipeline, causing garbled output in xterm.js: 1. TextDecoder reuse without {stream:true}: multi-byte UTF-8 characters (é, €, CJK, emoji) split across consecutive proto frames emitted U+FFFD. Fix: StateApplicator and useTerminalStream now pass {stream:true} on all streaming decode calls; separate lineDecoder for complete line content. 2. EscapeSequenceParser lookback too short (20→256): OSC window titles and DCS payloads from the new renderer exceed 20 bytes, causing incomplete sequences to be flushed as garbage. 3. ED2+ED3 stripping: parser stripped \x1b[3J when paired with \x1b[2J, bleed-through of previous session history. xterm.js v6 handles this correctly without intervention. 4. RedrawThrottler over-classification: any \x1b[\d+A was treated as a full-screen redraw; Ink emits cursor-up on every incremental line update, causing most progress/spinner frames to be dropped. Fix: only classify cursor-up + erase-screen as a genuine redraw. Also: 100→33ms cap (30fps) to match Ink render cadence. Adds 84 tests including a combined pipeline integration suite covering the full TerminalDiff→StateApplicator→EscapeSequenceParser→TerminalStreamManager chain. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(terminal): address code review - decoder isolation, test ESC prefix, timer cleanup Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(registry): regenerate after merge with main * fix(a11y): remove aria-selected from listitem div; aria-checked on checkbox is correct * chore(registry): remove stale entries for RPCs removed from main --------- Co-authored-by: Tyler Stapler <tystapler@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(bench): update go tier1 baseline [skip ci] * chore(bench): update e2e latency baseline [skip ci] * chore(bench): update frontend throughput baseline [skip ci] * feat(rules): auto-suggest rule name from criteria inputs (#140) * feat(rules): auto-suggest rule name from criteria inputs Generates a "Allow/Block/Escalate {target}" name as the user fills in tool target, category, pattern, or programs. The suggestion only applies when the name field is empty or still matches the previous auto-suggestion, so manual edits are never overwritten. Also scopes golangci-lint to the current module root to avoid scanning files in external workspace paths (../../../../../WorkProjects). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(tests): resolve TypeScript errors in ArtifactsTab tests and tighten RuleBuilderForm auto-suggest - Add makeArtifacts() cast helper in ArtifactsTab.test.tsx to satisfy protobuf Message<> type requirements without importing the full runtime - Fix computeSuggestedName category branch: check cat existence, not cat?.value (avoids truthiness trap on empty-string values) - Move nameRef sync to useLayoutEffect to avoid render-phase ref mutation in React concurrent mode Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: resolve CI failures in multib…

…rd status sync, loop prevention (#336) * chore(sdd): Phase 4 validation artifacts + plan corrections for backlog-github-two-way-sync - validation.md: 52 test cases (Go unit/integration/migration, Jest, Playwright) covering all 11 acceptance criteria. - pre-mortem.md: 3 P1 failure modes identified and resolved directly in plan.md (watermark clock-skew in CloseIssue's signature, UserModifiedFields presence-check vs value-diff, forward-sync failures wired into the row-level-warning store). - plan.md: fixed a real correctness bug found by cross-artifact consistency review (Labels backward-sync was missing its BackwardSyncEnabled gate, unlike the status blocks in Epic 2.1/2.2), and added Epic 4.4 (PreviewBackwardSyncImpact + confirm dialog) to close a Product Triad Review UX blocker: enabling backward sync could previously bulk-archive already-imported items with no preview or confirmation. Readiness gate: PASS. Triad review: READY TO BUILD (verified via a fresh, independent UX re-check after the blocker fix). * feat(backlog): Epic 0.4 — TriggeredByGitHubSync, GuardedTransitionAllowed, SyncLoop.workflowEngine Adds the audit-trail marker and read-only guard-evaluation helper the backward sync (GitHub -> backlog) work needs, without creating an import cycle (session cannot import server/services): - TriggeredByGitHubSync = "github_sync" constant alongside TriggeredByUser/TriggeredBySystem (session/backlog.go). - GuardedTransitionAllowed(engine, item, to) evaluates CanTransition + ValidateGates without executing the transition — the read-only counterpart to transitionWithGuard for callers in package session that can't import server/services (session/workflow_engine.go). - SyncLoop gains a workflowEngine field, defaulted to NewDefaultWorkflowEngine() in both constructors so existing NewSyncLoop(...)/NewSyncLoopWithKeyProvider(...) call sites compile unchanged (session/backlog_sync.go). Consumed by later Phase 2/3 work, not by this change. Ref: project_plans/backlog-github-two-way-sync/implementation/plan.md Epic 0.4. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NYt425C3izWQRqKgYLoj74 * feat(backlog): per-source sync-direction settings (Epic 0.5) Add ForwardSyncEnabled, BackwardSyncEnabled, ForwardSyncCloseLabel as first-class ItemSource fields end-to-end (ent schema -> generated code -> repository -> UpdateItemSource RPC handler -> proto), mirroring the existing Enabled field's shape. Proto field numbers verified free against the live .proto before assigning (ItemSource highest was 8, UpdateItemSourceRequest highest was 4 - matches plan.md's projected 9/10/11 and 5/6/7). Also fixes a latent bug found while adding the UpdateItemSource not-found test: EntRepository.UpdateItemSource wraps ent's *ent.NotFoundError as session.ErrNotFound before returning, so the handler's `ent.IsNotFound(err)` check never matched and unknown source IDs fell through to CodeInternal instead of CodeNotFound. Scoped the fix to UpdateItemSource only (per assigned scope). Ref: project_plans/backlog-github-two-way-sync/implementation/plan.md Epic 0.5. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NYt425C3izWQRqKgYLoj74 * feat(backlog): Labels/ExternalURL persistence, state=all fetch, GitHubSyncedIssueUpdatedAt watermark (Epics 0.1/0.2/0.6) Lands the ent schema, repository, and GitHub-plugin plumbing that both sync directions depend on: - Epic 0.1: `labels []string` + `external_url string` (backlog-github-issue-link had not landed external_url yet, so this adds it defensively per Task 0.1.1a) added to the BacklogItem ent schema, threaded through BacklogItemData/ BacklogItemUpdate and the ent create/update/read mapping, and populated by GitHubIssuesPlugin.MapToBacklogItem instead of being dropped. - Epic 0.2: GitHubIssuesPlugin.Fetch now queries state=all instead of state=open so closed/reopened issues are observed; ExternalItem gains State and IssueUpdatedAt (parsed from the issue's updated_at, reusing the same value already used to compute the Fetch cursor). - Epic 0.6: GitHubSyncedIssueUpdatedAt *time.Time loop-prevention watermark added to the ent schema/BacklogItemData/BacklogItemUpdate, mirroring PrFeedbackAddressedAt's exact shape (Set.../Clear... pair). Single `go generate ./session/ent` pass covers all new backlog_item fields across the three epics, per plan.md's Phase 0 instruction. Note: DecryptConfigToken (Epic 0.6, Story 0.6.2) was already renamed and committed as an incidental part of an earlier concurrent commit (58ded38) in this shared worktree — no separate change needed here. TestDecryptConfigToken is kept as a thin forwarding wrapper rather than deleted, since server/services/backlog_service_encryption_test.go (outside this task's file-ownership scope) still calls it directly. Ref: project_plans/backlog-github-two-way-sync/implementation/plan.md Epics 0.1, 0.2, 0.6. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NYt425C3izWQRqKgYLoj74 * feat(backlog): wire UserModifiedFields from UpdateBacklogItem RPC (Epic 0.3) Stories 0.3.1/0.3.2 of backlog-github-two-way-sync: export ParseUserModifiedFields/ContainsModifiedField and add MergeUserModifiedFields in package session; thread UserModifiedFields through BacklogItemUpdate and UpdateBacklogItem (repo + ent layers); populate it in the UpdateBacklogItem RPC handler via a value-diff against the existing item (not a presence check), per the pre-mortem P1 #2 correction — the only frontend edit form always resubmits Title verbatim, so a presence-only check would falsely mark it user-modified on nearly every edit. This makes the pre-existing local-wins gate in SyncOne reachable in production for the first time. * feat(backlog): expose ExternalURL/Labels on BacklogItem proto + summary Epic 0.1's ent/repository layer already persisted ExternalURL/Labels, but nothing surfaced them through BacklogItem's proto message or the list-view BacklogItemSummary struct — the frontend had no way to read them. Adds external_url (30) and labels (31) to the proto, wires both proto-conversion functions, and adds the fields to BacklogItemSummary (populated directly from the ent entity, no new query). Prerequisite for Epic 4.1/4.2 (card badge, detail Source section). * feat(backlog): backward sync status/labels + loop-prevention watermark (Phase 2-3) Implements Epics 2.1-2.4 (closed-issue -> archived status mapping per ADR-002, reopened-issue log-only no-op, gated Labels backward sync, ExternalURL/Labels backfill for pre-existing items) plus Phase 3's GitHubSyncedIssueUpdatedAt watermark read-and-skip check in SyncOne (ADR-003), all in the same gated-block style as the existing title/description/priority local-wins blocks. Includes the validation-pass correction from Task 2.3.1a: the Labels backward-sync block gates on source.BackwardSyncEnabled (previously missing from the plan draft), matching the closed/reopened status blocks' existing gate. Adds 15 new tests covering the ADR-002 decision table, the BackwardSyncEnabled/UserModifiedFields gates (including their deliberate asymmetry for ExternalURL vs Labels), and the two AC7 loop-prevention regressions (Risk A: done->done is structurally impossible; Risk B: a manual reopen after forward-sync-close is not re-closed by an exact-echo watermark comparison, while a genuinely newer external change is still processed). * feat(web-app): Phase 4 UI — GitHub provenance display + sync settings (Epics 4.1-4.3) Card badge (Epic 4.1) and detail-view Source section (Epic 4.2) show an item's GitHub provenance (issue link + labels) when ExternalURL/Labels are present, per ux.md's icon+identifier+link recommendation. lucide-react 1.14 ships no brand "Github" glyph, so CircleDot substitutes for it. Settings (Epic 4.3) adds two role="switch" toggles per source ("Close GitHub issues when I finish here" / "Reflect GitHub status back here"), a close-label input, a both-directions loop-risk warning, and a row-level warning for a non-transient (401/403/revoked) sync failure — sourced from eagerly-fetched sync history so it's visible without expanding it. The three new setForwardSyncEnabled/setBackwardSyncEnabled/ setForwardSyncCloseLabel hook functions (and the existing setItemSourceEnabled) now round-trip the full current ItemSource through UpdateItemSource, since its fields are unconditionally overwritten, not partial-update. Backward-sync-enable currently flips directly on click; Epic 4.4's confirm-with-preview gate (depends on Epic 2.1's determineBackwardSyncTarget, in flight concurrently) lands in a later wave — noted in code, not implemented here. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NYt425C3izWQRqKgYLoj74 * feat(backlog): forward sync — close linked GitHub issue on done (Phase 1, Epics 1.1-1.3) Implements AC3: transitioning a backlog item to done closes its linked GitHub issue (merging in a configured close label) and leaves an explanatory bot comment, gated by ItemSource.ForwardSyncEnabled. - Epic 1.1: GitHubIssuesPlugin.CloseIssue/PostIssueComment (session/backlog_plugin_github.go). CloseIssue returns the PATCH response's own updated_at (not wall-clock time), per ADR-003's loop-prevention watermark design (pre-mortem P1 #1). - Epic 1.2/1.3: externalIssueCloser interface + a new EventBus subscriber, StartBacklogGitHubForwardSyncSubscriber (server/services/backlog_github_forward_sync.go), wired in server.go alongside the other Start*Subscriber calls. On CloseIssue failure, records a queryable RecordSourceSyncFailure row instead of only logging (pre-mortem P1 #3; new EntRepository/Storage method, session/ent_repository_backlog.go + storage.go). Plan deviations discovered while implementing: - deps.SyncLoop is always nil (the live periodic SyncLoop is owned internally by session.BacklogController) and *session.SyncLoop has no exported registry accessor, so the subscriber takes the plugin registry and a SyncLoop as separate params, sourced from two new BacklogService accessors (Registry, SyncLoopForForwardSync) added in server/services/backlog_service_sync.go, mirroring TriggerSync's own inline SyncLoop construction — rather than session/backlog_sync.go, which a concurrent worker owns for Phase 2. - EntRepository.TransitionBacklogItemStatus reloads the item via a plain BacklogItem.Get (no .WithSource()), so the EventBus payload's Item can have an empty SourceID even for a source-linked item. handleForwardSyncClose re-fetches via storage.GetBacklogItem (which does eager-load Source) instead of trusting the payload snapshot. Deferred (explicitly non-blocking per plan.md pre-mortem P2 #5): skipping the close+comment when the issue is already known closed — BacklogItemData has no stored external-state field, so this would need a schema change or an extra GitHub call; left as a follow-up. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NYt425C3izWQRqKgYLoj74 * feat(backlog): PreviewBackwardSyncImpact + first-enable confirmation dialog (Epic 4.4) Closes Unresolved Question #3 (Product Triad Review UX blocker): turning on backward sync no longer silently bulk-archives already-imported items in the same tick the toggle flips. - New PreviewBackwardSyncImpact RPC (proto/session/v1/backlog.proto): server/services/backlog_sources_preview.go loads the source, decrypts its token, calls the plugin's Fetch once, and reuses determineBackwardSyncTarget (session/backlog_sync.go's new SyncLoop.PreviewBackwardSyncImpact) to count only items in idea/refining/ready/queued whose linked issue is closed. - BacklogSourcesSettings' backward-sync toggle now calls the preview RPC on enable; itemCount 0 flips immediately, itemCount > 0 shows a new BackwardSyncConfirmDialog (informed-consent copy, focus trap, Escape-to- cancel, focus-return) before calling setBackwardSyncEnabled. Toggle shows a pending state during the preview call; a preview failure shows an inline error with no dialog and no toggle flip. - tools/scanner/backend/proto_scanner.go: registered the new RPC's methodToID mapping so registry-generate produces the kebab-case feature id instead of falling back to the raw method name. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NYt425C3izWQRqKgYLoj74 * fix(backlog): don't advance loop-prevention watermark on failed transition session/backlog_sync.go's closed-issue backward-sync block advanced GitHubSyncedIssueUpdatedAt unconditionally, including when TransitionBacklogItemStatus itself failed — a failed write would permanently mark the item as "already reconciled" and never be retried on a later sync tick. Gate the watermark advance on the transition having actually succeeded (or deliberately skipped), matching this codebase's established retry-on-next-tick convention (see backlog_lifecycle.go's ReconcilePRPending precedent). Also resolves the make lint silenttransition finding on this line — the errored++ counter and next-tick retry are the existing notify mechanisms, per the //nolint justification added. * chore(backlog): feature registry updates for two-way-sync (Phase 5) Per .claude/rules/feature-registry.md — sweep found several stale entries and one missing marker from the preceding waves: - update-item.json/update-source.json: testIds were missing the new UserModifiedFields/sync-direction round-trip tests. - backlog-item-card.json/backlog-item-detail.json: testIds were missing the new provenance-badge/SourceSection tests. - settings-backlog-sources.json: testIds hadn't been touched since before Epic 4.3/4.4 landed (11 new tests added). - SourceSection.tsx had no // +feature: marker despite this repo's own precedent for detail sub-sections (LifecycleSummary.tsx, SessionDiagnosticPanel.tsx) — added the marker + a new registry entry. * fix(backlog): repair 8 code-review findings for GitHub two-way sync MUST FIX: - WCAG AA contrast: provenanceBadge / subHeading / previewPendingLabel rendered textMuted on surfaceMuted, failing 4.5:1 in the dark theme (2.99:1) and clean theme (3.10:1). Switch to textSecondary, and bump clean theme's textSecondary token (4.02:1 -> 4.57:1 against surfaceMuted) since it was itself marginal. - Keyboard nav: BacklogItemCard's onKeyDown fired on any bubbled Enter/Space, so Enter on the nested provenance-badge <a> both preventDefault()'d the anchor's navigation and opened the item detail. Guard on e.target === e.currentTarget. - Stale-closure double-click: handleToggleEnabled/handleToggleForwardSync had no in-flight guard, unlike handleToggleBackwardSync's backwardSyncPreviewPendingId pattern, so a rapid double-click could send the same target value twice. Added matching per-source pending-id guards for both. Cheap follow-ups: - PreviewBackwardSyncImpact was missing TriggerSync's syncFeatureEnabled gate — added it, and switched to SyncLoopForForwardSync() instead of reimplementing its branch inline. - Deleted TestDecryptConfigToken, a single-caller forwarding wrapper; the one caller now calls DecryptConfigToken directly. - closeLabelDrafts never cleared after a successful commit, permanently pinning the input to the locally-typed value. Clear the draft entry once refresh() succeeds. - The closed-issue backward-sync "no valid target" skip branch (item is in_progress/review/pr_pending) left advanceWatermark true even though nothing changed locally, which could permanently suppress a later legitimate auto-archive after a manual status revert. Mirrors the transition-failure branch's existing fix (0fa219f). Added regression tests for the keyboard-nav guard, the double-click guards (both toggles), the close-label reconciliation, and the watermark fix (including an end-to-end two-tick reprocessing test). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HWAXmtpHQXXZTKmnvLSSWb * fix(backlog): repair 5 verified findings from PR #336 code review CRITICAL: - UpdateItemSource guarded ForwardSyncCloseLabel on non-empty, so a user clearing the close-label input via blur got a 200 response but the label silently reappeared unchanged. Write it unconditionally like the sibling full-state-overwrite fields (Enabled, ForwardSyncEnabled, BackwardSyncEnabled). - PreviewBackwardSyncImpact called plugin.Fetch's single page (50 issues, sorted by created desc), silently missing older closed issues on repos with >50 total issues — could report "0 items affected" when more exist, undermining Epic 4.4's entire purpose. Added GitHubIssuesPlugin.FetchAll (a PaginatedFetcher the preview path type-asserts for) which paginates up to maxPreviewFetchPages (20 pages / 1000 issues), and a possibly_incomplete response field + UI caveat when the cap is hit — went with pagination (approach a) since it stayed contained to Fetch/FetchAll/PreviewBackwardSyncImpact. MAJOR: - Batched PreviewBackwardSyncImpact's N+1 per-issue GetBacklogItemByExternalID loop into one GetBacklogItemsByExternalIDs query. - Added regression tests for previously-untested guard paths: watermark persists when PostIssueComment fails after a successful CloseIssue; the GuardedTransitionAllowed-denied branch in SyncOne's closed-issue block; locally-created items (no SourceID/ExternalID) never trigger CloseIssue. NIT: - Fixed a stale e2e helper comment claiming the Epic 4.4 confirm-with-preview gate was a later wave — it ships in this PR; the fixture just has zero linked items so the dialog auto-skips. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HWAXmtpHQXXZTKmnvLSSWb * chore: trigger CI check-suite registration * fix(backlog): address Copilot review findings on PR #336 - session/backlog_sync.go: guard both closed/reopened-issue backward-sync blocks against a zero (unparsed) IssueUpdatedAt, which would otherwise either false-short-circuit as already-reconciled against a real watermark or persist a garbage zero watermark. - session/backlog_sync.go: track a per-item anyChange flag so a status transition/watermark write in the closed/reopened blocks isn't also double-counted by the generic `!anyField` skipped++ fallback, restoring the SourceSyncEvent aggregate's partition-of-item-count invariant. - server/services/backlog_service.go: only set the optional ExternalUrl proto field when ExternalURL is non-empty, in both backlogItemToProto and backlogItemSummaryToProto, instead of always setting a non-nil pointer to an empty string. - web-app SourceSection.tsx / BacklogItemCard.tsx: guard the "Issue #<id>" rendering so a present externalUrl with a missing externalId can't render a literal "Issue #undefined". - web-app BacklogSourcesSettings.tsx: isAuthFailure no longer treats every 403 uniformly — GitHub's rate-limit response is also a 403, so rate-limited messages are now explicitly excluded before matching on 401/403/bad credentials/revoked/requires authentication. - Test naming nit: renamed a SourceSection test to the file's established Subject_should_ExpectedBehavior_When_Condition convention. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HWAXmtpHQXXZTKmnvLSSWb --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

… test-race (#378) TestTmuxServerRegistry_PaneExitChannel intermittently failed with "SubscribePaneExit channel not closed within 3s after kill-session". Root cause #1 (server_registry.go): while reconnectLoop is sleeping out exponential backoff (100ms..30s), no syncSessions() runs at all until the next reconnect completes, so pane-exit detection latency was effectively bound by backoff instead of by anything caller-facing. Fixed with a syncMu-guarded fast-recheck path (waitBackoffWithFastRecheck + syncSessionsFastRecheck) that makes a small, bounded number of independent resync attempts during a long backoff wait without blocking on or interfering with the normal blocking syncSessions() callers. Ceiling is documented inline: fastRecheckAttempts * (fastRecheckSyncTimeout + fastRecheckInterval) = 700ms, gated behind fastRecheckMinBackoff=1600ms (below that, the plain wait alone already leaves ample margin, and unconditional fast-rechecking measurably worsened flakiness under load by adding avoidable list-sessions forks with zero benefit). TestTmuxServerRegistry_PaneExitDetectedDespiteElevatedBackoff exercises this structurally, by elevating backoff to 3200ms via a clean control-mode outage and asserting detection within 1.5s. Root cause #2 (server_registry_integration_test.go), found after the above fix still left a residual ~10-15% failure rate: two independent gaps in the test scaffolding, not the tmux server itself dying, root-caused with tmux's own -v/-vv server-side protocol log. - Isolated test servers were spawned without -f, so they silently loaded this developer's real ~/.tmux.conf (including a `run '~/.tmux/plugins/tpm/tpm'` that forks extra tmux subcommands against the fresh server as part of config load). Fixed with -f /dev/null on the command that starts each isolated server. - startIsolatedRegistry returned before the control-mode client had actually finished attaching, letting a test's own session-create race ahead of the registry's own attach-session. When it won, the session was created before the control client subscribed, so tmux never emitted %session-created/%sessions-changed for it (no event replay), and -- since the connection then stayed healthy with no further drops -- nothing ever triggered a resync before the test's poll timeout. Confirmed directly via a captured failure with zero reconnect/backoff log lines in between. Fixed by blocking on registry.IsHealthy() (set only after a live post-connect sync, which requires the server to have already processed the earlier-submitted attach-session) before startIsolatedRegistry returns. Verified: go test -race -tags integration ./session/tmux -run TestTmuxServerRegistry_PaneExitChannel at -count=40, three consecutive -count=20 runs, and -count=100 -- 260/260, zero failures, across two independent worktrees. Full session/tmux suite (including TestEnsureServerRunning_NoOp, TestKillOrphanedControlModeClients, and the new regression test) and make ci both pass cleanly. Claude-Session: https://claude.ai/code/session_01Y3suSzoDYXnvbg2KQyD2qG Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings March 29, 2026 05:17

Copilot started reviewing on behalf of tstapler March 29, 2026 05:17 View session

Copilot AI reviewed Mar 29, 2026

View reviewed changes

Copilot started work on behalf of tstapler April 11, 2026 22:34 View session

chore: rename Claude Squad to Stapler Squad in nil_safety_check.sh

f240162

Agent-Logs-Url: https://github.com/tstapler/stapler-squad/sessions/233ef675-a8ac-4957-a2df-86b348c680cd Co-authored-by: tstapler <3860386+tstapler@users.noreply.github.com>

Copilot finished work on behalf of tstapler April 11, 2026 22:36

tstapler merged commit 28103cf into main Apr 12, 2026
2 of 5 checks passed

This was referenced Jul 17, 2026

feat(backlog): opt-in auto-create-PR policy for Review Queue #159

Merged

fix(backlog): review-gate PipelineEngine coverage + pipeline-mode empty-state hint #178

Merged

tstapler mentioned this pull request Aug 3, 2026

feat: CI/CD status in diff viewer #326

Closed

7 tasks

Navigation Menu

chore: remove CLA and rename Claude Squad to Stapler Squad - #2

chore: remove CLA and rename Claude Squad to Stapler Squad#2
tstapler merged 2 commits into
mainfrom
cleanup/remove-cla-and-rename

tstapler commented Mar 29, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 29, 2026

Uh oh!

tstapler Apr 11, 2026

Uh oh!

Copilot AI Apr 11, 2026

Uh oh!

tstapler commented Apr 6, 2026

Uh oh!

Copilot AI commented Apr 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

tstapler commented Mar 29, 2026

What?

Changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

tstapler Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

tstapler commented Apr 6, 2026

Uh oh!

Copilot AI commented Apr 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants