@abelxiaoxing/cadence 2.0.11 → 2.0.13

package/README.md

@@ -136,7 +136,10 @@ A token grants workspace access, not action consent.
 Every mutation needs its own context-bound preview/confirmation; stale/duplicate/lost replies do not silently replay work.
 The WebUI provides task/run/assignment navigation, long retained messages and tool detail, exact literal search, timeline and complete scoped NDJSON/Markdown downloads.
 Desktop panes and phone drawers retain cancellation and keyboard controls.
-Its chrome follows pi-web-ui: a compact topbar with view tabs and icon actions, a sectioned task sidebar, pill inspector tabs, transcript/tool cards and a bottom statusbar; phones wrap the topbar into an action row and an icon tab row.
+Its layout follows pi-web-ui: the topbar shows the connection state, every recorded view as a tab, icon actions, the exact owner model and a **New task** chip; the left sidebar lists the project, running conversations and task history, each task's runs and subagents nested under it; the right panel holds the task's plan, checks, changes and review; a statusbar sits below.
+With no task selected the page is pi's new conversation: a welcome page with starter cards above a composer whose Enter previews Create (kind and model chips beside it), and a confirmed Create opens its new task.
+A selected task shows its conversation and, where the composer sits, a next-step bar (goal → plan → start → check and review) whose buttons only open panels or request previews; every effect still needs its own confirmation.
+Phones wrap the topbar into an action row and an icon tab row, with both panels as drawers.
 The interface is in English or Simplified Chinese: it follows the browser's first preferred language, and the topbar's globe chip (`中文` / `EN`) switches it, remembered only in that browser.
 Error codes, identifiers, commands and recorded content stay untranslated.
 
@@ -323,6 +326,11 @@ Task v1 remains a strict human-readable summary; rich graph/transcript data neve
 `TaskStore.loadSnapshot` includes raw-byte identity; save/publication requires exact expected bytes and revision.
 A same-revision external edit conflicts and remains preserved.
 Summary clipping is labeled and never clips retained detail; a subsequent publication failure remains separate from previously completed execution.
+A retained task may have no live `task.json` (for example after a workspace rebuild).
+Current reads then retain the requested task ID in an unavailable context, with no live task/plan or action authority; history snapshots and retained content remain readable without reconstructing the summary.
+Stable absence is not `stale`; appearance/disappearance or changed identities during an observation still are.
+Generic `stale` requests fresh observation/confirmation, not a diagnosis that `models.json` changed or an instruction to restart; build compatibility is evaluated separately from the session and independently built client identities.
+Local operation errors neither hide an independent observation error nor imply that the service needs to be started.
 
 ### Capture, retained history and privacy
 
@@ -462,9 +470,13 @@ WebUI text is keyed by its English source: fixed text goes through `useT().t`, w
 The timeline client takes the chosen language from its bridge and is remounted on a switch; browser scenarios pin `locale: "en-US"` so English assertions do not follow the host's `LANG`.
 The browser is conversation-first: the left panel groups the current service project, the actual active roster and retained task conversations, with run/subagent children under their task.
 One service still exposes one checkout; the project section is not a cross-project registry, Pi session importer or cwd switcher.
-The center shows retained message text as Markdown by default; tools/context/timeline/run facts and export/link actions live under Details, while the collapsible right inspector remains bound to the task's current plan/check/change/review context even when viewing a child.
+The center shows retained message text as Markdown by default; tools/context/timeline/run facts are direct topbar tabs beside export/link actions, while the collapsible right inspector remains bound to the task's current plan/check/change/review context even when viewing a child.
+With no task selected the center is the new-task composer; Enter only requests a Create preview, and a followed Create receipt opens its task once published.
+A selected task's next-step bar derives its step from the saved graph revision, observed runs and the active roster (the Cancel authority); it opens inspector tabs or requests Generate/Start previews.
+An observation poll withholds action capability while it reads, which invalidates an open confirmation, so automatic follow-ups (receipt lookups, roster rereads after a run settles) never poll or navigate while a preview is prepared or confirmed.
+A failed poll is observed again after 2s, doubling to the 30s cadence; the owner can answer a read `receipt-inconclusive` briefly while it publishes.
 Historical child links bind exact scope and watermark.
-Bounded history and Back never silently rebase; running conversations offer an explicit new-activity update, and source limitations/progress stay visible even when complete-record metadata is folded.
+Bounded history and Back never silently rebase; a conversation that fits its first page follows newer snapshots with one bounded read at a time, paged history offers an explicit new-activity update, and source limitations/progress stay visible even when complete-record metadata is folded.
 Cancel uses the independent active roster (including the fallback strip when workspace discovery fails); navigation, project selection and hiding panels never cancel or authorize execution.
 
 Publish `web/dist` from Node: Vite run under Bun lays out its preload helper differently, so a Bun build fails a Node `build:web:check`.
@@ -472,6 +484,23 @@ Review the independently enumerated package member list and every emitted body,
 Keep public Pi peers external for the extension, the exact Undici/ws runtime edges, the exact optional SDK pins for the standalone owner and all upstream/font/vendor notices.
 Preserve original license bytes through their precise Git attributes; line-ending normalization must not invalidate audited source/notice hashes.
 
+### Release 2.0.13 acceptance snapshot
+
+Full `verify` passed on the 2.0.13 release candidate before this evidence-only paragraph: 1983 root tests in 80 files (27 skipped on Linux), 133 web tests, 6 real-browser scenarios and the 132-member pack audit.
+Observed environment: Linux x86_64, Node22.22.1, Bun1.3.14, Pi SDK0.84.3 and existing Chrome for Testing153.0.8010.12.
+The WebUI follows pi-web-ui's new-conversation layout: a bottom composer whose Enter only previews Create, starter cards that only fill the draft, a next-step bar per task, direct topbar view tabs and a New task chip; a followed Create receipt opens the created task.
+The accepting-browser scenario first failed with Confirm start disabled because automatic follow-ups polled while a confirmation was open; they now skip while a preview is prepared or confirmed.
+Service contracts are unchanged; no new Windows/macOS, real service-manager installation or paid-provider qualification is claimed.
+
+### Release 2.0.12 acceptance snapshot
+
+Full `verify` passed on the 2.0.12 release candidate before this evidence-only paragraph: 1983 root tests in 80 files (27 skipped on Linux), 128 web tests, 6 real-browser scenarios and the 132-member pack audit.
+Observed environment: Linux x86_64, Node26.7.0, Bun1.3.14, Pi SDK0.84.3 and existing Chrome for Testing151.0.7922.34.
+Retained conversations remain readable after their live `task.json` disappears and the owner restarts without a selected model; reads neither reconstruct live state nor grant execution authority, and an unused Start grant from before removal is refused without admission.
+Generic stale guidance asks for fresh observation/confirmation without diagnosing a model-source change; local errors no longer hide that observation or suggest starting the service.
+The local-error banner regression failed against the prior built assets and passed against the rebuilt candidate; a new Chinese assertion was corrected to expect its translated status, and an initial integration attempt stopped at provenance JSON formatting before the final full pass.
+No new Windows/macOS, real service-manager installation or paid-provider qualification is claimed.
+
 ### Release 2.0.11 acceptance snapshot
 
 Full `verify` passed on the 2.0.11 release candidate before this evidence-only paragraph: 1976 root tests in 80 files (27 skipped on Linux), 122 web tests, 5 real-browser scenarios and the 132-member pack audit.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abelxiaoxing/cadence",
-  "version": "2.0.11",
+  "version": "2.0.13",
   "description": "Shared Pi task workspace: native terminal and WebUI, persistent service, checks and human review.",
   "license": "MIT",
   "type": "module",

package/src/native-build.ts

@@ -2,5 +2,5 @@
 export const nativeBuild = {
   kind: "native",
   contractHash:
-    "c2bb81519387005a71e88a64364dff47d5c39dab17812833ca898bc51055e59d",
+    "e9b1ea4bb8d1c275a0cb0cf70947f9ac58e5de0cc438d551dc96809f3e82dd7c",
 } as const;

package/src/service/contracts/current.ts

@@ -55,6 +55,8 @@ export interface CurrentView {
   epoch: string;
   committedSeq: string;
   context: ControlContext;
+  /** Null when no live record is available, even for a non-null request.taskId.
+   * This conveys no retained membership or permission to recreate the task. */
   task: CurrentTask | null;
   roles: RoleSelection[];
   readablePlan: null | {
@@ -131,8 +133,13 @@ function correlate(v: {
   context: ControlContext;
   task: CurrentTask | null;
 }) {
+  // A requested task without a live record (retained-only history) may answer
+  // with task: null while its context reports unavailable for that same task.
+  const taskMatches = v.task
+    ? v.task.id === v.request.taskId
+    : v.request.taskId === null || v.context.status === "unavailable";
   if (
-    v.request.taskId !== (v.task?.id ?? null) ||
+    !taskMatches ||
     controlWorkspace(v.context) !== v.workspaceId ||
     controlTask(v.context) !== v.request.taskId
   )

package/src/service-host.mjs

@@ -3870,7 +3870,8 @@ function savedGraph(v) {
   return { status: "unavailable", error: noEffect2(o.error) };
 }
 function correlate(v) {
-  if (v.request.taskId !== (v.task?.id ?? null) || controlWorkspace(v.context) !== v.workspaceId || controlTask(v.context) !== v.request.taskId)
+  const taskMatches = v.task ? v.task.id === v.request.taskId : v.request.taskId === null || v.context.status === "unavailable";
+  if (!taskMatches || controlWorkspace(v.context) !== v.workspaceId || controlTask(v.context) !== v.request.taskId)
     invalid();
   if (v.context.status === "available") {
     const c = v.context.version;
@@ -22190,8 +22191,6 @@ class TaskActions {
     const access = this.currentAccess();
     const committedSeq = snapshot ?? h.writer.committedSeq;
     const selected2 = taskId ? h.coordination.store.loadSnapshot(taskId) : null;
-    if (taskId && !selected2)
-      throw new ContractError("stale");
     if (selected2 && realpathSync6(selected2.record.cwd) !== this.cwd)
       throw new ContractError("unsupported-context");
     const secrets = this.viewSecrets();
@@ -22204,7 +22203,7 @@ class TaskActions {
     const plan = selected2 ? sanitizeText(selected2.record.plan, secrets) : null;
     const editable = selected2 ? plan === selected2.record.plan : true;
     let descriptor = null;
-    let unavailable2 = null;
+    let unavailable2 = taskId && !selected2 ? publicError("unavailable") : null;
     let saved = { status: "none" };
     if (selected2) {
       try {
@@ -22328,6 +22327,8 @@ class TaskActions {
     if (request.storeId !== this.options.host.reader.storeId)
       throw new ContractError("stale");
     const { view, changes, observation, secrets } = this.observeCurrent(request.taskId);
+    if (!view.task)
+      throw new ContractError("unavailable");
     const text2 = sanitizeText(changes.text, secrets);
     return decodeCurrentChanges({
       request,
@@ -22398,7 +22399,7 @@ class TaskActions {
   checkObligations(taskId) {
     const { view, assertCurrent } = this.observeCurrent(taskId);
     if (!view.task)
-      throw new ContractError("stale");
+      throw new ContractError("unavailable");
     const checks = this.obligationsFor(taskId, view.task.kind, view.context, view.committedSeq).checks;
     assertCurrent();
     return checks;
@@ -22923,7 +22924,7 @@ function refuseAt(stage, step) {
   }
 }
 async function createServiceHost(value, sourceBuild) {
-  const embedded = "c2bb81519387005a71e88a64364dff47d5c39dab17812833ca898bc51055e59d";
+  const embedded = "e9b1ea4bb8d1c275a0cb0cf70947f9ac58e5de0cc438d551dc96809f3e82dd7c";
   if (embedded && sourceBuild)
     throw new ContractError("unsupported-context");
   const contractHash = decodeHash(embedded ?? sourceBuild?.contractHash);