@orion-agents/orion-code 0.3.14 → 0.3.17

package/CHANGELOG.md

@@ -22,6 +22,292 @@ which is **not** a pass.
 
 ## [Unreleased]
 
+## [0.3.17]
+
+> **Status: candidate.** Opening a local project is made fast and honest
+> (`docs/plan/v0.3.16-plan-v1.md`): the directory preview no longer waits on the
+> session catalog, the Finder browse action no longer occupies the global
+> Context mutation admission, and every entry point shares one
+> inspect → confirm → activate contract. Covers S2, S3 and S5; S1 (per-stage
+> telemetry) and S4 (staged activate baseline) are not implemented yet. Not
+> merged, tagged or published.
+>
+> **Update:** S1 (per-stage telemetry) and the S4 headline (the foreground
+> snapshot no longer gates the first render) also landed on this branch, plus a
+> bounded inspect probe. The measured Host-side receipt is in
+> `docs/plan/evidence/v0.3.17-open-baseline.md`.
+>
+> **Update 2:** the Git right-hand work panel (`docs/plan/v0.3.17-plan.md`,
+> S0–S6) is implemented on this branch as well. Evidence per stage is under
+> `docs/plan/evidence/v0.3.17-git/`, and the scenario matrix is
+> `g317-status.md`. All functional gaps are closed; the remaining items are
+> assertion and evidence backlog, listed under **Known gaps** below.
+
+### Added
+
+- **Per-stage open-path telemetry:** `WorkspaceOpenTelemetryV1` keeps a bounded
+  ring of `{ requestId, operation, outcome, stage ms, errorCode }` for the
+  picker, the inspect probe and the Context transition, and exposes it
+  read-only through Diagnostics as `workspaceOpen`. Traces never carry a path,
+  a label or file content.
+
+### Fixed
+
+- **The preview no longer blocks on the session catalog:** `inspect` used to
+  call `countSessionsByProject()`, which can rebuild the catalog and hold its
+  file lock for up to 10s before the confirmation card appeared. It now reads
+  the warm cache only (`peekCachedSessionCounts()`) and reports
+  `sessionCountStatus: 'deferred'` when the catalog is cold; the card stays
+  usable and shows 会话数读取中 instead of stalling.
+
+### Changed
+
+- **The native picker is browse admission, not a mutation:**
+  `POST /workspaces/pick-directory` no longer goes through `executeMutation()`,
+  so an open Finder dialog does not raise `activeMutationCount` or enter the
+  idempotency ledger and can no longer make a project switch look like a busy
+  Runtime. Single-flight (`picker_busy`) and the nonce/origin/content-type
+  guards are unchanged.
+- **One path contract:** the advanced manual entry and the pinned/recent rows
+  now go through the same inspect → confirm → activate state machine as the
+  Finder entry. Nothing activates without an explicit confirmation, and
+  availability plus the Git/Folder kind are always re-checked.
+- **The picker timeout is wired:** `timeoutMs` reaches the default `execFile`
+  runner, and a timeout reports its own `picker_timeout` reason code instead of
+  being folded into `picker_unavailable`.
+- **The preview probe is bounded:** `inspectDirectory` now uses asynchronous fs
+  raced against a 250ms budget, so a hung network mount or a broken symlink
+  cannot freeze the Node event loop; on timeout the directory is reported
+  `unreadable` with an `inspect_budget_exceeded` trace code.
+- **The foreground snapshot no longer gates the first render:** `loadBaseline`
+  dispatches the identity baseline (bootstrap, workspaces, sessions, settings)
+  before restoring the session, so the project shell and session list appear
+  while the transcript is still loading. The reducer already marks the active
+  session `loading`, so the Composer stays disabled until the snapshot settles.
+- **Activation no longer re-requests the workspace page:** the page returned by
+  `POST /workspaces/activate` is reused by the baseline when its `activeId`
+  matches the freshly bootstrapped Context, so opening a project issues one
+  fewer round-trip. A mismatch falls back to the normal request.
+- **The confirmation card reports discrete stages:** while opening, the card
+  shows `准备项目 → 加载本地 Runtime → 恢复会话（如有）` with only the stage the
+  Host actually reports marked `aria-current="step"`, instead of one vague
+  "正在打开…" label covering the whole wait.
+
+### Tests
+
+- `tests/web-workbench-workspace-picker.test.ts` — the preview never calls the
+  catalog rebuild entry point; the count is `ready` when the cache is warm.
+- `tests/session-catalog-peek.test.ts` — the peek answers `null` on a cold
+  module instead of loading or locking.
+- `tests/native-directory-picker.test.ts` — a timeout keeps its own reason code.
+- `tests/web-ui-workspace-picker.test.tsx` — the card stays actionable while the
+  count is deferred, and the stage list only appears after confirming.
+- `tests/workspace-open-telemetry.test.ts` — stage offsets, duplicate marks,
+  bounded retention, and that a serialized trace contains no path.
+- `tests/e2e/web-v0317-workspace-open.spec.ts` — W316P-01/02/04/08/09 driven by a
+  scripted picker: no browse side effects, inspect-then-confirm, cancellation,
+  the shared advanced-path contract, and the no-path-leak regression.
+- `tests/e2e/*` — the four manual-path specs confirm on the card before
+  activating.
+
+### Test seams
+
+- **`ORION_CODE_WEB_PICKER_FIXTURE`** points the Host at a JSON script file so
+  end-to-end runs never open a real Finder dialog (`{"path": …}` /
+  `{"paths": […]}` / `{"outcome": "cancelled" | "unavailable"}`). The script is
+  re-read on every invocation, and an absent or malformed file behaves like a
+  cancelled dialog. It is browse-only: the returned path still has to be
+  confirmed and passes through the same guarded activation flow.
+
+### Added — Git right-hand work panel (S0–S6)
+
+- **Change navigation:** staged / unstaged / untracked / conflict groups with a
+  host-side filter and search, counts that cover the whole matching set, and a
+  pagination cursor bound to the group and query it was issued for.
+- **Diff reading:** unified and side-by-side, old/new line numbers, continuous
+  hunks, fold state, line anchors, word-level diff (`--word-diff=plain`) and
+  ignore-all-space — the last two are bound into the pagination cursor, so a
+  page can never be continued under a different view.
+- **Writes through an index transaction:** every index change holds
+  `index.lock` (and only ever removes a lock it created), writes to a private
+  sibling index, verifies it, and publishes with a single atomic rename.
+  Hunk-level and line-level staging rebuild the patch on the Host from the
+  reviewed document — the browser only ever sends ids.
+- **Commit form and result recovery:** summary plus multi-line body, the
+  identity / signing / hook configuration that will actually run, a preview of
+  the real index (independent of list filters), the draft preserved on failure,
+  and idempotent replay by `requestId`.
+- **History:** search across the whole reachable history, commit details,
+  root commits compared with the empty tree, merge parents selectable and
+  labelled, file history with `--follow`, blame, historical blobs for files
+  that no longer exist locally, and a commit graph drawn by git itself.
+- **Branch and version comparison:** two-endpoint snapshot and diverged-from
+  (merge-base) modes; the resolved commit ids are part of the result so an open
+  comparison can be frozen, and a multi-merge-base pair is refused rather than
+  silently picking one.
+- **Conflict views:** base / ours / theirs read from index stages 1/2/3 plus
+  the working tree, with a stage that legitimately does not exist reported as
+  absent instead of being elided.
+- **Submodule and LFS:** recorded gitlink SHAs are shown without traversing
+  submodules, and LFS pointers are reported as state without fetching objects.
+- **Image versions:** a bounded, magic-byte-identified image becomes a data URL
+  so both versions of a picture can be shown without a download.
+- **Cross-panel links:** "open in Files" translates a Git token into a Files
+  token on the Host, and the composer reference carries the file, comparison
+  source, revision and line range into the draft without sending it.
+- **Responsive and keyboard:** three tiers keyed off the panel container (not
+  the window), with a narrow layout that never writes the downgrade back into
+  the stored preference; arrow keys, Enter, F7 / Shift+F7 change navigation,
+  Escape unwinding one layer at a time, and Space toggling selection only —
+  never a Git write.
+
+### Fixed — Git panel
+
+- **Staging could silently do nothing:** the private index copy received a
+  fresh mtime, which defeated Git’s racy-clean rule — a file edited within the
+  same timestamp granularity and with an unchanged size was not re-hashed, so
+  `git add` succeeded while changing nothing. The copy now preserves the
+  original timestamps, and staging verifies each path with `hash-object
+  --path` against the index entry.
+- **`localhost` was rejected site-wide:** the Host and Origin checks compared
+  header strings exactly, so `http://localhost:<port>` returned 421 (and, with
+  only the Host check fixed, every mutation would have returned 403). Both now
+  accept any loopback spelling of the same endpoint while still refusing
+  attacker-controlled names and a mismatched port.
+- **`git apply -` and `git commit -F -` blocked forever:** the async
+  `execFile` `input` option is silently ignored, so stdin was never closed.
+  Writes now use `spawn` and close stdin explicitly, and a timeout kills the
+  whole process group so a slow hook cannot be orphaned.
+- **Refs came back empty:** `for-each-ref` does not support the `%x1f` escapes
+  that `git log --format` does; it printed them literally. Refs are now parsed
+  from a space-separated format.
+- **A detached HEAD could be reported as a branch:** the check was "no ref
+  points at HEAD", which is wrong when detaching onto a branch tip. It now
+  asks git whether HEAD is a symbolic ref.
+
+### Known gaps
+
+- Assertion and evidence backlog for the Git panel: an end-to-end spec
+  (`tests/e2e/web-v0317-git-workspace.spec.ts`), automated assertions for the
+  Files cross-panel link, and scenario variants not yet covered (staging a
+  deletion or rename, CRLF line selection, signing failure, bare repository
+  and linked worktree cases, agent-led file changes).
+- Narrow-viewport and dark-theme screenshots, plus performance samples for the
+  reads added in S5 and S6.
+- `npm run typecheck:e2e` fails on this branch with 12 errors in the v0.3.12
+  and v0.3.13 specs; the same 12 errors reproduce on the v0.3.16 baseline, so
+  they are pre-existing and unrelated to the Git panel.
+
+## [0.3.16] — CANDIDATE
+
+> **Status: candidate.** LOCAL WORKSPACE opens a new project without typing a
+> path (`docs/plan/v0.3.16-plan.md`): a Host-side native folder picker, and a
+> read-only inspect step separated from activation. Covers slices S1 and S2;
+> controlled workspace-roots discovery (S3) is not implemented yet. No protocol
+> removals or dependency changes. Not merged, tagged or published.
+
+### Added
+
+- **Native folder picker (Host):** `POST /workspaces/pick-directory` runs the OS
+  directory chooser on the Host. The AppleScript is a fixed constant and the
+  prompt / default location travel as `argv` through `execFile`, so a chosen
+  path is never interpolated into a shell or script string. Cancelling is a
+  normal outcome, platforms without an adapter report `picker_unavailable`
+  rather than faking a selection, and only one picker may be open at a time.
+- **Read-only workspace inspect:** `POST /workspaces/inspect` resolves the
+  canonical path, availability (`available` / `missing` / `not_directory` /
+  `unreadable`) and Git-vs-folder kind, plus existing workspace id, session
+  count and pin order. It never registers a workspace, activates a Context or
+  reads file contents.
+- **Project picker dialog:** the LOCAL WORKSPACE dialog now leads with
+  `从 Finder 选择文件夹…`, groups pinned and recent projects, and shows a
+  confirmation card (canonical path, kind, availability, session count). The
+  manual absolute-path entry moved into a collapsed 高级 disclosure.
+
+### Changed
+
+- Browsing, searching, inspecting and cancelling never call `activateContext`,
+  pause the event stream or stop a running Session; only confirming 打开项目
+  enters the existing activation flow.
+
+### Tests
+
+- `tests/native-directory-picker.test.ts` — outcome mapping, argv isolation,
+  trailing-separator handling and non-macOS unavailability.
+- `tests/web-workbench-workspace-picker.test.ts` — inspect is strictly
+  read-only and the picker is single-in-flight.
+- `tests/web-ui-workspace-picker.test.tsx` — state-machine invariants (no
+  activation without a confirmed candidate) and the confirmation card.
+- `tests/e2e/*` — the four specs that filled the manual path now open the
+  advanced disclosure first.
+
+## [0.3.15] — CANDIDATE
+
+> **Status: candidate.** Web Workbench visual & interaction convergence
+> (`docs/plan/v0.3.15-plan.md`): copy thinning, unified confirm modal, busy
+> affordances and resource-panel visual tightening. No protocol, API or
+> dependency changes. Not merged, tagged or published.
+
+### Added
+
+- **Pixel brand identity:** the Workbench brand is now true pixel art. A
+  dot-matrix `orion-code` wordmark (`PixelWordmark`, 5×7 grid, run-merged hard
+  rects, integer `scale`) sits in the expanded rail header, and an SVG page
+  icon (`web/public/favicon.svg`) gives the browser tab a real favicon (there
+  was none). `OrionBrandMark` gained an optional `pixel` prop that renders
+  solid two-tone bars with a 1px base shadow; the default gradient glyph used
+  by the boot screen and the collapsed rail is unchanged.
+
+### Fixed
+
+- Restored the keyboard-shortcut reference trigger (now a rail icon), which was
+  lost when the conversation header was removed.
+
+- The eager archived-sessions loader no longer refetches in a loop after a
+  rejected request: `archived_sessions_failed` now claims the workspace
+  (`ownerWorkspaceId`), so the App effect's guard skips settled workspaces, and
+  the fire-and-forget call no longer surfaces the workspace-switch Context race
+  (`The active Context changed before the operation was admitted`) as hundreds
+  of unhandled promise rejections / 409 console errors.
+
+### Changed
+
+- **Copy thinning (T1):** removed or compressed eight explanatory paragraphs in
+  Files / Git / Review / ProjectNavigator / Inspector; details moved to
+  `title` / `aria` attributes (search scope, binary metadata, sensitive-content
+  fence, Git read-model detail, hunk-to-composer hint, diagnostics redaction).
+  Empty states follow icon + one short line.
+- **Transient notices (T1):** Files/Git/Review recovery and success notices now
+  fade out automatically after 4s; error notices persist until replaced
+  (`useAutoNotice`).
+- **Unified confirm modal (T2/D3):** the two remaining `window.confirm` guards
+  — Files discard-unsaved-changes and Inspector clear-Goal — use a shared
+  `ConfirmDialog` (native `<dialog>`: Esc cancel, focus trap, cancel-focused
+  Enter, danger action styling).
+- **Busy affordances (T2):** Files/Git/Review refresh buttons report
+  `aria-busy` with a rotating icon (box size unchanged, reduced-motion aware);
+  the Files save button holds a fixed minimum width so 保存/保存中… no longer
+  shifts the row, and reports `aria-busy` while saving.
+- **Visual convergence (T3):** resource-panel icons unified on the 12/16/20
+  tiers (16px inside panels), search fields and change-list rows reuse the
+  existing radius tokens, and Git group/history headings step back to muted
+  11px type. No new theme tokens.
+- **Banner-free chrome:** the conversation header, the left-rail brand row and
+  the right-rail `PROJECT WORKSPACE` header are removed — conversation content
+  now starts at the top of the column. The theme-cycle and inspector-toggle
+  controls moved to the bottom of the right rail, and the left rail exposes a
+  collapse control in its toolbar. Project and session rows keep the plain
+  folder icon; the `orion-code` mark is used only in the rail header, the
+  collapsed rail and the favicon.
+
+### Tests
+
+- New SSR contracts (`tests/web-ui-resource-copy-v0315.test.tsx`): thinned copy
+  never returns to first paint, busy buttons idle on first paint, confirm-modal
+  markup (focused cancel, danger action, closed shell), goal-clear wiring.
+- E2E locators were unaffected: the only referenced copy (`二进制文件`,
+  `刷新文件树`, `选择文件预览`) is unchanged.
+
 ## [0.3.14] — CANDIDATE
 
 > **Status: candidate.** Editable Files panel (guarded `POST /files/write` with

package/README.md

@@ -2,13 +2,11 @@
 
 Local-first, goal-driven coding agent for the terminal and browser.
 
-> v0.3.12 candidate — a Wide Right Workspace on top of the vertical rail: pure
-> dock/rail/drawer geometry (detail dockable to 80vw while the conversation
-> keeps a 320px minimum), per-workspace layout preferences, a shared repository
-> snapshot store, progressive Review verification, guarded Git stage/unstage/
-> commit, bounded workspace search and revision-bound file_range Context
-> references. Candidate source is not an npm publication, Git tag, or
-> merge-ready release.
+> v0.3.15 candidate — Web Workbench visual & interaction convergence: thinned
+> explanatory copy across the resource panels, one unified confirm modal
+> replacing the last `window.confirm` guards, busy feedback for refresh/save
+> actions, and Orion-style visual tightening of Files / Git / Review.
+> Candidate source is not an npm publication, Git tag, or merge-ready release.
 
 [中文说明](README.zh-CN.md) ·
 [v0.3.7 plan](docs/plan/v0.3.7-left-rail-improvement-plan.md) ·
@@ -173,7 +171,7 @@ current development environments. Node 20 is upstream EOL and is no longer a v0.
 After the immutable `0.3.5` npm receipt exists:
 
 ```bash
-npm install -g @orion-agents/orion-code@0.3.12
+npm install -g @orion-agents/orion-code@0.3.15
 orion --version
 orion doctor
 ```

package/README.zh-CN.md

@@ -2,10 +2,9 @@
 
 面向终端与浏览器、本地优先的目标驱动 Coding Agent。
 
-> v0.3.12 候选版本：在竖状 rail 之上的**大尺寸右侧工作区**——纯 dock/rail/drawer 几何
-> （详情面可拉宽至 80vw，对话保留 320px 最小宽度）、按 workspace 的布局偏好、共享仓库快照
-> store、Review 验证证据渐进分页、受控 Git stage/unstage/commit、受限工作区搜索与带版本
-> 约束的 file_range Context 引用。Candidate 源码不代表已创建 npm 发布、Git tag 或达到可合并状态。
+> v0.3.15 候选版本：Web Workbench 视觉与交互收敛——资源面板说明文案瘦身、统一确认模态
+> 取代最后的 `window.confirm`、刷新/保存的进行中反馈，以及 Files / Git / Review 的
+> Orion 风格视觉收敛。Candidate 源码不代表已创建 npm 发布、Git tag 或达到可合并状态。
 
 [English](README.md) ·
 [v0.3.7 方案](docs/plan/v0.3.7-left-rail-improvement-plan.md) ·
@@ -102,7 +101,7 @@ Current。Node 20 已结束上游维护，不再属于 v0.3 Runtime 合同。
 当 npm 已存在不可变的 `0.3.4` 发布凭据后：
 
 ```bash
-npm install -g @orion-agents/orion-code@0.3.12
+npm install -g @orion-agents/orion-code@0.3.15
 orion --version
 orion doctor
 ```

package/dist/runtime/release-receipts.d.ts

@@ -9,12 +9,24 @@ export declare const WEB_E2E_WEB32_SCENARIOS_V1: readonly ["WEB32-P0-01", "WEB32
 export declare const WEB_E2E_WEB33_THEME_SCENARIOS_V1: readonly ["WEB33-P0-01", "WEB33-P0-02", "WEB33-P0-03", "WEB33-P0-04", "WEB33-P0-05", "WEB33-P0-06", "WEB33-P0-07", "WEB33-P0-08", "WEB33-P0-09", "WEB33-P0-10", "WEB33-P0-11", "WEB33-P0-12"];
 export declare const WEB_E2E_WEB33_SESSION_SCENARIOS_V1: readonly ["WEB33-P0-16", "WEB33-P0-17", "WEB33-P0-18", "WEB33-P0-19", "WEB33-P0-20", "WEB33-P0-21", "WEB33-P0-22", "WEB33-P0-23", "WEB33-P0-24"];
 export declare const WEB_E2E_WEB33_SCENARIOS_V1: readonly ("WEB33-P0-01" | "WEB33-P0-02" | "WEB33-P0-03" | "WEB33-P0-04" | "WEB33-P0-05" | "WEB33-P0-06" | "WEB33-P0-07" | "WEB33-P0-08" | "WEB33-P0-09" | "WEB33-P0-10" | "WEB33-P0-11" | "WEB33-P0-12" | "WEB33-P0-16" | "WEB33-P0-17" | "WEB33-P0-18" | "WEB33-P0-19" | "WEB33-P0-20" | "WEB33-P0-21" | "WEB33-P0-22" | "WEB33-P0-23" | "WEB33-P0-24")[];
-export declare const WEB_E2E_FULL_SCENARIOS_V1: readonly ("E2E-P0-01" | "E2E-P0-02" | "E2E-P0-03" | "E2E-P0-04" | "E2E-P0-05" | "E2E-P0-06" | "E2E-P0-07" | "E2E-P0-08" | "SET-P0-01" | "SET-P0-02" | "SET-P0-03" | "SET-P0-04" | "SET-P0-05" | "SET-P0-06" | "SET-P0-07" | "SET-P0-08" | "SET-P0-09" | "SET-P0-10" | "SET-P0-11" | "SET-P0-12" | "SET-P0-13" | "SET-P0-14" | "WEB31-P0-01" | "WEB31-P0-02" | "WEB31-P0-03" | "WEB31-P0-04" | "WEB31-P0-05" | "WEB31-P0-06" | "WEB31-P0-07" | "WEB31-P0-08" | "WEB31-P0-09" | "WEB31-P0-10" | "WEB31-P0-11" | "WEB31-P0-12" | "WEB32-P0-01" | "WEB32-P0-02" | "WEB32-P0-03" | "WEB32-P0-04" | "WEB32-P0-05" | "WEB32-P0-06" | "WEB32-P0-07" | "WEB32-P0-08" | "WEB32-P0-09" | "WEB32-P0-10" | "WEB32-P0-11" | "WEB32-P0-12" | "WEB33-P0-01" | "WEB33-P0-02" | "WEB33-P0-03" | "WEB33-P0-04" | "WEB33-P0-05" | "WEB33-P0-06" | "WEB33-P0-07" | "WEB33-P0-08" | "WEB33-P0-09" | "WEB33-P0-10" | "WEB33-P0-11" | "WEB33-P0-12" | "WEB33-P0-16" | "WEB33-P0-17" | "WEB33-P0-18" | "WEB33-P0-19" | "WEB33-P0-20" | "WEB33-P0-21" | "WEB33-P0-22" | "WEB33-P0-23" | "WEB33-P0-24")[];
-export declare const WEB_E2E_SETTINGS_SCENARIOS_V1: readonly ("E2E-P0-01" | "E2E-P0-02" | "E2E-P0-03" | "E2E-P0-04" | "E2E-P0-05" | "E2E-P0-06" | "E2E-P0-07" | "E2E-P0-08" | "SET-P0-01" | "SET-P0-02" | "SET-P0-03" | "SET-P0-04" | "SET-P0-05" | "SET-P0-06" | "SET-P0-07" | "SET-P0-08" | "SET-P0-09" | "SET-P0-10" | "SET-P0-11" | "SET-P0-12" | "SET-P0-13" | "SET-P0-14" | "WEB31-P0-01" | "WEB31-P0-02" | "WEB31-P0-03" | "WEB31-P0-04" | "WEB31-P0-05" | "WEB31-P0-06" | "WEB31-P0-07" | "WEB31-P0-08" | "WEB31-P0-09" | "WEB31-P0-10" | "WEB31-P0-11" | "WEB31-P0-12" | "WEB32-P0-01" | "WEB32-P0-02" | "WEB32-P0-03" | "WEB32-P0-04" | "WEB32-P0-05" | "WEB32-P0-06" | "WEB32-P0-07" | "WEB32-P0-08" | "WEB32-P0-09" | "WEB32-P0-10" | "WEB32-P0-11" | "WEB32-P0-12" | "WEB33-P0-01" | "WEB33-P0-02" | "WEB33-P0-03" | "WEB33-P0-04" | "WEB33-P0-05" | "WEB33-P0-06" | "WEB33-P0-07" | "WEB33-P0-08" | "WEB33-P0-09" | "WEB33-P0-10" | "WEB33-P0-11" | "WEB33-P0-12" | "WEB33-P0-16" | "WEB33-P0-17" | "WEB33-P0-18" | "WEB33-P0-19" | "WEB33-P0-20" | "WEB33-P0-21" | "WEB33-P0-22" | "WEB33-P0-23" | "WEB33-P0-24")[];
+/**
+ * v0.3.17 — LOCAL WORKSPACE open path. The picker is driven by a script file
+ * (`ORION_CODE_WEB_PICKER_FIXTURE`) so CI never opens a real Finder dialog.
+ */
+export declare const WEB_E2E_WEB38_SCENARIOS_V1: readonly ["WEB38-P0-01", "WEB38-P0-02", "WEB38-P0-03", "WEB38-P0-04", "WEB38-P0-05"];
+/**
+ * v0.3.17 — Git right-hand work panel (`docs/plan/v0.3.17-plan.md`).
+ *
+ * One id per user-visible capability the plan calls P0/P1 and that a browser can
+ * actually verify; the per-stage unit suites are registered separately.
+ */
+export declare const WEB_E2E_WEB317_SCENARIOS_V1: readonly string[];
+export declare const WEB_E2E_FULL_SCENARIOS_V1: readonly string[];
+export declare const WEB_E2E_SETTINGS_SCENARIOS_V1: readonly string[];
 export declare const WEB_E2E_WEB31_CRITICAL_SCENARIOS_V1: readonly ["WEB31-P0-01", "WEB31-P0-02", "WEB31-P0-08", "WEB31-P0-09", "WEB31-P0-10", "WEB31-P0-12"];
 export declare const WEB_E2E_WEB32_CRITICAL_SCENARIOS_V1: readonly ["WEB32-P0-01", "WEB32-P0-04", "WEB32-P0-05", "WEB32-P0-06", "WEB32-P0-09", "WEB32-P0-11", "WEB32-P0-12"];
 export declare const WEB_E2E_WEB33_CRITICAL_SCENARIOS_V1: readonly ["WEB33-P0-01", "WEB33-P0-03", "WEB33-P0-08", "WEB33-P0-10", "WEB33-P0-12", "WEB33-P0-16", "WEB33-P0-17", "WEB33-P0-18", "WEB33-P0-20", "WEB33-P0-21", "WEB33-P0-23", "WEB33-P0-24"];
-export declare const WEB_E2E_CRITICAL_SCENARIOS_V1: readonly ("E2E-P0-01" | "E2E-P0-02" | "E2E-P0-03" | "E2E-P0-04" | "E2E-P0-05" | "E2E-P0-06" | "E2E-P0-07" | "E2E-P0-08" | "SET-P0-01" | "SET-P0-02" | "SET-P0-03" | "SET-P0-04" | "SET-P0-05" | "SET-P0-06" | "SET-P0-07" | "SET-P0-08" | "SET-P0-09" | "SET-P0-10" | "SET-P0-11" | "SET-P0-12" | "SET-P0-13" | "SET-P0-14" | "WEB31-P0-01" | "WEB31-P0-02" | "WEB31-P0-03" | "WEB31-P0-04" | "WEB31-P0-05" | "WEB31-P0-06" | "WEB31-P0-07" | "WEB31-P0-08" | "WEB31-P0-09" | "WEB31-P0-10" | "WEB31-P0-11" | "WEB31-P0-12" | "WEB32-P0-01" | "WEB32-P0-02" | "WEB32-P0-03" | "WEB32-P0-04" | "WEB32-P0-05" | "WEB32-P0-06" | "WEB32-P0-07" | "WEB32-P0-08" | "WEB32-P0-09" | "WEB32-P0-10" | "WEB32-P0-11" | "WEB32-P0-12" | "WEB33-P0-01" | "WEB33-P0-02" | "WEB33-P0-03" | "WEB33-P0-04" | "WEB33-P0-05" | "WEB33-P0-06" | "WEB33-P0-07" | "WEB33-P0-08" | "WEB33-P0-09" | "WEB33-P0-10" | "WEB33-P0-11" | "WEB33-P0-12" | "WEB33-P0-16" | "WEB33-P0-17" | "WEB33-P0-18" | "WEB33-P0-19" | "WEB33-P0-20" | "WEB33-P0-21" | "WEB33-P0-22" | "WEB33-P0-23" | "WEB33-P0-24")[];
+export declare const WEB_E2E_CRITICAL_SCENARIOS_V1: readonly string[];
 export type ReleaseGateDecisionV1 = 'GO' | 'NO_GO';
 export interface TarballArtifactReceiptV1 {
     readonly version: typeof RELEASE_RECEIPT_VERSION_V1;

package/dist/runtime/release-receipts.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WEB_E2E_CRITICAL_SCENARIOS_V1 = exports.WEB_E2E_WEB33_CRITICAL_SCENARIOS_V1 = exports.WEB_E2E_WEB32_CRITICAL_SCENARIOS_V1 = exports.WEB_E2E_WEB31_CRITICAL_SCENARIOS_V1 = exports.WEB_E2E_SETTINGS_SCENARIOS_V1 = exports.WEB_E2E_FULL_SCENARIOS_V1 = exports.WEB_E2E_WEB33_SCENARIOS_V1 = exports.WEB_E2E_WEB33_SESSION_SCENARIOS_V1 = exports.WEB_E2E_WEB33_THEME_SCENARIOS_V1 = exports.WEB_E2E_WEB32_SCENARIOS_V1 = exports.WEB_E2E_WEB31_SCENARIOS_V1 = exports.WEB_E2E_LEGACY_SCENARIOS_V1 = exports.SUPPORTED_RELEASE_VERSION_LINE_V1 = exports.SUPPORTED_RELEASE_NODE_FLOORS_V1 = exports.SUPPORTED_RELEASE_NODE_MAJORS_V1 = exports.RELEASE_RECEIPT_VERSION_V1 = void 0;
+exports.WEB_E2E_CRITICAL_SCENARIOS_V1 = exports.WEB_E2E_WEB33_CRITICAL_SCENARIOS_V1 = exports.WEB_E2E_WEB32_CRITICAL_SCENARIOS_V1 = exports.WEB_E2E_WEB31_CRITICAL_SCENARIOS_V1 = exports.WEB_E2E_SETTINGS_SCENARIOS_V1 = exports.WEB_E2E_FULL_SCENARIOS_V1 = exports.WEB_E2E_WEB317_SCENARIOS_V1 = exports.WEB_E2E_WEB38_SCENARIOS_V1 = exports.WEB_E2E_WEB33_SCENARIOS_V1 = exports.WEB_E2E_WEB33_SESSION_SCENARIOS_V1 = exports.WEB_E2E_WEB33_THEME_SCENARIOS_V1 = exports.WEB_E2E_WEB32_SCENARIOS_V1 = exports.WEB_E2E_WEB31_SCENARIOS_V1 = exports.WEB_E2E_LEGACY_SCENARIOS_V1 = exports.SUPPORTED_RELEASE_VERSION_LINE_V1 = exports.SUPPORTED_RELEASE_NODE_FLOORS_V1 = exports.SUPPORTED_RELEASE_NODE_MAJORS_V1 = exports.RELEASE_RECEIPT_VERSION_V1 = void 0;
 exports.createTarballArtifactReceiptV1 = createTarballArtifactReceiptV1;
 exports.verifyTarballArtifactReceiptV1 = verifyTarballArtifactReceiptV1;
 exports.createRuntimeMatrixReceiptV1 = createRuntimeMatrixReceiptV1;
@@ -101,11 +101,37 @@ exports.WEB_E2E_WEB33_SCENARIOS_V1 = Object.freeze([
     ...exports.WEB_E2E_WEB33_THEME_SCENARIOS_V1,
     ...exports.WEB_E2E_WEB33_SESSION_SCENARIOS_V1,
 ]);
+/**
+ * v0.3.17 — LOCAL WORKSPACE open path. The picker is driven by a script file
+ * (`ORION_CODE_WEB_PICKER_FIXTURE`) so CI never opens a real Finder dialog.
+ */
+exports.WEB_E2E_WEB38_SCENARIOS_V1 = Object.freeze([
+    'WEB38-P0-01',
+    'WEB38-P0-02',
+    'WEB38-P0-03',
+    'WEB38-P0-04',
+    'WEB38-P0-05',
+]);
+/**
+ * v0.3.17 — Git right-hand work panel (`docs/plan/v0.3.17-plan.md`).
+ *
+ * One id per user-visible capability the plan calls P0/P1 and that a browser can
+ * actually verify; the per-stage unit suites are registered separately.
+ */
+exports.WEB_E2E_WEB317_SCENARIOS_V1 = Object.freeze([
+    'WEB39-P0-01',
+    'WEB39-P0-02',
+    'WEB39-P0-03',
+    'WEB39-P0-04',
+    'WEB39-P0-05',
+]);
 exports.WEB_E2E_FULL_SCENARIOS_V1 = Object.freeze([
     ...exports.WEB_E2E_LEGACY_SCENARIOS_V1,
     ...exports.WEB_E2E_WEB31_SCENARIOS_V1,
     ...exports.WEB_E2E_WEB32_SCENARIOS_V1,
     ...exports.WEB_E2E_WEB33_SCENARIOS_V1,
+    ...exports.WEB_E2E_WEB38_SCENARIOS_V1,
+    ...exports.WEB_E2E_WEB317_SCENARIOS_V1,
 ]);
 exports.WEB_E2E_SETTINGS_SCENARIOS_V1 = Object.freeze(exports.WEB_E2E_FULL_SCENARIOS_V1.filter(id => id.startsWith('SET-P0-')));
 exports.WEB_E2E_WEB31_CRITICAL_SCENARIOS_V1 = Object.freeze([

package/dist/services/session-storage.d.ts

@@ -620,6 +620,15 @@ export declare function listSessions(limit?: number): SessionMeta[];
  * Sessions are excluded so the picker count matches the default listing.
  */
 export declare function countSessionsByProject(): ReadonlyMap<string, number>;
+/**
+ * v0.3.17 — Counts **only when the catalog is already warm**.
+ *
+ * Previewing a directory must never make the user wait for a catalog rebuild or
+ * a file-lock acquisition (the lock ceiling is 10s). This validates the
+ * in-memory cache with a cheap `stat` — no scan, no lock, no write — and
+ * returns `null` otherwise so callers can defer the count instead of blocking.
+ */
+export declare function peekCachedSessionCounts(): ReadonlyMap<string, number> | null;
 /**
  * List sessions for a single canonical project (default listings exclude
  * archived sessions).

package/dist/services/session-storage.js

@@ -53,6 +53,7 @@ exports.loadSessionHistoryWithDiagnostics = loadSessionHistoryWithDiagnostics;
 exports.loadSessionRestoreBundle = loadSessionRestoreBundle;
 exports.listSessions = listSessions;
 exports.countSessionsByProject = countSessionsByProject;
+exports.peekCachedSessionCounts = peekCachedSessionCounts;
 exports.listProjectSessions = listProjectSessions;
 exports.listArchivedProjectSessions = listArchivedProjectSessions;
 exports.findSession = findSession;
@@ -2233,8 +2234,33 @@ function listSessions(limit) {
  * Sessions are excluded so the picker count matches the default listing.
  */
 function countSessionsByProject() {
+    return countSessionsByProjectFromCatalog(loadOrRebuildSessionCatalog());
+}
+/**
+ * v0.3.17 — Counts **only when the catalog is already warm**.
+ *
+ * Previewing a directory must never make the user wait for a catalog rebuild or
+ * a file-lock acquisition (the lock ceiling is 10s). This validates the
+ * in-memory cache with a cheap `stat` — no scan, no lock, no write — and
+ * returns `null` otherwise so callers can defer the count instead of blocking.
+ */
+function peekCachedSessionCounts() {
+    const cache = sessionCatalogCache;
+    if (!cache)
+        return null;
+    try {
+        const stat = (0, fs_1.statSync)(cache.path);
+        if (stat.mtimeMs !== cache.mtimeMs || stat.size !== cache.size)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return countSessionsByProjectFromCatalog(cache.catalog);
+}
+function countSessionsByProjectFromCatalog(catalog) {
     const counts = new Map();
-    for (const session of Object.values(loadOrRebuildSessionCatalog().sessions)) {
+    for (const session of Object.values(catalog.sessions)) {
         if (session.archivedAt)
             continue;
         counts.set(session.projectPath, (counts.get(session.projectPath) ?? 0) + 1);

package/dist/web/git-compare-service.d.ts

@@ -0,0 +1,45 @@
+export type GitCompareModeV1 = 'snapshot' | 'merge-base';
+export interface GitCompareFileV1 {
+    readonly path: string;
+    readonly renamedFrom: string | null;
+    readonly additions: number;
+    readonly deletions: number;
+    readonly binary: boolean;
+    readonly sensitive: boolean;
+}
+export interface GitCompareResultV1 {
+    readonly mode: GitCompareModeV1;
+    readonly requestedBaseRef: string;
+    readonly requestedHeadRef: string;
+    /** The commits the comparison actually used; the UI freezes the result against these. */
+    readonly baseOid: string;
+    readonly headOid: string;
+    readonly baseLabel: string;
+    readonly headLabel: string;
+    /** Set only in merge-base mode: the divergence point that was used. */
+    readonly mergeBaseOid: string | null;
+    readonly files: readonly GitCompareFileV1[];
+    readonly additions: number;
+    readonly deletions: number;
+    readonly truncated: boolean;
+}
+export interface GitCompareReaderOptions {
+    readonly runGit: (args: readonly string[]) => Promise<string>;
+}
+export declare function createGitCompareReader(options: GitCompareReaderOptions): {
+    /** Validates a pair of refs and returns their commits, without computing anything yet. */
+    resolvePair(baseRef: string, headRef: string): Promise<Readonly<{
+        baseRef: string;
+        headRef: string;
+        baseOid: string;
+        headOid: string;
+        baseLabel: string;
+        headLabel: string;
+    }>>;
+    compare(input: {
+        readonly baseRef: string;
+        readonly headRef: string;
+        readonly mode: GitCompareModeV1;
+    }): Promise<GitCompareResultV1>;
+};
+//# sourceMappingURL=git-compare-service.d.ts.map