opencode-navigator 0.24.0 → 0.25.0

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## [0.25.0] - 2026-10-31
+
+- Offer Enable Todo when OpenCode 2's native tool is disabled, with an existing server-config picker, exact change preview and separate confirmation. Preserve unrelated JSONC content and refuse stale targets; distinguish disabled Todo from an enabled empty list.
+- Update the seven-slide setup wizard for native Todo enablement, provider/account limits, multi-icon or text-only toolbar pins, About/changelog and Bug reports. Describe each host's real permissions/LSP capabilities and keep navigation visible while short-terminal content scrolls.
+
 ## [0.24.0] - 2026-10-31
 
 - Support the latest stable OpenCode 1.19.5 and 2.2.5 releases, preserving both host adapters and existing sidebar behavior.

package/HOST_API.md

@@ -33,6 +33,7 @@ justify bypassing a native API.
 | Subagent child discovery | Published TUI Data caches sessions but has no complete children-sync operation. Initial/manual/reconnect discovery uses the public paginated API and syncs unknown IDs into the host cache. | A complete children-sync/query on the supplied public Data interface. |
 | Subagent observation history and retry details | Native status and cached transcript retry data are used first; recent runs, pre-observation clock markers, errors and unloaded-child retry detail remain observation history. | Equivalent public observed-run/retry history without loading every transcript. |
 | Read-only Todo projection | Native completed tool calls and revert are public; the host's `sessionTodos` helper is not exported. No direct CRUD/priority API exists. | A public equivalent projection; editing also requires an explicitly selected interaction and supported API. |
+| Native Todo enablement | `config.get` exposes ordered sources, but `experimental.config.update` supports only shell. The setup feature previews and confirms a JSONC leaf edit in an existing discovered source through public server file APIs. File reads are location-confined, so selected-file IO is routed to its server-side parent; the original session/location remains the stale-target guard. Reads immediately before writes reject changed previews, and readback verifies the file and effective flag. The public write API has no CAS, so this is not an atomic transaction against concurrent external writers; uncertain outcomes require Refresh before retry. No model, shell or Todo event is used. | A public Todo config patch API preserving source precedence, unrelated JSONC content and conditional-write semantics. |
 | Console/Go request lifecycle and projection | `client.usage.limits` is public, but the internal usage cache and budget selectors are not in published Plugin Context. Workspace IDs are not provider account IDs. | Equivalent public cache and selector on the plugin interface. |
 | External quotas / reset credits | Console/Go is not a universal provider API and has no Codex reset-credit consume operation. Sources stay documented, account-bound and portable. Native auth/request errors never enable a bypass reader. | Host APIs matching provider/account/units/resets and idempotent consume semantics. |
 | Pinned-file snapshot installer | Native package updates do not implement the recognized versioned wrapper/staging layout. Preserve installation source and scope. | A public atomic file-snapshot update API with equivalent verification. |
@@ -54,7 +55,7 @@ exercise migration only; they do not extend the supported host matrix.
 The published 2.2.5 TUI context, plugin, index and Solid declarations are identical
 to 2.2.0. OpenTUI 0.8 retains the drawing-only paint-hook contract; renderer tests,
 nested dialogs and frame-level typing probes run against the updated runtime.
-Development uses Bun 1.4.4 and OpenTUI 0.8, leaving Solid/OpenTUI external so the
+Development uses Bun 1.4.4 and OpenTUI 0.8.1, leaving Solid/OpenTUI external so the
 host owns its runtime. The 1.x host ships older runtime modules; its actual smoke
 must pass rather than injecting the development modules into it.
 
@@ -68,11 +69,11 @@ renderer/FFI support. CI and package verification use Node 26.12.1.
 - `web-tree-sitter` stays at **0.25.10**, the exact peer required by OpenTUI
   0.8.0. Upgrade it when the supported host runtime publishes a compatible peer
   contract; the independent 0.27 line is not a compatible substitution.
-- `typescript` stays at **6.0.3**, the latest compatible compiler for the shared
-  linter stack. TypeScript 7.0.2 type-checks Navigator, but SonarJS/`ts-api-utils`
-  fails while loading its missing JavaScript compiler API. Upgrade when those
-  consumers support the new compiler distribution; do not disable their rules
-  to make an incompatible upgrade pass.
+- `typescript` is **7.0.2** throughout the resolved project graph. The shared
+  preset's legacy compiler dependency is overridden to TS7; its incompatible
+  SonarJS and typescript-eslint JS plugins are not loaded. Native replacements,
+  retained compatible plugins and the explicitly approved coverage loss are
+  documented in [Lint coverage](LINT_COVERAGE.md). No TS6 compatibility copy is used.
 - Bun remains pinned at **1.4.4**, the current stable release. Direct dependencies
   otherwise use their latest compatible stable releases; transitive updates stay
   within upstream ranges. Runtime peers remain host-owned and are not bundled.

package/LINT_COVERAGE.md

@@ -0,0 +1,201 @@
+# TypeScript 7 Lint Coverage
+
+Project type checking uses stable TypeScript 7. The lockfile resolves every
+TypeScript dependency, including the shared preset's dependency tree, to that
+version. There is no TypeScript 6 compatibility installation.
+
+Oxlint uses `@st1ggy/linter-config/solid-ox` with type-aware analysis. Oxfmt uses
+`@st1ggy/linter-config/oxfmt-common`. `scripts/native-lint-config.ts` adapts the
+published preset without editing installed packages. The user explicitly approved
+the uncovered SonarJS checks below after reviewing the TS7 incompatibility.
+
+## Preserved Checks
+
+- Native ESLint, TypeScript, import and Unicorn rules remain enabled.
+- The compatible Solid, ESLint-core, import-x, stylistic and Unicorn JS plugins
+  remain enabled. There is no blanket removal of JS plugins.
+- `typescript-js/array-type` and `typescript-js/prefer-as-const` use their native
+  `typescript/` equivalents. The legacy typescript-eslint plugin is not loaded.
+- Six SonarJS checks use native ESLint equivalents: `block-scoped-var`,
+  `no-delete-var`, `no-fallthrough`, `no-labels`, `no-unused-vars` and
+  `no-useless-catch`. Existing native options take precedence.
+- Oxfmt still checks formatting separately. This migration does not configure
+  Stylelint for the CSS-free TUI project.
+
+## Approved Coverage Loss
+
+The published preset configures 161 SonarJS rule names. Six have the direct
+native mappings above. The following 155 preset checks are not loaded after
+removing the TS6-dependent SonarJS plugin. Some overlap with other retained rules,
+but that is not claimed as complete semantic equivalence. The list includes
+checks for frameworks and services this project does not use; it describes the
+preset, not 155 distinct bugs or applicable findings in Navigator.
+
+In particular, native cyclomatic complexity is not a replacement for SonarJS
+cognitive complexity. Identical-function detection, several security/regex
+checks and SonarJS-specific test heuristics lose their dedicated coverage.
+
+```text
+sonarjs/assertions-in-test-cases
+sonarjs/async-test-assertions
+sonarjs/aws-apigateway-public-api
+sonarjs/aws-ec2-rds-dms-public
+sonarjs/aws-ec2-unencrypted-ebs-volume
+sonarjs/aws-efs-unencrypted
+sonarjs/aws-iam-all-privileges
+sonarjs/aws-iam-privilege-escalation
+sonarjs/aws-iam-public-access
+sonarjs/aws-opensearchservice-domain
+sonarjs/aws-rds-unencrypted-databases
+sonarjs/aws-restricted-ip-admin-access
+sonarjs/aws-s3-bucket-granted-access
+sonarjs/aws-s3-bucket-insecure-http
+sonarjs/aws-s3-bucket-public-access
+sonarjs/aws-s3-bucket-versioning
+sonarjs/aws-sagemaker-unencrypted-notebook
+sonarjs/aws-sns-unencrypted-topics
+sonarjs/aws-sqs-unencrypted-queue
+sonarjs/call-argument-line
+sonarjs/chai-determinate-assertion
+sonarjs/class-name
+sonarjs/code-eval
+sonarjs/cognitive-complexity
+sonarjs/comma-or-logical-or-case
+sonarjs/constructor-for-side-effects
+sonarjs/content-length
+sonarjs/content-security-policy
+sonarjs/cookie-no-httponly
+sonarjs/cors
+sonarjs/csrf
+sonarjs/disabled-timeout
+sonarjs/dynamically-constructed-templates
+sonarjs/encryption-secure-mode
+sonarjs/explicit-test-skip
+sonarjs/file-permissions
+sonarjs/file-uploads
+sonarjs/fixme-tag
+sonarjs/for-loop-increment-sign
+sonarjs/function-inside-loop
+sonarjs/future-reserved-words
+sonarjs/generator-without-yield
+sonarjs/hardcoded-secret-signatures
+sonarjs/hashing
+sonarjs/hooks-before-test-cases
+sonarjs/inconsistent-function-call
+sonarjs/insecure-cookie
+sonarjs/insecure-jwt-token
+sonarjs/inverted-assertion-arguments
+sonarjs/label-position
+sonarjs/link-with-target-blank
+sonarjs/max-switch-cases
+sonarjs/memoize-cache-key
+sonarjs/misplaced-loop-counter
+sonarjs/no-all-duplicated-branches
+sonarjs/no-angular-bypass-sanitization
+sonarjs/no-case-label-in-switch
+sonarjs/no-clear-text-protocols
+sonarjs/no-code-after-done
+sonarjs/no-dead-store
+sonarjs/no-debug-commands-in-ui-tests
+sonarjs/no-default-utility-imports
+sonarjs/no-duplicate-in-composite
+sonarjs/no-duplicate-test-title
+sonarjs/no-duplicated-branches
+sonarjs/no-element-overwrite
+sonarjs/no-empty-collection
+sonarjs/no-empty-test-file
+sonarjs/no-empty-test-title
+sonarjs/no-equals-in-for-termination
+sonarjs/no-exclusive-tests
+sonarjs/no-extra-arguments
+sonarjs/no-fixed-wait-in-tests
+sonarjs/no-floating-point-equality
+sonarjs/no-forced-browser-interaction
+sonarjs/no-global-this
+sonarjs/no-globals-shadowing
+sonarjs/no-gratuitous-expressions
+sonarjs/no-hardcoded-ip
+sonarjs/no-hardcoded-passwords
+sonarjs/no-hardcoded-secrets
+sonarjs/no-hook-setter-in-body
+sonarjs/no-identical-conditions
+sonarjs/no-identical-expressions
+sonarjs/no-identical-functions
+sonarjs/no-ignored-exceptions
+sonarjs/no-implicit-global
+sonarjs/no-incomplete-assertions
+sonarjs/no-internal-api-use
+sonarjs/no-interpolation-in-inline-snapshots
+sonarjs/no-invariant-returns
+sonarjs/no-inverted-boolean-check
+sonarjs/no-literal-call
+sonarjs/no-mime-sniff
+sonarjs/no-mixed-completion-style
+sonarjs/no-nested-assignment
+sonarjs/no-nested-conditional
+sonarjs/no-nested-functions
+sonarjs/no-nested-template-literals
+sonarjs/no-os-command-from-path
+sonarjs/no-parameter-reassignment
+sonarjs/no-primitive-wrappers
+sonarjs/no-redundant-assignments
+sonarjs/no-redundant-boolean
+sonarjs/no-redundant-jump
+sonarjs/no-referrer-policy
+sonarjs/no-same-argument-assert
+sonarjs/no-same-line-conditional
+sonarjs/no-session-cookies-on-static-assets
+sonarjs/no-skipped-tests
+sonarjs/no-table-as-layout
+sonarjs/no-trivial-assertions
+sonarjs/no-unenclosed-multiline-block
+sonarjs/no-uniq-key
+sonarjs/no-unthrown-error
+sonarjs/no-unused-collection
+sonarjs/no-use-of-empty-return-value
+sonarjs/no-useless-increment
+sonarjs/no-useless-react-setstate
+sonarjs/no-weak-cipher
+sonarjs/no-weak-keys
+sonarjs/non-existent-operator
+sonarjs/object-alt-content
+sonarjs/parameterized-tests
+sonarjs/prefer-default-last
+sonarjs/prefer-native-lodash-alternative
+sonarjs/prefer-promise-shorthand
+sonarjs/prefer-single-boolean-return
+sonarjs/prefer-specific-assertions
+sonarjs/prefer-type-guard
+sonarjs/prefer-while
+sonarjs/production-debug
+sonarjs/pseudo-random
+sonarjs/public-static-readonly
+sonarjs/publicly-writable-directories
+sonarjs/redundant-type-aliases
+sonarjs/review-blockchain-mnemonic
+sonarjs/session-regeneration
+sonarjs/stable-tests
+sonarjs/stateful-regex
+sonarjs/strict-transport-security
+sonarjs/super-linear-regex
+sonarjs/synchronous-suite-callback
+sonarjs/table-header
+sonarjs/table-header-reference
+sonarjs/test-check-exception
+sonarjs/todo-tag
+sonarjs/unverified-certificate
+sonarjs/unverified-hostname
+sonarjs/updated-const-var
+sonarjs/updated-loop-counter
+sonarjs/use-type-alias
+sonarjs/weak-ssl
+sonarjs/x-powered-by
+sonarjs/xml-parser-xxe
+```
+
+## Removing The Adapter
+
+Replace the compatibility projection when the shared preset offers a TS7-only
+stack with equivalent native rules or compatible public plugin APIs. Keep the
+coverage inventory explicit when upgrading that preset; do not label a removed
+check as preserved merely because a similarly named rule exists.

package/README.md

@@ -197,8 +197,22 @@ OpenCode 2.x CLI plugins are global terminal settings; there is no project-local
 plugin overrides are required. OpenCode validates `cli.json` strictly, so keep it
 within the linked schema and restart OpenCode after changing it.
 
-OpenCode 2.1's built-in Todo tool is opt-in. Enable it in the OpenCode server
-configuration used by that host, then restart OpenCode:
+OpenCode 2's built-in Todo tool is opt-in. When its effective configuration
+disables the tool, Navigator offers **Enable Todo…** in the section and
+**Enable native Todo** in the command palette. Choose an existing discovered
+server configuration file, review `experimental.todo → true`, then confirm
+**Enable Todo**. Cancel and Escape preserve the file. Navigator retains JSONC
+comments, formatting and unrelated settings, and checks for changed files,
+configuration sources, sessions and workspaces before writing.
+
+The check uses the host configuration, not the presence or absence of tasks.
+An enabled empty list therefore says **No tasks yet** without another enable
+offer. Configuration read failures have their own Retry action. Remote file
+operations stay on the connected server; no model or Todo mutation is used for
+setup. Refresh or restart OpenCode if a saved flag has not yet been applied.
+See [Host API boundaries](HOST_API.md) for precedence and conditional-write limits.
+
+Alternatively, enable the tool manually in the server configuration used by that host:
 
 ```json
 {
@@ -216,6 +230,10 @@ completed list visible; a completed write with an empty array clears it.
 Native tasks have `content` and one of `pending`, `in_progress`, `completed`, or
 `cancelled`; priorities remain unavailable in OpenCode 2's native schema.
 
+![Disabled native Todo offers enablement](screenshots/84-native-todo-disabled.png)
+
+![Review the server configuration change before enabling Todo](screenshots/86-native-todo-enable-preview.png)
+
 The optional **server** half of Navigator is used for provider-native quotas and
 read-only access to the previous Navigator Todo archive. Add it to the server
 configuration only when those integrations are needed:
@@ -349,9 +367,13 @@ opencode
 OpenCode reads TUI configuration at startup. Restart it after changing the
 plugin or `tui.json`.
 
-On first launch, a seven-step setup wizard introduces monitoring, Search Everything,
-Skills, Quick Actions, LSP, MCP controls, presets, and workspace customization
-before letting you choose which sections to show. The guide is shown once and can be opened again
+On first launch, a seven-step setup wizard introduces monitoring and native Todo
+enablement, provider/account limits, Search Everything and Skills, Actions and
+private toolbar pins, host-supported language tools, MCP, and customization.
+It includes About, release history and Bug reports before the final section picker.
+Descriptions match each host's permissions/LSP capabilities. Long content and
+section choices scroll with the mouse or PageUp/PageDown while headings and
+Back/Next/Finish stay visible. The guide is shown once and can be opened again
 later from the sidebar settings button. The settings dialog also selects global
 or current-worktree scope, manages named layout presets, and controls section
 order, MCP state persistence, icon style, and the sidebar shortcuts without
@@ -359,6 +381,8 @@ a restart. Settings are grouped into tabs; use `Tab` and `Shift+Tab` to switch
 tabs. In the Sections tab, use `Left`/`Right` or `Shift+Up`/`Shift+Down` to
 reorder the selected section.
 
+![Setup navigation remains visible in a short terminal](screenshots/94-setup-short.png)
+
 The Sections tab combines visibility, ordering, and the number of visible items
 for each section. Click `Items: All` / `Items: N`, or press `L` on the selected
 section, to edit its item limit. Enter toggles visibility; the arrow controls
@@ -950,7 +974,8 @@ session or workspace dismisses the entire search dialog chain.
 
 ## Scripts
 
-Development requires Bun 1.4.2 and Node.js 24.16 or newer. Install dependencies with
+Development uses Bun 1.4.4 and stable TypeScript 7. Standalone Node/OpenTUI paths
+require Node.js 26.4 or newer; CI pins Node 26.12.1. Install dependencies with
 `bun install --frozen-lockfile`.
 
 Oxlint uses the `solid-ox` preset from
@@ -959,6 +984,9 @@ Oxlint uses the `solid-ox` preset from
 OpenTUI callbacks, SDK compatibility, and test fixtures. Type-aware analysis uses
 `oxlint-tsgolint`; `tsconfig.lint.json` covers application code, tests, build scripts,
 and configuration files. Formatter exclusions are maintained in `oxfmt.config.ts`.
+The resolved dependency tree contains TS7 only. The approved removal of
+incompatible SonarJS checks and native replacements is documented in
+[Lint coverage](LINT_COVERAGE.md); compatible Solid and other JS checks remain.
 
 ```sh
 bun run test