opencode-navigator 0.25.0 → 0.27.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.27.0] - 2026-11-11
+
+- Add an experimental OpenCode Desktop interface with a native panel, narrow-screen drawer, and opt-in in-app mini-window. Move, resize, reset and redock it with the mouse or keyboard while keeping the selected session and filters.
+- Bring Search Everything, Skills, MCP groups and presets, Quick Actions, and customizable toolbar pins to Desktop. Share private favorites, trust decisions and preferences with local TUI instances without duplicating monitoring.
+- Add native Desktop settings with scoped section controls, groups, reviewed presets and project profiles, portable import/export, a seven-slide setup guide, About, browsable release history and editable GitHub Bug reports.
+- Keep superseded Desktop configuration reads from showing a false error after a newer refresh, while preserving genuine failures and retry guidance.
+- Show verified provider/account quotas in Desktop with explicit account linking and separately confirmed banked resets. Keep remote sessions isolated from local accounts and preserve unresolved reset attempts across retries.
+- Support OpenCode 1.19.5 and 2.2.6 while preserving both TUI adapters, existing settings, pinned-source updates and read-only legacy Todo archives.
+
+## [0.26.0] - 2026-11-06
+
+- Prevent background retries from accumulating cancellation listeners and preferences loading from waiting indefinitely on recovery markers.
+- Show exact active Subagent durations from OpenCode 2's native execution start time, preserving the observation fallback when timing is unavailable. Keep interrupted executions marked as cancelled in recent history.
+
 ## [0.25.0] - 2026-10-31
 
 - Offer Enable Todo when OpenCode 2's native tool is disabled, with an existing server-config picker, exact change preview and separate confirmation. Preserve unrelated JSONC content and refuse stale targets; distinguish disabled Todo from an enabled empty list.

package/HOST_API.md

@@ -1,17 +1,117 @@
 # Public Host APIs And Remaining Gaps
 
-Navigator supports only OpenCode **1.19.5** and **2.2.5**, the current stable
+Navigator supports only OpenCode **1.19.5** and **2.2.6**, the current stable
 release in each major line. Published SDK declarations and real-host checks
 define the boundary; internal host components are not plugin APIs.
 
+## Approved Desktop Integration Contract
+
+Desktop support uses the independent `./gui-experimental` entry available from
+Navigator 0.27.0, not the TUI entrypoint. Earlier packages do not include this GUI.
+The approved target is OpenCode Desktop 2.2.6, with TUI 1.19.5 and 2.2.6 kept
+behind explicit adapters. The published 2.2.6 plugin package preserves every TUI
+declaration from 2.2.5; its changed declarations are GUI-specific.
+
+| Capability | Published Desktop contract | Navigator integration constraint |
+| --- | --- | --- |
+| GUI loading | `./gui-experimental`, `@opencode/plugin/gui`, one CJS bundle through `gui/vite` | Load from global server configuration; a CLI-only plugin entry does not enable Desktop. Preserve the server plugin's historical identity. |
+| Data and requests | Reactive session `server.data` and live `server.client` | Resolve the selected session's server on every operation; the plugin-level client is the desktop sidecar, not an arbitrary remote session. |
+| Session identity | Host session keys include server identity; location can be unavailable during reconnect | Partition domain state and reject stale actions by server/session/location; never put credentials in cache keys. |
+| Layout | Native side panels, host-controlled bottom placement, narrow drawers, panel-specific width | Use native containers first. The optional floating view is an in-app presentation of the same state, not a detached OS window. |
+| Commands and composer | Native command registry and reactive routed composer/model | Map verified commands explicitly; never emulate GUI actions by fabricating terminal command events. |
+| Dialogs and settings | Native nested dialogs, SettingsPage and settings/menu components | Share validation and action state, not terminal dialog renderers or focus loops. |
+| Local operations | Desktop main, validated IPC, Node/Electron only in main | Renderer models have no filesystem, subprocess or token access. Preserve the existing private store and lock rather than copying preferences to GUI storage. |
+| Remote operations | The selected server's public client and existing plugin RPC | Do not read local project files or use local provider credentials for a remote target. Missing server capabilities remain explicit. |
+| Native windows | Public main context can inspect existing windows; no panel detach operation | Detached OS windows are outside this delivery. Do not mutate host DOM or use private app internals to simulate support. |
+
+The GUI API is experimental. Browser Web is not a verified target in this cycle.
+The renderer and headless models must remain independent of Electron so a later
+Web adapter does not require a second implementation of product rules.
+
+Verification uses an npm-style tarball in the official checksum-verified Linux
+ARM64 Desktop 2.2.6 package under Xvfb. Native macOS/Windows and multiple live
+Desktop windows are not claimed as real-host coverage; remote identity, independent
+window leases and concurrent shared-store writes are synthetic contracts. The
+unminified TUI remains limited to 360,000 bytes; the single-file GUI has its own
+600,000-byte budget (about 554 kB at the stage-10 baseline).
+
+Native Settings temporarily has no mounted session and may have no active tab.
+Navigator retains only a previously observed public session reference still
+confirmed by the public tab list, server and location; Home, closing that tab or
+changing its target clears it. Settings/profile operations use that reference's
+live client/cache rather than substituting the sidecar.
+
+Private favorites, trust, presets, account bindings and reset attempts remain in
+the established filesystem preferences store/lock via typed main IPC. Native GUI
+storage holds presentation only. Explicit Reload flushes writes, refreshes private
+preferences and selected-server configured defaults, and clears temporary layout
+overrides. Project profiles use the selected server RPC with exact file previews
+and stale-file checks; workspace-placed filesystems are rejected until the public
+server contract provides a verified placement-aware atomic write operation.
+
+GUI permission actions open native Settings. No supported Desktop startup/Home
+interception or LSP status contract was found; those terminal capabilities are not
+simulated. Revisit the gaps when equivalent public APIs become available. Changelog
+browsing is independent of the one-time version claim used by startup notes.
+
+On narrow Desktop windows, Navigator uses **More → Navigator**, the host's
+native drawer. The floating view redocks when the viewport becomes narrow.
+Desktop 2.2.6 keeps drawer opening in its own mobile navigation; Navigator does
+not click or move host elements to force it open. Revisit automatic drawer
+opening when the public layout API exposes that operation.
+
+The Desktop model controls use the verified 2.2.6 commands `model.choose` and
+`model.variant.cycle`. These IDs are version-audited mappings, not portable
+TUI command names; a rejected dispatch reports that the control is unavailable.
+
+The isolated Desktop 2.2.6 host also has a native dialog-context defect: opening
+its command palette after a plugin dialog in a session can fail with
+`Command context must be used within a context provider`. The same minimal
+fixture reproduces this with Navigator disabled; Home does not reproduce it.
+Navigator does not patch host contexts. Interaction smokes keep this native-only
+probe separate and exercise subsequent plugin commands through the public
+`commands.run` API. Recheck this limitation on the next audited Desktop target.
+
+Sources: [GUI plugins](https://opencode.ai/docs/build/plugins/gui),
+[TUI plugins](https://opencode.ai/docs/build/plugins/cli),
+[RPC](https://opencode.ai/docs/build/plugins/rpc), and the published
+`@opencode/plugin@2.2.6` declaration archive, audited on 2026-11-10.
+
 ## Host-Owned Services
 
-| Capability | OpenCode 1.19.5 | OpenCode 2.2.5 |
+### Dependency audit limits
+
+The candidate's frozen install and peer graph pass, but its security audit is
+not clean. The supported 1.x plugin pins an older Effect beta and Zod; its Effect
+graph also carries TOML denial-of-service advisories. The supported 2.x utility
+package pins Glob and Minimatch versions with denial-of-service advisories.
+Navigator does not force incompatible transitive-major overrides or suppress the
+audit. Removal depends on compatible upstream fixes in the supported host graph;
+review these advisories again before publication.
+
+### Selected-server quota services
+
+Desktop Codex reads and reset submissions run behind typed main-process IPC,
+only for the host-verified `sameMachine` sidecar. Main rechecks the session
+directory, live client, active connection and private account binding; it never
+returns credentials or provider headers to the renderer. Remote sessions use
+their selected server's quota RPC and never borrow the Desktop's local account.
+Public session and quota-event locations expose only a directory, not a workspace
+ID. Workspace requests retain explicit location guards, and quota observations
+without sufficient workspace identity do not trigger an automatic read.
+
+The ordinary Codex bucket is account-scoped even when `normalModelSlug` is null.
+Missing reset-credit details do not erase the provider's available count. Reset
+submission requires a separate confirmation and an authoritative persisted
+attempt; uncertain retries retain its idempotency key. No credit is spent during
+review, refresh or account linking.
+
+| Capability | OpenCode 1.19.5 | OpenCode 2.2.6 |
 | --- | --- | --- |
 | Todo | Supported host Todo source/events | Public message cache, completed `todowrite` and revert boundary |
-| Skills | Host discovery and prompt insertion | Native Skill cache and `session.skill` with exact ID |
-| MCP | Host status and connection API | Native cache, sync/invalidate and connect/disconnect |
-| Subagents | Supported child/status API and events | Native session cache/status and typed execution events |
+| Skills | Host discovery and prompt insertion | Native Skill cache and `experimental.session.skill` with exact ID |
+| MCP | Host status and connection API | Native cache, sync/invalidate and `experimental.mcp.connect/disconnect` |
+| Subagents | Supported child/status API and events | Native session cache/status, execution start time and typed execution events |
 | Commands | Public keymap | Public owned layers, targets, priorities, modes, discovery and dispatch |
 | Dialogs/toasts | Public dialog components and mounting | Public show/prompt/confirm/set/clear and toast |
 | Model/variant | Saved session model and host pickers | Reactive prompt model, variant API and host pickers |
@@ -31,10 +131,10 @@ justify bypassing a native API.
 | Bug-report transport and external browser launch | Neither supported public TUI contract provides GitHub issue creation or an external browser opener. Direct sending uses the user's authenticated `gh` without reading credential files; a `type: Bug` repository form handles browser reports. Bounded argv-based OS launch has a visible link/clipboard fallback on remote or headless hosts. | Equivalent public host issue/browser APIs preserving authentication ownership, editable draft, real issue type and confirmation semantics. |
 | Literal Ctrl+, hook on 2.x | Public plugin bindings are strings; the comma expander splits literal commas into alternatives. The named parser does not normalize `comma` to the actual comma event. Dispatch still uses the native command API. | A documented literal-comma binding passing the real Settings smoke. |
 | Subagent child discovery | Published TUI Data caches sessions but has no complete children-sync operation. Initial/manual/reconnect discovery uses the public paginated API and syncs unknown IDs into the host cache. | A complete children-sync/query on the supplied public Data interface. |
-| Subagent observation history and retry details | Native status and cached transcript retry data are used first; recent runs, pre-observation clock markers, errors and unloaded-child retry detail remain observation history. | Equivalent public observed-run/retry history without loading every transcript. |
+| Subagent observation history and retry details | Native status, `SessionInfo.time.busy` and cached retry data are used first. Valid current-execution start times give exact active durations without a pre-observation marker; missing/invalid timing keeps the observed fallback. Recent runs, errors and unloaded-child retry details remain observation history. The prior execution's `idle`/`outcome` never completes a currently running execution. | Equivalent public observed-run/retry history without loading every transcript. |
 | Read-only Todo projection | Native completed tool calls and revert are public; the host's `sessionTodos` helper is not exported. No direct CRUD/priority API exists. | A public equivalent projection; editing also requires an explicitly selected interaction and supported API. |
 | Native Todo enablement | `config.get` exposes ordered sources, but `experimental.config.update` supports only shell. The setup feature previews and confirms a JSONC leaf edit in an existing discovered source through public server file APIs. File reads are location-confined, so selected-file IO is routed to its server-side parent; the original session/location remains the stale-target guard. Reads immediately before writes reject changed previews, and readback verifies the file and effective flag. The public write API has no CAS, so this is not an atomic transaction against concurrent external writers; uncertain outcomes require Refresh before retry. No model, shell or Todo event is used. | A public Todo config patch API preserving source precedence, unrelated JSONC content and conditional-write semantics. |
-| Console/Go request lifecycle and projection | `client.usage.limits` is public, but the internal usage cache and budget selectors are not in published Plugin Context. Workspace IDs are not provider account IDs. | Equivalent public cache and selector on the plugin interface. |
+| Console/Go request lifecycle and projection | `client.experimental.usage.limits` is public, but the internal usage cache and budget selectors are not in published Plugin Context. Workspace IDs are not provider account IDs. | Equivalent public cache and selector on the plugin interface. |
 | External quotas / reset credits | Console/Go is not a universal provider API and has no Codex reset-credit consume operation. Sources stay documented, account-bound and portable. Native auth/request errors never enable a bypass reader. | Host APIs matching provider/account/units/resets and idempotent consume semantics. |
 | Pinned-file snapshot installer | Native package updates do not implement the recognized versioned wrapper/staging layout. Preserve installation source and scope. | A public atomic file-snapshot update API with equivalent verification. |
 | Corner masks and product UI | Multiline shape, three-cell controls, filters, groups, presets and pins are product features. Paint hooks only draw; scroll restoration runs outside paint. | Equivalent public primitives preserving geometry, behavior and fallback mode. |
@@ -52,10 +152,10 @@ justify bypassing a native API.
 
 Both current hosts have isolated real-host checks. Historical installer fixtures
 exercise migration only; they do not extend the supported host matrix.
-The published 2.2.5 TUI context, plugin, index and Solid declarations are identical
-to 2.2.0. OpenTUI 0.8 retains the drawing-only paint-hook contract; renderer tests,
+The published 2.2.6 TUI declarations are identical to 2.2.5. OpenTUI 0.8 retains
+the drawing-only paint-hook contract; renderer tests,
 nested dialogs and frame-level typing probes run against the updated runtime.
-Development uses Bun 1.4.4 and OpenTUI 0.8.1, leaving Solid/OpenTUI external so the
+Development uses Bun 1.4.4 and OpenTUI 0.8.3, leaving Solid/OpenTUI external so the
 host owns its runtime. The 1.x host ships older runtime modules; its actual smoke
 must pass rather than injecting the development modules into it.
 
@@ -67,13 +167,22 @@ renderer/FFI support. CI and package verification use Node 26.12.1.
 ### Deliberate Compatibility Pins
 
 - `web-tree-sitter` stays at **0.25.10**, the exact peer required by OpenTUI
-  0.8.0. Upgrade it when the supported host runtime publishes a compatible peer
+  0.8.3. Upgrade it when the supported host runtime publishes a compatible peer
   contract; the independent 0.27 line is not a compatible substitution.
-- `typescript` is **7.0.2** throughout the resolved project graph. The shared
-  preset's legacy compiler dependency is overridden to TS7; its incompatible
-  SonarJS and typescript-eslint JS plugins are not loaded. Native replacements,
-  retained compatible plugins and the explicitly approved coverage loss are
-  documented in [Lint coverage](LINT_COVERAGE.md). No TS6 compatibility copy is used.
+- `typescript` is **6.0.3**, selected to match the complete published
+  `@st1ggy/linter-config` **10.0.0** preset. SonarJS and typescript-eslint JS
+  plugins remain enabled without the former TS7 projection or override.
+  [Lint coverage](LINT_COVERAGE.md) records the current setup and historical exclusions.
+- Oxlint **1.90.0**, Oxfmt **0.75.0** and oxlint-tsgolint **7.0.2005** match the
+  preset's exact peer versions. Advance them when the preset supports newer engines.
+- OpenTUI's transitive `bun-ffi-structs` **0.3.1** declares the outdated compiler
+  peer `typescript: ^5`. A root-only Bun metadata patch expands it to `^5 || ^6`;
+  no runtime bytes or declarations change. Strict declaration compilation with
+  library checks enabled, packing regressions and the resolved compiler graph
+  verify the selected TS6 use. Remove the patch when upstream accepts TS6.
+  Bun patches apply only in this repository, not transitively in consumer projects
+  or the separately generated snapshot runtime manifest. Those installations may
+  still report the upstream peer warning; this is not an upstream fix.
 - Bun remains pinned at **1.4.4**, the current stable release. Direct dependencies
   otherwise use their latest compatible stable releases; transitive updates stay
   within upstream ranges. Runtime peers remain host-owned and are not bundled.

package/LINT_COVERAGE.md

@@ -1,39 +1,42 @@
-# TypeScript 7 Lint Coverage
+# Lint Coverage
 
-Project type checking uses stable TypeScript 7. The lockfile resolves every
-TypeScript dependency, including the shared preset's dependency tree, to that
-version. There is no TypeScript 6 compatibility installation.
+Project type checking uses stable TypeScript 6.0.3, matching the compiler API
+used by the published shared preset. The user selected this compatibility-first
+setup instead of extending the previous TypeScript 7 coverage exclusions.
 
 Oxlint uses `@st1ggy/linter-config/solid-ox` with type-aware analysis. Oxfmt uses
-`@st1ggy/linter-config/oxfmt-common`. `scripts/native-lint-config.ts` adapts the
-published preset without editing installed packages. The user explicitly approved
-the uncovered SonarJS checks below after reviewing the TS7 incompatibility.
+`@st1ggy/linter-config/oxfmt-common`. The version 10 preset is extended directly,
+including its SonarJS and typescript-eslint JS plugins. No compiler-compatibility
+projection filters its rules. Deliberate project exceptions remain documented
+beside their individual settings in `oxlint.config.ts`.
 
 ## Preserved Checks
 
+- GUI-only overrides add native JSX accessibility checks for ARIA, labels/content,
+  keyboard parity and focusability while retaining every native plugin from the
+  published Solid preset. OpenTUI JSX is excluded from these HTML-specific rules.
+  Native host controls retain their own semantics; real Desktop keyboard checks
+  complement source linting.
 - Native ESLint, TypeScript, import and Unicorn rules remain enabled.
-- The compatible Solid, ESLint-core, import-x, stylistic and Unicorn JS plugins
-  remain enabled. There is no blanket removal of JS plugins.
-- `typescript-js/array-type` and `typescript-js/prefer-as-const` use their native
-  `typescript/` equivalents. The legacy typescript-eslint plugin is not loaded.
-- Six SonarJS checks use native ESLint equivalents: `block-scoped-var`,
-  `no-delete-var`, `no-fallthrough`, `no-labels`, `no-unused-vars` and
-  `no-useless-catch`. Existing native options take precedence.
+- All published Solid, ESLint-core, import-x, stylistic, Unicorn, SonarJS and
+  typescript-eslint JS plugins remain enabled.
+- Promise handling and strict equality follow the version 10 preset.
+- Bun 1.4.4 can return undefined from `rejects`/`resolves` matchers for already
+  settled promises. Tests normalize matcher results through `Promise.resolve`
+  before awaiting, preserving pending assertions and satisfying both the native
+  thenable rule and SonarJS assertion handling without disabling either rule.
 - Oxfmt still checks formatting separately. This migration does not configure
   Stylelint for the CSS-free TUI project.
 
-## Approved Coverage Loss
+## Historical TypeScript 7 Coverage Exclusions
 
-The published preset configures 161 SonarJS rule names. Six have the direct
-native mappings above. The following 155 preset checks are not loaded after
-removing the TS6-dependent SonarJS plugin. Some overlap with other retained rules,
-but that is not claimed as complete semantic equivalence. The list includes
-checks for frameworks and services this project does not use; it describes the
-preset, not 155 distinct bugs or applicable findings in Navigator.
+Navigator 0.25.0 used native substitutions for six SonarJS rules and excluded
+the following 155 rule names from preset 8 for TS7 compatibility. This list is
+historical, not the current configuration. Preset 10 now supplies its complete
+rule set, subject only to the documented project-specific exceptions.
 
-In particular, native cyclomatic complexity is not a replacement for SonarJS
-cognitive complexity. Identical-function detection, several security/regex
-checks and SonarJS-specific test heuristics lose their dedicated coverage.
+Native cyclomatic complexity was not considered a replacement for SonarJS
+cognitive complexity. The compiler-driven exclusions are no longer applied.
 
 ```text
 sonarjs/assertions-in-test-cases
@@ -193,9 +196,9 @@ sonarjs/x-powered-by
 sonarjs/xml-parser-xxe
 ```
 
-## Removing The Adapter
+## Future Compiler Upgrades
 
-Replace the compatibility projection when the shared preset offers a TS7-only
-stack with equivalent native rules or compatible public plugin APIs. Keep the
-coverage inventory explicit when upgrading that preset; do not label a removed
-check as preserved merely because a similarly named rule exists.
+The compatibility projection has been removed. Reconsider TypeScript 7 only when
+the complete published lint stack supports its compiler API. Keep coverage
+explicit; do not label a removed check as preserved merely because a similarly
+named rule exists.

package/PROVIDERS.md

@@ -5,6 +5,15 @@ It never treats session token/cost totals as remaining provider quota. Subscript
 windows, API rate limits, configured capacities, and monetary balances are different
 measurements and are labelled separately.
 
+The experimental Desktop entry shares quota normalization, refresh scheduling,
+account binding and reset-attempt rules with TUI. Its renderer uses the selected
+session's live server client/cache. Local Codex subprocess access is restricted to
+typed Desktop-main IPC for a host-verified same-machine connection; remote or
+unverified targets never borrow the Desktop's local account or binding. No tokens
+or credential files are returned to the renderer. Remote provider reads use the
+selected server's existing quota RPC. Missing capabilities and authentication
+failures remain explicit rather than enabling an alternate credential reader.
+
 The external provider contracts were rechecked on 2026-10-06; the public
 OpenCode Console/Go contract was added on 2026-10-28. The runtime also includes providers from
 the host catalog; an unrecognized provider gets an explicit unverified-source state

package/README.md

@@ -1,6 +1,7 @@
 # OpenCode Navigator
 
-Search, navigate, and manage OpenCode sessions from the TUI. Navigator combines
+Search, navigate, and manage OpenCode sessions from the TUI, with an experimental
+OpenCode Desktop interface. Navigator combines
 Search Everything, task and subagent views, skills, MCP presets, and quick actions
 with a configurable sidebar.
 
@@ -44,7 +45,7 @@ collapsed. Use `Save current layout as default` in sidebar settings to reuse the
 current visible/hidden, expanded/collapsed, and ordering states in new sessions.
 
 **Only the latest stable release in each major line is supported: OpenCode
-1.19.5 and 2.2.5.** Both have separate real-host checks. Older releases are not
+1.19.5 and 2.2.6.** Both have separate real-host checks. Older releases are not
 part of the supported compatibility matrix. The 2.2 integration uses OpenTUI 0.8
 and public host caches, events, keymap layers, and client APIs while retaining
 the separate 1.x adapter. See [Host API boundaries](HOST_API.md) for remaining
@@ -52,7 +53,7 @@ capability gaps and removal conditions. On OpenCode 2, Navigator reads the same
 the host sidebar, including completed `todowrite` calls and the current revert
 boundary. Viewing Todo needs no Navigator server plugin. OpenCode 2.1 exposes
 content and four statuses, without priorities or direct Todo CRUD. LSP is hidden on 2.x while retaining Subagents,
-Skills, Quick Actions, MCP, Search, settings, and presets. All interface icons use Nerd Font glyphs by
+Skills, Quick Actions, MCP, Search, settings, and presets. All TUI interface icons use Nerd Font glyphs by
 default (Codicons for controls, keyboard symbols for hints, language logos for LSP). Use a Nerd Fonts v3
 terminal font, or select **Settings → Behavior → Icon style → Text fallback**.
 The switch applies to the entire interface, including Quick Actions, search
@@ -271,6 +272,72 @@ in a separate JSON file and set `OPENCODE_CONFIG` to its path **only when
 launching OpenCode 2.x**. The TUI configuration in `cli.json` remains separate;
 the OpenCode 1.x launch must not load Navigator's 2.x server plugin.
 
+### Experimental OpenCode Desktop
+
+Navigator 0.27.0 and newer also export `./gui-experimental` for **OpenCode Desktop
+2.2.6**. This is not browser Web support or a detached operating-system window.
+Earlier Navigator versions do not include the GUI export.
+
+Desktop discovers the GUI from its **global server plugin configuration**,
+`~/.config/opencode/opencode.json` (or the equivalent XDG location), not from
+`cli.json` or `tui.json`. Merge its package entry with existing plugins rather
+than replacing the configuration:
+
+```jsonc
+{
+  "$schema": "https://opencode.ai/config.json",
+  "plugins": [{ "package": "opencode-navigator" }],
+}
+```
+
+For a pinned local installation, use its reviewed package directory instead of
+the npm package name; that directory must include its runtime dependencies.
+Do not add this v2 server package to a configuration shared with OpenCode 1.x;
+keep the separate v2 launch configuration described above. The same package
+contains independent TUI, server, RPC and GUI entries.
+
+- Open **Open Navigator** from the command palette after selecting a session.
+  The native panel can be placed beside or below the chat with host controls.
+  Narrow windows use **More → Navigator**.
+- Choose **Float** for an opt-in mini-window inside the application. It follows
+  the selected session, hides on Home and yields to native dialogs. Move, resize,
+  reset and redock controls support keyboard input too. Both placements share
+  one monitoring runtime and filters; switching does not duplicate polling.
+- **Navigator settings** opens native Settings with Global/Worktree scope,
+  section controls, groups, trust, presets, portable/project profiles, About,
+  release history and reviewed Bug reports. **Reload preferences** imports
+  changes from other local Navigator instances explicitly.
+- Favorites, trust, account bindings, reset attempts and presets use the existing
+  private preferences file and lock shared with local TUI instances. Only window
+  placement lives in the native GUI store. Project profiles and configuration
+  requests use the selected server, including remote servers.
+- Todo is native and read-only; chat owns edits. Legacy Navigator tasks remain a
+  read-only archive. LSP and startup/Home interception are not exposed by this
+  Desktop contract. Permissions opens native host Settings rather than toggling
+  a simulated mode. Terminal fonts, corner masks and terminal shortcuts are not
+  GUI settings; Desktop does not need a Nerd Font or the corner font.
+- Provider quotas retain verified account scope. Local Codex access requires a
+  verified same-machine connection; a remote session never borrows its credentials
+  or private binding. Banked resets always require separate confirmation.
+
+The candidate is tested as an npm-style tarball in the official checksum-verified
+Linux ARM64 Desktop package on Xvfb. Native macOS/Windows, browser Web and multiple
+live Desktop windows are not claimed as real-host verification targets. Local,
+remote and multi-consumer guards have separate synthetic contract tests.
+See [Host API boundaries](HOST_API.md) for the native command-palette limitation.
+The manual Prepare Release workflow generated and byte-verified all 27 GUI
+captures using the real Desktop renderer on a virtual display. The terminal
+gallery above is rendered separately through Ghostty.
+
+![Desktop Search Everything with a synthetic Skill](screenshots/gui/02-desktop-search-skills.png)
+
+![Desktop mini-window preserving the current Todo filter](screenshots/gui/14-desktop-mini-window.png)
+
+![Desktop layout preview with a separate Apply action](screenshots/gui/07-desktop-layout-preview.png)
+
+See the [Desktop gallery](screenshots/README.md#experimental-desktop) for account
+linking, quotas, reviewed resets, profiles, onboarding and Bug reports.
+
 ### Install the corner font
 
 **Required for rounded multiline selections in Nerd Font mode.** Run the font
@@ -936,9 +1003,11 @@ tasks before pending tasks. Finished contains separate Completed and Cancelled
 groups. The selected view is temporary and resets to All when changing sessions.
 The header always reports completed tasks against the full task count.
 
-Subagents show observed run duration, retry countdowns, and execution errors. An
-already-running child discovered by the sidebar uses a clock icon (`~` in Text
-fallback) because its exact start time is unknown. Recent keeps the last 10 observed
+Subagents show run duration, retry countdowns, and execution errors. OpenCode 2
+uses its public execution-start timestamp for exact active durations, including
+children already running when Navigator opens. Missing or invalid native timing
+and OpenCode 1 retain observed durations. An already-running child whose exact
+start is unknown has a clock icon (`~` in Text fallback). Recent keeps the last 10 observed
 finished runs per parent session in memory across navigation, until OpenCode exits.
 An idle transition is labelled Finished, not a guarantee of successful task
 completion; errors and cancellations retain their own labels. A worker timeout
@@ -974,7 +1043,7 @@ session or workspace dismisses the entire search dialog chain.
 
 ## Scripts
 
-Development uses Bun 1.4.4 and stable TypeScript 7. Standalone Node/OpenTUI paths
+Development uses Bun 1.4.4 and stable TypeScript 6.0.3. Standalone Node/OpenTUI paths
 require Node.js 26.4 or newer; CI pins Node 26.12.1. Install dependencies with
 `bun install --frozen-lockfile`.
 
@@ -984,13 +1053,17 @@ Oxlint uses the `solid-ox` preset from
 OpenTUI callbacks, SDK compatibility, and test fixtures. Type-aware analysis uses
 `oxlint-tsgolint`; `tsconfig.lint.json` covers application code, tests, build scripts,
 and configuration files. Formatter exclusions are maintained in `oxfmt.config.ts`.
-The resolved dependency tree contains TS7 only. The approved removal of
-incompatible SonarJS checks and native replacements is documented in
-[Lint coverage](LINT_COVERAGE.md); compatible Solid and other JS checks remain.
+The complete version 10 preset includes SonarJS and typescript-eslint checks;
+the former TS7 compatibility projection is removed. See [Lint coverage](LINT_COVERAGE.md)
+for current exceptions and historical exclusions. A tested root-only Bun metadata
+patch corrects the legacy TypeScript 5 peer in OpenTUI's FFI helper for this repo.
+Consumer installations retain upstream metadata; see [Host APIs](HOST_API.md).
 
 ```sh
 bun run test
 bun run test:e2e
+bun run test:gui
+bun run test:e2e:gui
 bun run typecheck
 bun run lint
 bun run lint:fix
@@ -1004,8 +1077,11 @@ bun run screenshots:verify
 bun run check
 ```
 
-`bun run check` runs the tests, TypeScript, Oxlint, bundle-size guard, and Oxfmt
-check. The unminified TUI bundle is limited to 360,000 bytes.
+`bun run check` runs the TUI and browser-conditioned GUI tests, separate JSX
+typechecks, Oxlint, bundle-size guards, and Oxfmt. The unminified TUI bundle is
+limited to 360,000 bytes; the independent single-file GUI budget is 600,000 bytes
+(stage-10 measured baseline: about 554 kB). DOM accessibility checks apply only
+to GUI modules, never to terminal renderables.
 Font generation is a separate development task: `bun run font:build` and
 `bun run font:check` use `uv` and the pinned FontTools dependency. Users install
 the already generated font; Python and FontTools are not needed at runtime.
@@ -1022,6 +1098,15 @@ requires Docker with Linux ARM64 support. These commands are available for harne
 development; the committed release captures are generated by the manual
 `Prepare Release` GitHub Actions workflow.
 
+That workflow also runs `bun run screenshots:gui` and
+`bun run screenshots:gui:verify`. They use the real packaged Desktop renderer on
+Xvfb, not Ghostty, with synthetic sessions, providers and reports. The second run
+compares the PNGs byte-for-byte. Fixed renderer and synthetic main clocks,
+full software rasterization and disabled capture-time animations stabilize scenes
+without stopping interaction timers or adding comparison tolerances. GUI
+capture commands reject non-CI invocation; ordinary Desktop smoke tests never
+take screenshots. New captures and their visual review remain a pre-release gate.
+
 ## Publishing
 
 Publishing is handled by `.github/workflows/publish.yml` when a GitHub Release

package/dist/{chunk-bv0nm1tj.js → chunk-dm1y8x49.js}

@@ -1,4 +1,5 @@
 var SIDEBAR_SECTIONS=["limits","todo","subagents","skills","quick_actions","lsp","mcp"]
+var QUICK_ACTION_IDS=["session.rename","session.timeline","session.copy","session.export","session.compact","session.list","session.new","session.fork","messages.copy","session.first","session.last","session.messages_last_user","session.message.next","session.message.previous","permission.mode"]
 var SECTION_DEFINITIONS=[{name:"limits",label:"Limits"},{name:"todo",label:"Todo"},{name:"subagents",label:"Subagents"},{name:"skills",label:"Skills"},{name:"quick_actions",label:"Quick actions"},{name:"lsp",label:"LSP"},{name:"mcp",label:"MCP"}];
 var MAX_LIMITS_REFRESH_MINUTES=Math.floor(2147483647 / 60000);
 var PLUGIN_ID="opencode-navigator"
@@ -6,4 +7,4 @@ var TOGGLE_COMMAND=`${PLUGIN_ID}.toggle`
 var FOCUS_COMMAND=`${PLUGIN_ID}.focus`
 var SEARCH_COMMAND=`${PLUGIN_ID}.search`
 var DEFAULT_SEARCH_KEY="ctrl+shift+k"
-export{SIDEBAR_SECTIONS,SECTION_DEFINITIONS,PLUGIN_ID,DEFAULT_SEARCH_KEY}
+export{SIDEBAR_SECTIONS,QUICK_ACTION_IDS,SECTION_DEFINITIONS,PLUGIN_ID,DEFAULT_SEARCH_KEY}