opencode-navigator 0.26.0 → 0.27.1

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## [0.27.1] - 2026-11-11
+
+- Drag the Desktop mini-window by its header as well as its move handle, while keeping Dock a separate action. Match its surface and controls to OpenCode's light and dark themes.
+- Use native Desktop switches and selectors for Skill trust and Todo configuration, and align multiline fields with the host theme and focus styles.
+- Show a remaining-lifetime scale and time until expiry for banked reset credits with provider-supplied dates. Keep missing expiry explicit and prevent selecting expired credits for review.
+
+## [0.27.0] - 2026-11-11
+
+- Add an experimental OpenCode Desktop interface with a native panel, narrow-screen drawer, and opt-in in-app mini-window. Move, resize, reset and redock it with the mouse or keyboard while keeping the selected session and filters.
+- Bring Search Everything, Skills, MCP groups and presets, Quick Actions, and customizable toolbar pins to Desktop. Share private favorites, trust decisions and preferences with local TUI instances without duplicating monitoring.
+- Add native Desktop settings with scoped section controls, groups, reviewed presets and project profiles, portable import/export, a seven-slide setup guide, About, browsable release history and editable GitHub Bug reports.
+- Keep superseded Desktop configuration reads from showing a false error after a newer refresh, while preserving genuine failures and retry guidance.
+- Show verified provider/account quotas in Desktop with explicit account linking and separately confirmed banked resets. Keep remote sessions isolated from local accounts and preserve unresolved reset attempts across retries.
+- Support OpenCode 1.19.5 and 2.2.6 while preserving both TUI adapters, existing settings, pinned-source updates and read-only legacy Todo archives.
+
 ## [0.26.0] - 2026-11-06
 
 - Prevent background retries from accumulating cancellation listeners and preferences loading from waiting indefinitely on recovery markers.

package/HOST_API.md

@@ -1,12 +1,119 @@
 # Public Host APIs And Remaining Gaps
 
-Navigator supports only OpenCode **1.19.5** and **2.2.5**, the current stable
+Navigator supports only OpenCode **1.19.5** and **2.2.6**, the current stable
 release in each major line. Published SDK declarations and real-host checks
 define the boundary; internal host components are not plugin APIs.
 
+## Approved Desktop Integration Contract
+
+Desktop support uses the independent `./gui-experimental` entry available from
+Navigator 0.27.0, not the TUI entrypoint. Earlier packages do not include this GUI.
+The approved target is OpenCode Desktop 2.2.6, with TUI 1.19.5 and 2.2.6 kept
+behind explicit adapters. The published 2.2.6 plugin package preserves every TUI
+declaration from 2.2.5; its changed declarations are GUI-specific.
+
+| Capability | Published Desktop contract | Navigator integration constraint |
+| --- | --- | --- |
+| GUI loading | `./gui-experimental`, `@opencode/plugin/gui`, one CJS bundle through `gui/vite` | Load from global server configuration; a CLI-only plugin entry does not enable Desktop. Preserve the server plugin's historical identity. |
+| Data and requests | Reactive session `server.data` and live `server.client` | Resolve the selected session's server on every operation; the plugin-level client is the desktop sidecar, not an arbitrary remote session. |
+| Session identity | Host session keys include server identity; location can be unavailable during reconnect | Partition domain state and reject stale actions by server/session/location; never put credentials in cache keys. |
+| Layout | Native side panels, host-controlled bottom placement, narrow drawers, panel-specific width | Use native containers first. The optional floating view is an in-app presentation of the same state, not a detached OS window. |
+| Commands and composer | Native command registry and reactive routed composer/model | Map verified commands explicitly; never emulate GUI actions by fabricating terminal command events. |
+| Dialogs and settings | Native nested dialogs, SettingsPage and settings/menu components | Share validation and action state, not terminal dialog renderers or focus loops. |
+| Local operations | Desktop main, validated IPC, Node/Electron only in main | Renderer models have no filesystem, subprocess or token access. Preserve the existing private store and lock rather than copying preferences to GUI storage. |
+| Remote operations | The selected server's public client and existing plugin RPC | Do not read local project files or use local provider credentials for a remote target. Missing server capabilities remain explicit. |
+| Native windows | Public main context can inspect existing windows; no panel detach operation | Detached OS windows are outside this delivery. Do not mutate host DOM or use private app internals to simulate support. |
+
+The GUI API is experimental. Browser Web is not a verified target in this cycle.
+The renderer and headless models must remain independent of Electron so a later
+Web adapter does not require a second implementation of product rules.
+
+Verification uses an npm-style tarball in the official checksum-verified Linux
+ARM64 Desktop 2.2.6 package under Xvfb. Native macOS/Windows and multiple live
+Desktop windows are not claimed as real-host coverage; remote identity, independent
+window leases and concurrent shared-store writes are synthetic contracts. The
+unminified TUI remains limited to 360,000 bytes; the single-file GUI has its own
+600,000-byte budget (about 554 kB at the stage-10 baseline).
+
+Native Settings temporarily has no mounted session and may have no active tab.
+Navigator retains only a previously observed public session reference still
+confirmed by the public tab list, server and location; Home, closing that tab or
+changing its target clears it. Settings/profile operations use that reference's
+live client/cache rather than substituting the sidecar.
+
+Private favorites, trust, presets, account bindings and reset attempts remain in
+the established filesystem preferences store/lock via typed main IPC. Native GUI
+storage holds presentation only. Explicit Reload flushes writes, refreshes private
+preferences and selected-server configured defaults, and clears temporary layout
+overrides. Project profiles use the selected server RPC with exact file previews
+and stale-file checks; workspace-placed filesystems are rejected until the public
+server contract provides a verified placement-aware atomic write operation.
+
+GUI permission actions open native Settings. No supported Desktop startup/Home
+interception or LSP status contract was found; those terminal capabilities are not
+simulated. Revisit the gaps when equivalent public APIs become available. Changelog
+browsing is independent of the one-time version claim used by startup notes.
+
+On narrow Desktop windows, Navigator uses **More → Navigator**, the host's
+native drawer. The floating view redocks when the viewport becomes narrow.
+Desktop 2.2.6 keeps drawer opening in its own mobile navigation; Navigator does
+not click or move host elements to force it open. Revisit automatic drawer
+opening when the public layout API exposes that operation.
+
+GUI forms use `ctx.ui.Switch`, `TextInput`, `Select`, `Button` and the native
+Settings rows rather than importing or bundling `@opencode/ui`. Desktop 2.2.6's
+public UI facade has no multiline input, progress bar, disclosure row, or bookmark
+icon. Those focused semantic controls remain plugin-owned, using the host theme's
+surface, text, focus and elevation tokens. Remove these fallbacks when equivalent
+public controls preserve their multiline, expanded/selected and progress semantics.
+
+The Desktop model controls use the verified 2.2.6 commands `model.choose` and
+`model.variant.cycle`. These IDs are version-audited mappings, not portable
+TUI command names; a rejected dispatch reports that the control is unavailable.
+
+The isolated Desktop 2.2.6 host also has a native dialog-context defect: opening
+its command palette after a plugin dialog in a session can fail with
+`Command context must be used within a context provider`. The same minimal
+fixture reproduces this with Navigator disabled; Home does not reproduce it.
+Navigator does not patch host contexts. Interaction smokes keep this native-only
+probe separate and exercise subsequent plugin commands through the public
+`commands.run` API. Recheck this limitation on the next audited Desktop target.
+
+Sources: [GUI plugins](https://opencode.ai/docs/build/plugins/gui),
+[TUI plugins](https://opencode.ai/docs/build/plugins/cli),
+[RPC](https://opencode.ai/docs/build/plugins/rpc), and the published
+`@opencode/plugin@2.2.6` declaration archive, audited on 2026-11-10.
+
 ## Host-Owned Services
 
-| Capability | OpenCode 1.19.5 | OpenCode 2.2.5 |
+### Dependency audit limits
+
+The candidate's frozen install and peer graph pass, but its security audit is
+not clean. The supported 1.x plugin pins an older Effect beta and Zod; its Effect
+graph also carries TOML denial-of-service advisories. The supported 2.x utility
+package pins Glob and Minimatch versions with denial-of-service advisories.
+Navigator does not force incompatible transitive-major overrides or suppress the
+audit. Removal depends on compatible upstream fixes in the supported host graph;
+review these advisories again before publication.
+
+### Selected-server quota services
+
+Desktop Codex reads and reset submissions run behind typed main-process IPC,
+only for the host-verified `sameMachine` sidecar. Main rechecks the session
+directory, live client, active connection and private account binding; it never
+returns credentials or provider headers to the renderer. Remote sessions use
+their selected server's quota RPC and never borrow the Desktop's local account.
+Public session and quota-event locations expose only a directory, not a workspace
+ID. Workspace requests retain explicit location guards, and quota observations
+without sufficient workspace identity do not trigger an automatic read.
+
+The ordinary Codex bucket is account-scoped even when `normalModelSlug` is null.
+Missing reset-credit details do not erase the provider's available count. Reset
+submission requires a separate confirmation and an authoritative persisted
+attempt; uncertain retries retain its idempotency key. No credit is spent during
+review, refresh or account linking.
+
+| Capability | OpenCode 1.19.5 | OpenCode 2.2.6 |
 | --- | --- | --- |
 | Todo | Supported host Todo source/events | Public message cache, completed `todowrite` and revert boundary |
 | Skills | Host discovery and prompt insertion | Native Skill cache and `experimental.session.skill` with exact ID |
@@ -52,10 +159,10 @@ justify bypassing a native API.
 
 Both current hosts have isolated real-host checks. Historical installer fixtures
 exercise migration only; they do not extend the supported host matrix.
-The published 2.2.5 TUI context, plugin, index and Solid declarations are identical
-to 2.2.0. OpenTUI 0.8 retains the drawing-only paint-hook contract; renderer tests,
+The published 2.2.6 TUI declarations are identical to 2.2.5. OpenTUI 0.8 retains
+the drawing-only paint-hook contract; renderer tests,
 nested dialogs and frame-level typing probes run against the updated runtime.
-Development uses Bun 1.4.4 and OpenTUI 0.8.2, leaving Solid/OpenTUI external so the
+Development uses Bun 1.4.4 and OpenTUI 0.8.3, leaving Solid/OpenTUI external so the
 host owns its runtime. The 1.x host ships older runtime modules; its actual smoke
 must pass rather than injecting the development modules into it.
 
@@ -67,7 +174,7 @@ renderer/FFI support. CI and package verification use Node 26.12.1.
 ### Deliberate Compatibility Pins
 
 - `web-tree-sitter` stays at **0.25.10**, the exact peer required by OpenTUI
-  0.8.2. Upgrade it when the supported host runtime publishes a compatible peer
+  0.8.3. Upgrade it when the supported host runtime publishes a compatible peer
   contract; the independent 0.27 line is not a compatible substitution.
 - `typescript` is **6.0.3**, selected to match the complete published
   `@st1ggy/linter-config` **10.0.0** preset. SonarJS and typescript-eslint JS

package/LINT_COVERAGE.md

@@ -12,6 +12,11 @@ beside their individual settings in `oxlint.config.ts`.
 
 ## Preserved Checks
 
+- GUI-only overrides add native JSX accessibility checks for ARIA, labels/content,
+  keyboard parity and focusability while retaining every native plugin from the
+  published Solid preset. OpenTUI JSX is excluded from these HTML-specific rules.
+  Native host controls retain their own semantics; real Desktop keyboard checks
+  complement source linting.
 - Native ESLint, TypeScript, import and Unicorn rules remain enabled.
 - All published Solid, ESLint-core, import-x, stylistic, Unicorn, SonarJS and
   typescript-eslint JS plugins remain enabled.

package/PROVIDERS.md

@@ -5,6 +5,15 @@ It never treats session token/cost totals as remaining provider quota. Subscript
 windows, API rate limits, configured capacities, and monetary balances are different
 measurements and are labelled separately.
 
+The experimental Desktop entry shares quota normalization, refresh scheduling,
+account binding and reset-attempt rules with TUI. Its renderer uses the selected
+session's live server client/cache. Local Codex subprocess access is restricted to
+typed Desktop-main IPC for a host-verified same-machine connection; remote or
+unverified targets never borrow the Desktop's local account or binding. No tokens
+or credential files are returned to the renderer. Remote provider reads use the
+selected server's existing quota RPC. Missing capabilities and authentication
+failures remain explicit rather than enabling an alternate credential reader.
+
 The external provider contracts were rechecked on 2026-10-06; the public
 OpenCode Console/Go contract was added on 2026-10-28. The runtime also includes providers from
 the host catalog; an unrecognized provider gets an explicit unverified-source state

package/README.md

@@ -1,6 +1,7 @@
 # OpenCode Navigator
 
-Search, navigate, and manage OpenCode sessions from the TUI. Navigator combines
+Search, navigate, and manage OpenCode sessions from the TUI, with an experimental
+OpenCode Desktop interface. Navigator combines
 Search Everything, task and subagent views, skills, MCP presets, and quick actions
 with a configurable sidebar.
 
@@ -44,7 +45,7 @@ collapsed. Use `Save current layout as default` in sidebar settings to reuse the
 current visible/hidden, expanded/collapsed, and ordering states in new sessions.
 
 **Only the latest stable release in each major line is supported: OpenCode
-1.19.5 and 2.2.5.** Both have separate real-host checks. Older releases are not
+1.19.5 and 2.2.6.** Both have separate real-host checks. Older releases are not
 part of the supported compatibility matrix. The 2.2 integration uses OpenTUI 0.8
 and public host caches, events, keymap layers, and client APIs while retaining
 the separate 1.x adapter. See [Host API boundaries](HOST_API.md) for remaining
@@ -52,7 +53,7 @@ capability gaps and removal conditions. On OpenCode 2, Navigator reads the same
 the host sidebar, including completed `todowrite` calls and the current revert
 boundary. Viewing Todo needs no Navigator server plugin. OpenCode 2.1 exposes
 content and four statuses, without priorities or direct Todo CRUD. LSP is hidden on 2.x while retaining Subagents,
-Skills, Quick Actions, MCP, Search, settings, and presets. All interface icons use Nerd Font glyphs by
+Skills, Quick Actions, MCP, Search, settings, and presets. All TUI interface icons use Nerd Font glyphs by
 default (Codicons for controls, keyboard symbols for hints, language logos for LSP). Use a Nerd Fonts v3
 terminal font, or select **Settings → Behavior → Icon style → Text fallback**.
 The switch applies to the entire interface, including Quick Actions, search
@@ -271,6 +272,74 @@ in a separate JSON file and set `OPENCODE_CONFIG` to its path **only when
 launching OpenCode 2.x**. The TUI configuration in `cli.json` remains separate;
 the OpenCode 1.x launch must not load Navigator's 2.x server plugin.
 
+### Experimental OpenCode Desktop
+
+Navigator 0.27.0 and newer also export `./gui-experimental` for **OpenCode Desktop
+2.2.6**. This is not browser Web support or a detached operating-system window.
+Earlier Navigator versions do not include the GUI export.
+
+Desktop discovers the GUI from its **global server plugin configuration**,
+`~/.config/opencode/opencode.json` (or the equivalent XDG location), not from
+`cli.json` or `tui.json`. Merge its package entry with existing plugins rather
+than replacing the configuration:
+
+```jsonc
+{
+  "$schema": "https://opencode.ai/config.json",
+  "plugins": [{ "package": "opencode-navigator" }],
+}
+```
+
+For a pinned local installation, use its reviewed package directory instead of
+the npm package name; that directory must include its runtime dependencies.
+Do not add this v2 server package to a configuration shared with OpenCode 1.x;
+keep the separate v2 launch configuration described above. The same package
+contains independent TUI, server, RPC and GUI entries.
+
+- Open **Open Navigator** from the command palette after selecting a session.
+  The native panel can be placed beside or below the chat with host controls.
+  Narrow windows use **More → Navigator**.
+- Choose **Float** for an opt-in mini-window inside the application. It follows
+  the selected session, hides on Home and yields to native dialogs. Move, resize,
+  reset and redock controls support keyboard input too. Both placements share
+  one monitoring runtime and filters; switching does not duplicate polling.
+  Drag the mini-window by its header or move handle; Dock remains a separate
+  action. Its surface follows the current OpenCode theme.
+- **Navigator settings** opens native Settings with Global/Worktree scope,
+  section controls, groups, trust, presets, portable/project profiles, About,
+  release history and reviewed Bug reports. **Reload preferences** imports
+  changes from other local Navigator instances explicitly.
+- Favorites, trust, account bindings, reset attempts and presets use the existing
+  private preferences file and lock shared with local TUI instances. Only window
+  placement lives in the native GUI store. Project profiles and configuration
+  requests use the selected server, including remote servers.
+- Todo is native and read-only; chat owns edits. Legacy Navigator tasks remain a
+  read-only archive. LSP and startup/Home interception are not exposed by this
+  Desktop contract. Permissions opens native host Settings rather than toggling
+  a simulated mode. Terminal fonts, corner masks and terminal shortcuts are not
+  GUI settings; Desktop does not need a Nerd Font or the corner font.
+- Provider quotas retain verified account scope. Local Codex access requires a
+  verified same-machine connection; a remote session never borrows its credentials
+  or private binding. Banked resets always require separate confirmation.
+
+The candidate is tested as an npm-style tarball in the official checksum-verified
+Linux ARM64 Desktop package on Xvfb. Native macOS/Windows, browser Web and multiple
+live Desktop windows are not claimed as real-host verification targets. Local,
+remote and multi-consumer guards have separate synthetic contract tests.
+See [Host API boundaries](HOST_API.md) for the native command-palette limitation.
+The manual Prepare Release workflow generated and byte-verified all 29 GUI
+captures using the real Desktop renderer on a virtual display. The terminal
+gallery above is rendered separately through Ghostty.
+
+![Desktop Search Everything with a synthetic Skill](screenshots/gui/02-desktop-search-skills.png)
+
+![Desktop mini-window preserving the current Todo filter](screenshots/gui/14-desktop-mini-window.png)
+
+![Desktop layout preview with a separate Apply action](screenshots/gui/07-desktop-layout-preview.png)
+
+See the [Desktop gallery](screenshots/README.md#experimental-desktop) for account
+linking, quotas, reviewed resets, profiles, onboarding and Bug reports.
+
 ### Install the corner font
 
 **Required for rounded multiline selections in Nerd Font mode.** Run the font
@@ -636,7 +705,10 @@ separate muted guidance.
 
 The header's **Banked Resets** button appears when credits or an unresolved attempt
 exist. It displays the provider's available count, optional credit
-details, statuses, and expiry. Selecting a credit first checks fresh eligibility
+details, statuses, and expiry. In Desktop, dated credits show a shrinking
+remaining-lifetime scale and time until expiry, calculated from the provider's
+grant and expiry timestamps. Missing dates never produce a fabricated percentage;
+expired credits cannot be selected for review. Selecting a credit first checks fresh eligibility
 and opens a separate confirmation tied to the current account and model. Cancel
 or Escape returns to the credit list without spending anything.
 
@@ -995,6 +1067,8 @@ Consumer installations retain upstream metadata; see [Host APIs](HOST_API.md).
 ```sh
 bun run test
 bun run test:e2e
+bun run test:gui
+bun run test:e2e:gui
 bun run typecheck
 bun run lint
 bun run lint:fix
@@ -1008,8 +1082,11 @@ bun run screenshots:verify
 bun run check
 ```
 
-`bun run check` runs the tests, TypeScript, Oxlint, bundle-size guard, and Oxfmt
-check. The unminified TUI bundle is limited to 360,000 bytes.
+`bun run check` runs the TUI and browser-conditioned GUI tests, separate JSX
+typechecks, Oxlint, bundle-size guards, and Oxfmt. The unminified TUI bundle is
+limited to 360,000 bytes; the independent single-file GUI budget is 600,000 bytes
+(stage-10 measured baseline: about 554 kB). DOM accessibility checks apply only
+to GUI modules, never to terminal renderables.
 Font generation is a separate development task: `bun run font:build` and
 `bun run font:check` use `uv` and the pinned FontTools dependency. Users install
 the already generated font; Python and FontTools are not needed at runtime.
@@ -1026,6 +1103,15 @@ requires Docker with Linux ARM64 support. These commands are available for harne
 development; the committed release captures are generated by the manual
 `Prepare Release` GitHub Actions workflow.
 
+That workflow also runs `bun run screenshots:gui` and
+`bun run screenshots:gui:verify`. They use the real packaged Desktop renderer on
+Xvfb, not Ghostty, with synthetic sessions, providers and reports. The second run
+compares the PNGs byte-for-byte. Fixed renderer and synthetic main clocks,
+full software rasterization and disabled capture-time animations stabilize scenes
+without stopping interaction timers or adding comparison tolerances. GUI
+capture commands reject non-CI invocation; ordinary Desktop smoke tests never
+take screenshots. New captures and their visual review remain a pre-release gate.
+
 ## Publishing
 
 Publishing is handled by `.github/workflows/publish.yml` when a GitHub Release

package/dist/{chunk-bv0nm1tj.js → chunk-dm1y8x49.js}

@@ -1,4 +1,5 @@
 var SIDEBAR_SECTIONS=["limits","todo","subagents","skills","quick_actions","lsp","mcp"]
+var QUICK_ACTION_IDS=["session.rename","session.timeline","session.copy","session.export","session.compact","session.list","session.new","session.fork","messages.copy","session.first","session.last","session.messages_last_user","session.message.next","session.message.previous","permission.mode"]
 var SECTION_DEFINITIONS=[{name:"limits",label:"Limits"},{name:"todo",label:"Todo"},{name:"subagents",label:"Subagents"},{name:"skills",label:"Skills"},{name:"quick_actions",label:"Quick actions"},{name:"lsp",label:"LSP"},{name:"mcp",label:"MCP"}];
 var MAX_LIMITS_REFRESH_MINUTES=Math.floor(2147483647 / 60000);
 var PLUGIN_ID="opencode-navigator"
@@ -6,4 +7,4 @@ var TOGGLE_COMMAND=`${PLUGIN_ID}.toggle`
 var FOCUS_COMMAND=`${PLUGIN_ID}.focus`
 var SEARCH_COMMAND=`${PLUGIN_ID}.search`
 var DEFAULT_SEARCH_KEY="ctrl+shift+k"
-export{SIDEBAR_SECTIONS,SECTION_DEFINITIONS,PLUGIN_ID,DEFAULT_SEARCH_KEY}
+export{SIDEBAR_SECTIONS,QUICK_ACTION_IDS,SECTION_DEFINITIONS,PLUGIN_ID,DEFAULT_SEARCH_KEY}