tandem-editor 0.14.3 → 0.15.0

package/.claude-plugin/plugin.json

@@ -1,24 +1,24 @@
 {
   "name": "tandem",
-  "version": "0.8.0",
+  "version": "0.15.0",
   "description": "Edit and iterate on documents with any MCP-capable AI. Claude is the default and best-supported client today.",
   "author": {
     "name": "Tandem"
   },
   "repository": "https://github.com/bloknayrb/tandem",
-  "license": "MIT",
+  "license": "BUSL-1.1",
   "keywords": ["editor", "collaborative", "mcp", "claude"],
   "mcpServers": {
     "tandem": {
       "command": "npx",
-      "args": ["-y", "tandem-editor", "mcp-stdio"],
+      "args": ["-y", "tandem-editor@0.15.0", "mcp-stdio"],
       "env": {
         "TANDEM_URL": "http://127.0.0.1:3479"
       }
     },
     "tandem-channel": {
       "command": "npx",
-      "args": ["-y", "tandem-editor", "channel"],
+      "args": ["-y", "tandem-editor@0.15.0", "channel"],
       "env": {
         "TANDEM_URL": "http://127.0.0.1:3479"
       }

package/CHANGELOG.md

@@ -7,6 +7,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.15.0] - 2026-07-07
+
+### Added
+
+- **Setup diagnostics now surface at the moment of connection, and a connected agent can self-diagnose (#1174).** Three gaps closed: (1) the integration wizard's final step now probes `/health` after writing your AI's MCP config and watches live for the AI actually connecting (HTTP targets); stdio targets render honestly as not-applicable. (2) A new `tandem_diagnostics` MCP tool wraps the same checks `tandem doctor` runs, so a connected agent — including a Cowork VM that can't reach `localhost:3479` — can run diagnostics over its own transport. It's read-only and ungated (an escape hatch, like the other read tools). (3) The Cowork Settings banner now derives reachability from the on-disk workspace-install truth (reachable / unreachable / pending) rather than the bare `enabled` boolean.
+- **License issuance Worker landed (#1116, ADR-040).** `infra/license-issuance-worker/` is the public seam that turns a paid Polar checkout into an Ed25519-signed license: it verifies the Standard-Webhooks (svix) signature Polar actually sends (the loopback-only server handler it supersedes used an invented, wrong scheme Polar never sends), mints/signs the license, records an issuance ledger, writes the update entitlement the sibling `infra/license-update-worker/` reads, and emails the license via Resend — all before any behavior-visible change to the shipped app (the run-time license gate stays off by default per ADR-040). Owner-deployed; see `docs/licensing-operations.md`.
+
+### Changed
+
+- **Find & Replace rebuilt to the B4 design (#1171).** The bar now anchors to the top-right of the editor (was bottom-right) and slides in from above, sharing the motion of the new-tab / slash-menu chrome. Borderless inputs sit on the panel surface; the find row gains a search icon, a mono match count, and an Esc badge; a quieter controls strip carries the nav arrows and mono `Aa` / `\b` / `.*` toggles (accent-tinted when on), an expand chevron, and close. The replace row is collapsed by default (Replace All is the only filled-accent button), and Escape is two-stage — collapse the replace row, then close. A no-match now tints the find row to the error family. Every find/replace testid is preserved.
+- **Cowork setup dialogs now explain what actually happens, and the published plugin is current (#1173).** The in-app Cowork dialogs (Settings, integration wizard, onboarding, admin-declined modal) now state plainly what gets installed, that adding the firewall rule needs administrator rights Tandem doesn't have, how to verify it worked, and that real-time push needs the desktop app. The stale `v0.8.0` string is gone (the dialogs are now version-agnostic), the published `.claude-plugin/plugin.json` manifest is refreshed, and the README gains a `#cowork` section the dialogs link to. A new `tests/plugin-manifest.test.ts` drift-guards the plugin manifest against `package.json`.
+
+### Fixed
+
+- **Enabling Cowork no longer deletes its own firewall allow-rule (#1163).** The enable path added the "Tandem Cowork" allow rule and *then* ran orphan reconciliation — whose name-prefix scan matched the rule it had just added and deleted it, so every successful enable ended with no allow rule. Orphan cleanup now runs *before* the rule is added (the only sound fix, since the scan can't tell a fresh rule from a true orphan by name), and the stale-token workspace rewrite runs only after a successful add, so a fail-closed firewall failure never reaches a workspace write. Windows-only.
+- **Re-importing the same `.docx` no longer accumulates duplicate private notes (#1166, #1150).** When flat offsets drift between imports (a content edit, a heading-prefix change), imported Word comments were re-keyed by offset and injected as fresh notes. Import now dedupes on the stable Word comment id as a secondary axis and re-anchors the existing record in place. Also fixes post-promotion reply injection (a reply now follows the promoted record) and strips stale `relRange`/`textSnapshot` when re-anchoring a drifted note.
+- **The `.docx` conflict banner now acts on the right document (#1167).** The unsaved-`.docx` banner's "Reload from file" / "Keep my edits" silently no-op'd whenever the server's active doc differed from the focused tab (e.g. on an upgrade boot, `CHANGELOG.md` opens after session restore and becomes server-active). The handler now honors the body's `documentId` — validated against the open-document registry, so the file path still comes from the server's own registry, never request input — mirroring `POST /api/save`.
+- **The auto-launcher no longer spams doomed `claude --resume` attempts (#1169).** The old 5-second grace window was shorter than the ~6s `--resume` needs to detect a missing conversation, so a stale session was never cleared — producing a loop of failing resumes until the circuit breaker tripped (~70s), while the same timer reset the backoff index before the process exited, neutering the exponential backoff. A per-spawn confirmation flag replaces the wall-clock window: a resumed spawn confirms after 30s, and a non-zero exit before confirmation clears the stale session unconditionally (guarded against deliberate signal kills).
+- **Find & Replace match count no longer freezes at "No matches" (#1171).** `find`/`findNext`/`findPrev` dispatch meta-only ProseMirror transactions that change neither the doc nor the selection, so the bar's counter — driven by `update`/`selectionUpdate` — never bumped and the readout stayed empty even with matches present. It now bumps on the `transaction` event (a superset), gated on the bar being open. Fixed alongside the B4 redesign, whose no-match error tint made the latent bug glaring.
+- **`npx -y tandem-editor mcp-stdio` no longer risks silently running a stale global install.** A bare package name in `npx`'s spec resolves to `*`, which `npm exec` happily matches to *any* already-installed copy — on a machine with a leftover pre-desktop global `tandem-editor` predating the `mcp-stdio` subcommand, Claude Desktop's `tandem` MCP server showed "Server disconnected" because npx ran the stale global instead of fetching the current version. The plugin manifest, the Cowork VM installer, and `tandem setup`'s Claude Desktop config now all pin the npx spec to this build's exact version (`tandem-editor@<version>`), which forces `npm exec` past any stale global. `tandem doctor` gained a companion check that warns (with a one-line fix) when a global `tandem-editor` differs from the running build, for the case of a hand-typed `npx tandem-editor` outside the pinned entries.
+
+### Internal
+
+- Bump `undici` (6.26 → 6.27) and `esbuild` (0.28.0 → 0.28.1) in the `tests/tauri-driver` WebDriver harness (#1170, Dependabot). Test-tooling only — never shipped in `dist/`.
+- Track the `.claude/hooks/` README (documenting the 18 wired hook scripts) and the `tests/tauri-driver` lockfile, both previously untracked — for discoverability and reproducible installs (#1168).
+
 ## [0.14.3] - 2026-06-22
 
 ### Added

package/README.md

@@ -26,6 +26,7 @@ Tandem is approaching v1.0 and ships continuous improvements. See [CHANGELOG.md]
 - [For developers and contributors](#for-developers-and-contributors)
   - [Architecture overview](#architecture-overview)
   - [The MCP integration policy](#the-mcp-integration-policy)
+  - [Cowork](#cowork)
   - [MCP tools at a glance](#mcp-tools-at-a-glance)
   - [Channel push and real-time updates](#channel-push-and-real-time-updates)
   - [Development setup](#development-setup)
@@ -172,11 +173,30 @@ Client compatibility:
 | AI surface | Status |
 |---|---|
 | **Claude Code** (local CLI) | Default. Validated. Channel push supported. |
-| **Claude Desktop** (local app) | Supported via the Cowork bridge. Channel push N/A. |
+| **Claude Desktop** (local app) | Supported via the [Cowork plugin bridge](#cowork) (Windows today). Request/response only — channel push N/A. |
 | **claude.ai web chat** | Not supported. Would require exposing the local server publicly via a tunnel, which is outside scope. |
 | **Other MCP-capable clients** (Cursor, Continue.dev, LM Studio, Ollama, …) | Best-effort, MCP-contract-compatible, not validated. |
 | **Non-MCP AIs** | Not supported today. **Local models** (Ollama / LM Studio via OpenAI-compatible endpoints) are committed for v1.0 ([ADR-039](docs/decisions.md#adr-039-non-mcp-model-providers-local-slice-v10-cloud-slice-v11), tracked in #1123); cloud providers (ChatGPT direct, Gemini direct) follow in v1.1. |
 
+### Cowork
+
+[Cowork](https://www.anthropic.com/news/claude-code-on-the-web) is Claude Desktop's local agent mode — Claude runs in an isolated VM on your machine. Tandem connects to it through Claude's **plugin system**, but you don't add a marketplace or run any `/plugin` commands yourself.
+
+- **How to enable (Windows desktop app):** open the integration wizard (Settings → AI Assistant, or "Set up" next to Cowork) and click **Enable Cowork**, or toggle it on in Settings → Network. Tandem writes the plugin entry into every detected Cowork workspace and adds a Windows firewall rule so the VM can reach the Tandem server on this computer. That firewall step needs admin once — without it, the VM can't connect.
+- **Why it's automated, not a manual marketplace install:** inside the VM the plugin must point at `host.docker.internal:3479` and carry a per-machine secret auth token. A published marketplace plugin can't carry that token, so Tandem provisions the workspace entries directly. (The published `tandem@tandem-editor` marketplace plugin is for Claude Code running *on the host*, over `127.0.0.1` — see below.)
+- **Verify:** in a Cowork session, ask Claude to open or list your documents — Tandem's tools should appear. If they don't, re-run Enable.
+- **Real-time updates:** live annotation/chat push needs the Tandem desktop app and Claude Code's channel flag (see [Channel push](#channel-push-and-real-time-updates)); the Cowork connection itself is request/response.
+- **macOS / Linux:** not yet — tracked in #316 / #317.
+
+For Claude Code on the host, the published plugin can be added from the marketplace instead of the wizard:
+
+```bash
+claude plugin marketplace add bloknayrb/tandem
+claude plugin install tandem@tandem-editor
+```
+
+This activates the MCP tools and the bundled skill. It does **not** auto-enable channel push (that still needs `--dangerously-load-development-channels`, see below).
+
 ### MCP tools at a glance
 
 28 active tools across five capability areas. Full reference: [docs/mcp-tools.md](docs/mcp-tools.md).

package/dist/cli/index.js

@@ -289,6 +289,19 @@ function resolveChannelDist(env = process.env, exists = existsSync) {
   }
   return resolve2(PACKAGE_ROOT, "dist/channel/index.js");
 }
+function resolveCliVersion() {
+  if (true) return "0.15.0";
+  if (typeof __APP_VERSION__ !== "undefined") return __APP_VERSION__;
+  for (const rel of ["../../package.json", "../../../package.json"]) {
+    try {
+      const pkg = JSON.parse(readFileSync2(resolve2(__dirname2, rel), "utf8"));
+      if (pkg.version) return pkg.version;
+    } catch {
+    }
+  }
+  console.error("[Tandem] Could not resolve CLI version for npx pin; using unpinned fallback");
+  return "0.0.0-unknown";
+}
 function applyOpsForCli(create, opts) {
   return {
     create,
@@ -305,7 +318,7 @@ function buildMcpEntries(channelPath, opts = {}) {
     }
     tandemEntry = {
       command: "npx",
-      args: ["-y", "tandem-editor", "mcp-stdio"],
+      args: ["-y", `tandem-editor@${CLI_VERSION}`, "mcp-stdio"],
       env
     };
   } else {
@@ -660,7 +673,7 @@ async function applyConfigWithToken(token, opts = {}) {
   }
   return { updated, errors };
 }
-var __dirname2, PACKAGE_ROOT, CHANNEL_DIST, MCP_URL, MAX_CONFIG_BYTES, PathRejectedError, DEFAULT_ROOTS_CACHE, MSIX_PACKAGE_PATTERN, BUNDLED_SKILL_VERSION;
+var __dirname2, PACKAGE_ROOT, CHANNEL_DIST, MCP_URL, CLI_VERSION, MAX_CONFIG_BYTES, PathRejectedError, DEFAULT_ROOTS_CACHE, MSIX_PACKAGE_PATTERN, BUNDLED_SKILL_VERSION;
 var init_apply = __esm({
   "src/server/integrations/apply.ts"() {
     "use strict";
@@ -677,6 +690,7 @@ var init_apply = __esm({
     })();
     CHANNEL_DIST = resolveChannelDist();
     MCP_URL = `http://127.0.0.1:${DEFAULT_MCP_PORT}`;
+    CLI_VERSION = resolveCliVersion();
     MAX_CONFIG_BYTES = 5 * 1024 * 1024;
     PathRejectedError = class extends Error {
       constructor(path8, reason, message) {
@@ -2433,10 +2447,13 @@ var init_lockfile = __esm({
 // src/cli/doctor.ts
 var doctor_exports = {};
 __export(doctor_exports, {
+  evaluateStaleGlobal: () => evaluateStaleGlobal,
+  globalTandemEditorVersion: () => globalTandemEditorVersion,
   runDoctor: () => runDoctor,
   runDoctorCli: () => runDoctorCli,
   summarizeDoctorResults: () => summarizeDoctorResults
 });
+import { execFile as execFile3 } from "child_process";
 import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
 import { request } from "http";
 import { createConnection as createConnection2 } from "net";
@@ -2812,6 +2829,58 @@ function summarizeDoctorResults(failures, warnings) {
     return `${warnings} warning(s) \u2014 Tandem should work, but check the items above.`;
   return "All checks passed. Tandem is ready.";
 }
+function globalTandemEditorVersion() {
+  return new Promise((resolve4) => {
+    execFile3(
+      "npm",
+      ["ls", "-g", "--depth=0", "--json", "tandem-editor"],
+      { shell: true, windowsHide: true, timeout: 4e3, maxBuffer: 8 * 1024 * 1024 },
+      (_err, stdout) => {
+        if (!stdout || stdout.trim().length === 0) {
+          resolve4(null);
+          return;
+        }
+        try {
+          const parsed = JSON.parse(stdout);
+          resolve4(parsed.dependencies?.["tandem-editor"]?.version ?? null);
+        } catch {
+          resolve4(null);
+        }
+      }
+    );
+  });
+}
+function evaluateStaleGlobal(bundled, globalVersion) {
+  if (globalVersion === null) {
+    return null;
+  }
+  if (globalVersion === bundled) {
+    return { status: "pass", message: `Global tandem-editor@${globalVersion} matches this build` };
+  }
+  return {
+    status: "warn",
+    message: `Global tandem-editor@${globalVersion} differs from this build (${bundled}) \u2014 a stale global can break \`npx tandem-editor\` (e.g. Claude Desktop's MCP bridge).`,
+    fix: "npm uninstall -g tandem-editor   (or: npm install -g tandem-editor@latest)",
+    data: { globalVersion, bundledVersion: bundled }
+  };
+}
+async function checkStaleGlobal(r) {
+  const bundled = true ? "0.15.0" : null;
+  if (!bundled) return;
+  let globalVersion;
+  try {
+    globalVersion = await globalTandemEditorVersion();
+  } catch {
+    return;
+  }
+  const result = evaluateStaleGlobal(bundled, globalVersion);
+  if (!result) return;
+  if (result.status === "pass") {
+    r.pass(result.message);
+  } else {
+    r.warn(result.message, result.fix, result.data);
+  }
+}
 async function runDoctor(opts = {}) {
   const wsPort = opts.wsPort ?? DEFAULT_WS_PORT;
   const mcpPort = opts.mcpPort ?? DEFAULT_MCP_PORT;
@@ -2821,6 +2890,7 @@ async function runDoctor(opts = {}) {
   await r.check("mcp-json", () => checkMcpJson(r));
   await r.check("user-mcp-config", () => checkUserMcpConfig(r));
   await r.check("annotation-store", () => checkAnnotationStore(r));
+  await r.check("stale-global", () => checkStaleGlobal(r));
   const { mcp } = await r.check("ports", () => checkPorts(r, wsPort, mcpPort));
   if (mcp) {
     const healthy = await r.check("health", () => checkHealth(r, mcpPort));
@@ -3384,6 +3454,13 @@ var init_positions2 = __esm({
   }
 });
 
+// src/server/file-io/docx-comment-id.ts
+var init_docx_comment_id = __esm({
+  "src/server/file-io/docx-comment-id.ts"() {
+    "use strict";
+  }
+});
+
 // src/server/file-io/docx-walker.ts
 import { parseDocument as parseDocument2 } from "htmlparser2";
 var init_docx_walker = __esm({
@@ -3405,6 +3482,7 @@ var init_docx_comments = __esm({
     init_types3();
     init_schema();
     init_positions2();
+    init_docx_comment_id();
     init_docx_walker();
   }
 });
@@ -3424,6 +3502,7 @@ var init_docx_comment_export = __esm({
     init_sanitize();
     init_document_model();
     init_positions2();
+    init_docx_comment_id();
   }
 });
 
@@ -3838,7 +3917,7 @@ process.once("unhandledRejection", (reason) => {
 `);
   process.exit(1);
 });
-var version = true ? "0.14.3" : "0.0.0-dev";
+var version = true ? "0.15.0" : "0.0.0-dev";
 var args = process.argv.slice(2);
 if (args.includes("--help") || args.includes("-h")) {
   console.log(`tandem v${version}