* fix: don't overlap thinking banner over conversation
* feat: support message queue and add attention indicator
* fix(shell): use c to copy for claude
* fix: strip timestamp tags from cursor
* fix: select project when loading session from direct URL
* feat: support attached images for all providers
* feat(opencode): support permission options
* fix: resolve source control and chat UX bugs
- make staging real in the git panel: new /stage and /unstage endpoints,
/status now reports the actual index via porcelain -z (handles renames,
conflicts, and paths with spaces), and Stage/Unstage All run real git
commands instead of toggling client-side state
- add branch search to the header dropdown and Branches tab
- persist the chosen permission mode per provider so a brand-new chat
keeps it once the session id arrives, instead of reverting to default
- replace cmdk's fuzzy model search with strict token matching so
"chatgpt" no longer surfaces unrelated models
- unit tests for the git status parser
* feat(git): commit graph in history view and cross-spawn everywhere
- render a VSCode-style commit graph in the source control history:
lane-assignment algorithm, SVG strip with colored rails, merge and
branch curves, commit dots, and branch/tag badges per commit
- /commits returns parents and ref decorations across all branches
(--branches --remotes --tags --topo-order) using unit-separator
fields so pipes in commit subjects can't break parsing
- collect stats via a single --shortstat pass instead of one
`git show --stat` call per commit; raise the history limit to 50
- replace child_process spawn with cross-spawn in all runtimes,
routes, and services: it resolves .cmd shims and PATHEXT on
Windows (fixing taskmaster's npx invocations) and delegates to
native spawn elsewhere, removing the per-file win32 ternaries
- unit tests for the log parser and lane assignment
* fix: remove gemini support since google discontinued it
* fix: address code review findings
- validate chat image attachments server-side: only files inside the
~/.cloudcli/assets upload store may reach provider file reads
- harden asset serving with nosniff and attachment disposition for
SVGs to prevent stored XSS
- show the timestamp on image-only user messages
- serialize git stage/unstage calls and defer the status re-sync so
rapid toggles can't interleave or flicker
- use a literal hex fallback for commit ref badges (alpha suffix on a
var() string produced invalid CSS)
- stop binding a URL session to a guening
project instead
- add the missing attentionRequiredIndicator key to all sidebar locales
- clean up dangling conjunctions left the
de/ru/tr/ja/zh-CN/zh-TW READMEs
* fix: address code scanning findings
- enforce a second image trust boundary in the provider builders:
buildClaudeUserContent/buildCodexInputItems only accept files inside
the upload store or the run's working directory (CodeQL path
injection)
- drop an always-true selectedProject check in handleSubmit
- remove the unused resume option from spawnCursor
* fix: use CodeQL-recognized containment check for image reads
Replace the path.relative guard in isPathInsideDirectory with the
resolve + startsWith(root + sep) idiom so the path-injection barrier
is visible to code scanning; behavior is unchanged.
* fix(security): canonicalize Claude image attachment reads
Resolve image attachment paths with realpath before reading so symlinks
inside allowed roots cannot escape to arbitrary files. Preserve support for
symlinked project/upload roots and add focused coverage for both cases.
* fix: show agent subtask
* fix(sessions): title app-created sessions from the first user message
App-created sessions (started by sending a message from cloudcli) were
titled with placeholder names — "Untitled Codex Session" from the disk
indexer and, briefly, "New session" from the empty canonical upsert —
before a later sync finally settled on the right text, causing the
sidebar title to flicker.
- Codex/OpenCode synchronizers now title app-created sessions (distinct
app id mapped to a provider id) from the first user message, while
sessions found purely by indexing keep their existing setup. Claude
keeps its AI-generated titles; Cursor already used the first message.
- Decode OpenCode's JSON-string-literal prompts so titles no longer
surface wrapped in quotes; hoist unwrapJsonStringLiteral into
shared/utils since it's now used by both the reader and synchronizer.
- Guard the sidebar upsert merge so an empty summary can never blank out
a title that is already set.
- Add codex/opencode synchronizer tests for the app-created vs indexed
naming paths.
* fix(chat): make message queuing reliable across sessions and turn boundaries
Queued messages had four related defects:
- A queued message flashed and then vanished at flush time: concurrent
transcript refreshes (the `complete` handler racing the watcher-triggered
update) could resolve out of order, letting a stale response overwrite
newer server messages after the optimistic row was pruned. Session slots
now carry a monotonic fetch ticket and discard stale fetch/refresh/
fetchMore responses.
- Switching sessions flushed the previous session's queued draft into the
newly viewed one (sending it with the wrong provider's settings, e.g. a
Claude model into a Codex session). The composer flush is now scoped to
its session, and a draft restored into an idle session sends after a
short grace period so a live-run ack can cancel it.
- The thinking banner never appeared for a queued turn: the chat handler's
session-keyed completeRun safety net could fire after a queued message
had already started the session's next run, emitting a spurious
`complete` that killed it. The safety net is now scoped to its own run
via completeRunIfCurrent (with a regression test).
- Queued messages only sent while their session was being viewed. Drafts
now persist their send options (model, effort, permissions) at queue
time, and a new app-level useQueuedMessageAutoSend hook dispatches a
non-viewed session's queued message as soon as its run completes, using
the storage key as the claim ticket to prevent double sends.
* feat(i18n): add Turkish (tr) language support
Add comprehensive Turkish localization for the UI, following the
existing i18n pattern established by Japanese (#384), Russian (#514),
and German (#525) language support.
Changes:
- Add Turkish translation files for all 7 namespaces
(auth, chat, codeEditor, common, settings, sidebar, tasks)
- Register Turkish locale in config.js with all resources
- Add Turkish entry to languages.js (value: tr, nativeName: Türkçe)
- Update .gitignore to allow src/i18n/locales/tr/tasks.json
(matches existing en/ja/ru/de exceptions)
Translation details:
- 934 total strings translated (100% coverage, matches en.json key count)
- Translated by a native Turkish speaker with software engineering
background; terminology reviewed against conventional Turkish
tech community usage.
- Technical terms kept in English per Turkish dev community norms:
Claude, Cursor, Codex, Gemini, CLI, MCP, PRD, JSON, YAML, stdio,
http, commit, branch, token, prompt, minimap, sandbox, YOLO.
- Informal second-person singular (\"sen\") used throughout — fits the
developer-facing nature of the UI.
- All interpolation placeholders preserved exactly (e.g. {{count}},
{{projectName}}, {{email}}).
- i18next plural keys (_one/_other) kept intact.
Verification:
- Key structure parity with en.json confirmed (jq paths diff empty)
- All 38 unique interpolation variables preserved
- npm run build passes cleanly
* docs(readme): add Turkish README and language switcher links
Add README.tr.md — full Turkish translation of the main README,
following the structure of existing README.de.md / README.ja.md /
README.ko.md / README.ru.md / README.zh-CN.md.
Update the language switcher row in all 6 existing README variants
to include a Turkish link (matches the pattern used by #534 for the
German language link addition).
---------
Co-authored-by: Simos Mikelatos <simosmik@gmail.com>
* docs: standardize hero badges and language order across README translations
* fix: label README command blocks as bash
* docs: translate remaining sections to Japanese
* fix(readme): remove sponsor duplicate in Japanese readme
* fix(readme): japanese translation fixes
* fix(readme): remove duplicate sections
---------
Co-authored-by: Haile <118998054+blackmammoth@users.noreply.github.com>
* feat: add Russian locale
- Add ru translations and register namespaces
- Add Russian to supported languages list
- Ignore .gemini workspace config
* fix: improve Russian plural forms in sidebar translations
Add proper Russian plural forms (few/many) for correct grammar with different count values
* docs(readme): add Russian translation and fix language switcher order
- Create README.ru.md based on the current English README.
- Update language switchers in all localized README files so
English comes first, Russian second, and the remaining
languages follow.
- Fix the issue where the current language was not shown
correctly in the switcher for some localized README files
* fix(readme): fix language switcher positions and markdown issues
- Fix language switcher positions in README.md.
- Add bash language tags to command code blocks in README.ru.md.
* fix(readme): fix tool setup step numbering
- Fix tool setup step numbering in README.md and localized README files.
* fix(gitignore): allow translation task files to be tracked
Add exceptions to .gitignore for task translation files across multiple locales
(en, ja, ru, ko, zh-CN) to enable version control of translated content while
keeping generated task files ignored.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
* feat(i18n): add Russian translation for tasks
Add Russian locale translation file for TaskMaster task management interface.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
* fix: ignore missing tasks.json files for ko and zh-cn locales
* Delete .worktrees directory
---------
Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
