Initial multi-server checks can consume the entire five-second listener
budget before sslocal binds its inbound ports. Allow 15 seconds for
listeners and 30 seconds for GUI startup health confirmation.
Include endpoint readiness diagnostics and a delayed-start regression.
Keep regular policy while windows remain open to avoid repeated Dock registration. Share the activation retry budget across visibility events and stop permanently after exhaustion.
Remove lossy default-action writes that can replace china-proxy
with gfwlist. Preserve legacy preference reads and derive the
default action from the selected preset.
Update tests to use explicit presets and verify identity,
legacy compatibility, and no-op reselection.
Add Mainland China proxy routing with independent rule workspaces.
Preserve existing routing choices through equivalent preset mappings.
BREAKING CHANGE: existing custom rules and enablement settings are
not migrated. Recreate them in the appropriate preset.
CI scheduling can exhaust the fallback budget or exceed the elapsed-time
assertion. Separate record filtering and control deadline delivery so
tests verify fallback and request cancellation directly.
The home run-control card and the menu-bar status card render the agent
and system-proxy status rows straight from snapshot replacements, so fast
operations (e.g. proxy mode switches) flash transient states like
"applying" before settling.
Add a presentation-layer debounce shared by both surfaces:
- TransientDelayGate: per-stream gate where stable values display
immediately, transient values (starting/applying/repairing) display
after 400 ms and are dropped when superseded, and displayed transients
are held for at least 400 ms.
- StatusDisplayModel: app-level shared model deriving agent and
system-proxy payloads (row + detail + hint) from workflow snapshots
through two independent gates; domain facts keep their cadence.
- Wire the model through the composition root into RuntimeControlCard
and StatusCardView; toggles, approval actions, the difference view and
target/mode rows keep reading the raw snapshot.
Keyboard-launcher launches (Raycast/Spotlight Enter) left the
LSUIElement app unforegrounded with a missing Dock icon until Mission
Control forced a refresh. Investigation across real-machine rounds
(recorded in the ADR-0017 supplements) pinned three cooperating causes:
- The launch activation retry never started at launch: the workspace
window's participation events (anchor attach / occlusion / key) could
all miss the launch moment when content installed before the window
became visible and the visibility notification fired before the
anchor attached. A deferred visibility rescan plus re-armable chain
(until truly settled) close this gap.
- NSApp.isActive can report an activation illusion while the menu bar
still belongs to the previous frontmost app, so the settle check now
requires both isActive and menu bar ownership.
- A same-turn accessory->regular bounce is coalesced away by the
system; forced activation is a three-hop sequence with real settle
delays (accessory -> 0.1s -> regular -> 0.15s -> activate), which
re-registers the app with WindowServer/Dock and reclaims the menu
bar. Each acting attempt also re-asserts makeKeyAndOrderFront and
orderFrontRegardless as a visible-layer fallback.
Diagnostics: launchActivationRetry and windowAnchorAttached events
(unified-log category "window") record per-attempt facts (activation,
local policy, frontmost app, menu bar owner, space, window visibility);
user-environment facts stay out of shared diagnostic reports.
Replace the custom encrypted container with AgeSwift 0.1.0 so standard
age tools can inspect sensitive configuration independently of the app.
Use independent Keychain X25519 identities for catalog.age and
proxy-listening.age. Preserve atomic commits and confirmed recovery;
reject historical NG2 formats without migration or cleanup.
Move InMemoryDiagnosticReportExporter and InMemoryConfigurationGroupFileExporter
from App/PlatformEffects to Tests/Support: both are test doubles with no
production caller, and production composition wires only the AppKit adapters.
Delete RuleRuntimeCompiler.validation, a wrapper whose only callers were two
assertion blocks in the controller deployment test; those restated
custom-to-custom shadowing and validation order-independence, both pinned by
CustomRuleValidatorTests and RuleAnalysisTests. RuleRuntimeCompiler.compile
stays and keeps its production caller.
Co-Authored-By: DeepSeek Harness <noreply@deepseek.com>
Three tests claimed coverage they could not deliver:
- subscription URL credential cleanup asserted a lookup derived from the
already-empty subscription list, so it held even on a leak; production has
no separate URL credential store (SubscriptionRecord.url is a plain field)
- the runtime log event sweep planted no secret values, so its secret half
could never fail; keep the live JSON-dump check and rename the test to match
- clipboard and QR saver tests exercised only in-memory doubles that live in
production source and have no other caller; delete the six tests and the
three doubles (AppKit adapters stay untested, as before)
Co-Authored-By: DeepSeek Harness <noreply@deepseek.com>
Collapse the four definitions of "one log line" into LogLine (timestamp,
level, source, text) with a single renderer and parser. agent.log lines
now carry the uniform prefix, absorbing the ssxng: event marker into the
source column; legacy lines degrade to raw display without rewriting.
Level detection moves into the row model with a classic three-level
taxonomy whose unified-log projection stays unchanged.
The diagnostics log view merges GUI events and the agent.log tail through
DiagnosticLogIntake into one time-ordered list with level and source
filters; the tail window logic moves into the intake and blank lines are
kept for raw fidelity. The report whitelist projection and unified-log
routing are unchanged.
Ancestor groups of the active target now show a hollow bolt beside the
existing filled bolt on the target itself, in the servers tree, the
favorites table and the home target browser; the node detail subtitle
shows "含活动目标". The derivation lives in
CatalogTreeSnapshot.ancestors(of:) so every surface shares one rule
while activeTargetID stays a runtime fact outside the catalog
projection. Groups activated directly keep the filled bolt and leave
their member rows unmarked.
Qiu Yuzhou
Qiu Yuzhou
