Launch repaired IBus in a collected app.slice service so native owner retirement cannot kill the shared desktop daemon. Presence renewal refreshes credentials without repeating input readiness; explicit Connect still prepares the desktop.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Route project setup and file operations through ordinary SSH admission, retaining reserved control capacity for owned-port inspection and lifecycle operations.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Use bounded partial directory pages with a global metadata limit and explicit listing/export warnings. Always inspect the configured entry directly so it remains readable beyond the first page.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep active viewer leases and retired runner process proof, while removing expired or disconnected viewer records from the host ledger.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Hold a confined per-project flock across clone, repository validation, checkout, and worktree creation so another agent cannot observe partially created Git state.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Bind generated instructions and skills to fresh attempt-owned snapshot paths, retaining old immutable snapshots without touching persistent user files or provider HOME. Record possible process dispatch only at the actual launch RPC boundary so preparation failures can retire their exact owner safely.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep the immutable cache suite and Boat secret configuration acceptance assertion in the combined feature PR while preserving the standalone core review size.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Reserve exact computer generations for graceful suspension, keep provider checkpoints on their persistent remote authority, and fence failed prelaunch attempts before retry. Recover previously retired quiescent Codex checkpoints only with exact ownership and unchanged-byte evidence.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Preserve the two existing additive runtime acceptance suites in the stacked feature PR while keeping browser synchronization fixes in the independently checked core branch.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
* origin/master:
fix(pi-local): avoid embedding model catalogue in errors (#13628)
fix(opencode-local): run in the realized workspace (#11438)
fix(ui): align chat connection and recovery cards (#15771)
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Fence admission and ordinary commands at warm expiry, reserve exact-generation process control for at most thirty seconds of shutdown, and always retire the owned slice after graceful close or timeout.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Persist exact upload ownership before staging, renew a five-minute inactivity lease per chunk, and reclaim verified expired uploads on seed or home admission. Preserve active uploads and unrelated directories, and fence delayed writes and aborts after replacement.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Bound each physical Boat to eight SSH operations with six ordinary slots and four bulk transfers. Preserve command deadlines while queued and always release admission after transport completion or failure.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Dotta