Application shell #

The Octane/Kumo shell opens conversations at /conversations/<id>, with / listing saved conversations, /tasks showing scheduled task summaries, and /settings retaining the instructions and memory editors. /agents redirects to /; removed starter pages return the normal 404. Messaging and task editing are separate UI work, so the shell exposes no inactive chat composer or task actions.

ShellSessionProvider owns a native owner connection and conversation metadata for navigation. It performs authenticated HTTP preflight before opening a native AgentClient, waits for identity and list RPC, and only then reports Connected. Offline events detach; reconnect and failed handshakes repeat authentication with a three-second retry interval and bounded preflight, ready, and RPC waits. Unauthorized responses stop automatic retries and clear navigation metadata. Settings and the task overview retain independently scoped native owner clients.

The URL owns selection. Nothing private is written to browser storage or public SSR. A generic SSR navigation/content fallback remains around the published Kumo sidebar. Connection and query cancellation guards reject late results, and pending creation does not redirect a user who has since chosen another route. Closing a shell connection never cancels a durable conversation turn. Think remains the transcript authority; the shell stores no transcript or fabricated activity order. Metadata refreshes after creation, route changes and reconnect, and when stale on window/tab focus.

The command palette stays mounted and uses Kumo results, search, focus, and click activation. The public pinned ARIA adapter retains a stale focusedNodeId after filtering. A shell-local compatibility boundary keeps the input's active descendant aligned with the native focused option and dispatches Enter through that option's ordinary click handler. This also preserves modifier activation and duplicate conversation names. Remove the boundary when a verified public upstream release fixes that behavior. Keyboard listeners and the scoped observer are disposed.

pnpm test:app-shell runs Chromium against the packaged production Worker with a server-created owner cookie. It covers native create/list/rename and persistence, deep links, private SSR, keyboard/pointer palette activation, focus return, mobile navigation and 14px text, offline/auth recovery, bounded failed socket attempts, native create-validation failure, and a delayed stale list response. Test-only network interception introduces failures; successful data comes from the actual native runtime. pnpm test:settings retains instructions/memory behavior coverage. Run release builds and packaged browser tests sequentially to keep assets stable.

Conversation metadata now has one authoritative TanStack Query entry, exposed by useConversationsQuery in src/runtime/queries/. useShellSession combines that query with native connection/creation state for navigation, Home, the command palette, tasks and diagnostics. It no longer keeps a second list or manual list loading state. Simultaneous observers share in-flight reads. Connected still requires native readiness and a successful initial list read. Read errors never retire a healthy socket: a retained background error can coexist with an in-flight refresh after reconnect. Only native connection failures drive the reconnect loop.

The app-level customer provider owns the origin/session-scoped cache; see Agent settings for authentication cleanup. Reads use 30-second freshness, five-minute inactive retention and no automatic retries. Native broadcasts, route refreshes, explicit refresh and reconnect invalidate the list; Query handles stale focus refresh. Initial or background reads cancelled by a newer notification cannot replace a confirmed creation. Creation remains an explicit native command with no automatic retry, and the existing route guard still prevents a late result redirecting someone who already navigated away.

The resource hooks use .tsx so the pinned Octane compiler emits their nested hook-slot arguments. Plain .ts wrappers importing only the Query binding were not slotted by this compiler; the packaged browser regression covers hydration and the shared observers in addition to typechecking.