[brennanb2025]

	Files	Added	Deleted	Net
Test	14	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​505	$\color{#cf222e}{\Huge{\mathbf{−}}}$​5	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​500
Prod	47	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​1105	$\color{#cf222e}{\Huge{\mathbf{−}}}$​328	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​777

ELI5

An approval or question can disappear while its agent is still waiting for an answer. Chat controls currently come from whichever conversation rows are loaded, so opening a long chat, replacing its newest page or unloading old history can remove a request that still needs the person.

What Changed

Pending approvals and questions come from the host’s complete view of current work, independently of conversation pages. The existing controls keep the full request identity, revision, choices and question fields; answering still uses the existing saved-request validation. Resolved requests and requests from positively replaced owners are removed by that same host projection.

The subscription announces when current requests change. The client reads their full contents one small piece at a time and replaces the collection only when the complete answer belongs to the current host and execution. Unrelated conversation output does not restart the read. Older hosts retain the existing loaded-history behavior, and older clients receive no full request transfer. Desktop catch-up can require the new consumer capability separately.

Why

Current decisions must remain answerable when conversation history is paged. Keeping history pinned or avoiding snapshots around particular prompts would leave that dependency in place. Reusing the existing host owner separates current requests from historical rows without another saved state. Small reads provide delivery flow control through existing request replies; sending the entire collection through a subscription can overfill a phone’s receive window even when each individual frame fits.

This is an independent prerequisite for #28951, stacked on #28993. It also applies to ordinary initial reads and phone history windows. Requested by @BrennanKB5 during review.

Linked Issue

Native-chat performance review requested by @BrennanKB5; blocker R1-01 tracked in #28951. No separate issue.

Visual Proof

Actual hidden Electron on isolated GitHub Linux runners, built from the reviewed source commits. A deterministic command-line provider exercised the real host, read owner and rendered controls in a folder workspace; no renderer request collection was injected. Runtime run.

Before (#28993): a child approval has fallen outside 607 newer messages and its control is absent.

After (this PR): the complete approval stays available outside the loaded history page.

The grouped question also stays answerable through the existing card.

Rendered answers and removal, backward wheel paging, hidden-send settlement, owner-end removal and quit/relaunch ran. Ordinary short replay also passed on both heads; a separate fresh-window prerequisite run retained all loaded messages (run). A strict retention check after backward paging trimmed nine old rows on both the prerequisite and its base, an existing retention boundary. The separate paired bridge transport run below now certifies huge payloads and explicit required-text metadata; screenshots remain evidence of rendered controls.

Testing

Current head: 422766b. Round 3 correctness and dedicated transport/performance source review found no new proven issue; final source readiness and the end-round architectural decider completed. The full PR workflow and its PR checks passed aggregate succeeded on this exact head, including all five unit shards, static analysis/typecheck, generated catalog checks, wire compatibility, mobile verification, packages and relay integration. The full host current-request flow passed after correcting its provider test fixture. The exact-head helper benchmark passed, including complete pending-request adoption and full history reconstruction; rendered Electron and actual paired bridge evidence are complete. CI run.

• Hidden Electron off-page approval/question answers, backward paging, hidden sends and restart verified on the final commit; paired reconnect is covered separately below.
• Automated host, reducer, lifecycle, bounded-read, owner and compatibility contracts pass; real rendered and bridge evidence is linked above and below.
• CI is the full lint and typecheck gate. No checks, dependency installs, builds or apps run on the development Mac.

Review

The architectural decider ruled to keep complete current requests independent of paged history and adopt separate bounded reads refreshed by stream changes. One fresh plan check required bounded phone read-failure recovery; that correction is committed. Final source implementation review and readiness completed with no new proven high-severity regression; the remaining transport evidence is now complete with the limits below. Source review includes local and paired desktops, web, phone consumers, SSH host ownership and mixed versions. No new user-facing notice or prompt surface is added.

Agent skill upstream boundary

• Not applicable; no upstream skill implementation is copied.

Notes

Intended differences from the common pattern: reuse the existing execution-host saved conversation owner instead of adding a second request database; read small pieces to support independently updated phones and remote hosts; retain complete question payloads and existing controls. Temporary, tracked follow-up: pre-decode journal replay byte admission.

Complete pending-request memory scales with the work awaiting a response; each transport part is bounded. This does not change journal retention or preflight raw journal replay bytes. Pre-existing Cancel limitations when a child prompt outlives its parent turn are recorded separately on desktop and phone; answering remains supported.

Checklist

• This PR is focused on the current-request ownership contract.
• User-facing before/after, mechanism and alternatives explained.
• Exact-source before/after Electron screenshots and completed transport evidence attached.
• Final source correctness, compatibility, performance and readiness reviews complete.
• Cross-platform, SSH and older-peer implications considered.
• Full PR CI passes on the final commit.

Measurement evidence

Measured this exact head and #29125 on the same original Linux host and Node 26.1.0, with 300 older messages, 200/2,000/20,000 missed rows, 5 warmups and 31 samples. The original history-only control and 18 production-helper cases per head passed. Complete child approvals and required grouped questions adopted outside the loaded page; exact final content/cursor and full backward reconstruction passed, with no request refetch on unrelated output. The comparative timings and setup limits are in #29125. This helper run excludes outer RPC/network/phone bridge behavior and rendered UI, which are verified separately.

Existing question-card behavior observed during QA: a blank required last question displays Skip, but clicking it leaves the card unanswered; entering text and choosing Submit works. The card code is unchanged from the base and this is deferred with the existing child-only Cancel limitations.

Paired transport validation

Paired bridge run passed on the exact successor; nine relevant request/reader/transport source blobs are identical on the prerequisite. Production bridge modules and an actual encrypted connection delivered 5,774,314 bytes in 235 sequential reads, including a 1,048,911-byte request body. The largest bridge frame was 51,270 bytes, with one read in flight. The assembled JSON matched the host exactly, including all four generic approval options and explicit required-text metadata. Twelve subscription events (67,078 bytes) remained unacknowledged during the transfer; this did not fill the event window. Capability simulation correctly rejected an unsupported read, omitted the marker, replayed eight rows exactly, recovered after terminating the owned socket and stopped delivery after disposal. This exercises a scripted page endpoint, not a native phone WebView. The earlier run passed the main transfer and failed only because the compatibility probe supplied an invalid UUID; that harness input was corrected.

Native phone UI, an actual older binary, SSH transport and a late RPC reply after disposal were not exercised by this run. Owner replacement, unsupported openings and late-completion rejection passed the automated exact-head contracts.

[brennanb2025]

Current status: review complete, real-agent QA passed

Final head a4f3467328f03fed390bf4230c2e0f28b9bf06a1 merges current main. After the previous pass, CodeRabbit found that a current-request read failing the same way every time made the desktop resubscribe every 750 ms with no end; 7776abf now reopens once per failing version, then reports the failure and keeps the live transcript open (one new transport test). The full PR workflow and its aggregate passed on this head (one infrastructure-cancelled attempt was rerun), and real signed-in Claude QA on M4Air passed on this exact head (see the M4Air section below), including zero subscription reopens over 60 s with a healthy chat open. Native phone UI, SSH transport, an older binary, Codex and an injected repeating read failure were not exercised by real QA; the failure case is covered by the transport test. Earlier heads named below are history.

A pending child approval or question could disappear when its history row left the loaded page. The reviewed stack separates current decisions from paged history through the execution host’s existing owner and bounded independent reads. Pending approvals and questions now remain answerable independently of the loaded conversation history.

Three source rounds completed. The architecture review required the independent-request prerequisite; round 2 replaced an unpaced stream transfer with sequential cursor reads, and round 3 found no new proven defect. The final decider ruled KEEP. Catalog, type and wire-test corrections are included in the exact head 422766b923ccdb81f0b445da50f9f18eb278daed; the full PR workflow and its aggregate passed.

Actual hidden Electron comparison on isolated Linux runners reproduced missing controls on the base and verified both reviewed heads: off-page approval/grouped question, rendered answers and removal, backward wheel paging, hidden-send settlement, owner completion plus withdrawals, restart and ordinary short replay. Whole-window screenshots are attached in the PR body. A strict retention check after paging retired nine oldest rows on both base and prerequisite; the fresh prerequisite replay retained every loaded text message. Runtime matrix, fresh replay.

Final-stack measurements on the same original Linux host passed exact content/cursor/request payload and backward reconstruction checks. For 20,000 missed revisions, helper p50/p95 fell from 262.936/296.338 to 1.154/1.561 ms; distinct messages fell from 350.373/422.345 to 9.986/11.516 ms. These exclude network and painting; retained host scans and total request memory still scale with useful data.

Paired bridge run passed on the exact successor; nine relevant request/reader/transport source blobs are identical on the prerequisite. Production bridge modules and an actual encrypted connection delivered 5,774,314 bytes in 235 sequential reads, including a 1,048,911-byte request body. The largest bridge frame was 51,270 bytes, with one read in flight. The assembled JSON matched the host exactly, including all four generic approval options and explicit required-text metadata. Twelve subscription events (67,078 bytes) remained unacknowledged during the transfer; this did not fill the event window. Capability simulation correctly rejected an unsupported read, omitted the marker, replayed eight rows exactly, recovered after terminating the owned socket and stopped delivery after disposal. This exercises a scripted page endpoint, not a native phone WebView. The earlier run passed the main transfer and failed only because the compatibility probe supplied an invalid UUID; that harness input was corrected.

Deferred existing limitations: journal rows are decoded before byte admission; Cancel may do nothing for a child request after its parent ends; a blank required final question can display Skip but send no answer. Nonblank answers work. Intended differences from the common pattern are the existing execution-host owner, complete question payloads and bounded reads for independently updated remote consumers. Pre-decode byte admission remains a named temporary follow-up. Native phone UI, a real older binary and SSH transport were not exercised; capability simulation must not be read as those tests.

#28951 was closed separately by brennanb2025 at 22:07 UTC on October 15. This review worker did not merge or close any PR.

---

Real signed-in agent QA — 2026-10-16

Passed on exact head 422766b923ccdb81f0b445da50f9f18eb278daed, using real Claude Opus 1M/high in hidden Electron on the explicitly authorized Mac. A real background child requested permission to write one QA fixture. While the chat tab was hidden, its parent completed 225 separate Read calls and a long streamed reply; the pending approval at sequence141 was older than the newest200-item page (oldest sequence181). Reopening the actual chat tab showed “Allow Write?”; clicking Allow once reached the child, produced the expected file, and cleared the pending request. Older history rendered, and an app restart retained the approval’s saved Allow decision and the child’s “Write succeeded” result without another prompt. All pre-existing completed messages and tool results survived; the final child-notification turn finished during shutdown, adding its last reply.

The initial child-question attempt could not use AskUserQuestion because that tool was absent from the real child’s tool contract; that question flow is unverified. The actual child approval flow above passed. Claude recovered from one temporary HTTP502 retry. Codex remains blocked by credential isolation; no SSH, phone, or older-peer pass is claimed. Real Claude/Codex hook-file SHA256 values stayed unchanged.

Real signed-in agent QA — integrated head

PASS on 5bc316a2774ee57b5c6c36ffd323a3a262a3b3b3, using real signed-in Claude Opus 5.5 (1M context), high effort, in a hidden Electron window on the explicitly authorized Mac. A real background child waited for Write approval while the parent made 225 Read calls and streamed a long reply with the chat tab hidden. The approval was at sequence 1153, outside the newest 200 rows (oldest 1201). Reopening showed one Allow control; clicking once removed it, saved the answer and let the child create the expected file.

Backward scrolling loaded and rendered the oldest messages. The child and its notification turn finished before the restart snapshot. Restart preserved all 771 saved items with identical hash ed8023d9c699895a05a9c5070eccaba3db37ffc0fde9e224e3f6edc1490952d1; the child success remained rendered, with no pending approval or Sending bubble. The earlier old-head result remains historical evidence; this pass exercised the integrated head directly.

This sequential check reused the disposable chat profile from successor QA; it is not an independent empty-profile comparison. Codex remained blocked by authentication isolation, and the real child tool contract did not expose grouped questions. Native phone UI, SSH transport, older binaries and the full synthetic withdrawal/large-payload matrix were not rerun. Source review completion and readiness remain the review owner's responsibility.

Launch gates passed (initial load 5.61, memory 83% free; restart load 4.46, memory 83%; zero typechecks). Real Claude settings and Codex hook hashes stayed unchanged. Owned app and agent processes were stopped using recorded identities, and disposable homes were removed; the clean private checkout was removed.

Real signed-in agent QA (M4Air), head a4f3467

Passed with M4Air's real signed-in Claude, Opus (picker description Opus 5.5), High, Ask for approval, and auto-naming off through the UI. Grok drove the hidden isolated app over CDP; the folder workspace's group had its real parentPath set.

• The parent completed 225 Read calls over all 225 distinct fixtures and a 100-paragraph streamed reply while hidden. The child's pending Write approval was absent from the host's newest 200-item history page (236 saved items at that point).
• Reopening showed exactly one Allow. One click produced exactly ORCA_M4AIR_29121_CHILD_APPROVED plus one newline (32 bytes). Scrollback rendered the original prompt. No short follow-up was sent on this head.
• Actual agentSession.subscribe opens after attach: 0 over 60 seconds, with the healthy settled chat open.
• Same-profile restart on this head: 240/240 item IDs and body SHA-256 hashes matched, and all 509 journal rows were unchanged. The UI rendered the settled child result with no pending control and no Sending bubble. No Claude 429 occurred.
• Launch load (1/5/15 min): 19.56 / 9.15 / 6.37, 79% memory free. Restart: 3.02 / 3.39 / 4.03, 69% free.

Hooks stayed on. SHA-256 before and after:

• ~/.claude/settings.json: before 7847561ee31422545b5f29fc9154aeb4b73733c46e0457b719d1b633920a45c0; after 7847561ee31422545b5f29fc9154aeb4b73733c46e0457b719d1b633920a45c0.
• ~/.codex/hooks.json: before edb2d1cab54568e86a32aa813939d8a8892f1184a0d13bddbd08e9059a723eee; after edb2d1cab54568e86a32aa813939d8a8892f1184a0d13bddbd08e9059a723eee.

Pending approval:

Original prompt after scrollback:

Settled child after restart:

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0d9b193a-388e-44ef-8dc3-1e54b56a3283

📥 Commits

Reviewing files that changed from the base of the PR and between d68c541 and a4f3467.

📒 Files selected for processing: 1

• src/renderer/src/components/native-chat/structured-agent-session-read-transport.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

📝 Walkthrough

The change adds a current-requests capability for structured agent sessions. Hosts project pending approval and question records, publish markers, and serve cursor-based read pieces through a new RPC method. Renderer and mobile clients hydrate those records independently of paged transcript history and use them for prompt selection and send-queue checks. The change also updates subscription handling, reducer state, client capability lists, and related tests.

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to a4f34

A persistent current-request read failure triggers only one reopen for that marker, leaving no demonstrated merge-blocking risk.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 44.19% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 43 functions across 51 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly describes the primary change: keeping pending chat decisions available when they fall outside loaded history.
Description check		The description is detailed and covers the required explanation, scope, rationale, issue reference, visual proof, testing, review notes, compatibility considerations, and checklist. It references #289…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches: 💡 1

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: e28ee281-2e1a-4841-bbd1-512a8fe8f0e9

📥 Commits

Reviewing files that changed from the base of the PR and between 82a2414 and 5bc316a.

⛔ Files ignored due to path filters: 1

• src/shared/rpc-contract/rpc-params-catalog.generated.ts is excluded by !**/*.generated.*

📒 Files selected for processing: 59

• mobile/src/session/mobile-structured-actionable-prompt.ts
• mobile/src/session/mobile-structured-agent-session-cancel.ts
• mobile/src/session/mobile-structured-transcript-read.test.ts
• mobile/src/session/mobile-structured-transcript-read.ts
• mobile/src/session/mobile-structured-transcript-subscription.ts
• mobile/src/session/use-mobile-structured-agent-session.ts
• mobile/src/session/use-mobile-structured-agent-state.ts
• mobile/src/session/use-mobile-structured-send-with-outcome.ts
• mobile/src/transport/mobile-runtime-client-capabilities.ts
• mobile/src/transport/rpc-subscription-inventory.ts
• src/main/claude/claude-background-stop-records.test.ts
• src/main/ipc/desktop-renderer-runtime-capabilities.ts
• src/main/native-chat/agent-session-wire/agent-session-bounded-frames.ts
• src/main/native-chat/agent-session-wire/agent-session-current-requests.test.ts
• src/main/native-chat/agent-session-wire/agent-session-current-requests.ts
• src/main/native-chat/agent-session-wire/agent-session-published-work.ts
• src/main/native-chat/agent-session-wire/agent-session-stop-note-refresh.test.ts
• src/main/native-chat/agent-session-wire/agent-session-stop-note-refresh.ts
• src/main/native-chat/agent-session-wire/agent-session-subscriber-catch-up.ts
• src/main/native-chat/agent-session-wire/agent-session-subscriber-frame-fields.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-background-task-channel.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-current-requests.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-current-work.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-message-rig-provider.test-fixture.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.ts
• src/main/native-chat/agent-session-wire/structured-conversation-command-admission.test.ts
• src/main/runtime/mobile-rpc-allowlist.test.ts
• src/main/runtime/rpc/methods/structured-agent-session-current-requests.ts
• src/main/runtime/rpc/methods/structured-agent-session.test.ts
• src/main/runtime/rpc/methods/structured-agent-session.ts
• src/main/runtime/runtime-rpc/runtime-rpc-mobile-agent-session-methods.ts
• src/renderer/src/components/native-chat/structured-agent-session-message-projection.ts
• src/renderer/src/components/native-chat/structured-agent-session-prompt-response.ts
• src/renderer/src/components/native-chat/structured-agent-session-read-owner-contract.ts
• src/renderer/src/components/native-chat/structured-agent-session-read-owner.ts
• src/renderer/src/components/native-chat/structured-agent-session-read-transport.ts
• src/renderer/src/components/native-chat/structured-agent-session-reconnect.ts
• src/renderer/src/components/native-chat/use-structured-agent-session-transport-state.ts
• src/renderer/src/components/native-chat/use-structured-agent-session.ts
• src/renderer/src/web/web-runtime-client-capabilities.ts
• src/renderer/src/web/web-runtime-client.test.ts
• src/shared/agent-session-current-requests-capability.ts
• src/shared/agent-session-current-requests-reader.ts
• src/shared/agent-session-current-requests-wire.ts
• src/shared/agent-session-current-requests.ts
• src/shared/agent-session-frame-fields.ts
• src/shared/agent-session-handoff-status.ts
• src/shared/agent-session-wire.ts
• src/shared/electron-remote-runtime-client-capabilities.ts
• src/shared/protocol-version.ts
• src/shared/rpc-contract/agent-session-current-requests-params.ts
• src/shared/structured-agent-session-coalescer.ts
• src/shared/structured-agent-session-history-state.ts
• src/shared/structured-agent-session-reducer.ts
• tests/e2e/cross-version-wire/structured-agent-session-host-fixture.ts
• tests/e2e/cross-version-wire/structured-agent-session-surface-calls.ts
• tests/e2e/cross-version-wire/structured-agent-session-surface-execution.ts
• tests/e2e/cross-version-wire/structured-agent-session-surface-manifest.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 6 remain after this review.

[miguel93041]

Follow-up in #30062: Codex async questions now use the current-request transport introduced here, so their cards can remain available outside loaded history on desktop and mobile.

The extension keeps the existing chunked reads and host ownership. Hosts advertise async support, clients opt in, and older clients retain the previous response shape. New clients connected to older hosts keep their inline-card fallback. No new RPC method or persisted question store is added.

The PR also adapts the async-question reconstruction from #25448 for terminal-backed chat. It has 384 passing focused tests and a passing build; full CI and physical-device/live SSH verification remain pending.