Repository navigation
Chats without a project: a built-in Chats container with one scratch folder per chat - #887
Open
danyaberezun wants to merge 22 commits into
Open
danyaberezun wants to merge 22 commits into
danyaberezun wants to merge 22 commits into
Conversation
danyaberezun
requested review from
Olga Lavrichenko (OLavrik),
Rustam Sadykov (SBOne-Kenobi) and
Rinat S (rsolmano)
as code owners
October 26, 2026 03:52
Open
5 tasks done
danyaberezun
force-pushed
the
global-search-chats
branch
from
October 26, 2026 19:50
687b8df to
cdddba7
Compare
5 tasks done
![jetbrains-air[bot]](https://avatars.githubusercontent.com/in/3314082?s=60&v=4){kind=small}
5 tasks done
danyaberezun
force-pushed
the
global-search-chats
branch
from
October 28, 2026 03:25
cdddba7 to
3098809
Compare
A kind:"chats" container rooted at <dataDir>/chats and one kind:"chat" workspace per chat, stored apart in chats.json (partitioned on save, merged on load, set aside when corrupt) so an older host never sees them. New wire methods chat.create (folder + record + the one session), chat.delete (the only teardown door: transcripts and the folder go to the trash, the record is marked pending first) and chat.inspect; every repository door refuses a chat or the container; git never runs in a chat folder, backed by GIT_CEILING_DIRECTORIES; sockets below CHATS_PROTOCOL_VERSION never hear about chats; session state records carry pi's session title.
…Create dialog A Chats section tops the Projects panel (one row per chat with its title, status and a Delete that names the folder's file count); the topbar reads Chats › <title> for a chat with no branch or ship strip; the Create dialog gains a "Chat without a project" target (the only one when no repository is open) and the Welcome a card for it; git- and spec-backed tool bodies say "Not available in a chat without a project" while Files, terminal and Plan keep working; repository listings and fallbacks go through selectRepoProjects, and a second New chat in a chat starts another chat.
Architecture Decision 6 gains the third kind-marked exception; goal capabilities, the workspaces, persistence, host, agent, trash, contracts, server-graph, panels, shell, location-bar, store and e2e specs describe the container, the chats store, the refusal doors, the ceiling, the scoped pushes, the titles on state records and the UI surfaces.
…nd load the Chats list on a first chat Address the review: the plan read skips the unattributed-change and adopted-commit git reads for a chat and the Plan page hides its branch line, commits menu and Open PR; the setup funnel's project_present ignores the Chats container; a first chat loads the container's list instead of seeding it; the chats store latch has a test seam.
… in Chats, the topbar and its empty center
…s the Chats container The host ensures the Chats container at boot, but the onboarding selectors counted every project, so a fresh install with no repository and no provider never showed the setup wizard. Both selectors now count repository projects only, the shown branch included, and the done step's cards now include Chat without a project next to Open project.
… doors out of chats The topbar's Delete chat confirmed whatever chat was active by then; one ChatDeleteDialog, shared with the Chats row, now holds the chat it was opened for, names its file count, and closes when that chat is removed, starts deleting elsewhere or stops being the active one. Settle and the automatic Settled shelf, per-session Trash in Recently closed and prompt history, Manage skills in the chat target and file commenting are no longer offered for a chat. A pending deletion is opened by no navigating surface; the topbar's Chats loads the container's list before it starts a chat; a reconnect replaces the container's membership; host hits name a chat and the container by their labels; a start in flight is joined, and a first chat ends the first-run wizard; the Create dialog takes its defaults once per opening.
A delete during a chat's first session left a live session in a trashed folder, two concurrent recoveries started two top-level sessions, and a deletion-pending chat still attached sessions and spawned terminals after a restart. One per-chat claim now serializes create, first session, recovery and delete: a recovery joins a start in flight (same session, real model and effort), and a delete takes the claim over. The deletion runs its Trash moves inside the agent's own preparation barrier, exported from the agent barrel as closeWorkspaceSessions (archive's removeWorkspaceSessions now composes it), so sessions are listed only once nothing can still start or write one; the folder is trashed only when it lies under the chats root. Every session/terminal start or attach door refuses a chat being deleted or whose deletion is pending, and initial-terminal provisioning skips it. The refusals get their own codes - CHAT_HAS_SESSION, CHAT_DELETING, CHAT_DELETION_PENDING - so a client never mistakes "being deleted" for "start a sibling chat". The misnamed recovery test now recovers.
Deleting a chat without a project left delegation/<workspaceId>/ and the workspace's delegation service behind. The agent now owns a recoverable twin of archive's removeWorkspaceDelegation: trashWorkspaceDelegation moves the store to the Trash (never rmSync) and only then releases the service. The chat deletion calls it inside the agent's barrier, after the child cascades settled and the transcripts went to the Trash, so a failed move leaves both for Retry.
…ecovery chat.create never recorded an explicit model as recent, its chat_started reported the session's model even when the host found none to resolve, and a chat's recovery through session.create dropped the requested model and effort. Both creation paths now share one bookkeeping (noteNewChat: an explicit pick becomes recent, analytics hear the model the chat got or none), and the recovery passes the request through.
… pushes A client below CHATS_PROTOCOL_VERSION still got chat workspace ids, the container and chat transcripts from search.query, search.preview and history.search, could list the container's or a chat's rows directly, heard pi.extensionUi for chat sessions, and heard a detached session's disk-only rename because its pi.event carried only a session id. One visibility policy, seesChats(protocolVersion), now lives in host/chats.ts and drives all of it: the search service takes the client's audience and drops the container (and so its chats' records, root, files, plans, titles, transcripts and previews) before any provider ranks or pages; history.search hides chat cwds from every scope through a hidden-cwd predicate; workspace.list of the container answers [] and session.list of a chat answers as unknown; extension UI for a chat session reaches only sockets that see chats and fall within the request's own audience. The agent now hands every pi.event publication its workspace beside the payload, so publishScoped scopes a detached session's rename like a live one's. Tests cover a v96 and a v97 client over the handlers, the search service, the history scope and real sockets.
project.cloneDestination and project.clone accepted the Chats root (the clone downloaded, then openProject refused and stranded the checkout), project.inspect offered init for a folder init refuses, and the containment check was lexical, so /tmp versus /private/tmp, a symlink or a folder that does not exist yet slipped past it. One policy now guards inspect, open, init, create, the clone destination (and so clone, before it reserves a folder or Git downloads anything) and the existing-worktree admission: the projects barrel's assertOutsideChatsRoot, over persistence's landsInChatsRoot - the lexical check plus canonical containment through the nearest existing ancestors of the path and of the root. It throws CHATS_CONTAINER before any filesystem or Git side effect; a worktree registered under the root is no longer offered either. Recorded paths keep their resolved spelling.
A chat without a project is files, terminal and Plan - never git, review or specs - but several reused paths still treated it as a repository: the search file cache reloaded a stale chat root through git, fs.readDir ran git check-ignore for every listing, the /blob route ran git for a chat id, request_review and its guideline were offered to chat sessions whenever Agent review was on, the plan's review doors could reach a git-backed review snapshot, and host search returned chat records as workspace hits named "Chat" and answered specs for a chat root. The file-list cache now keeps each root's git mode through every TTL or invalidation reload; fs.readDir skips the git-ignore decoration for a chat; /blob answers 404 for a chat before any git; the host's Agent review resolver answers false for a chat, so its sessions get neither the tool nor its guidance; todo.review/startReview/reviewAll/requestFix join the repository-only doors; search leaves chat records out of workspace hits and answers an empty spec group for a chat root while its files, transcripts and plans stay searchable.
… store untouched The chats store accepted structurally invalid JSON (a container without an id later threw inside slugify), yet treated any non-ENOENT read error - a transient EBUSY or EPERM - as corruption, renamed the file aside and latched chat writes off; a newer host's store would have been set aside the same way. chats.json is now schema-validated: only a file that is not JSON, or is not a valid version-1 store and names no newer version, is set aside. A store with a newer integer version is left untouched, loads empty and refuses writes; any other read failure renames nothing, is not remembered and is read again on the next load. chatsStoreProblem names which, and workspaces words CHATS_STORE_UNAVAILABLE after it. The parsed store is cached while the file keeps the inode, size and mtime it was read or written at, every load hands out a copy, and a partitioning save builds only on that cached store, so a save after a failed load cannot overwrite the chats the load missed.
…e budgets chat.inspect walked the folder synchronously and capped only files, so a directory-heavy scratch tree could stall the in-process host, and it counted ThinkRail's own .thinkrail/context/.gitignore (an empty chat said "1 file"). The inspection is now an asynchronous opendir walk that yields to the event loop, bounded by CHAT_INSPECT_BUDGET - entries visited, folders included, and wall time - and answers truncated when either runs out. Symlinks are counted, never followed, and the scratch-dir scaffolding is not counted.
…chat that already has one A second conversation in a chat is now refused with CHAT_HAS_SESSION, so that code alone turns New chat into a sibling chat; a chat being deleted or with its deletion pending is reported, never answered with a new chat. The Plan page offers no review in a chat and the palette no Specs scope, matching what the host now refuses and answers there.
…fresh install has it resetState deleted chats.json under a running host, so every e2e cold start lacked the container that production always has at boot, and the onboarding regression it caused stayed invisible. The reset now drops the chats and their folders but keeps the container record and an empty chats root.
…still starting The extension-UI publisher found a session's workspace only among registered sessions, so a notice an extension or MCP startup sent during session_start, before registration, was broadcast to clients that do not see chats. The agent now attributes a preparing session too (getSessionAttribution), and the publisher scopes by it.
The walk checked its deadline only per entry, so a tree of many empty folders ran past the budget and still answered truncated: false.
…nfirmation A double click on Welcome's Chat without a project sends one chat.create, and a topbar Delete confirmation opened for a chat closes when another window deletes that chat, so it can never delete the chat the window falls back to.
…nding chats out of the palette The reconnect refresh replaced the Chats container's list but left an active or open chat that another window had deleted mounted with no row behind it; each chat gone from the list now goes through applyWorkspaceRemoved first, as the missed workspace.removed push would have. The palette's work items skip a chat whose deletion is pending, like every other navigating surface.
danyaberezun
force-pushed
the
global-search-chats
branch
from
October 28, 2026 16:52
3098809 to
52a50c3
Compare
Collaborator
Author
|
@jetbrains-air please review — rebased with the stack onto main |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Every chat in ThinkRail belongs to a workspace, and every workspace to a git repository. There is no place for the question that has no repo yet — "compare these two caching strategies", "draft the launch checklist" — except to open some project and pollute a worktree with it. The 2026 agent apps all have this surface (Codex
⌥Spaceand⌘⌥O, Claude Quick Entry, T3's projectless threads); the global-search interview (#804's research) put it on the roadmap as the palette's one missing start target, and the user kept it in the plan after the redesign.Fourth PR of the global-search stack; stacked on #806. Design and review history:
TASK-projectless-chat.md(three design-review rounds, "Ready to implement").Rebased on
main(Oct 26, then twice on Oct 28) with the stack.CHATS_PROTOCOL_VERSIONis now v97 (mainholds v95 for #975's repository cloning; search is v96). The Oct 26 commitfix(web): label an unnamed chat without a project by its first prompt in Chats, the topbar and its empty centerbrings #911's first-prompt label to this PR's surfaces.main's #975 clone and #808 first-run wizard meet this PR: the Chats root is refused by clone too, and the container no longer hides the wizard (below).Review (Oct 28). Two design reviews and three code-review rounds (GPT-6 Astra / GPT-6.1 Sol, Claude Fable 5.1) confirmed all 11 open review-bot threads and found more; the fixes:
closeWorkspaceSessions, which archive's teardown now uses too) before it lists anything, so a delete during the first session's start or two concurrent recoveries can no longer leave an orphan session or a second conversation. A chat being deleted or with its deletion pending is refused at every resource door (CHAT_DELETING,CHAT_DELETION_PENDING); a second session isCHAT_HAS_SESSION, the one code New chat turns into a sibling chat. An Agent child's transcripts go to the Trash with the chat./blobrefuses a chat, Agent review and its tool never reach a chat's session, plan review is refused, and search returns no chat workspace hits and no specs for a chat root; the web hides Settle and the automatic Settled shelf, per-session Trash, Manage skills, file commenting, plan review and the palette's Specs scope there.chats.jsonunder the running host, which hid this; it now keeps the boot-created container, so e2e cold starts are a user's.replaceProjectMembership), so a chat deleted while away leaves; the topbar's Chats loads the list before it starts a chat; the Create dialog keeps its draft when another window opens or reorders projects; a double click starts one chat; no surface opens a chat pending deletion; host hits and the topbar name chats and the container by their labels.chats.jsonis schema-checked — an invalid v1 file is set aside, a newer version or an unreadable file is left untouched and writes are refused, and the parsed store is cached by file identity;chat.inspectwalks asynchronously within entry and time budgets.Approach
kindis the marker. A built-in Chats project (Project.kind: "chats", root~/.thinkrail/chats, permanently untrusted, never closed) holds onekind: "chat"workspace per chat, each its own folder<yyyy-mm-dd>-<short id>(no words from the prompt — architecture Decision 8 stands). Records keep the required wire fields with inert values (branch: "",baseBranch: ""), so the ≈80branch/baseBranchreads and every workspace-keyed module (fs, terminal, watch, plan, search) work unchanged; routes, store keying and navigation restore are unchanged. Rejected: a separate entity, an optionalprojectId.chats.json(PersistedChatsv1, atomic) is merged on load and partitioned on save by kind for both legacy files, so an older host — the CLI is the supported rollback artifact — never sees a chat and its reclaim path can neverrm -rfa chat folder. An invalid file is set aside (.corrupt-<epoch>); a newer version or an unreadable file is left untouched, and chat writes are refused meanwhile.REPOSITORY_ONLY_METHODS(git, changes, reviews, PRs, turns, diff stats/base) refuse a chat at the handler; project close/rename/trust/skills,workspace.create/listExisting,git.listBranches/prefetchrefuse the container; the settled lifecycle, turn snapshots, plan artifacts, head recording, diff stats and the external refresh skip chats;project.open/initrefuse paths under the chats root; search walks a chat folder instead ofgit ls-files. Plus a boot-timeGIT_CEILING_DIRECTORIES=<dataDir>/chatsso git,gh, PTYs and pi's bash inherit a ceiling that stops any walk up out of a chat folder into a repository that happens to enclose the data dir (~/.thinkrailinside a checkout). A unit test records everyBun.spawn/spawnSyncacross create / list / doors / delete and asserts no git under the chats root, and runs realgit rev-parsefrom a chat folder nested inside a real repo expecting failure.chat.createmakes folder, record, initial terminal and the one session the chat owns in one call (host default model or the dialog's pick);session.createon a chat that already has one is refused (CHAT_HAS_SESSION) — a second conversation is a new chat — and otherwise heals a chat whose session never started (joining a start still in flight).chat.deleteis the single teardown: claim → markdeletionPending(persisted before anything destructive, survives restart with Retry) → every session through the agent's trash-based transaction (transcripts file by file, never the encoded directory) → terminals, watcher, sidecars → trash the folder → drop the record → publish removal;session.deleteon a chat is refused.chat.inspectgives the confirmation its bounded file count. The host never sweeps unknown folders under the chats root.CHATS_PROTOCOL_VERSION(v97) get a welcome,project.listandsession.stateListwithout the container, its chats and their records, and every id-carrying push goes through onepublishScopedsender (per-socket for a chat/container id, broadcast otherwise). The chat-id check is answered from memory (only this process writes the store), sopi.eventpays no file read.SessionStateRecord.titleexposes pi's session name (never copied); the publication fingerprint includes it and the disk-only rename path republishes — the Chats rows, the topbar and the palette read titles from state records.Chats › <title>with no branch or ship strip; the Create dialog gains a Chat without a project target — the only one when no repository is open — and the Welcome a card for it; the palette offers "New chat without a project" and its start row works with no repository; git- and spec-backed tool bodies say "Not available in a chat without a project" while Files, terminal and Plan work; New chat inside a chat starts a sibling chat. Repository listings and fallbacks readselectRepoProjects, so the container is never offered as a project. The Chats section and start surfaces gate on protocol support alone; the host ensures the container at boot, and it never counts as a project — not for the first-run wizard either.Deferred (named in the task-spec): per-step crash-point tests of the delete transaction (covered end to end with a trash seam); pi-subagents' cosmetic "Git branch:" line under the ceiling; Continue in workspace (PR5, with the
continuedTomarker).Changes
packages/contracts:PROTOCOL_VERSION = 97=CHATS_PROTOCOL_VERSION;Project.kind?: "chats",Workspace.kindgains"chat",Workspace.deletionPending,SessionStateRecord.title;chat.create/chat.delete/chat.inspect(ChatCreateResult,ChatInspection); error codesCHATS_CONTAINER,CHAT_WORKSPACE,NOT_A_CHAT,CHATS_STORE_UNAVAILABLE, and from the reviewCHAT_HAS_SESSION,CHAT_DELETING,CHAT_DELETION_PENDING.packages/server:persistence(chats.json, partition on save, set-aside,chatsRoot),workspaces/chats.ts(container, records, id cache, refusal helpers) + gates inworkspaces.ts,host/chats.ts(create/ensure/inspect/delete),host/gitCeiling.ts, handlers (doors, filtering,REPOSITORY_ONLY_METHODS),server.ts(publishScoped, boot container, welcome filtering),settledLifecycle/turns/todos/search/analytics gates,agentSessionManagertitles,spec.specSnapshotunchanged API. Tests:persistence/chats.test.ts,host/chats.test.ts(+ boot/channel/search test updates).apps/web:storeselectors (selectRepoProjects,selectChatsContainer,selectChatWorkspaces,selectChatWorkspaceTitle,selectContextRepoProject,isChatWorkspace,supportsProjectlessChats),panels/chatActions.ts,panels/ChatsSection.tsx,NewWorkspaceDialogchat target (projectId: string | null),WelcomePanelcard,openChatsibling fallback,FilesPanel/useGitStatusno git for chats,shell/locationBar/ChatSegment.tsx,ProjectSegmentChats entry,WorkspaceWorkbenchunavailable bodies,Shelldialog context, palette command + start row; 23 locale keys.host/chats.ts(per-chat claim, deletion inside the agent barrier, resource-door refusals, async budgeted inspect),agent(closeWorkspaceSessions,trashWorkspaceDelegation,getSessionAttribution), visibility insearch/historyScope/ handlers /server.ts,persistence(landsInChatsRoot, validated and cachedchats.json),projects/clone/workspaces(assertOutsideChatsRoot),search/files.tsgit mode,fileRoutes; webChatDeleteDialog, onboarding selectors,replaceProjectMembership, kind-aware Settle / Trash / skills / commenting / plan review / Specs scope, dialog defaults per opening, joined start, pending filters, labels. Tests:host/chatsWire.test.ts(real v96/v97 sockets), lifecycle races and restart inhost/chats.test.ts, persistence/search/projects cases, web store/selector/search cases.chats.spec.ts(Welcome → chat with its own folder, no git tools, Files works; a double click starts one chat and a Delete confirmation closes when another window deletes its chat; palette → dialog chat target → first prompt → delete to Trash),welcome.spec.tsandonboarding.spec.tsexpectations,resetStatedrops every chat but keeps the boot-created container.687b8df78): the plan read skips the unattributed-change / adopted-commit git reads for a chat and the Plan page hides its branch line, commits menu and Open PR; the setup funnel'sproject_presentignores the container; a first chat loads the container's list instead of seeding it; the chats-store latch has a test seam.contracts, server graph,workspaces,persistence,host,agent,trash, webpanels,shell,locationBar,store,e2e; README bullet.Screenshots
1280×800. Before = the stack's head (#806) with no project open; After = the same screen with the Chats section and the chat card, then the chat itself.
Chats › Chat, its own folder in the terminal, Specs and Review not availableTesting
All on the final head (
52a50c332) unless noted:bun run lint,check:deps,check:boundaries,check:seams,check:i18n,check:spec-surface,check:compiler→ green;bunx turbo run typecheck --filter='!@thinkrail/desktop'→ 24/24cd packages/server && bun test→ 2063 pass, 4 skip, 0 fail;cd packages/contracts && bun test→ 114 pass;apps/webbun test→ 2055 passsession_startnotice, reserved-root aliases, git-free reloads andfs.readDir, store version/shape/I-O handling, inspect budgets, onboarding with the container, settle, pending palette items, reconnect membership)bun run e2e e2e/chats.spec.ts --repeat-each=3→ 9 passed;e2e/chats.spec.ts e2e/onboarding.spec.ts --repeat-each=2→ 40 passedbun run e2e(full no-agent suite, 8 shards) → all passed (a first run loste2e/extension-dialogs.spec.ts:178once — a viewport timing check this PR does not touch — which then passed 25/25 under--repeat-each=5)Related issues
Part of the global-search stack (#804 → #805 → #806 → this). Refs #765 (chat titles now ride the state record).
Checklist
bun run lint,bun run typecheck,bun run testbun run e2e, orbun run e2e:fullwhen touching agent behavior)SPEC.md/ top-level specs updated to reflect any boundary, contract, or behavior change