Release ShadowCode 0.22.0 with hardened native workflows

Refine model controls, response forks, parallel workspaces and Guardian diagnostics. Harden sandbox ownership, source indexing, pause/rewind and engine reconnection; expand regression and packaged application coverage and refresh release documentation.

Author: ShadowfetchStudio

.github/workflows/native.yml

@@ -77,46 +77,46 @@ jobs:
       - name: Build native development packages with dependency notices
         run: node scripts/build-native.mjs
       - name: Inspect both packages
-        run: node scripts/check-native-package.mjs target/release/bundle/appimage/ShadowCode_0.21.0_amd64.AppImage target/release/bundle/deb/ShadowCode_0.21.0_amd64.deb
+        run: node scripts/check-native-package.mjs target/release/bundle/appimage/ShadowCode_0.22.0_amd64.AppImage target/release/bundle/deb/ShadowCode_0.22.0_amd64.deb
       - name: Rebuild the shipped runtime sources without network access
         run: node scripts/test-native-runtime-sources.mjs
       - name: Exercise concurrent AppImage extraction and shutdown
         run: node scripts/test-native-runtime.mjs
       - name: Exercise the packaged CLI without a display
         env:
-          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_0.21.0_amd64.AppImage
+          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_0.22.0_amd64.AppImage
           SHADOW_CLI_ARGS: '["--appimage-extract-and-run"]'
           SHADOW_CLI_ARTIFACTS: artifacts/native-package/cli
         run: node scripts/test-native-cli.mjs
       - name: Exercise the packaged native terminal
         env:
-          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_0.21.0_amd64.AppImage
+          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_0.22.0_amd64.AppImage
           SHADOW_CLI_ARGS: '["--appimage-extract-and-run"]'
           SHADOW_TUI_ARTIFACTS: artifacts/native-package/tui
         run: node scripts/test-native-tui.mjs
       - name: Exercise the packaged native window
         env:
-          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_0.21.0_amd64.AppImage
+          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_0.22.0_amd64.AppImage
           SHADOW_DESKTOP_ARGS: '["--appimage-extract-and-run","ui"]'
           SHADOW_NATIVE_DEFAULT_PROFILE: '1'
           SHADOW_NATIVE_ARTIFACTS: artifacts/native-package/window
         run: xvfb-run -a -s '-screen 0 1440x1100x24' dbus-run-session -- node scripts/test-native-desktop.mjs
       - name: Exercise the packaged native MCP server
         env:
-          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_0.21.0_amd64.AppImage
+          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_0.22.0_amd64.AppImage
           SHADOW_CLI_ARGS: '["--appimage-extract-and-run"]'
           SHADOW_MCP_ARTIFACTS: artifacts/native-package/mcp-server
         run: node scripts/test-native-mcp-server.mjs
       - name: Exercise the packaged native MCP HTTP server
         env:
-          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_0.21.0_amd64.AppImage
+          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_0.22.0_amd64.AppImage
           SHADOW_CLI_ARGS: '["--appimage-extract-and-run"]'
           SHADOW_MCP_ARTIFACTS: artifacts/native-package/mcp-server-http
           SHADOW_MCP_TRANSPORT: http
         run: node scripts/test-native-mcp-server.mjs
       - name: Verify packaged MCP interoperability with official TypeScript clients
         env:
-          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_0.21.0_amd64.AppImage
+          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_0.22.0_amd64.AppImage
           SHADOW_CLI_ARGS: '["--appimage-extract-and-run"]'
           SHADOW_MCP_PEER_ARTIFACTS: artifacts/native-package/mcp-peer
         run: node scripts/test-native-mcp-peer.mjs

.github/workflows/release.yml

@@ -64,9 +64,7 @@ jobs:
           npm --prefix scripts/native-mcp-peer ci --ignore-scripts --no-audit --no-fund
           SHADOW_DESKTOP_BINARY="$BINARY" SHADOW_CLI_ARGS='["--appimage-extract-and-run"]' node scripts/test-native-mcp-peer.mjs
       - name: Create release checksums
-        run: |
-          cd target/release/bundle
-          sha256sum appimage/*.AppImage appimage/*runtime-sources.tar.gz deb/*.deb > SHA256SUMS
+        run: cp artifacts/native-package/SHA256SUMS target/release/bundle/SHA256SUMS
       - name: Verify installer replacement and checksum refusal
         run: bash scripts/test-install-appimage.sh
       - name: Publish checked native artifacts

.gitignore

@@ -7,7 +7,7 @@ build/
 .pytest_cache/
 .mypy_cache/
 .ruff_cache/
-.venv/
+.venv
 venv/
 ui/node_modules/
 scripts/native-mcp-peer/node_modules/
@@ -32,5 +32,5 @@ artifacts/
 ui/test-results/
 ui/playwright-report/
 src/shadow_agent/_assets/
-/target/
+/target
 /src-tauri/gen/

CHANGELOG.md

@@ -1,24 +1,32 @@
 # Changelog
 
-## Unreleased (flagship complete)
-
-- **Code intelligence:** On-demand SQLite AST symbol index for Rust/TypeScript
-  (ordinary tables). Tools: `find_references`, `goto_definition`,
-  `get_diagnostics`, `get_type_signature`. Patch prep includes bounded callers.
-- **Sandbox:** Ephemeral scratch upper (`SHADOWCODE_SCRATCH`) with discard path;
-  real home stays read-only; CoW probe is honest (not kernel-proof).
-- **Parallel worktrees:** Cap 2 workers + lead; verifier reports unclean merges;
-  disabled outside git.
-- **Inference:** Ollama `keep_alive` retained; no fake prefix-cache 3× claim
-  (see `docs/NATIVE_INFERENCE.md`).
-- **Verification:** Bug/fix prompts still ask for a failing case first; narrow
-  test commands when verification is requested; model prose never verifies.
-- **Session fork:** `POST /api/sessions/{id}/fork` from an event id; original
-  intact.
-- **Guardian:** Optional scheduled read-only health check (default OFF); patch
-  prepare only after approval; never silent auto-PR.
-- **UI:** Advanced settings group for guardian/parallel/sandbox; vitest uses
-  happy-dom (jsdom ESM break on Node 22.11).
+## 0.22.0
+
+- Native desktop controls for context windows, Ollama residency, response forks,
+  parallel workspace preparation and combined integration checks.
+- Durable, workspace-scoped parallel plans; cleanup refuses dirty or active
+  checkouts and retains worker branches. Git filters and custom merge drivers
+  cannot execute through these operations.
+- Event forks retain completed tool context, exclude later turns and reject
+  events belonging to other sessions. Original deletion preserves fork context.
+- Rewind waits for a confirmed pause boundary and reserves idle workspaces;
+  in-flight commands and other tasks cannot race checkpoint restoration.
+  Task pause/resume controls are distinct from goal scheduling controls.
+- Attached windows close promptly during owner reconnection and retain live
+  event notifications across engine replacements and subsequent disconnects.
+- Private AST cache with path confinement, content hashes, Unicode-safe
+  signatures, deletion refresh, exact-name priority and syntactic call sites.
+- Managed temporary scratch cleanup, corrected project mount order, operational
+  bubblewrap probing and no automatic shell replay after an execution failure.
+- Guardian state and proposal approvals scoped to profile/workspace. Diagnostics
+  and draft proposals now accurately describe their limited behavior.
+- Validated Ollama residency, numeric unload/indefinite wire values and saved
+  routing preferences. Removed unused prompt hash computation.
+- Fixed Ctrl+N after session activation and shortcut modifier overlap; improved
+  model badge contrast in light, dark and dimmed dialog layouts.
+- Split Markdown rendering into a separate UI bundle. Updated Happy DOM to a
+  patched release and declared the supported Node minimum.
+- Updated native build, packaging version, regression coverage and feature docs.
 
 ## 0.21.0
 

Cargo.lock

@@ -4,7 +4,7 @@ default-members = ["native/core"]
 resolver = "2"
 
 [workspace.package]
-version = "0.21.0"
+version = "0.22.0"
 edition = "2021"
 rust-version = "1.95"
 license = "MIT"

Cargo.toml

@@ -1,6 +1,6 @@
 # ShadowCode
 
-![version](https://img.shields.io/badge/version-0.21.0-386c51) ![Rust](https://img.shields.io/badge/runtime-Rust%201.95-orange) ![license](https://img.shields.io/badge/license-MIT-green)
+![version](https://img.shields.io/badge/version-0.22.0-386c51) ![Rust](https://img.shields.io/badge/runtime-Rust%201.95-orange) ![license](https://img.shields.io/badge/license-MIT-green)
 
 **Your ideas. Your models. Your machine.**
 
@@ -10,7 +10,7 @@ context, tools, permissions, checkpoints, plans, and verification.
 
 ![ShadowCode workspace](docs/images/workspace-light.png)
 
-**Native 0.21 release:** the `main` branch builds a Rust/Tauri desktop window
+**Native 0.22 release:** the `main` branch builds a Rust/Tauri desktop window
 with the interface embedded in the executable. It needs no Python runtime or
 browser launcher. See the [native desktop guide](docs/NATIVE_DESKTOP.md)
 and the [goals](docs/NATIVE_GOALS.md) and [model routing](docs/NATIVE_ROUTING.md)
@@ -35,33 +35,33 @@ Integrations and release checks are tracked under the [release gates](docs/NATIV
 
 ## Native AppImage
 
-Download the `v0.21.0` **x86_64 AppImage**
-and its `SHA256SUMS` file from [GitHub releases](https://github.com/ShadowfetchLinux/ShadowCode/releases/latest).
+Download the `v0.22.0` **x86_64 AppImage**
+and its `SHA256SUMS` file from [GitHub releases](https://github.com/Shadowfetchapps/ShadowCode/releases/latest).
 The native application embeds its interface; Python, Node.js and a browser
 launcher are not runtime dependencies. The release targets **Ubuntu 24.04 or
 newer / glibc 2.39+**. Git and a model provider such as Ollama remain external.
 
 ```bash
-sha256sum -c SHA256SUMS
-chmod +x ShadowCode_0.21.0_amd64.AppImage
-./ShadowCode_0.21.0_amd64.AppImage --appimage-extract-and-run
+sha256sum --ignore-missing -c SHA256SUMS
+chmod +x ShadowCode_0.22.0_amd64.AppImage
+./ShadowCode_0.22.0_amd64.AppImage --appimage-extract-and-run
 ```
 
 Extraction mode works without FUSE. To install into `~/Applications`, add a
 stable `shadow` command, and replace the desktop launcher:
 
 ```bash
-git clone https://github.com/ShadowfetchLinux/ShadowCode.git
+git clone https://github.com/Shadowfetchapps/ShadowCode.git
 cd ShadowCode
-./scripts/install-appimage.sh /path/to/ShadowCode_0.21.0_amd64.AppImage
+./scripts/install-appimage.sh /path/to/ShadowCode_0.22.0_amd64.AppImage
 ```
 
 Keep `SHA256SUMS` beside the download and the installer verifies its matching
 entry automatically. It replaces older ShadowCode AppImages only after the new
 executable starts, preserves settings, keys, memory and task history, and refuses
 a changed download before it can alter the installed application.
 
-## Native 0.21 highlights
+## Native 0.22 highlights
 
 - **A focused workspace.** Persistent projects and tasks, search, pinned tasks,
   a refined light/dark interface, and responsive layouts. Files, review, terminal,
@@ -87,16 +87,17 @@ a changed download before it can alter the installed application.
   outputs from the machine running ShadowCode, never screen contents, and marks
   incomplete detection as unknown instead of guessing zero.
 
-See [CHANGELOG.md](CHANGELOG.md) for the release history and
+See the [0.22 qualification report](docs/SHADOWCODE_022_QUALIFICATION_REPORT.md),
+[CHANGELOG.md](CHANGELOG.md) for the release history, and
 [the user guide](docs/USER_GUIDE.md) for workflows and recovery.
 
 ## Native development build
 
-Requires Rust 1.95, Node 22+, and the packages listed in the [native desktop
+Requires Rust 1.95, Node 22.12+ or 24+, and the packages listed in the [native desktop
 guide](docs/NATIVE_DESKTOP.md#build-and-run).
 
 ```bash
-git clone https://github.com/ShadowfetchLinux/ShadowCode.git
+git clone https://github.com/Shadowfetchapps/ShadowCode.git
 cd ShadowCode
 npm --prefix ui ci
 npm --prefix ui run build
@@ -108,39 +109,27 @@ cargo build -p shadowcode-desktop --locked
 the [native migration guide](docs/NATIVE_MIGRATION.md) for validation and release
 requirements.
 
-## Open-Weight Model Flagship Pillar
-
-ShadowCode is purpose-built to serve as the definitive harness for open-source, open-weight models:
-
-- **Open-Weight Coding Champions:** First-class showcase and prompt tuning for **Qwen 2.5 Coder** (7B, 14B, 32B), **DeepSeek R1 & V3** (14B, 32B, 671B), **Llama 3.3** (70B), **Mistral Devstral** (22B), **GPT-OSS** (20B), and **Gemma 4** (12B).
-- **Hardware & VRAM Compatibility Advisor:** Automatically checks your GPU and VRAM (e.g. NVIDIA RTX 16GB) to suggest optimal model quantization and parameters (7B ~5GB, 14B ~10GB, 32B ~20GB, 70B ~40GB).
-- **Local Privacy & Zero Telemetry:** Connects seamlessly to local inference runtimes:
-  - **Ollama** (`http://127.0.0.1:11434`)
-  - **LM Studio** (`http://127.0.0.1:1234`)
-  - **vLLM** (`http://127.0.0.1:8000`)
-  - **llama.cpp** (`http://127.0.0.1:8080`)
-- **Reasoning Channel Visualizer:** Transparent chain-of-thought streaming for reasoning models like DeepSeek R1 with live timers and collapsible thought traces.
-
-## 20-Minute Fast-Track Mastery (Codex & Cursor Workflow)
-
-Anyone with basic coding intent can master the autonomous agent loop in under 20 minutes:
-
-1. **Pick Model & Workspace:** Connect your local Ollama / open-weight server in one click or select from the Open-Weights Showcase.
-2. **Select Agent Mode:**
-   - 🔨 **Build (Coder):** Autonomous file modification, command execution, and test repair.
-   - 🧭 **Plan (Architect):** Non-destructive milestone blueprints and roadmaps before editing code.
-   - 🛡️ **Review (Auditor):** Strict security audits, vulnerability scanning, and bug discovery.
-   - 🧪 **Test (QA):** Unit test authoring and behavioral regression checks.
-3. **The Codex / Cursor Iterative Loop:**
-   - Prompt with clear intent and file attachments.
-   - Watch live tool execution and file inspection cards.
-   - Inspect color-coded diff hunks in the Changes drawer (`Ctrl+B`).
-   - Accept or reject edits per-hunk, per-file, or rewind previous tasks with one click.
-4. **Live Steering & Queueing:**
-   - Click **Pause** to give live redirection advice, then **Resume** to inject context.
-   - Queue follow-ups while an active task is executing without waiting.
-5. **Interactive Flow Guide:**
-   - Launch the visual **20-Min Flow Guide** anytime from the top bar or welcome screen.
+## Local models and a focused workflow
+
+Connect Ollama, LM Studio, llama.cpp, vLLM, or a compatible hosted endpoint.
+Tool use and answer quality depend on the selected model. ShadowCode provides
+workspace tools, explicit approvals, saved history, and verification evidence.
+A model is useful for coding only when it reliably calls those tools.
+
+Settings → Model exposes the context window and Ollama model residency. Start
+with 16,384 tokens on a local model and increase it only within the model's
+supported window and your available memory. Model weights and inference engines
+remain external; see [inference settings](docs/NATIVE_INFERENCE.md).
+
+During a task, pause and steer the next model turn, or queue a follow-up.
+**Fork from here** creates a separate conversation at a response while retaining
+available completed tool context. See [history](docs/NATIVE_HISTORY.md).
+
+Settings → Advanced prepares up to two workspaces, opens them for explicit
+tasks, checks their combined merge result, and removes clean checkouts while
+retaining branches. It does not launch workers automatically. Optional Guardian
+diagnostics are off by default. See [parallel workspaces](docs/NATIVE_PARALLEL.md)
+and [Guardian](docs/NATIVE_GUARDIAN.md).
 
 ## Workflows
 

README.md

@@ -13,7 +13,8 @@ model:
   endpoint: ""
   api_key_env: OPENAI_API_KEY
   name: mock-coder
-  context_limit: 128000
+  context_limit: 16384
+  keep_alive: "30m"  # Ollama only: duration, "0" to unload, "-1" indefinite
 
 permissions:
   level: workspace          # read_only | workspace | elevated

config.example.yaml

@@ -1,4 +1,4 @@
-# Native desktop — 0.21
+# Native desktop — 0.22
 
 The `main` branch builds one Rust desktop executable with the React
 interface embedded. Tauri hosts it in the system WebKit webview. The interface
@@ -53,7 +53,7 @@ sudo apt-get install build-essential pkg-config libgtk-3-dev \
   libwebkit2gtk-4.1-dev librsvg2-dev libayatana-appindicator3-dev patchelf
 ```
 
-Use Rust 1.95 and Node 22 or newer for development. From the repository root:
+Use Rust 1.95 and Node 22.12+ or 24+ for development. From the repository root:
 
 ```sh
 npm --prefix ui ci
@@ -140,8 +140,8 @@ From the repository root, build both package formats with:
 ```sh
 node scripts/build-native.mjs
 node scripts/check-native-package.mjs \
-  target/release/bundle/appimage/ShadowCode_0.21.0_amd64.AppImage \
-  target/release/bundle/deb/ShadowCode_0.21.0_amd64.deb
+  target/release/bundle/appimage/ShadowCode_0.22.0_amd64.AppImage \
+  target/release/bundle/deb/ShadowCode_0.22.0_amd64.deb
 node scripts/test-native-runtime.mjs
 node --test scripts/test-native-source-fetch.mjs
 node scripts/test-native-runtime-sources.mjs

docs/NATIVE_DESKTOP.md

@@ -1,9 +1,17 @@
-# Guardian (optional, approval-gated)
+# Guardian diagnostics
 
-`shadowcode serve` may run a scheduled **read-only** health check when enabled
-in Settings → Advanced. **Default OFF.**
+Guardian is off by default. Enable it and save an interval of 60–86,400 seconds
+in Settings → Advanced. Run diagnostics manually there; scheduled checks run
+while `shadowcode serve` is running. The desktop alone does not start a scheduler.
 
-- Checks Doctor/sandbox probes and test hints without writing the main tree.
-- May open a worktree and prepare a patch **only after explicit approval**.
-- Never pushes, opens a PR, or notify-and-merges while idle.
-- Desktop notification via `notify-send` when available; otherwise logs.
+Checks inspect local isolation support and identify a suggested test command.
+They do not run tests, edit code, push, open a PR or merge. Last-run results and
+pending proposals are scoped to the current engine profile and workspace.
+Results are visible in Advanced; desktop notifications are not implemented.
+
+The optional proposal API requires both `enabled` and `allow_prepare_patch`.
+`POST /api/guardian/request-patch` with `summary` returns an immutable
+`approval_id`. Passing that exact ID to `POST /api/guardian/approve-patch` saves
+`PROPOSAL.md` outside the project. The ID is bound to the profile, workspace and
+original summary and can be used once. Despite the compatibility endpoint name,
+this saves a **proposal draft**, not a generated patch or Git worktree.