2.2.0: your own endpoints, Agent settings, find, text size, smarter palette and UI polish

[ShadowfetchStudio]

UI and feature improvements for 2.2.0. CHANGELOG.md has the full entry, under ## 2.2.0 (unreleased).

Features

• Your own OpenAI-compatible endpoints (Settings › Accounts › Your own endpoints). Connect Ollama, LM Studio, a llama.cpp or vLLM server, xAI, OpenAI or any compatible API. Find models lists what the server offers; tick the models you want, then Test or Remove them.
  • New routes:
    • POST /api/providers/models lists a server's models and saves nothing.
    • POST /api/models/endpoints adds the chosen models and saves the key under a name chosen per service (api.deepseek.com → DEEPSEEK_API_KEY).
    • POST /api/models/remove removes a model; its saved key stays.
  • Only models added in Settings are listed (added_in: "settings"). The model: fallback in config.yaml, which the engine registers itself, never shows up.
  • Servers on this computer join On this computer; others are API rows that are off in offline mode.
  • A remote device never makes the desktop send a saved key to an address it typed.
• Settings › Agent covers limits, the token budget and autonomy profile, tool timeout and output size, history shortening, retries, the stuck check, subagents, checkpoints and the commands that count as checks.
  • Each field validates its range inline and has Reset.
  • Only changed keys are saved, so a project's own values are never copied into the profile.
  • It shows and saves the profile's own values. When the open project uses another, the setting notes it ("This project uses 200."). GET/PUT /api/config return agent_profile and agent_project for this.
• Find in conversation (Ctrl+F) searches the whole conversation, including older pages that aren't loaded. It highlights matches with the CSS Custom Highlight API, or outlines the row where that's missing.
• Search finds words in answers. GET /api/sessions?q= also matches task summaries and returns a match excerpt, which the sidebar and the Tasks tab show with the words marked.
• Smarter command palette:
  • fuzzy, ranked matching;
  • jump to conversations and projects;
  • a Recent group;
  • full combobox/listbox ARIA.
• Text size and zoom:
  • Ctrl+= / Ctrl+- / Ctrl+0 from 80% to 175%, saved as ui.zoom.
  • The desktop uses the webview's own zoom (core:webview:allow-set-webview-zoom added to the window's capability). Browsers use CSS zoom, with viewport units divided out at build time.
  • A phone or browser using remote access keeps its own size in its own storage, starting at 100%. It never writes ui.zoom, so the desktop's size never changes from a phone.
  • Theme and size preview live on the Appearance page.
  • The palette reaches all three themes.

Polish and fixes

• Message times at the edge of each message.
• Tool output: Show all / Show less and Copy.
• Page title names the open conversation.
• Composer: Enter picks the highlighted / command.
• Toasts pause while pointed at or focused.
• Screen readers: milestone announcements instead of streamed tokens, and a named log.
• Drawer: proper tablist.
• Reduced motion is respected by "Latest activity".
• Automations: delete uses the app's own dialog.
• Theme default: ui.theme now defaults to system, matching the window and onboarding.
• Docs:
  • fixed the stale Custom model… reference in NATIVE_ROUTING.md;
  • the retry example matches the default of 3;
  • USER_GUIDE.md, API_CONTRACT.md, SUBAGENTS.md and others updated.

Engine fixes

• Spending limits: choosing Stop at a limit could end the task as failed instead of cancelled. The answer woke the waiting task before the engine cancelled it. spend_gate now cancels the task itself when it sees Stop (engine/spending.rs).
• Subagent settings are checked when saved. A subagents value that is misspelled, the wrong type or out of range is refused, with the allowed range, by PUT /api/config and Config::patch. Before, it was clamped, or the whole group silently fell back to defaults. Config::load stays lenient, so an existing config.yaml still starts the engine.
• Settings › Agent showed project values as the profile's. GET /api/config is project-merged while PUT saves to the profile. The page now uses agent_profile and notes agent_project overrides; other pages are unchanged.
• Stale-socket tests: they now wait until a dropped listener really refuses before asserting. Another test forking at bind time can briefly hold a copy of it. The sweep also counts a socket timestamped ahead of the clock as age zero.

Tests

• Rust:
  • cargo fmt --check and clippy --all-targets -D warnings are clean.
  • New: tests/custom_endpoints.rs, using a fake OpenAI-compatible server.
  • New unit tests in endpoints.rs, models.rs, store.rs, control.rs and subagents.rs, plus route tests in config_keys.rs.
  • data_care is updated for the new theme default.
  • Locally, cargo test --workspace --no-fail-fast passes except for 13 tests that need a non-root user or a fresh engine binary. They fail with "Run without root/DAC override" or "a different version" in this root container.
• UI:
  • typecheck and Prettier are clean;
  • Vitest: 869/869;
  • Playwright: the full suite (136) passes once the drawer-tab selector updates in two specs and a smooth-scroll race in workspace.spec.ts were fixed in this PR.
  • New specs: endpoints, search, palette, agentSettings, find, appearance and transcriptPolish, with axe checks in both themes.

Notes for review

• Left for a follow-up: autonomy_profile step caps are not enforced, and mcp.inline_tools is missing from the defaults.
• The desktop title bar stays "ShadowCode"; only the page title changes. Forwarding it would need on_document_title_changed in src-tauri, and scripts/clean-host-gui-smoke.sh checks the exact window name.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Fn7NbipAkYG7cYZxHk8xRu

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0f8b49a8-9310-43e4-b8ba-30aa2d45344f

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[ShadowfetchStudio]

verify (aarch64) on 20a3ddb: one failure, control::tests::stale_sockets_are_swept_without_touching_live_ones (native/core/src/control.rs:597). The sweep returned [] where the test expected the dead socket.

I don't think this failure comes from this PR:

• The PR doesn't change control.rs or anything it calls.
• The same test passed on aarch64 for 4af4726 and e6f862a.

Likely cause: in sweep_stale_sockets, now.duration_since(modified).ok() treats a socket whose timestamp is even slightly later than SystemTime::now() as not old enough. That can happen with clock adjustment or file timestamp granularity on the runner. The test calls the sweep with Duration::ZERO right after binding, so it is the case most exposed to this race.

Proposed patch (not pushed here, to keep this PR scoped):

let old_enough = before
    .modified()
    .ok()
    .map(|m| now.duration_since(m).unwrap_or(Duration::ZERO))
    .is_some_and(|age| age >= min_age);

A timestamp in the future then counts as age zero. A real minimum age still leaves such a socket alone, and only a zero minimum age, as in this test, removes it.

GitHub refused the re-run while the x86_64 job in the same run is still going; I'll re-run the failed job once when the run finishes.

---

Generated by Claude Code

[ShadowfetchStudio]

verify (aarch64) on 7bb969f failed one test: process_stress::a_detached_pipe_cannot_hang_completion (native/core/tests/process_stress.rs:136, assert!(result.truncated)).

I don't think this comes from this PR:

• The PR doesn't change the process runner or this test.
• The test passed on aarch64 in every earlier run of this PR.
• It depends on timing: a setsid child must still hold the output pipe when the shell exits after sleep .1.

It is the third different timing-sensitive test to fail once on the aarch64 runner. The other two, the stale socket sweep and the spending Stop status, are fixed in this PR.

No fix for this one exists yet. 7bb969f is already superseded by 79927ff, whose CI is running, so I'm not re-running the old job. If it fails again on the current head, I'll treat it as real and fix it.

---

Generated by Claude Code