showagent 0.7.0 — every agent, every OS

[aytzey]

Release branch for v0.7.0. Everything below is on this branch and gated by the hardened CI (vet, golangci-lint, race tests, cross-compiles for all five release targets).

New agents

• feat(session): add OpenCode provider backed by the opencode CLI (653a985)
• feat(session): add Gemini CLI provider (a21aad0)
• refactor(session): introduce provider registry replacing per-provider dispatch (0ceacd1) — a provider is now one self-contained file implementing a small interface; badges, filter keys, and convert targets derive from the registry

Multi-OS

• feat: support Windows launch, multi-OS release archives, and installer (cdcccec) — darwin amd64/arm64, windows amd64 added to releases; Windows resume uses a run-and-wait fallback instead of unix exec; scripts/install.sh added

Real CLI surface

• feat(cli): add help, version, list, and resume commands (2f01454) — --help/--version, list --json, resume <id|latest>
• test(cli): cover arg parsing, list --json shape, and resume resolution (437789c)

Safer conversions and scanning

• fix(session): atomic converted-session writes, scan hardening, linear reverseLines (783dae4) — temp-file + rename so a crash never corrupts another CLI's session store
• feat(session): add scan-target reporting and pre-launch validation (ac20863)

TUI overhaul

• fix(tui): return longest fitting suffix in rightCells (81a7668) — path truncation no longer amputates the project basename
• feat(tui): rework keybindings, validate before exec, and fix small-terminal layout (8db4e2c) — BREAKING: provider filters move to number keys, 'd' now deletes; 'r' rescans; launch errors surface in-TUI; help bar survives 80x24
• docs(readme): update keybinding table for the reworked picker keys (39d1997)

Quality and CI

• fix(lint): make the tree golangci-lint clean and add the lint config (48e29c9)
• ci: gate on vet, golangci-lint, race tests, and cross-compiles (eca5908)
• chore(deps): bump patch-level dependencies and go directive to 1.25.9 (ccdffd5)

Docs and demo

• feat(demo): add hermetic GIF recording scaffold (5fb3670)
• feat(demo): record the hero GIF with Gemini fixtures and final keys (ba3c36e)
• docs(readme): rewrite around the browse+convert wedge for v0.7.0 (f9ba9ee)

Co-Authored-By: Claude Fable 5 noreply@anthropic.com

Summary by CodeRabbit

• New Features

  • Added support for more session providers, including Gemini and OpenCode.
  • Introduced new CLI actions for listing sessions in JSON, resuming by ID or latest, and setting up compound-engineering support.
  • Expanded release builds to include macOS, Windows, and Linux downloads with checksums.

• Bug Fixes

  • Improved handling of large or malformed session files so discovery is more reliable.
  • Made session writes safer to reduce the chance of partial files after failures.

• Documentation

  • Refresh a large portion of the README and demo instructions, including install and usage guidance.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR adds a provider registry abstraction replacing switch-based dispatch for session providers, introduces Gemini and OpenCode providers, refactors the CLI into testable subcommands (list/resume/setup), reworks TUI key bindings/rendering with provider-based badges and rescan/validation flows, hardens file scanning/writes, and updates CI, release, install, and demo tooling.

Estimated code review effort: 5 (Critical) | ~150 minutes

Changes

showagent core changes

Layer / File(s)	Summary
Provider registry abstraction internal/session/provider.go, internal/session/compound.go, internal/session/handoff.go, internal/session/session.go	Introduces ProviderImpl interface, ordered registry, providerFor/ProviderOrder/DisplayName/CompoundAgents, and refactors compound command building, conversion, transcript extraction, discovery, and deletion to dispatch through the registry instead of switch statements; adds ScanTargets, ValidateResume/ValidateCompound, and rewrites reverseLines.
Existing provider hardening internal/session/codex.go, internal/session/claude.go, internal/session/jcode.go, internal/session/exec_other.go	Adds scanner-error handling to drop malformed files from discovery, adopts atomic file writes, adds explicit errors for missing session files, and implements a real non-Unix syscallExec.
Gemini provider internal/session/gemini.go, internal/session/gemini_test.go	Adds a Gemini session provider supporting discovery, JSONL replay with rewind/checkpoint handling, legacy format parsing, transcript extraction, and conversion, with extensive tests.
OpenCode provider internal/session/opencode.go, internal/session/opencode_test.go	Adds an OpenCode session provider backed by the opencode CLI for discovery, export-based transcripts, import-based conversion, and ID generation, with tests.
Discovery hardening and env wiring internal/session/hardening_test.go, internal/session/session_test.go	Adds tests for atomic-write failure safety and reverseLines edge cases, and updates existing tests to configure new provider environment variables.
CLI dispatcher refactor cmd/showagent/main.go, cmd/showagent/main_test.go	Refactors CLI into a testable run() dispatcher with list, resume, setup subcommands, exit-code-based error handling, and comprehensive tests.
TUI table rendering internal/tui/table.go, internal/tui/table_test.go, internal/tui/theme.go	Makes PrintTable width-driven, refactors column layout, and centralizes provider badge styling via a theme map.
TUI interaction and validation internal/tui/keys.go, internal/tui/tui.go, internal/tui/tui_test.go	Adds digit-based provider filtering and rescan bindings, reworks model state/rendering for rescan/compound/resume validation and empty-state scan targets, with extensive tests.
CI, lint, and release workflows .github/workflows/ci.yml, .github/workflows/release.yml, .golangci.yml, go.mod	Adds permissions, go vet/lint/race steps, a golangci-lint config, and multi-OS/arch release packaging with aggregated checksums; bumps Go and dependency versions.
Install script and demo assets scripts/install.sh, demo/*	Adds a standalone install script and demo recording tooling (fixture generator, stub CLIs, VHS tape, README, gitignore).
README rewrite README.md	Rewrites installation, quick start, keybindings, scripting contract, comparison, compound engineering, FAQ, and provider-extension documentation.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the PR’s main release theme: v0.7.0 with broader agent and OS support.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch release/v0.7.0

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 4

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/ci.yml (1)

15-15: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Set persist-credentials: false on checkout steps.

Both actions/checkout steps persist the GitHub token in .git/config by default. Subsequent steps executing untrusted code (e.g., go test running dependency code, go build executing build scripts from modules) could exfiltrate it. Neither job needs git push access.

🔒 Proposed fix for both checkout steps

       - uses: actions/checkout@v7.0.0
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@v6.4.0

Apply the same change to the checkout in the cross-compile job (line 41).

Also applies to: 41-41

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml at line 15, The checkout steps in the CI workflow
are leaving the GitHub token persisted in git config, which can be exposed to
later untrusted build/test commands. Update both uses of actions/checkout in the
workflow to set persist-credentials to false, and keep the change consistent
across the checkout step in the main job and the one in cross-compile so neither
job retains push credentials.

Source: Linters/SAST tools

🧹 Nitpick comments (2)

internal/session/opencode.go (1)

450-458: 🩺 Stability & Availability | 🔵 Trivial | 💤 Low value

decodeOpenCodeJSON can latch onto a bracket inside preamble text.

bytes.IndexAny(output, "[{") returns the first [ or { anywhere in the output, so a banner/notice line containing either character before the real payload would make json.Unmarshal start mid-noise and fail — contrary to the "tolerate banner lines" intent. Consider scanning line-by-line for the first line that begins (after trimming) with [ or {, or matching the trailing JSON.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/session/opencode.go` around lines 450 - 458, decodeOpenCodeJSON is
too permissive because it uses bytes.IndexAny and can start parsing from a stray
[ or { in banner text instead of the real JSON payload. Update
decodeOpenCodeJSON to locate the first actual JSON line in the output, such as
by scanning line-by-line in the decodeOpenCodeJSON helper and selecting the
first trimmed line that begins with [ or {, or by otherwise matching the real
trailing JSON block before calling json.Unmarshal. Keep the existing tolerance
for preamble text, but avoid latched parsing from arbitrary brackets inside
notices.

internal/tui/tui.go (1)

342-358: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Consider renaming the local key variable to avoid shadowing the key package import.

key := msg.String() at line 345 shadows the imported key package within this block. While the block returns before any key.Matches call, a future edit adding key.Matches here would fail to compile with a confusing error.

♻️ Optional rename

  if m.compoundChoosing {
-   key := msg.String()
+   keyStr := msg.String()
    if agents := session.CompoundAgents(); len(keyStr) == 1 && keyStr[0] >= '1' && keyStr[0] <= '9' {
      if index := int(keyStr[0] - '1'); index < len(agents) {
        return m.startCompound(agents[index])
      }
    }
-   switch key {
+   switch keyStr {
    case "esc", "q", "ctrl+c":
      m.compoundChoosing = false
      m.compoundRow = nil
      m.compoundNotice = ""
      return m, nil
    }
    return m, nil
  }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/tui/tui.go` around lines 342 - 358, Rename the local variable in the
compound chooser block inside the TUI handling logic to avoid shadowing the
imported key package; the `key := msg.String()` declaration in the
`m.compoundChoosing` branch conflicts with later use of `key.Matches` elsewhere
in `internal/tui/tui.go`. Update the variable name in that block and all
references to it in the same scope so the code stays clear and future
key-matching edits won’t run into a package-name collision.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release.yml:
- Line 28: Both checkout steps currently persist the GitHub token in git config
by default, so update the `actions/checkout` usage in both the `release` job and
the other checkout step to set `persist-credentials: false`. Keep the change
localized to the `checkout` action invocations in the workflow so `gh release
create` continues to use `GH_TOKEN` instead of stored git credentials.

In `@cmd/showagent/main.go`:
- Line 155: The empty-state onboarding hint in main should be updated to reflect
all supported providers, not just codex and claude. Adjust the stderr message
near the showagent startup flow so it stays aligned with the providers exposed
by ScanTargets() and --help, including gemini, opencode, and jcode, and keep the
wording generic enough that any supported agent can be used to start a
conversation.

In `@go.mod`:
- Around line 3-28: Update the go.mod dependency on golang.org/x/sys because the
current v0.47.0 version is not a published release and prevents module
resolution. Replace it with a valid released version that is compatible with the
existing charm.land/bubbles/v2, charm.land/bubbletea/v2, and
charm.land/lipgloss/v2 dependencies, then verify the module graph still resolves
cleanly.

In `@internal/session/codex.go`:
- Around line 46-57: The codexProvider.Delete shell-out can block forever
because command.CombinedOutput has no timeout; update Delete to use
exec.CommandContext with a timeout-aware context so a hung codex CLI can be
canceled. Create the command from the context before setting command.Dir, keep
the existing cwd behavior and error wrapping, and make sure the timeout is
applied specifically around the codex delete invocation in codexProvider.Delete.

---

Outside diff comments:
In @.github/workflows/ci.yml:
- Line 15: The checkout steps in the CI workflow are leaving the GitHub token
persisted in git config, which can be exposed to later untrusted build/test
commands. Update both uses of actions/checkout in the workflow to set
persist-credentials to false, and keep the change consistent across the checkout
step in the main job and the one in cross-compile so neither job retains push
credentials.

---

Nitpick comments:
In `@internal/session/opencode.go`:
- Around line 450-458: decodeOpenCodeJSON is too permissive because it uses
bytes.IndexAny and can start parsing from a stray [ or { in banner text instead
of the real JSON payload. Update decodeOpenCodeJSON to locate the first actual
JSON line in the output, such as by scanning line-by-line in the
decodeOpenCodeJSON helper and selecting the first trimmed line that begins with
[ or {, or by otherwise matching the real trailing JSON block before calling
json.Unmarshal. Keep the existing tolerance for preamble text, but avoid latched
parsing from arbitrary brackets inside notices.

In `@internal/tui/tui.go`:
- Around line 342-358: Rename the local variable in the compound chooser block
inside the TUI handling logic to avoid shadowing the imported key package; the
`key := msg.String()` declaration in the `m.compoundChoosing` branch conflicts
with later use of `key.Matches` elsewhere in `internal/tui/tui.go`. Update the
variable name in that block and all references to it in the same scope so the
code stays clear and future key-matching edits won’t run into a package-name
collision.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: ff4d9d5a-964b-4b88-ba71-d588e7c7eeda

📥 Commits

Reviewing files that changed from the base of the PR and between 03f7c58 and f9ba9ee.

⛔ Files ignored due to path filters (3)

• docs/demo.gif is excluded by !**/*.gif
• docs/social-preview.png is excluded by !**/*.png
• go.sum is excluded by !**/*.sum

📒 Files selected for processing (34)

• .github/workflows/ci.yml
• .github/workflows/release.yml
• .golangci.yml
• README.md
• cmd/showagent/main.go
• cmd/showagent/main_test.go
• demo/.gitignore
• demo/README.md
• demo/bin/claude
• demo/bin/codex
• demo/demo.tape
• demo/fixtures/gen.sh
• go.mod
• internal/session/claude.go
• internal/session/codex.go
• internal/session/compound.go
• internal/session/exec_other.go
• internal/session/gemini.go
• internal/session/gemini_test.go
• internal/session/handoff.go
• internal/session/hardening_test.go
• internal/session/jcode.go
• internal/session/opencode.go
• internal/session/opencode_test.go
• internal/session/provider.go
• internal/session/session.go
• internal/session/session_test.go
• internal/tui/keys.go
• internal/tui/table.go
• internal/tui/table_test.go
• internal/tui/theme.go
• internal/tui/tui.go
• internal/tui/tui_test.go
• scripts/install.sh

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Set persist-credentials: false on checkout steps.

Both actions/checkout steps persist the GitHub token in .git/config by default. The release job uses GH_TOKEN env var for gh release create, not git credentials, so persist-credentials: false is safe for both jobs.

🔒 Proposed fix for both checkout steps

       - uses: actions/checkout@v7.0.0
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@v6.4.0

Apply the same change to the checkout in the release job (line 65).

Also applies to: 65-65

🧰 Tools

🪛 zizmor (1.26.1)

[warning] 28-28: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml at line 28, Both checkout steps currently
persist the GitHub token in git config by default, so update the
`actions/checkout` usage in both the `release` job and the other checkout step
to set `persist-credentials: false`. Keep the change localized to the `checkout`
action invocations in the workflow so `gh release create` continues to use
`GH_TOKEN` instead of stored git credentials.

Source: Linters/SAST tools

[coderabbitai]

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Stale onboarding hint lists only two of five providers.

The empty-state guidance says to start a session "with codex or claude", but --help and ScanTargets() now cover gemini, opencode, and jcode too. Widen the hint so users with only those agents aren't misled.

✏️ Suggested wording

-	_, _ = fmt.Fprintln(stderr, "start a conversation with codex or claude, then run showagent again")
+	_, _ = fmt.Fprintln(stderr, "start a conversation with a supported agent (codex, claude, gemini, opencode, jcode), then run showagent again")

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	_, _ = fmt.Fprintln(stderr, "start a conversation with codex or claude, then run showagent again")
	_, _ = fmt.Fprintln(stderr, "start a conversation with a supported agent (codex, claude, gemini, opencode, jcode), then run showagent again")

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cmd/showagent/main.go` at line 155, The empty-state onboarding hint in main
should be updated to reflect all supported providers, not just codex and claude.
Adjust the stderr message near the showagent startup flow so it stays aligned
with the providers exposed by ScanTargets() and --help, including gemini,
opencode, and jcode, and keep the wording generic enough that any supported
agent can be used to start a conversation.

[coderabbitai]

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify Go module versions via the Go module proxy
echo "=== charm.land/bubbles/v2 ==="
curl -s "https://proxy.golang.org/charm.land/bubbles/v2/@v/list"
echo "=== charm.land/bubbletea/v2 ==="
curl -s "https://proxy.golang.org/charm.land/bubbletea/v2/@v/list"
echo "=== charm.land/lipgloss/v2 ==="
curl -s "https://proxy.golang.org/charm.land/lipgloss/v2/@v/list"
echo "=== golang.org/x/sys ==="
curl -s "https://proxy.golang.org/golang.org/x/sys/@v/list"

Repository: aytzey/showagent

Length of output: 1984

---

🌐 Web query:

proxy.golang.org charm.land/bubbles/v2 v2.1.1 charm.land/bubbletea/v2 v2.0.8 charm.land/lipgloss/v2 v2.0.5 golang.org/x/sys v0.47.0

💡 Result:

As of July 8, 2026, the status of the requested Go modules is as follows: - charm.land/bubbles/v2: The latest version is v2.1.1, released on July 4, 2026 [1]. This is a patch release that fixes a textarea styling bug [2][3]. - charm.land/bubbletea/v2: The latest version is v2.0.8 [4][5]. It includes improvements for specific emoji-rendering edge cases [2][6]. - charm.land/lipgloss/v2: The latest version is v2.0.5, released in late June 2026 [7][8]. It also addresses emoji-rendering issues [9]. - golang.org/x/sys: There is no version v0.47.0 for this module [10][11][12]. Versions for golang.org/x/sys generally follow a different release cadence than packages like golang.org/x/net or golang.org/x/crypto, which did reach v0.47.0 in June 2026 [10][12]. As of early June 2026, golang.org/x/sys was at v0.40.0 [11][12].

Citations:

• 1: https://pkg.go.dev/charm.land/bubbles/v2
• 2: chore(deps): bump the all group with 3 updates charmbracelet/huh#797
• 3: deps: bump charm.land/bubbles/v2 from 2.1.0 to 2.1.1 davidbudnick/redis-tui#51
• 4: https://pkg.go.dev/charm.land/bubbletea/v2
• 5: https://github.com/charmbracelet/bubbletea
• 6: chore: bump bubbletea v2.0.7 → v2.0.8, annotate WithInput(nil) github/gh-aw#43171
• 7: https://pkg.go.dev/charm.land/lipgloss/v2
• 8: https://github.com/charmbracelet/lipgloss
• 9: deps: bump bubbletea v2.0.8, lipgloss v2.0.5 github/gh-aw#43375
• 10: https://pkg.go.dev/golang.org/x/net@v0.47.0
• 11: https://go.googlesource.com/crypto/+/refs/tags/v0.47.0%5E%21/
• 12: https://pkg.go.dev/golang.org/x/crypto@v0.47.0

---

🌐 Web query:

site:pkg.go.dev "charm.land/bubbles/v2" "v2.1.1"

💡 Result:

charm.land/bubbles/v2 v2.1.1 is a specific version of the Bubbles library, which is a collection of common UI components for Bubble Tea applications [1][2]. Key details regarding this release include: - Version: v2.1.1 [1] - Published Date: July 4, 2026 [1] - Module Path: charm.land/bubbles/v2 [1] - Repository: The source code is maintained by Charmbracelet at github.com/charmbracelet/bubbles [1]. - License: MIT [1] - Go Version Requirement: Requires Go 1.25.0 or later [1]. This module provides various ready-to-use components for building terminal user interfaces (TUIs) in Go, such as: - stopwatch: A component for implementing stopwatch functionality [3]. - paginator: A tool for calculating and managing pagination [2]. - filepicker: A file selection component [4]. - key: Utilities for managing user-definable keybindings [5]. As of July 8, 2026, v2.1.1 is the latest default version of the module [1].

Citations:

• 1: https://pkg.go.dev/charm.land/bubbles/v2
• 2: https://pkg.go.dev/charm.land/bubbles/v2/paginator
• 3: https://pkg.go.dev/charm.land/bubbles/v2/stopwatch
• 4: https://pkg.go.dev/charm.land/bubbles/v2/filepicker
• 5: https://pkg.go.dev/charm.land/bubbles/v2/key

---

🌐 Web query:

site:pkg.go.dev "charm.land/bubbletea/v2" "v2.0.8"

💡 Result:

The module charm.land/bubbletea/v2 at version v2.0.8 is a recognized version of the Bubble Tea framework, which is a popular library for building terminal user interfaces (TUIs) in Go [1][2][3]. It is widely used in various open-source projects and CLI tools as a dependency for creating modern, interactive terminal applications [2][4][3][5]. For official documentation and usage details regarding this module, you can access the Go package documentation at https://pkg.go.dev/charm.land/bubbletea/v2 [1].

Citations:

• 1: https://pkg.go.dev/charm.land/bubbletea/v2
• 2: https://pkg.go.dev/github.com/entireio/cli
• 3: https://pkg.go.dev/github.com/allaman/werkzeugkasten
• 4: https://pkg.go.dev/github.com/docker/docker-agent
• 5: https://pkg.go.dev/github.com/hyperlocalise/hyperlocalise

---

🌐 Web query:

site:pkg.go.dev "charm.land/lipgloss/v2" "v2.0.5"

💡 Result:

charm.land/lipgloss/v2 v2.0.5 refers to a specific version of the Lip Gloss library, a popular Go package used for defining styles and layouts in terminal applications [1]. Key points regarding this version: - Identity: It is the same library as the well-known charmbracelet/lipgloss, hosted under the charm.land domain, which serves as a module namespace for projects by Charm. This version (v2.0.5) is actively indexed and documented on pkg.go.dev [1]. - Functionality: The library provides tools for creating sophisticated terminal user interfaces (TUIs) [1]. It includes core styling capabilities, as well as sub-packages for specific UI components, such as list and tree [2][3]. - Usage: It is currently utilized as a dependency in various Go projects, including CLI tools and agents [4][5][6]. As of July 2026, version 2.0.5 is a stable release for developers building interfaces with Go [1].

Citations:

• 1: https://pkg.go.dev/charm.land/lipgloss/v2
• 2: https://pkg.go.dev/charm.land/lipgloss/v2/list
• 3: https://pkg.go.dev/charm.land/lipgloss/v2/tree
• 4: https://pkg.go.dev/github.com/docker/docker-agent
• 5: https://pkg.go.dev/github.com/entireio/cli
• 6: https://pkg.go.dev/github.com/gechr/clog

---

🌐 Web query:

site:pkg.go.dev "golang.org/x/sys" "v0.47.0"

💡 Result:

As of July 8, 2026, golang.org/x/sys v0.47.0 is not listed as the current or latest version of the module. The most recent established version for golang.org/x/sys noted in official documentation as of late May 2026 is v0.46.0 [1][2]. While other related Go sub-repositories (such as golang.org/x/net, golang.org/x/crypto, and golang.org/x/tools) have released versions labeled v0.47.0 [3][4][5], the golang.org/x/sys module has not reached that version number. You can verify the latest available version of the module by visiting the official package page at https://pkg.go.dev/golang.org/x/sys [2].

Citations:

• 1: https://pkg.go.dev/golang.org/x/sys/unix
• 2: https://pkg.go.dev/golang.org/x/sys
• 3: https://pkg.go.dev/golang.org/x/net@v0.47.0
• 4: https://pkg.go.dev/golang.org/x/crypto@v0.47.0
• 5: https://pkg.go.dev/golang.org/x/tools

---

🌐 Web query:

site:go.dev "go1.25.9" release

💡 Result:

Go 1.25.9 was released on April 7, 2026 [1]. This release included several important security fixes addressing vulnerabilities in the Go toolchain and standard library, specifically: - cmd/go: Addressed a security vulnerability (CVE-2026-27140) [2]. - crypto/tls: Fixed a vulnerability (CVE-2026-32283) affecting TLS handshake and connection handling [3]. - archive/tar: Resolved a memory allocation issue (CVE-2026-32288) related to reading malformed "old GNU sparse map" archives [4]. - cmd/compile: Addressed a compiler-related vulnerability (CVE-2026-27144) [5]. These fixes were part of a coordinated security release, and users of the Go 1.25 branch were encouraged to update to version 1.25.9 to mitigate these risks [1].

Citations:

• 1: https://go.dev/doc/devel/release
• 2: https://pkg.go.dev/vuln/GO-2026-4871
• 3: https://pkg.go.dev/vuln/GO-2026-4870
• 4: https://pkg.go.dev/vuln/GO-2026-4869
• 5: https://pkg.go.dev/vuln/GO-2026-4867

---

🌐 Web query:

site:golang.org/dl/ "go1.25.9"

💡 Result:

There is no official record or release of a Go version 1.25.9 as of July 8, 2026. The official Go release documentation does not list this version [1].

Citations:

• 1: https://golang.org/dl/

---

Bump golang.org/x/sys to a published release charm.land/bubbles/v2, charm.land/bubbletea/v2, and charm.land/lipgloss/v2 look fine, but golang.org/x/sys v0.47.0 doesn’t appear to be a real release, so this go.mod won’t resolve until that dependency is updated.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 3 - 28, Update the go.mod dependency on golang.org/x/sys
because the current v0.47.0 version is not a published release and prevents
module resolution. Replace it with a valid released version that is compatible
with the existing charm.land/bubbles/v2, charm.land/bubbletea/v2, and
charm.land/lipgloss/v2 dependencies, then verify the module graph still resolves
cleanly.

[coderabbitai]

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Add a timeout to the codex delete shell-out.

command.CombinedOutput() blocks indefinitely if the codex CLI hangs (e.g. stalls on a network/auth check despite --force). There's no way to recover short of killing the whole app.

🕐 Suggested fix using exec.CommandContext with a timeout

+import "context"
+import "time"
+
 func (codexProvider) Delete(row Row) error {
-	command := exec.Command("codex", "delete", "--force", row.ID)
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	command := exec.CommandContext(ctx, "codex", "delete", "--force", row.ID)
 	if info, err := os.Stat(row.CWD); err == nil && info.IsDir() {
 		command.Dir = row.CWD
 	}
 	if output, err := command.CombinedOutput(); err != nil {
 		return fmt.Errorf("codex delete failed: %w: %s", err, strings.TrimSpace(string(output)))
 	}
 	return nil
 }

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	// Delete shells out to the codex CLI so codex can keep its own bookkeeping
	// (history metadata) consistent instead of us unlinking the rollout file.
	func (codexProvider) Delete(row Row) error {
	command := exec.Command("codex", "delete", "--force", row.ID)
	if info, err := os.Stat(row.CWD); err == nil && info.IsDir() {
	command.Dir = row.CWD
	}
	if output, err := command.CombinedOutput(); err != nil {
	return fmt.Errorf("codex delete failed: %w: %s", err, strings.TrimSpace(string(output)))
	}
	return nil
	}
	// Delete shells out to the codex CLI so codex can keep its own bookkeeping
	// (history metadata) consistent instead of us unlinking the rollout file.
	func (codexProvider) Delete(row Row) error {
	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
	defer cancel()
	command := exec.CommandContext(ctx, "codex", "delete", "--force", row.ID)
	if info, err := os.Stat(row.CWD); err == nil && info.IsDir() {
	command.Dir = row.CWD
	}
	if output, err := command.CombinedOutput(); err != nil {
	return fmt.Errorf("codex delete failed: %w: %s", err, strings.TrimSpace(string(output)))
	}
	return nil
	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/session/codex.go` around lines 46 - 57, The codexProvider.Delete
shell-out can block forever because command.CombinedOutput has no timeout;
update Delete to use exec.CommandContext with a timeout-aware context so a hung
codex CLI can be canceled. Create the command from the context before setting
command.Dir, keep the existing cwd behavior and error wrapping, and make sure
the timeout is applied specifically around the codex delete invocation in
codexProvider.Delete.