Persist native AI recovery targets and per-pane launch contexts without treating
command submission as provider confirmation. Keep window partitions and the
active window in the durable session snapshot for immediate and scheduled updates.
Coordinate draft approval, snapshot writes, helper readiness, process exit and
installation with a committed transaction. Reverify packages and retain recovery
state on failure. Isolate acceptance installers from production integrations and
reject same-version setup that leaves the executable unchanged.
Validation: Windows GPUI suite 1552 passed; settings 55 passed; i18n 20 passed;
9 native helper scenarios; 77 installer migration checks and 41 static invariants.
Full interactive packaged upgrade acceptance remains separate.
Right-clicking a folder has always opened the configured default shell —
usually PowerShell — with no way to ask for a WSL distribution instead.
- `--shell <id>` takes the same ids the `shell` setting uses (`pwsh`, `cmd`,
`wsl:Ubuntu`, or an imported profile's settings id) and applies to the
first tab this process creates. It carries an id rather than a path so
every launch re-resolves the executable.
- The id travels both startup paths: the cold start (`run_shell` →
`WorkspaceStartup::NewTerminal`), and the resident hand-off, which is the
common case on Windows. `tab.new`/`window.create` gained an optional
`shell` field, so clicking the menu while Pebrel is already running adds a
tab to the existing window instead of starting a second process.
- An explicit request never silently degrades. An unresolvable id fails
(`invalid_shell`, or a startup error before any window opens), and a
`wsl:<distro>` id that the registry no longer lists still launches
`wsl.exe -d <distro>`, leaving the complaint to the distribution itself.
The `shell` setting keeps its documented fallback to the platform default.
- The winit shell rejects a shell request instead of ignoring it, so the
caller falls back to a cold GPUI start and still gets the requested shell.
The resolution lives in a new `workspace::shell_launch` module: `main.rs` has
to validate `--shell` before it opens a window, and none of it needs
`NebulaWorkspace` state — `workspace.rs` is also at its line budget, which
this keeps from growing (`architecture/file-budgets.txt`).
The installer registers one context-menu entry per registered WSL
distribution (`PebrelWsl<n>`, skipping `docker-desktop*`) and the uninstaller
reclaims them by key prefix plus the command line it wrote. `--shell` is
passed before `--working-directory`: a drive-root `%V` ends in `\"`, which
would swallow the rest of the line if the directory came first. Both the
string and the order are pinned by installer assertions.
Docs (runtime API schema + control API) and shell completions are updated.
kuddev