* fix(web): scope plugin URL imports to workspace
* test(web): cover billing interest remount lifecycle
* feat(packaged): enable the workspace-team transport for test-profile builds
The vela test backend now serves the workspace-team API, so a packaged build
baked with the test AMR profile should drive team projects / collab / resource
sharing there instead of leaving them dormant. Replace the single feature-test
equality check with a profile -> vela web origin map so adding a backend is one
entry, and keep every unlisted profile (prod above all) off.
* test(daemon): cover billing catch-up after SSE reconnect
* fix(collab): surface and start first materialization when opening a shared project
QA P0: a brand-new member on a fresh install joins someone's workspace, opens a
project from it, and sees no loading state and no files — content only appears
on a SECOND open, much later.
Two defects, both on the first `/collab/status` request that opening a shared
project makes.
1. No pull is started. The daemon's self-materialization block was gated on
`callerIsOwner`, so a non-owner member got the placeholder record registered
and nothing else. The web's auto-pull is gated on `publishedVersion`
advancing past its cursor, and a fresh daemon's first status response cannot
carry a published head: `collab.publishedVersion()` reads an in-process map
that has never been written, and the real hub head is fetched
fire-and-forget into `headEnrichmentCache` for a LATER poll to consume.
Materialization therefore arrived only whenever a proactive lane (hub push /
reconnect catch-up / the 30s recovery floor) next fired — the "second open"
the report describes.
2. No download state is shown. `useProjectCollab.downloadPending` — which picks
DesignFilesPanel's "Syncing files from the team…" over its empty state and
create-a-file CTAs — reads only `publishedVersion > cursor`,
`contentTransferState`, and an in-flight pull. All three are blank on that
first response, so the member was shown an empty project inviting them to
start creating over content that was still on its way.
The fix makes the placeholder stamp the load-bearing signal on both sides:
- `materializePlaceholderOnOpen` (routes/collab-sync.ts) replaces the
owner-only block: any viewer opening a shared project whose only local record
is an unmaterialized placeholder starts its pull on that same request,
through the same coalesced flow. The retracted-share heal in its catch stays
owner-only — a member who hits the hub tombstone has merely lost access and
must not unshare anyone's project.
- `/collab/status` reports `awaitingFirstMaterialization`, a purely local,
synchronous fact that needs no hub round-trip and is therefore available on
the very first response. `od collab status` prints it too.
- `localFilesAreNotTheContentYet` (useProjectCollab.ts) makes it always
download-pending, bypassing the member-only `shouldAutoPull` gate: whether the
local files are the content is a fact about the record, not about who may
pull it, so the owner of an unmaterialized placeholder (the reinstall case,
recvqzaDvUU6B3) stops seeing the same empty state too.
Red evidence: all six new specs fail on origin/feat/workspace-team @ 793d7b92c
— the first status response reported `awaitingFirstMaterialization: undefined`
with publishedVersion/materializedVersion/contentTransferState all null,
`beginContentTransfer` was never called for a member's first open, and
`downloadPending` was false for both the member and the owner.
* chore(packaged): inject the vela web origin at build time, not source
This repository is public. Commit 319cb42b3 added a profile -> vela web
origin table to apps/packaged/src/sidecars.ts, which put an internal
environment's hostname into product source and would have published it on
merge. The same hostname had also reached apps/web/src/runtime/amr-guidance.ts
as a new profile row.
Internal AMR environments are not public (one of them fronts a Stripe
sandbox), so their origins now travel the same build-time path POSTHOG_KEY
already uses:
release-beta.yml env (per-profile secret)
-> tools-pack config (OD_VELA_WEB_URL)
-> open-design-config.json (velaWebUrl)
-> packaged config -> daemon spawn env (OD_VELA_WEB_URL)
-> GET /api/integrations/vela/status (consoleOrigin)
-> web runtime console links
The workspace-team gate keeps its meaning and gets stricter: it now needs an
allowlisted AMR profile AND an injected origin. `prod` can never satisfy the
profile half, so a stable build stays dormant however it is configured, and a
feature-test/test build whose secret is unset stays dormant too rather than
pointing the transports at an unknown backend.
A build with no secret configured therefore ships with workspace-team silently
off — the same failure mode as a fork build without POSTHOG_KEY, and the safe
direction for an unreleased feature.
apps/packaged/tests/source-origins.test.ts is a standing guard: every absolute
URL literal under apps/packaged/src must resolve to a publishable host, so the
next backend origin cannot be hardcoded there either.
Secrets required for a workspace-team dogfood build:
VELA_WEB_URL_FEATURE_TEST, VELA_WEB_URL_TEST.
* test(e2e): follow the #5517 plugin-details route in the visual capture
`captures the home plugin use staged surface` has been failing on this
branch since before the main merge. It was written against the pre-#5517
UI: clicking a marketplace card opened a role="dialog" details overlay
with a per-slug `plugin-details-use-<id>` action.
#5517 made plugin details a full-page route — `openCardDetail` calls
navigate({ kind: 'marketplace-detail' }) for plugin records, rendering
`PluginDetailView` at /marketplace/<id> whose Use control is a single
`plugin-detail-use` button. Per the product rule that the accepted
feature-branch UI is the source of truth, the test follows the route
instead of the UI being changed back.
Asserting the route alone was not enough: the detail surface refetches
the record from /api/plugins/<id>, which the visual fixture never mocked
(it mocks the list, */preview and */apply), so the route rendered its
"Failed to load plugin: HTTP 404" branch. configureVisualPage now serves
the single-plugin GET from the same VISUAL_PLUGINS fixture.
The capture asserts the Use button rather than the `plugin-detail` shell
because the shell also renders for the loading and load-failed states.
* fix(packaged): restore masked CLI icons (#6154)
* Sync local workspace-team batch: UI polish, popover simplification, update-reminder progress (#6156)
* UI polish batch: import-dialog cleanup, settings toast placement, tab chrome fixes
- Plugin/skill import dialog: drop per-card icons, left-align card content
- Settings page: center the autosave pill under the top nav
- Avatar model menu: soften the pinned footer divider
- Workspace tabs: pinned entry tab always reads as Home; remove tab-search
button and its popover
- Model picker: wider row gap in the two-pane browse popover
- Community header: unpin (scrolls with content)
- New update-reminder dialog assets and strings
- Keep entry-settings-button as the signed-out settings entry (e2e contract);
align NextStepActions with the navPlugins key rename
* Update reminder: simulate in-place download progress instead of linking out
The strip's confirm now runs a staged progress state ('updating') with an
eased fake download bar, then marks the version updated — replacing the
jump to the GitHub releases page.
* test(web): retire AvatarMenu account-row suites after the popover simplification
The composer popover was reduced to a model picker (2026-07-24): the Open
Design account row — plan badge, balance, wallet fallback, upgrade/console
links — no longer renders there, so the nine suites asserting that surface
(including the workspace-balance and billing-permission gates that landed
upstream meanwhile) can no longer pass. Drop them and recast the remaining
account-row test as the guard for the new invariant: a signed-in AMR status
must render no account UI in the popover.
Also drop the stale onClose prop from the new upstream sign-out-confirm
test; the rail no longer takes one.
* Design-systems toast: anchor to the pane's top edge, pill radius
* Update reminder strip: progress ring on the button, percent face
While updating, the collapsed strip no longer stacks a label + bar above
the rocket button. Progress draws as a brand-green ring hugging the round
button's edge (5px band reserved so the button never shifts), and the
button face swaps the rocket for the bare percent — 'N%' while
downloading, 完成 (updater.done) at 100. The full 正在下载更新 N% label
stays reachable via the hover bubble and the ring's aria-label. Demo
payload version bumps to 1.4.6 so the once-per-version card re-arms.
* fix(web): restore design kit section spacing (#6155)
* fix(web): carry the plugin back to Home when Use runs from the detail route
Product call: using a plugin from the full-page detail route should land on
Home with that plugin already selected and its brief pre-filled, exactly
like the marketplace card's "Try it".
It did not. `PluginDetailView.onUse` applied the plugin, kept the result in
local state, and navigated home. `App` renders that route outside
`EntryShell`, so the navigation unmounted the holder and dropped both the
plugin and the brief — Home came up empty. The "redirected to Home with the
brief pre-filled" note under the button could never be seen either, since
the navigation fired immediately; it is removed rather than left lying.
Reuses the existing channel instead of adding a parallel one: onUse now
publishes the same `createPluginUseHandoff` payload "Try it" produces, and
Home's existing pendingPluginUseHandoff path applies it unchanged. The
handoff is parked in module scope — not on `window` — so it survives the
unmount, and `EntryShell` claims it in a lazy state initializer so it
arrives in the same commit as the mount. Reads are destructive, so a
handoff applies once and does not re-fire on the next visit to Home.
Red first: PluginDetailView.use-handoff.test.tsx fails on the unfixed code
at the handoff assertion (navigation and the failure path already passed),
and goes green with this change. The e2e visual capture that asserts
home-hero-active-plugin should follow without weakening its assertion.
test(e2e): match the settings surface in both #5517 presentations
openSettingsDetailsFromHeader still waited on `.modal-settings[role="dialog"]`.
#5517 routes the entry's settings to /settings, where SettingsDialog renders
in presentation="page" mode with `role="region"`, so that selector never
matched the page presentation: an already-open settings surface looked
absent and the helper fell through to hunting for entry triggers that
surface does not carry, failing 16 captures on one line.
Reuses `settingsSurface` from amr.ts — the existing bare `.modal-settings`
matcher both presentations share — rather than adding a third local
variant. That helper also documents why the `role="dialog"` fallback was
actively wrong: AvatarMenu is a dialog too, so it could resolve to the
account menu.
* test(e2e): open the nav rail before reaching for entry settings
The bare-`.modal-settings` change alone did not move the settings-workspace
lane: all 16 captures still died on `.settings-icon-btn`, because the
failure happens before the surface selector matters. None of the four
triggers was ever visible.
amr.ts already documents why. #5517 moved the entry settings chip into the
nav rail footer, and a collapsed rail is `inert` + `aria-hidden`: the chip
is present but invisible to `getByRole`, and even a programmatic
`element.click()` is a no-op. `openSettingsDialog` expands the rail first
(`ensureEntryRailOpenIfPresent`), clears loading, dismisses the privacy
dialog, matches the surface with the shared bare class, and ends its
trigger chain on the settings aria-label instead of `.settings-icon-btn`,
which the entry surface does not carry. It also clicks
`entry-settings-open-details`, so it is a superset of the local copy.
So `openSettingsDetailsFromHeader` now delegates to it and keeps only its
name, leaving exactly one settings opener instead of a third variant.
* test: realign the suites #6156 outpaced, and reach Settings from a project
#6156 (4e3161751) landed a UI batch whose test fallout was only partly
handled. Four Vitest files and four e2e call sites still describe the surface
as it looked before it, and the Playwright settings opener never had a trigger
that exists once a project is open.
Vitest — the assertions now read the surface that shipped:
- community-view: the type tabs traded their `<small>` count badges for type
icons, so `readFacets().badge` was `NaN`. Counts move to a new
`readFacetCardCounts()` that drives each tab and counts the grid — the same
array the badges were derived from, so the catalogue-fidelity guard
(including "never grids more than the whole catalogue") survives the
badge's removal rather than being dropped.
- home-logo-assets: the rail's signed-out brand header is gone (with no cloud
identity the rail starts at the search box), so it can no longer carry
`od-brand-glyph`. Keeps the guard that still means something: it must never
fall back to the retired raster app icon.
- acceptance-visual-fixes: recvq4iEq1Esno's fix is intact — page mode still
hides only `.settings-chrome-btn`, leaving the autosave pill visible. #6156
re-added the bare `.settings-page-shell .settings-chrome` selector purely to
centre that pill under the top nav, so assert the invariant the row is
about (no page-mode `display: none`) instead of the selector's absence.
- FileViewer: the new `artifact-preview-first-load` cover is a `role="status"`
of its own, so `findByRole('status')` had become ambiguous. Scope the
success assertion to the toast.
e2e — `entry-nav-settings` no longer exists anywhere in `apps/web/src`; the
rail item carries `entry-settings-button`. #6156 renamed it and updated
entry-chrome-flows' two `toHaveCount(0)` assertions but not the four places
that click or await it (critical-smoke, entry-topbar x2, entry-chrome-flows x2).
`openSettingsDialog` also only ever knew entry-shell triggers, all of which
live on Home. From a project every one of them is absent — and
`EntrySettingsMenu` and `AppChromeHeader`'s `SettingsIconButton` are both
unrendered — so the surface never opened and the failure surfaced as a missing
`.modal-settings`. Add the project surface's real entry: the composer model
popover's pinned `avatar-open-execution-settings`, with the topbar switcher's
`inline-model-switcher-open-settings` as a second route.
Not addressed here, deliberately: #6156 also deleted the `settings-general-field`
block that rendered `AppearanceSection`, orphaning the component. That removes
the product's only System/Light/Dark control (the rail's account menu dropped its
theme row *because* Settings owned it), so the 11 `SettingsDialog.execution`
appearance failures are reporting a capability loss, not a stale expectation.
Restoring it is a product call, so those tests are left red rather than weakened.
* test(e2e): finish the popover the settings chain opens on a project surface
`openSettingsDialog`'s trigger chain ends on OPEN_SETTINGS_LABEL, which matches
`Account & settings` — and that is `avatar.title`, the label on AvatarMenu's
own trigger. So on a project surface the chain does find something and clicks
it, but what opens is the composer's model popover, not Settings. The
follow-through step then looked only for `entry-settings-open-details`, which
#5517 left unrendered, so the run gave up with a missing `.modal-settings`
after three identical attempts.
Widen the follow-through to the two rows that actually route to Settings from
a project — AvatarMenu's pinned `avatar-open-execution-settings` and the topbar
switcher's `inline-model-switcher-open-settings` — so whichever popover the
first click opened gets finished.
* test(e2e): pin the AMR selection assertion to the agent card
With Settings actually opening from a project surface again, the surface-wide
`/Open Design/i` in amr-logout-requires-relogin resolves to the sidebar's
"Open Design MCP" `settings-nav-item` — which carries no `aria-pressed` — not
to the AMR agent card's select button. The looseness was invisible while the
surface never opened.
Read the toggle through `settings-agent-card-amr` instead, so the assertion
names the thing the test is about: AMR stays the selected agent.
* test(e2e): prove Settings opened via its section nav, not a heading probe
`prepareVisualSettingsDialog` gated on a heading matching
/Settings|General|Execution mode/. Now that the surface opens from a project it
lands on the execution section, whose heading reads "Models & providers" — and
the surface's own <h2> is consumed as its accessible name via aria-labelledby
anyway, so the probe could not match in either presentation.
Assert `settings-nav-execution` instead, which is what critical-smoke already
uses for the same purpose and holds for both the modal and the routed page.
* test(web): retire the theme/appearance cases the product cut
Product decision (2026-07-28), verbatim: 「主题设置不要了,因为 workspace 功能不
支持暗色主题,要干掉,并且之前用户如果设置了暗色主体,需要强制改成明亮色主题」
So #6156 deleting the `AppearanceSection` render site was the right direction,
and the NON-ALIGNMENT #9 note that argued for keeping the segmented control as
the product's last "follow system" entry point is formally overturned. These
cases are retired because the capability is gone by decision — NOT to turn CI
green. The source-side removal (orphaned `AppearanceSection`, onboarding
light/dark toggle, `settings.appearance*` keys, `trackSettingsAppearanceClick`,
plus forcing stored dark/system back to light for existing users) lands
separately on `fix/remove-theme-force-light`.
Deleted (8) — their whole subject was theme or the accent it carried:
- offers the theme segmented control, and System leaves the document theme unset
- applies the stored default accent color even though the picker is gone
- writes the picked theme to the document and autosaves it
- live previews the configured theme on open, and System leaves no explicit
document theme
- reverts an unsaved appearance preview back to the saved appearance when the
dialog closes
- persists System mode explicitly and preserves accent variables without an
explicit document theme
- keeps a stored non-default accent applied and carries it through an autosave
- localizes the theme controls in Chinese
Nothing was left behind as a loose "still renders something" assertion, and no
live coverage went with them: the close-button/`onClose` path the revert case
also touched is already covered at five other call sites in this file.
Kept (3) — theme was only the vehicle, the subject is still shipping. Each now
rides the notifications completion-sound toggle, seeded on so the single click
is a real state change (the pills no-op when clicked in their current state):
- reconciles the open settings draft when the parent agent CLI env changes —
the only integration proof that `reconcileAmrModelChoice` /
`reconcileAmrProfileEnv` actually run through the real draft on autosave;
its two siblings are pure unit tests and do not cover that path.
- drops a pending autosave when explicit onboarding reset unmounts Settings —
subject is the pending-autosave drop and the draft the reset carries.
- still autosaves an unrelated edit that lands during a silent-update save —
subject is autosave bookkeeping (success must only advance
autosaveLastSavedRef for allowSilentUpdates).
The enclosing block is renamed 'SettingsDialog draft reconciliation' since it no
longer describes appearance, and its document theme/accent teardown is dropped —
nothing in it writes those any more. 144/144 green.
* test(e2e): realign the visual workspace captures with the narrowed surfaces
Three deliberate narrowings shipped without this Playwright lane following, so
eight captures were driving UI that no longer renders. All eight are stale
fixtures; none was a regression.
- `ef9c8cd8b` made the home top-bar `InlineModelSwitcher` `compact`, and
`EntryShell` (its only call site) always passes the flag. In compact mode the
popover is just the active agent's model radio list plus the route to
設定 → 執行; the mode segmented control, agent grid, account block, and both
searchable dropdowns live in the non-compact branches. `68cecac1c` records
that product confirmed this narrower shape, so acceptance #40 ("home 页不能
切换 cli 了") is working as designed.
- `4e3161751` (#6156) removed the Open Design account row from `AvatarMenu`
(plan badge, balance, wallet fallback, upgrade/console links) and retired the
nine equivalent Vitest suites — but not these.
- `56b538aa4` moved the design-system picker out of the staged-context bar, so
`staged-contexts` is no longer unconditionally mounted.
Where a surface still ships, the capture follows it and the assertion got
sharper rather than looser: staged contexts now stages a real attachment and
names the chip; the topbar/avatar captures assert the surviving model picker
plus the *inverse* invariant (no account block, no upgrade button, no balance),
gated on a counted `vela/status` request so a negative cannot pass by racing the
fetch. `:57` additionally pins `inline-model-switcher-mode-daemon` at count 0, so
re-mounting the CLI console on Home fails here again.
`:167` (topbar BYOK model dropdown) is deleted: in compact mode it would
re-capture the identical popover as `:141`, which is a duplicate screenshot
rather than coverage. `:141` absorbed its guard.
`:244` (avatar reasoning readout) turned out never to have passed — not a #6156
casualty. `VISUAL_CLI_AGENTS`' codex entry declares `models` only, while
`AvatarMenu` draws the readout solely for agents reporting `reasoningOptions`, so
it has been red since `68cecac1c` authored it. Fixed by declaring
`reasoningOptions` on a test-local codex fixture, matching what the real daemon
reports (`apps/daemon/src/runtimes/defs/codex.ts:164`).
Nothing was dropped without a verified live home elsewhere in the same CI lane
or in Vitest: the AMR plan/balance/upgrade card at `visual-settings.test.ts:30`,
the searchable dropdowns at `visual-settings.test.ts:93`/`:156`, the upgrade
attribution URLs in `InlineModelSwitcher.test.tsx:585` and
`AvatarMenu.test.tsx:283`, the "no account row" invariant at
`AvatarMenu.test.tsx:528`, and real staged-context chips in
`project-management-flows.test.ts`. The one assertion with no surviving home is
the Open-Design-first agent ordering, whose grid no longer renders anywhere;
that is called out in the test comment rather than silently lost.
* test(e2e): give the AMR upgrade capture a billing-capable workspace
`settings-agent-card-amr-upgrade` stopped rendering for this capture because
`amrCardCanUpgrade` (SettingsDialog.tsx:4651) now also requires
`workspaceContext?.permissions?.canManageBilling` — this branch's
workspace-scoped billing work, i.e. the feature #6142 exists to ship. The gate
is correct; the fixture was not representing anyone entitled to pass it, since
`mockSignedInVelaAccount` establishes a Vela session but no workspace context.
Stub `/api/workspace/context` with a personal-owner context inline in this one
test rather than widening `mockSignedInVelaAccount`, which visual-workspace
shares. The assertion is unchanged — the upgrade entry is a real capability for
billing-capable members, so the fixture represents one instead of the assertion
being relaxed.
Verified the stub does not quietly satisfy the three assertions that already
passed: `planId: null` keeps `resolvePlanTier` falling through to `plus`, and
billing still 404s so the balance stays `$247.51`.
Expect one legitimate baseline diff on `visual-settings-open-design-account`:
the rail now renders signed-in workspace chrome, which is the only state in
which the upgrade entry exists at all.
* test(e2e): leave projects through shipping chrome, and reach /projects reliably
Two dead locators and one under-budgeted wait, all test-side.
`openNewProjectModal` (rail.ts) probed `entry-nav-new-project` then
`entry-nav-projects`, both deleted from EntryNavRail by the #5517 redesign
(`b55f17169`, `f16075f7e`) — `onNewProject` is still destructured there but has
zero call sites. Its body is byte-identical to main, where both testids exist, so
main takes the rail path and never reaches the fallback this branch always hits.
The live affordance is `designs-new-project` / `designs-empty-new-project` in
DesignsTab, inside `entry-view-projects`; `/projects` has no UI entry at all
(entry-chrome-flows:373-382 already documents that and routes directly).
The fallback then failed for a second reason: `entry-view-projects` does ship
(EntryShell.tsx:1579) and `/projects` does route to it, but it was asserted on
the 10s default budget right after `waitUntil: 'domcontentloaded'`. `apps/web`
mounts `src/App` via `dynamic(..., { ssr: false })`, so domcontentloaded fires
while only the boot shell exists — every suite that does this correctly waits out
`Loading Open Design…` with `T.long` first. Now routed via
`history.pushState` + `popstate` (the client router listens) instead of a full
reload, boot shell waited out, and both the view and the create button given
`T.long`.
`ensureRailOpen` was also called unconditionally, but it ends in a hard
`expect(workspace-home-rail-toggle).toBeVisible()` and that testid only renders
for `isPinned && active` (WorkspaceTabsBar.tsx:1474-1510) — from inside a project
it does not exist, so the helper hard-failed on a control this flow never needed.
Now best-effort and gated on `.entry`, kept only so the
`visual-new-project-modal` baseline does not churn.
`real-daemon-run.test.ts:547` hung on `/back to projects/i`, which matches
nothing on a project surface: `AppChromeHeader` owns that aria-label but is no
longer mounted anywhere, and ChatPane's top-left slot resolves
`onCollapse ?? onBack` while ProjectView passes both, so it is always
`chat-collapse-toggle` (deliberate, `884ed1085`). Replaced with a local
`leaveProjectForEntry` that clicks the pinned entry tab — the shipping way out —
so the isolation journey still leaves through real chrome instead of a URL jump.
Dropped `getActionablePoint` with its only consumer. Removing the reload from
~25 call sites across 15 suites was audited against the stub-order-sensitive ones
(settings-media-providers, new-project-ds-picker-*, api-empty-response,
visual-entry); all install routes before their first navigation.
Correcting my own earlier misattribution: `.ws-tab` / `.ws-tab-label` are
FileWorkspace's in-project file strip and are fully intact, `role="tab"` and
file-name labels included. #6156 rewrote WorkspaceTabsBar, which renders
`.workspace-tab` / `.workspace-tab__label` — a different component. Upload→tab is
also intact (`FileWorkspace.uploadFiles` still calls `openFile`). Five of those
six failures merely routed through the broken helper above; the sixth was the
dead back-button. No `.ws-tab` assertion was rewritten.
* fix manual edit across workspace pages (#6160)
* fix(collab): keep process-local presence alive when the collab transport is off (#6170)
`createVelaCliCollabClientFromEnv` returns `null` unless the run opted into
the vela-cli collab transport, but `server.ts` wired the presence routes with
an object literal of arrow functions closing over that client. A literal is
unconditionally truthy, so `registerCollabPresenceRoutes` always saw a `cloud`
dependency: its `deps.cloud ?? null` could never resolve to `null`, the
process-local `presence.present()` fallback became dead code, and every
presence request that reached the cloud branch dereferenced `null` and was
answered `502 collab_presence_unavailable`.
`POST /api/projects/:id/presence/leave` carries no shared-project
precondition, so it failed on any project id in any run without the
transport — every stable/prod packaged build (the packaged workspace-team env
is gated to the `feature-test`/`test` AMR profiles) and every plain
`tools-dev` run. `server.ts` is `@ts-nocheck`, so the null dereference was
invisible to `pnpm typecheck`.
Route the dependency through `createCollabPresenceCloudClient`, which lives in
the checked route module and states the invariant: a `cloud` dependency exists
if and only if a transport exists. Removing its guard is now a typecheck
error, so the bug class cannot come back at the construction site even while
`server.ts` stays unchecked.
* fix(web): scope desktop vibrancy to macOS (#6171)
* fix(web): remove the theme setting and force every install back to light (#6168)
Product removed theme selection: the workspace surfaces shipped for team
workspaces have no dark tokens, so dark mode renders a broken app.
Deleting the picker is not sufficient on its own. Every install that ever
opened it still has `theme: 'dark'` — or `'system'`, which resolves dark on a
dark OS — persisted in localStorage, and a stored value does not move when the
default does. So the theme is now coerced on READ, at all three points a
persisted value can reach the document:
- `loadConfig()` funnels `parsed.theme` through `resolveAppTheme()` and marks
the config migrated so the coerced value is written back once.
- `applyAppearanceToDocument()` stamps `data-theme="light"` unconditionally.
The attribute must be PRESENT, not merely non-dark: every dark CSS rule is
gated on `html:not([data-theme])` / `html:not([data-theme="light"])`, and
every JS theme reader (shiki, ConnectorLogo, SketchEditor, TerminalViewer,
connectorBrandColor, MentionNode) falls back to `prefers-color-scheme` only
when the attribute is absent.
- The pre-hydration inline script in `app/layout.tsx` stamps light before React
mounts, outside its try/catch so a throwing storage read still leaves the
attribute set.
Electron's `themeSource` defaults to `system`, which colours everything the web
layer does not own (macOS vibrancy glass, native menus/dialogs) on a dark-mode
Mac — including the splash, before the renderer's appearance IPC lands. It is
now pinned to light before the first window exists.
Removed surfaces:
- `AppearanceSection` in SettingsDialog, orphaned by #6156 (zero call sites),
together with its `settings-general-block--appearance` styles. Its docblock
claimed the control was "deliberately kept … NON-ALIGNMENT #9"; that decision
is superseded, so the comment goes with the code.
- The onboarding welcome page's sun/moon toggle — the last reachable theme
writer — and the `onThemeChange` prop chain behind it
(App → EntryView/ProjectView → EntryShell → OnboardingView).
- The orphaned theme row in EntrySettingsMenu and its styles.
- i18n keys `settings.appearance`, `settings.appearanceHint`,
`settings.themeSystem`, `settings.themeLight`, `settings.themeDark` across
`types.ts` and all 19 locales.
- Analytics `trackSettingsAppearanceClick`, `SettingsAppearanceClickProps`, and
the `settings_popover` `appearance` element.
`'appearance'` survives only as a legacy settings deep-link token that
`normalizeSettingsSection` folds into General, so an old link is not a type
error.
Red-first: tests/state/force-light-theme.test.ts and
tests/components/theme-settings-removed.test.tsx were written against the
unmodified branch and went red (11 failing) before any source change.
* fix(web): make the update surfaces read real data (#6163)
* fix(web): make the update surfaces read real data
#6156 (4e3161751) shipped two update surfaces whose every field was
invented. `EntryShell` held a private `updateReminderStage` machine keyed on
a literal `'1.4.6'` (the app ships 0.16.1), the rocket's confirm ran a 200ms
`setInterval` easing a fake bar toward 100% and then wrote "updated" to
localStorage, and the cover dialog listed three hardcoded English notes past
i18n over a committed 432 KB JPEG. Nothing in that path made a single
network, IPC or daemon call — a user who clicked "立即更新" watched a
progress ring finish and got no update.
Both surfaces now sit on the real machinery that already existed:
The cover dialog becomes the post-update highlights surface and REPLACES the
bottom-right `WhatsNewPopup` card rather than coexisting with it. Cover art,
release headline, bullets and link all come from the hosted highlights
document via `/api/whats-new`; the title states the running version from
`useAppVersion()` (`/api/version`). It keeps that card's show gate verbatim —
once per highlight `id`, only with content, only on the home surface after
the app returns on a new version — and its existing analytics
(`whats_new_popup` surface-view / click). Its footer is close + open-release;
there is no "cancel / update now", because reporting what already shipped is
all this surface does. Bullets come from a new `whatsNewNotesFromBody`, which
splits the document's `body` per line and strips operator list markers.
The rocket keeps its look and becomes the real updater's ready indicator in
the bottom-left rail footer, replacing that indicator's arrow glyph. It is
gated on the updater's own `shouldShowControl` (installer downloaded and
never opened, desktop only) and still drives `openUpdaterInstaller` →
`quitAfterUpdaterInstallerOpen` through the untouched panel, watchdog and
restart-safety preflight. The progress ring and percent face are gone on
purpose: the indicator only exists once the download has finished, so any
percentage it drew would be invented.
Deleted: `lib/update-reminder.ts`, `UpdateReminderDialog.tsx` and its module
CSS, `public/update-reminder-cover.jpg`, the now-dead
`entry-updater-menu__button/__glyph/__progress` rules, and the unused
`accountNotice` rail slot. The three `updateReminder.*` i18n keys and the
orphaned `whatsNew.dismissAria` are replaced by one `whatsNew.updatedTitle`
across all 19 locales.
A source-level guard (`tests/update-surface-real-data.test.ts`) pins the
invariant that outlives the deletion: no quoted `x.y.z` and no `setInterval`
in the update surfaces, and the placeholder module and cover art stay gone.
* fix(web): name the release-notes destination on the what's-new CTA
Product review of the five open calls closed all five; only the CTA copy
changes. The button opens the release notes, so it now says so —
「查看更新说明」 in Chinese (product's wording, verbatim), with the other 18
locales aligned on "view the release notes" instead of inheriting the old
"see what's new" tease. `whatsNew.cta` had exactly one consumer left (the
dialog) once it replaced the bottom-right card, so the key is repurposed in
place rather than forked.
The other four calls were approved as implemented, and two of them overturn
conventions the old comments still asserted, so those comments are synced:
- `lib/whats-new.ts` documented the toast's deliberate Escape exemption
(Escape hid the card WITHOUT spending the highlight). As a focus-trapping
modal that exemption is retired — every close path marks seen — and the
docblock now says which paths and why.
- `contracts/api/whats-new.ts` described `title` as generic copy, `imageUrl`
as an image "beside the copy", `body` as prose, and `linkUrl` as the "See
what's new" link. The dialog reads them as headline / top-inset cover /
one-bullet-per-line / release-notes link, so each field now documents the
role it actually plays. Comment-only; no shape change.
* fix(web): never state the placeholder version on the what's-new dialog
Review catch (nettee, #6163): `useAppVersion()` reads /api/version at runtime,
so it necessarily boots on `APP_VERSION_PLACEHOLDER` and resolves a round-trip
later. This dialog rendered as soon as /api/whats-new resolved and printed the
hook unconditionally — so a highlights fetch that won that race painted
"Open Design 0.0.0 is here" on first frame. An invented version string, on the
one surface this PR exists to make truthful. The new suite could not see it
because it mocked the hook to an already-resolved value.
Fixed by falling back rather than gating the whole render: gating would delay
the dialog behind a second round-trip on slow networks, while the highlights
document already carries the running version in its `version` field — the
daemon stamps it for display (see contracts/api/whats-new.ts), which is what
fed the old bottom-right card's eyebrow. So `statedAppVersion()` prefers the
resolved hook, falls back to the document, and returns null when neither can
name one; on null the dialog waits, because highlights are worth nothing under
a headline that lies. The same derived value feeds the title AND every
`app_version` prop, so analytics cannot ship the placeholder either.
`APP_VERSION_PLACEHOLDER` moves out of ./provider into a new leaf
analytics/app-version.ts alongside an `isResolvedAppVersion()` predicate, so a
surface that must not PRINT a placeholder can test for it without importing the
analytics client. The provider keeps its own use of the constant.
Regression tests, red before this commit (`.red-evidence-version-race.txt`
reproduces nettee's exact string, `expected 'Open Design 0.0.0 is here…' not to
contain '0.0.0'`): the placeholder never paints while /api/version is in
flight, it never reaches the surface-view analytics, the title switches to the
running version once the hook resolves, and a document with no usable version
waits instead of inventing one. The suite's provider mock is now a mutable
holder so both sides of the race are reachable.
Also caught by this PR's own source guard: quoting the literal in a docblock
tripped it, so the comment names the constant instead.
* test(e2e): unmask the AMR runtime lane and repair the visual settings/workspace captures (#6174)
Three fixture defects, each verified by running the lane rather than reading it.
- amr-run-failure-recovery.test.ts was still `mode: 'serial'`. A second
`describe.configure({ timeout })` cannot clear it — configure only
overwrites the keys it is given — so one failure skipped the eight cases
behind it and the lane reported them as "did not run". e2e/AGENTS.md
forbids serial groups outright.
- configureVisualPage's `**/api/**` catch-all (added by #6126, which is on
main) answered `/conversations` with 404. ProjectView mounts ChatPane only
once a conversation resolves, and both listConversations and
createConversation swallow a non-ok response, so the project opened with no
conversation and no error, ChatPane never mounted, and every capture that
enters the workspace died on `chat-composer` not existing. Supplies the
conversation boundary the catch-all closed without replacing.
- The BYOK tab is named "API providers" since #5971 renamed
`settings.modeApiMeta`; `getByRole('tab', { name: 'BYOK' })` matched
nothing and three captures hung until the test timed out. The topbar BYOK
capture also left `[MOCK_AGENT]` installed, contradicting its own "a BYOK
config has no local agent" premise: an installed agent wins the popover and
renders its model radiogroup instead of the BYOK rows.
Co-authored-by: lefarcen <ontf116@gmail.com>
* Home shell productization batch: message center, What's-new on release data, update-reminder & updater popup restyle (#6162)
* UI polish batch: import-dialog cleanup, settings toast placement, tab chrome fixes
- Plugin/skill import dialog: drop per-card icons, left-align card content
- Settings page: center the autosave pill under the top nav
- Avatar model menu: soften the pinned footer divider
- Workspace tabs: pinned entry tab always reads as Home; remove tab-search
button and its popover
- Model picker: wider row gap in the two-pane browse popover
- Community header: unpin (scrolls with content)
- New update-reminder dialog assets and strings
- Keep entry-settings-button as the signed-out settings entry (e2e contract);
align NextStepActions with the navPlugins key rename
* Update reminder: simulate in-place download progress instead of linking out
The strip's confirm now runs a staged progress state ('updating') with an
eased fake download bar, then marks the version updated — replacing the
jump to the GitHub releases page.
* test(web): retire AvatarMenu account-row suites after the popover simplification
The composer popover was reduced to a model picker (2026-07-24): the Open
Design account row — plan badge, balance, wallet fallback, upgrade/console
links — no longer renders there, so the nine suites asserting that surface
(including the workspace-balance and billing-permission gates that landed
upstream meanwhile) can no longer pass. Drop them and recast the remaining
account-row test as the guard for the new invariant: a signed-in AMR status
must render no account UI in the popover.
Also drop the stale onClose prop from the new upstream sign-out-confirm
test; the rail no longer takes one.
* Design-systems toast: anchor to the pane's top edge, pill radius
* Update reminder strip: progress ring on the button, percent face
While updating, the collapsed strip no longer stacks a label + bar above
the rocket button. Progress draws as a brand-green ring hugging the round
button's edge (5px band reserved so the button never shifts), and the
button face swaps the rocket for the bare percent — 'N%' while
downloading, 完成 (updater.done) at 100. The full 正在下载更新 N% label
stays reachable via the hover bubble and the ring's aria-label. Demo
payload version bumps to 1.4.6 so the once-per-version card re-arms.
* Home shell productization batch: message center in the account menu, What's-new on real release data
- Message center: entry moves into the account menu under 设置 (bell row);
MessageCenter becomes controllable (hideTrigger + open/onOpenChange +
onUnreadCountChange) and mounts persistently in EntryNavRail so unread
polling survives the hover menu; unread shows as a red dot on the account
avatar (and on the menu row); avatars go from squircle clip to 8px rounded
squares; panel filter segmented control and mark-all-read go pill-radius.
- What's-new: the post-update highlights card now wears the shared
release-dialog shell (cover / title / dotted notes / pill footer) while
keeping its REAL /api/whats-new data source, show-once-per-id timing,
soft-hide Escape/backdrop semantics, and analytics. The demo-payload
update-reminder dialog and its simulated download no longer trigger; the
stage machine and progress strip stay for the real updater-feed wiring.
- Rail chrome: brand logo and the in-rail collapse control are gone — the
rail starts at the search box and folding lives in the pinned Home tab's
toggle; the signed-out cloud tip bottom inset now matches its sides.
- Brand picker (modal variant): side-nav split — search + vertical category
nav left, a roomy 2-up borderless gallery right, content flush to the
column line with hover fill/ring bleeding past it; logo tiles lose their
boxed edge; selected template chip and the composer mode pill share the
same selected ring, with the mode glyph optically matched at 13px.
- Tab launcher: rows are icon + label only (descriptions dropped) with a
rotating four-hue icon palette; the 新建空白页面 entry is paused behind
ENABLE_BLANK_PAGE_WORKSPACE_ENTRYPOINT and its PageCreator suites skipIf
on the same switch.
- Move-to-team confirmations: extracted MoveToTeamConfirmDialog, no backdrop
blur (dim only), and the confirm keeps its brand-green label through the
mention-home ink-pill restyle in every interaction state.
- Publish CTA: hover inverts to ink fill with brand-green icon + label.
- Plus assorted in-progress workspace polish (composer, viewer, settings,
model icons) riding the same branch iteration.
* Restyle the updater ready popup to the update-reminder dialog language
Cover art on top (compressed 1296x555 jpg, natural aspect), the orange
accent icon tile removed, secondary action as a soft white pill and the
install CTA as a black pill with brand-green ink, and a stacked footer so
the silent-update checkbox keeps a full-width single line instead of
wrapping beside the widened pills.
* Signed-out rail: message-center entry under 设置
The signed-out rail has no account menu (where the 消息中心 row lives when
signed in), which left the message panel with no opener at all. The rail
item carries the unread dot.
* Composer row: pin chip glyphs against flex shrink
The row-wide min-width: 0 that lets chip labels ellipsize also let SVG
glyphs absorb the squeeze — a hard-narrowed pane rendered the design-system
palette icon tiny. Chips still shrink; their icons keep natural size.
* Bind Community Remix projects to the current workspace
Addresses mrcfps' review thread on apps/web/src/App.tsx:3303.
Product reproduction: 「通过 remix 后的方案, 不出现在我当前 workspace 里的
草稿了」 — stable repro in a team workspace.
`duplicatePluginAsProject` only sends the workspace/member identity headers
when its third `workspaceContext` argument is supplied, and the daemon's
`authorizeCreatedProjectWorkspace` deliberately reads a COMPLETELY headerless
create as a legal legacy/anonymous caller — `bindCreatedProjectToWorkspace` is
a no-op for a null context. Both remix call sites this PR adds (App.tsx's
standalone /community branch and EntryShell's community tab) omitted the
argument, so a remix performed inside a team workspace produced a project
bound to no workspace at all and therefore invisible to every workspace view.
Same enforceWorkspaceProjectMutation / created-project bypass class as
c0bce3b8f, fixed the same way: thread the already-resolved workspace context
that both files already hold, through the repo's existing
`resolvedWorkspaceContextForWrite` seam so an unresolved or unavailable
authority fails closed instead of silently creating an unbound orphan.
The second half of the review note — the follow-up `patchProject` whose `null`
was ignored — was a consequence of the same root cause: with the project
unbound, `enforceWorkspaceResourceMutation` finds no workspace row for the
caller's workspace and 403s the pendingPrompt seed, so the template prompt was
dropped too. Both requests now share one resolved authority, so they can never
disagree about which workspace they are acting in, and a still-null result is
reported instead of swallowed (without creating a second project, which is what
routing it through the existing catch would do).
Red spec first: apps/web/tests/components/community-remix-workspace-binding.test.tsx
drives both call sites in a team workspace against a fetch stub that reproduces
the daemon's create-then-bind contract. Red before this change (the create
carried no workspace headers, the project stayed unbound, and the seed PATCH
403'd), green after.
* Cover the refused-prompt-seed branch of the Community Remix fix
Second half of mrcfps' review ask on the same thread: prove what the flow does
when the follow-up `patchProject` still returns null after the binding fix.
The remaining null shapes are genuine transient refusals (daemon down,
membership revoked mid-flight, workspace locked between the two requests). By
then the copied project is real and bound, so the flow deliberately does NOT
fall into its own catch — that path creates a second, prompt-only project and
would strand the copy. It keeps the user on the remix and reports the dropped
seed. This case pins that: user lands on the remixed project, no second project
is created, and the failure is surfaced rather than swallowed.
* Re-anchor three style specs on the dogfooded UI
`Web workspace tests` went red on this branch because three CSS specs still
described the pre-dogfood layout the restyle replaced. Each one is re-pointed at
what shipped, keeping the invariant it was written to protect:
- `acceptance-visual-fixes` (recvpYDfW12NBu): the preset-thumbnail fix is the
resting `scale(1.15)` framing transform, which is intact. Its hover partner
went away with the family-wide cover-zoom removal (2026-07-27), so the spec
now asserts the framing zoom on both media surfaces and separately locks the
hover rules out — re-adding one would resample the covers soft again.
- `mention-popover`: the filter strip scrolls on one line instead of wrapping to
a second row. The "no clipped labels" half of the contract is unchanged and
still asserted (pills hold natural width, labels stay `nowrap`).
- `settings-polish`: the updater popup footer stacks the silent-update checkbox
above a 50/50 action row. Long en labels must still wrap inside the checkbox
column rather than overflow the panel, which the spec keeps checking.
* Return message-center focus to the rail opener that owns it
`hideTrigger` handed the message-center entry point to the rail but left the
component's internal `triggerRef` unattached, so `closePanel()` restored focus
to nothing. Opening focuses the portaled dialog, so every close — button,
backdrop, Escape, notification-settings — unmounted the focused node and dropped
keyboard focus to the document. Both external openers also failed to advertise
the dialog they own.
`MessageCenter` now takes a `returnFocusRef`: the host that hides the built-in
bell owns the duty that button used to serve. `EntryNavRail` points it at a
control that is still mounted after the close — the account trigger on the
signed-in branch, because the hover menu unmounts the 消息中心 row before the
panel opens, and the rail item itself when signed out. Both openers carry
`aria-haspopup="dialog"` and the live `aria-expanded`.
Red first: `EntryNavRail.message-center-entry.test.tsx` opens from each entry,
closes with Escape and with the close button, and asserts focus lands back on
the host control. All four cases failed before this change.
* Carry the menu popup contract onto the composer quick pills
The 插件 / 设计百宝箱 pills open the standalone `role="menu"` popovers in
ChatComposer, but they arrived without the contract of the ComposerPlusMenu rows
they replaced: no `aria-haspopup` / `aria-expanded`, no Escape handler, and no
focus return. Keyboard and screen-reader users could not tell a popup was open,
and Escape pressed while focus sat in the plugin search did nothing.
The pills live in ChatPane while the popovers live in ChatComposer, so the state
is plumbed both ways rather than duplicated:
- `onStandalonePanelChange` reports which popover is open, and each pill carries
`aria-haspopup="menu"` plus its own `aria-expanded` — the same pair
`ComposerPlusMenu` already puts on its trigger. No `aria-controls`: that
surface does not use one, and this is not the place to invent a second
convention.
- `openDesignToolbox` / `openPluginsPanel` take the opening pill as the
return-focus target. Both popovers move focus inside themselves, so a
dismissal has to hand it back, and the pill is the control the user came from.
- Escape closes through a document-level handler, mirroring ComposerPlusMenu's.
`dismissStandalonePanels` is deliberately only wired to the dismissal paths
(Escape, backdrop). Picking a plugin or an action keeps the plain setters,
because those hand focus to the composer input and pulling it back to the pill
would fight that.
No interaction changes: hover-open, the shared close timer, pill-to-popup
pointer travel and every selection path behave exactly as before.
Red first: `tests/components/ChatPane.quick-pill-popup-contract.test.tsx` runs
both pills through advertise / expand / Escape-from-inside / backdrop-dismiss and
asserts focus lands back on the pill. All six cases failed before this change.
---------
Co-authored-by: lefarcen <935902669@qq.com>
* Converge the visual Design Files prelude instead of clicking once (#6181)
`Playwright visual (settings-workspace)` went red on `[P2] captures the settings
BYOK surface` with a 10s `aria-selected` timeout: the Design Files tab sat at
`false` for all 23 polls with nothing re-clicking it. Seven other captures run
this identical prelude and passed, including the two neighbouring BYOK cases.
The defect is in the oracle, not the product. `prepareVisualWorkspaceFileList`
decided **once** whether to click — one instantaneous `isVisible()` probe of a
file row — and then asserted a state nothing retries. Any interleaving where the
workspace's own tab reconciliation lands around that single click leaves the
assertion permanently unsatisfiable for that attempt, and the lane runs
`OD_PLAYWRIGHT_FULLY_PARALLEL=1` with `retries: 0`, so it reports as a hard
failure rather than a flake.
`activateVisualDesignFilesTab` now converges on the goal state via `toPass`,
driving off `aria-selected` directly rather than through the file-row proxy —
the guard and the assertion were about different things even though
FileWorkspace derives both from one `activeTab === DESIGN_FILES_TAB` expression.
Repeat clicks are safe: the tab's handler is `setPersistedActive(DESIGN_FILES_TAB)`,
which is idempotent.
Why this is not a product regression from #6162: nothing in it touches tab
selection, tab persistence, or row visibility. Its only `design-files.css` change
deletes the hover cover-zoom, which cannot affect visibility, and a diff of
`apps/web/src` for `localStorage|activeTab|openTabs|restoreTab` comes back empty.
The lane's one green run before this failure (`4a6653186`, the #6174 repair of
the unrelated #5971 BYOK rename) is the whole basis for calling the baseline
clean.
Scope is the visual lane only — every caller is in `visual.ts` or
`visual-*.test.ts`, so the UI P0 lanes are untouched.
* fix(web): explain the AMR workspace-scope block instead of a dead send button (#6178)
An Open Design Cloud project run requires a resolved personal/team workspace
authority (21f452ffe). Failing closed there is correct and stays. Failing
closed SILENTLY was the bug: the send button went grey with no reason on
screen and no way out, while Home's equivalent dead end
(checkAmrBalanceGate -> AmrBalanceDialog reason `signed_out`) hands the user
an in-app sign-in. e2e/ui/amr-logout-requires-relogin.test.ts exists to
protect exactly that route, which a disabled composer can never reach.
Adds a classifier (`amrWorkspaceScopeBlock`) that turns "gate closed" into
the remedy that clears it, and a composer-adjacent notice that renders it:
signed_out — the same AmrLoginPill action and `chat.amrBalanceGate.signInCta`
copy Home's balance gate uses, so one identical action clears it from
either surface.
unresolved — a re-read of the project's workspace authority, exposed as
`ProjectWorkspaceScopeState.revalidate`. An account action would be a guess.
The gate itself is untouched: `projectRunWorkspaceScopeReady` never consults
the classifier, and the `disabled: true` invariant stays asserted.
* test(updater): join the installer-reinstall floor across release and client (#6167)
* test(updater): join the installer-reinstall floor across release and client
A payload update never replaces the Electron outer shell, so a release whose
shell changed can only reach an old install through the installer. The
`control.launcher.version.{min,url}` floor is the one mechanism that forces
that, and it spans three owners: tools/release resolves the channel policy,
the feed carries it, and the desktop updater enforces it against the
physically installed outer version. Every side had unit coverage; nothing
joined them, so the only place a break in the chain would surface was a
release publish.
Adds six specs to the already-allowlisted packaged-launcher cross-boundary
suite, driving the real release-side resolver into a real feed and then into a
real packaged update check:
- an outer below the floor takes the installer, not the payload, and the
launcher pointer proves nothing was adopted;
- the floor is judged by the installed outer rather than the payload it is
running (two installs on the same payload, only the stale shell diverted);
- an unreadable installed outer fails closed as `outer-version-unreadable`
with no installedVersion to render;
- a launcher schema beyond this client diverts on the ABI axis alone;
- with no floor configured a below-floor outer still swallows the payload,
which is why a shell-changing release must set the repo vars deliberately;
- a floor above the release version stays refused.
Falsifying `remoteRequiresReinstall` to compare against `config.currentVersion`
-- the semantics the released 0.15.1/0.16.1 shells actually ship -- turns two
of these red, including the unreadable case being mislabelled as below-min.
Also pins the floor's operational shape against real channel version formats:
a bare stable floor sorts above every same-base `-beta.N`/`-preview.N`/
`-prerelease.N`, so inheriting it into those lanes hard-fails their publish.
The specs name that trap and pin the one-explicit-pair-per-lane configuration
that avoids it.
* test(updater): drive the reinstall floor on Windows too, off the real outer
Review (nettee) caught these specs running macOS only: the feed described
`platforms.mac`, the payload writer built a `.app`, and the updater config was
pinned to arm64/darwin. So `resolveInstalledOuterVersion`'s Windows branch —
`dirname(launcherLaunchPath)/resources/open-design-config.json`, a different
lookup from the mac bundle path — and the `installer` artifact shape never ran.
Since the installs most exposed to a shell/payload mismatch are the oldest ones,
leaving Windows uncovered left the half most likely to break unguarded.
The specs now run through `describe.each` over a per-platform target table
carrying the launch-path shape, outer-config location, installer artifact key,
and payload extractor.
They also stop using `OD_UPDATE_INSTALLED_VERSION`. That override returns before
the platform branch it was supposed to exercise, so it was masking the code under
test. Each scenario now materializes a real installed outer package at the real
per-platform location and lets the updater read the version off disk — which
also makes the unreadable-outer case genuinely unreadable rather than simulated.
Falsifying the Windows lookup (collapsing it into the macOS path) fails exactly
the two Windows specs that depend on reading a real installed version, while all
twelve macOS and publication-policy specs stay green.
* fix(web): partition the workspace plan nameplate like the wallet (#6182)
A workspace Vela Web shows as 免费 rendered as 专业版 Plus in the client's
account menu, while the 额度 row in the same card correctly read $0.00.
Money and plan travelled different paths. `GET /api/workspace/billing`
returns three independently scoped things, and only two of them are about
the workspace: `workspaceBalance` / `workspaceSnapshot` are proven for the
exact workspace + member, while `summary` is the caller's VELA ACCOUNT
billing (`workspaceId: null` by contract; the daemon reads it with one
unscoped `fetchBilling()` regardless of `?workspaceId=`). The rail's plan
nameplate read `response.summary` raw, so an account holding a personal
Plus reported `plus` in every workspace — a value that cannot change when
the workspace changes, because it was never about the workspace.
`workspaceBillingSummaryForContext` makes the partition key explicit, the
same `workspaceId` + `workspaceMemberId` pair money already uses:
- personal workspace — the account IS the scope, summary passes through;
- team workspace — plan comes from the context-authorized snapshot, and
the account tier may stand in only when it is itself team-namespaced,
since a personal tier cannot name a team workspace's plan.
That last clause keeps the 飞书 P0 fix intact: B omits planId/billingState
for a non-owner and `workspaceSnapshot` is an additive capability, so a
team-namespaced account tier is the only surviving evidence that a paying
MEMBER's team is subscribed.
`useWorkspaceBilling` is now this projection over the ambient context, and
EntryShell / SettingsDialog consume it instead of the raw summary. No
interaction, layout, or copy changes.
* Revert "fix(web): explain the AMR workspace-scope block instead of a dead send button (#6178)" (#6184)
This reverts commit ea259eb402.
* fix(daemon): resolve an unbound project against the caller's current workspace (#6185)
* fix(daemon): resolve an unbound project against the caller's current workspace
Every project must resolve to a workspace; when the project itself has no
binding, the workspace is the one the caller is currently acting in. There is no
other candidate.
`GET /api/projects/:id/workspace-scope` read only the persisted
`workspace_projects` row and the membership directory — never the request's
`x-od-workspace-*` identity — so a project with no row answered `unbound` for
every caller forever. `unbound` makes `projectWorkspaceScopeAuthorizesAmr` false,
which disabled the chat composer's send button for an Open Design Cloud run on
that project permanently, with nothing the user could do to clear it. #6178 wrote
user-facing copy for that state instead of fixing it (reverted in #6184).
`resolveProjectWorkspaceScopeForCaller` wraps the existing resolver instead of
branching inside it, so `resolveProjectWorkspaceScope` stays byte-identical and
the bound path is provably untouched. The fallback re-enters that resolver with a
synthetic binding naming the caller's own workspace, so the resulting
`workspaceMemberId` comes from the membership directory and never from the
request header: a caller can only select among workspaces their signed-in
identity is genuinely an active member of, and anything the directory cannot
confirm degrades back to `unbound` rather than to `unavailable` on a workspace the
project was never bound to.
Two cases keep today's behavior, both pinned by spec:
unavailable — all three of its return sites. A project pinned to workspace X
read by a member of Y answers X. The scope carries `workspaceMemberId`, the
wallet that pays for the project's runs; resolving to Y would bill Y for X's
project. Reachable because `GET /api/projects/:id` has no workspace gate, so
a deep link or a workspace switch lands there.
no caller identity — signed out, or a plain curl, has no current workspace to
fall back to, and inventing one is worse than answering "none".
The fallback deliberately does not persist a binding.
`reconcileUnboundProjectBeforeMutation` was the preferred shape going in and is
wrong here: its own docblock is explicit that a passive read must not hand out
ownership just because it ran first, and this endpoint is a GET. Writing a row
from it would let whichever workspace opened the project first claim authorship
on no user intent, and would race two clients in different workspaces.
* fix(web): stop pre-emptively blocking an AMR send that has a wallet
An Open Design Cloud run is billed to the CALLER's own wallet, so the only
defensible client-side veto is "there is no billing principal at all". The gate
instead required THIS PROJECT's workspace scope to resolve, and blocked the send
whenever it did not: an unbound project, a membership-directory read that
transiently failed (offline / 504 / timeout all collapse into one `ok: false`
upstream), a workspace that is billing_past_due or locked, or a team the caller
has since left. In every one of those the user is spending their own quota.
It is also not the enforcement point. Real enforcement is server-side — the
daemon's `WORKSPACE_CONTEXT_REQUIRED` 401 plus vela's own billing check. The
client gate could only convert a request the server would have answered into a
dead, unexplained button, which is strictly worse than an honest server error.
It arrived as 21f452ffe, whose entire message is "fail closed on unresolved
workspace authority" with no body and no stated product requirement.
`workspaceIdentityCanBillAmr` names the invariant on the identity read, and the
gate now admits either witness of a billing principal: that identity, or a
project scope that already resolves to an explicit personal/team principal.
Strictly a widening — every state it newly admits was previously blocked, and
nothing previously admitted becomes blocked.
Deliberately NOT treated as "no wallet":
loading — the identity read holds no answer yet. Reporting "signed out" on a
frame that has not heard back is the bug shape this replaces.
failure 'unavailable' — a transient outage taught us nothing about the user.
failure 'unsupported' — an old daemon with no workspace endpoint keeps its
legal pre-workspace behavior.
A genuinely signed-out caller — a settled, authoritative read that came back with
no workspace — stays blocked: there is no wallet, so the run cannot be billed and
cannot succeed.
No UI, no notice, no copy: #6178 wrote copy for this dead end instead of removing
it, and #6184 reverts that. This removes the dead end.
* fix(web): point every console entry at /dashboard, drop the wallet target (#6165)
* fix(web): point every console entry at /dashboard, drop the wallet target
Product ruling: there is no wallet page in the console's information
architecture any more. Balance, manual top-up and the auto-recharge policy were
all rehomed onto the console dashboard (vela #1055), so every entry that used to
open `/wallet` now dropped users on a surface the product no longer navigates
to.
Retargets all of them:
- `AMR_CONSOLE_URL` / `DEFAULT_AMR_RECHARGE_URL` and the per-profile console
map (prod / test / local) now resolve `/dashboard`, keeping the
`?source=open_design` attribution param.
- `teamConsoleUrl`'s `billing` section — the team account menu's 「额度 $0.00」
row — is a plain dashboard visit.
- `teamConsoleUrl`'s `plans` section, `amrPlansUrlForProfile` and
`amrPlansUrlForWorkspace` — the free-tier 「升级」 button and every other
Upgrade affordance — send `billing=plan` instead of the wallet page's
`view=plans`.
- `amrWalletUrlForWorkspace` is renamed `amrConsoleUrlForWorkspace` so the name
matches where it now points.
`billing=plan` is the console's one state-aware upgrade intent: its dashboard
resolves it against the workspace's real subscription state, so a personal owner
lands on the personal plan modal — the dialog the console's own 「升级订阅」 hero
button opens, which is what product asked the free-tier 「升级」 button to reach —
while a team owner still gets checkout or change-plan. The team `upgrade` section
keeps sending its more specific `billing=checkout` hint, but that is now only a
hint: powerformer/vela#1127 makes the console fall back to the dialog that
actually matches, so a stale `hasActivePlan` can no longer strand the user on a
bare Overview page (recvpSQKna0LwR).
Comments carrying earlier live-verification findings are updated wherever this
change invalidated them, rather than left contradicting the code.
No new user-facing copy, so no locale changes: the affected labels are all
action-named (「充值」/「升级套餐」), never destination-named.
* fix(daemon): retire the wallet target in the AMR recharge link too
The daemon builds its own recharge URL for AMR balance failures — it lands in
the failure message and in `actionUrl`, which the client renders as the chat
error card's clickable link — and it still pointed at the console's retired
wallet page. Same product ruling as the client-side retarget: balance and manual
top-up report on the console dashboard now (vela #1055), so this link has to go
there.
Every existing assertion in `vela-errors.test.ts` referenced the constant
symbolically, so all of them would have kept passing while the link sent users
to a surface the product no longer navigates to. Added one that pins the literal,
which is the red spec for this change.
Also retargets the two e2e assertions that pinned the old destination
(`e2e/tests/amr/insufficient-balance.test.ts` on the daemon's emitted URL,
`e2e/ui/visual-workspace.test.ts` on the avatar upgrade link's `view=plans`), and
the web-side fixtures that mimic the daemon's emitted string so they stop
documenting a URL it no longer produces.
* chore(release): bump feat/workspace-team to 0.16.2 (#6188)
The published beta feed is self-inconsistent: metadata.json carries
baseVersion 0.16.1 alongside betaVersion 0.16.2-beta.144, because
0.16.2-beta.144 was published with an explicit release_version override
while every manifest on this branch still said 0.16.1. Every subsequent
beta build now fails its own consistency check:
[release-beta] beta metadata.json baseVersion 0.16.1
does not match betaVersion 0.16.2-beta.144
`force` does not help — it only waives "base must exceed latest stable",
not the baseVersion/betaVersion match.
Raising the branch's base version to 0.16.2 makes the next beta
(0.16.2-beta.145) consistent with its own metadata, and removes the need
to pass force at all. Same 18 manifests the release bot touched in
23f9fcaac; test fixtures that mention 0.16.1 as data are left alone, as
that commit also left them.
Co-authored-by: lefarcen <ontf116@gmail.com>
* fix(collab): keep a project's "last changed" time out of sync's hands (#6189)
A member who opened the client hours later and pulled a shared project saw
「刚刚更新」 on a project nobody had touched, and the home 最近项目 strip kept
rendering the previous workspace's cards for a beat after switching workspaces.
Two independent defects, both reported by the product owner on a packaged
client.
1. `projects.updated_at` (and the `workspace_projects.updated_at` the project
list folds into it with `MAX`) is what the project card shows and what the
list sorts by, so it must answer "when did a person last change this
project's conversations, files, or name". Sync was answering it too:
`materializePulledTeamMirror` carried the origin's timestamp into the
project row but not into the binding it wrote in the same transaction, so
`MAX` surfaced the pull's own clock on EVERY pull. Four more sync writers
had the same shape. `SYNC_KEEPS_UPDATED_AT` names the invariant and the
sync paths now either carry the origin's time or keep the row's existing
answer.
2. A loaded project list describes exactly one workspace identity, so leaving
that workspace invalidates it. The re-list on switch runs in an effect —
after the commit — so the browser painted workspace A's cards under
workspace B's identity first. The list is now dropped during the render
that first observes the new scope, so no frame shows another workspace's
projects. No extra request: the refetch already existed and was already
keyed on the resolved workspace.
Co-authored-by: lefarcen <ontf116@gmail.com>
* fix(web): key every workspace read cache on who is asking (#6198)
`coalesced-get` and `shared-cancellable-get` are CACHES (1s share window), not
just in-flight dedupers, so a key that omits the caller's identity hands the
previous workspace's answer to the next one — and an in-flight entry is joined
with no window at all.
Three reads were keyed on a constant:
- `useTeamMembers` — `'workspace-members'`. `GET /api/workspace/members` answers
for whichever workspace the DAEMON is active in and reads nothing off the
request, so the roster is a per-workspace answer with no per-workspace URL.
A leaked roster renders the previous workspace's teammate name on project
cards (`RecentProjectsStrip.resolveCreator`). Now keyed on the workspace
identity, which also makes the hook re-read on a switch instead of waiting out
its 15-60s poll, and a late read for the identity the user left no longer
overwrites the newer roster.
- `useWorkspaceContext` — `'workspace-context'`. This is the read that
ESTABLISHES the identity, so it cannot be keyed on the identity it fetches and
has no workspace argument to borrow (the switch is a separate
`PUT /api/workspace/active`). It is keyed on the identity GENERATION instead:
one token per deliberate identity change, so a single broadcast heard by a
dozen mounted consumers still collapses to one request, while two switches
inside `forceCoalescedGet`'s 250ms burst window stop being mistaken for one.
- `useProjectWorkspaceScope` — `project-workspace-scope:<id>`. The scope carries
the `workspaceMemberId` that pays for the project's runs, so a shared key
serves one member the wallet of another.
The same read also fetched HEADERLESS, which made #6185's daemon fallback
unreachable: `GET /api/projects/:id/workspace-scope` resolves an unbound project
against the caller's current workspace, but only when the request carries the
caller's `x-od-workspace-*` identity. It now sends `workspaceProjectHeaders`,
the same set every other workspace-aware project read uses — and waits for the
caller's own identity to settle first, so a project open still costs one request
instead of a wrong headerless one followed by a corrected one.
* fix(collab): carry B's workspace name for personal workspaces too (#6199)
B names EVERY workspace, personal included: vela's CurrentWorkspaceContext
requires `workspaceName`, derives "«owner»'s workspace" for an unnamed
personal one (vela #964), and an owner may rename it outright.
The daemon read that field and then threw it away unless the workspace was a
team, because the only name on WorkspaceCollabContext was `teamName`. The
switcher's collapsed label therefore had nothing real to show for a personal
workspace and fell back to a hardcoded English "Personal workspace" until the
user opened the dropdown and the separate workspace-directory read landed.
Adds `workspaceName` to the context contract and carries it for both workspace
types, in the vela mapping and in the directory-item synthesis. `teamName`
stays team-only: it is the team switcher's field and doubles as an "is a team"
signal, so nothing may start reading it for a personal workspace.
The web side consumes the context the shell already holds at startup, so the
label is correct on first paint and NO new request is added — the diff adds
zero fetch call sites. The dev provider parses `workspaceName` too so the
dev/demo lane can drive a personal workspace's label the way B does.
Note this is not what the reported screenshot shows: there, B's real name for
that workspace IS the literal "Personal workspace", because an in-place team
upgrade flips the default workspace's stored type to 'team' and vela's
owner-derived naming then no longer applies. That half is upstream.
Co-authored-by: lefarcen <ontf116@gmail.com>
* fix(web): stop offering 升级 at the top plan tier (team_max) (#6205)
A 团队版 Max workspace is the top of the ladder — nothing is above it — but
both upgrade entry points still showed 「升级」, and clicking it could only
reopen the plan the user already holds.
The two surfaces got there two different ways, and neither shared a rule:
- The account menu's billing card gated on `billingUpgradeUrl &&
canManageBilling` — a destination check and a permission check, with no
TIER check at all. Every tier saw the button.
- The Settings AMR card asked a personal-ladder question
(`canUpgradeVelaPlan`) about `amrCardStatus.account.plan` — vela's
ACCOUNT-scoped login projection, which reports `free` for a user whose
entitlement is held by a team workspace. So a team_max owner measured as
"free" and got the button, while the PlanBadge beside it correctly read
Max off the workspace-resolved tier.
Both now ask one predicate, `canUpgradeFromPlanTier`, about the same
resolved tier each surface already LABELS, so the button can never
contradict the nameplate next to it.
Team and personal tiers are two ladders, so the predicate reads the
team-namespaced id whole instead of stripping the prefix and asking a
personal question. Per the product ruling — 「个人档位都是要显示可升级的,
最顶的就是团队 max」 — personal `max` keeps the affordance: that user can
still move onto a team plan, and vela #1146 deliberately routes their
click to the Team upgrade dialog. Only `team_max` loses it.
Destination logic (`workspaceUpgradeUrl` / `amrPlansUrl`) is untouched;
this only decides whether the affordance renders. No copy, no new i18n
keys.
* fix(web): keep Send alive after using a community template (#6206)
Clicking 「使用」 on a community template seeds the template's own brief into
the composer and binds the template as the run's driver. For a template whose
`od.inputs` are `required: true` with no `default` -- the real
`example-html-ppt-pitch-deck` ships three such fields -- the bind left
`active.inputsValid` false, and `submitDisabled` folded that into the send
button. The user saw a full prompt next to a permanently dead Send whose
tooltip still read "type something to run". Typing did not help: the gate was
never about the prompt.
Those fields have no input surface on that path. #3645 removed the Home
composer's inline plugin-inputs form, and the template's query carries no
`{{...}}` placeholders, so prompt -> inputs write-back cannot reach them
either. A gate on values the user cannot supply anywhere is a dead end, not a
guard.
Narrow it to where it is actionable: `requiredInputsAreUserFillable` keeps the
gate when the media composer renders the fields as controls, or when the
tracked query template actually names the missing field as a `{{placeholder}}`
that editing the prompt writes back. A tracked template alone is not enough --
re-applying a plugin without an explicit template derives one from the
manifest, placeholders or not, which is the shape a reload lands in.
The daemon stays the authority: `validateInputs` still throws
MissingInputError. Since the seeded path no longer pre-empts the send, its
rejection now reports the fields it rejected instead of a generic "Failed to
apply", reusing the existing pre-submit wording.
* fix(collab): give every created project a workspace home (#6201)
* fix(collab): give every created project a workspace home
A project created with no `x-od-workspace-*` headers got no
`workspace_projects` row and still returned 200, so nothing surfaced the
loss. `GET /api/projects/:id/workspace-scope` then answers `unbound`,
which strips the workspace off the run request (`ProjectView`'s
`projectRunWorkspaceContext` -> an Open Design Cloud run nothing can
bill) and blanks the balance/plan area while that project is open
(`AvatarMenu`). The same orphan is also denied its first run outright by
`enforceWorkspaceResourceMutation`.
Headerless creates are not anonymous callers asserting "no workspace" —
they are callers that could not say which workspace they meant:
`od project create` and the MCP `create_project` tool mint no headers at
all, the web duplicate / design-system-copy / plugin-share paths read a
ref that drops the context's `loading` flag, and Orbit + scheduled
routines have no request to read headers from. So a create that names no
workspace now binds to the one this daemon is signed in to, read through
`workspaceContext.lastKnown()` — zero-network, synchronous, no failure
mode. A daemon that has resolved no workspace still binds nothing, which
keeps `unbound` correct for the signed-out single-player user.
Six creation paths were writing no binding at all, not merely skipping it
when headerless: the plugin share-project task, Orbit run projects,
scheduled routine projects, the library capture-as-page exit, the
project-location scan importer, and the `ds-*` project backing a design
system's editing workspace. All six now bind.
Deliberately unchanged: the collab pull's register-on-pull and
shared-project placeholder. Those are a teammate's shared project, whose
correct binding is written by `materializePulledTeamMirror` with
`visibility: 'team'`; claiming them into the reader's ambient workspace
as personal would misattribute someone else's resource.
No creation path gains a new failure mode. `createdProjectWorkspaceHome`
never refuses — a partial or denied header identity degrades to the
ambient workspace rather than turning a working 200 into a 4xx.
On the web side `createPluginShareProject` was the one create in
`state/projects.ts` with no `workspaceContext` parameter at all, so it
sent no workspace identity ever. It now forwards the context when known,
best-effort — deliberately not `resolvedWorkspaceContextForWrite`, which
throws while the identity read is in flight and would add a new block to
a path that works today.
* fix(collab): verify an asserted workspace before persisting it
`createdProjectWorkspaceHome` resolved a created project's workspace with
`resolveCreatedProjectWorkspace`, which only PARSES headers. It trusted
the caller-provided member status and permissions and never checked that
the workspace/member pair exists in the membership directory or agrees
with the daemon's last-known state. `x-od-workspace-*` headers are an
unauthenticated hint, so any local caller — the `od` CLI, a plain curl, a
compromised page — could assert an arbitrary pair and get a project bound
to a workspace it has no membership in, with a fabricated
`createdByWorkspaceMemberId`.
"Do not fail the create" and "trust unverified input" are not the same
constraint. The helper now VERIFIES, then DEGRADES — never rejects, never
trusts:
1. asserted identity that verifies -> bind to it
2. asserted identity that does NOT -> bind to the daemon's ambient
verify, including an unreadable workspace instead, or leave
authority ("cannot confirm") the project unbound
3. nothing asserted -> ambient, as before
Creation still never answers 4xx, so the six previously-never-bound paths
keep binding and a signed-out daemon still creates usable local projects.
An unverifiable claim is simply never written as fact.
Verification is not re-implemented. It is `authorizeCreatedProjectWorkspace`
— the same directory lookup `POST /api/projects` gates on, which also
returns the DIRECTORY's authoritative context rather than the caller's
claimed one — plus `withLastKnownMembership`, the same cross-check the
mutation gates apply (now exported rather than copied). Only the failure
behavior differs: they refuse, this degrades. An absent directory fetcher
remains `authorizeCreatedProjectWorkspace`'s own documented local/dev
compatibility path, not a second weaker definition of verified.
Route modules now take one `CreatedProjectWorkspaceResolver` dep instead
of re-threading the three authorities, so there is a single notion of
"verified" per daemon.
* test(daemon): drive brand routes through the created-project workspace resolver
The brand harness constructed `registerBrandRoutes` without the new
`resolveCreatedProjectHome` seam, so the binding became a no-op and
"binds a freshly extracted brand project into the caller's ACTIVE team
workspace" went red. Inject the same production resolver `server.ts`
builds, in its no-directory (local/dev) configuration, so the test keeps
asserting the product behavior through the real seam instead of a
header-trusting shortcut.
---------
Co-authored-by: lefarcen <ontf116@gmail.com>
* fix(web): move the update-ready rocket above the rail account row (#6208)
* fix(web): move the update-ready rocket onto the rail account row
#5517 removed the entry topbar and parked the updater host in the rail
footer, which put the green rocket on its own line UNDERNEATH the account
row — bottom-left, detached from the identity it belongs to. Product
reported it from a real client: the rocket belongs at the right edge of
the name + plan wordmark line.
Move the mount instead of nudging it with CSS: the rail now owns the
updater host through an `updaterSlot` prop and renders it inside the
account row (`.entry-nav-rail__account-row`), as a SIBLING of the account
trigger so it never steals the account-menu click target. The rail footer
stays as the fallback home for the signed-out shell, which has no account
row to ride, so the rocket's appearance conditions are unchanged.
Same change also un-clips the 「更新已就绪」 prompt. The host is pinned to
the bottom of the rail, so a `top: 0` panel grew downward off the bottom
of the window and the copy was cut off mid-sentence. Anchor its BOTTOM
edge to the host instead, the same way `.entry-help-popover` already does
for the same reason.
Side effect worth having: the rail no longer grows a 52px footer strip
the moment an update lands, so the account row stops jumping.
* fix(web): put the rocket ABOVE the account row, right-aligned
Placement correction. 「放到名字啥的上面的右侧」 was read as "on the name
row, right side"; product clarified 「应该是在名字那个横条的上方,靠右对齐」
— the rocket gets its own right-aligned strip ABOVE the identity row, not a
slot inside it.
The strip (`.entry-nav-rail__account-updater`) is mounted unconditionally so
it stays the account trigger's immediately-preceding sibling, and carries
`:empty { display: none }` so an idle rail reserves no height for it. That
rule is load-bearing: without it every user without a pending update would
get a blank 34px row plus the container's 6px gap pushing the account area
up — a worse regression than the placement it fixes. Measured in a real
browser at 1280x900: the account trigger sits at y 850-884 in BOTH states,
so nothing shifts.
Everything else from the first commit stands: the rail owning the host via
`updaterSlot` instead of an opaque `footerExtra`, the sibling-not-child
relationship to the trigger (now moot in the best way — a strip above the
row cannot be button-in-button), the `bottom: 0` panel anchoring that
un-clips 「更新已就绪」, and the footer fallback for the signed-out shell.
* fix(web): stop the home model list offering picks the chip cannot honor (#6209)
On the Home composer, clicking a model in the chip's compact list did
nothing — the chip kept showing the previous model.
The compact list rendered `currentAgent.models` raw, so a model above the
caller's plan (`enabled: false`, straight from `vela model list --json`)
appeared as an ordinary selectable row. Clicking it wrote the pick to
config, `normalizeAgentModelChoice` reported the plan fallback instead, and
the re-normalization effect in `InlineModelSwitcher` persisted that
fallback — so the chip snapped back with no explanation, and the user's
previous pick was overwritten by the default in the process.
The sibling surface (`AvatarMenu`, the project composer's model list) had
already hand-rolled `agent.id === 'amr' && model.enabled === false` for
this. Copying the rule per surface is what let the newest list drop it, so
this introduces one definition instead: `agentModelIsSelectable`, defined
to be at least as strict as `normalizeAgentModelChoice` (pinned by a test)
so a gated row can never be a pick the config would revert. Both surfaces
now ask it, and every model write inside `InlineModelSwitcher` — the
compact list and the execution-settings picker — goes through a single
`applyAgentModel` sink that asks the same question, leaving no second path
for a future list to bypass.
Locked rows now read as locked: dimmed, `aria-disabled`, a lock glyph, the
existing `settings.amrModelUpgradeHint` reason, sorted below the available
models, and a click routes to the plans page instead of silently doing
nothing.
* fix(collab): verify the asserted workspace before claiming an orphan project (#6213)
* fix(collab): verify the asserted workspace before claiming an orphan project
`reconcileUnboundProjectBeforeMutation` claims a project this daemon has
never bound to ANY workspace into the current mutating request's
workspace, so a true orphan is not denied its first mutation by
`enforceWorkspaceResourceMutation`'s `!row -> false` rule (recvqbhor3pai2).
It resolved that workspace from `workspaceProjectContextFromRequest(req)`
— header PARSING with no authority check — and stamped
`createdByWorkspaceMemberId: ctx.workspaceMemberId` from the same headers.
`x-od-workspace-*` is an unauthenticated hint any local caller can forge,
so a plain curl could claim someone else's orphaned project into a
workspace it has no membership in AND install itself as the author.
Authorship is the dangerous half: `workspaceResourceAccess` derives
`selfCreated` from it, and that bit is what grants a non-privileged member
mutation rights over the row.
Both the workspace and the authorship now come from
`resolveCreatedProjectHome` — the same verify-then-degrade resolver #6201
introduced for created projects:
- asserted identity VERIFIES against the membership directory -> claim
it, attributed to the DIRECTORY's member id, not the header's;
- it does NOT verify (foreign, inactive, permissions disagree,
last-known says removed, or the authority is unreadable so it cannot
be confirmed) -> claim the daemon's own ambient workspace instead,
attributed to that verified session's member id;
- neither available -> write nothing, and let the pre-existing gate
answer.
The `null`/`'missing'` early return is unchanged and load-bearing, which
is why this does not reuse `createdProjectWorkspaceHome`'s own third
branch: the mutation gate's HEADERLESS branch answers 401 as soon as any
row exists for the resource, so claiming on a request that asserts
nothing would convert a working headerless mutation into a 401.
A verified caller is unaffected — `workspace-projects.test.ts`'s
recvqbhor3pai2 regression case still passes unchanged. A caller that
cannot prove membership over a never-claimed project is now refused by
that pre-existing gate instead of being let through on a binding it had
just invented for itself; #6201's e2e case is updated to assert the
persisted binding rather than the mutation's status, since both outcomes
satisfy the property it pins.
* fix(collab): persist only an asserted-and-confirmed workspace on an orphan
Review follow-up (mrcfps). `resolveCreatedProjectHome` is not a pure
verifier: by contract a foreign, inactive, removed, or unconfirmable
assertion degrades to `workspaceContext.lastKnown()`. Reconciliation then
persisted that ambient context onto a PRE-EXISTING orphan before the
mutation gate had rejected the asserted caller — and the
`getWorkspaceProjectByProjectId` guard one line above makes that write
sticky, so the rightful verified workspace could never reconcile it
afterwards. A forged request, or a legitimate one during an authority
outage after the active workspace changed, would permanently mis-file the
project.
Creation and reconciliation are not the same risk, which is the
distinction the original patch missed. Putting a BRAND-NEW project in the
ambient workspace takes nothing from anyone — that is #6201 and it stays.
Putting an EXISTING orphan there may take it from the workspace it
actually belongs to.
So a degraded ambient authority is persisted only when it names the very
pair that was asserted. Verified assertions resolve to the asserted pair
by construction (the directory lookup is keyed on it), so they are
unaffected; outage continuity still works for the ordinary legitimate
caller, whose client took its headers from this same daemon and therefore
agrees with it; a mismatch writes nothing at all.
Not in tension with 「所有 project 都应该能找到 workspace」: the
display-side fallback (#6185) already renders an unbound project inside
the caller's current workspace, so nothing reads as "unknown". The
binding row is a separate, durable fact and stays conservative.
Adds the fixture-matrix case the review asked for — a populated but
DIFFERENT ambient workspace, asserting the orphan stays unbound. The mock
authority's `/current` is now flippable so the fixture can create a true
orphan while ambient is absent and then populate ambient deterministically
through `GET /api/workspace/context`, rather than depending on a poll tick.
---------
Co-authored-by: lefarcen <ontf116@gmail.com>
* fix(web): use neutral Windows app background (#6218)
* fix(collab): let a headerless caller mutate its own daemon's project (#6216)
* fix(collab): let a headerless caller mutate its own daemon's project
`enforceWorkspaceResourceMutation`'s headerless branch answered
401 WORKSPACE_CONTEXT_REQUIRED as soon as ANY `workspace_projects` row
existed for the resource. That was survivable while headerless creates
left projects unbound. #6201 made every created project get a workspace
home, so the two rules combined into a project its own creator cannot
touch:
od project create -> 200, and now writes a binding
od project duplicate -> 401
The `od` CLI never sends `x-od-workspace-*` — only `od workspace …`
builds those headers — so this is not an edge case for it. It is every
CLI mutation of every project the CLI created, which breaks the
embeddability contract `AGENTS.md` makes the CLI responsible for.
Reproduced end to end through the real binary against a daemon-only
process (`od daemon start --headless`, no web, no browser).
INVARIANT, now named in `headerlessMutationAllowed`: every mutation
resolves to a workspace identity. A request that ASSERTS one is judged on
that assertion; a request that asserts NOTHING is the local daemon's own
signed-in user and is judged as that identity. Being unable to name a
workspace is not the same as having no standing in one — the same
"nothing asserted -> ambient" fallback the create path already applies,
so the gate and the creation paths finally agree about what a headerless
caller is.
Verified the ambient identity is available without any UI: a
daemon-only process resolves it from the vela session on disk, and
`GET /api/workspace/context` answers fully in that state. The
`ambientWorkspaceId` in `collab/workspace-hub-subscriptions.ts` is
unrelated — it is SSE subscription bookkeeping fed from the
disk-persisted selection store, not an authorization input.
Deliberately NOT weakened: `authorizeCreatedProjectWorkspace` still
refuses to let ambient stand in for an explicitly CLAIMED pair, and
`resolveProjectWorkspaceScope` still resolves a persisted binding without
consulting ambient. Both govern cases where something WAS asserted;
headerless is the third case.
What stays refused, because the original branch protected something real
(recvqbeDjAsejl / recvqbklNGDqYY, spec 04 §10): a resource bound to a
workspace the daemon is not currently in; a resource the daemon's own
identity may not mutate anyway (the same
`workspaceResourceMutationAllowed` computation runs); and everything when
the daemon has no signed-in identity to resolve. With no ambient wired
the branch is byte-identical to before.
The ambient snapshot type moves down into
`collab/workspace-resource-mutation.ts` so the gate and the creation
paths cannot drift into two notions of "the daemon's own workspace";
`created-project-workspace.ts` re-exports it and now reuses the shared
context builder instead of its own copy.
* test(e2e): pin that signed out, visible equals unbound equals mutable
「未登录也可以用自己 cli 修改未登录态下的那些 project, 这个一定要保证,
不然就是 P0 事故」
A signed-out client can only SEE unbound projects: the no-scope catalog
(`routes/project/index.ts:2432-2443`) reads no `x-od-workspace-*` at all
and joins through `listUnboundProjects`, so a project any workspace has
claimed never leaks to a caller with no identity to check it against
(spec 04 §10). This pins the other half of that set — everything visible
while signed out stays WRITABLE.
The case runs against a daemon with NO vela session at all, not merely a
request without headers, creates its draft in that same signed-out state
(the real user sequence), asserts the draft is listed by the no-scope
catalog, then renames it, duplicates it, and duplicates it again through
the real `od` binary.
It holds only because `headerlessMutationAllowed` short-circuits on "no
row anywhere" BEFORE it asks for an ambient identity, so it is
mutation-tested against that ordering rather than written red-first:
moving the short-circuit after the ambient check turns it red with
`expected 401 to be 200`.
* fix(collab): make the delete side effect use the gate's own context
Review follow-up (mrcfps). Allowing a headerless caller to mutate a
project the daemon's own identity owns made a latent inconsistency
reachable: `DELETE /api/projects/:id` re-derived its context with
`workspaceProjectContextFromRequest(req)`, which is null for a headerless
caller, so `requestTeamVisibility(..., 'personal')` was skipped while
`dbDeleteProject` still ran. The owner's local row and directory
disappeared and the hub kept serving the resource, so teammates went on
seeing a project that no longer existed — a cross-client data-consistency
bug, worse than the 401 this branch set out to fix.
Threading the context, not narrowing the capability:
`effectiveWorkspaceProjectContext` names the identity a mutation actually
acts under — asserted when the request carries one, ambient when it does
not — and its docblock states the invariant that any SIDE EFFECT must read
from it rather than re-deriving from headers, or the effect disagrees with
the gate that permitted it. The delete now uses it.
The no-context case becomes a refusal rather than a silent skip. It is
unreachable while the gate is intact (a team-bound row is admitted only
for an asserted identity or a matching ambient one), but falling through
is what produced a local-only delete of a still-shared project, so a
future gate change must not be able to reintroduce it quietly.
Audited every other capability this branch newly admits for a headerless
caller. Delete was the only one: `/move` and both share/unshare routes
each guard with their own `if (!ctx) return sendMissingWorkspaceContext(res)`
so headerless never reaches their hub work, and the upload route's
`workspaceProjectContextFromRequest(req) !== null` only shapes a 404 for a
missing project. Rename/duplicate/writeFiles/comment have no hub side
effect.
Adds the requested route regression to
`tests/routes/project-delete-unshares-team-share.test.ts`: real route,
real collab runtime, mutable fake hub, no request headers,
`workspaceContext.lastKnown()` populated — asserting the unpublish and
catalog removal happened and the project is gone locally only after. Plus
the other half: with no ambient identity either, the delete is refused and
nothing is destroyed. Mutation-tested — restoring the header re-derivation
turns the first red with "expected 0 to be greater than 0".
---------
Co-authored-by: lefarcen <ontf116@gmail.com>
* fix(web): draw the team wordmark for every tier of a team plan (#6219)
The account row of a team workspace showed the PERSONAL Plus wordmark. Product
ruling: 「团队版的订阅，这里应该都显示 team 的标识」…「产品期望团队从 free 到
max，徽标都显示 team 的那个，个人的还是维持现状不要动」.
The badge names the plan FAMILY, not the tier inside it, and it got that wrong
from both ends. `planBadgeTierForLabel` asked `plus` / `pro` / `max` BEFORE
`team`, and B namespaces team ids by EMBEDDING the personal tier word — so
`team_plus` matched `plus` and the `team` branch was reachable only from a bare
`team` id, the one team tier that happened to work. The free team tier missed
from the other side: B reports an unsubscribed workspace with a null `planId`
and an empty `membershipTier`, an id no different from a personal free account,
so no id can name it.
`planBadgeTierForWorkspace` states the whole rule once, and both surfaces read
it — the rail's account row and the Settings CLI card, which the owner requires
to move together (「设置中的这里应该一样的逻辑」). Team-namespaced ids go through
the shared `isTeamPlanTier`, so the badge cannot drift from the other team
gates; `workspaceType === 'team'` covers the free tier that no id can express.
The plan LABEL is untouched, deliberately: it answers a subscription question,
every user-created workspace in B is team-typed, and reading one as the other
is #146. 免费 beside the `team` wordmark is now the intended pairing — the
family is team, the subscription is not paid.
No interaction, layout, sizing, artwork, or copy changes; no new i18n keys.
* fix(collab): warm the workspace-scoped digest faces on switch and reconnect (#6222)
Every workspace-scoped cache in the daemon keys on the active workspace, so the
instant the user switches, `catalog` and `members` are both a miss and the FIRST
consumer in the new workspace refills them inline on its own request path
(`createPersistentSyncCache` fetches synchronously on a miss). The cost is the
same either way; the only question is who waits for it. A switch is a user
action followed by idle time, so paying it there is free — paying it inside the
first project load or agent run is not.
`PUT /api/workspace/active` now announces a CONFIRMED switch through a new
fire-and-forget `onWorkspaceSwitched` seam, and the daemon warms the two faces
from it. The announcement deliberately does not fire for a rejected or
rolled-back switch: warming there would refill the caches against a workspace
this daemon just refused to move to.
Warming goes through the cache functions, never their underlying fetchers.
`createSwrCache`'s read returns `entry.inflight ?? refresh(key)`, so a warm that
races the very consumer it is protecting joins that consumer's request instead
of issuing a second one. No request is added that would not otherwise be made.
Second half, same root cause: on hub reconnect the gap-closing catch-up read the
team-project and member lists THROUGH those same caches, so an entry that
settled just before (or during) the disconnect still counted as fresh, the diff
concluded "nothing changed", and the one cycle meant to close the gap emitted
nothing — the client stayed stale until an unrelated read happened to miss.
Reconnect now drops those two entries first, and `pollOnce` joins the in-flight
refresh that starts, so the pair still costs one fetch per face.
Co-authored-by: lefarcen <ontf116@gmail.com>
* fix(daemon): split AMR workspace proof failure from proof refusal (#6221)
An AMR run died in preflight with "its persisted workspace <id> is
unavailable for the signed-in member". Two causally unrelated situations
shared that one error and one outcome: a directory that answered and
genuinely listed no active membership, and a directory that could not be
read at all. The `.catch` swallowed a read failure into
`{ ok: false, items: [] }`, so a transient vela blip made a user's own
project unrunnable — and nothing downstream could tell the two apart.
Refusal now fails closed under `ProjectWorkspaceScopeRefusedError`
(`PROJECT_WORKSPACE_SCOPE_REFUSED`); an unreadable directory is retried
with bounded backoff and, if it still cannot be reached, the run proceeds
with no workspace, i.e. on the caller's own account wallet. That is a
product decision recorded in the docblock: a hard failure is worse than a
mis-attributed personal charge. The reverse direction, charging a personal
run to a team wallet, stays impossible — no fallback selects another
workspace, and a proven non-membership still refuses.
The decision was also invisible: a full diagnostics export carried no
directory-fetch line, no run-id in the daemon log, and only a generic
AGENT_EXECUTION_FAILED plus prose. Every branch now reports a closed-union
outcome to the daemon log, the run record (via `ApiError.details`, leaving
the wire error code unchanged) and telemetry.
* fix(comments): preserve rejected mutations
* fix(comments): preserve partial send results
* fix(web): keep workspace-scoped data fresh across account and workspace changes (#6225)
* fix(web): keep workspace-scoped data fresh across account and workspace changes
Three defects in one family — workspace-scoped data in the web client going
stale or being read under the wrong identity.
1. The workspace switcher's module-level directory cache had no invalidation.
`/api/workspace/directory` answers "which workspaces can the SIGNED-IN
ACCOUNT see", but nothing cleared the cache on an account change and
`resetWorkspaceDirectoryCache` had no production caller — so signing in as a
different account kept the previous account's workspace names on screen, and
kept them confidently, since a non-empty cache also suppresses the loading
state. The cache is now served only to an identity that can claim it, by
membership id, which keeps the flash-free reopen it exists for. The
`coalescedGet` key is identity-scoped for the same reason.
2. App.tsx read `/api/skills` without the caller's workspace headers and never
refetched on a workspace switch. The daemon is fail-closed on a missing
`x-od-workspace-id`, so a headerless read is not the unfiltered list — it is
the list with every workspace-claimed skill removed, including the ones
claimed by the workspace the user is in. Skills now get the identity headers
and the same workspace-keyed refresh design systems already had. Launch still
spends exactly one `/api/skills` request: the read moved from the boot pass to
the workspace-keyed effect rather than being added alongside it.
3. `PUT /api/workspace/active` already returns the post-switch context, from the
same producer `GET /api/workspace/context` serves and only after the daemon
agrees the switch happened. The client parsed that body, discarded it, and
made every consumer re-read the same data. The shell is now seeded from the
response; the refresh broadcast still fires, because
`useProjectWorkspaceScope` listens to it and passive tabs cannot be seeded.
Switch path: 2 requests -> 1.
* fix(web): discard workspace-scoped reads that land after the identity moved
Review follow-up on #6225 (PerishCode, two threads — both real).
Keying a read by identity stops the wrong identity being SERVED a cached
answer. It does nothing about the other direction: a read issued for identity A
resolves later, and by then the caller may be identity B. Committing that late
answer restores A's data under B — the same staleness this PR removes, arriving
through the back door. A workspace switch is precisely when one read is in
flight and another starts, so reverse-order completion is reachable, not exotic.
Both sites now use one mechanism, `beginWorkspaceScopedRead`: capture the
identity the read is issued FOR, request with that captured context, and compare
against a ref before any commit. Its docblock states the invariant and the two
rules that make it hold (request with the captured context so request and guard
cannot disagree; compare against a ref, never a closed-over prop, which would
always match and guard nothing). It is the cross-component form of the
`requestEpochRef` ordering guard `useWorkspaceContext` already applies to its
own read.
- `refreshSkills` and `handleSkillsChanged` (App.tsx): a slow read for the
workspace the user left no longer overwrites the current catalog. The
registry-ready gate is intentionally skipped on a discarded response — it is
not an answer about the current identity, and the newer read marks it.
- `loadWorkspaceDirectory` (EntryNavRail.tsx): an in-flight account-A read that
lands after the rail moved to account B no longer repopulates either the
module cache or the visible list. This was the sharper of the two, because it
wrote into module scope and so persisted past the render that caused it.
Request counts are unchanged (startup 4, switch 1): the guard discards
responses, it does not issue requests.
* fix(web): make computing a workspace identity total, and key the skills trigger on it
Fixes the `Web workspace tests` failure 886f11b24 introduced. CI reported all
555 files and 5583 tests PASSING and still exited 1:
Unhandled Rejection
TypeError: Cannot read properties of undefined (reading 'canShareProjects')
❯ workspaceIdentityCacheKey src/collab/useWorkspaceContext.ts:112:32
❯ beginWorkspaceScopedRead src/collab/useWorkspaceContext.ts:159:20
❯ src/App.tsx:1770 ❯ src/App.tsx:1799 ❯ commitHookEffectListMount
originating in tests/components/App.amr-plan-tier.test.tsx
`workspaceIdentityCacheKey` dereferenced `context.permissions` unguarded. That
survived while it was only called during render (a throw there fails loudly, in
the right place) and inside `fetchSkills`'s own try/catch. 886f11b24 put it
behind `beginWorkspaceScopedRead` in an async function launched with
`void refreshSkills()`, so a partial context turned a synchronous programming
error into an unhandled rejection — invisible to every assertion, fatal to the
process.
`permissions` is required on the contract, but API JSON reaches these objects
through an unchecked cast, so a partial context is reachable at runtime and not
only in fixtures. Computing an identity must therefore be TOTAL: a partial
context is its own cache partition, never an exception.
Second, independent defect, found while fixing the first: the skills trigger was
keyed on `workspaceId` while the commit guard compares the full identity digest.
A guard that discards without guaranteeing a successor is worse than the
staleness it replaced — two accounts in one shared team workspace differ only by
membership, so account A's pending read would be discarded for B while the
unchanged workspace id suppressed B's replacement read, leaving the functional
registry loading forever. The trigger now uses the same digest the guard
compares, so every transition that invalidates a response also starts its
successor.
Both are covered by tests that go red without the fix:
- tests/collab/workspace-identity-key-is-total.test.ts (new) — identity is total
for null, partial and complete contexts, including a late commit-time guard.
- tests/components/App.skills-workspace-scope.test.tsx — a member-id-only change
must start AND complete a successor read.
---------
Co-authored-by: lefarcen <ontf116@gmail.com>
* feat(landing): publish current pricing snapshot
* fix: durably deliver enterprise leads
* test(web): update ProjectView comment-status suites to the workspace-scoped signature (#6233)
`feat/workspace-team`'s `Web workspace tests` lane is red at the branch tip: 3
files / 4 tests, all comment-status assertions. Not a flake and not attributable
to any open PR — I had to prove twice while landing #6225 that a red lane was
inherited rather than mine, which is the cost a red base imposes on every
downstream PR.
Cause: `1c15574c2 fix(comments): preserve rejected mutations` gave
`patchPreviewCommentStatus` a fifth argument — the acting workspace context — so
the daemon can authorize the mutation (`routes/project/comments.ts`, same
commit). It updated `FileViewer.test.tsx` and added `registry.test.ts` coverage
but left three `ProjectView.*` suites on the four-argument signature.
The tests were stale, not the code. Checked before editing, because "update the
tests" is the wrong move if the assertions were right:
- Every asserted call still happens, unchanged. The failures are pure arity
mismatches: `api-empty-response` expects `(…, 'failed')` and receives
`(…, 'failed', null)`; likewise `needs_review` in run-cleanup and `applying`
in run-isolation. No status transition changed.
- `1c15574c2` shipped the new contract WITH tests —
`describe('preview comment scoped mutations')` asserting `x-od-workspace-id`
reaches the PATCH. The fifth argument is deliberate and covered.
- The parameter is optional and additive; headers are spread only when a
context is present.
Also restores two assertions that had gone silently vacuous. A four-argument
matcher cannot match a five-argument call, so `run-isolation`'s two
`not.toHaveBeenCalledWith` assertions could never match once the signature grew
and passed unconditionally — coverage actively lost, not merely failing. Both
pass with the correct arity, which independently confirms the new code does not
write `needs_review` after a canceled+done run and does not reset a queued
send's own comment to `open`.
The fifth argument is matched as an explicit `null` rather than
`expect.anything()`, which rejects null/undefined and would have re-broken the
positive assertions and re-vacuated the negative ones.
Tests only — no source file is touched.
Co-authored-by: lefarcen <ontf116@gmail.com>
* fix(collab): make the local pin the only workspace-selection truth (#6230)
* test(collab): pin the one-account-two-clients workspace scope behaviour
Executable evidence for the account-level Active Workspace investigation.
Models vela exactly as its source behaves at origin/main 2155a969f:
- active_workspace_selections is keyed by app_user_id alone
(db/schema/public.hcl:792), so an account has exactly ONE selection.
- GET /api/v1/workspaces/current discards a ?workspaceId= hint
(services/api/src/workspaces/routes.ts:166-176, and vela asserts it by
name in services/api/test/workspaces-personal.test.ts:480).
- GET /api/v1/workspaces is scoped by app_user_id, not by the selection.
What it establishes: OD's local pin DOES hold against a competing client
(resolvePinnedWorkspace), so the switch does not 404. The damage is that
the losing client's context degrades to a directory synthesis - planId
null and a 0/0 seat summary, which derives isSeatFull: true - and its
context read gains a second, fallible round-trip the winning client
never makes.
No behaviour change.
* fix(collab): make the local pin the only workspace-selection truth
Picking a workspace is a local action, but `PUT /api/workspace/active`
gated it on mutating ACCOUNT-scoped state in vela: it PUT the account-level
active workspace first and failed the user's click with 502
`workspace_switch_rejected` when that write did not take, then rolled back
both the local pin and the backend switch if the follow-up context read
disagreed.
That backend row is keyed by app user alone, so it can only ever name ONE
workspace for an account. One account routinely runs several clients in
different workspaces, so every switch yanked the other clients' server-side
scope, and whichever client did not write the row last was answered for the
wrong workspace — forcing OD to synthesize its context from the membership
directory, which carries no billing plane. That client saw planId null and a
0/0 seat summary, and a 0/0 summary derives isSeatFull: true, so a workspace
with free seats read as FULL and blocked inviting. It also turned that
client's context read into two round-trips, the second of which could blip
and leave it with no context at all.
vela #1179 (1ba3eebcb, deployed to test 09:57Z) taught
`GET /api/v1/workspaces/current` to honour `x-vela-workspace-id`, the
per-request workspace scope vela already accepted on its resource plane,
billing scope routes and the Link gateway. So:
- `fetchCurrent` sends that header and drops the `?workspaceId=` query
param, which vela ignores by design and asserts it ignores — it only ever
made this call look scoped.
- `PUT /api/workspace/active` no longer calls vela. The membership
directory it already reads is the authorization; once that confirms an
active membership the switch cannot fail, so the 502 gate and the
rollback are gone along with `selectWorkspace` and `putCurrentWorkspace`.
- An unconfirmed context read is no longer treated as a refusal: the route
answers from the directory entry it already validated instead of
reverting the user's choice, mirroring the invariant
`resolvePinnedWorkspace` already follows in the same module.
Verified against the deployed test backend, GETs only: an explicit
workspace returns that workspace (not the account row), a workspace the
caller is not a member of is refused 404 `workspace_member_required`, and
both an absent and a blank header keep the previous account-level
behaviour. The URL query hint is still ignored.
vela's `active_workspace_selections` table and its write path are left
alone; deprecating it is a separate decision and #1179 kept omitting the
header backward compatible.
Two comments that asserted the now-false invariant are corrected.
* fix(collab): never answer a switch with a workspace the pin no longer holds
Review catch (mrcfps): `workspaceContext.current()` is not a passive read.
The vela provider's `resolvePinnedWorkspace` does its OWN fresh directory
lookup and, when that confirms the pinned workspace is gone, clears the pin
and re-pins a recovery workspace so a removed member is not locked out of
everything. The route's directory read can meanwhile have been served from
its 5s cache and still list that workspace.
The previous branch state read `context.workspaceId !== workspaceId` and
treated the provider's recovery as a merely-unconfirmed read, synthesized the
stale cached entry, and returned 200 claiming the requested workspace while
`activeWorkspace.get()` had already become the fallback. That shipped this
PR's own thesis — the local pin is the only selection truth — as a violable
invariant, and the user-visible symptom is the switch appearing to succeed
and then snapping back on the next context poll.
The pin is now re-read AFTER `current()` resolves. If the provider moved it,
the route reports `404 workspace_no_longer_available` for the workspace the
user asked for, never claims it, and does not warm its caches. The recovery
pin is deliberately left in place: reverting it would restore the very
"signed out of every workspace" state it exists to prevent.
The directory entry that authorizes the switch is also now required to be a
LIVE membership (`memberStatus === 'active'`, lifecycle not deleted) — the
same predicate the provider uses. Matching on id alone let a listed-but-
removed membership authorize a switch AND get synthesized into the response.
Tests wire the real provider against the production cached directory fetcher
over one shared pin store, exactly as server.ts does, so the cached and fresh
reads genuinely disagree. Disabling the new pin re-read turns "never claims a
workspace the pin no longer holds" red and nothing else.
---------
Co-authored-by: lefarcen <ontf116@gmail.com>
* fix landing pricing controls
* fix(daemon): resolve the AMR scope-telemetry app version in its own scope (#6240)
Every AMR run in 0.16.2-beta.148 died at spawn with
`spawn failed: appVersionForCapture is not defined`.
`appVersionForCapture` is a local of
`createFinalizedMessageTelemetryReporter`. #6221's
`amr_workspace_scope_resolved` capture called it from `startChatRun`,
~7,500 lines and one function away, so the name resolved to nothing.
The callback runs while building the agent's launch env, inside the
spawn `try`, so the ReferenceError surfaced as the generic
AGENT_EXECUTION_FAILED spawn failure for 100% of AMR runs.
`design.getAppVersion` is the accessor that scope actually has, and it
is the same one the unreachable helper falls back to, so the reported
value is unchanged.
A scope guard covers the class rather than the instance: it runs the
checker over `server.ts` with `@ts-nocheck` stripped and fails on any
identifier that reaches runtime unbound. It flagged one sibling, fixed
here too — the critique orchestrator's `skill` label read
`effectiveSkillId`, a local of `composeDaemonSystemPrompt`. A `typeof`
guard on an undeclared name does not throw, so instead of crashing that
label has silently been `undefined` for every run since #1485.
`@ts-nocheck` on `server.ts` is the enabling condition for both: an
undefined identifier in this file reaches users without any tool
objecting. Removing it is a separate project — 29 daemon files carry it.
* fix(web): isolate workspace identity snapshots
* test(e2e): move the server.ts identifier-scope guard into the merge gate (#6244)
`apps/daemon/tests/server-identifier-scope.test.ts` landed with the
0.16.2-beta.148 AMR spawn fix (#6240) but protected nothing: `ci.yml`'s
"Daemon workspace tests" step runs exactly one file
(`tests/project-watchers.test.ts`), so no other daemon suite executes in
any workflow. The guard sat outside every merge-gate lane.
Widening the daemon lane is not available as a local fix — that exact
command string is pinned by `workflowRunsOnlyAllowedDaemonTest` in
`scripts/check-certain-exempt-consumption.ts`, which conditions the
`trae-cli.test.ts` docs-consumption exception on the lane running nothing
else. Touching it is a coupled scope-policy change.
So host the guard where a lane already runs and the wiring is itself
guarded:
- Any change under `apps/daemon/src/` matches `certain-daemon-core`
(`scripts/scopes.ts`), whose effects include
`ui_p0_validation_required`; `run_e2e_vitest` is
`isFull || web_tests_required || ui_p0_validation_required`. A
`server.ts`-only change therefore arms `E2E Vitest` even at the merge
queue's `certain` threshold, and an unresolved file list escalates
fail-closed to full.
- The `daemon core boundary` guard (`scripts/lib/guard/scope.ts`) asserts
`ci.yml` still contains both `run_e2e_vitest == 'true'` and
`pnpm --filter @open-design/e2e test`, and runs in the always-on policy
floor — so the premise cannot rot silently.
The check only ever reads `server.ts` as text (no daemon boot, no
fixtures), and reading another app's tree as a repository resource is
what root `AGENTS.md` sends to `e2e/tests/` — the same reason
`e2e/tests/critique-coverage.test.ts` lives there. Behavior is
unchanged, including both self-checks that keep the guard from going
vacuous.
Verified red on the pre-#6240 `server.ts`: exit 1 naming
`appVersionForCapture (line 9261)` and `effectiveSkillId (lines
9657/9658)`; green (exit 0) on the fixed file.
* fix(collab): align unbound project mutation identity (#6231)
* fix(web): name the caller when a run starts before its project scope resolves
Sending the 「水面焦散」 example prompt from Home failed instantly on a team
workspace:
daemon 401: {"error":{"code":"WORKSPACE_CONTEXT_REQUIRED","message":"workspace context is required"}}
with `run_id: n/a`, because the refusal lands before the run is created. That
string is produced in exactly one place in the repo — the `!createResp.ok`
branch of the `POST /api/runs` create fetch in `providers/daemon.ts` — so the
refused call is run creation, gated by `enforceWorkspaceResourceMutation
('project', …)`.
The cause is client-side. Home creates the project WITH the caller's workspace
headers, so #6201 binds it to the team workspace; the follow-on auto-send then
went out with NO headers, because it took its identity from the PROJECT's
workspace scope — an async read still in flight when the auto-send fires (its
gate is `messagesInitialized` + `activeConversationId`, never the scope). Every
other project write in `ProjectView` (`patchProject`, `uploadProjectFiles`, the
comment mutations) already asserts the caller's own context; run creation was
the one write that did not.
INVARIANT, now named in `runWorkspaceIdentity`: a send names its caller while
the project's binding is still UNREAD, and never overrides an answer the daemon
actually gave. Deliberately not a blanket `?? caller` — every answered or failed
state keeps asserting nothing, because for them a headerless request is judged
on daemon-owned state while an asserted one is judged on client-controlled
headers:
- `unbound` — `headerlessMutationAllowed` short-circuits on "no row anywhere"
BEFORE asking for an identity, so asserting would turn a working 200 into a
403 and break 「未登录也可以用自己 cli 修改未登录态下的那些 project」.
- `unavailable` — the daemon's `resolveProjectWorkspaceScope` returns this
both for an unreadable directory AND for a directory that answered with no
active membership, i.e. a proven "you were removed".
- a FAILED scope read — this identity also picks the wallet the AMR pre-run
balance gate prices against, and guessing the caller's team wallet with the
binding unknown blocks a send the daemon would have answered (the dead
button 21f452ffe undid).
Second consequence of the same null, fixed by the same one-liner: with no
resolved scope, `checkAmrBalanceGate` was called with `undefined` and priced the
run against the ACCOUNT wallet instead of the team's. The red spec observes
that directly rather than arguing it.
`ProjectView.run-isolation.test.tsx` mocks `useProjectWorkspaceScope` with a
hand-written factory that enumerates every export, so the new export is added
there too — without it, adding one export breaks all 64 tests in that file with
"not a function" at render.
* fix(web): narrow the run-identity fallback to a project's first unread binding
Review catch (nettee): keying the fallback on `loading` served two opposite
situations, because `useProjectWorkspaceScope`'s trailing transition guard
re-enters `{ loading: true, scope: null }` whenever the resolved caller identity
stops matching — and every workspace switch does that:
- first read, nothing known -> the caller is the only identity available
- revalidating a KNOWN binding -> the caller's current workspace is a guess
that contradicts an answer we already have
So a send issued during a workspace switch asserted the workspace the user had
just moved TO for a project still bound to the one they moved FROM. Both
consumers break, and differently: `POST /api/runs` can 403 because
`enforceWorkspaceResourceMutation` still finds the project row under the old
workspace, and `checkAmrBalanceGate` preflights the new workspace's wallet —
worse than the `undefined` this fix was written to remove, because a wrong
wallet looks like a real answer.
`ProjectWorkspaceScopeState` now carries `initialLoadPending`, reported by the
hook rather than inferred from `loading`: true from mount until the first settled
answer (a scope OR a failure) for the current `projectId`, false for that
project's whole lifetime afterwards, and reset when `projectId` changes because a
different project genuinely has not been read. `runWorkspaceIdentity` keys the
fallback on that bit alone, and its docblock names which of the two loading
reasons it serves so the distinction cannot erode.
The field is required, not optional, so every construction site has to state
which case it is. Two pre-existing assertions in
`useProjectWorkspaceScope.test.tsx` now document the distinction they always
exercised: a project A->B rerender reports pending (B is unread), while a
same-project identity change reports not-pending — the exact window this fixes.
* fix(collab): align unbound project mutation identity
Allow an identified caller to mutate a project that no workspace has claimed, matching the existing headerless and unbound-resource behavior without persisting a new binding. Name the caller on Home auto-send while keeping AMR preflight scope derivation unchanged.
* fix(web): refresh the settled run billing scope
Track the project billing context in both callbacks that read it so an auto-send after scope settlement cannot preflight through a stale unscoped closure. Add a regression whose run identity stays referentially stable while the billing scope changes.
* fix(web): stop asserting disproved run scope
* fix(web): guard workspace-scoped catalog reads (#6249)
* fix(web): guard workspace-scoped catalog reads
* fix(web): guard remaining plugin catalog races
* fix(web): align design catalog guard scope
* fix(landing): show introductory team totals
* fix(daemon): label critique with project skill (#6251)
* fix CI scopes across file renames (#6252)
* fix(ci): preserve scopes across renames
* fix merge queue rename ceiling detection
* test raw merge compare responses
* fix(landing): make contact sales KV canonical
* fix(web): preserve Cloud sign-in during outages (#6274)
* fix(collab): allow shared project viewer comments
* fix(web): keep readonly comment creation available
* feat(web): personal/team project labels + collapse chat for shared non-owners (#6294)
* feat(web): rename sidebar project lists and collapse chat for shared non-owners
Workspace home left rail now labels personal vs team project lists
("Personal projects" / "Team projects", 个人项目 / 团队项目) across all
locales. Opening a confirmed shared team project that the viewer did not
create defaults the chat pane to collapsed so the design is primary;
owners and personal projects keep chat open, and expanding chat stays
sticky for the visit.
* fix(web): use effective ownership for shared non-owner chat default
Default-collapsed chat was latching on raw isOwner, so a catalog-confirmed
owner whose collab status was still missing ownerMemberId looked like a
non-owner and permanently collapsed chat. Expose isEffectiveOwner and
isSharedNonOwner from useProjectCollab (catalog + session-created + status)
and gate the sticky collapse path on the confirmed non-owner signal only.
* fix(web): stop narrow chat error cards stacking titles vertically (#6295)
Move the long Open Design Cloud switch CTA into UserActionCard footer
actions (same shell as run-recovery), add a card-width container query so
head actions reflow when ChatPane is narrow, and soften title wrapping so
CJK copy no longer renders one character per line.
* fix(workspace): make resource authority explicit (#6287)
* fix: make workspace authority explicit across resources
* fix(web): keep new team projects writable during scope load
* fix: close workspace authority review gaps
* fix(web): retry rejected project auto-send
* fix: propagate workspace scope to project consumers
* fix: cache project read workspace authority
* fix(web): stabilize project scope revalidation
* fix: cache project collaboration status authority
* fix: cache collaboration status owner reads
* fix: revalidate media wait tool authority
* fix: rehome member comments on local threads
* fix(web): stabilize project resource authorization
* fix(web): prioritize settled project authority
* fix(web): consume queued home auto-send handoffs
* fix: revalidate dirty comment pulls
* fix: isolate mutation authority reads by session
* fix: cache project presence read hot path
* fix(web): stop unauthorized project background writes
* fix(web): require settled scope for project background work
* fix(web): scope remaining project reads by workspace
* fix(web): scope remaining project resource consumers
* fix(web): partition project caches by full authority
* fix(daemon): pin run workspace billing scope
* fix(daemon): lease workspace read authority
* fix(daemon): keep presence reads on the hot path
* fix(web): refresh deck thumbnails across workspace scope
* fix(daemon): revoke stale unshared team mirrors
* perf(daemon): cache stale mirror read guards
* fix(web): gate deep-link reads on project workspace
* fix(web): keep deep-linked project tab scoped
* fix(web): preserve project routes during onboarding
* fix(web): keep project previews warm across file-list toggles
* perf(daemon): refresh presence without cold reads
* fix(web): keep retained preview iframes connected
* fix(web): reuse exact HTML thumbnail sources
* fix(web): settle read-only empty project chat
* fix(daemon): scope CLI run transports by workspace
* test(web): align preview cache refresh semantics
* fix(web): require positive shared viewer ownership proof
* fix preview auto-fit measurement feedback
* preserve preview fit during annotation freezes
* preserve preview measurement semantics on refresh
* stabilize preview overflow measurement test
* test design systems move exclusively to team
* fix design systems move exclusively to team
* test shared project title scope convergence
* test(daemon): cover project command workspace scope
* fix(daemon): scope project command transports
* fix shared title test project state type
* fix(daemon): preserve shared project catalog title
* fix(daemon): keep foreign mirrors creator-unattributed
* fix(web): recover first shared project conversations
* fix(web): fence conversation recovery generations
* test(web): verify conversation recovery cleanup fence
* UI polish batch: cloud sign-in, onboarding, composer menu (#6281)
* UI polish batch: cloud sign-in, onboarding, composer menu
Sign-in surfaces (rail callout, balance-gate dialog, onboarding) had
drifted from the visual system and lost some redundant chrome; this
batch tightens them up alongside a couple of composer/design-files
reorganizations that were sitting in the same working tree:
- Rail's signed-out callout: reorder copy above the login pill, give
the pill an icon + accent-green label, restore the Escape hatch
the pill had before it lost its close affordance.
- AmrBalanceDialog (insufficient-balance / signed-out gate): add a
full-bleed art banner above the copy, drop the now-redundant icon
badge, tighten spacing/shadows to match.
- Onboarding cloud landing: switch from a single centered column to
a two-column layout (form pane + full-bleed art panel), move the
language switcher into the footer, swap the local-CLI/BYOK links
for icon Buttons, and add a dismiss control to the activation-retry
hint.
- Composer "+" menu: fold 插件/设计百宝箱 back in as hover-expand
submenu rows instead of standalone quick pills above the input.
- Design files panel: move new-document/upload actions out of the
always-visible toolbar into the empty-state actions only.
- Message center: drop the redundant header close button (backdrop
click and Escape still dismiss it) and restyle the list from
bordered cards to a divider-separated list.
- New `key` / `robot` / `translate` / `arrow-right` icons; language
menu switches from the `languages` glyph to `translate`.
- Tab launcher popover reverts to the glass material; language
dropdown gets a max-height + scroll so long lists don't blow out
the popover.
Rebased the composer-quick-pill removal onto this branch's own
accessibility work on those pills (opener-based focus return via
`ComposerStandalonePanel`) rather than reverting it — the "next step"
card still drives the same standalone-panel API, just without a pill
to hand focus back to. Also updated/removed the tests that pinned the
now-removed surfaces (quick-pill popup contract, message-center close
button, onboarding top bar, design-files toolbar upload trigger) so
none of this lands with a newly-red suite.
* perf(web): optimize onboarding cloud artwork
* fix(web): invalidate project file reads after mutations
* fix(web): disable readonly project starter mutations
* fix(web): preserve focus for standalone composer panels
* test(e2e): require explicit workspace scope
* fix(web): invalidate file reads on project events
* test(e2e): seed explicit settings workspace
* test(e2e): align manual edit with current inspector
* fix(web): refresh deployments when share opens
* test(e2e): follow composer design system entry
* fix(web): keep local project creation workspace-independent
* fix(web): preserve scoped auth recovery state
* test(e2e): follow current entry settings flows
* fix(web): preserve AMR retry across settings
* test(e2e): model explicit personal workspace recovery
* test(e2e): stabilize AMR logout settings recovery
* fix(projects): return workspace scope on create
---------
Co-authored-by: lefarcen <935902669@qq.com>
* fix(workspace): preserve scoped projects after main sync (#6320)
* fix(daemon): surface AMR OpenCode stall context (#6040)
* fix(daemon): surface AMR OpenCode stall context
* fix(daemon): accept runtime-omitted OpenCode diagnostics
Generated-By: looper 0.11.0 (runner=fixer, agent=codex)
* fix(ci): make static gate runner-independent (#6039)
---------
Co-authored-by: PerishFire <39043006+PerishCode@users.noreply.github.com>
* test(e2e): parallelize restoration group (#6169)
* test(e2e): parallelize restoration group
* test(e2e): identify conversations from persisted prompts
Generated-By: looper 0.11.0 (runner=fixer, agent=codex)
* test(e2e): wait for conversation persistence
---------
Co-authored-by: Looper <looper@noreply.github.com>
* feat(landing-page): sharpen the Codex agent page for "codex ui" intent (#6200)
The /agents/codex-design/ page ranks #1 for "codex design" but only ~6th
with a 1.3% CTR for "codex ui", a query that grew from 30 to ~90 daily
impressions this month. A live SERP check shows the intent is mostly
"build UI with Codex" (our intent), with a minority looking for the Codex
app's own interface.
- Retitle to "Codex Design: Build UI with OpenAI Codex" (title + H1).
- Lead the frontend section with the query phrase and an answer-shaped
opening paragraph, so the section is extractable for AI answers.
- Add a disambiguation paragraph separating the Codex app's own UI from
the UI you build with Codex, and route the former back to the main line.
- Add two FAQ entries covering both readings; they also feed the FAQPage
schema, which already earns a text snippet on this query.
Applied across all 11 shipped locales (en, zh authored; the other nine
translated with the page's terminology preserved).
Co-authored-by: Joey <236967869+joeylee12629-star@users.noreply.github.com>
* Add Clone Audit plugin (#5687)
* Add Clone Audit plugin
* Update open-design.json
* fix: make clone audit skill reusable
* fix: sanitize clone audit provenance path
* fix(e2e): bound tools-dev runtime lifecycle (#6204)
* test(e2e): refresh full-pool UI fixtures (#6211)
* fix(web): allow skipping required chat questions (#6177)
* fix(web): allow skipping required chat questions
* fix(web): auto-skip unanswered chat questions
---------
Co-authored-by: xiaoche-hub <298951296+xiaoche-hub@users.noreply.github.com>
* docs(tools-pack): add build cache contract (#6207)
* docs(tools-pack): add build cache contract
Document the tools-pack build-graph cache as a contract: the exact-match
acceptance model, determinant rules, materialization-time parameters, the
signing boundary, and fail-closed confidence grading.
The rules come from an audit of all 11 cache nodes. Two are written down
because nothing currently enforces them: a node key must carry the key of
every upstream node it consumes, and a node key must not restate a list that
already exists as a constant.
Known low-confidence points are declared explicitly so fail-closed grading
stays checkable rather than becoming a verbal convention.
* docs(tools-pack): clarify cache materialization exceptions
Generated-By: looper 0.11.2 (runner=fixer, agent=codex)
* docs(tools-pack): document NSIS base version scope
Generated-By: looper 0.11.2 (runner=fixer, agent=codex)
---------
Co-authored-by: Looper <looper@noreply.github.com>
* docs(landing-page): add 0.16.0 release post, localize and re-cover 0.15.1 (#6236)
* docs(landing-page): localize 0.15.1 post, fix its cover, add 0.16.0 release post
The 0.15.1 blog post shipped English-only and with an off-brand cover: a
Fauvist oil painting overlaid with large display type, which reads nothing
like the warm editorial illustrations every other release post uses. It also
pointed `socialImage` at a 309KB JPEG while a WebP sat unused beside it.
Regenerate the cover in the established house style (cream paper ground,
sage/terracotta watercolour washes, pencil sketch resolving into a calm
product surface), drop the stray JPEG, and add the full ten-locale i18n block
so /zh/, /ja/, /ko/, /de/, /fr/, /ru/, /es/, /pt-br/, /it/ and /tr/ read in
their own language instead of falling back to English.
Also add the missing 0.16.0 "Reliable Delivery" post with a cover plus two
inline figures in the same style, localized across the same ten locales. The
0.16.1 patch is a single preview fix, too thin to carry its own page, so it
lands as a closing section of the 0.16.0 post and the download CTA points
there.
* docs(landing-page): fix doubled apostrophes and locale copy in release posts
Three defects surfaced reviewing the localized bodies.
The French, Italian and Turkish bodies rendered every apostrophe twice —
"aujourd''hui", "all''interno", "0.16.1''i". The `''` escape belongs to
single-quoted YAML scalars, but `bodyHtml` is a block scalar, where content is
literal. 173 occurrences across the two posts.
Korean used Japanese corner brackets and Brazilian Portuguese and Turkish used
French guillemets. All three take curly double quotes.
The Chinese copy read as translation rather than prose. "标签" opens the release
line as a UI label, not a version tag; "抢画框", "编辑策展位" and "安静修复" are
literal renderings that say nothing in Chinese; "画廊" is not the term the
product itself uses for a gallery, which keeps the English word. The tag fix
also lands on 0.10.0 through 0.15.0, which share the phrasing — leaving the
series half-corrected would read worse than either state alone.
* docs(landing-page): drop the leading tag word from release post openings
Every release post opened with the word for a git tag before the version
identifier — "Tag open-design-v0.16.0", "Etiqueta …", "タグ …", and in Chinese
"标签", which reads as a UI label rather than a version. The word carries no
information the identifier does not already carry, and in several languages it
lands as a category noun the sentence never uses again.
Drop it across all nine release posts and every locale, in both the summary and
the opening line, leaving the version identifier to open the dateline. Spanish
and Brazilian Portuguese lose the feminine agreement that referred back to the
removed noun; Turkish loses the trailing "etiketi" apposition for the same
reason.
* docs(landing-page): correct the 0.16.1 interval in the 0.16.0 post
0.16.0 was published 2026-07-22 14:42 UTC and 0.16.1 on 2026-07-23 16:11 UTC —
25.5 hours apart. "Two days later" overstated it, and the same wording had been
carried into all ten localized bodies, so every published route repeated it.
---------
Co-authored-by: Joey <236967869+joeylee12629-star@users.noreply.github.com>
* feat(integrations): add the local Open Design Cloud flow for Codex (#6055)
* feat(daemon): expose Vela login through CLI and MCP
* feat(mcp): add interactive local brief card
* feat(packaged): bootstrap local MCP headlessly
* feat(daemon): secure local BYOK credential profiles
* feat(cli): manage secure BYOK profiles
* feat(web): store BYOK keys in secure profiles
* fix(runs): deduplicate cloud generation requests
* feat(daemon): add end-to-end plugin observability
* fix(pack): include native PTY runtime in desktop packages
Lazy-load node-pty in the daemon so missing native binaries only
disable Terminal and interactive Keychain operations instead of
crashing startup.
Ship and validate target prebuilds in macOS and Windows packages.
Repair the macOS spawn helper before signing, and invalidate stale
Windows packaging caches.
Cover the packaged PTY path in macOS and Windows smoke tests. Require
Vela CLI for every beta desktop build target.
* fix(mcp): localize and stabilize plugin briefs
Keep collect and confirm on one MCP Apps card, report intrinsic size changes,
and remove the fragile widget-state fallback.
Localize brief forms, summaries, status, and public errors from the current
request or Host locale while preserving stable protocol ids and selections.
Keep internal runtime identifiers out of user-facing MCP guidance.
* fix(packaged): register live Studio URLs with daemon
Register the packaged web sidecar loopback origin over namespace-scoped daemon
IPC after dynamic binding.
Invalidate install-info by the live web port and remove the second MCP URL cache
so run and project responses use the current Studio address.
Validate loopback origins and cover registration, rebind, and cache refresh.
* fix(mcp): stabilize brief confirmation lifecycle
Keep confirmed briefs locked after Host publication failures and retry only the cached follow-up message instead of confirming twice.
Replace blank initialization with a compact loading state, accept immediate and delayed tool results, and bump the MCP Apps resource to v3 so Codex does not reuse the stale card.
Add an executable JSDOM Host bridge harness covering double-submit, publication retry, delayed results, and repeated draft notifications. Validated with the full daemon suite, workspace typecheck, and guard.
* fix(mcp): prevent brief app resize feedback loops
Replace the self-observed intrinsic-height loop with deduplicated body measurements so Codex MCP app iframes do not repeatedly resize themselves and fail sandbox startup.
Bump the brief resource URI to v4 to avoid cached v3 cards and cover the regression with the focused brief-app spec. Validated with daemon tests/build, workspace guard/typecheck, a verified beta DMG, and a direct packaged MCP resource smoke.
* fix(mcp): use the final Open Design plugin identity
Make open-design the only accepted external plugin ID across MCP tools, run attribution, artifact version origins, and telemetry. Rename the Brief MCP App resource to v5 and reject the unpublished old ID instead of aliasing it.
Validated with 171 daemon tests, 5 web tests, daemon/web typechecks, and guard.
* chore(pack): bump Vela CLI to 0.0.27
* chore(nix): refresh pnpm dependency hashes
* fix(mcp): honor host and plugin request contracts
Respect independently advertised MCP Apps capabilities and prefer the Codex-native follow-up bridge so confirmed briefs render as readable user turns instead of context-only messages. Bump the brief resource to v6 to invalidate stale cards.\n\nMark Vela login and account probes as open-world interactions, and require stable request IDs for attributed generation so lost responses cannot create a second logical run.
* fix(cli): support keyless BYOK profiles
Add an explicit --no-api-key save mode for local and self-hosted providers while keeping credential-bearing profiles stdin-only. Reject missing or conflicting credential modes and cover both paths in the CLI tests.
* fix(pack): replace headless owner when desktop opens
Advertise headless packaged runtimes as having no visible window, then shut them down before a normal desktop launch continues instead of treating SHOW as a successful focus.
Validated with the focused packaged headless and launcher lifecycle tests (20 passed).
* fix(pack): clean up failed headless startup
Acquire the headless identity, sidecars, and IPC server through one failure-atomic lifecycle so later bootstrap errors close every previously acquired owner in reverse order.
Cover MCP-install and web-identity publication failures; validated with 22 focused tests and the packaged typecheck.
* fix(byok): remove raw provider request contract
Expose only daemon-owned BYOK profile references from shared run types and the web transport, while retaining the daemon's fail-closed rejection for legacy or untyped raw credential payloads.
Validated with 76 web provider tests plus web and contracts typechecks.
* fix(daemon): preserve interrupted run idempotency
Hydrate queued or running durable requests as DAEMON_RESTARTED failures before idempotency reuse, preserving the original request and workflow mappings instead of creating a second cloud operation.
Share the restart transition with boot reconciliation and expose synthetic terminal events to reattaching clients. Validated with 48 focused tests and the daemon typecheck.
* fix(byok): roll back failed credential metadata writes
Snapshot secure-store values before mutation and compensate create, update, and delete operations when profile metadata cannot be persisted, preventing orphaned or lost credentials.
Validated with nine focused credential-service tests and the daemon typecheck.
* fix(web): reconcile selected BYOK profile metadata
Treat the daemon's selected secure profile as authoritative for protocol, endpoint, model, and API version so CLI profile edits cannot leave the browser showing stale execution settings.
Validated with 66 config tests and the web typecheck.
* fix(byok): migrate legacy credentials before cleanup
Import each supported legacy browser credential into a stable daemon-owned secure profile before removing plaintext copies. Keep the original browser record on secure-store or unsupported-provider failures and surface a Settings recovery path.
Cover successful migration, duplicate projections, and injected secure-backend failure while preserving existing Bedrock downgrade behavior in memory.
* fix(byok): secure Windows profiles with DPAPI
Dispatch native Windows BYOK profiles to a CurrentUser DPAPI backend rooted under the resolved daemon data directory. Secrets enter PowerShell only through stdin, encrypted blobs stay separate from non-secret profile metadata, and API responses remain secret-free.
Add platform dispatch coverage, a Windows-only real DPAPI round-trip test, and the packaged Windows smoke path for create, resolve, response-redaction, and delete behavior.
* fix(web): preserve config writes during hydration
* fix(byok): persist secure credentials across entry flows
* test(byok): cover secure onboarding persistence
---------
Co-authored-by: Cheems <94773058+itscheems@users.noreply.github.com>
Co-authored-by: lefarcen <935902669@qq.com>
* test: strengthen E2E coverage and fixtures (#6150)
* test: strengthen e2e coverage and fixtures
* test: allow artifact route when starting conversation
* test: keep e2e count assertions stable
Use the shared stable-count helper for no-request and duplicate-event windows so delayed async events cannot escape the assertions.
Generated-By: looper 0.11.0 (runner=fixer, agent=codex)
* fix: add e2e assertion import extension
Use the explicit runtime extension required by the e2e NodeNext typecheck.\n\nGenerated-By: looper 0.11.0 (runner=fixer, agent=codex)
* fix: preserve design system provenance and settle e2e assertions
Keep disabled design systems available to project recovery and provenance while filtering only runtime injection. Make hover and cancellation checks observe their full settled windows.
Generated-By: looper 0.11.2 (runner=fixer, agent=codex)
* test(e2e): preserve unique restoration run IDs
Pass the restoration fixture's run ID prefix through routeSuccessfulRuns so each mocked request receives a distinct run identity.
Generated-By: looper 0.11.2 (runner=fixer, agent=codex)
* test(e2e): stabilize agent and async count fixtures
Route restoration agent requests through the shared JSON and SSE fixture, capture autosave baselines after a quiet period, and observe onboarding cancellation for a bounded stable window.\n\nGenerated-By: looper 0.11.2 (runner=fixer, agent=codex)
* fix: honor disabled design systems in daemon runs
Filter disabled persisted project selections at prompt and analytics boundaries, and keep restoration run fixtures unique.\n\nGenerated-By: looper 0.11.2 (runner=fixer, agent=codex)
* test(e2e): shorten cancellation duplicate check
Generated-By: looper 0.11.2 (runner=fixer, agent=codex)
* fix(daemon): continue stalled post-tool sessions (#6237)
* fix(daemon): continue stalled post-tool sessions
* fix(daemon): separate post-tool continuation budget
Generated-By: looper 0.11.1 (runner=fixer, agent=codex)
* fix(daemon): preserve retry telemetry budget
Generated-By: looper 0.11.1 (runner=fixer, agent=codex)
* fix(daemon): align retry failure telemetry
Generated-By: looper 0.11.1 (runner=fixer, agent=codex)
* fix(tools-pack): carry workspace build key into tarballs (#6235)
* fix(amr): recover late login failures and trace auth stages (#5986)
* fix(amr): recover late login failures and trace auth stages
* fix(amr): preserve scoped cancel attempt IDs
Generated-By: looper 0.11.1 (runner=fixer, agent=codex)
* fix(amr): defer unsupported Vela auth stages
Generated-By: looper 0.11.1 (runner=fixer, agent=codex)
* fix(amr): narrow fallback telemetry to shipped Vela
Generated-By: looper 0.11.1 (runner=fixer, agent=codex)
* fix(amr): preserve live login after stale cancel
Generated-By: looper 0.11.1 (runner=fixer, agent=codex)
* fix(amr): preserve cancel during login startup
Retain cancellation intent when a provisional cancel races the delayed canonical login response, then cancel the canonical attempt before polling can begin.
Generated-By: looper 0.11.1 (runner=fixer, agent=codex)
* fix(amr): rejoin newer login after startup cancel
Generated-By: looper 0.11.1 (runner=fixer, agent=codex)
* fix(amr): preserve cancel across web login starts
Generated-By: looper 0.11.1 (runner=fixer, agent=codex)
* fix(amr): retain cancel when status refresh fails
Generated-By: looper 0.11.1 (runner=fixer, agent=codex)
* fix(amr): cancel onboarding status preflight
Treat cancellation before an auth attempt exists as a local preflight cancel so a delayed status response cannot start login.\n\nGenerated-By: looper 0.11.1 (runner=fixer, agent=codex)
* ci: constrain Actions cache writes (#6270)
* fix(tools-pack): carry workspace build key into tarballs
* ci: constrain Actions cache writes
* fix(daemon): auto-mint assistantMessageId when clients omit pin (#6107)
* fix(daemon): auto-mint assistantMessageId when API clients omit it
Web always supplies assistantMessageId. Headless/MCP/eval clients that
already send conversationId but omit the pin left lastMessageId null and
skipped multi-turn native session resume (missing_cursor). Mint the id
server-side whenever a conversation is bound and the client did not, and
seed the user message the same way the old MCP-only path did.
* fix(daemon): validate conversation ownership before omit-pin seed
Reorder project-ownership checks before minting assistantMessageId and
seeding the user prompt so cross-project omit-pin requests cannot corrupt
foreign chats. Make ChatRunCreateRequest.assistantMessageId optional and
expose conversationId/assistantMessageId on McpRunCreateRequest with
contract tests for the omit-pin shape.
Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build)
* fix(daemon): reject missing conversation before omit-pin mint
Return CONVERSATION_NOT_FOUND when a client supplies a stale or mistyped
conversationId so omit-pin does not mint an unpersisted assistantMessageId
and plugin snapshot resolve does not FK-crash with a 500.
Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build)
* fix(daemon): seed latest turn and fallback-bound user prompts
Prefer currentPrompt over full message transcripts when seeding omit-pin
user turns, and still seed after conversationId fallback when the client
already supplied assistantMessageId.
Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build)
* fix(daemon): preserve attachments on omit-pin seeded user turns
Copy request attachments and commentAttachments into the server-seeded
user message so omit-pin/headless clients keep chips and annotation
context after conversation reload.
Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build)
* fix(daemon): treat empty currentPrompt as authoritative omit-pin seed
Attachments-only ChatRequest turns send currentPrompt as '' while message
is the flattened transcript. Prefer any string currentPrompt, including
empty, so seeded user rows keep empty content and do not duplicate history.
Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build)
* fix(daemon): seed turn metadata and bump project activity on omit-pin
Persist sessionMode, runContext, and appliedPluginSnapshot on omit-pin
seeded user turns so reload/retry keep applied context. Call updateProject
after seed so listProjects reorders headless/API activity like PUT /messages.
Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build)
* fix(daemon): require projectId for bound conversation ownership
Reject POST /api/runs when conversationId is present but projectId is
missing or non-string, so omit-pin cannot seed messages without owning
project context. Cover both early and post-fallback ownership checks.
Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build)
* fix(daemon): preserve slideIndex and BMP kind on omit-pin seeds
Keep deck annotation slideIndex and classify .bmp as image when seeding
user messages for clients that omit assistantMessageId.
Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build)
* fix(daemon): seed empty message when omit-pin has attachments
When currentPrompt is unset and message is empty, still seed the user
turn if attachment metadata is present so chips/annotations survive reload.
Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build)
* fix(daemon): seed omit-pin chat content from original request
Plugin resolution may rewrite meta.message with a rendered scenario
brief for the run; persist requestBody currentPrompt/message for the
user turn so the internal brief is not shown as chat content.
Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build)
* fix(web): persist browser preview viewport (#4899)
* fix(daemon): honor Kiro ACP turn completion (#6268)
* fix(daemon): isolate plugin-started Local Codex runs (#6273)
Disable Codex plugins only for externally attributed Open Design Plugin runs so Local Codex cannot recursively enter collect_brief or Cloud login. Preserve normal Local Codex plugin loading and the existing operator-wide override.
Validated with the focused runtime args suite, workspace typecheck, guard, and an isolated source smoke that produced a valid artifact without Cloud login.
Co-authored-by: Cheems <94773058+itscheems@users.noreply.github.com>
* fix(landing): accept signed Vela team plan leads (#6283)
* fix: durably deliver enterprise leads
* fix(landing): make contact sales KV canonical
* feat(prompts): introduce on-demand discovery in SP v2.0 (#6223)
* feat(prompts): introduce on-demand discovery in SP v2.0
* fix(prompts): prevent nested deck label overlap
* fix(plugins): stabilize od-default task routing
* fix: address prompt and deck audit regressions
* fix(prompts): restore plan mode precedence
* fix(daemon): accept all form answer headers
---------
Co-authored-by: bone3deep1962-collab <bone3deep1962@gmail.com>
* fix(web): surface BYOK migration validation errors (#6280)
* fix(web): surface BYOK migration validation errors
Preserve structured daemon errors during legacy credential migration and reserve offline guidance for fetch failures.
Keep legacy browser credentials until migration succeeds, and cover HTTP validation, malformed responses, and network failures.
Validated with focused web tests, web typecheck, workspace guard, and workspace typecheck.
* fix(web): stabilize BYOK persistence error telemetry
Map secure-profile HTTP and network failures to semantic error codes before emitting settings_byok_test_result, while preserving existing fallback behavior for unrelated connection-test errors.
Validated with the complete web test suite, web typecheck, workspace typecheck, guard, and git diff --check.
---------
Co-authored-by: Cheems <94773058+itscheems@users.noreply.github.com>
* fix(ui): improve dark-mode contrast for off-state toggles (#5825)
* fix(ui): improve dark-mode contrast for off-state toggles
The default off-state track uses --border-strong (#c9d0da light / #46433c dark).
In dark mode #46433c is only ~5% lighter than the --bg-subtle (#252321) panel
behind it, making the toggle nearly invisible when off and users unsure of the
control state.
Bump the off-state track to #6b6862 with a subtle inset border, and add a
thin outline to the white thumb so it stays visible against the (now lighter)
track. On-state already uses --text (#e8e4dc) and is left unchanged.
Applies to both .toggle-row (used by speaker-notes toggle in the deck tab)
and .compact-toggle (used by SurfaceOptions toggles). Hover lift gives an
additional interactive affordance.
Fixes#5298
* fix(ui): fix two dark-mode toggle blocking issues from review
Two correctness issues called out by mrcfps:
1. System dark theme never gets the contrast fix — the default "system"
theme mode removes [data-theme] and falls back to
@media prefers-color-scheme. Added a parallel block scoped to
html:not([data-theme]) inside @media (prefers-color-scheme: dark).
2. Hover override wins over on-state — .compact-toggle:hover and
.toggle-row:hover have higher specificity than .on
variants, so hovering an ON toggle dropped its track from bright
var(--text) to #75726c. Changed to :not(.on):hover so the hover
lift only applies when off, leaving the on-state always bright.
Both applied to both selector paths (explicit data-theme and system dark).
* fix(web): keep Azure deployment names editable (#6034)
* chore(plugin-previews): refresh baked preview manifest (#6293)
Co-authored-by: open-design-bot <bot@open-design.ai>
* fix(byok): withdraw Windows DPAPI backend (#6308)
* fix(byok): withdraw Windows DPAPI backend
* fix(byok): clean up retired Windows secret blobs
Generated-By: looper 0.11.2 (runner=fixer, agent=codex)
---------
Co-authored-by: Looper <looper@noreply.github.com>
* fix(web): dismiss stale todo after continuation starts (#6307)
* fix(web): preserve shared project update timestamps
* fix(web): reconcile shared timestamps on home
* fix(web): preserve workspace scope in preview assets
* fix(collab): avoid unscoped shared cover requests
* fix(web): avoid double-wrapping preview assets
* fix(web): preserve first prompt across project refresh
* test(web): target the active shared project card
* test(web): keep empty BYOK profile type-safe
* test(e2e): require explicit workspace scope
* fix(web): finish scoped preview hydration
* test(e2e): align manual edit with current inspector
* fix(web): reconcile files after event stream readiness
* fix(web): keep local project creation workspace-independent
* fix(web): preserve scoped auth recovery state
* test(e2e): assert explicit Personal workspace scope
* test(e2e): preserve visual AMR account fixture
* test(web): await scoped cover source
* UI polish batch: cloud sign-in, onboarding, composer menu (#6281)
* UI polish batch: cloud sign-in, onboarding, composer menu
Sign-in surfaces (rail callout, balance-gate dialog, onboarding) had
drifted from the visual system and lost some redundant chrome; this
batch tightens them up alongside a couple of composer/design-files
reorganizations that were sitting in the same working tree:
- Rail's signed-out callout: reorder copy above the login pill, give
the pill an icon + accent-green label, restore the Escape hatch
the pill had before it lost its close affordance.
- AmrBalanceDialog (insufficient-balance / signed-out gate): add a
full-bleed art banner above the copy, drop the now-redundant icon
badge, tighten spacing/shadows to match.
- Onboarding cloud landing: switch from a single centered column to
a two-column layout (form pane + full-bleed art panel), move the
language switcher into the footer, swap the local-CLI/BYOK links
for icon Buttons, and add a dismiss control to the activation-retry
hint.
- Composer "+" menu: fold 插件/设计百宝箱 back in as hover-expand
submenu rows instead of standalone quick pills above the input.
- Design files panel: move new-document/upload actions out of the
always-visible toolbar into the empty-state actions only.
- Message center: drop the redundant header close button (backdrop
click and Escape still dismiss it) and restyle the list from
bordered cards to a divider-separated list.
- New `key` / `robot` / `translate` / `arrow-right` icons; language
menu switches from the `languages` glyph to `translate`.
- Tab launcher popover reverts to the glass material; language
dropdown gets a max-height + scroll so long lists don't blow out
the popover.
Rebased the composer-quick-pill removal onto this branch's own
accessibility work on those pills (opener-based focus return via
`ComposerStandalonePanel`) rather than reverting it — the "next step"
card still drives the same standalone-panel API, just without a pill
to hand focus back to. Also updated/removed the tests that pinned the
now-removed surfaces (quick-pill popup contract, message-center close
button, onboarding top bar, design-files toolbar upload trigger) so
none of this lands with a newly-red suite.
* perf(web): optimize onboarding cloud artwork
* fix(web): invalidate project file reads after mutations
* fix(web): disable readonly project starter mutations
* fix(web): preserve focus for standalone composer panels
* test(e2e): require explicit workspace scope
* fix(web): invalidate file reads on project events
* test(e2e): seed explicit settings workspace
* test(e2e): align manual edit with current inspector
* fix(web): refresh deployments when share opens
* test(e2e): follow composer design system entry
* fix(web): keep local project creation workspace-independent
* fix(web): preserve scoped auth recovery state
* test(e2e): follow current entry settings flows
* fix(web): preserve AMR retry across settings
* test(e2e): model explicit personal workspace recovery
* test(e2e): stabilize AMR logout settings recovery
* fix(projects): return workspace scope on create
---------
Co-authored-by: lefarcen <935902669@qq.com>
* test(e2e): lock design system team partition
* fix(workspace): stabilize scoped project lifecycle
* test(e2e): stabilize retained workspace transitions
* fix(workspace): retain exact scope through transient outages
* test(workspace): lock outage identity boundaries
---------
Co-authored-by: Ray Xi <2667192167@qq.com>
Co-authored-by: PerishFire <39043006+PerishCode@users.noreply.github.com>
Co-authored-by: Looper <looper@noreply.github.com>
Co-authored-by: Joey-nexu <joeylee12629@gmail.com>
Co-authored-by: Joey <236967869+joeylee12629-star@users.noreply.github.com>
Co-authored-by: bestthanapon <thanapon.suwannasuk@gmail.com>
Co-authored-by: open-design-crew[bot] <299007234+open-design-crew[bot]@users.noreply.github.com>
Co-authored-by: xiaoche-hub <298951296+xiaoche-hub@users.noreply.github.com>
Co-authored-by: Cheems <94773058+itscheems@users.noreply.github.com>
Co-authored-by: Amy <58060647+AmyShang-alt@users.noreply.github.com>
Co-authored-by: Marc Chan <mrc@powerformer.com>
Co-authored-by: _HDCoder <2728073932@qq.com>
Co-authored-by: bone3deep1962-collab <bone3deep1962@gmail.com>
Co-authored-by: Nicholas-Xiong <2482929840@qq.com>
Co-authored-by: mehmet turac <mehmetturac@gmail.com>
Co-authored-by: open-design-release-bot[bot] <295937643+open-design-release-bot[bot]@users.noreply.github.com>
Co-authored-by: open-design-bot <bot@open-design.ai>
Co-authored-by: CHENGLONG WANG <honam884844@gmail.com>
* fix(workspace): seed dashboard workspace input
* test(workspace): cover live dashboard workspace input
* fix(workspace): backfill legacy workspace names
* test(e2e): harden workspace collaboration coverage (#6312)
Harden Workspace collaboration authority, lifecycle cleanup, and browser coverage.\n\nRetry an expired authorized Team-project pull exactly once with a fresh receipt while preserving fail-closed scope, version, cleanup, and final freshness checks. Align the fake Vela receipt lifetime with the real two-second contract and use scalable E2E timeouts.
* fix(workspace): refresh dashboard input on switch
* fix(viewer): avoid inert attribute warning
* fix(chat): preserve user turn ordering
* fix(workspace): stop retracted Team plugins immediately (#6335)
Prevent stale Team-plugin listings, materializations, and delayed positive hub reads from reactivating a resource after retraction. Preserve independent Personal plugins with the same manifest ID and keep Team members able to share their own resources.
Add deterministic regression coverage for cache invalidation, binding lifecycle, and the superseded-positive activation race.
* fix(workspace): harden Vela billing proxy boundaries (#6348)
Reject invalid wallet balances without overwriting valid cache state, validate normalized proxy paths and Workspace scope, strip hop-by-hop headers, and tear down upstream requests on disconnect.
Keep team Workspace scope fail-closed when Connection nominates the protected header.
* fix(web): tolerate unnamed workspace directory rows (#6349)
Preserve a verified explicit Workspace context when legacy directory rows omit the display-only workspaceName field. Keep exact-row name backfill when a non-empty name is present, without inferring authority from active or default Workspace state.
* fix(workspace): enforce exact project-list scope
* fix(workspace): show team design systems in pickers
* fix(web): reserve image cards while thumbnails load
* fix(web): keep home creation types ready during refresh
* test(e2e): align Windows beta smoke with installer
* perf(web): start team catalog from exact directory identity
* fix(web): refresh revoked workspace context
* fix(web): order collaboration presence refreshes
* fix(amr): prefer selected Vela OpenCode companion
* fix(web): isolate collaboration presence sessions
* fix(web): parallelize scoped project route bootstrap
* perf(daemon): cache workspace project list authority
* fix(web): preserve project-open connection budget
* test(web): preserve memory toast exports in app mock
* fix(web): preserve exact project opening scope
* fix(daemon): coalesce scoped comment pulls
* fix(daemon): retry team comment relay delivery
* fix(daemon): atomically queue comment relay writes
* fix(collab): show team comments across local conversations
* fix(daemon): preserve catalog-only projects on unshare
* fix(collab): close comment realtime catch-up gaps
* docs: add workspace team rollout runbook
* fix(collab): retry failed Team project shares
* fix(workspace): isolate personal projects in recent lists
* fix(daemon): isolate personal design systems
* fix(workspace): authorize runs before plugin snapshots
* test(daemon): align workspace retry contracts
* fix: isolate plugins and skills by workspace member
* fix(workspace): scope design systems in run prompts
* fix(workspace): gate runs before plugin resolution
* fix(daemon): namespace team design system bindings
* fix: close plugin and skill scope leaks
* test(collab): cover project-scoped comment actions
* fix(workspace): scope project resource selection
* fix(workspace): preserve personal design system reads
* fix(workspace): authorize scoped run resources first
* fix(workspace): keep project design systems scoped
* fix(types): carry design system member scope
* fix(billing): scope personal balances by workspace
* fix(workspace): preserve unbound local design systems
* fix: resolve team design systems by canonical binding
* fix(workspace): invalidate nested project catalog cache
* fix: keep team design system runs canonical
* perf: batch durable comment relay delivery
* fix: cancel stale local comment relays
* fix(web): preserve scoped project display snapshots
* fix(web): synchronize project rename projections
* perf: reuse request-scoped workspace authority
* test: enforce personal project creator ownership
* fix(web): wait for project workspace authority
* fix(daemon): invalidate team project caches before signaling
* fix(web): order targeted project metadata refreshes
* fix(workspace): preserve team catalog on outages
* fix(web): isolate catalog display across accounts
* fix(web): scope extension marketplace catalogs
* fix(web): order broad team catalog refreshes
* fix(web): scope home plugins to workspace identity
* fix(web): isolate plugin views by workspace identity
* fix(web): polish sign-in and composer focus
* fix(web): preserve scoped project state after team moves
* fix(workspace): enforce scoped design and billing identity
* test(e2e): align workspace flows with scoped bootstrap
* fix(collab): drain newer comment revisions promptly
* test(e2e): keep owner actions after workspace lock
* fix(web): converge project renames across scoped lists
* fix(web): preserve pending projects across view changes
* fix(web): restore preview runtime after activation
* test(e2e): align workspace scope assertions
* test(web): cover hidden stream recovery
* fix(web): update deep-link project titles after rename
* fix(collab): retry project metadata propagation
* fix(web): preserve legacy design system logos
* fix(web): wait for activated preview bridge
* fix(design-systems): isolate team resource storage
* fix(plugins): reject team mirror mutations
* fix(web): partition extension catalogs by workspace
* fix(skills): isolate team mirrors by workspace
* fix(plugins): keep local share projects unscoped
* fix(web): retry preview state capture during activation
* test(e2e): scope project workspace fixtures explicitly
* feat(collab): coordinate team resource invalidations
* fix(collab): emit team resource changes after sync
* fix(web): invalidate project lists after updates
* fix(web): serialize project renames by scope
* fix(collab): preserve team project comment anchors
* fix(web): refresh shared resources after remote changes
* fix(collab): materialize team projects before rename
* fix(web): keep workspace catalogs current
* fix(web): close catalog and credential races
* test(workspace): harden team workflows and packaged deep links (#6358)
* test(workspace): harden team workflows and deep links
* fix(packaged): deliver hot invite deeplinks
Generated-By: looper 0.11.7 (runner=fixer, agent=codex)
* fix(workspace): catch up team resources safely
Generated-By: looper 0.11.7 (runner=fixer, agent=codex)
* fix(workspace): invalidate resource catch-up changes
Generated-By: looper 0.11.7 (runner=fixer, agent=codex)
* fix(workspace): catch up shared resource changes
Generated-By: looper 0.11.7 (runner=fixer, agent=codex)
* fix(packaged): preserve fallback invite deeplinks
Generated-By: looper 0.11.7 (runner=fixer, agent=codex)
* fix(workspace): hide retracted team skills
Generated-By: looper 0.11.7 (runner=fixer, agent=codex)
* test(e2e): align workspace CI fixtures with route bootstrap
* fix(collab): complete design system reconnect adoption
* feat(analytics): track Workspace interactions (#6397)
* feat(analytics): track Workspace interactions
* fix(analytics): dedupe community page views
---------
Co-authored-by: elifive555555 <296440099+elifive555555@users.noreply.github.com>
* fix(daemon): preserve team comments across conversations
* fix(collab): keep presence rosters converged
* fix(comments): preserve routed comment anchors
* fix(workspace): reconcile team project renames
* fix(collab): preserve member directory last-good state
* perf(collab): start scoped Team presence before status
* fix(comments): keep relay anchors internal
* perf(collab): warm presence from daemon cache
* perf(collab): cancel obsolete cold status polls
* fix: fence presence sessions against late heartbeats
* perf(collab): share team member roster scheduling
* fix(collab): preserve roster store through strict replay
* perf(collab): retain workspace member directory stores
* fix(collab): resolve presence identities from team directory
* fix(collab): hide unresolved presence identities
* fix(collab): prefer directory presence names
* perf(web): preload workspace member directory
* test(collab): preserve no-leave lifecycle contract
* fix(web): preserve personal workspace presence after share
* fix(web): refresh covers after team materialization
* fix(web): refresh files after team materialization
* fix(web): gate shared file reads on project authority
* fix(web): preserve workspace folder action sizing
* ci(e2e): split project-workspace UI P0 shard into project-workspace + project-collab
project-workspace pins workers=1 by design (deliberate, not incidental —
see e2e/AGENTS.md's UI test stability rules on cross-file worker carry-over),
so its 7 files ran fully serially: ~26min wall time in recent merge-queue
runs, the longest pole in the ui_p0 matrix by a wide margin over its
10-13min siblings.
workspace-multi-client-collab.test.ts alone (spins up two isolated
client/daemon runtimes per case) accounted for ~10 of those minutes.
Carving it and workspace-keyboard-flows.test.ts into a new project-collab
shard — still workers=1, still one file at a time — lets the two halves
run as separate concurrent CI jobs instead of one long serial chain,
without touching the single-worker-per-shard isolation the pin exists for.
Updates the topology guards that pin the exact matrix shape so the split
doesn't drift silently: DAEMON_RUNTIME_DEFINITION_MATRIX_NAMES (scopes.ts),
the full/candidate matrix name guards (guard/scope.ts), and the fixed
expectations in scopes.test.ts / packaged-smoke-workflow.test.ts.
Validated: pnpm guard (UI P0 shadow contract + CI topology checks pass),
pnpm typecheck (all workspaces), and the two topology test files
(107/107 passing).
* fix(collab): revoke unshared team project mirrors
* fix(web): preserve unbound project authority across workspace changes
* fix(web): pair scoped raw queries with headers
* test(e2e): pin writable scope for project actions
* test(web): cover Personal authority recovery after reload
* test(web): await version preview readiness
* fix(workspace): scope brand design system resources
* fix(workspace): materialize owner team design systems
* fix(web): fence design system reads by generation
* fix(web): propagate brand read generations
* fix(web): preserve workspace project visibility
* fix(preview): retain scope for runtime relative assets
* fix(web): explain design system delete denial
* fix(daemon): bound team resource prewarm scopes
* fix(daemon): recheck prewarm lease after queue
* fix(web): stabilize transient presence roster gaps
* chore(pack): pin Vela CLI 0.0.28
* fix(workspace): move design system project with team share
* fix(workspace): gate linked unshare on live authority
* fix(workspace): ensure backing project before design share
* fix(web): scope srcdoc preview assets
* perf(web): mint preview scope only for srcdoc
* perf(web): reuse srcdoc preview scope
* chore(nix): refresh pnpm deps hashes for vela-cli 0.0.28
pnpm-lock.yaml moved @powerformer/vela-cli from 0.0.27-test.7 to 0.0.28, but nix/pnpm-deps.nix was not regenerated, so `nix flake check` failed with a fixed-output hash mismatch for both the daemon and web derivations.
Hashes taken from the Nix-reported expected values in CI run 30933223422 (nix is not available on this machine to run `pnpm nix:update-hash` locally); the merge of origin/main did not touch pnpm-lock.yaml, so those values still describe this tree.
* chore(ci): retrigger workspace-team validation
The previous ci run for this branch sat pending with zero dispatched jobs; cancelling it and pushing an empty commit re-enters the ci-6142 concurrency group from a clean slot.
* perf(web): skip preview mint for authored base
* fix(collab): preserve presence through lease gaps
---------
Co-authored-by: Ray Xi <2667192167@qq.com>
Co-authored-by: CHENGLONG WANG <honam884844@gmail.com>
Co-authored-by: lefarcen <ontf116@gmail.com>
Co-authored-by: PerishFire <39043006+PerishCode@users.noreply.github.com>
Co-authored-by: Looper <looper@noreply.github.com>
Co-authored-by: Joey-nexu <joeylee12629@gmail.com>
Co-authored-by: Joey <236967869+joeylee12629-star@users.noreply.github.com>
Co-authored-by: bestthanapon <thanapon.suwannasuk@gmail.com>
Co-authored-by: open-design-crew[bot] <299007234+open-design-crew[bot]@users.noreply.github.com>
Co-authored-by: xiaoche-hub <298951296+xiaoche-hub@users.noreply.github.com>
Co-authored-by: Cheems <94773058+itscheems@users.noreply.github.com>
Co-authored-by: Amy <58060647+AmyShang-alt@users.noreply.github.com>
Co-authored-by: Marc Chan <mrc@powerformer.com>
Co-authored-by: _HDCoder <2728073932@qq.com>
Co-authored-by: bone3deep1962-collab <bone3deep1962@gmail.com>
Co-authored-by: Nicholas-Xiong <2482929840@qq.com>
Co-authored-by: mehmet turac <mehmetturac@gmail.com>
Co-authored-by: open-design-release-bot[bot] <295937643+open-design-release-bot[bot]@users.noreply.github.com>
Co-authored-by: open-design-bot <bot@open-design.ai>
Co-authored-by: shangxinyu1 <shangxinyu@refly.ai>
Co-authored-by: elifive555555 <296440099+elifive555555@users.noreply.github.com>
* feat(web): manual edit v2 direct manipulation (v2.2–v2.4)
Selection overlay with action bar and drag/resize handles, floating text
toolbar with range-format highlight (queryCommandState round trip), Manus
color picker, image replace/crop/paste/drop, element copy/duplicate/delete,
and the systematized in-place content pipeline: every element-scoped patch
now reconciles the live iframe DOM from the saved source over
od-edit-apply-dom (replace/insert-after/append-child/prepend-child/remove)
with positional identity restamping, so commits, undo and redo never reload
the canvas, never flash, and never move the scroll position. Frozen-source
reloads remain only as a scroll-capturing fallback. Includes the Chromium
Home/End double-booking fix, the dblclick word-selection guard, and light
targets-broadcast dedupe.
* test(web): manual edit v2 unit and e2e coverage
Bridge (in-place apply ops, positional restamp, selection format state,
Home/End consumption, dblclick selection guard), source-patches (insert
readback, restore descriptors, sanitization), gestures/shortcuts/color
units, and host-level FileViewer suites proving content commits mutate the
canvas without a srcDoc reload, hand selection to inserted elements, and
record labeled manual versions for undo/redo. Also realigns the
manual-edit-history and srcdoc-reload-races helpers with the v2.1 opt-in
inspector two-step flow.
* docs(specs): manual edit v2 architecture spec
Six-layer map (identity/chrome/style/content/history/external-sync), core
invariants (DOM equals saved source without reloads; positional identity
restamps on structural change; every save is a labeled manual version),
patch-kind application matrix, performance contract, and the v2.1–v2.4
revision log including the real-browser verification round.
* fix(tools-dev): fail fast when a sidecar process dies during startup wait
waitForDaemonRuntime/waitForWebRuntime now accept a liveness probe for the
spawned pid, so a crashed daemon/web process surfaces immediately instead
of burning the full startup timeout.
* fix(web): edit brand-kit pages in place — no reload flash, no scroll jump
Brand-kit targets carry runtime-annotated ids with no markup of their own in
the saved source (edits persist into the payload / runtime overrides), so
the in-place readback came up empty and every commit fell back to a
srcDoc reload — the flash-and-jump-to-top the user hit when editing text
after an image. New od-edit-apply-dom op 'apply-content' mirrors the patch
fields (text/href/src/alt/html/attributes, on*/data-od-* filtered) onto the
live element instead, and set-outer-html reuses replace with the patch
html. The reload fallback's scroll restore also gains a clamped-only retry
ladder (600–4000ms) so async-rendering pages (brand kit renders after
load) no longer land at the top when a reload is genuinely needed.
* refactor(FileViewer): unify manual edit history management and enhance undo/redo functionality
This update introduces a consistent approach to managing manual edit history and undo/redo stacks by utilizing refs to mirror state. The new `updateManualEditHistoryStack` and `updateManualEditUndoneStack` functions ensure that the state remains in sync with the refs, preventing stale data issues during undo/redo operations. Additionally, the handling of in-session undo (Cmd+Z) has been improved to escalate to the host's global history when no local changes remain, ensuring a seamless user experience. Tests have been added to verify the correct behavior of these features.
* feat(manual-edit): enhance manual edit functionality with space scaling and improved gesture handling
This update introduces a new `ManualEditSpaceScale` interface to manage the scaling between viewport pixels and CSS pixels, ensuring accurate positioning during manual edits. The `manualEditMovePreviewTransform` and `manualEditResizeStyles` functions have been updated to utilize this scaling, improving the precision of drag and resize gestures. Additionally, the `ManualEditSelectionOverlay` component now maintains pointer capture during gestures to prevent interaction issues with nested iframes. Tests have been added to verify the correct behavior of these enhancements, ensuring a smoother user experience in manual editing scenarios.
* feat(FileViewer): add localized toasts for image upload process in manual edit
This update enhances the manual editing experience by introducing localized toast notifications for the image upload process. New messages for uploading, processing, and successful addition of images have been added to the i18n files. The `insertManualEditImage` function now manages these notifications, providing users with real-time feedback during image uploads. Additionally, tests have been implemented to ensure the correct display of these toasts across different locales.
* fix(manual-edit): drag whole image to move + lock selection frame to element box (#5888)
Two direct-manipulation fixes reported from real prototype/landing/deck edits:
1. Move by dragging the image body, not only the top pill. Adds a
full-interior moveBody surface inside the selection frame that starts the
same undoable move gesture; scoped to image targets so text/link bodies
keep click-to-edit. Rendered under the resize handles so edges still resize.
2. Keep the selection frame locked to the element during resize. The frame
previously drew the gesture-intent x/width and only adopted the iframe's
measured y/height, so an element that re-centers, caps at max-width, or
reflows on width change left the frame drifting horizontally off the
picture. adoptMeasuredExtent now takes the full measured rect and
displayRect follows it, so the chrome always wraps the element.
Adds ManualEditSelectionOverlay tests for body-drag move and measured-box
frame sync; records the change as spec v2.5.
Co-authored-by: Claude <noreply@anthropic.com>
* test(web): stabilize manual edit browser validation
* fix(manual-edit): address structural edit review blockers
* fix(manual-edit): preserve runtime formatting and restore order
* fix(manual-edit): flush toolbar styles before navigation
* fix(manual-edit): preserve runtime target identity
* fix(manual-edit): serialize saves and image handoff
* fix(manual-edit): clear stale runtime clipboard
* fix(manual-edit): scrub rich text identities
* fix(manual-edit): save inspector text after formatting
* fix(manual-edit): action-bar boundary avoidance, select-without-reflow, image paste shortcut (#5892)
Three edit-mode canvas fixes from user feedback:
1. Action bar no longer covers the element frame/handles. A small or
edge-hugging element previously had its move pill and resize handles
hidden under the floating action bar (clamped to the top), so it could not
be moved or resized. New pure helper manualEditActionBarTop places the bar
above the frame, flips it below when the element hugs the top edge, and
keeps it inside the canvas; horizontal clamping already handles the side
edges. Adds a data-placement attribute.
2. Selecting a text element no longer makes it jump/grow. The bridge fused
'select' and 'enter inline edit' into one click, and making a deck text box
contenteditable releases its line-clamp/height cap so it visibly reflows
larger the instant it is selected. The first click now only selects (no
contenteditable, no reflow); editing begins on a second click of the
already-selected element or a double-click — matching how images/containers
already select.
3. A selected image/container can be pasted with Cmd/Ctrl+V. The native paste
event only fires while an editable element holds the caret, which never
happens for non-text selections, so the shortcut did nothing for images.
The bridge keydown handler now forwards od-edit-paste-request for a selected
non-editable element (paired with the existing Cmd/Ctrl+C copy).
Updates the 14 inline-edit bridge tests to enter edit via double-click and
adds coverage for all three fixes; recorded as spec v2.6.
Co-authored-by: Claude <noreply@anthropic.com>
* fix(manual-edit): image corner scaling, nowrap unlock on resize, restore image paste
Three edit-mode canvas fixes from user feedback:
1. Images get four corner anchors that scale aspect-locked from any corner,
anchored at the opposite corner (new resize-nw/ne/sw/se gesture kinds).
The dominant pointer axis drives the scale, the floor binds the larger
dimension, and corner gestures skip snapping so the ratio never breaks.
Corner resizes persist width AND height (space-scale corrected) plus the
offsets that keep the anchored corner fixed.
2. Resizing an element with white-space: nowrap (or pre) now unlocks
wrapping (normal / pre-wrap) alongside the width — a narrowed heading
previously stayed on one line and overflowed its own new box.
ManualEditStyles and the bridge style props gain whiteSpace.
3. Image paste works again. The v2.6 Cmd/Ctrl+V keydown branch called
preventDefault, which suppresses the native paste event — the only place
clipboard image bytes are readable — so pasting an image did nothing.
The shortcut now arms a 150ms one-shot element-paste fallback instead;
any real paste event disarms it and routes image vs element itself, so
the two channels never double-fire.
Adds gesture/overlay/bridge coverage for all three; recorded as spec v2.7.
* fix(manual-edit): replay runtime history in place
* fix(brands): reject scraped CSS junk font families before token emission
An extraction can capture CSS source text instead of a real font family
(e.g. Tailwind v4's `--theme(--default-font-family` from aliyun.com).
Interpolated raw into the kit's `--brand-font-family`, the unbalanced
parenthesis swallows every later :root declaration, so the component kit
renders unstyled (UA serif, collapsed buttons) while earlier color tokens
still work.
isRenderableFontFamily() now guards both emission seams: the seed's
fontStack (kit/variables/artifacts token block) and brandFontAssets'
display-family stack (h1-h3 face). Junk families drop out and the
renderable fallbacks + system stack take over.
* fix(manual-edit): replay runtime-only style history from the persisted override rule
Runtime-only brand-kit targets persist set-style patches in the
style[data-od-manual-edit-runtime-overrides] rule, not as element inline
styles. The in-place history replay read inline styles only, so redo of a
runtime style change replayed empty values while reporting success — the
file held the redone style while the canvas stayed on the undone one.
readManualEditSavedStyles() now reads a target's persisted styles wherever
they live (inline attribute for source-backed nodes, the runtime override
rule otherwise), and the set-style history branch replays through it. The
same inline-only read also made reconcileManualEditStyleSave() treat every
runtime style save as "target vanished" — erroring, dropping the selection,
and reloading the canvas — so it now consults
hasManualEditRuntimeStyleOverride() before taking that path.
Regressions: source-patches unit coverage for the saved-styles read and the
override predicate, plus a FileViewer spec that styles a runtime target,
undoes and redoes it without any srcdoc change, and asserts the redo
preview carries the persisted value (red on the previous head).
* fix(manual-edit): merge partial runtime style patches into the persisted rule
Successive debounced toolbar autosaves send only the touched property, but
setRuntimeStyleOverride() rebuilt the target's override rule solely from the
incoming patch, so a runtime-only brand-kit target lost its earlier saved
declarations (fontSize save, then color save -> font-size silently dropped).
Persistence now merges the incoming patch into the existing rule
declarations, treating empty incoming values as deletions and removing the
rule once its last declaration is deleted.
---------
Co-authored-by: Claude <noreply@anthropic.com>
Stable shipped 0.12.0 (tag open-design-v0.12.0, 2026-06-26) but main's
packaged base version stayed at 0.11.1. release-beta's metadata guard
requires the packaged base version to be strictly greater than the latest
stable, so the daily beta build (notify-daily-feishu, 01:00 UTC) has failed
every morning since 2026-06-27 with:
packaged base version 0.11.1 must be strictly greater than latest stable 0.12.0
Bump all 18 workspace package.json versions in lockstep to 0.12.1 so main
leads stable again. Verified the real prepare-beta guard now resolves
0.12.1-beta.1 (EXIT 0) against the live stable/beta feeds.
main read 0.10.1 (== latest stable 0.10.1), so the daily beta build's
strictly-greater-than-stable version guard refused to produce a beta
from main. Advance the 0.10.x dev line to 0.10.2 across the same 16
lockstep workspace package.json that #4381 bumped, and align the
packaged-smoke stable dry-run fixture to 0.10.2.
This continues the existing beta line on R2 (0.10.2-beta.4) so a build
from main produces 0.10.2-beta.5.
Back-fill the 0.10.1 version bump that shipped via the release/v0.10.1
branch (tag open-design-v0.10.1, already published) but never merged
back to main. The feature/perf content of that release already landed
on main via #4198, #4203 and #4202; only the version-number bump and
the packaged-smoke stable fixture were left behind, so main still read
0.10.0.
This applies the release-specific deltas onto current main:
- bump version 0.10.0 -> 0.10.1 across the 16 workspace package.json
in the 0.10.x release set (apps/daemon, apps/desktop, apps/landing-page,
apps/packaged, apps/web, e2e, root, packages/contracts, packages/download,
packages/host, packages/launcher-proto, packages/platform,
packages/sidecar-proto, packages/sidecar, tools/dev, tools/pack)
- align e2e packaged-smoke stable fixture to 0.10.1
launcher-proto was added to main after the 0.10.1 release branch was cut,
so it was not in the original release commit; it is part of the lockstep
0.10.x release set (private workspace package, sibling of sidecar-proto),
so it is bumped here to keep main release metadata consistent.
Independently-versioned workspace packages (agui-adapter, components,
diagnostics, metatool, plugin-runtime, registry-protocol, tools/serve,
telemetry-worker) are intentionally left untouched.
Supersedes the stale release/v0.10.1 PR (#4205).
* feat(runtimes): register AMR (vela) as an ACP stdio agent
AMR is the vela CLI's ACP runtime mode. `vela agent run --runtime opencode`
speaks ACP JSON-RPC over stdio (see vela's
`specs/current/runtime/manual-agent-run-openrouter.md`); per
`docs/new-agent-runtime-acp.md` we expose it through the same `streamFormat:
'acp-json-rpc'` transport that already powers Hermes, Devin, Kimi, etc.
The new `defs/amr.ts` is the entire wiring — `buildArgs` returns
`['agent', 'run', '--runtime', 'opencode']`, `fetchModels` reuses
`detectAcpModels`, and the fallback list seeds the OpenRouter ids vela's
e2e baseline uses. `executables.ts`/`app-config.ts`/`metadata.ts` get the
matching `VELA_BIN`/`VELA_LINK_URL`/`VELA_RUNTIME_KEY`/`VELA_OPENCODE_BIN`
allowlist + install/docs URLs, so users can configure the per-agent env in
Settings without leaking into other adapters.
Coverage: `tests/fixtures/fake-vela.mjs` is a minimal ACP stub that returns
the documented `initialize` / `session/new` / `session/set_model` /
`session/prompt` shapes; `tests/amr-acp-integration.test.ts` spawns it via
`child_process.spawn` and drives a full turn through `attachAcpSession` and
`detectAcpModels`, so the ACP transport contract for AMR is end-to-end
verified locally even before a real `vela` binary is installed.
Validated:
- pnpm guard
- pnpm typecheck (all workspace projects)
- pnpm --filter @open-design/daemon test (2881/2881)
Deferred: real OpenRouter-backed turn through a built `vela` binary —
the runtime def needs no changes for that path, only `VELA_RUNTIME_KEY`
and `VELA_LINK_URL` in env (or Settings).
* fix(runtimes/amr): pin a concrete default model and bare openai ids
End-to-end validation against a freshly-built `vela` (nexu-io/vela@main)
+ OpenRouter surfaced two contract details the first AMR runtime def
got wrong:
1. vela rejects `session/prompt` with `session/set_model must be called
before session/prompt`. attachAcpSession in apps/daemon/src/acp.ts
skips set_model whenever the picked model is the synthetic 'default'
id, so AMR's fallback list must NOT include DEFAULT_MODEL_OPTION. The
def now ships a concrete `gpt-5.4-mini` as both `fetchModels`'
default option and `fallbackModels[0]`, which makes attachAcpSession
always send a real `session/set_model` for AMR turns.
2. `vela --runtime opencode` auto-prepends `openai/` to whatever modelId
it forwards to opencode's openai provider. With OpenRouter-style ids
like `openai/gpt-5.4-mini`, opencode receives the double-prefixed
`openai/openai/gpt-5.4-mini` and replies `ProviderModelNotFoundError`.
The new fallback list ships the bare ids opencode's openai registry
actually knows about (gpt-5.4, gpt-5.4-mini, gpt-5.4-fast, etc.).
Stub + tests:
- tests/fixtures/fake-vela.mjs now enforces the set_model gate the same
way real vela does, so a regression that silently goes back to
model: 'default' would surface as a fatal error in tests instead of a
hidden production failure.
- tests/amr-acp-integration.test.ts pins both contracts: no 'default' /
no 'openai/' prefix in fallbackModels, and a negative case that
asserts session/prompt fails when no model is set.
Adds `apps/daemon/scripts/verify-amr-real-vela.mjs` — a small dev-time
runner that drives `attachAcpSession` against a real `vela` binary and
prints the daemon's chat events, so future protocol drift can be checked
against an actual OpenRouter call.
Verified locally: `vela agent run --runtime opencode` + OpenRouter
returns the prompted string ("AMR-E2E-PASS") through the full daemon
pipeline; daemon test suite stays 2883/2883.
* fix(runtimes/amr): substitute concrete model when chat run sends 'default'
A plugin-driven AMR run from the UI surfaced a real-world hole in the
prior commit:
json-rpc id 3: session/set_model must be called before session/prompt
The Default-design-router plugin (and any caller that doesn't pin a
real model) sends `model: 'default'` straight through, which the AMR
runtime def cannot accept — vela rejects `session/prompt` without
`session/set_model` and attachAcpSession skips set_model whenever
model === 'default'. Just leaving DEFAULT_MODEL_OPTION out of the
adapter's `fallbackModels` is not enough: the chat-run handler in
server.ts still forwarded 'default' verbatim.
This adds `resolveModelForAgent(def, resolved, env?)` as the
single source of truth for the substitution:
1. If the caller picked a real id, pass it through.
2. Else, if `def.defaultModelEnvVar` is set and the daemon process
env has a non-empty value for it, return that (operator escape
hatch — see below).
3. Else, if the def's `fallbackModels` does NOT contain a 'default'
id, return `fallbackModels[0].id`.
4. Else, return the original value (the historic shape — defs that
list 'default' themselves are untouched).
AMR sets `defaultModelEnvVar: 'VELA_DEFAULT_MODEL'`, so when
opencode's openai-provider registry deprecates `gpt-5.4-mini`
upstream, an operator can swap the fallback id without a code change
by exporting `VELA_DEFAULT_MODEL=gpt-5.5` before launching tools-dev
/ od. Worth noting the env var must live in the daemon's `process.env`
(Settings-UI per-agent env values only reach the spawned child, not
the daemon's resolver) — the new field's docblock spells this out.
Coverage:
- `tests/runtimes/resolve-model.test.ts` — 8 unit tests covering all
four resolver branches plus the env-override happy path / fallback /
ignore-when-user-picked-a-real-id case.
- `pnpm --filter @open-design/daemon typecheck` clean.
* chore(runtimes/amr): move AMR to the top of the base agent list
So `AMR (vela)` shows up first in the agent picker / status views,
ahead of claude / codex. Pure ordering change; no behavior delta.
* feat(amr): Sign-in / Sign-out button on the AMR Settings card
The first half of the AMR work assumed the operator would set
VELA_RUNTIME_KEY / VELA_LINK_URL on the daemon process and never
surfaced login state to users. This adds the missing UX so a fresh
install can drive the full path from Settings:
- GET /api/integrations/vela/status reads ~/.vela/config.json
for the active profile and returns { loggedIn, profile, user }
(without leaking the runtime/control keys themselves).
- POST /api/integrations/vela/login spawns `vela login` once
(409 if one is already in flight). The vela CLI opens the user's
browser to the device-authorization page itself — Open Design
only needs to kick the subprocess off.
- POST /api/integrations/vela/logout removes ~/.vela/config.json
so the next status read returns logged-out.
`AmrAgentCard` is a dedicated agent-card component for AMR because
the existing `<button>` row can't host an interactive sub-control
(nested interactive elements). It polls /status after a login click
until the daemon reports loggedIn=true (or 5 minutes elapse), and
exposes a Sign-out action on hover. Other adapters (claude, codex,
hermes, …) keep their existing `<button>` card.
i18n: 8 new keys (settings.amrLogin / Logout / LoggingIn / etc.)
added to en + zh-CN. Other locales spread `en` and inherit the
English copy until translations land.
Coverage:
- `tests/integrations/vela.test.ts` pins the config.json reader
against a tmp HOME — including the negative case where a profile
has user info but no runtimeKey (still logged-out), and the
secret-leak guard ("rt-secret-*" must not appear in the projection
payload).
- `tests/components/AmrAgentCard.test.tsx` covers all four UI
states (logged-out, logging-in, logged-in, logging-out) plus the
click-propagation invariant the divergent card was built to keep.
`pnpm --filter @open-design/daemon test` 2901 / 2901 passing.
`pnpm --filter @open-design/web test` 1719 / 1719 passing.
`pnpm typecheck` + `pnpm guard` clean.
Dev script side-effects: `apps/daemon/scripts/verify-amr-real-vela.mjs`
no longer requires both VELA_RUNTIME_KEY and VELA_LINK_URL — if
VELA_PROFILE is set, the vela CLI is allowed to resolve credentials
from `~/.vela/config.json`. Added the two AMR `.mjs` fixtures to
`scripts/guard.ts` allowlist with the executable-fixture / dev-runner
rationale.
* fix(connection-test): substitute model for AMR before attachAcpSession
The chat-run path in server.ts already routes the requested model through
`resolveModelForAgent` so AMR / vela (whose CLI demands an explicit
`session/set_model` before `session/prompt`) gets the def's first
concrete fallback id when the chat run ships `model: 'default'`.
`connectionTest.ts` was wiring `attachAcpSession({ ..., model: model ?? null })`
directly, which made the Test Connection button on the AMR Settings
card deadlock with the same `session/set_model must be called before
session/prompt` error the chat-run path already handles — surfaced as a
permanent "Testing connection…" spinner in the UI.
Reuse the same helper here so Test Connection mirrors chat-run behavior.
* test(amr): three-layer end-to-end coverage for the AMR login + turn flow
The PR up to this point shipped runtime + UI code with unit-level Vitest
coverage. This commit adds the cross-layer regression net the live demo
relied on:
1. apps/daemon/tests/integrations/vela.routes.test.ts (HTTP, Vitest)
Spins up the real daemon Express app via `startServer({port:0,...})`,
persists `agentCliEnv.amr.VELA_BIN = <fake>` into app-config.json,
and exercises every /api/integrations/vela/* endpoint against the
extended fake-vela stub:
- status reads ~/.vela/config.json under various states
- login spawns the fake, waits for config.json to appear, returns
pid + startedAt + profile
- 409 already-running guard with the stub's delay knob
- logout removes the file (idempotent)
- secrets (runtimeKey / controlKey) never leak in the projection
- login → status round-trip flips loggedIn=false → true
2. e2e/tests/amr/turn.test.ts (tools-dev orchestrated, Vitest)
Boots a namespaced daemon + web pair through `createSmokeSuite`,
inlines a self-contained fake `vela` binary that handles BOTH
`vela login` (writes ~/.vela/config.json) and
`vela agent run --runtime opencode` (ACP stdio with the
`session/set_model must precede session/prompt` gate the real binary
enforces), then drives a complete /api/runs lifecycle for
`agentId: 'amr', model: 'default'` and asserts the assistant message
captures the fake's streamed text. This is the test that would have
surfaced today's plugin-default-model regression (the `set_model
before prompt` error) at PR time instead of demo time.
3. e2e/ui/amr-login-pill.test.ts (Playwright)
Mocks /api/agents + /api/integrations/vela/{status,login,logout}
to drive the Settings AMR card through the full Sign in → Signed in
→ Sign out cycle. Pins the AmrLoginPill polling contract and the
aria-label semantics (the pill's accessible name is "Sign out" once
logged in, regardless of which label the hover-state text shows).
fake-vela.mjs extensions:
- Handles `vela login` argv by writing
~/.vela/config.json for the active VELA_PROFILE and exiting 0 —
mirrors real vela's on-disk side-effect without the device-auth
loop.
- FAKE_VELA_LOGIN_DELAY_MS knob so route tests can observe the
in-flight state of the spawn lifecycle.
- FAKE_VELA_LOGIN_USER_EMAIL / _USER_PLAN to assert the surfaced
user fields end-to-end.
Validated:
- `pnpm guard` + `pnpm typecheck` (all workspace projects)
- `pnpm --filter @open-design/daemon test`: 2998 / 2998 passing,
including the new 8-test integration suite.
- `cd e2e && pnpm test tests/amr`: 1 / 1 passing.
- `cd e2e && pnpm exec playwright test ui/amr-login-pill.test.ts`:
1 / 1 passing (6.7s).
* feat(amr): package native cli and refine login ui
* feat(amr): wire vela cli beta packaging
* docs(amr): document vela ci packaging review
* docs(amr): refine vela ci integration review
* fix(ci): refresh nix pnpm dependency hashes
* fix(pack): clean up Vela CLI packaging
* fix(pack): bundle Vela CLI support files
* fix(amr): recover login attempts from stale auth state
* test: expand AMR and automations coverage
* fix(amr): address review follow-ups
* test(web): align tasks fixtures with contracts
* fix(daemon): type wildcard route params
* fix(ci): refresh PR merge validation
* fix(amr): clear env credentials on logout
* feat(settings): inline local CLI model configuration
* fix(amr): recognize daemon env credentials
* [codex] Fix Vela companion packaging (#2979)
* Fix Vela companion packaging
* Update Nix pnpm dependency hashes
* [codex] Surface AMR account failures (#2980)
* fix: surface AMR account failures
* fix: cover AMR recovery error guidance
* chore: bump beta base version to 0.8.1 (#2990)
* Fix AMR profile and packaged runtime review issues
* Detect packaged AMR OpenCode companion tree
* feat(web): polish AMR frontend flows
* Polish AMR onboarding card
* fix: read AMR login state from dot-amr config (#3048)
* test: tighten AMR credential and packaging coverage
* test: restore AMR executable test env helper
* [codex] Fix packaged mac Dock identity and AMR label (#3076)
* Fix packaged mac sidecar Dock identity
* Rename AMR assistant label
* Fix AMR live models and dot-amr login state (#3073)
* fix: read AMR login state from dot-amr config
* fix: load live AMR models before runs
* fix: point AMR onboarding link to production wallet
* fix: address AMR model review feedback
* fix: persist live AMR model fallback
* [codex] Fix AMR link catalog model ids (#3088)
* Fix packaged mac sidecar Dock identity
* Rename AMR assistant label
* Fix AMR link catalog model ids
* Fix AMR model normalization typecheck
* Use live AMR model for default runs
* fix: polish AMR runtime settings UI
* Accelerate AMR startup defaults (#3092)
* Surface AMR insufficient balance wallet URL (#3099)
* fix(web): polish onboarding controls (#3112)
* fix(web): show CLI scan loading state
* Avoid duplicate AMR wallet recharge links (#3117)
* Avoid duplicate AMR wallet recharge links
* Use Vela CLI 0.0.3 test package
* chore(nix): refresh pnpm deps hash
* Fix AMR wallet guidance display
---------
Co-authored-by: open-design-bot[bot] <282769551+open-design-bot[bot]@users.noreply.github.com>
* chore(pack): pin Vela CLI 0.0.3-test.1 (#3127)
* chore(nix): refresh pnpm deps hash
* chore(pack): pin Vela CLI 0.0.3
* chore(nix): refresh pnpm deps hash
* fix(web): suppress AMR exit 130 fallback (#3136)
* feat(web): nudge users to hosted AMR on model/auth/quota failures (#3083)
* feat(web): nudge users to hosted AMR on model/auth/quota failures
When a non-AMR agent run fails with an auth / quota / upstream model
error, surface an inline nudge under the error pill linking to Open
Design's hosted AMR gateway (https://open-design.ai/amr). The nudge
fires `surface_view` (element=run_failed_toast) on impression and
`ui_click` (element=go_amr) on the link.
Also teach the daemon to classify CLI-agent auth/quota/upstream failures
(Claude Code, codex, ...) into specific API error codes
(AGENT_AUTH_REQUIRED / RATE_LIMITED / UPSTREAM_UNAVAILABLE) instead of
the generic AGENT_EXECUTION_FAILED, so both the error message and the
nudge key off accurate codes. AMR's own runs are excluded from the
nudge — they keep the dedicated sign-in / recharge affordances.
* feat(web): rework failed-run AMR guidance into per-case error UI
Replace the single inline nudge with a per-case failed-run experience
driven by the run's error code + agent:
- The error card is now neutral gray (was red) and always carries a
retry button; it is driven by the persisted per-message error event so
it survives a reload.
- Non-AMR agent hitting a model/auth/quota wall: a theme-color promotion
card under the error card offers "switch to AMR & retry" — switches the
run to AMR, opens Settings on the AMR card, and auto-retries once the
account signs in (ProjectView polls vela login status, independent of
the Settings pill lifecycle, with success / 5-min-timeout / unmount
exits).
- AMR agent unauthorized: clearer copy + an "authorize & retry" button.
- AMR agent out of balance: clearer copy + a "top up" button to the AMR
wallet, with manual retry.
- Settings AMR card: when opened from the nudge, it scrolls into view and
pulses, and an authorize-button coachmark (a fake hand cursor that
rises in and dismisses on hover) points at the sign-in control when not
yet authorized.
analytics: surface_view (run_failed_toast) on the promotion card and
ui_click (go_amr) on its action are retained. i18n adds chat.amrCard.*
and chat.amrError.* (en / zh-CN / zh-TW translated; other locales fall
back to en) and drops the old chat.amrErrorGuidance keys.
* fix(daemon): require status context for numeric service-failure codes
Per review on #3083: the model-service classifier matched bare HTTP
status numbers (`500`, `502`, `429`, `401`), so ordinary CLI output like
`line 500`, `read 502 bytes`, or `exit code 401` could be misclassified
as a provider outage / auth wall and wrongly surface the AMR nudge. Now
a status number only counts when it carries explicit context (`HTTP 500`,
`status 503`, `code: 401`, `502 Bad Gateway`); textual provider phrases
(overloaded, bad gateway, service unavailable, rate limit, …) are
unchanged. Adds fixtures proving unrelated numeric output stays null.
* fix(web): keep error pill for failed runs ChatPane's card doesn't cover
Per review on #3083: the per-message gray error pill was suppressed for
every persisted error status event, but ChatPane only renders the
replacement top-level error card for `retryableAssistantMessage` (the
last failed assistant). So a failed turn that is no longer last (after a
follow-up) or an older failed run in history showed neither the pill nor
the card — its error detail vanished, undercutting reload/history
survival. ChatPane now passes `errorCardOwnerId` (the assistant id whose
error the card represents); AssistantMessage suppresses only that one
pill and keeps rendering StatusPill for all other error events.
* fix(daemon): don't treat a process exit code as an HTTP status
Follow-up to review on #3083: the status-context helper accepted a bare
`code` prefix, so `exit code 401` / `process exited with code 429` still
matched and got classified as AGENT_AUTH_REQUIRED / RATE_LIMITED (the
very `exit code 401` case the comment calls out as noise). `code` now
only counts when qualified (`status code` / `error code` / `response
code`) or punctuation-bound (`code: 401`); bare `exit code N` no longer
matches. Adds fixtures for exit-code lines returning null.
* chore(web): translate AMR card / error keys for 16 remaining locales
PR #3083 added 10 new `chat.amrCard.*` / `chat.amrError.*` keys but only
provided en/zh-CN/zh-TW translations; the other 16 locales fell back to
English. Translate the card title/body, three chips, primary CTA, and
the AMR self-error (auth / balance) messages and buttons for ar, de,
es-ES, fa, fr, hu, id, it, ja, ko, pl, pt-BR, ru, th, tr, uk.
* fix(amr): address review feedback on #2355
Targeted fixes for the unresolved review threads on #2355. Each fix
includes / updates a focused test.
- runtimes/executables.ts: `packagedVelaOpenCodeCompanionTree` now
verifies the inner `opencode` executable exists + is runnable, not
just the directory. This closes the false-positive availability path
that let `detectAgents()` surface AMR as available even when the
packaged companion was empty / partially copied (mrcfps, 4 threads).
- runtimes/executables.ts: `resolveAmrOpenCodeExecutable` now prefers
the bundled `<OD_RESOURCE_ROOT>/bin/libexec/opencode/opencode` over a
stale `opencode` on the user's PATH, so packaged AMR builds can't be
hijacked by a global installation.
- web/EntryShell.tsx: when the Local CLI scan returns an available
agent and the previously-selected agent is AMR, switch the selection
to the first available local agent so the runtime and persisted
agent agree before Continue.
- server.ts (model-probe branch): for AMR, check `readVelaLoginStatus`
BEFORE rejecting on an empty live-model catalog — a signed-out user
was getting `AMR_MODEL_UNAVAILABLE` ("choose a model") instead of
the correct `AMR_AUTH_REQUIRED` (sign-in affordance).
- server.ts (default model fallback): if the user asked for the AMR
agent default and the cached id is no longer in the FRESH catalog,
fall back to `liveModels[0]` from the probe instead of rejecting the
run as `AMR_MODEL_UNAVAILABLE`.
- integrations/vela.ts: route `vela login` through
`createCommandInvocation` so an npm/Node-style `vela.cmd` / `.bat`
shim on Windows gets the correct `cmd.exe /d /s /c …` wrapping with
verbatim args (matches `execAgentFile` / chat-run spawning).
- tools/pack/src/linux.ts: in containerized Linux builds, bind-mount
the host directory of `OPEN_DESIGN_VELA_CLI_BIN` and rewrite the env
to the container-side path. The host path was being passed in as-is
even though the default container only mounts /project, /tools-pack
and cache/home — `copyOptionalVelaCliBinary` saw a missing path.
Deferred (out of scope for this PR):
- `od amr status/login/logout/cancel` CLI subcommands (AGENTS.md
UI/CLI dual-track rule, server.ts:5763) — sizable surface; tracked
for a separate focused PR.
- Strict `--require-vela-cli` for Windows + mac-x64 beta builds:
prematurely blocked — `@powerformer/vela-cli` only publishes the
`darwin-arm64` platform binary today; adding the flag elsewhere
would fail the builds. Revisit once win/x64/linux binaries ship.
* fix(amr): hoist sendAmrAccountFailure above the AMR catalog preflight (TDZ)
The new signed-out AMR branch in the catalog preflight at server.ts:10875
calls `sendAmrAccountFailure(...)` to emit AMR_AUTH_REQUIRED, but the
const declaration sat ~100 lines below at the outer function scope. Because
`const` is TDZ-aware, that branch would have thrown `ReferenceError:
Cannot access 'sendAmrAccountFailure' before initialization` for the
exact users it tries to help — defeating the original intent.
Hoist the helper to just above the AMR preflight block so it's available
to every AMR code path in this function. Behavior elsewhere is unchanged.
Also rerun the daemon test suite: `launch.test.ts > resolveAgentLaunch
uses packaged built-in Vela for AMR` was creating the
`<resourceRoot>/bin/libexec/opencode/` companion *directory* only, but
this PR's earlier tightening of `packagedVelaOpenCodeCompanionTree`
also requires the inner `opencode` executable. Add it to that fixture
to match the new contract; the test was a sibling of the executables /
env-and-detection fixtures already updated in 13fc4f4.
Addresses #2355 review (mrcfps, 2026-05-28).
* feat(web): add hover cancel for AMR login (#3158)
* feat(web): add hover cancel for AMR login
* fix(web): don't bounce AmrLoginPill back to 'Signing in…' after local cancel
Both codex-connector (P2) and looper (CHANGES_REQUESTED) on this PR
flagged the same race in the new local-cancel path: `handleCancelLogin`
dispatches `notifyAmrLoginStatusChanged('login-canceled')` immediately
after `/login/cancel` returns, but the `AMR_LOGIN_STATUS_EVENT` listener
unconditionally re-enters `refresh()` and then restarts polling
whenever `/api/integrations/vela/status` still reports
`loginInFlight: true`.
That is a real race because the daemon's `cancelVelaLogin()` only sends
SIGTERM (escalating to SIGKILL after `LOGIN_CANCEL_KILL_GRACE_MS` =
2000 ms) and keeps the child in `activeLoginProcs` until it actually
exits — so the first `/status` read after a successful cancel can
legally still come back as in-flight. Under that window the pill flips
back to 'Signing in…' and can later surface the timeout/error path even
though the user already canceled, defeating the behavior promised in
the PR description.
Fix the listener instead of every dispatch site: in the
`login-canceled` branch, after the local reset (stopPolling +
setPending(null) + clear refs), optimistically mark every subscribed
pill instance as not-in-flight (`setStatus((c) => c ? { ...c,
loginInFlight: false } : c)`) and `return` — skip the
refresh-and-reconcile branch below entirely. The next explicit refresh
(component mount, user interaction, or a `status-changed` event) will
pick up the daemon's confirmed state once the child has actually
exited.
Add a focused regression test that holds `/api/integrations/vela/status`
at `loginInFlight: true` even after a successful `/login/cancel`,
asserting that the pill stays at the Canceled → Authorize sequence and
never bounces back to 'Signing in…'. This test fails on the pre-fix
listener and passes on the new behavior; existing
'cancels an in-flight AMR sign-in…' and 'reconciles late AMR browser
completion to Signed in after local cancel' tests continue to pass.
Addresses review feedback on #3158 (chatgpt-codex-connector, nettee).
---------
Co-authored-by: lefarcen <935902669@qq.com>
---------
Co-authored-by: a1chzt <chizblank@gmail.com>
Co-authored-by: Amy <1184569493@qq.com>
Co-authored-by: Mason <jinmeihong0201@gmail.com>
Co-authored-by: Caprika <56862773+alchemistklk@users.noreply.github.com>
Co-authored-by: open-design-bot[bot] <282769551+open-design-bot[bot]@users.noreply.github.com>
PR #2461 sync prep — resolves 14 conflicts merging 84 main-side commits
on top of 58 release-side commits accumulated during the 0.8.0 cycle.
Resolution summary:
Take main (theirs) where main carried deliberate forward progress:
- apps/web/src/components/PluginCard.tsx — 7 hunks, i18n migration:
hardcoded English aria-labels/titles replaced with t() calls keyed
on pluginCard.* (all 8 keys verified present in en.ts).
- apps/web/src/components/TasksView.tsx — 1 hunk, source-ingestion
feature: sortedRoutines (newest-first), sourceIngestionTemplates,
patchSourceForm, submitSourceIngestion. activeCount/pausedCount
semantics preserved (now keyed on sortedRoutines, count unchanged).
- e2e/ui/app.test.ts — new node:fs/promises + tmpdir + path + @/timeouts
imports needed by main-side test helpers.
- e2e/ui/settings-local-cli-codex-fallback.test.ts — menu-dismissal
helper block added by main.
Keep both sides where each added a different field to the same object
literal:
- apps/web/src/components/ProjectView.tsx (locale + analyticsHints
spread).
- apps/web/src/components/DesignSystemFlow.tsx (locale + analyticsHints).
Take release (ours) where release carried deliberate work that ships
0.8.0:
- CHANGELOG.md — release-side 0.8.0 entry + PR link refs; main's
Unreleased section was the same body of work, now finalized.
- apps/landing-page/public/{apple-touch-icon,favicon}.png +
apps/web/public/app-icon.svg — release-side visual refresh assets
consistent with 0.8.0 stable ship.
- tools/pack/src/linux.ts — packageVersion const required by line 466;
taking main's empty line would build-error.
- e2e/ui/project-management-flows.test.ts +
e2e/ui/settings-api-protocol.test.ts +
e2e/ui/settings-memory-routines.test.ts — release-side release-smoke
hardening (shangxinyu1 + PerishFire) takes precedence on overlap.
Closes-issue / unblocks: PR #2461 sync release/v0.8.0 → main.
* fix(tools-dev): preserve web origin trust on web start
Restart daemon/web when the trusted web port is missing, and reuse the active web port during repeated starts so run web and start web keep app-config origin checks aligned.
Generated-By: looper 0.0.0-dev (runner=worker, agent=opencode)
* fix(plugins): refresh official registry bundled count
Generated-By: looper 0.0.0-dev (runner=fixer, agent=opencode)
* fix(tools-dev): preserve daemon/web reserved ports
Generated-By: looper 0.0.0-dev (runner=fixer, agent=opencode)
* fix(tools-dev): preserve daemon reuse on web start
Generated-By: looper 0.0.0-dev (runner=fixer, agent=opencode)
* fix(tools-dev): preserve running daemon port on web reuse
Generated-By: looper 0.0.0-dev (runner=fixer, agent=opencode)
* fix(tools-dev): reserve explicit web port before daemon allocation
Generated-By: looper 0.0.0-dev (runner=fixer, agent=opencode)
* test(web): stabilize media provider reload flash timing
Generated-By: looper 0.0.0-dev (runner=fixer, agent=opencode)
* fix(web): restore merged reattach workspace coverage
Generated-By: looper 0.0.0-dev (runner=fixer, agent=opencode)
* fix(tools-dev): reserve allocated daemon port
Generated-By: looper 0.0.0-dev (runner=fixer, agent=opencode)
* test(e2e): wait for artifact manifest persistence
Generated-By: looper 0.0.0-dev (runner=fixer, agent=opencode)
Conflicts resolved by taking origin/main on both files. Root cause:
main's PR #2460 (fix(landing): align logo.webp with brand icon) changed
HomeHero.tsx's .home-hero__brand-mark to render <img src=/app-icon.svg>
instead of an inlined <HeroBrandIcon /> SVG, and bundled the matching
CSS (26px round badge with bg-panel + border + padding 2px) plus a
gap/font-size tune. The release-side visual-refresh CSS still targeted
the SVG layout (38px square, transparent, inset SVG selector). Keeping
release's CSS would leave main's <img> unstyled.
- apps/web/src/styles/home/home-hero.css three blocks, all taken from
main: .home-hero__brand gap 8px, .home-hero__brand-mark redesigned for
<img> child, .home-hero__brand-name font-size 16px.
- apps/web/src/index.css two blocks, both taken from main: workspace
tab close column 22px and .workspace-tab__close 18x18 (paired
tune-down of tab UI spacing).
* feat(daemon): add project working directory management and editor hand-off functionality
- Introduced new flags for project commands to manage working directories, including `--working-dir` and `--dir`.
- Implemented API routes for listing available editors and opening projects in selected editors.
- Added a hand-off button in the ChatPane header to facilitate opening project folders in local applications.
- Enhanced the HomeHero component to include working directory and design system settings, improving user experience in project creation.
- Created HomeHeroSettingsChips component for inline management of working directory and design system selection.
* feat(chat): implement voice transcription proxy and enhance UI components
- Added a new API route for voice transcription using OpenAI's `/audio/transcriptions` endpoint, allowing users to send audio blobs directly for transcription.
- Integrated multer for handling audio file uploads in memory, ensuring efficient processing without disk storage.
- Updated the HomeHero component to include example prompt suggestions for plugins, enhancing user interaction.
- Introduced the EditorIcon component to visually represent different editors in the hand-off menu, improving the user experience.
- Refined the HandoffButton component to utilize the new EditorIcon, providing a more cohesive interface for selecting editors.
- Enhanced CSS styles for various components to improve layout and responsiveness, including adjustments to tab and button sizes for better usability.
* style(workspace-shell): enhance layout and overflow handling
- Updated CSS for .workspace-shell to ensure full viewport width and height, with proper overflow management.
- Adjusted grid layout to prevent content overflow and maintain responsiveness.
- Modified styles for .workspace-tabs-chrome to improve width handling and prevent overflow issues.
* refactor(chat): remove voice transcription proxy and related components
- Deleted the voice transcription proxy implementation, including the associated API route and multer configuration.
- Removed the MicButton component from the ChatComposer and HomeHero components to streamline the UI.
- Updated HomeHero to include example suggestions without the voice input functionality.
- Adjusted CSS styles for various components to maintain layout consistency after the removal of the MicButton.
* feat(daemon): implement minting of HMAC tokens for working directory management
- Added a new function `mintImportTokenFromCurrentSecret` to generate HMAC tokens bound to a specified base directory, enhancing security for working directory operations.
- Updated the `desktop-auth.ts` file to include the new token minting functionality, which returns structured errors when the desktop auth secret is cleared.
- Introduced new IPC message types for minting import tokens in the sidecar protocol, allowing seamless integration with the daemon's working directory management.
- Enhanced the `WorkingDirPill` component to utilize the new token minting flow for secure directory selection in desktop builds.
- Updated CSS styles for the HomeHero component to accommodate new example suggestion features and maintain layout consistency.
* fix(HomeView): import HOME_HERO_CHIPS constant for improved chip management
- Updated the HomeView component to import the HOME_HERO_CHIPS constant from the chips module, enhancing the management of hero chips within the component.
* feat(daemon): implement mintImportTokenViaSidecar for secure working directory management
- Introduced the `mintImportTokenViaSidecar` function to facilitate the minting of HMAC tokens for desktop-import operations via the daemon's sidecar IPC. This allows CLI commands to bypass authentication when the desktop-auth gate is active.
- Updated the CLI to utilize the new token minting function when setting the working directory, ensuring secure access to trust-gated API endpoints.
- Enhanced the sidecar server to handle minting requests and return structured error messages for improved user feedback.
- Added tests to validate the new token minting functionality and its integration with the working directory management process.
- Refactored related components to support the new token flow, improving overall security and user experience.
* feat(HomeHero): enhance UI components and styles for improved user experience
- Updated HomeHero component to replace active dot indicators with Plug icons for better visual representation of active plugins.
- Adjusted CSS styles for various elements, including padding and dimensions, to enhance layout consistency and responsiveness.
- Introduced new styles for active type icons and improved hover effects for buttons.
- Updated HomeHeroSettingsChips to change button titles and icons for clarity.
- Added tests to ensure proper rendering and functionality of updated components.
* feat(ProjectDesignSystemPicker): enhance design system selection with preview functionality
- Updated the ProjectDesignSystemPicker component to include a preview feature for design systems, allowing users to see a preview of the selected design system.
- Implemented hover functionality to update the preview based on the hovered design system.
- Added fullscreen preview capability for a more immersive experience.
- Enhanced CSS styles for the design system picker to improve layout and responsiveness.
- Introduced tests to validate the new preview functionality and ensure proper interaction within the component.
* feat: refactor project metadata handling and enhance design system picker
- Updated the default scenario plugin ID retrieval to use project metadata, improving the logic for determining the appropriate plugin based on project intent.
- Enhanced the ProjectDesignSystemPicker and related components to support localized design system summaries and categories, improving user experience.
- Introduced new translations for working directory and design system picker components, ensuring better accessibility and usability across different locales.
- Added a new 'live-artifact' project type to the HomeHero chips, expanding the functionality for users creating refreshable artifacts.
- Updated tests to validate the new project metadata handling and design system picker functionalities.
* feat: enhance localization and styling for design system components
- Added French translations for working directory and design system picker components, improving accessibility for French-speaking users.
- Updated CSS styles for the pet task item to ensure consistent padding and layout.
- Introduced a new test suite for HomeHeroSettingsChips to validate localization and design system selection functionality.
- Enhanced ProjectDesignSystemPicker tests to ensure proper localization and interaction with design system categories.
* fix: update .gitignore to include all claude-sessions directories and remove specific session files
- Modified .gitignore to ensure all claude-sessions directories are ignored by using a wildcard pattern.
- Deleted two specific claude-sessions markdown files to clean up unnecessary session data.
* fix: repair home automation ci regressions
* fix: stabilize artifact consistency e2e
* Remove folder picker changes from PR 2400
---------
Co-authored-by: pftom <1043269994@qq.com>
Co-authored-by: qiongyu1999 <2694684348@qq.com>
* fix: remove dead ternary in WORKSPACE_ROOT resolution
Both tools/dev and tools/pack config files had:
ENTRY_DIR_NAME === "dist" ? "../../.." : "../../.."
with identical branches. Since `src/` and `dist/` are siblings under
`tools/{dev,pack}/`, both resolve to the same path. The ternary and
ENTRY_DIR_NAME constant were dead code — simplify to "../..".
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* Fix workspace root depth
---------
Co-authored-by: Test User <test@example.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Co-authored-by: PerishCode <perishcode@gmail.com>
* feat(web): pure reducer for Critique Theater states (Phase 7.1)
Pure CritiqueState reducer driven by the contracts-level PanelEvent
(the same shape both the live SSE stream and the recorded transcript
emit), so a single reducer powers both the in-flight panel and the
rerun replay. Lifecycle covers run_started → running → (shipped /
degraded / interrupted / failed), with panelist_open / dim /
must_fix / close / round_end events building per-round
CritiquePanelistView entries as they arrive.
Defensive behaviour that surfaced while writing the spec tests:
- Terminal phases (shipped / degraded / interrupted / failed) are
sticky against further lifecycle events for the same run, except
for parser_warning which can land late and is recorded in a side
channel without changing phase.
- A new run_started for a different runId at any time discards the
prior state and reboots, so the UI can launch consecutive runs
without an explicit reset action.
- Events whose runId does not match the active run return the same
state reference, so React's useReducer doesn't re-render
subscribers on stray traffic.
- Round bookkeeping keys by round number rather than "always last",
so an out-of-order panelist_dim for round 1 arriving after a
round 2 dim does not corrupt the round 2 bucket.
Test coverage: 18 cases covering each transition, the runId guard,
sticky-terminal behaviour, the out-of-order round invariant, and
the stable-identity guarantee. Sets up Phase 7.2 and 7.3 to wire
SSE + replay into the same reducer.
* feat(web): useCritiqueStream hook subscribes to SSE and feeds reducer (Phase 7.2)
createCritiqueEventsConnection is a pure connection manager that
mirrors apps/web/src/providers/project-events.ts: opens an
EventSource at /api/projects/:id/events, listens for every name in
CRITIQUE_SSE_EVENT_NAMES, decodes each frame back into a PanelEvent
(stripping the critique. prefix and merging the data payload), and
hands it to the caller's onEvent. Reconnect uses exponential
backoff (1s → 30s) and resets on `ready`; malformed payloads drop
with a dev-mode warning rather than tearing the stream.
useCritiqueStream wraps the manager in a useReducer that owns the
CritiqueState. enabled=false or a null projectId tears down the
connection cleanly; switching projectId closes the old connection
and opens a fresh one. The returned dispatch lets local UI
synthesise actions (e.g. an Esc keypress firing a synthetic
interrupted while a kill request is in flight); production traffic
comes from the SSE stream.
Test coverage:
- sse.test.ts (10 cases, node env): subscription set covers every
CRITIQUE_SSE_EVENT_NAMES channel; payload decoding lifts the wire
shape back to PanelEvent; malformed JSON is swallowed and does
not stop the stream; exponential backoff schedule and ready-reset
semantics are pinned with a setTimeout seam; close() cancels
pending reconnects and shuts the live source; no-op fallback
when EventSource is unavailable.
- useCritiqueStream.test.tsx (6 cases, jsdom env): idle pre-event,
reducer driven by synthetic actions, no connection when disabled
or projectId is null, clean close on unmount, projectId change
reopens cleanly.
* feat(web): useCritiqueReplay hook drives reducer from transcript file (Phase 7.3)
Fetches the per-run NDJSON transcript (one PanelEvent per line),
parses every line via the shared isPanelEvent predicate, and
dispatches into the same CritiqueState reducer the live SSE stream
uses. A single reducer means the UI rendering a replay can be
identical to the live panel, and a UI mounting both
useCritiqueStream and useCritiqueReplay in parallel does not have
to reconcile two state shapes.
speed knob is `paused | instant | live | { intervalMs: N }`.
- instant flushes every event synchronously, useful for opening a
finished run already at its terminal state.
- intervalMs paces dispatches at a fixed cadence so the reviewer
can watch the run unfold.
- paused parses the transcript but holds events back until the
caller advances speed (consumers can drive a scrubber later).
- live is reserved for the future "playback at original cadence"
feature, currently treated as instant; replay timestamps are not
yet persisted with each event so honest pacing requires a
follow-up Phase 7+ task.
gunzip seam handles `.ndjson.gz` transcripts via
DecompressionStream when present; the production fetch path picks
between text and arrayBuffer based on the URL extension. Both seams
are injectable so the unit tests don't need to spin up a real
network or a real gzip pipeline.
Test coverage (8 cases, jsdom env):
- Idle status before any URL is provided.
- speed=instant flushes the full transcript synchronously to
shipped state.
- speed={intervalMs:N} paces with the setTimeout seam, reaching
done after the last tick.
- speed=paused leaves status=playing with no dispatches.
- Empty transcript reports done with state still idle.
- Fetch rejection surfaces an error status with the message.
- Malformed NDJSON lines are skipped; valid events around them
still land.
- .gz transcripts route through the gunzip seam.
Closes the Phase 7 plan tasks 7.1 / 7.2 / 7.3 (reducer + stream +
replay), all on one branch ready for review. Phases 8+ (Theater
components) consume these from this PR.
* fix(web): close payload-override gap + paused-resume bug in Critique Theater hooks (Phase 7 review)
Two P1 fixes from lefarcen's review on PR #1307:
SSE payload override
`sseToPanelEvent` previously spread `data` after the channel-derived
`type`, so a payload-provided `type` could override the channel and
route a `critique.run_started` frame into the reducer as a `ship`
action. Reversed the spread so the channel-derived `type` is
authoritative, and revalidated the resulting object through the
contracts-level `isPanelEvent` predicate before returning. Frames
that fail validation (missing runId, empty runId, unknown type) are
dropped, so a malformed or compromised SSE frame can no longer
dispatch a wrong-shape action into the reducer.
Three new sse.test.ts cases pin the regression: hostile `type:'ship'`
in the payload still resolves to `run_started`, missing runId is
dropped, empty runId is dropped.
Replay pause/resume
`useCritiqueReplay` had one big effect keyed on `transcriptUrl`
only, so flipping `speed` from `paused` to `instant` never re-fired
and the held events sat undispatched. Split into a parse effect
(depends on URL, fetches and stores events in state) and a pace
effect (depends on parsed-events + speed, owns the cursor + timers).
The playback cursor lives in a ref that survives pause/resume
cycles, so flipping `paused` -> `instant` flushes from the current
position rather than restarting (which would double-dispatch
`run_started` and reset the reducer).
Two new useCritiqueReplay.test.tsx cases:
- paused-then-instant transitions from `playing` to `done` and
reaches the shipped terminal phase
- intervalMs paced playback dispatches one event, pauses to drain
the next scheduled timer, flips to instant, and confirms the
remaining transcript drains exactly once (cursor was preserved)
Doc consistency
The earlier source comment in useCritiqueReplay.ts claimed `live`
"paces by recorded timestamps" while the impl used zero-delay
timers and the PR body said it behaves like `instant`. Aligned to
reality: `live` currently behaves like `{ intervalMs: 0 }` (events
drain on successive microtasks via setTimeoutFn) because transcripts
do not yet carry per-event timestamps. Honest timestamp-driven
pacing is queued as a Phase 7+ follow-up.
Validated: pnpm guard, pnpm --filter @open-design/web typecheck,
Theater suite 47/47 (up from 42, +3 sse + 2 replay), full web suite
96 files / 888 tests.
* feat(i18n): seed Critique Theater key block (en + zh-CN; other locales fall back via spread)
* feat(web): Theater PanelistLane component (Phase 8.1)
* feat(web): Theater ScoreTicker component (Phase 8.2)
* feat(web): Theater RoundDivider component (Phase 8.3)
* feat(web): Theater InterruptButton component with Escape keybind (Phase 8.4)
* feat(web): Theater TheaterDegraded chip (Phase 8.5)
* feat(web): Theater TheaterCollapsed post-run summary (Phase 8.6)
* feat(web): Theater TheaterTranscript replay surface (Phase 8.7)
* feat(web): Theater TheaterStage top-level container (Phase 8.8)
* feat(web): Theater CSS using existing semantic tokens (no hex literals)
* feat(web): Theater public exports barrel
* fix(web): resolve P2 + P3 review feedback on Phase 8 (PR #1314)
Addresses all 4 P2 + 3 P3 items from codex, Siri-Ray, and lefarcen.
State-lifecycle fixes (3 x P2)
1. Reducer learns a synthetic `__reset__` action (`CritiqueResetAction`).
Host hooks dispatch it when their gating prop changes so a stale
run from a prior project / transcript cannot bleed into the next
context. Reset is idempotent on idle (returns the same reference).
2. `useCritiqueStream` dispatches `__reset__` at the top of its
connection effect, so a workspace switch from project A (which
streamed a critique) to project B clears the reducer before the
new EventSource opens. enabled=false also clears.
3. `useCritiqueReplay` dispatches `__reset__` at the top of its
parse effect, so transcriptUrl swaps (including swap-to-null after
a replay reached `shipped`) lift the reducer back to idle before
the new fetch starts.
SSE validation (1 x P2)
4. `sseToPanelEvent` now runs a per-variant `hasValidVariantShape`
check after the cheap `isPanelEvent` predicate. A
`critique.ship` frame missing `composite` / `round` / `status` /
`artifactRef` is rejected before reaching the reducer, so
TheaterCollapsed can no longer crash on `undefined.toFixed(1)`.
Every variant's required fields are validated: run_started
(protocolVersion, non-empty cast, maxRounds, threshold, scale),
panelist_* (round, role, plus variant-specific shape), round_end
(round, composite, mustFix, decision in {continue,ship}, reason),
ship (round, composite, status, artifactRef.{projectId,artifactId},
summary), degraded (reason, adapter), interrupted (bestRound,
composite), failed (cause), parser_warning (kind, position).
Reducer correctness (1 x P2)
5. `panelist_open` now materializes the round + an empty panelist
view (`{dims: [], mustFixes: []}`) so TheaterStage can highlight
the in-progress lane the instant the tag opens. Before this, a
stream that emitted only `panelist_open` after `run_started` left
`rounds = []` and the UI rendered no current round until a later
`panelist_dim` arrived.
Polish (3 x P3)
6. Brand role tint swaps from `var(--magenta, var(--accent))` to
`var(--purple, var(--accent))`. `--purple` is actually defined
across the design systems; `--magenta` is not, so Brand was
silently falling through to `--accent` and looking identical to
Designer.
7. New i18n key `critiqueTheater.interruptedSummary` for the
interrupted-collapse copy ("Interrupted at round N, best
composite X.X"). Previously the interrupted branch reused
`shippedSummary` and the UI read "Shipped at round..." for a run
that specifically did not ship. Native value in en + zh-CN; other
locales fall back via `...en` spread.
8. `TheaterDegraded` heading id comes from `useId()` instead of a
hardcoded `theater-degraded-heading`, so two chips rendered on
the same page (chat history with multiple completed runs) keep
their aria-labelledby references unambiguous.
Tests (15 new cases)
- reducer.test.ts (+5): __reset__ on running/terminal/idle, panelist_open materializes round, panelist_open does not stomp prior panelist data.
- sse.test.ts (+6): variant-level rejection for ship without required fields, degraded without adapter, run_started with empty cast, panelist_dim with non-numeric score, round_end with unknown decision, plus a positive fully-formed ship.
- useCritiqueStream.test.tsx (+2): state reset on projectId change, state reset on enabled flip false.
- useCritiqueReplay.test.tsx (+1): state reset on transcriptUrl swap to null after a replay reached shipped.
- TheaterCollapsed.test.tsx (text-pinning update): asserts the interrupted branch reads "Interrupted at round 1" + "best composite 7.9", and explicitly NOT "Shipped at round...".
- TheaterDegraded.test.tsx (+1): two chips on the same page get unique aria-labelledby ids that each resolve to an `<h3>`.
Validated
- pnpm guard clean
- pnpm --filter @open-design/web typecheck clean
- Theater suite: 13 files, 101 tests (was 86 on the first Phase 8 push, +15 new)
- tests/i18n/locales.test.ts 5 of 5 across 18 locales
* feat(web): CritiqueTheaterMount wires SSE + reducer into a single drop-in (Phase 9.1)
* feat(i18n): Critique Theater strings for de + ja + ko + zh-TW (Phase 9.2)
* fix(web): resolve P1 + P2 review feedback on Phase 9 (PR #1315)
Addresses every blocker from codex, Siri-Ray, and lefarcen. The
three state-lifecycle and SSE-validation issues they also flagged
inherit fixes from PR #1314's review pass that this branch now sits
on top of after rebase.
Real daemon kill on Interrupt (P1)
- CritiqueTheaterMount now POSTs to
/api/projects/:id/critique/:runId/interrupt alongside the
optimistic local dispatch. Before this fix, clicking Interrupt
only flipped the React state to interrupted while the daemon job
kept running. The fetch is best-effort: a 404 (endpoint not wired
yet, lands in Phase 15) is swallowed with a dev-mode console.warn
so the UI still moves to the collapsed badge.
- New fetchInterrupt test seam lets RTL assert on the URL / method
and simulate the "daemon not ready yet" path. Two tests pin both:
the happy URL proj-42/critique/run-abc/interrupt POSTs, and a
rejected fetch still flips the UI.
interruptPending reset on new run (P2)
- A ref-backed effect compares the current runId against the last
one we saw; when it changes, interruptPending is cleared. A user
who interrupts run-1 and then triggers run-2 from the same mount
now gets a fresh, enabled kill button instead of one stuck in
"Interrupting…". Pinned by a new mount test.
Escape keybind scope (P2)
- InterruptButton now checks the keydown target. Escape inside an
input, textarea, select, or contenteditable element is ignored
(and any ancestor of those via closest() is treated the same
way). Body-level focus still fires the keybind so the Theater
area's affordance keeps working. Four new tests cover textarea,
input, contenteditable, and the body-focus positive case.
userFacingName i18n key (P2)
- The spec at specs/current/critique-theater.md:6 mandates a single
critiqueTheater.userFacingName key so the "Design Jury" label can
be renamed without touching code. Phase 8 introduced
critiqueTheater.title by mistake; renamed across types.ts, en.ts,
zh-CN.ts, de.ts, ja.ts, ko.ts, zh-TW.ts, and the lone consumer
TheaterStage.tsx. The locale alignment test stays green.
Validated
- pnpm guard clean
- pnpm --filter @open-design/web typecheck clean
- Theater suite: 14 files, 112 tests (was 101 before, +11 new for
the Phase 9 review pass: 3 mount + 4 InterruptButton focus scope;
the rest were already in #1314's review fix).
- tests/i18n/locales.test.ts 5 of 5 across 18 locales.
* feat(daemon): adapter-degraded registry with TTL (Phase 10.1)
In-memory registry recording adapters that produced malformed or
oversize transcripts so the orchestrator can skip them for a TTL
window (default 24h) instead of cycling through known-bad providers
on every run.
Records carry reason (malformed_block | oversize_block |
missing_artifact), source label, and expiresAt. The test-only
clock seam lets the suite advance time deterministically and prove
that an expired entry stops counting as degraded without anyone
calling clearDegraded.
7/7 vitest cases green.
* feat(daemon): synthetic good + bad adapter fixtures (Phase 10.2)
Two test-only adapters that read the existing v1 transcript
fixtures (happy-3-rounds and malformed-unbalanced) and replay them
as either a full string or a 512-byte chunked stream. The chunked
form is what the conformance harness uses to prove the parser
holds together when the transcript arrives in arbitrary network
slices, not as one buffered blob.
* feat(daemon): adapter conformance harness (Phase 10.3)
runAdapterConformance pulls a transcript through the same
parseCritiqueStream pipeline the orchestrator uses and classifies
the outcome as shipped, degraded, or failed. On a degraded
outcome it forwards the matched reason to the adapter-degraded
registry, so a single nightly conformance run is what populates
the skip list rather than the orchestrator learning each adapter
is broken at request time.
5/5 vitest cases green covering shipped, malformed degraded,
oversize degraded, no-ship failure, and the harness-thrown
failure path.
* test(e2e): Critique Theater Playwright suite (Phase 11)
Six tests, one viewport per visual case, deterministic SSE
fixtures stubbed via page.route(). Adds the suite to
test:ui:extended so the existing extended-UI lane picks it up.
Coverage:
1. Happy path: a single mounted theater plays the full
fixture (1 run_started, 5 panelists open / dim / must_fix /
close, 1 round_end, 1 ship) and ends on the score badge.
2. Interrupt mid-run: the panelist that is open at the time
the interrupt button is clicked closes with an interrupted
marker and the transcript freezes there.
3. Visual regression at 375x720 mobile.
4. Visual regression at 768x1024 tablet.
5. Visual regression at 1280x800 desktop.
6. A11y role tree: the theater region exposes a labelled
landmark, each panelist lane is a group with an accessible
name, the score is a status live region.
All SSE traffic is stubbed by page.route so the suite runs in CI
without a daemon. The toggle is seeded via localStorage by
bootAppWithCritiqueEnabled so the gate behaves as if Settings
flipped it on. typecheck clean; playwright --list reports 6.
* test(web): reducer p99 bench at 10k iterations (Phase 13.1)
Locks the documented 2ms budget for the Critique Theater reducer
on a representative SSE script (27 actions, one full happy run)
behind a regression gate. Asserts p99 stays under 4ms (2x the
documented budget) so CI runners with a noisy neighbour do not
flake while a real regression to 20ms or 200ms still trips.
The bench is a vitest case rather than a bare microbenchmark so
it runs in the same CI lane as every other web test and does not
need a parallel runner.
* test(web): critique surface coverage walker (Phase 13.2)
Walks the public critique surface (11 SSE event names, 5 panelist
roles, 6 lifecycle phases, 9 named i18n keys) and asserts each
named symbol appears in both the src corpus and the test corpus.
The walker is the gate that catches a rename in one half of the
codebase without a matching update in the other half: a future
PR that drops 'panelist_must_fix' from the reducer without also
removing its test reference fails this suite.
62 assertions, one per symbol per corpus.
* docs: Critique Theater user guide (Phase 14.1)
Seven sections aimed at end users (not contributors):
1. What is Design Jury
2. How it works (the five panelists, auto-converging rounds,
the composite formula)
3. Settings (the M1 toggle and what it does)
4. Reading the score badge
5. Replay surface
6. Troubleshooting (degraded, interrupted, failed)
7. FAQ
The composite formula is documented as
designer * 0 + critic * 0.4 + brand * 0.2 + a11y * 0.2 + copy * 0.2
because anyone trying to reverse-engineer the score is going to
search for those weights and the docs are the place they should
land first.
* docs(daemon): critique module AGENTS map (Phase 14.2)
Daemon-side wayfinder for the apps/daemon/src/critique directory.
Tables every file, what owns what invariant, and the 'when you
change anything here' guide so a future contributor does not
have to reverse-engineer the rollout resolver before adding a
new SSE event.
* docs(web): Theater module AGENTS map (Phase 14.3)
Web-side mirror of the daemon AGENTS map. Same file table, same
invariants section, same change-impact guide, sized to the
Theater component package.
* feat(daemon): rollout flag resolver (Phase 15.1)
Single decision point every caller consults to know whether the
orchestrator should wire the critique pipeline for a given run.
Priority:
1. Skill-level policy (required wins, opt-out wins inversely)
2. Per-project override from the Settings toggle
3. OD_CRITIQUE_ENABLED env override
4. Rollout phase default
M0 dark-launch false
M1 settings only false (toggle is off until the user flips it)
M2 per-skill true if skill opted in
M3 global default true
OD_CRITIQUE_ROLLOUT_PHASE parser defaults to M0 on unknown input
so a fresh install never surprises a user with the feature on.
10/10 vitest cases green covering every cell of the matrix.
* feat(web): Settings toggle hook for Critique Theater (Phase 15.2)
React hook that reads critiqueTheaterEnabled from the existing
open-design:config localStorage blob and stays in sync via:
- the platform storage event (cross-tab)
- a open-design:critique-theater-toggle CustomEvent (same-tab)
Same-tab event is the one that fires when the Settings panel saves
in the current window: the toggle and every mounted theater update
without a page reload.
setCritiqueTheaterEnabled(next) is the imperative setter the Settings
panel calls. It preserves the rest of the stored config (mode, apiKey,
etc.) and dispatches the same-tab event after the localStorage write.
The web hook reflects what the user toggled; the daemon-side
isCritiqueEnabled is the final routing authority (project override,
env, rollout phase). When they disagree, the daemon wins for backend
gating and the web reflects the toggle state.
6/6 vitest cases green covering first read, stored read, same-tab
event flip, config preservation, corrupted JSON tolerance, and
cross-tab storage event.
* test(web): Phase 15 toggle hook failure-mode coverage (PR #1320)
lefarcen P2 on PR #1320 flagged that the PR body claimed safe
behavior for disabled localStorage, non-object JSON, and missing
CustomEvent shim, but the suite only covered corrupt JSON plus
happy-path storage events. Added four failure-mode tests so the
swallowed errors are not silently traded for a throw in a future
refactor:
1. Returns false on a stored JSON value that parses to an array
(non-object). Catches a regression where the guard treats
anything truthy as a config blob.
2. Returns false on a stored JSON value of literal 'null'.
typeof null === 'object' in JS, so the guard has to check null
explicitly; this test pins that check.
3. Returns false when localStorage.getItem throws (private mode /
disabled storage / SecurityError). The hook must swallow and
return false so the rest of the app keeps rendering.
4. setCritiqueTheaterEnabled still dispatches the same-tab
CustomEvent when localStorage.setItem throws (quota exceeded /
disabled storage). The dispatch path is the in-session
broadcast that keeps every mounted hook coherent even when
persistence is unavailable; verified by mounting two probes
and asserting both flip after the setter is called with a
throwing setItem.
10/10 vitest cases green (6 existing + 4 new).
* fix(web): honor CustomEvent payload in toggle hook listener (PR #1320)
Both Siri-Ray (blocking) and lefarcen (P2 new) caught the same
real bug in the failure-mode test I added in affcdd27: the test
asserts the in-session UI flips when localStorage.setItem throws,
but the CustomEvent listener was ignoring the event's typed
detail and just calling readToggle(). Under a throwing setItem
the localStorage value is stale (or absent), so the listener
would see the OLD value and the test would fail (or worse, the
production claim 'in-session event keeps mounts coherent' was
hollow).
Fixed the hook, not the test: the listener now reads
event.detail.enabled when it is a boolean, falling back to
readToggle() only for malformed events or for cross-tab storage
events (which do not carry a typed payload). The setter already
dispatched the detail; the listener just was not consuming it.
Test changes:
- The existing 'setItem throws' test now asserts the right
behavior for the right reason. Updated the inline comment to
say the listener reads from detail, not localStorage.
- New test 'falls back to readToggle when the CustomEvent
carries no usable detail' pins the fallback path: a
malformed dispatcher (no detail, or detail.enabled not a
boolean) degrades cleanly instead of throwing or being
silently ignored.
11 / 11 vitest cases green (10 prior + 1 new fallback).
* feat(daemon): route critique spawn-path eligibility through the rollout resolver
The wireup edit Phase 10 and Phase 15 carved out: today server.ts gates
the critique pipeline on critiqueCfg.enabled, which is just the
OD_CRITIQUE_ENABLED env var. After this commit it gates on
isCritiqueEnabled(...) from the Phase 15 resolver, so the full
priority matrix is live:
1. Per-skill od.critique.policy veto (opt-out / required)
2. Per-project override (M1 Settings toggle, written through the
existing Phase 6 settings endpoint)
3. OD_CRITIQUE_ENABLED env override (power-user lane / CI fixtures)
4. OD_CRITIQUE_ROLLOUT_PHASE default
M0 dark-launch false
M1 settings only false
M2 per-skill only when skillPolicy === 'opt-in'
M3 global default true
Default behaviour on a fresh install is unchanged: the resolver
returns false at M0 without an env override or a project override,
so prod traffic falls through to the legacy single-pass path
exactly the way it did before.
Inputs threaded today: phase from OD_CRITIQUE_ROLLOUT_PHASE,
envOverride from OD_CRITIQUE_ENABLED. skillPolicy and projectOverride
are passed as null for the v1 cutover; the daemon-side handler that
round-trips critiqueTheaterEnabled on the project settings row and
the od.critique.policy frontmatter resolver land as the next two
commits in this branch.
The three call sites that used critiqueCfg.enabled (the brand-thread
guard, the skill-thread guard, the top-line critiqueShouldRun
compound) now read from a single locally-scoped critiqueEnabledForRun
boolean, so the eligibility check is computed exactly once per spawn
and the prompt composer + orchestrator stay in lockstep the way
the existing comment already promised.
Tests still green: daemon vitest 22 / 22 across rollout +
conformance + adapter-degraded. Daemon typecheck clean.
* feat(web): mount CritiqueTheaterMount in ProjectView
The web counterpart of the daemon wireup. ProjectView now renders
<CritiqueTheaterMount projectId={project.id} enabled={...} /> as a
sibling of <AppChromeHeader> inside the top-level <div className="app">.
The mount is the drop-in from the Phase 9 stack: it owns the SSE
subscription, the kill-request handshake, and the phase-aware swap
from the live <TheaterStage> to the collapsed badge once a run
settles. The mount returns null until the daemon emits a
critique.run_started for the active project, so the visual surface
is byte-for-byte unchanged for users who have not opted in.
Enabled wiring: useCritiqueTheaterEnabled() reads the M1 Settings
toggle from the existing open-design:config localStorage blob and
stays in sync with both the platform storage event (cross-tab) and
the same-tab open-design:critique-theater-toggle CustomEvent the
Phase 15 setter dispatches. The hook honors the event payload
directly so a private-mode browser that cannot persist the toggle
still updates the in-session UI correctly.
The daemon-side gate (isCritiqueEnabled in apps/daemon/src/server.ts)
remains the authority for whether a run is actually wired through
the critique pipeline. This hook only governs whether the web layer
renders the resulting SSE stream when the daemon emits one. The
two-layer gate is intentional: an integrator embedding the Theater
in a custom UI can flip the web visibility independent of the
daemon's routing decision, and a daemon-side env override flips
backend gating without touching the web's localStorage.
Tests still green: web Theater suite 181 / 181 across 16 files.
Web typecheck clean.
* feat(daemon): resolve od.critique.policy frontmatter at the spawn site
The next step in the wireup branch's ladder: replace the placeholder
`skillPolicy: null` with the actual value parsed from the active
skill's SKILL.md frontmatter.
Three small edits, one new field on a public type:
1. SkillInfo gains a `critiquePolicy: SkillCritiquePolicy` field
carrying the parsed `od.critique.policy` token (required /
opt-in / opt-out / null). The field is null when the skill has
no opinion, which lets the lower-priority resolver tiers
(projectOverride, envOverride, phase default) decide.
2. listSkills() populates the new field via a small
`normalizeCritiquePolicy` helper that tolerates the YAML
scalar's casing and trims whitespace. Unknown tokens collapse
to null so a typo in SKILL.md cannot accidentally force the
panel on or off; it just falls through. Derived example cards
inherit the parent's policy.
3. server.ts captures `skill.critiquePolicy` into a hoisted
`skillCritiquePolicy` variable inside the existing skill-load
block, then threads it into the isCritiqueEnabled call as the
skillPolicy input. The hoisting keeps the variable in scope at
the resolver call site without restructuring the spawn handler.
After this commit, the priority matrix the rollout resolver was
designed for is live for its top tier. The previous commit wired
env + phase; this one wires skill. The projectOverride input
remains null pending the next commit that extends the Phase 6
settings endpoint.
Daemon vitest: 10 / 10 rollout cases pass against the new wiring.
Daemon typecheck: clean.
* feat(daemon): feed projectOverride into the rollout resolver from project metadata
Replaces the placeholder `projectOverride: null` in the spawn
handler with the actual value the Settings panel writes onto the
project's metadata blob: `critiqueTheaterEnabled?: boolean`.
The read is defensive at the boundary: the metadata object is
typed loosely (it round-trips through SQLite as a free-form JSON
blob), so the spawn handler narrows to `boolean` and falls
through to `null` for any other shape. A missing key, a malformed
value, or a project that has never visited Settings collapses to
`null`, which is exactly the resolver's "no opinion, fall
through to env / phase" signal.
The `critique` frontmatter slot also gets typed on the
SkillFrontmatter shape so the `od.critique.policy` chain the
previous commit introduced no longer needs a bracket-access
cast. Same pattern as the existing `craft`, `preview`, and
`design_system` nested-record slots.
After this commit, every tier of the rollout resolver's priority
matrix is wired:
1. skillPolicy (from SKILL.md od.critique.policy)
2. projectOverride (from project metadata critiqueTheaterEnabled)
3. envOverride (from OD_CRITIQUE_ENABLED)
4. rollout phase (from OD_CRITIQUE_ROLLOUT_PHASE)
The write path for projectOverride still flows through the
existing project-update handler the Settings panel already uses
to persist project metadata; no new endpoint is needed. The
Settings UI button that calls setCritiqueTheaterEnabled and
posts the new field is the next commit on this branch.
Daemon typecheck: clean. Daemon vitest: 10 / 10 rollout cases
still green against the new wiring.
* fix(daemon): forward critique events to project sinks + align composer gate (PR #1338)
Two codex review items addressed in one commit since they share the
same root cause (resolver-enabled run hits a transport / prompt
contract that was still env-gated):
P1 (transport mismatch). The daemon emits critique.* SSE frames
through critiqueBus -> design.runs.emit, which fans out on
/api/runs/:runId/events. The web CritiqueTheaterMount subscribes to
/api/projects/:projectId/events (it's project-scoped, not run-
scoped, because the mount lives at the project workspace and
follows the user across runs). Result: in production the mount
never sees a real frame and the e2e tests' stubbed routes hide the
mismatch.
Fixed by extending critiqueBus.emit to fan out to BOTH sinks: the
existing runs.emit transport, AND the per-project event-sinks map.
The project-events route emits via sse.send(payload.type, payload),
so we pack the SSE channel name onto payload.type and let the sink
push the right channel. The web sseToPanelEvent overwrites type
from the channel name on the way back into a PanelEvent, so the
round-trip stays correct.
P2 (prompt gate misalignment). composeSystemPrompt reads
cfg.enabled to decide whether to append the panel addendum, but
critiqueCfg.enabled is loaded from OD_CRITIQUE_ENABLED only. A run
the resolver enabled via phase / project / skill (env unset) would
have critiqueShouldRun = true while critiqueCfg.enabled remained
false, dropping the panel prompt while still routing through
runOrchestrator -> parser waits for tags that never arrive -> run
degrades.
Fixed by passing a derived config { ...critiqueCfg, enabled: true }
to the composer when critiqueShouldRun is true. The composer's own
gate now agrees with the resolver decision on every input the
spec defines.
Daemon typecheck: clean. Daemon vitest: 10 / 10 rollout cases
still green against the new wiring.
* fix: address PerishCode P1 + P2 follow-ups on PR #1338
Two follow-up items PerishCode flagged on the activation PR.
Non-blocking but both are real:
1. Phase 11 e2e suite was wired into test:ui:extended but lands
the user on '/' (home route) where ProjectView (and therefore
CritiqueTheaterMount) is never rendered. With the suite as
written, every assertion would time out the first time the
lane runs in CI, contradicting the PR body's claim that the
suite stays parked behind test.describe.fixme.
The state diverged from my earlier Phase 11 work because the
merge from main on commit 4ab719c6 brought in #1307's
squash-merged version of the e2e file (the pre-fixme shape).
Re-applied test.describe.fixme to the describe block plus
removed ui/critique-theater.test.ts from the test:ui:extended
script in e2e/package.json. Added a file-header docblock
explaining what the follow-up commit needs to do: replace
goto('/') with /projects/:id navigation similar to
app-design-files.test.ts, split the SSE fixture into a live
prefix and terminal suffix (Codex P2 on PR #1320), and commit
the first PNG baselines.
2. bestRoundOf in CritiqueTheaterMount returned the LAST round
with a numeric composite, not the round with the HIGHEST
composite, while bestCompositeOf correctly returned the max.
A run that closed round 1 at 8.5 and round 2 at 6.0 would
dispatch interrupted { bestRound: 2, composite: 8.5 } on a
user-clicked interrupt.
Folded the two helpers into a single bestRoundAndComposite
that walks state.rounds once and returns the matching pair so
the two values cannot drift. The onInterrupt callback now
destructures from one helper instead of two independent reads.
Falls back to (state.activeRound, 0) when no round has closed
with a composite yet.
Web typecheck: clean. CritiqueTheaterMount.test.tsx: 7 / 7 cases
still green against the new helper.
* fix: wire M1 project override end-to-end + correct deferred-surface doc claims (PR #1338)
Three lefarcen P2s on the latest review pass, all real:
1. M1 project override was half-wired: the daemon read
metadata.critiqueTheaterEnabled but the web setter only
wrote localStorage. A user opt-in would render the Theater
on the web (localStorage was set) while the daemon resolved
projectOverride=null and skipped critique unless env / phase
already permitted. Two halves talking past each other.
Extended setCritiqueTheaterEnabled to accept an optional
{ projectId, fetchProjectSettings } options bag. When a
projectId is supplied, the setter ALSO sends a
PATCH /api/projects/:id with { metadata: { critiqueTheaterEnabled
} } so the daemon's spawn-time resolver picks the same value up
on the next generation. The existing project-routes endpoint
already accepts arbitrary metadata patches, so no new endpoint
is needed. The local write + the CustomEvent dispatch still
fire before the PATCH, so a network failure does not unwind
the in-session UI flip. Three new vitest cases pin the new
path: PATCHes when projectId is provided, skips when it is
not, swallows a rejected PATCH so the in-session UI still
flips.
2. Rollout docs (docs/critique-theater.md section 3) claimed the
Settings toggle persists into the daemon settings store, but
the previous implementation only had a localStorage reader /
writer plus a daemon read of project metadata, with no
round-trip. Rewrote the section to lead with the four-tier
resolver (skill policy / project override / env / phase),
document that the setter now round-trips via the existing
PATCH endpoint when given a projectId, and call out the
Settings panel UI control as a deliberate follow-up.
3. Troubleshooting table pointed users at /api/metrics/critique
(Phase 12, deferred) and 'od adapters clear-degraded <id>'
(CLI wrapper that does not exist). Replaced the metrics
reference with the local conformance harness command
(pnpm --filter @open-design/daemon vitest run
tests/critique-conformance.test.ts) that ships today, with a
note that the Phase 12 dashboard surfaces this status as a
series once that PR lands. Replaced the CLI command with the
programmatic clearDegraded() helper that exists today and
flagged the CLI wrapper as planned follow-up.
Web typecheck: clean. Toggle hook tests: 14 / 14 green (11
existing + 3 new for the round-trip path).
* test(web): multi-round interrupt regression for bestRoundAndComposite (PR #1338)
lefarcen P3 follow-up to the previous bestRoundAndComposite fix:
the existing CritiqueTheaterMount.test.tsx interrupt cases only
exercised a single-round state, so a future refactor back to two
independent helpers wouldn't be caught by the test suite even
though it'd reintroduce the round / composite drift bug.
Added a regression case that:
1. Drives the reducer through two complete rounds with the
full 5-role cast closing at distinct composites: round 1
at 8.5, round 2 at 6.0 (the high-composite round is NOT the
most recent one).
2. Clicks Interrupt + waits for the daemon ack via the test
seam fetcher returning 204.
3. Asserts the collapsed badge displays "round 1" (the
correct best-composite round), and queryByText for
"round 2 ... 8.5" returns null (the buggy pairing
would have produced that string).
The bestRoundAndComposite helper walks state.rounds in one pass
and returns the matching pair, so the round number and the
composite cannot drift apart. This test locks the fix in: a
refactor that splits the helpers back into independent walks
will be caught here.
8 / 8 vitest cases green on the file.
* fix(web): read-merge-write the project metadata in setCritiqueTheaterEnabled (PerishCode P2 on PR #1338)
The previous round-trip sent { metadata: { critiqueTheaterEnabled: next } }
as the entire PATCH body. The daemon's project-routes handler only
re-stamps three immutable fields (baseDir, importedFrom,
fromTrustedPicker) before calling updateProject(db, id, patch),
which then does a shallow { ...existing, ...patch } in apps/daemon/
src/db.ts. So patch.metadata replaces the row's metadata wholesale,
dropping kind, templateId, linkedDirs, and every other field the rest
of the app reads.
No in-tree caller passes projectId today (only vitest cases), so the
bug had not surfaced yet. But the surface is documented in
docs/critique-theater.md section 3 and the function's own JSDoc as
the M1 round-trip path, so it would have shipped as a latent footgun
for the next integrator: a Settings UI follow-up, or any third party
that wires the setter into a project-aware surface.
Fix: read-merge-write rather than a bare patch.
- GET /api/projects/:id to read the row's current metadata.
- Spread that metadata into the PATCH body and overlay
critiqueTheaterEnabled: next on top, mirroring the partial-metadata
pattern already used in ChatComposer.tsx for linkedDirs.
- PATCH the merged object.
Failure handling:
- GET fails: skip the PATCH entirely. We cannot construct a safe
merged body without the current state, and a bare patch would
wipe other metadata. The in-session CustomEvent fired earlier in
the setter still keeps every mounted hook consistent; the next
save retries the round-trip.
- PATCH fails: log in dev. The in-session UI is already correct via
the CustomEvent.
Tests (TDD, red-first):
- 'GETs the project then PATCHes with merged metadata when a
projectId is supplied': stubs a GET that returns
{ kind: 'template', templateId: 'modern-blog', linkedDirs: [...] }
and asserts the PATCH body equals the merge plus the toggle.
- 'PATCHes with just the toggle when the project has no prior
metadata': stubs a GET that returns no metadata block.
- 'skips the PATCH (does not stomp metadata) when the prefetch GET
fails': stubs a rejecting GET and asserts only the GET fires.
- 'swallows a rejected PATCH after a successful prefetch': stubs a
successful GET and a rejecting PATCH; asserts the in-session UI
still flips via the CustomEvent.
Doc updated on the setter's JSDoc to describe the new three-step
flow (localStorage, CustomEvent, read-merge-write PATCH) and the
two failure modes.
Verified:
- pnpm --filter @open-design/web typecheck clean.
- pnpm --filter @open-design/web test: 111 files / 1055 tests green
(was 1052, +3 from the new merge-flow cases).
* fix(web): restore wait-for-daemon-ack pattern on Theater interrupt
Same regression as flagged on PR #1316 post-main-merge: the
optimistic local dispatch fired before the POST resolved, so a
daemon 404 / 409 still terminalized the UI and the real SSE
terminal event got ignored by the sticky interrupted phase.
Snapshot runId / bestRound / composite at click time, dispatch
interrupted only on res.ok, clear interruptPending on rejection or
non-2xx so the user can retry. Tests cover rejection + 404 leaving
the run on the live stage; the 204 path waits for the ack.
* feat(daemon): Critique Theater Phase 12 observability foundations
Lands the metrics registry, the structured logger, the /api/metrics
route, and the adapter-degraded bump that wires up the first data
point. The orchestrator-side bumps for runs / rounds / composite /
must-fix / interrupted / parser_errors / protocol_version land in a
follow-up commit on this branch (kept separate so the wiring diff
reads cleanly against the registry shape).
Surfaces added:
- apps/daemon/src/metrics/index.ts: 9 Prometheus series under the
open_design_critique_* namespace with the histogram buckets the
spec calls out (round_duration_ms at 100 / 250 / 500 / 1000 /
2500 / 5000 / 10000 / 30000 / 60000 ms; composite_score at
0-10 integer steps).
- apps/daemon/src/logging/critique.ts: 6 typed events, one JSON line
per call on stdout, namespaced critique. Matches the JSON-per-line
convention cli.ts already uses; no new logger framework.
- apps/daemon/src/server.ts: GET /api/metrics route. Honors
OD_METRICS_ENDPOINT=disabled to opt out for air-gapped installs.
- apps/daemon/src/critique/adapter-degraded.ts: markDegraded now
bumps degraded_total so the adapter-health dashboard panel
reflects every TTL refresh and every fresh mark.
Deps: prom-client ^15.1.0, @opentelemetry/api ^1.9.0 added to
apps/daemon/package.json. Both are zero-config no-ops without an
exporter wired; daemon bundle size impact is ~150 KB uncompressed.
The @opentelemetry/api dep is in place ahead of the OTel-spans
follow-up commit; it adds no behavior on this commit.
Tests:
- tests/metrics/critique.test.ts (3 cases): registry shape +
exposition text + reset-between-tests
- tests/logging/critique.test.ts (4 cases): event shape + ordering
+ newline framing + namespace stamping
Verification (Windows-local):
- pnpm --filter @open-design/daemon typecheck: clean
- New metrics + logging suites: 7 / 7 green
- Existing adapter-degraded + conformance + rollout suites:
22 / 22 green; the bump is non-breaking
* feat(daemon): wire Critique Theater metrics + structured logs from the orchestrator
Lights up the bump sites the Phase 12 foundations PR registered the
series for. Every panel event the parser surfaces now reaches the
matching Prometheus counter / histogram and the matching JSON log
line on stdout.
Switch-loop bumps + logs:
- run_started: log run_started, set protocol_version gauge to the
observed protocol version (small-integer cardinality).
- panelist_open: record the first-open wall-clock per round so
round_end can compute round_duration_ms; subsequent opens in the
same round leave the start time untouched.
- panelist_must_fix: bump must_fix_total with the panelist role.
The wire event does not yet carry a dim name, so the label is
'unspecified' for now; a future parser revision can drop in the
real dim without a metric rename.
- round_end: bump rounds_total, observe composite_score, observe
round_duration_ms (current ms minus the tracked start), log
round_closed with the composite / mustFix / decision triple.
- parser_warning (parser-yielded): bump parser_errors_total with
the kind label, log parser_recover with kind + position.
Orchestrator-side parser warnings (composite_mismatch and
duplicate_ship from the daemon-authoritative scoring checks) go
through a new emitParserWarning helper so the bus emit, the
collectedEvents push, the metric bump, and the log line stay in
lockstep. Three inline emission sites collapse to one-line helper
calls.
After the try/catch, a single terminal-status switch bumps
runs_total{status, adapter, skill} once per run, with branch-
specific log + counter:
- shipped / below_threshold: log run_shipped
- interrupted: bump interrupted_total, log run_failed{cause: interrupted}
- timed_out: log run_failed{cause: timed_out}
- failed: log run_failed{cause: orchestrator_internal}
- degraded: log degraded{reason: orchestrator_classified}
OrchestratorParams gains optional skill: string for the label;
defaults to 'unknown' so spawn sites that have not yet threaded it
keep working without a metric shape change.
Tests:
- The new metrics + logging suites (7 / 7) verify registry shape
and event framing; orchestrator-side metric integration is
exercised through the existing critique-conformance and
critique-adapter-degraded suites (22 / 22 still green).
- Logger test reassigns process.stdout.write directly instead of
vi.spyOn so the Node overloaded write signature does not
collide with MockInstance<unknown>.
* feat(observability): Grafana dashboard JSON for Critique Theater
Three default rows mapping to the metrics this branch wires up:
1. Fleet quality: composite score p50 / p90 / p99 line graph by
adapter, plus a heatmap of the composite distribution. The
line graph answers 'are my agents getting better over time';
the heatmap answers 'are the bad runs clustered around one
adapter or smeared across the fleet'.
2. Adapter health: stacked bar charts for degraded marks (by
adapter / reason) and parser errors (by adapter / kind) over
a 5-minute window. The two queries together let an operator
see 'is this adapter degraded because of malformed wire output
or because of oversize blocks' without flipping panels.
3. Brief throughput: runs-per-hour by terminal status, an average
rounds-per-run stat per adapter, and a round-duration ms p50 /
p90 / p99 line. Throughput numbers fall straight out of the
runs_total / rounds_total counters; the duration histogram is
the same one the runs feed.
The dashboard uses a templated $datasource var (defaults to
'prometheus') so an operator with multiple Prometheus instances
can switch without editing JSON. Schema version 39 (Grafana 11).
Operators import via:
pnpm dlx @grafana/cli dashboard import tools/dev/dashboards/critique.json
or paste into a provisioned dashboards directory. The file is
checked into the repo as a starting artifact; alert rules and
SLO panels ship after the first 1000 runs inform the right
thresholds. JSON validates with node -e 'JSON.parse(...)' (sanity
checked locally).
* feat(daemon): OpenTelemetry outer span around the critique run
Wraps each runOrchestrator call in a 'critique.run' span via the
existing @opentelemetry/api dep added in the Phase 12 foundations
commit. Attributes set on the span:
- critique.run_id, critique.adapter, critique.skill at start
- critique.final_status, critique.final_composite on terminal
resolution
- span status flipped to ERROR for failed / timed_out runs so a
Tempo / Honeycomb / Jaeger filter on traces.status=error
surfaces the right slice without joining back to Prometheus
No exporter is wired by default; @opentelemetry/api is the API
package and intentionally splits from @opentelemetry/sdk-*, so
the span is zero-overhead until an operator attaches an SDK
through their runtime config.
Inner per-round / parse_chunk / scoreboard_eval / persist_round /
ship.persist spans defined in the Phase 12 plan are a follow-up:
the outer span alone gives the trace a duration + final status +
adapter/skill labels, which is the 80% value for dashboards that
correlate runs across services. Adding child spans inside the
existing 600-line orchestrator without restructuring is a separate
careful change.
Verification:
- pnpm --filter @open-design/daemon typecheck: clean
- 29 / 29 critique + metrics + logging tests still green
* fix(nix): bump pnpmDepsHash for prom-client + @opentelemetry/api lockfile bump
nix-check failed on PR #1485 with hash mismatch in
open-design-daemon-pnpm-deps and open-design-web-pnpm-deps after
the Phase 12 foundations commit (2b8b7445) added prom-client and
@opentelemetry/api to apps/daemon/package.json and refreshed
pnpm-lock.yaml.
CI reported the new sha:
specified: HFLm+8hv3o5x3Xem4MXNsNclIgiVRc70+EBafL0rVn8=
got: 7R1sQC38gOT0gsZ2oNOviCZ486cbbGJGJCis6WI8z9s=
Both nix files pin the same workspace lockfile, so both flip in
lockstep. No other Nix surface changes required.
* fix(daemon): four Phase 12 review findings (Codex P2 x2 + Siri-Ray P2 + lefarcen P2)
1. Siri-Ray P2 in orchestrator.ts (round metric / log used untrusted
agent values). The new observability path now records rs.composite
and rs.mustFix (daemon-authoritative) instead of event.composite
and event.mustFix when rs exists, and skips the bumps + log
entirely when rs is missing (a degenerate round_end without any
matching panelist_open). The dashboard p50 / p90 / p99 now agrees
with persistence and ship decisions; an adapter reporting <ROUND_END
composite='10'> while the daemon computed 6 logs 6 and still emits
the composite_mismatch parser warning the prior block was already
producing.
2. Codex P2 in server.ts (skill label always 'unknown'). The spawn
path called runOrchestrator without passing the resolved skill id,
so every live run bumped open_design_critique_*{skill='unknown'}
and the per-skill dashboard breakdown was always empty. Threaded
effectiveSkillId (already computed at the same handler scope as
the project skill fallback) through skill: . . . so the metric
reflects the real skill when one is assigned, and the orchestrator
default of 'unknown' only fires for runs that genuinely have none.
3. Codex P2 in conformance.ts (protocol-version mismatch let through).
An adapter that emitted <CRITIQUE_RUN version='2'> followed by a
valid SHIP classified as shipped because the harness only watched
for terminal events. Added a guard inside the parse loop: if a
run_started carries protocolVersion !== CRITIQUE_PROTOCOL_VERSION,
mark the adapter degraded with reason 'protocol_version_mismatch'
(already in DEGRADED_REASONS) and return early. ConformanceOutcome
union widened to accept the new reason.
4. lefarcen P2 in tools/dev/dashboards/critique.json (runs-per-hour
panel under-reported by 3600x). 'rate(...[1h])' returns per-second.
Multiplied by 3600 so the panel title and unit match the actual
value rendered.
Verification:
- pnpm --filter @open-design/daemon typecheck: clean
- New metrics + logging suites (7), existing adapter-degraded (7),
conformance (5), rollout (10): 29 / 29 green
- Grafana JSON re-parses with node -e 'JSON.parse(...)'
* fix(nix): set pnpmDepsHash to fakeHash so CI surfaces the real hash for the regenerated lockfile (lefarcen P1 on PR #1485)
* fix(nix): pin pnpmDepsHash to sha256-NtXbiRU0YZ4EVJVNC6N3sR1S0ozA3BvCwgXI0L0OMH4= from CI nix-check output
---------
Co-authored-by: Nagendhra <nagendhra405@gmail.com>
* feat(daemon): expose resolvedDir on GET /api/projects/:id (#451 prereq)
Native projects (no metadata.baseDir) live at <projects root>/<id>, where
projects root is daemon-side state. The web client cannot reconstruct an
absolute path on its own, and shell.openPath on a relative path is
undefined behavior. Without resolvedDir, the upcoming Continue in CLI
button (#451) would render permanently disabled for native projects.
Mirrors PR #832's pattern of exposing designMdPath in its response.
Computed via the existing resolveProjectDir(...) helper. No behavior
change to existing callers; they ignore the new field.
Adds ProjectDetailResponse contract type and a focused projects-routes
test covering imported-folder, native, and unknown-id paths.
* feat(web): add parseProvenance helper for DESIGN.md staleness checks
Pure helper that extracts Project ID, design system, current artifact,
transcript message count, and generated UTC timestamp from the
`## Provenance` section emitted by the daemon's finalize synthesis
prompt (apps/daemon/src/finalize-design.ts). Used by useDesignMdState
to derive the Continue in CLI button's stale/fresh state without an
additional daemon endpoint.
Handles missing section, "none" sentinels for design system /
artifact, and malformed timestamps without throwing. Tests cover all
four branches.
* feat(web): add buildClipboardPrompt template for Continue in CLI
Inline single-source-of-truth template per #451 spec §3.4. Names the
project, the working directory, and the DESIGN.md-first operating
contract for the receiving `claude` CLI session. Trailing TODO is
the blank task slot the issue body specifies — left empty so the user
fills it in before submitting.
Also lands the shared copyToClipboard helper (jsdom-safe canonical path
+ execCommand fallback) so the new button and any future caller share
one fallback path, mirroring the inline pattern in FileViewer.tsx.
Tests cover happy-path field rendering, "none"/"unknown" sentinels
when DESIGN.md fields are absent, and both clipboard branches.
* feat(web): add useProjectDetail + useDesignMdState hooks
useProjectDetail wraps GET /api/projects/:id, surfacing the resolvedDir
field and falling back to metadata.baseDir for older daemons that don't
include it. Continue in CLI needs an absolute working directory so the
desktop bridge can openPath it; the web client never reconstructs the
path itself.
useDesignMdState fetches the project's file list, downloads DESIGN.md
when present, parses the Provenance section, and computes a stale
verdict by comparing the recorded generatedAt against the max mtime of
non-DESIGN.md files and the max conversation updatedAt. Drives the
button's three-state UI (disabled / fresh / stale) without a
daemon-side endpoint.
Tests cover happy path, fallback, and both stale branches plus the
pure computeStale helper for the null-timestamp edge case.
* feat(web): add useFinalizeProject hook with cancel + error-code mapping
Wraps POST /api/projects/:id/finalize/anthropic for the Finalize design
package button. Three concerns:
1. Lifecycle: idle → pending → success | error. Double-clicking the
button aborts the prior in-flight request before starting a new
one so the daemon never sees stacked finalize calls per project.
2. Cancellation: AbortController plumbed through fetch + a 130 s
timer (daemon timeout 120 s + 10 s buffer). Cancel returns to idle
cleanly — it's a user gesture, not an error surface.
3. Daemon error mapping: when the response is non-OK, body.error.code
drives the canonical user-facing toast string (table covers all
7 codes the daemon emits today plus a network-error catch-all).
body.error.details, when a string, surfaces alongside the category
message so account-usage-cap responses (Anthropic 400 →
UPSTREAM_UNAVAILABLE) can show the upstream's own reason instead
of just the daemon's category label — committed to lefarcen on
#450 verification reply.
Tests cover request body shape, all 8 error codes via it.each, the
network-error path, the details-surfacing branch, the cancel ⇒ idle
flow, and the unknown-code → catch-all message branch.
* feat(web): add useTerminalLaunch with electron/web detection
Capability-detected wrapper around window.electronAPI.openPath. On
desktop the bridge forwards to shell.openPath, which opens the OS
file manager at the project working directory (per Electron's
contract for directory paths — it is NOT a terminal launcher;
spawning a terminal application is deferred per #451 Non-goals). On
browser builds the hook reports web-fallback so the caller renders
a manual-instruction toast naming the working directory.
Treats any non-empty string return from shell.openPath as ok: false
so platform-specific failures surface the manual fallback toast.
Behavior is exercised end-to-end by the upcoming
ContinueInCliButton tests.
* feat(desktop): expose shell.openPath via electronAPI bridge
Adds an openPath bridge method that the Continue in CLI button (#451)
uses to surface the project working directory in the OS file manager.
shell.openPath is part of Electron's contract and resolves to '' on
success / a non-empty error string on failure; the IPC handler
forwards the result so the renderer can decide between the success
toast and the manual fallback toast without a separate error channel.
Empty / non-string inputs short-circuit to a self-describing error
string so the renderer never needs to worry about undefined-input
crashes from the main process.
Web side: extracts Window.electronAPI into a single global declaration
at apps/web/src/types/electron.d.ts so future bridge methods land in
one place. Two pre-existing inline declare-global blocks
(NewProjectPanel.tsx, providers/registry.ts) are deleted in favor of
that single source of truth — the inline ones each carried a partial
shape of the bridge and were diverging from the desktop preload.
* feat(web): add FinalizeDesignButton, ContinueInCliButton, ProjectActionsToolbar
Project-level toolbar that hosts the two new actions from #451.
Mounted between AppChromeHeader and the chat/workspace split (wiring
lands in the next commit). Per-file actions (Export PDF/PPTX/ZIP,
Deploy) stay in the FileViewer share menu.
FinalizeDesignButton has three idle labels driven by DESIGN.md
existence + staleness, plus a pending state with a spinner and a
cancel link that maps to useFinalizeProject's AbortController. Error
toasts are owned by ProjectView so the button doesn't carry its own
toast surface.
ContinueInCliButton renders disabled with a Finalize-pointing
tooltip when DESIGN.md is missing (so the workflow is discoverable
rather than hidden), enabled when fresh, and enabled with a stale
chip otherwise. Chip text is the spec's canonical "Spec is stale —
regenerate?" — N-turns-ago is deferred per spec §4.6.
Toast.tsx is a tiny transient component that mirrors
PromptTemplatePreviewModal's state-based toast pattern; supports a
secondary details line so daemon error envelopes that carry an
upstream explanation (e.g. Anthropic account-usage cap) can surface
the real reason alongside the daemon's category label.
CSS appends one block to apps/web/src/index.css mirroring the
existing app-project-title token usage; no CSS modules in this
repo (verified by grep).
* test(web): cover ContinueInCliButton states + interaction wiring
Three rendered states (DESIGN.md missing → disabled with the
Finalize-pointing tooltip; DESIGN.md fresh → enabled, no chip;
DESIGN.md stale → enabled with the canonical "Spec is stale —
regenerate?" chip), plus three onClick branches (no-op when
disabled, fires once when fresh, fires once when stale).
Click-handler integration with clipboard / shell.openPath / toast
lives in ProjectView (the button is presentational and takes the
handler in via props), so those are covered by Phase K's wiring +
the manual smoke test rather than the per-component test.
* feat(web): wire Continue in CLI + Finalize buttons into ProjectView
Mounts the new project-actions toolbar between AppChromeHeader and
the chat/workspace split, hidden when workspaceFocused so the
focus-mode artifact view stays uncluttered.
Wires the four hooks (useProjectDetail, useDesignMdState,
useFinalizeProject, useTerminalLaunch) to a single shared toast
surface. handleFinalize reads the request body from the existing
config: AppConfig prop and uses effectiveMaxTokens(config) to match
the chat-flow's maxTokens defaulting; on success it refreshes
useDesignMdState so the toolbar re-renders with the new chip state.
handleContinueInCli builds the literal clipboard prompt, copies it,
opens the working directory via shell.openPath on desktop /
falls through to a manual-instruction toast on browser, and surfaces
shell.openPath failures with a fallback toast that names the path.
Errors lift into the same toast surface (a useEffect tied to
finalize.error) so the daemon's category message + body.error.details
reach the user as the spec's two-line render — covered by hook test
16a in the prior commit.
⌘+Shift+K (mac) / Ctrl+Shift+K (others) is the keyboard
accelerator for Continue in CLI; capture-phase, platform-gated,
no-op when DESIGN.md is missing. Mirrors the existing FileWorkspace
shortcut idiom and does not collide with ⌘+P (Quick Switcher).
* fix(web): distinguish timeout abort from user cancel in useFinalizeProject
Addresses codex P2 finding on PR #974: the catch block treated every
AbortError as a user-initiated cancel and reset to idle silently. If
the internal 130 s timeout fired, users saw no failure signal but the
daemon's synthesis call may still have been in flight.
Adds a timedOutRef set inside the setTimeout callback before
controller.abort(), and branches in the catch: timeout → status
'error' with new TIMEOUT code ("Finalize timed out after 130 s. The
daemon may still be running."), user cancel → existing idle reset.
Reset the ref at the start of every trigger() so a previous timeout
doesn't poison the next call.
Adds one test using vi.useFakeTimers() that advances past 130_001 ms
and asserts the TIMEOUT error surface.
* fix(web): surface clipboard failures by rendering the prompt in the toast
Addresses codex P2 finding on PR #974: handleContinueInCli ignored
copyToClipboard's return value, so when both clipboard paths failed
(restricted browser context / insecure origin) the toast still said
"paste the prompt" though nothing had been copied — leaving users
with no manual-copy recourse in exactly the environments where the
fallback should help.
handleContinueInCli now branches on copyToClipboard's boolean return.
On failure the toast renders the prepared prompt in a scrollable
<pre> block and pins itself open (no auto-dismiss) so the user has
time to select-and-copy manually. Includes a Dismiss button + the
working directory in the secondary details line so the user has the
information needed to proceed.
The folder-open call is skipped on copy failure because there's
nothing to paste yet; the user copies first, then re-clicks Continue
in CLI when they're ready.
Toast component grows an optional Updating VS Code Server to version 41dd792b5e652393e7787322889ed5fdc58bd75b
Removing previous installation...
Installing VS Code Server for Linux x64 (41dd792b5e652393e7787322889ed5fdc58bd75b)
Downloading: 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 1% 1% 1% 1% 1% 1% 1% 1% 1% 1% 1% 1% 1% 1% 1% 1% 1% 1% 2% 2% 2% 2% 2% 2% 2% 2% 2% 2% 2% 2% 2% 2% 2% 2% 2% 2% 3% 3% 3% 3% 3% 3% 3% 3% 3% 3% 3% 3% 3% 3% 3% 3% 3% 3% 4% 4% 4% 4% 4% 4% 4% 4% 4% 4% 4% 4% 4% 4% 4% 4% 4% 4% 5% 5% 5% 5% 5% 5% 5% 5% 5% 5% 5% 5% 5% 5% 5% 5% 5% 5% 6% 6% 6% 6% 6% 6% 6% 6% 6% 6% 6% 6% 6% 6% 6% 6% 6% 6% 7% 7% 7% 7% 7% 7% 7% 7% 7% 7% 7% 7% 7% 7% 7% 7% 7% 7% 8% 8% 8% 8% 8% 8% 8% 8% 8% 8% 8% 8% 8% 8% 8% 8% 8% 8% 9% 9% 9% 9% 9% 9% 9% 9% 9% 9% 9% 9% 9% 9% 9% 9% 9% 10% 10% 10% 10% 10% 10% 10% 10% 10% 10% 10% 10% 10% 10% 10% 10% 10% 10% 11% 11% 11% 11% 11% 11% 11% 11% 11% 11% 11% 11% 11% 11% 11% 11% 11% 11% 12% 12% 12% 12% 12% 12% 12% 12% 12% 12% 12% 12% 12% 12% 12% 12% 12% 12% 13% 13% 13% 13% 13% 13% 13% 13% 13% 13% 13% 13% 13% 13% 13% 13% 13% 13% 14% 14% 14% 14% 14% 14% 14% 14% 14% 14% 14% 14% 14% 14% 14% 14% 14% 14% 15% 15% 15% 15% 15% 15% 15% 15% 15% 15% 15% 15% 15% 15% 15% 15% 15% 15% 16% 16% 16% 16% 16% 16% 16% 16% 16% 16% 16% 16% 16% 16% 16% 16% 16% 16% 17% 17% 17% 17% 17% 17% 17% 17% 17% 17% 17% 17% 17% 17% 17% 17% 17% 17% 18% 18% 18% 18% 18% 18% 18% 18% 18% 18% 18% 18% 18% 18% 18% 18% 18% 19% 19% 19% 19% 19% 19% 19% 19% 19% 19% 19% 19% 19% 19% 19% 19% 19% 19% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 21% 21% 21% 21% 21% 21% 21% 21% 21% 21% 21% 21% 21% 21% 21% 21% 21% 21% 22% 22% 22% 22% 22% 22% 22% 22% 22% 22% 22% 22% 22% 22% 22% 22% 22% 22% 23% 23% 23% 23% 23% 23% 23% 23% 23% 23% 23% 23% 23% 23% 23% 23% 23% 23% 24% 24% 24% 24% 24% 24% 24% 24% 24% 24% 24% 24% 24% 24% 24% 24% 24% 24% 25% 25% 25% 25% 25% 25% 25% 25% 25% 25% 25% 25% 25% 25% 25% 25% 25% 25% 26% 26% 26% 26% 26% 26% 26% 26% 26% 26% 26% 26% 26% 26% 26% 26% 26% 26% 27% 27% 27% 27% 27% 27% 27% 27% 27% 27% 27% 27% 27% 27% 27% 27% 27% 28% 28% 28% 28% 28% 28% 28% 28% 28% 28% 28% 28% 28% 28% 28% 28% 28% 28% 29% 29% 29% 29% 29% 29% 29% 29% 29% 29% 29% 29% 29% 29% 29% 29% 29% 29% 30% 30% 30% 30% 30% 30% 30% 30% 30% 30% 30% 30% 30% 30% 30% 30% 30% 30% 31% 31% 31% 31% 31% 31% 31% 31% 31% 31% 31% 31% 31% 31% 31% 31% 31% 31% 32% 32% 32% 32% 32% 32% 32% 32% 32% 32% 32% 32% 32% 32% 32% 32% 32% 32% 33% 33% 33% 33% 33% 33% 33% 33% 33% 33% 33% 33% 33% 33% 33% 33% 33% 33% 34% 34% 34% 34% 34% 34% 34% 34% 34% 34% 34% 34% 34% 34% 34% 34% 34% 34% 35% 35% 35% 35% 35% 35% 35% 35% 35% 35% 35% 35% 35% 35% 35% 35% 35% 35% 36% 36% 36% 36% 36% 36% 36% 36% 36% 36% 36% 36% 36% 36% 36% 36% 36% 37% 37% 37% 37% 37% 37% 37% 37% 37% 37% 37% 37% 37% 37% 37% 37% 37% 37% 38% 38% 38% 38% 38% 38% 38% 38% 38% 38% 38% 38% 38% 38% 38% 38% 38% 38% 39% 39% 39% 39% 39% 39% 39% 39% 39% 39% 39% 39% 39% 39% 39% 39% 39% 39% 40% 40% 40% 40% 40% 40% 40% 40% 40% 40% 40% 40% 40% 40% 40% 40% 40% 40% 41% 41% 41% 41% 41% 41% 41% 41% 41% 41% 41% 41% 41% 41% 41% 41% 41% 41% 42% 42% 42% 42% 42% 42% 42% 42% 42% 42% 42% 42% 42% 42% 42% 42% 42% 42% 43% 43% 43% 43% 43% 43% 43% 43% 43% 43% 43% 43% 43% 43% 43% 43% 43% 43% 44% 44% 44% 44% 44% 44% 44% 44% 44% 44% 44% 44% 44% 44% 44% 44% 44% 44% 45% 45% 45% 45% 45% 45% 45% 45% 45% 45% 45% 45% 45% 45% 45% 45% 45% 46% 46% 46% 46% 46% 46% 46% 46% 46% 46% 46% 46% 46% 46% 46% 46% 46% 46% 47% 47% 47% 47% 47% 47% 47% 47% 47% 47% 47% 47% 47% 47% 47% 47% 47% 47% 48% 48% 48% 48% 48% 48% 48% 48% 48% 48% 48% 48% 48% 48% 48% 48% 48% 48% 49% 49% 49% 49% 49% 49% 49% 49% 49% 49% 49% 49% 49% 49% 49% 49% 49% 49% 50% 50% 50% 50% 50% 50% 50% 50% 50% 50% 50% 50% 50% 50% 50% 50% 50% 50% 51% 51% 51% 51% 51% 51% 51% 51% 51% 51% 51% 51% 51% 51% 51% 51% 51% 51% 52% 52% 52% 52% 52% 52% 52% 52% 52% 52% 52% 52% 52% 52% 52% 52% 52% 52% 53% 53% 53% 53% 53% 53% 53% 53% 53% 53% 53% 53% 53% 53% 53% 53% 53% 53% 54% 54% 54% 54% 54% 54% 54% 54% 54% 54% 54% 54% 54% 54% 54% 54% 54% 55% 55% 55% 55% 55% 55% 55% 55% 55% 55% 55% 55% 55% 55% 55% 55% 55% 55% 56% 56% 56% 56% 56% 56% 56% 56% 56% 56% 56% 56% 56% 56% 56% 56% 56% 56% 57% 57% 57% 57% 57% 57% 57% 57% 57% 57% 57% 57% 57% 57% 57% 57% 57% 57% 58% 58% 58% 58% 58% 58% 58% 58% 58% 58% 58% 58% 58% 58% 58% 58% 58% 58% 59% 59% 59% 59% 59% 59% 59% 59% 59% 59% 59% 59% 59% 59% 59% 59% 59% 59% 60% 60% 60% 60% 60% 60% 60% 60% 60% 60% 60% 60% 60% 60% 60% 60% 60% 60% 61% 61% 61% 61% 61% 61% 61% 61% 61% 61% 61% 61% 61% 61% 61% 61% 61% 61% 62% 62% 62% 62% 62% 62% 62% 62% 62% 62% 62% 62% 62% 62% 62% 62% 62% 62% 63% 63% 63% 63% 63% 63% 63% 63% 63% 63% 63% 63% 63% 63% 63% 63% 63% 64% 64% 64% 64% 64% 64% 64% 64% 64% 64% 64% 64% 64% 64% 64% 64% 64% 64% 65% 65% 65% 65% 65% 65% 65% 65% 65% 65% 65% 65% 65% 65% 65% 65% 65% 65% 66% 66% 66% 66% 66% 66% 66% 66% 66% 66% 66% 66% 66% 66% 66% 66% 66% 66% 67% 67% 67% 67% 67% 67% 67% 67% 67% 67% 67% 67% 67% 67% 67% 67% 67% 67% 68% 68% 68% 68% 68% 68% 68% 68% 68% 68% 68% 68% 68% 68% 68% 68% 68% 68% 69% 69% 69% 69% 69% 69% 69% 69% 69% 69% 69% 69% 69% 69% 69% 69% 69% 69% 70% 70% 70% 70% 70% 70% 70% 70% 70% 70% 70% 70% 70% 70% 70% 70% 70% 70% 71% 71% 71% 71% 71% 71% 71% 71% 71% 71% 71% 71% 71% 71% 71% 71% 71% 71% 72% 72% 72% 72% 72% 72% 72% 72% 72% 72% 72% 72% 72% 72% 72% 72% 72% 73% 73% 73% 73% 73% 73% 73% 73% 73% 73% 73% 73% 73% 73% 73% 73% 73% 73% 74% 74% 74% 74% 74% 74% 74% 74% 74% 74% 74% 74% 74% 74% 74% 74% 74% 74% 75% 75% 75% 75% 75% 75% 75% 75% 75% 75% 75% 75% 75% 75% 75% 75% 75% 75% 76% 76% 76% 76% 76% 76% 76% 76% 76% 76% 76% 76% 76% 76% 76% 76% 76% 76% 77% 77% 77% 77% 77% 77% 77% 77% 77% 77% 77% 77% 77% 77% 77% 77% 77% 77% 78% 78% 78% 78% 78% 78% 78% 78% 78% 78% 78% 78% 78% 78% 78% 78% 78% 78% 79% 79% 79% 79% 79% 79% 79% 79% 79% 79% 79% 79% 79% 79% 79% 79% 79% 79% 80% 80% 80% 80% 80% 80% 80% 80% 80% 80% 80% 80% 80% 80% 80% 80% 80% 80% 81% 81% 81% 81% 81% 81% 81% 81% 81% 81% 81% 81% 81% 81% 81% 81% 81% 81% 82% 82% 82% 82% 82% 82% 82% 82% 82% 82% 82% 82% 82% 82% 82% 82% 82% 83% 83% 83% 83% 83% 83% 83% 83% 83% 83% 83% 83% 83% 83% 83% 83% 83% 83% 84% 84% 84% 84% 84% 84% 84% 84% 84% 84% 84% 84% 84% 84% 84% 84% 84% 84% 85% 85% 85% 85% 85% 85% 85% 85% 85% 85% 85% 85% 85% 85% 85% 85% 85% 85% 86% 86% 86% 86% 86% 86% 86% 86% 86% 86% 86% 86% 86% 86% 86% 86% 86% 86% 87% 87% 87% 87% 87% 87% 87% 87% 87% 87% 87% 87% 87% 87% 87% 87% 87% 87% 88% 88% 88% 88% 88% 88% 88% 88% 88% 88% 88% 88% 88% 88% 88% 88% 88% 88% 89% 89% 89% 89% 89% 89% 89% 89% 89% 89% 89% 89% 89% 89% 89% 89% 89% 89% 90% 90% 90% 90% 90% 90% 90% 90% 90% 90% 90% 90% 90% 90% 90% 90% 90% 90% 91% 91% 91% 91% 91% 91% 91% 91% 91% 91% 91% 91% 91% 91% 91% 91% 91% 92% 92% 92% 92% 92% 92% 92% 92% 92% 92% 92% 92% 92% 92% 92% 92% 92% 92% 93% 93% 93% 93% 93% 93% 93% 93% 93% 93% 93% 93% 93% 93% 93% 93% 93% 93% 94% 94% 94% 94% 94% 94% 94% 94% 94% 94% 94% 94% 94% 94% 94% 94% 94% 94% 95% 95% 95% 95% 95% 95% 95% 95% 95% 95% 95% 95% 95% 95% 95% 95% 95% 95% 96% 96% 96% 96% 96% 96% 96% 96% 96% 96% 96% 96% 96% 96% 96% 96% 96% 96% 97% 97% 97% 97% 97% 97% 97% 97% 97% 97% 97% 97% 97% 97% 97% 97% 97% 97% 98% 98% 98% 98% 98% 98% 98% 98% 98% 98% 98% 98% 98% 98% 98% 98% 98% 98% 99% 99% 99% 99% 99% 99% 99% 99% 99% 99% 99% 99% 99% 99% 99% 99% 99% 99%100%100%
Unpacking: 0% 1% 2% 3% 4% 5% 6% 7% 8% 9% 10% 11% 12% 13% 14% 15% 16% 17% 18% 19% 20% 21% 22% 23% 24% 25% 26% 27% 28% 29% 30% 31% 32% 33% 34% 35% 36% 37% 38% 39% 40% 41% 42% 43% 44% 45% 46% 47% 48% 49% 50% 51% 52% 53% 54% 55% 56% 57% 58% 59% 60% 61% 62% 63% 64% 65% 66% 67% 68% 69% 70% 71% 72% 73% 74% 75% 76% 77% 78% 79% 80% 81% 82% 83% 84% 85% 86% 87% 88% 89% 90% 91% 92% 93% 94% 95% 96% 97% 98% 99%100%
Unpacked 4009 files and folders to /home/bryan/.vscode-server/bin/41dd792b5e652393e7787322889ed5fdc58bd75b.
Looking for compatibility check script at /home/bryan/.vscode-server/bin/41dd792b5e652393e7787322889ed5fdc58bd75b/bin/helpers/check-requirements.sh
Running compatibility check script
Compatibility check successful (0) prop and the auto-dismiss
TTL is suppressed whenever code is present. CSS adds .od-toast-code
(monospace, max-height 240 with overflow-auto) and .od-toast-dismiss
styling.
Six new Toast tests cover details rendering, code rendering,
no-auto-dismiss when code is present, auto-dismiss when code is
absent, and the Dismiss button affordance.
* fix(web): make ContinueInCliButton disabled-state guidance visible
Addresses mrcfps's PR #974 review: native <button disabled> does
not fire hover/focus events in browsers we ship against, so a
`title` tooltip on the disabled button never surfaces. The only
guidance for the missing-DESIGN.md state was effectively invisible —
defeating the spec's "discoverable, not hidden" intent.
Renders the help text as a visible sibling <span> next to the
disabled button instead. Adds aria-describedby pointing the button
at the hint's id so assistive tech announces the explanation when
the disabled button gets focus. The native `disabled` attribute
stays so the button still can't be clicked or submitted.
CSS adds .project-actions-disabled-hint (muted italic, 11.5px,
matches the existing meta/secondary text style on this surface).
Test asserts the role="note" hint is in the DOM with the canonical
text and that the button's aria-describedby links to its id.
* fix(web): keep ProjectActionsToolbar at natural height inside the .app grid
The .app container was `grid-template-rows: auto 1fr` — only two
rows. Adding ProjectActionsToolbar as a third child between
AppChromeHeader and the chat/workspace split made the toolbar the
2nd grid item, so it took the `1fr` row (filling roughly half the
viewport) while the split got pushed into an implicit auto row at
its content's natural height. Surfaced as a screenshot from Bryan
showing the toolbar's background bleeding across most of the screen.
Extend grid-template-rows to `auto auto 1fr` and pin the split to
`grid-row: 3` explicitly. Now:
- Toolbar visible: row 1 = header (auto), row 2 = toolbar (auto),
row 3 = split (1fr, fills remaining viewport).
- Toolbar hidden via hidden=workspaceFocused → ProjectActionsToolbar
returns null, row 2 collapses to 0px (auto with no content), split
still fills row 3.
No JS changes; existing 609 tests still green.
* fix(web): guard useFinalizeProject state writes against superseded triggers
Addresses mrcfps's PR #974 P1 review on useFinalizeProject.ts:132
(also called out as P1.3 in lefarcen's deep-dive review).
Calling trigger() twice in quick succession aborted the first
controller and swapped abortRef to the new one, but the first
request's later AbortError catch still unconditionally called
setStatus('idle') / setError(null). That cleared the spinner and
re-enabled both toolbar buttons while the replacement finalize was
still pending — defeating the de-duplication this hook was meant to
enforce.
Adds an isCurrent() closure (`abortRef.current === controller`)
and gates every state-write site after the await: success path,
non-OK envelope path, AbortError-timeout, AbortError-cancel, and
network-error all bail early when the trigger has been superseded.
Per mrcfps: "make every state write request-scoped."
Regression test triggers twice in quick succession with a
never-resolving fetch, awaits the first promise (it rejects with
AbortError), and asserts status stays 'pending' rather than
collapsing to 'idle' under the replacement's lifetime.
* fix(desktop): allowlist-validate shell.openPath against registered project roots
Addresses mrcfps's PR #974 P1 review on runtime.ts:305 (also called
out as P1.2 in lefarcen's deep-dive review): the new
`shell:open-path` IPC handler accepted any renderer-supplied
string and forwarded it straight into Electron's `shell.openPath`,
widening the renderer→main trust boundary so XSS or a compromised
renderer dependency could open arbitrary local paths to the user.
Adds an explicit gate around the bridge:
1. validateExistingDirectory(p) — floor check that rejects empty
strings, relative paths, files, apps, and non-existent paths;
realpath-resolves so symlink games can't be used to register
one path and reach another.
2. createProjectRootGate() — Set-backed allowlist of
daemon-validated project working directories. The renderer
calls registerProjectRoot(absDir) once per project mount via
a new IPC method (preload bridge); the main process only
opens paths that pass both the floor check and the allowlist.
ProjectView wires the registration via a useEffect tied to
projectDetail.resolvedDir, so the active project's daemon-supplied
working directory is always the one being approved (not a renderer-
synthesized string).
Threat-model caveat documented in the runtime.ts comment block: an
attacker that fully controls the renderer can also call register
with arbitrary paths. Closing that gap fully requires a daemon-side
round-trip to derive the canonical resolvedDir from the daemon's
project registry, which is deferred to keep this PR focused.
Today's allowlist still defends against accidental misuse, bugs,
and common XSS payloads that don't know to call register first.
Adds apps/packaged/tests/desktop-project-root-gate.test.ts with 13
cases: floor-validation rejection cases (empty / relative / missing
/ file), happy-path resolution, symlink realpath canonicalization,
and the allowlist's register/isApproved/reset semantics. Mirrors
the existing apps/packaged/tests/desktop-url-allowlist.test.ts
pattern from PR #911 — the packaged workspace hosts the test
because apps/desktop has no vitest setup yet.
* fix(daemon): wire request-lifecycle abort signal through finalize route
Addresses mrcfps's PR #974 P1 review on
apps/daemon/src/server.ts:3831-3837 (also called out as P1.1 in
lefarcen's deep-dive review): `POST /api/projects/:id/finalize/anthropic`
called `finalizeDesignPackage(...)` without threading any
request-lifecycle abort, so cancelling the browser fetch only
aborted the UI-side request — the daemon's 60–120 s Anthropic call
kept running and still wrote DESIGN.md after the UI returned to idle.
Adds an AbortController inside the route handler, fired from
`res.on('close')`, and threads its signal into the existing
`signal?: AbortSignal` parameter on `FinalizeOptions`
(finalize-design.ts:70). `callAnthropicWithRetry` already passes
the signal through to the underlying fetch, so a client disconnect
now propagates all the way to the Anthropic SDK call.
Listener-event choice: `res.on('close')` is the canonical event
for "client disconnected before response was sent" in Express. The
common alternative `req.on('close')` fires whenever the *request*
stream finishes — for POST routes that means as soon as the
body-parser middleware drains the body, well before the route does
any work. Using req.on('close') would have flipped the abort
controller in every successful run; the test caught this empirically.
Caveat documented in the route's comment block: an abort fired
*after* the upstream response has been received but *before* the
atomic write completes still allows the write to land. The SDK
contract bounds the network round-trip, not the post-network disk
handoff.
Adds tests/finalize-route-abort.test.ts: spins up the test server,
mocks global fetch to capture the daemon-side AbortSignal at the
Anthropic call, sends the request via raw http (so we can destroy
the underlying socket), waits until the server reaches the
Anthropic call, then destroys the socket and asserts that the
daemon-side signal received an abort event within 5 s.
Three pre-existing project-watchers chokidar tests show flaky
timeouts under full-suite concurrency but pass in isolation;
unrelated to this fix.
* fix(daemon): refactor finalize-route-abort test to satisfy strict TS narrowing
The CI typecheck (`pnpm --filter @open-design/daemon typecheck`,
which runs both tsconfig.json and tsconfig.tests.json) caught what
my pre-push validation missed: TS narrowed `capturedSignal` to
literal `null` because vitest's mockImplementation closure can't
prove its callback runs, leaving the bare `let capturedSignal:
AbortSignal | null = null` permanently typed at its initial value.
At line 184 (`expect(capturedSignal?.aborted).toBe(true)`) the
right-hand side of the optional-chain became unreachable, and TS
flagged it as `Property 'aborted' does not exist on type 'never'`.
Switches to the standard ref-object pattern
(`const capture: { signal: AbortSignal | null } = { signal: null }`).
TS narrows let bindings inside closures conservatively but treats
object-property writes as opaque, so `capture.signal` reads
correctly across the closure boundary. Logic is unchanged.
(Pre-push oversight: ran `pnpm --filter @open-design/web typecheck`
but not the full repo `pnpm typecheck` after the daemon test
landed; the daemon's own typecheck would have caught this. Adding
`pnpm typecheck` back into the standard pre-push checklist.)
* fix(desktop): make shell.openPath gate daemon-controlled and reject .app bundles
Addresses lefarcen + mrcfps PR #974 P1 reviews on the previous path
allowlist (commit 8bf56597):
- mrcfps (runtime.ts:45): `validateExistingDirectory` accepted
macOS `.app` bundles because they're directories, so the gate
would forward `/Applications/Safari.app` (or any other app
bundle) into shell.openPath and *launch* the application — a
stronger capability than the bridge's intended "reveal the
project folder" feature.
- lefarcen (runtime.ts:396): the allowlist was renderer-controlled.
A compromised renderer could call `shell:register-project-root`
with any existing absolute directory and then `shell:open-path`
that same path; the IPC injection issue I'd documented as
"deferred" was the central reviewer concern, not an acceptable
caveat. Both reviewers asked for the gate to be derived from
a daemon-authoritative source.
The redesign drops the renderer-controlled register/openPath pair
and replaces it with a single `openPath(projectId)` bridge call.
The desktop main process resolves the project ID by calling the
daemon's `GET /api/projects/:id` endpoint over the web sidecar
proxy (which already forwards `/api/*` to the daemon — verified
in apps/web/sidecar/server.ts:209 and apps/web/next.config.ts:77),
parses `resolvedDir` from the response, validates it against the
floor (absolute, exists, is-directory, not .app), and only then
forwards to `shell.openPath`. The renderer never names the path
directly, so a compromised renderer cannot escalate to opening
arbitrary local paths — it can only name a project the daemon
already knows about, and the canonical path comes from the daemon's
own response.
Surface changes:
- `runtime.ts`: `createProjectRootGate` removed.
`fetchResolvedProjectDir(webUrl, projectId, fetchImpl?)` added.
`validateExistingDirectory` rejects `.app` suffix after the
realpath check (so symlinked launders are caught too).
`shell:open-path` handler signature changes from `(path)` to
`(projectId)`; `shell:register-project-root` handler removed.
- `preload.cts`: `openPath(projectId)`; `registerProjectRoot`
removed from the bridge surface.
- `apps/web/src/types/electron.d.ts`: type updated to match.
- `useTerminalLaunch.ts`: `open(projectId)` instead of
`open(dir)`.
- `ProjectView.tsx`: passes `project.id` to
`terminalLauncher.open`; the registerProjectRoot useEffect is
deleted. Toast text still reads `projectDir` (from
`useProjectDetail.resolvedDir`) for fallback messages — the
*display* path is independent of the *open* mechanism.
- `apps/packaged/tests/desktop-project-root-gate.test.ts`:
rewritten to cover `validateExistingDirectory` (8 cases
including the new `.app` suffix and symlinked-bundle rejection)
and `fetchResolvedProjectDir` (8 cases including empty/invalid
project ids, daemon HTTP success/failure, missing resolvedDir,
network error, and URL canonicalization).
Total: 16 passing tests, ~330 LOC churn including test rewrites.
Lesson learned (from the iteration loop, not the code): when a
reviewer asks for "ideally X, or at least Y," shipping Y with a
deferred-X note flags the gap rather than fixing it. Either ship X
or argue Y is sufficient; don't middle-ground.
* feat(contracts,sidecar-proto): add desktop-auth IPC + fromTrustedPicker
Schema-only prep for the PR #974 round-3 fix. Adds the two type
extensions the daemon HTTP gate and the desktop main process will
build on:
- packages/sidecar-proto: SIDECAR_MESSAGES.REGISTER_DESKTOP_AUTH, with a
base64-validated `{ secret }` payload + RegisterDesktopAuthResult.
Updates normalizeDaemonSidecarMessage to accept the new message and
pins both branches (accept + reject) in tests/index.test.ts.
- packages/contracts: ProjectMetadata.fromTrustedPicker — a marker the
daemon stamps on folder-imported projects whose POST /api/import/folder
passed the desktop HMAC gate. The marker is privileged in the same
way as `baseDir`: only the gated import handler sets it, and the
desktop main process refuses to forward `shell.openPath` for
folder-imported projects whose metadata lacks it.
* fix(daemon): gate /api/import/folder on desktop HMAC token
Closes the renderer→arbitrary-baseDir→shell.openPath bypass chain
flagged by lefarcen and mrcfps in round 3 of PR #974. Both reviewers
converged on the same gap: the previous round only moved path
resolution into the daemon, but renderer JS could still POST
/api/import/folder with any absolute path, get a project ID back, and
then call openPath(projectId) to reveal the attacker-chosen path.
Daemon-side closure:
- New module-scope desktop auth secret + setter exported from
apps/daemon/src/server.ts. The secret is null at boot (web/standalone
mode unaffected) and gets set when the desktop main process
registers it over the daemon's sidecar IPC.
- New `verifyDesktopImportToken` pure helper. Verifies tokens shaped
`${nonce}~${exp}~${signature}` against HMAC-SHA256(secret, baseDir +
"\n" + nonce + "\n" + exp). Field separator is `~` (not `.`) because
ISO 8601 expiries embed dots; `~` is in neither base64url nor ISO
8601 character sets. Rejects expired tokens, replayed nonces, and
expiries beyond 2× the 60s TTL.
- New middleware on POST /api/import/folder. When the secret is set,
every request must carry a valid `X-OD-Desktop-Import-Token` header
bound to the requested baseDir. Rejected requests return 403 with
FORBIDDEN. When the secret is unset (no desktop registered), the
route is unchanged so web-only deployments and standalone daemons
keep working.
- Trusted imports get `metadata.fromTrustedPicker: true` stamped on
the project. POST /api/projects and PATCH /api/projects/:id reject
any client-supplied `fromTrustedPicker` (privileged the same way as
`baseDir`), and the PATCH preservation block re-stamps the marker
on partial-metadata patches so it cannot be silently stripped.
- Daemon sidecar IPC handler: REGISTER_DESKTOP_AUTH calls
setDesktopAuthSecret with the base64-decoded secret. The HTTP and
IPC servers share a process so the registration takes effect
immediately for the next inbound /api/import/folder call.
Tests:
- apps/daemon/tests/desktop-import-token-gate.test.ts (15 cases): web
mode acceptance, no-token rejection, malformed-token rejection,
wrong-secret rejection, wrong-baseDir rejection, expired rejection,
oversized-window rejection, valid mint + trusted-picker stamp +
replay rejection, plus 6 pure-helper cases for verifyDesktopImportToken.
afterAll() clears the secret to keep the shared HTTP server clean
for sibling test files.
- apps/daemon/tests/projects-routes.test.ts (+2 cases): POST and PATCH
reject `fromTrustedPicker` in client-supplied metadata.
Existing folder-import-route.test.ts continues to pass because none of
those tests register a desktop secret; the gate stays dormant.
* fix(desktop,web): atomic pickAndImport replacing pickFolder; openPath trusted-picker check
Closes the renderer→arbitrary-baseDir bypass at the bridge boundary.
The renderer no longer receives a raw filesystem path from the main
process; the picker dialog and the import call live in a single
main-process transaction.
Desktop main:
- runDesktopMain generates a per-process 32-byte secret and registers
it with the daemon over the daemon's sidecar IPC *before* the
BrowserWindow is created. registerDesktopAuthWithDaemon retries a
few times because tools-dev / tools-pack spawn daemon, web, and
desktop as siblings, so the daemon may not be listening yet on
desktop boot. A failed registration logs a warning and the runtime
refuses pickAndImport calls (no secret → no token can be minted).
- runtime.ts replaces the `dialog:pick-folder` IPC with
`dialog:pick-and-import`. The handler shows the picker, mints an
HMAC token bound to the chosen path, POSTs /api/import/folder via
the discovered web URL with the token + body, and returns the
daemon's ImportFolderResponse to the renderer (or a structured
failure envelope). Renderer never sees the path or the token.
- shell:open-path now consults a new pure helper
`isOpenPathAllowedForProject` that refuses folder-imported projects
whose metadata lacks `fromTrustedPicker: true`. This is the literal
interpretation of mrcfps's round-3 follow-up: openPath is gated to
projects whose resolvedDir came from the trusted-picker flow, not
just transitively via the import gate. Native projects (no
baseDir → daemon-owned <projectsRoot>/<id>) are always safe to open.
- fetchResolvedProjectDir now returns a `ResolvedProjectDirContext`
with hasBaseDir + fromTrustedPicker so the openPath handler can
enforce the marker check.
- New `signDesktopImportToken` pure helper mirrors the daemon-side
signer with the same `~`-separated wire shape, exported for the
packaged workspace's test file.
Preload bridge:
- `pickFolder` is deleted. The new `pickAndImport(init?)` returns the
daemon's import response or a structured failure. `openPath` keeps
its existing signature; its trust gate now lives in the main
process.
Web renderer:
- electron.d.ts drops `pickFolder` and adds `pickAndImport` with the
shared DesktopPickAndImportResult union pulled from contracts.
- NewProjectPanel: when running on Electron (pickAndImport bridge
present), the "Open folder" button calls pickAndImport atomically
and forwards the response through a new `onImportFolderResponse`
prop. On web (no bridge), the existing manual baseDir input keeps
working — browser builds have no shell.openPath surface so a
renderer-named path cannot escalate.
- EntryView and App.tsx pass through the new callback. App's
`handleImportFolderResponse` updates state from the response without
a second fetch (the import already happened in the main process).
Tests (apps/packaged/tests/desktop-project-root-gate.test.ts):
- 3 cases for `isOpenPathAllowedForProject`: native allowed,
trusted-picker allowed, legacy folder-import refused.
- 6 cases for `signDesktopImportToken`: shape (~-separated), determinism,
signature flips when secret/baseDir/nonce/exp changes.
- Existing fetchResolvedProjectDir cases extended for the new
`context` shape and additional cases that prove the metadata
inspection (hasBaseDir, fromTrustedPicker) reads the daemon
response correctly.
* fix(daemon): make desktop import-folder gate fail-closed (PR #974 round 4)
lefarcen P1 on round 3 of PR #974: the gate's `secret == null → accept`
branch (originally intended to keep web-only deployments unaffected)
let a renderer bypass the import boundary in two real desktop edges:
- Startup race: desktop's REGISTER_DESKTOP_AUTH IPC hasn't reached the
daemon yet, but the renderer is already alive in the BrowserWindow
and races to fetch /api/import/folder directly with arbitrary baseDir.
- Daemon restart mid-session: the new daemon process boots tokenless
while a desktop is still running. Same shape: renderer fetches the
route, daemon falls through to "web mode", accepts the untrusted
baseDir. shell.openPath rejects (no fromTrustedPicker marker) but
the daemon's other file APIs (read/write project files, list
directories) operate on the attacker-chosen path.
Two coordinated mechanisms close that:
(1) Sticky in-process flag. `desktopAuthEverRegistered` flips to true
on first non-null `setDesktopAuthSecret(...)` and never goes back.
setDesktopAuthSecret(null) (used by tests) does NOT relax the gate
so production code can never silently fall back to fail-open. Add
`resetDesktopAuthForTests()` for vitest cleanup.
(2) Orchestrator-pinned mode via OD_REQUIRE_DESKTOP_AUTH=1 read at
module load. tools-dev / tools-pack / apps/packaged set this when
the daemon is spawned in a desktop-bundled flow (separate commits).
With the env set, the gate is active from request 0 — a renderer
racing /api/import/folder before registration completes gets a
503 DESKTOP_AUTH_PENDING (transient, retry).
Standalone-daemon (web-only) deployments where neither mechanism fires
keep the gate dormant and the route's behavior unchanged.
Also addresses lefarcen P3 (whitespace HMAC mismatch): the desktop
signs the exact picker output, so the daemon must verify the same
string. The previous version trimmed `baseDir` before HMAC, which
would reject legitimate paths whose final component carried edge
whitespace. Use the raw request-body baseDir for verification; the
existing trim()+realpath() logic still normalizes for fs operations.
New error code: `DESKTOP_AUTH_PENDING` (HTTP 503, retryable).
Tests:
- `stays fail-closed (503 DESKTOP_AUTH_PENDING) after a registered
secret is cleared` — exercises the sticky flag.
- `verifies the exact request-body baseDir, not a trimmed version` —
pins the round-4 P3 fix.
- All existing desktop-import-token-gate cases continue to pass; the
beforeEach/afterEach/afterAll resetters now use
resetDesktopAuthForTests() to honor the sticky flag.
* fix(tools-dev,packaged): pin desktop import-auth on daemon spawn
PR #974 round-4 P1 follow-through. The daemon-side fail-closed gate
needs OD_REQUIRE_DESKTOP_AUTH=1 in the daemon's spawn env whenever
the daemon is paired with a desktop, so the gate is active from
request 0 and the daemon-restart-mid-session bypass cannot reopen.
tools-dev:
- spawnDaemonRuntime accepts a `requireDesktopAuth` option that
appends OD_REQUIRE_DESKTOP_AUTH=1 to the spawn env.
- startDaemon takes the same flag and additionally checks whether a
desktop runtime is already alive in this namespace; either branch
pins the env (revival case where the daemon died mid-session and
the user runs `tools-dev start daemon` to bring it back up).
- startApp threads the bundled-target list down so the daemon spawn
knows when desktop is queued in the same orchestration even though
the daemon starts first.
- The `start` / `restart` / `run` command actions pass the resolved
target list into startApp.
apps/packaged:
- Packaged builds always pair a desktop with the daemon, so
startPackagedSidecars unconditionally sets OD_REQUIRE_DESKTOP_AUTH=1
in the daemon child env. Headless builds also flow through this
same path, so the same gate applies.
Standalone-daemon flows unaffected: `tools-dev start daemon` (alone,
no desktop running, no desktop in the bundled target list) does not
set the env, and the daemon's gate stays dormant — current web-only
behavior is preserved.
* fix(desktop,web): align project-id regex with daemon; surface pickAndImport failures
mrcfps round-4 nits on PR #974.
apps/desktop/src/main/runtime.ts (mrcfps #1): the previous client-side
regex `^[a-zA-Z0-9_-]+$` rejected `.` even though the daemon's
canonical isSafeId / POST /api/projects accept `[A-Za-z0-9._-]{1,128}`.
Result: dotted ids like `my-project.v2` were valid backend-side but
got "project id contains disallowed characters" before
fetchResolvedProjectDir even hit the network, regressing Continue in
CLI / Finalize for those projects. Align the regex with the daemon's
shape, comment-tag the rationale.
apps/packaged/tests/desktop-project-root-gate.test.ts: add a
regression case for a dotted id and one for the 128-char length cap
(the new regex exposes both, the old regex obscured the dotted one).
apps/web/src/components/NewProjectPanel.tsx (mrcfps #2): the
`if (!result || result.ok !== true) return` branch swallowed every
non-OK pickAndImport shape (`desktop auth secret not registered`,
`web sidecar URL not available`, daemon HTTP errors with details)
the same way as the explicit `{ canceled: true }` cancel — leaving
the user with a silent no-op when the trusted-picker flow couldn't
even get off the ground. Reserve silent-return for the cancel case
only; surface every other reason via a Toast (existing component,
already used by ProjectView for related Continue-in-CLI flows).
The new `formatPickAndImportErrorDetails` helper flattens daemon
ApiError envelopes into a single readable secondary line so the
operator sees both the category ("Open folder failed: daemon
returned HTTP 503") and the upstream reason
("desktop auth required but secret not yet registered").
* docs(architecture): document desktop folder-import auth boundary
lefarcen P3 on PR #974 round 4: the `Folder import` section in
docs/architecture.md still documented only realpath / sandbox /
RUNTIME_DATA_DIR checks and omitted the new desktop HMAC trust
boundary, replay/TTL behavior, fail-closed semantics, daemon-restart
edge, and legacy-import migration note. Without that subsection it's
hard to review whether the 60s TTL, the `~`-separated token shape,
or the legacy folder-imports needing re-pick are intentional product
decisions or overlooked gaps.
Add a "Desktop folder-import auth (PR #974)" subsection covering:
- The trust handshake (32-byte secret over sidecar IPC at desktop boot).
- Token shape (`${nonce}~${exp}~${signature}`), HMAC payload, and
why `.` cannot be the field separator (ISO 8601 expiries embed dots).
- TTL and replay behavior (60s, single-use, 2× TTL upper bound).
- Fail-closed mechanisms — sticky in-process flag and
OD_REQUIRE_DESKTOP_AUTH env var pinning.
- Web-only deployments are unaffected (browser builds have no
shell.openPath surface).
- The `metadata.fromTrustedPicker` marker and the openPath-side
defense-in-depth check.
- Legacy folder-imports need re-pick to use the Continue-in-CLI button.
- Daemon-restart edge: 503 DESKTOP_AUTH_PENDING until desktop
re-registers; restart desktop to recover.
* fix(packaged): skip desktop-auth gate in headless mode (PR #974 round 5 P2)
Round 5 (lefarcen P2): packaged headless mode (daemon+web only, no
Electron) was inheriting OD_REQUIRE_DESKTOP_AUTH=1 from the round-4
unconditional pin in startPackagedSidecars. Headless never runs desktop
main, so no client could ever register an HMAC secret and folder import
returned 503 DESKTOP_AUTH_PENDING permanently — even though headless has
no shell.openPath surface to exploit.
Plumb a required `requireDesktopAuth: boolean` option through
startPackagedSidecars: apps/packaged/src/index.ts (Electron entry)
passes true; apps/packaged/src/headless.ts passes false. Extract
buildPackagedDaemonSpawnEnv as a pure helper so vitest can pin both
branches without spawning a child process.
Tests added in apps/packaged/tests/sidecars.test.ts cover both branches
plus OD_LEGACY_DATA_DIR / daemonCliEntry env forwarding edges.
Refs: nexu-io/open-design#974
* fix(desktop,daemon): lazy auth retry + canonical HMAC binding (PR #974 round 5 P1+P3)
Round 5 (lefarcen P1, mrcfps): a daemon restart under
OD_REQUIRE_DESKTOP_AUTH=1 left desktop holding a stale secret while the
new daemon process required a fresh registration — folder import
returned 503 DESKTOP_AUTH_PENDING permanently until the user restarted
desktop. Same dead-end if the startup handshake missed its retry window.
Round 5 (lefarcen P3): the daemon verified the HMAC against raw
request-body baseDir, then trimmed before realpath(). A picker selection
of "/tmp/foo " could authorize an import of "/tmp/foo" — token bound to
a different path than the one imported.
Three coordinated fixes:
1. P1 lazy retry: extract pickAndImportFolder as a pure helper that
takes injected fetch / mintToken / registerDesktopAuth deps. On 503
DESKTOP_AUTH_PENDING from /api/import/folder, re-invoke the
registration callback once, mint a fresh token (new nonce + new exp
keeps replay protection), and POST again. Single retry, no infinite
loop. Other failure shapes return immediately to the renderer.
2. P1 wiring: runDesktopMain now ALWAYS passes desktopAuthSecret to the
runtime regardless of whether the initial handshake succeeded, plus
a registerDesktopAuthWithDaemon callback the runtime invokes lazily.
Soften the startup warning text to match the new recovery semantics.
3. P3 binding: trim picker output ONCE on the desktop side before both
signing the HMAC and POSTing. Daemon-side verification stays against
raw request-body baseDir (round-4 behavior); the daemon's defensive
trim before realpath() is now a no-op for desktop traffic and only
load-bearing for web-mode callers (path.isAbsolute(" /foo ") is
false). End-to-end: desktop-signed string == request body == HMAC-
verified string == realpath() input.
Tests:
- apps/packaged/tests/desktop-pick-and-import.test.ts (NEW, 7 cases):
lazy-retry happy path; lazy-retry exhausted (re-register WAS called);
single-attempt happy path (no unnecessary IPC); optional-callback
no-op; non-503 failures bypass retry; network errors; non-PENDING 503
bypasses retry.
- apps/daemon/tests/desktop-import-token-gate.test.ts: replace round-4
whitespace test with two round-5 binding tests — the trimmed string
flows end-to-end (HMAC verifies, project metadata.baseDir equals
realpath of trimmed input), and a request whose body baseDir diverges
from the HMAC-bound string is rejected 403.
docs/architecture.md §"Desktop folder-import auth" — update the daemon-
restart-edge bullet to describe the lazy-retry recovery (round 4 said
"restart desktop to recover", which is now wrong) and add a headless-
packaged-mode bullet describing the round-5 P2 gate exclusion.
Refs: nexu-io/open-design#974
* feat(sidecar-proto,daemon): surface desktopAuthGateActive over STATUS IPC (PR #974 round 6 prep)
Round 6 (mrcfps): the split-start dev flow `tools-dev start daemon` ->
`tools-dev start desktop` was leaving the daemon ungated because
`OD_REQUIRE_DESKTOP_AUTH=1` is only injected when daemon and desktop
spawn in the same orchestrator invocation. To fix that, tools-dev needs
to introspect the running daemon's gate state before launching desktop
main — but the existing STATUS IPC didn't carry the flag.
This commit extends `DaemonStatusSnapshot` with a required
`desktopAuthGateActive: boolean` and wires the daemon sidecar's STATUS
handler (and the public `status()` method on the handle) to recompute
the value from `isDesktopAuthGateActive()` per request, since the flag
flips after `REGISTER_DESKTOP_AUTH` and stays sticky.
Extracted `withCurrentDesktopAuthGate(snapshot)` as a tiny pure helper
so the wiring is testable without booting a real IPC server. The new
test pins four scenarios:
- no secret registered (web-only mode) -> false
- after `setDesktopAuthSecret(buf)` -> true
- after `setDesktopAuthSecret(null)` (sticky) -> still true
- input snapshot's stale value is overridden by the live flag
The orchestrator-side consumer lands in the next commit
(`tools/dev/src/desktop-auth-gate.ts`).
Refs: nexu-io/open-design#974
* fix(tools-dev): auto-restart ungated daemon before desktop start (PR #974 round 6 mrcfps)
Round 6 (mrcfps): the split-start dev sequence
`tools-dev start daemon` -> `tools-dev start desktop` was leaving the
daemon running without `OD_REQUIRE_DESKTOP_AUTH=1`. The env var is
only injected when (A) daemon and desktop spawn in the same
orchestrator invocation (`startApp` line ~682) or (B) a desktop
runtime is already alive at daemon spawn time (`startDaemon` lines
~595-596). Neither fires for the split flow, so a renderer (or any
local HTTP client) could `POST /api/import/folder` directly with an
arbitrary `baseDir` before the desktop's first registration POST.
Round-5's lazy retry didn't help: it triggers on `503 DESKTOP_AUTH_PENDING`,
and the ungated daemon returns 200.
Close the gap by introspecting the running daemon's
`desktopAuthGateActive` (added to the STATUS IPC in the prior
commit) at the start of `startApp(DESKTOP, ...)`. When the daemon
reports the gate inactive, stop the daemon (and web, if running),
respawn the daemon with `requireDesktopAuth: true`, restart web,
then proceed with the desktop start. Restart order is critical and
pinned by tests: web stops FIRST (so the web->daemon proxy doesn't
serve a transient 502 against the down-then-up daemon), then daemon
stops, then daemon respawns gated, then web restarts.
The bundled-targets path (`pnpm tools-dev`) is unaffected because
trigger (A) already armed the gate at first daemon spawn — the
helper costs one ~800ms STATUS IPC roundtrip and returns no-op.
Helper lives in its own module (`tools/dev/src/desktop-auth-gate.ts`)
so the regression test can import it without triggering the
`cli.parse()` side effect at the bottom of `tools/dev/src/index.ts`.
Five `node:test` cases pin the call sequence — no daemon, gate
active, gate inactive + no web, gate inactive + web running, log
shape — so a future refactor can't silently regress the gate.
Two synthetic `DaemonStatusSnapshot` literals in `inspectAppStatus`
and `inspect` (used when the IPC is unreachable) get
`desktopAuthGateActive: false` to satisfy the now-required type
field — semantically correct since "no daemon answering" trivially
means "no gate active."
`docs/architecture.md` adds a new bullet under the Desktop folder-
import auth section describing this auto-restart behavior.
Refs: nexu-io/open-design#974
* fix(daemon): combine finalize request-abort + timeout signals (PR #974 round 7 lefarcen P1)
Round 6 wired the route handler to pass `finalizeAbort.signal` into
`finalizeDesignPackage`, but the helper only created its own
DEFAULT_TIMEOUT_MS controller when no caller signal was supplied. The
result: a client that stayed connected could hold the finalize lock and
upstream call indefinitely. Always create the timeout controller; when
the caller passes a signal, combine both via `AbortSignal.any` so
neither cancel path replaces the other.
Adds two regression tests in finalize-design.test.ts:
- timeout fires when caller signal never aborts
- pre-aborted caller signal still cancels
Adds an internal `timeoutMs` option to FinalizeOptions so tests can
exercise the abort path without a 120 s wait or fake-timer chains.
Production callers omit it; default remains DEFAULT_TIMEOUT_MS.
* fix(daemon): allow PATCH preserving existing fromTrustedPicker marker (PR #974 round 7 lefarcen P2)
The PATCH /api/projects/:id handler was rejecting any metadata that
contained `fromTrustedPicker`, including the unchanged `true` marker
that the linked-folder UI re-spreads when editing `linkedDirs`. Trusted
folder-imported projects could not update other metadata fields without
400-ing on their own marker.
Switch the rejection condition from `'in'` to a value comparison: only
reject when the incoming value differs from the persisted one
(`patch.metadata.fromTrustedPicker !== existingMeta?.fromTrustedPicker`).
That keeps acquisition (existing=undefined, patch true) and flip
(existing=true, patch false) attempts blocked while letting the UI
re-spread the existing marker.
POST /api/projects stays strict; that path has no existingMeta.
Adds two regression tests in desktop-import-token-gate.test.ts:
- allows PATCH preserving the existing fromTrustedPicker:true marker
- rejects PATCH that flips fromTrustedPicker on a trusted project
* fix(desktop,packaged): main-process api uses daemon URL not webUrl (PR #974 round 7 lefarcen P2)
Packaged builds load the renderer from `od://app/` and report that URL
through `discoverWebUrl`. But Node-side `globalThis.fetch` (undici) does
not route through Electron's registered `od://` protocol handler — that
handler runs in the renderer's protocol scope, not in main-process Node.
So `pickAndImportFolder` and `fetchResolvedProjectDir` calls from main
silently failed in packaged builds against the protocol scheme.
Add `discoverDaemonUrl` to `DesktopRuntimeOptions` and `DesktopMainOptions`.
The packaged shell already has the sidecar's real `http://127.0.0.1:<port>`
URL (`sidecars.daemon.url` from STATUS IPC) — thread it through to the
runtime. Main-process API calls now prefer the daemon URL and fall back
to the renderer URL for tools-dev (where it is itself http://127.0.0.1).
`PickAndImportFolderDeps.webUrl` renamed to `apiBaseUrl` so the boundary
is explicit at the type level; `fetchResolvedProjectDir`'s first
parameter renamed similarly. tools-dev callers see no behavior change —
their web URL is already an http://127.0.0.1 URL Node fetch can hit.
Test (`apps/packaged/tests/desktop-pick-and-import.test.ts`):
- existing 7 cases updated to the new prop name (no behavior change)
- new case pins URL composition: builds `${apiBaseUrl}/api/import/folder`
and never produces a custom-protocol URL.
Note for review: this test pins URL composition; full Electron protocol
handler integration (renderer fetch through `od://`) is not exercised in
unit tests here.
* fix(tools-dev): preserve daemon/web ports across desktop-auth gate restart (PR #974 round 7 lefarcen P2)
Round 6 added the split-start auto-restart in ensureDaemonGateForDesktop
to close the dev-flow gap where `start daemon` then `start desktop`
left the daemon ungated. The restart was passing the current
`start desktop` CLI options to startDaemonGated/startWeb, which meant a
stack started with `--daemon-port 17456 --web-port 17573` could be
silently moved to random ports during the hardening restart, breaking
browsers and scripts pinned to those ports.
Extract the running ports from the STATUS snapshots (daemon.url and
web.url) and forward them as explicit `{ port }` callback args. The
closure in `tools/dev/src/index.ts` overrides the corresponding option
when a port was extracted; null falls back to the original CLI flags.
Adds three regression tests in tools/dev/tests/desktop-auth-gate.test.ts:
- preserves the running daemon port across the hardening restart
- preserves the running web port across the hardening restart
- falls back to caller options (port:null) when the URL has no port
* fix(web): refresh useDesignMdState on file/chat events (PR #974 round 7 mrcfps)
useDesignMdState() previously only recomputed on mount and on explicit
refresh() (called once after finalize). Once the user kept working —
editing files or sending more chat turns — the stale/fresh badge could
drift out of sync because file mtimes and conversation updatedAt moved
past the recorded generatedAt without the hook re-checking.
Hook accepts an optional `refreshKey: number` arg; ProjectView keeps a
counter and bumps it on three events:
- file-changed SSE (covers tool-emitted file mutations)
- live_artifact* SSE (covers chat turns that emit artifacts)
- streaming `true → false` edge (covers pure-text chat turns)
The hook treats refreshKey as a compute() dep; React's Object.is
comparison short-circuits the no-op renders, so each bump is a single
recompute pass.
Adds a regression test in useDesignMdState.test.tsx:
- flips stale state after a refreshKey bump without remounting
* fix(web): degraded-state useDesignMdState on malformed provenance (PR #974 round 7 mrcfps)
useDesignMdState used to report `{ isStale: false, staleReason: null }`
when the parser could not extract a comparison timestamp from the
DESIGN.md `## Provenance` section. The pinned test made that the
documented behavior. As mrcfps pointed out, that fails open exactly
when the freshness signal is most untrustworthy: any provenance-
formatting drift silently disables the staleness warning.
Extend `DesignMdStaleReason` with a third variant `'unknown-provenance'`.
On `generatedMs === null`, return `{ isStale: true, staleReason: 'unknown-provenance' }`.
ContinueInCliButton renders a distinct chip text "Spec freshness
unknown — regenerate to refresh signal" for that variant; the button
stays enabled because not-comparable is not the same as broken state.
Tests:
- modify the existing pinned test to assert the new degraded state
- add an end-to-end useDesignMdState test feeding a malformed Provenance
section through compute() so a regression that re-pins fresh-on-null
at the hook level (not just computeStale) fails fast
- add ContinueInCliButton render + click tests for the new chip
---------
Co-authored-by: DevForgeAI CI/CD Engineer <devforge-ai@development.ai>
Co-authored-by: lefarcen <935902669@qq.com>
Move sidecar source under src/ so a single tsconfig produces all daemon
output. Removes the parallel dist/src/ tree that was emitted by
tsconfig.sidecar.json (it included src/**/*.ts to type-check the
`../src/server.js` cross-tree import).
Build now emits:
- dist/<flat> (cli.js, server.js, app-version.js, ...)
- dist/sidecar/{index,server}.js
`dist/sidecar/server.js` reaches the main daemon via `../server.js`
instead of `../src/server.js`, so there is no second copy of the source
tree in the published tarball.
Background — issue #534 (already fixed by #537):
The packaged Settings → About panel showed 0.0.0 because the sidecar
chain loaded the duplicated `dist/src/app-version.js`, where the fixed
`new URL('../package.json', import.meta.url)` resolved to a non-existent
`dist/package.json`. #537 patched the symptom by walking parents until a
real `package.json` is found and by writing `appVersion` into the Linux
packaged config. Both stay in place — they're sound defenses — but the
underlying duplicate-emit was never addressed; any future relative
resource lookup (templates, schemas, prompts) anchored on
`import.meta.url` would have hit the same trap.
This change removes the trap.
* chore: enforce test directory conventions
Move package, app, and tool tests out of src and add guard enforcement so source directories stay source-only.
* ci: use guard and package-scoped tests
Run the new repository guard in CI and keep test execution aligned with package-scoped commands after removing root aliases.
* ci: align stable release guard check
Use the new repository guard in stable release verification after replacing the residual-JS-only script.
* chore: tighten test layout enforcement
Enforce sibling tests directories, typecheck moved test suites with dedicated configs, and refresh remaining guidance that pointed at src-based tests.
* chore: clarify no-emit test tsconfigs
Explicitly disable declaration-only emit in test tsconfigs so review tooling sees they are no-emit typecheck configs.
Fix web sidecar proxy requests so same-origin browser requests reach the daemon without tripping origin validation, while unrelated origins remain rejected. Fixes#388.
PR #258 standardized agent spawning through `createCommandInvocation`,
which on Windows wraps `.cmd` / `.bat` paths in `cmd.exe /d /s /c <line>`
and quotes each argument with cmd-style doubled quotes. PR #232's
follow-up fix for `shell:true` was lost in that refactor, and the new
shape has its own quoting bug on argv-style spawn:
1. cmd.exe `/s /c` strips exactly one leading and one trailing `"` from
the rest of the command line.
2. Node, with `windowsVerbatimArguments` unset, escapes each argv element
using CommandLineToArgvW rules — so the inner `"path with space"`
ends up surfacing to cmd.exe with an extra layer of `\"` escaping
that cmd doesn't understand.
Together these collapse `"C:\Users\Ethical Byte\...\codex.CMD" --help`
into `C:\Users\Ethical Byte\...\codex.CMD --help` with no quoting
preserved, and cmd.exe parses the first space as a token boundary —
"`Ethical` is not recognized as an internal or external command." See
issue #315 for the full repro.
The fix mirrors what Node's own `child_process.spawn({ shell: true })`
does internally: wrap the entire joined command line in an extra `"…"`
and set `windowsVerbatimArguments: true`. The outer wrap absorbs the
`/s /c` strip, leaving inner per-arg quoting intact, and the verbatim
flag tells Node to pass argv through to CreateProcess unchanged.
Changes:
- `packages/platform/src/index.ts`
- Extend `CommandInvocation` with optional `windowsVerbatimArguments`.
- Extract the cmd.exe shim builder into `buildCmdShimInvocation` and
apply the outer wrap + verbatim flag in both `createCommandInvocation`
and `createPackageManagerInvocation`.
- Forward the flag through `spawnBackgroundProcess` and
`spawnLoggedProcess`.
- `apps/daemon/src/server.ts` — agent spawn forwards
`invocation.windowsVerbatimArguments`. This is the call site that
hit #315 in the wild (Codex CLI `.CMD` shim, user dir with space).
- `tools/pack/src/win.ts` — `runPnpm` and `runNpmInstall` forward the
flag through `execFileAsync`. Affects the Windows packaged-build
pipeline when run from a path with spaces.
- `tools/dev/src/index.ts` — `runLoggedCommand` accepts and forwards the
flag; `buildDesktop` propagates it from
`createPackageManagerInvocation`. Affects local dev on Windows.
Tests:
- 9 new unit tests in `packages/platform/src/index.test.ts` stub
`process.platform` so both Windows and POSIX branches run on every
CI runner. Coverage:
- POSIX pass-through.
- Windows non-shim binary pass-through.
- `.CMD` shim with spaces in the binary path (the #315 repro).
- `.bat` shim parity.
- Argv elements with spaces alongside the shim path.
- Argv elements without whitespace stay unquoted.
- `process.env.ComSpec` fallback.
- `npm_execpath` short-circuit (cross-platform).
- POSIX pnpm pass-through.
- Windows pnpm wrapped through cmd.exe.
Closes#315.
* fix(tools-dev): strip ELECTRON_RUN_AS_NODE before spawning desktop
Parent processes such as Electron-based IDEs may set ELECTRON_RUN_AS_NODE=1
in their environment for sidecar/script reuse. When tools-dev inherits this
env via process.env, the spawned electron.exe runs as plain Node and fails
to inject main-process APIs (app, BrowserWindow, protocol all become
undefined). Explicitly drop the variable before spawning so desktop always
boots in real Electron mode regardless of caller environment.
* fix(desktop): ensure BrowserWindow is visible on initial load
Windows focus-stealing prevention can leave detached-spawned GUI windows
minimized or hidden, even when constructed with show:true. Add a small
ensureWindowVisible helper that restores from minimized state and forces
show+focus after the placeholder URL loads. Cross-platform safe: only
acts when window is actually hidden or minimized, preserving any user
window-state adjustments.
ensureWebDevNodeModules() called fs.symlink(target, path, "dir") to
link apps/web/node_modules into the web runtime root. On Windows,
"dir" symlinks require either Administrator rights or Developer Mode
(SeCreateSymbolicLinkPrivilege). Standard non-elevated user accounts
without Developer Mode get EPERM and tools-dev exits before web ever
starts.
Junctions ("junction") are functionally equivalent for directory-only
links on the same volume, work for any user without elevation or
Developer Mode, and are silently treated as plain symlinks on POSIX.
The existing isSymbolicLink() check on the next launch still matches
junctions on Node.
Reproduced on Windows 11 + Node 24 with a non-elevated PowerShell
session and Developer Mode off.
* feat(tools-dev): add --prod flag and OD_HOST for headless server deployment
- Lazy-load electronBinaryPath so daemon+web can start without Electron
- Add --prod flag to tools-dev start/run that sets NODE_ENV, OD_WEB_PROD,
and OD_WEB_OUTPUT_MODE automatically for production Next.js builds
- Add OD_HOST env var support to daemon and web sidecar bind addresses
(defaults to 127.0.0.1, set to 0.0.0.0 for remote access)
- Skip next.config.ts distDir override when OD_WEB_PROD=1 so production
builds resolve the default .next directory
Closes#221
* fix: address PR review — hardcode daemon bind to 127.0.0.1, cache electron path
- Revert OD_HOST from daemon: daemon is a local privileged process and must
only bind 127.0.0.1. Remote access goes through the web sidecar proxy.
- Web sidecar resolveDaemonOrigin now always uses 127.0.0.1, separated from
the web bind address (OD_HOST) so the daemon proxy works correctly even
when the web listener binds 0.0.0.0.
- Add OD_HOST character validation to reject clearly invalid values early.
- Cache electronBinaryPath getter result to avoid repeated require() calls.
---------
Co-authored-by: yamsfeer <yamsfeer@users.noreply.github.com>
open-design-release-bot[bot]