sync(desktop): propagate macOS/Linux UX into top epic - #2079

… wizard in t

Implemented by ProPR AI using gpt-5.6-sol model.

Implementation completed successfully.

Fixed the PR’s two UI lint failures:

- Refactored [LocalSetupWizard.tsx](/tmp/git-processor/worktrees/integry/propr/pr-1978-followup-2026-08-29T19-16-57/propr-ui/src/desktop/LocalSetupWizard.tsx:43) into focused phase/form components, reducing function complexity.
- Reduced counted lines in [DesktopExperience.test.tsx](/tmp/git-processor/worktrees/integry/propr/pr-1978-followup-2026-08-29T19-16-57/propr-ui/src/desktop/DesktopExperience.test.tsx:13) without changing behavior.

Verification passed:

- UI lint with zero warnings
- UI typecheck
- UI production build
- 26 desktop renderer tests
- `git diff --check`

Only those two files changed; no commit was created.

PR: #1978
Comment by: @github-actions[bot] (ID: 5464300976)
Model: gpt-5.6-sol

Implemented F1–F7 as a unified hardened local-setup design:

- Removed renderer credential IPC and duplicate remote pairing/auth injection.
- Added native filesystem selection with session-bound, expiring, single-use capabilities.
- Enforced the official relay origin and strict runtime IPC schemas.
- Added process-tree cancellation with bounded cleanup and no late writes.
- Added validated, redacted resume plans and shared hydration.
- Centralized secret redaction across renderer events, persistence, logs, and diagnostics.
- Expanded security, cancellation, restart, platform-gating, and wizard tests.

Validation passed:

- Desktop typecheck, tests, and lint
- Local-setup tests: 10 passed
- CLI setup tests: 130 passed
- Wizard/UI tests: 26 passed
- Process-tree cancellation test
- UI production build
- CLI package dry run
- Electron production package
- `git diff --check`

The branch remains based on `1951-epic-desktop-experience-uxs`; nothing was committed or merged. A fresh `/review` should be posted after the automation commits and publishes this delta.

PR: #1978
Comment by: @integry (ID: 5464383143)
Model: gpt-5.6-sol

sync(desktop): propagate finalized runtime into UX epic

fix(desktop): propagate canonical deep-link length validation to UX

…tting.

Implemented all requested exact-head blockers without committing.

Key outcomes:

- Renderer no longer handles webhook secret bytes; main uses a native prompt and opaque, expiring, session-bound one-shot capabilities.
- Root and private-key authority now use ownership/link/inode validation, anchored directory authority, and durable app-owned key copies.
- Added shared atomic 0700/0600 persistence with no-follow, hardlink rejection, fsync, cancellation checks, and failure cleanup.
- Cancellation propagates correctly with no fallback or late writes.
- Docker abort cleanup journals and removes only run-owned daemon-side containers.
- Linux gating occurs before reporters or mutations.
- Removed dead `loginAgents`; preserved official relay enforcement and existing remote-auth deletion.
- Added clean desktop preparation and the missing `dockerAsync` test mock.
- Stabilized the UI manager shortcut regression.

Validation:

- Clean `npm ci`: passed, 0 vulnerabilities.
- Desktop: 46/46.
- Local setup: 12/12.
- Focused CLI/orchestrator: 89/89.
- UI: 69 files, 496/496.
- Full runner: all 323 non-UI entries passed; its final UI timing failure was fixed and the complete UI workspace then passed.
- Root, desktop, and UI typechecks: passed.
- Production Electron package: passed.
- `git diff --check`: passed.
- Packaged sandbox smoke could not run because the container cannot configure Chromium’s root-owned SUID sandbox or create user namespaces. I did not weaken it with `--no-sandbox`.

PR: #1978
Comment by: @integry (ID: 5464699344)
Model: gpt-5.6-sol

… committing or merging the advanced UX base.

Implemented the three exact-head fixes on `dfba5ac` without committing or merging the advanced UX base.

Key changes:

- Fixed cancellation fake output using synchronous fd-1 writes; cleanup now repeatedly proves exact run-owned removal while preserving foreign/preexisting containers.
- Added main-only descriptor-anchored root operations for setup, filesystem commits, Docker handoff, and fixed-root lifecycle actions. Custom lifecycle roots now require reselection.
- Guarded final stack status, abort checks, Docker error/nonzero handling, and awaited exact-label cleanup.
- Added atomic-root replacement and Docker-launch race regressions.

Validation passed:

- Cancellation regression: 5 repeated mid-launch runs, final-`docker ps` abort, and nonzero status case
- 120 focused setup/CLI/orchestrator tests
- Desktop: 48/48
- Configured UI: 26/26
- Local-setup, CLI, desktop, and UI typechecks
- CLI package dry run
- Linux desktop packaging
- `git diff --check`

Environment limitations:

- Full 324-entry suite was attempted but Redis is unavailable; `llmMetrics.test.ts` reached the runner’s 180-second timeout.
- Packaged smoke was blocked by the Electron `chrome-sandbox` ownership/mode requirement.
- Docker is unavailable for a real daemon smoke test.

PR: #1978
Comment by: @integry (ID: 5465027279)
Model: gpt-5.6-sol

…5cd79a3af140600c3dec75e0f9` without merging or committing.

Implemented all four blockers on exact head `be3d9f933243015cd79a3af140600c3dec75e0f9` without merging or committing.

- Docker binds now use only the validated private `<userData>/desktop/local-stack` root—never `/proc/.../fd`, `/dev/fd`, chooser paths, symlinks, or renderer values.
- Removed custom runtime-root selection and resume state; lifecycle and retries always reopen the fixed root.
- Cleanup now re-inspects after every stop result and force-removes only the same exactly labeled setup-run container.
- Cancellation coverage uses deterministic, bounded serial iterations and passes alongside parallel tests.
- Added persisted HostConfig/restart, replacement sentinel, root identity, and nonzero-stop regression coverage.

Validation passed:

- Desktop tests: 49/49
- Root unit suite: 278/278
- UI suite: 496/496
- CLI suite: 331 passed, one platform skip
- Orchestrator suite: 110/110
- Local setup, typechecks, and Linux desktop packaging
- Repeated serial/parallel cancellation runs
- `git diff --check`

Real Docker restart/smoke, Redis full-suite execution, Xvfb sandbox smoke, and `.deb` creation were unavailable because Docker, Redis, `xvfb-run`, and `fakeroot` are not installed.

PR: #1978
Comment by: @integry (ID: 5465215437)
Model: gpt-5.6-sol

…9ef80d672c21cd8532d111` without merging, syncing, or committing.

Implemented the exact-head follow-up on `73ddce0bb05d7773049ef80d672c21cd8532d111` without merging, syncing, or committing.

Key results:

- Added injectable, loopback-only local profile probing without touching PR #1977 remote-auth ownership.
- Hardened cancellation boundaries around GitHub, fetch, relay, token, version, and persistence operations.
- Threaded descriptor-root reads and authority revalidation through all local configuration consumers.
- Added fixed/redacted lifecycle IPC errors and protected main-process diagnostics.
- Added a single setup/lifecycle/cancel/shutdown coordinator.
- Added exact-label, fixed-bind lifecycle recovery supporting Stop → Start/Restart and partial stopped stacks while rejecting foreign replacements.
- Made rollback concurrent with bounded deadlines, post-stop ownership inspection, residual detection, and explicit incomplete-cleanup failure.

Validation passed:

- Desktop: 63 tests
- Local setup: 12 tests
- CLI setup engine: 59 tests
- API: 8 tests
- Repeated serial/parallel orchestrator suites: 61 tests per run
- Desktop/UI, CLI, local-setup, and client typechecks
- Linux x64 production packaging
- `git diff --check`
- Canonical and packaged orchestrators match

The configured full suite reached test 188 before Redis-dependent tests failed with `ECONNREFUSED`; `redis-server` is unavailable here. Docker and `xvfb-run` are also unavailable, so their smoke tests could not run.

PR: #1978
Comment by: @integry (ID: 5465406860)
Model: gpt-5.6-sol

…ng/syncing or touching auth/transport work.

Implemented the exact-head rollback proof fix without merging/syncing or touching auth/transport work.

Key changes:

- Failed/malformed `docker inspect` now requires a separate bounded exact-name query before absence is accepted.
- Nonzero, timeout, signal, truncation, malformed, ambiguous, duplicate, or present query results fail closed with `PROPR_SETUP_CLEANUP_INCOMPLETE`.
- The classifier is reused before stop, after stop, after remove, and during final residual verification.
- Docker output is capped/discarded and excluded from renderer-facing errors/logs.
- Added deterministic rollback regressions in [orchestratorRollbackAbsenceProof.test.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1978-followup-2026-08-30T00-23-23/test/orchestratorRollbackAbsenceProof.test.mjs:18).
- Updated bounded-result typing in [types.ts](/tmp/git-processor/worktrees/integry/propr/pr-1978-followup-2026-08-30T00-23-23/packages/cli/src/orchestrator/types.ts:121).

Validation passed:

- Setup controller: 21/21
- Orchestrator focused suites: 62/62
- Local setup: 12/12
- All 30 CLI non-live test files
- Desktop/UI and CLI typechecks
- Canonical/built orchestrator byte comparisons
- `git diff --check`

The full 329-file suite completed all tests through the first 183 files successfully, then encountered unavailable Redis (`ECONNREFUSED 127.0.0.1:6379`). Neither Redis nor Docker is installed in this environment, so the unavailable remainder was stopped. HEAD remains exactly `61961b3dee25bfb5c7d27f10a0fe16b751e363a0`.

PR: #1978
Comment by: @integry (ID: 5465725447)
Model: gpt-5.6-sol

sync(desktop): propagate finalized packaging runtime into UX epic

…960/gpt-5.6-sol-implement-the-guided-loca-20260829-1840-7k8

Automatically resolved merge conflicts after merging target branch into PR branch.
Resolved conflicts in:
- apps/desktop/README.md
- apps/desktop/forge.config.ts
- apps/desktop/package.json
- apps/desktop/src/logger.ts
- apps/desktop/src/main.ts
- propr-ui/src/desktop.tsx
- propr-ui/src/desktop/DesktopExperience.test.tsx

PR: #1978
Model: gpt-5.6-sol

Implemented the UX/runtime reconciliation and deep-link seam.

Key outcomes:

- Exact merge commit exists at `6813708122ad`, with parents:
  - `a6b5b5c841231b67200492e55e1b46b78e354ab3`
  - `0ec939446c2c71eab11c1aac43e9cd3e0cbe1d64`
- Added ordered preload deep-link buffering, exactly-once boundary subscription, teardown/remount safety, and typed adapter exposure.
- Connect links only stage untrusted candidates for explicit confirmation.
- Open links validate active-profile identity and bounded routes, with fixed redacted rejection UI.
- Preserved remote platform flows, Linux local setup, canonical packaged resources, and inert smoke behavior.
- No conflicts, unmerged entries, conflict markers, or whitespace errors.

Validation passed:

- Desktop/UI typechecks
- Focused deep-link, preload, boundary, remount, wizard, main, and smoke tests
- Complete desktop suite
- Unit suite: 278 passed
- Browser smoke: 4 passed
- UI suite: 71 files, 508 tests passed
- Full Suite: all 342 non-live files plus native workspace suite passed
- Validate Changes build/lint/package/release/client/notification checks
- `git diff --check`

Per the harness instruction, the follow-up working-tree changes are ready for its system-managed commit.

PR: #1978
Comment by: @integry (ID: 5486959279)
Model: gpt-5.6-sol

Implemented the requested #1978 follow-ups without committing.

Key changes:

- Darwin skips only the Linux `/proc/<pid>/fd` rename/swap proof.
- Windows skips only the POSIX/Linux controller and filesystem-capability suites; schema, secrets, remote bridge/auth tests still run.
- Added canonical HTTPS remote browser authentication with a validated `/api/auth/github` endpoint and `propr://connect` recovery.
- macOS/Windows renderer bridges now reject local setup without IPC and expose no lifecycle/Docker authority.
- Updated packaged smoke checks for the final welcome-card Connect flow, including no persistence/activation and remote-only setup.
- Extracted desktop presentation panels and split management tests; affected files are all under 400 lines.

Validation passed:

- Full desktop suite: 228 tests, 0 failures.
- Darwin-mode targeted run: 37 passed, exactly one `/proc` test skipped.
- Windows-mode targeted run: platform-neutral tests passed; only explicit POSIX suites skipped.
- UI targeted suite: 32 passed.
- `npm run desktop:typecheck`
- Full UI lint
- Packaged smoke support/authorization tests
- `git diff --check` including new files.

PR: #1978
Comment by: @integry (ID: 5487399603)
Comment by: @integry (ID: 5487406606)
Comment by: @github-actions[bot] (ID: 5487412763)
Comment by: @integry (ID: 5487428417)
Comment by: @integry (ID: 5487441045)
Model: gpt-5.6-sol

…fbe9972a5818c6c020e18439608dd0b3b2c9`. No commit was created.

Implemented the consolidated correction on exact head `e22dfbe9972a5818c6c020e18439608dd0b3b2c9`. No commit was created.

- Replaced browser-cookie OAuth with main-owned two-phase desktop pairing, secure credential storage, origin-bound bearer injection, activation tickets/scopes, authenticated REST/socket handling, and renderer-safe adapters.
- Removed obsolete `remote-authentication.ts` and its URL-only tests.
- Updated packaged smoke to exercise `window.__PROPR_DESKTOP__`, while independently proving macOS/Windows legacy bridges expose no lifecycle authority.
- Closed the coordinator cancellation race and added deterministic delayed-cleanup overlap coverage.

Verification passed:

- Desktop: 328 tests, 0 failures
- Client pairing/transport: 51 tests
- API desktop authentication: 16 tests
- UI desktop/transport suites: 67 tests
- Desktop/UI/API typechecks and lint
- Desktop packaging and packaged-artifact/fuse inspection
- `git diff --check`

The live packaged smoke was attempted but could not launch because the environment has no valid X display or Xvfb installation. The packaged artifact itself built and passed static smoke inspection.

PR: #1978
Comment by: @integry (ID: 5487666617)
Model: gpt-5.6-sol

…c40e1109c2bf378570e342239d7c7558`, without committing.

Implemented the complete correction on exact head `6f8599a8c40e1109c2bf378570e342239d7c7558`, without committing.

Key changes include:

- Restored bounded, ordered IPC/session/protocol/setup/lifecycle/credential/profile/window shutdown and admission draining.
- Restored native durability and release workflow gates.
- Separated metadata-only local activation from ticketed remote scope publication.
- Added encryption-unavailable metadata storage while keeping all secret writes fail-closed.
- Guarded every SocketProvider application event against stale scopes.
- Corrected Windows realpath, HTTPS runtime-config, and explicit Linux preload fixtures.
- Preserved coordinator cancellation exclusion and bridge authority behavior.

Validation passed:

- Desktop typecheck and full suite: 351 tests, 345 passed, 6 expected platform skips.
- Native durability gate: 117/117, zero skips.
- Focused UI regressions: 95/95.
- UI lint, typecheck, build, client tests/build.
- Linux package build and packaged executable/fuse inspection.
- Release metadata verification and `git diff --check`.

Environment limitations:

- Live packaged GUI smoke could not launch because this runner has no X display or `xvfb-run`.
- Windows and Darwin native execution require their respective CI hosts.
- The pinned actionlint container image was unavailable locally.

PR: #1978
Comment by: @integry (ID: 5488054466)
Model: gpt-5.6-sol

…7b29003aaafebf42dea8d60265be0a51c2` without committing.

Implemented all requested corrections on exact head `76ba297b29003aaafebf42dea8d60265be0a51c2` without committing.

Key changes:

- Restored `@propr/client` build ordering in root `test:prepare`.
- Fixed packaged layout inspection to use retained `elements.card`.
- Added executable packaged transport/security coverage for bearer REST, Socket.IO/Engine.IO scope authentication and rotation, stale rejection, complete origin-storage cleanup/rollback, OS-backed credential custody, renderer-secret exclusion, and success/retry/forced-timeout shutdown.
- Added Linux CI provisioning for D-Bus, Secret Service, keyring custody scanning, and both x64/ARM64 smoke jobs.
- Moved local activation persistence behind main-process tickets, generation checks, serialized profile mutations, and exact rollback authority.
- Added deterministic overlapping activation coverage proving superseded attempts neither remain selected nor publish transport state.

Validation passed:

- Desktop tests: 346 passed, 6 platform skips.
- Native durability: 118/118.
- IPC shutdown and pairing lifecycle: 21 passed.
- Desktop/UI typechecks, lint, builds, targeted renderer tests.
- Validate unit, hosted-tunnel, notification, CLI package, client, and Playwright browser suites.
- Linux x64 package build and executable/fuse inspection.
- Release workflow and packaged-smoke support tests.
- `git diff --check`.

Full Suite reached test 200/349 with completed tests passing, then was stopped because this host has no Redis server or Docker and repeatedly returned `ECONNREFUSED`. Full executable Linux smoke requires Xvfb and GNOME Keyring, which are unavailable here; ARM64, native Windows, and Darwin execution likewise require their CI runners. The workflow now provisions and runs those gates.

PR: #1978
Comment by: @integry (ID: 5488378817)
Model: gpt-5.6-sol

…dd7552c55d58e0f7`.

Implemented F17/F18 on exact head `b0012fb8703ded3949b254cedd7552c55d58e0f7`.

- F17: [socketAuthentication.ts](/home/node/workspace/packages/api/services/socketAuthentication.ts) now uses frozen, socket-specific header facades and never mutates the shared Engine.IO request. New namespaces receive the same authentication middleware. Added deterministic failure/reconnect isolation coverage in [socketAuthenticationIsolation.test.ts](/home/node/workspace/packages/api/test/socketAuthenticationIsolation.test.ts).
- F18: [ConfigManager.ts](/home/node/workspace/packages/cli/src/config/ConfigManager.ts) treats successful atomic-save resolution as the commit point, with rollback only on save rejection. Added abort-at-resolution memory/disk parity coverage.

Passed:

- 33 targeted tests
- API/CLI lint and typecheck
- Validate application gates, including 279 fast tests, 321 tunnel tests, CLI packaging, client/UI/docs builds, and notification suites
- Linux x64 desktop package
- 118/118 native durability tests
- Desktop suite: 346 passed, 6 platform skips
- Packaged executable/fuse inspection

Environment-limited:

- Full Suite reached file 209/350 with all prior files green, then required Redis. Docker and Redis are unavailable here.
- Darwin, Windows, ARM64, Linux executable smoke, and native DEB/RPM jobs require their CI runners and missing host tools.

No commit was created.

PR: #1978
Comment by: @integry (ID: 5488805044)
Model: gpt-5.6-sol

…77509dc5d692`.

Implemented F19 on exact head `7866809d20e4f086718e4f6e39f177509dc5d692`.

- [socketAuthentication.ts](/tmp/git-processor/worktrees/integry/propr/pr-1978-followup-2026-09-01T04-50-39/packages/api/services/socketAuthentication.ts:28) now attaches authentication to root, all pre-existing namespaces, and future namespaces through one idempotent enumeration abstraction.
- [socketAuthenticationIsolation.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-1978-followup-2026-09-01T04-50-39/packages/api/test/socketAuthenticationIsolation.test.ts:125) adds deterministic pre-registration coverage for missing/wrong credentials and later-namespace credential isolation.

Verification:

- Focused authentication: 13 passed
- API typecheck/lint: passed
- Full Suite: 349/350 runs passed; only `llmMetrics.test.ts` timed out because Redis/Docker is unavailable
- Host-compatible Validate stages: passed
- Linux x64 package, fuse inspection, typechecks: passed
- Native durability: 118/118 passed
- Desktop tests: 346 passed, 6 platform skips
- Runtime/desktop audits: zero vulnerabilities

The remaining native matrix legs and Linux launch smoke could not run because this host lacks macOS/Windows/ARM64 runners, Docker, Redis, `xvfb-run`, keyring, and RPM tooling. Only the two requested files are modified; no commit was created.

PR: #1978
Comment by: @integry (ID: 5489066697)
Model: gpt-5.6-sol

…702d868a5e9c`.

Implemented F20 on exact HEAD `7d9f0978e0131e9db1b4b96ba235702d868a5e9c`.

- Added shared 16–512 character webhook-secret policy in [webhook-secret-policy.ts](/tmp/git-processor/worktrees/integry/propr/pr-1978-followup-2026-09-01T05-27-32/apps/desktop/src/webhook-secret-policy.ts).
- Enforced it in native prompt acquisition and capability issuance/validation.
- Added 15-character rejection, 16-character acceptance, 512 acceptance, and 513 rejection coverage.
- Added exact shortest-secret renderer/log/diagnostic redaction checks while preserving structured errors.
- Confirmed one-character contextual strings are not globally redacted.

Verification passed:

- Full Suite: all 350 files plus native workspace suite
- Desktop typecheck and tests: 349 passed, 6 platform skips
- Native durability: 118/118
- Validate’s locally reproducible stages
- Linux x64 package build and executable/fuse inspection
- `git diff --check`

Unavailable locally: GUI packaged smoke due missing Xvfb, and the five non-Linux-x64 native/package runners. No commit was created.

PR: #1978
Comment by: @integry (ID: 5489339922)
Model: gpt-5.6-sol

…guided-loca-20260829-1840-7k8

[1960 by GPT-5.6 Sol] Implement the guided local Linux setup wizard in the desktop app