feat: repaint the desktop chrome, adopt the DeepSeek tokens, and add thinking effort levels (#97)

## Related Issue

No issue. The problem is described below.

## Problem

Several things had drifted at once across the desktop app and the web
UI:

- The desktop window painted its own chrome, lost the native macOS
corners and
the vibrancy material, and shipped without the release changesets it
needed.
- The web UI's colours came from ad-hoc values. In the light theme the
secondary
and meta label ramp measured 3.71:1, 2.13:1 and 1.26:1 on white — all
below
  WCAG AA.
- The composer offered a single thinking on/off row that always sent
`high`,
even though the model catalog knows which effort levels each model
supports
  and every other renderer already offers the full set.
- The model quick-switch menu had a height floor but no ceiling, so a
provider
  with roughly twenty models filled the whole window.
- The marketing site was removed, but a desktop test still read
  `apps/site/src/App.vue` and an oauth comment still pointed at it.
- The legacy migration package was removed, leaving stale references
behind.

## What changed

**Desktop.** The macOS window keeps its native frame and vibrancy
material, both
palettes were repainted, the window is opaque on every platform, and the
release
workflow now pins its actions to commit SHAs and publishes to the
dedicated
desktop release repository.

**Design tokens.** The web UI adopts the vendored DeepSeek token sheets.
The
light palette overrides three label tokens, because the vendored ramp
fails AA
on a white page and the neutral scale has no step between -600 and -700;
the
replacements measure 5.00:1, 4.57:1 and 3.25:1 and keep the ramp
ordering. Dark
mode keeps the vendored aliases untouched.

**Thinking effort.** The model catalog now carries `support_efforts` and
`adaptive_thinking` through all five layers (zod schema →
`toProtocolModel` →
`WireModel` → `toAppModel` → `AppModel`), so the web client finally
knows what a
model offers. The composer lists those levels, clamps a requested level
to the
nearest lower supported one, and shows the effective level in the footer
pill.
The rules mirror `packages/node-sdk/src/thinking-levels.ts`; the web app
has no
dependency on the SDK, so the mirror is deliberate.

**Menu height.** The quick-switch dropdown is capped at 360px and
scrolls.

**Cleanup.** The marketing site references, the legacy migration
fallout, and
two stale attachment-chip theme overrides are gone. The prompt anchor
rail's
setting hint and code comment now describe what the rail actually draws.

### Verification

- Full suite: 10285 passed, 71 skipped, 2 todo — green via the pre-push
hook.
- `pnpm --filter @pymodel/pythinker-web run typecheck` — exit 0.
- `pnpm run lint` — exit 0, no errors.
- Light-theme contrast measured live in Chromium, not calculated only.

## Checklist

- [x] I have read the
[CONTRIBUTING](https://github.com/PyModel/pythinker-code/blob/main/CONTRIBUTING.md)
document.
- [x] I have linked a related issue, or explained the problem above.
- [x] I have added tests that prove my feature works.
- [x] Ran `gen-changesets` skill, or this PR needs no changeset.
- [x] Ran `gen-docs` skill, or this PR needs no doc update.

Author: elkaix

.agents/skills/gen-changesets/SKILL.md

@@ -9,7 +9,7 @@ description: Use when generating changesets in the pythinker-code repository, in
 
 - `@pymodel/pythinker-code`: the CLI
 
-All other `@pymodel/*` packages are treated as internal packages, including `@pymodel/pythinker-code-sdk`, `agent-core`, `kosong`, `kaos`, `pythinker-code-oauth`, `pythinker-telemetry`, and `migration-legacy`.
+All other `@pymodel/*` packages are treated as internal packages, including `@pymodel/pythinker-code-sdk`, `agent-core`, `kosong`, `kaos`, `pythinker-code-oauth`, and `pythinker-telemetry`.
 
 ## Core Rules
 

.changeset/README.md

@@ -22,14 +22,12 @@ All other workspace packages are private internal packages, are not published to
 - `@pymodel/pythinker-telemetry`
 - `@pymodel/pythinker-web`
 - `@pymodel/kosong`
-- `@pymodel/migration-legacy`
 - `@pymodel/protocol`
 - `@pymodel/server`
 - `@pymodel/server-e2e`
 - `@pymodel/dashboard`
 - `@pymodel/dashboard-server`
 - `@pymodel/dashboard-web`
-- `pythinker-migration-legacy`
 
 Version impact from internal dependencies must be judged manually. The published artifacts for CLI and SDK bundle internal workspace packages into the artifact itself; runtime `dependencies` of published packages must not include any `@pymodel/*` internal workspace packages.
 

.changeset/config.json

@@ -14,14 +14,12 @@
     "@pymodel/pythinker-telemetry",
     "@pymodel/pythinker-web",
     "@pymodel/kosong",
-    "@pymodel/migration-legacy",
     "@pymodel/protocol",
     "@pymodel/server",
     "@pymodel/server-e2e",
     "@pymodel/dashboard",
     "@pymodel/dashboard-server",
-    "@pymodel/dashboard-web",
-    "pythinker-migration-legacy"
+    "@pymodel/dashboard-web"
   ],
   "snapshot": {
     "useCalculatedVersion": true,

.changeset/dark-sidebar-contrast.md

@@ -0,0 +1,6 @@
+---
+"@pymodel/pythinker-code": patch
+"@pymodel/pythinker-desktop": patch
+---
+
+Make the workspace header, session timestamps, and the settings row legible in dark mode on the translucent desktop sidebar.

.changeset/desktop-dedicated-update-channel.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-desktop": patch
+---
+
+Publish desktop releases to a dedicated update channel so update checks resolve a desktop build instead of an unrelated release, and fail the release when a packaged build carries no update feed.

.changeset/desktop-pin-host-port.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-desktop": patch
+---
+
+Pin the Host port so the desktop app reconnects to its own Host, and stop reporting builds that cannot self-update as update errors.

.changeset/general-session-mode.md

@@ -0,0 +1,6 @@
+---
+"@pymodel/agent-core": minor
+"@pymodel/protocol": minor
+---
+
+Add a general non-coding session mode for research and connected tools.

.changeset/model-catalog-thinking-metadata.md

@@ -0,0 +1,7 @@
+---
+"@pymodel/protocol": minor
+"@pymodel/agent-core": minor
+"@pymodel/pythinker-web": minor
+---
+
+The model catalog now carries per-model thinking-effort levels and the adaptive-thinking flag to API clients.

.changeset/remove-legacy-migration.md

@@ -0,0 +1,6 @@
+---
+'@pymodel/pythinker-code': minor
+---
+
+Remove the legacy pythinker-cli migration: the `pythinker migrate` subcommand, the first-launch
+migration prompt, and the `[imported]` session badge.

.github/workflows/release.yml

@@ -61,15 +61,15 @@ jobs:
       id-token: write # Required for NPM Trusted Publishing (OIDC)
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned from v6.0.2
         with:
           fetch-depth: 0
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v6
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # pinned from v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # pinned from v6
         with:
           node-version-file: .nvmrc
           cache: "pnpm"
@@ -93,14 +93,14 @@ jobs:
 
       - name: Mint release-bot token
         id: release-bot
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # pinned from v2
         with:
           app-id: ${{ vars.RELEASE_BOT_APP_ID }}
           private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
 
       - name: Create Release Pull Request or Publish to npm
         id: changesets
-        uses: changesets/action@v1
+        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # pinned from v1
         with:
           publish: node scripts/release/changeset-publish-idempotent.mjs
           version: pnpm run version:release
@@ -142,13 +142,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned from v6.0.2
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v6
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # pinned from v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # pinned from v6
         with:
           node-version-file: .nvmrc
           cache: "pnpm"
@@ -196,7 +196,7 @@ jobs:
 
       - name: Upload VSIX artifacts
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # pinned from v7
         with:
           name: pythinker-code-vsix
           path: apps/vscode/artifacts/vsix/*.vsix
@@ -296,12 +296,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned from v6.0.2
         with:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # pinned from v6
         with:
           node-version-file: .nvmrc
 
@@ -318,10 +318,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned from v6.0.2
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # pinned from v6
         with:
           node-version-file: .nvmrc
 
@@ -330,7 +330,7 @@ jobs:
       # Cloning and pushing the tap needs contents and nothing else.
       - name: Mint tap token
         id: tap-token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # pinned from v2
         with:
           app-id: ${{ vars.RELEASE_BOT_APP_ID }}
           private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
@@ -388,10 +388,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned from v6.0.2
 
       - name: Download native artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # pinned from v8
         with:
           pattern: pythinker-code-native-*
           path: dist-native-release