chore(fork): sync upstream multica v0.6.3 (CHE-1835, CHE-1837) [merge]

AGENTS.md

@@ -122,6 +122,7 @@ Workspace-scoped queries filter by `workspace_id`; membership gates access and `
 ## Change and Delivery Rules
 
 - Keep changes scoped; reuse existing patterns. Code comments are English.
+- Use names, types, and tests to express behavior. Keep comments for non-obvious rationale and constraints; remove superseded plans and incident narratives when updating code. Preserve tool directives and mixed-version contracts.
 - Do not add internal compatibility shims, dual writes, fallback paths, or legacy adapters unless requested. This does not relax API response compatibility above.
 - New global pre-workspace routes use a single word or `/{noun}/{verb}`, not hyphenated root names. Update `server/internal/handler/reserved_slugs.json`, run `pnpm generate:reserved-slugs`, and commit `packages/core/paths/reserved-slugs.ts` when changing reserved slugs.
 - Use atomic conventional commits and the repository PR template. For releases, follow [.github/RELEASING.md](.github/RELEASING.md); default to a patch bump unless specified otherwise.

apps/desktop/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@multica/desktop",
   "productName": "Multica",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "private": true,
   "description": "Multica Desktop — native desktop client for the Multica platform.",
   "homepage": "https://multica.ai",

apps/desktop/src/main/keyboard-shortcuts.ts

@@ -26,28 +26,10 @@ const ZOOM_MIN = -3;
 const ZOOM_MAX = 4.5;
 
 /**
- * Inspect a `before-input-event` key and apply (or block) the matching
- * window-level shortcut. Returns `true` when the caller should call
- * `event.preventDefault()` — that both swallows the renderer keydown and
- * prevents the application menu accelerator from firing, so we don't
- * double-trigger zoom on macOS where the default menu also binds these
- * keys.
- *
- * Why we don't rely on the menu's `zoomIn` / `zoomOut` roles: on macOS the
- * default `Cmd+-` accelerator does not fire reliably across keyboard
- * layouts (issue MUL-2354 — Cmd+= zooms in but Cmd+- doesn't undo it).
- * Handling the shortcuts here gives identical behavior on every platform
- * and every layout.
- */
-/**
- * Result of handleAppShortcut:
- * - `false`: not handled, let Electron continue
- * - `true`: handled (preventDefault), no further action
- * - `"close-tab"`: Cmd/Ctrl+W intercepted — caller should send IPC to renderer
- * - `"open-settings"`: Cmd/Ctrl+, intercepted — caller should route the
- *   request to the tabbed main window
- * - `{ action: "select-tab", key }`: Cmd/Ctrl+1..9 intercepted — caller
- *   should route the requested browser-style tab position to the main window
+ * Window shortcut outcomes tell the caller whether to continue, preventDefault,
+ * or dispatch a renderer action. Prevent handled input from also firing the menu
+ * accelerator. Handle zoom here for consistent keyboard-layout behavior.
+ * close-tab, open-settings, and select-tab actions route to the main window.
  */
 export type ShortcutResult =
   | boolean

apps/desktop/src/main/navigation-guard.ts

@@ -1,24 +1,8 @@
 /**
- * Top-level navigation hardening for renderer windows.
- *
- * Scope note (MUL-4899) — this is origin hardening ONLY, and deliberately NOT
- * the mechanism that handles in-app links.
- *
- * Client-side routing never fires `will-navigate`: React Router pushes history
- * entries without a document load. So an in-app path — a good one like
- * `/acme/issues/1` or a bad one like `/Users/me/shot.png` pasted by an agent —
- * never reaches this guard at all. Bad in-app paths are a routing concern,
- * answered by the renderer's 404 page. Trying to police application paths here
- * would be both ineffective (the hook does not see them) and wrong (it would
- * break legitimate reloads).
- *
- * What it does catch is a real document-level navigation away from the trusted
- * renderer: `window.location = 'https://evil.example'`, an anchor Chromium
- * resolves to a remote URL in the same window, a dropped file URL. These windows
- * run with `webSecurity: false` (the process sandbox is enabled), so a
- * foreign document landing in one would inherit privileged context. New
- * windows and external links already route through `setWindowOpenHandler` →
- * `openExternalSafely`; this closes the same-window path.
+ * Guard document-level renderer navigation to trusted origins or the packaged
+ * entry file. Same-window foreign documents must not inherit renderer privileges.
+ * Client-side route changes do not fire will-navigate and remain the router's
+ * responsibility. New windows and external links use openExternalSafely.
  */
 
 /** The subset of BrowserWindow this module needs — keeps it unit-testable. */

apps/desktop/src/renderer/src/App.auth-recovery.test.tsx

@@ -40,10 +40,6 @@ vi.mock("@multica/core/auth", () => ({
     selector(state.auth),
 }));
 
-vi.mock("@multica/core/onboarding", () => ({
-  useWelcomeStore: { getState: () => ({ reset: vi.fn() }) },
-}));
-
 vi.mock("@multica/core/workspace/queries", () => ({
   workspaceKeys: { list: () => ["workspace-list"] },
 }));

apps/desktop/src/renderer/src/App.tsx

@@ -3,7 +3,6 @@ import { useQueryClient } from "@tanstack/react-query";
 import { CoreProvider } from "@multica/core/platform";
 import { pickLocale, type SupportedLocale } from "@multica/core/i18n";
 import { useAuthStore } from "@multica/core/auth";
-import { useWelcomeStore } from "@multica/core/onboarding";
 import { workspaceKeys } from "@multica/core/workspace/queries";
 import { useWorkspaceList } from "@multica/core/workspace";
 import { api } from "@multica/core/api";
@@ -364,7 +363,6 @@ const sessionTeardown: SessionTeardown = {
     window.desktopAPI.reportAuthSession?.(userId),
   resetTabs: () => useTabStore.getState().reset(),
   closeOverlay: () => useWindowOverlayStore.getState().close(),
-  resetWelcome: () => useWelcomeStore.getState().reset(),
   clearDaemonToken: () => window.daemonAPI.clearToken(),
   stopDaemon: () => window.daemonAPI.stop(),
 };

apps/desktop/src/renderer/src/components/tab-bar.tsx

@@ -47,33 +47,11 @@ import { parseIssueWindowPath } from "../../../shared/issue-window";
 const TAB_SCROLL_FADE_SIZE = 24;
 const TAB_ENTRY_EASE = [0.22, 1, 0.36, 1] as const;
 
-// Chrome-style merged tab: the active tab shares the content surface's fill and
-// flares into it through concave bottom corners. Each flare is a small square
-// whose radial gradient carves a quarter-circle notch (transparent, so the
-// strip behind the flare shows through), strokes a 1px arc that continues the
-// tab's side border into the content card's top ring, and fills the rest with
-// the surface colour. The 0.4px spread on either side of the --surface-border
-// pair anti-aliases that arc.
-//
-// That background-color is load-bearing, not decoration: the flare's bottom row
-// overlaps the content card's top ring, and in dark mode --surface-border is
-// translucent (oklch(1 0 0 / 10%)), so without an opaque layer beneath it the
-// arc would composite over the ring instead of replacing it and the two keylines
-// would stack into a markedly lighter line right where the straight ring meets
-// the curve. It therefore has to be the strip's real backdrop — the sidebar
-// wrapper's fill, which is conditional and not this file's to re-derive.
-// SIDEBAR_WRAPPER_FILL_CLASS reads it off the wrapper itself.
-//
-// The backing may only reach as far as it is needed, though. A flare hangs 9px
-// past the tab's edge, over the neighbouring tab, so an opaque square there
-// prints over whatever that neighbour draws: its hover pill lost the whole
-// corner it shares with the flare and read as a dark bite (MUL-6160). Masking
-// the notch away removes the backing exactly where the gradient is transparent
-// anyway, so the notch is a hole rather than a painted-on copy of the strip and
-// shows whatever is actually behind it — bare strip usually, the neighbour's
-// pill where it reaches in. The mask is opaque again by the radius where the
-// arc's anti-aliasing starts, so every pixel the arc and the canvas fill cover
-// keeps its backing.
+// Concave tab flares need an opaque backing beneath translucent border arcs
+// to avoid compositing a second keyline over the content ring. Read that backdrop
+// from SIDEBAR_WRAPPER_FILL_CLASS rather than duplicating the wrapper's fill rule.
+// Mask the transparent notch so the backing cannot paint over a neighboring hover
+// pill, while retaining backing beneath the arc's antialiasing.
 const TAB_FLARE_RADIUS = 10;
 const tabFlareGradient = (side: "left" | "right") => {
   const r = TAB_FLARE_RADIUS;

apps/desktop/src/renderer/src/components/workspace-route-layout.test.tsx

@@ -89,10 +89,6 @@ vi.mock("@multica/views/workspace/use-workspace-seen", () => ({
   useWorkspaceSeen: () => state.workspaceSeen,
 }));
 
-vi.mock("@multica/views/workspace/welcome-after-onboarding", () => ({
-  WelcomeAfterOnboarding: () => null,
-}));
-
 vi.mock("@multica/views/layout", () => ({
   WorkspacePresencePrefetch: () => null,
 }));

apps/desktop/src/renderer/src/components/workspace-route-layout.tsx

@@ -10,7 +10,6 @@ import { getCurrentSlug, setCurrentWorkspace } from "@multica/core/platform";
 import { isWorkspaceDeletePending } from "@multica/core/workspace/pending-delete";
 import { useAuthStore } from "@multica/core/auth";
 import { useWorkspaceSeen } from "@multica/views/workspace/use-workspace-seen";
-import { WelcomeAfterOnboarding } from "@multica/views/workspace/welcome-after-onboarding";
 import { WorkspacePresencePrefetch } from "@multica/views/layout";
 import { SourceBackfillModal } from "@multica/views/onboarding";
 import { useTabStore } from "@/stores/tab-store";
@@ -57,12 +56,11 @@ export function WorkspaceRouteLayout() {
   const isAuthLoading = useAuthStore((s) => s.isLoading);
   // While a WindowOverlay is open (onboarding, accept-invite, new-workspace),
   // the underlying tab is still mounted in the React tree — so this layout
-  // and its WelcomeAfterOnboarding Modal would render UNDER the overlay.
+  // and its SourceBackfillModal would render UNDER the overlay.
   // Because the modal uses a Portal that targets document.body, it ends up
   // rendered LATER in the DOM and visually outranks the overlay's z-50.
-  // Suppress the modal whenever any overlay is active; the moment the
-  // overlay closes the welcome hook re-evaluates and pops if its store
-  // signal is still set.
+  // Suppress the modal whenever any overlay is active; it re-evaluates the
+  // moment the overlay closes.
   const overlayActive = useWindowOverlayStore((s) => s.overlay !== null);
 
   // Workspace routes require auth. App.tsx renders <DesktopLoginPage>
@@ -179,20 +177,12 @@ export function WorkspaceRouteLayout() {
     <WorkspaceSlugProvider slug={workspaceSlug}>
       <WorkspacePresencePrefetch />
       <Outlet />
-      {/* Reads the welcome-store transient signal parked by
-       *  OnboardingFlow.handleRuntimeNext. Suppressed while a WindowOverlay
-       *  (onboarding / accept-invite / new-workspace) is open so the modal
-       *  doesn't portal-jump in front of an active pre-workspace flow.
-       *  Once the overlay closes the hook re-evaluates and pops the
-       *  Modal — unless the store signal has already been consumed, in
-       *  which case the hook renders null. */}
-      {!overlayActive && <WelcomeAfterOnboarding />}
       {/* Source-attribution backfill: same Dialog the web shell mounts
        *  inside DashboardLayout. Desktop's WorkspaceRouteLayout doesn't
        *  wrap DashboardLayout, so the modal has to be wired in directly
-       *  here. Same overlay-suppression rule as WelcomeAfterOnboarding —
-       *  a portal-rendered Dialog at z-50 would otherwise sit above an
-       *  active pre-workspace overlay. */}
+       *  here. Suppressed while a WindowOverlay is open — a portal-rendered
+       *  Dialog at z-50 would otherwise sit above an active pre-workspace
+       *  overlay. */}
       {!overlayActive && <SourceBackfillModal />}
     </WorkspaceSlugProvider>
   );

apps/desktop/src/renderer/src/platform/session-teardown.test.ts

@@ -14,7 +14,6 @@ function makeTeardown(
     reportAuthSession: vi.fn(),
     resetTabs: vi.fn(),
     closeOverlay: vi.fn(),
-    resetWelcome: vi.fn(),
     clearDaemonToken: vi.fn(async () => {}),
     stopDaemon: vi.fn(async () => {}),
     ...overrides,
@@ -33,7 +32,6 @@ describe("tearDownOnLogout", () => {
     expect(t.reportAuthSession).toHaveBeenCalledWith(null);
     expect(t.resetTabs).toHaveBeenCalledOnce();
     expect(t.closeOverlay).toHaveBeenCalledOnce();
-    expect(t.resetWelcome).toHaveBeenCalledOnce();
     expect(t.clearDaemonToken).toHaveBeenCalledOnce();
     expect(t.stopDaemon).toHaveBeenCalledOnce();
   });
@@ -82,6 +80,5 @@ describe("tearDownOnSessionExpiry", () => {
     expect(t.reportAuthSession).toHaveBeenCalledWith(null);
     expect(t.resetTabs).toHaveBeenCalledOnce();
     expect(t.closeOverlay).toHaveBeenCalledOnce();
-    expect(t.resetWelcome).toHaveBeenCalledOnce();
   });
 });

apps/desktop/src/renderer/src/platform/session-teardown.ts

@@ -25,8 +25,6 @@ export interface SessionTeardown {
   resetTabs: () => void;
   /** Any pre-workspace overlay left open (invite, onboarding, …). */
   closeOverlay: () => void;
-  /** The one-shot post-onboarding welcome signal. */
-  resetWelcome: () => void;
   /** Credential the local daemon authenticates with. */
   clearDaemonToken: () => Promise<unknown>;
   /** The local daemon process itself. Resolves to an IPC result we ignore —
@@ -47,7 +45,6 @@ export async function tearDownOnLogout(t: SessionTeardown): Promise<void> {
   t.reportAuthSession(null);
   t.resetTabs();
   t.closeOverlay();
-  t.resetWelcome();
   try {
     await t.clearDaemonToken();
   } catch {
@@ -75,5 +72,4 @@ export function tearDownOnSessionExpiry(t: SessionTeardown): void {
   t.reportAuthSession(null);
   t.resetTabs();
   t.closeOverlay();
-  t.resetWelcome();
 }

apps/desktop/src/renderer/src/platform/tab-coordinator.ts

@@ -14,24 +14,10 @@ import {
 } from "@/stores/tab-store";
 
 /**
- * Tab Coordinator (MUL-4741 Phase 2) — the ONLY writer of the single app
- * router.
- *
- * Architecture: the tab store is the source of truth; the router is a
- * projection of the active session's URL. The Coordinator subscribes to the
- * store and *reconciles* the router to `activeSession.url`, stamping every
- * navigation with a token. All entry points (tab bar clicks, adapter
- * push/replace, shell back/forward, error recovery) mutate the store — none
- * of them touch the router. This makes invariant 1 hold by construction:
- *
- *   - Router location change WITH a pending token   → expected, consume it.
- *   - Router location change WITHOUT a pending token → protocol error →
- *     bounded recovery (re-reconcile toward the session URL, capped).
- *
- * The router's own history is never used: the Coordinator always navigates
- * with `replace`, and per-tab back/forward is a session operation over the
- * session's virtual history stack. A POP therefore can only come from
- * unforeseen code and is handled by the same protocol-error path.
+ * Project the active tab session onto the single app router. Navigation entry
+ * points mutate the store; only this coordinator writes the router, using replace
+ * and a pending token. Untokened location changes trigger bounded reconciliation.
+ * Per-tab virtual history owns back/forward; router POP is a protocol error.
  */
 
 let router: DataRouter | null = null;

apps/desktop/src/renderer/src/stores/tab-store.ts

@@ -5,17 +5,9 @@ import { createPersistStorage, defaultStorage } from "@multica/core/platform";
 import { createSafeId } from "@multica/core/utils";
 import { isReservedSlug } from "@multica/core/paths";
 
-// ---------------------------------------------------------------------------
-// Types
-// ---------------------------------------------------------------------------
-//
-// MUL-4741 Phase 2: tabs are *sessions*, not routers. A TabSession is pure
-// serializable state — URL, identity, virtual history, and a memento of
-// restorable view state. The single app router is a projection of the active
-// session, driven exclusively by the tab Coordinator (src/platform/
-// tab-coordinator.ts) which subscribes to this store and reconciles the
-// router to `activeSession.url` with a navigation token. Nothing in this
-// file touches react-router.
+// Tab sessions hold serializable URLs, identity, virtual history, and view
+// mementos. The coordinator projects the active session onto the single router;
+// this store does not operate the router.
 
 /**
  * One captured scroll position.
@@ -293,9 +285,7 @@ interface TabStore {
   reset: () => void;
 }
 
-// ---------------------------------------------------------------------------
 // Session identity helpers
-// ---------------------------------------------------------------------------
 //
 // A tab's icon is NOT part of this model. It is derived from `tab.url` at
 // render time via `routeIconForPath` (@multica/views/layout), which shares the
@@ -312,9 +302,7 @@ function extractWorkspaceSlug(path: string): string | null {
   return first;
 }
 
-// ---------------------------------------------------------------------------
 // URL helpers
-// ---------------------------------------------------------------------------
 
 /** Split a tab URL into pathname and the search+hash suffix. */
 export function splitTabUrl(url: string): { pathname: string; suffix: string } {
@@ -405,9 +393,7 @@ export function sanitizeTabPath(path: string): string | null {
   return path;
 }
 
-// ---------------------------------------------------------------------------
 // Session factory
-// ---------------------------------------------------------------------------
 
 function createId(): string {
   return createSafeId();
@@ -618,9 +604,7 @@ function normalizeBrowsingHistoryTitles(
   return result;
 }
 
-// ---------------------------------------------------------------------------
 // Group helpers
-// ---------------------------------------------------------------------------
 
 /**
  * Build a group with its MRU order reconciled against the new (tabs,
@@ -711,9 +695,7 @@ function buildCloseOtherTabsResult(
   };
 }
 
-// ---------------------------------------------------------------------------
 // Store
-// ---------------------------------------------------------------------------
 
 export const useTabStore = create<TabStore>()(
   persist(
@@ -1497,9 +1479,7 @@ function setHistoryIndex(
   });
 }
 
-// ---------------------------------------------------------------------------
 // Persisted shapes (for migration)
-// ---------------------------------------------------------------------------
 
 interface V1Tab {
   id: string;
@@ -1711,9 +1691,7 @@ export function migrateV1ToV2(v1: Partial<V1Persisted>): V2Persisted {
   return { activeWorkspaceSlug, byWorkspace };
 }
 
-// ---------------------------------------------------------------------------
 // Selectors (convenience hooks)
-// ---------------------------------------------------------------------------
 
 /**
  * Pure non-hook helper — useful from event handlers / effects that already