486 Commits

Author	SHA1	Message	Date
Naiyuan Qing	2840ebb308	feat(chat): add explicit context picker (#3735) ... * feat(chat): add explicit context picker Co-authored-by: multica-agent <github@multica.ai> * fix(chat): address context picker review Co-authored-by: multica-agent <github@multica.ai> --------- Co-authored-by: multica-agent <github@multica.ai>	2026-06-04 10:22:31 +08:00
Bohan Jiang	8c98940b79	Lark Bot integration MVP: migration + service boundary (MUL-2671) (#3277) ... * feat(db): add Lark integration migration (MUL-2671) Introduces seven tables for the 飞书 Bot integration MVP — per-agent PersonalAgent installations, user/chat bindings, inbound dedup + non-content drop audit, outbound card mapping, and short-lived single-use member binding tokens. Schema notes: - chat_session schema unchanged; Lark routes through a separate binding table rather than adding a metadata JSONB column. - Outbound card mapping is task/message scoped so multiple runs on the same session can't stomp each other's cards. - lark_inbound_audit stores routing / identity / drop_reason ONLY, never message body — the audit channel for unbound users and group messages that don't address the Bot. - app_secret stores ciphertext (encryption helper lands in a follow-up commit on this branch); DB never sees plaintext. Co-authored-by: multica-agent <github@multica.ai> * feat(util): add secretbox AES-256-GCM helper for at-rest secrets First consumer is lark_installation.app_secret (MUL-2671 §4.4), but the helper is intentionally generic — future per-tenant secrets that must not appear in a DB dump can reuse it. Construction: AES-256-GCM with a per-message random nonce, providing authenticated encryption. Tampered ciphertext fails Open instead of silently decrypting to garbage. Master key loaded from a base64 env var via LoadKey; key rotation is not in scope yet. Co-authored-by: multica-agent <github@multica.ai> * refactor(issues): extract IssueService.Create as single create entry (MUL-2671) Establishes the service-layer boundary mandated by Elon's 二审 of MUL-2671 §4.8: issue creation no longer lives inside the HTTP handler. Both the HTTP POST /issues handler and the future Lark /issue command call into service.IssueService.Create, so duplicate guard, issue numbering, attachment linking, broadcast, analytics, and agent/squad enqueue stay aligned. Handler responsibilities shrink to parsing the HTTP request, doing actor resolution / validation (transport-specific), and converting service results into the IssueResponse + 201. The transaction-wrapped core, attachment link, event publish, analytics capture, and agent/squad enqueue all move into service.IssueService.Create. A BroadcastPayload callback on the service keeps the WS broadcast shape (the full IssueResponse) without forcing the service to depend on handler-layer response types. Co-authored-by: multica-agent <github@multica.ai> * feat(integrations): add Lark package skeleton (MUL-2671) Establishes the architectural boundaries Elon's 二审 mandated as first-PR blockers without dragging in OAuth, WebSocket, or card-patching code (those land in follow-up PRs): - ChatSessionService interface — channel-aware chat-session entry point for Lark, deliberately separate from the HTTP SendChatMessage handler. The HTTP handler's single-creator guard (creator_id == request user_id) is correct for the browser client but rejects group chat_sessions by construction; Lark needs its own service. - AuditLogger interface — the only path for recording dropped events. Its signature deliberately omits message body, enforcing the drop-audit policy (MUL-2671 §4.7) at the type level: unbound users and non-addressed group messages can't accidentally end up in chat_session. - Typed IDs (OpenID, ChatID) prevent UUIDs from being conflated with Lark-side identifiers at compile time. - DropReason constants align dashboard/audit queries across callers. Co-authored-by: multica-agent <github@multica.ai> * refactor(issues): move parent/project workspace check into IssueService (MUL-2671) Parent existence and project workspace membership now live inside IssueService.Create, inside the same transaction as the duplicate guard and counter increment. The HTTP handler stops re-implementing the lookup; every future create entry (Lark /issue, MCP, API keys) inherits the same boundary without copy-pasting the SQL. Adds two error sentinels (ErrParentIssueNotFound, ErrProjectNotFound) so transports can translate to their own error shapes. Handler-level cross-workspace tests guard the boundary against future regressions. Co-authored-by: multica-agent <github@multica.ai> * fix(db): harden Lark migration safety底座 — TTL cap + workspace FK (MUL-2671) Two storage-layer hardenings that move the must-fix line off "the app layer enforces it" and onto the schema itself, so future write paths or hand-inserted rows cannot regress the invariants. 1) lark_binding_token TTL cap. The DB CHECK was 1 hour as defense-in-depth while the app constant was 15 minutes; the CHECK now matches the product cap (15 minutes). Application constant docstring updated to reflect that storage enforces the same bound. 2) lark_user_binding workspace membership. The table previously only FK'd to workspace / user / installation independently, so a binding could exist for a user no longer in the workspace, or claim a workspace different from its installation's. Two composite FKs close the gap structurally: * (installation_id, workspace_id) → lark_installation(id, workspace_id) — guarantees a binding's workspace_id always matches its installation's workspace_id. A new UNIQUE (id, workspace_id) on lark_installation is added as the FK target. * (workspace_id, multica_user_id) → member(workspace_id, user_id) with ON DELETE CASCADE — when a user is removed from the workspace, the binding cascades away in the same transaction. There is no longer a path where lark_user_binding outlives workspace membership. These two FKs are the schema-level proof for §4.3's "unbound or non-workspace members cannot leak content into chat_session" invariant. Co-authored-by: multica-agent <github@multica.ai> * feat(integrations/lark): inbound services + /issue dispatcher (MUL-2671) Lands the inbound service layer for the Lark Bot MVP, sitting on top of the migration + service-boundary scaffold from the previous commits. What ships: - sqlc queries for all seven lark_* tables (idempotent dedup insert, CAS WS-lease, single-use binding-token consume, etc.) plus GetMostRecentUserChatMessage for the /issue fallback. - AuditLogger backed by lark_inbound_audit; signature deliberately body-free so callers cannot leak content into the drop log. - ChatSessionService: find-or-create chat_session via the binding table (winner-takes-all on the UNIQUE race), append-with-dedup, /issue parser, "previous user message" fallback for bare `/issue` invocation. - Dispatcher orchestrates the inbound pipeline in one place: installation routing → group-mention filter → identity check → ensure session → append+dedup → /issue → enqueue chat task. Group sessions use the installer as creator (stable workspace identity); p2p uses the sender. Agent-offline path falls through with OutcomeAgentOffline so the WS adapter can reply with the offline notice from §4.6. - BindingTokenService: random URL-safe token, SHA-256 stored hash, 15-min TTL pinned at the application AND the DB CHECK; Redeem returns the same opaque error for all rejection cases (no timing oracle on replay). - Unit tests for the parser (13 cases), dispatcher (8 cases via fake Queries/Chat/Audit/IssueCreator/Enqueuer), and binding-token hash/entropy. Real-DB integration tests for OAuth + token redeem land alongside the HTTP handlers in the next commit. Out of scope for this commit (next ones on the same feature branch): OAuth callback, HTTP routes, WebSocket hub, outbound card patcher, frontend. Co-authored-by: multica-agent <github@multica.ai> * feat(integrations/lark): installation HTTP surface + secretbox-gated wiring (MUL-2671) Lands the HTTP boundary on top of the inbound services from the previous commit. What ships: - InstallationService.Upsert: the only path that writes lark_installation. Encrypts app_secret with the secretbox passed in at construction time; refuses to fall back to plaintext storage (returns an error from the constructor if no Box is supplied), so a misconfigured dev environment cannot accidentally land a row with cleartext credentials. Revoke flips status without DELETE so audit trail survives. - HTTP handlers under /api/workspaces/{id}/lark/: * GET /installations — member-visible (Integrations tab renders for non-admins). Soft 200 with empty list + configured:false when MULTICA_LARK_SECRET_KEY is unset, so the tab does not error on self-host that has not opted in. * POST /installations — admin-only; 503 when not configured. Re-validates agent_id ∈ workspace before accepting credentials so a cross-workspace agent UUID is rejected. * DELETE /installations/{id} — admin-only; workspace-scoped lookup so one workspace cannot revoke another's installation by UUID guess. - POST /api/lark/binding/redeem (user-scoped, no workspace context): the only path that mints a lark_user_binding row from user action. Redeemer identity comes from the session, not the token, so a stolen link cannot bind an open_id to an attacker's Multica user. The composite FK on lark_user_binding cascades the binding away if the user is not (or no longer) a workspace member, so a non-member who steals the link gets 403 at the DB layer. - Two new event-bus types in protocol.events: EventLarkInstallationCreated, EventLarkInstallationRevoked. - Router wiring: MULTICA_LARK_SECRET_KEY drives a conditional initialization of h.LarkInstallations + h.LarkBindingTokens. When unset, the integration disables itself with an INFO log and the rest of the server boots normally. - Handler tests cover all four not-configured short-circuits. Happy-path integration tests (real DB, full create→list→revoke cycle and token mint→redeem) ship alongside the WS hub PR. Co-authored-by: multica-agent <github@multica.ai> * fix(integrations/lark): close binding-token rebind & typed task errors (MUL-2671) Two must-fixes from PR review on HEAD 87ad15e1: 1. Binding-token redeem could be used to grab an already-bound Lark open_id. Two changes harden the path: - lark.sql `CreateLarkUserBinding` now gates ON CONFLICT DO UPDATE on `multica_user_id = EXCLUDED.multica_user_id`, so a cross-user rebind via a second valid token returns zero rows instead of silently switching ownership. - `BindingTokenService.RedeemAndBind` consumes the token and writes the binding row inside one transaction. A failed bind no longer burns the token; a successful bind never leaves a consumed-but- unused token. Distinct typed errors: ErrBindingTokenInvalid (410), ErrBindingAlreadyAssigned (409), ErrBindingNotWorkspaceMember (403). The handler maps each to its own status code. 2. Dispatcher collapsed every `EnqueueChatTask` error to `OutcomeAgentOffline`, hiding infra failure and misusing the "offline" label for cases (e.g. archived agent) where it doesn't fit. Now: - `service.EnqueueChatTask` returns `ErrChatTaskAgentNoRuntime` and `ErrChatTaskAgentArchived` as sentinel errors; DB / load / insert failures stay wrapped as ordinary errors. - Dispatcher uses `errors.Is` to map only the productizable cases (`OutcomeAgentOffline`, new `OutcomeAgentArchived`); any other error is returned to the WS adapter so it can retry or page instead of disguising the outage as an offline card. A daemon that's merely disconnected is still NOT an error — as long as `agent.runtime_id` is set the chat task enqueues and waits for the daemon to claim it on next online (returns `OutcomeIngested`). Co-authored-by: multica-agent <github@multica.ai> * ci: re-trigger workflow on lark MVP must-fix HEAD Co-authored-by: multica-agent <github@multica.ai> * ci: re-trigger workflow on lark MVP must-fix HEAD (retry) Co-authored-by: multica-agent <github@multica.ai> * test(integrations/lark): guard binding-token sentinel contract (MUL-2671) Two unit tests that document and protect the must-fix invariants without requiring a DB: 1. TestRedeemAndBindRequiresTxStarter — if a future refactor wires up BindingTokenService without a TxStarter, RedeemAndBind must fail fast with a clear error rather than nil-panic on Begin. The atomicity contract (consume + bind commit together) depends on that transaction existing. 2. TestBindingErrorSentinelsAreDistinct — the HTTP handler maps ErrBindingTokenInvalid → 410, ErrBindingAlreadyAssigned → 409, ErrBindingNotWorkspaceMember → 403. Accidentally aliasing them (e.g. var ErrBindingAlreadyAssigned = ErrBindingTokenInvalid) would silently regress the response codes without any other test catching it. Co-authored-by: multica-agent <github@multica.ai> * feat(integrations/lark): WS hub orchestrator + outbound card patcher (MUL-2671) The hub owns one supervisor goroutine per active installation. Each supervisor acquires the WS lease via the existing CAS query, runs an EventConnector (interface — real Lark wire protocol lands in a follow-up behind it), renews the lease on a tighter cadence than the TTL, and backs off (with jitter) on connector failure. Lease loss tears the connector down cleanly; revocation is reaped on the next sweep. Per- process node id satisfies §4.4 multi-replica safety: at most one Hub globally holds the lease for any installation. The patcher subscribes to task / chat-done events on the existing events.Bus and keeps the per-task Lark interactive card in sync (thinking → streaming → final | error). Card binding is per-task as required by §4.5; throttled patches via an in-memory last-patched map; final / error transitions bypass the throttle so the user always sees the terminal state. The Renderer is plug-replaceable so the product card template can evolve without touching transport. The APIClient interface centralizes the Lark Open Platform surface this package needs (send card, patch card, send binding prompt, exchange OAuth code). The default stubAPIClient returns ErrAPIClientNotConfigured for every transport call so a misconfigured deployment fails loudly instead of dropping cards silently. Real implementation lands in a follow-up; OAuth callback + frontend entries land in the next commits on this branch. Co-authored-by: multica-agent <github@multica.ai> * feat(integrations/lark): OAuth install start / callback (MUL-2671) OAuthService builds a signed-state Lark authorization URL the frontend can render as a QR (or open directly), then on callback verifies the HMAC-protected state, exchanges the OAuth code for installation credentials via APIClient.ExchangeOAuthCode, and persists the row via InstallationService.Upsert (which keeps app_secret encryption inside a single chokepoint). State token format: workspaceID.agentID.initiatorID.expiresUnix.nonce.sig — HMAC-SHA256 over the first five fields with a deployment-level secret. TTL defaults to 10 minutes (covered by tests). Three failure modes (invalid state / expired state / missing code) map to typed errors so the HTTP handler can emit a single lark_error= query param the frontend uses to pick copy. Both endpoints degrade cleanly: the at-rest key gate (already in place) returns 503 from /install/start when the InstallationService is nil, and the OAuth gate (MULTICA_LARK_OAUTH_APP_ID / _SECRET / _REDIRECT_URI / _STATE_SECRET) returns configured:false from /install/start so the frontend can render "configure manually instead" without an error banner. /install/callback always finishes with a redirect to /settings?tab=lark carrying either lark_installed=1 or lark_error=<code>. Tests cover signed-URL shape, missing-config rejection, tampered state, expired state, propagated exchange error, and the no-config redirect path on the HTTP handler. Co-authored-by: multica-agent <github@multica.ai> * feat(views/lark): settings tab + agent bind button + /lark/bind redemption page (MUL-2671) Adds the user-facing Lark surface across the shared packages: - packages/core/types/lark.ts — wire shapes that mirror server/internal/ handler/lark.go. Optional fields default to undefined so older desktop builds keep parsing if the server adds new keys (CLAUDE.md → API Response Compatibility). - packages/core/lark/{queries,index}.ts — Tanstack Query options keyed by workspace id; realtime sync invalidates `installations(wsId)` on `lark_installation:*` events. - packages/core/api/client.ts — listLarkInstallations, getLarkInstallURL, deleteLarkInstallation, redeemLarkBindingToken. - packages/views/settings/components/lark-tab.tsx — Settings → Lark panel. Listing is member-visible (matches backend); disconnect is admin-only. Empty state points users at the per-Agent bind entry, matching the (workspace_id, agent_id) UNIQUE: there is no "pick an agent" UI here because the bind URL is per-agent. - LarkAgentBindButton (same file) is the per-Agent CTA the Agent detail page imports. Opens the OAuth URL in a new tab; the callback bounces back to /settings?tab=lark with a query param the panel reads for inline confirmation copy. - packages/views/lark/bind-page.tsx — the Bot's "you need to bind" destination. Requires session before redeeming, distinguishes the 410/409/403 backend responses into distinct copy. - apps/web/app/lark/bind/page.tsx — Next.js route wrapping the shared bind page in a Suspense boundary (Next 15 useSearchParams rule). i18n: all user-facing strings land in en/zh-Hans, settings tab nav includes a Sparkles-iconed Lark entry, bind-page copy lives under common.lark_bind so it works pre-workspace-context too. typecheck + lint clean. Co-authored-by: multica-agent <github@multica.ai> * chore(integrations/lark): wire outbound Patcher into server bootstrap (MUL-2671) Constructs the Patcher next to the existing Installation/BindingToken wiring in router.go and Register()s it on the event bus. With the stub APIClient any actual transport call surfaces ErrAPIClientNotConfigured; once the real Lark client lands, swap NewStubAPIClient for the real implementation here without touching the Patcher's subscription logic. doc.go updated to reflect everything the package now contains (Hub, Patcher, OAuthService, APIClient interface). The Hub itself is NOT booted here yet — it needs an EventConnector implementation for the Lark long-connection wire protocol, which lands in a follow-up; the orchestrator code and its unit tests are in place so that follow-up can focus on the WS protocol rather than lifecycle plumbing. Co-authored-by: multica-agent <github@multica.ai> * fix(integrations/lark): address Elon 二审 5 must-fix items (MUL-2671) - Hub: renewer cancels run ctx on lease loss so the connector exits even if its wire I/O is blocked, keeping the §4.4 ownership invariant intact under lease theft. - Hub: EventEmitter returns (DispatchResult, error) so the real connector can post the matching Lark-side card (needs_binding, agent_offline, agent_archived) and react to infra failures instead of silently logging at the seam. - Dispatcher: top-level message_id dedup runs before group filter and identity check, so a reconnect storm cannot re-fire binding prompts or re-spam not_addressed_in_group audit rows; the in- AppendUserMessage dedup is removed since the table-level UNIQUE is the ultimate backstop. - OAuth: HandleCallback auto-binds the installer via the new InstallerBinder seam (BindingTokenService implements it), so the §2.1 "scan to bind, you're done" promise holds end-to-end. validateExchangeResult now requires installer open_id; new error reason codes wired through the callback redirect. - Frontend / handler: install_supported listing field + StartLark- Install short-circuit on stub APIClient hide install entry points (Settings tab + per-agent button) while no real Lark HTTP client is wired, so users do not land in an OAuth flow that fails at exchange. Includes tests for each fix (lease-loss cancel, emit error propagation, dedup ordering, OAuth installer-bind contract, stub- client install gate) and i18n strings for the new preview state. Co-authored-by: multica-agent <github@multica.ai> * fix(integrations/lark): two-phase dedup so infra failures do not swallow messages (MUL-2671) The pre-fix top-level dedup wrote the lark_inbound_message_dedup row before EnsureChatSession / AppendUserMessage. An infra error in either step left the row in place and a WS-adapter retry was mis-classified as a duplicate, so the user's Lark message was permanently lost without ever landing in chat_session. Make dedup two-phase: - ClaimLarkInboundDedup acquires an in-flight claim (processed_at NULL). Stale claims older than 60 s are re-takeable so a process crash does not strand the message_id. - MarkLarkInboundDedupProcessed flips processed_at on durable success (audit row OR chat_message + session touch). - ReleaseLarkInboundDedup deletes the in-flight row on infra failure before any durable side effect, so the retry can re-claim immediately. Dispatcher.Handle now finalizes the claim exactly once based on whether the inner pipeline reached a durable outcome — chat_message commit being the transition point (errors past it Mark, errors before it Release). Regression tests cover the two failure variants Elon flagged plus the inverse invariants (durable-error Marks, drops Mark, in-flight replays drop, stale claims re-claim). Co-authored-by: multica-agent <github@multica.ai> * fix(integrations/lark): owner-fence dedup claim to close the double-write windows (MUL-2671) The two-phase Claim/Mark/Release fix from the previous commit closed the "infra error swallows a replay" gap but left two windows that could still write a chat_message twice for the same Lark message_id: 1. Stale-reclaim race. Worker A claims at t=0, runs slowly past the 60 s staleness TTL but is still alive. Worker B sees the row as stale and re-takes the claim. A reaches AppendUserMessage and commits a second chat_message. 2. Mark window. Worker A commits chat_message but the post-pipeline MarkLarkInboundDedupProcessed fails (DB hiccup) or the process crashes before it runs. 60 s later a retry treats the in-flight row as stale, re-claims it, and writes a second chat_message. Close both with owner fencing + same-tx Mark: - lark_inbound_message_dedup now carries a `claim_token` UUID; ClaimLarkInboundDedup mints a fresh one on insert and on stale re-take, so a reclaim ROTATES the token. - MarkLarkInboundDedupProcessed and ReleaseLarkInboundDedup are fenced on (message_id, claim_token, processed_at IS NULL) and return rowsAffected. Zero means our token is no longer live, and the caller treats it as a no-op (not an error). - AppendUserMessage invokes MarkLarkInboundDedupProcessed INSIDE its chat_message+session tx (qtx). If the token has been rotated by a concurrent reclaim, the Mark matches zero rows and the method returns ErrClaimLost; the deferred Rollback unwinds the chat_message insert, so the other holder is the sole writer. The durable write and the Mark therefore commit (or roll back) atomically — there is no "committed but not yet Marked" window for a crash or retry to exploit. Dispatcher.processClaimed now returns a tri-state dedupFinalize directive (none / mark / release): finalizeNone for the in-tx Mark path (and ErrClaimLost), finalizeMark for audit-drop branches and the defensive post-Append-success fallback, finalizeRelease for pre-durable infra errors. ErrClaimLost is translated into OutcomeDropped + DropReason- Duplicate at the Handle boundary, matching what the WS adapter expects for a "another worker is the writer" outcome. Regression tests: - TestDispatcher_StaleReclaimRaceDoesNotDoubleWrite injects worker B's reclaim via a beforeAppend hook so the claim_token rotates between Claim and AppendUserMessage. Asserts worker A's AppendUserMessage returns ErrClaimLost (no chat_message committed), the dispatcher surfaces a duplicate drop, the token rotated to a value distinct from A's original, and a follow-up replay still duplicate-drops. - TestDispatcher_InTxMarkPreventsPostCommitReclaim verifies the "Mark window" case is unreachable: a successful in-tx Mark produces exactly one Mark call (no post-finalize duplicate), the row is terminal, and a retry with dedupReclaim=true still duplicate-drops without re-rotating the token. - TestDispatcher_InTxMarkSucceedsAndSkipsPostFinalize pins the positive contract: DedupMarked=true must make applyFinalize a no-op (no extra Mark, no Release). fakeQueries gains a fakeDedupRow model carrying (processed, token, rotations) so the test seam matches production's UPDATE-with-WHERE semantics; fakeChat gains a beforeAppend hook to inject race timing. go test ./... and go vet ./... pass. Co-authored-by: multica-agent <github@multica.ai> * feat(integrations/lark): real Lark HTTP APIClient for IM v1 send/patch (MUL-2671) Lands the production Lark Open Platform HTTP APIClient that replaces the stub for outbound transport. The patcher's "thinking → streaming → final | error" card lifecycle and the dispatcher's binding-prompt card both now reach Lark for real once MULTICA_LARK_HTTP_ENABLED=true. Scope of this stage: - tenant_access_token retrieval via /open-apis/auth/v3/ tenant_access_token/internal, cached in-process per app_id with a 60s safety margin against Lark's `expire` value. Sub-2-minute expires are clamped to 120s so we never cache an entry that's already past its safe window. - SendInteractiveCard: POST /open-apis/im/v1/messages?receive_id_type=chat_id returning the Lark message_id the Patcher persists in lark_outbound_card_message for later patches. - PatchInteractiveCard: PATCH /open-apis/im/v1/messages/:id with the full re-rendered card body (Lark's update endpoint replaces, not deep-merges). - SendBindingPromptCard: open_id-targeted interactive card with a primary "去绑定" CTA pointing at the redemption URL. Template is co-located with the transport so the dispatcher never has to know about Lark's card schema. - Token-error invalidation: Lark codes 99991663 (expired) / 99991664 (invalid) drop the cached token so the next call refreshes from /tenant_access_token/internal instead of looping on a stale entry. Out of scope (deferred to follow-up stages): - ExchangeOAuthCode stays unimplemented behind ErrAPIClientNotConfigured. The PersonalAgent install handshake's response shape (returning per-installation app credentials in a single call) is not yet verified against the production endpoint, and a silent mis-fill of OAuthExchangeResult would corrupt lark_installation rows past validateExchangeResult. Operators continue to use the manual-paste InstallationService path until the OAuth stage lands. - Inbound WS EventConnector — Hub's ConnectorFactory still needs a real wire-protocol implementation. Wiring: - MULTICA_LARK_HTTP_ENABLED=true switches router.go from the stub to the real client. MULTICA_LARK_HTTP_BASE_URL overrides the default open.feishu.cn host (set to open.larksuite.com for the Lark international tenant, or to an httptest URL for integration tests). - The OAuth handler now also receives the real client (its ExchangeOAuthCode still surfaces ErrAPIClientNotConfigured, so callback behavior is unchanged until that stage lands). Tests (19 new cases against an httptest.Server fake): - happy path send/patch/binding-prompt round trips, asserting URL query params, body shape, Authorization header - token cache: 3 sends share one /tenant_access_token/internal hit - token refresh after clock-driven expiry - sub-margin expire clamping (10s expire → cached for >= safety margin of wall-clock) - Lark error code surfacing (230001 send, 230002 patch, 10003 auth) - token-expired (99991663) invalidates the cache; caller's retry re-fetches and succeeds - non-2xx HTTP status surfaces "http 500: …" - input validation: missing chat_id short-circuits BEFORE auth round-trip, missing card json / open_id / bind url all fail pre-flight without hitting Lark - ExchangeOAuthCode still returns ErrAPIClientNotConfigured - binding-prompt template carries the BindURL and the localized "去绑定" CTA in valid JSON go build ./..., go vet ./..., and go test ./internal/integrations/lark/... pass. Pre-existing handler/router integration tests that require a real Postgres connection are unaffected by this change. Co-authored-by: multica-agent <github@multica.ai> * fix(integrations/lark): split outbound vs OAuth-install capability + card update_multi (MUL-2671) Address Elon's two must-fix items from the HEAD a09993b1 review: 1. HTTP outbound and OAuth-install are now distinct APIClient capabilities. The new SupportsOAuthInstall() reports whether the install flow can succeed end-to-end (i.e. ExchangeOAuthCode is implemented); the real httpAPIClient still returns IsConfigured() = true (send / patch / binding prompt work) but SupportsOAuthInstall() = false until the PersonalAgent install-time response shape is pinned. Handler-side `install_supported` and StartLarkInstall now gate on SupportsOAuthInstall, so a half-wired client never reveals the scan-to-bind UI. larkOAuthErrorReason also maps ErrAPIClientNotConfigured to a dedicated `oauth_exchange_unimplemented` reason so a raw callback hit no longer masquerades as `internal_error`. 2. defaultRenderer now emits config.update_multi=true on every Kind. Lark refuses to apply PatchInteractiveCard to a card whose initial config doesn't declare it shared/updatable, so the absent flag would make every patch after the first send silently no-op on the wire while the local outbound status row still flipped to streaming/final. Tests cover both halves of each fix: - TestHTTPClient_SupportsOAuthInstall_FalseUntilExchangeLands + TestHTTPClient_StubReportsBothCapabilitiesFalse pin the new capability surface. - TestStartLarkInstall_TransportOnlyClientReportsNotConfigured + TestListLarkInstallations_TransportOnlyClientReportsInstallNotSupported pin the handler gate at exactly the half-wired state. - TestLarkOAuthErrorReason_APIClientNotConfigured pins the mapping for both the bare sentinel and the fmt.Errorf-wrapped form HandleCallback produces. - TestDefaultRendererConfigCarriesUpdateMulti covers every CardKind. - TestHTTPClient_(Send|Patch)InteractiveCard_DefaultRendererBodyHasUpdateMulti verify the wire body Lark actually receives carries update_multi through both send and patch transport paths. Co-authored-by: multica-agent <github@multica.ai> * feat(integrations/lark): real OAuth code exchange + agent-detail bind entry (MUL-2671) Stages the install side of the MVP critical path on top of the real HTTP outbound work: - httpAPIClient.ExchangeOAuthCode runs the production Lark v2 OAuth flow: POST /authen/v2/oauth/token to swap the authorization code for the installer's open_id, then GET /bot/v3/info under the parent app's tenant_access_token to fetch bot_open_id. Result feeds InstallationParams unchanged so OAuthService.HandleCallback's auto-bind step lights up automatically. - HTTPClientConfig gains OAuthAppID/OAuthAppSecret, read from the same MULTICA_LARK_OAUTH_APP_ID/_APP_SECRET env vars the OAuthConfig consumes. SupportsOAuthInstall now mirrors that pair so the install capability gate is honest: outbound transport without OAuth creds reports configured-but-not-install-supported, exactly like before. - Agent detail inspector wires the LarkAgentBindButton in a new Integrations section, viewer-hidden by canEdit. The button still self-hides when SupportsOAuthInstall is false, so a deployment without OAuth creds renders the section empty rather than CTA-broken. - Capability wording cleaned across handler / router / lark-tab to say "OAuth-install capability" instead of "real APIClient wired", and the misleading TransportOnly... test was renamed/refocused on the early-return branch it actually exercises (Elon non-blocking note). Co-authored-by: multica-agent <github@multica.ai> * fix(integrations/lark): identity-only OAuth + atomic bind (MUL-2671) Addresses Elon's round-4 must-fix items on PR #3277: 1. OAuth v2 token → user_info chain now matches Lark's official user-OAuth shape. `httpAPIClient.ExchangeOAuthCode` POSTs /open-apis/authen/v2/oauth/token (RFC 6749: top-level access_token, NO open_id), then GETs /open-apis/authen/v1/user_info with the user_access_token as Bearer to obtain the installer's open_id / union_id. The test fixture now reflects the real wire shape (separate user_info handler; no synthetic open_id in the token response). 2. `OAuthExchangeResult` is identity-only — drops the synthesized shared-parent AppID / AppSecret / BotOpenID return that broke the UNIQUE(app_id) constraint and the dispatcher's per-app_id routing. `OAuthService.HandleCallback` no longer Upserts an installation row: it looks up the lark_installation already provisioned via the manual-paste POST /lark/installations route and binds the installer onto it. Two new typed errors — ErrInstallationNotProvisioned and ErrInstallationRevoked — map to `installation_not_provisioned` / `installation_revoked` reasons at the HTTP boundary so the UI can guide the admin. The PersonalAgent install API (which would deliver per-installation bot credentials at scan time) remains a follow-up; until it lands the OAuth flow is identity-binding only and the agent-detail bind button stays hidden on deployments without OAuth env (capability gate unchanged). 3. The installation lookup + installer bind run inside a single DB transaction so a concurrent revoke / re-provision between the read and the binding insert cannot leak a half-applied state. `InstallerBinder.BindInstaller` is renamed to `BindInstallerTx` and accepts the OAuth-service-owned transaction's qtx; the binding_token redemption path is unchanged. 4. `validateExchangeResult` is simplified to require only the installer's open_id; the obsolete ErrExchangeMissingAppID / AppSecret / BotOpenID sentinels are removed (no caller can trip them now). The oauth_test suite is rewritten to use a stub failTxStarter so tests covering state-token verification and exchange-error propagation remain DB-free, while a new TestOAuthCallbackOpensTxAfterValidExchange pins the post-must-fix order (state ok + exchange ok ⇒ Begin runs before any lookup or bind, and a Begin failure aborts cleanly with no bind). Verified locally: - go build ./... / go vet ./... clean - go test ./internal/integrations/lark/... ✓ - go test ./internal/handler -run 'Lark|Binding|OAuth' ✓ - go test ./internal/util/secretbox/... ./internal/service/... ✓ Co-authored-by: multica-agent <github@multica.ai> * feat(integrations/lark): device-flow scan-to-install (MUL-2671) Replaces the manual paste-credentials install path + identity-only OAuth callback (rejected in product review: too many steps before a user sees value) with a true single-step scan-to-install built on Lark's RFC 8628 device-flow registration endpoint (POST accounts.feishu.cn/oauth/v1/app/registration) — the same protocol the official larksuite/oapi-sdk-go/scene/registration package and zarazhangrui/feishu-claude-code-bridge use. User journey: admin clicks "Bind to Lark" on the Agent detail page → QR dialog opens → admin scans in the Lark app on their phone → authorizes the new PersonalAgent → dialog auto-closes with the new installation visible. No app_id / app_secret to copy, no Lark developer console visit, no Multica-side OAuth env to configure. Backend (server/internal/integrations/lark): - registration.go — inline ~280-line RFC 8628 client. Begin posts archetype=PersonalAgent / auth_method=client_secret / request_user_info=open_id; Poll follows the upstream SDK's state machine including the tenant-brand mid-stream domain swap to accounts.larksuite.com when a Lark-international account authorizes. SDK is NOT vendored — one endpoint isn't worth dragging the full oapi-sdk-go + transitive deps. - registration_service.go — owns the in-process session store + background polling goroutine. On success calls APIClient.GetBotInfo (the new IM-side endpoint added below) and writes lark_installation + the installer's lark_user_binding inside one DB transaction so a half-applied install can never land. Stable error_reason codes (expired / access_denied / lark_protocol_error / bot_info_failed / installation_conflict / installer_bind_failed / internal_error) drive the UI copy without parsing prose. - client.go / http_client.go — drops ExchangeOAuthCode and SupportsOAuthInstall (no longer applicable: device-flow returns identity alongside credentials in one response); adds GetBotInfo which mints a tenant_access_token from the freshly-minted client_id / client_secret and calls /open-apis/bot/v3/info for the bot_open_id. install_supported now gates on IsConfigured() (real HTTP client wired) instead of a separate OAuth capability. - binding_token.go — absorbs InstallerBindParams / InstallerBinder (previously in oauth.go), retargets the doc-comment from the OAuth caller to the device-flow caller. - Deletes oauth.go + oauth_test.go entirely. Handler & router (server/internal/handler, server/cmd/server): - POST /api/workspaces/{id}/lark/install/begin — opens a new registration session, returns {session_id, qr_code_url, expires_in_seconds, poll_interval_seconds}. Admin-only. - GET /api/workspaces/{id}/lark/install/{sessionId}/status — polling endpoint, returns {status, installation_id?, error_reason?, error_message?}. Workspace-scoped lookup so a stolen session_id cannot be polled from another workspace. Admin-only. - Removes POST /lark/installations (paste form), GET /lark/install/start (OAuth-redirect entry), and GET /api/lark/install/callback (OAuth redirect target). - Removes MULTICA_LARK_OAUTH_APP_ID / _APP_SECRET / _REDIRECT_URI / _STATE_SECRET / _AUTHORIZE_URL / _SUCCESS_URL env vars. Self-host operators no longer need a parent Lark app at all. Frontend (packages/core, packages/views): - New types BeginLarkInstallResponse / LarkInstallStatusResponse + matching API methods (beginLarkInstall / getLarkInstallStatus); drops getLarkInstallURL. - LarkAgentBindButton opens LarkInstallDialog instead of a window.open() to Lark's authorize page. The dialog uses react-qr-code (catalog) to render the verification_uri_complete inline as SVG (no external CDN image), polls status at the server-supplied cadence, auto-closes on success, offers "scan again" on terminal failure. Per CLAUDE.md "Enum drift downgrades, not crashes", error_reason switch has a default fallback so an older desktop build on a newer server still renders the generic failure copy. - Adds the device-flow strings to en + zh-Hans settings.json; removes the obsolete OAuth-not-configured copy. Verified locally: - go build ./... / go vet ./... clean - go test ./internal/integrations/lark/... — all green (existing tests + 15 new registration / GetBotInfo tests) - go test ./internal/handler -run 'Lark|Binding' — all green - pnpm typecheck — all 6 packages clean - pnpm lint — 0 errors (15 pre-existing warnings, none in changed files) - pnpm --filter @multica/views test — 859/859 pass Pre-existing failures in server/internal/middleware (column "profile_description" missing from local test DB) reproduce against the parent commit and are unrelated to this change. Co-authored-by: multica-agent <github@multica.ai> * fix(integrations/lark): gate bind CTA to workspace admins, terminate QR polling on 4xx (MUL-2671) Two frontend must-fixes from the PR #3277 二审: 1. LarkAgentBindButton now self-hides for non-admin viewers in addition to the existing install_supported check. The agent-detail page mounts the button under `canEdit`, which canEditAgent lets agent owners through even when they are not workspace admins — but the backend gates POST /lark/install/begin and the status poll on owner/admin (router.go:478-487), so the previous behavior shipped a CTA that was guaranteed to 403. The new gate reads workspace role from the same member list the settings tab already uses. 2. The status polling loop now terminates on 404 (session gone — server restarted, multi-instance routing, or in-process GC swept it) and 403/401 (permission revoked mid-session). Previously every error path scheduled another setTimeout, which trapped the user on a stale QR forever. ApiError gives us the HTTP status verbatim; terminal responses set status=error with stable error_reason codes (session_lost, forbidden) that flow through the existing dialog switch + retry/close affordances. 5xx + network blips still retry. i18n: new install_error_session_lost / install_error_forbidden in en and zh-Hans, with default fallback preserved per the enum-drift rule. Coverage: 6 new vitest cases — admin/owner allow, member deny, unsupported-install deny, and the two terminal-error polling paths using fake timers to assert the loop stops scheduling. Also clears a handful of stale OAuth/manual-install doc comments flagged in the review (non-blocker cleanup): doc.go's §10 now points at RegistrationService, installation.go's input-shape doc loses the OAuth-callback half, and client.go's stubAPIClient comments no longer reference OAuth callbacks. Co-authored-by: multica-agent <github@multica.ai> * docs(integrations/lark): describe gate as device-flow install in agent-detail integrations comment (MUL-2671) The comment block above the agent-detail Integrations section still described the capability gate as 'server-side OAuth-install'. The OAuth path is gone — install is now device-flow per RFC 8628 — so the comment now reads 'server-side device-flow install capability gate'. Pure comment change; behavior is unchanged. Cleans up the nit Elon called out in PR #3277 二审 (MUL-2671). Co-authored-by: multica-agent <github@multica.ai> * feat(integrations/lark): wire inbound pipeline + WS Hub at boot (MUL-2671) Stage 3.a of MUL-2671. Hub class, Dispatcher, ChatSessionService and AuditLogger have all been implemented and tested in prior PRs but none of them was constructed at boot, so the in-process plumbing was never exercised end-to-end. This change wires them together behind the same `MULTICA_LARK_SECRET_KEY` gate that already gates InstallationService / RegistrationService, and starts the Hub under the existing `sweepCtx` so it winds down alongside the other long-running workers after HTTP drain. The real long-conn EventConnector is still pending; the factory hands every supervisor a shared NoopConnector that holds the lease and emits nothing. That lets staging exercise the lease / supervisor / shutdown lifecycle against real DB rows without committing to the Lark wire protocol implementation. Swapping in the real connector is a single line change in the same router block; the Dispatcher / ChatSessionService / Hub seams stay frozen. ## Why a noop placeholder, not a stub-or-skip The Hub's value is mostly its lifecycle: §4.4 ownership lease, LeaseRenewInterval / LeaseTTL, supervisor reap on revoke, clean release on shutdown. None of that runs unless the Hub is actually started. Holding off until the real connector lands means the next PR has to debut both pieces simultaneously; wiring the supervisor loop first lets the real connector PR be a focused, reviewable swap. ## Changes - `internal/integrations/lark/noop_connector.go` — `NoopConnector` implementing `EventConnector`: blocks on ctx until the Hub cancels (lease loss / shutdown / revoke), emits no events, logs on enter/exit so operators see exactly which installation the supervisor is holding the lease for. - `internal/integrations/lark/noop_connector_test.go` — verifies the connector blocks until ctx cancel, returns nil on clean exit, never invokes the emit callback, and the factory shares a single connector instance across installations. - `internal/handler/handler.go` — new `LarkHub *lark.Hub` field on `Handler`. Nil when the Lark integration is disabled. - `cmd/server/router.go` — inside the existing Lark wiring block, construct `AuditLogger`, `ChatSessionService` (with `*pgxpool.Pool` for the in-tx dedup Mark), `Dispatcher` (wiring `h.IssueService` and `h.TaskService` so `/issue`-created issues share counter / duplicate guard / project boundary / broadcast / analytics with the rest of the product), and the `Hub` with the `NoopConnectorFactory`. `NewRouterWithOptions` now returns `(chi.Router, *handler.Handler)` so main.go can drive Hub lifecycle; `NewRouter` discards the handler. - `cmd/server/main.go` — start the Hub under `sweepCtx` after the other background workers, and `Wait` on it after HTTP drain + sweep cancel so the lease renewer can issue a final release before exit. Skipped entirely when `h.LarkHub == nil`. ## Test plan - [x] `go build ./...` clean - [x] `go vet ./...` clean - [x] `go test ./internal/integrations/lark/...` (new noop tests + existing hub / dispatcher / chat_service / registration / binding_token / outbound / issue_command suites) — all pass - [x] `go test ./internal/handler -run 'TestLark|TestRedeemLarkBinding'` pass — handler-side Lark surfaces unchanged - [x] `go test ./internal/service/... ./internal/util/secretbox/...` pass - [x] `pnpm --filter @multica/views exec vitest run settings/components/lark-tab` pass (6/6) — frontend lark surfaces unchanged - [ ] Local broad `go test ./internal/handler/...` still blocked by the pre-existing test DB schema drift Elon flagged in the previous round (`column "metadata" does not exist`, unrelated to this change); CI is the authoritative check. - [ ] Manual end-to-end deferred until the real long-conn EventConnector lands (next stage). MUL-2671 Co-authored-by: multica-agent <github@multica.ai> * fix(integrations/lark): bound Hub lease release + shutdown wait (MUL-2671) Lease release used context.Background(); a stalled DB pool could pin shutdown indefinitely. Add LeaseReleaseTimeout (5s default) and ShutdownTimeout (15s default) to HubConfig, route releaseLease through a bounded context, and expose WaitWithTimeout for main.go so a wedged supervisor degrades to LeaseTTL expiry on the next replica instead of blocking process exit. Also correct the LarkHub field comment in handler.go: the Hub is wired whenever the at-rest secret key is set, independent of whether the outbound HTTP APIClient is configured. Co-authored-by: multica-agent <github@multica.ai> * feat(integrations/lark): real WS long-conn connector + ctx-cancel-breaks-read (MUL-2671) Replaces NoopConnectorFactory with a production EventConnector that opens Lark's event-subscription WebSocket. Gated behind MULTICA_LARK_WS_ENABLED so staging boots stay on the noop path until operators opt in, and falls back to noop with a warning when the WS flag is set without MULTICA_LARK_HTTP_ENABLED (the real connector needs the cached tenant_access_token). Why this connector exists separately from the Hub: gorilla/websocket ReadMessage blocks on the underlying TCP socket and does not observe context. The watchdog goroutine inside WSLongConnConnector.Run closes the conn the moment ctx fires, so lease loss / shutdown breaks the blocking read in bounded time — exactly the invariant Hub renewLeaseUntil's runCancel depends on for the "at most one active WS per installation across replicas" guarantee. Tests cover this explicitly (TestWSConnectorRunReturnsOnCtxCancelEvenWhenReadIsBlocked). The Lark wire surface is split into three swappable seams so the transport layer stays tested in isolation: - EndpointFetcher (POST /event-subscription/v1/connection_token) resolves a one-shot wss URL per Run. No caching — replaying a one-shot token would look like a Lark outage. - FrameDecoder turns one raw JSON envelope into an InboundMessage or a "control / heartbeat / drop" verdict. Decoder errors log + drop the frame; they do NOT tear down the connection. - CredentialsProvider wraps InstallationService.DecryptAppSecret so plaintext app_secret lives in memory only during a Run. Also fixes the handler.go LarkHub comment: it still said "joins on Wait during graceful shutdown" but main.go has used WaitWithTimeout (bounded wait) for several commits. Comment now matches. Co-authored-by: multica-agent <github@multica.ai> * feat(integrations/lark): align WS to official binary Frame protocol + DispatchResult outbound replies (MUL-2671) Two must-fix items from Elon's review of PR #3277: 1. WS protocol layer rewritten to match the official Lark Go SDK (`larksuite/oapi-sdk-go/v3/ws`): - Bootstrap is `POST /callback/ws/endpoint` with AppID/AppSecret in the body (no tenant_access_token bearer). Response carries wss URL + ClientConfig (PingInterval / ReconnectInterval / ReconnectNonce / ReconnectCount). - `service_id` is parsed from the wss URL query and used as Frame.Service on every outbound frame. - Wire envelope is the binary protobuf `pbbp2.Frame` (hand-rolled via protowire to avoid pulling the whole SDK in, byte-identical field tags). JSON payloads are nested inside Frame.Payload. - Inbound data frames are ACKed with a `Response{code:200,...}` JSON payload that reuses the inbound headers; infra failures produce code=500 so Lark retries. - Ping is the app-layer binary `NewPingFrame(serviceID)` at the server-supplied cadence; WebSocket protocol PING is removed (Lark ignores it). Server-initiated pings get a pong reply. - ctx-cancel-breaks-read invariant preserved via the watchdog goroutine that closes the conn on ctx.Done; the read loop and ping goroutine serialize their writes through a single mutex. 2. `DispatchResult` outbound replies wired via a new `OutcomeReplier`: - `OutcomeNeedsBinding` mints a one-shot binding token and sends the binding prompt card to the sender's open_id. - `OutcomeAgentOffline` / `OutcomeAgentArchived` push a notice card into the chat with the agent name + Chinese copy matching §4.6. - `OutcomeIngested` stays owned by the Patcher; `OutcomeDropped` is silent. - The replier is best-effort: outbound failures are logged and swallowed so a Lark outage cannot stall the inbound pipeline. - Hub installs the noop replier by default; router wires the production `LarkOutcomeReplier` when APIClient.IsConfigured(). PersonalAgent long-conn risk surfaced (open per Feishu docs: `长连接模式仅支持企业自建应用`). The implementation works for any app archetype; the open question is whether `/callback/ws/endpoint` accepts PersonalAgent credentials in practice. Surfacing the Lark code+msg verbatim from the bootstrap response so an operator running the smoke test sees the exact failure rather than a generic timeout. Co-authored-by: multica-agent <github@multica.ai> * fix(integrations/lark): byte-compat Frame marshal, chunk reassembly, ACK off reply critical path (MUL-2671) Three protocol blockers from Elon's review of 9540008a: 1. Frame.Marshal is now byte-identical to oapi-sdk-go/v3/ws/pbbp2.Frame: - SeqID/LogID/Service/Method (proto2 req) emit unconditionally even at zero - PayloadEncoding/PayloadType/LogIDNew emit unconditionally per gogo generated MarshalToSizedBuffer (no zero-guard) - Payload uses the SDK's `!= nil` guard (nil omits, []byte{} emits 0-length) - ACK payload JSON matches SDK's NewResponseByCode + json.Marshal output ({"code":N,"headers":null,"data":null}) Golden tests pin exact byte sequences for ping/pong/ACK/full/zero frames; verified against the real SDK pbbp2.pb.go MarshalToSizedBuffer producing identical bytes. 2. Multi-frame events (sum>1) are reassembled via the new chunkAssembler: - 5s sliding TTL (matches SDK combine() cache TTL) - Lazy GC on admit (no separate sweeper goroutine) - Out-of-order seq + duplicate seq idempotent - Partial chunks are NOT ACKed (SDK behaviour: only the final chunk's ACK confirms the whole event so Lark can retry on partial loss) - Connector wires assembler per-Run; state dies with the session 3. OutcomeReplier detached from ACK critical path: - HubConfig.ReplyTimeout default 2.5s, strictly under Lark's 3s ACK deadline - handleEvent dispatches synchronously (fast DB path), then spawns the replier under a fresh background ctx with WithTimeout(ReplyTimeout) - Hub.replyWg tracks in-flight replies; Hub.Wait / WaitWithTimeout drain them so shutdown is bounded - Noop replier short-circuits inline (no goroutine cost when outbound APIClient isn't configured) Proof tests: - TestHubScheduleReplyReturnsImmediately: scheduleReply with a 10s slow replier returns in <50ms - TestHubReplyTimeoutCancelsHungReplier: hung replier ctx fires at ReplyTimeout - TestHubWaitDrainsInFlightReplies: Wait blocks until replies finish - TestHubACKNotBlockedByOutboundReply: end-to-end through the connector — data-frame ACK lands within 500ms even when the replier hangs 5s PersonalAgent real-env smoke remains Bohan's decision; this PR closes the technical blockers Elon flagged. Co-authored-by: multica-agent <github@multica.ai> * docs(service/issue): narrow position concurrency claim to create-create (MUL-2671) Elon's review of the merge resolution flagged that the comment on the new NextTopPosition call promised more than the code guarantees: concurrent manual reorder via UpdateIssue(position) does NOT take the workspace row lock that IncrementIssueCounter holds, so a create racing a reorder can still land on the same position. Rewrite the comment to only claim create-create serialization, which is the behaviour the lock actually delivers. No code change. Co-authored-by: multica-agent <github@multica.ai> * fix(integrations/lark): keep device-flow polling on RFC 8628 HTTP 400 (MUL-2671) Lark's device-flow polling endpoint returns HTTP 400 with the JSON body `{"error":"authorization_pending"}` while the user hasn't scanned the QR yet — this is the RFC 8628 spec, and the upstream oapi-sdk-go implements the same handling. Our previous doForm treated ANY non-2xx as a terminal protocol error, so every install session was killed by the first poll (~5s after begin) and the install dialog appeared silently empty: the frontend received status=error + lark_protocol_error before the user could even read the description. Fix: doForm now decodes the JSON body first; if it parses, the caller (Begin / Poll) routes on the body's `error` field, where the existing switch correctly maps authorization_pending / slow_down to "keep polling" and access_denied / expired_token to terminal failure. Only unparseable bodies (5xx HTML proxy pages, gateway timeouts) still surface as a typed http_NNN RegistrationError. Three regression tests pin the new behaviour: - HTTP 400 + authorization_pending → res.Status="authorization_pending" - HTTP 400 + access_denied → res.Err.Code="access_denied" (terminal) - HTTP 502 + HTML body → http_502 RegistrationError Verified against the live local env: install/begin -> 200, status stays "pending" through the first poll cycle, no longer flips to "error" within seconds. Co-authored-by: multica-agent <github@multica.ai> * fix(views/lark): reset closedRef on every mount so StrictMode double-mount renders QR (MUL-2671) Empty QR dialog body in the dev env: Bohan opened the bind dialog and got an empty white area where the QR should have been — no QR, no "starting" placeholder, no error text. Backend was returning the QR URL correctly; the bug was on the frontend. Root cause: React 19 / Next.js dev StrictMode mounts every component twice (mount → cleanup → mount). The component instance is REUSED across the simulated remount, which means useRef objects are preserved. The dialog's `closedRef` lifecycle: 1. Mount #1: closedRef={current:false}, beginSession() kicked off (HTTP request still in flight) 2. Cleanup runs: closedRef.current=true 3. Mount #2: beginSession() kicked off again, BUT the ref still reads {current:true} from step 2 4. Both promises resolve. Both hit the post-await guard `if (closedRef.current) return;` and bail out before setSession(). 5. Result: session stays null forever. Every conditional in the dialog body (beginning/session-pending/success/error) is false → empty body. Fix: reset closedRef.current=false at the START of the effect, not just at component construction. The cleanup-then-mount pair now re-arms the guard so subsequent setSession calls actually land. Regression test wraps the dialog in <StrictMode> and asserts the QR appears within 2s with the correct value — fails closed if anyone removes the reset. Co-authored-by: multica-agent <github@multica.ai> * fix(integrations/lark): drop EventTaskCompleted subscription so the chat reply doesn't get overwritten by "Done." (MUL-2671) Bohan reproduced on the live dev env: agent replies show only a card saying "Done." in Lark, even though Multica's own chat panel has the real "Hello! I'm cc…" reply. Tasks succeed end-to-end, but the user loses the reply on the Lark side. Root cause: TaskService.CompleteTask publishes two events for every chat task IN ORDER: 1. broadcastChatDone(...) → ChatDonePayload{Content: "Hello!..."} 2. broadcastTaskEvent(Completed) → map[string]any{task_id, agent_id,...} (no `content` key) The Patcher subscribed to BOTH and routed each to finalize(). The first patch correctly rendered the reply text, the second patched the same card with an empty payload — chatDoneContent() returned "" and the renderer fell back to "Done." (default empty-body copy). The second patch wins because Lark stores whatever was last applied. Fix: stop subscribing to EventTaskCompleted in the Patcher and remove the corresponding switch arm. EventChatDone is the canonical "agent finished replying" signal for the Lark card path; EventTaskCompleted is still emitted to the bus for other listeners (web UI, analytics, task usage) where the lack of content doesn't matter. Regression test TestPatcherIgnoresEventTaskCompletedForChatTasks emits ChatDone followed by TaskCompleted on a streaming card and asserts: exactly one patch, body contains the agent reply, body does NOT contain "Done.". If anyone re-adds the EventTaskCompleted subscription, this fails immediately. Co-authored-by: multica-agent <github@multica.ai> * feat(integrations/lark): chat replies as plain text IM messages, not card chrome (MUL-2671) Bohan reported on the live dev env that even with the agent's reply shown correctly, every message is wrapped in an interactive card with the agent name as the header — it feels like a system notification, not a normal chat reply. He wants the reply to land as a regular Lark text bubble. Changes: - Add APIClient.SendTextMessage backed by Lark's /open-apis/im/v1/messages with msg_type=text. JSON-encodes the {"text": ...} envelope Lark requires so callers pass raw strings. - Patcher.Register no longer subscribes to EventTaskQueued / EventTaskRunning. There is no more thinking → running → final card lifecycle on the success path: it added card chrome without buying anything for free-form chat. - On EventChatDone, the new sendChatReply path posts the assistant message content as plain text. Empty content is silently dropped rather than rendered as "Done." (the prior fallback that confused Bohan). - Failure path keeps a one-shot error card on EventTaskFailed — the visual distinction from a normal reply is genuinely useful, and failures are rare enough that the chrome isn't noisy. - Throttle / lastPatched map / MinPatchInterval / shouldPatch / markPatched / loadCardOrSkip are all removed; nothing in the new flow patches. Tests: - TestPatcherSendsPlainTextOnChatDone pins the new contract: exactly one SendTextMessage call, no card sends or patches, content matches the ChatDonePayload. - TestPatcherDropsEmptyChatReply pins the "no more Done. fallback" decision — empty content drops, period. - TestPatcherFailEventSendsErrorCard pins the failure path still uses a card (one-shot, no patching). - TestPatcherIgnoresEventTaskCompletedForChatTasks rewritten for text path: ChatDone then TaskCompleted yields exactly one text send, no duplicate. - TestPatcherSkipsWhenNoChatSessionBinding and TestPatcherSwallowsInstallationLoadErrors rewritten to drive EventChatDone (the new entry point) instead of TaskQueued. - TestPatcherSendsThinkingCardOnTaskQueued deleted (no more thinking card). Co-authored-by: multica-agent <github@multica.ai> * feat(integrations/lark): pre-fill PersonalAgent bot name as "<agent> - Multica" (MUL-2823) (#3520) The device-flow install left the bot at Lark's auto-generated "{用户姓名}的智能助手". Lark's registration scene supports pre-filling the name via a `name` query param on the verification/QR URL (mirrors the upstream SDK's AppPreset.Name) — a user-editable default that rides on the QR URL, not the begin POST body (which has no name field). BeginInstall already loads the agent for its ownership check, so we keep it and thread `<agent.Name> - Multica` through Begin → decorateQRCodeURL. A blank name degrades to plain "Multica". There is no post-install rename API (bot/v3 is read-only; no bot/v3/update), so the install-time pre-fill is the only programmatic lever; the user can still edit the name on the creation form. Co-authored-by: J <j@multica.ai> Co-authored-by: multica-agent <github@multica.ai> * fix(integrations/lark): restore /issue confirmation + pin SendTextMessage wire (MUL-2671) Two recovered/added contracts off Trump's review of HEAD fe381a07: 1) /issue confirmation in Lark was a casualty of the plain-text refactor. The pre-refactor `RenderInput.IssueNumber` field was declared but never actually rendered into the card body, so even in the original card-based flow the user never saw a "Created [MUL-42]" confirmation. Now the OutcomeReplier handles OutcomeIngested + IssueID.Valid by sending a plain text message: Created MUL-42 — fix login bug https://multica.example/issues/MUL-42 Composed from a new DispatchResult.IssueIdentifier + IssueTitle, populated by the Dispatcher from workspace.IssuePrefix + issue.Number / issue.Title. Workspace lookup is best-effort: a Postgres blip on workspace gets a "#42" fallback rather than silently dropping the confirmation. The agent's own chat reply (if any) continues to land separately via the Patcher on EventChatDone — these are two semantically distinct messages and the user benefits from seeing both. 2) SendTextMessage is the wire layer Trump flagged for missing coverage. Three new wire tests pin: - happy path: POST /open-apis/im/v1/messages?receive_id_type=chat_id, msg_type=text, Bearer <tenant_access_token>, double-JSON content envelope - special-character round trip: newlines, double quotes, backslashes, tabs, Chinese + emoji, JSON-lookalike strings. The inner {"text": ...} is encoded once at JSON.Marshal time and once again when the outer body serializes; losing either pass corrupts the message and the bug is invisible without a contract pin. - Lark error path: non-zero `code` surfaces as a wrapped error with the code embedded. Tests: - TestDispatcher_IssueCreationFromCommand asserts IssueIdentifier ("MUL-42") and IssueTitle propagate through DispatchResult. - TestDispatcher_IssueIdentifierFallsBackToNumberOnWorkspaceLookupErr pins the "#7" degrade-graceful fallback. - TestLarkOutcomeReplierIssueCreatedSendsConfirmation pins the text body (identifier + title + deep link) and asserts no card send on this path. - TestLarkOutcomeReplierOutcomeIngestedSilentWithoutIssue pins the silent-on-plain-chat default so we don't accidentally start emitting a confirmation for every message. - TestHTTPClient_SendTextMessage_* covers the wire contract. Frontend locale parity (en + zh-Hans, 53 tests) is currently green on this HEAD; no changes needed. Co-authored-by: multica-agent <github@multica.ai> * fix(views/locales): add missing ko keys for Lark MVP (MUL-2671) Trump flagged on PR #3277 review that the ko bundle was missing the Lark-MVP-only keys that en + zh-Hans both carry. The parity test caught it cleanly after main was merged in (Korean PR landed on main between the prior review and this one): common.lark_bind.* (13 keys) settings.page.tabs.lark (1 key) settings.lark.* (45 keys) agents.inspector.section_integrations (1 key) Korean translations are professional/concise — "Lark" stays as the brand name (matches how en keeps "Lark" + "(飞书)" parenthetically; ko/users searching for the product expect "Lark"), and product copy follows the zh-Hans tone where Multica nouns ("에이전트", "워크스페이스") are romanized loan words consistent with the rest of the ko bundle. Slot ordering preserved against EN: - page.tabs.lark sits between github and integrations - inspector.section_integrations sits right after section_skills Verified: pnpm exec vitest run locales/parity → 105/105 pass. Co-authored-by: multica-agent <github@multica.ai> * fix(integrations/lark): /issue origin_type CHECK + Hub restart on credentials rotation (MUL-2671) Two live-env bugs Bohan reproduced: 1) /issue command crashed the WS connector. Dispatcher writes origin_type='lark_chat' on issues born from `/issue`, but the issue_origin_type_check CHECK constraint was last extended in migration 060 for quick_create — it doesn't list lark_chat, so every Lark /issue tripped SQLSTATE 23514 and bubbled up as an infra error. The infra error tore down the WS connector, Lark retried the same message, the new connector tripped the same constraint and crashed again. Repro in the live env: three crashes from the same /issue event over ~40s, each leaving the user with no confirmation in Lark. Migration 111 extends the CHECK list: CHECK (origin_type IN ('autopilot', 'quick_create', 'lark_chat')) 2) Re-scanning an already-bound agent silenced the bot. The device flow re-registers with Lark, which mints a brand-new bot (fresh app_id + app_secret); RegistrationService.finishSuccess upserts into lark_installation by agent_id, so the row's credentials rotate in place. But the running supervisor held the OLD inst struct by value and kept a WS open against the OLD bot's app_id — so all events to the NEW bot went nowhere. Bohan's "claude code 现在不能在飞书里回复了" symptom maps exactly to this: log timeline: 16:29:57 cc connector connected with app_id=cli_aa9398dd... (OLD) 16:34:07 lark registration: install complete (rotation) → row.app_id is now cli_aa93f36f... (NEW) → old WS still subscribed to OLD app_id; new app_id receives nothing Fix: Hub.sweep now compares each installation row's credentials fingerprint (app_id + bot_open_id + sha256(app_secret_encrypted)) against the snapshot the running supervisor was started with. On diff, cancel the old supervisor and start a fresh one inline. A monotonic gen counter on the supervisor entry disambiguates the old goroutine's deferred cleanup from the new entry the rotation path already swapped in. Tests: - TestHubRestartsSupervisorOnCredentialsRotation pins the new path: starts hub on app_one, rotates the row to app_two, asserts the connector factory is called again with the fresh AppID. - TestHubDoesNotRestartSupervisorOnUnchangedRow pins the negative case so an unchanged row doesn't degenerate into a per-sweep busy-loop. - Existing hub tests (lease, supervise, shutdown, ACK timing, noop replier) all green. Verification: - go test ./internal/integrations/lark/... -race -count=1 ok - go build ./... clean - migration applied locally; \d+ issue confirms lark_chat in CHECK Co-authored-by: multica-agent <github@multica.ai> * fix(integrations/lark): per-supervisor lease token to fence rotation handoff (MUL-2671) Elon flagged a race in HEAD be8d4cef's rotation path: both the old and the new supervisors of the same Hub used the hub-wide nodeID as their WS lease token, so an old supervisor's post-cancel releaseLease(nodeID) would CAS-match the lease row the successor had just acquired with the SAME token and DELETE it. Symptom would be a silently empty lease row a few hundred ms after every device-flow re-scan — no replica owning the install, no events delivered, the "bot goes quiet" pattern Bohan hit the first time but now from the fencing side rather than the credentials side. Fix: leaseToken(nodeID, gen) composes "<nodeID>-g<gen>", where gen is the monotonic counter already attached to each supervisorEntry. The nodeID prefix keeps cross-replica observability (an operator inspecting lark_installation.ws_lease_token can still map back to a process) while the -g suffix makes the OLD supervisor's release target the OLD row state. Once the rotation path swaps in the new supervisor, the row's CurrentToken is the new -g(N+1) token, so the old -gN release's WHERE clause no-ops instead of clobbering. acquireLease / renewLeaseUntil / releaseLease now take an explicit token argument; supervise threads its leaseToken through. The plumbing isn't pretty, but having an explicit argument at every call site is the only way the rotation invariant survives subsequent refactors — without it, a future caller could quietly reintroduce "just use h.nodeID" and the race is back. Two regression tests: - TestHubRotationStaleReleaseDoesNotClearSuccessorLease drives the fake lease state machine directly: 1. old acquires(tokenA) 2. rotation lands; new acquires(tokenB) 3. old's stale release(tokenA) fires Asserts owner ends up still tokenB. Hub-wide-nodeID code would fail step 3 by clearing the entry. - TestHubRotationEndToEndKeepsSuccessorLeased runs the same scenario through the live supervise loop: starts hub, rotates the row, waits for sup2 to take over with a distinct token, sleeps past sup1's unwind, asserts the row is still held by a non-sup1 token. Catches the bug even when the goroutine timing is non-deterministic. Verification: go test ./internal/integrations/lark/... -race -count=1 ok go build ./... clean go vet ./... clean Co-authored-by: multica-agent <github@multica.ai> * fix(integrations/lark): route group @-mentions via union_id, not open_id (MUL-2671) In a Lark group with multiple Multica bots installed, the bot whose WS received the event sometimes failed to recognize that it was the @-target while the OTHER bot's supervisor falsely fired. Bohan's controlled three- message test (only @A, only @B, @both) hit this: @A and @B alone went unanswered, @both got picked up by A only. Root cause: the `mentions[].id.open_id` field Lark puts on the WS event is structurally INVERSE to `/bot/v3/info`'s `bot.open_id` across the two WSes. From A's WS perspective, the wire-form open_id for "A was @-ed" is NOT equal to A's API-side open_id, but IS equal to what B's WS sees on its side, and vice versa. The decoder's `mention.open_id == inst.BotOpenID` match therefore fires on the wrong bot in multi-bot groups. Only `union_id` (the Lark-tenant-scoped stable identifier) is consistent across both WSes. Changes: - migration 112 adds nullable `lark_installation.bot_union_id` - sqlc query exposes UpsertLarkInstallation/CreateLarkInstallation with bot_union_id, plus a focused SetLarkInstallationBotUnionID for the backfill path - httpAPIClient.GetBotInfo now follows /bot/v3/info with /contact/v3/ users/{open_id}?user_id_type=open_id and returns both identifiers on BotInfo. Soft-fails on contact-scope denial: install still succeeds with an empty UnionID, and the decoder falls back to the legacy open_id match for single-bot deployments. - RegistrationService.finishSuccess persists union_id alongside open_id during the device-flow finalize. - ws_frame_decoder.containsMention prefers union_id and only walks open_id when the installation row has not been backfilled yet. - BackfillBotUnionIDs runs once at server boot for installations created before migration 112; bounded per-row 10s timeout and a pure soft-fail policy so a slow Lark round-trip cannot block startup. - regression tests cover the three decoder paths: union_id match wins over open_id mismatch, union_id mismatch overrides open_id match, and open_id fallback when union_id is unknown. Co-authored-by: multica-agent <github@multica.ai> * chore: drop trailing blank lines at EOF on four files (MUL-2671) git diff --check origin/main..origin/pr-3277 flagged these as new blank lines at EOF; clearing so the diff stays clean for review. Co-authored-by: multica-agent <github@multica.ai> * fix(views/locales): add missing ja keys for Lark MVP + section_integrations (MUL-2671) CI frontend job tripped on the ja locale parity check: ja is missing the lark_bind block in common.json, the lark block + page.tabs.lark in settings.json, and inspector.section_integrations in agents.json. The ko fix earlier covered Korean; ja was added separately on main and the merge surfaced these gaps. Translations mirror the en source and follow the same voice as the existing ja bundle. Co-authored-by: multica-agent <github@multica.ai> * fix(integrations/lark): rewrite @_user_N placeholders into clean body (MUL-2671) When Lark dispatches a group `im.message.receive_v1`, the message text contains opaque `@_user_1`, `@_user_2`, … placeholders and the real identity is in `mentions[]`. We were forwarding the raw text to the agent, so a Bohan-typed "@Bot ping test" arrived as "@_user_1 ping test" — neither human-readable nor useful as LLM context, and the agent was paying tokens to figure out which `@_user_N` was even itself. The new resolveMentions pass: * strips the bot's own mention entirely (the dispatcher already routes the event on AddressedToBot; re-emitting @<self> in front of every message adds zero signal and pollutes context), * substitutes other participants with `@<displayName>` so a follow-up "@Alice" reads naturally, * collapses horizontal whitespace introduced by the strip while preserving original newlines. Bot identity check uses the same union_id-preferred + open_id fallback as containsMention, so the rewrite stays consistent with the routing path. Tests cover the four shapes: bot self-mention, mixed bot + other-user mention, multi-line body with stripped mention, and a no-mention body that should be left untouched. Co-authored-by: multica-agent <github@multica.ai> * fix(integrations/lark): union_id-first self mention strip + token-aware scan + local whitespace cleanup (MUL-2671) Three review blockers on the mention rewrite from PR review: 1. isBotMention now mirrors containsMention's union_id-first policy. When the installation row knows our union_id, we trust it exclusively (open_id is structurally inverted in multi-bot groups — matching on it would re-introduce the routing bug we fixed two commits ago). open_id fallback fires only when union_id is absent. New tests: @-ing both bots in one message correctly strips only self and renders the sibling as @<name>; open_id-matches-but-union_id-differs does NOT strip. 2. resolveMentions no longer collapses or trims whitespace globally. Indentation, tabs, code blocks, tables — all preserved verbatim. When the self mention is removed we eat exactly one adjacent horizontal space (the one after the placeholder, or, when the mention sits at end-of-input, a single space already emitted right before it). New test exercises a multi-line indented + tabbed body and asserts the whole shape survives. 3. Prefix-collision-safe replacement. A chat with 11+ participants exposes both `@_user_1` and `@_user_10`; naive ReplaceAll for `@_user_1` would mangle the substring of `@_user_10`. The resolver now does a single-pass token scan with the mention list sorted longest-key-first, so the longer placeholder always wins at any scan position. New test covers the @_user_1 / @_user_10 case explicitly. Also drops the temporary INFO-level diag logging the previous commit added — root cause was confirmed (union_id swap in the manual backfill; not a decoder bug). Co-authored-by: multica-agent <github@multica.ai> * fix(integrations/lark): scope inbound dedup per (installation_id, message_id) (MUL-2671) Root cause of the residual "@Cc gets dropped as not_addressed_in_group" even after the union_id swap landed: lark_inbound_message_dedup was keyed on `message_id` alone. In a Lark group chat where the workspace has multiple Multica bots installed, Lark delivers the SAME message_id to every bot's WS supervisor. Whichever WS claimed first then ran its own AddressedToBot check; the bot that was actually @-ed lost the dedup race, found the row already terminal (`processed_at IS NOT NULL`), and was dropped as `duplicate` BEFORE it could evaluate its own mention. Net: every @ silently disappeared if Lark happened to route the OTHER bot's WS first. The dedup gate's original purpose (idempotency against WS reconnect replay) is per-installation by definition, so the right key is composite (installation_id, message_id). Changes: - migration 113 drops + recreates lark_inbound_message_dedup with installation_id NOT NULL REFERENCES lark_installation(id) ON DELETE CASCADE and PRIMARY KEY (installation_id, message_id). The table is a 24h transient cache, so dropping existing rows is safe. - sqlc queries: ClaimLarkInboundDedup / MarkLarkInboundDedupProcessed / ReleaseLarkInboundDedup all now take installation_id. - AppendUserMessageParams carries InstallationID through to the in-tx Mark call so the chat_message+dedup atomicity stays intact. - Dispatcher passes inst.ID to claim + applyFinalize + AppendUserMessage. - Test fakes key dedup state on (installation_id, message_id) via a composite map key; all existing pre-seeded rows use a seedDedupKey helper bound to the default activeInstallation fixture so the prior staleness / token-rotation / in-tx mark tests still exercise the same regression they did before. - New regression TestDispatcher_DedupIsScopedPerInstallation pins the multi-bot invariant: a row pre-seeded for installation A does NOT block installation B's first delivery of the same message_id; B runs through its own group-filter / identity / ingest pipeline. Co-authored-by: multica-agent <github@multica.ai> * feat(integrations/lark): render markdown chat replies via schema-2.0 card (MUL-2671) The agent's chat replies were going out as msg_type=text, so every `**bold**`, fenced code block, list, table, and link in the body showed up as literal markdown characters in Lark — the user saw raw asterisks, hashes, pipes instead of formatted text. Bohan reported this and pointed at zarazhangrui/lark-coding-agent-bridge as the shape to emulate. The bridge repo uses Lark interactive cards with the schema-2.0 envelope and a `tag: "markdown"` body element; Lark's client renders that to formatted text (GFM-ish: bold/italic, headings, lists, links, fenced code blocks, tables, blockquotes). They expose multiple reply modes (card / markdown-as-post / text) gated by user config; we go a step simpler — auto-detect markdown syntax in the agent's body and route accordingly: - containsMarkdown(): cheap substring + regex pass for fenced code blocks, headings, list markers, bold/italic, tables, links, blockquotes, horizontal rules, inline code. Biases toward false- positive — wrapping prose in a card still renders fine, but missing a real markdown block leaves raw characters visible. - APIClient gains SendMarkdownCard / SendMarkdownCardParams. Implementation marshals the schema-2.0 envelope verbatim: {schema:"2.0", body:{elements:[{tag:"markdown", content: md}]}}. Stub returns ErrAPIClientNotConfigured. - Patcher.sendChatReply now branches on containsMarkdown: markdown → SendMarkdownCard, plain prose → SendTextMessage. A one-liner "sure, on it" stays as a normal IM bubble (no card chrome); anything with markdown gets the rendered card. Tests: TestContainsMarkdown pins the heuristic across plain prose and ten markdown shapes; TestPatcherRoutesMarkdownReplyToCard and TestPatcherRoutesPlainReplyToText cover the router; new HTTP wire test TestHTTPClient_SendMarkdownCard_HappyPath contract-pins the card envelope (msg_type=interactive, schema 2.0, markdown tag, verbatim body). Full lark suite passes. Co-authored-by: multica-agent <github@multica.ai> * fix(service/issue): route analytics.IssueCreated through obsmetrics.RecordEvent (MUL-2671) CI's TestNoNakedAnalyticsCaptureInHandlersOrServices guard caught the post-merge analytics call in IssueService.captureCreatedAnalytics that still used s.Analytics.Capture(...) directly. Main added that lint to prevent the Prometheus and PostHog sides from drifting — any new analytics.* event must go through obsmetrics.RecordEvent so the business-metrics collector and the PostHog client fire from the same call site. Fix mirrors how TaskService handles it: IssueService gains a Metrics *obsmetrics.BusinessMetrics field (router wires it via h.IssueService.Metrics = opts.BusinessMetrics next to the existing TaskService line), and the in-service Capture call becomes obsmetrics.RecordEvent(s.Analytics, s.Metrics, ...). nil-safe by construction — RecordEvent treats a nil Metrics as PostHog-only. Co-authored-by: multica-agent <github@multica.ai> * feat(views/lark): swap Bind CTA for Connected+Manage link when agent already has an installation (MUL-2671) Bohan reported the agent-detail Bind button keeps inviting the user to re-scan the QR even when the agent already has an active Lark PersonalAgent connected — and re-scanning silently upserts the installation row, leaving the previously-created Lark bot dangling as a zombie. Frustrating UX and an actual product footgun. Anti-zombie guard at the only entry point: LarkAgentBindButton now checks the cached installations listing for an active row pinned to this agent_id. When one exists, the install CTA is gone — replaced by a small Connected pill + an "Manage in Lark" link that opens the Bot's app page in Lark's developer console (open.feishu.cn/app/<app_id>) in a new tab. That's where scopes, display name, and additional permission requests actually live; re-scanning never was the right answer for managing an existing bot. Scoping is per-agent: an active installation on a DIFFERENT agent in the same workspace doesn't affect this agent's button, and a revoked installation falls back to the bind CTA so the user can re-create. Tests cover all four states (own-active / own-revoked / other-agent-active / no-installation) and pin the Manage link's href + target=_blank + noopener. i18n: three new keys in settings.json (en / zh-Hans / ja / ko): agent_bot_connected_label, agent_bot_manage_link, agent_bot_manage_tooltip. Locale parity test still 157/157. The dev console host is hardcoded to open.feishu.cn — operators on the Lark international tenant currently get the wrong host; future-proof fix wants the backend to surface a per-installation dev_console_url on the listings response, called out in a code comment. Co-authored-by: multica-agent <github@multica.ai> * feat(views/settings): collapse Lark into Integrations + render agent identity (MUL-2671) Lark was its own top-level workspace settings tab while Integrations sat empty next to it. As more integrations land, the sidebar would balloon with one tab per provider. Move the Lark surface into Integrations as the first hosted integration; the old ?tab=lark URL redirects through LEGACY_WORKSPACE_TAB_REDIRECTS so bookmarks still resolve. The Connected bots list was leaking the raw Lark app_id (cli_…) as the row title with bot_open_id (ou_…) underneath — meaningless to product users. Since the binding is 1:1 with a Multica Agent, join on agent_id and render the agent's avatar + name via the workspace-standard ActorAvatar + useActorName.getAgentName. Deleted agents fall back to "Unknown Agent" so the row is still actionable for cleanup. Tests: stub useActorName + ActorAvatar in lark-tab.test.tsx and add LarkTab connected-bot tests covering the agent identity render and the deleted-agent fallback. Drop the now-dead integrations.* + page.tabs.lark + lark.bot_open_id_label keys across all four locales — parity still 157/157, views suite 1141/1141. Co-authored-by: multica-agent <github@multica.ai> * feat(views/settings): wrap Lark in a named section inside Integrations (MUL-2671) Integrations is meant to host multiple providers (Slack, Linear etc. as they land), so the Lark content should sit under a Lark heading rather than fill the tab directly — otherwise the first additional integration would feel like it broke the IA. Add a "Lark" / "飞书" section heading above LarkTab using the same h2 chrome the other settings tabs use, and pin lark.section_title across all four locales (parity 169/169). Co-authored-by: multica-agent <github@multica.ai> --------- Co-authored-by: multica-agent <github@multica.ai> Co-authored-by: J <j@multica.ai>	2026-06-03 19:12:14 +08:00
Bohan Jiang	5900d8b637	fix(issues): make start_date/due_date timezone-stable calendar days (#3618) (#3692) ... * fix(issues): store start_date/due_date as DATE, not timestamp (MUL-2925) These fields are calendar days (the pickers offer no time-of-day), but were stored as TIMESTAMPTZ. A client serializing local midnight via toISOString() folded its timezone into the instant, so the day shifted by the local offset (GH #3618). Migrate the columns to DATE and parse/serialize date-only "YYYY-MM-DD". ParseCalendarDate still accepts legacy RFC3339 (truncated to the UTC day) so older clients keep working. Co-authored-by: multica-agent <github@multica.ai> * fix(issues): render start_date/due_date as timezone-stable calendar days (MUL-2925) Pickers now emit date-only "YYYY-MM-DD" (local calendar day) instead of toISOString(), and every read formats via the shared @multica/core/issues/date helpers with timeZone:"UTC" so the day never shifts with the viewer's offset. The Gantt's existing UTC bucketing is now correct. Covers web/desktop pickers, quick-set menu, list/board/detail/activity, and the mobile due-date picker. Co-authored-by: multica-agent <github@multica.ai> * fix(issues): address date-only review — loud-fail ambiguous dates, finish display sweep (MUL-2925) Review follow-ups on #3692: - ParseCalendarDate no longer silently truncates a legacy non-midnight RFC3339 to the wrong UTC day; it accepts only YYYY-MM-DD or an exact UTC-midnight instant and rejects ambiguous ones loudly. Adds util unit tests. - migration 112 pins the TIMESTAMPTZ->DATE conversion to UTC explicitly via AT TIME ZONE 'UTC' (was session-timezone dependent); down migration too. - Convert remaining date-change display sites to formatDateOnly: inbox detail label (web) and mobile activity + inbox labels (were new Date()+local format). - CLI --start-date/--due-date help now says YYYY-MM-DD, not RFC3339. Co-authored-by: multica-agent <github@multica.ai> --------- Co-authored-by: J <j@multica.ai> Co-authored-by: multica-agent <github@multica.ai>	2026-06-03 14:34:01 +08:00
Naiyuan Qing	f2f17e3355	Optimize chat message loading (#3685) ... * Optimize chat message loading Co-authored-by: multica-agent <github@multica.ai> * Fix chat history cursor pagination Co-authored-by: multica-agent <github@multica.ai> * Fix chat session list remount key Co-authored-by: multica-agent <github@multica.ai> * fix(chat): fall back to legacy /messages when paged endpoint 404s Deployment-order compatibility: a backend deployed before the /messages/page endpoint existed returns 404 for the unknown route. The cursorless initial page now falls back to the legacy full-list /messages endpoint and wraps it in a single has_more:false page, so chat never white-screens regardless of which side deploys first. A 404 on a cursor request still propagates to avoid duplicating the full list. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: multica-agent <github@multica.ai> --------- Co-authored-by: multica-agent <github@multica.ai> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-03 13:47:30 +08:00
Jiayuan Zhang	f539fdba83	feat(onboarding): backfill prompt for missing source attribution (MUL-2796) (#3550) ... * feat(onboarding): backfill prompt for users missing source attribution Adds a one-shot popup shown after login to already-onboarded users whose `onboarding_questionnaire.source` was never recorded — either they completed onboarding before the source step shipped, or they clicked Skip on it. Reuses the existing 12-option StepSource UI and the existing `PATCH /api/me/onboarding` endpoint, so no schema or backend changes. Web renders it as a route at /onboarding/source (sibling of the reserved /onboarding); desktop dispatches it as a WindowOverlay per the Route categories rule. Submit and explicit Skip are terminal; the close X bumps a per-user localStorage counter and stops appearing after 3 dismissals. Emits source_backfill_shown / submitted / skipped / dismissed PostHog events so the funnel can be tracked separately from first-time onboarding. For MUL-2796. Co-authored-by: multica-agent <github@multica.ai> * fix(onboarding): preserve role/use_case and respect dismiss cap in source backfill Round-2 fixes from Emacs's review of #3550: 1. PATCH wipe: `PATCH /api/me/onboarding` replaces the JSONB column wholesale (server/internal/handler/onboarding.go), so sending only the source slots was wiping role/use_case/version for exactly the historical users this targets. Read user.onboarding_questionnaire, overlay the source fields client-side via mergedQuestionnairePatch, and send the full shape. 7 unit cases cover the merge semantics. 2. Legacy single-string source: pre-multi-select rows wrote `source: "search"` as a bare string. needsSourceBackfill now treats that as already answered, matching mergeQuestionnaire (views) and stringOrSlice.UnmarshalJSON (server). Flipped the existing test and added empty-string + null coverage. 3. Dismiss cap honored in callback: the web auth callback was passing dismissCount=0, which would force-route capped users through /onboarding/source on every login (the route page would bounce them onward, but only after a blank detour and a re-fired `source_backfill_shown` event). Added readSourceBackfillDismissCount so the callback reads the same per-user localStorage bucket the prompt writes to. Test asserts a count of 3 bypasses the detour. Co-authored-by: multica-agent <github@multica.ai> * test(onboarding): clear source-backfill dismiss counter in callback test beforeEach Co-authored-by: multica-agent <github@multica.ai> * fix(onboarding): footer hint text matches the Submit button on the backfill prompt The Source step's hint reads "Hit Continue when you're ready" because its commit button is "Continue". The backfill view ships a "Submit" button instead, so the inherited hint was misleading. Add a dedicated `source_backfill.hint_ready` key across en / zh / ko and use it here. Caught during browser E2E in the round-2 verification stack. Co-authored-by: multica-agent <github@multica.ai> * fix(onboarding): magic-code login also detours through source backfill The round-2 fix in PR #3550 only wired the source-backfill detour into the OAuth `/auth/callback` post-success path. Magic-code login goes through `/login` → `handleSuccess()` which calls `resolveLoggedInDestination()` and pushes directly to the workspace, so those users never reach `/onboarding/source`. Caught during the local-env demo for Jiayuan. Add `maybeSourceBackfillDetour` to the login page and apply it in both the already-authenticated useEffect and the post-verify-code handler. Predicate consults the same per-user localStorage bucket the prompt writes to, so a user who hit the close-X cap on this browser flows straight through. Co-authored-by: multica-agent <github@multica.ai> * refactor(onboarding): source backfill is a workspace-mounted modal, not a route detour Per UAT, the prompt should overlay the workspace as a Dialog with the workspace visible behind a dimmed backdrop — the original brief and reference screenshot both showed a modal. PR #3550 shipped a full-window takeover (web /onboarding/source + desktop WindowOverlay) which Jiayuan rejected. This commit replaces the full-window view with a Dialog-based `<SourceBackfillModal />` mounted once inside the shared `DashboardLayout` (packages/views/layout). The modal self-mounts: it reads `needsSourceBackfill(user, dismissCount)` and opens itself when the predicate flips to true; X / ESC / outside-click all bump the per-user localStorage cap and close. Removed: - apps/web/app/(auth)/onboarding/source/page.tsx (route) - paths.sourceBackfill (no longer needed) - callback page detour - login page maybeSourceBackfillDetour - desktop WindowOverlay type "source-backfill" - desktop navigation interception of /onboarding/source - desktop App.tsx dispatch effect - pageview-tracker case - views/onboarding `SourceBackfillView` + `readSourceBackfillDismissCount` exports Preserved (semantics unchanged): - `needsSourceBackfill` predicate (incl. legacy single-string source coercion) - `mergedQuestionnairePatch` so role / use_case survive Submit / Skip - PostHog events: source_backfill_shown / submitted / skipped / dismissed - Per-user dismiss-count cap (3) in localStorage - en / zh / ko i18n strings Tests: - 7 new tests for the modal in packages/views/onboarding/source-backfill-modal.test.tsx - Adjusted apps/web/app/auth/callback/page.test.tsx: detour tests dropped, one assertion remains that onboarded users with missing source land in the workspace (the modal handles the rest) - Full suite: 965 tests pass, typecheck + lint clean Co-authored-by: multica-agent <github@multica.ai> * fix(onboarding): mount source-backfill modal on the desktop workspace too Desktop's WorkspaceRouteLayout never wraps DashboardLayout, so the previous commit's modal mount only fired for web. Regression: desktop users were not seeing the prompt at all. Wire the same `<SourceBackfillModal />` next to `<WelcomeAfterOnboarding />` inside `workspace-route-layout.tsx`, with the matching `!overlayActive` suppression so the Dialog doesn't portal-jump above an active pre-workspace WindowOverlay (onboarding / accept-invite / new-workspace). Same component on both platforms — single source of truth lives in packages/views/onboarding/source-backfill-modal.tsx. Also drop the now-stale `source-backfill detour` comment in the web callback test fixture (Emacs nit, non-blocking). Co-authored-by: multica-agent <github@multica.ai> * test(desktop): assert workspace-route-layout mounts source-backfill modal Two structural tests pinning the round-4 fix: - `mounts SourceBackfillModal when no WindowOverlay is active` — guards against the regression Emacs caught (modal silently absent on desktop because the previous round only wired DashboardLayout). - `suppresses SourceBackfillModal while a WindowOverlay is active` — mirrors the existing `!overlayActive` rule that WelcomeAfterOnboarding already relies on so a portal-rendered Dialog can't visually outrank an active pre-workspace overlay. Mocks the SourceBackfillModal with a marker component so the test asserts mount/unmount without depending on the modal's own predicate gate. Co-authored-by: multica-agent <github@multica.ai> * fix(onboarding): backfill modal Other toggles off; entrance settles after 700ms UAT round-3 follow-ups from Jiayuan: 1. **Other can't be deselected**: the modal kept a parallel `pendingOther` flag set to true on every Other click, and `IconOtherOptionCard`'s row click was guarded with `if (!selected) onSelect()` — so a second click neither flipped pendingOther nor reached the parent toggle. Drop `pendingOther` (the `source.includes("other")` derivation is already authoritative) AND add an opt-in `allowToggleOff` prop to `IconOtherOptionCard` that lets the row toggle when already selected. The text input stops click propagation so typing never deselects. 2. **Rebase + absorb GitHub channel**: rebased onto origin/main which added `social_github` (PR #3612). Modal's option list now mirrors StepSource — GitHub slotted between YouTube and Other social, reusing the existing `GitHubIcon`. 3. **Soft entrance**: defer the dialog open by 700ms after the user lands on a workspace so the underlying view paints first and the modal feels like an inviting prompt rather than a hard block. Honour `prefers-reduced-motion: reduce` (open immediately for users who have opted out of incidental motion). Tests: - New `Other toggles off on the second click instead of getting stuck` - New `renders the GitHub channel rebased from origin/main` - New `defers the entrance by ~700ms when the user has not opted into reduced motion` - Existing tests stamp `prefers-reduced-motion: reduce` in beforeEach so the dialog opens synchronously and they don't need to drive fake timers. Full suite passes (969 tests). Co-authored-by: multica-agent <github@multica.ai> * fix(onboarding): backfill modal opens reliably + Other deselects via icon area Three follow-up fixes after live UAT: 1. Strict-mode regression on entrance delay: the gate ref was being stamped when the effect *scheduled* the timer, so React Strict Mode's double-invoke cleared the first timer and then bailed on the second pass because the ref was already set, leaving the dialog forever closed. Stamp the ref only inside the timer callback (or synchronously when reduced-motion is on) so the second strict pass starts a fresh timer. 2. Other deselect: dropping `pendingOther` wasn't enough — the input that replaces the label when Other is selected was previously stopping click propagation, so a re-click on the row never reached the toggle. Remove `e.stopPropagation()` and instead let the row's onClick ignore clicks whose target IS the input (typing / focusing the input still doesn't deselect; clicks on the icon, padding, or border do). 3. Tests: drive the Other re-click via Playwright `click({position: {x:24,y:24}})` so the click lands on the icon area instead of the center of the input, matching real-user behaviour. Co-authored-by: multica-agent <github@multica.ai> * refactor(onboarding): source picker is single-select primary source Per Jiayuan's call after the survey of HDYHAU UX in PLG SaaS (Linear / Vercel / Loom / Notion / Webflow / Stripe / Figma / Cursor / PostHog mostly skip the question entirely; where it's asked the documented default — Fairing / Recast / HockeyStack / Ruler Analytics — is to capture the primary source so channel weights sum to 100% and ROI math is defensible). Modal + StepSource both pivot from multi-select to single-select radio. Server schema is intentionally untouched: `source` stays `string[]` for back-compat with v2 multi-select rows; the client always sends a one-element array. Zero migration, zero data loss. Frontend: - `source-backfill-modal.tsx`: state pivots from a multi-element `source: Source[]` to a single `pickedSlug` derived from `source[0]`; click handler replaces the array instead of toggling. Cards switch to `mode="radio"`, the fieldset gets `role="radiogroup"`, the now-redundant `pendingOther` and `allowToggleOff` opt-in go away — radio mode means no toggle-off, so the original UAT bug ("Other can't be deselected") is structurally impossible. - `step-source.tsx`: drop the `multiSelect` prop so it routes through `step-question.tsx`'s existing radio path (same one StepRole already uses). Picking a second option replaces the first; switching away from Other clears `source_other` so a stale value can't leak. - `icon-option-card.tsx`: revert the `allowToggleOff` plumbing. Tests: - `source-backfill-modal.test.tsx`: drop the multi-select toggle-off assertion; add "picking a second option replaces the first" with explicit radio-role queries. - `step-source.test.tsx`: rewrite multi-select tests as single-select (no more "stacks several picks" / "toggle off" cases); add "switching away from Other clears source_other". Full suite (970 tests) green, typecheck + lint clean. Co-authored-by: multica-agent <github@multica.ai> * docs(onboarding): refresh stale multi-select comments around source Comment-only follow-up to the single-select refactor in d14f9d09f. Five docblocks still described `source` as multi-select; they now correctly say single-select and explain the array shape is kept purely for v2 back-compat with the JSONB column. - packages/core/onboarding/types.ts — QuestionnaireAnswers docblock - packages/core/onboarding/store.ts — PostHog mirror comment - packages/views/onboarding/steps/step-question.tsx — header docblock, canContinue branch, and footer-hint comment (Source moves from the multi-select side to the single-select side; Use case stays as the remaining multi-select consumer) - server/internal/handler/onboarding.go — questionnaireAnswers docblock and the stringOrSlice fall-back comment (the column "going multi- select" is no longer the current state; rename to "pre-array shape") - server/internal/analytics/events.go — OnboardingQuestionnaireSubmitted docblock No behaviour changes. Tests + Go build still green. Co-authored-by: multica-agent <github@multica.ai> * i18n(onboarding): add ja translations for source-backfill keys The Japanese locale landed on main (PR #3538) after this branch started, so my source-backfill round-2 keys (`common.close`, `source_backfill.eyebrow / lede / submit / hint_ready`) never made it into ja and the parity test fails in CI. Add them now with translations that match the en/zh-Hans/ko wording and tone. Co-authored-by: multica-agent <github@multica.ai> --------- Co-authored-by: Lambda <lambda@multica.ai> Co-authored-by: multica-agent <github@multica.ai>	2026-06-02 10:07:36 +02:00
Chener	fd1cdf1801	fix project progress cache invalidation (#3016) ... Co-authored-by: chener <chener@M5Air.local>	2026-06-02 15:05:49 +08:00
Anderson Shindy Oki	1aa742053b	i18n: add japanese locale (MUL-2893) (#3538) ... * i18n: add japanese locale * fix: spacing issues * refactor * fix(desktop): set <html lang> before paint to avoid JA Kanji font flash Switch the documentElement.lang sync from useEffect to useLayoutEffect so lang is committed before the first paint. Otherwise Japanese desktop users saw one frame of Kanji rendered with the Chinese-first fallback stack before the html[lang|="ja"] CJK override applied. Also fix the stale selector in the HTML_LANG comment (html[lang^="ja"] -> html[lang|="ja"]). Addresses review nits on MUL-2893. Co-authored-by: multica-agent <github@multica.ai> * fix(docs): tokenize the ideographic iteration mark in JA search Add U+3005 (々) to the Japanese search tokenizer character class. It sits just below the kana blocks, so words like 様々 / 日々 / 個々 previously dropped the mark and split awkwardly, hurting recall. Addresses a review nit on MUL-2893. Co-authored-by: multica-agent <github@multica.ai> * fix(i18n): restore ja locale parity after merging main Merging main brought new EN strings into agents/chat/onboarding/settings/ squads that the ja bundle (authored against an older snapshot) lacked, breaking the locales parity test. Add the Japanese translations for the new keys (workspace logo upload, agents runtime filter, chat session-history stop dialog, onboarding social_github, squad archived status) and drop the two renamed chat window keys (active_group / archived_group) that EN removed in favour of history_group. Fixes the failing @multica/views parity.test.ts on the FE CI for MUL-2893. Co-authored-by: multica-agent <github@multica.ai> --------- Co-authored-by: J <j@multica.ai> Co-authored-by: multica-agent <github@multica.ai>	2026-06-02 14:29:29 +08:00
Multica Eve	e2720f7d33	feat: add opencode thinking variants ... Adds OpenCode model variant discovery for thinking controls, passes saved thinking_level through opencode run --variant, and hardens verbose model parsing with fallback coverage.	2026-06-02 13:15:14 +08:00
YYClaw	a6b83fef41	fix(agents): surface archived status for retired agents (#3608) ... Retired agents (agent.archived_at set) previously read as offline across the agent dot, hover card, detail badge, and squad member list — a leftover online runtime row could even make them look reachable. Add a dedicated archived presence/status that wins over every runtime/task signal so a retired agent never reads as live or merely offline. - Add archived to AgentAvailability and SquadMemberStatusValue unions - Short-circuit deriveAgentPresenceDetail before runtime/task scan - Backend deriveSquadMemberStatus returns archived instead of offline - Render gray Archive dot/label; skip workload + reassign affordances - en/ko/zh-Hans locale strings	2026-06-02 13:03:15 +08:00
xiaoyue26	27945727af	fix(realtime): invalidate chat/labels/invitations queries on WS reconnect (#3570) ... Backfill the missing query invalidations (chat / labels / invitations) in invalidateWorkspaceScopedQueries, so those lists refresh on WS reconnect and workspace switch instead of showing stale data until a manual refresh. Adds tests covering invalidation on ws-instance change and actor_type passing to event handlers. MUL-2882	2026-06-02 12:32:03 +08:00
Matt Voska	700cd97407	feat(workspace): add per-workspace logo upload (#2760) ... Adds avatar_url column to workspace, threads it through the API + WorkspaceAvatar component, and adds a click-to-upload editor in the workspace settings tab. Mirrors the squad avatar pattern (migration 086); UI strings use "logo" while the schema/code uses avatar_url for codebase consistency with user.avatar_url and squad.avatar_url. - migration 093: ALTER TABLE workspace ADD COLUMN avatar_url TEXT - UpdateWorkspace SQL + handler accept avatar_url (auth gated to owner/admin at the router via RequireWorkspaceRoleFromURL) - WorkspaceAvatar renders <img> when avatar_url is set, falls back to the initial-letter span otherwise - workspace-tab.tsx adds a 16x16 click-to-upload logo editor at the top of the general settings card, using useFileUpload + accept= image/png,image/jpeg,image/webp (server stores under workspaces/{id}/) - en + zh-Hans settings i18n strings added Co-authored-by: Matt Voska <voska@users.noreply.github.com>	2026-06-01 16:48:05 +02:00
Bohan Jiang	0f9d9d1494	fix(skills): align Go/TS frontmatter coercion for non-scalar values (#3614) ... The Go SKILL.md frontmatter parser unmarshalled into a {Name,Description} string struct, so a non-scalar value (a list/map written where a scalar belongs) made the whole decode fail and dropped even a valid sibling `name`. The TS parser instead kept the name and JSON-encoded the value, so the file-viewer (TS) and the import path (Go) could disagree about the same SKILL.md. Decode into a generic map and coerce per key on the Go side, mirroring the TS coercion (scalars -> literal form, sequences/mappings -> JSON), so both sides produce identical results and a structured value never discards a sibling key. Rename ParseFrontmatter -> ParseSkillFrontmatter to remove the cross-language name clash with the TS parseFrontmatter (which returns {frontmatter, body}), and drop the unused TS parseSkillFrontmatter export. Add parity tests for sequence/mapping values plus name-only, description-only, leading-blank-line and triple-dash-in-body edge cases on both sides. Follow-up to #3543 / MUL-2842. Co-authored-by: J <j@multica.ai> Co-authored-by: multica-agent <github@multica.ai>	2026-06-01 19:42:20 +08:00
YOMXXX	801c201d4c	fix(skills): parse multi-line YAML frontmatter in SKILL.md (#3495) (#3543) ... Three independent line-based frontmatter parsers only handled single-line `description: value`, so a YAML block scalar (`description: |`) collapsed to the literal "|" and the rest of the description was dropped before it ever reached the database. Replace all three with real YAML decoders that understand block scalars, folded scalars and quoted values: - server/internal/skill: shared ParseFrontmatter via gopkg.in/yaml.v3, used by both the handler import path and daemon local-skill discovery - packages/core/skills: shared parseFrontmatter via the yaml package - file-viewer renders multi-line frontmatter values (whitespace-pre-wrap) Both parsers fall back to empty values on malformed YAML, preserving the previous non-fatal behaviour.	2026-06-01 19:35:01 +08:00
Jiayuan Zhang	57894f29b6	feat(onboarding): add GitHub to acquisition channels (#3612) ... Add 'social_github' as a new attribution source option in the onboarding 'How did you hear about Multica?' multi-select picker, alongside the existing X / LinkedIn / YouTube options. Includes: - New 'social_github' value in the Source type union - New GitHubIcon in the brand-icons component - New option in step-source.tsx (placed next to other social picks) - en/zh-Hans/ko i18n labels Co-authored-by: Lambda <lambda@multica.ai> Co-authored-by: multica-agent <github@multica.ai>	2026-06-01 12:21:38 +02:00
Multica Eve	c9c269675c	fix: align MCP support docs and UI gate (#3553) ... Co-authored-by: Eve <eve@multica-ai.local> Co-authored-by: multica-agent <github@multica.ai>	2026-05-30 18:24:45 +08:00
Ivan Vinokurov	9aa8ba0191	fix(runtimes): self-host daemon setup URLs (MUL-2804) (#3474) ... Expose self-host daemon setup URLs from /api/config at runtime so the Add computer dialog renders the operator's own server/app domains, while Multica Cloud defaults stay unchanged. Fixes #3013.	2026-05-30 18:13:02 +08:00
Multica Eve	eda2150a97	fix(agents): show MCP tab for ACP runtimes (#3534) ... Co-authored-by: Eve <eve@multica-ai.local> Co-authored-by: multica-agent <github@multica.ai>	2026-05-29 20:00:05 +08:00
김보경/DAXTF	5aa4fb7487	MUL-2760: feat(i18n): add Korean locale support (#3369) ... * feat: add korean locale support * feat(i18n): localize Korean landing page * fix(i18n): refine Korean landing copy * fix(i18n): refine Korean translations * fix(i18n): translate Korean landing subpages * fix(i18n): route Korean landing docs links * fix(i18n): add Korean use case content * fix(i18n): polish Korean locale copy * fix(i18n): improve Korean landing copy * fix(onboarding): persist Korean helper artifacts Co-authored-by: multica-agent <github@multica.ai> * fix(web): add use case locale fallback Co-authored-by: multica-agent <github@multica.ai> * Align Korean pull requests wording Co-authored-by: multica-agent <github@multica.ai> * fix(i18n): dedupe docs href helper Co-authored-by: multica-agent <github@multica.ai> * fix(i18n): localize changelog dates Co-authored-by: multica-agent <github@multica.ai> * fix(docs): prerender Korean fallback pages Co-authored-by: multica-agent <github@multica.ai> * fix(docs): align fallback hreflang metadata Co-authored-by: multica-agent <github@multica.ai> * fix(i18n): preserve Chinese CJK font fallback order Co-authored-by: multica-agent <github@multica.ai> * chore(onboarding): update localized comment wording Co-authored-by: multica-agent <github@multica.ai> * test(i18n): harden CJK font fallback assertions Co-authored-by: multica-agent <github@multica.ai> * fix(docs): keep Chinese font fallbacks first Co-authored-by: multica-agent <github@multica.ai> * test(i18n): harden locale fallback coverage Co-authored-by: multica-agent <github@multica.ai> --------- Co-authored-by: multica-agent <github@multica.ai>	2026-05-29 15:16:22 +08:00
Bohan Jiang	fa076d38f2	MUL-2778 feat(agent): wire mcp_config through OpenClaw runtime (#3450) ... * MUL-2778 feat(agent): wire mcp_config through OpenClaw runtime The MCP config tab (#3419) lets admins save mcp_config on an agent, and recent work (#3439) plumbed it through the three ACP runtimes. OpenClaw still ignored the field, leaving the Tab silently inert for any OpenClaw-backed agent. Translate the agent's Claude-style `{"mcpServers": {...}}` into the per-task OpenClaw wrapper's `mcp.servers` block — OpenClaw resolves MCP via its own config schema rather than ExecOptions, so the existing OPENCLAW_CONFIG_PATH preparer is the right seam. Fail closed on malformed JSON / entries missing `command` or `url`, matching the fail-closed posture the preparer already uses for the agents.list step. Null / absent mcp_config leaves the wrapper free of an `mcp` key so the user's global mcp.servers flows through untouched; an explicit empty managed set (`{}` / `{"mcpServers":{}}`) is honoured as "admin saved no servers" mirroring `hasManagedCodexMcpConfig`. Strict-mode replacement (drop user-only servers entirely) would require OpenClaw to do a per-key replace rather than a deep merge at `mcp.servers`; the comment documents that caveat rather than relying on undocumented behaviour. Also adds `openclaw` to `MCP_SUPPORTED_PROVIDERS` so the MCP Tab actually surfaces in the agent overview pane, and pins the new visibility case with a renderPane test. Co-authored-by: multica-agent <github@multica.ai> * MUL-2778 fix(agent): make openclaw mcp_config strict-replace via sanitized snapshot Elon flagged on #3450 that the previous wiring let user-only mcp.servers leak through the wrapper's `$include` of the live user config: deep-merge at `mcp.servers` keeps user-only names, and the strict-empty case (`{ "mcpServers": {} }`) silently inherited user globals. Switch the strict-replace path to write a sanitized snapshot of the user's fully resolved config (via `openclaw config get --json`) with the `mcp` block stripped, then have the wrapper `$include` the snapshot instead of the live user file. With the user's `mcp` gone from the $include resolution, the wrapper's `mcp.servers` is the only definition the embedded OpenClaw sees — managed only, including the explicit empty set. The snapshot lives in envRoot at 0o600 alongside the wrapper so the GC reaper sweeps it with the rest of the task scratch, and no extra OPENCLAW_INCLUDE_ROOTS entry is needed (same-dir $include). Fail-closed on `config get --json` errors so the daemon never silently falls back to the leaky $include path. The inherit branch (null mcp_config) still uses the live user file directly — no extra CLI roundtrip and no snapshot is written. New tests pin the contract Elon's review required: - TestPrepareOpenclawConfigStrictReplacesUserMcpServers: user has global_one + shared, managed has shared + managed_only → wrapper has exactly {shared (managed value), managed_only}; global_one does NOT leak; snapshot file has the user's `mcp` stripped while preserving gateway / providers / API keys. - TestPrepareOpenclawConfigStrictEmptyManagedSetDropsUserMcp: empty managed set drops user's global_one (both `{}` and `{"mcpServers":{}}` cases). - TestPrepareOpenclawConfigNullMcpConfigKeepsUserInclude: null path inherits the live user config, writes no snapshot, makes no extra CLI call. - TestPrepareOpenclawConfigFailsClosedOnResolvedConfigError: errors during `config get --json` surface; no stale wrapper or snapshot. - TestPrepareOpenclawConfigManagedSetFreshInstall: fresh install with managed mcp_config skips the snapshot dance entirely. Also tightens en + zh-Hans MCP Tab copy to mention OpenClaw goes via the per-task wrapper, and to use OpenClaw's own `transport` field rather than Claude's `type` for HTTP/SSE entries. Co-authored-by: multica-agent <github@multica.ai> * MUL-2778 fix(agent): narrow openclaw snapshot strip to mcp.servers only Elon's third-round must-fix: the previous strict-replace snapshot deleted the entire `mcp` block, which wiped out non-server settings under `mcp` like `sessionIdleTtlMs`. Those are documented OpenClaw config keys (https://docs.openclaw.ai/gateway/configuration-reference#mcp) outside the MCP Tab's scope — the agent's saved mcp_config only manages server definitions, so other `mcp.*` tuning the user set must survive. Replace the blanket `delete(resolved, "mcp")` with a stripUserMcpServers helper that: - deletes only `mcp.servers` when `mcp` is an object - drops the parent `mcp` key only when the object is empty after the strip (so we don't emit `mcp: {}` placeholders) - leaves non-object `mcp` values untouched (we only know how to strip servers from the documented shape) Pinned with TestPrepareOpenclawConfigStrictPreservesNonServerMcpKeys: user resolved has both `mcp.sessionIdleTtlMs: 300000` and `mcp.servers.global_one`; after the strict path runs the snapshot keeps the TTL and drops the servers map, and the wrapper's `mcp.servers` is exactly the managed set with no leak. Co-authored-by: multica-agent <github@multica.ai> --------- Co-authored-by: J <j@multica.ai> Co-authored-by: multica-agent <github@multica.ai>	2026-05-28 18:43:02 +08:00
LinYushen	7bbca54e92	feat(billing): test page consuming /api/cloud-billing/* (#3442) ... * feat(billing): test page consuming /api/cloud-billing/* Stuffs every cloud-billing endpoint onto a single dev page so we can verify the proxy + Stripe end-to-end flow without a designed UI. Reachable at /<workspaceSlug>/billing — the page is account-level data but lives under the workspace dashboard layout because that's where the authenticated shell sits. No sidebar entry on purpose; this is test-quality and meant to be deleted when the real billing UI ships. What's there: * Balance card (GET /balance) * Stripe-success polling banner — visible only when ?session_id= is in the URL (Stripe substitutes it into checkout_success_url on its way back). React Query refetchInterval polls every 2s until the topup status reaches credited / failed / canceled, then a 'Clear from URL' button calls navigation.replace(pathname). * Buy section: server-authoritative price tier buttons (GET /price-tiers) → POST /checkout-sessions → window.location to the Stripe URL. We do NOT hard-code amounts on the frontend; tier config lives in cloud's billing.price_tiers. * Stripe Billing Portal button (POST /portal-sessions). Opens in a new tab so the originating page stays put for easy verification. Documented behaviour: 400 is expected for users with no Stripe customer record yet. * Three lists: transactions / batches / topups. Plumbing: * packages/core/types/billing.ts — interfaces mirroring the cloud response shapes. Status / source / tx_type fields are typed 'string' rather than enum unions to match the schemas' z.string() parsing (same convention as CloudRuntimeNode); the canonical enum values are exported as separate type aliases for callers that want to switch on them. * packages/core/api/schemas.ts — 9 zod schemas + 7 EMPTY_ fallbacks, all .loose() so a non-breaking cloud-side field addition doesn't crash the parser. * packages/core/api/client.ts — 8 methods using parseWithFallback, matching the existing cloud-runtime shape. * packages/core/billing/{queries,mutations,index}.ts — React Query queryOptions + mutations. Notable choices: balance / lists are NOT keyed on workspace (account-level data), and the checkout-session polling stops automatically when status is terminal so we don't poll forever after a user closes the tab. * packages/core/package.json + packages/views/package.json — exports map updated for @multica/core/billing and @multica/views/billing. Verification: * pnpm --filter @multica/core typecheck clean * pnpm --filter @multica/views typecheck — only pre-existing hast-util-to-html error in editor code (exists on main) * pnpm --filter @multica/core test — 412 passing * pnpm --filter @multica/views test — 877 passing, 1 failure (editor/readonly-content) is also pre-existing on main, not caused by this change Out of scope: real production-quality billing UI; sidebar entry; i18n strings; mobile app. This is a single test page; it gets replaced when the real UI ships. * fix(billing): refetch balance/lists when checkout polling reaches terminal Closes the second-half of the Stripe-return race the previous commit left dangling. Symptom: After Stripe redirects back with ?session_id=..., the banner polls /checkout-sessions/{id} every 2s and the rest of the page (balance, transactions, batches, topups) is fetched once on mount. The webhook race means those four queries usually see pre-credit state — but the banner is the only thing that keeps polling, so once it reads 'credited' nothing else on the page knows. The user would see 'Final status: credited' next to a stale balance card until they manually refresh. Fix: Add useInvalidateBillingDataAfterCredit() in @multica/core/billing — a hook returning a callback that flushes balance / transactions / batches / topups (NOT the checkout-session itself; its refetchInterval already terminated, refetching would just confirm the same value). The Stripe-success banner runs this callback in a useEffect keyed on terminal-status transition, so it fires exactly once when the polling lands. Strict scope is documented in the hook's JSDoc: - balance/transactions/batches: only change at the 'credited' transition (cloud writes ledger + batch + wallet in one DB tx) - topups: changes on every terminal transition - For 'failed' / 'canceled' we technically over-fetch the first three; three cheap round-trips, simplifies the call site, fine on a test page. Effect dep is . terminal flips false→true at most once per session id (the polling stops when terminal is true so the data won't change again). If the user lands here with a session that is already terminal (re-opened tab on a credited URL), the effect still fires on first data load and we still re-fetch — correct, the cached snapshot is just as stale in that case. go build / pnpm typecheck / pnpm test clean (core 412 passing; only pre-existing hast-util-to-html error in unrelated editor code on views, same as on main).	2026-05-28 16:48:04 +08:00
Bohan Jiang	90ddfb04e2	feat(self-host): DISABLE_WORKSPACE_CREATION env var (MUL-2777) (#3441) ... * feat(self-host): DISABLE_WORKSPACE_CREATION env var (MUL-2777, #3433) When self-hosters set DISABLE_WORKSPACE_CREATION=true, POST /api/workspaces returns 403 for every caller and the UI hides every "Create workspace" affordance (sidebar, modal, /workspaces/new page, onboarding Step 2). This closes the gap where ALLOW_SIGNUP=false still let any signed-in user open an isolated workspace the platform admin couldn't see. - server: new Config.DisableWorkspaceCreation, gate in CreateWorkspace, workspace_creation_disabled in /api/config, Go tests. - frontend: new workspaceCreationDisabled in configStore, hide sidebar entry, swap NewWorkspacePage / CreateWorkspaceModal / onboarding StepWorkspace to a "creation disabled, ask for invite" state when the flag is on, EN + zh-Hans locale strings. - ops: .env.example, docker-compose.selfhost, helm values + configmap, SELF_HOSTING.md, SELF_HOSTING_ADVANCED.md, environment-variables docs (EN + zh). Co-authored-by: multica-agent <github@multica.ai> * fix(onboarding): drive create path off workspaceCreationAllowed (#3433) PR #3441 review: when DISABLE_WORKSPACE_CREATION=true and the user already has a workspace, StepWorkspace still walked the resume copy (`headline_resume` / `lede_resume` mentioning "or start another") and `creatingActive` ignored the flag, leaving a stale clickable create CTA possible if /api/config arrived late. Refactor StepWorkspace to derive a single `workspaceCreationAllowed` boolean from the config store. It now drives: - Initial `mode` state (defaults to "existing" when disabled + reusing so the CTA is pre-armed for the only valid action). - `creatingActive` so the footer CTA cannot fall back into the create branch even mid-render. - Eyebrow / headline / lede strings — adds `creation_disabled_{eyebrow,headline,lede}_resume` (EN + zh-Hans) for the disabled + reusing variant. Tests: cover the three reachable shapes — flag off + no existing, flag on + no existing, flag on + existing. Co-authored-by: multica-agent <github@multica.ai> --------- Co-authored-by: J <j@multica.ai> Co-authored-by: multica-agent <github@multica.ai>	2026-05-28 16:42:08 +08:00
Bohan Jiang	1195255e43	MUL-2771: feat(transcript): server-derived relative work_dir chip (#3428) ... * MUL-2771: feat(transcript): server-derived relative work_dir chip Adds a privacy-safe `relative_work_dir` field to the agent task wire shape so the transcript dialog can show where a task ran without leaking the user's home directory. Standard tasks strip the daemon's workspaces root to `<wsUUID>/<taskShort>/workdir`; local_directory tasks fall back to the trailing two path segments (`repos/foo`), which keeps enough context for the user to recognise the directory without exposing $HOME or the username. The derivation lives in `taskToResponse` so every endpoint that serves a task — list, snapshot, claim, rerun, cancel, complete, fail — fills the field consistently. taskToResponse now also populates `workspace_id`, which the prior shape declared but never set. shortTaskID mirrors execenv.shortID; a colocated test pins the two helpers together so future daemon-side layout changes don't silently degrade the chip into the local_directory fallback. Replaces the front-end stripping attempt in PR #3379, which passed issue_id where workspace_id was required and therefore rendered the full absolute path on every standard task. Co-authored-by: multica-agent <github@multica.ai> * MUL-2771: harden privacy guards on transcript work_dir chip Address second-round review feedback from PR #3428: 1. Drop the `title={task.work_dir}` tooltip in the transcript dialog. The visible chip was safe but native browser tooltips re-rendered the absolute `/Users/<name>/...` on hover, leaking into screen shares, screenshots, and recordings — defeating the stated goal of the chip. The absolute path now never reaches the DOM (no title, aria, or data attribute). 2. Replace the "tail two segments" fallback for local_directory paths with explicit home-prefix stripping plus a basename-only final fallback. The old behaviour leaked the username on shallow paths like `/Users/alice/foo`, `/home/alice/project`, and `C:\Users\alice\foo`. The new behaviour recognises common per-user home layouts on macOS, Linux, and Windows (case-insensitive), strips them down to the remainder, and falls back to the basename for any path under an unrecognised root — a single segment can never carry the home prefix. 3. Align the Go and TypeScript field comments with the real fallback policy so future readers see "strip home / basename" instead of the outdated "tail two segments" description. Tests: expanded `TestRelativeWorkDir` to cover shallow `/Users/...`, `/home/...`, and `C:\Users\...` paths, the exact-home edge cases, case-insensitive matching, and the non-home basename-only fallback. Co-authored-by: multica-agent <github@multica.ai> --------- Co-authored-by: J <j@multica.ai> Co-authored-by: multica-agent <github@multica.ai>	2026-05-28 15:53:16 +08:00
Bohan Jiang	d39da9f7f0	MUL-2764: feat(agents): add MCP config tab to agent detail page (#3419) ... * MUL-2764: feat(agents): add MCP config tab to agent detail page Backend already stores `mcp_config` and the daemon forwards it to the runtime CLI via `--mcp-config`; this only adds the UI entry point. The new tab presents a JSON editor that pretty-prints the existing config, validates the buffer on every keystroke, and saves through the existing `PUT /api/agents/{id}` path. Clearing the editor sends `mcp_config: null`, which the handler reads as "wipe the column" and the daemon falls back to the CLI's own default. When the caller can't see secrets (agent actor, or a non-owner non-admin member), the server already returns `mcp_config: null` with `mcp_config_redacted: true`; the tab renders a read-only "configured but hidden" state in that case so a non-privileged member cannot silently overwrite an admin-owned config by saving an empty editor. Co-authored-by: multica-agent <github@multica.ai> * fix(agents): MCP tab — preserve in-flight edits + warn non-Claude runtimes - Fix stale-editor sync: compare the local draft against the *previous* original via a ref, so a background agent refetch updates an untouched editor instead of being silently ignored. Without this, a draft equal to the OLD original was treated as user-edited after the prop changed, and the next Save would write the old config back over a concurrent admin edit. - Surface a notice inside the tab when the agent's runtime provider is not Claude — today's daemon only forwards mcp_config via Claude's --mcp-config, so saving on e.g. a Codex agent was silent but ineffective. - Tests for both: rerender resyncs an untouched editor, rerender preserves an in-flight edit, warning renders on non-Claude / hides on Claude. MUL-2764 Co-authored-by: multica-agent <github@multica.ai> * MUL-2764: feat(agents): codex MCP support + hide MCP tab on unsupported runtimes - Backend: codex.go now translates agent.mcp_config (Claude-style `{"mcpServers": {...}}`) into `-c mcp_servers.<name>=<inline-toml>` flags for `codex app-server`, so MCP servers configured in the UI reach Codex's per-task config layer. Bad mcp_config JSON downgrades to a warn-and-skip so it can't break the agent launch. - Frontend: AgentOverviewPane hides the MCP tab when the agent's runtime provider doesn't read mcp_config — only `claude` and `codex` are supported today, every other provider sees no MCP tab. The previous in-tab warning is removed (no longer reachable). - New shared helper `providerSupportsMcpConfig` lives in `@multica/core/agents` so views and any future caller share one list of MCP-aware providers. - Tests: new go-side coverage for stdio + url + multi-server inputs, TOML string escaping, malformed-input fallback, and arg ordering vs custom_args; new views-side coverage for which providers surface the MCP tab. En + zh-Hans copy and parity test refreshed. Co-authored-by: multica-agent <github@multica.ai> * MUL-2764: fix(agents): keep codex mcp_config secrets out of argv/logs Move the agent's mcp_config from a `-c mcp_servers.<id>=<inline-toml>` argv flag into a daemon-managed `[mcp_servers.*]` block inside the per-task `$CODEX_HOME/config.toml`. mcp_servers.<id>.env is a documented Codex config field and the UI already treats mcp_config as redacted for non-admins; argv would have leaked those values into `ps aux` and the `agent command` log line. The file is forced to 0600 to keep secrets in the daemon owner's lane regardless of the seed file's mode. Also drop user-supplied `-c/--config mcp_servers.*` entries from custom_args. Codex `-c` is last-wins (verified against codex-cli 0.132.0), so without filtering, a custom_args entry could silently shadow whatever the MCP Tab saved. Strip inherited `[mcp_servers.*]` tables from the per-task config.toml when the agent has its own mcp_config, mirroring Claude's `--strict-mcp-config`: avoids TOML "table already exists" errors on name collisions and matches admin expectations that the MCP Tab is the authoritative source for that task. Co-authored-by: multica-agent <github@multica.ai> * MUL-2764: fix(agents): codex mcp_config three-state semantics + custom_args compat Address the third review pass: 1. Distinguish nil vs present-but-empty mcp_config. `{}` and `{"mcpServers":{}}` now count as "admin saved an explicit (empty) managed set" — strip inherited user `[mcp_servers.*]` and pin an empty managed marker block. Only SQL NULL / JSON `null` map to "absent" and fall back to the user's global `~/.codex/config.toml`. This aligns Codex with the API's three-state contract (omit / null / object) and with Claude's `--strict-mcp-config` semantics. 2. Fail closed on `ensureCodexMcpConfig` errors and on managed mcp_config without CODEX_HOME. Previous warn-and-launch would silently inherit the user's global MCP servers and look identical to a successful apply — exactly the surprise the MCP Tab is meant to remove. 3. Only filter `-c mcp_servers.*` from `custom_args`/`extra_args` when the agent has a managed mcp_config. Pre-MUL-2764 agents that configured MCP via custom_args keep working; once an admin opts in via the MCP Tab the daemon owns the `mcp_servers` namespace and overrides are dropped (last-wins safety). 4. Update mcp_config locale intro to mention $CODEX_HOME/config.toml instead of the now-removed `-c mcp_servers.*` argv path. Tests: - Split `TestEnsureCodexMcpConfigEmptyInputsAreNoop` into `TestEnsureCodexMcpConfigAbsentLeavesUserTablesAlone` (nil/null) and `TestEnsureCodexMcpConfigEmptyManagedSetStripsUserMcp` (`{}`, `{"mcpServers":{}}`). - Add `TestEnsureCodexMcpConfigEmptyManagedSetIdempotent` to pin byte-identical reruns on the empty managed marker block. - Add `TestHasManagedCodexMcpConfig` covering the eight relevant inputs. - Add `TestBuildCodexArgsPreservesCustomMcpOverridesWhenUnmanaged` and `TestBuildCodexArgsDropsCustomMcpOverridesWhenManaged` to pin the new gating. - Add `TestCodexExecuteFailsClosedWhenMcpConfigInvalid` and `TestCodexExecuteFailsClosedWhenManagedMcpButNoCodexHome` for the Execute paths. Co-authored-by: multica-agent <github@multica.ai> --------- Co-authored-by: J <j@multica.ai> Co-authored-by: multica-agent <github@multica.ai>	2026-05-28 15:11:28 +08:00
Bohan Jiang	5732b0dae8	fix(issues): clear deleted ids from recent issues store (#3420) ... cleanupDeletedIssueCaches now also calls a new useRecentIssuesStore.forgetIssue(wsId, issueId) action so the persisted Recent Issues bucket no longer keeps deleted ids around. Both the delete mutation and the WS delete event flow through the same cleanup, so this covers self-delete and cross-client delete. Without this, Cmd+K fires a detail query for every recent id on open and returns a steady stream of 404s for issues the user has deleted (#3413). MUL-2765 Co-authored-by: J <j@multica.ai> Co-authored-by: multica-agent <github@multica.ai>	2026-05-28 13:06:13 +08:00
Anderson Shindy Oki	bdb60acae9	fix: swimlane empty lanes in due to pagination (MUL-2724) (#3326) ... * fix: Swimlane lazy load issues * wip * refactor * fix: Rebase issues * fix: rerender * refactor bactch and chunking	2026-05-27 16:28:15 +08:00
Alex	746c0c4456	MUL-2746 fix(avatar): normalize relative avatar urls in desktop/web (#3100) ... * fix(avatar): normalize relative avatar urls in desktop/web Co-authored-by: multica-agent <github@multica.ai> * fix: test Co-authored-by: multica-agent <github@multica.ai> * fix(avatar): normalize avatar url in AvatarPicker preview MUL-2746. The picker is used by create-agent and create-squad, and also prefills from a template's `avatar_url` when duplicating an agent. The upload result / template URL is root-relative in local-storage setups, so on Desktop (file:// runtime) the preview <img> resolves against the local filesystem and the avatar fails to render. Route the value through `resolvePublicFileUrl` for rendering only; the stored URL stays raw so the parent's create call still posts what the backend expects. Co-authored-by: multica-agent <github@multica.ai> --------- Co-authored-by: multica-agent <github@multica.ai> Co-authored-by: J (Multica agent) <agents@multica.ai>	2026-05-27 16:02:08 +08:00
Raúl Anatol	2b5696703f	MUL-2703: feat(autopilots): webhook event filters per trigger (MUL-2334 follow-up) (#3231) ... * feat(autopilots): webhook event filters per trigger (MUL-2334 follow-up) Adds schema-backed event/action filtering to webhook triggers so operators can declare exactly which GitHub (or generic) events should spawn autopilot runs. Events outside the declared scope are recorded as ignored with reason 'event_filtered' — visible in the delivery log but without expensive run/task creation. Closes #3093 (supersedes the description-parsing approach from that PR). Backend: - Migration 108 adds event_filters JSONB to autopilot_trigger - sqlc queries updated for CREATE / UPDATE / LIST / GET - HandleAutopilotWebhook filters against trigger.event_filters before dispatch - Create/Update trigger handlers accept event_filters in the request body - Response shape includes event_filters so the UI can render it Frontend: - New WebhookEventFilterSection component in the autopilot dialog - Inputs for event name + comma-separated actions - i18n strings added (en + zh-Hans) Tests: - Unit tests for splitWebhookEvent and webhookEventAllowedByTriggerScope - Handler-level integration tests for filtered / allowed / no-filter paths co-authored-by: ZephaniaCN <agent/autopilot-webhook-filter> * fix: recognize gitlab/bitbucket/gitea as providers in splitWebhookEvent TestSplitWebhookEvent failed because only 'github' was recognized as a provider prefix. Extract isKnownProvider() to handle gitlab, bitbucket, and gitea as well. * fix(autopilots): address PR #3231 review for webhook event filters Must-fix from PR #3231 review: 1. event_filters now uses typed []WebhookEventFilter at the HTTP boundary instead of []byte. encoding/json was base64-encoding the field on the way out, so the UI could not .map() the response, and a real JSON array on the way in failed to decode. Response field also decodes the stored JSONB into a typed slice before serialising back. 2. UpdateAutopilotTriggerRequest.EventFilters is *[]WebhookEventFilter with tri-state PATCH semantics: nil pointer = leave alone, [] = clear, [...] = replace. The handler marshals an explicit empty slice to the JSONB literal `[]` so COALESCE overwrites instead of preserves. AutopilotDialog now PATCHes the webhook trigger when event_filters change in edit mode (previously the toast said "updated" while the backend was unchanged). 3. webhookEventAllowedByTriggerScope no longer short-circuits to false on the first event-name match whose actions don't line up. Earlier code silently shadowed any later filter that shared the same event name with disjoint actions. Robustness: validateWebhookEventFilters rejects empty event names / actions at write time, and the matcher fails closed on malformed stored bytes instead of widening the allowlist. Tests: handler tests now post real JSON arrays (the prior []byte path masked the contract bug). Adds round-trip / clear-with-[] / preserve- when-omitted / replace / invalid-filter / filters-on-schedule coverage, plus matcher tests for same-event multi-filter and malformed-deny. Migration renamed 108 → 110 to avoid colliding with main's 108_task_token (came in via the merge from main).	2026-05-27 15:47:36 +08:00
Naiyuan Qing	bd1fb10afa	chore: react-doctor cleanup — button types, useContext→use(), toSorted, error fixes (#3350) ... - Add explicit type="button" to 61 <button> elements missing the attribute - Replace useContext() with React 19 use() across 16 context consumers - Replace [...arr].sort() with arr.toSorted() in 12 web/desktop files (mobile excluded — Hermes lacks toSorted support) - Fix rules-of-hooks violation: useSidebar try/catch → useSidebarSafe null check - Fix nested component definition: useMemo wrapping HeaderRight → useCallback - Fix missing ARIA: add aria-expanded + aria-controls to combobox in create-squad React Doctor score: 23 → 30. No behavioral changes, no business logic modified. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-27 14:57:07 +08:00
LinYushen	c968c13c87	feat(auth): support mcn_ Cloud Node PATs verified via Fleet (#3349) ... * feat(auth): support mcn_ Cloud Node PATs verified via Fleet Adds a new token kind, mcn_ (multica cloud node), recognized in both the regular Auth and DaemonAuth middlewares. mcn_ tokens are minted and owned by Multica Cloud (not the local personal_access_tokens table); the server validates them by POSTing to the Fleet's /api/v1/pat/verify endpoint and uses the returned owner_id as X-User-ID for downstream handlers. Cloud is the authoritative owner of token status, so this is a verifier-only path with no DB fallback: * Fleet says valid:false -> 401 (token genuinely bad) * Fleet unreachable / 5xx -> 503 (transient, retry) * No MULTICA_CLOUD_FLEET_URL configured -> 401 (fail closed) Verification results are cached in Redis for 60s under mul:auth:mcn:<sha256> to bound the per-request load on Fleet without extending the revocation window beyond what the Cloud doc allows. Negative results are NOT cached, so a freshly minted token doesn't get locked out by a stale 'token_not_found'. Reuses MULTICA_CLOUD_FLEET_URL (the same env the cloud-runtime proxy already uses) so deployments don't need a second config knob. Tests cover the happy path, every documented invalid reason, 4xx/5xx mapping, network error, decode error, ctx cancellation, the fail-closed valid:true-without-owner_id case, trailing-slash URL normalization, and the Redis cache short-circuit + negative no-cache contract. Middleware tests pin the four 401/503/200 outcomes in both Auth and DaemonAuth. * auth(mcn): require owner_id to map to a real local user; drop X-User-PAT plumbing Two related changes: 1. Cloud-verified owner_id is now checked against our local users table. The Cloud owner_id and our users.id share the same UUID space by contract; a missing local user means either the row was deleted under an active node or something is forging owner_ids — either way, fail closed. CloudPATVerifier.Verify takes a new OwnerLookupFunc: - returns (true, nil) -> success, cache + return - returns (false, nil) -> ErrCloudPATInvalid (reason='owner_unknown'), NOT cached (so a freshly-created user doesn't get locked out for a TTL window) - returns (_, error) -> ErrCloudPATUnavailable (transient, middleware emits 503) Both Auth and DaemonAuth wire ownerLookupFor(queries), a new shared helper that wraps queries.GetUser, mapping pgx.ErrNoRows / unparseable UUIDs to (false, nil) and other errors to a real Go error. 2. Removed all X-User-PAT plumbing. Cloud now mints node-scoped mcn_ PATs itself during /api/v1/nodes (see multica-cloud docs/api/node-pat.md) and ships them into the EC2 instance via SSM, so multica-api no longer needs to forward the caller's mul_ PAT. Propagating a long-lived user PAT into a remote machine widened the blast radius of any node compromise; that's gone now. Removed: - cloud_runtime.go: withUserPAT option, cloudRuntimeUserPAT, generateCloudRuntimePAT, revokeGeneratedPAT - cloudruntime/Request.UserPAT field + X-User-PAT header - X-User-PAT from CORS allowed headers - obsolete handler tests: TestCreateCloudRuntimeNodeForwardsValidatedPAT TestCreateCloudRuntimeNodeRejectsUnownedPAT TestCreateCloudRuntimeNodeRejectsExpiredPAT TestCreateCloudRuntimeNodeAutoGeneratesPAT replaced with TestCreateCloudRuntimeNodeForwardsBody - X-User-PAT references in packages/core/api/client.test.ts Tests: * 3 new verifier-level tests (owner_unknown not cached, lookup error -> Unavailable, success path is cached for both fleet AND lookup) * 5 new owner_lookup_test.go tests (nil queries, existing user, missing user, malformed UUID, DB error) * 1 new end-to-end DaemonAuth test (cloud says valid, no local user -> 401) * Existing X-User-PAT TS assertions removed; full vitest run passes. * go test ./... and go vet ./... clean on the server module.	2026-05-27 14:52:03 +08:00
Naiyuan Qing	31b58494cf	feat(comments): align UpdateComment post-processing with CreateComment (#3337) ... * feat(comments): align UpdateComment post-processing with CreateComment (#2965 follow-up) Part 1 — PR #2965 code review follow-ups: - Fix sqlc Column3 naming → AttachmentIds via sqlc.arg(attachment_ids) - Return 500 on ReplaceCommentAttachments failure instead of logging + 200 - Remove optional marker from onEdit attachmentIds (always passed) - Add optimistic update for attachments in useUpdateComment - Extract useEditAttachmentState hook from CommentRow/CommentCardImpl - Add integration tests for attachment replacement scenarios Part 2 — Edit-comment logic alignment: - Add ExpandIssueIdentifiers to UpdateComment (bare identifiers now expand) - Add handleEditMentionDiff: diff old vs new agent/squad mentions on edit, cancel tasks for removed mentions, enqueue tasks for added mentions, cancel + re-trigger when content changes but mentions are unchanged Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Co-authored-by: multica-agent <github@multica.ai> * fix(sqlc): regenerate with v1.31.1 + add mention diff integration tests Fixes sqlc version downgrade (v1.31.1 → v1.30.0) that was introduced when the original PR was authored with a local v1.30.0 binary. Regenerated all sqlc output with v1.31.1 to match main. Adds integration tests for handleEditMentionDiff covering: edit adds mention → task enqueued, edit removes mention → task cancelled, edit changes content with same mentions → cancel + re-trigger. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Co-authored-by: multica-agent <github@multica.ai> * refactor(comments): simplify edit post-processing to cancel-all + re-trigger Replace handleEditMentionDiff (120-line mention diff) with a simpler model: when content changes, cancel all tasks triggered by this comment, then re-run the same three trigger paths as CreateComment (assignee, squad leader, mentions). Fixes gap where assignee/squad-leader tasks were not cancelled or re-triggered on edit. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Co-authored-by: multica-agent <github@multica.ai> * refactor(comments): extract triggerTasksForComment to unify Create/Edit trigger paths Create and Edit duplicated the same three trigger paths (assignee, squad leader, mentioned agents). A fourth path would need changes in two places. Extract into a shared function so the composition is: Create: trigger() + unresolve() Edit: cancel() + trigger() Delete: cancel() Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Co-authored-by: multica-agent <github@multica.ai> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> Co-authored-by: multica-agent <github@multica.ai>	2026-05-27 14:30:41 +08:00
Bohan Jiang	17714c3ad1	fix(create-issue): preserve parent_issue_id through Create with agent flow (MUL-2534) (#3083) ... * fix(create-issue): preserve parent_issue_id through Create with agent flow (MUL-2534) When the create-issue modal was opened from the "Add sub issue" entry on an existing issue and the user switched to "Create with agent", the parent_issue_id was silently dropped: switchToAgent only forwarded prompt + actor + project_id, the AgentCreatePanel had no notion of parent context, and the daemon prompt never instructed the agent to pass --parent <uuid>. The sub-issue intent was lost and the new issue landed as a standalone. This fix threads parent_issue_id through the whole pipeline silently — no new editable form field, the existing carry channel handles it: - Frontend: ManualCreatePanel.switchToAgent + AgentCreatePanel.switchToManual now carry parent_issue_id (and identifier, for display) so the sub-issue intent survives mode flips in either direction. AgentCreatePanel reads parent from `data`, forwards to api.quickCreateIssue, and renders a read-only "Sub-issue of MUL-XX" chip so the user can see the relationship. - API: quickCreateIssue accepts optional parent_issue_id. - Backend: QuickCreateIssueRequest validates parent_issue_id belongs to the same workspace (same path as CreateIssue), persists it in QuickCreateContext, and the daemon claim handler resolves the parent's identifier for prompt context. - Daemon prompt: when ParentIssueID is set, buildQuickCreatePrompt instructs the agent to pass `--parent <uuid>` and treat the modal entry point as authoritative. Tests cover all three hops: switchToAgent carry payload, AgentCreatePanel → api.quickCreateIssue, and the daemon prompt's --parent injection (with both identifier-present and UUID-only fallback branches). Co-authored-by: multica-agent <github@multica.ai> * test(create-issue): cover quick-create parent trust boundary + identifier fallback (MUL-2534) Address review on PR #3083: - Add server-side test for POST /api/issues/quick-create parent_issue_id: same-workspace parent threads through QuickCreateContext.ParentIssueID, foreign-workspace and bogus UUIDs return 400 and never enqueue a task. - Fall back to `data.parent_issue_identifier` in ManualCreatePanel's switchToAgent when the parent detail query hasn't hydrated yet, so the agent chip never renders "Sub-issue of " with an empty tail. Co-authored-by: multica-agent <github@multica.ai> --------- Co-authored-by: multica-agent <github@multica.ai>	2026-05-27 14:18:48 +08:00
Bohan Jiang	341ce7bfa5	feat: support local working directory for projects (MUL-2618 v1) (#3283) ... * feat(project): add local_directory project_resource type (MUL-2662) Adds a second project_resource type alongside github_repo so a project can be pinned to an existing directory on a specific daemon (the v1 of the local-working-directory flow tracked in MUL-2618). The ref schema is { local_path, daemon_id, label? }; local_path must be absolute and daemon_id is required. The same (daemon_id, local_path) pair is allowed on multiple projects by design — no UNIQUE constraint is added. Implementation reuses the existing project_resource API surface: the new type is wired through the validator switch with no migration, no new events, and no daemon-handler changes (daemon already passes through arbitrary resource types via ProjectResources). The CLI gains --local-path / --daemon-id / --ref-label shortcuts so `multica project resource add --type local_directory` mirrors the existing `--type github_repo --url ...` ergonomics; the generic --ref flag still works for both types. Tests cover the full CRUD lifecycle, the same-path-across-projects allowance, the same-path-same-project conflict, the validator rejections (missing/blank/relative path, missing daemon_id, wrong payload type), and the cross-platform isAbsoluteLocalPath helper. Co-authored-by: multica-agent <github@multica.ai> * feat(project): add update endpoint + label-shadow guard for project_resource (MUL-2662) Addresses the Elon review on PR #3263: - Add PUT /api/projects/{id}/resources/{resourceId} with sqlc query, matching handler, CLI `project resource update`, and a new EventProjectResourceUpdated WS event. resource_type stays immutable; ref/label/position are all individually optional. - Catch same-project (daemon_id, local_path) collisions where only the embedded label differs — the row-level UNIQUE only matches the full ref JSON, so a label typo would otherwise let the same working directory bind twice. - Tests cover the update lifecycle (label-only / ref / clear / 404 / invalid path) and the label-shadow conflict on both create and update; the in-place rename still succeeds because the conflict scan ignores the row being edited. Incidental: regenerating sqlc picked up a missing skills_local scan in UpdateAgentCustomEnv that drifted in from #3200. Co-authored-by: multica-agent <github@multica.ai> * fix(project): close bundled-create label-shadow gap + merge resource_ref on CLI update (MUL-2662) Two follow-ups from MUL-2662 review round 2: - CreateProject inline resources path now dedupes local_directory entries on (daemon_id, local_path) before opening the transaction. The DB-level UNIQUE(project_id, resource_type, resource_ref) constraint only fires on a full JSON match, so two rows with the same target but different `label` would otherwise slip past. Standalone POST/PUT already cover this via findLocalDirectoryConflict; bundled create was the missing surface. - `multica project resource update` now seeds resource_ref from the existing row before applying per-type shortcut flags, so `--default-branch-hint x` on its own no longer constructs a payload missing `url` (which the server 400s on). Local_directory partial edits get the same merge behavior. Co-authored-by: multica-agent <github@multica.ai> * feat(desktop): local_directory project_resource UI (MUL-2665) (#3273) * feat(desktop): local_directory project_resource UI (MUL-2665) First UI surface for the local-working-directory flow tracked in MUL-2618. Lets users on the desktop pin a project to an existing folder on this machine; web stays read-only since the per-daemon check can't be done in the browser. What's new for the renderer: - ProjectResourcesSection grows a desktop-only "Add local directory" button next to the existing GitHub-repo popover. Clicking it opens Electron's native folder picker, validates the path through a new IPC pair (existence + r/w), and submits a project_resource of resource_type=local_directory with daemon_id pulled live from daemonAPI.getStatus. - LocalDirectoryRow renders the rename pencil + path tooltip, and greys out when ref.daemon_id != this machine's daemon_id (with a "only available on the machine that registered this directory" tooltip). Delete stays enabled so users can drop stale registrations from any device. - LocalDirectoryHint sits above the issue-detail comment composer and shows "Agent will work in-place at {label} ({path})" when the issue's project has a local_directory matching this daemon. Hidden on web. - TaskStatusPill picks up a new "waiting_for_directory_release" stage that the daemon will publish when it dequeues a task but can't acquire the path lock. The render is in place now so the daemon sibling subtask can wire the status string without an additional UI PR. Plumbing: - @multica/core/types gains LocalDirectoryResourceRef + UpdateProjectResourceRequest, and the api client gets the matching PUT method backed by the server endpoint that landed in 2ac3faebb (MUL-2662). A useUpdateProjectResource hook drives the in-place label edit. - New Electron handlers under apps/desktop/src/main/local-directory.ts: local-directory:pick -> dialog.showOpenDialog (openDirectory) local-directory:validate -> stat + access(R_OK + W_OK) exposed through the preload as desktopAPI.pickDirectory / validateLocalDirectory. View code talks to them via a thin packages/views/platform helper that returns reason=unsupported on web instead of crashing. - useLocalDaemonStatus exposes the local daemon's id, device name, and running flag from daemonAPI.onStatusChange so the renderer can do the cross-device match without coupling to the desktop preload typings. Tests: - pickStageKeys gets a unit test covering the new stage and proving the directory-release status outranks availability hints. - LocalDirectoryHint tests cover the four render branches (no project, no daemon, foreign daemon, matching daemon). - i18n parity stays green; new keys added under projects.resources.* and chat.status_pill.stages.waiting_for_directory_release in both locales. Out of scope (will land separately): - The daemon-side waiting/lock signal that flips the pill into the new state. - Adding local_directory to the create-project modal's bulk attach flow. - Docs page refresh for project-resources.mdx — left for the MUL-2618 umbrella sweep. Co-authored-by: multica-agent <github@multica.ai> * fix(desktop): hide rename for foreign daemon local_directory rows (MUL-2618) Address review nit on #3273: the rename pencil was gated only by `canEdit`, so a foreign / unknown-daemon row still showed it even though the spec says cross-device rows are disabled. Gate rename on `!mismatch` so it disappears on those rows; delete stays available so a stale registration can still be dropped from any device. Co-authored-by: multica-agent <github@multica.ai> --------- Co-authored-by: multica-agent <github@multica.ai> * feat(daemon): local_directory execution + path mutex + GC exception (MUL-2663) (#3274) * feat(daemon): local_directory execution + path mutex + GC exception (MUL-2663) Wires up the daemon side of the local_directory project_resource introduced in MUL-2662. When a task is dispatched against a project whose resources include a local_directory pinned to this daemon's UUID, the daemon now: - Validates the path (absolute, exists, daemon process can read+write, not in the system-root / $HOME blacklist) and fails the task fast on any precondition violation, with a user-readable reason. - Serialises concurrent tasks on the same on-disk path via a daemon-local LocalPathLocker keyed by symlink-resolved realpath. The lock is held for the entire task lifetime (claim → context write → agent → result report). - When the lock is contended, the daemon flips the row to a new waiting_local_directory status on the server (carrying a wait_reason like "<path> (held by task <short id>)") so the UI can render "等待本地目录释放" instead of leaving the row silently in dispatched past the sweeper timeout. The status accepts being woken into running once the lock is acquired. - Sets execenv.WorkDir to the user's path (no copy, no mount). envRoot still lives under workspacesRoot/<wsID>/ and hosts output/, logs/, and .gc_meta.json — the daemon's logbook for the run. - Stamps GCMeta.LocalDirectory=true so the GC loop never RemoveAlls envRoot for these tasks (gcActionClean → gcActionCleanArtifacts, gcActionOrphan → gcActionSkip). The user's directory was never under envRoot to begin with, so this is defense in depth. - Skips execenv.Reuse for local_directory tasks because the prior WorkDir is the user's path and reusing it through that code path loses the envRoot association the GC loop needs. Prepare is cheap here (no clone, no copy), so always running it is fine. Server-side protocol changes: - New CHECK value 'waiting_local_directory' on agent_task_queue.status plus a wait_reason TEXT column (migration 109). - All cancel / active / counted-as-running / orphan-recovery queries expanded to include the new status; FailStaleTasks intentionally excludes it (the daemon owns the wait). - New SQL MarkAgentTaskWaitingLocalDirectory(id, reason) and a relaxed StartAgentTask that accepts both dispatched and waiting_local_directory as preconditions (and clears wait_reason on the way through). - New POST /api/daemon/tasks/{taskId}/wait-local-directory endpoint, TaskService.MarkTaskWaitingLocalDirectory broadcaster, and matching daemon Client.MarkTaskWaitingLocalDirectory. Tests cover: path blacklist + R/W enforcement, mutex serialisation + ctx-cancelled wait, lock handover between two tasks, GC never returns gcActionClean / gcActionOrphan for local_directory rows (with negative control for the standard path), and Prepare/Cleanup correctly substitute + protect the user's WorkDir. The desktop UI side (UI for adding a local_directory resource, surfacing the "等待本地目录" badge) is MUL-2665; the agent-task lifecycle changes (no branch switch, dirty-tree tolerant, auto-commit) are MUL-2664. This PR targets the shared MUL-2618 v1 feature branch agent/j/912b8cb1, not main; the whole v1 will be merged to main together when complete. Co-authored-by: multica-agent <github@multica.ai> * fix(daemon): tighten local_directory status, symlink, cancel handling (MUL-2618) Address the 3 must-fix items from Elon's review of PR #3274. 1. Status string unified. The server / daemon publish `waiting_local_directory`; align views, locales, and the pickStageKeys test (PR #3273 had used `waiting_for_directory_release` on a placeholder string). Without this, the daemon's wait state never reached the pill once the two siblings merged. 2. validateLocalPath now also runs the blacklist against the symlink-resolved realpath, with macOS's `/etc` -> `/private/etc` redirect handled via `isBlacklistedRealPath` which compares canonical forms. Without this, a symlink such as `/Users/me/proj/home -> /Users/me` slipped the literal $HOME check while every daemon write still landed in the user's home. Tests cover symlink-to-home, symlink-to-system-root, and the negative case (symlink to a regular subdirectory). 3. acquireLocalDirectoryLockIfNeeded now spins up a cancellation watcher inside `onWait` (lazy — the fast path stays free) so the gap between dispatch and StartTask responds to server-side cancel or row deletion. If the watcher fires while the daemon is parked on the path mutex, the lock-wait context is cancelled, Acquire returns promptly, and the helper exits silently the same way the run-phase poller does. New TestAcquireLocalDirectoryLock_CancelDuringWait exercises the path end-to-end with a fake server. Co-authored-by: multica-agent <github@multica.ai> * fix(daemon): unconditional canonical blacklist + Windows drive-root generalisation (MUL-2618) - validateLocalPath now always runs isBlacklistedRealPath on the symlink-resolved path, not only when it differs from absPath. The old guard let users type the canonical form of an OS-symlinked banned root (e.g. /private/tmp, /private/etc, /private/var on macOS) straight through, since EvalSymlinks is a no-op on already-canonical input. - Windows drive-root rejection moved off the static C/D/E/F enumeration onto filepath.VolumeName via a new isDriveRoot helper, so removable / network drives mounted at G:..Z: and UNC \\server\share roots are also blocked. systemRootBlacklist keeps the well-known C:\ trees only. - Tests: macOS-only case exercises direct /private/{tmp,etc,var}; a new TestIsDriveRoot covers the Windows generalisation (skipped on POSIX runners by runtime guard). Co-authored-by: multica-agent <github@multica.ai> --------- Co-authored-by: multica-agent <github@multica.ai> * feat(views): wire waiting_local_directory end-to-end in issue UI + presence (MUL-2618) Connect the daemon-emitted `task:waiting_local_directory` and `task:running` events through to issue execution log, sticky agent banner, activity indicator, and agent presence so a parked task is no longer invisible on the issue page. - Add `waiting_local_directory` to `AgentTask.status` and the typed `task:running` / `task:waiting_local_directory` WS event payloads. - Chat realtime sync writes both new statuses into the pending-task cache so the chat StatusPill flips out of a stale `dispatched` frame. - ExecutionLogSection: count `waiting_local_directory` as active, add tone + status label, treat parked tasks the same as dispatched for time anchor / transcript visibility / terminate-confirm note. - AgentLiveCard: subscribe to both new events, rank the parked state between dispatched and queued, and surface a "is waiting for the local directory" banner with the muted "Clock" treatment used for queued. - IssueAgentActivityIndicator: route parked tasks into the queued bucket so the hover stack and chip stay visible. - derive-presence: parked tasks count toward `queuedCount` so the agent workload chip stays out of `idle` while the daemon waits on the path lock. - Locales: add `agent_live.is_waiting_local_directory` and `execution_log.status_waiting_local_directory` (en + zh-Hans). Co-authored-by: multica-agent <github@multica.ai> * feat(project): enforce one local_directory per (project, daemon) (MUL-2618) The daemon-side resolver picks the first matching local_directory by daemon_id, so allowing two rows on the same daemon — even at different paths — let the agent silently write into whichever sorted first. Tighten the invariant top to bottom: - server: `findLocalDirectoryConflict` rejects any second row sharing a daemon_id, regardless of `local_path` or label. Bundled-create surface in `CreateProject` runs the same daemon-scoped dedupe up front. - daemon: `findLocalDirectoryAssignment` fails fast when it finds more than one row pinned to the current daemon (older API client / direct DB writes can still produce that state — refuse to guess). - desktop UI: hide the "Add local directory" action once the current daemon owns a row on this project, with a hint and a defensive toast on the call path; foreign-daemon rows stay visible read-only as before. - Tests: * daemon: new `two local_directory rows on this daemon fail fast` / `local_directory rows on different daemons coexist` cases. * handler: rewrite the legacy `LabelShadow` cases as `DaemonScopedConflict` / `BundledLocalDirectoryDaemonConflict` — asserts 409 on same-daemon different-path, 201 on per-daemon bundles. - Locales: en + zh-Hans copy for the new hint + toast. Co-authored-by: multica-agent <github@multica.ai> * chore(sqlc): drop stale skills_local in UpdateAgentCustomEnv (MUL-2618) Follow-up to the main-merge in 0f8e8ca7: the auto-merge preserved most of main's skills_local revert but kept the column reference inside the UpdateAgentCustomEnv scanner because that block hadn't been touched by either side. Re-running `sqlc generate` regenerates the file without skills_local in this query, matching the rest of the file and the post-revert schema. Co-authored-by: multica-agent <github@multica.ai> * feat(create-project): binary source picker — repos OR local directory Turn the create-project dialog's "Repos" pill into a binary Source picker. A project's source is mutually exclusive: either a set of GitHub repos (worktree mode, default) or a single local working directory (local mode, desktop-only). Mirrors the constraint the backend will enforce next. Behavior: - Pill shows the active mode's selection (GitHub icon + repo count, or folder icon + local label/path). - Popover has a 2-tab segmented control at the top; the Local tab is hidden entirely on web (local_directory needs a daemon_id). - Local tab requires the daemon online — amber notice + disabled picker when offline, re-renders automatically via useLocalDaemonStatus. - Switching tabs preserves the other side's stash, but handleSubmit only emits the resource matching the active sourceMode, so abandoned picks never leak into the created project. Backend mutual-exclusion validation + the resources-section conditional-add-button still to come — this PR just unblocks the dialog so it can be demoed. * fix(mobile): cover waiting_local_directory in run row status maps (MUL-2618) --------- Co-authored-by: multica-agent <github@multica.ai> Co-authored-by: Multica J <j@multica.ai>	2026-05-27 13:44:31 +08:00
Bohan Jiang	fa2a0e57ec	feat(views): swimlane supports parent / project / assignee grouping (MUL-2711) (#3311) ... * feat(views): swimlane supports parent / project / assignee grouping (MUL-2711) The swimlane view was hard-coded to group by parent issue. This adds a display dropdown so users can pick parent (default), project, or assignee — analogous to how the board view exposes its grouping option. - Generalise the lane builder in swimlane-view.tsx behind a `LaneGroup` abstraction (matcher + per-grouping `moveUpdates` payload) so the drag-end handler no longer branches on grouping. Cell ids gain a `<grouping>:<rawId>` prefix and lane sortable ids include the grouping so dnd-kit cannot collide entries from different groupings. - Extend the view store with `swimlaneGrouping`, `swimlaneOrders` (one saved order per grouping), and a grouping-keyed `collapsedSwimlanes`. The persist `merge` defends against the old `string[]` shape so a pre-upgrade snapshot doesn't crash on first read. - Wire `setSwimlaneGrouping` into the issues display popover next to the existing board grouping control. Add en / zh-Hans copy for the three swimlane buckets (Parent issue / Project / Assignee) and the two new pinned lanes (No project / Unassigned). - Expand swimlane tests with parent / project / assignee smoke cases and update existing mocks to the new lane-id format. Add stable `useActorName` / `projectListOptions` mocks to avoid the set-state-in-effect loop that an unstable `getActorName` would trigger via the cells-rebuild memo. Co-authored-by: multica-agent <github@multica.ai> * feat(views): default swimlane grouping to assignee Co-authored-by: multica-agent <github@multica.ai> --------- Co-authored-by: J <j@multica.ai> Co-authored-by: multica-agent <github@multica.ai>	2026-05-26 22:23:14 +08:00
Multica Eve	744b474199	revert(agent): remove per-agent local skill toggle (MUL-2603) (#3286) ... * Revert "feat(agents): hide skills_local toggle for runtimes that don't honour it (MUL-2603) (#3276)" This reverts commit 0b50c5a209. Co-authored-by: multica-agent <github@multica.ai> * Revert "fix(agent): surface host OAuth token via env var on macOS isolation (MUL-2603) (#3267)" This reverts commit a67bf81225. Co-authored-by: multica-agent <github@multica.ai> * Revert "fix(agents): tighten skills-tab intro and drop redundant import hint (#3265)" This reverts commit d8075a5775. Co-authored-by: multica-agent <github@multica.ai> * Revert "fix(agent): mirror $HOME/.claude.json into isolated config dir (MUL-2661) (#3261)" This reverts commit 40da88fc16. Co-authored-by: multica-agent <github@multica.ai> * Revert "feat(agent): per-agent toggle to isolate host-machine skills (MUL-2603) (#3200)" This reverts commit 960befa56f. Co-authored-by: multica-agent <github@multica.ai> * Add migration cleanup for reverted agent skills toggle Co-authored-by: multica-agent <github@multica.ai> --------- Co-authored-by: Eve <eve@multica-ai.local> Co-authored-by: multica-agent <github@multica.ai>	2026-05-26 17:00:01 +08:00
Bohan Jiang	057cb2ff34	fix(issues): thread sort through load-more so appended pages render (MUL-2678) (#3279) ... The recent server-side-sort change (#3228) keyed the issue-list cache by sort but did not update the load-more hooks: useLoadMoreByStatus used a prefix-match that could pick a stale cache variant, and neither hook forwarded sort to the API request. As a result, scroll-to-load-more fired its request, but the response was either appended to a cache no useQuery was subscribed to, or it appended rows in an unsorted order into a sorted bucket. Pass `sort` explicitly through Board/List/Swimlane and into the hooks. The hook now targets the full sorted key via setQueryData and forwards sort to the listIssues / listGroupedIssues calls so the appended page lines up with the existing items. Also adds focused tests for both load-more hooks: stale-sort cache is untouched, sort is forwarded to the API, and sort-less callers still hit the {} key path used by actor-issues-panel. Co-authored-by: multica-agent <github@multica.ai>	2026-05-26 16:27:33 +08:00
Bohan Jiang	0b50c5a209	feat(agents): hide skills_local toggle for runtimes that don't honour it (MUL-2603) (#3276) ... * feat(agents): hide skills_local toggle for runtimes that don't honour it (MUL-2603) Only Claude Code and Codex runtimes actually enforce `skills_local` at exec time today — Claude isolates `~/.claude/skills/` via `CLAUDE_CONFIG_DIR`, Codex isolates `~/.codex/skills/` via per-task `CODEX_HOME`. Every other runtime currently stores the field but treats it as a no-op, which made the toggle in the Create Agent dialog and Skills tab misleading for those runtimes. Gate the toggle on `runtime.provider` so it only renders for the providers the daemon currently isolates. Centralise the supported-provider list as `isSkillsLocalSupportedProvider()` in `packages/core/agents` and reuse it from the create dialog and the Skills tab. The create dialog also drops `skills_local` from the payload when the selected runtime is unsupported, so a runtime swap can't leave a stale `ignore` opt-in pinned where it would never take effect. Docs (EN + ZH) updated to say the toggle is hidden — not just "a no-op" — for the unsupported runtimes. Co-authored-by: multica-agent <github@multica.ai> * docs(agents): align skills_local hint and type comment with claude+codex boundary Co-authored-by: multica-agent <github@multica.ai> --------- Co-authored-by: multica-agent <github@multica.ai>	2026-05-26 16:09:51 +08:00
Anderson Shindy Oki	65ed5744a6	feat: add issue view swimlane (MUL-2607) (#3149) ... * feat: Add swimlane view * refactor * test: add tests * wip * wip * wip * refactor * refactor and fixes * refactor * fix: parent empty cells * chore: Remove meanless comments * remove meanless comments	2026-05-26 15:22:16 +08:00
LinYushen	bf8a346cf0	feat(runtimes): cascade-archive agents on runtime delete (MUL-2667) (#3266) ... * feat(runtimes): cascade-archive agents on runtime delete (MUL-2667) Replace the bare 409 "cannot delete runtime: it has active agents" with a structured response carrying the blocking agent list, and wire a cascade endpoint that archives those agents, cancels their tasks, pauses dangling autopilots and deletes the runtime in a single transaction. The unified DeleteRuntimeDialog opens directly in cascade mode when the runtime has bound agents, pivots from light to cascade if the strict DELETE refuses with runtime_has_active_agents, and re-prompts when the cascade refuses with runtime_delete_plan_changed (live agent set drifted while the dialog was open). The online-local self-healing rule is preserved at the affordance level (kebab hidden, Diagnostics button disabled with tooltip) and re-checked at confirm time as defence in depth. Co-authored-by: multica-agent <github@multica.ai> * fix(runtimes): close cascade race + i18n delete dialog (PR #3266 review) - Acquire FOR UPDATE on the runtime row at the top of the cascade tx so FK-validated agent INSERTs/UPDATEs that would point at this runtime block until commit, and lock each currently-active agent row via ListActiveAgentsByRuntimeForUpdate so a concurrent archive/move of an existing active row also blocks. - Switch the bulk archive from runtime-keyed (ArchiveAgentsByRuntime) to ID-keyed (ArchiveAgentsByIDs), narrowed to the user-confirmed expected_active_agent_ids set. Combined with the runtime row lock, this guarantees no agent outside the confirmed plan can be silently archived between plan-compare and archive even at read-committed. - Wire delete-runtime-dialog.tsx to runtimes locale via useT(); add detail.delete_dialog.{light,cascade} keys (EN with _one/_other plurals, zh-Hans _other) covering titles, descriptions, warning, notices, checkbox, buttons, table headers, presence labels, and toasts. Resolves the i18next/no-literal-string CI failure. - Locale parity test passes (51 tests). All 4 dialog test cases pass unmodified (EN copy preserves original wording). Full views vitest: 91 files / 792 tests green; full server go test: green. Co-authored-by: multica-agent <github@multica.ai> --------- Co-authored-by: multica-agent <github@multica.ai>	2026-05-26 14:59:38 +08:00
Naiyuan Qing	612ac8f28e	feat(issues): server-side sort + fix drag position corruption (#3228) ... * refactor(editor): split rich text styles * feat(issues): server-side sort + fix drag position corruption in non-manual sort Backend: ListIssues and ListGroupedIssues now accept `sort` and `direction` query params (position/priority/title/created_at/start_date/due_date). ListIssues converted from sqlc to hand-written SQL for dynamic ORDER BY. Priority sort uses CASE expression for semantic ordering. Frontend: query keys include sort so changing sort triggers server refetch. Client-side sortIssues() removed from board-view and list-view. Drag-and-drop: non-manual sort disables within-column reorder (prevents silent position corruption). Cross-column drag only updates status/assignee, preserves original position. Column overlay shows current sort during drag. Cache: query key split into prefix (list) for invalidation and full key (listSorted) for queryOptions. All optimistic update paths use prefix matching via getQueriesData to work with any active sort. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(board): prevent drag flicker by settling columns until mutation refetch After drag-and-drop, the optimistic cache patch updates position values without reordering the bucket array. The useEffect that rebuilds columns from TQ data would overwrite the correct local drag order, causing cards to snap back then forward. Fix: isSettlingRef blocks column rebuilds between drag end and mutation onSettled. Also invalidate issueKeys.list on WS position changes so other windows refetch correctly sorted data instead of showing stale bucket order. Includes debug logs (to be removed after verification). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(board): stabilize drag-and-drop for non-manual sort modes Three behavioral fixes for board drag when sort != position: 1. Settling: isSettlingRef + settleVersion blocks column rebuilds between drag-end and mutation settle, preventing the optimistic cache patch (which updates position values without reordering the bucket array) from overwriting the correct local column state. 2. Non-manual cross-column: handleDragOver returns prev (no visual card movement — column highlight + sort label is sufficient). handleDragEnd uses overCol directly instead of findColumn on the card's current position (which would be the source column). Cards use useSortable({ disabled: { droppable: true } }) to suppress within-column insertion indicators. 3. Collision detection: when no card droppables exist (disabled in non-manual sort), return column droppables from pointerWithin instead of falling through to closestCenter, so isOver reflects the column the pointer is actually inside. Also: WS position changes now invalidate issueKeys.list so other windows refetch correctly sorted data. Insertion-position prediction intentionally omitted — PostgreSQL's en_US.utf8 collation (glibc) cannot be faithfully replicated in JavaScript (ICU/V8), and an inaccurate indicator is worse than none. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(sort): manual sort ignores direction param on both ends Manual sort (position) is user-defined order via drag-and-drop — reversing it has no product meaning. Backend: sort=position now skips the direction query param and always uses ASC. Both ListIssues and ListGroupedIssues handlers. Frontend: sort object omits sort_direction when sortBy is position. Direction toggle hidden in the display popover for manual mode. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * perf(board): memo columns + stabilize references to reduce re-renders - BoardColumn, PaginatedBoardColumn, PaginatedAssigneeBoardColumn wrapped in memo() — only columns with changed props re-render - IssueAgentActivityIndicator wrapped in memo() — 111 snapshot subscribers no longer trigger full re-render on every WS task event - buildColumns rewritten from O(groups × issues) to single-pass O(n) - EMPTY_IDS constant replaces ?? [] fallbacks (stable reference) - EMPTY_CHILD_PROGRESS constant replaces new Map() default - BOARD_COL_WIDTH / BOARD_CARD_WIDTH constants shared between column and DragOverlay for consistent card dimensions - issueListOptions + issueAssigneeGroupsOptions use placeholderData: keepPreviousData so sort/filter changes don't flash a full-page skeleton - Loading skeleton scoped to content area only — header stays rendered during data transitions Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: remove outdated server-side sort implementation plan Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-26 14:50:25 +08:00
Bohan Jiang	960befa56f	feat(agent): per-agent toggle to isolate host-machine skills (MUL-2603) (#3200) ... * feat(agent): per-agent toggle to isolate host-machine skills (MUL-2603) Adds an agent-scoped `skills_local` switch ("ignore" default / "merge") so shared agents stop inheriting the operator's user-global Claude skill directory. A single broken local skill on one operator's machine was crashing the Claude CLI before it ever read stdin — the daemon saw a "broken pipe" with no recoverable signal (GitHub #3052). - DB: migration 108 adds `agent.skills_local` (NOT NULL DEFAULT 'ignore'), with sqlc CreateAgent/UpdateAgent updates and handler validation. - Claude runtime: when the agent is in "ignore" mode the backend points CLAUDE_CONFIG_DIR at an empty per-task scratch dir under the task cwd (fallback: OS temp), strips any inherited override, and cleans up after the run. Workspace skills under `{cwd}/.claude/skills/` still load. "merge" preserves the legacy inherit-from-machine behavior; Codex and other isolated backends are no-ops. - UI: new Skills toggle in the Create Agent dialog and the Agent → Skills tab, with EN/zh-Hans copy and SkillsLocalToggle shared between the two. - Tests: unit coverage for the new env helper, isolation dir lifecycle, full Claude execute paths (ignore + merge), and the handler tristate contract. Existing skills-tab test updated for the new copy. - Docs: updated `/skills` docs (EN + ZH) and added a 0.3.7 changelog entry in the landing-page i18n. Co-authored-by: multica-agent <github@multica.ai> * fix(agent): preserve claude login + validate skills_local input (MUL-2603) Address Elon's review on PR #3200: 1. Skill isolation no longer drops the operator's Claude login. The per-task scratch dir now mirrors every entry under `~/.claude/` as symlinks except `skills/`, so `.credentials.json`, settings, plugins, etc. reach the CLI exactly as on the host while the user-global skills directory stays hidden. Without this, default `ignore` would have broken every Claude agent on a non-API-key host the moment migration 108 landed. 2. Internal CreateAgent callers (agent_template, onboarding_shim) now set `SkillsLocal: "ignore"`. The Go zero value was about to trip the migration-108 CHECK constraint and 500 template / onboarding agent creation. 3. Create / update handler validation no longer normalizes garbage to "ignore". The strict 400 path is now reachable on bad client input; the drift-safe `normalizeSkillsLocal` stays on the read side only. UI copy + docs clarified that the toggle is Claude-only; other runtimes ignore the setting. Verification: - `go test ./...` green (full suite locally). - `pnpm --filter @multica/views exec vitest run agents/components/tabs/skills-tab.test.tsx` green. - Handler DB-backed tests still skip locally without docker (same as Elon's run) — CI will validate the create / update paths against migration 108. Co-authored-by: multica-agent <github@multica.ai> * fix(agent): mirror effective claude config dir with windows fallback (MUL-2603) Address Elon's second-round review on PR #3200: 1. The per-task scratch dir now mirrors the *effective* host Claude config dir, not unconditionally `~/.claude/`. Precedence: agent `custom_env` CLAUDE_CONFIG_DIR > parent process env > `~/.claude/`. Without this, an operator who pinned Claude at a managed install (custom env CLAUDE_CONFIG_DIR) would get the wrong credentials in the scratch dir, because `buildClaudeEnv` strips that env before handing it to the child. We resolve the source up front and feed it to the mirror, so the override env still points at the right bytes. 2. Mirror entries now go through platform-aware linkers. On Windows without Developer Mode / admin, `os.Symlink` is denied, which previously left the scratch dir empty and broke Claude Code auth on default `ignore`. The new helpers try symlink first, then fall back to a directory junction (`mklink /J`) for dirs or a hardlink (same-volume content share) / copy for files. Mirrors the execenv/codex_home_link_windows.go pattern. 3. Tests: - `TestResolveHostClaudeConfigDir` locks in the custom_env > parent_env > `~/.claude` precedence. - `TestNewIsolatedClaudeConfigDirMirrorsCustomHostDir` confirms the scratch dir picks up `.credentials.json` from a synthetic custom host dir, proving the source resolution actually propagates into the mirror. - `TestNewIsolatedClaudeConfigDirEmptyHostIsNoop` documents the env-var-auth-only case (no host source ⇒ empty scratch dir). - `TestMirrorHostClaudeExceptSkillsWith_FallbackWhenSymlinkFails` exercises the Windows-no-Developer-Mode path via the new `mirrorHostClaudeExceptSkillsWith` seam, asserting credentials and sub-dir children still reach the scratch dir after the symlink stand-in fails. - `TestMirrorHostClaudeExceptSkillsWith_PropagatesFirstLinkError` confirms callers see the per-entry error when even fallback fails (so the warn-log fires on broken Windows installs). - `TestCopyFileRoundTrip` covers the last-resort copy fallback and its EXCL no-overwrite contract. - `TestClaudeExecuteIsolatesUsesCustomEnvSource` is the end-to-end check: an agent with custom_env CLAUDE_CONFIG_DIR reads its credentials from the pinned dir, not `~/.claude/`. 4. Docs: `apps/docs/content/docs/skills.{mdx,zh.mdx}` updated to describe the effective-source resolution and the Windows fallback chain so the docs match the runtime behaviour. Verification: - `go test ./...` green (full server suite locally, including `pkg/agent` 23 cases covering the new + existing isolation paths). - `GOOS=windows GOARCH=amd64 go vet ./pkg/agent/...` and `go test -c -o /dev/null` both compile clean, confirming the Windows-tagged linker file builds. Co-authored-by: multica-agent <github@multica.ai> * fix(agent): default skills_local to merge to preserve legacy behavior (MUL-2603) Per Bohan's product decision on PR #3200, the per-agent host-skill toggle defaults to "merge" — the pre-MUL-2603 inherit-from-machine behavior — so existing personal workflows that rely on locally installed Claude Skills keep working unchanged. Agent owners explicitly opt into "ignore" when they need to harden a shared agent against a broken local skill on one operator's machine (GitHub #3052). Also audited all 11 runtimes for user-global skill discovery paths and documented the scope of the toggle. Only Claude reads a user-global `~/.claude/skills/`; Codex isolates via `CODEX_HOME`, the ACP backends (Hermes / Kimi / Kiro) and the JSON-stream backends (Copilot / Cursor / Gemini / Pi / OpenCode / OpenClaw) anchor discovery to the task workdir and never read a user-global skill directory. UI copy and docs now say "for runtimes that support it (currently Claude Code)" everywhere so the scope is explicit. Changes: - Migration 108: column default flipped to 'merge'. - Handler CreateAgent: missing field → "merge"; explicit "ignore" / "merge" still validated, garbage still 400. - normalizeSkillsLocal: drift-safe coercion now lands on "merge" for anything that isn't the exact literal "ignore". - agent_template.go / onboarding_shim.go: internal CreateAgent callers send "merge" instead of "ignore" to match the new default. - Claude runtime (`claude.go`): isolate-mode gate flipped from `SkillsLocal != "merge"` to `SkillsLocal == "ignore"`, so "" (legacy daemons / older clients) and "merge" both walk `~/.claude/` directly. - Create Agent dialog + Skills tab: toggle defaults to on (merge); only duplicate of an explicit "ignore" agent carries through. The isolation opt-in is now `skills_local: "ignore"` when the user flips off; "merge" is omitted from the request body. - i18n (EN + zh-Hans): copy reframed — "On (default) — merged"; "Off — ignored. Recommended for shared agents". - Docs (`/skills`, `/guides/agents.zh`): describe new default and enumerate which runtimes act on the toggle. - Landing changelog 0.3.7: retitled "Per-Agent Local-Skill Toggle"; note the on-by-default behavior + off-to-isolate framing. - Tests: - `TestClaudeExecuteIsolatesHostSkillsWhenIgnoreOptedIn` replaces the old by-default isolation case (now requires explicit "ignore"). - New `TestClaudeExecuteDefaultModeKeepsHostConfigDir` locks in that default ExecOptions preserve the host CLAUDE_CONFIG_DIR. - `TestClaudeExecuteIsolatesUsesCustomEnvSource` now explicitly opts into "ignore" mode. - Handler tests: omitted → "merge"; explicit "ignore" round-trips; preserve-existing test seeds "ignore" and asserts "merge" flip-back. - `TestNormalizeSkillsLocal_DriftStaysSafe`: only literal "ignore" maps to ignore; everything else → "merge". - `skills-tab.test.tsx`: toggle ON by default; flip OFF when agent opted into "ignore". Intro-text matcher anchored to a more specific phrase so it no longer collides with the toggle hint copy. Verification: - `go test ./...` green (full server suite locally). - `GOOS=windows GOARCH=amd64 go vet ./pkg/agent/...` and `go test -c -o /dev/null` both compile clean (windows-tagged linker file still builds). - `pnpm typecheck` green across all packages and apps. - `pnpm --filter @multica/views test` 88 files / 771 tests green. - `pnpm --filter @multica/core test` 43 files / 390 tests green. - Handler DB-backed tests still skip locally without docker; CI will validate the create / update paths against migration 108. Co-authored-by: multica-agent <github@multica.ai> * chore(landing): drop 0.3.7 changelog entry from this PR (MUL-2603) The landing-page release notes belong in a separate release-prep PR, not in the feature PR. Co-authored-by: multica-agent <github@multica.ai> * fix(agent): propagate skills_local=ignore to codex user-skill seed (MUL-2603) Make the per-agent skills_local toggle real for Codex too, not just Claude. Previously the toggle was only consumed by the Claude backend, while the daemon's execenv layer always seeded Codex's per-task CODEX_HOME with the host machine's user-installed skills from ~/.codex/skills/. A shared Codex agent with skills_local=ignore could still inherit a broken local skill from one operator's machine. Now: PrepareParams/ReuseParams carry SkillsLocal; hydrateCodexSkills skips seedUserCodexSkills when SkillsLocal == "ignore" so the per-task CODEX_HOME exposes only workspace skills to the codex CLI. Default ("merge", or empty from older servers/clients) preserves existing inherit-from-machine behavior. UI / docs are updated to reflect the contract honestly: Claude Code and Codex honor the toggle; other runtimes (Hermes / Kimi / Kiro / Copilot / Cursor / Gemini / Pi / OpenCode / OpenClaw) leave $HOME untouched and discover user-level skills natively, so the toggle is a no-op for them today. New tests: TestPrepareCodexSkillsLocalIgnoreSkipsUserSeed, TestPrepareCodexSkillsLocalMergeSeedsUserSkills, and TestReuseCodexSkillsLocalIgnoreSkipsUserSeed cover Prepare(ignore), Prepare(merge), and the toggle-flip-on-reuse path. Co-authored-by: multica-agent <github@multica.ai> * docs(skills): scope skills_local toggle copy to Claude Code + Codex (MUL-2603) Off-state hint and Skills tab intro now explicitly call out Claude Code + Codex as the only runtimes that honor the toggle, with "other runtimes ignore this setting" wired into both states (en + zh-Hans), so users on non-Claude/Codex agents don't read "Off" as runtime-wide isolation. Docs (skills.mdx, skills.zh.mdx, guides/agents.zh.mdx) stop describing Hermes / Kimi / Gemini / Copilot / Cursor / Pi / OpenCode / OpenClaw / Kiro as having native user-level skill discovery; the daemon simply does not manage user-level skill discovery for those runtimes today, and the toggle is a no-op regardless of where it is set. Co-authored-by: multica-agent <github@multica.ai> --------- Co-authored-by: multica-agent <github@multica.ai>	2026-05-26 13:26:33 +08:00
Naiyuan Qing	ec1589f7b6	fix(deps): add eslint phantom dep detection + fix existing violations (MUL-2654) (#3249) ... * fix(deps): add eslint phantom dep detection + fix existing violations (MUL-2654) Introduce eslint-plugin-import-x/no-extraneous-dependencies rule to prevent phantom deps from causing production build splits when pnpm creates peer-dep variants. Fix all existing phantom deps across the monorepo, unify catalog references, and enable desktop smoke CI on PRs. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Co-authored-by: multica-agent <github@multica.ai> * revert(ci): remove desktop smoke PR trigger per user feedback The existing smoke workflow only verifies packaging completes — it does not actually start the app or check rendering. This means it wouldn't have caught the white-screen bug (which was a runtime issue, not a build failure). Adding it to PRs would slow CI without providing meaningful protection. The ESLint no-extraneous-dependencies rule is the actual prevention mechanism. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Co-authored-by: multica-agent <github@multica.ai> * fix(deps): sync pnpm-lock.yaml for rehype-sanitize dep classification Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Co-authored-by: multica-agent <github@multica.ai> * fix(ui): move rehype-sanitize to deps + declare eslint-config (MUL-2654) - Move rehype-sanitize from devDependencies to dependencies (used in production Markdown.tsx) - Add @multica/eslint-config to devDependencies (imported by eslint.config.mjs but previously undeclared) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Co-authored-by: multica-agent <github@multica.ai> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> Co-authored-by: multica-agent <github@multica.ai>	2026-05-26 09:42:29 +08:00
Bohan Jiang	13f74e651a	feat(agents): remove custom_env from agent resources, add audited env endpoint (MUL-2600) (#3209) ... * feat(agents): remove custom_env from agent resources, add audited env endpoint (MUL-2600) The agent resource shape (list / get / create / update / archive / restore responses + WebSocket events) no longer carries `custom_env` values. Reads/writes of env now flow exclusively through a dedicated `/api/agents/{id}/env` endpoint that is owner/admin-only, rejects agent-actor sessions, applies a "****" sentinel preserve guard on PUT, and writes a persistent audit row per reveal/update. Why - `multica agent list --output json` historically returned plaintext `custom_env` for owner/admin callers (the redaction gate gave only members the masked map). Any agent token running on the workspace inherits its owner's role and could read every other agent's secrets just by listing. - Patching list/get redaction alone (PR #3175 direction) left symmetric leaks via mutation responses, WS events, the "reveal" path itself (no actor-aware auth), and a `****` overwrite footgun on UpdateAgent. What changed - Backend: drop `custom_env` from AgentResponse; add coarse `has_custom_env` + `custom_env_key_count`. Strip env handling from UpdateAgent (silently ignored if sent). Keep CreateAgent's custom_env acceptance. - Backend: new GET/PUT `/api/agents/{id}/env` handlers in `internal/handler/agent_env.go`: - resolveActor → 403 for agent actors (closes the lateral-movement path). - Owner/admin role gate via existing helper. - PUT honours value == "****" as "preserve existing value". - Both write to `activity_log` with `agent_env_revealed` / `agent_env_updated` actions. Audit details record key names only, never values. - Daemon claim path (`ClaimAgentTask`) unchanged — `TaskAgentData` still carries plaintext env for runtime injection. - SQL: new `UpdateAgentCustomEnv` query; sqlc regenerated (v1.31.1). - CLI: new `multica agent env get|set` subcommands. `--custom-env*` flags removed from `multica agent update`; the no-fields error now points to the new path. - Frontend: drop env fields from `Agent` + `UpdateAgentRequest`; add `getAgentEnv` / `updateAgentEnv` client methods; rewrite env-tab to show "N variables configured" + explicit "Reveal & edit" button, fetching values only on intentional reveal. - Locales: parity-safe additions to en + zh-Hans. - Docs: agents-create.{mdx,zh.mdx} reflect the new threat model and endpoint. - Mobile: schema drops `custom_env` / `custom_env_redacted`, adds metadata fields. Tests - Handler tests pinned the new invariants: no env in list/get responses, owner reveal happy-path + audit row, agent-actor 403, `****` sentinel preserves real values, UpdateAgent silently ignores `custom_env`, pure `mergeAgentEnv` cases. - CLI tests pivot to the new flag surface: `agent update` MUST NOT expose the env flags; `agent env set` MUST expose --custom-env-stdin/--custom-env-file. - Frontend test fixtures updated; pnpm typecheck / test / lint pass cleanly. This is a breaking API change. Scripts that read `custom_env` from `/api/agents` must migrate to `GET /api/agents/{id}/env`. Co-authored-by: multica-agent <github@multica.ai> * fix(agents): close actor-spoofing + audit fail-closed in env endpoints (MUL-2600) Addresses Elon's review of #3209: * Mint a task-scoped `mat_` token per claim, bound to (agent, task, workspace, owner). Daemon injects it into the agent process in place of its own credential. Auth middleware authoritatively rebuilds X-User-ID / X-Agent-ID / X-Task-ID from the token row and sets X-Actor-Source=task_token; that header is server-set only — incoming values are stripped before any auth branch runs. resolveActor honors the header so an agent that strips X-Agent-ID / X-Task-ID still resolves as actor=agent. * GetAgentEnv / UpdateAgentEnv are now fail-closed on audit-log failures: GET refuses to return plaintext, PUT persists inside the same tx as the audit row so they commit/roll back together. * PUT /api/agents/{id} returns 400 when the body carries custom_env instead of silently dropping it — directs callers to the audited env endpoint. * Agent actors never see mcp_config, even when the underlying member is owner/admin; mutation broadcasts go through a redaction shim so WS subscribers don't pick it up either. * Fix backend test that asserted dense JSON (jsonb::text renders whitespace) and frontend test that assumed a unique "Test User" match. Co-authored-by: multica-agent <github@multica.ai> * fix(agents): close residual MUL-2600 gaps from review (MUL-2600) Migration 108 FK now correctly references agent_task_queue(id) instead of the non-existent agent_task table; the previous name blocked CI backend migrations. Task-token-authenticated requests can no longer be re-routed at a different workspace by passing workspace_slug / workspace_id / ?workspace_id / a URL workspace param. ResolveWorkspaceIDFromRequest and resolveWorkspaceUUID both short-circuit on X-Actor-Source=task_token and return only the token-bound X-Workspace-ID; buildMiddleware adds a defence-in-depth 403 if any URL-resolved workspace disagrees with the token binding. mcp_config no longer leaks back to agent actors through UpdateAgent / CreateAgent / ArchiveAgent / RestoreAgent HTTP responses — the same redactAgentResponseForActor helper that GetAgent/ListAgents use is now applied to mutation responses too. WS broadcasts were already redacted via broadcastAgentResponse. FailTask and every TaskService cancel path (CancelTask / CancelTasksForIssue / CancelTasksForAgent / CancelTasksByTriggerComment / BroadcastCancelledTasks) now eagerly DeleteTaskTokensByTask so the mat_ token's 24h window doesn't outlive a terminated task. Failure is non-fatal — the FK cascade and expiry remain durable guards. Doc-only: clarify that PUT /api/agents/{id} now hard-rejects bodies that carry custom_env (was previously "silently ignores"). Tests: - middleware: TestResolveWorkspaceIDFromRequest gains a task_token case asserting client-supplied slug/id/query cannot override the bound workspace. - handler: TestUpdateAgent_RedactsMcpConfigForAgentActor and TestUpdateAgent_KeepsMcpConfigForMemberActor pin the mutation- response redaction contract per actor type. Co-authored-by: multica-agent <github@multica.ai> * fix(agents): match redacted mcp_config as JSON null, not Go nil (MUL-2600) `AgentResponse.McpConfig` is `json.RawMessage` without `omitempty`, so the redacted response serialises as `"mcp_config": null`. On decode, `json.RawMessage` keeps the literal bytes `null` rather than collapsing to Go nil, which made the assertion fire on a non-leak. The product contract (field always present, distinguished from "no config" via `mcp_config_redacted`) is intentional, so adjust the test to check for "no secret-bearing content" instead of weakening the contract via `omitempty`. Co-authored-by: multica-agent <github@multica.ai> --------- Co-authored-by: multica-agent <github@multica.ai>	2026-05-25 18:42:48 +08:00
LinYushen	a8cda1bd96	feat: add description field to workspace repository settings (#3198) ... - Add optional description field to WorkspaceRepo type - Show description input below URL in edit mode - Display description text in view mode - Update isDirty to compare descriptions - Update tests for new field Co-authored-by: multica-agent <github@multica.ai>	2026-05-25 14:51:24 +08:00
Naiyuan Qing	6261ea45fd	Improve board and squad hover cards (#3188)	2026-05-25 12:58:39 +08:00
lucccf	077bc055f7	fix(views): sort timeline entries by created_at on WebSocket append (MUL-2582) (#3139) ... * fix: sort timeline entries by created_at on WebSocket append When multiple agents post comments concurrently, WebSocket events may arrive out of chronological order. The handlers blindly appended new entries to the end of the cached timeline array, causing display misordering. This fix sorts the array by created_at (with id as tie-breaker) after each insert. Changes: - use-issue-timeline.ts: sort after comment:created and activity:created - issue-ws-updaters.ts: sort in appendTimelineEntry Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(views): extract sortTimelineEntriesAsc helper, cover mutation onSuccess Review feedback from @Bohan-J: useCreateComment.onSuccess also appends unsorted (mutations.ts:558). When the local user posts a comment whose HTTP response returns after a concurrent WS event, the unsorted append leaves the cache misordered and the subsequent WS dedup skips re-sort. Extract sortTimelineEntriesAsc helper and reuse it in all three web cache writers: - comment:created WS handler - activity:created WS handler - useCreateComment.onSuccess Mobile keeps its own inline sort (apps/mobile/CLAUDE.md boundary). Add regression tests for sort position (mid-insert and oldest-insert). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-25 12:54:09 +08:00
Naiyuan Qing	5f1f08e466	feat(web): add use-cases content pipeline with welcome page (MUL-2349) (#2795) ... * feat(web): add use-cases content pipeline with welcome page (MUL-2349) Wire fumadocs-mdx into apps/web with an independent collection rooted at content/use-cases/. Add the first page at /use-cases/welcome (header + H1 + prose + screenshot + footer) using the about-page visual shell. - source.config.ts + lib/use-cases-source.ts (separate from apps/docs) - features/landing/components/mdx/screenshot.tsx wraps next/image - public/use-cases/welcome/screenshot-1.png placeholder (55KB) - next.config.ts wraps NextConfig with createMDX() - .gitignore + eslint ignore .source/ Co-authored-by: multica-agent <github@multica.ai> * feat(web): bilingual db-boy use case with cookie locale (MUL-2349) Extends the use-cases pipeline into the first real article. - ZH + EN MDX (auto-data-analysis.{zh,en}.mdx) sharing three real screenshots; sensitive fields on db-boy-profile.png (RDS host, DB name, password) are blurred in-place. - Cookie-based locale: /use-cases/<slug> reads multica-locale server-side via lib/use-cases-i18n.ts (mirrors LandingLayout's cookie + Accept-Language fallback). Same URL serves either language; no [lang] segment so all other landing routes stay unchanged. - Frontmatter schema (source.config.ts): z.looseObject with declared hero_image / updated_at (required) / category (optional); a preprocess converts YAML-auto-parsed Date back to a YYYY-MM-DD string. - MDX components factory createMdxComponents(locale) routes the secondary CTA to /docs/zh (ZH) or /docs (EN); internal MDX links use <Link> for SPA nav; full-width and half-width colons both trigger [CTA: ...] / [占位图: ...] markers; 副 and Secondary both work as the secondary CTA prefix. - Index page localizes hero / subtitle / card CTA / metadata; sort fallback uses an epoch placeholder so undefined-order disappears. - Landing header + footer surface use-cases entry in both locales. - Detail route: sticky header, right-rail TOC with anchor jumps, scroll-mt-[100px] on H2/H3 so anchor jumps don't slip under the sticky header. - Drop welcome demo page. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(web): resolve code review blockers on use-cases PR - Add `use-cases` to reserved_slugs.json + regenerate TS (P1: prevent future workspace slug collision) - Fix dead links in both MDX files: /features/* → /docs/* (P2) - Remove duplicate brand suffix in page title metadata (nit) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Co-authored-by: multica-agent <github@multica.ai> * fix(web): align usecases locale routing * chore: refresh web mdx lockfile * fix(web): type mdx next config adapter * fix(web): wrap settings route page --------- Co-authored-by: multica-agent <github@multica.ai> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-25 10:05:17 +08:00
Naiyuan Qing	fd0fe1d08a	feat(mobile): Multica for iOS — first version (#2337) ... * docs(mobile): establish independence rules and tech-stack baseline - Refactor root CLAUDE.md sharing rules into a single Sharing Principles section, replacing scattered mentions across 10 places with one source of truth + minimal "(web + desktop)" qualifiers on existing sections - Add apps/mobile/CLAUDE.md with locked tech-stack baseline: Expo SDK 54, React Native 0.81, NativeWind 4 + Tailwind 3.4, react-native-reusables, TanStack Query 5, Zustand, expo-secure-store - Mobile pins React directly (does NOT track root catalog:) so the Expo SDK / RN release schedule isn't blocked by web/desktop upgrades - Visual tokens are mobile-owned (transcribed from packages/ui/styles/ tokens.css by hand, not imported); Tailwind v3.4 vs v4 mismatch makes file sharing impractical anyway - Document mobile build/release pipeline (main CI excludes mobile, separate mobile-verify and mobile-release workflows, EAS Update for OTA) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): v1 shell — auth, workspace switching, inbox + my-issues - Auth: email OTP login mirroring packages/core/auth/store.ts behavior (401 clears token, non-401 preserves; token written only on verify success); expo-secure-store with key "multica_token" matching desktop - Workspace context: /[workspace]/ URL slug as source of truth (deep- link friendly), ApiClient auto-injects X-Workspace-Slug, SecureStore persists last-selected slug for cold-start restore - Bottom tabs (Ionicons): Inbox / My Issues / Settings - Inbox: actor avatar, unread brand-dot, status icon, time-ago + body subtitle. getInboxDisplayTitle mirrored from packages/views/inbox/ components/inbox-display.ts - My Issues: priority bars (matching IssuePriority bar counts from packages/core/issues/config/priority.ts), status dot, identifier, title, assignee avatar - Settings: account info + workspace switcher; switching replaces nav to /[newSlug]/inbox so back stack doesn't trail to old workspace - Multi-env: .env.staging / .env.production / .env.development.local with EXPO_PUBLIC_API_URL; APP_ENV in app.config.ts swaps bundleIdentifier so dev/staging/prod coexist on a device - Build: dev:mobile + dev:mobile:staging scripts; main turbo build/typecheck/lint/test filter excludes @multica/mobile Tech-stack (locked in apps/mobile/CLAUDE.md): - Expo SDK 55, RN 0.83.6, React 19.2.0 (pinned, NOT catalog) - NativeWind 4 + Tailwind 3.4 (intentional mismatch w/ web's Tailwind 4; visual tokens transcribed by hand from packages/ui/styles/tokens.css) - TanStack Query 5 with AppState focus listener; Zustand 5 Not in this commit (intentional): issue detail page, mark-read mutation, pull-to-refresh polish — next iteration. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(mobile): unignore data/ + dedup, layout, mark-read, SVG icons, issue page Critical: previous commit (def9c08d) was missing apps/mobile/data/ entirely because root .gitignore has a generic `data/` rule (for backend runtime dirs) that swallowed mobile's source tree. Added !data/ override to apps/mobile/.gitignore. The branch was running locally only because untracked files still load at runtime. Functional changes on top: - Status icon: react-native-svg, 7 variants (backlog 16-dot ring / todo / in_progress 0.5 / in_review 0.75 / done + check / blocked + slash / cancelled + x). Geometry mirrors packages/views/issues/components/ status-icon.tsx (14x14 viewBox, OUTER_R=6, FILL_R=3.5) - Priority icon: 4 ascending bars + "none" horizontal dash; mirrors web priority-icon.tsx. Urgent pulse animation deferred. - Inbox row click: optimistic mark-read (mirrors packages/core/inbox/ mutations.ts useMarkInboxRead) + router.push to /[ws]/issue/[id] - My Issues row click: router.push to /[ws]/issue/[id] - /[ws]/issue/[id] placeholder with native iOS Stack header + back button + edge-swipe-to-dismiss - Inbox layout: title-row right edge = StatusIcon, body-row right edge = timeAgo, vertically aligned (matches web inbox-list-item.tsx) - InboxDetailLabel mobile mirror at components/inbox/detail-label.tsx — type-aware second-line ("Set status to (icon) Done" / "Mentioned" / "Assigned to <name>" etc.). Was rendering raw markdown body which leaked ## heading prefixes. - Inbox dedup: deduplicateInboxItems mirrored into apps/mobile/lib/ inbox-display.ts (filter archived -> group by issue_id -> keep newest -> sort desc). Without it mobile rendered 3 unread dots while web sidebar showed "Inbox 1". Documented in apps/mobile/CLAUDE.md "Behavioral parity" with the lesson: before rendering ANY list-shaped API response, mirror every preprocessing step web/desktop runs between useQuery and JSX (dedupe / coalesce / filter / display helpers). Backend returns raw cache shape; client shapes it. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): ApiClient capability set + issue detail v1 + lessons in CLAUDE.md ApiClient hardening (data/api.ts): - onUnauthorized callback wired in _layout.tsx — 401 clears token, workspace store, TanStack Query cache, replaces nav to /login. Idempotent via signingOutRef. Mirrors packages/core/api/client.ts handleUnauthorized. - X-Request-ID per request (lib/request-id.ts) - Structured logger: `[api] -> METHOD path (rid)` on start, `[api] <- STATUS path (rid, duration)` on end. console.error for 5xx, console.warn for 404, console.log for success. - Zod parseWithFallback for listIssues + listTimeline (the only two endpoints with schemas in packages/core/api/schemas.ts today — matches web's current coverage; new schemas should land on the web side first and both clients pick them up). Core export (packages/core/package.json): - Add `./api/schemas` to exports map so mobile can import the shared Zod schemas + EMPTY_* fallbacks (pure data, on the mobile sharing whitelist per CLAUDE.md). Issue detail v1 (app/(app)/[workspace]/issue/[id].tsx): - Read issue + infinite-scroll timeline + comment composer - Stack header shows MUL-XXX once detail loads - Supporting files: data/queries/issues.ts, data/mutations/issues.ts, components/issue/{timeline-list,comment-composer,...}, lib/{format-activity,timeline-coalesce,timeline-thread}.ts - Property edits, reactions, mentions, image lightbox deferred to V2+ apps/mobile/CLAUDE.md — Lessons learned (encode into reflexes): 1. Install/upgrade deps: `pnpm view <pkg> dist-tags` first; `expo install` for Expo packages, never `pnpm add` blindly 2. New source subdirectory: `git check-ignore -v` to verify against root .gitignore generic rules (data/, build/, bin/); add !data/ override if matched. Cost a 14-file missing commit before. 3. ApiClient capability list (Zod parse / 401 callback / X-Request-ID / structured logger) — all baseline, not polish 4. Visual alignment is baseline, not polish — tab icons, screen titles, right-column vertical alignment of trailing elements, type-aware secondary lines (mirror InboxDetailLabel, not raw item.body) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): activity row parity with web — lead icon, coalesce badge, single-line Activity rows previously showed a two-line `[verb] / [absolute time]` block with no icons, mismatching web (issue-detail.tsx:1046-1100). This redesign brings mobile in line: - Single-line layout: [lead icon] [name] [verb...truncate] [×N] [time→] - Contextual lead icon: StatusIcon(details.to) for status_changed, PriorityIcon(details.to) for priority_changed, inline Calendar SVG for due_date_changed, ActorAvatar(size=16) otherwise - Relative time right-aligned (drops the made-up "Linear-style" absolute timestamp; web uses relative + hover tooltip, mobile keeps relative only for v1) - Coalesce ×N badge for non-task actions; task_completed/failed already bake the count into their copy - Whole row text-xs muted-foreground — activity is supposed to feel quiet next to comment bubbles - FlatList contentContainer gap-3 owns row spacing; rows themselves drop their own py so spacing doesn't double up Calendar icon is an inline 16-line react-native-svg primitive — avoids adding lucide-react-native to the mobile baseline. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): standalone markdown renderer with mentions, files, images, lightbox Replaces `<Text>{content}</Text>` placeholders in issue description and comment body with a full markdown pipeline at apps/mobile/lib/markdown/. Pipeline: preprocess → marked.lexer → AST transforms → RN component tree. Uses `marked` (~30KB JS parser) for CommonMark+GFM tokens; renderer is hand-written (~600 LoC) for full control over RN's text-in-text rules, mention chips, file cards, and inline-image-to-block promotion. Supported in this drop: - Headings, paragraphs, lists (ordered/unordered/task), block quotes, hr, fenced code (no syntax highlight), strong/em/del/codespan, autolinks - Mention chips: mention://member/<id>, mention://agent/<id>, mention://issue/<id> — name resolution via existing useActorLookup; issue tap navigates to /:slug/issue/:id - File cards: !file[name](url) preprocessed to [📎 name](url) link; Linking.openURL hands off to system viewers (PDF, doc, share sheet) - Inline images promoted to block siblings (AST pass) — marked always wraps `![]()` in paragraph and RN can't put Image inside Text - Real aspect ratio via Image.getSize, expo-image for caching/transition, global LightboxProvider with react-native-image-viewing for tap-to-zoom - Tables degrade to card-per-row with header:value pairs (mobile-friendly responsive pattern; horizontal scroll tables get lost on touch) - Embedded HTML stripped before lexing: <br> → newline, comments removed, other tags peeled to inner text. Residual html tokens render muted Cross-package: lifted preprocessMentionShortcodes to @multica/core/markdown so mobile can import it (mobile may import pure functions from core; cannot import from packages/ui per Sharing Principles). packages/ui/markdown keeps its own synced copy with a cross-reference comment — packages/ui cannot import from core (Package Boundary Rules), so two synced copies is the cleanest path. Drops the comment-card "📎 N attachments" placeholder; markdown rendering covers inline images and !file[] cards. attachments[] is backend cleanup metadata, not display content (matches web). New deps: marked@18, expo-image@55, react-native-image-viewing@0.2. All Expo Go compatible — no native modules added. Plan: ~/.claude/plans/plan-dynamic-narwhal.md Research: apps/mobile/docs/markdown-renderer-research.md Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * wip(mobile): markdown engine swap to enriched-markdown + sprint progress Bundles the markdown rendering overhaul plus in-flight mobile feature work as a single WIP for review. Markdown work (the new direction): - Swap internal Markdown component from hand-rolled marked walker to react-native-enriched-markdown (Software Mansion, native md4c). Public API <Markdown content={...} /> unchanged; consumers untouched. Mention links degrade to colored links + onLinkPress routing. - Pre-swap fixes that landed first: 3-layer inline code (later corrected), Shiki via react-native-shiki-engine wired (now bypassed; code retained for selective re-enable on code blocks), code block copy button with expo-clipboard + expo-haptics, inline SVG copy/check icons, header scale calibrated to Apple HIG, paragraph leading-6 for CJK, list bullet column 24->16, lineBreakStrategyIOS="hangul-word" on outer paragraph Text. - Preprocess: <br> -> " \n" (CommonMark HardBreak) so md4c respects intentional breaks without misreading bare \n. - Drop the Expo Go compatibility constraint from CLAUDE.md and markdown-renderer-research.md (project runs on dev client). - New apps/mobile/docs/markdown-renderer-research.md captures the RN nested-Text rendering constraints (#10775 / #45925 / #6728), the CJK amplification mechanism, the typography scale calibration, and every decision-log entry from the engine evolution. Other in-flight mobile features included: - Issue detail timeline polish, comment composer + action sheet, mention suggestion bar, emoji picker sheet, reaction bar. - Status / priority / assignee / label / due date picker sheets. - My Issues filter sheet + view store. - Realtime layer (ws-client, realtime-provider, use-inbox-realtime). - Data layer additions (queries, mutations, schemas, attribute chips). Cross-package: - packages/core/api/schemas.ts: export IssueSchema for mobile use. Build: native rebuild required after pulling (enriched-markdown is a native Fabric module). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): 4-tab shell — Chat tab, More tab, single-row header, filter chips, modal stubs Scaffolds the next phase of mobile so per-feature work has a clean shell to fill into. No new business logic, no data fetching beyond what already existed; this is layout + navigation only. Tab restructure (3 → 4 tabs): - Add Chat tab placeholder (will port web bottom-right chat widget logic). - Rename Settings → More; convert to grouped iOS-style list with sections Workspace / Personal / Account / Workspaces, all SectionGroup + NavRow. - Workspace switcher list inside More uses the same NavRow visual pattern (active row marks with checkmark, inactive shows chevron). Header (single-row): - ScreenHeader simplified to one row: large title left, right actions slot. Removed the second-row WS switcher idea — switcher only lives in More now (the global header would mix scope levels with global actions). - New HeaderActions component holds the two global actions: search and create-issue. Wired into all 4 tabs. My Issues filter relocation: - Filter button moved out of the header right slot (was a scope-mismatch hazard — global header should not host tab-local controls). Now sits inline at the right end of the ScopeTabs row. - New ActiveFilterChips row renders below ScopeTabs when filters are active; each chip is tap-to-clear. Mirrors iOS Mail/Things UX. Stubs for next phase: - [workspace]/new-issue.tsx and [workspace]/search.tsx as modal screens presented from HeaderActions. Both have a Cancel button (new ModalCloseButton) in headerLeft. - More tab sub-pages: more/{projects,agents,pins,notifications}.tsx registered in [workspace]/_layout.tsx with native Stack headers. Cross-cutting: - lib/issue-status.ts exports PRIORITY_LABEL alongside STATUS_LABEL (used by the new filter chip row). - All new code uses Ionicons from @expo/vector-icons; not adding lucide-react-native — see comment-composer.tsx for the reasoning. Verified: pnpm --filter @multica/mobile typecheck passes; lint shows only pre-existing issues unrelated to this change; more/ subdirectory checked against .gitignore per CLAUDE.md mobile rule 2. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): hybrid markdown — Shiki code + lightbox images, prose via enriched react-native-enriched-markdown does not expose JS-level custom renderers (issues #54, #232, #246), so syntax highlighting, tap-to-lightbox, and copy buttons cannot live inside enriched. Maintainer-endorsed workaround (#246): split markdown at those boundaries and render the leaves in React. splitMarkdown walks marked.lexer tokens and emits prose / code / image segments. Each prose island gets its own EnrichedMarkdownText; code blocks reuse the in-house CodeBlock (Shiki + copy + horizontal scroll); images reuse MarkdownImage (expo-image + lightbox). Paragraph-embedded images are promoted to block siblings, matching GitHub mobile and Linear iOS. Drops ~600 LOC of dead walker code (render-block, render-inline, ast, link, mention-chip, key) that the previous engine swap left behind. Visual polish for the hybrid output: - inline code alpha 20% → 12%; enriched paints over the full line height and RN can't apply the padding/radius/0.85em that keep GitHub web's chip compact, so the web alpha reads too heavy here. - new `code-surface` token (#e8e8eb), one step darker than `secondary`, plus a 1px `border-border` hairline. Code block now elevates inside both white issue bodies and grey comment cards. - code block margin my-3 — breathing room both sides. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): new issue creation — Manual mode fully wired with @ mention Mobile can now actually create issues. Phase 1 left submit as a console.log stub; this iteration wires Manual mode end-to-end so an issue typed on a phone lands in the backend and appears in the user's my-issues list on next refresh. Wire-up: - api.createIssue(body) — POST /api/issues, mirroring server route at server/cmd/server/router.go:320. Matches the CreateIssueRequest type exported from @multica/core/types so payload shape agrees across clients. - useCreateIssue() mutation in data/mutations/issues.ts — no optimistic insert (the my-issues list is status-bucketed + scope-filtered, so optimism needs bucket+scope decisions; invalidation is simpler and hosted-backend latency is sub-300ms). onSuccess invalidates myAll and inbox query keys. - new-issue.tsx Manual panel: submit ↑ calls mutateAsync, dismisses on success, surfaces errors via Alert.alert with the form state preserved so the user can retry. Button shows a spinner during the in-flight request and all inputs are disabled. @ mention in description (members + agents): - Mirrors comment-composer.tsx pattern exactly — selection tracking, tokenAtCursor on every change/selection event, MentionSuggestionBar rendered above the chip row, insertMention on pick, markers list appended. - Title input stays plain (web doesn't allow mentions in title; we mirror that). - Wire format on submit: serializeMentions(description, markers) → `[@name](mention://type/id)` markdown. Recognised by: * server/internal/util/mention.go ParseMentions * packages/views/editor/extensions/mention-extension.ts (web Tiptap) * apps/mobile/components/issue/mention-chip.tsx (mobile timeline) - Backend does NOT trigger inbox notifications for mentions in issue descriptions (only on comments — see server/internal/handler/comment.go ParseMentions call). Mobile doesn't need to send a separate mentioned_* field; the markdown alone is sufficient. Header polish: - SubmitIssueButton accepts a `loading` prop; renders ActivityIndicator in place of the ↑ glyph while pending. Defends against double-tap. - ModalCloseButton's earlier "Cancel" text is now a ✕ icon in a circle to match the new-issue / search modal visual reference (Linear-style). Agent mode unchanged — still a placeholder that console.logs and dismisses. Phase 3 will wire the real agent picker, apiClient .quickCreateIssue, and the daemon version gate. Explicitly NOT in this commit (later phases): - Markdown formatting toolbar (Phase 2C) - Project / Labels / Due date / Parent chips (Phase 2D) - Image / file attachments (Phase 2E) - #MUL-42 issue references, @all mention - Draft persistence, "Create Another" toggle - Pre-fill from sub-issue entry, optimistic list insert - Success toast (success path = silent dismiss; mobile has no toast component yet) Verified: pnpm --filter @multica/mobile typecheck passes; lint shows only pre-existing issues unrelated to this change. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): WS realtime coverage — issue detail / my issues / agent tasks Previous iteration shipped issue creation but mobile only ran WS for inbox. Anything else (issue detail, my-issues list, agent task progress) was pull-refresh only. Cross-client edits, agents working in the background, and concurrent user changes all required the user to manually refresh. This commit closes that gap so all four user-facing surfaces stay live without input. Mobile now matches web/desktop in product freshness, while keeping mobile-specific patterns (patch over invalidate, per-screen mount, event-always-wins) that reflect cellular and AppState constraints. New (3 files): - data/realtime/issue-ws-updaters.ts — mobile-owned cache patchers. Pure functions over QueryClient: patchIssueDetail, prependTimelineEntry, patchTimelineEntry, removeTimelineEntry, patchMyIssuesList, removeFromMyIssuesList, addCommentReaction, removeCommentReaction, addIssueReaction, removeIssueReaction, patchIssueLabels, commentToTimelineEntry. NOT imported from packages/core because web's updaters bind to web's issueKeys instance and target bucketed caches mobile doesn't have — see CLAUDE.md "Mobile-owned updaters" rule. - data/realtime/use-issue-realtime.ts — per-issue subscriptions mounted by the detail screen. Subscribes to 11 issue/comment/activity/reaction events plus 6 task:* events for live agent progress. Every handler filters by issue_id so we ignore noise from other issues. Reconnect invalidates only this issue's detail + timeline (not a global sweep). On issue:deleted for the active id, runs onDeleted callback so the screen can router.back() rather than strand the user on a 404. - data/realtime/use-my-issues-realtime.ts — listing-level subscriptions mounted globally. issue:created → invalidate myAll (we don't know scope/filter membership for a fresh issue). issue:updated → patch via setQueriesData across every cached scope/filter combination. issue:deleted → strip from every cached list. Reconnect → invalidate myAll. Modified (2 files): - app/(app)/[workspace]/_layout.tsx — RealtimeSubscriptions adds useMyIssuesRealtime alongside useInboxRealtime. Both are workspace- session lifetime. - app/(app)/[workspace]/issue/[id].tsx — mounts useIssueRealtime(id) with router.back as the onDeleted callback. Docs (apps/mobile/CLAUDE.md): New top-level section "## Realtime / WebSocket strategy" before the Lessons section. Documents: - Three-layer stack (ws-client → realtime-provider → per-feature hooks) - Mount strategy: list-level global vs per-record per-screen, and why mobile doesn't use a single centralized useRealtimeSync like web - Patch over invalidate (cellular-data rule) - Mobile-owned updaters (don't import packages/core/issues/ws-updaters) - Event-always-wins conflict policy - Per-hook reconnect scoping (no global invalidate sweep) - Recipe for adding new event coverage Out of scope (deferred): - Workspace member events (Phase 3D) — wait until More tab adds a real members list - "N new comments" floating banner — patch-only for now - Push notifications (APNs) — requires server config + entitlement Verified: pnpm --filter @multica/mobile typecheck passes; lint shows only pre-existing issues unrelated to this change. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(mobile): markdown segment spacing uses Yoga gap, not per-child margin Two consecutive fenced code blocks (and code-image / image-image combos) rendered with effectively zero gap on iOS — NativeWind 4 compiles `my-3` to `marginVertical: 12`, but Yoga's sibling margin behaviour doesn't accumulate the way web CSS does. Result: a `my-3` sibling pair landed at ~12px on the screen instead of 24px, and the border-on-border made it look like the two blocks were glued. Move the spacing from per-child `marginVertical` to a `gap-3` on the markdown root `<View>`. Gap is layout-level (Yoga implements it directly), independent of margin behaviour, and uniformly applies between every segment pair — prose ↔ code, code ↔ code, image ↔ code, etc. CodeBlock and MarkdownImage drop their `my-3` / `mb-3` since the parent now owns the spacing. Prose ↔ code reads as ~24px (prose's enriched-markdown `paragraph.marginBottom` 12 + root gap 12), which is the comfortable "new block" feel; code ↔ code reads as exactly 12px, which is the "these are related" feel. Both improve on the previous 0–8px crunch. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): unified input UX — mention hook, markdown toolbar, file upload new-issue Description and Comment composer used to each carry their own copy of mention state (mentioning / recomputeMentioning / onChangeText / onSelectionChange / onAtButton / onSelectMention / serialize), ~50 LOC of identical boilerplate per surface. The description had no toolbar at all; the comment had a lone left-side `@` button. Visually the two body inputs looked like different products — description was bare text, comment was rounded-2xl bg-secondary with a focus tint. Three changes consolidate the body-input experience: 1. Shared mention pipeline. `useMentionInput()` in lib/use-mention-input.ts owns text / selection / markers / mentioning, plus handlers (onChangeText, onSelectionChange, onAtButtonPress), suggestion-bar props, `insertAtCursor`, `insertAtLineStart`, serialize, snapshot, restore, reset. Comment-composer and new-issue both consume it, killing the duplication. 2. Shared keyboard-bar markdown toolbar. Linear-iOS range: `@`, bullet list, checklist, code block, quote, image, file. All buttons are literal-character inserts via hook helpers — no WYSIWYG. Toggles like bold/italic are deliberately out of scope because RN TextInput can't render styled ranges inside the input; a real WYSIWYG would mean swapping to react-native-enriched and crossing an HTML <-> markdown boundary, which is a separate decision. 3. File upload. `api.uploadFile(asset, { issueId?, commentId? })` mirrors web's `/api/upload-file` contract but takes the RN-shaped `{ uri, name, type }` payload and validates the response against a strict `AttachmentSchema` (no silent fallback — an empty `url` would put a broken link into the editor). `useFileAttach()` glues expo-image-picker / expo-document-picker into the toolbar's image and file buttons. Context follows web: comments pass issueId, not-yet-created issues pass nothing. MAX_FILE_SIZE is mirrored, not imported, per mobile CLAUDE.md. Cleanup: - `MOBILE_PLACEHOLDER_COLOR` + `MIN_BODY_INPUT_HEIGHT_PX` in components/ui/input-tokens.ts; six hardcoded `#a1a1aa` callers now reference the const. - Description now sits in a rounded-2xl bg-secondary/40 container with a focus-tint border, visually matching the comment composer. - app.config.ts gets `expo-image-picker` plugin with `photosPermission` set and `cameraPermission` / `microphonePermission` disabled — without this Info.plist string, calling the image picker hard-crashes on iOS 14+. A dev-client rebuild is required (new native modules); existing behaviour and read-only rendering are unchanged. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(mobile): hard 30s fetch timeout + TanStack Query signal pass-through Triggered by a real user-visible bug: the Inbox tab's pull-to-refresh spinner sometimes stuck on indefinitely after returning the app to the foreground. List items rendered normally underneath, but `isRefetching` never flipped back to `false`. Root cause: api.ts fetch() had no timeout, no AbortController, and ignored caller-supplied signals. iOS suspends background apps and can silently kill in-flight network tasks (facebook/react-native#35384, #38711). When the app foregrounded, the suspended Promise neither resolved nor rejected. TanStack Query saw a fetch already in flight and would not start a replacement on invalidate — it just waited forever on the dead Promise. Fix is three layers (all three required — partial fix leaves a footgun): 1. api.ts fetch() — hard 30s timeout via manual AbortController + setTimeout. Hermes does not implement AbortSignal.timeout() / AbortSignal.any() (facebook/react-native#42042, livekit#4014), so composition is via addEventListener("abort", ...) forwarding. On timeout we throw an ApiError(message, status=0) so callers see a real error instead of a Promise-that-never-settles. 2. All read-side api methods now accept opts?: { signal?: AbortSignal } and forward to fetch(): listInbox, listWorkspaces, getMe, listMembers, listAgents, listIssues, getIssue, listTimeline, listLabels, listProjects. Mutations are unchanged — TanStack Query doesn't pass a signal to mutationFn. 3. All queryFn definitions in data/queries/* now destructure { signal } and forward it. The TanStack official cancellation guide states that the signal is aborted when a query becomes out-of-date or inactive, so this is the primary mechanism that unwedges stuck queries (the 30s timeout is the safety net for cases where nothing else fires). Already in place (untouched, but documented): - query-client.ts wires focusManager ← AppState and onlineManager ← NetInfo per TanStack's React Native official guide. focusManager alone wasn't enough — when a fetch hangs, "focused = true" can't unstick the query without signal cancellation or timeout. The three pieces work together. Docs (apps/mobile/CLAUDE.md): New Lesson #5 captures all of the above with: - The original symptom + root cause - The three-part rule (timeout / api opts / queryFn destructure) - Hermes-specific caveats with citations to the upstream issues - A grep verification command future readers can run to enforce part 3 Verified: - pnpm --filter @multica/mobile typecheck passes - pnpm --filter @multica/mobile lint shows only pre-existing issues unrelated to this change - grep -n "queryFn: () =>" apps/mobile/data/queries/*.ts returns zero matches (every queryFn destructures signal) Sources cited in CLAUDE.md: - TanStack Query Cancellation guide (tanstack.com/query/v5) - TanStack Query React Native official guide (tanstack.com/query/v5) - facebook/react-native#42042 (AbortSignal.timeout unavailable in Hermes) - facebook/react-native#35384 (iOS background fetch failure) - facebook/react-native#38711 (iOS background JS Timers don't fire) - livekit/livekit#4014 (AbortSignal.any unavailable in React Native) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): chat v1 — single-tab IA, optimistic send, two-tier WS Fill the Chat tab placeholder. UX is mobile-native (top bar with tap-title sheet, message list, bottom composer — no two-layer nav); logic is at parity with web (API/events/has_unread/optimistic sequence/permissions/ enums all mirrored). Includes: - data layer: 8 chat API methods + zod schemas with .catch() enum drift fallback; queries / mutations (optimistic delete + markRead); per- session drafts store - two-tier realtime: listing-level hook mounted in workspace _layout (chat:session_* + chat:done for has_unread), per-record hook mounted in the chat screen (chat:message/done + 5 task:* events, all filtered by chat_session_id, scoped reconnect invalidates); ws-updaters carry an invalidate fallback for pre-#2123 servers that omit chat:done payload - rule mirrors: canAssignAgent, failureReasonLabel, agent availability three-state hook (mirror-not-import per apps/mobile/CLAUDE.md) - UI: ChatHeader (tap title → SessionSheet) + ChatMessageList (FlatList, destructive bubble on failure_reason) + ChatComposer (mention + markdown toolbar minus file/image) + StatusPill (Thinking · Ns) + SessionSheet (with agent avatars + long-press delete) + AgentPickerSheet + NoAgentBanner v1 cuts (deferred to v2): file upload, rename, Chat tab unread badge, agent presence dot, task tool_use detail expansion, focus mode route anchor, starter prompts, history pagination, mobile test infra. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): add due_date / project to create-issue, drop agent toggle Wire the last two CreateIssueRequest fields that have a meaningful UX on mobile (due_date, project_id) to the new-issue form via two new chips sharing the existing CreateFormAttributeRow + picker-sheet pattern. Fixes a silent 400 on the existing detail-page due_date update: the picker was emitting YYYY-MM-DD but server/internal/handler/issue.go parses with time.Parse(time.RFC3339, ...) which rejects date-only. Now sends full ISO, matching web's due-date-picker.tsx. Removes the placeholder agent-mode toggle from new-issue — it was a dead UI surface (logged to console on submit, never wired). Mobile's create-issue is now manual-only, aligned with web's form semantics. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): redesign chat composer as floating card Move chat input to a rounded card with inline @ and Send/Stop buttons (Linear / iMessage idiom), dropping the markdown toolbar that comment- composer needs but chat doesn't. Send stays visible-but-disabled when there's no draft so the button row no longer jitters as the user types. Adds SF Symbols, expo-haptics, and reanimated crossfade for send↔stop. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): add issue MentionType + viewed-issues store Extend MentionType with "issue" and serialize issue mentions without the leading `@` in the link label, matching web's mention-extension.ts:67-74. New in-memory LRU tracks recently viewed issues per workspace so the chat composer can surface them next. Issue detail screen pushes its id into the store on mount. Suggestion bar UI lands in a follow-up commit. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): @ in chat picks an issue (Recent + My issues) In 1:1 user↔agent chat sessions, @member and @agent are noise (no notification channel; the session is already bound to one agent). Switch the mention bar to surface issues instead — Recent (most recent 5 from the in-memory viewed-issues store) followed by My issues (assigned-to-me, max 10, deduped). The serialized token matches web byte-for-byte ([MUL-XXX](mention://issue/<uuid>)) so the agent can read the reference directly even though chat.go SendChatMessage doesn't yet run ParseMentions — that's a follow-up. MentionSuggestionBar gains a mode="comment"|"chat" prop; comment mode is the default and preserves existing behaviour for the issue comment composer and new-issue body. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(mobile): stable empty reference in viewed-issues selector selectViewedIssueIds was returning a fresh `[]` when the workspace had no entry yet, which made useSyncExternalStore see a different snapshot on every read and trigger "getSnapshot should be cached" + infinite re-render. Share a single frozen empty array for all no-entry paths, matching the Zustand footgun rule in CLAUDE.md. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): iMessage-style keyboard dismiss in chat message list Drag the list to interactively pull the keyboard down with the finger, or tap empty space between bubbles to dismiss. `handled` keeps long- press action sheets and other in-bubble Pressables firing normally. Sending a message intentionally keeps the input focused so the user can immediately type the next one — RN's default and the chat-app standard. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(mobile): tap message area dismisses keyboard in chat keyboardShouldPersistTaps="handled" on FlatList has a long-standing RN bug (facebook/react-native#31448) that prevents the tap-to-dismiss path from firing in many setups. Wrap ChatMessageList with a Pressable that calls Keyboard.dismiss() — the canonical workaround documented in the RN Keyboard guide and the Expo keyboard-handling guide. Interactive drag-dismiss on the FlatList itself (the previous commit) is an independent code path and continues to work. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(mobile): drop double home-indicator padding under chat composer chat.tsx wrote SafeAreaView edges={["top","bottom"]} while the parent <Tabs> container already absorbs the home-indicator inset on behalf of all tab screens. The result was ~34pt of empty space below the composer. Sibling tabs (inbox / my-issues / more) all use edges={["top"]} — chat was the outlier. The gap only became visible after the floating-card composer landed; the previous sticky-bar layout disguised it as bg-coloured padding. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(mobile): simplify create-issue layout, fix render loop Reshape the new-issue modal into one vertical scrolling form (title → description → property chips), matching the Apple Reminders / Linear iOS pattern. Previously the chips sat sticky- pinned above the keyboard, which made them invisible when the keyboard was up and stranded at the bottom of an empty screen when it was down — neither state served the user. Drop the markdown toolbar and upload buttons from the modal: mobile users almost never format markdown when creating an issue, and attachment upload is deferred for this release. Removing them also lets the form breathe vertically. Fix the "Maximum update depth exceeded" loop that surfaced once real data started flowing. Root cause was duplicate useQuery(projectListOptions) subscribers in CreateFormAttributeRow and ProjectPickerSheet on the same key, under React 19 strict mode. Form now holds the full Project object lifted from the picker, so only the picker queries the list. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): More tab opens global nav popover Replaces the full-screen More tab with a bottom-bar trigger that opens a popover containing the workspace switcher and 9 nav destinations (Inbox, My Issues, Favorites, Projects, Initiatives, Views, Teams, Settings, Search). Uses expo-router Tabs.Screen listeners.tabPress + preventDefault — the more.tsx route is a stub that redirects to inbox if hit directly. Custom Modal popover (no @gorhom/bottom-sheet) since that lib still requires Reanimated v3 and mobile is on v4. Account info + workspace list + sign out moved into a dedicated Settings page. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): add projects feature with realtime cache sync Mobile parity for the projects domain — browse, detail, create, edit, delete, plus GitHub resource attach. UX adapted to iOS (Stack push + modal sheets, picker sheets per property, ActionSheet for Edit/Delete, collapsible Open/Done buckets in related issues) while preserving web's semantics: 5 status enums (incl. cancelled), 5 priorities, lead supports both members and agents, counts come from server fields. Data layer follows mobile CLAUDE.md rules: parseWithFallback + signal on every read, optimistic patch + WS event-always-wins on mutations, mobile-owned ws-updaters (not imported from packages/core) that patch over invalidate to honour the cellular-data rule. Per-record realtime hook subscribes to issue:* events filtered by project_id so the related-issues list stays fresh without pull-to-refresh. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): redesign More popover — user card + lean nav - Add user identity card at top of GlobalNavMenu, mirroring web sidebar dropdown (packages/views/layout/app-sidebar.tsx:496). Tap pushes into the existing settings page where account / workspaces / sign-out already live. - Trim NAV_ITEMS to Projects only. Inbox / My Issues / Chat are bottom tabs; Settings is reached via the user card. - Delete six orphaned stub routes (favorites, initiatives, views, teams, notifications, pins) — no remaining external references. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor(mobile): extract shared IssueRow + props-driven filter sheet - Add components/issue/issue-row.tsx as the single source for list-style issue rendering. `<IssueRow issue showStatus? />` — showStatus opt-in for ungrouped lists (project related-issues), default off where the SectionList header already shows status (my-issues). - Replace the two inline IssueRow copies in (tabs)/my-issues.tsx and components/project/project-related-issues.tsx. - Rename MyIssuesFilterSheet → IssueFilterSheet and replace store-coupled state with props so the same sheet can serve any view-store. My Issues call site passes useMyIssuesViewStore selectors as props. - Rename filterMyIssues → filterIssues (function was already generic; the misnomer just reflected the original single call site). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): workspace Issues page in More popover New surface for the workspace-wide issue list. Mirrors web's IssuesPage (packages/views/issues/components/issues-page.tsx) at mobile fidelity: SectionList grouped by status, status + priority filter (reuses the shared IssueFilterSheet), pull-to-refresh, empty/error states, IssueRow identical to other surfaces. Differs from My Issues by dropping the Assigned/Created/Agents scope tabs (workspace-wide list has no per-user scope) and using an independent view-store so filters don't bleed between the two pages. Plumbing: - data/queries/issues.ts → issueListOptions(wsId) using existing issueKeys.list(wsId) prefix (already wired into invalidations from mutations and project realtime). - data/stores/issues-view-store.ts → status/priority filter state. - data/realtime/use-issues-realtime.ts → list-level WS subscription; patches list(wsId) on issue:created (prepend) / updated / deleted, invalidates on reconnect. Mounted in <RealtimeSubscriptions />. - data/realtime/issue-ws-updaters.ts → patchIssuesList / prependToIssuesList / removeFromIssuesList, plus extending patchIssueLabels to also patch list(wsId). - workspace _layout: register more/issues Stack.Screen, drop Stack.Screen entries for the routes deleted in 5cc7f01 (favorites/initiatives/ views/teams/notifications/pins). Filters beyond status/priority (assignee/project/label/creator) are a v1.1 follow-up; v1 ships at My Issues parity for code reuse. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore(mobile): add Issues entry to More popover Wires the new workspace Issues page (more/issues.tsx) into GlobalNavMenu, ordered above Projects (higher-frequency surface). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore(mobile): rename ios run scripts to ios:device, add .env.example, document commands `expo run:ios` always meant device install in this project, but the unqualified `ios` / `ios:mobile` script names invited confusion with the simulator default. Rename to `ios:device` / `ios:device:staging` so the intent is explicit, and pair with a checked-in `.env.example` so a fresh clone knows which keys mobile needs. CLAUDE.md picks up the new command list under the existing Commands section. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor(mobile): drop paginated timeline, fetch as single ASC list Server-side timeline pagination was retired (#2322) because p99 issues have ~30 entries — cursors were pure overhead and split reply threads across page boundaries. Mobile mirrors the new shape: - `api.listTimeline` returns `TimelineEntry[]` directly (was `TimelinePage` with `next_cursor` + `has_more_before`). - `issueTimelineOptions` is a flat `queryOptions` (was `infiniteQueryOptions`); query consumers drop the page-walking dance. - WS handlers `comment:created` / `activity:created` now `append` (oldest-first ASC list) instead of `prepend`. Mirror updater renamed. - Timeline list view collapses to a single `FlatList data={entries}`, no more `pages.flat()` + `fetchNextPage` plumbing. Mirrors web's post-#2322 `issueTimelineOptions` shape (per apps/mobile/CLAUDE.md "mirror, don't import"). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(mobile): restore Chat list scrolling + align bubble UI with web The Chat tab message list was unscrollable. Two distinct root causes under the same surface symptom: 1. Wrapper hijacking the touch responder. chat.tsx mounted a Pressable around ChatMessageList to implement "tap empty area = dismiss keyboard". Any Touchable* (Pressable / TouchableWithoutFeedback / TouchableOpacity) claims the responder via the shared Touchable mixin and does NOT reliably hand it back to the child FlatList for pan gestures, killing scroll. Removed entirely — `keyboardShouldPersistTaps ="handled"` on the FlatList already provides the same behaviour per RN docs (a tap not handled by a child bubble dismisses the keyboard), and `keyboardDismissMode="interactive"` covers drag-to-dismiss. Mirrors web's bare `<div className="flex-1 overflow-y-auto">` mount. 2. `onContentSizeChange` re-sticking to bottom on every async layout. Markdown async rendering (Shiki highlight, image natural-size resolution, lightbox provider injection) fires content-size changes for seconds after first paint. The previous handler called `scrollToEnd` unconditionally, snapping the user back to the bottom the instant they tried to drag up. Replaced with a sticky-bottom state machine — `isAtBottomRef` / `userHasScrolledRef` / `firstMsgIdRef` — that only re-sticks while the user is anchored at the bottom; reading history is left alone. Same semantic as iMessage and web ChatWindow. Bonus alignment with web's bubble styling: - User bubble: bg-muted (was bg-primary dark), max-w-[80%] (was 88%), text-foreground. - Assistant: w-full (was self-start max-w-[88%]) so Markdown / code blocks / tables get the full content width. - Outer content padding: px-4 pt-3 pb-4 gap-3 (was px-3 py-3 gap-2), matching web's `max-w-4xl px-5 py-4 space-y-4` rhythm at mobile scale and giving the last bubble breathing room above the composer. - FlatList itself gets `className="flex-1"` so its height is the remaining viewport in the KeyboardAvoidingView column, matching web's `flex-1 overflow-y-auto` host. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): default Chat tab to most recent session on first entry Web's chat-window opens to an empty state when no activeSessionId is persisted, because the sidebar SessionDropdown makes one-click switching cheap. On a phone, picking a session is 4 taps (header → sheet open → row → close), so an always-empty default is friction — users complained they had to re-pick the session every cold start. Mobile-only deviation: on the first Chat tab entry for a given workspace, jump straight to the most recent session (`sessions[0]`, server-sorted by `updated_at desc`). A per-workspace `useRef` flag makes the hydration a one-shot — subsequent user intent (point + New, delete-active) sets activeSessionId to null and is respected forever after. When the user switches workspaces, the ref resets so the new workspace gets its own first-entry hydration. Behavioural parity is preserved: counts / visibility / permissions / enums match web exactly. UX is allowed to diverge on UI mechanics per apps/mobile/CLAUDE.md. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(mobile): inbox row flips to read state before navigation push Tapping an unread inbox row produced no visible "now read" feedback — the row disappeared into the issue detail push transition still wearing its unread bullet and bold-foreground style. Users came back via the back button to find it had become read (correct cache state, just no real-time feedback). Root cause: `useMarkInboxRead.onMutate` does `await qc.cancelQueries` before the optimistic `setQueryData`, so the optimistic write lands one microtask after the synchronous `router.push`. iOS native stack captures the source view screenshot at push time — the screenshot freezes the row in its unread state, and the transition animates that frozen frame regardless of any later cache write. Fix: in `onPressItem`, do the optimistic `setQueryData` synchronously right before calling `markRead.mutate(...)`. The mutation still runs end-to-end (so the server PATCH fires and `onSettled` invalidate reconciles), but the row already shows the read style on the frame that gets screenshotted for the push transition. The tab-bar inbox badge also drops one count at the same instant for the same reason. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): unread badges on Inbox and Chat tabs Surface the same unread signals web puts on the sidebar (inbox) and the ChatFab (chat). On a phone the user lives on the tab bar, so mounting badges directly on the Inbox and Chat tabs is the closest equivalent. Display semantics mirror web exactly (apps/mobile/CLAUDE.md "counts must agree"): - Inbox badge = `deduplicateInboxItems(items).filter(i => !i.read).length`, same as web's `useInboxUnreadCount` (packages/core/inbox/queries.ts:22). 99+ truncation matches the sidebar. - Chat badge = `sessions.filter(s => s.has_unread).length`, same as web's ChatFab (packages/views/chat/components/chat-fab.tsx:29). 9+ truncation matches the fab. Implementation: - New `apps/mobile/lib/unread-counts.ts` with two `useQuery + select` hooks; mirror-don't-import the web design. - Wired into `(tabs)/_layout.tsx` as React Navigation's native `tabBarBadge` + `tabBarBadgeStyle`. Style is JUST `backgroundColor` (brand blue `#4571e0`); @react-navigation/elements `Badge` internally uses `borderRadius = size / 2` and `minWidth = size`, so the single-character badge renders as a true circle. Overriding minWidth / fontSize / fontWeight breaks that geometry — keep the override minimal. - Brand blue chosen over the iOS default red: matches web's ChatFab `bg-brand` pip and avoids the "error / critical" connotation red carries for an everyday new-comment notification. Both queries (`inboxListOptions`, `chatSessionsOptions`) are already kept fresh by listing-level realtime hooks mounted in `app/(app)/[workspace]/_layout.tsx` (`useInboxRealtime` / `useChatSessionsRealtime`), so badges update via WS events without a poll or focus refetch. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): workspace search modal Wires the header search icon to a working modal — debounced search across issues + projects, Recent as empty state, modal-to-detail via router.replace. Behavioral parity with packages/views/search but stays search-only (no command-palette section) so it doesn't dual-list targets already in the More popover. - data/schemas.ts: SearchIssuesResponseSchema / SearchProjectsResponseSchema with enum-drift defense (match_source falls back to "title") - data/api.ts: searchIssues / searchProjects with AbortSignal forwarding and parseWithFallback - (app)/[workspace]/search.tsx: TextInput + 300ms debounce + abort, single FlatList driving Recent / Projects / Issues rows, snippet line for comment-matches mirrors web search-command.tsx:632 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(mobile): stop emoji clipping in ProjectIcon Previous impl rendered the emoji as <Text leading-none>. On iOS, emoji glyphs render ~10-15% larger than fontSize because they ignore latin baseline metrics, and <Text> clips content to lineHeight — so the top and bottom of every project emoji were being cut off. project-row.tsx had a pt-0.5 compensation that only nudged the top, leaving the bottom clipped and producing the "row height feels off" visual. Wrap the Text in a fixed square View (sm=18 / md=22 / lg=28 px), set explicit lineHeight = round(fontSize * 1.2) so the glyph has the room it needs. Drop the pt-0.5 hack — the icon now self-centers cleanly and flex parents using items-start / items-center align siblings against a stable square footprint. Affects every ProjectIcon call site: search rows, Projects list, project header card, issue attribute / create-form rows, project picker sheet. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): inbox → comment deep-link with flash highlight When a user taps a new_comment / mentioned / reaction_added inbox row, the issue detail screen now auto-scrolls to the target comment and flashes it (matching web's behavior at packages/views/issues/components/ issue-detail.tsx:686-709). Replies are folded into their parent's CommentCard, so a reply deep-link scrolls to the parent row and lights up the matching child View only — mirroring web's replyToRoot fallback. - Inbox tap now uses object-form router.push with highlight + h (nonce) params so re-tapping the same row re-fires the effect. - TimelineList owns scrollToIndex (data-relative, viewPosition 0.3) with the standard onScrollToIndexFailed estimate-then-retry dance for variable-height rows. - CommentCard renders an absolute-positioned Reanimated overlay (borderWidth + bg wash for root, bg-only for reply) driven by a single sharedValue with withSequence(700ms in, 1800ms hold, 700ms out) — matching web's transition-colors duration-700 + setTimeout(2500) timing. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): TextField + AutosizeTextArea primitives Mobile had 16 bare <TextInput> sites and a shared <Input> component that nothing used. Every screen author repeated the four RN cross- platform workarounds independently — paddingVertical:0, includeFont Padding:false, textAlignVertical, and (for multiline) the onContentSize Change + height-state dance — and most missed at least one. This commit introduces two primitives that bake those in: - <TextField> — single-line baseline with variant="filled" (default). Locks multiline={false} + numberOfLines={1} so callers can't mix iOS UITextField / UITextView modes by accident. - <AutosizeTextArea> — multiline that actually grows with content, via onContentSizeChange → useState(height) clamp to [minHeight, maxHeight]. RN's Yoga doesn't read native intrinsicContentSize (facebook/react-native#54570, open), so this is the only way the bounding box keeps up with text. scrollEnabled flips on at the ceiling so a tall draft becomes internally scrollable instead of pushing the layout open. Migrated 8 of 16 sites — chat composer, 3 description fields (new issue, project new, project edit), and 4 picker sheets (label, project, assignee, add-resource). Comment composer migration ships in the follow-up commit since it's bundled with the redesign. login / verify / search / hero titles + variant="outlined" / size="hero" intentionally deferred (Out of Scope per plan) — no user-reported bug, add them when the migration earns its weight. <Input> is repurposed as a re-export of <TextField> so any future import-by-name resolves to a sensible primitive. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): comment composer tap-to-expand two-state UX CommentComposer's previous "stacked horizontal bars" layout (replying- to chip + 7-button MarkdownToolbar + TextInput row + floating Send) looked nothing like the chat composer beside it and dominated ~120pt of vertical space on the issue detail screen even when no one was composing. Rewritten as a compact pill that taps open into a chat-composer-shaped floating card. State machine is blur-driven: - compact + tap pill → expanded, focus TextInput via useRef + rAF (autoFocus on conditional render is unreliable across iOS/Android) - expanded + onBlur + text empty + no replyingTo → collapse to compact - expanded + onBlur + has text or replyingTo → stay expanded; draft visible, user can scroll the timeline without losing context - send success resets text but does not collapse — next blur drives it, so back-to-back sends don't make the card jump In-card action row mirrors chat: @ · 📷 · 📎 left, Send right. File / image upload reuses useFileAttach and inserts the existing markdown formats (, [📎 name](url)) — no backend changes. Drops MarkdownToolbar entirely (list/checkbox/code/quote) — users can still type those by hand and the timeline renderer is unchanged. The replyingTo chip moves to a rounded pill above the card (border-b would have clashed visually with the rounded-3xl card geometry). Also fixes a pre-existing race: canSend now gates on !fileAttach. uploading so a deferred insertAtCursor can't land in an already-cleared input. Hardens canCancelReply: blur the input when reply is cleared with empty text, so the existing collapse rule fires uniformly without forcing manual keyboard dismiss. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor(mobile): standardize sheets on iOS pageSheet via SheetShell The 16 Modal-based sheets in apps/mobile/ all copy-pasted the same transparent-fade + hand-drawn backdrop + maxHeight pattern from the project's first sheet. That shape is right for short action menus but wrong for content viewing / search / forms — each subsequent sheet hit its own bug (keyboard squash, FlatList clipping, useSafeAreaInsets returning 0 inside Modal, "floating" feel from transparent backdrop). Introduce SheetShell — a shared primitive wrapping Modal presentationStyle="pageSheet" + nested SafeAreaProvider + header (title + X) + safe-area-aware body. Migrate 7 misclassified sheets: session, issue-filter, assignee/label/project/project-lead pickers, add-resource. Codify the container-selection rule as CLAUDE.md Lesson #6 so the next sheet doesn't inherit the wrong shape. A-class sheets (comment-action, emoji-picker, fixed-option pickers) intentionally left alone — their content matches the original pattern. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): show agent runs on issue detail New double-state row inside IssueHeaderCard (between title and attributes): "[👤👤👤] Working" + pulse dot when ≥1 active task, "Runs · N" when only past runs exist, hidden otherwise. Tap opens a pageSheet listing Active + Past runs with status badges and an inline Cancel button on active rows. Data layer: - api.ts: listActiveTasksForIssue (GET /api/issues/:id/active-task) and listTasksByIssue (GET /api/issues/:id/task-runs), both run through parseWithFallback + a new AgentTaskSchema (lenient enums with .catch() for forward-compat) - queries/issue-keys.ts + queries/issues.ts: activeTasks + tasks options, workspace-scoped, signal forwarded - mutations/issues.ts: useCancelTask with optimistic remove + rollback - realtime/use-issue-realtime.ts: task:* WS events now invalidate the two new task queries (in addition to detail+timeline), so the row and sheet update without polling New components: AgentActivityRow (the row), RunsSheet (built on SheetShell), RunRow (single task row, cancel action), AvatarStack (mobile-native overlapping avatars). Transcript drilldown deferred to a follow-up — past row tap is no-op in v1. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): inbox swipe-to-archive + batch menu Closes the inbox archive gap on mobile — desktop made archive a first-class action (hover icon + batch dropdown) but mobile had no archive entry point at all. Adds the canonical iOS pattern: left-swipe on a row reveals a destructive Archive button, full swipe auto-fires. Header gains a three-action menu for "archive all read / completed / all" mirroring the desktop dropdown. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): issue detail delete via three-dot header menu Issue detail had no headerRight menu, leaving users unable to delete issues from the phone. Adds the same ActionSheetIOS pattern the project detail screen already uses: Copy link / Open on web / Delete (red, Alert-confirmed). Property edits stay on IssueHeaderCard chips — one entry per action. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(mobile): close API schema + polymorphic-actor parity gaps Three real bugs uncovered by the apps/mobile/ code review, all unprotected by parseWithFallback or by the actor/assignee polymorphism: - ActorAvatar + useActorLookup did not accept "system" actors. Inbox items with actor_type="system" (platform-triggered notifications) rendered a blank circle. Add a system glyph branch + widen the lookup signature. - AssigneeValue was narrowed to "member" | "agent", silently dropping squad assignments coming from web/desktop and preventing the user from clearing them on mobile. Widen to IssueAssigneeType and render squad assignees with a generic group glyph (no squad list query yet — picker still lists members + agents only, but Unassigned now clears squads). - Six read endpoints (getMe, listWorkspaces, listInbox, listMembers, listAgents, getIssue) returned bare fetch<T>() casts with no schema validation, violating the "API Response Compatibility" rule that installed-app architectures depend on. Add zod schemas with .loose() and enum-drift .catch() defenses, plus EMPTY_* sentinels so drift downgrades to "stale defaults render" instead of crashing the boot sequence. Also fixes the AttachmentSchema typecheck failure by adding the missing chat_session_id and chat_message_id fields (mobile schema had drifted from packages/core/types/attachment.ts). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor(mobile): simplify TextField primitive Strip the four cross-platform RN TextInput workaround comments down to the two notes that still apply. Anchor height with `h-10` instead of `paddingVertical: 0`, and inline `fontSize` to avoid NativeWind mapping to fontSize+lineHeight (RN clips descenders when lineHeight is set on iOS TextInput). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): swap tab bar icons to SF Symbols Use expo-image's `sf:` source URLs for the four tab icons (tray / checklist / bubble.left / ellipsis) instead of Ionicons. Native SF Symbols render at the iOS standard tab-bar weight and stroke, so the bar matches first-party iOS apps visually. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor(mobile): always-on issue comment composer Drop the tap-to-expand pill state machine. The composer now mounts in its full form (input + @ / 📷 / 📎 / Send action row) immediately, with no compact-pill intermediate state. Tap focuses the input and opens the keyboard directly. The pill→expand pattern was added to mirror chat composer's two-state UX, but on a primary input surface like comments it is pure friction: the user always has to tap once to get the affordance they came to use. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): OTP code input + resend cooldown on verify screen Replace the generic Input on the email-verify screen with a 6-slot SF-styled OTP component (`input-otp-native`). Auto-submits on the final keystroke instead of requiring a tap on the Verify button, and exposes a `clear()` ref so the input resets after a server-side rejection. Add a 60-second resend cooldown with a live countdown beneath the input, calling `auth.sendCode` on tap. Clears the previous code + error when a new code is requested. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): agent presence dots + offline banner Mirrors web's agent presence semantics (packages/core/agents/derive-presence.ts) on iOS: 3-state availability (online / unstable / offline) derived from runtime.status + last_seen_at + task snapshot, with a 30s wall-clock tick so the 5-min unstable window decays without new server data. Pure derivation imported from @multica/core/agents (whitelisted). React glue (hook + WS + UI) is mobile-owned per the Sharing Principles in apps/mobile/CLAUDE.md. Wired into 12 avatar call sites via an opt-in showPresence prop: chat-header / agent-picker / session-sheet / inbox-row / issue-row / attribute-row / create-form-attribute-row / comment-card / run-row / project lead + picker. Chat composer gets an OfflineBanner above it that stays silent during loading. Two mobile-specific tweaks vs web: - 30s tick is AppState-gated and forces a recompute on foreground resume (iOS freezes JS timers in background). - daemon:heartbeat / task:progress / task:message are explicitly skipped from the WS invalidation list — high-frequency events would burn cellular data; web already documented this footgun in use-realtime-sync.ts. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): ambient agent-working badge in issue header Adds an always-visible "agent is working" indicator next to the issue detail Stack header — a small AvatarStack + green PulseDot that opens the Runs sheet on tap. Pairs with the existing in-card AgentActivityRow, which is the first-time discovery surface; the header badge is the ambient surface that stays put while the user scrolls the timeline (agent tasks run minutes to tens of minutes). Refactors AgentActivityRow + RunsSheet to dispatch through a shared useRunsSheetStore (Zustand), since the Stack-header tree and the page-body tree can't share local React state across that boundary on Expo Router. Rationale: Apple HIG "Progress Indicators" + agent-UX ambient status pattern. See plan /Users/qingnaiyuan/.claude/plans/ok-plan-linked-taco.md. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): squad @-mention support in issue composer Adds squad rows to the @-mention suggestion bar — picker / serializer / actor name lookup. Selecting a squad emits a `mention://squad/<uuid>` token; backend wakes the squad's leader. Mirrors web's mention extension (packages/views/editor/extensions/mention-suggestion.tsx): alphabetical sort, archived hidden, distinct "Squad" badge. Also adds a presence dot to the agent suggestion row in the same bar (opt-in showPresence prop on ActorAvatar, mirroring 12 other call sites on this branch). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * docs: add iOS mobile client section + apps/mobile/README Adds a pointer from the root README (EN + zh) to apps/mobile/, plus a mobile-specific README covering scripts, env files, and the build-onto- your-own-iPhone path for self-hosters. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(mobile): escape apostrophes in login + select-workspace copy CI lint failed on react/no-unescaped-entities. Two pre-existing JSX literals contained raw apostrophes; replace with &apos;. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore(mobile): add iOS app icon (shared 1024x1024 with desktop) Adds apps/mobile/assets/icon.png (copy of apps/desktop/build/icon.png, 1024x1024 RGBA) and points the Expo config at it. Resolves the \"No icon is defined in the Expo config\" warning on prebuild / EAS build. Single-source: any brand refresh updates desktop's icon, then mirrors into apps/mobile/assets/. Expo prebuild generates every required iOS icon size from this one PNG. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(mobile): remove alpha channel from app icon iOS app icons must not have an alpha channel — transparent backgrounds can render as a blank/default icon on the device home screen. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * docs(mobile): env example documents all six build/dev scripts Previous template only mentioned the two dev:mobile* (Metro) scripts. Now lists all six commands that read .env.development.local / .env.staging, and flags the compile-time-baked gotcha: changing a value requires a re-run of an ios:* build before an installed app sees the new value. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(mobile): chat tab badge stuck or self-clearing in background Two paired bugs in the auto-markRead effect: 1. A `lastMarkedRef` short-circuited every re-fire of the effect, so once a session was marked read, a subsequent chat:done arriving on the same session left the badge stuck at 1 forever. 2. With (1) gone, the effect re-fired even while the Chat tab was backgrounded (React Navigation keeps sibling tabs mounted), silently clearing unread state the user never had a chance to see. Mirror web's chat-window.tsx logic: gate on `useIsFocused()` (mobile's analogue of web's `isOpen`), and rely on has_unread itself as the dedup signal — the mutation's optimistic patch flips it false immediately, so the effect won't re-fire until the next chat:done flips it true again. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): add ios:device:staging:release build script Adds a Release-configuration build path for the staging variant: pnpm ios:mobile:device:staging:release → cd apps/mobile && expo run:ios --device --configuration Release Release builds strip `expo-dev-launcher` from the binary (it's only linked in the Debug Pod configuration), so the installed app loads the embedded JS bundle directly — no "Downloading…" screen, no Metro probe, no Recently-opened launcher menu. Standalone use feels like an App Store install. The existing `ios:device:staging` (Debug) path is unchanged — it stays the daily-driver for hot-reload development. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * docs(mobile): correct Debug-vs-Release standalone claim and env reload semantics Two corrections to docs landed earlier this branch: - The README told self-host users that ios:device:staging "runs without the Mac after the build completes." That is wrong for the Debug build it produces: every launch the embedded expo-dev-launcher probes Metro, showing a "Downloading…" / Recently-opened screen and stalling when the Mac is asleep or unreachable. Split the section into two paths and recommend the new :release variant for standalone use. - The .env.example said changing a value "requires re-running an ios:* build" and that "dev:* (Metro) alone will not refresh baked-in values." That is only true for an installed Release build. For Debug, restarting Metro is sufficient — it re-reads .env on startup and inlines the new values into the next JS bundle it serves. Rewrite the comment to distinguish the two cases. Also drop stale references to the removed ios:mobile:sim* scripts from the env example. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): adopt react-native-reusables + class-mode dark mode First wave of the RNR migration documented in apps/mobile/docs/ rnr-migration.md. The hand-written components/ui/ shell was producing a steady stream of dark-mode and sheet-handling bugs; this commit establishes the foundation that lets every subsequent screen pick up RNR-shipped components and a real theme system instead. Foundation (Phase 1): - global.css + tailwind.config.js switch to shadcn neutral CSS variables (light + dark) under :root and .dark:root, with Multica custom tokens appended. tailwind utilities resolve to hsl(var(--...)). - New lib/theme.ts mirrors the variables in TypeScript and exports NAV_THEME for React Navigation chrome. - New lib/use-color-scheme.ts wraps NativeWind's useColorScheme with expo-secure-store persistence (preference key: theme-preference, values: light/dark/system). - components.json registers shadcn CLI paths so `npx @rnr/cli add` writes to the expected aliases. metro.config.js gains inlineRem: 16. - app/_layout.tsx wraps the tree in ThemeProvider(NAV_THEME[scheme]) and mounts <PortalHost /> for RNR dialogs. - Settings → Appearance picker (three rows: Light / Dark / System, persisted) — the only product addition in this commit. Component canary (Phase 2): - button.tsx + text.tsx replaced by RNR's defaults via the CLI (uses TextClassContext to flow text variants from Button into nested Text). - 11 button call sites updated to wrap children in <Text> (the RNR convention). The old `brand` variant had zero call sites and was dropped without follow-up. Bottom navigation: - (tabs)/_layout.tsx tried NativeTabs first but rolled back to JS Tabs: NativeTabs hard-codes canPreventDefault: false on tabPress events, so the "More tap opens a sheet without navigating" pattern was unreachable. The rolled-back layout uses useColorScheme + THEME to derive active/inactive tint, fixing the dark-mode "dim selected tab" bug. - More tab intercepts tabPress and pushes /[workspace]/menu — a stack route registered with presentation: "formSheet" + sheetAllowedDetents: "fitToContents" so iOS sizes the sheet to the menu's intrinsic height (UIKit handles drag handle, swipe dismiss, blur backdrop). - The formSheet route is named `menu.tsx` rather than `more.tsx` to avoid the URL collision with (tabs)/more.tsx — both files would otherwise resolve to /[workspace]/more because (tabs) is a transparent route group. - components/nav/global-nav-menu.tsx refactored from a self-managed Modal into a plain ScrollView (no flex-1, so fitToContents can measure). Closes via router.dismiss() instead of an onClose prop. Docs / rules: - apps/mobile/CLAUDE.md adds two hard rules: "defaults first" and "iOS native > RNR > discuss" (the three-tier waterfall). - apps/mobile/docs/rnr-migration.md captures the alternatives evaluated, the three-tier component classification, the phased rollout, and the pitfalls hit during this commit. Out of scope for this wave (planned but not started): - Tier A remaining primitives (input / card / text-field / textarea) - Tier B sheets (the 18 hand-rolled Modal sheets — to be replaced one PR at a time with ActionSheetIOS / native pickers / RNR Dialog) - Tier C domain UI internal-token upgrades Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * wip(mobile): markdown rendering tweaks — incomplete Checkpoint commit. Markdown rendering refactor is in progress and not yet producing the full expected output; committing so it isn't lost alongside the RNR migration in the same tree. Will be finished in a follow-up before push. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor(mobile): simple Header + IconButton, drop ScreenHeader / ChatHeader Tab and stack screens were carrying two hand-rolled header components (ScreenHeader, ChatHeader) that reimplemented enough of UINavigationBar to ship the obvious bugs: hardcoded hex colors that didn't follow the NativeWind dark scheme, no shared dark/light token wiring, no consistent touch feedback for action buttons (Pressable + custom className per call site). This commit collapses both into one shared component family: - `components/ui/header.tsx` — slot-based (`title` / `center` / `left` / `right`) rendered in the screen's JSX. Self-handles the top safe area, uses semantic RNR tokens (`bg-background`, `text-foreground`, `border-border`) so dark mode flips via NativeWind class mode with no per-screen logic. - `components/ui/icon-button.tsx` — `<RNR Button variant="ghost" size="icon">` wrapping an Ionicon whose color falls back to `useTheme().colors.text` (the active navigation theme), so the glyph follows dark/light automatically without callers passing a color prop. - `components/chat/chat-title-button.tsx` + `chat-session-actions.tsx` — chat-specific slots that plug into the same Header (center + right) instead of the chat tab having its own complete header. Call sites: - Inbox / My Issues / Chat / more/issues — drop `<ScreenHeader>` and `<ChatHeader>`, render `<Header ...>` at the top of the screen body with the appropriate slot contents. - HeaderActions — Search / New-Issue buttons swap raw Pressable for IconButton. The previously-added Menu button is removed (redundant with the "More" tab in the bottom bar). - more/issues — was rendering both the workspace stack's native header AND its own ScreenHeader inside the screen body, so the filter button now goes onto the stack header via `navigation.setOptions({ headerRight })` and the in-body header is gone. Why the per-tab Stack approach (briefly explored) was abandoned: react-navigation's native large title is the only thing that needed a Stack per tab, and the product doesn't want collapse-on-scroll. With that gone, every dynamic header content piece (Inbox's archive menu, Chat's agent picker title) was forced through `navigation.setOptions` in a useLayoutEffect — strictly more complexity than just rendering the Header in JSX with state passed as props. Net: 349 lines removed, 208 added. Two header components deleted; two small primitives added. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(mobile): resolve mc:// image URIs against attachment list before render Markdown content authored in Multica stores image references as `mc://file/<id>` rather than baking signed HTTPS URLs into the text (signed URLs expire). iOS image loader doesn't understand the `mc:` scheme, so any attachment-image in a description, comment, or chat message was raising a redbox: "No suitable image URL loader found for mc://file/...". Web already resolves this via `packages/views/editor/ attachment-download-context.tsx`: components look up the markdown URL in the issue's attachment list and use the matching `download_url`. This commit mirrors that pattern for mobile. The wiring: - `data/schemas.ts` — AttachmentListSchema + EMPTY_ATTACHMENT_LIST - `data/api.ts` — listAttachments(issueId) → GET /api/issues/:id/attachments - `data/queries/issue-keys.ts` — `attachments(wsId, id)` key - `data/queries/issues.ts` — issueAttachmentsOptions - `lib/markdown/markdown.tsx` — Markdown accepts `attachments?` and forwards to MarkdownImage - `lib/markdown/markdown-image.tsx` — looks up uri in attachments, swaps for `download_url`; unresolved URIs fall through and fail the getSize callback gracefully (16:9 muted placeholder, no redbox) - `IssueDescription` and `CommentCard` — fetch via issueAttachmentsOptions; TanStack Query dedupes so the same issue's attachment list only fires one request regardless of how many components need it - `chat-message-list` — passes `message.attachments` directly (chat messages carry their attachment list on the message record itself, distinct from the issue-scoped model) Unmatched URIs (e.g. test placeholders like `file_abc123`) now render the same muted 16:9 fallback as a 404 — never a redbox. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor(mobile): typed ws.on<E>() + useWSSubscriptions to cut realtime boilerplate Adds WSEventPayloadMap in @multica/core/types so callers get the precise payload type per event — no more `const p = msg as IssueUpdatedPayload` boilerplate at every handler. Mobile ws-client adopts the generic signature; web's untyped on() is untouched but can opt in later. useWSSubscriptions wraps the if-ws-and-wsId-then-useEffect-cleanup template every Layer-3 realtime hook used to repeat. Each of the 8 hooks sheds ~7 lines of lifecycle scaffolding and ~30 total `as Payload` casts go away; only 1 deliberate cast stays for the cross-event onTaskEvent (task:progress has no formal payload interface yet). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): settings — profile + notifications subscreens, RNR primitives, API helpers Settings page rewritten to use RNR primitives (RadioGroup, Switch, Avatar, Separator) instead of self-drawn equivalents, removes 3 hardcoded #71717a hex colors in favor of THEME tokens, and adds Alert.alert confirmation on sign-out with destructive Button variant. Two new push subscreens under more/settings/: - profile.tsx edits name + avatar. Avatar tap opens iOS native ActionSheetIOS (Take Photo / Library / Remove) via expo-image-picker, then PATCH /api/me. - notifications.tsx 5 inbox groups + system_notifications toggle, backed by optimistic PUT /api/notification-preferences. New mobile-owned query + mutation for notification preferences mirror the web design (no runtime import — per CLAUDE.md "Mobile-owned updaters"). auth-store gets setUser action for in-memory user update after profile PATCH. ApiClient gains fetchValidated + fetchValidatedWith private helpers that collapse the fetch+parseWithFallback envelope. 4 settings-related methods migrated as canary (getMe, updateMe, getNotificationPreferences, updateNotificationPreferences); remaining 30+ read methods migrate progressively in later PRs. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): inbox refactor — Mark all read, swipe UX, parity fixes Swipe-to-archive no longer auto-fires on full drag (felt aggressive, no peek, easy mistrigger on fast scroll). Now matches iOS Mail / Linear: drag reveals the red Archive button + medium haptic at threshold, user taps to commit. Auto-fire path removed; useAnimatedReaction + runOnJS bridges the UI-thread shared value to Haptics.impactAsync. Behavioral parity fixes the previous mobile inbox was missing vs web: - Mark all read action — endpoint POST /api/inbox/mark-all-read already existed server-side; mobile just never wired it. Added api.markAllInbox Read + useMarkAllInboxRead (optimistic flip read=true on non-archived) + ActionSheet menu entry as the first option. - issue:updated → patch inbox row's StatusIcon inline. Previously mobile ignored the event and showed stale status until the next inbox event refetched the list. - issue:deleted → strip orphaned inbox rows so tapping doesn't 404 on the issue detail page. - Both via a new mobile-owned inbox-ws-updaters.ts mirroring web's packages/core/inbox/ws-updaters.ts. Internal cleanup: - inboxKeys factory in data/queries/inbox.ts ({all,list}, 3-segment shape matching web). 6 inline ["inbox", wsId] strings retired across queries / mutations / realtime / useCreateIssue inbox invalidate. - Synchronous setQueryData hack (workaround for iOS push transition snapshot capturing pre-flip state) moved from inbox.tsx caller into useMarkInboxRead.onMutate. Every caller benefits, none can forget it. UX polish: - Loading state: 6 Skeleton rows (RNR, installed this PR) replacing centered ActivityIndicator. - Empty state: mail-open icon + helper text replacing bare "No inbox items." copy. - ItemSeparatorComponent ml-[60px] → ml-16 (token, aligns with avatar 36 + px-4 + gap-3). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * docs(mobile): encode helper-layer conventions + swipe & Tier C lessons CLAUDE.md grew with rules surfaced by the inbox PR + the earlier WS / API helper work, so future agents can find the helpers instead of recreating them. New section "Data layer helpers" — three rails (logic mirrors web; use existing components, don't invent primitives; use the wrapped request layer) + helper-by-helper reference (fetchValidated, fetchValidatedWith, xKeys factory shape, ws.on<E>() + WSEventPayloadMap, useWSSubscriptions, synchronous-setQueryData-before-await ordering) + a 7-step checklist for new features. Realtime strategy extended with "Cross-cutting cache patches across features" — the rule that issue:* → inbox-cache patches live in inbox-ws-updaters.ts (owned by the feature being patched), not in issues' own hook. Reconnect table updated to use inboxKeys.list(wsId). Two new Lessons: - Lesson 7: destructive swipe is reveal-only, never auto-fire; haptic via useAnimatedReaction + runOnJS at the threshold. Encoded from the inbox PR's swipe UX fix. - Lesson 8: Tier C domain components (ActorAvatar, StatusIcon, etc.) upgrade opportunistically — don't silently rewrite when you're just rendering them in a new feature. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): issue detail — comment-as-modal route, hex/Pressable cleanup, API helpers Comment composer redesign (user feedback: inline always-on was clunky, keyboard avoidance bad, no room for @mention suggestion bar). The bottom of issue/[id].tsx is now a single <Button>Comment</Button>; tap pushes the new issue/[id]/new-comment modal — full screen for typing, AutosizeTextArea + MentionSuggestionBar + toolbar. Reply path goes through the same modal with parent / parentName route params, so "Reply" on a comment long-press just pushes the modal in reply mode. Comment-card long-press no longer competes with iOS native text selection: wrapped <Markdown> in a View with userSelect:'none' so the press only triggers the action sheet. Users can still copy the full comment body via the existing "Copy text" entry. issue/[id].tsx headerRight 3-dot menu switches from a hand-drawn Pressable + Ionicons (hardcoded #0a84ff/#71717a) to <IconButton>. Same hex cleanup applied to: - agent-activity-row.tsx (2× #a1a1aa → THEME.mutedForeground) - activity-row.tsx (MUTED constant deleted; SVG glyph takes stroke prop) - comment-card.tsx BRAND_RING/BRAND_WASH rgba constants gone — animated overlays now use NativeWind border-brand/50 + bg-brand/5 classes, opacity stays the only animated channel. API layer: 5 issue GET methods migrated to fetchValidated (getIssue, listTimeline, listAttachments, listActiveTasksForIssue, listTasksByIssue). Write endpoints stay on raw this.fetch per the existing mobile convention — migrating writes needs new zod schemas, defer to a follow-up PR. comment-composer.tsx deleted: orphan after the modal swap. CommentActionSheet is kept as-is — it has the quick-react emoji row (the only "add reaction" entry for comments) and already follows the correct Lesson 6 short-action card pattern. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor(mobile): close button uses <IconButton variant=secondary> Both the SheetShell (pageSheet header) and the standalone ModalCloseButton (modal Stack header) were drawing the circular grey close ✕ by hand: <Pressable> + <View bg-secondary> + <Ionicons color="#3f3f46">. Two problems with that pattern: 1. The #3f3f46 zinc-700 hex is invisible in dark mode — the icon and background both go dark, contrast collapses. 2. It bypasses RNR Button (which is exactly what an icon button is), re-implements active state, and lives outside the design system. Swap both to <IconButton name="close" variant="secondary" className="size-7 rounded-full"> — RNR Button under the hood, secondary variant carries the bg-secondary token (so dark mode flips), icon color comes from useTheme(). className locks the 28pt circular shape that Linear iOS / Things 3 use for this slot (RNR's default size="icon" is a 40pt rounded-md square box, which is a different look). One-line fix per file, no new primitive. Affects every pageSheet close button (RunsSheet, picker sheets via sheet-shell) and every modal close button (new-issue, search, new-comment). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(mobile): PulseDot uses brand colour, not success — running ≠ completed The agent "is working" pulse dot (shown both in the issue Stack header ambient badge and in the in-card AgentActivityRow "Working" row) was backgroundColor #22c55e — that's the success/completed token. Reading green here meant "task complete", which is the opposite of what the animation represents. Switch to THEME[scheme].brand (hsl(225 71% 58%)), matching: - mobile RunRow status text: STATUS_CLASS.running = "text-brand" - web agent-live-card.tsx:327: <Loader2 text-info animate-spin /> - Apple HIG / shadcn semantic colour convention: green = success, blue/brand = in-progress, red = destructive One-line fix in pulse-dot.tsx; both call sites (AgentHeaderBadge top-right, AgentActivityRow under the title) flip from green to brand blue together. Docstring updated to spell out the rule for future readers: DO NOT use success here. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(mobile): activity ↔ web parity — start_date / squad_leader / wording Five small fixes that close the remaining gaps between mobile's activity rendering and the web equivalent in packages/views/issues/components/ issue-detail.tsx. All logic-layer; no component or container changes. - timeline-coalesce.ts: add NEVER_COALESCE_ACTIONS = {squad_leader_ evaluated}. Without it, two consecutive squad-leader evaluations from the same actor within 2 min merged into one row, dropping the second's `outcome` + `reason` audit fields. Web does this since the rule was added; mobile was missing it. - format-activity.ts: add cases for `start_date_changed` (set / remove branches) and `squad_leader_evaluated` (outcome × reason 4 branches). Before, both fell through to the default that returns the raw enum name — users saw literal `start_date_changed` / `squad_leader_ evaluated` strings in the timeline. - format-activity.ts: tighten assignee wording from "assigned NAME" to "assigned to NAME" — matches web's en/issues.json copy. - activity-row.tsx: `LeadIcon` now reuses CalendarGlyph for `start_date_changed` (same affordance as `due_date_changed`). - components/inbox/detail-label.tsx: TYPE_LABEL Record was missing `start_date_changed` — fixes a pre-existing TS error. - data/schemas.ts: EMPTY_ISSUE_FALLBACK was missing `start_date: null` — fixes the other pre-existing TS error. Both gaps had the same root cause (backend added the field, mobile didn't follow). Typecheck is now clean — no pre-existing errors remaining. Copy strings mirror packages/views/locales/en/issues.json verbatim (activity.start_date_set / squad_leader_action / etc.). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): attribute row — project picker wired + all pickers go pageSheet Issue-detail AttributeRow chip row (status / priority / assignee / label / project / due-date) had three nagging gaps. Fix them together so the whole row behaves consistently. - ProjectPickerSheet was never wired: the file existed (155 lines, ready to use) but the chip was read-only with a stale `// picker deferred until web ships one` comment. Web has had a project picker forever. Add the projectOpen state, an `onProject` handler that calls `useUpdateIssue.mutate({ project_id })`, a placeholder dimmed chip when no project is set, and mount the sheet. Mobile users can now change an issue's project. - PRIORITY_LABEL was duplicated in two places — re-declared inside priority-picker-sheet.tsx (full form `none: "No priority"`) and as a near-identical chip placeholder in attribute-row.tsx (short form `none: "Priority"`). Both now import from the single source in `lib/issue-status.ts`; attribute-row keeps a 1-key override (`PRIORITY_CHIP_LABEL = { ...PRIORITY_FULL_LABEL, none: "Priority" }`) so the chip placeholder still reads as a placeholder, not as an assigned value. - Sheet container split was inconsistent: assignee / label / project pickers used SheetShell pageSheet (slide-up from bottom), while status / priority / due-date used a centered transparent Modal card (different gesture, different position). For a chip row where users tap several pickers in succession, the inconsistency broke iOS muscle memory. Status / priority / due-date all switch to pageSheet so the whole row reads as "tap chip → slide-up sheet" uniformly. Linear iOS / Things 3 / Apple Reminders use this pattern even for short fixed lists. CLAUDE.md Lesson #6 modal container table grew a "picker-row consistency wins over per-container optimisation" carve-out so future row-of-pickers work follows the same rule. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor(mobile): 5-tier surface elevation scale — fixes comment-bubble nested contrast + inline-code link confusion Two related fixes that share root cause: shadcn's neutral palette collapses `secondary` / `muted` / `accent` to the SAME L 96.1% value intentionally — it's a single tonal slot whose semantic name varies by use case, not three different colors. Stacking a bg-muted child on a bg-secondary parent (which is what we were doing for code/table headers inside the comment bubble) made the inner element visually disappear. Introduce a proper 5-tier elevation scale calibrated to Refactoring UI and Material 3 guidance: L 100 page bg / card / popover (page floor) L 98 surface-1 NEW (subtle elevated — comment bubbles, iOS settings-cell feel: visible boundary via radius + border, fill is almost-page) L 96.1 secondary / muted / accent (shadcn default, untouched — button hover, chips, skeleton) L 90 surface-2 NEW (nested inside surface-1 — table headers + code blocks inside comment bubbles, 8% L step over surface-1) L 84 border (was 89.8% → 84%) (visible across every tier, 6-16% darker than adjacent surface, within Refactoring UI's 5-10% guideline) Dark mirror flips the lightness direction (higher elevation = lighter): page 3.9 → surface-1 8 → secondary 14.9 → surface-2 19 → border 25. Applied across three files: - global.css + tailwind.config.js + lib/theme.ts mirror the new tokens (CSS variables, Tailwind class map, TypeScript export — they must stay in sync per CLAUDE.md §5). - components/issue/comment-card.tsx switches the bubble bg from `bg-secondary` (too prominent, same color as inner muted elements) to `bg-surface-1` (subtle, 8% lighter than inner surface-2). - lib/markdown/markdown-style.ts: - table.headerBackgroundColor + codeBlock.backgroundColor: `t.muted` → `t.surface2`, so they're framed against the bubble. - inline `code:`: REVERT 2026-05-19's `color: t.brand` workaround for upstream enriched-markdown #255. The brand-tint avoided the chip's top-heavy padding artifact but broke Refactoring UI's #1 rule (color carries semantic meaning — brand IS the link color, users reported tapping inline code thinking it was a link). Re-enable bg-chip + foreground text, matching GitHub mobile / Slack / Notion / Apple Notes. The padding artifact is the lesser evil; in surface-2 (L 90%) on surface-1 (L 98%) the chip is subtle enough that the few pixels of asymmetry are unobtrusive. The shadcn `secondary` / `muted` / `accent` tokens stay at L 96.1% unchanged — other call sites (button hover, skeleton, avatar fallback, chips) all work fine on their own and were never the problem. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * docs(mobile): hoist "existing pattern first" to Principle 1 in UI rules So AI agents grep the codebase for an analogous component before reaching for RNR add or hand-rolling — structural fix for the pre-migration legacy (21 hand-written components, 18 sheets) that accumulated by treating each new screen as a blank slate. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): align my-issues + Issues with web/desktop — squad parity, scope tabs, RNR UI - my-issues "agents" scope now uses server-side involves_user_id (MUL-2397) covering squads the user is involved in; tab label "Agents and Squads" matches web my-issues.json:14 - workspace Issues gains all / members / agents scope tabs with per-scope counts (client-side assignee_type filter mirroring issues-page.tsx:90-94), scope persists across workspace switches - both screens migrate to iOS-native SegmentedControl, IconButton + dot, Ionicons chip X, and a shared IssuesLoading skeleton — drops hardcoded #71717a and react-native-svg usage on these surfaces - new useClearFiltersOnWorkspaceChange hook + IssuesLoading component shared across both surfaces (three-occurrence threshold respected) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): migrate sheet modals to route-level pageSheet (Tier B rollout) Replaces the legacy "Modal transparent fade + hand-drawn backdrop" sheet shell with expo-router route-level pageSheet modals — the canonical container for content sheets per mobile/CLAUDE.md Lesson 6 and the Tier B section of docs/rnr-migration.md. Sheets deleted (9): chat session-sheet, comment-action-sheet, issue-filter-sheet, six issue pickers (assignee, due-date, label, priority, project, status), runs-sheet, project add-resource-sheet, project-lead-picker-sheet, plus the shared sheet-shell and runs-sheet-store that supported them. Route-level modals added: /[workspace]/{chat-sessions, issues-filter, new-issue-picker/*, issue/[id]/{runs, picker/*, comment/[commentId]/actions}, project/[id]/{add-resource, picker/lead}}. Each picker is split into a thin route file + reusable *-picker-body.tsx so the same body composes inside the new-issue draft form and the issue-detail attribute row. Comment CRUD endpoints (update / delete / resolve / unresolve) + matching optimistic mutations + CommentSchema added to support the new comment actions route. Two new draft/picker stores carry session-scoped state for the chat-session picker and the new-issue form. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * docs(mobile): markdown rendering ADR + selectable carve-out Formalises the rendering decision (Path B — react-native-markdown-display + Shiki + custom renderers) into a one-page ADR with A-tier source citations, keeping the longer research log alongside it. Adds a `selectable` opt-out to `CodeBlock` and `Markdown` so timeline comments can disable RN's UIKit selection magnifier when an outer Pressable already owns the long-press gesture, while issue descriptions and chat messages keep the default selectable behaviour for copy-to-clipboard. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(mobile): add inline titles to 5 issue picker bodies SHEET_OPTIONS sets headerShown: false so every formSheet body must draw its own title. Five issue pickers (status / priority / assignee / label / project) were shipping headerless; only due-date had a title. Inline a single header row in each body — five callers, no shared primitive (3x rule not triggered). * feat(mobile): full emoji picker for comment reactions via formSheet route Mobile now offers the full emoji set behind a 'More reactions' overflow in the per-comment actions sheet, matching web's emoji-mart parity. - Adopt rn-emoji-keyboard 1.7.0 (zero runtime deps, React 19 / RN 0.83 compatible, installed via expo install). - New formSheet route at issue/[id]/comment/[commentId]/emoji-picker.tsx embeds EmojiKeyboard inline so UISheetPresentationController retains grabber, detents, and drag-to-dismiss. - Quick-row overflow '+' button in comment actions pushes the new route. - Delete the dead emoji-picker-sheet.tsx and the unused emojiPickerOpen state in comment-card.tsx (never opened from anywhere after the actions-route migration). - Move QUICK_EMOJIS to lib/quick-emojis.ts since its old host file is gone. - Update rnr-migration.md B.4 to record the resolution. * feat(mobile): project status + priority pickers via formSheet routes Project detail's Status and Priority chips were the last two picker chips still using the legacy centered-Modal pattern. The mixed gesture (Status/Priority popped a centered card; Lead / Add Resource slid up a formSheet) violated the picker-row consistency rule in CLAUDE.md Lesson 6 — the four chips on the same row now all open the same way. - New picker bodies under components/project/pickers/. - New formSheet routes under app/(app)/[workspace]/project/[id]/picker/. - Register both screens in workspace _layout.tsx using SHEET_OPTIONS. - project/[id].tsx: drop the local state, swap chip onPress to router.push, and remove the trailing 'still uses transparent-Modal' apology comment. - project/new.tsx is a draft modal so it can't push to a route (no project exists yet to read from cache). Inline a tiny DraftPickerModal shell that hosts the same picker bodies — documented in the file. - Delete the obsolete ProjectStatusPickerSheet / ProjectPriorityPickerSheet files and update rnr-migration.md to reflect that B.2 is closed. * refactor(mobile): menu sheet uses shared SHEET_OPTIONS Drop the bespoke 'fitToContents' branch for menu.tsx. Every other formSheet uses [0.6, 0.95] explicit detents to dodge the iOS 26 + Expo 55 fitToContents bugs (expo/expo#42904, #42965). Keeping menu on the unsafe API solely because it 'shipped first' was a divergence without a current reason — the bugs apply to it too. SHEET_OPTIONS is now the single source of truth for every sheet. CLAUDE.md Lesson 6 rationale updated to match. * fix(mobile): reset cross-route draft stores on workspace change Both useNewIssueDraftStore and useChatSessionPickerStore hold workspace-scoped state (assignee ids, draft session ids) that points at records in the workspace that seeded them. Switching workspaces left that state in place — a draft assignee from workspace A would survive into workspace B's new-issue modal, where the id resolves to nothing. Add a reset() to chat-session-picker-store (new-issue-draft-store already had one) and expose a use…ResetOnWorkspaceChange(wsId) hook from each store file. Wire both hooks once from workspace _layout.tsx so the reset fires on every transition between matched workspace ids. Docblocks updated to record where the reset is wired (single source of truth: workspace _layout.tsx). * fix(mobile): typed picker pathname maps replace 'as never' router.push attribute-row.tsx and create-form-attribute-row.tsx built the formSheet route pathname via template strings cast 'as never', which silently accepted any field name. Typos would compile and only blow up at runtime with a 'no matching route' that's easy to miss in dev. Introduce per-row IssuePickerField / NewIssuePickerField union types mapped to literal-typed pathname records (with 'satisfies' to keep the record exhaustive). Any new picker field is now a compile error until both the union and the map are updated together. Verified: changing 'priority' to 'pirority' at a call site now produces TS2345 instead of compiling silently. * fix(mobile): cold-start anchor for formSheet deep links Without unstable_settings.anchor, a deep link or notification that targets a formSheet route (issue/[id]/picker/status, etc.) cold-starts the app onto the sheet alone — no parent screen, swipe-down lands the user on a blank canvas. Anchor: '(tabs)' tells Expo Router to mount the tab UI as the implicit base, so dismissing the sheet always returns to a sensible workspace home. Set on the workspace _layout.tsx that owns every formSheet route registration. The root (app)/_layout has no formSheet declarations so no anchor is needed there. * refactor(mobile): new-project draft store + formSheet pickers Replaces the one-off DraftPickerModal (RN <Modal transparent fade> + centered card) in project/new.tsx with the same cross-route draft-store + formSheet picker route pattern as new-issue. Status / priority chips now push /new-project-picker/<field> like the new-issue chips do, and the picker bodies are reused as-is. Removes the last hand-rolled modal sheet introduced after the Lesson 6 formSheet migration — keeping the rule "every sheet is a formSheet route" intact across the codebase. * fix(mobile): make first mount a true no-op in draft-store reset hooks The two cross-route draft store reset hooks (new-issue, chat-session) documented their first mount as "effectively a no-op" but the implementations stomped the store on every workspace-id transition including the initial null → uuid resolve. That's harmless when the store is already INITIAL but contradicts the docblock and would corrupt any future code that pre-seeds the store before navigation lands. Gate the reset() call on a useRef-tracked previous id so it only fires on genuine transitions. Matches the new-project-draft-store hook added in the prior commit so all three stores follow one shape. * fix(mobile): menu sheet keeps fitToContents detent The Tier B sheet migration swept menu.tsx into shared SHEET_OPTIONS, which set sheetAllowedDetents=[0.6, 0.95]. That's right for picker-row sheets where consistency across neighbour chips matters, but the menu is an isolated sheet (≤ 5 fixed actions, opened from the tab bar) — the two-snap default leaves ~60% of the sheet blank. Override sheetAllowedDetents to "fitToContents" for menu only, and amend the SHEET_OPTIONS rationale in apps/mobile/CLAUDE.md so the rule is spelled out: picker-row sheets share the explicit detents for muscle-memory carry-over; isolated sheets shrink-wrap. * fix(mobile): align picker search box to title (px-4) The three search-bearing picker bodies (assignee / label / project) had title rows at px-4 and search boxes at px-3 — a 4px misalignment where the search field's leading edge sat outside the title's leading edge. Bring the search container to px-4 so the title text, the search placeholder, and the search input all share one vertical baseline. Status / priority / due-date pickers have no search box (and so no misalignment); project-detail lead picker has no title row (search box defines its own px-3 baseline), both intentionally unchanged. * feat(mobile): mirror web project progress section in header card Adds a horizontal progress bar driven by `done_count / issue_count` plus a "X / Y · NN%" label, hidden when issue_count is zero (no info to show + divide-by-zero hazard). Mirrors web's project-detail.tsx 596-620 to satisfy behavioral parity — web users see project progress in the project header, mobile users should too. Note: this change was added autonomously by the code-review follow-up agent outside the original 6-item review scope. Code quality is sound (token-based colors, zero-count guard, web source referenced inline) so kept rather than dropped, but flagged here for traceability. * feat(mobile): project surface v1 — Board view, hex/SVG sweep, planning docs Closes the remaining items from project-v1-plan.md: - View mode switcher (List / Board) on project detail's related-issues: - List mode regrouped into full BOARD_STATUSES (backlog / todo / in_progress / in_review / done / blocked), replacing the mobile-only "Open / Done" two-bucket rollup that silently diverged from web's six-bucket grouping (parity violation, gap audit §3) - Board mode: horizontal scroll, one status column per group, each column is a FlatList of IssueRow (reuses existing primitive) - View mode is local useState — no Zustand store (single component scope, mobile/CLAUDE.md "no state unless required") - Hex sweep → THEME tokens / NativeWind semantic classes (gap audit §5): project-properties-section, project-resources-section, project/[id], more/projects. Eliminates the last project-domain dark-mode breakage. - Hand-drawn SVG icons → existing primitives (gap audit §6): more/projects PlusButton → <IconButton name="add"> project-properties-section chevron → <Ionicons name="chevron-forward"> project-related-issues chevron → <Ionicons name="chevron-forward"> Drops react-native-svg where no longer used. Items 1 / 2 / 4 (Tier B picker migration, progress section, new-project draft persistence) landed in preceding commits c644e2a3, 7337206f, 2ff95c34. With this PR the full project-v1-plan is implemented and the two planning docs (gap audit + implementation plan) are committed for future reference. * refactor(mobile): drop project board (kanban) view, keep list-only Mobile intentionally diverges from web's Board / List view selector and ships only the status-grouped list. Reasons (now documented in the file docblock): - Phone screens are too narrow to show ≥3 status columns at once, defeating kanban's core "see pipeline at a glance" value — users end up swiping between near-empty columns. - Major mobile task apps (Linear iOS, Things, Apple Reminders) don't ship kanban; list with status grouping is the established small-screen pattern. - mobile/CLAUDE.md "Behavioral parity" permits UI divergence when semantics agree. Same issues, same status enum, same 6 BOARD_STATUSES grouping — only the layout differs. What stays from the prior plan: - Full BOARD_STATUSES grouping (backlog / todo / in_progress / in_review / done / blocked) — the real parity fix replacing the earlier mobile-only "Open / Done" two-bucket rollup. Cancelled remains hidden on both clients. What's removed: - BoardView component + horizontal ScrollView - View mode SegmentedControl + ViewMode local state - BoardView's column-empty placeholders The `@react-native-segmented-control/segmented-control` dependency is kept — my-issues and more/issues still use it for scope tabs (Mine / All / Agents) where semantics also vary on web. * feat(mobile): More tab opens dropdown popover anchored above the tab Tapping the More tab now opens a small DropdownMenu popover containing the user card, workspace switcher, and secondary nav (Issues/Projects) — anchored directly above the tab button. Replaces the previous listeners.tabPress that pushed /menu as an iOS formSheet, which felt heavy for a quick switch. Implementation: - Add @rn-primitives/dropdown-menu and a shadcn-style wrapper at components/ui/dropdown-menu.tsx (Root/Trigger/Portal/Overlay/Content/ Item/Label/Separator using semantic tokens — bg-popover, accent, border — matching the existing button.tsx pattern). - New MoreTabDropdownAnchor (components/nav/more-tab-dropdown.tsx) mounts as a sibling to <Tabs> at the workspace tabs layout. It is absolute-positioned over the More tab's screen rect (right 25%, bottom = safe-area inset, height = 49) with pointerEvents="box-none" so taps pass straight through to the real tab button. The Trigger inside is an invisible Pressable; opened imperatively via TriggerRef.open() from listeners.tabPress on the More tab. The @rn-primitives Trigger measures its own rect inside open(), so the popover anchors correctly without manual screen-width math. - The /menu formSheet route stays registered in [workspace]/_layout.tsx as a dead path for now (reversibility); to be removed once the popover bakes in. Rejected alternative: replacing the More tab's tabBarButton with a custom DropdownMenuTrigger wrapper. RN's BottomTabItem wraps the returned button in <View style={{flex:1}}> and expects a single Pressable; introducing the DropdownMenu Root as an extra wrapping View broke the flex layout and stripped the "More" label. The Option B pattern here leaves the real tab button entirely untouched. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor(mobile): swap SegmentedControl for RNR Tabs; drop bg-popover from sheet contents - Add components/ui/tabs.tsx (RNR Tabs primitive wrapper on @rn-primitives/tabs, shadcn-style API). - My Issues and the More > Issues page swap iOS SegmentedControl for the new RNR Tabs — consistent visual with the rest of the RNR components and gives count-suffix labels room to breathe. - Switch the shared SHEET_OPTIONS contentStyle from height: "100%" to flex: 1 — works for both fixed-detent and fitToContents sheets, whereas the explicit 100% height pre-empted flex behaviour in the fitToContents case. - Drop the explicit `bg-popover` background from sheet root Views (chat-sessions, issues-filter, runs, comment actions/emoji-picker, add-resource). The iOS formSheet container already paints the popover surface; an inner bg-popover stacked on top showed as a subtle double-layer when detents animated. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): native iOS assignee picker — search bar + pin selected + checkmark accessory - Switch assignee picker (issue + new-issue) from body-rendered header to native Stack header + UISearchController via headerSearchBarOptions. - Body becomes pure FlatList — fixes react-native-screens#3634 overlap (FlatList now route's direct child, no intermediate wrapper view). - Pin currently-selected actor + Unassigned to the top when no query; search results stay in member → agent → squad order. - Inline right-aligned "Agent" / "Squad" tag mirrors Apple's Value-1 cell style (UIListContentConfiguration.valueCell) used throughout Settings. - Selection indicator: Ionicons checkmark in primary tint only, no row bg highlight (Apple HIG: never use selection to indicate state). - Avatar 28pt → 36pt. - autoFocus on search bar for search-first pickers — keyboard appears on mount, opt-in via hook option. - Extract useNativeSearchBar + useScrollToTopOnChange hooks under apps/mobile/lib/ for phase-2 rollout to label / project / lead pickers. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * wip(mobile): in-flight comment-select / chat / markdown work Batch commit of pre-existing uncommitted work carried forward alongside the assignee picker refactor. Topics mixed — split into proper atomic commits when each lands. - apps/mobile/data/comment-select-store.ts: new comment-selection store - components/issue/comment-card.tsx + issue/[id].tsx + comment actions: comment-select wiring - components/chat/chat-message-list.tsx: chat list rework (~170 lines) - lib/markdown/markdown.tsx: markdown adjustments - package.json + pnpm-lock.yaml: dependency drift Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore(mobile): EXPO_BUNDLE_IDENTIFIER override + brand logo + CLAUDE.md preflight rules - .env.example + app.config.ts: optional EXPO_BUNDLE_IDENTIFIER for devs whose Apple ID isn't on the Multica team - components/brand/multica-logo.tsx: new brand logo asset - CLAUDE.md: restructured with mandatory pre-flight (read web impl → show plan → wait for go) before any new mobile feature; consolidated behavioral parity rules Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(mobile): friendlier auth error messages on login + verify Adds lib/auth-error.ts that maps backend raw English errors (invalid / expired / rate-limited / network) to user-facing copy. login.tsx and verify.tsx route their catch blocks through it with a per-screen fallback string. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore(mobile): markdown rendering + UI primitive polish - lib/markdown/{code-block,markdown-style,preprocess}: refined code block rendering, restructured style map, preprocess tweaks - components/ui/{actor-avatar,text-field}: visual polish - components/issue/mention-suggestion-bar: tweaks alongside inline composer mention pipeline - components/editor/use-file-attach: small adjustments Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): picker polish + inline label create with deterministic color - New labels mutation (data/mutations/labels.ts) + createLabel API method (data/api.ts) so the label picker can create-and-attach in one flow without leaving the sheet - lib/inline-color.ts: deterministic palette hash ported from packages/views label-picker for behavioral parity (same name → same color across web/mobile) - All issue + project picker bodies (label/priority/status/project on issues; lead/priority/status on projects) reworked for visual + interaction consistency - Picker route shells (issue/[id]/picker/{label,project}, new-issue-picker/project, project/[id]/picker/lead) updated to match Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor(mobile): drop menu route + global-nav-menu, dropdown only The More-tab dropdown popover (introduced earlier) now covers everything the dedicated /menu route and global-nav-menu component used to render. Drop both. The Stack.Screen registration for the menu route in (app)/[workspace]/_layout.tsx is removed in the follow-up comment-surface commit alongside other dead route registrations. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): comment surface — inline composer + UIKit context menu + failed-retry + last-viewed divider Replaces the old route-based comment composition + actions sheet with surface-level UI that matches iMessage / Slack iOS / Telegram conventions. Long-press on a comment bubble now hands the gesture to UIKit's UIContextMenuInteraction (via react-native-ios-context-menu) — system blur, snapshot scale, grouped menu (Reply / Edit / Copy / Select Text / Copy Link / Resolve / New Issue / Delete), and a Tapback-style auxiliary preview emoji row above the snapshot. Eliminates the race between Pressable.onLongPress and UITextView's selection magnifier that the old formSheet route suffered from. New inline composer (components/issue/inline-comment-composer.tsx) sits at the bottom of the issue detail screen, pinned just above the keyboard via KeyboardStickyView (react-native-keyboard-controller). Replaces the new-comment.tsx modal route — phone keyboard already gives the composer dedicated real estate, the route + draft store were overhead. Timeline gains: - "New since last view" divider driven by data/stores/last-viewed-store.ts - Failed-comment retry/discard inline affordance backed by data/stores/failed-comments-store.ts (mutation onError keeps the optimistic entry; this store carries retry metadata + error string) Data layer: - mutations/issues: useCreateComment accepts attachmentIds, mirrors web's activeIds derivation - realtime/issue-ws-updaters + use-issue-realtime: WS coverage tweaks for new comment lifecycle - comment-select-store: extended for the Select Text path triggered from the new context menu Cleanup of dead route registrations (workspace _layout.tsx) for the removed new-comment, comment/actions, and (already-removed) menu routes. Adds deps: react-native-ios-context-menu, react-native-ios-utilities, react-native-keyboard-controller. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): More popover — pins + workspace switcher - Pins: pin issues/projects from the header three-dot menu; Pinned list in the More popover; mirrors web's pin endpoints + cache shapes. Adds data/queries/pins.ts, data/mutations/pins.ts, realtime updater, PinListSchema + EMPTY_PIN_LIST fallback. - Workspace switcher: collapse the per-workspace list in the More popover down to a single WorkspaceCard row + pushes a dedicated switch-workspace formSheet with an iOS Alert.alert confirm before actually switching. Adds friction against accidental taps and keeps the popover short. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor(mobile): comment + chat long-press → ActionSheetIOS, composer pill↔expanded - Comment long-press: drop react-native-ios-context-menu UIContextMenu wrapper in favour of native ActionSheetIOS via a useCommentLongPress hook. Removes two native deps (react-native-ios-context-menu + react-native-ios-utilities). The "Select text" path still works — toggling useCommentSelectStore swaps the bubble's long-press handler for selectable text. - Comment composer: two visual states. Collapsed = pill placeholder ("Add a comment, @ to mention…"). Expanded = TextInput + toolbar (📎 attach · ➤ send). Adds reply-target-store driven by the long-press "Reply" action and an attachment row (composer-attachment-row + comment-attachment-list mirror web's data contract). - Chat: matching ActionSheetIOS long-press (Copy / Select Text / Cancel) via message-long-press + chat-select-store; cleared on tab blur via useFocusEffect. - useMentionInput.setText now accepts the React functional updater so post-await replacements (upload placeholder → final markdown) don't lose the user's intermediate typing. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor(mobile): list parity polish + drop new-issue seed params - my-issues / more issues: drop the RNR Tabs primitive in favour of plain Pressable pills (Tabs adds vertical padding + a divider that break under the cramped 375pt SE3 layout). "Agents and Squads" pill label trimmed to "Agents" — backend predicate unchanged (involves_user_id), empty-state copy still mentions "agents or squads". Scope counts dropped from pill labels (web's IssuesHeader doesn't show them either, and "(123)" suffix overflowed on SE3). - issue-row: render assignee whenever assignee_type + assignee_id are both truthy. Earlier whitelist (member/agent only) silently dropped squad assignees; ActorAvatar already handles all four enum values. - new-issue: remove unused seed_content / seed_actor route params — the comment-action-sheet path that fed them no longer exists. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * style(mobile): tighter markdown code sizing + auth layout - Markdown: inline code 15→14 (match body) and block code 14→13 + leading-5. SF Mono is denser than PingFang at the same point size, so the +1 inline bump made mono glyphs visibly larger than surrounding Latin text; the new sizing matches GitHub Mobile / Linear iOS / Notion iOS. The two paths (CodeBlock vs enriched list-nested code) now agree on 13px. - Login + verify: logo 56→32, title text-3xl bold → text-2xl semibold, description text-base → text-sm, outer gap-8 → gap-6, brand cluster gap-4/2 → gap-3/1. Brings the auth screens in line with iOS native Settings / Things 3 / Linear iOS layouts. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore(mobile): fresh-checkout build path — simulator scripts, env consistency - Track apps/mobile/.env.staging (root .gitignore was swallowing it despite mobile gitignore claiming it was committed). Fresh checkouts can now run *:staging without copying the template first. - Rename EXPO_BUNDLE_IDENTIFIER → EXPO_BUNDLE_IDENTIFIER_DEV and apply only in the dev variant of app.config.ts. Expo CLI auto-loads .env.development.local on every run regardless of APP_ENV, so a generic name silently leaked a dev's personal bundle id into staging / production builds and collapsed the three variants onto one id. The _DEV suffix + isDev-only branch keeps each variant on its canonical id. - Add ios:mobile / ios:mobile:staging scripts (root + apps/mobile package.json) so the iOS Simulator path exists end-to-end. Previously the only documented build commands targeted USB devices. - Rewrite apps/mobile/README.md: 6-row command table, first-time setup section (.env.development.local copy step, EXPO_BUNDLE_IDENTIFIER_DEV note), explicit simulator section, clarify 7-day signing limit applies to device builds only. - Update root CLAUDE.md mobile commands block to list both simulator and device commands. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(mobile): prod build path + composer/mention/edit polish Prod build path — lets external users self-build a personal copy against api.multica.ai's production backend: - New `prod` variant alongside `dev` / `staging`: `.env.production`, `dev:prod` / `ios:device:prod` / `ios:device:prod:release` scripts - `EXPO_BUNDLE_IDENTIFIER_PROD` shell override in `app.config.ts` for contributors not on the Multica Apple Developer team (parallel to existing `_DEV` pattern) - Public docs page `mobile-app.{mdx,zh.mdx}` + Reference entry; README gains a top-of-file "Just want to use it" section Composer refactor: - Shared `components/composer/message-composer.tsx` shell removes ~400 lines of duplication between chat-composer and inline-comment-composer - Mention picker pulled out of inline modal into a Router formSheet route (`mention-picker.tsx` + `pickers/mention-picker-body.tsx`), backed by a Zustand `mention-draft-store` Other: - Issue edit screen (`issue/[id]/edit.tsx`) + reusable description-field - Chat empty-state and timeline split into dedicated components; status-pill / message-list / attachment-row rewrites - Markdown render tweaks, `lib/format-elapsed.ts`, `ui/collapsible.tsx` - Realtime / schemas additions for chat session updates; new mention-picker stack screen registered in workspace `_layout.tsx` Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * docs(mobile): rewrite self-build framing + fix latent CI errors Docs: drop the "Multica Apple Developer team" framing (no such team) — every contributor signs the default bundle id with Xcode's free Personal Team; the EXPO_BUNDLE_IDENTIFIER_PROD override is just a fallback for the rare case where the prefix gets squatted in Apple's developer portal. Touched: - apps/mobile/README.md (top "Just want to use it" section) - apps/docs/content/docs/mobile-app.{mdx,zh.mdx} CI: latent type / lint errors that the prior install-step failure had been masking — surfaced once dependencies installed cleanly: - failure-reason-label.ts / run-row.tsx — add the new codex_semantic_inactivity enum key from packages/core/types/agent.ts - schemas.ts UserSchema + EMPTY_USER — add profile_description, timezone - schemas.ts EMPTY_ISSUE_FALLBACK — add metadata - profile.tsx — escape apostrophe in JSX text Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-22 19:14:55 +08:00
Naiyuan Qing	e0b756f515	feat(issues): redesign board card layout + extract useTimeAgo i18n hook (#3064) ... * refactor(views): replace static timeAgo with shared useTimeAgo hook The previous timeAgo helper in packages/core/utils.ts hardcoded English output ("2d ago"), producing "更新于 2d ago" mixed-language strings in zh locale. Replaced with a localized useTimeAgo() hook in packages/views/i18n, backed by common.time.{just_now,minutes_ago, hours_ago,days_ago} translation keys. Migrated all 10 view-side call sites and removed the static function. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(issues): redesign board card layout Properties were piling onto the bottom row (assignee + priority badge + start date + due date) until it overflowed. Restructured into four semantic rows: - Top: priority icon (left, icon-only — color already conveys urgency) + identifier; agent activity indicator (right) - Title - Chip row: project + labels - Meta row: assignee (left, avatar + name when only property present; bare avatar otherwise) + start/due dates + child progress Long agent/team names truncate cleanly (min-w-0 + max-w-[160px]) and dates/progress are shrink-0 so they never compress. When the meta row contains only an assignee, the right side fills with "Updated 2d ago" to avoid a half-empty row. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-22 15:21:10 +08:00
Bohan Jiang	c967ae0e0e	feat(issues): platform-owned parent notify on child done (MUL-2538) (#3055) ... * feat(issues): platform-owned parent notify on child done (MUL-2538) When a child issue transitions from a non-done status into `done` and has an open parent, the server now posts a top-level platform-generated comment on the parent itself. Replaces the agent-prompt rule shipped in PR #2918, which produced self-mention loops, planner ping-pong, and accidental `MUL-` prefix hardcoding because the agent did not always know the workspace prefix. - Migration 107 widens `comment.author_type` to allow `system`; the zero UUID is used as the sentinel `author_id` (the column stays NOT NULL, callers branch on `author_type === 'system'`). - `Handler.notifyParentOfChildDone` fires from both `UpdateIssue` and `BatchUpdateIssues`. Guards: prev status != done, new status == done, parent set, parent not in `done`/`cancelled`. Bypasses the CreateComment HTTP path so the assignee on_comment trigger and the mention-trigger paths do not fire — the comment content carries only the safe issue mention for the child, no `mention://agent/...` / `mention://member/...` / `mention://squad/...` links. - `runtime_config.go` downgrades the Parent/Sub-issue Protocol rule 1 to an explicit "do NOT post one yourself" guardrail; rule 2 (sub-issue creation `--status todo` vs `backlog`) is unchanged. - New handler test exercises the happy path, idempotency, reopen+done, parent done/cancelled guards, and the no-parent case. Runtime-config tests reassert the new wording and the banned strings from the prior revision. Co-authored-by: multica-agent <github@multica.ai> * fix(issues): isolate system comments + wire GH merge path (MUL-2538) Addresses the two must-fix items from the PR #3055 second review: 1. The platform-generated `comment:created` event (author_type='system') was running through the generic comment listeners, which (a) tried to subscribe the zero-UUID author and (b) parsed @mentions from the body for inbox notifications. Both subscriber_listeners and notification_listeners now early-return on author_type='system' so the event becomes a pure WS broadcast for the timeline — no inbox rows, no transcluded-mention attack surface. 2. advanceIssueToDone (the GitHub merge auto-done path) only published issue:updated and skipped notifyParentOfChildDone, so a child closed via merged PR — the dominant completion path — left the parent silent. The helper is now invoked on the same prev/updated pair, with the existing guards (transition + parent state) protecting double-fire. Tests: - New cmd/server/notification_listeners_test: TestNotification_SystemCommentSkipsInboxAndMentions (parent subscribers and smuggled @mention targets stay quiet), TestSubscriberSystemCommentDoesNotSubscribe (zero-UUID never reaches AddIssueSubscriber). - New internal/handler/github_test: TestWebhook_MergedPR_ChildWithParent_NotifiesParent fires a real pull_request closed-merged webhook against a child and asserts the parent receives exactly one safe system comment with the workspace's real identifier (no `mention://agent|member|squad` links). Co-authored-by: multica-agent <github@multica.ai> * fix(runtime): drop parent-notification guidance from agent brief (MUL-2538) Per Bohan's product call on PR #3055: the platform now owns the child-done parent notification, so the runtime brief should not mention the parent-comment path at all — not as an instruction, not as a "do not do it" guardrail. The previous revision kept rule 1 of the Parent / Sub-issue Protocol as a "Do NOT post your own parent-notification comment." sentence; that still puts the concept in front of the agent every run, which is exactly what we are trying to avoid. What changes: - Delete the "Parent / Sub-issue Protocol" preamble and rule 1 from buildMetaSkillContent. The remaining content — the `--status todo` vs `--status backlog` rule for creating sub-issues — now lives in a dedicated `## Sub-issue Creation` section, since the parent/child framing it previously sat under is gone. - The system comment on the parent stays exactly as in 366f6e2: the agent simply does not need to know about it. Tests: - runtime_config_test.go is rewritten around the new section name and the wider "no parent-notification guidance" canary; the banned list now covers both the original PR #2918 wording and the intermediate "do NOT post one" wording. System comment UI: the frontend already renders `author_type === "system"` with author name "Multica" (`useActorName`) and the MulticaIcon avatar (`ActorAvatar` via `isSystem`), matching Bohan's "looks like a normal comment, author is multica + multica logo" requirement — no frontend changes needed. Co-authored-by: multica-agent <github@multica.ai> --------- Co-authored-by: multica-agent <github@multica.ai>	2026-05-22 14:51:43 +08:00
Naiyuan Qing	fedd0f1694	feat(issues): live agent activity chip + per-issue indicator + filter (#3058) ... * feat(server): broadcast task:running event The dispatched → running transition was silent: only task:queued, task:dispatch, task:cancelled, task:completed and task:failed broadcast over WS. Any UI that distinguishes "queued" from "running" (e.g. the new issue-card agent activity indicator) would lag by up to the 30s agentTaskSnapshot staleTime on the most user-visible transition. StartTask now broadcasts task:running so the workspace snapshot invalidates immediately, keeping the agent activity UI live. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(issues): live agent activity chip + per-issue indicator + filter Surfaces "which agents are working on what, right now" in the Issues and My Issues views, with a one-click filter to narrow the list to issues that have a running agent task. Two visual surfaces: - **Workspace chip** in the header (left of Filter). Shows the brand-tinted avatar stack of agents currently running on visible issues. Click toggles a page-scoped filter; idle state renders a static "0 working" button with a hover-card placeholder. When the filter is active the chip pins to brand fill across hover and popover states (the Button outline variant otherwise repaints back to neutral). A muted "Viewing only working agents" hint sits to the left of the chip whenever the filter is on, so users notice the active state without having to hover. - **Per-issue indicator** on every board card and list row (top-right of the identifier line). Renders the avatar stack of agents in running or queued state on that issue, full-opacity ring at brand/70 when ≥1 is running, half-opacity stack when only queued. Returns null when nothing is in flight. Both surfaces open the same hover-card body that lists each active task with the agent avatar, status dot (composed via the existing availability + workload tokens), and a live-ticking duration. Adds a new "All" scope to /my-issues that unions assignee, creator, and involves_user_id via three parallel fetches deduped on the client — no backend changes for this part. The chip's count and the quick-filter both use the page's currently visible issue ids so they stay in sync with the active scope. State is per-user (Zustand + localStorage) and the agentRunningFilter is intentionally omitted from partialize — running state changes second-to-second and a stored toggle would land users in an unexplained empty list. WS task:running, already added in the preceding commit, drives real-time updates without polling. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor(issues): swap indicator ring pulse for shimmer text label Earlier iterations layered a brand ring with various opacity-pulse cadences around the per-issue avatar stack. Every tuning attempt was either invisible (transparent ring + faded pulse) or oppressive (a visible ring that flashed on a dense board). Moves the "alive" signal onto a small text label and reuses chat's existing `animate-chat-text-shimmer` utility — a soft light sweep across the glyphs that already powers the ChatGPT-style "thinking" cue in task-status-pill. Indicator now reads as a 12 px avatar stack + 10 px label: - Running → full-opacity avatars + shimmering localized "Working" - Queued → half-opacity avatars + muted static "Queued" - Idle → render nothing (unchanged) Avatars and the surrounding card stay completely still; only the few glyphs animate. The label is i18n-driven via the existing `status_running` / `status_queued` keys, so no locale changes are required. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-22 14:20:42 +08:00