@trops/dash-core 0.1.415 → 0.1.417

package/dist/electron/index.js

@@ -63840,7 +63840,13 @@ function generateRegistryManifest(dashboardConfig, options = {}) {
     .toLowerCase();
 
   const githubUser = options.githubUser || "";
-  const version = "1.0.0";
+  // Prefer an explicitly-passed version (caller resolved it already,
+  // e.g. via resolveNextVersion + bump). Fall back to the dashboard's
+  // own version, then a 1.0.0 baseline. The previous hardcoded
+  // "1.0.0" meant every republish looked identical to the registry;
+  // latestVersion never advanced, so downstream update-check never
+  // saw a diff and no notification fired.
+  const version = options.version || dashboardConfig.version || "1.0.0";
   const visibility = options.visibility === "private" ? "private" : "public";
 
   const manifest = {
@@ -63867,13 +63873,31 @@ function generateRegistryManifest(dashboardConfig, options = {}) {
         options.callerScope && w.scope && w.scope !== options.callerScope
           ? options.callerScope
           : w.scope || "";
+      // Packaged id — the scoped "@<scope>/<packageName>" string that
+      // the install flow looks up in the registry. Build this from the
+      // REMAPPED scope + bare packageName so installers resolve against
+      // the scope the widget was actually published as, not the local
+      // `@ai-built` convention. Stripping the scope prefix from a
+      // potentially-scoped packageName keeps the result canonical.
+      const bareName = stripScopePrefix(
+        w.packageName || w.package || "",
+        remappedScope || w.scope,
+      );
+      const scopedPackageId = remappedScope
+        ? `@${remappedScope.replace(/^@/, "")}/${bareName}`
+        : bareName;
       return {
         id: w.id,
         scope: remappedScope,
-        packageName: w.packageName || w.package || "",
+        packageName: bareName,
         widgetName: w.widgetName || (w.id ? w.id.split(".").pop() : w.package),
         name: w.id ? w.id.split(".").pop() : w.package,
-        package: w.package,
+        // `package` is consumed by the install flow as the registry
+        // package id (see installDashboardFromRegistry in
+        // dashboardConfigController.js). Must carry the remapped
+        // scope, otherwise installers look up an @ai-built/... id that
+        // only exists on the publisher's machine.
+        package: scopedPackageId,
         version: w.version || "*",
         required: w.required !== false,
         author: w.author || "",
@@ -63982,11 +64006,27 @@ function buildDashboardPreview(source) {
  * @returns {Array} Update records with workspace info and version comparison
  */
 function checkDashboardUpdates(workspaces = [], registryPackages = []) {
-  const registryByName = new Map();
+  // Index the registry by canonical `@scope/name` so the lookup
+  // survives installs that capture scope differently from the
+  // registry's raw `name` field. The previous map was keyed by bare
+  // `pkg.name`, which misses anytime the installed config recorded
+  // `@scope/name` (our new publish flow writes that) or when two
+  // users publish the same bare name. Key both forms for safety.
+  const registryByKey = new Map();
+  const asKey = (scope, name) => {
+    if (!name) return null;
+    if (!scope) return name;
+    const bareScope = String(scope).replace(/^@/, "");
+    return `@${bareScope}/${name}`;
+  };
   for (const pkg of registryPackages) {
-    if (pkg.name && (pkg.type || "widget") === "dashboard") {
-      registryByName.set(pkg.name, pkg);
-    }
+    if (!pkg.name) continue;
+    if ((pkg.type || "widget") !== "dashboard") continue;
+    const scoped = asKey(pkg.scope, pkg.name);
+    if (scoped) registryByKey.set(scoped, pkg);
+    // Back-compat: also store under bare name so installed configs
+    // that predate the scope-aware write continue to match.
+    registryByKey.set(pkg.name, pkg);
   }
 
   const updates = [];
@@ -63995,7 +64035,24 @@ function checkDashboardUpdates(workspaces = [], registryPackages = []) {
     const config = ws._dashboardConfig;
     if (!config || !config.registryPackage) continue;
 
-    const registryPkg = registryByName.get(config.registryPackage);
+    // Lookup chain: try the scoped form first, fall back to bare. The
+    // installed config may record either. Scope is stored on the
+    // config by the install flow (or set here by the publish persist
+    // step we just added).
+    const installedScope =
+      config.registryScope ||
+      (config.registryPackage.startsWith("@")
+        ? config.registryPackage.slice(1).split("/")[0]
+        : null);
+    const installedName = config.registryPackage.includes("/")
+      ? config.registryPackage.split("/").pop()
+      : config.registryPackage;
+    const scopedKey = asKey(installedScope, installedName);
+
+    const registryPkg =
+      (scopedKey && registryByKey.get(scopedKey)) ||
+      registryByKey.get(config.registryPackage) ||
+      registryByKey.get(installedName);
     if (!registryPkg) continue;
 
     const installedVersion = config.installedVersion || "0.0.0";
@@ -64006,6 +64063,7 @@ function checkDashboardUpdates(workspaces = [], registryPackages = []) {
         workspaceId: ws.id,
         workspaceName: ws.name || ws.label || "",
         registryPackage: config.registryPackage,
+        registryScope: installedScope,
         installedVersion,
         latestVersion,
         importedAt: config.importedAt || null,
@@ -64151,6 +64209,67 @@ function extractEventWiringFromWorkspace$1(workspace) {
   return wiring;
 }
 
+/**
+ * Strip publisher-specific personalization (userPrefs + selectedProviders)
+ * from every widget instance in a layout-ish structure. Used by the
+ * dashboard publish flow so the installer starts with the widget's
+ * own defaultValue on every field instead of inheriting the
+ * publisher's absolute paths, region tags, credentials, etc.
+ *
+ * Walks the standard layout shapes that forEachWidget handles:
+ *   - top-level `layout` arrays
+ *   - `workspace.pages[*].layout`
+ *   - `workspace.sidebarLayout`
+ *   - `LayoutGridContainer` children stored on `item.items` / `item.layout`
+ *
+ * Returns a deep copy — never mutates the input workspace.
+ *
+ * Title-ish defaults (widget.name) are intentionally preserved — they
+ * are part of the dashboard template, not personal data. Anything else
+ * under userPrefs is dropped; the installer's widget re-reads the
+ * `defaultValue` declared in the component's `.dash.js`.
+ */
+function stripPersonalizationFromWorkspace$1(workspace) {
+  if (!workspace) return workspace;
+  const cleanItem = (item) => {
+    if (!item || typeof item !== "object") return item;
+    // Preserve the layout position + children, but blank out the
+    // user-set config values that are tied to the publisher's machine.
+    const cleaned = { ...item };
+    if ("userPrefs" in cleaned) delete cleaned.userPrefs;
+    if ("selectedProviders" in cleaned) delete cleaned.selectedProviders;
+    if (Array.isArray(cleaned.items)) {
+      cleaned.items = cleaned.items.map(cleanItem);
+    }
+    if (Array.isArray(cleaned.layout)) {
+      cleaned.layout = cleaned.layout.map(cleanItem);
+    }
+    return cleaned;
+  };
+  const cleaned = { ...workspace };
+  if (Array.isArray(cleaned.layout))
+    cleaned.layout = cleaned.layout.map(cleanItem);
+  if (Array.isArray(cleaned.sidebarLayout))
+    cleaned.sidebarLayout = cleaned.sidebarLayout.map(cleanItem);
+  if (Array.isArray(cleaned.pages)) {
+    cleaned.pages = cleaned.pages.map((page) =>
+      page
+        ? {
+            ...page,
+            ...(Array.isArray(page.layout)
+              ? { layout: page.layout.map(cleanItem) }
+              : {}),
+          }
+        : page,
+    );
+  }
+  // Workspace-level selectedProviders map lives at the top level for
+  // some older workspaces; drop it too so the installer doesn't get
+  // bindings to provider names that don't exist on their machine.
+  if ("selectedProviders" in cleaned) delete cleaned.selectedProviders;
+  return cleaned;
+}
+
 var dashboardConfigUtils$1 = {
   collectComponentNames: collectComponentNames$1,
   collectComponentNamesFromWorkspace: collectComponentNamesFromWorkspace$1,
@@ -64165,6 +64284,7 @@ var dashboardConfigUtils$1 = {
   checkDashboardUpdates,
   buildProviderSetupManifest,
   checkApiCompatibility,
+  stripPersonalizationFromWorkspace: stripPersonalizationFromWorkspace$1,
 };
 
 /**
@@ -64315,6 +64435,128 @@ var registryApiController$3 = {
   REGISTRY_BASE_URL,
 };
 
+/**
+ * widgetPublishManifest.js
+ *
+ * Pure helpers for widget-publish flow — version bumping, package-name
+ * parsing, and manifest generation. No electron / fs / adm-zip deps so
+ * these can be unit-tested directly.
+ */
+
+var widgetPublishManifest;
+var hasRequiredWidgetPublishManifest;
+
+function requireWidgetPublishManifest () {
+	if (hasRequiredWidgetPublishManifest) return widgetPublishManifest;
+	hasRequiredWidgetPublishManifest = 1;
+	const SEMVER_RE =
+	  /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/;
+
+	function bumpVersion(current, type) {
+	  if (!current || typeof current !== "string") return "1.0.0";
+	  const match = current.match(SEMVER_RE);
+	  if (!match) return current;
+	  let [, major, minor, patch] = match;
+	  major = Number(major);
+	  minor = Number(minor);
+	  patch = Number(patch);
+	  switch (type) {
+	    case "major":
+	      return `${major + 1}.0.0`;
+	    case "minor":
+	      return `${major}.${minor + 1}.0`;
+	    case "patch":
+	    default:
+	      return `${major}.${minor}.${patch + 1}`;
+	  }
+	}
+
+	function resolveNextVersion(currentVersion, options = {}) {
+	  if (options.version) return options.version;
+	  if (options.bump) return bumpVersion(currentVersion, options.bump);
+	  return currentVersion;
+	}
+
+	function parsePackageName(pkgName) {
+	  if (!pkgName) return { scope: null, name: "" };
+	  const m = pkgName.match(/^@([^/]+)\/(.+)$/);
+	  if (m) return { scope: m[1], name: m[2] };
+	  return { scope: null, name: pkgName };
+	}
+
+	function generateWidgetRegistryManifest(
+	  packageJson,
+	  widgetConfigs,
+	  options = {},
+	) {
+	  const parsed = parsePackageName(packageJson.name || "");
+	  const scope = options.scope || parsed.scope || "";
+	  const name = options.name || parsed.name || packageJson.name || "";
+	  const version = options.version || packageJson.version || "1.0.0";
+	  const visibility = options.visibility === "private" ? "private" : "public";
+
+	  const providerKeys = new Set();
+	  const providers = [];
+	  for (const cfg of widgetConfigs || []) {
+	    if (!Array.isArray(cfg.providers)) continue;
+	    for (const p of cfg.providers) {
+	      const key = `${p.type}:${p.providerClass || "mcp"}`;
+	      if (providerKeys.has(key)) continue;
+	      providerKeys.add(key);
+	      providers.push({
+	        type: p.type,
+	        required: p.required !== false,
+	        providerClass: p.providerClass || "mcp",
+	      });
+	    }
+	  }
+
+	  const widgets = (widgetConfigs || []).map((cfg) => ({
+	    name: cfg.component || cfg.name,
+	    displayName: cfg.name || cfg.component,
+	    description: cfg.description || "",
+	    icon: cfg.icon || "square",
+	    providers: Array.isArray(cfg.providers)
+	      ? cfg.providers.map((p) => ({
+	          type: p.type,
+	          required: p.required !== false,
+	          providerClass: p.providerClass || "mcp",
+	        }))
+	      : [],
+	  }));
+
+	  return {
+	    scope,
+	    name,
+	    displayName: options.displayName || packageJson.displayName || name,
+	    version,
+	    type: "widget",
+	    visibility,
+	    description: options.description || packageJson.description || "",
+	    author:
+	      options.authorName ||
+	      (typeof packageJson.author === "string"
+	        ? packageJson.author
+	        : packageJson.author?.name || ""),
+	    category: options.category || "general",
+	    tags: Array.isArray(options.tags) ? options.tags : [],
+	    icon: options.icon || "puzzle-piece",
+	    providers,
+	    widgets,
+	    appOrigin: options.appOrigin || "",
+	    publishedAt: new Date().toISOString(),
+	  };
+	}
+
+	widgetPublishManifest = {
+	  bumpVersion,
+	  resolveNextVersion,
+	  parsePackageName,
+	  generateWidgetRegistryManifest,
+	};
+	return widgetPublishManifest;
+}
+
 /**
  * themeRegistryController.js
  *
@@ -64359,14 +64601,20 @@ function generateThemeRegistryManifest(themeData, themeKey, options = {}) {
   const sanitizedName = sanitizeName(humanName);
   const colors = extractColors(themeData);
   const visibility = options.visibility === "private" ? "private" : "public";
+  // Prefer an explicitly-resolved version (caller already bumped),
+  // then the theme's own stored version, then the 1.0.0 baseline.
+  // The old hardcoded 1.0.0 meant republishes silently clobbered the
+  // registry record — update notifications never fired downstream.
+  const version = options.version || themeData.version || "1.0.0";
 
   return {
     scope: options.scope || "",
     name: sanitizedName,
     displayName: humanName,
-    author: options.authorName || "",
+    author:
+      options.authorName || themeData.author || options.fallbackAuthor || "",
     description: options.description || "",
-    version: "1.0.0",
+    version,
     visibility,
     type: "theme",
     category: "general",
@@ -64436,6 +64684,7 @@ function extractColors(themeData) {
  */
 async function prepareThemeForPublish$1(win, appId, themeKey, options = {}) {
   try {
+    const { resolveNextVersion } = requireWidgetPublishManifest();
     // Read the theme data
     const themesResult = themeController$3.listThemesForApplication(win, appId);
     if (themesResult.error) {
@@ -64469,11 +64718,33 @@ async function prepareThemeForPublish$1(win, appId, themeKey, options = {}) {
       };
     }
 
+    // Resolve version: prefer explicit, then bump the theme's stored
+    // version, then start at 1.0.0. Without this themes always
+    // published as 1.0.0 and update-check could never diff.
+    const previousVersion = themeData.version || "1.0.0";
+    const nextVersion = resolveNextVersion(previousVersion, {
+      bump: options.bump,
+      version: options.version,
+    });
+
+    // Author fallback chain (F7): explicit → theme data → registry
+    // profile displayName/username → blank. Matches the widget
+    // author-normalization shape so ai-built / scaffolded themes
+    // don't ship to the registry with a blank author field.
+    const resolvedAuthor =
+      options.authorName ||
+      themeData.author ||
+      profile?.displayName ||
+      profile?.username ||
+      "";
+
     // Generate manifest
     const manifest = generateThemeRegistryManifest(themeData, themeKey, {
       ...options,
       scope,
       appOrigin: appId,
+      version: nextVersion,
+      authorName: resolvedAuthor,
     });
 
     // Validate colors
@@ -64530,6 +64801,35 @@ async function prepareThemeForPublish$1(win, appId, themeKey, options = {}) {
         "[ThemeRegistryController] Registry publish result:",
         registryResult,
       );
+      // Persist the resolved version + author back onto the theme so
+      // the NEXT publish picks up from here. Without this, the
+      // publisher would be bumping from 1.0.0 every time and the
+      // manifest's author normalization would be re-applied every
+      // run (OK but confusing).
+      if (registryResult?.success) {
+        try {
+          const updatedTheme = {
+            ...themeData,
+            version: nextVersion,
+            author: resolvedAuthor || themeData.author,
+            _registryMeta: {
+              ...(themeData._registryMeta || {}),
+              packageName: `${scope}/${manifest.name}`,
+              scope,
+              lastPublishedAt: new Date().toISOString(),
+              lastPublishedVersion: nextVersion,
+            },
+          };
+          themeController$3.saveThemeForApplication(win, appId, {
+            key: themeKey,
+            theme: updatedTheme,
+          });
+        } catch (persistErr) {
+          console.warn(
+            `[ThemeRegistryController] Version persist failed (continuing): ${persistErr.message}`,
+          );
+        }
+      }
     }
 
     return {
@@ -64870,12 +65170,120 @@ function getThemePublishPreview$1(appId, themeKey) {
   }
 }
 
+/**
+ * Check installed themes for available updates against the registry.
+ *
+ * Reads every theme from the app's theme file, picks the ones that
+ * carry a `_registryMeta.packageName` (i.e. were installed from the
+ * registry, not locally created), resolves each against the registry
+ * index by `@scope/name` (with a bare-name fallback), and returns a
+ * diff record for each stale theme.
+ *
+ * Mirrors `checkDashboardUpdatesForApp` — callable standalone, works
+ * the same way on the renderer side.
+ *
+ * @param {BrowserWindow} win
+ * @param {string} appId
+ * @returns {Promise<{success, updates, totalInstalled, error?}>}
+ */
+async function checkThemeUpdatesForApp$1(win, appId) {
+  try {
+    const { fetchRegistryIndex } = registryController$3;
+    const themesResult = themeController$3.listThemesForApplication(win, appId);
+    if (themesResult.error) {
+      return {
+        success: false,
+        error: themesResult.message || "Failed to read themes",
+        updates: [],
+      };
+    }
+    const themes = themesResult.themes || {};
+
+    // Filter to registry-installed themes only.
+    const installed = [];
+    for (const [themeKey, themeData] of Object.entries(themes)) {
+      const meta = themeData?._registryMeta;
+      if (!meta?.packageName) continue;
+      installed.push({
+        themeKey,
+        packageName: meta.packageName,
+        scope: meta.scope || null,
+        version: themeData.version || meta.lastPublishedVersion || "0.0.0",
+      });
+    }
+
+    if (installed.length === 0) {
+      return { success: true, updates: [], totalInstalled: 0 };
+    }
+
+    const index = await fetchRegistryIndex();
+    const packages = (index.packages || []).filter(
+      (p) => (p.type || "widget") === "theme",
+    );
+
+    // Index registry packages by scoped + bare key, same pattern as
+    // dashboard update check.
+    const registryByKey = new Map();
+    for (const pkg of packages) {
+      if (!pkg.name) continue;
+      if (pkg.scope) {
+        const bareScope = String(pkg.scope).replace(/^@/, "");
+        registryByKey.set(`@${bareScope}/${pkg.name}`, pkg);
+      }
+      registryByKey.set(pkg.name, pkg);
+    }
+
+    const updates = [];
+    for (const inst of installed) {
+      const scope = inst.scope
+        ? String(inst.scope).replace(/^@/, "")
+        : inst.packageName.startsWith("@")
+          ? inst.packageName.slice(1).split("/")[0]
+          : null;
+      const bareName = inst.packageName.includes("/")
+        ? inst.packageName.split("/").pop()
+        : inst.packageName;
+      const scopedKey = scope ? `@${scope}/${bareName}` : null;
+      const registryPkg =
+        (scopedKey && registryByKey.get(scopedKey)) ||
+        registryByKey.get(inst.packageName) ||
+        registryByKey.get(bareName);
+      if (!registryPkg) continue;
+
+      const latestVersion = registryPkg.version || "0.0.0";
+      if (inst.version !== latestVersion) {
+        updates.push({
+          themeKey: inst.themeKey,
+          packageName: inst.packageName,
+          scope,
+          installedVersion: inst.version,
+          latestVersion,
+          downloadUrl: registryPkg.downloadUrl || null,
+        });
+      }
+    }
+
+    return {
+      success: true,
+      updates,
+      totalInstalled: installed.length,
+    };
+  } catch (err) {
+    console.error(
+      "[ThemeRegistryController] Error checking theme updates:",
+      err,
+    );
+    return { success: false, error: err.message, updates: [] };
+  }
+}
+
 var themeRegistryController$1 = {
   prepareThemeForPublish: prepareThemeForPublish$1,
   installThemeFromRegistry: installThemeFromRegistry$1,
   getThemePublishPreview: getThemePublishPreview$1,
   generateThemeRegistryManifest,
   extractColors,
+  checkThemeUpdatesForApp: checkThemeUpdatesForApp$1,
 };
 
 /**
@@ -64910,6 +65318,7 @@ const {
   buildWidgetDependencies,
   buildProviderRequirements,
   applyEventWiringToLayout,
+  stripPersonalizationFromWorkspace,
 } = dashboardConfigUtils$1;
 const { searchRegistry, getPackage } = registryController$3;
 const { getStoredToken, clearToken } = registryAuthController$2;
@@ -64957,7 +65366,11 @@ async function exportDashboardConfig$1(
       };
     }
 
-    const layout = workspace.layout || [];
+    // Strip publisher-specific personalization (userPrefs,
+    // selectedProviders) so the exported file carries a clean
+    // template, not one pre-filled with the publisher's paths.
+    const sharedWorkspace = stripPersonalizationFromWorkspace(workspace);
+    const layout = sharedWorkspace.layout || [];
 
     // 2. Collect components, extract wiring, resolve deps — walk main
     //    layout, every page, and the sidebar so multi-page / sidebar
@@ -64985,13 +65398,17 @@ async function exportDashboardConfig$1(
         label: workspace.label || workspace.name,
         version: workspace.version || 1,
         layout,
-        ...(Array.isArray(workspace.pages) && workspace.pages.length > 0
-          ? { pages: workspace.pages, activePageId: workspace.activePageId }
+        ...(Array.isArray(sharedWorkspace.pages) &&
+        sharedWorkspace.pages.length > 0
+          ? {
+              pages: sharedWorkspace.pages,
+              activePageId: workspace.activePageId,
+            }
           : {}),
-        ...(Array.isArray(workspace.sidebarLayout) &&
-        workspace.sidebarLayout.length > 0
+        ...(Array.isArray(sharedWorkspace.sidebarLayout) &&
+        sharedWorkspace.sidebarLayout.length > 0
           ? {
-              sidebarLayout: workspace.sidebarLayout,
+              sidebarLayout: sharedWorkspace.sidebarLayout,
               sidebarEnabled: workspace.sidebarEnabled !== false,
             }
           : {}),
@@ -65331,7 +65748,30 @@ async function processDashboardConfig(
     dashboardConfig.widgets.length
   ) {
     const installedWidgets = widgetRegistry.getWidgets();
-    const installedPackages = new Set(installedWidgets.map((w) => w.name));
+    // Build a canonical id set — `@scope/name` — so lookups survive
+    // the publisher/installer having the widget under different
+    // keys. The widget-registry entry carries `w.packageId`,
+    // `w.name`, and `w.scope`; the dashboard dep carries
+    // `dep.package` (now scope-remapped at publish time). Seeding
+    // every form we've seen avoids silent "missing widget" misses
+    // on bare-vs-scoped mismatch.
+    const canonicalId = (w) => {
+      if (w?.packageId) return w.packageId;
+      if (w?.scope && w?.name) {
+        const scope = String(w.scope).replace(/^@/, "");
+        const bareName = String(w.name).replace(new RegExp(`^@?${scope}/`), "");
+        return `@${scope}/${bareName}`;
+      }
+      return w?.name || null;
+    };
+    const installedPackages = new Set();
+    for (const w of installedWidgets) {
+      const id = canonicalId(w);
+      if (id) installedPackages.add(id);
+      // Back-compat: keep bare name in the set too, so older
+      // dashboard configs (pre-scope-remap) still match.
+      if (w?.name) installedPackages.add(w.name);
+    }
 
     // Emit initial "pending" state for all widgets
     for (let i = 0; i < widgetTotal; i++) {
@@ -65369,7 +65809,20 @@ async function processDashboardConfig(
       const displayName =
         widgetDep.displayName || widgetDep.name || packageName;
 
-      if (installedPackages.has(packageName)) {
+      // Try both the fully-scoped id and a bare-name fallback — the
+      // installed set holds both forms, but the dashboard dep may
+      // carry either shape. Without this, a widget stored locally as
+      // `@trops/pipeline` and referenced as `pipeline` (or vice
+      // versa) silently flagged as "failed" even though it was
+      // installed.
+      const isInstalled =
+        installedPackages.has(packageName) ||
+        (packageName?.includes("/") &&
+          installedPackages.has(packageName.split("/").pop())) ||
+        (packageName &&
+          !packageName.startsWith("@") &&
+          installedPackages.has(`@${packageName}`));
+      if (isInstalled) {
         installSummary.alreadyInstalled.push(packageName);
         win.webContents.send(DASHBOARD_CONFIG_INSTALL_PROGRESS, {
           packageName,
@@ -65401,6 +65854,10 @@ async function processDashboardConfig(
           );
           installSummary.installed.push({ packageName, config });
           installedPackages.add(packageName);
+          // Also add the canonical form so a subsequent dep that
+          // references it under a different shape still hits.
+          const installedCanonical = canonicalId(config);
+          if (installedCanonical) installedPackages.add(installedCanonical);
           win.webContents.send(DASHBOARD_CONFIG_INSTALL_PROGRESS, {
             packageName,
             displayName,
@@ -66138,16 +66595,30 @@ async function getDashboardPublishPlan$1(
       }
     }
 
+    // Scopes that only exist on the publisher's machine and aren't
+    // resolvable from the registry as-is. Any dep under one of these
+    // scopes MUST be republished under the caller's scope for the
+    // dashboard's widget refs to work on another machine. The modal
+    // uses this flag to auto-check + lock such rows.
+    const LOCAL_ONLY_SCOPES = new Set(["ai-built", "@ai-built"]);
+
     const widgets = deps.widgets.map((w) => {
       const publishScope = publishScopeFor(w);
       const key =
         publishScope && w.packageName
           ? `${publishScope}/${w.packageName}`
           : null;
+      const isLocalOnlyScope =
+        !!w.scope && LOCAL_ONLY_SCOPES.has(String(w.scope).replace(/^@/, ""));
       return {
         ...w,
         publishScope,
         registry: key ? resolvedByKey.get(key) || null : null,
+        // True when this widget cannot be installed as-is under its
+        // local scope — the dashboard publish MUST republish it under
+        // the caller's scope alongside the dashboard itself. The
+        // modal treats this as mandatory rather than opt-in.
+        requiresRepublish: isLocalOnlyScope,
       };
     });
 
@@ -66211,6 +66682,7 @@ async function prepareDashboardForPublish$1(
     const {
       generateRegistryManifest,
     } = dashboardConfigUtils$1;
+    const { resolveNextVersion } = requireWidgetPublishManifest();
 
     // 1. Read workspace
     const filename = path$2.join(
@@ -66243,7 +66715,29 @@ async function prepareDashboardForPublish$1(
       };
     }
 
-    const layout = workspace.layout || [];
+    // Resolve the version this publish will ship. Previous publishes
+    // store the last version on workspace._dashboardConfig.version; new
+    // dashboards start at 1.0.0. Caller may pass `options.version`
+    // (explicit) or `options.bump` ("patch"/"minor"/"major"). Without
+    // this, every dashboard republish used a hardcoded 1.0.0 — the
+    // registry never saw a new version, so the update-check never
+    // fired a notification for installers.
+    const previousVersion = workspace._dashboardConfig?.version || "1.0.0";
+    const nextVersion = resolveNextVersion(previousVersion, {
+      bump: options.bump,
+      version: options.version,
+    });
+
+    // Strip publisher-specific personalization (userPrefs,
+    // selectedProviders) from every widget instance before we snapshot
+    // the workspace into the dashboardConfig. Without this, every
+    // installer inherits the publisher's absolute filesystem paths,
+    // region tags, and provider bindings as their "defaults" — a
+    // widget's own `defaultValue` on each field never gets a chance.
+    // Layout position, ordering, nested containers, and any title text
+    // are preserved (they're part of the template, not personal).
+    const sharedWorkspace = stripPersonalizationFromWorkspace(workspace);
+    const layout = sharedWorkspace.layout || [];
 
     // 3. Build the dashboard config — walk main + pages + sidebar
     const componentNames = collectComponentNamesFromWorkspace(workspace);
@@ -66270,6 +66764,10 @@ async function prepareDashboardForPublish$1(
       schemaVersion: CURRENT_SCHEMA_VERSION,
       name: workspace.name || workspace.label || "Dashboard",
       description: options.description || "",
+      // Package version (semver). Distinct from workspace.version
+      // (schema revision, integer). Persisted on the workspace after a
+      // successful publish so the next publish resolves from here.
+      version: nextVersion,
       ...(options.authorName
         ? { author: { name: options.authorName, id: options.authorId || "" } }
         : {}),
@@ -66283,13 +66781,17 @@ async function prepareDashboardForPublish$1(
         label: workspace.label || workspace.name,
         version: workspace.version || 1,
         layout,
-        ...(Array.isArray(workspace.pages) && workspace.pages.length > 0
-          ? { pages: workspace.pages, activePageId: workspace.activePageId }
+        ...(Array.isArray(sharedWorkspace.pages) &&
+        sharedWorkspace.pages.length > 0
+          ? {
+              pages: sharedWorkspace.pages,
+              activePageId: workspace.activePageId,
+            }
           : {}),
-        ...(Array.isArray(workspace.sidebarLayout) &&
-        workspace.sidebarLayout.length > 0
+        ...(Array.isArray(sharedWorkspace.sidebarLayout) &&
+        sharedWorkspace.sidebarLayout.length > 0
           ? {
-              sidebarLayout: workspace.sidebarLayout,
+              sidebarLayout: sharedWorkspace.sidebarLayout,
               sidebarEnabled: workspace.sidebarEnabled !== false,
             }
           : {}),
@@ -66420,6 +66922,7 @@ async function prepareDashboardForPublish$1(
       repository: options.repository || "",
       appOrigin: appId,
       visibility: options.visibility || "public",
+      version: nextVersion,
     });
 
     // 9. Show save dialog for the publish package
@@ -66467,6 +66970,35 @@ async function prepareDashboardForPublish$1(
           console.log(
             `[DashboardConfigController] Published to registry: ${registrySubmission.registryUrl}`,
           );
+          // Persist the resolved next version back onto the workspace
+          // so the NEXT publish resolves from it. Without this, the
+          // publisher would have to re-enter the same version every
+          // time (or keep bumping from 1.0.0, masking that the
+          // registry already advanced).
+          try {
+            const workspaceController = workspaceController_1;
+            const nextWorkspace = {
+              ...workspace,
+              _dashboardConfig: {
+                ...(workspace._dashboardConfig || {}),
+                version: nextVersion,
+                registryPackage: manifest.name,
+                registryScope: manifest.scope || manifest.githubUser,
+              },
+            };
+            workspaceController.saveWorkspaceForApplication(
+              win,
+              appId,
+              nextWorkspace,
+            );
+          } catch (persistErr) {
+            // Non-fatal — registry is the source of truth for
+            // latestVersion, so the next publish can still resolve
+            // against it if this workspace write fails.
+            console.warn(
+              `[DashboardConfigController] Version persistence failed (continuing): ${persistErr.message}`,
+            );
+          }
         } else {
           console.warn(
             `[DashboardConfigController] Registry publish failed: ${registrySubmission.error}`,
@@ -72931,120 +73463,6 @@ var dashboardRatingsController = {
   enrichPackagesWithRatings: enrichPackagesWithRatings$1,
 };
 
-/**
- * widgetPublishManifest.js
- *
- * Pure helpers for widget-publish flow — version bumping, package-name
- * parsing, and manifest generation. No electron / fs / adm-zip deps so
- * these can be unit-tested directly.
- */
-
-const SEMVER_RE =
-  /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/;
-
-function bumpVersion(current, type) {
-  if (!current || typeof current !== "string") return "1.0.0";
-  const match = current.match(SEMVER_RE);
-  if (!match) return current;
-  let [, major, minor, patch] = match;
-  major = Number(major);
-  minor = Number(minor);
-  patch = Number(patch);
-  switch (type) {
-    case "major":
-      return `${major + 1}.0.0`;
-    case "minor":
-      return `${major}.${minor + 1}.0`;
-    case "patch":
-    default:
-      return `${major}.${minor}.${patch + 1}`;
-  }
-}
-
-function resolveNextVersion$1(currentVersion, options = {}) {
-  if (options.version) return options.version;
-  if (options.bump) return bumpVersion(currentVersion, options.bump);
-  return currentVersion;
-}
-
-function parsePackageName$1(pkgName) {
-  if (!pkgName) return { scope: null, name: "" };
-  const m = pkgName.match(/^@([^/]+)\/(.+)$/);
-  if (m) return { scope: m[1], name: m[2] };
-  return { scope: null, name: pkgName };
-}
-
-function generateWidgetRegistryManifest$1(
-  packageJson,
-  widgetConfigs,
-  options = {},
-) {
-  const parsed = parsePackageName$1(packageJson.name || "");
-  const scope = options.scope || parsed.scope || "";
-  const name = options.name || parsed.name || packageJson.name || "";
-  const version = options.version || packageJson.version || "1.0.0";
-  const visibility = options.visibility === "private" ? "private" : "public";
-
-  const providerKeys = new Set();
-  const providers = [];
-  for (const cfg of widgetConfigs || []) {
-    if (!Array.isArray(cfg.providers)) continue;
-    for (const p of cfg.providers) {
-      const key = `${p.type}:${p.providerClass || "mcp"}`;
-      if (providerKeys.has(key)) continue;
-      providerKeys.add(key);
-      providers.push({
-        type: p.type,
-        required: p.required !== false,
-        providerClass: p.providerClass || "mcp",
-      });
-    }
-  }
-
-  const widgets = (widgetConfigs || []).map((cfg) => ({
-    name: cfg.component || cfg.name,
-    displayName: cfg.name || cfg.component,
-    description: cfg.description || "",
-    icon: cfg.icon || "square",
-    providers: Array.isArray(cfg.providers)
-      ? cfg.providers.map((p) => ({
-          type: p.type,
-          required: p.required !== false,
-          providerClass: p.providerClass || "mcp",
-        }))
-      : [],
-  }));
-
-  return {
-    scope,
-    name,
-    displayName: options.displayName || packageJson.displayName || name,
-    version,
-    type: "widget",
-    visibility,
-    description: options.description || packageJson.description || "",
-    author:
-      options.authorName ||
-      (typeof packageJson.author === "string"
-        ? packageJson.author
-        : packageJson.author?.name || ""),
-    category: options.category || "general",
-    tags: Array.isArray(options.tags) ? options.tags : [],
-    icon: options.icon || "puzzle-piece",
-    providers,
-    widgets,
-    appOrigin: options.appOrigin || "",
-    publishedAt: new Date().toISOString(),
-  };
-}
-
-var widgetPublishManifest = {
-  bumpVersion,
-  resolveNextVersion: resolveNextVersion$1,
-  parsePackageName: parsePackageName$1,
-  generateWidgetRegistryManifest: generateWidgetRegistryManifest$1,
-};
-
 /**
  * widgetRegistryController.js
  *
@@ -73074,7 +73492,7 @@ const {
   resolveNextVersion,
   parsePackageName,
   generateWidgetRegistryManifest,
-} = widgetPublishManifest;
+} = requireWidgetPublishManifest();
 
 /**
  * Resilient widget lookup. Callers pass identifiers in different shapes —
@@ -73550,6 +73968,7 @@ const {
   prepareThemeForPublish,
   installThemeFromRegistry,
   getThemePublishPreview,
+  checkThemeUpdatesForApp,
 } = themeRegistryController$1;
 const {
   prepareWidgetForPublish,
@@ -73643,6 +74062,7 @@ var controller = {
   prepareThemeForPublish,
   installThemeFromRegistry,
   getThemePublishPreview,
+  checkThemeUpdatesForApp,
   prepareWidgetForPublish,
   inspectWidgetPackage,
   assignRoles,