local-operator-ui 0.31.10 → 0.31.12

package/README.md

@@ -5,70 +5,58 @@
        src="./resources/local-operator-icon-2-light-clear.png">
 </picture>
 
-<h1 align="center">Local Operator: AI Agent Assistants On Your Device</h1>
-<div align="center">
-  <h2>🤖 Personal AI Assistants that Turn Ideas into Action</h2>
-  <p><i>Real-time code execution on your device through natural conversation</i></p>
-</div>
+<h1 align="center">Local Operator</h1>
 
-<br />
+<p align="center"><i>AI agent assistants on your device — they plan, write, and run Python, and every step stays in the conversation.</i></p>
 
 <p align="center">
-  <img src="./resources/preview-example.gif" alt="Local Operator UI Dashboard Example" style="width: 640px">
-</div>
+  <a href="https://github.com/damianvtran/local-operator-ui/releases/latest"><img alt="Latest release" src="https://img.shields.io/github/v/release/damianvtran/local-operator-ui"></a>
+  <a href="https://github.com/damianvtran/local-operator-ui/actions/workflows/ci.yml"><img alt="CI status" src="https://img.shields.io/github/actions/workflow/status/damianvtran/local-operator-ui/ci.yml?branch=main"></a>
+  <a href="https://www.npmjs.com/package/local-operator-ui"><img alt="npm version" src="https://img.shields.io/npm/v/local-operator-ui"></a>
+  <a href="./LICENSE"><img alt="License: MIT" src="https://img.shields.io/github/license/damianvtran/local-operator-ui"></a>
+  <img alt="Platforms: macOS, Windows, and Linux" src="https://img.shields.io/badge/platform-macOS%20%7C%20Windows%20%7C%20Linux-lightgrey">
+</p>
 
 <br />
 
-**<span style="color: #38C96A">Local Operator</span>** empowers you to run Python code safely on your own machine through an intuitive chat interface. The AI agent:
-
-🎯 **Plans & Executes** - Breaks down complex goals into manageable steps and executes them with precision.
-
-🔒 **Prioritizes Security** - Built-in safety checks by independent AI review and user confirmations keep your system protected
-
-🌐 **Flexible Deployment** - Run completely locally with Ollama models or leverage cloud providers like OpenAI
+<p align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="./resources/readme/app-shell-chat-dark.webp">
+    <source media="(prefers-color-scheme: light)" srcset="./resources/readme/app-shell-chat-light.webp">
+    <img alt="The app's chat view: an agent's reply, the run details panel with two subagents running, and their shared to-do list." src="./resources/readme/app-shell-chat-light.webp">
+  </picture>
+  <br />
+  <sub><code>the app at work</code> — a conversation with an agent, two subagents running beside it, and the to-do list they share.</sub>
+</p>
 
-🔧 **Problem Solving** - Intelligently handles errors and roadblocks by adapting approaches and finding alternative solutions
+<br />
 
-This project is proudly open source under the MIT license. We believe AI tools should be accessible to everyone, given their transformative impact on productivity. Your contributions and feedback help make this vision a reality!
+**Local Operator** runs AI agent assistants on your own machine, from a desktop chat app. You give an agent a goal; it plans the work, writes and runs Python on your device, reads and writes files, and asks before it takes anything risky. The whole run — messages, tool calls, commands, and results — stays in the conversation in front of you.
 
-> "Democratizing AI-powered productivity, one conversation at a time."
+For the agent environment CLI and server backend, see the [Local Operator repository](https://github.com/damianvtran/local-operator).
 
-<div align="center">
-  <a href="https://github.com/damianvtran/local-operator">Agent Backend</a> •
-  <a href="https://local-operator.com">Learn More</a> •
+<p align="center">
+  <a href="https://github.com/damianvtran/local-operator">Agent backend</a> •
+  <a href="https://local-operator.com">Website</a> •
   <a href="https://github.com/damianvtran/local-operator/tree/main/examples/notebooks">Examples</a>
-</div>
+</p>
 
-## 💡 Overview
-
-The Local Operator UI is a user interface for managing and interacting with the Local Operator agent environment. It is built using Electron, React, and TypeScript, leveraging modern web technologies for a rich and responsive user experience.
-
-👉 For the agent environment CLI and Server backend, see the [Local Operator GitHub repository](https://github.com/damianvtran/local-operator).
-
-## 🚀 Getting Started
+## Getting started
 
 ### Prerequisites
 
-Before you begin, ensure you have the following installed:
-
-- **Node.js**: Version 22.13.1 or higher. It's recommended to use [nvm](https://github.com/nvm-sh/nvm) for managing Node.js versions.
-
-The Local Operator backend is now bundled with the application and will be installed automatically when you first run the application. If you prefer to use an existing Local Operator backend installation, the application will detect it and use it instead.
-
-### NPM Installation
+- **Node.js** 22.13.1 or newer, for the npm install paths below. [nvm](https://github.com/nvm-sh/nvm) is a good way to manage Node versions. The desktop installers need no toolchain.
 
-You can install and run Local Operator UI directly using [npx](https://docs.n8n.io/hosting/installation/npm/).
+### Run with npx
 
 ```bash
-# Install and run in one command
+# Download and run in one command
 npx local-operator-ui
 ```
 
-This will download and execute the latest version of the Local Operator UI, launching the application immediately.
+This runs the latest version and launches the app.
 
-### Manual Installation
-
-Alternatively, without npx, you can install the package globally with standard npm:
+### Install with npm
 
 ```bash
 # Install globally
@@ -78,52 +66,67 @@ npm install -g local-operator-ui
 local-operator-ui
 ```
 
-After installation, the application will automatically connect to the Local Operator backend API at `http://localhost:1111` by default.
-
-### Desktop Applications
+### Desktop applications
 
-Pre-built desktop applications are available for macOS, Windows, and Linux. Visit the [Releases](https://github.com/damianvtran/local-operator-ui/releases) page to download the latest version for your platform.
+Prebuilt apps are on the [download page](https://local-operator.com/download) and the [releases page](https://github.com/damianvtran/local-operator-ui/releases):
 
-- **macOS**: Download the `.dmg` file and drag the application to your Applications folder.
+- **macOS**: Download the `.dmg` (or `.zip`) and open it.
 - **Windows**: Download the `.exe` installer and follow the installation prompts.
-- **Linux**: Download the appropriate package (`.deb`, `.rpm`, or `.AppImage`) for your distribution.
+- **Linux**: Download the `.deb`, `.rpm`, or `.AppImage` for your distribution.
 
-### Building from Source
+The Local Operator backend is bundled with the application and is installed automatically on first run. If you already have a Local Operator backend installed, the application detects it and uses it instead; by default it connects to the backend API at `http://localhost:1111`.
 
-If you want to build the application from source, see the [BUILD.md](./docs/BUILD.md) file for detailed instructions.
+## What it looks like
 
-#### Python Bundling
+### Chat and agents
 
-For macOS builds, we now bundle a standalone Python directly with the application instead of requiring Homebrew installation. This approach:
+| Light | Dark |
+| :---: | :---: |
+| <img src="./resources/readme/chat-trace-light.webp" alt="Light theme: a conversation showing tool rows, a blocked risky action, and a question the agent asked." width="420"> | <img src="./resources/readme/chat-trace-dark.webp" alt="Dark theme: the same conversation." width="420"> |
 
-- Eliminates the need for admin privileges during installation
-- Makes the application more self-contained
-- Works offline
-- Provides a more reliable user experience
-- Supports installation of Python packages via pip
+<sub><code>chat</code> — a working agent's tool rows, a blocked risky action, and the question it asked before continuing.</sub>
 
-To set up the standalone Python for development:
+### Agent hub
 
-```bash
-# Run the setup script to download and configure standalone Python
-pnpm setup-python-standalone
-```
+| Light | Dark |
+| :---: | :---: |
+| <img src="./resources/readme/agent-hub-light.webp" alt="Light theme: the agent hub with categories and a grid of community agents." width="420"> | <img src="./resources/readme/agent-hub-dark.webp" alt="Dark theme: the agent hub grid." width="420"> |
 
-This uses [python-build-standalone](https://github.com/indygreg/python-build-standalone), the same approach used by Datasette Desktop and PyOxidizer.
+<sub><code>agent hub</code> — community agents you can browse and download, by category.</sub>
 
-For more details, see the [PYTHON_BUNDLING.md](./docs/PYTHON_BUNDLING.md) documentation.
+### Schedules
 
-### Code Signing and Notarization
+| Light | Dark |
+| :---: | :---: |
+| <img src="./resources/readme/schedules-light.webp" alt="Light theme: the schedules page, listing scheduled wakes with their cadence and run history." width="420"> | <img src="./resources/readme/schedules-dark.webp" alt="Dark theme: the schedules page." width="420"> |
 
-All desktop applications are code signed and notarized to ensure security and trust:
+<sub><code>schedules</code> — conversations that wake on a timer, with what ran and when they run next.</sub>
 
-- **macOS**: Applications are signed with an Apple Developer ID and notarized with Apple's notarization service
-- **Windows**: Applications are signed with a trusted code signing certificate
-- **Linux**: While code signing is less common on Linux, packages are built with integrity checks
+### Projects
 
-For detailed information about the code signing and notarization process, see the [CODE_SIGNING.md](./docs/CODE_SIGNING.md) document.
+| Light | Dark |
+| :---: | :---: |
+| <img src="./resources/readme/projects-board-light.webp" alt="Light theme: the projects board with active, paused, and done columns." width="420"> | <img src="./resources/readme/projects-board-dark.webp" alt="Dark theme: the projects board." width="420"> |
+
+<sub><code>projects</code> — workstreams you and your agents track across sessions, as a board or a timeline.</sub>
+
+### Appearance
+
+| Light | Dark |
+| :---: | :---: |
+| <img src="./resources/readme/appearance-light.webp" alt="Light theme: the appearance picker showing the Local Operator themes as swatches." width="420"> | <img src="./resources/readme/appearance-dark.webp" alt="Dark theme: the appearance picker." width="420"> |
+
+<sub><code>appearance</code> — 59 colour themes ship with the app; Local Operator Dark is the default.</sub>
 
-## 🗂️ Project Structure
+## Features
+
+- **Chat with agents** — real-time conversation with markdown rendering for code blocks and formatted text, syntax highlighting, and per-conversation history.
+- **Agent management** — create, update, and delete agents, and configure their settings: model and description (general), temperature and top_p (chat), and security prompt and execution permissions (security).
+- **Settings** — system prompt configuration, API credentials management, and application configuration in one place.
+- **Local Operator API integration** — the app talks to the Local Operator backend API and shows real-time status updates for long-running operations.
+- **Bundled backend** — the Local Operator backend is installed automatically on first run on every platform; an existing backend installation is detected and used instead.
+
+## Project structure
 
 The codebase is organized for modularity and code reuse:
 
@@ -132,59 +135,55 @@ The codebase is organized for modularity and code reuse:
 - `src/renderer/src/app.tsx`, `main.tsx`, etc.: Entry points for the Electron renderer process.
 - `build/`, `resources/`, `scripts/`: Build assets, static resources, and build scripts.
 
-**Import Conventions:**
+**Import conventions:**
 
 - Use `@shared/` for shared modules (e.g., `import { useAgents } from "@shared/hooks/use-agents"`).
 - Use `@features/` for feature-specific modules.
-- The old aliases (`@renderer`, `@components`, `@hooks`, etc.) have been removed in favor of this unified structure.
+- The build also resolves the older aliases (`@renderer`, `@components`, `@hooks`, etc.) for the files that still import them.
 
 For more details on building or contributing, see the [Contributing Guide](./CONTRIBUTING.md) and [BUILD.md](./docs/BUILD.md).
 
-## ✨ Features
+## Building from source
+
+If you want to build the application from source, see the [BUILD.md](./docs/BUILD.md) file for detailed instructions.
 
-The Local Operator UI provides a comprehensive interface for interacting with AI agents:
+### Python bundling
 
-### Chat Interface
+For macOS builds, the app bundles a standalone Python directly instead of requiring a Homebrew installation. This approach:
 
-- Real-time chat with AI agents
-- Markdown rendering for code blocks and formatted text
-- Syntax highlighting for code snippets
-- Message history and conversation management
+- Needs no admin privileges during installation
+- Keeps the application self-contained
+- Works offline
+- Supports installing Python packages with pip
 
-### Agent Management
+To set up the standalone Python for development:
 
-- Create, update, and delete AI agents
-- Configure agent settings:
-  - General settings (name, description, model)
-  - Chat settings (temperature, top_p, etc.)
-  - Security settings (security prompt, execution permissions)
+```bash
+# Run the setup script to download and configure standalone Python
+pnpm setup-python-standalone
+```
 
-### Settings
+This uses [python-build-standalone](https://github.com/indygreg/python-build-standalone), the same approach used by Datasette Desktop and PyOxidizer.
 
-- System prompt configuration
-- API credentials management
-- Application configuration
+For more details, see the [PYTHON_BUNDLING.md](./docs/PYTHON_BUNDLING.md) documentation.
 
-### API Integration
+### Code signing and notarization
 
-- Seamless integration with the Local Operator backend API
-- Real-time status updates for long-running operations
-- Error handling and retry mechanisms
+All desktop applications are code signed and notarized to ensure security and trust:
 
-### Bundled Backend
+- **macOS**: Applications are signed with an Apple Developer ID and notarized with Apple's notarization service
+- **Windows**: Applications are signed with a trusted code signing certificate
+- **Linux**: While code signing is less common on Linux, packages are built with integrity checks
 
-- The Local Operator backend is now bundled with the application
-- Automatic installation of the backend when first running the application
-- Automatic detection and use of existing backend installations
-- Cross-platform support for Windows, macOS, and Linux
+For detailed information about the code signing and notarization process, see the [CODE_SIGNING.md](./docs/CODE_SIGNING.md) document.
 
-## 🤝 Contributing
+## Contributing
 
 Contributions are welcome! Please see our [Contributing Guide](./CONTRIBUTING.md) for details on how to get started with development, code style guidelines, and our contribution process.
 
-## 🐛 Troubleshooting
+## Troubleshooting
 
-### Common Issues
+### Common issues
 
 #### Application fails to connect to the backend
 
@@ -197,7 +196,7 @@ Contributions are welcome! Please see our [Contributing Guide](./CONTRIBUTING.md
 #### Backend installation fails
 
 - Check the application logs for error messages
-- For macOS, the application now uses a bundled Python framework instead of requiring Homebrew and pyenv
+- For macOS, the application uses a bundled Python framework instead of requiring Homebrew and pyenv
 - If you encounter issues with the bundled Python, see the [PYTHON_BUNDLING.md](./docs/PYTHON_BUNDLING.md) documentation
 - As a fallback, you can try installing the backend manually with `pip install local-operator` and then start it with `local-operator serve`
 
@@ -215,38 +214,23 @@ Contributions are welcome! Please see our [Contributing Guide](./CONTRIBUTING.md
 
 #### The window came to the front on its own, or a run never appeared
 
-Every time the app brings a window to the front it writes one line to its own
-backend log (`~/Library/Application Support/Local Operator/logs/backend-service.log`
-on macOS; the `LOCAL_OPERATOR_LOG_DIR` environment variable moves it):
+Every time the app brings a window to the front it writes one line to its own backend log (`~/Library/Application Support/Local Operator/logs/backend-service.log` on macOS; the `LOCAL_OPERATOR_LOG_DIR` environment variable moves it):
 
 ```
 [window-raise] trigger=second-instance mode=normal requested=focus pid=9182 cwd=/Users/you/project applied=restore+show+focus
 ```
 
-`trigger` names what asked: `initial-present` (the app starting up),
-`second-instance` (a second launch sharing this profile), `banner-click`,
-`viewer-focus` or `viewer-resume`. `pid` and `cwd`, when they are there, name the
-process that asked — that is the one to stop if something keeps doing it. A run
-that raises nothing writes nothing, so an app that never came forward has no line
-at all — although a conversation that is WAITING for a window does: a `headless`
-launch against an app with no window open writes `applied=parked`, `parked=<id>`
-rather than a raise, and that conversation opens the next window you give the app.
-In the line above, `mode` is the window mode the raise ran under and `applied` is
-what it actually did.
-
-A second launch only brings the window as far as IT asked: a `headless` run never
-raises it (it can still load the conversation it names), an `inactive` one orders
-the window without activating the app and without pulling it back out of the
-Dock, and a launch that declares nothing — you double-clicking the app while it is
-already running — still comes to the front.
-
-### Getting Help
+`trigger` names what asked: `initial-present` (the app starting up), `second-instance` (a second launch sharing this profile), `banner-click`, `viewer-focus` or `viewer-resume`. `pid` and `cwd`, when they are there, name the process that asked — that is the one to stop if something keeps doing it. A run that raises nothing writes nothing, so an app that never came forward has no line at all — although a conversation that is WAITING for a window does: a `headless` launch against an app with no window open writes `applied=parked`, `parked=<id>` rather than a raise, and that conversation opens the next window you give the app. In the line above, `mode` is the window mode the raise ran under and `applied` is what it actually did.
+
+A second launch only brings the window as far as IT asked: a `headless` run never raises it (it can still load the conversation it names), an `inactive` one orders the window without activating the app and without pulling it back out of the Dock, and a launch that declares nothing — you double-clicking the app while it is already running — still comes to the front.
+
+## Getting help
 
 If you encounter issues not covered here, please:
 
 1. Check the [GitHub Issues](https://github.com/damianvtran/local-operator-ui/issues) for similar problems
 2. Open a new issue if your problem hasn't been reported
 
-## 📄 License
+## License
 
-This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
+This project is licensed under the MIT License — see the [LICENSE](LICENSE) file for details. It is open source because AI tools should be accessible to everyone, and your contributions and feedback help make that real.

package/out/main/index.js

@@ -67,6 +67,7 @@ const mcpOperationId = zod.z.string().regex(/^[a-f0-9]{32}$/);
 const mcpCatalogCwd = zod.z.string().min(1).max(4096).regex(/^(\/|[A-Za-z]:[\\/])/);
 const SUBSCRIPTION_ID_PATTERN = /^[a-f0-9]{32}$/;
 const requestId = zod.z.string().regex(/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/);
+const meshId = zod.z.string().regex(/^[A-Za-z0-9_-]{1,128}$/);
 const sessionImage = zod.z.object({
   data_b64: zod.z.string().min(1).max(1e6),
   mime_type: zod.z.enum(["image/png", "image/jpeg", "image/gif", "image/webp"])
@@ -296,6 +297,24 @@ const desktopRequestUnion = zod.z.discriminatedUnion("op", [
      * archived state, and an unarchive control on a row found by search.
      */
     include_archived: zod.z.boolean().optional(),
+    /*
+     * Whether conversations OTHER devices hold belong in the answer.
+     *
+     * ABSENT MEANS `false`, the same compatibility promise `include_archived`
+     * makes and for the same reason: the app's own sidebar fetch has always
+     * meant "this device's catalogue", and a client that predates the mesh must
+     * keep reading exactly that. The Mesh tab is the ONE surface that asks for
+     * the federated list, because "which conversation is on which device" is its
+     * question and it cannot answer it from `session_count` alone.
+     *
+     * THE COST IS NOT ZERO, which is why only that surface asks: the backend's
+     * peer projection dials each peer's relay under a 12 s fan-out budget and is
+     * TTL-cached at 20 s (`network/relay.py`, `session/peer_rows.py`), while a
+     * machine in no network short-circuits to no call at all — so the flag costs
+     * a paired device one cached fan-out per cadence, and an unpaired one
+     * nothing. The sidebar's two-second poll must never carry it.
+     */
+    include_peers: zod.z.boolean().optional(),
     /*
      * The four parameters that make the catalogue PAGEABLE, and the switch that
      * makes the daemon count it.
@@ -1384,14 +1403,81 @@ const desktopRequestUnion = zod.z.discriminatedUnion("op", [
    * UI that could would have to re-implement the relay's authorisation model in
    * JavaScript.
    *
-   * THE MUTATING MESH OPS ARE NOT HERE YET, deliberately: slice 1 of the Mesh tab is
-   * a read surface, and a request schema entry with no caller is a capability this
-   * app advertises but cannot exercise. `networks.invite`,
-   * `networks.member.remove` and `sessions.transfer` land with the surfaces that use
-   * them (the invite action, the member table, the drag layer).
+   * THE MUTATING MESH OPS LANDED WITH THE SURFACES THAT USE THEM (slice 2: the drag
+   * layer, the invite action, the member list), which is the rule this block stated
+   * while they were still absent: a request schema entry with no caller is a
+   * capability this app advertises but cannot exercise.
+   *
+   * `features.session_transfer` gates the TRANSFER and only it (`capabilities.py`):
+   * a backend can host a network, mint invites and remove members without being able
+   * to move a conversation, and the surfaces that gate on the wrong key draw a
+   * control that 404s. The three ops below therefore sit behind different keys —
+   * `networks.invite`/`networks.member.remove` behind `features.peers` (they are
+   * routes the mesh itself introduced), `sessions.transfer` behind
+   * `features.session_transfer`.
+   *
+   * WHAT TRAVELS, AND WHAT DOES NOT. `to` is the destination device id or the
+   * literal `"local"` (a RECALL), because that is the route's own shape: one route,
+   * two protocols, and the direction is decided by which of the two ends is asking
+   * — see `guide://network`. `request_id` is minted by the CALLER and is what makes
+   * a retry replay a recorded outcome instead of starting a second move for a
+   * request that may still be running, so it is sent on every drop rather than kept
+   * for a retry path this surface does not have.
    */
   zod.z.object({ op: zod.z.literal("peers.list") }).strict(),
   zod.z.object({ op: zod.z.literal("networks.list") }).strict(),
+  /*
+   * Mint an invite. `role` is the joined device's own role in the network and
+   * `device` BINDS the token to one device id, so a token intercepted on its way to
+   * another machine cannot be redeemed by a third one. The token itself NEVER
+   * crosses this API (the receipt carries a path, and it is written where the
+   * renderer cannot read it) — which is why the answer is a receipt and not a
+   * secret.
+   */
+  zod.z.object({
+    op: zod.z.literal("networks.invite"),
+    networkId: meshId,
+    role: zod.z.enum(["read", "drive", "admin"]),
+    deviceId: meshId.optional()
+  }).strict(),
+  /*
+   * Revoke a membership. `confirm` is the NETWORK'S NAME, typed by the user, and
+   * the route compares it exactly: this is the one mesh act that changes other
+   * devices' state (every peer is rekeyed and the removed device is locked out on
+   * its next handshake), so the request must carry what the user was shown rather
+   * than a bool a stray retry could also send.
+   */
+  zod.z.object({
+    op: zod.z.literal("networks.member.remove"),
+    networkId: meshId,
+    deviceId: meshId,
+    confirm: zod.z.string().min(1).max(256)
+  }).strict(),
+  /*
+   * Ask a device to take a conversation, or ask THIS device to take one back.
+   *
+   * THE DIRECTION IS THE PROTOCOL'S, not a UI preference: there is no push verb, so
+   * a drop on a peer is this device asking that peer to PULL (`to: <device_id>`),
+   * and a drop on this device is a recall (`to: "local"`). `keep` is the reversible
+   * half — it mints a new id at the destination and leaves the source running —
+   * while a move deletes the source's copy once the handoff commits, which is why
+   * `source_retired = (mode == "move")` on the receipt.
+   *
+   * `wait_s` is a CEILING ON WAITING INSIDE THE REQUEST, not a promise: the route
+   * returns as soon as it has a definite outcome, and a `busy` source refuses
+   * rather than being interrupted. The desktop's own deadline for this op is
+   * derived from the route's published bound rather than from the 20 s control
+   * budget (see `moveClientBoundMs`) — the defect this avoids is a client that gives
+   * up first and reports its own timeout for a move the backend was about to answer.
+   */
+  zod.z.object({
+    op: zod.z.literal("sessions.transfer"),
+    sessionId,
+    to: zod.z.union([zod.z.literal("local"), meshId]),
+    keep: zod.z.boolean().optional(),
+    waitS: zod.z.number().min(0).max(300).optional(),
+    requestId: requestId.optional()
+  }).strict(),
   /*
    * The Projects surface (`/v1/desktop/projects*`), APPENDED to the union
    * rather than inserted beside the other catalogue ops: the backend serves
@@ -1466,6 +1552,30 @@ const desktopRequestUnion = zod.z.discriminatedUnion("op", [
     op: zod.z.literal("projects.milestone.remove"),
     key: projectKey,
     name: zod.z.string().min(1).max(PROJECT_MILESTONE_NAME_MAX_CHARS)
+  }).strict(),
+  /*
+   * AIDA'S CONTROL PLANE: one read and one control op on the same route
+   * (`/v1/desktop/aida`), because the rail's row and the composer's `/aida`
+   * need the SAME state and a second spelling of it would be a second answer
+   * about her one long session (`design.md` § 4 freezes the route).
+   *
+   * The feature is gated by its OWN capability key (`features.aida`), never a
+   * bump of `commands`: a renderer that does not read it keeps working against
+   * this backend, and this renderer must not call the route while the key is
+   * absent or 0 (§ 3.4's version skew).
+   *
+   * Deliberately NOT a `MESSAGE_OPS` member (see `desktopRequestByteBudget`):
+   * an enum word and a receipt are not prose, so this costs the control budget.
+   */
+  zod.z.object({ op: zod.z.literal("aida.status") }).strict(),
+  zod.z.object({
+    op: zod.z.literal("aida.control"),
+    /*
+     * The route's own op vocabulary, held to it here: a word the backend does
+     * not serve must fail at this boundary rather than travel as a 422 the
+     * user reads as a defect of their press.
+     */
+    action: zod.z.enum(["open", "pause", "resume", "greet", "status"])
   }).strict()
 ]);
 const desktopRequestSchema = desktopRequestUnion.superRefine(
@@ -1568,7 +1678,23 @@ const LONG_READ_OPS = /* @__PURE__ */ new Set([
   ...PROVIDER_READ_OPS,
   ...MESH_READ_OPS
 ]);
-function desktopRequestDeadlineMs(op) {
+const MOVE_OP_DEADLINE_S = 90;
+const MOVE_OFFLOAD_CONFIRM_S = 30;
+const MOVE_COPY_WAIT_S = 300;
+const MOVE_CONTROL_SLACK_S = 10;
+const MOVE_CLIENT_MARGIN_S = 15;
+const MOVE_APP_MARGIN_MS = 1e4;
+function moveClientBoundMs(shape) {
+  const recall = shape.to === "local";
+  const hold = recall || shape.keep ? MOVE_COPY_WAIT_S : MOVE_OFFLOAD_CONFIRM_S;
+  const waitS = Math.max(0, shape.waitS ?? 0);
+  return (MOVE_OP_DEADLINE_S + hold + MOVE_CONTROL_SLACK_S + MOVE_CLIENT_MARGIN_S) * 1e3 + waitS * 1e3;
+}
+function desktopRequestDeadlineMs(request) {
+  if (typeof request !== "string" && request.op === "sessions.transfer") {
+    return moveClientBoundMs(request) + MOVE_APP_MARGIN_MS;
+  }
+  const op = typeof request === "string" ? request : request.op;
   return LONG_READ_OPS.has(op) ? DESKTOP_LONG_READ_DEADLINE_MS : DESKTOP_CONTROL_DEADLINE_MS;
 }
 const DESKTOP_DEADLINE_EXCEEDED_CODE = "deadline_exceeded";
@@ -1630,6 +1756,12 @@ const PANEL_READ_OPS = /* @__PURE__ */ new Set([
 function desktopRequestDeadlineDetail(op, deadlineMs) {
   const seconds = Math.round(deadlineMs / 1e3);
   const code = DESKTOP_DEADLINE_EXCEEDED_CODE;
+  if (op === "sessions.transfer") {
+    return {
+      code,
+      message: `The app waits up to ${seconds} seconds for a move, and it was still running when the app stopped waiting. The move was asked for, so its outcome is unknown from here: read the session again before moving it anywhere else.`
+    };
+  }
   if (READ_ONLY_OPS.has(op)) {
     return {
       code,
@@ -1689,6 +1821,46 @@ function desktopEndpoint(request) {
       return { path: "/v1/desktop/peers", method: "GET" };
     case "networks.list":
       return { path: "/v1/desktop/networks", method: "GET" };
+    /*
+     * THE THREE MESH WRITES. Each path segment is `encodeURIComponent`ed even
+     * though `meshId` already refuses `/`, `.` and `%`: the schema is this
+     * client's check, and a redirect or a hand-built request must not be able to
+     * turn a device id into a path fragment. `device: null` on an invite is the
+     * route's own "unbound token" — an invite any device may redeem once.
+     */
+    case "networks.invite":
+      return {
+        path: `/v1/desktop/networks/${encodeURIComponent(request.networkId)}/invite`,
+        method: "POST",
+        body: { role: request.role, device: request.deviceId ?? null }
+      };
+    case "networks.member.remove":
+      return {
+        path: `/v1/desktop/networks/${encodeURIComponent(request.networkId)}/members/${encodeURIComponent(request.deviceId)}`,
+        method: "DELETE",
+        // The NETWORK'S NAME, as typed: see the op's own comment for why the
+        // route takes a name rather than a bool.
+        body: { confirm: request.confirm }
+      };
+    case "sessions.transfer":
+      return {
+        path: `/v1/desktop/sessions/${encodeURIComponent(request.sessionId)}/transfer`,
+        method: "POST",
+        body: {
+          to: request.to,
+          // Sent explicitly rather than omitted-when-false: `keep` decides whether
+          // the SOURCE'S COPY IS DELETED, so the request says which move it is
+          // rather than leaving the route's default to answer for a drop a user
+          // made from a menu that offered the copy.
+          keep: request.keep ?? false,
+          wait_s: request.waitS ?? 0,
+          // Omitted while absent, and this one is load-bearing: the route
+          // journals an UNCONFIRMED move under this key so a retry replays the
+          // recorded outcome instead of moving twice, and a request with no key
+          // is a different (unjournalled) request on purpose.
+          ...request.requestId ? { request_id: request.requestId } : {}
+        }
+      };
     case "profiles.list":
       return { path: "/v1/desktop/profiles", method: "GET" };
     case "profiles.get":
@@ -1745,6 +1917,7 @@ function desktopEndpoint(request) {
       if (request.scope_name) params.set("scope_name", request.scope_name);
       if (request.cursor) params.set("cursor", request.cursor);
       if (request.with_counts) params.set("with_counts", "true");
+      if (request.include_peers) params.set("include_peers", "true");
       return {
         path: `/v1/desktop/sessions?${params}`,
         method: "GET"
@@ -2526,6 +2699,19 @@ function desktopEndpoint(request) {
         path: `/v1/desktop/projects/${encodeURIComponent(request.key)}/milestones/${encodeURIComponent(request.name)}`,
         method: "DELETE"
       };
+    case "aida.status":
+      return { path: "/v1/desktop/aida", method: "GET" };
+    case "aida.control":
+      return {
+        path: "/v1/desktop/aida",
+        method: "POST",
+        /*
+         * The route's body is `{"op": ...}` — its own word, not this envelope's
+         * — so the ACTION travels under the route's field name and the two `op`s
+         * cannot be read as one.
+         */
+        body: { op: request.action }
+      };
   }
 }
 const MAX_PROBE_PATHS = 64;
@@ -6129,7 +6315,7 @@ async function requestDesktopOutcome(input, backendUrl, token) {
   }
   const target2 = desktopEndpoint(request);
   let answered = false;
-  const deadlineMs = desktopRequestDeadlineMs(request.op);
+  const deadlineMs = desktopRequestDeadlineMs(request);
   try {
     const body = target2.body === void 0 ? void 0 : JSON.stringify(target2.body);
     if (body && Buffer.byteLength(body) > desktopRequestByteBudget(request.op)) {

package/out/renderer/assets/{_basePickBy-9ROOwmxL.js → _basePickBy-BmRJBnL9.js}

@@ -1 +1 @@
-import{e as o,c as b,g as v,k as O,h as P,j as p,l as w,m as A,n as x,t as c,o as N}from"./_baseUniq-eE-r5ZZ4.js";import{as as g,aa as y,at as E,au as F,av as M,aw as I,ax as _,ay as $,az as B,aA as T}from"./mermaid.core-xrJy-S5f.js";var S=/\s/;function z(n){for(var r=n.length;r--&&S.test(n.charAt(r)););return r}var G=/^\s+/;function H(n){return n&&n.slice(0,z(n)+1).replace(G,"")}var m=NaN,L=/^[-+]0x[0-9a-f]+$/i,R=/^0b[01]+$/i,q=/^0o[0-7]+$/i,C=parseInt;function K(n){if(typeof n=="number")return n;if(o(n))return m;if(g(n)){var r=typeof n.valueOf=="function"?n.valueOf():n;n=g(r)?r+"":r}if(typeof n!="string")return n===0?n:+n;n=H(n);var t=R.test(n);return t||q.test(n)?C(n.slice(2),t?2:8):L.test(n)?m:+n}var W=1/0,X=17976931348623157e292;function Y(n){if(!n)return n===0?n:0;if(n=K(n),n===W||n===-1/0){var r=n<0?-1:1;return r*X}return n===n?n:0}function D(n){var r=Y(n),t=r%1;return r===r?t?r-t:r:0}function fn(n){var r=n==null?0:n.length;return r?b(n):[]}var l=Object.prototype,J=l.hasOwnProperty,dn=y(function(n,r){n=Object(n);var t=-1,e=r.length,a=e>2?r[2]:void 0;for(a&&E(r[0],r[1],a)&&(e=1);++t<e;)for(var f=r[t],i=F(f),s=-1,d=i.length;++s<d;){var u=i[s],h=n[u];(h===void 0||M(h,l[u])&&!J.call(n,u))&&(n[u]=f[u])}return n});function un(n){var r=n==null?0:n.length;return r?n[r-1]:void 0}function Q(n){return function(r,t,e){var a=Object(r);if(!I(r)){var f=v(t);r=O(r),t=function(s){return f(a[s],s,a)}}var i=n(r,t,e);return i>-1?a[f?r[i]:i]:void 0}}var U=Math.max;function Z(n,r,t){var e=n==null?0:n.length;if(!e)return-1;var a=t==null?0:D(t);return a<0&&(a=U(e+a,0)),P(n,v(r),a)}var hn=Q(Z);function V(n,r){var t=-1,e=I(n)?Array(n.length):[];return p(n,function(a,f,i){e[++t]=r(a,f,i)}),e}function gn(n,r){var t=_(n)?w:V;return t(n,v(r))}var j=Object.prototype,k=j.hasOwnProperty;function nn(n,r){return n!=null&&k.call(n,r)}function vn(n,r){return n!=null&&A(n,r,nn)}function rn(n,r){return n<r}function tn(n,r,t){for(var e=-1,a=n.length;++e<a;){var f=n[e],i=r(f);if(i!=null&&(s===void 0?i===i&&!o(i):t(i,s)))var s=i,d=f}return d}function mn(n){return n&&n.length?tn(n,$,rn):void 0}function an(n,r,t,e){if(!g(n))return n;r=x(r,n);for(var a=-1,f=r.length,i=f-1,s=n;s!=null&&++a<f;){var d=c(r[a]),u=t;if(d==="__proto__"||d==="constructor"||d==="prototype")return n;if(a!=i){var h=s[d];u=void 0,u===void 0&&(u=g(h)?h:B(r[a+1])?[]:{})}T(s,d,u),s=s[d]}return n}function on(n,r,t){for(var e=-1,a=r.length,f={};++e<a;){var i=r[e],s=N(n,i);t(s,i)&&an(f,x(i,n),s)}return f}export{rn as a,tn as b,V as c,on as d,mn as e,fn as f,hn as g,vn as h,dn as i,D as j,un as l,gn as m,Y as t};
+import{e as o,c as b,g as v,k as O,h as P,j as p,l as w,m as A,n as x,t as c,o as N}from"./_baseUniq-7Lo40p8f.js";import{as as g,aa as y,at as E,au as F,av as M,aw as I,ax as _,ay as $,az as B,aA as T}from"./mermaid.core-CF1Z-P7X.js";var S=/\s/;function z(n){for(var r=n.length;r--&&S.test(n.charAt(r)););return r}var G=/^\s+/;function H(n){return n&&n.slice(0,z(n)+1).replace(G,"")}var m=NaN,L=/^[-+]0x[0-9a-f]+$/i,R=/^0b[01]+$/i,q=/^0o[0-7]+$/i,C=parseInt;function K(n){if(typeof n=="number")return n;if(o(n))return m;if(g(n)){var r=typeof n.valueOf=="function"?n.valueOf():n;n=g(r)?r+"":r}if(typeof n!="string")return n===0?n:+n;n=H(n);var t=R.test(n);return t||q.test(n)?C(n.slice(2),t?2:8):L.test(n)?m:+n}var W=1/0,X=17976931348623157e292;function Y(n){if(!n)return n===0?n:0;if(n=K(n),n===W||n===-1/0){var r=n<0?-1:1;return r*X}return n===n?n:0}function D(n){var r=Y(n),t=r%1;return r===r?t?r-t:r:0}function fn(n){var r=n==null?0:n.length;return r?b(n):[]}var l=Object.prototype,J=l.hasOwnProperty,dn=y(function(n,r){n=Object(n);var t=-1,e=r.length,a=e>2?r[2]:void 0;for(a&&E(r[0],r[1],a)&&(e=1);++t<e;)for(var f=r[t],i=F(f),s=-1,d=i.length;++s<d;){var u=i[s],h=n[u];(h===void 0||M(h,l[u])&&!J.call(n,u))&&(n[u]=f[u])}return n});function un(n){var r=n==null?0:n.length;return r?n[r-1]:void 0}function Q(n){return function(r,t,e){var a=Object(r);if(!I(r)){var f=v(t);r=O(r),t=function(s){return f(a[s],s,a)}}var i=n(r,t,e);return i>-1?a[f?r[i]:i]:void 0}}var U=Math.max;function Z(n,r,t){var e=n==null?0:n.length;if(!e)return-1;var a=t==null?0:D(t);return a<0&&(a=U(e+a,0)),P(n,v(r),a)}var hn=Q(Z);function V(n,r){var t=-1,e=I(n)?Array(n.length):[];return p(n,function(a,f,i){e[++t]=r(a,f,i)}),e}function gn(n,r){var t=_(n)?w:V;return t(n,v(r))}var j=Object.prototype,k=j.hasOwnProperty;function nn(n,r){return n!=null&&k.call(n,r)}function vn(n,r){return n!=null&&A(n,r,nn)}function rn(n,r){return n<r}function tn(n,r,t){for(var e=-1,a=n.length;++e<a;){var f=n[e],i=r(f);if(i!=null&&(s===void 0?i===i&&!o(i):t(i,s)))var s=i,d=f}return d}function mn(n){return n&&n.length?tn(n,$,rn):void 0}function an(n,r,t,e){if(!g(n))return n;r=x(r,n);for(var a=-1,f=r.length,i=f-1,s=n;s!=null&&++a<f;){var d=c(r[a]),u=t;if(d==="__proto__"||d==="constructor"||d==="prototype")return n;if(a!=i){var h=s[d];u=void 0,u===void 0&&(u=g(h)?h:B(r[a+1])?[]:{})}T(s,d,u),s=s[d]}return n}function on(n,r,t){for(var e=-1,a=r.length,f={};++e<a;){var i=r[e],s=N(n,i);t(s,i)&&an(f,x(i,n),s)}return f}export{rn as a,tn as b,V as c,on as d,mn as e,fn as f,hn as g,vn as h,dn as i,D as j,un as l,gn as m,Y as t};