chore: fix merge pr 255 (#292)

* feat(console): add resizable log panel

* feat(state): wire runtime slices and summarizer

* chore(fmt): add treefmt wiring

* chore(credentials): remove legacy plaintext fallback

* ci: add evaluate workflow

* fix(theme): scope Minted to Monaco diffs

* feat(settings): split backup and tuning panels

* refactor(frontend): move backend mirrors to viewmodel

* chore(beads): update state migration issues

* fix: repair branch-wide breakage so the merge compiles & tests pass

Prior to this commit, both this branch (since a92e61b) and the merge
result failed `cargo check` with 22 errors. The user asked for cargo +
bun validation against the merge resolution, so this commit fixes the
preexisting structural breakage that the merge inherited, plus a few
follow-ups uncovered by the test suites.

Rust:
- git/mod.rs: restore the develop-side mod.rs that declares
  `pub mod query` / `pub mod init` and re-exports the right names from
  each. The orphan query.rs / init.rs files were already on disk; only
  the mod entry was missing after a92e61b accidentally gutted it.
- evolve/mod.rs: route `repo_root` through `git::query` (its new home),
  pull `FileEdit` from `shared_types`, re-export `Evolution` from
  `shared_types::Evolution` (types.rs only imports it, doesn't re-export
  it), and fix the `made_edit_or_build_check` typo that develop's PR
  #272 introduced (variable never defined; should be
  `made_edit || made_build_check`).
- shared_types/git.rs: re-add `WatcherEvent` alongside the unused
  `GitState` slice type — `state/watcher.rs` still constructs it and
  needs the symbol back. Marked `GitState` `#[allow(dead_code)]` until
  the watcher migration finishes.
- summarize/queue_summarizer.rs: `#[allow(dead_code)]` on the
  not-yet-wired worker scaffolding (a92e61b carryover).
- commands/settings_io.rs: update an EvolutionLimits test fixture to
  include the new `max_token_budget` / `max_output_tokens` fields.

Frontend (post-merge tweaks):
- ipc/api.ts: drop the duplicate `devConfigs` entry the auto-merge
  produced (it appeared once near `settings` and again after
  `promptHistory`).
- ipc/types.ts: regenerated via `cargo run --example specta_gen_ts` to
  drop duplicated `ConfigField` / `ConfigurableSchema` / `EnumVariant`
  / `FieldType` blocks the auto-merge dual-inserted.
- viewmodel/git.ts + viewmodel.test.ts: switch the
  `git_state_changed` payload type from `GitState` (unused TS-side) to
  `WatcherEvent` (what the Rust watcher actually emits).
- hooks/use-evolve.ts: drop the eager `mirrorChangeMapState(null)` at
  the top of `handleEvolve`. Line 109 already correctly avoids
  overwriting the change map for conversational responses; the eager
  clear contradicted that and broke develop's PR #243 test that
  exercises conversational follow-ups.
- Tests (`use-evolve.test.ts`, `use-rollback.test.ts`,
  `prompt-input.test.tsx`, `system-defaults-cta.test.tsx`): swap the
  removed `setGitStatus` / `setEvolveState` / `setChangeMap` /
  `setSummaryAvailable` widget-store setters for the viewmodel mirror
  fns (`mirrorGitState`, `mirrorEvolveState`, `mirrorChangeMapState`).
  `summaryAvailable` no longer exists on the widget store; the
  related assertions are dropped.
- Storybook snapshots: 30 stories were regenerated after the
  AI Models tab field split, the system-defaults icon swap, and the
  hunk-pill render going through `DiffLineStatsBadge`.

Validation:
- `cargo check`: clean
- `cargo test`: 366 passed
- `bun run test:unit`: 116 passed
- `bun run test:storybook`: 165 passed
- `bun run build` (tsc + vite): clean

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix signing

* refactor: restore slice-event-per-slice contract in watcher

The earlier repair commit (8a19689) brought back `WatcherEvent` to make
state/watcher.rs compile, but that struct bundles four slices' worth of
state (git_status, change_map, evolve_state, error) onto the
`git_state_changed` channel. The intended architecture is one event per
slice, each carrying just that slice's state.

Watcher now emits:
- `git_state_changed`  →  GitState { git_status, external_build_detected }
- `change_map_changed` →  SemanticChangeMap   (unchanged)
- `evolve_state_changed` is no longer emitted from the watcher at all;
  evolve_state::set() writes through Slice<EvolveState>, whose
  write-guard already emits the event on drop. The watcher was emitting
  it twice.

Drop WatcherEvent from shared_types/git.rs and from the specta
registration; the `#[allow(dead_code)]` on GitState becomes unnecessary.

Separately, queue_summarizer's three #[allow(dead_code)] annotations
were honest: the commit a92e61b ("feat: wire runtime slices and
summarizer") never actually wired the worker — `app.manage(start_worker(handle)?)`
was missing from main.rs. Adding it now so the pipelines'
`try_state::<SummarizerState>()` path is actually used instead of always
falling back to inline processing.

Frontend follow-ups:
- viewmodel/git.ts subscribes `git_state_changed` as `GitState` now.
- viewmodel.test.ts constructs `GitState` (2 fields), not the made-up
  5-field WatcherEvent.
- types.ts regenerated via `cargo run --example specta_gen_ts`.

Validation: cargo check clean, 366 cargo tests pass, 116 unit tests
pass, tsc + vite build clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: some permission tests would fail on CI

Replace with more effective and reproducible tests.

---------

Co-authored-by: Cooper Maruyama <me@cooperm.com>
Co-authored-by: cooper <1325802+czxtm@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: 3 people

.beads/issues.jsonl

@@ -84,7 +84,11 @@ jobs:
       # Running `security list-keychain -d user -s <keychain>` before the build
       # replaces the keychain search list and breaks DMG bundling on tag runs.
       - name: Build Tauri app
-        run: bun run desktop:build
+        run: |
+          # unset the certificate and password so the runner can't influence the build
+          export APPLE_SIGNING_IDENTITY="-"
+          unset APPLE_CERTIFICATE APPLE_CERTIFICATE_PASSWORD KEYCHAIN_PASSWORD
+          bun run desktop:build
         shell: 'sops exec-env ops/secrets/secrets.yaml "bash -e {0}"'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/build.yaml

@@ -0,0 +1,75 @@
+name: Evaluate
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+  merge_group:
+  workflow_dispatch:
+
+concurrency:
+  group: evaluate-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  rust-build:
+    name: Rust Build
+    runs-on: macos-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+      - name: Rust cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: apps/native/src-tauri
+      - name: Build Rust app crate
+        working-directory: apps/native/src-tauri
+        run: cargo build --locked
+
+  typescript:
+    name: TypeScript
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+      - name: Type-check native app
+        working-directory: apps/native
+        run: bunx tsc --noEmit
+
+  treefmt:
+    name: Treefmt
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - name: Install Nix
+        uses: cachix/install-nix-action@v31.10.6
+      - name: Check changed Nix and shell files
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: |
+          set -euo pipefail
+
+          base="${BASE_SHA:-}"
+          if [ -z "$base" ]; then
+            base="$(git rev-parse HEAD^)"
+          fi
+
+          git diff -z --name-only --diff-filter=ACMR "$base" HEAD -- '*.nix' '*.sh' > /tmp/treefmt-files
+
+          if [ ! -s /tmp/treefmt-files ]; then
+            echo "No treefmt-covered files changed."
+            exit 0
+          fi
+
+          xargs -0 nix fmt -- --ci --formatters nixfmt --formatters shellcheck < /tmp/treefmt-files

.github/workflows/evaluate.yml

@@ -70,6 +70,7 @@ build
 # Environment variables
 .env
 .env*.local
+!.envrc
 
 # Turbo
 .turbo

.gitignore

@@ -71,7 +71,7 @@ fn main() {
         .register::<shared_types::ChangeType>()
         .register::<shared_types::GitFileStatus>()
         .register::<shared_types::GitStatus>()
-        .register::<shared_types::WatcherEvent>()
+        .register::<shared_types::GitState>()
         .register::<shared_types::EvolutionState>()
         .register::<shared_types::EvolutionTelemetry>()
         .register::<shared_types::EvolutionResult>()

apps/native/src-tauri/examples/specta_gen_ts.rs

@@ -125,7 +125,7 @@ Shared "managed edit" pattern (prepare, apply, finalize into review flow).
 
 - `build_state.rs` — Last successful nix-darwin build (store path, changeset, commit hash)
 - `evolve_state.rs` — Frontend step-routing state machine (Begin/Evolve/Commit/ManualEvolve/ManualCommit)
-- `watcher.rs` — Polls git status at a configurable interval, emits `WatcherEvent` to frontend
+- `watcher.rs` — Polls git status at a configurable interval and emits slice update events to frontend
 - `completion_log.rs` — Records AI completion responses to daily JSONL files
 
 **Called by:** commands, rebuild, evolve/lifecycle, main.rs (watcher startup)

apps/native/src-tauri/migrations/03-evolutions-origin-branch/up.sql

@@ -2,7 +2,7 @@ use super::helpers::capture_err;
 use crate::state::{build_state, evolve_state};
 use crate::storage::store;
 use crate::{db, git, shared_types};
-use tauri::AppHandle;
+use tauri::{AppHandle, State};
 
 /// Returns original (HEAD) and modified (working-tree) content for each requested file.
 #[tauri::command]
@@ -42,6 +42,7 @@ pub async fn git_status_and_cache(app: AppHandle) -> Result<shared_types::GitSta
 #[tauri::command]
 pub async fn git_commit(
     app: AppHandle,
+    db_pool: State<'_, db::DbPool>,
     message: String,
 ) -> Result<shared_types::CommitResult, String> {
     let dir = store::ensure_git_repo_folder(&app).map_err(|e| capture_err("git_commit", e))?;
@@ -56,22 +57,20 @@ pub async fn git_commit(
         log::warn!("[git_commit] Failed to tag commit: {}", e);
     }
 
-    if let Ok(db_path) = db::get_db_path(&app) {
-        let now = crate::utils::unix_now();
-        match db::commits::upsert_commit(
-            &db_path,
-            &commit_info.hash,
-            &commit_info.tree_hash,
-            Some(&message),
-            now,
-        ) {
-            Ok(id) => log::info!(
-                "[git_commit] Saved commit to database (id={}, hash={})",
-                id,
-                &commit_info.hash[..8]
-            ),
-            Err(e) => log::error!("[git_commit] Failed to save commit: {}", e),
-        }
+    let now = crate::utils::unix_now();
+    match db::commits::upsert_commit_in_pool(
+        &db_pool,
+        &commit_info.hash,
+        &commit_info.tree_hash,
+        Some(&message),
+        now,
+    ) {
+        Ok(id) => log::info!(
+            "[git_commit] Saved commit to database (id={}, hash={})",
+            id,
+            &commit_info.hash[..8]
+        ),
+        Err(e) => log::error!("[git_commit] Failed to save commit: {}", e),
     }
 
     // Update build state: new HEAD hash, no changeset (working tree is now clean).

apps/native/src-tauri/src/README.md

@@ -17,4 +17,3 @@ pub async fn permissions_request(
     permissions::request_permission(&permission_id)
         .map_err(|e| capture_err("permissions_request", e))
 }
-

apps/native/src-tauri/src/commands/git.rs

@@ -243,7 +243,9 @@ mod tests {
             &mut skipped,
             serde_json::to_value(EvolutionLimits {
                 max_iterations: 12,
+                max_token_budget: 80_000,
                 max_build_attempts: 4,
+                max_output_tokens: 16_384,
             })
             .unwrap(),
             false,