Merge main into feat/run-failure-longtail-895

Resolve i18n and run-failure guidance conflicts while preserving both the long-tail error cards and current main behavior.

Author: xiaoche-hub

.github/workflows/bake-plugin-previews-release.yml

@@ -40,7 +40,16 @@ jobs:
         with:
           ref: ${{ github.ref }}
           fetch-depth: 0
-          token: ${{ secrets.PREVIEW_BAKE_TOKEN || github.token }}
+          # Read-only clone with the default token, but do NOT persist it as a
+          # github.com credential. release/** is guarded by the "Protected
+          # branches (preview/*, release/v*)" ruleset (deletion / non_fast_forward
+          # / pull_request), so a direct push is rejected (GH013) unless the pusher
+          # is a bypass actor. github-actions[bot] is NOT one — so the manifest
+          # writeback below force-authenticates as open-design-bot, which IS a
+          # bypass actor, via an explicit token URL. A persisted github.token
+          # extraheader would override that inline token on push (see #5357), so
+          # drop it; nothing between here and the push needs the persisted cred.
+          persist-credentials: false
 
       - name: Loop guard — skip the bake bot's own manifest commit
         id: guard
@@ -71,8 +80,26 @@ jobs:
           r2-bucket: ${{ secrets.CLOUDFLARE_R2_REPOSITORY_ASSETS_BUCKET }}
           r2-endpoint: ${{ secrets.CLOUDFLARE_R2_REPOSITORY_ASSETS_URL }}
 
+      - name: Mint the open-design-bot token for the release-branch push
+        if: ${{ steps.guard.outputs.skip != 'true' }}
+        id: bot
+        # open-design-bot (app id 3640364) is a bypass actor on the
+        # "Protected branches (preview/*, release/v*)" ruleset, so its push clears
+        # the pull_request rule that rejects github-actions[bot] (GH013). The
+        # release bake pushes the manifest directly (it then rides the non-squash
+        # release back-merge to main). Minted here — after the long render, not at
+        # job start — because an App token lives ~1h and the render can run long.
+        uses: actions/create-github-app-token@v3.2.0
+        with:
+          client-id: ${{ secrets.BOT_APP_CLIENT_ID }}
+          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
+          owner: nexu-io
+          repositories: open-design
+
       - name: Commit the authoritative manifest onto the release branch
         if: ${{ steps.guard.outputs.skip != 'true' }}
+        env:
+          BOT_TOKEN: ${{ steps.bot.outputs.token }}
         run: |
           OLD=data/plugin-previews/manifest.json
           NEW=.tmp/plugin-previews/manifest.json
@@ -89,4 +116,7 @@ jobs:
           git config user.email "bot@open-design.ai"
           git add "$OLD"
           git commit -m "chore(plugin-previews): refresh baked preview manifest (release cut)"
-          git push origin "HEAD:${GITHUB_REF#refs/heads/}"
+          # Push as open-design-bot (a ruleset bypass actor) via an explicit token
+          # URL. A plain `git push origin` would authenticate as github-actions[bot]
+          # and be rejected by the release/** pull_request rule (GH013).
+          git push "https://x-access-token:${BOT_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "HEAD:${GITHUB_REF#refs/heads/}"

.github/workflows/bake-plugin-previews.yml

@@ -41,6 +41,23 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6.0.2
+        with:
+          # Do NOT persist the default GITHUB_TOKEN as a github.com credential.
+          # The rolling manifest branch is force-pushed below with the release-bot
+          # App token (`x-access-token:${APP_TOKEN}`) precisely so the resulting PR
+          # sync is attributed to app/open-design-release-bot and its CI runs
+          # automatically (a github-actions[bot]-attributed pull_request run is held
+          # as `action_required` — GitHub's bot-recursion gate — which starves
+          # bake-plugin-previews-automerge.yml, since that reactor only approves +
+          # enqueues on `workflow_run.conclusion == 'success'`). When checkout
+          # persists the GITHUB_TOKEN it installs an `http.https://github.com/.extraheader`
+          # Authorization header that overrides the inline App token on push, so the
+          # force-push authenticates as github-actions[bot] and the rolling PR's CI
+          # never runs without a manual "Approve and run". Nothing between here and
+          # the push needs the persisted credential (setup-workspace only touches the
+          # pnpm store; render/upload uses R2 creds; gh + push use the App token), so
+          # dropping it is safe and keeps the App token the sole push credential.
+          persist-credentials: false
 
       - name: Setup workspace
         uses: ./.github/actions/setup-workspace

PRIVACY.md

@@ -13,13 +13,13 @@ default**, and you can turn it off at any time under **Settings → Privacy**.
 
 Usage telemetry is **on by default**. On first run the app shows a privacy
 disclosure banner so you can see what is collected before doing anything else.
-It is an informed-disclosure notice with a single **I get it** acknowledgement,
-not an opt-in gate — and because telemetry is already enabled, the app may begin
-sending events (such as onboarding and UI-interaction events) from first launch.
+The banner asks you to choose **Share** or **Don’t share**.
+Choosing **Share** keeps telemetry enabled; choosing **Don’t share**
+turns telemetry off.
 
-You stay in control: the banner footer tells you sharing is on and points you to
-**Settings → Privacy**, where you can turn telemetry off and toggle each category
-below — and you can change your decision at any time.
+You stay in control: the banner points you to **Settings → Privacy**, where you
+can turn telemetry off and toggle each category below — and you can change your
+decision at any time.
 
 ## What is collected
 

apps/daemon/src/connectionTest.ts

@@ -56,7 +56,6 @@ import {
 import { aihubmixHeaders } from './integrations/aihubmix.js';
 import type { AgentCliEnvPrefs } from './app-config.js';
 import type { RuntimeAgentDef } from './runtimes/types.js';
-import { resolveModelForAgent } from './runtimes/models.js';
 import { preparePromptFileForAgent, type PreparedPromptFile } from './runtimes/prompt-file.js';
 import { configuredAllowedInternalHosts } from './origin-validation.js';
 import {
@@ -76,7 +75,19 @@ import {
   type ProviderTestRequest,
 } from '@open-design/contracts/api/connectionTest';
 import { googleGenerateContentUrl } from './integrations/google-models.js';
-import { resolveAmrProfile } from './integrations/vela.js';
+import { readVelaCredentialRevision, resolveAmrProfile } from './integrations/vela.js';
+import { amrModelLoadingCache } from './runtimes/amr-model-cache.js';
+import { buildAmrModelCacheKey } from './runtimes/amr-model-probe.js';
+import {
+  fetchVelaPresetModels,
+  fetchVelaRemoteModelsWithRetry,
+} from './runtimes/defs/amr.js';
+import {
+  getRememberedLiveModels,
+  preferFreshLiveModels,
+  resolveDefaultModelFromOptions,
+  resolveModelForAgent,
+} from './runtimes/models.js';
 
 export { validateBaseUrl } from '@open-design/contracts/api/connectionTest';
 
@@ -1880,12 +1891,9 @@ function attachAgentStreamHandlers(
       child,
       prompt,
       cwd,
-      // Same substitution as the chat-run path in server.ts — adapters whose
-      // CLI rejects the synthetic 'default' (e.g. AMR / vela, which forces
-      // session/set_model before session/prompt) need the def's first
-      // concrete fallback id here too, otherwise Test connection deadlocks
-      // on the same `session/set_model must be called before session/prompt`
-      // error the chat-run path already handles.
+      // Same substitution as the chat-run path in server.ts: omitted models can
+      // resolve to a concrete fallback, while an explicit 'default' is preserved
+      // so ACP runtimes can use their upstream configured default.
       model: resolveModelForAgent(def as never, model ?? null, modelEnv, liveModelScope),
       mcpServers: [],
       send,
@@ -1963,11 +1971,41 @@ async function prepareOpenCodeConnectionTestCwd(tempDir: string): Promise<void>
   }
 }
 
+async function resolveConnectionTestModelForAgent(
+  def: RuntimeAgentDef,
+  requestedModel: string | null,
+  env: NodeJS.ProcessEnv,
+  liveModelScope: string | null,
+  launchPath?: string | null,
+): Promise<string | null> {
+  const resolved = resolveModelForAgent(def, requestedModel, env, liveModelScope);
+  if (def.id !== 'amr' || resolved !== 'default' || !launchPath) return resolved;
+
+  try {
+    const cacheKey = buildAmrModelCacheKey({
+      launchPath,
+      env,
+      credentialRevision: readVelaCredentialRevision(env),
+    });
+    const catalog = await amrModelLoadingCache.get(cacheKey, {
+      fetchPreset: () => fetchVelaPresetModels(launchPath, env),
+      fetchRemote: () => fetchVelaRemoteModelsWithRetry(launchPath, env),
+    });
+    const liveModels = preferFreshLiveModels(
+      catalog.models ?? [],
+      getRememberedLiveModels(def.id, liveModelScope),
+    );
+    return resolveDefaultModelFromOptions(liveModels) ?? resolved;
+  } catch {
+    return resolved;
+  }
+}
+
 async function testAgentConnectionInternal(
   input: AgentConnectionInput,
 ): Promise<ConnectionTestResponse> {
   const start = Date.now();
-  const model =
+  let model =
     typeof input.model === 'string' && input.model.trim()
       ? input.model.trim()
       : 'default';
@@ -2221,6 +2259,13 @@ async function testAgentConnectionInternal(
       ...baseEnv,
       ...(mmdRouteLaunchEnv || {}),
     }, executableResolution);
+    model = await resolveConnectionTestModelForAgent(
+      def,
+      model,
+      env,
+      liveModelScope,
+      executableResolution.launchPath,
+    ) ?? model;
     const auth = await probeAgentAuthStatus(def, executableResolution.launchPath, env);
     if (auth?.status === 'missing') {
       // Preflight auth probe runs after binary resolution but before the
@@ -2278,7 +2323,7 @@ async function testAgentConnectionInternal(
       child,
       SMOKE_PROMPT,
       tempDir,
-      input.model,
+      model,
       env,
       liveModelScope,
       sink.send,

apps/daemon/src/design-systems/index.ts

@@ -90,6 +90,7 @@ export type DesignSystemStaticFileDetail = {
 
 export type DesignSystemPackageInfo = {
   manifest?: DesignSystemProjectManifest;
+  availableFiles?: string[];
   sourceEvidence?: {
     scannedFileCount?: number;
     tokenCount?: number;
@@ -404,12 +405,49 @@ export async function readDesignSystemPackageInfo(
   if (manifest === null) return null;
 
   const sourceEvidence = await readDesignSystemSourceEvidence(brandRoot, manifest);
+  const availableFiles = await listAvailableDesignSystemPackageFiles(brandRoot, manifest);
   return {
     manifest,
+    ...(availableFiles.length > 0 ? { availableFiles } : {}),
     ...(sourceEvidence ? { sourceEvidence } : {}),
   };
 }
 
+async function listAvailableDesignSystemPackageFiles(
+  brandRoot: string,
+  manifest: DesignSystemProjectManifest,
+): Promise<string[]> {
+  const candidates = new Set<string>(DESIGN_SYSTEM_STATIC_SYSTEM_FILES);
+  const add = (filePath: string | undefined): void => {
+    const cleanPath = typeof filePath === 'string' ? sanitizeRelativeFilePath(filePath) : null;
+    if (cleanPath) candidates.add(cleanPath);
+  };
+
+  add(manifest.files.design);
+  add(manifest.files.tokens);
+  add(manifest.files.components);
+  add(manifest.files.designTokens);
+  add(manifest.files.tailwind);
+  add(manifest.usage);
+  add(manifest.componentsManifest);
+  for (const page of manifest.preview?.pages ?? []) add(page.path);
+  for (const font of manifest.fonts ?? []) add(font.file);
+
+  const out: string[] = [];
+  const resolvedRoot = path.resolve(brandRoot);
+  for (const relativePath of Array.from(candidates).sort()) {
+    const filePath = path.resolve(brandRoot, relativePath);
+    if (filePath !== resolvedRoot && !filePath.startsWith(`${resolvedRoot}${path.sep}`)) continue;
+    try {
+      const stats = await stat(filePath);
+      if (stats.isFile()) out.push(relativePath);
+    } catch (err) {
+      if (!isAbsenceError(err)) throw err;
+    }
+  }
+  return out;
+}
+
 /**
  * Structured (compiled) form of a brand's design system. Optional sibling
  * files alongside DESIGN.md that, when present, give agents a
@@ -1231,6 +1269,49 @@ export async function updateUserDesignSystem(
   return listed.find((s) => s.id === `user:${dirId}`) ?? null;
 }
 
+// A design-system workspace project mirrors its design system's title:
+// ensureUserDesignSystemWorkspaceProject re-stamps the project name from
+// the registry title every time the workspace is ensured, so a rename
+// applied only to the project row silently reverts on the next open.
+// Renames on these projects must instead be written through to the
+// design-system title — the sync then carries the new name back onto the
+// project and both records agree.
+export function workspaceRenameDesignSystemId(project: {
+  designSystemId?: string | null;
+  metadata?: unknown;
+}): string | null {
+  const id = typeof project?.designSystemId === 'string' ? project.designSystemId : '';
+  if (!id.startsWith('user:')) return null;
+  const metadata = project?.metadata;
+  const importedFrom =
+    metadata && typeof metadata === 'object'
+      ? (metadata as Record<string, unknown>).importedFrom
+      : undefined;
+  return importedFrom === 'design-system' ? id : null;
+}
+
+// 'not-applicable': the project is not a design-system workspace (or the
+// name is blank) — the rename does not involve a design system at all.
+// 'propagated': the bound design system's title now matches the new name.
+// 'failed': the project IS bound to a user design system but the title
+// could not be written through (e.g. the entry is missing on disk).
+// Callers must not persist the project-row rename on 'failed' — doing so
+// recreates the silent revert this write-through exists to prevent.
+export type WorkspaceRenamePropagation = 'not-applicable' | 'propagated' | 'failed';
+
+export async function propagateWorkspaceProjectRename(
+  root: string,
+  project: { designSystemId?: string | null; metadata?: unknown },
+  name: unknown,
+): Promise<WorkspaceRenamePropagation> {
+  const id = workspaceRenameDesignSystemId(project);
+  if (!id) return 'not-applicable';
+  const title = typeof name === 'string' ? name.trim() : '';
+  if (!title) return 'not-applicable';
+  const updated = await updateUserDesignSystem(root, id, { title });
+  return updated != null ? 'propagated' : 'failed';
+}
+
 export async function linkUserDesignSystemProject(
   root: string,
   id: string,

apps/daemon/src/integrations/vela-errors.ts

@@ -1,9 +1,12 @@
-export type AmrAccountErrorCode = 'AMR_AUTH_REQUIRED' | 'AMR_INSUFFICIENT_BALANCE';
+export type AmrAccountErrorCode =
+  | 'AMR_AUTH_REQUIRED'
+  | 'AMR_INSUFFICIENT_BALANCE'
+  | 'AMR_TIER_UPGRADE_REQUIRED';
 
 export interface AmrAccountFailure {
   code: AmrAccountErrorCode;
   message: string;
-  action: 'relogin' | 'recharge';
+  action: 'relogin' | 'recharge' | 'upgrade';
   actionUrl?: string;
 }
 
@@ -27,6 +30,12 @@ const AMR_AUTH_REQUIRED_MESSAGE =
 const AMR_INSUFFICIENT_BALANCE_MESSAGE =
   `AMR Cloud reported insufficient balance for this model. Recharge your AMR wallet at ${DEFAULT_AMR_RECHARGE_URL}, then retry this run.`;
 
+const AMR_TIER_UPGRADE_REQUIRED_MESSAGE =
+  'Your current AMR plan does not include this model or request type. Upgrade your AMR plan, or switch to an available model and retry.';
+
+const AMR_TIER_REQUEST_KIND_NOT_ENTITLED_MESSAGE =
+  'Your current AMR plan does not include this request type yet. Upgrade your AMR plan, or switch to a supported model and retry.';
+
 function normalizeFailureText(text: string): string {
   return String(text || '').toLowerCase();
 }
@@ -74,6 +83,22 @@ export function classifyAmrAccountFailureDetails(details: unknown): AmrAccountFa
     };
   }
 
+  if (code === 'tier_model_not_entitled') {
+    return {
+      code: 'AMR_TIER_UPGRADE_REQUIRED',
+      message: AMR_TIER_UPGRADE_REQUIRED_MESSAGE,
+      action: 'upgrade',
+    };
+  }
+
+  if (code === 'tier_request_kind_not_entitled') {
+    return {
+      code: 'AMR_TIER_UPGRADE_REQUIRED',
+      message: AMR_TIER_REQUEST_KIND_NOT_ENTITLED_MESSAGE,
+      action: 'upgrade',
+    };
+  }
+
   return null;
 }
 
@@ -114,6 +139,22 @@ export function classifyAmrAccountFailure(text: string): AmrAccountFailure | nul
     };
   }
 
+  if (value.includes('tier_model_not_entitled')) {
+    return {
+      code: 'AMR_TIER_UPGRADE_REQUIRED',
+      message: AMR_TIER_UPGRADE_REQUIRED_MESSAGE,
+      action: 'upgrade',
+    };
+  }
+
+  if (value.includes('tier_request_kind_not_entitled')) {
+    return {
+      code: 'AMR_TIER_UPGRADE_REQUIRED',
+      message: AMR_TIER_REQUEST_KIND_NOT_ENTITLED_MESSAGE,
+      action: 'upgrade',
+    };
+  }
+
   if (
     value.includes('auth_required') ||
     value.includes('authentication required') ||