chore(workspace): sync main through 517f39ac - #6346
Merged
Merged
Conversation
* fix(daemon): surface AMR OpenCode stall context * fix(daemon): accept runtime-omitted OpenCode diagnostics Generated-By: looper 0.11.0 (runner=fixer, agent=codex) * fix(ci): make static gate runner-independent (#6039) --------- Co-authored-by: PerishFire <39043006+PerishCode@users.noreply.github.com>
* test(e2e): parallelize restoration group * test(e2e): identify conversations from persisted prompts Generated-By: looper 0.11.0 (runner=fixer, agent=codex) * test(e2e): wait for conversation persistence --------- Co-authored-by: Looper <looper@noreply.github.com>
#6200) The /agents/codex-design/ page ranks #1 for "codex design" but only ~6th with a 1.3% CTR for "codex ui", a query that grew from 30 to ~90 daily impressions this month. A live SERP check shows the intent is mostly "build UI with Codex" (our intent), with a minority looking for the Codex app's own interface. - Retitle to "Codex Design: Build UI with OpenAI Codex" (title + H1). - Lead the frontend section with the query phrase and an answer-shaped opening paragraph, so the section is extractable for AI answers. - Add a disambiguation paragraph separating the Codex app's own UI from the UI you build with Codex, and route the former back to the main line. - Add two FAQ entries covering both readings; they also feed the FAQPage schema, which already earns a text snippet on this query. Applied across all 11 shipped locales (en, zh authored; the other nine translated with the page's terminology preserved). Co-authored-by: Joey <236967869+joeylee12629-star@users.noreply.github.com>
* Add Clone Audit plugin * Update open-design.json * fix: make clone audit skill reusable * fix: sanitize clone audit provenance path
* fix(web): allow skipping required chat questions * fix(web): auto-skip unanswered chat questions --------- Co-authored-by: xiaoche-hub <298951296+xiaoche-hub@users.noreply.github.com>
* docs(tools-pack): add build cache contract Document the tools-pack build-graph cache as a contract: the exact-match acceptance model, determinant rules, materialization-time parameters, the signing boundary, and fail-closed confidence grading. The rules come from an audit of all 11 cache nodes. Two are written down because nothing currently enforces them: a node key must carry the key of every upstream node it consumes, and a node key must not restate a list that already exists as a constant. Known low-confidence points are declared explicitly so fail-closed grading stays checkable rather than becoming a verbal convention. * docs(tools-pack): clarify cache materialization exceptions Generated-By: looper 0.11.2 (runner=fixer, agent=codex) * docs(tools-pack): document NSIS base version scope Generated-By: looper 0.11.2 (runner=fixer, agent=codex) --------- Co-authored-by: Looper <looper@noreply.github.com>
…15.1 (#6236) * docs(landing-page): localize 0.15.1 post, fix its cover, add 0.16.0 release post The 0.15.1 blog post shipped English-only and with an off-brand cover: a Fauvist oil painting overlaid with large display type, which reads nothing like the warm editorial illustrations every other release post uses. It also pointed `socialImage` at a 309KB JPEG while a WebP sat unused beside it. Regenerate the cover in the established house style (cream paper ground, sage/terracotta watercolour washes, pencil sketch resolving into a calm product surface), drop the stray JPEG, and add the full ten-locale i18n block so /zh/, /ja/, /ko/, /de/, /fr/, /ru/, /es/, /pt-br/, /it/ and /tr/ read in their own language instead of falling back to English. Also add the missing 0.16.0 "Reliable Delivery" post with a cover plus two inline figures in the same style, localized across the same ten locales. The 0.16.1 patch is a single preview fix, too thin to carry its own page, so it lands as a closing section of the 0.16.0 post and the download CTA points there. * docs(landing-page): fix doubled apostrophes and locale copy in release posts Three defects surfaced reviewing the localized bodies. The French, Italian and Turkish bodies rendered every apostrophe twice — "aujourd''hui", "all''interno", "0.16.1''i". The `''` escape belongs to single-quoted YAML scalars, but `bodyHtml` is a block scalar, where content is literal. 173 occurrences across the two posts. Korean used Japanese corner brackets and Brazilian Portuguese and Turkish used French guillemets. All three take curly double quotes. The Chinese copy read as translation rather than prose. "标签" opens the release line as a UI label, not a version tag; "抢画框", "编辑策展位" and "安静修复" are literal renderings that say nothing in Chinese; "画廊" is not the term the product itself uses for a gallery, which keeps the English word. The tag fix also lands on 0.10.0 through 0.15.0, which share the phrasing — leaving the series half-corrected would read worse than either state alone. * docs(landing-page): drop the leading tag word from release post openings Every release post opened with the word for a git tag before the version identifier — "Tag open-design-v0.16.0", "Etiqueta …", "タグ …", and in Chinese "标签", which reads as a UI label rather than a version. The word carries no information the identifier does not already carry, and in several languages it lands as a category noun the sentence never uses again. Drop it across all nine release posts and every locale, in both the summary and the opening line, leaving the version identifier to open the dateline. Spanish and Brazilian Portuguese lose the feminine agreement that referred back to the removed noun; Turkish loses the trailing "etiketi" apposition for the same reason. * docs(landing-page): correct the 0.16.1 interval in the 0.16.0 post 0.16.0 was published 2026-07-22 14:42 UTC and 0.16.1 on 2026-07-23 16:11 UTC — 25.5 hours apart. "Two days later" overstated it, and the same wording had been carried into all ten localized bodies, so every published route repeated it. --------- Co-authored-by: Joey <236967869+joeylee12629-star@users.noreply.github.com>
…6055) * feat(daemon): expose Vela login through CLI and MCP * feat(mcp): add interactive local brief card * feat(packaged): bootstrap local MCP headlessly * feat(daemon): secure local BYOK credential profiles * feat(cli): manage secure BYOK profiles * feat(web): store BYOK keys in secure profiles * fix(runs): deduplicate cloud generation requests * feat(daemon): add end-to-end plugin observability * fix(pack): include native PTY runtime in desktop packages Lazy-load node-pty in the daemon so missing native binaries only disable Terminal and interactive Keychain operations instead of crashing startup. Ship and validate target prebuilds in macOS and Windows packages. Repair the macOS spawn helper before signing, and invalidate stale Windows packaging caches. Cover the packaged PTY path in macOS and Windows smoke tests. Require Vela CLI for every beta desktop build target. * fix(mcp): localize and stabilize plugin briefs Keep collect and confirm on one MCP Apps card, report intrinsic size changes, and remove the fragile widget-state fallback. Localize brief forms, summaries, status, and public errors from the current request or Host locale while preserving stable protocol ids and selections. Keep internal runtime identifiers out of user-facing MCP guidance. * fix(packaged): register live Studio URLs with daemon Register the packaged web sidecar loopback origin over namespace-scoped daemon IPC after dynamic binding. Invalidate install-info by the live web port and remove the second MCP URL cache so run and project responses use the current Studio address. Validate loopback origins and cover registration, rebind, and cache refresh. * fix(mcp): stabilize brief confirmation lifecycle Keep confirmed briefs locked after Host publication failures and retry only the cached follow-up message instead of confirming twice. Replace blank initialization with a compact loading state, accept immediate and delayed tool results, and bump the MCP Apps resource to v3 so Codex does not reuse the stale card. Add an executable JSDOM Host bridge harness covering double-submit, publication retry, delayed results, and repeated draft notifications. Validated with the full daemon suite, workspace typecheck, and guard. * fix(mcp): prevent brief app resize feedback loops Replace the self-observed intrinsic-height loop with deduplicated body measurements so Codex MCP app iframes do not repeatedly resize themselves and fail sandbox startup. Bump the brief resource URI to v4 to avoid cached v3 cards and cover the regression with the focused brief-app spec. Validated with daemon tests/build, workspace guard/typecheck, a verified beta DMG, and a direct packaged MCP resource smoke. * fix(mcp): use the final Open Design plugin identity Make open-design the only accepted external plugin ID across MCP tools, run attribution, artifact version origins, and telemetry. Rename the Brief MCP App resource to v5 and reject the unpublished old ID instead of aliasing it. Validated with 171 daemon tests, 5 web tests, daemon/web typechecks, and guard. * chore(pack): bump Vela CLI to 0.0.27 * chore(nix): refresh pnpm dependency hashes * fix(mcp): honor host and plugin request contracts Respect independently advertised MCP Apps capabilities and prefer the Codex-native follow-up bridge so confirmed briefs render as readable user turns instead of context-only messages. Bump the brief resource to v6 to invalidate stale cards.\n\nMark Vela login and account probes as open-world interactions, and require stable request IDs for attributed generation so lost responses cannot create a second logical run. * fix(cli): support keyless BYOK profiles Add an explicit --no-api-key save mode for local and self-hosted providers while keeping credential-bearing profiles stdin-only. Reject missing or conflicting credential modes and cover both paths in the CLI tests. * fix(pack): replace headless owner when desktop opens Advertise headless packaged runtimes as having no visible window, then shut them down before a normal desktop launch continues instead of treating SHOW as a successful focus. Validated with the focused packaged headless and launcher lifecycle tests (20 passed). * fix(pack): clean up failed headless startup Acquire the headless identity, sidecars, and IPC server through one failure-atomic lifecycle so later bootstrap errors close every previously acquired owner in reverse order. Cover MCP-install and web-identity publication failures; validated with 22 focused tests and the packaged typecheck. * fix(byok): remove raw provider request contract Expose only daemon-owned BYOK profile references from shared run types and the web transport, while retaining the daemon's fail-closed rejection for legacy or untyped raw credential payloads. Validated with 76 web provider tests plus web and contracts typechecks. * fix(daemon): preserve interrupted run idempotency Hydrate queued or running durable requests as DAEMON_RESTARTED failures before idempotency reuse, preserving the original request and workflow mappings instead of creating a second cloud operation. Share the restart transition with boot reconciliation and expose synthetic terminal events to reattaching clients. Validated with 48 focused tests and the daemon typecheck. * fix(byok): roll back failed credential metadata writes Snapshot secure-store values before mutation and compensate create, update, and delete operations when profile metadata cannot be persisted, preventing orphaned or lost credentials. Validated with nine focused credential-service tests and the daemon typecheck. * fix(web): reconcile selected BYOK profile metadata Treat the daemon's selected secure profile as authoritative for protocol, endpoint, model, and API version so CLI profile edits cannot leave the browser showing stale execution settings. Validated with 66 config tests and the web typecheck. * fix(byok): migrate legacy credentials before cleanup Import each supported legacy browser credential into a stable daemon-owned secure profile before removing plaintext copies. Keep the original browser record on secure-store or unsupported-provider failures and surface a Settings recovery path. Cover successful migration, duplicate projections, and injected secure-backend failure while preserving existing Bedrock downgrade behavior in memory. * fix(byok): secure Windows profiles with DPAPI Dispatch native Windows BYOK profiles to a CurrentUser DPAPI backend rooted under the resolved daemon data directory. Secrets enter PowerShell only through stdin, encrypted blobs stay separate from non-secret profile metadata, and API responses remain secret-free. Add platform dispatch coverage, a Windows-only real DPAPI round-trip test, and the packaged Windows smoke path for create, resolve, response-redaction, and delete behavior. * fix(web): preserve config writes during hydration * fix(byok): persist secure credentials across entry flows * test(byok): cover secure onboarding persistence --------- Co-authored-by: Cheems <94773058+itscheems@users.noreply.github.com> Co-authored-by: lefarcen <935902669@qq.com>
* test: strengthen e2e coverage and fixtures * test: allow artifact route when starting conversation * test: keep e2e count assertions stable Use the shared stable-count helper for no-request and duplicate-event windows so delayed async events cannot escape the assertions. Generated-By: looper 0.11.0 (runner=fixer, agent=codex) * fix: add e2e assertion import extension Use the explicit runtime extension required by the e2e NodeNext typecheck.\n\nGenerated-By: looper 0.11.0 (runner=fixer, agent=codex) * fix: preserve design system provenance and settle e2e assertions Keep disabled design systems available to project recovery and provenance while filtering only runtime injection. Make hover and cancellation checks observe their full settled windows. Generated-By: looper 0.11.2 (runner=fixer, agent=codex) * test(e2e): preserve unique restoration run IDs Pass the restoration fixture's run ID prefix through routeSuccessfulRuns so each mocked request receives a distinct run identity. Generated-By: looper 0.11.2 (runner=fixer, agent=codex) * test(e2e): stabilize agent and async count fixtures Route restoration agent requests through the shared JSON and SSE fixture, capture autosave baselines after a quiet period, and observe onboarding cancellation for a bounded stable window.\n\nGenerated-By: looper 0.11.2 (runner=fixer, agent=codex) * fix: honor disabled design systems in daemon runs Filter disabled persisted project selections at prompt and analytics boundaries, and keep restoration run fixtures unique.\n\nGenerated-By: looper 0.11.2 (runner=fixer, agent=codex) * test(e2e): shorten cancellation duplicate check Generated-By: looper 0.11.2 (runner=fixer, agent=codex)
* fix(daemon): continue stalled post-tool sessions * fix(daemon): separate post-tool continuation budget Generated-By: looper 0.11.1 (runner=fixer, agent=codex) * fix(daemon): preserve retry telemetry budget Generated-By: looper 0.11.1 (runner=fixer, agent=codex) * fix(daemon): align retry failure telemetry Generated-By: looper 0.11.1 (runner=fixer, agent=codex)
* fix(amr): recover late login failures and trace auth stages * fix(amr): preserve scoped cancel attempt IDs Generated-By: looper 0.11.1 (runner=fixer, agent=codex) * fix(amr): defer unsupported Vela auth stages Generated-By: looper 0.11.1 (runner=fixer, agent=codex) * fix(amr): narrow fallback telemetry to shipped Vela Generated-By: looper 0.11.1 (runner=fixer, agent=codex) * fix(amr): preserve live login after stale cancel Generated-By: looper 0.11.1 (runner=fixer, agent=codex) * fix(amr): preserve cancel during login startup Retain cancellation intent when a provisional cancel races the delayed canonical login response, then cancel the canonical attempt before polling can begin. Generated-By: looper 0.11.1 (runner=fixer, agent=codex) * fix(amr): rejoin newer login after startup cancel Generated-By: looper 0.11.1 (runner=fixer, agent=codex) * fix(amr): preserve cancel across web login starts Generated-By: looper 0.11.1 (runner=fixer, agent=codex) * fix(amr): retain cancel when status refresh fails Generated-By: looper 0.11.1 (runner=fixer, agent=codex) * fix(amr): cancel onboarding status preflight Treat cancellation before an auth attempt exists as a local preflight cancel so a delayed status response cannot start login.\n\nGenerated-By: looper 0.11.1 (runner=fixer, agent=codex)
* fix(tools-pack): carry workspace build key into tarballs * ci: constrain Actions cache writes
* fix(daemon): auto-mint assistantMessageId when API clients omit it Web always supplies assistantMessageId. Headless/MCP/eval clients that already send conversationId but omit the pin left lastMessageId null and skipped multi-turn native session resume (missing_cursor). Mint the id server-side whenever a conversation is bound and the client did not, and seed the user message the same way the old MCP-only path did. * fix(daemon): validate conversation ownership before omit-pin seed Reorder project-ownership checks before minting assistantMessageId and seeding the user prompt so cross-project omit-pin requests cannot corrupt foreign chats. Make ChatRunCreateRequest.assistantMessageId optional and expose conversationId/assistantMessageId on McpRunCreateRequest with contract tests for the omit-pin shape. Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build) * fix(daemon): reject missing conversation before omit-pin mint Return CONVERSATION_NOT_FOUND when a client supplies a stale or mistyped conversationId so omit-pin does not mint an unpersisted assistantMessageId and plugin snapshot resolve does not FK-crash with a 500. Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build) * fix(daemon): seed latest turn and fallback-bound user prompts Prefer currentPrompt over full message transcripts when seeding omit-pin user turns, and still seed after conversationId fallback when the client already supplied assistantMessageId. Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build) * fix(daemon): preserve attachments on omit-pin seeded user turns Copy request attachments and commentAttachments into the server-seeded user message so omit-pin/headless clients keep chips and annotation context after conversation reload. Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build) * fix(daemon): treat empty currentPrompt as authoritative omit-pin seed Attachments-only ChatRequest turns send currentPrompt as '' while message is the flattened transcript. Prefer any string currentPrompt, including empty, so seeded user rows keep empty content and do not duplicate history. Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build) * fix(daemon): seed turn metadata and bump project activity on omit-pin Persist sessionMode, runContext, and appliedPluginSnapshot on omit-pin seeded user turns so reload/retry keep applied context. Call updateProject after seed so listProjects reorders headless/API activity like PUT /messages. Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build) * fix(daemon): require projectId for bound conversation ownership Reject POST /api/runs when conversationId is present but projectId is missing or non-string, so omit-pin cannot seed messages without owning project context. Cover both early and post-fallback ownership checks. Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build) * fix(daemon): preserve slideIndex and BMP kind on omit-pin seeds Keep deck annotation slideIndex and classify .bmp as image when seeding user messages for clients that omit assistantMessageId. Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build) * fix(daemon): seed empty message when omit-pin has attachments When currentPrompt is unset and message is empty, still seed the user turn if attachment metadata is present so chips/annotations survive reload. Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build) * fix(daemon): seed omit-pin chat content from original request Plugin resolution may rewrite meta.message with a rendered scenario brief for the run; persist requestBody currentPrompt/message for the user turn so the internal brief is not shown as chat content. Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build)
Disable Codex plugins only for externally attributed Open Design Plugin runs so Local Codex cannot recursively enter collect_brief or Cloud login. Preserve normal Local Codex plugin loading and the existing operator-wide override. Validated with the focused runtime args suite, workspace typecheck, guard, and an isolated source smoke that produced a valid artifact without Cloud login. Co-authored-by: Cheems <94773058+itscheems@users.noreply.github.com>
* fix: durably deliver enterprise leads * fix(landing): make contact sales KV canonical
* feat(prompts): introduce on-demand discovery in SP v2.0 * fix(prompts): prevent nested deck label overlap * fix(plugins): stabilize od-default task routing * fix: address prompt and deck audit regressions * fix(prompts): restore plan mode precedence * fix(daemon): accept all form answer headers --------- Co-authored-by: bone3deep1962-collab <bone3deep1962@gmail.com>
* fix(web): surface BYOK migration validation errors Preserve structured daemon errors during legacy credential migration and reserve offline guidance for fetch failures. Keep legacy browser credentials until migration succeeds, and cover HTTP validation, malformed responses, and network failures. Validated with focused web tests, web typecheck, workspace guard, and workspace typecheck. * fix(web): stabilize BYOK persistence error telemetry Map secure-profile HTTP and network failures to semantic error codes before emitting settings_byok_test_result, while preserving existing fallback behavior for unrelated connection-test errors. Validated with the complete web test suite, web typecheck, workspace typecheck, guard, and git diff --check. --------- Co-authored-by: Cheems <94773058+itscheems@users.noreply.github.com>
* fix(ui): improve dark-mode contrast for off-state toggles The default off-state track uses --border-strong (#c9d0da light / #46433c dark). In dark mode #46433c is only ~5% lighter than the --bg-subtle (#252321) panel behind it, making the toggle nearly invisible when off and users unsure of the control state. Bump the off-state track to #6b6862 with a subtle inset border, and add a thin outline to the white thumb so it stays visible against the (now lighter) track. On-state already uses --text (#e8e4dc) and is left unchanged. Applies to both .toggle-row (used by speaker-notes toggle in the deck tab) and .compact-toggle (used by SurfaceOptions toggles). Hover lift gives an additional interactive affordance. Fixes #5298 * fix(ui): fix two dark-mode toggle blocking issues from review Two correctness issues called out by mrcfps: 1. System dark theme never gets the contrast fix — the default "system" theme mode removes [data-theme] and falls back to @media prefers-color-scheme. Added a parallel block scoped to html:not([data-theme]) inside @media (prefers-color-scheme: dark). 2. Hover override wins over on-state — .compact-toggle:hover and .toggle-row:hover have higher specificity than .on variants, so hovering an ON toggle dropped its track from bright var(--text) to #75726c. Changed to :not(.on):hover so the hover lift only applies when off, leaving the on-state always bright. Both applied to both selector paths (explicit data-theme and system dark).
Co-authored-by: open-design-bot <bot@open-design.ai>
* fix(byok): withdraw Windows DPAPI backend * fix(byok): clean up retired Windows secret blobs Generated-By: looper 0.11.2 (runner=fixer, agent=codex) --------- Co-authored-by: Looper <looper@noreply.github.com>
lefarcen
added
size/XS
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
10 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The Workspace delivery branch had already absorbed the current main fixes through prior squash merges, but its Git ancestry did not record those main commits. This caused repeated large conflict sets during later synchronization and made it harder to prove that final Workspace validation was running against the current product baseline.
This PR records the exact main ancestry through
517f39acwhile preserving the already-reviewed Workspace behavior and the latest collaboration hardening fromfeat/workspace-team.What users will see
No intentional product or UI change. Existing explicit Workspace scoping, Team member self-sharing permissions, collaboration authority, billing isolation, and preview behavior remain unchanged.
Surface area
apps/weborapps/desktop(including Electron menu bar)odsubcommand or flag, newtools-dev/tools-packflag, or newOD_*env var/api/*endpoint, new SSE event, or changed shape inpackages/contractsskills/,design-systems/,design-templates/, orcraft/, or change to the skills protocolTRANSLATIONS.mdfor the locale workflow)package.json(dependenciesordevDependencies); workspace-packagepackage.jsonfiles are out of scope. Include a paragraph on what we get vs. what bytes we ship (seeCONTRIBUTING.md→ Code style)Screenshots
Not applicable; this ancestry synchronization intentionally has no UI change.
Bug fix verification
Not applicable; this PR records ancestry and carries forward already-validated fixes without changing product behavior. The only net file change against the current feature head strengthens an existing onboarding negative assertion by replacing a fixed delay with a stable observation window.
Validation
pnpm guardpnpm typecheckgit diff --checkAll validations passed without retry-only success. The final product tree is byte-for-byte identical to feature head
4f662dd, except for the single strengthened onboarding E2E assertion. Vela CLI remains pinned to0.0.27-test.7.