Release 107 feedback: clean desktop chat previews

.dependency-cruiser.cjs

@@ -15,7 +15,7 @@ module.exports = {
       name: 'not-to-unresolvable',
       comment: 'A broken/typo/moved import must fail the build, not surface at runtime.',
       severity: 'error',
-      from: {},
+      from: { path: '^src/' },
       to: { couldNotResolve: true }
     },
     {
@@ -71,7 +71,8 @@ module.exports = {
         'the boundary. A stray core->pro import ships paid source in the public repo.',
       severity: 'error',
       from: {
-        pathNot: '(loadProFeaturesMain|loadProFeaturesRenderer|main\\.tsx|bootstrap/proStub)'
+        pathNot:
+          '(loadProFeaturesMain|loadProFeaturesRenderer|main\\.tsx|bootstrap/proStub|\\.(test|spec)\\.[tj]sx?$|/__tests__/)'
       },
       to: { path: 'bootstrap/proStub\\.ts$|(^|/)pro/(main|renderer)/' }
     },
@@ -107,7 +108,9 @@ module.exports = {
     }
   ],
   options: {
-    doNotFollow: { path: 'node_modules' },
+    // Pro is a sibling checkout in CI. Inspect the core -> Pro edge, but do not
+    // traverse the private graph and apply open-core rules inside Pro itself.
+    doNotFollow: { path: 'node_modules|^pro/' },
     tsConfig: { fileName: 'tsconfig.web.json' },
     exclude: { path: 'node_modules|e2e/' },
     tsPreCompilationDeps: true,

.github/workflows/ci.yml

@@ -11,6 +11,7 @@ on:
   pull_request:
   push:
     branches: [main]
+  workflow_dispatch:
 jobs:
   # ONE job per repo, matching mobile and mobile-pro: typecheck, tests + coverage, boundaries, lint and the
   # Playwright e2e all report as a single `ci` check.
@@ -25,6 +26,10 @@ jobs:
     timeout-minutes: 50 # backstop: a hung step fails fast instead of running for hours (unit gates + e2e tour)
     steps:
       - uses: actions/checkout@v4
+        with:
+          # The authoritative coverage gate compares the checked-out change with
+          # origin/main. A depth-1 checkout has no merge base to measure.
+          fetch-depth: 0
       # Check out pro on the branch that MATCHES this PR/push (so a coordinated
       # core+pro change is tested together). If pro has no such branch (most PRs),
       # this step's checkout fails quietly and the fallback below pulls pro `main`.
@@ -40,6 +45,7 @@ jobs:
           token: ${{ secrets.CI_CROSS_REPO_TOKEN }}
           path: pro
           ref: ${{ github.head_ref || github.ref_name }}
+          fetch-depth: 0
           # Don't leave the cross-repo PAT in ./pro/.git/config where a later
           # PR-controlled step could reuse it — we only need it for the clone.
           persist-credentials: false
@@ -51,6 +57,7 @@ jobs:
           repository: off-grid-ai/desktop-pro
           token: ${{ secrets.CI_CROSS_REPO_TOKEN }}
           path: pro
+          fetch-depth: 0
           persist-credentials: false
       # pro MUST be present: without it the guarded typecheck/coverage path is skipped and
       # CI would pass core-only with cratered/misleading coverage (the failure the
@@ -63,7 +70,10 @@ jobs:
           fi
       - uses: actions/setup-node@v4
         with:
-          node-version: '24' # node:sqlite (used by integration tests) is available unflagged
+          # Node 22 supports node:sqlite and both native SQLite dependencies. Node
+          # 24 aborts while Vitest unloads the cipher module; Node 26 cannot build
+          # better-sqlite3 12.6.
+          node-version: '22'
       # Shared packages are file: dependencies on the SIBLING shared monorepo. CI must provision it before
       # installing Desktop. actions/checkout refuses a path outside the workspace, so it lands inside and is
       # moved up one level - exactly where the file: specifiers point.
@@ -107,6 +117,30 @@ jobs:
           npm --prefix ../shared ci
           npm --prefix ../shared/packages/sync run build
           npm --prefix ../shared/packages/models run build
+          npm --prefix ../shared/packages/speech run build
+          npm --prefix ../shared/packages/ui run build
+      - name: Check out the private Desktop speech runtime
+        uses: actions/checkout@v4
+        with:
+          repository: off-grid-ai/executorch-speech
+          token: ${{ secrets.CI_CROSS_REPO_TOKEN }}
+          path: _executorch_speech
+          lfs: false
+          # Keep the checkout credential only until the selective LFS pull in
+          # the next step. That step removes it before any project code runs.
+          persist-credentials: true
+      - name: Put the speech runtime beside this checkout
+        run: |
+          if [ ! -f _executorch_speech/package.json ]; then
+            echo "::error::off-grid-ai/executorch-speech was not checked out. Check CI_CROSS_REPO_TOKEN."
+            exit 1
+          fi
+          # Tests exercise the real native boundary, but ordinary CI does not need
+          # the 350 MB bundled English asset set used only by the Mac release.
+          git -C _executorch_speech lfs pull --include='native/bin/executorch-speech' --exclude=''
+          git -C _executorch_speech config --unset-all http.https://github.com/.extraheader || true
+          rm -rf ../executorch-speech
+          mv _executorch_speech ../executorch-speech
       - run: npm ci
       # Hard gates: types + the full test suite.
       - name: Typecheck (core)
@@ -116,12 +150,23 @@ jobs:
         if: ${{ hashFiles('pro/tsconfig.json') != '' }}
         timeout-minutes: 6
         run: cd pro && npx tsc --noEmit -p tsconfig.json
-      # Runs the full vitest suite AND enforces the coverage ratchet floor
-      # (vitest.config.ts `thresholds`) — the same gate as the pre-push hook, so a
-      # coverage regression fails CI, not just local pushes. The pro/** threshold
-      # group applies only when pro was checked out above (guarded in the config).
-      - name: Test + coverage thresholds
-        timeout-minutes: 10
+      # npm's Electron install hooks leave sqlite compiled for Electron's ABI. The
+      # Vitest process is plain Node, and some default integration tests open the
+      # real database, so put the native module on Node's ABI before that gate.
+      # The later DB journey script restores the Electron ABI in its EXIT trap.
+      - name: Rebuild SQLite for the Node test runner
+        run: npm rebuild better-sqlite3-multiple-ciphers
+      # This is the fast report, not the complete coverage measurement. DB-only
+      # journeys run next and e2e can add coarse coverage later. Test failures still
+      # block here; the aggregate new-code gate below owns the coverage decision.
+      - name: Test + fast coverage report
+        # The tests finish in about four minutes. V8 then maps coverage across the
+        # complete core + Pro source set, including files no test imported. That
+        # aggregation can take another six minutes on a busy runner, so give report
+        # generation enough time to finish.
+        timeout-minutes: 20
+        env:
+          OFFGRID_AGGREGATE_COVERAGE: '1'
         run: npm run test:coverage
       # The DB journeys - 74 files, 255 cases - which CI has NEVER run.
       #
@@ -148,7 +193,7 @@ jobs:
           # reason is recorded in vitest.db.ci.config.ts with the evidence from the run that found it. 243 of the
           # 248 cases still run here.
           OFFGRID_DB_VITEST_CONFIG: vitest.db.ci.config.ts
-        run: npm run test:db
+        run: npm run test:db -- --coverage
       # Build/native/port integration tests (packaging, whisper build-staging, the
       # model-port + System Health seams that own :8439). These need a packaged
       # build / native toolchain / a live engine port the pure `verify` runner
@@ -233,6 +278,27 @@ jobs:
           else
             echo "no e2e coverage captured (the suite may not have launched)"
           fi
+      # Match the pre-push authority: merge every report that can cover this change,
+      # then gate only executable lines added on this branch. The floors are the same
+      # ratchets as scripts/hooks/pre-push; neither whole-tree debt nor a partial suite
+      # can decide the result.
+      - name: Coverage gate (new code across all suites)
+        run: |
+          reports="coverage/coverage-final.json coverage-db/coverage-final.json"
+          for report in $reports; do
+            if [ ! -f "$report" ]; then
+              echo "::error::required coverage report is missing: $report"
+              exit 1
+            fi
+          done
+          coarse=""
+          if [ -f coverage-e2e/coverage-final.json ]; then
+            coarse="--coarse=coverage-e2e/coverage-final.json"
+          fi
+          node ../shared/scripts/new-code-coverage.mjs . $reports $coarse \
+            --min-statements=78 --min-branches=57 --min-functions=52 --min-lines=78
+          node ../shared/scripts/new-code-coverage.mjs ./pro $reports $coarse \
+            --min-statements=72 --min-branches=45 --min-functions=46 --min-lines=72
       - name: Upload e2e coverage
         if: ${{ always() && vars.OFFGRID_CI_E2E == '1' }}
         uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4

.github/workflows/release.yml

@@ -23,6 +23,15 @@ on:
         type: string
         required: false
         default: ''
+      artifact_only:
+        # Internal demo build: the SAME signed + notarized DMG, but uploaded as a run
+        # artifact (repo-scoped, auto-expiring) instead of a published Release. Skips the
+        # release-create/upload, the pro-mac.yml + latest/nightly aliases, Slack, and the
+        # whole Windows job - so nothing lands on the releases page or the update feed.
+        description: 'Build the signed+notarized DMG as a run artifact only (no Release, no Windows, no Slack)'
+        type: boolean
+        required: false
+        default: false
 
 permissions:
   contents: write
@@ -149,6 +158,12 @@ jobs:
           chmod +x resources/bin/meeting-recorder
           file resources/bin/meeting-recorder
           otool -l resources/bin/meeting-recorder | awk '/LC_BUILD_VERSION/{f=1} f&&/minos/{print "[ci] meeting-recorder minos="$2; exit}'
+      - name: Build Computer Use capture helper (exclude supervisor window)
+        run: |
+          MACOS_DEPLOYMENT_TARGET=13.0 bash scripts/build-computer-use-capture.sh resources/bin
+          chmod +x resources/bin/computer-use-capture
+          file resources/bin/computer-use-capture
+          otool -l resources/bin/computer-use-capture | awk '/LC_BUILD_VERSION/{f=1} f&&/minos/{print "[ci] computer-use-capture minos="$2; exit}'
       # Compile the dictation push-to-talk helper (CGEventTap) and stage it into
       # resources/bin so extraResources bundles it at Contents/Resources/bin — the
       # path PushToTalkHotkey resolves. Self-contained: no committed binary, built
@@ -160,6 +175,17 @@ jobs:
           mkdir -p resources/bin
           cp scripts/dictation-hotkey/dictation-hotkey resources/bin/dictation-hotkey
           chmod +x resources/bin/dictation-hotkey
+      # Compile the native actions helper (EventKit) and stage it into resources/bin so
+      # extraResources bundles it at Contents/Resources/bin — the path runNativeAction
+      # resolves. Self-contained: no committed binary, built fresh against the pinned
+      # target. If it ever fails to ship, the calendar tools report "not available" and
+      # the rest of the app is unaffected, so it can't break a release.
+      - name: Build native actions helper (computer use, semantic rail)
+        run: |
+          bash scripts/build-actions-helper.sh
+          mkdir -p resources/bin
+          cp scripts/actions-helper/actions-helper resources/bin/actions-helper
+          chmod +x resources/bin/actions-helper
       # Stage the Parakeet STT runtime (sherpa-onnx CLI + ONNX model) into
       # resources/bin/parakeet. Additive: with SHERPA_ONNX_URL / PARAKEET_MODEL_URL
       # unset this is a no-op and transcription stays on whisper, so it can't break a
@@ -228,7 +254,27 @@ jobs:
           # drifted lock stops the release instead of resolving a graph nobody committed.
           npm --prefix ../shared ci
           npm --prefix ../shared/packages/sync run build
+          # @offgrid/use (the durable action engine) is consumed the same way as sync
+          # and needs the same explicit build - file-dep prepare alone does not emit
+          # its dist/ types before the typecheck runs.
+          npm --prefix ../shared/packages/use run build
           npm --prefix ../shared/packages/models run build
+      - name: Check out the private Desktop speech runtime
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          repository: off-grid-ai/executorch-speech
+          token: ${{ secrets.CI_CROSS_REPO_TOKEN }}
+          path: _executorch_speech
+          lfs: true # Mac releases bundle the default English voices for offline first use.
+          persist-credentials: false
+      - name: Put the speech runtime beside this checkout
+        run: |
+          if [ ! -f _executorch_speech/package.json ]; then
+            echo "::error::off-grid-ai/executorch-speech was not checked out. Check CI_CROSS_REPO_TOKEN."
+            exit 1
+          fi
+          rm -rf ../executorch-speech
+          mv _executorch_speech ../executorch-speech
       - name: Install dependencies
         run: npm ci
       # Stamp the resolved version into package.json so electron-builder picks the
@@ -268,6 +314,7 @@ jobs:
           # notarytool needs the API key as a file; write it from the secret.
           printf '%s' "$APPLE_API_KEY_CONTENT" > "$RUNNER_TEMP/AuthKey.p8"
           export APPLE_API_KEY="$RUNNER_TEMP/AuthKey.p8"
+          npm run prepare:speech-defaults
           # Build every artifact with publication disabled. The artifact hook verifies
           # both the updater ZIP and DMG before this command can complete.
           npx electron-builder --mac \
@@ -278,7 +325,18 @@ jobs:
           APP="$(find dist -mindepth 2 -maxdepth 2 -type d -name 'Off Grid AI Desktop.app' -print -quit)"
           test -n "$APP"
           node scripts/probe-packaged-tts.mjs "$APP" --synthesize
+      # Internal demo build: hand the signed+notarized DMG back as a run artifact and stop
+      # (the publish steps below are all skipped). Repo-scoped, auto-expiring, no Release.
+      - name: Upload signed DMG as a build artifact
+        if: ${{ inputs.artifact_only }}
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4
+        with:
+          name: OffGrid-macOS-${{ needs.version.outputs.version }}
+          path: dist/OffGrid-*.dmg
+          if-no-files-found: error
+          retention-days: 14
       - name: Stage verified update assets and publish the release
+        if: ${{ !inputs.artifact_only }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           VERSION: ${{ needs.version.outputs.version }}
@@ -310,6 +368,7 @@ jobs:
             gh release edit "$TAG" --draft=false --prerelease
           fi
       - name: Migrate legacy Pro update channel (publish pro-mac.yml)
+        if: ${{ !inputs.artifact_only }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           VERSION: ${{ needs.version.outputs.version }}
@@ -335,7 +394,7 @@ jobs:
       # --clobber replaces the copy from the prior run. The versioned DMG + updater
       # feed (latest-mac.yml) are untouched, so auto-update is unaffected.
       - name: Publish stable latest.dmg alias
-        if: needs.version.outputs.channel == 'stable'
+        if: ${{ !inputs.artifact_only && needs.version.outputs.channel == 'stable' }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           VERSION: ${{ needs.version.outputs.version }}
@@ -349,7 +408,7 @@ jobs:
       # /releases/latest or the stable OffGrid-latest.dmg:
       #   https://github.com/off-grid-ai/off-grid-ai-desktop/releases/download/nightly/OffGrid-nightly.dmg
       - name: Publish constant nightly.dmg link
-        if: needs.version.outputs.channel == 'beta'
+        if: ${{ !inputs.artifact_only && needs.version.outputs.channel == 'beta' }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           VERSION: ${{ needs.version.outputs.version }}
@@ -367,7 +426,7 @@ jobs:
       # v$VERSION tag exist for beta too, so beta/nightly releases get their changelog on
       # the release page, not just stable.
       - name: Attach release notes
-        if: success()
+        if: ${{ !inputs.artifact_only && success() }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           VERSION: ${{ needs.version.outputs.version }}
@@ -378,7 +437,7 @@ jobs:
       # Slack outage never fails a release. Needs org/repo secret SLACK_WEBHOOK_URL (an
       # Incoming Webhook, channel-bound). No secret => the step is a logged no-op.
       - name: Announce release in Slack
-        if: success()
+        if: ${{ !inputs.artifact_only && success() }}
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
           PRODUCT: Off Grid AI Desktop
@@ -398,6 +457,8 @@ jobs:
   # (the repo's LFS binaries are macOS-only).
   build-win:
     needs: [version, build-mac]
+    # Skipped for an artifact-only demo build (macOS DMG is all the lead needs).
+    if: ${{ !inputs.artifact_only }}
     # windows-2022 = VS 2022 toolchain. windows-latest ships VS 2026, which node-gyp 11
     # can't parse, breaking native-module (better-sqlite3) compiles. Pin until it catches up.
     runs-on: windows-2022
@@ -469,7 +530,28 @@ jobs:
           # drifted lock stops the release instead of resolving a graph nobody committed.
           npm --prefix ../shared ci
           npm --prefix ../shared/packages/sync run build
+          # @offgrid/use (the durable action engine) is consumed the same way as sync
+          # and needs the same explicit build - file-dep prepare alone does not emit
+          # its dist/ types before the typecheck runs.
+          npm --prefix ../shared/packages/use run build
           npm --prefix ../shared/packages/models run build
+      - name: Check out the private Desktop speech package
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          repository: off-grid-ai/executorch-speech
+          token: ${{ secrets.CI_CROSS_REPO_TOKEN }}
+          path: _executorch_speech
+          lfs: false # The current native speech engine is macOS-only.
+          persist-credentials: false
+      - name: Put the speech package beside this checkout
+        shell: bash
+        run: |
+          if [ ! -f _executorch_speech/package.json ]; then
+            echo "::error::off-grid-ai/executorch-speech was not checked out. Check CI_CROSS_REPO_TOKEN."
+            exit 1
+          fi
+          rm -rf ../executorch-speech
+          mv _executorch_speech ../executorch-speech
       - name: Install dependencies
         run: npm ci
       - name: Fetch Windows native binaries (llama/whisper/sd/ffmpeg)