Release 107 feedback: clean desktop chat previews

.github/workflows/ci.yml

@@ -107,6 +107,7 @@ jobs:
           npm --prefix ../shared ci
           npm --prefix ../shared/packages/sync run build
           npm --prefix ../shared/packages/models run build
+          npm --prefix ../shared/packages/speech run build
       - run: npm ci
       # Hard gates: types + the full test suite.
       - name: Typecheck (core)
@@ -116,6 +117,12 @@ jobs:
         if: ${{ hashFiles('pro/tsconfig.json') != '' }}
         timeout-minutes: 6
         run: cd pro && npx tsc --noEmit -p tsconfig.json
+      # npm's Electron install hooks leave sqlite compiled for Electron's ABI. The
+      # Vitest process is plain Node, and some default integration tests open the
+      # real database, so put the native module on Node's ABI before that gate.
+      # The later DB journey script restores the Electron ABI in its EXIT trap.
+      - name: Rebuild SQLite for the Node test runner
+        run: npm rebuild better-sqlite3-multiple-ciphers
       # Runs the full vitest suite AND enforces the coverage ratchet floor
       # (vitest.config.ts `thresholds`) — the same gate as the pre-push hook, so a
       # coverage regression fails CI, not just local pushes. The pro/** threshold

CLAUDE.md

@@ -21,6 +21,7 @@ The window is WIDE. A list of cards/rows stretched edge-to-edge in a single colu
 - **Tight, consistent spacing on a 4/8/12px scale.** Dense data UIs use narrow gutters (8-12px) and small padding, NOT the 16-24px editorial spacing. Body text ~12-14px, compact line-height. Flat and sharp, per the brand.
 - **Group, then separate.** Reduce gaps _within_ a group (rows in a section) but keep clear separation _between_ functional groups (filters vs data, "On this device" vs "Available"). Section headers over a wall of identical rows.
 - **Progressive disclosure.** Secondary info and rarely-used controls go behind a detail panel / "…" / hover affordance — don't lay everything flat. Master list stays scannable; depth lives in the side panel or slide-over.
+- **Side panels, not desktop modals.** Open settings, editors, previews, and other multi-step detail flows in the shared `SidePanel`. It must close with Escape, an outside click, and its close control. Reserve a centered dialog only for a short confirmation that blocks one immediate action, such as confirming a destructive delete.
 - **Sticky context.** Fix headers, tabs, filter bars, and column labels while the body scrolls, so context never scrolls away.
 - **Finesse the interactions.** Every click gets a small micro-interaction — `transition-all duration-150`, `active:scale-95` on buttons, slide+fade (not abrupt mount) for panels/slide-overs. State changes animate; nothing pops in or out hard.
 - **Offer density where it matters**, but the default IS dense — this is a terminal/brutalist desktop app, not a spacious mobile-first card feed.

docs/GAPS_BACKLOG.md

@@ -1286,3 +1286,29 @@ Follow up with an isolated physical-device benchmark on a strong 5 GHz or 6 GHz
 desktop-to-phone transfer at a time, separate checksum preparation from wire time, and compare both
 directions. Also persist verified file checksums so a repeat send does not hash the same multi-GB
 model again after an app restart. Keep the 4 MiB authenticated frame format and bounded memory.
+
+---
+
+## Desktop voice modes need the final physical audio pass
+
+**Status:** automation-backed; manual device verification is open. Filed 2026-08-24.
+
+The rendered Chat journey now proves Manual start/stop and cancellation, Auto end-on-silence,
+Hands-free speech detection, the generation and playback lock, the two-second speaker-drain wait,
+automatic rearming, pause, and the transition back to text mode. The global dictation reducer also
+proves Hold, Toggle, and Both, including auto-repeat protection. The focused suites pass 41 tests.
+
+The remaining boundary is the installed macOS app with real hardware and models. On the release Mac:
+
+1. Select a Whisper model and a Parakeet model in turn. Confirm Chat reports and uses the selected
+   transcription model without changing the chat model.
+2. Speak one turn in Manual, Auto, and Hands-free. Confirm Auto does not cut off a normal pause and
+   Hands-free does not record its own Kokoro reply.
+3. Interrupt and pause Hands-free, switch to text during an active recording, deny and restore
+   microphone permission, and cancel during transcription. Confirm the mic indicator and audio output
+   stop and no discarded transcript appears.
+4. In TextEdit and one other app, verify the Pro Voice Hold, Toggle, and Both gestures and confirm one
+   transcript is pasted for each completed turn.
+
+Close this gap only with the exact packaged build, an audible reply, the real macOS microphone
+indicator, and a saved diagnostic excerpt that identifies the active speech-to-text model.

docs/features/voice.md

@@ -2,6 +2,33 @@
 
 [← All features](../FEATURES.md)
 
-- **Speech → text** with `whisper.cpp` (tiny → large-v3-turbo).
-- **Text → speech** with Kokoro (multiple voices) — tap **Speak** on any message.
-- **Voice mode** turns chat into a hands-free, voice-note conversation.
+Speak instead of typing, and hear a reply without sending your words to a cloud service.
+
+## In Chat
+
+Select the voice-mode button at the top of Chat. Then select how each turn works:
+
+- **Manual:** Select the microphone to start. Select it again to stop and send.
+- **Auto:** Select the microphone to start. Off Grid stops and sends after you stop speaking.
+- **Hands-free:** Off Grid listens for your voice, sends after you stop speaking, plays the reply,
+  and then listens again. Select the microphone to pause or resume.
+
+During transcription, the microphone shows the installed speech-to-text model that is in use. Select
+the cancel control to discard that turn. When you return to text mode, Off Grid stops the active
+recording and keeps the text composer ready.
+
+## Dictation in other apps (Pro)
+
+Open **Voice** and set the Option+Space gesture:
+
+- **Hold:** Hold Option+Space while you speak. Release it to stop.
+- **Toggle:** Press Option+Space once to start. Press it again to stop.
+- **Both:** A quick press toggles recording. A hold works as push-to-talk.
+
+Off Grid transcribes with the active Whisper or Parakeet model. Auto-send can paste the result at the
+current cursor. Saved recordings stay searchable in Voice.
+
+## Hear a reply
+
+Select **Speak** on a text reply, or play a voice-mode reply. Off Grid uses the selected Kokoro
+language and voice. Only one reply plays at a time.

integration-tests/memory-chat-tts.ui.integration.dbtest.ts

@@ -329,10 +329,10 @@
     await user.click(await screen.findByTitle('Voice mode off'))
     await waitFor(() => expect(database.getSetting('composerVoiceMode', false)).toBe(true))
 
-    await user.click(screen.getByText('Tap to record a voice note'))
+    await user.click(screen.getByText('Click to record a voice note'))
     expect(RecorderBoundary.instances).toHaveLength(1)
     expect(RecorderBoundary.instances[0]!.state).toBe('recording')
-    await user.click(screen.getByText('Recording — tap to send'))
+    await user.click(screen.getByText('Recording - click to send'))
 
     await waitFor(() => expect(screen.getAllByText('Show transcript')).toHaveLength(2), {
       timeout: 10_000
@@ -376,7 +376,7 @@
     await user.click(screen.getByTitle('Voice mode on — speak and listen in voice notes'))
     await waitFor(() => expect(database.getSetting('composerVoiceMode', true)).toBe(false))
     const composer = await screen.findByPlaceholderText(/^ask /i)
     fireEvent.change(composer, { target: { value: 'Typed chat remains usable after voice recovery' } })
     expect((screen.getByPlaceholderText(/^ask /i) as HTMLTextAreaElement).value).toBe(
       'Typed chat remains usable after voice recovery'
     )

package.json

@@ -59,6 +59,7 @@
     "@offgrid/clipboard": "file:./packages/clipboard",
     "@offgrid/design": "file:./packages/design",
     "@offgrid/models": "file:../shared/packages/models",
+    "@offgrid/speech": "file:../shared/packages/speech",
     "@offgrid/rag": "file:./packages/rag",
     "@offgrid/sync": "file:../shared/packages/sync",
     "@phosphor-icons/react": "^2.1.10",

scripts/hooks/pre-push

@@ -35,6 +35,26 @@ fi
 # So: run each suite, keep its report, gate once on the union. The floors are a RATCHET recording what this
 # branch achieves. Raise them as coverage rises; do not lower them to pass.
 echo "[pre-push] coverage 1/3 — unit + integration"
+# The app keeps SQLite built for Electron. The fast suite also contains real product
+# integrations that open SQLite under Node, so give them Node's ABI before Vitest starts.
+# The DB journey immediately below restores Electron's ABI in its EXIT trap.
+sqlite_needs_electron_restore=0
+restore_electron_sqlite() {
+  if [ "$sqlite_needs_electron_restore" != "1" ]; then
+    return
+  fi
+  sqlite_needs_electron_restore=0
+  echo "[pre-push] restoring SQLite for Electron"
+  npx electron-rebuild -f -w better-sqlite3-multiple-ciphers >/dev/null 2>&1 || \
+    npx electron-builder install-app-deps >/dev/null 2>&1 || true
+  ./scripts/probe-electron-sqlite.sh '[pre-push]'
+}
+trap restore_electron_sqlite EXIT
+if ! npm rebuild better-sqlite3-multiple-ciphers >/dev/null 2>&1; then
+  echo "[pre-push] BLOCKED: could not rebuild SQLite for the Node test runner."
+  exit 1
+fi
+sqlite_needs_electron_restore=1
 if ! npm run --silent test:coverage; then
   echo ""
   echo "[pre-push] NOTE: the fast suite reported failures or missed its own thresholds. The aggregate gate"
@@ -46,6 +66,9 @@ echo "[pre-push] coverage 2/3 — DB journeys (real SQLite)"
 if ! OFFGRID_DB_VITEST_CONFIG=vitest.db.coverage.config.ts npm run --silent test:db -- --coverage; then
   echo "[pre-push] NOTE: the DB journeys reported failures; their contribution may be missing below."
 fi
+# test-db.sh restores Electron's ABI in its own EXIT trap. The parent trap above
+# remains the interruption guard for every earlier exit path.
+sqlite_needs_electron_restore=0
 
 # Full Playwright e2e on the built app — the one gate the unit/integration suite can't give:
 # does the built app actually render + drive its surfaces. Specs needing real models/engine binaries

scripts/probe-electron-sqlite.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+
+# Verify the native SQLite module with Electron's ABI after Node-based database tests. The optional
+# executable argument is the external-process boundary used by the regression test.
+prefix="${1:-[sqlite]}"
+electron_binary="${2:-./node_modules/electron/dist/Electron.app/Contents/MacOS/Electron}"
+
+if ELECTRON_RUN_AS_NODE=1 "$electron_binary" \
+  -e 'new (require("better-sqlite3-multiple-ciphers"))(":memory:")' >/dev/null 2>&1; then
+  echo "$prefix Electron ABI restored (app can load sqlite)."
+else
+  echo "$prefix WARNING: Electron cannot load sqlite - run 'npx electron-rebuild -f -w better-sqlite3-multiple-ciphers' before launching the app."
+fi

scripts/test-db.sh

@@ -18,10 +18,7 @@ restore() {
   # no-op from cache). Verify the app can actually load it; warn loudly if not.
   npx electron-rebuild -f -w better-sqlite3-multiple-ciphers >/dev/null 2>&1 \
     || npx electron-builder install-app-deps >/dev/null 2>&1 || true
-  ELECTRON_RUN_AS_NODE=1 ./node_modules/electron/dist/Electron.app/Contents/MacOS/Electron \
-    -e 'new (require("better-sqlite3-multiple-ciphers"))(":memory:")' >/dev/null 2>&1 \
-    && echo "[test:db] Electron ABI restored (app can load sqlite)." \
-    || echo "[test:db] WARNING: Electron cannot load sqlite - run 'npx electron-rebuild -f -w better-sqlite3-multiple-ciphers' before launching the app."
+  ./scripts/probe-electron-sqlite.sh '[test:db]'
 }
 trap restore EXIT
 

src/main/__tests__/electron-sqlite-probe.integration.test.ts

@@ -0,0 +1,28 @@
+import { spawnSync } from 'node:child_process'
+import path from 'node:path'
+import { describe, expect, it } from 'vitest'
+
+const PROBE = path.resolve(process.cwd(), 'scripts/probe-electron-sqlite.sh')
+
+function runProbe(executable: '/usr/bin/true' | '/usr/bin/false'): string {
+  const result = spawnSync('/bin/sh', [PROBE, '[pre-push]', executable], {
+    encoding: 'utf8'
+  })
+  expect(result.status).toBe(0)
+  expect(result.stderr).toBe('')
+  return result.stdout.trim()
+}
+
+describe('Electron SQLite restoration probe', () => {
+  it('reports that Electron can load the restored native module', () => {
+    expect(runProbe('/usr/bin/true')).toBe(
+      '[pre-push] Electron ABI restored (app can load sqlite).'
+    )
+  })
+
+  it('reports the exact rebuild action when Electron cannot load SQLite', () => {
+    expect(runProbe('/usr/bin/false')).toBe(
+      "[pre-push] WARNING: Electron cannot load sqlite - run 'npx electron-rebuild -f -w better-sqlite3-multiple-ciphers' before launching the app."
+    )
+  })
+})

src/main/__tests__/mcp-oauth-cancellation.test.ts

@@ -0,0 +1,47 @@
+import { describe, expect, it, vi } from 'vitest'
+import { beginOAuthAuthorization, cancelOAuthAuthorization } from '../mcp-oauth-cancellation'
+
+describe('connector OAuth cancellation registry', () => {
+  it('cancels only the named connector and clears the registration', () => {
+    const first = vi.fn()
+    const second = vi.fn()
+    beginOAuthAuthorization(101, first)
+    beginOAuthAuthorization(202, second)
+
+    expect(cancelOAuthAuthorization(101)).toBe(true)
+    expect(first).toHaveBeenCalledWith(
+      expect.objectContaining({ message: 'Authorization cancelled' })
+    )
+    expect(second).not.toHaveBeenCalled()
+    expect(cancelOAuthAuthorization(101)).toBe(false)
+
+    cancelOAuthAuthorization(202)
+  })
+
+  it('cancels an older attempt when a connector starts a new one', () => {
+    const older = vi.fn()
+    const newer = vi.fn()
+    beginOAuthAuthorization(303, older)
+    const finishNewer = beginOAuthAuthorization(303, newer)
+
+    expect(older).toHaveBeenCalledWith(
+      expect.objectContaining({ message: 'Authorization superseded by a newer request' })
+    )
+    finishNewer()
+    expect(cancelOAuthAuthorization(303)).toBe(false)
+    expect(newer).not.toHaveBeenCalled()
+  })
+
+  it('does not let an older completion clear a newer attempt', () => {
+    const older = vi.fn()
+    const newer = vi.fn()
+    const finishOlder = beginOAuthAuthorization(404, older)
+    beginOAuthAuthorization(404, newer)
+
+    finishOlder()
+    expect(cancelOAuthAuthorization(404)).toBe(true)
+    expect(newer).toHaveBeenCalledWith(
+      expect.objectContaining({ message: 'Authorization cancelled' })
+    )
+  })
+})

src/main/__tests__/mcp-oauth-pkce.test.ts

@@ -0,0 +1,40 @@
+import { describe, expect, it } from 'vitest'
+import { OAuthPkceVerifier } from '../mcp-oauth-pkce'
+
+describe('OAuth PKCE verifier lifecycle', () => {
+  it('keeps the verifier when the SDK invalidates all credentials before an exchange retry', () => {
+    const verifier = new OAuthPkceVerifier()
+    verifier.save('attempt-verifier')
+
+    verifier.invalidate('all')
+
+    expect(verifier.read()).toBe('attempt-verifier')
+  })
+
+  it('clears the verifier after tokens are saved', () => {
+    const verifier = new OAuthPkceVerifier()
+    verifier.save('attempt-verifier')
+
+    verifier.complete()
+
+    expect(() => verifier.read()).toThrow('missing PKCE code verifier')
+  })
+
+  it('clears the verifier when authorization is cancelled', () => {
+    const verifier = new OAuthPkceVerifier()
+    verifier.save('attempt-verifier')
+
+    verifier.cancel()
+
+    expect(() => verifier.read()).toThrow('missing PKCE code verifier')
+  })
+
+  it('honors explicit verifier invalidation during an active attempt', () => {
+    const verifier = new OAuthPkceVerifier()
+    verifier.save('attempt-verifier')
+
+    verifier.invalidate('verifier')
+
+    expect(() => verifier.read()).toThrow('missing PKCE code verifier')
+  })
+})