Merge remote-tracking branch 'upstream/main' into feat/user-choose-workspace

# Conflicts:
#	apps/desktop/src/main/index.ts
#	apps/desktop/src/renderer/src/store.test.ts

Author: MoveCloudROY

.changeset/always-reportable-round-2.md

@@ -0,0 +1,23 @@
+---
+'@open-codesign/desktop': minor
+'@open-codesign/shared': patch
+'@open-codesign/i18n': patch
+---
+
+fix: tighten Always Reportable architecture after 3-reviewer audit
+
+Follow-up to the Always Reportable refactor, consolidating 3 parallel reviews (architecture / privacy / UX).
+
+**Privacy hardening:**
+- IPC validators (`parseReportableError`, `parseRecordRendererErrorInput`) cap `message` at 8 KB, `stack` at 16 KB, `context` at 4 KB serialized. Previously a compromised renderer could DoS via 10 MB stack.
+- `reportEvent` handler recomputes the dedup fingerprint main-side instead of trusting the renderer-supplied value.
+- `recordRendererError` IPC echoes the main-computed `fingerprint` back so the in-memory record matches the persisted row.
+
+**Correctness:**
+- All four main-side `computeFingerprint` call sites now pass `message` alongside `errorCode`+`stack`, matching the renderer signature. Previously stack-less errors produced different fingerprints on the two sides, which broke the "you already reported this" dedup.
+- `applyGenerateError` reads `err.code` from the rejected IPC error so `ATTACHMENT_TOO_LARGE` / `PROVIDER_HTTP_4XX` / `CONFIG_MISSING` survive into the Report (previously flattened to a generic `GENERATION_FAILED`). `NormalizedProviderError` fields are forwarded into `ReportableError.context`, so the preview's upstream block fires for real provider failures.
+
+**UX:**
+- `reportableErrorToast` helper + migrated 13 existing `pushToast({variant:'error'})` sites (onboarding imports, provider test/save/delete/activate, model save, reasoning save, open-log-folder fail, onboarding-blocked inline comments). Each now ships with a meaningful `code` and `scope` for triage rather than the generic `RENDERER_ERROR`/`renderer` fallback.
+- Diagnostics panel falls back to rendering the in-memory `reportableErrors[]` when SQLite is unavailable, with a "showing in-memory — will not persist" banner. Previously a DB-down user had no way to find their dismissed toast errors.
+- Bundle-saved toast now always fires after the bundle is written, regardless of whether `openExternal` or `clipboard.writeText` succeeds afterward. On failure, a follow-up recovery toast includes a copy-URL / paste-manually hint.

.changeset/chatgpt-codex-oauth-phase2.md

@@ -0,0 +1,68 @@
+---
+"@open-codesign/providers": minor
+"@open-codesign/desktop": minor
+"@open-codesign/shared": minor
+"@open-codesign/core": minor
+"@open-codesign/i18n": patch
+---
+
+feat(codex): unify ChatGPT subscription path onto pi-ai's built-in openai-codex-responses wire
+
+Phase 2 of the Codex subscription login work. The self-rolled Codex client
+path from Phase 1 is replaced by pi-ai's first-class `openai-codex-responses`
+adapter (shipped in pi-ai 0.67.68) so every provider — Anthropic, OpenAI,
+Gemini, ChatGPT Codex — now runs through the same core/pi-agent-core route
+with no provider-specific branching.
+
+### Schema + routing
+- `packages/shared`: extend `WireApiSchema` and `CanonicalWire` with
+  `openai-codex-responses`; promote `CHATGPT_CODEX_PROVIDER_ID` to shared so
+  `provider-settings` references the same literal the OAuth module writes
+  without creating a module cycle.
+- `canonicalBaseUrl` passes codex URLs through untouched (pi-ai's wire
+  appends `/codex/responses` itself); `modelsEndpointUrl` throws for codex
+  (no discoverable /models endpoint — providers use `modelsHint`).
+- `packages/core`, `packages/providers`: `apiForWire` + `synthesizeWireModel`
+  recognize the new wire; all 4 duplicated `'openai-chat' | …` unions
+  consolidated onto the shared `WireApi` type.
+
+### Desktop wiring
+- New `apps/desktop/src/main/resolve-api-key.ts`: dependency-injected helper
+  that routes ChatGPT provider id to the token store's auto-refreshing
+  access token, and every other provider to the keychain-backed API key.
+  Codex auth failures surface as `CodesignError(PROVIDER_AUTH_MISSING)` so
+  the renderer's error-code routing stays consistent with the API-key-missing
+  path. Covered by 7 unit tests via DI.
+- `main/index.ts`: `resolveActiveApiKeyFromState` replaces the inline
+  `isChatgptCodex` validate / dispatch branches in all 4 IPC handlers
+  (`codesign:v1:generate`, legacy `codesign:generate`, apply-comment,
+  generate-title). Legacy `codesign:generate` no longer rejects codex.
+- Long-running agent runs: `GenerateInput.getApiKey` is a new optional async
+  getter; the desktop passes it only for codex so pi-agent-core calls back
+  into the token store on each LLM round-trip (auto-refreshes within the
+  5-min buffer). Mid-run sign-out errors are captured in a closure variable
+  and rethrown verbatim from the post-agent branch so the structured
+  `PROVIDER_AUTH_MISSING` code isn't lost to pi-agent-core's plain-string
+  failure-message flattening.
+
+### Registration + migration
+- `codex-oauth-ipc.ts`: provider entry registers `wire=openai-codex-responses`,
+  bare `baseUrl=https://chatgpt.com/backend-api`, and the full 9-model catalog
+  (gpt-5.1 → gpt-5.4-mini), ordered flagship-first.
+- `migrateStaleCodexEntryIfNeeded()` runs once at boot and rewrites any
+  Phase-1-shaped `chatgpt-codex` provider (`wire=openai-responses`,
+  `baseUrl=/codex`) to the Phase 2 canonical values, so feat-branch testers
+  don't need to sign out and back in after upgrade. No-op when the entry is
+  absent or already canonical.
+
+### UI
+- `ChatgptLoginCard.tsx`: flipped out of "coming soon" mode back to the full
+  three-state login/status/logout flow, with i18n keys in both locales.
+
+### Deletions (-963 LOC of Phase 1 code now provided by pi-ai)
+- `apps/desktop/src/main/codex-generate.ts` + test
+- `apps/desktop/src/main/codex-title.ts`
+- `packages/providers/src/codex/client.ts` + test
+
+OAuth-side code (`oauth.ts`, `oauth-server.ts`, `token-store.ts`) is unchanged
+— still the only codex-specific code, and it sits outside the generation link.

.changeset/codex-image-attachments.md

@@ -0,0 +1,10 @@
+---
+'@open-codesign/desktop': patch
+'@open-codesign/core': patch
+---
+
+fix: send attached screenshots to ChatGPT Codex as image inputs
+
+Image attachments in the desktop app were previously reduced to filename-only hints on the `chatgpt-codex` route, so models like `gpt-5.4` could ignore uploaded screenshots entirely.
+
+This change keeps the existing text-attachment behavior, but reads supported image files into data URLs and forwards them as Responses `input_image` parts for ChatGPT Codex generations.

.changeset/cpa-modal-autodiscover.md

@@ -0,0 +1,10 @@
+---
+'@open-codesign/desktop': patch
+'@open-codesign/i18n': patch
+---
+
+feat(settings): auto-discover models in custom provider modal
+
+When adding a custom provider (e.g. a CPA at http://127.0.0.1:8317), the modal now probes the endpoint automatically after the user types a valid http(s) baseUrl, debouncing 500ms. A spinner appears inline next to the "Default model" label while discovery runs, then either a green "Found N models" badge or a muted "Could not connect" hint.
+
+On success the "Default model" input becomes a `<select>` pre-populated with discovered model IDs, with smart auto-selection prioritising claude-sonnet-4-5 → claude-opus → claude-sonnet → gemini-2.5-pro → gpt-5 → first in list. A "Enter manually" escape hatch lets users type any ID instead, and a "Pick from list" link restores the dropdown. The probe re-fires when the API key or wire protocol changes. Empty or non-http(s) baseUrls are skipped so the existing manual flow is completely unaffected.

.changeset/cpa-preset.md

@@ -0,0 +1,13 @@
+---
+'@open-codesign/desktop': minor
+'@open-codesign/shared': patch
+'@open-codesign/i18n': patch
+---
+
+feat(settings): add CLIProxyAPI preset quick-pick
+
+Adds CLIProxyAPI (`router-for-me/CLIProxyAPI`) as a first-class preset in the Add Provider menu. CLIProxyAPI is a Go local proxy on port 8317 that wraps Claude/Codex/Gemini OAuth subscriptions into a unified Anthropic Messages API — heavily requested by the Chinese user base.
+
+- `packages/shared`: new `cli-proxy-api` entry in `PROXY_PRESETS` (anthropic wire, `http://127.0.0.1:8317`)
+- `packages/i18n`: `settings.providers.cliProxyApi.*` keys in both `en.json` and `zh-CN.json` (preset name, description, api-key-optional hint, thinking-budget hint, model discovery strings)
+- `apps/desktop`: `AddProviderMenu` gains a CLIProxyAPI item that opens `AddCustomProviderModal` pre-filled with the CPA endpoint and anthropic wire; claude-cli identity headers are injected automatically by the existing `shouldForceClaudeCodeIdentity` path (no extra code needed)

.changeset/fix-binary-attachment-size.md

@@ -0,0 +1,5 @@
+---
+"@open-codesign/desktop": patch
+---
+
+Fix: allow larger binary attachments (images/png) up to 10MB. Binary attachments only contribute filename to context so size limit can be larger.

.changeset/fix-ollama-provider-row.md

@@ -0,0 +1,6 @@
+---
+"@open-codesign/desktop": patch
+"@open-codesign/i18n": patch
+---
+
+Fix Settings so Ollama is hidden until users add the local provider manually.

.changeset/logging-adversarial-round-3.md

@@ -0,0 +1,42 @@
+---
+'@open-codesign/desktop': patch
+'@open-codesign/shared': patch
+'@open-codesign/i18n': patch
+'@open-codesign/providers': patch
+---
+
+fix: 3-reviewer adversarial round — privacy, UX, correctness
+
+Third consolidated round of fixes from three parallel adversarial reviewers.
+
+**Privacy (from R1):**
+- Issue URL `logs=` and `actual=` fields now go through the same redact pipeline as `summary.md`. Previously the URL (which ends up in browser history + referrer + shell history) silently ignored the user's redact toggles.
+- `bundlePath` in the issue URL now renders as `~/Downloads/...` rather than `/Users/<realUsername>/...`, so OS username isn't leaked through the link.
+- `config-redacted.toml` now applies path + URL redaction per toggle, so raw IPs in `baseUrl` and filesystem paths in `[designSystem]` get masked when the user unchecks Paths/URLs. The filename is no longer a lie.
+- `API_KEY_RE` broadened to catch Google Gemini `AIzaSy…`, AWS `AKIA…`, and 43-char Azure base64 keys.
+- `setWindowOpenHandler` is now gated through `isAllowedExternalUrl`, matching the existing allowlist for the IPC channel.
+- `showItemInFolder` rejects paths outside config/logs/Downloads to prevent a compromised renderer from revealing arbitrary files in Finder.
+
+**UX (from R2):**
+- Redaction placeholders changed from `<prompt omitted>` / `<path omitted>` / `<url omitted>` to `[prompt omitted]` / `[path omitted]` / `[url omitted]`. GitHub's markdown renderer was stripping the angle-bracket form as HTML tags, leaving users and triagers looking at empty redacted fields.
+- `summary.md` Message field now uses a backtick-safe inline code span (`mdInlineCode`), so error messages containing backticks don't eat the lines that follow.
+- Report dialog panel has `max-h-[90vh] overflow-y-auto` so buttons stay on-screen at 1280×720 viewports.
+- Dedup warning now shows the prior issue number (`#123`) when extractable from the stored URL.
+- Confirm step ("Yes, open anyway") has a 60-second countdown visible on the button.
+- Notes-too-long error is now localized.
+- Toast Report button shows a Loader2 spinner while the auto-record IPC is resolving.
+- Report bundle-saved toast only appears AFTER `openExternal` / `clipboard.writeText` succeeds, so a silent failure doesn't flash a green success toast alongside an error banner.
+- User notes are now injected into the bug_report.yml `actual` field, not just the zipped bundle.
+- Windows `platform_version` maps NT build (`10.0.22631`) to marketing name (`Windows 11 (10.0.22631)`).
+
+**Correctness (from R3):**
+- Fingerprint basis includes a hash of `message` when the stack is empty. Previously all renderer errors without stacks collapsed to the same fingerprint and triggered false "already reported" warnings.
+- `ReportEventDialog` is now mounted once at the App root via a single store slice (`activeReportEventId`). Previously each error toast mounted its own dialog, so opening Report on two toasts stacked two overlays.
+
+**i18n:**
+- Filled in three missing English keys (`loading.tokens`, `settings.providers.missingKey`, `settings.providers.addKey`).
+- `{relative}` single-brace interpolation finally fixed (it was rendering literally because i18next expects `{{relative}}`).
+
+**Test coverage:**
+- Added regression tests for each privacy leak, the fingerprint collision, the store's auto-record chain, and the dedup countdown.
+- 779 desktop + 153 shared tests pass.

apps/desktop/electron-builder.yml

@@ -28,11 +28,12 @@ mac:
       arch: [arm64, x64]
 dmg:
   # Custom window layout guides users to drag the app into /Applications.
-  # Running from the DMG mount leaves safeStorage unavailable (the volume
-  # is read-only so macOS can't establish a keychain trust entry), which
-  # breaks API key save / import. The background, arrow, and in-app boot
-  # check (install-check.ts) work together to steer users to the right
-  # flow.
+  # Running Open CoDesign from a mounted DMG instead of /Applications
+  # breaks (1) the auto-update code path (read-only volume can't receive
+  # electron-updater's staged binary), and (2) XDG-style user-data-dir
+  # resolution (Electron falls back to a path inside the mounted image
+  # which disappears when the volume ejects). The background, arrow, and
+  # in-app boot check (install-check.ts) steer users to the right flow.
   background: build/dmg-background.png
   iconSize: 92
   window: