ci: Bump actions/setup-node from 4 to 6 - #4

- Fix historical messages animating on conversation load by tracking
  message IDs instead of array length (Codex #1)
- Add prefers-reduced-motion support for ResizeObserver smooth scroll (Codex #2)
- Move render-phase mutations to useEffect for React concurrent mode (Codex #3, Opus #1/#2)
- Consolidate two ResizeObservers into single instance (Opus #4)
- Use individual timeouts per message for animation cleanup (Opus #3)
- Simplify redundant animate === true check in MessageItem (Opus #6)

Opus Review Fixes:
- Issue #7: Use MainThreadMarker for reliable main thread detection
- Issue #8: Add thread safety documentation and debug assertions
- Issue #9: Change animation easing from ease-in-out to ease-out
- Issue #11: Simplify forward_to_super_bool (always returns true)
- Issues #1,#2,#3: Document intentional memory leaks with rationale

Codex Review Fixes:
- Issue #1: Persist traffic light offsets in global RwLock
- Issue #2: Check respondsToSelector before forwarding to delegate
- Issue #3: Remove unused timeout_ms from browser_eval_async
- Issue #4: Validate browser window exists in browser_has

Security:
- JSON-encode script in browser_eval to prevent injection attacks

Clippy Compliance:
- Use parking_lot::RwLock (project requirement)
- Add backticks to doc comments (AppKit, NSWindowDelegate, etc.)
- Make forward_to_super_bool const fn

…oads

The stale-load guard added in 679dbf4 (Code review: Opus cycle 3, issue #4)
checked sessionIdRef.current !== targetSessionId inside setTimeout(0), but
sessionIdRef is only updated by setSessionId() inside startTransition — the
very code the guard prevented from executing. This created a chicken-and-egg
deadlock where every conversation:loaded was silently aborted.

Replace with a monotonic conversationLoadEpoch counter that is bumped
synchronously when each conversation:loaded event arrives, before the
setTimeout(0) defer. Newer loads bump the counter, and stale deferred
callbacks detect the mismatch and bail.

…nch-aware turn_duration

- Gate non-adaptive thinking behind _thinkingMode so 'off' actually disables it
- Prevent setEffortLevel() from unconditionally forcing _thinkingMode=true
- Guard effort:set IPC in use-chat-messages.ts with isAdaptiveThinkingModel
- Prevent SessionManager.setEffortLevel() from contaminating modePreferences
- Append file @tokens instead of prepending so slash commands stay at position 0
- Add last_assistant_active tracking to skip dead-branch turn_duration events
- Document that setEffortLevel/setThinkingMode are deferred to next session

Fixes: verified-cycle-1-codex review findings #1, #2, #3, #4

* fix: auto-restart session on OAuth 401 token expiry

After a 401 + successful token refresh, the SDK query still holds the
stale token. This adds Layer 4 to the auth defense: a session restart
flag that triggers stopSession + startSession(resume) on the next
sendMessage, giving the new query fresh credentials from Keychain.

All change sites tagged [oauth-401-recovery] for easy revert.

* feat: skills system, slash command UX, and inline token rendering

- Add Skills dialog with click-to-add-chip, skills listing by source
- Slash commands work mid-text (not just at input start) with surgical token replacement
- Ghost autocomplete text overlay for slash commands as you type
- Tab key completes selected slash command
- Auto-dismiss slash popover when no commands match (instead of "No commands found")
- Render /skill-name and @filename as inline code tags in user message bubbles
- Fix Rust strip_sdk_command_xml to handle <command-args> tag (content persists across chat switch)
- Remove skill tiles and file attachment tiles from message rendering
- Add Sub Agents to Powers sidebar list
- Remove "Coming soon" badge from Powers button

* chore: add mosaic skill and skills dialog plan doc

* deps: bump SDK, Sentry, jsdom, lucide-react, and minor deps

Consolidates dependabot PRs #54, #55, #61:
- @anthropic-ai/claude-agent-sdk: 0.1.76 → 0.2.44
- @anthropic-ai/sdk: 0.71.2 → 0.74.0
- @sentry/bun: 9.24.0 → 10.38.0
- jsdom: 26.1.0 → 28.0.0
- lucide-react: 0.562.0 → 0.566.0
- react-scan: 0.4.3 → 0.5.0
- use-stick-to-bottom: 1.1.2 → 1.1.3

SDK 0.2.x migration:
- Replace maxThinkingTokens with thinking option (adaptive/enabled/disabled)
- Handle new tool_use_summary content block type in switch statements

* feat: use SDK sessionId option to eliminate UUID remapping for new sessions

Pass Orbit's frontend session UUID as `options.sessionId` to the Claude
Agent SDK (v0.2.44+), so the SDK uses our ID instead of auto-generating
one. This eliminates the 6-store remap cascade on system:init for new
sessions. Legacy remap code preserved for forks and backward compat.

* fix: prevent thinking block duplication during streaming

The agent-bridge was emitting thinking content twice — once via
streaming deltas and again from the final assistant message. Add
thinkingWasStreamed guard mirroring the existing textWasStreamed
pattern to skip re-emission when deltas were already streamed.

* fix: enable real-time SDK streaming and default thinking to ultra

Remove options.thinking assignments that caused the SDK to pass
--max-thinking-tokens to the CLI, which suppressed all StreamEvent
messages. Opus 4.6 delegates adaptive thinking to the CLI natively;
all other models default to ultra (32k) extended thinking.

- Omit options.thinking for Opus 4.6 (CLI handles adaptive natively)
- Omit options.thinking for non-thinking models (was type: disabled)
- Default thinkingMode to 'ultra' in ToolStore (was 'off')
- Send maxThinkingTokens at session creation for all models
- Extract THINKING_MODE_BUDGET shared constant

* fix: turn duration display, interrupt detection from JSONL, and UTF-16 content offsets

- Parse SDK `system` JSONL lines (subtype: turn_duration) to surface
  wall-clock turn timing per assistant message with ClockFading icon
- Detect `[Request interrupted by user...]` SDK markers in JSONL to
  restore isInterrupted flag on session reload (stop_reason is null
  in streaming input mode)
- Fix content_offset to use UTF-16 code units instead of UTF-8 bytes,
  matching JavaScript string.slice() indexing for correct tool widget
  placement with multibyte characters (em dashes, emojis, etc.)
- Guard agent bridge query ref to prevent post-interrupt restart from
  nulling out the new currentQuery
- Remove Math.min clamp on content_offset that corrupted offsets when
  frontend hadn't received all flushed text
- Update welcome page overlay to transparent in light mode

* fix: remove welcome page overlay in light theme

Keep dark mode gradient overlay for text legibility, use hidden dark:block
instead of transparent light-mode stops.

* fix: update tool-store tests to expect ultra as default thinking mode

* feat: collapsed-by-default tools with inline preview, compact UX, and interrupt redesign

Tools & Thinking:
- All 11 tool widgets + ThinkingBox start collapsed by default (removed auto-expand/collapse)
- Added ToolInlinePreview component showing one-line live summary in collapsed headers
- Preview visible only while tool is running, hidden after completion
- Restructured every tool header: [left info] [flex-1 preview] [chevron]

Compact (/compact):
- CompactIndicator replaces user bubble for /compact messages (centered dashed divider)
- Two states: ThinkingDots "Context compacting" → Minimize2 "Context compacted"
- Full event pipeline: SDK compact_boundary → bridge → Rust → Tauri → frontend
- Conversation reload from disk after compaction (1.5s delay for SDK JSONL finalization)
- Filtered SDK artifacts: <local-command-stdout> and "No response requested." messages
- Message-level compacting state tracking (compactingMessageId in ChatStore)

Interrupt indicator:
- Redesigned as centered dashed-line divider (was solid colored box)
- Removed Retry button, full-width layout

* feat: update model lineup to Haiku 4.5, Sonnet 4.6, Opus 4.6 with adaptive thinking

Remove Sonnet 4.5 and Opus 4.5 models. Add Sonnet 4.6 (claude-sonnet-4-6) with
adaptive thinking support alongside Opus 4.6. Only Haiku 4.5 retains extended
thinking (off/think/hard/ultra). Fix streaming regression by including Sonnet 4.6
in the adaptive model check in agent.ts, and align reset() effort default to max.

* feat: insight block widget and branch selector overflow fix

Add rehype-insight-blocks plugin that transforms Claude Code's
explanatory output style `★ Insight ───` / `───` borders into
styled <aside> callout cards with warm accent border and header.

Fix branch selector dropdown growing unbounded by adding max-w-80
and enabling truncation on upstream remote tracking text.

* feat: auto-update system with rich toast, sidebar button, CI pipeline, and Orbit-Release mirror

- Tauri updater plugin + process plugin for check/download/install/restart
- Rich card-style update toast (image hero, progress bar, action buttons)
- Sidebar "Update available" button (appears after toast dismissal)
- Update store (Zustand) with full state machine: idle → checking → available → downloading → ready
- useAutoUpdate hook: 5s delay on mount, re-check every 4h
- CI workflow: macOS ARM64 only, Xcode 26.2, Apple signing + notarization, Ed25519 update signing
- Mirror job copies artifacts to public Recusive/Orbit-Release repo with rewritten latest.json URLs
- Version unified to 0.0.1 across all manifests
- bump-version.sh script for synchronized version bumps
- Stress test simulation via window.__orbit_debug.simulateUpdate()
- AUTO-UPDATE.md architecture doc covering full pipeline

* docs: add current status and next steps to AUTO-UPDATE.md

* fix: add ISC license to cargo-deny allow list

The tauri-plugin-updater pulls in ring, rustls-webpki, and untrusted
which use the ISC license. ISC is OSI-approved and permissive.

* fix: review fixes, prune stale slash commands, surface SDK command errors

- Apply verified review findings: render-pure slash command popover indexing,
  SDK version comment on thinking omission, Math.max(0) guard on content_offset,
  clarifying comment on intentional bracket omission in Rust parser
- Remove stale Claude Code TUI commands (/clear, /help, review-*, /document,
  /fix-tests) and frontend-only commands (/new, /model, /settings)
- Surface <local-command-stderr> from SDK command expansion failures inline
  in chat instead of silently swallowing them
- Generate fallback turnMessageId for command-only turns with no streaming

* fix: ESC during permission dialog no longer causes API error 400

- handleStop now sends proper deny responses for pending permissions
  before agent:stop, preventing dangling permission callbacks
- PermissionManager returns interrupt: true when abort signal detected,
  stopping the SDK cleanly instead of racing with SIGINT
- ESC is now a global window listener, works from anywhere on screen
- Enter approves permissions globally (capture phase, no Cmd required)
- Removed duplicate keyboard handler from permission-modal.tsx
- Updated shortcut hints: Accept ⏎, Reject ESC

* fix: restore thinking 'off' mode, fix file/skill prefix ordering, branch-aware turn_duration

- Gate non-adaptive thinking behind _thinkingMode so 'off' actually disables it
- Prevent setEffortLevel() from unconditionally forcing _thinkingMode=true
- Guard effort:set IPC in use-chat-messages.ts with isAdaptiveThinkingModel
- Prevent SessionManager.setEffortLevel() from contaminating modePreferences
- Append file @tokens instead of prepending so slash commands stay at position 0
- Add last_assistant_active tracking to skip dead-branch turn_duration events
- Document that setEffortLevel/setThinkingMode are deferred to next session

Fixes: verified-cycle-1-codex review findings #1, #2, #3, #4

* fix: remove disabled ToolInlinePreview component and dead preview code

* fix: handle insight block closer embedded in non-paragraph elements

The rehype plugin only searched sibling <p> elements for the closer,
but when the model uses bullet lists the closer ends up inside a <li>.
Now recursively searches all sibling descendants for the closer pattern.

* feat: Dia-style frameless inset layout with floating content card

Restructure window chrome to dark base layer + floating rounded content card:
- AppShell: flex root with base layer bg, hosts sidebar globally (all modes)
- ContentCard: rounded floating card with margin animation on sidebar toggle
- ContentTopBar: replaces HeaderBar, moves git controls + breadcrumb into card header, gradient fade replaces border-b
- PrimarySidebar: renders on base layer (no bg-card/border), collapses to 0px
- Traffic lights: Rust command to reposition native macOS traffic lights, hidden when sidebar closes
- useFullscreen: detects macOS fullscreen for margin/radius removal
- SidebarResizeHandle: snaps to 0 instead of 35px collapsed width
- Remove ChatHeader component, consolidate git branch selector + diff stats into ContentTopBar
- Activity panel: remove top indicator from file tabs, sharp diff stat colors

* feat: extract ActivityPanel to base layer, rAF-based resize for smooth drag

- Extract ActivityPanel from ChatArea into its own ActivityCard on the
  base layer (App.tsx), matching the Dia-style card architecture
- Activity panel slides in/out as rigid body via margin+transform
  (sidebar pattern), replacing Allotment's width-based animation
- Add borderless + onDrag props to ResizeHandle: during drag, updates
  DOM directly via requestAnimationFrame (no React re-renders per frame),
  commits to Zustand store only on mouseup
- Move ActionsBar from RootLayout to AppShell base layer
- Add actionsBarOpen prop to ContentCard for margin coordination
- Remove status bar border, remove actions bar border/background
- Hover indicator uses CSS group-hover instead of JS state (no stuck hover)

* fix: polish UI — consistent 12px rounding, light theme contrast, layout refinements

- Light theme sidebar uses gray-4 for better contrast against chat area
- Unified border-radius to explicit pixel values across popovers, dialogs, and menus
  (14px for settings/skills dialogs, 12px for command/context/mention popovers, 10px for base dialogs)
- Chat input: rounded-[14px], border-gray-5, reduced bottom padding
- Moved git action buttons under commit form, removed redundant borders
- Removed tooltips from panel toggle and sidebar collapse buttons
- Workspace name uses gray-11 text instead of opacity
- Actions bar disclaimer icon bottom padding matches top button spacing
- Extract activity panel and terminal to base layer with rAF-based resize

* feat: native macOS SF Symbol icons with cross-platform fallbacks

Replace custom SVG and lucide icons with native SF Symbols rendered via
AppKit (Rust FFI → base64 PNG → CSS mask-image with currentColor).
Each SFSymbol usage includes a fallback prop with the original icon for
web demo and non-macOS platforms.

New crate: crates/common/sf-symbols (AppKit rendering pipeline)
New component: SFSymbol with module-level cache and 3-state loading

* fix: suppress liquid glass defocus dimming, fix header transparency in glass mode

Hide NSGlassEffectView on window defocus (Codex-style approach) with
theme-matching opaque backgrounds. Frontend notifies native layer of
effective theme via set_glass_theme command so the defocus color respects
Orbit's theme regardless of system appearance.

Fix content header appearing washed out in liquid glass mode by scoping
the transparency rule to .bg-base-layer (AppShell root) instead of all
[data-tauri-drag-region] elements.

Also: sidebar light-theme contrast bump (gray-2 → gray-5), actions bar
tooltip cleanup, welcome page rounding consistency.

* fix: UI polish — mode switcher in actions bar, lighter sidebar hovers, header reorder

- Add Agent/Editor/Canvas mode switcher to actions bar with SF Symbol icons
- Sidebar hover: bg-gray-5 → bg-gray-3 (light) for subtler hover states
- Active conversation: bg-gray-5 → bg-gray-3 (light) to match
- Search bar: bg-gray-6 resting with bg-gray-7 hover (light)
- Sidebar tab switcher: heading + Switch toggle replaces two-tab buttons
- Header (sidebar closed): sidebar toggle before arrows, vertical separators
- Chat name: text-gray-12 instead of opacity-70
- Dropdown menu: rounded-xl, branch selector + diff stats: rounded-full

* fix: sidebar polish — scroll fade mask, inline settings/feedback row

* feat: Projects dialog + fix native folder picker crash in liquid glass mode

Add Projects icon-grid dialog (sidebar → Projects button) showing recent
projects with tile view, loading skeleton, and empty state.

Fix NSOpenPanel crash on macOS 26+ when liquid glass is active:
- Route all directory picks through a raw NSOpenPanel (runModal) in the
  decorum plugin, bypassing tauri-plugin-dialog's sheet presentation
- Suspend glass defocus observers during dialog lifecycle to prevent
  toggle_glass from modifying the window's view tree mid-transition
- Add NSPanel guard in toggle_glass + notification handler filtering
  as defense-in-depth

* feat: move welcome actions and recent projects into sidebar

Sidebar now shows Open Project, Clone, SSH buttons and recent projects
list when no workspace is open, keeping traffic lights naturally
positioned. Welcome page simplified to just the ORBIT logo and account
banner.

* fix: browser panel UI polish, todo bar, glass defocus with child windows

- Browser panel: add bottom inset to prevent webview overflow on rounded
  card corners, remove redundant toolbar border
- TodoBar: persistent todo display above chat input (replaces inline
  TodoToolWidget snapshots in the stream)
- MessageItem: hide message actions while agent is still running
  (isAgentRunning prop) to avoid premature rewind buttons
- Glass defocus: skip restoring glass when a non-glass child window
  (embedded browser) becomes key — prevents macOS compositor defocus
  tint on the main window

* fix: suppress native WebKit context menu in production app

* refactor: unify editor mode into shared layout — sidebar, chat panel, header

- Move editor sidebar content (Explorer / Source Control) into PrimarySidebar
  with mode-aware tab switching (EditorSidebarTab)
- Move editor chat panel into ActivityCard slot in App.tsx, carrying
  ContentTopBar + gradient fade with it
- Simplify EditorLayout to thin wrapper around EditorCenter (no more
  duplicate sidebar, resize handles, or chat panel)
- Remove EditorSidebar component (replaced by PrimarySidebar in editor mode)
- Remove terminal from EditorCenter (handled by shared terminal system)
- Update editor tab styling to use gray-4/gray-1 instead of chat-area

* feat: 3-position sidebar switch for editor mode, fix chat panel visibility

- Add TriStateSwitch component (Explorer / Source Control / Sessions)
  for the editor sidebar, replacing the binary Radix Switch
- Add sessions tab in editor mode showing the full conversation list
  with New Session, Projects, Vault, and Powers actions
- Fix editor chat panel always hidden on mode switch — activity column
  now stays open in editor mode regardless of reviewPanelOpen state
- Add TodoBar to EditorChatPanel and remove extra padding wrapper to
  match agent page layout

* feat: add Tauri drag regions to sidebar header, file tab bars, and editor tabs

Makes the empty space in tab bars and sidebar header draggable for
window movement, matching the existing ContentTopBar pattern.

* feat: add cross-platform SVG icons matching all 9 SF Symbols used in sidebar and header

Replace dependency on macOS-only SF Symbols with hand-crafted SVG React
components for sidebar.left, arrow.left, arrow.right, square.and.pencil,
gear, exclamationmark.bubble, sidebar.squares.right, apple.terminal, and
switch.2. Gear icon traced from native SF Symbol PNG via potrace; the rest
are parametric stroke-based SVGs. Also nudge traffic light Y position 24→25.

* feat: Apple Liquid Glass delete dialog — macOS 26 UI Kit spec

Add frosted glass material dialog with backdrop-filter blur, pill-shaped
buttons, and light/dark mode tint layers for the conversation delete
confirmation.

* fix: liquid glass sidebar hover/selected states use semi-transparent overlays

Fixed hex colors (bg-gray-3) are invisible against vibrancy. Replace
with rgba overlays that darken/lighten proportionally against any
backdrop, matching macOS 26 UI Kit material spec.

* feat: apply Apple Liquid Glass design tokens across entire UI

Migrate all components from hardcoded Radix gray references to --lg-*
design tokens. Adds Tailwind utility mappings (bg-lg-control,
bg-lg-sidebar-hover, etc.), Apple-spec glass input with multi-layer
::before/::after pseudo-elements, and Liquid Glass switch styling
with #0D6FFF checked state + accessibility indicators (dash/circle).

Covers: sidebar, header, chat area, input controls, tool widgets,
activity panel, settings, git, file explorer, modals, and all UI
primitives (button, dropdown, dialog, select, context-menu, input).

* fix: Liquid Glass polish — settings dialogs, switch, editor dialogs scroll

- Settings: nav items match sidebar glass hover/selected, chat-area bg on content
- Settings pages: disable font size & accessibility, remove data section, 14px cards
- UI primitives: pill-shaped inputs/selects/buttons, squircle switch (7px track, 5px thumb)
- Editor dialogs (slash commands, subagents): glass overlay, inner wrapper pattern for
  scroll + glass border coexistence, chat-area bg, pill tool toggles
- Sidebar toggle switch slightly larger (h-4 w-8)
- Branch selector hover uses lg-control-hover token

* chore: fix Tailwind v4 canonical class warnings and add claude skills

- Migrate !important prefix to suffix syntax (Tailwind v4)
- Replace break-words with wrap-break-word
- Add emil-design-engineering and web-animation-design skills

* fix: disable Canvas mode button with "coming soon" tooltip

* fix: reduce liquid glass color bleed from desktop background

Apply semi-opaque dark tint (#121212 at 62%) directly on the root
bg-base-layer element so the native NSGlassEffectView blur reads as
neutral-dark instead of picking up wallpaper hue. Bump native tint
alpha from cc (80%) to e6 (90%) for stronger desaturation.

* fix: Liquid Glass polish, ESC permission deny, and production hardening

- Refine Liquid Glass design tokens across all UI components (color bleed,
  separators, tool widgets, dialogs, onboarding)
- Fix ESC key not denying permission requests (capture-phase handler)
- Add chat message grouping and session lifecycle improvements
- Add tool gauntlet stress test for DevTools-driven testing

* fix: tool widget polish, coming-soon sidebar badges, and agent:complete simplification

- Unify tool widget inner containers to rounded-lg for visual consistency
- Add "Soon" badges to unimplemented Powers sidebar items (Plugins, MCP, Slash Commands, Sub Agents)
- Simplify agent:complete handler — SDK sends exactly one result per sendMessage(), so remove intermediate-turn heuristic and safety timers

* fix: production hardening — solid popovers, race condition fixes, orphaned tool cleanup

- Replace glass-popover/backdrop-blur with solid bg-sidebar backgrounds on all
  dropdowns and menus (fixes visual artifacts on some macOS configurations)
- Fix TOCTOU race in consumeRewindForkPoint/consumePendingConversationFork by
  reading + deleting atomically inside Immer set() callback
- Add infinite-loop guard to evictIfNeeded when all sessions are pinned/running
- Force-complete orphaned tools on agent:complete and agent:error events
- Migrate tool sessionIds in remapSession so rewind doesn't lose tool widgets
- Carry toolUses through rewind data for tool widget restoration on rewind 2+
- Retry compacted conversation reload with backoff instead of fixed 1500ms delay
- Reduce rewind interrupt delay from 500ms to 100ms (SDK flush is faster)
- Remove dead pendingRewindCheckpointId in-loop rewind mechanism
- Remove unused useTauriMessages hook and subscribe from TauriProvider
- Fix decorum pick_folder to resume glass_defocus observers before error propagation
- Reduce liquid glass base layer opacity and tint color alpha for subtler effect
- Add critiqueEnabled, sessionMode, resumeSessionAt, forkSession to bridge schema
- Normalize compact_complete event to use sessionId (camelCase)
- Hoist IS_DEMO to module scope (parsed once, not per-render)
- Downgrade verbose rewind logger.warn calls to logger.debug
- Round git source-control buttons to pill shape (rounded-full)

* fix: correct terminal position test to match store behavior

toggleReviewPanel does not auto-switch terminal position — tests
now assert position independence from activity panel state.

* fix: CI — platform-gate pick_directory, correct terminal position test

pick_directory uses macOS-only NSOpenPanel via decorum plugin; gate
with cfg(target_os) and no-op on Linux so Rust CI compiles.

Terminal position test now asserts independence from activity panel
state, matching the actual store behavior.

* fix: scope clippy expect to macOS only in window.rs

The needless_pass_by_value lint only fires on macOS where AppHandle
is borrowed; on Linux the param is consumed by let _, so the expect
was unfulfilled. Use cfg_attr to gate it.