No-repo mode: sandbox-free, local-first (collapse chat/scratch, native file ops)

[KvFxKaido]

Design: docs/decisions/No-Repo Mode — Sandbox-Free, Local-First.md (Draft)

Retire no-repo on web (composer becomes repo-only — no bare chat retained). No-repo survives native-only as local mode: file ops gated behind the native shell as kind: 'native' (local-pc's tool profile on the native plugin transport). Completes the "no-repo never touches the cloud sandbox" invariant — scratch is the lone violator today (chat / local-pc / relay are all sandboxId: null).

Two pieces are closer to done than the original framing: repo-mode device checkpoint/restore is already built (Native Checkpoint Store, Current, VITE_NATIVE_CHECKPOINTS, device-validated 2026-06-23), and local mode's storage substrate already exists (it reuses the checkpoint store's filesDir + native git engine) — so local mode's real blocker is the native file-CRUD bridge, not storage.

Sequencing:

• 1. Web retire — composer repo-only; retire scratch's sandbox; remove chat. Pure refactor, no device, CI-testable, reversible. Unblocks deleting the web Orchestrator loop (with the inline-delegation flag retirement).
• 2. GA the Native Checkpoint Store — widen VITE_NATIVE_CHECKPOINTS toward default-on for repo-mode device durability. Already built + device-validated; flag flip, not a build. Proves the shared substrate local mode reuses.
• 3. Native file-CRUD bridge + native sandbox_* execution path. The real long pole (storage already exists). Device-validate read/write/list/edit/diff on the Moto G.
• 4. git init lifecycle + kind: 'native' — flip the dormant git-session.ts arm. APK no-repo = local-first project, behind VITE_NATIVE_*.
• 5. Optional GitHub sync — push-first (native push + token wiring already exist). Pull/merge deferred (solo authors push; no-shell conflict UX).
• (tracking) retire the inline-delegation flag → delete the web Orchestrator loop (runRoundLoop), unblocked by step 1.

Out of scope (see doc): repo-mode local-fs lean (the device↔sandbox coherence seam — two live trees, distinct from the checkpoint store's one-way device backup), on-device execution, web local projects.

The decision doc is the design source of truth; this issue tracks sequencing only.

[KvFxKaido]

Step 1 (web collapse) — scope locked

Expands checklist item 1. Correction to the one-liner above: step 1 carries no fileOps axis — it's pure deletion of scratch. fileOps + the native-shell flag arrive in step 3 on the distinct kind: 'native'. (#1230's runtime-context consolidation is therefore a step-3 concern, not step-1.)

Locked decisions

1. Keep mode: 'chat' as the canonical no-repo value (no rename to 'no-repo'). chat is already the sandbox-free path; renaming churns every call site + migration for cosmetic gain, and native gets its own kind/mode in step 3.
2. Migrate by read-time coercion, not an IDB rewrite. Stored kind:'scratch' sessions and mode:'scratch' / legacy mode:undefined conversations are read as chat; message history untouched. This is what keeps the cut reversible — a revert strands nobody.

What step 1 is

Delete the scratch mode/kind; chat becomes the sole no-repo mode. Retire scratch's cloud-sandbox auto-spin. No-repo routes to ChatSurfaceRoute, leaving WorkspaceChatRoute repo-only.

Sub-slices (each compiles green; commit per slice)

1a — Types + drift tests

• types/index.ts:73 drop 'scratch' from WorkspaceMode; :157 remove the {kind:'scratch'} arm; :1229 drop from the mode?: literal.
• capabilities.test.ts:528-543 and :586-593 — remove 'scratch' from both allModes arrays.

1b — Session creation + migration

• App.tsx — delete handleStartScratchWorkspace (:295), handleStartScratchFromHome (:457), composer scratch branch (:513-520), resume-scratch branches (:570-574, :608-616) → route to chat.
• App.tsx:61-140 + :674-695 — coerce stored kind:'scratch' → chat (drop sandboxId) on load/persist.
• chat-management.ts:36-42 + :44-70 — collapse getWorkspaceScopedMode + the chat/scratch predicate (:54/:58) to one no-repo→chat rule.
• WorkspaceSessionScreen.tsx:287-292, 719-720 — no-repo → ChatSurfaceRoute; WorkspaceChatRoute becomes repo-only.

1c — Sandbox lifecycle

• useWorkspaceSandboxController.ts:118-126, 207-211, 237-248 — delete scratch auto-spin / auto-start / restart branches.

1d — UI cleanup

• ComposerDraftScreen.tsx:67-75,242,324,476; RepoLauncherPanel.tsx:528-551,555-594,611-627; LauncherHomeContent.tsx:83-102; RepoChatDrawer.tsx:196-218; WorkspaceHubSheet.tsx:1331-1366,1761-1812; ChatScreen.tsx:161-234; FileBrowser.tsx:372-416; workspace-chat-route-builders.ts:225-250.

1e — Dead code + comments

• Verify scratch-only, then delete useSnapshotManager.ts + WorkspaceScratchActions (types/index.ts:181). (Repo mode uses the separate checkpoint/auto-back system, not these.)
• Comments: orchestrator.ts:531, runtime-context.ts:16.

Trade-off owned

Web permanently loses the ephemeral file-editing playground (scratch sandbox + file browser + snapshots + download). Native file ops are APK-only (steps 2–4). This is the intended probe, not collateral.

The two locked decisions also land in docs/decisions/No-Repo Mode — Sandbox-Free, Local-First.md with the step-1 PR (same-PR doc discipline), correcting its step-1 line.