Merge remote-tracking branch 'origin/main' into deps-low-risk-batch

# Conflicts:
#	frontend/package-lock.json
#	frontend/package.json

Author: alicoding

.claude/rules/testing.md

@@ -154,17 +154,29 @@ layer per capability," never "a seed per thing":
   poll. The earlier headless-windowing lead was never actually
   tested — the harness failed before the app could boot. With
   `syscall.Signal(0)` the local run connects and drives the real
-  registry (the click-model and selection-ring checks have passed
-  against the real WKWebView). What remains before the job means
-  anything: the CHECK REGISTRY was written blind against a
-  single-window assumption — Mill's desktop build opens multiple
-  windows (main + the Quick Panel's second window), so
-  `app-info-window-sane` and the bridge's window-ambiguous clicks
-  and badge locator need calibrating against the app's real window
-  shape (tracked as its own goal). Until that lands, the OPERATIVE
-  parity gate remains the LOCAL run, read with the registry's
-  current miscalibration in mind; the CI job stays wired,
-  non-required.
+  registry. **Calibrated (goal 0107): all six checks green, three
+  consecutive local runs.** The registry now asserts the app's real
+  three-window shape by NAME (main + quickpanel + approvalprompt;
+  the main window carries an explicit `Name: "main"` in main.go for
+  exactly this addressing), and every page-directed bridge call is
+  window-scoped via `withWindow` — the bridge's `window` parameter
+  defaults to "focused or first window", which with three windows
+  was the root of every flip-flopping check and the missed badge.
+  Second root cause, harness-repaired and upstream-worthy: the
+  bridge's `call_bound_method` tool imports a SECOND runtime
+  instance into the page (`await import('/wails/runtime.js')` in
+  its own implementation), which re-registers
+  `window._wails.dispatchWailsEvent` and permanently orphans the
+  app bundle's event listeners — all live-sync (and the footer
+  clock) dies at the first bound call. Every bound call in the
+  harness therefore goes through `callBoundJSON`, which re-chains
+  the captured app dispatcher (`captureAppDispatch` /
+  `repairAppDispatch`, checks.go). This defect is bridge-client
+  triggered only — a desktop build nobody drives over MCP never
+  imports the second instance — but any future agent-drives-the-
+  desktop-app work must reuse the same repair. CI job: stays wired,
+  non-required, promote after a green track record on the
+  calibrated registry.
 - **Manual-only registry** — OS-bound checks (hotkey delivery, real
   clipboard, tray) listed explicitly with reasons, never silently
   absent (see goal 0010's enforcement). Non-seed instance: the

.ls-lint.yml

@@ -52,7 +52,11 @@
 #     added here -- that's the point, not a bug: root additions are
 #     layout decisions, never accidents.
 ls:
-  .go: regex:(main|singleinstance_(production|dev))
+  # auxwindows: the ADR-0033 second-window constructors (Quick Panel +
+  # approval prompt), split from main.go along that family seam when it
+  # crossed the 500-line convention -- `package main` (they wire into
+  # main.go's app object) so they cannot move under internal/.
+  .go: regex:(main|auxwindows|singleinstance_(production|dev))
   # SECURITY/CONTRIBUTING added goal 0028 (public-repo hygiene): both are
   # standard GitHub community-profile root files, same allowlist family as
   # README below (checked, not new -- CODE_OF_CONDUCT deliberately stays

auxwindows.go

@@ -0,0 +1,76 @@
+package main
+
+import "github.com/wailsapp/wails/v3/pkg/application"
+
+// The ADR-0033 second-window family: always-alive auxiliary windows
+// created once at startup, Hidden, shown/hidden for the app's life
+// (never destroyed/recreated). Split from main.go along that family
+// seam (the 500-line convention); main.go keeps the main window, tray,
+// and service wiring.
+
+// newQuickPanelWindow builds the Quick Panel (docs/adr/0033): a
+// floating window the summon hotkey toggles. URL is a hash route, not
+// a bare path: production asset serving has no SPA fallback, so a bare
+// path second window would 404 in a real installed build. Deliberately
+// NOT ActivationPolicyAccessory (would pull Mill's dock icon too) and
+// NOT a non-activating NSPanel (unmerged upstream at beta.4) --
+// showing this window still activates Mill and steals focus, which
+// SettingsService's yieldFocusIfMainHidden mitigates on dismiss.
+func newQuickPanelWindow(app *application.App) *application.WebviewWindow {
+	return app.Window.NewWithOptions(application.WebviewWindowOptions{
+		Name:             "quickpanel",
+		Title:            "Mill Quick Panel",
+		Width:            560,
+		Height:           400,
+		Hidden:           true,
+		Frameless:        true,
+		DisableResize:    true,
+		InitialPosition:  application.WindowCentered,
+		HideOnFocusLost:  true,
+		HideOnEscape:     true,
+		BackgroundColour: application.NewRGB(6, 7, 15),
+		Mac: application.MacWindow{
+			Backdrop:           application.MacBackdropTranslucent,
+			WindowLevel:        application.MacWindowLevelFloating,
+			CollectionBehavior: application.MacWindowCollectionBehaviorCanJoinAllSpaces | application.MacWindowCollectionBehaviorFullScreenAuxiliary,
+			TitleBar: application.MacTitleBar{
+				AppearsTransparent: true,
+				Hide:               true,
+			},
+		},
+		URL: "/#/quickpanel",
+	})
+}
+
+// newApprovalPromptWindow builds the floating approval prompt
+// (docs/goals/0023-attention-escalation.md item 1): the incoming-call/
+// askpass pattern, ADR-0033's second-window mechanism reused rather
+// than re-derived. Shown by the BACKEND itself
+// (SettingsService.NotifyPendingApproval's away verdict), never by a
+// hotkey. Deliberately NOT HideOnFocusLost (unlike the Quick Panel):
+// a decision prompt must not vanish just because focus wandered --
+// Escape (HideOnEscape) is its one explicit, native dismiss path.
+func newApprovalPromptWindow(app *application.App) *application.WebviewWindow {
+	return app.Window.NewWithOptions(application.WebviewWindowOptions{
+		Name:             "approvalprompt",
+		Title:            "Mill Approval",
+		Width:            520,
+		Height:           200,
+		Hidden:           true,
+		Frameless:        true,
+		DisableResize:    true,
+		InitialPosition:  application.WindowCentered,
+		HideOnEscape:     true,
+		BackgroundColour: application.NewRGB(6, 7, 15),
+		Mac: application.MacWindow{
+			Backdrop:           application.MacBackdropTranslucent,
+			WindowLevel:        application.MacWindowLevelFloating,
+			CollectionBehavior: application.MacWindowCollectionBehaviorCanJoinAllSpaces | application.MacWindowCollectionBehaviorFullScreenAuxiliary,
+			TitleBar: application.MacTitleBar{
+				AppearsTransparent: true,
+				Hide:               true,
+			},
+		},
+		URL: "/#/approvalprompt",
+	})
+}

frontend/bindings/github.com/alicoding/mill/internal/services/settingssvc/settingsservice.ts

@@ -324,6 +324,16 @@ export function ResolveMCPWrite(id: string, approve: boolean): $CancellablePromi
     return $Call.ByID(2304068895, id, approve);
 }
 
+/**
+ * ResolveUpdateChannel returns the effective channel for this run: the
+ * persisted preference when set, else the build's ldflags stamp.
+ * main.go calls this once before SetUpdateChannel/InitUpdater so the
+ * guard, the UI label, and the provider's feed all agree.
+ */
+export function ResolveUpdateChannel(buildChannel: string): $CancellablePromise<string> {
+    return $Call.ByID(1332358316, buildChannel);
+}
+
 /**
  * ResolvedMCPWrites lists every already-resolved MCP write still in its
  * 24h retention window (docs/goals/0026 item 6) -- Review's
@@ -460,6 +470,17 @@ export function SetPendingBadge(count: number): $CancellablePromise<void> {
     return $Call.ByID(4240483754, count);
 }
 
+/**
+ * SetUpdateChannelPreference persists the channel override. The
+ * preference resolves at BOOT (ResolveUpdateChannel below): the update
+ * provider's feed selection is fixed at Init, so a change applies
+ * after the next restart -- the UI says so rather than pretending a
+ * live switch happened.
+ */
+export function SetUpdateChannelPreference(pref: string): $CancellablePromise<void> {
+    return $Call.ByID(218736037, pref);
+}
+
 /**
  * SetWorkflowMinutesSaved overrides workflowID's estimate. minutes must
  * be positive -- Home's own formula (RunCount × MinutesPerRun) always
@@ -568,3 +589,11 @@ export function UnassignSummonHotkey(): $CancellablePromise<void> {
 export function UpdateChannel(): $CancellablePromise<string> {
     return $Call.ByID(1676930456);
 }
+
+/**
+ * UpdateChannelPreference returns the persisted channel override:
+ * "" (follow the build's own channel), "beta", or "release".
+ */
+export function UpdateChannelPreference(): $CancellablePromise<string> {
+    return $Call.ByID(2624864437);
+}

frontend/e2e/atlas-folder-import.spec.ts

@@ -89,6 +89,15 @@ test('add from folder: scan, partial accept, containment, and mirror rendering a
   await expect(overlay.getByTestId('atlas-page-mirror-path')).toHaveValue(/Reports\/Q1 Summary\.md$/)
   await expect(overlay.getByTestId('atlas-mirror-markdown')).toContainText('Numbers looked good across the board.')
 
+  // Mermaid fences render as inline SVG diagrams (goal 0108); a fence
+  // that fails to parse keeps its original code block -- the fixture
+  // carries one of each, so exactly one diagram and one surviving
+  // fence prove both the render and the honest fallback.
+  const diagram = overlay.getByTestId('atlas-mermaid-diagram')
+  await expect(diagram).toHaveCount(1)
+  await expect(diagram.locator('svg')).toBeVisible()
+  await expect(overlay.getByTestId('atlas-mirror-markdown').locator('code.language-mermaid')).toHaveCount(1)
+
   // Cleanup (testing.md's within-file/within-worker discipline): the
   // child card must go before its own container can be deleted. Once
   // "Reports" holds no children, it renders as a plain note card,

frontend/e2e/fixtures/server.ts

@@ -70,6 +70,10 @@ export const UPDATES_RELEASE_SERVER_BASE_PORT = 9790
 export const UPDATES_RELEASE_MCP_BASE_PORT = 9810
 export const UPDATES_BETA_SERVER_BASE_PORT = 9815
 export const UPDATES_BETA_MCP_BASE_PORT = 9825
+// The channel-preference opt-in test: persists a store value and
+// reloads, so it needs its own server like the other updates cases.
+export const UPDATES_CHANNEL_PREF_SERVER_BASE_PORT = 10360
+export const UPDATES_CHANNEL_PREF_MCP_BASE_PORT = 10380
 // guardrail-authoring.spec.ts's own dedicated pair (goal 0078): the
 // full rule-from-park -> unstick -> audit-edit -> policy-removed loop
 // asserts exact rule counts/groupings in the Rules audit view, which

frontend/e2e/fixtures/synced-folder/Reports/Q1 Summary.md

@@ -1,3 +1,12 @@
 # Q1 summary
 
 Numbers looked good across the board.
+
+```mermaid
+graph TD;
+  Pilot-->Rollout;
+```
+
+```mermaid
+this is not a diagram %% deliberately invalid
+```

frontend/e2e/updates.spec.ts

@@ -7,6 +7,8 @@ import {
   type SpawnedServer,
   UPDATES_BETA_MCP_BASE_PORT,
   UPDATES_BETA_SERVER_BASE_PORT,
+  UPDATES_CHANNEL_PREF_MCP_BASE_PORT,
+  UPDATES_CHANNEL_PREF_SERVER_BASE_PORT,
   UPDATES_RELEASE_MCP_BASE_PORT,
   UPDATES_RELEASE_SERVER_BASE_PORT,
   UPDATES_SOURCE_MCP_BASE_PORT,
@@ -150,3 +152,38 @@ test('Beta-channel build shows the primary Update now button and the beta channe
     await browser.close()
   }
 })
+
+// The channel opt-in (goal 0100 follow-up slice): a
+// source-built copy can point the updater at the beta feed. The
+// preference persists to the settings store and applies on the next
+// boot (the provider's feed is fixed at Init), so the UI must say so
+// -- this pins the select, the saved-note, and persistence across a
+// reload.
+// eslint-disable-next-line no-empty-pattern -- this test needs `testInfo` (the second arg), not any fixture.
+test('Update-channel preference saves, explains the restart, and survives a reload', async ({}, testInfo) => {
+  const idx = testInfo.parallelIndex
+  let server: SpawnedServer | undefined
+  let dir: string | undefined
+  const browser = await chromium.launch()
+  try {
+    ;({ server, dir } = await spawnUpdatesServer(idx, UPDATES_CHANNEL_PREF_SERVER_BASE_PORT, UPDATES_CHANNEL_PREF_MCP_BASE_PORT, {}))
+    const page = await browser.newPage()
+    await page.goto(`${server.baseURL}/`)
+    await page.getByRole('link', { name: 'Settings' }).click()
+
+    const select = page.getByTestId('update-channel-select')
+    await expect(select).toHaveValue('')
+    await select.selectOption('beta')
+    await expect(page.getByTestId('update-channel-saved')).toContainText('Restart Mill')
+
+    await page.reload()
+    await page.getByRole('link', { name: 'Settings' }).click()
+    await expect(page.getByTestId('update-channel-select')).toHaveValue('beta')
+
+    await page.close()
+  } finally {
+    await server?.stop()
+    if (dir) rmSync(dir, { recursive: true, force: true })
+    await browser.close()
+  }
+})