Pin the server and UI client to the installed beta runtime and reject mismatched CLI versions before shared-service startup. Delegate proven shared-service shutdown to Service.stop while retaining CodeNomad lease, peer, registration, endpoint, and process-identity checks.
Adopt native Forms and the client/solid data reducer for live messages, tools, permissions, and input forms. Propagate internal stream generations into authoritative reconnect reconciliation and replace directory-wide session scans with native project cursor pagination.
Fail worktree deletion when session evacuation fails and deduplicate canonical workspace folders instead of exposing non-isolated duplicate instances. Update migration notes and CI coverage for the reviewed contract.
Validated with server/UI/Electron typechecks, 244 UI partition tests, 122 Electron native tests, 248 server tests plus 3 platform skips (the sole Windows cleanup race passed in isolation), UI/server/Electron builds, Tauri cargo check --locked, and git diff --check.
Treat DEV-v2 as an authorized development base in build, artifact-comment, and PR restriction workflows. GitHub evaluates pull_request policy from the base branch, so child PR changes cannot authorize themselves.
This allows PRs 648 and 649 to run validation without weakening restrictions for unrelated target branches. Workflow diffs and git diff checks pass.
Integrate the current native V2 runtime, inline form flow, pruned validation matrix, and shared desktop/runtime fixes without restoring the removed delta-buffer transport.
Keep PR 648's bounded transcript rendering and inactive-memory budget, then replace oversized transcript rejection with stale-safe 200-message window paging. Consolidate duplicate caches, account native and pending state, preserve paging cursors through scroll snapshots, and keep authoritative active content untruncated.
Reduce feature-specific tests to representative memory, eviction, rendering, lazy-copy, paging, authority, and cleanup invariants. UI typecheck and build pass; focused standard/browser suites, the server suite, Electron native suite, and diff checks pass.
Reduce the V2 test matrix to CodeNomad-owned behavior instead of repeating generated OpenCode request shapes, mock choreography, equivalent endpoint permutations, and source-level helper wiring.
Retain representative happy paths and the boundaries that protect workspace ownership, traversal and credentials, PID and WSL lifecycle proof, shutdown timeouts, permission isolation, restore handoff, deletion authority, streaming reconciliation, and persisted client state.
This removes 2,818 net test and CI lines. The full server suite passes with 249 tests and 3 platform skips; the PR UI matrices pass with 204 standard and 53 browser-conditioned tests, both server and UI typechecks pass, and git diff checks are clean.
Delete the obsolete pre-MVP roadmap and task references now that Git preserves that development history, while retaining current V2 operational and architecture guidance.
Remove behavior-neutral server and UI plumbing that has no remaining caller: unused workspace options and cached endpoint state, redundant auto-accept metadata, an unused PTY get adapter, and a one-use message-loading helper. Keep lifecycle proof, restore gates, timeline projection, and targeted invalidation because they still enforce runtime behavior.
Validated with server and UI typechecks, the full server suite (308 passed, 3 skipped), focused UI matrices, browser-conditioned UI tests, production server/UI build, diff checks, caller searches, and an independent regression review.
Keep tool-targeted V2 forms inline from the moment their metadata arrives instead of briefly opening the permission-center fallback while message state catches up.
Render the pending form directly in place of the tool-call chrome so users see one stable response surface without a stray disclosure chevron. Global and inactive-session forms retain the floating fallback.
Validated with the UI typecheck, the 83-test restore/form integration matrix, a production Tauri build, and git diff checks.
Update the empty plugin-status copy in every supported locale now that the panel reports runtime-active plugin IDs rather than configured package entries.
The UI typecheck and diff check pass.
Allow the read-only OpenCode /api/plugin endpoint through the workspace proxy so the status panel can distinguish active plugins from configured but unloaded packages.
Keep the route inside the explicit proxy allowlist and cover it with the instance proxy suite. The focused 25-test proxy suite, server typecheck, and diff check pass.
Keep provider usage visible across status-panel remounts and reuse fresh results for the normal polling interval so message refreshes cannot collapse the panel into a loading state.
Treat compaction as the boundary for the visible agent plan, source plugin status from active V2 plugin IDs instead of configured package entries, and reserve the background-shell panel for native PTYs.
Propagate session interruption to active descendants and replace the placeholder busy check with the real working/compacting status. Focused tests cover active plugin filtering, compacted plans, and descendant interruption; the complete UI test matrix, UI typecheck, and production build pass.
Document the A/B staging and deployment slot roles so smoke builds are launched from the validated deployed artifact.
Describe the complete external interactive-task handoff flow, including precise V2 process selection, request construction, environment setup, result verification, hash validation, and one-shot task cleanup. This gives future agents a positive executable procedure and prevents the handoff launcher from sharing the process tree it replaces.
The V2 migration first disabled and then removed the OpenCode update action because the native runtime no longer exposes V1's global upgrade endpoint. The remaining version card also queried the legacy opencode-ai package instead of the V2 beta channel.
Restore the settings action using the official @opencode-ai/cli beta installation flow for npm, pnpm, bun, and yarn. Restrict automatic updates to the managed opencode2 command, preserve custom binaries, compare monotonically numbered beta builds numerically, and verify the configured binary after installation before reporting success.
Validated against the live beta registry, 11 focused update tests, 307 server tests with 3 skipped, 544 UI tests, server and UI typechecks, the production UI build, and diff checks.
Rapid V2 deltas continuously extended the programmatic-scroll window. Virtua measurement corrections during that window could leave the controller logically following while the viewport remained above the bottom.
Enforce the bottom invariant whenever follow mode has no fresh user escape or active restoration. Classify page navigation from non-editing controls and primary selection drags as user ownership, cancel pending submit pinning for every recognized user scroll, and allow explicit downward intent to rejoin during a programmatic window.
Validated with 39 focused follow tests, 56 combined streaming/send/projection tests, the UI typecheck, 544 UI tests, and diff checks.
Optimistic user text was inserted synchronously but marked synthetic, causing timeline projection and message rendering to hide it until delayed REST or SSE reconciliation replaced the part. Large histories and active streaming made that delay especially visible.
Keep optimistic user text renderable while retaining reconciliation authority through the existing optimistic part ID registry. Also tolerate provisional text and reasoning parts without a text property when computing timeline signatures.
Validated with 12 focused projection and send-lifecycle tests, including a deferred native request proving pre-network visibility, plus the UI typecheck and diff checks.
Middle-button autoscroll starts from message descendants, but the virtual list only recorded pointer intent when the scroll container itself was the event target. The resulting scroll events had no user intent and were immediately pinned back to the bottom.
Treat a non-interactive middle-button pointer press anywhere inside the list as explicit user scroll ownership. This exits follow mode and cancels active bottom pinning without preventing the browser's native middle-button behavior.
Validated with 36 focused follow-controller tests, the UI typecheck, 539 UI tests, and git diff checks.
On large sessions, recent SSE messages can mount before the full paginated snapshot is hydrated. Scroll restoration then failed to find its saved anchor, immediately applied an obsolete absolute pixel offset, and was clamped near the bottom before the anchor arrived.
Keep restoration authoritative while waiting a bounded five seconds for the saved key to enter the virtual item set. Once available, the existing index navigation and offset stabilizer apply; genuinely missing anchors still fall back at the strict bound.
Validated with 39 targeted restoration tests, the UI typecheck, 538 UI tests, and git diff checks.
The first connected status from a newly started OpenCode stream waited for initial hydration and then repeated the same session, pending-request, catalog, metadata, and filesystem loads. This made every normal startup pay for a reconnect recovery pass.
Track only genuine error or unexpected-disconnect transitions as requiring recovery. Initial connecting-to-connected startup and deliberate workspace shutdown no longer resync, while failed streams still receive one coalesced authoritative recovery after reconnection.
Validated with 10 targeted connection and readiness tests, the UI typecheck, 537 UI tests, and git diff checks.
The instance bridge duplicated every OpenCode event payload into a synthetic properties field because server-side auto-accept still consumed the V1-style envelope. This expanded the SSE contract and left UI deletion handling with legacy fallbacks.
Move auto-accept and session deletion to native event.data, publish OpenCode events unchanged, type the shared stream as OpenCodeEvent, and guard PTY consumers before narrowing their event union. Internal CodeNomad worktree events remain separate.
Validated with server and UI typechecks, 51 targeted server tests, 21 targeted UI tests, 304 passing server tests with 3 platform skips, 535 UI tests, and git diff checks.
Volatile V2 events previously refreshed every catalog, metadata, and filesystem domain. Even an agent or command update therefore caused unrelated API requests and cache invalidation, with a trailing full rerun when events overlapped.
Map each native event to the state domains it can affect and merge pending domains in one coordinator. Reconnects retain a complete refresh, while agent, command, integration, metadata, filesystem, and VCS events now update only their relevant stores.
Validated with 21 targeted invalidation and request-authority tests, the UI typecheck, 535 UI tests, and git diff checks.
OpenCode SDK location responses expose workspaceID, while generated request inputs require workspace. Passing a response LocationRef directly was structurally accepted by TypeScript but caused the generated client to omit the workspace selector from catalog requests.
Centralize the output-to-request conversion and apply it to agent, provider, model, default-model, and command catalog calls. Internal session state continues using the SDK response shape.
Validated with 21 targeted request-authority tests, the UI typecheck, 533 UI tests, and git diff checks.
Real question-backed V2 forms set custom=true. The long-option branch therefore bypassed the intended select and rendered a text input with a datalist, so the tested 4/5 threshold did not hold for actual native requests.
Render every long option list as a select regardless of custom-value support, and preserve free-form answers in a separate custom input. Short lists remain visible cards.
Validated against a live four-option V2 form, targeted form tests, the UI typecheck, 532 UI tests, and git diff checks.
The Tauri macOS ARM prebuild combines DOM and Node timer declarations, so injected and global setTimeout implementations can return either a numeric browser handle or a Node Timeout. The previous inferred alias accepted only the Node variant and failed server compilation on that matrix leg.
Represent the manager timer handle as the actual portable union and avoid Array.prototype.at in a server test because the server TypeScript target predates ES2022.
Validated with the complete server build, 304 passing server tests with 3 platform skips, 11 targeted workspace tests, and git diff checks.
The Tauri client-state tests exercise process-global file locks and invoke PowerShell/CIM for process identity. Running them concurrently on the shared Windows runner can starve those probes, causing both cross-host election and bounded registration timing assertions to fail together despite passing independently.
Run the 74-test Windows Tauri suite with one test thread. Linux coverage remains parallel, and product-side participant reconciliation remains covered by repeated cross-host tests.
Validated with the exact serial Windows cargo command: 74 passed, 0 failed.
A session can mount from startup discovery before native workspace restoration seeds its saved scroll snapshot. The message stream previously marked that no-snapshot pass complete and ignored the authoritative seed when it arrived, leaving Virtua at the top despite a valid anchor.
Track no-snapshot completion as provisional and permit exactly one later restore when the reactive seed appears. Normal completed restores remain terminal, and session changes reset the provisional authority.
Validated with UI typecheck, 48 targeted restoration tests, 532 complete UI tests, and git diff checks.
Electron and Tauri can each publish a legacy running marker immediately before publishing their shared cross-host participant. On a simultaneous Windows startup, both hosts could observe that transient gap and yield ownership, leaving no primary.
When legacy detection initially blocks a primary candidate, wait for one bounded 50ms participant grace period and reconcile once before yielding. Apply the same protocol on both Node and Rust hosts; genuine legacy clients still block ownership after the grace period.
Validated with root typecheck, 50 repeated cross-host election runs, 122 Electron native tests, 74 Tauri tests, and git diff checks.
Render native V2 string option lists with up to four answers as visible radio cards, including each option description, so question-style forms retain the scannable V1 interaction. Lists with five or more answers continue to use a compact select control.
Apply the same selected-card treatment to multiselect answers, preserve custom-value entry, validate required inline strings, and keep grouped controls accessibly labelled. Option styling lives in a focused component stylesheet and uses existing square-corner design tokens.
Validated with UI typecheck, 531 UI tests, a production desktop build, git diff checks, and visual inspection in the deployed WebView.
When a native V2 form resolves to a tool call, render it as the sole interactive surface and suppress the legacy QuestionToolBlock for that call. Legacy questions remain available when no native form is pending, while unresolved and cross-session forms continue to use the existing floating fallback.
Improve the native form hierarchy with token-based panel and field surfaces, explicit required and focus states, consistent checkbox controls, square action buttons, and responsive stacked actions on narrow screens.
Validated with UI typecheck, 530 UI tests, a production desktop build, git diff checks, and desktop/mobile inspection in the deployed WebView.
Stop deleting OPENCODE_DB from legacy CodeNomad environment preferences during settings layout migration. Environment variables now migrate uniformly without a database-specific exception.
The OpenCode V2 service destination remains unchanged and continues to use ~/.local/share/opencode2/opencode.db through the launch-time service environment override.
Validated with the settings migration test, root typecheck, the complete server suite, and git diff --check.
Attempt configured WSL host-to-service translation before treating POSIX paths as already service-native. This preserves real Windows behavior while allowing Linux CI to exercise Windows workspace ownership with temporary git worktrees.
Remove the environment-dependent assertion that a bare opencode2 command resolves to a packaged executable. Deterministic shim coverage remains in buildServiceLaunchSpec and the Windows PATH/PATHEXT tests.
Validated with full typecheck, 27 spawn tests, 9 workspace manager tests, and the complete server suite with 304 passing tests and 3 skips.
Preserve the last authoritative non-empty tab snapshot through native shutdown, make shutdown capture terminal, and restore the exact saved active tab. Seed scroll snapshots before session selection and wait for usable Virtua measurements so project, tab, session, and anchor position survive A/B restarts.
Render native runtime forms inline only when their active-session tool target is resolved, retain the floating fallback for unresolved requests, share form schema visibility and URL validation with provider auth, and remove the unused session form-list proxy route and obsolete V1 request wrapper.
Return the native V2 session.active map without a legacy data envelope, avoid full-history refreshes for deltas already applied locally, and bound timeline projection refreshes during streaming. Coverage includes UI restoration, form targeting, proxy contracts, native streaming, and CI test registration.
Validated with root typecheck, 529 UI tests, 305 passing server tests with 3 skips, 74 Tauri tests, 122 Electron native tests, production A/B builds, a no-seed native handoff, and runtime verification of the active-session proxy shape.
The Star History chart was broken because it depended on the GitHub
stargazer API. Switch it to an alternative provider using the same data
source so the community chart renders correctly. No API token required.
Co-authored-by: OctoBored <212877535+OctoBored@users.noreply.github.com>
Keep follow ownership tied to explicit user intent so Virtua measurement corrections cannot silently escape an actively followed response. Large key jumps now land immediately, while explicit timeline and top navigation cancel submit pinning without confusing programmatic movement for user scrolling.
Rebuild timeline segments from cached V2 structural signatures instead of part-count and same-length replacement heuristics. This handles provisional-to-authoritative part replacement, type and renderability changes, terminal status updates, locale changes, duplicate part IDs, and the V2 time.completed contract without rebuilding streamed text on every token.
Add follow-state, timeline projection, and duplicate-part regression coverage to the PR workflow. Validated with 264 standard UI tests, 72 browser/integration tests, full UI and Electron typechecks, production UI build, and live Tauri WebView navigation/follow scenarios.
Align the V2 delta reducer with the live OpenCode contract, where many unique events append to the same message, content type, and ordinal. Keep one provisional part per source part instead of treating ordinals as fragment sequence numbers.
Render the first fragment immediately, then coalesce subsequent store and Markdown updates to one 16 ms window. Flush pending content before terminal reconciliation, preserve authoritative snapshot IDs and error states, cancel timers on session or workspace cleanup, and retain bounded replay protection.
Validated against a live 1,485-event response that streamed 100 lines and 6,387 characters continuously to completion. Added repeated-ordinal, timer, snapshot, tool-boundary, cleanup, terminal, and error regressions; all 223 standard UI tests, 72 browser/integration tests, and workspace typechecks pass.
Apply OpenCode V2 text and reasoning delta events directly to the normalized message store so assistant responses appear as they are generated instead of waiting for periodic HTTP snapshots.
Deduplicate replayed events, preserve ordinal part ordering, reconcile stale or superseded snapshots, settle terminal messages, retry failed terminal refreshes, and clear streaming state when sessions or workspaces are removed. This keeps snapshot refreshes as authoritative recovery without erasing visible streamed content or recreating removed stores.
Add focused streaming regression coverage and extend native event tests for immediate text, reasoning, periodic refresh behavior, replay handling, deletion cleanup, and terminal reconciliation. Validated with 223 standard UI tests, 64 browser/integration tests, full workspace typechecks, a production Tauri build, and a live CDP smoke covering progressive rendering and reload restoration.
Keep established conversations mounted while V2 performs authoritative message refreshes. Background loads no longer insert the initial loader or clear timeline segments, preventing the measured prompt displacement and timeline flicker during native streaming.
Restore saved sessions directly before the expensive all-worktree session scan, while preserving every referenced draft, attachment, scroll, expansion, idle, and generation record. Make workspace readiness follow newer reconnect loads without leaking waits after cancellation, and exclude synthetic views from native session hydration.
Harden question interruption races by rebinding requests when authoritative tool parts arrive late or replace optimistic parts, and clear inline question state immediately after reply or rejection. Isolate PTY loading reads from Solid effects to prevent recursive reload storms.
Add focused regressions to the PR workflow. Validated with 223 standard UI tests, 58 browser-condition tests, full TypeScript checks, 307 server tests, 74 Rust tests, 28 Windows spawn tests, a production Tauri build, and real cold-start state restoration.
Give the V2 desktop runtime its own WebView2 user-data folder so it cannot reuse V1 service workers, browser caches, or locked profile state. Preserve an explicitly supplied WEBVIEW2_USER_DATA_FOLDER for debugging and custom launches.
Defer installation of the Windows session-end subclass until the main thread can provide a native window handle, preventing startup from aborting during slower WebView creation.
Validated with nine shutdown tests, a release build, simultaneous V1/V2 WebView processes using distinct data folders, and sequential CodeNomad/openchamber workspace launches without UI or runtime exceptions.
Update the experimental OpenCode client, protocol, and schema dependencies to the latest reviewed next release while removing the exact CLI version gate from shared-service discovery. This lets CodeNomad use current opencode2 releases instead of timing out solely because the runtime advanced.
Refresh migration, contributor, architecture, and skill guidance to require release-note, documentation, declaration, and proxy-parity review on each upgrade. The isolated opencode2 database behavior is documented consistently.
Validated with server and UI typechecks, 36 passing targeted service/workspace tests, a release Tauri build, and a packaged desktop smoke. The smoke opened D:\CodeNomad, reused three existing sessions, and received three distinct exact prompt responses from opencode2 next-17444.
Force the V2 service to use the opencode2 database under the current user's data directory so parallel V1 launches cannot redirect it through shared environment settings.
Keep the bare opencode and opencode2 commands out of custom binary history while preserving real executable paths, and document the parallel desktop smoke procedure. Existing history entries are intentionally left untouched for manual cleanup.
The server manager test and typecheck passed, and the Tauri package built successfully before the final UI-only simplification. No additional compilation was run per request.
Merge upstream dev into the OpenCode V2 foundation while preserving native V2 session, provider, proxy, PTY, and explicit database behavior.
Resolve desktop workspace-open and provider visibility conflicts across Electron and Tauri, bound local API requests, refresh standalone dependency locks, and keep grouped integration preferences keyed by native provider IDs.
Validated with desktop typechecks, 267 UI tests, 308 server tests, 122 Electron tests, 74 Tauri tests, packaged builds, and an exact OpenCode 0.0.0-next-17353 Tauri smoke covering prompt, reload, agent fallback, and PTY lifecycle.
Restore reliable V2 catalogs, agent identifiers, cursor pagination, prompts, variants, attachments, forms, native event reconciliation, Yolo persistence, and location-aware PTY controls. Prevent completed control records from appearing as streaming placeholders and keep live output refreshing during sustained token streams.
Harden the shared service and workspace proxy with explicit OPENCODE_DB isolation, launch-signature validation, traversal protection, WSL namespace translation, ownership-scoped routes, bounded SSE backpressure, reconnect recovery, and safe process-proof transfer and shutdown semantics.
Align provider, VCS, LSP, update, documentation, and CI behavior with the experimental next-17353 contract. Validation includes server/UI/Electron typechecks, 252 workflow UI tests, focused server suites, production UI/server builds, 68 Tauri tests, and a real V2 workspace/session/prompt smoke.
Load sessions from each logical root and worktree using the native V2 directory filter, preserve locally known sessions when a combined response may be incomplete, and resolve locationless events through their session IDs. This restores worktree sessions, prompt activity, and deletion updates without reintroducing the removed transport.
Require the bundled OpenCode prerelease for shared-service discovery and surface structured prompt errors. Move Electron and Tauri restore state and election files under the V2 namespace, copying V1 state once without mutating or deleting the legacy files.
Cover multi-directory loading, locationless event routing, version-constrained discovery, and cross-host state isolation. Validated UI, server, Electron, and Tauri tests and built the Tauri release executable and NSIS installer.
Treat the persisted V1 default command 'opencode' as 'opencode2' so restored and newly selected workspaces use the required V2 service instead of waiting for the obsolete binary to time out.
Keep the folder selection view mounted while startup restore is active and feed it the existing loading state, preventing the renderer from appearing blank while saved workspaces are recreated.
Cover the legacy binary setting and restore loading gate with regression tests. Server/UI typechecks, targeted restore tests, the UI production build, and a real lifecycle smoke from an 'opencode' configuration pass.
Re-scope the renderer-memory fix on the native V2 baseline after removal of the duplicate Tauri event transport. Bound Markdown, reasoning, tool output, diagnostics, diffs, task steps, todos, and per-message part rendering while retaining complete authoritative content behind lazy copy actions.
Coordinate message records and derived render caches under one 64 MiB byte-aware LRU. Protect mounted, loading, and live transcripts; cap pending parts and prompt display overrides; fence stale cache writes; and conservatively account measurement failures.
Reload evicted transcripts through bounded complete V2 pagination, reject stale lifecycle completions, purge all per-instance session state, and prevent delayed SSE/delta work from recreating removed stores. Keep DEV-v2 PR validation enabled without reintroducing native Tauri transport changes.
Validated with full UI and Electron typecheck, UI production build, 248 standard UI tests, 71 browser-condition UI tests, 118 Electron native tests, and git diff checks. The long-duration WebKit soak remains pending while the PR stays draft.
## Summary
- size provider card actions to their content on desktop
- prevent the global full-width selector button rule from overflowing
the Provider Authentication dialog
- retain full-width stacked actions in the existing narrow/mobile layout
## Validation
- `npm run typecheck --workspace @codenomad/ui`
- `npm run build --workspace @codenomad/ui`
- `git diff --check`
Follow-up to #637.
Closes#650.
## Summary
- add per-provider model visibility controls to Settings > Providers and
the floating provider dialog
- persist exact hidden model IDs as CodeNomad presentation preferences
- keep large plugin catalogs manageable with search and Show all / Hide
all actions
## Behavior
- all current and newly reported models remain visible by default
- unchecked models are hidden only from model picker lists
- active/default models remain usable even when hidden
- favorites remain persisted and return when their models are shown
again
- the same management UI is available from Settings and the floating
model-picker dialog
This intentionally mirrors OpenChamber/OpenCode Desktop client-side
hiding. It does not rewrite OpenCode configuration or change model
execution/default semantics.
## Validation
- npm run typecheck
- node --import tsx --test packages/ui/src/lib/model-visibility.test.ts
- npm run build --workspace @codenomad/ui
- Gatekeeper reviews: PASS
Closes#636
## Summary
- add project folder, terminal, and explicit editor actions to the
command palette and native File menus
- replace the Files-row copy button with desktop context actions while
preserving internal file navigation and web/remote copy fallback
- resolve trusted workspace roots through the authenticated local server
and enforce canonical path containment in Electron and Tauri
- use safe platform launch policies, including Windows Open/Edit/Open
With handling and executable rejection on Unix
- localize all new UI actions across supported locales
## Validation
- npm run typecheck
- npm run test:native --workspace @neuralnomads/codenomad-electron-app
(122 passed)
- cargo test (86 passed)
- npm run build
- git diff --check
- independent security, platform, and UX reviews: zero findings
Closes#570
## Summary
- identify remote CodeNomad webviews explicitly as Tauri hosts
- grant remote-* windows the minimum native notification permissions
- keep dialogs, opener access, menus, and other desktop privileges
restricted to the main window
## Cause
Remote windows were marked with the remote window context but not with
the Tauri runtime host. The UI therefore selected the Web Notification
API inside WebView2, where requesting permission had no effect. Those
windows also did not match a Tauri capability that allowed notification
plugin commands.
## Implementation
The initialization script now sets both runtime host and window context
before remote UI scripts run. A dedicated capability permits only
permission checks, permission requests, and notification delivery for
configured HTTP/HTTPS remote origins.
## Validation
- cargo test --manifest-path packages/tauri-app/src-tauri/Cargo.toml: 85
passed
- npm run typecheck --workspace @codenomad/ui
- npm run build:ui
- git diff --check
- two independent review rounds: zero findings after least-privilege
cleanup
Fixes#640
