fix: use -p never shorthand for electron-builder

The --publish never format wasn't being parsed correctly. Using -p never shorthand instead.

.coderabbit.yaml

@@ -1,65 +0,0 @@
-# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
-
-# CodeRabbit Configuration
-# Documentation: https://docs.coderabbit.ai/reference/configuration
-
-language: "en-US"
-
-reviews:
-  # Review profile: "chill" for fewer comments, "assertive" for more thorough feedback
-  profile: "assertive"
-
-  # Generate high-level summary in PR description
-  high_level_summary: true
-
-  # Automatic review settings
-  auto_review:
-    enabled: true
-    auto_incremental_review: true
-    # Target branches for review (in addition to default branch)
-    base_branches:
-      - develop
-      - "release/*"
-      - "hotfix/*"
-    # Skip review for PRs with these title keywords (case-insensitive)
-    ignore_title_keywords:
-      - "[WIP]"
-      - "WIP:"
-      - "DO NOT MERGE"
-    # Don't review draft PRs
-    drafts: false
-
-  # Path filters - exclude generated/vendor files
-  path_filters:
-    - "!**/node_modules/**"
-    - "!**/.venv/**"
-    - "!**/dist/**"
-    - "!**/build/**"
-    - "!**/*.lock"
-    - "!**/package-lock.json"
-    - "!**/*.min.js"
-    - "!**/*.min.css"
-
-  # Path-specific review instructions
-  path_instructions:
-    - path: "apps/backend/**/*.py"
-      instructions: |
-        Focus on Python best practices, type hints, and async patterns.
-        Check for proper error handling and security considerations.
-        Verify compatibility with Python 3.12+.
-    - path: "apps/frontend/**/*.{ts,tsx}"
-      instructions: |
-        Review React patterns and TypeScript type safety.
-        Check for proper state management and component composition.
-    - path: "tests/**"
-      instructions: |
-        Ensure tests are comprehensive and follow pytest conventions.
-        Check for proper mocking and test isolation.
-
-chat:
-  auto_reply: true
-
-knowledge_base:
-  opt_out: false
-  learnings:
-    scope: "auto"

.coveragerc

@@ -1,12 +0,0 @@
-[run]
-parallel = true
-source = apps/backend/cli
-omit =
-    */tests/*
-    */__pycache__/*
-    */.venv/*
-
-[report]
-exclude_lines =
-    pragma: no cover
-    if __name__ == "__main__":

.github/FUNDING.yml

@@ -1,3 +0,0 @@
-# These are supported funding model platforms
-
-github: AndyMik90

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,27 +1,75 @@
-name: 🐛 Bug Report
-description: Something isn't working
-labels: ["bug", "needs-triage"]
+name: Bug Report
+description: Report a bug or unexpected behavior
+labels: ["bug", "triage"]
 body:
-  - type: checkboxes
-    id: checklist
+  - type: markdown
     attributes:
-      label: Checklist
-      options:
-        - label: I searched existing issues and this hasn't been reported
-          required: true
+      value: |
+        Thanks for taking the time to report a bug! Please fill out the sections below.
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Bug Description
+      description: A clear and concise description of the bug.
+      placeholder: What happened?
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected Behavior
+      description: What did you expect to happen?
+      placeholder: What should have happened?
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to Reproduce
+      description: Steps to reproduce the behavior.
+      placeholder: |
+        1. Run command '...'
+        2. Click on '...'
+        3. See error
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Error Messages / Logs
+      description: If applicable, paste any error messages or logs.
+      render: shell
+
+  - type: textarea
+    id: screenshots
+    attributes:
+      label: Screenshots
+      description: If applicable, add screenshots to help explain the problem.
 
   - type: dropdown
-    id: area
+    id: component
     attributes:
-      label: Area
+      label: Component
+      description: Which part of Auto Claude is affected?
       options:
-        - Frontend
-        - Backend
-        - Fullstack
+        - Python Backend (auto-claude/)
+        - Electron UI (auto-claude-ui/)
+        - Both
         - Not sure
     validations:
       required: true
 
+  - type: input
+    id: version
+    attributes:
+      label: Auto Claude Version
+      description: What version are you running? (check package.json or git tag)
+      placeholder: "v2.0.1"
+
   - type: dropdown
     id: os
     attributes:
@@ -30,47 +78,26 @@ body:
         - macOS
         - Windows
         - Linux
+        - Other
     validations:
       required: true
 
   - type: input
-    id: version
+    id: python-version
     attributes:
-      label: Version
-      placeholder: "e.g., 2.5.5"
-    validations:
-      required: true
+      label: Python Version
+      description: Output of `python --version`
+      placeholder: "3.12.0"
+
+  - type: input
+    id: node-version
+    attributes:
+      label: Node.js Version (for UI issues)
+      description: Output of `node --version`
+      placeholder: "20.10.0"
 
   - type: textarea
-    id: description
+    id: additional
     attributes:
-      label: What happened?
-      placeholder: Describe the bug clearly and concisely. Include any error messages you encountered.
-    validations:
-      required: true
-
-  - type: textarea
-    id: steps
-    attributes:
-      label: Steps to reproduce
-      placeholder: |
-        1. Run command '...' or click on '...'
-        2. Observe behavior '...'
-        3. See error or unexpected result
-    validations:
-      required: true
-
-  - type: textarea
-    id: expected
-    attributes:
-      label: Expected behavior
-      placeholder: What did you expect to happen instead? Describe the correct behavior.
-    validations:
-      required: true
-
-  - type: textarea
-    id: logs
-    attributes:
-      label: Logs / Screenshots
-      description: Required for UI bugs. Attach relevant logs, screenshots, or error output.
-      render: shell
+      label: Additional Context
+      description: Any other context about the problem.

.github/ISSUE_TEMPLATE/config.yml

@@ -1,8 +1,8 @@
 blank_issues_enabled: false
 contact_links:
-  - name: 💡 Feature Request
+  - name: Questions & Discussions
     url: https://github.com/AndyMik90/Auto-Claude/discussions
-    about: Suggest new features in GitHub Discussions
-  - name: 💬 Discord Community
-    url: https://discord.gg/QhRnz9m5HE
-    about: Questions and discussions - join our Discord!
+    about: Ask questions and discuss ideas with the community
+  - name: Documentation
+    url: https://github.com/AndyMik90/Auto-Claude#readme
+    about: Check the documentation before opening an issue

.github/ISSUE_TEMPLATE/docs.yml

@@ -1,37 +0,0 @@
-name: 📚 Documentation
-description: Improvements or additions to documentation
-labels: ["documentation", "needs-triage", "help wanted"]
-body:
-  - type: dropdown
-    id: type
-    attributes:
-      label: Type
-      options:
-        - Missing documentation
-        - Incorrect/outdated info
-        - Improvement suggestion
-        - Typo/grammar fix
-    validations:
-      required: true
-
-  - type: input
-    id: location
-    attributes:
-      label: Location
-      description: Which file or page?
-      placeholder: "e.g., README.md or guides/setup.md"
-
-  - type: textarea
-    id: description
-    attributes:
-      label: Description
-      description: What needs to change?
-    validations:
-      required: true
-
-  - type: checkboxes
-    id: contribute
-    attributes:
-      label: Contribution
-      options:
-        - label: I'm willing to submit a PR for this

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,70 @@
+name: Feature Request
+description: Suggest a new feature or enhancement
+labels: ["enhancement", "triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for suggesting a feature! Please describe your idea below.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem Statement
+      description: What problem does this feature solve? Is this related to a frustration?
+      placeholder: I'm always frustrated when...
+    validations:
+      required: true
+
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed Solution
+      description: Describe the solution you'd like to see.
+      placeholder: I would like Auto Claude to...
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives Considered
+      description: Have you considered any alternative solutions or workarounds?
+      placeholder: I've tried...
+
+  - type: dropdown
+    id: component
+    attributes:
+      label: Component
+      description: Which part of Auto Claude would this affect?
+      options:
+        - Python Backend (auto-claude/)
+        - Electron UI (auto-claude-ui/)
+        - Both
+        - New component
+        - Not sure
+    validations:
+      required: true
+
+  - type: dropdown
+    id: priority
+    attributes:
+      label: How important is this feature to you?
+      options:
+        - Nice to have
+        - Important for my workflow
+        - Critical / Blocking my use
+
+  - type: checkboxes
+    id: contribution
+    attributes:
+      label: Contribution
+      description: Would you be willing to help implement this?
+      options:
+        - label: I'm willing to submit a PR for this feature
+
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional Context
+      description: Add any other context, mockups, or screenshots about the feature request.

.github/ISSUE_TEMPLATE/question.yml

@@ -1,61 +0,0 @@
-name: ❓ Question
-description: Needs clarification
-labels: ["question", "needs-triage"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        **Before asking:** Check [Discord](https://discord.gg/QhRnz9m5HE) - your question may already be answered there!
-
-  - type: checkboxes
-    id: checklist
-    attributes:
-      label: Checklist
-      options:
-        - label: I searched existing issues and Discord for similar questions
-          required: true
-
-  - type: dropdown
-    id: area
-    attributes:
-      label: Area
-      options:
-        - Setup/Installation
-        - Frontend
-        - Backend
-        - Configuration
-        - Other
-    validations:
-      required: true
-
-  - type: input
-    id: version
-    attributes:
-      label: Version
-      description: Which version are you using?
-      placeholder: "e.g., 2.7.1"
-    validations:
-      required: true
-
-  - type: textarea
-    id: question
-    attributes:
-      label: Question
-      placeholder: "Describe your question in detail..."
-    validations:
-      required: true
-
-  - type: textarea
-    id: context
-    attributes:
-      label: Context
-      description: What are you trying to achieve?
-    validations:
-      required: true
-
-  - type: textarea
-    id: attempts
-    attributes:
-      label: What have you already tried?
-      description: What steps have you taken to resolve this?
-      placeholder: "e.g., I tried reading the docs, searched for..."

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,103 +1,44 @@
-## Base Branch
+## Summary
 
-- [ ] This PR targets the `develop` branch (required for all feature/fix PRs)
-- [ ] This PR targets `main` (hotfix only - maintainers)
-
-## Description
-
-<!-- What does this PR do? 2-3 sentences -->
-
-## Related Issue
-
-Closes #
+<!-- Brief description of what this PR does -->
 
 ## Type of Change
 
-- [ ] 🐛 Bug fix
-- [ ] ✨ New feature
-- [ ] 📚 Documentation
-- [ ] ♻️ Refactor
-- [ ] 🧪 Test
+- [ ] Bug fix (non-breaking change that fixes an issue)
+- [ ] New feature (non-breaking change that adds functionality)
+- [ ] Breaking change (fix or feature that would cause existing functionality to change)
+- [ ] Documentation update
+- [ ] Refactoring (no functional changes)
+- [ ] Tests (adding or updating tests)
 
-## Area
+## Related Issues
 
-- [ ] Frontend
-- [ ] Backend
-- [ ] Fullstack
+<!-- Link any related issues: Fixes #123, Closes #456 -->
 
-## Commit Message Format
+## Changes Made
 
-Follow conventional commits: `<type>: <subject>`
+<!-- List the main changes in this PR -->
 
-**Types:** feat, fix, docs, style, refactor, test, chore
-
-**Example:** `feat: add user authentication system`
-
-## AI Disclosure
-
-<!-- Check the box below if any part of this PR was written with AI assistance. -->
-
-- [ ] This PR includes AI-generated code (Claude, Codex, Copilot, etc.)
-
-<!-- If checked, please also fill in: -->
-**Tool(s) used:** <!-- e.g., Claude Code, GitHub Copilot, ChatGPT -->
-**Testing level:**
-- [ ] Untested -- AI output not yet verified
-- [ ] Lightly tested -- ran the app / spot-checked key paths
-- [ ] Fully tested -- all tests pass, manually verified behavior
-
-- [ ] I understand what this PR does and how the underlying code works
-
-## Checklist
-
-- [ ] I've synced with `develop` branch
-- [ ] I've tested my changes locally
-- [ ] I've followed the code principles (SOLID, DRY, KISS)
-- [ ] My PR is small and focused (< 400 lines ideally)
-
-## Platform Testing Checklist
-
-**CRITICAL:** This project supports Windows, macOS, and Linux. Platform-specific bugs are a common source of breakage.
-
-- [ ] **Windows tested** (either on Windows or via CI)
-- [ ] **macOS tested** (either on macOS or via CI)
-- [ ] **Linux tested** (CI covers this)
-- [ ] Used centralized `platform/` module instead of direct `process.platform` checks
-- [ ] No hardcoded paths (used `findExecutable()` or platform abstractions)
-
-**If you only have access to one OS:** CI now tests on all platforms. Ensure all checks pass before submitting.
-
-## CI/Testing Requirements
-
-- [ ] All CI checks pass on **all platforms** (Windows, macOS, Linux)
-- [ ] All existing tests pass
-- [ ] New features include test coverage
-- [ ] Bug fixes include regression tests
+-
+-
+-
 
 ## Screenshots
 
-<!-- Required for UI changes. Delete if not applicable. -->
+<!-- If applicable, add screenshots for UI changes -->
 
-| Before | After |
-|--------|-------|
-|        |       |
+## Checklist
 
-## Feature Toggle
+- [ ] I have run `pre-commit run --all-files` and fixed any issues
+- [ ] I have added tests for my changes (if applicable)
+- [ ] All existing tests pass locally
+- [ ] I have updated documentation (if applicable)
+- [ ] My code follows the project's code style
 
-<!-- If feature is incomplete or experimental, how is it hidden from users? -->
-<!-- This ensures incomplete work can be merged without affecting production. -->
+## Testing
 
-- [ ] Behind localStorage flag: `use_feature_name`
-- [ ] Behind settings toggle
-- [ ] Behind environment variable/config
-- [ ] N/A - Feature is complete and ready for all users
+<!-- Describe how you tested these changes -->
 
-## Breaking Changes
+## Additional Notes
 
-<!-- Does this PR introduce breaking changes? If yes, describe what breaks and migration steps. -->
-<!-- Delete this section if not applicable. -->
-
-**Breaking:** Yes / No
-
-**Details:**
-<!-- What breaks? What do users/developers need to change? -->
+<!-- Any additional context or notes for reviewers -->

.github/actions/finalize-macos-notarization/action.yml

@@ -1,160 +0,0 @@
-name: 'Finalize macOS Notarization'
-description: 'Wait for Apple notarization to complete and staple tickets to DMG files'
-
-inputs:
-  apple-id:
-    description: 'Apple ID for notarization'
-    required: true
-  apple-app-specific-password:
-    description: 'Apple app-specific password'
-    required: true
-  apple-team-id:
-    description: 'Apple Team ID'
-    required: true
-  intel-notarization-id:
-    description: 'Notarization request ID for Intel build'
-    required: false
-    default: ''
-  arm64-notarization-id:
-    description: 'Notarization request ID for ARM64 build'
-    required: false
-    default: ''
-  intel-dmg-file:
-    description: 'Filename of the Intel DMG'
-    required: false
-    default: ''
-  arm64-dmg-file:
-    description: 'Filename of the ARM64 DMG'
-    required: false
-    default: ''
-  intel-artifact-path:
-    description: 'Path to Intel build artifacts'
-    required: false
-    default: 'intel'
-  arm64-artifact-path:
-    description: 'Path to ARM64 build artifacts'
-    required: false
-    default: 'arm64'
-  timeout:
-    description: 'Timeout in seconds for notarization wait'
-    required: false
-    default: '3600'
-
-outputs:
-  intel-stapled:
-    description: 'Whether Intel DMG was successfully stapled'
-    value: ${{ steps.staple.outputs.intel_stapled }}
-  arm64-stapled:
-    description: 'Whether ARM64 DMG was successfully stapled'
-    value: ${{ steps.staple.outputs.arm64_stapled }}
-
-runs:
-  using: 'composite'
-  steps:
-    - name: Wait for notarization and staple
-      id: staple
-      shell: bash
-      env:
-        APPLE_ID: ${{ inputs.apple-id }}
-        APPLE_APP_SPECIFIC_PASSWORD: ${{ inputs.apple-app-specific-password }}
-        APPLE_TEAM_ID: ${{ inputs.apple-team-id }}
-        INTEL_NOTARIZATION_ID: ${{ inputs.intel-notarization-id }}
-        ARM64_NOTARIZATION_ID: ${{ inputs.arm64-notarization-id }}
-        INTEL_DMG: ${{ inputs.intel-dmg-file }}
-        ARM64_DMG: ${{ inputs.arm64-dmg-file }}
-        INTEL_PATH: ${{ inputs.intel-artifact-path }}
-        ARM64_PATH: ${{ inputs.arm64-artifact-path }}
-        TIMEOUT: ${{ inputs.timeout }}
-      run: |
-        intel_stapled=false
-        arm64_stapled=false
-
-        if [ -z "$APPLE_ID" ]; then
-          echo "Skipping notarization wait: APPLE_ID not configured"
-          echo "intel_stapled=false" >> "$GITHUB_OUTPUT"
-          echo "arm64_stapled=false" >> "$GITHUB_OUTPUT"
-          exit 0
-        fi
-
-        # Warn if no notarization IDs provided (could indicate submission failure)
-        if [ -z "$INTEL_NOTARIZATION_ID" ] && [ -z "$ARM64_NOTARIZATION_ID" ]; then
-          echo "::warning::No notarization IDs provided - nothing to finalize. Check if notarization submission succeeded."
-          echo "intel_stapled=false" >> "$GITHUB_OUTPUT"
-          echo "arm64_stapled=false" >> "$GITHUB_OUTPUT"
-          exit 0
-        fi
-
-        # Wait for Intel notarization
-        if [ -n "$INTEL_NOTARIZATION_ID" ]; then
-          echo "Waiting for Intel notarization: $INTEL_NOTARIZATION_ID"
-          if ! xcrun notarytool wait "$INTEL_NOTARIZATION_ID" \
-            --apple-id "$APPLE_ID" \
-            --password "$APPLE_APP_SPECIFIC_PASSWORD" \
-            --team-id "$APPLE_TEAM_ID" \
-            --timeout "$TIMEOUT"; then
-            echo "::error::Intel notarization failed or timed out"
-            exit 1
-          fi
-          # Verify notarization was accepted (not just processed)
-          INTEL_STATUS=$(xcrun notarytool info "$INTEL_NOTARIZATION_ID" \
-            --apple-id "$APPLE_ID" \
-            --password "$APPLE_APP_SPECIFIC_PASSWORD" \
-            --team-id "$APPLE_TEAM_ID" \
-            --output-format json | jq -r '.status // "Unknown"')
-          if [ "$INTEL_STATUS" != "Accepted" ]; then
-            echo "::error::Intel notarization status is '$INTEL_STATUS', expected 'Accepted'"
-            exit 1
-          fi
-          echo "Intel notarization status: $INTEL_STATUS"
-          # Verify DMG file exists before stapling
-          if [ ! -f "$INTEL_PATH/$INTEL_DMG" ]; then
-            echo "::error::Intel DMG not found at $INTEL_PATH/$INTEL_DMG"
-            exit 1
-          fi
-          echo "Stapling Intel DMG: $INTEL_PATH/$INTEL_DMG"
-          if ! xcrun stapler staple "$INTEL_PATH/$INTEL_DMG"; then
-            echo "::error::Failed to staple Intel DMG"
-            exit 1
-          fi
-          echo "Successfully stapled Intel DMG"
-          intel_stapled=true
-        fi
-
-        # Wait for ARM64 notarization
-        if [ -n "$ARM64_NOTARIZATION_ID" ]; then
-          echo "Waiting for ARM64 notarization: $ARM64_NOTARIZATION_ID"
-          if ! xcrun notarytool wait "$ARM64_NOTARIZATION_ID" \
-            --apple-id "$APPLE_ID" \
-            --password "$APPLE_APP_SPECIFIC_PASSWORD" \
-            --team-id "$APPLE_TEAM_ID" \
-            --timeout "$TIMEOUT"; then
-            echo "::error::ARM64 notarization failed or timed out"
-            exit 1
-          fi
-          # Verify notarization was accepted (not just processed)
-          ARM64_STATUS=$(xcrun notarytool info "$ARM64_NOTARIZATION_ID" \
-            --apple-id "$APPLE_ID" \
-            --password "$APPLE_APP_SPECIFIC_PASSWORD" \
-            --team-id "$APPLE_TEAM_ID" \
-            --output-format json | jq -r '.status // "Unknown"')
-          if [ "$ARM64_STATUS" != "Accepted" ]; then
-            echo "::error::ARM64 notarization status is '$ARM64_STATUS', expected 'Accepted'"
-            exit 1
-          fi
-          echo "ARM64 notarization status: $ARM64_STATUS"
-          # Verify DMG file exists before stapling
-          if [ ! -f "$ARM64_PATH/$ARM64_DMG" ]; then
-            echo "::error::ARM64 DMG not found at $ARM64_PATH/$ARM64_DMG"
-            exit 1
-          fi
-          echo "Stapling ARM64 DMG: $ARM64_PATH/$ARM64_DMG"
-          if ! xcrun stapler staple "$ARM64_PATH/$ARM64_DMG"; then
-            echo "::error::Failed to staple ARM64 DMG"
-            exit 1
-          fi
-          echo "Successfully stapled ARM64 DMG"
-          arm64_stapled=true
-        fi
-
-        echo "intel_stapled=$intel_stapled" >> "$GITHUB_OUTPUT"
-        echo "arm64_stapled=$arm64_stapled" >> "$GITHUB_OUTPUT"

.github/actions/merge-macos-manifests/action.yml

@@ -1,194 +0,0 @@
-name: 'Merge macOS Manifests'
-description: 'Merge Intel and ARM64 macOS manifests for electron-updater'
-
-inputs:
-  dist-path:
-    description: 'Path to the dist directory containing build artifacts'
-    required: false
-    default: 'dist'
-  output-path:
-    description: 'Path to output the merged manifest'
-    required: false
-    default: 'release-assets'
-  copy-other-manifests:
-    description: 'Whether to copy Windows/Linux manifests as well'
-    required: false
-    default: 'true'
-  yq-version:
-    description: 'Version of yq to use for YAML merging'
-    required: false
-    default: 'v4.44.3'
-
-outputs:
-  merged:
-    description: 'Whether manifests were merged (true) or single architecture used (false)'
-    value: ${{ steps.merge.outputs.merged }}
-  file-count:
-    description: 'Number of files in the merged manifest'
-    value: ${{ steps.validate.outputs.file_count }}
-
-runs:
-  using: 'composite'
-  steps:
-    - name: Merge macOS manifests
-      id: merge
-      shell: bash
-      env:
-        # yq SHA256 checksum for v4.44.3 linux_amd64
-        # When updating yq-version, update this checksum and the one in validate step
-        YQ_SHA256: "a2c097180dd884a8d50c956ee16a9cec070f30a7947cf4ebf87d5f36213e9ed7"
-      run: |
-        echo "=== Merging macOS update manifests ==="
-
-        # Find all latest-mac.yml files from different build artifacts
-        intel_manifest=$(find "${{ inputs.dist-path }}" -path "*/macos-intel-builds/latest-mac.yml" -type f 2>/dev/null | head -1)
-        arm64_manifest=$(find "${{ inputs.dist-path }}" -path "*/macos-arm64-builds/latest-mac.yml" -type f 2>/dev/null | head -1)
-
-        echo "Intel manifest: ${intel_manifest:-not found}"
-        echo "ARM64 manifest: ${arm64_manifest:-not found}"
-
-        mkdir -p "${{ inputs.output-path }}"
-
-        if [ -n "$intel_manifest" ] && [ -n "$arm64_manifest" ]; then
-          echo "Both architectures found - merging manifests..."
-          echo "merged=true" >> "$GITHUB_OUTPUT"
-
-          # Install yq for YAML merging (pinned version with checksum verification)
-          YQ_VERSION="${{ inputs.yq-version }}"
-          YQ_URL="https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64"
-
-          echo "Downloading yq ${YQ_VERSION}..."
-          if ! wget -qO /tmp/yq "$YQ_URL"; then
-            echo "::error::Failed to download yq ${YQ_VERSION}"
-            exit 1
-          fi
-
-          # Verify checksum
-          echo "Verifying yq checksum..."
-          ACTUAL_SHA256=$(sha256sum /tmp/yq | cut -d' ' -f1)
-          if [ "$ACTUAL_SHA256" != "$YQ_SHA256" ]; then
-            echo "::error::yq checksum verification failed!"
-            echo "Expected: $YQ_SHA256"
-            echo "Actual:   $ACTUAL_SHA256"
-            rm -f /tmp/yq
-            exit 1
-          fi
-          echo "Checksum verified successfully"
-
-          sudo mv /tmp/yq /usr/local/bin/yq
-          sudo chmod +x /usr/local/bin/yq
-          echo "Installed yq version:"
-          yq --version
-
-          # Merge the files arrays from both manifests using two-step approach
-          # Step 1: Collect all files from both manifests into a temp file
-          yq eval-all '[.files] | flatten' "$intel_manifest" "$arm64_manifest" > /tmp/merged-files.yml
-
-          # Step 2: Replace files array in first manifest with merged files
-          yq eval '.files = load("/tmp/merged-files.yml")' "$intel_manifest" > "${{ inputs.output-path }}/latest-mac.yml"
-
-          echo "Merged manifest contents:"
-          cat "${{ inputs.output-path }}/latest-mac.yml"
-
-        elif [ -n "$intel_manifest" ]; then
-          echo "Only Intel manifest found - using as-is"
-          echo "merged=false" >> "$GITHUB_OUTPUT"
-          cp "$intel_manifest" "${{ inputs.output-path }}/latest-mac.yml"
-        elif [ -n "$arm64_manifest" ]; then
-          echo "Only ARM64 manifest found - using as-is"
-          echo "merged=false" >> "$GITHUB_OUTPUT"
-          cp "$arm64_manifest" "${{ inputs.output-path }}/latest-mac.yml"
-        else
-          echo "::error::No macOS manifests found - this will cause auto-update to fail"
-          exit 1
-        fi
-
-    - name: Validate merged manifest
-      id: validate
-      shell: bash
-      env:
-        # Single source of truth for yq checksum - must match merge step
-        YQ_SHA256: "a2c097180dd884a8d50c956ee16a9cec070f30a7947cf4ebf87d5f36213e9ed7"
-      run: |
-        manifest_file="${{ inputs.output-path }}/latest-mac.yml"
-
-        echo "=== Validating merged manifest ==="
-
-        # Check file exists
-        if [ ! -f "$manifest_file" ]; then
-          echo "::error::Merged manifest file not found at $manifest_file"
-          exit 1
-        fi
-
-        # Install yq if not already installed (for single-arch case)
-        if ! command -v yq &> /dev/null; then
-          YQ_VERSION="${{ inputs.yq-version }}"
-          YQ_URL="https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64"
-
-          echo "Downloading yq ${YQ_VERSION}..."
-          wget -qO /tmp/yq "$YQ_URL"
-
-          # Verify checksum (YQ_SHA256 from env)
-          ACTUAL_SHA256=$(sha256sum /tmp/yq | cut -d' ' -f1)
-          if [ "$ACTUAL_SHA256" != "$YQ_SHA256" ]; then
-            echo "::error::yq checksum verification failed!"
-            echo "Expected: $YQ_SHA256"
-            echo "Actual:   $ACTUAL_SHA256"
-            exit 1
-          fi
-
-          sudo mv /tmp/yq /usr/local/bin/yq
-          sudo chmod +x /usr/local/bin/yq
-        fi
-
-        # Validate YAML is parseable
-        if ! yq eval '.' "$manifest_file" > /dev/null 2>&1; then
-          echo "::error::Merged manifest is not valid YAML"
-          cat "$manifest_file"
-          exit 1
-        fi
-        echo "YAML syntax is valid"
-
-        # Count files in manifest
-        file_count=$(yq eval '.files | length' "$manifest_file")
-        echo "file_count=$file_count" >> "$GITHUB_OUTPUT"
-        echo "Manifest contains $file_count file entries"
-
-        # Validate file count
-        if [ "$file_count" -eq 0 ]; then
-          echo "::error::Merged manifest contains no files"
-          exit 1
-        fi
-
-        # If we merged both architectures, expect at least 2 files (one per arch)
-        if [ "${{ steps.merge.outputs.merged }}" = "true" ] && [ "$file_count" -lt 2 ]; then
-          echo "::warning::Merged manifest has fewer than 2 files - merge may have failed"
-        fi
-
-        # Validate required fields exist
-        if ! yq eval '.version' "$manifest_file" | grep -q .; then
-          echo "::error::Manifest missing 'version' field"
-          exit 1
-        fi
-        echo "Version field present: $(yq eval '.version' "$manifest_file")"
-
-        echo "Manifest validation passed"
-
-    - name: Copy other manifests
-      if: inputs.copy-other-manifests == 'true'
-      shell: bash
-      run: |
-        echo "=== Copying other update manifests ==="
-
-        # Copy other manifests (Windows, Linux) - these don't have the duplicate issue
-        for manifest in latest.yml latest-linux.yml latest-linux-arm64.yml; do
-          found=$(find "${{ inputs.dist-path }}" -name "$manifest" -type f 2>/dev/null | head -1)
-          if [ -n "$found" ]; then
-            echo "Copying $manifest"
-            cp "$found" "${{ inputs.output-path }}/"
-          fi
-        done
-
-        echo ""
-        echo "=== Manifest files in ${{ inputs.output-path }} ==="
-        ls -la "${{ inputs.output-path }}"/*.yml 2>/dev/null || echo "No manifest files found"

.github/actions/setup-node-frontend/action.yml

@@ -1,126 +0,0 @@
-name: 'Setup Node.js Frontend'
-description: 'Set up Node.js with npm and cached dependencies for the frontend'
-
-inputs:
-  node-version:
-    description: 'Node.js version to use'
-    required: false
-    default: '24'
-  ignore-scripts:
-    description: 'Whether to use --ignore-scripts flag during npm ci'
-    required: false
-    default: 'false'
-
-outputs:
-  cache-hit:
-    description: 'Whether npm cache was hit'
-    value: ${{ steps.cache.outputs.cache-hit }}
-
-runs:
-  using: 'composite'
-  steps:
-    - name: Setup Node.js ${{ inputs.node-version }}
-      uses: actions/setup-node@v4
-      with:
-        node-version: ${{ inputs.node-version }}
-
-    - name: Get npm cache directory
-      id: npm-cache-dir
-      shell: bash
-      run: echo "dir=$(npm config get cache)" >> "$GITHUB_OUTPUT"
-
-    - name: Cache npm dependencies
-      id: cache
-      uses: actions/cache@v4
-      with:
-        path: ${{ steps.npm-cache-dir.outputs.dir }}
-        key: ${{ runner.os }}-npm-${{ hashFiles('package-lock.json') }}
-        restore-keys: ${{ runner.os }}-npm-
-
-    - name: Install dependencies
-      shell: bash
-      # Run npm ci from root to properly handle workspace dependencies.
-      # With npm workspaces, the lock file is at root and dependencies are hoisted there.
-      # Running npm ci in apps/frontend would fail to populate node_modules correctly.
-      run: |
-        if [ "${{ inputs.ignore-scripts }}" == "true" ]; then
-          npm ci --ignore-scripts
-        else
-          npm ci
-        fi
-
-    - name: Link node_modules for electron-builder
-      shell: bash
-      # electron-builder expects node_modules in apps/frontend for native module rebuilding.
-      # With npm workspaces, packages are hoisted to root. Create a link so electron-builder
-      # can find the modules during packaging and code signing.
-      # Uses symlink on Unix, directory junction on Windows (works without admin privileges).
-      #
-      # IMPORTANT: npm workspaces may create a partial node_modules in apps/frontend for
-      # packages that couldn't be hoisted. We must remove it and create a proper link to root.
-      run: |
-        # Verify npm ci succeeded
-        if [ ! -d "node_modules" ]; then
-          echo "::error::Root node_modules does not exist. npm ci may have failed."
-          exit 1
-        fi
-
-        # Remove any existing node_modules in apps/frontend
-        # This handles: partial directories from npm workspaces, AND broken symlinks
-        if [ -e "apps/frontend/node_modules" ] || [ -L "apps/frontend/node_modules" ]; then
-          # Check if it's a valid symlink pointing to root node_modules
-          if [ -L "apps/frontend/node_modules" ]; then
-            target=$(readlink apps/frontend/node_modules 2>/dev/null || echo "")
-            if [ "$target" = "../../node_modules" ] && [ -d "apps/frontend/node_modules" ]; then
-              echo "Correct symlink already exists: apps/frontend/node_modules -> ../../node_modules"
-            else
-              echo "Removing incorrect/broken symlink (was: $target)..."
-              rm -f "apps/frontend/node_modules"
-            fi
-          else
-            echo "Removing partial node_modules directory created by npm workspaces..."
-            rm -rf "apps/frontend/node_modules"
-          fi
-        fi
-
-        # Create link if it doesn't exist or was removed
-        if [ ! -L "apps/frontend/node_modules" ]; then
-          if [ "$RUNNER_OS" == "Windows" ]; then
-            # Use directory junction on Windows (works without admin privileges)
-            # Use PowerShell's New-Item -ItemType Junction for reliable path handling
-            abs_target=$(cygpath -w "$(pwd)/node_modules")
-            link_path=$(cygpath -w "$(pwd)/apps/frontend/node_modules")
-            powershell -Command "New-Item -ItemType Junction -Path '$link_path' -Target '$abs_target'" > /dev/null
-            if [ $? -eq 0 ]; then
-              echo "Created junction: apps/frontend/node_modules -> $abs_target"
-            else
-              echo "::error::Failed to create directory junction on Windows"
-              exit 1
-            fi
-          else
-            # Use symlink on Unix (macOS/Linux)
-            if ln -s ../../node_modules apps/frontend/node_modules; then
-              echo "Created symlink: apps/frontend/node_modules -> ../../node_modules"
-            else
-              echo "::error::Failed to create symlink"
-              exit 1
-            fi
-          fi
-        fi
-
-        # Final verification - the link must exist and resolve correctly
-        # Note: On Windows, junctions don't show as symlinks (-L), so we check if the directory exists
-        # and can be listed. On Unix, we also verify it's a symlink.
-        if [ "$RUNNER_OS" != "Windows" ] && [ ! -L "apps/frontend/node_modules" ]; then
-          echo "::error::apps/frontend/node_modules symlink was not created"
-          exit 1
-        fi
-        # Verify the link resolves to a valid directory with content
-        if ! ls apps/frontend/node_modules/electron >/dev/null 2>&1; then
-          echo "::error::apps/frontend/node_modules does not resolve correctly (electron not found)"
-          ls -la apps/frontend/ || true
-          ls apps/frontend/node_modules 2>&1 | head -5 || true
-          exit 1
-        fi
-        count=$(ls apps/frontend/node_modules 2>/dev/null | wc -l)
-        echo "Verified: apps/frontend/node_modules resolves correctly ($count entries)"

.github/actions/setup-python-backend/action.yml

@@ -1,52 +0,0 @@
-name: 'Setup Python Backend'
-description: 'Set up Python with uv package manager and cached dependencies for the backend'
-
-inputs:
-  python-version:
-    description: 'Python version to use'
-    required: false
-    default: '3.12'
-  install-test-deps:
-    description: 'Whether to install test dependencies'
-    required: false
-    default: 'false'
-
-outputs:
-  cache-hit:
-    description: 'Whether cache was hit'
-    value: ${{ steps.cache.outputs.cache-hit }}
-
-runs:
-  using: 'composite'
-  steps:
-    - name: Set up Python ${{ inputs.python-version }}
-      uses: actions/setup-python@v5
-      with:
-        python-version: ${{ inputs.python-version }}
-
-    - name: Install uv package manager
-      uses: astral-sh/setup-uv@v4
-      with:
-        version: "latest"
-
-    - name: Cache uv dependencies
-      id: cache
-      uses: actions/cache@v4
-      with:
-        path: |
-          ~/.cache/uv
-          ~/AppData/Local/uv/cache
-          ~/Library/Caches/uv
-        key: uv-${{ runner.os }}-${{ runner.arch }}-${{ inputs.python-version }}-${{ hashFiles('apps/backend/requirements.txt', 'tests/requirements-test.txt') }}
-        restore-keys: |
-          uv-${{ runner.os }}-${{ runner.arch }}-${{ inputs.python-version }}-
-
-    - name: Install dependencies
-      working-directory: apps/backend
-      shell: bash
-      run: |
-        uv venv
-        uv pip install -r requirements.txt
-        if [ "${{ inputs.install-test-deps }}" == "true" ]; then
-          uv pip install -r ../../tests/requirements-test.txt
-        fi

.github/actions/submit-macos-notarization/action.yml

@@ -1,87 +0,0 @@
-name: 'Submit macOS Notarization'
-description: 'Submit a macOS DMG file for Apple notarization asynchronously'
-
-inputs:
-  apple-id:
-    description: 'Apple ID for notarization'
-    required: true
-  apple-app-specific-password:
-    description: 'Apple app-specific password'
-    required: true
-  apple-team-id:
-    description: 'Apple Team ID'
-    required: true
-  dmg-path:
-    description: 'Path to the dist directory containing the DMG file'
-    required: false
-    default: 'apps/frontend/dist'
-
-outputs:
-  notarization-id:
-    description: 'The notarization request ID'
-    value: ${{ steps.submit.outputs.notarization_id }}
-  dmg-file:
-    description: 'The DMG filename that was submitted'
-    value: ${{ steps.submit.outputs.dmg_file }}
-
-runs:
-  using: 'composite'
-  steps:
-    - name: Submit notarization (async)
-      id: submit
-      shell: bash
-      env:
-        APPLE_ID: ${{ inputs.apple-id }}
-        APPLE_APP_SPECIFIC_PASSWORD: ${{ inputs.apple-app-specific-password }}
-        APPLE_TEAM_ID: ${{ inputs.apple-team-id }}
-        DMG_PATH: ${{ inputs.dmg-path }}
-      run: |
-        if [ -z "$APPLE_ID" ]; then
-          echo "Skipping notarization: APPLE_ID not configured"
-          echo "notarization_id=" >> "$GITHUB_OUTPUT"
-          echo "dmg_file=" >> "$GITHUB_OUTPUT"
-          exit 0
-        fi
-
-        # Find the DMG file
-        DMG_FILE=$(find "$DMG_PATH" -name "*.dmg" -type f | head -1)
-        if [ -z "$DMG_FILE" ]; then
-          echo "::error::No DMG file found in $DMG_PATH"
-          exit 1
-        fi
-
-        echo "Submitting $DMG_FILE for notarization (async)..."
-
-        # Submit for notarization without waiting
-        # Capture both stdout and exit code
-        set +e
-        RESULT=$(xcrun notarytool submit "$DMG_FILE" \
-          --apple-id "$APPLE_ID" \
-          --password "$APPLE_APP_SPECIFIC_PASSWORD" \
-          --team-id "$APPLE_TEAM_ID" \
-          --no-wait \
-          --output-format json 2>&1)
-        SUBMIT_EXIT_CODE=$?
-        set -e
-
-        echo "$RESULT"
-
-        # Check if submission command itself failed (not just missing ID)
-        if [ $SUBMIT_EXIT_CODE -ne 0 ]; then
-          echo "::error::notarytool submit failed with exit code $SUBMIT_EXIT_CODE"
-          exit 1
-        fi
-
-        # Extract the notarization ID from JSON response
-        # jq is always available on macOS runners
-        NOTARIZATION_ID=$(echo "$RESULT" | jq -r '.id // empty' 2>/dev/null)
-
-        if [ -z "$NOTARIZATION_ID" ]; then
-          echo "::error::Failed to get notarization ID from response"
-          echo "Response was: $RESULT"
-          exit 1
-        fi
-
-        echo "Notarization submitted with ID: $NOTARIZATION_ID"
-        echo "notarization_id=$NOTARIZATION_ID" >> "$GITHUB_OUTPUT"
-        echo "dmg_file=$(basename "$DMG_FILE")" >> "$GITHUB_OUTPUT"

.github/dependabot.yml

@@ -1,37 +0,0 @@
-version: 2
-updates:
-  # Python dependencies
-  - package-ecosystem: pip
-    directory: /apps/backend
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 5
-    labels:
-      - dependencies
-      - python
-    commit-message:
-      prefix: "chore(deps)"
-
-  # npm dependencies
-  - package-ecosystem: npm
-    directory: /apps/frontend
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 5
-    labels:
-      - dependencies
-      - javascript
-    commit-message:
-      prefix: "chore(deps)"
-
-  # GitHub Actions
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 5
-    labels:
-      - dependencies
-      - ci
-    commit-message:
-      prefix: "ci(deps)"

.github/workflows/beta-release.yml

@@ -1,745 +0,0 @@
-name: Beta Release
-
-# Manual trigger for beta releases from develop branch
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'Beta version (e.g., 2.8.0-beta.1)'
-        required: true
-        type: string
-      dry_run:
-        description: 'Test build without creating release'
-        required: false
-        default: false
-        type: boolean
-
-jobs:
-  validate-version:
-    name: Validate beta version format
-    runs-on: ubuntu-latest
-    steps:
-      - name: Validate version format
-        run: |
-          VERSION="${{ github.event.inputs.version }}"
-
-          # Check if version matches beta semver pattern
-          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+-(beta|alpha|rc)\.[0-9]+$ ]]; then
-            echo "::error::Invalid version format: $VERSION"
-            echo "Version must match pattern: X.Y.Z-beta.N (e.g., 2.8.0-beta.1)"
-            exit 1
-          fi
-
-          echo "Valid beta version: $VERSION"
-
-  create-tag:
-    name: Create beta tag
-    needs: validate-version
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    outputs:
-      version: ${{ github.event.inputs.version }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: develop
-
-      - name: Create and push tag
-        if: ${{ github.event.inputs.dry_run != 'true' }}
-        run: |
-          VERSION="${{ github.event.inputs.version }}"
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git tag -a "v$VERSION" -m "Beta release v$VERSION"
-          git push origin "v$VERSION"
-          echo "Created tag v$VERSION"
-
-      - name: Create tag only (dry run)
-        if: ${{ github.event.inputs.dry_run == 'true' }}
-        run: |
-          VERSION="${{ github.event.inputs.version }}"
-          echo "DRY RUN: Would create tag v$VERSION"
-
-  # Intel build on Intel runner for native compilation
-  build-macos-intel:
-    needs: create-tag
-    runs-on: macos-15-intel
-    outputs:
-      notarization_id: ${{ steps.notarize.outputs.notarization-id }}
-      dmg_file: ${{ steps.notarize.outputs.dmg-file }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          # Use tag for real releases, develop branch for dry runs
-          ref: ${{ github.event.inputs.dry_run == 'true' && 'develop' || format('v{0}', needs.create-tag.outputs.version) }}
-
-      - name: Setup Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: '3.11'
-
-      - name: Setup Node.js and install dependencies
-        uses: ./.github/actions/setup-node-frontend
-
-      - name: Install Rust toolchain (for building native Python packages)
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Cache pip wheel cache (for compiled packages like real_ladybug)
-        uses: actions/cache@v5
-        with:
-          path: ~/Library/Caches/pip
-          key: pip-wheel-${{ runner.os }}-x64-${{ hashFiles('apps/backend/requirements.txt') }}
-          restore-keys: |
-            pip-wheel-${{ runner.os }}-x64-
-
-      - name: Cache bundled Python
-        uses: actions/cache@v5
-        with:
-          path: apps/frontend/python-runtime
-          key: python-bundle-${{ runner.os }}-x64-3.12.8-rust-${{ hashFiles('apps/backend/requirements.txt') }}
-          restore-keys: |
-            python-bundle-${{ runner.os }}-x64-3.12.8-rust-
-
-      - name: Build application
-        run: cd apps/frontend && npm run build
-        env:
-          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
-          SENTRY_TRACES_SAMPLE_RATE: ${{ secrets.SENTRY_TRACES_SAMPLE_RATE }}
-          SENTRY_PROFILES_SAMPLE_RATE: ${{ secrets.SENTRY_PROFILES_SAMPLE_RATE }}
-
-      - name: Package macOS (Intel)
-        run: |
-          VERSION="${{ needs.create-tag.outputs.version }}"
-          cd apps/frontend && npm run package:mac -- --x64 --config.extraMetadata.version="$VERSION"
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CSC_LINK: ${{ secrets.MAC_CERTIFICATE }}
-          CSC_KEY_PASSWORD: ${{ secrets.MAC_CERTIFICATE_PASSWORD }}
-          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
-          SENTRY_TRACES_SAMPLE_RATE: ${{ secrets.SENTRY_TRACES_SAMPLE_RATE }}
-          SENTRY_PROFILES_SAMPLE_RATE: ${{ secrets.SENTRY_PROFILES_SAMPLE_RATE }}
-
-      - name: Submit notarization (async)
-        id: notarize
-        uses: ./.github/actions/submit-macos-notarization
-        with:
-          apple-id: ${{ secrets.APPLE_ID }}
-          apple-app-specific-password: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
-          apple-team-id: ${{ secrets.APPLE_TEAM_ID }}
-
-      - name: Upload artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: macos-intel-builds
-          path: |
-            apps/frontend/dist/*.dmg
-            apps/frontend/dist/*.zip
-            apps/frontend/dist/*.yml
-
-  # Apple Silicon build on ARM64 runner for native compilation
-  build-macos-arm64:
-    needs: create-tag
-    runs-on: macos-15
-    outputs:
-      notarization_id: ${{ steps.notarize.outputs.notarization-id }}
-      dmg_file: ${{ steps.notarize.outputs.dmg-file }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          # Use tag for real releases, develop branch for dry runs
-          ref: ${{ github.event.inputs.dry_run == 'true' && 'develop' || format('v{0}', needs.create-tag.outputs.version) }}
-
-      - name: Setup Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: '3.11'
-
-      - name: Setup Node.js and install dependencies
-        uses: ./.github/actions/setup-node-frontend
-
-      - name: Cache pip wheel cache
-        uses: actions/cache@v5
-        with:
-          path: ~/Library/Caches/pip
-          key: pip-wheel-${{ runner.os }}-arm64-${{ hashFiles('apps/backend/requirements.txt') }}
-          restore-keys: |
-            pip-wheel-${{ runner.os }}-arm64-
-
-      - name: Cache bundled Python
-        uses: actions/cache@v5
-        with:
-          path: apps/frontend/python-runtime
-          key: python-bundle-${{ runner.os }}-arm64-3.12.8-${{ hashFiles('apps/backend/requirements.txt') }}
-          restore-keys: |
-            python-bundle-${{ runner.os }}-arm64-3.12.8-
-
-      - name: Build application
-        run: cd apps/frontend && npm run build
-        env:
-          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
-          SENTRY_TRACES_SAMPLE_RATE: ${{ secrets.SENTRY_TRACES_SAMPLE_RATE }}
-          SENTRY_PROFILES_SAMPLE_RATE: ${{ secrets.SENTRY_PROFILES_SAMPLE_RATE }}
-
-      - name: Package macOS (Apple Silicon)
-        run: |
-          VERSION="${{ needs.create-tag.outputs.version }}"
-          cd apps/frontend && npm run package:mac -- --arm64 --config.extraMetadata.version="$VERSION"
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CSC_LINK: ${{ secrets.MAC_CERTIFICATE }}
-          CSC_KEY_PASSWORD: ${{ secrets.MAC_CERTIFICATE_PASSWORD }}
-          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
-          SENTRY_TRACES_SAMPLE_RATE: ${{ secrets.SENTRY_TRACES_SAMPLE_RATE }}
-          SENTRY_PROFILES_SAMPLE_RATE: ${{ secrets.SENTRY_PROFILES_SAMPLE_RATE }}
-
-      - name: Submit notarization (async)
-        id: notarize
-        uses: ./.github/actions/submit-macos-notarization
-        with:
-          apple-id: ${{ secrets.APPLE_ID }}
-          apple-app-specific-password: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
-          apple-team-id: ${{ secrets.APPLE_TEAM_ID }}
-
-      - name: Upload artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: macos-arm64-builds
-          path: |
-            apps/frontend/dist/*.dmg
-            apps/frontend/dist/*.zip
-            apps/frontend/dist/*.yml
-
-  build-windows:
-    needs: create-tag
-    runs-on: windows-latest
-    permissions:
-      id-token: write  # Required for OIDC authentication with Azure
-      contents: read
-    env:
-      # Job-level env so AZURE_CLIENT_ID is available for step-level if conditions
-      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          # Use tag for real releases, develop branch for dry runs
-          ref: ${{ github.event.inputs.dry_run == 'true' && 'develop' || format('v{0}', needs.create-tag.outputs.version) }}
-
-      - name: Setup Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: '3.11'
-
-      - name: Setup Node.js and install dependencies
-        uses: ./.github/actions/setup-node-frontend
-
-      - name: Cache pip wheel cache
-        uses: actions/cache@v5
-        with:
-          path: ~\AppData\Local\pip\Cache
-          key: pip-wheel-${{ runner.os }}-x64-${{ hashFiles('apps/backend/requirements.txt') }}
-          restore-keys: |
-            pip-wheel-${{ runner.os }}-x64-
-
-      - name: Cache bundled Python
-        uses: actions/cache@v5
-        with:
-          path: apps/frontend/python-runtime
-          key: python-bundle-${{ runner.os }}-x64-3.12.8-${{ hashFiles('apps/backend/requirements.txt') }}
-          restore-keys: |
-            python-bundle-${{ runner.os }}-x64-3.12.8-
-
-      - name: Build application
-        run: cd apps/frontend && npm run build
-        env:
-          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
-          SENTRY_TRACES_SAMPLE_RATE: ${{ secrets.SENTRY_TRACES_SAMPLE_RATE }}
-          SENTRY_PROFILES_SAMPLE_RATE: ${{ secrets.SENTRY_PROFILES_SAMPLE_RATE }}
-
-      - name: Package Windows
-        shell: bash
-        run: |
-          VERSION="${{ needs.create-tag.outputs.version }}"
-          cd apps/frontend && npm run package:win -- --config.extraMetadata.version="$VERSION"
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # Disable electron-builder's built-in signing (we use Azure Trusted Signing instead)
-          CSC_IDENTITY_AUTO_DISCOVERY: false
-          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
-          SENTRY_TRACES_SAMPLE_RATE: ${{ secrets.SENTRY_TRACES_SAMPLE_RATE }}
-          SENTRY_PROFILES_SAMPLE_RATE: ${{ secrets.SENTRY_PROFILES_SAMPLE_RATE }}
-
-      - name: Azure Login (OIDC)
-        if: env.AZURE_CLIENT_ID != ''
-        uses: azure/login@v2
-        with:
-          client-id: ${{ secrets.AZURE_CLIENT_ID }}
-          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
-          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-
-      - name: Sign Windows executable with Azure Trusted Signing
-        if: env.AZURE_CLIENT_ID != ''
-        uses: azure/trusted-signing-action@v0.5.11
-        with:
-          endpoint: https://neu.codesigning.azure.net/
-          trusted-signing-account-name: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
-          certificate-profile-name: ${{ secrets.AZURE_CERTIFICATE_PROFILE }}
-          files-folder: apps/frontend/dist
-          files-folder-filter: exe
-          file-digest: SHA256
-          timestamp-rfc3161: http://timestamp.acs.microsoft.com
-          timestamp-digest: SHA256
-
-      - name: Verify Windows executable is signed
-        if: env.AZURE_CLIENT_ID != ''
-        shell: pwsh
-        run: |
-          cd apps/frontend/dist
-          $exeFile = Get-ChildItem -Filter "*.exe" | Select-Object -First 1
-          if ($exeFile) {
-            Write-Host "Verifying signature on $($exeFile.Name)..."
-            $sig = Get-AuthenticodeSignature -FilePath $exeFile.FullName
-            if ($sig.Status -ne 'Valid') {
-              Write-Host "::error::Signature verification failed: $($sig.Status)"
-              Write-Host "::error::Status Message: $($sig.StatusMessage)"
-              exit 1
-            }
-            Write-Host "✅ Signature verified successfully"
-            Write-Host "  Subject: $($sig.SignerCertificate.Subject)"
-            Write-Host "  Issuer: $($sig.SignerCertificate.Issuer)"
-            Write-Host "  Thumbprint: $($sig.SignerCertificate.Thumbprint)"
-          } else {
-            Write-Host "::error::No .exe file found to verify"
-            exit 1
-          }
-
-      - name: Regenerate checksums after signing
-        if: env.AZURE_CLIENT_ID != ''
-        shell: pwsh
-        run: |
-          $ErrorActionPreference = "Stop"
-          cd apps/frontend/dist
-
-          # Find the installer exe (electron-builder names it with "Setup" or just the app name)
-          # electron-builder produces one installer exe per build
-          $exeFiles = Get-ChildItem -Filter "*.exe"
-          if ($exeFiles.Count -eq 0) {
-            Write-Host "::error::No .exe files found in dist folder"
-            exit 1
-          }
-
-          Write-Host "Found $($exeFiles.Count) exe file(s): $($exeFiles.Name -join ', ')"
-
-          $ymlFile = "latest.yml"
-          if (-not (Test-Path $ymlFile)) {
-            Write-Host "::error::$ymlFile not found - cannot update checksums"
-            exit 1
-          }
-
-          $content = Get-Content $ymlFile -Raw
-          $originalContent = $content
-
-          # Process each exe file and update its hash in latest.yml
-          foreach ($exeFile in $exeFiles) {
-            Write-Host "Processing $($exeFile.Name)..."
-
-            # Compute SHA512 hash and convert to base64 (electron-builder format)
-            $bytes = [System.IO.File]::ReadAllBytes($exeFile.FullName)
-            $sha512 = [System.Security.Cryptography.SHA512]::Create()
-            $hashBytes = $sha512.ComputeHash($bytes)
-            $hash = [System.Convert]::ToBase64String($hashBytes)
-            $size = $exeFile.Length
-
-            Write-Host "  Hash: $hash"
-            Write-Host "  Size: $size"
-          }
-
-          # For electron-builder, latest.yml has a single file entry for the installer
-          # Update the sha512 and size for the primary exe (first one, typically the installer)
-          $primaryExe = $exeFiles | Select-Object -First 1
-          $bytes = [System.IO.File]::ReadAllBytes($primaryExe.FullName)
-          $sha512 = [System.Security.Cryptography.SHA512]::Create()
-          $hashBytes = $sha512.ComputeHash($bytes)
-          $hash = [System.Convert]::ToBase64String($hashBytes)
-          $size = $primaryExe.Length
-
-          # Update sha512 hash (base64 pattern: alphanumeric, +, /, =)
-          $content = $content -replace 'sha512: [A-Za-z0-9+/=]+', "sha512: $hash"
-          # Update size
-          $content = $content -replace 'size: \d+', "size: $size"
-
-          if ($content -eq $originalContent) {
-            Write-Host "::error::Checksum replacement failed - content unchanged. Check if latest.yml format has changed."
-            exit 1
-          }
-
-          Set-Content -Path $ymlFile -Value $content -NoNewline
-          Write-Host "✅ Updated $ymlFile with new base64 hash and size for $($primaryExe.Name)"
-
-      - name: Skip signing notice
-        if: env.AZURE_CLIENT_ID == ''
-        run: echo "::warning::Windows signing skipped - AZURE_CLIENT_ID not configured. The .exe will be unsigned."
-
-      - name: Upload artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: windows-builds
-          path: |
-            apps/frontend/dist/*.exe
-            apps/frontend/dist/*.yml
-
-  build-linux:
-    needs: create-tag
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          # Use tag for real releases, develop branch for dry runs
-          ref: ${{ github.event.inputs.dry_run == 'true' && 'develop' || format('v{0}', needs.create-tag.outputs.version) }}
-
-      - name: Setup Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: '3.11'
-
-      - name: Setup Node.js and install dependencies
-        uses: ./.github/actions/setup-node-frontend
-
-      - name: Setup Flatpak and verification tools
-        run: |
-          set -e
-          sudo apt-get update
-          sudo apt-get install -y flatpak flatpak-builder libarchive-tools
-          flatpak remote-add --user --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
-          flatpak install -y --user flathub org.freedesktop.Platform//25.08 org.freedesktop.Sdk//25.08
-          flatpak install -y --user flathub org.electronjs.Electron2.BaseApp//25.08
-
-      - name: Cache pip wheel cache
-        uses: actions/cache@v5
-        with:
-          path: ~/.cache/pip
-          key: pip-wheel-${{ runner.os }}-x64-${{ hashFiles('apps/backend/requirements.txt') }}
-          restore-keys: |
-            pip-wheel-${{ runner.os }}-x64-
-
-      - name: Cache bundled Python
-        uses: actions/cache@v5
-        with:
-          path: apps/frontend/python-runtime
-          key: python-bundle-${{ runner.os }}-x64-3.12.8-${{ hashFiles('apps/backend/requirements.txt') }}
-          restore-keys: |
-            python-bundle-${{ runner.os }}-x64-3.12.8-
-
-      - name: Build application
-        run: cd apps/frontend && npm run build
-        env:
-          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
-          SENTRY_TRACES_SAMPLE_RATE: ${{ secrets.SENTRY_TRACES_SAMPLE_RATE }}
-          SENTRY_PROFILES_SAMPLE_RATE: ${{ secrets.SENTRY_PROFILES_SAMPLE_RATE }}
-
-      - name: Package Linux
-        run: |
-          VERSION="${{ needs.create-tag.outputs.version }}"
-          cd apps/frontend && npm run package:linux -- --config.extraMetadata.version="$VERSION"
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
-          SENTRY_TRACES_SAMPLE_RATE: ${{ secrets.SENTRY_TRACES_SAMPLE_RATE }}
-          SENTRY_PROFILES_SAMPLE_RATE: ${{ secrets.SENTRY_PROFILES_SAMPLE_RATE }}
-
-      - name: Verify Linux packages
-        run: cd apps/frontend && npm run verify:linux
-
-      - name: Upload artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: linux-builds
-          path: |
-            apps/frontend/dist/*.AppImage
-            apps/frontend/dist/*.deb
-            apps/frontend/dist/*.flatpak
-            apps/frontend/dist/*.yml
-
-  # Finalize macOS notarization (runs in parallel with Windows/Linux builds)
-  finalize-notarization:
-    needs: [build-macos-intel, build-macos-arm64]
-    runs-on: macos-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Download Intel DMG
-        uses: actions/download-artifact@v7
-        with:
-          name: macos-intel-builds
-          path: intel
-
-      - name: Download ARM64 DMG
-        uses: actions/download-artifact@v7
-        with:
-          name: macos-arm64-builds
-          path: arm64
-
-      - name: Wait for notarization and staple
-        uses: ./.github/actions/finalize-macos-notarization
-        with:
-          apple-id: ${{ secrets.APPLE_ID }}
-          apple-app-specific-password: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
-          apple-team-id: ${{ secrets.APPLE_TEAM_ID }}
-          intel-notarization-id: ${{ needs.build-macos-intel.outputs.notarization_id }}
-          arm64-notarization-id: ${{ needs.build-macos-arm64.outputs.notarization_id }}
-          intel-dmg-file: ${{ needs.build-macos-intel.outputs.dmg_file }}
-          arm64-dmg-file: ${{ needs.build-macos-arm64.outputs.dmg_file }}
-
-      - name: Upload stapled Intel DMG
-        uses: actions/upload-artifact@v4
-        with:
-          name: macos-intel-stapled
-          path: intel/*.dmg
-
-      - name: Upload stapled ARM64 DMG
-        uses: actions/upload-artifact@v4
-        with:
-          name: macos-arm64-stapled
-          path: arm64/*.dmg
-
-  create-release:
-    needs: [create-tag, finalize-notarization, build-windows, build-linux]
-    runs-on: ubuntu-latest
-    if: ${{ github.event.inputs.dry_run != 'true' }}
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: v${{ needs.create-tag.outputs.version }}
-          fetch-depth: 0
-
-      - name: Download all artifacts
-        uses: actions/download-artifact@v7
-        with:
-          path: dist
-
-      - name: Flatten binary artifacts
-        run: |
-          mkdir -p release-assets
-
-          # Copy stapled macOS DMGs (from finalize-notarization job)
-          # Validate that stapled DMGs exist before copying
-          if ! find dist/macos-intel-stapled dist/macos-arm64-stapled -type f -name "*.dmg" 2>/dev/null | grep -q .; then
-            echo "::warning::No stapled DMGs found. Using un-stapled DMGs from build artifacts."
-            find dist/macos-intel-builds dist/macos-arm64-builds -type f -name "*.dmg" -exec cp {} release-assets/ \; 2>/dev/null || true
-          else
-            find dist/macos-intel-stapled dist/macos-arm64-stapled -type f -name "*.dmg" -exec cp {} release-assets/ \; 2>/dev/null || true
-          fi
-
-          # Copy other macOS artifacts (zip, yml, blockmap for delta updates) from original build
-          find dist/macos-intel-builds dist/macos-arm64-builds -type f \( -name "*.zip" -o -name "*.yml" -o -name "*.blockmap" \) -exec cp {} release-assets/ \; 2>/dev/null || true
-
-          # Copy Windows and Linux artifacts (including blockmap for delta updates)
-          find dist/windows-builds dist/linux-builds -type f \( -name "*.exe" -o -name "*.AppImage" -o -name "*.deb" -o -name "*.flatpak" -o -name "*.yml" -o -name "*.blockmap" \) -exec cp {} release-assets/ \; 2>/dev/null || true
-
-          # Validate that at least one artifact was copied
-          artifact_count=$(find release-assets -type f \( -name "*.dmg" -o -name "*.zip" -o -name "*.exe" -o -name "*.AppImage" -o -name "*.deb" -o -name "*.flatpak" \) | wc -l)
-          if [ "$artifact_count" -eq 0 ]; then
-            echo "::error::No build artifacts found! Expected .dmg, .zip, .exe, .AppImage, .deb, or .flatpak files."
-            exit 1
-          fi
-
-          echo "Found $artifact_count binary artifact(s):"
-          ls -la release-assets/
-
-      # Merge macOS manifests from Intel and ARM64 builds
-      # See: https://github.com/electron-userland/electron-builder/issues/5592
-      - name: Merge macOS manifests
-        uses: ./.github/actions/merge-macos-manifests
-        with:
-          dist-path: dist
-          output-path: release-assets
-          copy-other-manifests: 'true'
-
-      - name: Rename and validate beta manifests
-        run: |
-          cd release-assets
-
-          echo "=== Current manifest files ==="
-          ls -la *.yml 2>/dev/null || echo "No yml files found yet"
-
-          # electron-builder generates latest*.yml files by default
-          # For beta channel, electron-updater expects beta*.yml files
-          # Rename: latest.yml -> beta.yml, latest-mac.yml -> beta-mac.yml, latest-linux.yml -> beta-linux.yml
-
-          # Windows: latest.yml -> beta.yml
-          if [ -f "latest.yml" ]; then
-            echo "Renaming latest.yml -> beta.yml (Windows)"
-            mv latest.yml beta.yml
-          fi
-
-          # macOS: latest-mac.yml -> beta-mac.yml
-          if [ -f "latest-mac.yml" ]; then
-            echo "Renaming latest-mac.yml -> beta-mac.yml (macOS)"
-            mv latest-mac.yml beta-mac.yml
-          fi
-
-          # Linux: latest-linux.yml -> beta-linux.yml
-          if [ -f "latest-linux.yml" ]; then
-            echo "Renaming latest-linux.yml -> beta-linux.yml (Linux)"
-            mv latest-linux.yml beta-linux.yml
-          fi
-
-          # Linux ARM64: latest-linux-arm64.yml -> beta-linux-arm64.yml (if exists)
-          if [ -f "latest-linux-arm64.yml" ]; then
-            echo "Renaming latest-linux-arm64.yml -> beta-linux-arm64.yml (Linux ARM64)"
-            mv latest-linux-arm64.yml beta-linux-arm64.yml
-          fi
-
-          echo ""
-          echo "=== Beta manifest files after rename ==="
-          ls -la *.yml 2>/dev/null || echo "No yml files found"
-
-          # Validate required beta manifests exist
-          missing_manifests=""
-
-          if [ ! -f "beta-mac.yml" ]; then
-            missing_manifests="$missing_manifests beta-mac.yml"
-          fi
-
-          if [ ! -f "beta.yml" ]; then
-            missing_manifests="$missing_manifests beta.yml"
-          fi
-
-          if [ ! -f "beta-linux.yml" ]; then
-            missing_manifests="$missing_manifests beta-linux.yml"
-          fi
-
-          if [ -n "$missing_manifests" ]; then
-            echo "::error::Missing required beta manifests:$missing_manifests"
-            echo "::error::Auto-update will fail on affected platforms without these files!"
-            exit 1
-          fi
-
-          echo ""
-          echo "All required beta manifests present:"
-          echo "  - beta-mac.yml (macOS)"
-          echo "  - beta.yml (Windows)"
-          echo "  - beta-linux.yml (Linux)"
-
-      - name: Generate checksums
-        run: |
-          cd release-assets
-          sha256sum ./* > checksums.sha256
-          cat checksums.sha256
-
-      - name: Create Beta Release
-        uses: softprops/action-gh-release@v2
-        with:
-          tag_name: v${{ needs.create-tag.outputs.version }}
-          name: v${{ needs.create-tag.outputs.version }} (Beta)
-          body: |
-            ## Beta Release v${{ needs.create-tag.outputs.version }}
-
-            This is a **beta release** for testing new features. It may contain bugs or incomplete functionality.
-
-            ### How to opt-in to beta updates
-            1. Open Auto Claude
-            2. Go to Settings > Updates
-            3. Enable "Beta Updates" toggle
-
-            ### Reporting Issues
-            Please report any issues at https://github.com/AndyMik90/Auto-Claude/issues
-
-            ---
-
-            **Full Changelog**: https://github.com/${{ github.repository }}/compare/main...v${{ needs.create-tag.outputs.version }}
-          files: release-assets/*
-          draft: false
-          prerelease: true
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-  dry-run-summary:
-    needs: [create-tag, finalize-notarization, build-windows, build-linux]
-    runs-on: ubuntu-latest
-    if: ${{ github.event.inputs.dry_run == 'true' }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Download all artifacts
-        uses: actions/download-artifact@v7
-        with:
-          path: dist
-
-      - name: Flatten binary artifacts
-        run: |
-          mkdir -p release-assets
-
-          # Copy stapled macOS DMGs (from finalize-notarization job)
-          find dist/macos-intel-stapled dist/macos-arm64-stapled -type f -name "*.dmg" -exec cp {} release-assets/ \; 2>/dev/null || true
-
-          # Copy other macOS artifacts (zip, yml, blockmap for delta updates) from original build
-          find dist/macos-intel-builds dist/macos-arm64-builds -type f \( -name "*.zip" -o -name "*.yml" -o -name "*.blockmap" \) -exec cp {} release-assets/ \; 2>/dev/null || true
-
-          # Copy Windows and Linux artifacts (including blockmap for delta updates)
-          find dist/windows-builds dist/linux-builds -type f \( -name "*.exe" -o -name "*.AppImage" -o -name "*.deb" -o -name "*.flatpak" -o -name "*.yml" -o -name "*.blockmap" \) -exec cp {} release-assets/ \; 2>/dev/null || true
-
-      # Merge macOS manifests (same logic as real release)
-      - name: Merge macOS manifests
-        uses: ./.github/actions/merge-macos-manifests
-        with:
-          dist-path: dist
-          output-path: release-assets
-          copy-other-manifests: 'true'
-
-      - name: Validate and rename beta manifests
-        run: |
-          cd release-assets
-
-          # Rename latest*.yml to beta*.yml
-          [ -f "latest.yml" ] && mv latest.yml beta.yml
-          [ -f "latest-mac.yml" ] && mv latest-mac.yml beta-mac.yml
-          [ -f "latest-linux.yml" ] && mv latest-linux.yml beta-linux.yml
-          [ -f "latest-linux-arm64.yml" ] && mv latest-linux-arm64.yml beta-linux-arm64.yml
-
-          # Validate required manifests
-          missing=""
-          [ ! -f "beta-mac.yml" ] && missing="$missing beta-mac.yml"
-          [ ! -f "beta.yml" ] && missing="$missing beta.yml"
-          [ ! -f "beta-linux.yml" ] && missing="$missing beta-linux.yml"
-
-          if [ -n "$missing" ]; then
-            echo "::warning::DRY RUN: Missing required beta manifests:$missing"
-            echo "MANIFEST_STATUS=FAILED" >> $GITHUB_ENV
-          else
-            echo "MANIFEST_STATUS=PASSED" >> $GITHUB_ENV
-
-            # Show merged manifest content for verification
-            echo ""
-            echo "=== beta-mac.yml content (should have both architectures) ==="
-            cat beta-mac.yml
-          fi
-
-      - name: Dry run summary
-        run: |
-          echo "## Beta Release Dry Run Complete" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Version:** ${{ needs.create-tag.outputs.version }}" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-
-          echo "### Build Artifacts" >> $GITHUB_STEP_SUMMARY
-          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-          find dist -type f \( -name "*.dmg" -o -name "*.zip" -o -name "*.exe" -o -name "*.AppImage" -o -name "*.deb" -o -name "*.flatpak" \) >> $GITHUB_STEP_SUMMARY
-          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-
-          echo "### Update Manifests (Required for Auto-Update)" >> $GITHUB_STEP_SUMMARY
-          if [ "$MANIFEST_STATUS" = "PASSED" ]; then
-            echo "All required beta manifests present:" >> $GITHUB_STEP_SUMMARY
-            echo "- beta-mac.yml (macOS)" >> $GITHUB_STEP_SUMMARY
-            echo "- beta.yml (Windows)" >> $GITHUB_STEP_SUMMARY
-            echo "- beta-linux.yml (Linux)" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "**WARNING: Missing required manifests! Auto-update will fail.**" >> $GITHUB_STEP_SUMMARY
-            echo "Check build logs for details." >> $GITHUB_STEP_SUMMARY
-          fi
-          echo "" >> $GITHUB_STEP_SUMMARY
-
-          echo "To create a real release, run this workflow again with dry_run unchecked." >> $GITHUB_STEP_SUMMARY

.github/workflows/build-prebuilds.yml

@@ -10,11 +10,11 @@ on:
       electron_version:
         description: 'Electron version to build for'
         required: false
-        default: '40.0.0'
+        default: '39.2.6'
 
 env:
   # Default Electron version - update when upgrading Electron in package.json
-  ELECTRON_VERSION: ${{ github.event.inputs.electron_version || '40.0.0' }}
+  ELECTRON_VERSION: ${{ github.event.inputs.electron_version || '39.2.6' }}
 
 jobs:
   build-windows:
@@ -30,19 +30,24 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v4
         with:
-          node-version: '24'
+          node-version: '20'
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
 
       - name: Install Visual Studio Build Tools
         uses: microsoft/setup-msbuild@v2
 
       - name: Install node-pty and rebuild for Electron
-        working-directory: apps/frontend
+        working-directory: auto-claude-ui
         shell: pwsh
         run: |
           # Install only node-pty
-          npm install node-pty@1.1.0-beta42
+          pnpm add node-pty@1.1.0-beta42
 
           # Get Electron ABI version
           $electronAbi = (npx electron-abi $env:ELECTRON_VERSION)
@@ -52,7 +57,7 @@ jobs:
           npx @electron/rebuild --version $env:ELECTRON_VERSION --module-dir node_modules/node-pty --arch ${{ matrix.arch }}
 
       - name: Package prebuilt binaries
-        working-directory: apps/frontend
+        working-directory: auto-claude-ui
         shell: pwsh
         run: |
           $electronAbi = (npx electron-abi $env:ELECTRON_VERSION)
@@ -78,7 +83,7 @@ jobs:
           Get-ChildItem $prebuildDir
 
       - name: Create archive
-        working-directory: apps/frontend
+        working-directory: auto-claude-ui
         shell: pwsh
         run: |
           $electronAbi = (npx electron-abi $env:ELECTRON_VERSION)
@@ -93,14 +98,14 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: node-pty-win32-${{ matrix.arch }}
-          path: apps/frontend/node-pty-*.zip
+          path: auto-claude-ui/node-pty-*.zip
           retention-days: 90
 
       - name: Upload to release
         if: github.event_name == 'release'
         uses: softprops/action-gh-release@v1
         with:
-          files: apps/frontend/node-pty-*.zip
+          files: auto-claude-ui/node-pty-*.zip
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -110,7 +115,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v4
         with:
           path: artifacts
 

.github/workflows/ci.yml

@@ -1,165 +1,105 @@
-# Cross-Platform CI Pipeline
-#
-# Tests on all target platforms (Linux, Windows, macOS) to catch
-# platform-specific bugs before they merge. ALL platforms must pass.
-#
-# Optimized: Reduced matrix (4 jobs vs 6), merged integration tests,
-# coverage on Linux only, path filters to skip on docs-only changes.
-
 name: CI
 
 on:
   push:
-    branches: [main, develop]
-    paths:
-      - 'apps/**'
-      - 'tests/**'
-      - 'package*.json'
-      - 'requirements*.txt'
-      - 'pyproject.toml'
-      - 'tsconfig*.json'
-      - 'biome.jsonc'
-      - '.github/workflows/ci.yml'
-      - '.github/actions/**'
+    branches: [main]
   pull_request:
-    branches: [main, develop]
-    paths:
-      - 'apps/**'
-      - 'tests/**'
-      - 'package*.json'
-      - 'requirements*.txt'
-      - 'pyproject.toml'
-      - 'tsconfig*.json'
-      - 'biome.jsonc'
-      - '.github/workflows/ci.yml'
-      - '.github/actions/**'
-
-concurrency:
-  group: ci-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
+    branches: [main]
 
 jobs:
-  # --------------------------------------------------------------------------
-  # Python Backend Tests - Optimized Matrix (4 jobs instead of 6)
-  # --------------------------------------------------------------------------
+  # Python tests
   test-python:
-    name: test-python (${{ matrix.python-version }}, ${{ matrix.os }})
-    runs-on: ${{ matrix.os }}
-
+    runs-on: ubuntu-latest
     strategy:
-      fail-fast: false
       matrix:
-        # 3.12 on all OS for cross-platform coverage
-        # 3.13 on Linux only for compatibility check (saves 2 jobs)
-        include:
-          - os: ubuntu-latest
-            python-version: '3.12'
-          - os: ubuntu-latest
-            python-version: '3.13'
-          - os: windows-latest
-            python-version: '3.12'
-          - os: macos-latest
-            python-version: '3.12'
+        python-version: ['3.12', '3.13']
 
     steps:
-      - name: Checkout repository
+      - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Setup Python backend
-        uses: ./.github/actions/setup-python-backend
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
-          install-test-deps: 'true'
 
-      - name: Run all tests (including platform-specific)
-        working-directory: apps/backend
-        shell: bash
-        env:
-          PYTHONPATH: ${{ github.workspace }}/apps/backend
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+        with:
+          version: "latest"
+
+      - name: Install dependencies
+        working-directory: auto-claude
         run: |
-          if [ "$RUNNER_OS" == "Windows" ]; then
-            source .venv/Scripts/activate
-          else
-            source .venv/bin/activate
-          fi
-          pytest ../../tests/ -v --tb=short -x
+          uv venv
+          uv pip install -r requirements.txt
+          uv pip install -r ../tests/requirements-test.txt
 
-      - name: Run coverage (Linux + Python 3.12 only)
-        if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.12'
-        working-directory: apps/backend
-        shell: bash
-        env:
-          PYTHONPATH: ${{ github.workspace }}/apps/backend
+      - name: Run tests
+        working-directory: auto-claude
         run: |
           source .venv/bin/activate
-          pytest ../../tests/ -v --cov=. --cov-report=xml --cov-report=term-missing --cov-fail-under=10
+          pytest ../tests/ -v --tb=short -x
 
-      - name: Upload coverage to Codecov
-        if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.12'
+      - name: Run tests with coverage
+        if: matrix.python-version == '3.12'
+        working-directory: auto-claude
+        run: |
+          source .venv/bin/activate
+          pytest ../tests/ -v --cov=. --cov-report=xml --cov-report=term-missing
+
+      - name: Upload coverage reports
+        if: matrix.python-version == '3.12'
         uses: codecov/codecov-action@v4
         with:
-          file: ./apps/backend/coverage.xml
+          file: ./auto-claude/coverage.xml
           fail_ci_if_error: false
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
-  # --------------------------------------------------------------------------
-  # Frontend Tests - All Platforms
-  # --------------------------------------------------------------------------
+  # Frontend lint, typecheck, test, and build
   test-frontend:
-    name: test-frontend (${{ matrix.os }})
-    runs-on: ${{ matrix.os }}
-
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
-
+    runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
+      - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Setup Node.js frontend
-        uses: ./.github/actions/setup-node-frontend
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
         with:
-          ignore-scripts: 'true'
+          node-version: '20'
 
-      - name: Run TypeScript type check
-        working-directory: apps/frontend
-        run: npm run typecheck
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
 
-      - name: Run unit tests
-        working-directory: apps/frontend
-        run: npm run test
+      - name: Get pnpm store directory
+        id: pnpm-cache
+        run: echo "dir=$(pnpm store path)" >> "$GITHUB_OUTPUT"
 
-      - name: Build application
-        working-directory: apps/frontend
-        run: npm run build
+      - uses: actions/cache@v4
+        with:
+          path: ${{ steps.pnpm-cache.outputs.dir }}
+          key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: ${{ runner.os }}-pnpm-
 
-  # --------------------------------------------------------------------------
-  # Gate Job - Single check for branch protection
-  # --------------------------------------------------------------------------
-  ci-complete:
-    name: CI Complete
-    runs-on: ubuntu-latest
-    needs: [test-python, test-frontend]
-    if: always()
-    steps:
-      - name: Check all CI jobs passed
-        run: |
-          echo "CI Job Results:"
-          echo "  test-python:   ${{ needs.test-python.result }}"
-          echo "  test-frontend: ${{ needs.test-frontend.result }}"
-          echo ""
+      - name: Install dependencies
+        working-directory: auto-claude-ui
+        run: pnpm install --frozen-lockfile --ignore-scripts
 
-          if [[ "${{ needs.test-python.result }}" != "success" ]] || \
-             [[ "${{ needs.test-frontend.result }}" != "success" ]]; then
-            echo "❌ One or more CI jobs failed"
-            exit 1
-          fi
+      - name: Lint
+        working-directory: auto-claude-ui
+        run: pnpm run lint
 
-          echo "✅ All CI checks passed"
+      - name: Type check
+        working-directory: auto-claude-ui
+        run: pnpm run typecheck
+
+      - name: Run tests
+        working-directory: auto-claude-ui
+        run: pnpm run test
+
+      - name: Build
+        working-directory: auto-claude-ui
+        run: pnpm run build

.github/workflows/issue-auto-label.yml

@@ -1,53 +0,0 @@
-name: Issue Auto Label
-
-on:
-  issues:
-    types: [opened]
-
-jobs:
-  label-area:
-    runs-on: ubuntu-latest
-    permissions:
-      issues: write
-    steps:
-      - name: Add area label from form
-        uses: actions/github-script@v8
-        with:
-          script: |
-            const issue = context.payload.issue;
-            const body = issue.body || '';
-
-            console.log(`Processing issue #${issue.number}: ${issue.title}`);
-
-            // Map form selection to label
-            const areaMap = {
-              'Frontend': 'area/frontend',
-              'Backend': 'area/backend',
-              'Fullstack': 'area/fullstack'
-            };
-
-            const labels = [];
-
-            for (const [key, label] of Object.entries(areaMap)) {
-              if (body.includes(key)) {
-                console.log(`Found area: ${key}, adding label: ${label}`);
-                labels.push(label);
-                break;
-              }
-            }
-
-            if (labels.length > 0) {
-              try {
-                await github.rest.issues.addLabels({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  issue_number: issue.number,
-                  labels: labels
-                });
-                console.log(`Successfully added labels: ${labels.join(', ')}`);
-              } catch (error) {
-                core.setFailed(`Failed to add labels: ${error.message}`);
-              }
-            } else {
-              console.log('No matching area found in issue body');
-            }

.github/workflows/lint.yml

@@ -2,88 +2,57 @@ name: Lint
 
 on:
   push:
-    branches: [main, develop]
-    paths:
-      - 'apps/**'
-      - 'tests/**'
-      - '.github/workflows/lint.yml'
-      - '.github/actions/**'
-      - 'apps/frontend/biome.jsonc'
-      - '.pre-commit-config.yaml'
+    branches: [main]
   pull_request:
-    branches: [main, develop]
-    paths:
-      - 'apps/**'
-      - 'tests/**'
-      - '.github/workflows/lint.yml'
-      - '.github/actions/**'
-      - 'apps/frontend/biome.jsonc'
-      - '.pre-commit-config.yaml'
-
-concurrency:
-  group: lint-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+    branches: [main]
 
 jobs:
-  # Python linting (Ruff) - already fast, no changes needed
+  # Python linting
   python:
-    name: Python (Ruff)
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v5
         with:
           python-version: '3.12'
 
-      # Pin ruff version to match .pre-commit-config.yaml
       - name: Install ruff
-        run: pip install ruff==0.14.10
+        run: pip install ruff
 
       - name: Run ruff check
-        run: ruff check apps/backend/ --output-format=github
+        run: ruff check auto-claude/ --output-format=github
 
       - name: Run ruff format check
-        run: ruff format apps/backend/ --check --diff
+        run: ruff format auto-claude/ --check --diff
 
-  # TypeScript/JavaScript linting (Biome) - 15-25x faster than ESLint
-  typescript:
-    name: TypeScript (Biome)
+  # TypeScript/React linting
+  frontend:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      # Pin version to match package.json for consistent behavior
-      - name: Setup Biome
-        uses: biomejs/setup-biome@v2
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
         with:
-          version: 2.3.11
+          node-version: '20'
 
-      - name: Run Biome
-        working-directory: apps/frontend
-        # biome ci fails on errors by default; warnings are reported but don't block
-        # Use --error-on-warnings when ready to enforce all rules
-        run: biome ci .
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
 
-  # --------------------------------------------------------------------------
-  # Gate Job - Single check for branch protection
-  # --------------------------------------------------------------------------
-  lint-complete:
-    name: Lint Complete
-    runs-on: ubuntu-latest
-    needs: [python, typescript]
-    if: always()
-    steps:
-      - name: Check lint results
-        run: |
-          if [[ "${{ needs.python.result }}" != "success" ]] || \
-             [[ "${{ needs.typescript.result }}" != "success" ]]; then
-            echo "❌ Linting failed"
-            echo "  Python:     ${{ needs.python.result }}"
-            echo "  TypeScript: ${{ needs.typescript.result }}"
-            exit 1
-          fi
-          echo "✅ All linting passed"
+      - name: Install dependencies
+        working-directory: auto-claude-ui
+        run: pnpm install --frozen-lockfile --ignore-scripts
+
+      - name: Run ESLint
+        working-directory: auto-claude-ui
+        run: pnpm lint
+
+      - name: Run TypeScript check
+        working-directory: auto-claude-ui
+        run: pnpm typecheck

.github/workflows/pr-labeler.yml

@@ -1,299 +0,0 @@
-name: PR Labeler
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened]
-
-concurrency:
-  group: pr-labeler-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  pull-requests: write
-
-jobs:
-  label:
-    name: Auto Label PR
-    runs-on: ubuntu-latest
-    # Security: Prevent fork PRs from modifying labels (they don't have write access)
-    if: github.event.pull_request.head.repo.full_name == github.repository
-    timeout-minutes: 5
-
-    steps:
-      - name: Label PR
-        uses: actions/github-script@v8
-        with:
-          retries: 3
-          retry-exempt-status-codes: 400,401,403,404,422
-          script: |
-            // ═══════════════════════════════════════════════════════════════
-            // CONFIGURATION - Single source of truth for all settings
-            // ═══════════════════════════════════════════════════════════════
-
-            const CONFIG = {
-              // Size thresholds (lines changed)
-              SIZE_THRESHOLDS: {
-                XS: 10,
-                S: 100,
-                M: 500,
-                L: 1000
-              },
-
-              // Conventional commit type mappings
-              TYPE_MAP: Object.freeze({
-                'feat': 'feature',
-                'fix': 'bug',
-                'docs': 'documentation',
-                'refactor': 'refactor',
-                'test': 'test',
-                'ci': 'ci',
-                'chore': 'chore',
-                'perf': 'performance',
-                'style': 'style',
-                'build': 'build'
-              }),
-
-              // Area detection paths
-              AREA_PATHS: Object.freeze({
-                frontend: 'apps/frontend/',
-                backend: 'apps/backend/',
-                ci: '.github/'
-              }),
-
-              // Label definitions
-              LABELS: Object.freeze({
-                SIZE: ['size/XS', 'size/S', 'size/M', 'size/L', 'size/XL'],
-                AREA: ['area/frontend', 'area/backend', 'area/fullstack', 'area/ci']
-              }),
-
-              // Pagination
-              MAX_FILES_PER_PAGE: 100
-            };
-
-            // ═══════════════════════════════════════════════════════════════
-            // HELPER FUNCTIONS - Small, focused, single responsibility
-            // ═══════════════════════════════════════════════════════════════
-
-            /**
-             * Safely parse conventional commit type from PR title
-             * @param {string} title - PR title
-             * @returns {{type: string|null, isBreaking: boolean}}
-             */
-            function parseConventionalCommit(title) {
-              if (!title || typeof title !== 'string') {
-                return { type: null, isBreaking: false };
-              }
-
-              // Limit input length to prevent ReDoS attacks
-              const safeTitle = title.slice(0, 200);
-              const match = safeTitle.match(/^(\w{1,20})(\([^)]{0,50}\))?(!)?:/);
-
-              if (!match) {
-                return { type: null, isBreaking: false };
-              }
-
-              return {
-                type: match[1].toLowerCase(),
-                isBreaking: match[3] === '!'
-              };
-            }
-
-            /**
-             * Determine size label based on lines changed
-             * @param {number} totalLines - Total lines changed
-             * @returns {string} Size label
-             */
-            function determineSizeLabel(totalLines) {
-              const { SIZE_THRESHOLDS } = CONFIG;
-
-              if (totalLines < SIZE_THRESHOLDS.XS) return 'size/XS';
-              if (totalLines < SIZE_THRESHOLDS.S) return 'size/S';
-              if (totalLines < SIZE_THRESHOLDS.M) return 'size/M';
-              if (totalLines < SIZE_THRESHOLDS.L) return 'size/L';
-              return 'size/XL';
-            }
-
-            /**
-             * Detect areas affected by file changes
-             * @param {Array} files - List of changed files
-             * @returns {{frontend: boolean, backend: boolean, ci: boolean}}
-             */
-            function detectAreas(files) {
-              const areas = { frontend: false, backend: false, ci: false };
-              const { AREA_PATHS } = CONFIG;
-
-              for (const file of files) {
-                const path = file.filename || '';
-                if (path.startsWith(AREA_PATHS.frontend)) areas.frontend = true;
-                if (path.startsWith(AREA_PATHS.backend)) areas.backend = true;
-                if (path.startsWith(AREA_PATHS.ci)) areas.ci = true;
-              }
-
-              return areas;
-            }
-
-            /**
-             * Determine area label based on detected areas
-             * @param {{frontend: boolean, backend: boolean, ci: boolean}} areas
-             * @returns {string|null} Area label or null
-             */
-            function determineAreaLabel(areas) {
-              if (areas.frontend && areas.backend) return 'area/fullstack';
-              if (areas.frontend) return 'area/frontend';
-              if (areas.backend) return 'area/backend';
-              if (areas.ci) return 'area/ci';
-              return null;
-            }
-
-            /**
-             * Remove labels from PR (with error handling)
-             * @param {Array} labels - Labels to remove
-             * @param {number} prNumber - PR number
-             */
-            async function removeLabels(labels, prNumber) {
-              const { owner, repo } = context.repo;
-
-              await Promise.allSettled(labels.map(async (label) => {
-                try {
-                  await github.rest.issues.removeLabel({
-                    owner,
-                    repo,
-                    issue_number: prNumber,
-                    name: label
-                  });
-                  console.log(`  ✓ Removed: ${label}`);
-                } catch (e) {
-                  // 404 means label wasn't present - that's fine
-                  if (e.status !== 404) {
-                    console.log(`  ⚠ Failed to remove ${label}: ${e.message}`);
-                  }
-                }
-              }));
-            }
-
-            /**
-             * Add labels to PR (with error handling)
-             * @param {Array} labels - Labels to add
-             * @param {number} prNumber - PR number
-             */
-            async function addLabels(labels, prNumber) {
-              if (labels.length === 0) return;
-
-              const { owner, repo } = context.repo;
-
-              try {
-                await github.rest.issues.addLabels({
-                  owner,
-                  repo,
-                  issue_number: prNumber,
-                  labels
-                });
-                console.log(`  ✓ Added: ${labels.join(', ')}`);
-              } catch (e) {
-                if (e.status === 404) {
-                  core.warning(`One or more labels do not exist. Create them in repository settings.`);
-                } else {
-                  throw e;
-                }
-              }
-            }
-
-            /**
-             * Fetch PR files with full pagination support
-             * @param {number} prNumber - PR number
-             * @returns {Array} List of all files (paginated)
-             */
-            async function fetchPRFiles(prNumber) {
-              const { owner, repo } = context.repo;
-
-              try {
-                // Use paginate to fetch ALL files, not just first 100
-                const files = await github.paginate(
-                  github.rest.pulls.listFiles,
-                  { owner, repo, pull_number: prNumber, per_page: CONFIG.MAX_FILES_PER_PAGE }
-                );
-                return files;
-              } catch (e) {
-                console.log(`  ⚠ Could not fetch files: ${e.message}`);
-                return [];
-              }
-            }
-
-            // ═══════════════════════════════════════════════════════════════
-            // MAIN LOGIC - Orchestrates the labeling process
-            // ═══════════════════════════════════════════════════════════════
-
-            const { owner, repo } = context.repo;
-            const pr = context.payload.pull_request;
-            const prNumber = pr.number;
-            const title = pr.title || '';
-
-            console.log(`::group::PR #${prNumber} - Auto-labeling`);
-            console.log(`Title: ${title.slice(0, 100)}${title.length > 100 ? '...' : ''}`);
-            console.log(`Action: ${context.payload.action}`);
-
-            const labelsToAdd = new Set();
-            const labelsToRemove = new Set();
-
-            // 1. Parse conventional commit type
-            const { type, isBreaking } = parseConventionalCommit(title);
-            if (type && CONFIG.TYPE_MAP[type]) {
-              labelsToAdd.add(CONFIG.TYPE_MAP[type]);
-              console.log(`  📝 Type: ${type} → ${CONFIG.TYPE_MAP[type]}`);
-            } else {
-              console.log(`  ℹ️ No conventional commit prefix detected`);
-            }
-
-            if (isBreaking) {
-              labelsToAdd.add('breaking-change');
-              console.log(`  ⚠️ Breaking change detected`);
-            }
-
-            // 2. Detect areas from changed files
-            const files = await fetchPRFiles(prNumber);
-            const areas = detectAreas(files);
-            const areaLabel = determineAreaLabel(areas);
-
-            if (areaLabel) {
-              labelsToAdd.add(areaLabel);
-              CONFIG.LABELS.AREA.filter(l => l !== areaLabel).forEach(l => labelsToRemove.add(l));
-              console.log(`  📁 Area: ${areaLabel.replace('area/', '')}`);
-            }
-
-            // 3. Calculate size label
-            const totalLines = (pr.additions || 0) + (pr.deletions || 0);
-            const sizeLabel = determineSizeLabel(totalLines);
-            labelsToAdd.add(sizeLabel);
-            CONFIG.LABELS.SIZE.filter(l => l !== sizeLabel).forEach(l => labelsToRemove.add(l));
-            console.log(`  📏 Size: ${sizeLabel} (${totalLines} lines)`);
-
-            console.log('::endgroup::');
-
-            // 4. Apply label changes
-            console.log(`::group::Applying labels`);
-
-            // Remove labels that should be replaced (exclude ones we're adding)
-            const removeList = [...labelsToRemove].filter(l => !labelsToAdd.has(l));
-            await removeLabels(removeList, prNumber);
-
-            // Add new labels
-            await addLabels([...labelsToAdd], prNumber);
-
-            console.log('::endgroup::');
-            console.log(`✅ PR #${prNumber} labeled successfully`);
-
-            // 5. Write job summary
-            const summaryType = type ? CONFIG.TYPE_MAP[type] || 'unknown' : 'none';
-            const summaryArea = areaLabel ? areaLabel.replace('area/', '') : 'other';
-
-            await core.summary
-              .addHeading(`PR #${prNumber} Auto-Labels`, 3)
-              .addTable([
-                [{ data: 'Category', header: true }, { data: 'Label', header: true }],
-                ['Type', summaryType],
-                ['Area', summaryArea],
-                ['Size', sizeLabel]
-              ])
-              .addRaw(`\n**Files:** ${files.length} | **Lines:** +${pr.additions || 0} / -${pr.deletions || 0}\n`)
-              .write();

.github/workflows/prepare-release.yml

@@ -1,251 +0,0 @@
-name: Prepare Release
-
-# Triggers when code is pushed to main (e.g., merging develop → main)
-# If package.json version is newer than the latest tag:
-# 1. Validates CHANGELOG.md has an entry for this version (FAILS if missing)
-# 2. Extracts release notes from CHANGELOG.md
-# 3. Creates a new tag which triggers release.yml
-
-on:
-  push:
-    branches: [main]
-    paths:
-      - 'apps/frontend/package.json'
-      - 'package.json'
-  workflow_dispatch:
-    inputs:
-      force:
-        description: 'Force release even if version check fails (use with caution)'
-        required: false
-        default: false
-        type: boolean
-
-jobs:
-  check-and-tag:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    outputs:
-      should_release: ${{ steps.check.outputs.should_release }}
-      new_version: ${{ steps.check.outputs.new_version }}
-    steps:
-      # Fail fast with clear error if PAT_TOKEN is not configured
-      - name: Validate PAT_TOKEN is configured
-        run: |
-          if [ -z "${{ secrets.PAT_TOKEN }}" ]; then
-            echo "::error::PAT_TOKEN secret is not configured."
-            echo "::error::This secret is required for automatic release triggering."
-            echo "::error::See https://github.com/AndyMik90/Auto-Claude/pull/1043 for setup instructions."
-            exit 1
-          fi
-
-      # IMPORTANT: Use PAT_TOKEN instead of GITHUB_TOKEN
-      # When GITHUB_TOKEN pushes a tag, it does NOT trigger other workflows (GitHub security feature)
-      # PAT_TOKEN allows the tag push to trigger release.yml automatically
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          token: ${{ secrets.PAT_TOKEN }}
-
-      - name: Get package version
-        id: package
-        run: |
-          VERSION=$(node -p "require('./apps/frontend/package.json').version")
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "Package version: $VERSION"
-
-      - name: Get latest tag version
-        id: latest_tag
-        run: |
-          # Get the latest version tag (v*)
-          LATEST_TAG=$(git tag -l 'v*' --sort=-version:refname | head -n1)
-          if [ -z "$LATEST_TAG" ]; then
-            echo "No existing tags found"
-            echo "version=0.0.0" >> $GITHUB_OUTPUT
-          else
-            # Remove 'v' prefix
-            LATEST_VERSION=${LATEST_TAG#v}
-            echo "version=$LATEST_VERSION" >> $GITHUB_OUTPUT
-            echo "Latest tag: $LATEST_TAG (version: $LATEST_VERSION)"
-          fi
-
-      - name: Check if release needed
-        id: check
-        run: |
-          PACKAGE_VERSION="${{ steps.package.outputs.version }}"
-          LATEST_VERSION="${{ steps.latest_tag.outputs.version }}"
-          FORCE="${{ github.event.inputs.force }}"
-
-          echo "Comparing: package=$PACKAGE_VERSION vs latest_tag=$LATEST_VERSION"
-
-          # Use npx semver for proper semantic version comparison
-          # This correctly handles pre-release versions (2.7.3 > 2.7.3-beta.1)
-          if npx -y semver "$PACKAGE_VERSION" -r ">$LATEST_VERSION" > /dev/null 2>&1; then
-            echo "should_release=true" >> $GITHUB_OUTPUT
-            echo "new_version=$PACKAGE_VERSION" >> $GITHUB_OUTPUT
-            echo "✅ New release needed: v$PACKAGE_VERSION"
-          elif [ "$FORCE" = "true" ]; then
-            echo "should_release=true" >> $GITHUB_OUTPUT
-            echo "new_version=$PACKAGE_VERSION" >> $GITHUB_OUTPUT
-            echo "⚠️ Force release enabled: v$PACKAGE_VERSION"
-          else
-            echo "should_release=false" >> $GITHUB_OUTPUT
-            echo "⏭️ No release needed (package version not newer than latest tag)"
-          fi
-
-      # CRITICAL: Validate CHANGELOG.md has entry for this version BEFORE creating tag
-      - name: Validate and extract changelog
-        if: steps.check.outputs.should_release == 'true'
-        id: changelog
-        run: |
-          VERSION="${{ steps.check.outputs.new_version }}"
-          CHANGELOG_FILE="CHANGELOG.md"
-
-          echo "🔍 Validating CHANGELOG.md for version $VERSION..."
-
-          if [ ! -f "$CHANGELOG_FILE" ]; then
-            echo "::error::CHANGELOG.md not found! Please create CHANGELOG.md with release notes."
-            exit 1
-          fi
-
-          # Extract changelog section for this version
-          # Looks for "## X.Y.Z" header and captures until next "## " or "---" or end
-          CHANGELOG_CONTENT=$(awk -v ver="$VERSION" '
-            BEGIN { found=0; content="" }
-            /^## / {
-              if (found) exit
-              # Match version at start of header (e.g., "## 2.7.3 -" or "## 2.7.3")
-              if ($2 == ver || $2 ~ "^"ver"[[:space:]]*-") {
-                found=1
-                # Skip the header line itself, we will add our own
-                next
-              }
-            }
-            /^---$/ { if (found) exit }
-            found { content = content $0 "\n" }
-            END {
-              if (!found) {
-                print "NOT_FOUND"
-                exit 1
-              }
-              # Trim leading/trailing whitespace
-              gsub(/^[[:space:]]+|[[:space:]]+$/, "", content)
-              print content
-            }
-          ' "$CHANGELOG_FILE")
-
-          if [ "$CHANGELOG_CONTENT" = "NOT_FOUND" ] || [ -z "$CHANGELOG_CONTENT" ]; then
-            echo ""
-            echo "::error::═══════════════════════════════════════════════════════════════════════"
-            echo "::error::  CHANGELOG VALIDATION FAILED"
-            echo "::error::═══════════════════════════════════════════════════════════════════════"
-            echo "::error::"
-            echo "::error::  Version $VERSION not found in CHANGELOG.md!"
-            echo "::error::"
-            echo "::error::  Before releasing, please update CHANGELOG.md with an entry like:"
-            echo "::error::"
-            echo "::error::    ## $VERSION - Your Release Title"
-            echo "::error::"
-            echo "::error::    ### ✨ New Features"
-            echo "::error::    - Feature description"
-            echo "::error::"
-            echo "::error::    ### 🐛 Bug Fixes"
-            echo "::error::    - Fix description"
-            echo "::error::"
-            echo "::error::═══════════════════════════════════════════════════════════════════════"
-            echo ""
-
-            # Also add to job summary for visibility
-            echo "## ❌ Release Blocked: Missing Changelog" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "Version **$VERSION** was not found in CHANGELOG.md." >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "### How to fix:" >> $GITHUB_STEP_SUMMARY
-            echo "1. Update CHANGELOG.md with release notes for version $VERSION" >> $GITHUB_STEP_SUMMARY
-            echo "2. Commit and push the changes" >> $GITHUB_STEP_SUMMARY
-            echo "3. The release will automatically retry" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "### Expected format:" >> $GITHUB_STEP_SUMMARY
-            echo "\`\`\`markdown" >> $GITHUB_STEP_SUMMARY
-            echo "## $VERSION - Release Title" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "### ✨ New Features" >> $GITHUB_STEP_SUMMARY
-            echo "- Feature description" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "### 🐛 Bug Fixes" >> $GITHUB_STEP_SUMMARY
-            echo "- Fix description" >> $GITHUB_STEP_SUMMARY
-            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-
-            exit 1
-          fi
-
-          echo "✅ Found changelog entry for version $VERSION"
-          echo ""
-          echo "--- Extracted Release Notes ---"
-          echo "$CHANGELOG_CONTENT"
-          echo "--- End Release Notes ---"
-
-          # Save changelog to file for artifact upload
-          echo "$CHANGELOG_CONTENT" > changelog-extract.md
-
-          # Also save to output (for short changelogs)
-          # Using heredoc for multiline output
-          {
-            echo "content<<CHANGELOG_EOF"
-            echo "$CHANGELOG_CONTENT"
-            echo "CHANGELOG_EOF"
-          } >> $GITHUB_OUTPUT
-
-          echo "changelog_valid=true" >> $GITHUB_OUTPUT
-
-      # Upload changelog as artifact for release.yml to use
-      - name: Upload changelog artifact
-        if: steps.check.outputs.should_release == 'true' && steps.changelog.outputs.changelog_valid == 'true'
-        uses: actions/upload-artifact@v4
-        with:
-          name: changelog-${{ steps.check.outputs.new_version }}
-          path: changelog-extract.md
-          retention-days: 1
-
-      - name: Create and push tag
-        if: steps.check.outputs.should_release == 'true' && steps.changelog.outputs.changelog_valid == 'true'
-        run: |
-          VERSION="${{ steps.check.outputs.new_version }}"
-          TAG="v$VERSION"
-
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-
-          echo "Creating tag: $TAG"
-          git tag -a "$TAG" -m "Release $TAG"
-          git push origin "$TAG"
-
-          echo "✅ Tag $TAG created and pushed"
-          echo "🚀 This will trigger the release workflow"
-
-      - name: Summary
-        run: |
-          if [ "${{ steps.check.outputs.should_release }}" = "true" ] && [ "${{ steps.changelog.outputs.changelog_valid }}" = "true" ]; then
-            echo "## 🚀 Release Triggered" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "**Version:** v${{ steps.check.outputs.new_version }}" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "✅ Changelog validated and extracted from CHANGELOG.md" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "The release workflow has been triggered and will:" >> $GITHUB_STEP_SUMMARY
-            echo "1. Build binaries for all platforms" >> $GITHUB_STEP_SUMMARY
-            echo "2. Use changelog from CHANGELOG.md" >> $GITHUB_STEP_SUMMARY
-            echo "3. Create GitHub release" >> $GITHUB_STEP_SUMMARY
-            echo "4. Update README with new version" >> $GITHUB_STEP_SUMMARY
-          elif [ "${{ steps.check.outputs.should_release }}" = "false" ]; then
-            echo "## ⏭️ No Release Needed" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "**Package version:** ${{ steps.package.outputs.version }}" >> $GITHUB_STEP_SUMMARY
-            echo "**Latest tag:** v${{ steps.latest_tag.outputs.version }}" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "The package version is not newer than the latest tag." >> $GITHUB_STEP_SUMMARY
-            echo "To trigger a release, bump the version using:" >> $GITHUB_STEP_SUMMARY
-            echo "\`\`\`bash" >> $GITHUB_STEP_SUMMARY
-            echo "node scripts/bump-version.js patch  # or minor/major" >> $GITHUB_STEP_SUMMARY
-            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-          fi

.github/workflows/quality-security.yml

@@ -1,177 +0,0 @@
-name: Quality Security
-
-# CodeQL runs on all PRs, pushes to main, and weekly schedule
-# Note: CodeQL takes 20-30 min per language (40-60 min total)
-# Bandit is fast (5-10 min)
-
-on:
-  push:
-    branches: [main]
-    paths:
-      - 'apps/**'
-      - 'tests/**'
-      - 'pyproject.toml'
-      - 'package.json'
-      - '.github/workflows/quality-security.yml'
-  pull_request:
-    branches: [main, develop]
-    paths:
-      - 'apps/**'
-      - 'tests/**'
-      - 'pyproject.toml'
-      - 'package.json'
-      - '.github/workflows/quality-security.yml'
-  schedule:
-    - cron: '0 0 * * 1' # Weekly on Monday at midnight UTC
-
-concurrency:
-  group: security-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  security-events: write
-  actions: read
-
-jobs:
-  codeql:
-    name: CodeQL (${{ matrix.language }})
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [python, javascript-typescript]
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
-        with:
-          languages: ${{ matrix.language }}
-          queries: +security-extended,security-and-quality
-
-      - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
-        with:
-          category: "/language:${{ matrix.language }}"
-
-  # Bandit runs on all PRs - it's fast (5-10 min)
-  python-security:
-    name: Python Security (Bandit)
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: '3.12'
-
-      - name: Install Bandit
-        run: pip install bandit
-
-      - name: Run Bandit security scan
-        id: bandit
-        run: |
-          echo "::group::Running Bandit security scan"
-          bandit -r apps/backend/ -ll -ii -f json -o bandit-report.json || BANDIT_EXIT=$?
-          if [ "${BANDIT_EXIT:-0}" -gt 1 ]; then
-            echo "::error::Bandit scan failed with exit code $BANDIT_EXIT"
-            exit 1
-          fi
-          echo "::endgroup::"
-
-      - name: Analyze Bandit results
-        uses: actions/github-script@v8
-        with:
-          script: |
-            const fs = require('fs');
-
-            if (!fs.existsSync('bandit-report.json')) {
-              core.setFailed('Bandit report not found - scan may have failed');
-              return;
-            }
-
-            const report = JSON.parse(fs.readFileSync('bandit-report.json', 'utf8'));
-            const results = report.results || [];
-
-            const high = results.filter(r => r.issue_severity === 'HIGH');
-            const medium = results.filter(r => r.issue_severity === 'MEDIUM');
-            const low = results.filter(r => r.issue_severity === 'LOW');
-
-            console.log(`::group::Bandit Security Scan Results`);
-            console.log(`Found ${results.length} issues:`);
-            console.log(`  HIGH:   ${high.length}`);
-            console.log(`  MEDIUM: ${medium.length}`);
-            console.log(`  LOW:    ${low.length}`);
-            console.log('::endgroup::');
-
-            let summary = `## Python Security Scan (Bandit)\n\n`;
-            summary += `| Severity | Count |\n`;
-            summary += `|----------|-------|\n`;
-            summary += `| High | ${high.length} |\n`;
-            summary += `| Medium | ${medium.length} |\n`;
-            summary += `| Low | ${low.length} |\n\n`;
-
-            if (high.length > 0) {
-              summary += `### High Severity Issues\n\n`;
-              for (const issue of high) {
-                summary += `- **${issue.filename}:${issue.line_number}**\n`;
-                summary += `  - ${issue.issue_text}\n`;
-                summary += `  - Test: \`${issue.test_id}\` (${issue.test_name})\n\n`;
-              }
-            }
-
-            core.summary.addRaw(summary);
-            await core.summary.write();
-
-            if (high.length > 0) {
-              core.setFailed(`Found ${high.length} high severity security issue(s)`);
-            } else {
-              console.log('No high severity security issues found');
-            }
-
-  # --------------------------------------------------------------------------
-  # Gate Job - Single check for branch protection
-  # --------------------------------------------------------------------------
-  security-summary:
-    name: Security Summary
-    runs-on: ubuntu-latest
-    needs: [codeql, python-security]
-    if: always()
-    timeout-minutes: 5
-    steps:
-      - name: Check security results
-        uses: actions/github-script@v8
-        with:
-          script: |
-            const codeql = '${{ needs.codeql.result }}';
-            const bandit = '${{ needs.python-security.result }}';
-
-            console.log('Security Check Results:');
-            console.log(`  CodeQL:        ${codeql}`);
-            console.log(`  Bandit:        ${bandit}`);
-
-            // Only 'failure' is a real failure; 'skipped' is acceptable (e.g., path filters, PR skipping CodeQL)
-            const acceptable = ['success', 'skipped'];
-            const codeqlOk = acceptable.includes(codeql);
-            const banditOk = acceptable.includes(bandit);
-            const allPassed = codeqlOk && banditOk;
-
-            if (allPassed) {
-              console.log('\n✅ All security checks passed');
-              core.summary.addRaw('## ✅ Security Checks Passed\n\nAll security scans completed successfully.');
-            } else {
-              console.log('\n❌ Some security checks failed');
-              core.summary.addRaw('## ❌ Security Checks Failed\n\nOne or more security scans found issues.');
-              core.setFailed('Security checks failed');
-            }
-
-            await core.summary.write();

.github/workflows/release.yml

@@ -1,10 +1,4 @@
 name: Release
-# Triggers on version tags (v*) to build and publish releases
-#
-# IMPORTANT: If branch protection is enabled on 'main', the update-readme job
-# requires a PAT or GitHub App token with bypass permissions to push directly.
-# Currently uses GITHUB_TOKEN which works if "Allow GitHub Actions to create
-# and approve pull requests" is enabled OR branch protection is not configured.
 
 on:
   push:
@@ -15,7 +9,7 @@ on:
       dry_run:
         description: 'Test build without creating release'
         required: false
-        default: false
+        default: true
         type: boolean
 
 jobs:
@@ -23,424 +17,233 @@ jobs:
   # Note: macos-15-intel is the last Intel runner, supported until Fall 2027
   build-macos-intel:
     runs-on: macos-15-intel
-    outputs:
-      notarization_id: ${{ steps.notarize.outputs.notarization-id }}
-      dmg_file: ${{ steps.notarize.outputs.dmg-file }}
     steps:
       - uses: actions/checkout@v4
 
-      - name: Setup Python
-        uses: actions/setup-python@v6
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
         with:
-          python-version: '3.11'
+          node-version: '20'
 
-      - name: Setup Node.js and install dependencies
-        uses: ./.github/actions/setup-node-frontend
-
-      - name: Install Rust toolchain (for building native Python packages)
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Cache pip wheel cache (for compiled packages like real_ladybug)
-        uses: actions/cache@v5
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
         with:
-          path: ~/Library/Caches/pip
-          key: pip-wheel-${{ runner.os }}-x64-${{ hashFiles('apps/backend/requirements.txt') }}
-          restore-keys: |
-            pip-wheel-${{ runner.os }}-x64-
+          version: 10
 
-      - name: Cache bundled Python
-        uses: actions/cache@v5
+      - name: Get pnpm store directory
+        id: pnpm-cache
+        run: echo "dir=$(pnpm store path)" >> $GITHUB_OUTPUT
+
+      - uses: actions/cache@v4
         with:
-          path: apps/frontend/python-runtime
-          key: python-bundle-${{ runner.os }}-x64-3.12.8-rust-${{ hashFiles('apps/backend/requirements.txt') }}
-          restore-keys: |
-            python-bundle-${{ runner.os }}-x64-3.12.8-rust-
+          path: ${{ steps.pnpm-cache.outputs.dir }}
+          key: ${{ runner.os }}-x64-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: ${{ runner.os }}-x64-pnpm-
+
+      - name: Install dependencies
+        run: cd auto-claude-ui && pnpm install --frozen-lockfile
 
       - name: Build application
-        run: cd apps/frontend && npm run build
-        env:
-          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
-          SENTRY_TRACES_SAMPLE_RATE: ${{ secrets.SENTRY_TRACES_SAMPLE_RATE }}
-          SENTRY_PROFILES_SAMPLE_RATE: ${{ secrets.SENTRY_PROFILES_SAMPLE_RATE }}
+        run: cd auto-claude-ui && pnpm run build
 
       - name: Package macOS (Intel)
-        run: cd apps/frontend && npm run package:mac -- --x64
+        run: cd auto-claude-ui && pnpm run package:mac -- --arch=x64 -p never
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           CSC_LINK: ${{ secrets.MAC_CERTIFICATE }}
           CSC_KEY_PASSWORD: ${{ secrets.MAC_CERTIFICATE_PASSWORD }}
-          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
-          SENTRY_TRACES_SAMPLE_RATE: ${{ secrets.SENTRY_TRACES_SAMPLE_RATE }}
-          SENTRY_PROFILES_SAMPLE_RATE: ${{ secrets.SENTRY_PROFILES_SAMPLE_RATE }}
 
-      - name: Submit notarization (async)
-        id: notarize
-        uses: ./.github/actions/submit-macos-notarization
-        with:
-          apple-id: ${{ secrets.APPLE_ID }}
-          apple-app-specific-password: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
-          apple-team-id: ${{ secrets.APPLE_TEAM_ID }}
+      - name: Notarize macOS Intel app
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          if [ -z "$APPLE_ID" ]; then
+            echo "Skipping notarization: APPLE_ID not configured"
+            exit 0
+          fi
+          cd auto-claude-ui
+          for dmg in dist/*.dmg; do
+            echo "Notarizing $dmg..."
+            xcrun notarytool submit "$dmg" \
+              --apple-id "$APPLE_ID" \
+              --password "$APPLE_APP_SPECIFIC_PASSWORD" \
+              --team-id "$APPLE_TEAM_ID" \
+              --wait
+            xcrun stapler staple "$dmg"
+            echo "Successfully notarized and stapled $dmg"
+          done
 
       - name: Upload artifacts
         uses: actions/upload-artifact@v4
         with:
           name: macos-intel-builds
           path: |
-            apps/frontend/dist/*.dmg
-            apps/frontend/dist/*.zip
-            apps/frontend/dist/*.yml
-            apps/frontend/dist/*.blockmap
+            auto-claude-ui/dist/*.dmg
+            auto-claude-ui/dist/*.zip
 
   # Apple Silicon build on ARM64 runner for native compilation
   build-macos-arm64:
     runs-on: macos-15
-    outputs:
-      notarization_id: ${{ steps.notarize.outputs.notarization-id }}
-      dmg_file: ${{ steps.notarize.outputs.dmg-file }}
     steps:
       - uses: actions/checkout@v4
 
-      - name: Setup Python
-        uses: actions/setup-python@v6
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
         with:
-          python-version: '3.11'
+          node-version: '20'
 
-      - name: Setup Node.js and install dependencies
-        uses: ./.github/actions/setup-node-frontend
-
-      - name: Cache pip wheel cache
-        uses: actions/cache@v5
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
         with:
-          path: ~/Library/Caches/pip
-          key: pip-wheel-${{ runner.os }}-arm64-${{ hashFiles('apps/backend/requirements.txt') }}
-          restore-keys: |
-            pip-wheel-${{ runner.os }}-arm64-
+          version: 10
 
-      - name: Cache bundled Python
-        uses: actions/cache@v5
+      - name: Get pnpm store directory
+        id: pnpm-cache
+        run: echo "dir=$(pnpm store path)" >> $GITHUB_OUTPUT
+
+      - uses: actions/cache@v4
         with:
-          path: apps/frontend/python-runtime
-          key: python-bundle-${{ runner.os }}-arm64-3.12.8-${{ hashFiles('apps/backend/requirements.txt') }}
-          restore-keys: |
-            python-bundle-${{ runner.os }}-arm64-3.12.8-
+          path: ${{ steps.pnpm-cache.outputs.dir }}
+          key: ${{ runner.os }}-arm64-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: ${{ runner.os }}-arm64-pnpm-
+
+      - name: Install dependencies
+        run: cd auto-claude-ui && pnpm install --frozen-lockfile
 
       - name: Build application
-        run: cd apps/frontend && npm run build
-        env:
-          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
-          SENTRY_TRACES_SAMPLE_RATE: ${{ secrets.SENTRY_TRACES_SAMPLE_RATE }}
-          SENTRY_PROFILES_SAMPLE_RATE: ${{ secrets.SENTRY_PROFILES_SAMPLE_RATE }}
+        run: cd auto-claude-ui && pnpm run build
 
       - name: Package macOS (Apple Silicon)
-        run: cd apps/frontend && npm run package:mac -- --arm64
+        run: cd auto-claude-ui && pnpm run package:mac -- --arch=arm64 -p never
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           CSC_LINK: ${{ secrets.MAC_CERTIFICATE }}
           CSC_KEY_PASSWORD: ${{ secrets.MAC_CERTIFICATE_PASSWORD }}
-          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
-          SENTRY_TRACES_SAMPLE_RATE: ${{ secrets.SENTRY_TRACES_SAMPLE_RATE }}
-          SENTRY_PROFILES_SAMPLE_RATE: ${{ secrets.SENTRY_PROFILES_SAMPLE_RATE }}
 
-      - name: Submit notarization (async)
-        id: notarize
-        uses: ./.github/actions/submit-macos-notarization
-        with:
-          apple-id: ${{ secrets.APPLE_ID }}
-          apple-app-specific-password: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
-          apple-team-id: ${{ secrets.APPLE_TEAM_ID }}
+      - name: Notarize macOS ARM64 app
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          if [ -z "$APPLE_ID" ]; then
+            echo "Skipping notarization: APPLE_ID not configured"
+            exit 0
+          fi
+          cd auto-claude-ui
+          for dmg in dist/*.dmg; do
+            echo "Notarizing $dmg..."
+            xcrun notarytool submit "$dmg" \
+              --apple-id "$APPLE_ID" \
+              --password "$APPLE_APP_SPECIFIC_PASSWORD" \
+              --team-id "$APPLE_TEAM_ID" \
+              --wait
+            xcrun stapler staple "$dmg"
+            echo "Successfully notarized and stapled $dmg"
+          done
 
       - name: Upload artifacts
         uses: actions/upload-artifact@v4
         with:
           name: macos-arm64-builds
           path: |
-            apps/frontend/dist/*.dmg
-            apps/frontend/dist/*.zip
-            apps/frontend/dist/*.yml
-            apps/frontend/dist/*.blockmap
+            auto-claude-ui/dist/*.dmg
+            auto-claude-ui/dist/*.zip
 
   build-windows:
     runs-on: windows-latest
-    permissions:
-      id-token: write  # Required for OIDC authentication with Azure
-      contents: read
-    env:
-      # Job-level env so AZURE_CLIENT_ID is available for step-level if conditions
-      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
     steps:
       - uses: actions/checkout@v4
 
-      - name: Setup Python
-        uses: actions/setup-python@v6
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
         with:
-          python-version: '3.11'
+          node-version: '20'
 
-      - name: Setup Node.js and install dependencies
-        uses: ./.github/actions/setup-node-frontend
-
-      - name: Cache pip wheel cache
-        uses: actions/cache@v5
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
         with:
-          path: ~\AppData\Local\pip\Cache
-          key: pip-wheel-${{ runner.os }}-x64-${{ hashFiles('apps/backend/requirements.txt') }}
-          restore-keys: |
-            pip-wheel-${{ runner.os }}-x64-
+          version: 10
 
-      - name: Cache bundled Python
-        uses: actions/cache@v5
+      - name: Get pnpm store directory
+        id: pnpm-cache
+        shell: bash
+        run: echo "dir=$(pnpm store path)" >> $GITHUB_OUTPUT
+
+      - uses: actions/cache@v4
         with:
-          path: apps/frontend/python-runtime
-          key: python-bundle-${{ runner.os }}-x64-3.12.8-${{ hashFiles('apps/backend/requirements.txt') }}
-          restore-keys: |
-            python-bundle-${{ runner.os }}-x64-3.12.8-
+          path: ${{ steps.pnpm-cache.outputs.dir }}
+          key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: ${{ runner.os }}-pnpm-
+
+      - name: Install dependencies
+        run: cd auto-claude-ui && pnpm install --frozen-lockfile
 
       - name: Build application
-        run: cd apps/frontend && npm run build
-        env:
-          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
-          SENTRY_TRACES_SAMPLE_RATE: ${{ secrets.SENTRY_TRACES_SAMPLE_RATE }}
-          SENTRY_PROFILES_SAMPLE_RATE: ${{ secrets.SENTRY_PROFILES_SAMPLE_RATE }}
+        run: cd auto-claude-ui && pnpm run build
 
       - name: Package Windows
-        run: cd apps/frontend && npm run package:win
+        run: cd auto-claude-ui && pnpm run package:win -- -p never
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # Disable electron-builder's built-in signing (we use Azure Trusted Signing instead)
-          CSC_IDENTITY_AUTO_DISCOVERY: false
-          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
-          SENTRY_TRACES_SAMPLE_RATE: ${{ secrets.SENTRY_TRACES_SAMPLE_RATE }}
-          SENTRY_PROFILES_SAMPLE_RATE: ${{ secrets.SENTRY_PROFILES_SAMPLE_RATE }}
-
-      - name: Azure Login (OIDC)
-        if: env.AZURE_CLIENT_ID != ''
-        uses: azure/login@v2
-        with:
-          client-id: ${{ secrets.AZURE_CLIENT_ID }}
-          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
-          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-
-      - name: Sign Windows executable with Azure Trusted Signing
-        if: env.AZURE_CLIENT_ID != ''
-        uses: azure/trusted-signing-action@v0.5.11
-        with:
-          endpoint: https://neu.codesigning.azure.net/
-          trusted-signing-account-name: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
-          certificate-profile-name: ${{ secrets.AZURE_CERTIFICATE_PROFILE }}
-          files-folder: apps/frontend/dist
-          files-folder-filter: exe
-          file-digest: SHA256
-          timestamp-rfc3161: http://timestamp.acs.microsoft.com
-          timestamp-digest: SHA256
-
-      - name: Verify Windows executable is signed
-        if: env.AZURE_CLIENT_ID != ''
-        shell: pwsh
-        run: |
-          cd apps/frontend/dist
-          $exeFile = Get-ChildItem -Filter "*.exe" | Select-Object -First 1
-          if ($exeFile) {
-            Write-Host "Verifying signature on $($exeFile.Name)..."
-            $sig = Get-AuthenticodeSignature -FilePath $exeFile.FullName
-            if ($sig.Status -ne 'Valid') {
-              Write-Host "::error::Signature verification failed: $($sig.Status)"
-              Write-Host "::error::Status Message: $($sig.StatusMessage)"
-              exit 1
-            }
-            Write-Host "✅ Signature verified successfully"
-            Write-Host "  Subject: $($sig.SignerCertificate.Subject)"
-            Write-Host "  Issuer: $($sig.SignerCertificate.Issuer)"
-            Write-Host "  Thumbprint: $($sig.SignerCertificate.Thumbprint)"
-          } else {
-            Write-Host "::error::No .exe file found to verify"
-            exit 1
-          }
-
-      - name: Regenerate checksums after signing
-        if: env.AZURE_CLIENT_ID != ''
-        shell: pwsh
-        run: |
-          $ErrorActionPreference = "Stop"
-          cd apps/frontend/dist
-
-          # Find the installer exe (electron-builder names it with "Setup" or just the app name)
-          # electron-builder produces one installer exe per build
-          $exeFiles = Get-ChildItem -Filter "*.exe"
-          if ($exeFiles.Count -eq 0) {
-            Write-Host "::error::No .exe files found in dist folder"
-            exit 1
-          }
-
-          Write-Host "Found $($exeFiles.Count) exe file(s): $($exeFiles.Name -join ', ')"
-
-          $ymlFile = "latest.yml"
-          if (-not (Test-Path $ymlFile)) {
-            Write-Host "::error::$ymlFile not found - cannot update checksums"
-            exit 1
-          }
-
-          $content = Get-Content $ymlFile -Raw
-          $originalContent = $content
-
-          # Process each exe file and update its hash in latest.yml
-          foreach ($exeFile in $exeFiles) {
-            Write-Host "Processing $($exeFile.Name)..."
-
-            # Compute SHA512 hash and convert to base64 (electron-builder format)
-            $bytes = [System.IO.File]::ReadAllBytes($exeFile.FullName)
-            $sha512 = [System.Security.Cryptography.SHA512]::Create()
-            $hashBytes = $sha512.ComputeHash($bytes)
-            $hash = [System.Convert]::ToBase64String($hashBytes)
-            $size = $exeFile.Length
-
-            Write-Host "  Hash: $hash"
-            Write-Host "  Size: $size"
-          }
-
-          # For electron-builder, latest.yml has a single file entry for the installer
-          # Update the sha512 and size for the primary exe (first one, typically the installer)
-          $primaryExe = $exeFiles | Select-Object -First 1
-          $bytes = [System.IO.File]::ReadAllBytes($primaryExe.FullName)
-          $sha512 = [System.Security.Cryptography.SHA512]::Create()
-          $hashBytes = $sha512.ComputeHash($bytes)
-          $hash = [System.Convert]::ToBase64String($hashBytes)
-          $size = $primaryExe.Length
-
-          # Update sha512 hash (base64 pattern: alphanumeric, +, /, =)
-          $content = $content -replace 'sha512: [A-Za-z0-9+/=]+', "sha512: $hash"
-          # Update size
-          $content = $content -replace 'size: \d+', "size: $size"
-
-          if ($content -eq $originalContent) {
-            Write-Host "::error::Checksum replacement failed - content unchanged. Check if latest.yml format has changed."
-            exit 1
-          }
-
-          Set-Content -Path $ymlFile -Value $content -NoNewline
-          Write-Host "✅ Updated $ymlFile with new base64 hash and size for $($primaryExe.Name)"
-
-      - name: Skip signing notice
-        if: env.AZURE_CLIENT_ID == ''
-        run: echo "::warning::Windows signing skipped - AZURE_CLIENT_ID not configured. The .exe will be unsigned."
+          CSC_LINK: ${{ secrets.WIN_CERTIFICATE }}
+          CSC_KEY_PASSWORD: ${{ secrets.WIN_CERTIFICATE_PASSWORD }}
 
       - name: Upload artifacts
         uses: actions/upload-artifact@v4
         with:
           name: windows-builds
           path: |
-            apps/frontend/dist/*.exe
-            apps/frontend/dist/*.yml
-            apps/frontend/dist/*.blockmap
+            auto-claude-ui/dist/*.exe
 
   build-linux:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
 
-      - name: Setup Python
-        uses: actions/setup-python@v6
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
         with:
-          python-version: '3.11'
+          node-version: '20'
 
-      - name: Setup Node.js and install dependencies
-        uses: ./.github/actions/setup-node-frontend
-
-      - name: Setup Flatpak and verification tools
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y flatpak flatpak-builder libarchive-tools
-          flatpak remote-add --user --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
-          flatpak install -y --user flathub org.freedesktop.Platform//25.08 org.freedesktop.Sdk//25.08
-          flatpak install -y --user flathub org.electronjs.Electron2.BaseApp//25.08
-
-      - name: Cache pip wheel cache
-        uses: actions/cache@v5
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
         with:
-          path: ~/.cache/pip
-          key: pip-wheel-${{ runner.os }}-x64-${{ hashFiles('apps/backend/requirements.txt') }}
-          restore-keys: |
-            pip-wheel-${{ runner.os }}-x64-
+          version: 10
 
-      - name: Cache bundled Python
-        uses: actions/cache@v5
+      - name: Get pnpm store directory
+        id: pnpm-cache
+        run: echo "dir=$(pnpm store path)" >> $GITHUB_OUTPUT
+
+      - uses: actions/cache@v4
         with:
-          path: apps/frontend/python-runtime
-          key: python-bundle-${{ runner.os }}-x64-3.12.8-${{ hashFiles('apps/backend/requirements.txt') }}
-          restore-keys: |
-            python-bundle-${{ runner.os }}-x64-3.12.8-
+          path: ${{ steps.pnpm-cache.outputs.dir }}
+          key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: ${{ runner.os }}-pnpm-
+
+      - name: Install dependencies
+        run: cd auto-claude-ui && pnpm install --frozen-lockfile
 
       - name: Build application
-        run: cd apps/frontend && npm run build
-        env:
-          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
-          SENTRY_TRACES_SAMPLE_RATE: ${{ secrets.SENTRY_TRACES_SAMPLE_RATE }}
-          SENTRY_PROFILES_SAMPLE_RATE: ${{ secrets.SENTRY_PROFILES_SAMPLE_RATE }}
+        run: cd auto-claude-ui && pnpm run build
 
       - name: Package Linux
-        run: cd apps/frontend && npm run package:linux
+        run: cd auto-claude-ui && pnpm run package:linux -- -p never
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
-          SENTRY_TRACES_SAMPLE_RATE: ${{ secrets.SENTRY_TRACES_SAMPLE_RATE }}
-          SENTRY_PROFILES_SAMPLE_RATE: ${{ secrets.SENTRY_PROFILES_SAMPLE_RATE }}
-
-      - name: Verify Linux packages
-        run: cd apps/frontend && npm run verify:linux
 
       - name: Upload artifacts
         uses: actions/upload-artifact@v4
         with:
           name: linux-builds
           path: |
-            apps/frontend/dist/*.AppImage
-            apps/frontend/dist/*.deb
-            apps/frontend/dist/*.flatpak
-            apps/frontend/dist/*.yml
-            apps/frontend/dist/*.blockmap
-
-  # Finalize macOS notarization (runs in parallel with Windows/Linux builds)
-  finalize-notarization:
-    needs: [build-macos-intel, build-macos-arm64]
-    runs-on: macos-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Download Intel DMG
-        uses: actions/download-artifact@v7
-        with:
-          name: macos-intel-builds
-          path: intel
-
-      - name: Download ARM64 DMG
-        uses: actions/download-artifact@v7
-        with:
-          name: macos-arm64-builds
-          path: arm64
-
-      - name: Wait for notarization and staple
-        uses: ./.github/actions/finalize-macos-notarization
-        with:
-          apple-id: ${{ secrets.APPLE_ID }}
-          apple-app-specific-password: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
-          apple-team-id: ${{ secrets.APPLE_TEAM_ID }}
-          intel-notarization-id: ${{ needs.build-macos-intel.outputs.notarization_id }}
-          arm64-notarization-id: ${{ needs.build-macos-arm64.outputs.notarization_id }}
-          intel-dmg-file: ${{ needs.build-macos-intel.outputs.dmg_file }}
-          arm64-dmg-file: ${{ needs.build-macos-arm64.outputs.dmg_file }}
-
-      - name: Upload stapled Intel DMG
-        uses: actions/upload-artifact@v4
-        with:
-          name: macos-intel-stapled
-          path: intel/*.dmg
-
-      - name: Upload stapled ARM64 DMG
-        uses: actions/upload-artifact@v4
-        with:
-          name: macos-arm64-stapled
-          path: arm64/*.dmg
+            auto-claude-ui/dist/*.AppImage
+            auto-claude-ui/dist/*.deb
 
   create-release:
-    needs: [build-macos-intel, build-macos-arm64, finalize-notarization, build-windows, build-linux]
+    needs: [build-macos-intel, build-macos-arm64, build-windows, build-linux]
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -450,80 +253,23 @@ jobs:
           fetch-depth: 0
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v4
         with:
           path: dist
 
-      - name: Flatten binary artifacts
+      - name: Flatten and validate artifacts
         run: |
           mkdir -p release-assets
+          find dist -type f \( -name "*.dmg" -o -name "*.zip" -o -name "*.exe" -o -name "*.AppImage" -o -name "*.deb" \) -exec cp {} release-assets/ \;
 
-          # Copy stapled macOS DMGs (from finalize-notarization job)
-          # Validate that stapled DMGs exist before copying
-          if ! find dist/macos-intel-stapled dist/macos-arm64-stapled -type f -name "*.dmg" 2>/dev/null | grep -q .; then
-            echo "::warning::No stapled DMGs found. Using un-stapled DMGs from build artifacts."
-            find dist/macos-intel-builds dist/macos-arm64-builds -type f -name "*.dmg" -exec cp {} release-assets/ \; 2>/dev/null || true
-          else
-            find dist/macos-intel-stapled dist/macos-arm64-stapled -type f -name "*.dmg" -exec cp {} release-assets/ \; 2>/dev/null || true
-          fi
-
-          # Copy other macOS artifacts (zip, yml, blockmap) from original build
-          find dist/macos-intel-builds dist/macos-arm64-builds -type f \( -name "*.zip" -o -name "*.yml" -o -name "*.blockmap" \) -exec cp {} release-assets/ \; 2>/dev/null || true
-
-          # Copy Windows and Linux artifacts
-          find dist/windows-builds dist/linux-builds -type f \( -name "*.exe" -o -name "*.AppImage" -o -name "*.deb" -o -name "*.flatpak" -o -name "*.yml" -o -name "*.blockmap" \) -exec cp {} release-assets/ \; 2>/dev/null || true
-
-          # Validate that installer files exist
-          installer_count=$(find release-assets -type f \( -name "*.dmg" -o -name "*.zip" -o -name "*.exe" -o -name "*.AppImage" -o -name "*.deb" -o -name "*.flatpak" \) | wc -l)
-          if [ "$installer_count" -eq 0 ]; then
-            echo "::error::No installer artifacts found! Expected .dmg, .zip, .exe, .AppImage, .deb, or .flatpak files."
+          # Validate that at least one artifact was copied
+          artifact_count=$(find release-assets -type f \( -name "*.dmg" -o -name "*.zip" -o -name "*.exe" -o -name "*.AppImage" -o -name "*.deb" \) | wc -l)
+          if [ "$artifact_count" -eq 0 ]; then
+            echo "::error::No build artifacts found! Expected .dmg, .zip, .exe, .AppImage, or .deb files."
             exit 1
           fi
 
-          echo "Found $installer_count binary artifact(s):"
-          find release-assets -type f \( -name "*.dmg" -o -name "*.zip" -o -name "*.exe" -o -name "*.AppImage" -o -name "*.deb" -o -name "*.flatpak" \) -exec basename {} \;
-
-      # Merge macOS manifests from Intel and ARM64 builds
-      # See: https://github.com/electron-userland/electron-builder/issues/5592
-      - name: Merge macOS manifests
-        uses: ./.github/actions/merge-macos-manifests
-        with:
-          dist-path: dist
-          output-path: release-assets
-          copy-other-manifests: 'true'
-
-      - name: Validate manifests
-        run: |
-          # Validate that electron-updater manifest files are present (required for auto-updates)
-          yml_count=$(find release-assets -type f -name "*.yml" | wc -l)
-          if [ "$yml_count" -eq 0 ]; then
-            echo "::error::No update manifest (.yml) files found! Auto-update will not work."
-            exit 1
-          fi
-
-          echo "Found $yml_count manifest file(s):"
-          find release-assets -type f -name "*.yml" -exec basename {} \;
-
-          # Validate required manifests exist
-          missing=""
-          [ ! -f "release-assets/latest-mac.yml" ] && missing="$missing latest-mac.yml"
-          [ ! -f "release-assets/latest.yml" ] && missing="$missing latest.yml"
-          [ ! -f "release-assets/latest-linux.yml" ] && missing="$missing latest-linux.yml"
-
-          if [ -n "$missing" ]; then
-            echo "::error::Missing required manifests:$missing"
-            echo "::error::Auto-update will fail on affected platforms!"
-            exit 1
-          fi
-
-          echo ""
-          echo "All required manifests present:"
-          echo "  - latest-mac.yml (macOS)"
-          echo "  - latest.yml (Windows)"
-          echo "  - latest-linux.yml (Linux)"
-
-          echo ""
-          echo "All release assets:"
+          echo "Found $artifact_count artifact(s):"
           ls -la release-assets/
 
       - name: Generate checksums
@@ -532,6 +278,144 @@ jobs:
           sha256sum ./* > checksums.sha256
           cat checksums.sha256
 
+      - name: Scan with VirusTotal
+        id: virustotal
+        continue-on-error: true
+        if: ${{ github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.dry_run != true) }}
+        env:
+          VT_API_KEY: ${{ secrets.VIRUSTOTAL_API_KEY }}
+        run: |
+          if [ -z "$VT_API_KEY" ]; then
+            echo "::warning::VIRUSTOTAL_API_KEY not configured, skipping scan"
+            echo "vt_results=" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          echo "## VirusTotal Scan Results" > vt_results.md
+          echo "" >> vt_results.md
+
+          for file in release-assets/*.{exe,dmg,AppImage,deb}; do
+            [ -f "$file" ] || continue
+            filename=$(basename "$file")
+            filesize=$(stat -c%s "$file" 2>/dev/null || stat -f%z "$file")
+            echo "Scanning $filename (${filesize} bytes)..."
+
+            # For files > 32MB, get a special upload URL first
+            if [ "$filesize" -gt 33554432 ]; then
+              echo "  Large file detected, requesting upload URL..."
+              upload_url_response=$(curl -s --request GET \
+                --url "https://www.virustotal.com/api/v3/files/upload_url" \
+                --header "x-apikey: $VT_API_KEY")
+
+              upload_url=$(echo "$upload_url_response" | jq -r '.data // empty')
+              if [ -z "$upload_url" ]; then
+                echo "::warning::Failed to get upload URL for large file $filename"
+                echo "Response: $upload_url_response"
+                echo "- $filename - ⚠️ Upload failed (large file)" >> vt_results.md
+                continue
+              fi
+              api_url="$upload_url"
+            else
+              api_url="https://www.virustotal.com/api/v3/files"
+            fi
+
+            # Upload file to VirusTotal
+            response=$(curl -s --request POST \
+              --url "$api_url" \
+              --header "x-apikey: $VT_API_KEY" \
+              --form "file=@$file")
+
+            # Check if response is valid JSON before parsing
+            if ! echo "$response" | jq -e . >/dev/null 2>&1; then
+              echo "::warning::VirusTotal returned invalid JSON for $filename"
+              echo "Response (first 500 chars): ${response:0:500}"
+              echo "- $filename - ⚠️ Scan failed (invalid response)" >> vt_results.md
+              continue
+            fi
+
+            # Check for API error response
+            error_code=$(echo "$response" | jq -r '.error.code // empty')
+            if [ -n "$error_code" ]; then
+              error_msg=$(echo "$response" | jq -r '.error.message // "Unknown error"')
+              echo "::warning::VirusTotal API error for $filename: $error_code - $error_msg"
+              echo "- $filename - ⚠️ Scan failed ($error_code)" >> vt_results.md
+              continue
+            fi
+
+            # Extract analysis ID
+            analysis_id=$(echo "$response" | jq -r '.data.id // empty')
+
+            if [ -z "$analysis_id" ]; then
+              echo "::warning::Failed to upload $filename to VirusTotal"
+              echo "Response: $response"
+              echo "- $filename - ⚠️ Upload failed" >> vt_results.md
+              continue
+            fi
+
+            echo "Uploaded $filename, analysis ID: $analysis_id"
+
+            # Wait for analysis to complete (max 5 minutes per file)
+            analysis=""
+            for i in {1..30}; do
+              sleep 10
+              analysis=$(curl -s --request GET \
+                --url "https://www.virustotal.com/api/v3/analyses/$analysis_id" \
+                --header "x-apikey: $VT_API_KEY")
+
+              # Validate JSON response
+              if ! echo "$analysis" | jq -e . >/dev/null 2>&1; then
+                echo "  Warning: Invalid JSON response on attempt $i, retrying..."
+                continue
+              fi
+
+              status=$(echo "$analysis" | jq -r '.data.attributes.status // "unknown"')
+              echo "  Status: $status (attempt $i/30)"
+
+              if [ "$status" = "completed" ]; then
+                break
+              fi
+            done
+
+            # Final validation that we have valid analysis data
+            if ! echo "$analysis" | jq -e '.data.attributes.stats' >/dev/null 2>&1; then
+              echo "::warning::Could not get complete analysis for $filename, using local hash"
+              file_hash=$(sha256sum "$file" | cut -d' ' -f1)
+              echo "- [$filename](https://www.virustotal.com/gui/file/$file_hash) - ⚠️ Analysis incomplete" >> vt_results.md
+              continue
+            fi
+
+            # Get file hash for permanent URL
+            file_hash=$(echo "$analysis" | jq -r '.meta.file_info.sha256 // empty')
+
+            if [ -z "$file_hash" ]; then
+              # Fallback: calculate hash locally
+              file_hash=$(sha256sum "$file" | cut -d' ' -f1)
+            fi
+
+            # Get detection stats
+            malicious=$(echo "$analysis" | jq -r '.data.attributes.stats.malicious // 0')
+            suspicious=$(echo "$analysis" | jq -r '.data.attributes.stats.suspicious // 0')
+            undetected=$(echo "$analysis" | jq -r '.data.attributes.stats.undetected // 0')
+
+            vt_url="https://www.virustotal.com/gui/file/$file_hash"
+
+            if [ "$malicious" -gt 0 ] || [ "$suspicious" -gt 0 ]; then
+              echo "::warning::$filename has $malicious malicious and $suspicious suspicious detections (likely false positives)"
+              echo "- [$filename]($vt_url) - ⚠️ **$malicious malicious, $suspicious suspicious** detections (review recommended)" >> vt_results.md
+            else
+              echo "$filename is clean ($undetected engines, 0 detections)"
+              echo "- [$filename]($vt_url) - ✅ Clean ($undetected engines, 0 detections)" >> vt_results.md
+            fi
+          done
+
+          echo "" >> vt_results.md
+
+          # Save results for release notes
+          cat vt_results.md
+          echo "vt_results<<EOF" >> $GITHUB_OUTPUT
+          cat vt_results.md >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
       - name: Dry run summary
         if: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run == true }}
         run: |
@@ -545,139 +429,25 @@ jobs:
           cat release-assets/checksums.sha256 >> $GITHUB_STEP_SUMMARY
           echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
 
-      - name: Extract changelog from CHANGELOG.md
-        if: ${{ github.event_name == 'push' }}
+      - name: Generate changelog
+        if: ${{ github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.dry_run != true) }}
         id: changelog
-        run: |
-          # Extract version from tag (v2.7.2 -> 2.7.2)
-          VERSION=${GITHUB_REF_NAME#v}
-          CHANGELOG_FILE="CHANGELOG.md"
-
-          echo "📋 Extracting release notes for version $VERSION from CHANGELOG.md..."
-
-          if [ ! -f "$CHANGELOG_FILE" ]; then
-            echo "::warning::CHANGELOG.md not found, using minimal release notes"
-            echo "body=Release v$VERSION" >> $GITHUB_OUTPUT
-            exit 0
-          fi
-
-          # Extract changelog section for this version
-          # Looks for "## X.Y.Z" header and captures until next "## " or "---"
-          CHANGELOG_CONTENT=$(awk -v ver="$VERSION" '
-            BEGIN { found=0; content="" }
-            /^## / {
-              if (found) exit
-              # Match version at start of header (e.g., "## 2.7.3 -" or "## 2.7.3")
-              if ($2 == ver || $2 ~ "^"ver"[[:space:]]*-") {
-                found=1
-                next
-              }
-            }
-            /^---$/ { if (found) exit }
-            found { content = content $0 "\n" }
-            END {
-              if (!found) {
-                print "NOT_FOUND"
-                exit 0
-              }
-              # Trim leading/trailing whitespace
-              gsub(/^[[:space:]]+|[[:space:]]+$/, "", content)
-              print content
-            }
-          ' "$CHANGELOG_FILE")
-
-          if [ "$CHANGELOG_CONTENT" = "NOT_FOUND" ] || [ -z "$CHANGELOG_CONTENT" ]; then
-            echo "::warning::Version $VERSION not found in CHANGELOG.md, using minimal release notes"
-            REPO="${{ github.repository }}"
-            CHANGELOG_CONTENT="Release v$VERSION"$'\n\n'"See [CHANGELOG.md](https://github.com/${REPO}/blob/main/CHANGELOG.md) for details."
-          fi
-
-          echo "✅ Extracted changelog content"
-
-          # Save to file first (more reliable for multiline)
-          echo "$CHANGELOG_CONTENT" > changelog-body.md
-
-          # Use file-based output for multiline content
-          {
-            echo "body<<CHANGELOG_EOF"
-            cat changelog-body.md
-            echo "CHANGELOG_EOF"
-          } >> $GITHUB_OUTPUT
+        uses: release-drafter/release-drafter@v6
+        with:
+          config-name: release-drafter.yml
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Create Release
-        if: ${{ github.event_name == 'push' }}
+        if: ${{ github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.dry_run != true) }}
         uses: softprops/action-gh-release@v2
         with:
           body: |
             ${{ steps.changelog.outputs.body }}
 
-            ---
-
-            **Full Changelog**: https://github.com/${{ github.repository }}/blob/main/CHANGELOG.md
-
-            _VirusTotal scan results will be added automatically after release._
+            ${{ steps.virustotal.outputs.vt_results }}
           files: release-assets/*
           draft: false
           prerelease: ${{ contains(github.ref, 'beta') || contains(github.ref, 'alpha') }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-  # Update README with new version after successful release
-  update-readme:
-    needs: [create-release]
-    runs-on: ubuntu-latest
-    # Only update README on actual releases (tag push), not dry runs
-    if: ${{ github.event_name == 'push' }}
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: main
-          # Use PAT_TOKEN to bypass branch protection rules on main
-          token: ${{ secrets.PAT_TOKEN }}
-
-      - name: Extract version and detect release type
-        id: version
-        run: |
-          # Extract version from tag (v2.7.2 -> 2.7.2)
-          VERSION=${GITHUB_REF_NAME#v}
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-
-          # Detect if this is a prerelease (contains - after version, e.g., 2.7.2-beta.10)
-          if [[ "$VERSION" == *-* ]]; then
-            echo "is_prerelease=true" >> $GITHUB_OUTPUT
-            echo "Detected PRERELEASE: $VERSION"
-          else
-            echo "is_prerelease=false" >> $GITHUB_OUTPUT
-            echo "Detected STABLE release: $VERSION"
-          fi
-
-      - name: Update README.md
-        run: |
-          VERSION="${{ steps.version.outputs.version }}"
-          IS_PRERELEASE="${{ steps.version.outputs.is_prerelease }}"
-
-          if [ "$IS_PRERELEASE" = "true" ]; then
-            python3 scripts/update-readme.py "$VERSION" --prerelease
-          else
-            python3 scripts/update-readme.py "$VERSION"
-          fi
-
-          echo "--- Verifying update ---"
-          grep -E "(stable-|beta-|version-)[0-9]" README.md | head -5
-
-      - name: Commit and push README update
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-
-          # Check if there are changes to commit
-          if git diff --quiet README.md; then
-            echo "No changes to README.md, skipping commit"
-            exit 0
-          fi
-
-          git add README.md
-          git commit -m "docs: update README to v${{ steps.version.outputs.version }} [skip ci]"
-          git push origin main

.github/workflows/stale.yml

@@ -1,25 +0,0 @@
-name: Stale Issues
-
-on:
-  schedule:
-    - cron: '0 0 * * 0'  # Every Sunday
-  workflow_dispatch:
-
-jobs:
-  stale:
-    runs-on: ubuntu-latest
-    permissions:
-      issues: write
-    steps:
-      - uses: actions/stale@v9
-        with:
-          stale-issue-message: |
-            This issue has been inactive for 60 days. It will be closed in 14 days if there's no activity.
-
-            - If this is still relevant, please comment or update the issue
-            - If you're working on this, add the `in-progress` label
-          close-issue-message: 'Closed due to inactivity. Feel free to reopen if still relevant.'
-          stale-issue-label: 'stale'
-          days-before-stale: 60
-          days-before-close: 14
-          exempt-issue-labels: 'priority/critical,priority/high,in-progress,blocked'

.github/workflows/test-azure-auth.yml

@@ -1,21 +0,0 @@
-name: Test Azure Auth
-
-on:
-  workflow_dispatch:
-
-jobs:
-  test-auth:
-    runs-on: windows-latest
-    permissions:
-      id-token: write
-      contents: read
-    steps:
-      - name: Azure Login (OIDC)
-        uses: azure/login@v2
-        with:
-          client-id: ${{ secrets.AZURE_CLIENT_ID }}
-          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
-          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-
-      - name: Success
-        run: echo "Azure authentication successful!"

.github/workflows/test-on-tag.yml

@@ -0,0 +1,66 @@
+name: Test on Tag
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  # Python tests
+  test-python:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ['3.12', '3.13']
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+        with:
+          version: "latest"
+
+      - name: Install dependencies
+        working-directory: auto-claude
+        run: |
+          uv venv
+          uv pip install -r requirements.txt
+          uv pip install -r ../tests/requirements-test.txt
+
+      - name: Run tests
+        working-directory: auto-claude
+        run: |
+          source .venv/bin/activate
+          pytest ../tests/ -v --tb=short
+
+  # Frontend tests
+  test-frontend:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - name: Install dependencies
+        working-directory: auto-claude-ui
+        run: pnpm install --frozen-lockfile --ignore-scripts
+
+      - name: Run tests
+        working-directory: auto-claude-ui
+        run: pnpm test

.github/workflows/validate-version.yml

@@ -0,0 +1,71 @@
+name: Validate Version
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  validate-version:
+    name: Validate package.json version matches tag
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Extract version from tag
+        id: tag_version
+        run: |
+          # Extract version from tag (e.g., v2.5.5 -> 2.5.5)
+          TAG_VERSION=${GITHUB_REF#refs/tags/v}
+          echo "version=$TAG_VERSION" >> $GITHUB_OUTPUT
+          echo "Tag version: $TAG_VERSION"
+
+      - name: Extract version from package.json
+        id: package_version
+        run: |
+          # Read version from package.json
+          PACKAGE_VERSION=$(node -p "require('./auto-claude-ui/package.json').version")
+          echo "version=$PACKAGE_VERSION" >> $GITHUB_OUTPUT
+          echo "Package.json version: $PACKAGE_VERSION"
+
+      - name: Compare versions
+        run: |
+          TAG_VERSION="${{ steps.tag_version.outputs.version }}"
+          PACKAGE_VERSION="${{ steps.package_version.outputs.version }}"
+
+          echo "=========================================="
+          echo "Version Validation"
+          echo "=========================================="
+          echo "Git tag version:      v$TAG_VERSION"
+          echo "package.json version: $PACKAGE_VERSION"
+          echo "=========================================="
+
+          if [ "$TAG_VERSION" != "$PACKAGE_VERSION" ]; then
+            echo ""
+            echo "❌ ERROR: Version mismatch detected!"
+            echo ""
+            echo "The version in package.json ($PACKAGE_VERSION) does not match"
+            echo "the git tag version ($TAG_VERSION)."
+            echo ""
+            echo "To fix this:"
+            echo "  1. Delete this tag: git tag -d v$TAG_VERSION"
+            echo "  2. Update package.json version to $TAG_VERSION"
+            echo "  3. Commit the change"
+            echo "  4. Recreate the tag: git tag -a v$TAG_VERSION -m 'Release v$TAG_VERSION'"
+            echo ""
+            echo "Or use the automated script:"
+            echo "  node scripts/bump-version.js $TAG_VERSION"
+            echo ""
+            exit 1
+          fi
+
+          echo ""
+          echo "✅ SUCCESS: Versions match!"
+          echo ""
+
+      - name: Version validation result
+        if: success()
+        run: |
+          echo "::notice::Version validation passed - package.json version matches tag v${{ steps.tag_version.outputs.version }}"

.github/workflows/virustotal-scan.yml

@@ -1,343 +0,0 @@
-name: VirusTotal Scan
-
-# Runs AFTER release is published to avoid blocking release creation
-# VirusTotal scans can take 5+ minutes per file, which delays releases
-
-on:
-  release:
-    types: [published]
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: 'Release tag to scan (e.g., v2.8.0)'
-        required: true
-        type: string
-
-# Prevent TOCTOU race condition when updating release notes
-# If two runs target the same tag, queue them instead of running in parallel
-concurrency:
-  group: virustotal-${{ github.event.inputs.tag || github.event.release.tag_name }}
-  cancel-in-progress: false
-
-jobs:
-  scan:
-    name: Scan release assets
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write  # Required to update release notes
-    steps:
-      - name: Determine release tag
-        id: tag
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            echo "tag=${{ github.event.inputs.tag }}" >> $GITHUB_OUTPUT
-          else
-            echo "tag=${{ github.event.release.tag_name }}" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Check for API key
-        id: check-key
-        env:
-          VT_KEY: ${{ secrets.VIRUSTOTAL_API_KEY }}
-        run: |
-          if [ -z "$VT_KEY" ]; then
-            echo "::warning::VIRUSTOTAL_API_KEY not configured, skipping scan"
-            echo "has_key=false" >> $GITHUB_OUTPUT
-          else
-            echo "has_key=true" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Download release assets
-        if: steps.check-key.outputs.has_key == 'true'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          TAG="${{ steps.tag.outputs.tag }}"
-          echo "Downloading assets for release $TAG..."
-
-          mkdir -p release-assets
-
-          # First verify the release exists
-          if ! gh release view "$TAG" --repo "${{ github.repository }}" >/dev/null 2>&1; then
-            echo "::error::Release $TAG not found"
-            exit 1
-          fi
-
-          # Download assets, distinguishing between "no matching assets" and real errors
-          set +e
-          gh release download "$TAG" \
-            --repo "${{ github.repository }}" \
-            --pattern "*.exe" \
-            --pattern "*.dmg" \
-            --pattern "*.AppImage" \
-            --pattern "*.deb" \
-            --pattern "*.flatpak" \
-            --dir release-assets 2>&1
-          exit_code=$?
-          set -e
-
-          if [ $exit_code -ne 0 ]; then
-            # Check if it's just "no assets matched" vs a real error
-            asset_count=$(gh release view "$TAG" --repo "${{ github.repository }}" --json assets -q '.assets | length')
-            if [ "$asset_count" -eq 0 ]; then
-              echo "Release has no assets yet (this is OK for new releases)"
-            else
-              # Check if any scannable assets exist that should have been downloaded
-              scannable_assets=$(gh release view "$TAG" --repo "${{ github.repository }}" --json assets \
-                -q '.assets[].name | select(test("\\.(exe|dmg|AppImage|deb|flatpak)$"))' | wc -l)
-              if [ "$scannable_assets" -gt 0 ]; then
-                echo "::error::Download failed - $scannable_assets scannable asset(s) exist but download failed"
-                exit 1
-              fi
-              echo "No assets matched the patterns (exe, dmg, AppImage, deb, flatpak)"
-            fi
-          fi
-
-          echo "Downloaded assets:"
-          ls -la release-assets/ || echo "No assets found"
-
-      - name: Scan with VirusTotal
-        if: steps.check-key.outputs.has_key == 'true'
-        id: virustotal
-        env:
-          VT_API_KEY: ${{ secrets.VIRUSTOTAL_API_KEY }}
-        run: |
-          echo "## VirusTotal Scan Results" > vt_results.md
-          echo "" >> vt_results.md
-
-          # Check if there are any files to scan
-          shopt -s nullglob
-          files=(release-assets/*.{exe,dmg,AppImage,deb,flatpak})
-          if [ ${#files[@]} -eq 0 ]; then
-            echo "No scannable files found in release assets"
-            echo "- No executable files found in release" >> vt_results.md
-            echo "vt_results<<EOF" >> $GITHUB_OUTPUT
-            cat vt_results.md >> $GITHUB_OUTPUT
-            echo "EOF" >> $GITHUB_OUTPUT
-            exit 0
-          fi
-
-          for file in "${files[@]}"; do
-            [ -f "$file" ] || continue
-            filename=$(basename "$file")
-            filesize=$(stat -c%s "$file" 2>/dev/null || stat -f%z "$file")
-            echo "Scanning $filename (${filesize} bytes)..."
-
-            # VirusTotal requires special upload URL for files > 32MB
-            LARGE_FILE_THRESHOLD=33554432  # 32 MB in bytes
-            if [ "$filesize" -gt "$LARGE_FILE_THRESHOLD" ]; then
-              echo "  Large file detected, requesting upload URL..."
-              upload_http_response=$(curl -s -w '\n%{http_code}' --request GET \
-                --url "https://www.virustotal.com/api/v3/files/upload_url" \
-                --header "x-apikey: $VT_API_KEY")
-              upload_http_code=$(echo "$upload_http_response" | tail -1)
-              upload_url_response=$(echo "$upload_http_response" | sed '$d')
-
-              if [ "$upload_http_code" != "200" ]; then
-                echo "::warning::Failed to get upload URL for large file $filename (HTTP $upload_http_code)"
-                echo "- $filename - ⚠️ Upload failed (large file, HTTP $upload_http_code)" >> vt_results.md
-                continue
-              fi
-
-              upload_url=$(echo "$upload_url_response" | jq -r '.data // empty')
-              if [ -z "$upload_url" ]; then
-                echo "::warning::Failed to get upload URL for large file $filename"
-                echo "Response: $upload_url_response"
-                echo "- $filename - ⚠️ Upload failed (large file)" >> vt_results.md
-                continue
-              fi
-              api_url="$upload_url"
-            else
-              api_url="https://www.virustotal.com/api/v3/files"
-            fi
-
-            # Upload file to VirusTotal (capture HTTP status code)
-            http_response=$(curl -s -w '\n%{http_code}' --request POST \
-              --url "$api_url" \
-              --header "x-apikey: $VT_API_KEY" \
-              --form "file=@$file")
-            http_code=$(echo "$http_response" | tail -1)
-            response=$(echo "$http_response" | sed '$d')
-
-            # Check HTTP status code first
-            if [ "$http_code" != "200" ]; then
-              echo "::warning::VirusTotal returned HTTP $http_code for $filename"
-              if [ "$http_code" = "429" ]; then
-                echo "- $filename - ⚠️ Scan failed (rate limited)" >> vt_results.md
-              elif [ "$http_code" = "403" ]; then
-                echo "- $filename - ⚠️ Scan failed (forbidden - check API key)" >> vt_results.md
-              else
-                echo "- $filename - ⚠️ Scan failed (HTTP $http_code)" >> vt_results.md
-              fi
-              continue
-            fi
-
-            # Check if response is valid JSON before parsing
-            if ! echo "$response" | jq -e . >/dev/null 2>&1; then
-              echo "::warning::VirusTotal returned invalid JSON for $filename"
-              echo "Response (first 500 chars): ${response:0:500}"
-              echo "- $filename - ⚠️ Scan failed (invalid response)" >> vt_results.md
-              continue
-            fi
-
-            # Check for API error response
-            error_code=$(echo "$response" | jq -r '.error.code // empty')
-            if [ -n "$error_code" ]; then
-              error_msg=$(echo "$response" | jq -r '.error.message // "Unknown error"')
-              echo "::warning::VirusTotal API error for $filename: $error_code - $error_msg"
-              echo "- $filename - ⚠️ Scan failed ($error_code)" >> vt_results.md
-              continue
-            fi
-
-            # Extract analysis ID
-            analysis_id=$(echo "$response" | jq -r '.data.id // empty')
-
-            if [ -z "$analysis_id" ]; then
-              echo "::warning::Failed to upload $filename to VirusTotal"
-              echo "Response: $response"
-              echo "- $filename - ⚠️ Upload failed" >> vt_results.md
-              continue
-            fi
-
-            echo "Uploaded $filename, analysis ID: $analysis_id"
-
-            # Wait for analysis to complete (max 5 minutes per file)
-            analysis=""
-            for i in {1..30}; do
-              sleep 10
-              analysis_http_response=$(curl -s -w '\n%{http_code}' --request GET \
-                --url "https://www.virustotal.com/api/v3/analyses/$analysis_id" \
-                --header "x-apikey: $VT_API_KEY")
-              analysis_http_code=$(echo "$analysis_http_response" | tail -1)
-              analysis=$(echo "$analysis_http_response" | sed '$d')
-
-              # Check HTTP status code
-              if [ "$analysis_http_code" != "200" ]; then
-                echo "  Warning: HTTP $analysis_http_code on attempt $i, retrying..."
-                if [ "$analysis_http_code" = "429" ]; then
-                  echo "  Rate limited, waiting longer..."
-                  sleep 30
-                fi
-                continue
-              fi
-
-              # Validate JSON response
-              if ! echo "$analysis" | jq -e . >/dev/null 2>&1; then
-                echo "  Warning: Invalid JSON response on attempt $i, retrying..."
-                continue
-              fi
-
-              status=$(echo "$analysis" | jq -r '.data.attributes.status // "unknown"')
-              echo "  Status: $status (attempt $i/30)"
-
-              if [ "$status" = "completed" ]; then
-                break
-              fi
-            done
-
-            # Handle analysis timeout - if loop completed without status=completed
-            if [ "$status" != "completed" ]; then
-              echo "::warning::Analysis timed out for $filename (status: $status after 5 minutes)"
-              file_hash=$(sha256sum "$file" | cut -d' ' -f1)
-              echo "- [$filename](https://www.virustotal.com/gui/file/$file_hash) - ⚠️ Analysis timed out" >> vt_results.md
-              continue
-            fi
-
-            # Final validation that we have valid analysis data
-            if ! echo "$analysis" | jq -e '.data.attributes.stats' >/dev/null 2>&1; then
-              echo "::warning::Could not get complete analysis for $filename, using local hash"
-              file_hash=$(sha256sum "$file" | cut -d' ' -f1)
-              echo "- [$filename](https://www.virustotal.com/gui/file/$file_hash) - ⚠️ Analysis incomplete" >> vt_results.md
-              continue
-            fi
-
-            # Get file hash for permanent URL
-            file_hash=$(echo "$analysis" | jq -r '.meta.file_info.sha256 // empty')
-
-            if [ -z "$file_hash" ]; then
-              # Fallback: calculate hash locally
-              file_hash=$(sha256sum "$file" | cut -d' ' -f1)
-            fi
-
-            # Get detection stats
-            malicious=$(echo "$analysis" | jq -r '.data.attributes.stats.malicious // 0')
-            suspicious=$(echo "$analysis" | jq -r '.data.attributes.stats.suspicious // 0')
-            undetected=$(echo "$analysis" | jq -r '.data.attributes.stats.undetected // 0')
-
-            vt_url="https://www.virustotal.com/gui/file/$file_hash"
-
-            if [ "$malicious" -gt 0 ] || [ "$suspicious" -gt 0 ]; then
-              echo "::warning::$filename has $malicious malicious and $suspicious suspicious detections (likely false positives)"
-              echo "- [$filename]($vt_url) - ⚠️ **$malicious malicious, $suspicious suspicious** detections (review recommended)" >> vt_results.md
-            else
-              echo "$filename is clean ($undetected engines, 0 detections)"
-              echo "- [$filename]($vt_url) - ✅ Clean ($undetected engines, 0 detections)" >> vt_results.md
-            fi
-          done
-
-          echo "" >> vt_results.md
-
-          # Save results for next step
-          cat vt_results.md
-          echo "vt_results<<EOF" >> $GITHUB_OUTPUT
-          cat vt_results.md >> $GITHUB_OUTPUT
-          echo "EOF" >> $GITHUB_OUTPUT
-
-      - name: Update release notes with scan results
-        if: steps.check-key.outputs.has_key == 'true' && steps.virustotal.outputs.vt_results != ''
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          TAG="${{ steps.tag.outputs.tag }}"
-
-          # Get current release body with error checking
-          if ! current_body=$(gh release view "$TAG" --repo "${{ github.repository }}" --json body -q '.body'); then
-            echo "::error::Failed to fetch current release body for $TAG"
-            exit 1
-          fi
-
-          # Additional safeguard for empty body
-          if [ -z "$current_body" ]; then
-            echo "::warning::Release body is empty, this may indicate a problem"
-          fi
-
-          # Check if VirusTotal results already exist in the body
-          if echo "$current_body" | grep -q "## VirusTotal Scan Results"; then
-            echo "VirusTotal results already in release notes, skipping update"
-            exit 0
-          fi
-
-          # Use file-based approach to avoid shell expansion issues
-          # First, write current body to file
-          echo "$current_body" > release-body.md
-
-          # Remove placeholder text if present (portable sed approach)
-          sed '/_VirusTotal scan results will be added automatically after release\./d' release-body.md > release-body.tmp && mv release-body.tmp release-body.md
-
-          # Append separator and VT results
-          echo "" >> release-body.md
-          echo "---" >> release-body.md
-          echo "" >> release-body.md
-          cat vt_results.md >> release-body.md
-
-          # Update release using --notes-file to avoid shell quoting issues
-          gh release edit "$TAG" \
-            --repo "${{ github.repository }}" \
-            --notes-file release-body.md
-
-          echo "✅ Updated release notes with VirusTotal scan results"
-
-      - name: Summary
-        if: always()
-        run: |
-          echo "## VirusTotal Scan Summary" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Release:** ${{ steps.tag.outputs.tag }}" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          if [ "${{ steps.check-key.outputs.has_key }}" = "false" ]; then
-            echo "⚠️ Scan skipped: VIRUSTOTAL_API_KEY not configured" >> $GITHUB_STEP_SUMMARY
-          elif [ -f vt_results.md ]; then
-            cat vt_results.md >> $GITHUB_STEP_SUMMARY
-          else
-            echo "No scan results available" >> $GITHUB_STEP_SUMMARY
-          fi

.github/workflows/welcome.yml

@@ -1,33 +0,0 @@
-name: Welcome
-
-on:
-  pull_request_target:
-    types: [opened]
-  issues:
-    types: [opened]
-
-jobs:
-  welcome:
-    runs-on: ubuntu-latest
-    permissions:
-      issues: write
-      pull-requests: write
-    steps:
-      - uses: actions/first-interaction@v1
-        with:
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-          issue-message: |
-            👋 Thanks for opening your first issue!
-
-            A maintainer will triage this soon. In the meantime:
-            - Make sure you've provided all the requested info
-            - Join our [Discord](https://discord.gg/QhRnz9m5HE) for faster help
-          pr-message: |
-            🎉 Thanks for your first PR!
-
-            A maintainer will review it soon. Please make sure:
-            - Your branch is synced with `develop`
-            - CI checks pass
-            - You've followed our [contribution guide](https://github.com/AndyMik90/Auto-Claude/blob/develop/CONTRIBUTING.md)
-
-            Welcome to the Auto Claude community!

.gitignore

@@ -1,73 +1,31 @@
-# ===========================
-# OS Files
-# ===========================
+# OS
 .DS_Store
-.DS_Store?
-._*
 Thumbs.db
-ehthumbs.db
-Desktop.ini
-nul
 
-# ===========================
-# Security - Environment & Secrets
-# ===========================
+# Environment files (contain API keys)
 .env
-.env.*
-!.env.example
-/config.json
-*.pem
-*.key
-*.crt
-*.p12
-*.pfx
-.secrets
-secrets/
-credentials/
+.env.local
 
-# ===========================
-# IDE & Editors
-# ===========================
+# Git worktrees (used by auto-build parallel mode)
+.worktrees/
+
+# IDE
 .idea/
 .vscode/
 *.swp
 *.swo
-*.sublime-workspace
-*.sublime-project
-.project
-.classpath
-.settings/
 
-# ===========================
 # Logs
-# ===========================
 logs/
 *.log
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-lerna-debug.log*
 
-# ===========================
-# Git Worktrees (parallel builds)
-# ===========================
-.worktrees/
+# Personal notes
+OPUS_ANALYSIS_AND_IDEAS.md
 
-# ===========================
-# Auto Claude Generated
-# ===========================
-.auto-claude/
-.planning/
-.planning-archive/
-.auto-build-security.json
-.auto-claude-security.json
-.auto-claude-status
-.claude_settings.json
-.update-metadata.json
+# Documentation
+docs/
 
-# ===========================
-# Python (apps/backend)
-# ===========================
+# Python
 __pycache__/
 *.py[cod]
 *$py.class
@@ -75,19 +33,25 @@ __pycache__/
 .Python
 build/
 develop-eggs/
+dist/
+downloads/
 eggs/
 .eggs/
+/lib/
+/lib64/
+parts/
+sdist/
+var/
+wheels/
 *.egg-info/
 .installed.cfg
 *.egg
-MANIFEST
 
 # Virtual environments
 .venv/
 venv/
 ENV/
 env/
-.conda/
 
 # Testing
 .pytest_cache/
@@ -100,78 +64,26 @@ coverage.xml
 *.py,cover
 .hypothesis/
 
-# Type checking
+# mypy
 .mypy_cache/
 .dmypy.json
 dmypy.json
-.pytype/
-.pyre/
 
-# ===========================
-# Node.js (apps/frontend)
-# ===========================
-node_modules
-apps/frontend/node_modules
-.npm
-.yarn/
-.pnp.*
+# Auto-build generated files
+.auto-build-security.json
+.auto-claude-security.json
+.auto-claude-status
+.claude_settings.json
+.update-metadata.json
 
-# Build output
-dist/
-out/
-*.tsbuildinfo
-apps/frontend/python-runtime/
-
-# Cache
-.cache/
-.parcel-cache/
-.turbo/
-.eslintcache
-.prettiercache
-
-# ===========================
-# Electron
-# ===========================
-apps/frontend/dist/
-apps/frontend/out/
-*.asar
-*.blockmap
-*.snap
-*.deb
-*.rpm
-*.AppImage
-*.dmg
-*.exe
-*.msi
-
-# ===========================
-# Testing
-# ===========================
-coverage/
-.nyc_output/
-test-results/
-playwright-report/
-playwright/.cache/
-
-# ===========================
-# Misc
-# ===========================
-*.local
-*.bak
-*.tmp
-*.temp
-
-# Development
+# Development of Auto Build with Auto Build
 dev/
-_bmad/
-_bmad-output/
-.claude/
-/docs
-OPUS_ANALYSIS_AND_IDEAS.md
-/.github/agents
 
-# Auto Claude generated files
-.security-key
-/shared_docs
-logs/security/
-Agents.md
+.auto-claude/
+
+/docs
+
+_bmad
+_bmad-output
+
+.claude

.husky/commit-msg

@@ -1,81 +0,0 @@
-#!/bin/sh
-
-# Commit message validation
-# Enforces conventional commit format: type(scope)!?: description
-#
-# Valid types: feat, fix, docs, style, refactor, perf, test, build, ci, chore, revert
-# Scope allows: letters, numbers, hyphens, underscores, slashes, dots
-# Optional ! for breaking changes
-# Examples:
-#   feat(tasks): add drag and drop support
-#   fix(terminal): resolve scroll position issue
-#   feat!: breaking change without scope
-#   feat(api)!: breaking change with scope
-#   docs: update README with setup instructions
-#   chore: update dependencies
-
-commit_msg_file=$1
-commit_msg=$(cat "$commit_msg_file")
-
-# Regex for conventional commits
-# Format: type(optional-scope)!?: description
-# Scope allows: letters, numbers, hyphens, underscores, slashes, dots (consistent with GitHub workflow)
-# Optional ! for breaking changes: feat!: or feat(scope)!:
-pattern="^(feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(\([a-zA-Z0-9_/.-]+\))?!?: .{1,100}$"
-
-# Allow merge commits
-if echo "$commit_msg" | grep -qE "^Merge "; then
-  exit 0
-fi
-
-# Allow revert commits
-if echo "$commit_msg" | grep -qE "^Revert "; then
-  exit 0
-fi
-
-# Check first line against pattern
-first_line=$(echo "$commit_msg" | head -n 1)
-
-if ! echo "$first_line" | grep -qE "$pattern"; then
-  echo ""
-  echo "ERROR: Invalid commit message format!"
-  echo ""
-  echo "Your message: $first_line"
-  echo ""
-  echo "Expected format: type(scope)!?: description"
-  echo ""
-  echo "Valid types:"
-  echo "  feat     - A new feature"
-  echo "  fix      - A bug fix"
-  echo "  docs     - Documentation changes"
-  echo "  style    - Code style changes (formatting, semicolons, etc.)"
-  echo "  refactor - Code refactoring (no feature/fix)"
-  echo "  perf     - Performance improvements"
-  echo "  test     - Adding or updating tests"
-  echo "  build    - Build system or dependencies"
-  echo "  ci       - CI/CD configuration"
-  echo "  chore    - Other changes (maintenance)"
-  echo "  revert   - Reverting a previous commit"
-  echo ""
-  echo "Examples:"
-  echo "  feat(tasks): add drag and drop support"
-  echo "  fix(terminal): resolve scroll position issue"
-  echo "  feat!: breaking change without scope"
-  echo "  feat(api)!: breaking change with scope"
-  echo "  docs: update README"
-  echo "  chore: update dependencies"
-  echo ""
-  exit 1
-fi
-
-# Check description length (max 100 chars for first line)
-if [ ${#first_line} -gt 100 ]; then
-  echo ""
-  echo "ERROR: Commit message first line is too long!"
-  echo "Maximum: 100 characters"
-  echo "Current: ${#first_line} characters"
-  echo ""
-  exit 1
-fi
-
-exit 0

.husky/pre-commit

@@ -1,297 +1,6 @@
 #!/bin/sh
 
-# =============================================================================
-# GIT WORKTREE ENVIRONMENT CLEANUP
-# =============================================================================
-# Git automatically sets GIT_DIR (and CWD to the working tree root) before
-# running hooks -- even in worktrees. We do NOT need to manually parse .git
-# files or export GIT_DIR/GIT_WORK_TREE.
-#
-# However, external tools (IDEs, agents, parent shells) may leave stale
-# GIT_DIR/GIT_WORK_TREE values in the environment. If these point to a
-# different repo or worktree, git commands in this hook would target the
-# wrong repository. Unsetting them lets git re-resolve the correct values
-# from the working directory.
-# =============================================================================
-unset GIT_DIR
-unset GIT_WORK_TREE
-
-# =============================================================================
-# SAFETY CHECK: Detect and fix corrupted core.worktree configuration
-# =============================================================================
-# core.worktree lives in the SHARED .git/config (not per-worktree). If any
-# process accidentally writes it (e.g., running `git init` with a leaked
-# GIT_WORK_TREE), ALL repos and worktrees see the wrong working tree root,
-# causing files from one worktree to "leak" into others.
-#
-# This check runs from both main repo and worktree contexts since the config
-# is shared and corruption can happen from either.
-CORE_WORKTREE=$(git config --get core.worktree 2>/dev/null || true)
-if [ -n "$CORE_WORKTREE" ]; then
-  echo "Warning: Detected corrupted core.worktree setting ('$CORE_WORKTREE'), removing it..."
-  if ! git config --unset core.worktree 2>/dev/null; then
-    echo "Warning: Failed to unset core.worktree. Manual intervention may be needed."
-  fi
+# Run lint-staged in auto-claude-ui if there are staged files there
+if git diff --cached --name-only | grep -q "^auto-claude-ui/"; then
+  cd auto-claude-ui && pnpm exec lint-staged
 fi
-
-echo "Running pre-commit checks..."
-
-# =============================================================================
-# VERSION SYNC - Keep all version references in sync with root package.json
-# =============================================================================
-
-# Check if package.json is staged
-if git diff --cached --name-only | grep -q "^package.json$"; then
-  echo "package.json changed, syncing version to all files..."
-
-  # Extract version from root package.json
-  VERSION=$(node -p "require('./package.json').version")
-
-  if [ -n "$VERSION" ]; then
-    # Sync to apps/frontend/package.json
-    if [ -f "apps/frontend/package.json" ]; then
-      node -e "
-        const fs = require('fs');
-        const pkg = require('./apps/frontend/package.json');
-        if (pkg.version !== '$VERSION') {
-          pkg.version = '$VERSION';
-          fs.writeFileSync('./apps/frontend/package.json', JSON.stringify(pkg, null, 2) + '\n');
-          console.log('  Updated apps/frontend/package.json to $VERSION');
-        }
-      "
-      git add apps/frontend/package.json
-    fi
-
-    # Sync to apps/backend/__init__.py
-    if [ -f "apps/backend/__init__.py" ]; then
-      sed -i.bak "s/__version__ = \"[^\"]*\"/__version__ = \"$VERSION\"/" apps/backend/__init__.py
-      rm -f apps/backend/__init__.py.bak
-      git add apps/backend/__init__.py
-      echo "  Updated apps/backend/__init__.py to $VERSION"
-    fi
-
-    # Sync to README.md - section-aware updates (stable vs beta)
-    if [ -f "README.md" ]; then
-      # Escape hyphens for shields.io badge format (shields.io uses -- for literal hyphens)
-      ESCAPED_VERSION=$(echo "$VERSION" | sed 's/-/--/g')
-
-      # Detect if this is a prerelease (contains - after base version, e.g., 2.7.2-beta.10)
-      if echo "$VERSION" | grep -q '-'; then
-        # PRERELEASE: Update only beta sections
-        echo "  Detected PRERELEASE version: $VERSION"
-
-        # Update beta version badge (orange)
-        sed -i.bak "s/beta-[0-9]*\.[0-9]*\.[0-9]*\(--[a-z]*\.[0-9]*\)*-orange/beta-$ESCAPED_VERSION-orange/g" README.md
-
-        # Update beta version badge link (within BETA_VERSION_BADGE section)
-        sed -i.bak '/<!-- BETA_VERSION_BADGE -->/,/<!-- BETA_VERSION_BADGE_END -->/s|releases/tag/v[0-9.a-z-]*)|releases/tag/v'"$VERSION"')|g' README.md
-
-        # Update beta download links (within BETA_DOWNLOADS section only)
-        # Use perl for cross-platform compatibility (BSD sed doesn't support {block} syntax)
-        for SUFFIX in "win32-x64.exe" "darwin-arm64.dmg" "darwin-x64.dmg" "linux-x86_64.AppImage" "linux-amd64.deb" "linux-x86_64.flatpak"; do
-          perl -i -pe 'if (/<!-- BETA_DOWNLOADS -->/ .. /<!-- BETA_DOWNLOADS_END -->/) { s|Auto-Claude-[0-9.a-z-]*-'"$SUFFIX"'\]\(https://github.com/AndyMik90/Auto-Claude/releases/download/v[^/]*/Auto-Claude-[^)]*-'"$SUFFIX"'\)|Auto-Claude-'"$VERSION"'-'"$SUFFIX"'](https://github.com/AndyMik90/Auto-Claude/releases/download/v'"$VERSION"'/Auto-Claude-'"$VERSION"'-'"$SUFFIX"')|g }' README.md
-        done
-      else
-        # STABLE: Update stable sections and top badge
-        echo "  Detected STABLE version: $VERSION"
-
-        # Update top version badge (blue) - within TOP_VERSION_BADGE section
-        sed -i.bak '/<!-- TOP_VERSION_BADGE -->/,/<!-- TOP_VERSION_BADGE_END -->/s/version-[0-9]*\.[0-9]*\.[0-9]*\(--[a-z]*\.[0-9]*\)*-blue/version-'"$ESCAPED_VERSION"'-blue/g' README.md
-        sed -i.bak '/<!-- TOP_VERSION_BADGE -->/,/<!-- TOP_VERSION_BADGE_END -->/s|releases/tag/v[0-9.a-z-]*)|releases/tag/v'"$VERSION"')|g' README.md
-
-        # Update stable version badge (blue) - within STABLE_VERSION_BADGE section
-        sed -i.bak '/<!-- STABLE_VERSION_BADGE -->/,/<!-- STABLE_VERSION_BADGE_END -->/s/stable-[0-9]*\.[0-9]*\.[0-9]*\(--[a-z]*\.[0-9]*\)*-blue/stable-'"$ESCAPED_VERSION"'-blue/g' README.md
-        sed -i.bak '/<!-- STABLE_VERSION_BADGE -->/,/<!-- STABLE_VERSION_BADGE_END -->/s|releases/tag/v[0-9.a-z-]*)|releases/tag/v'"$VERSION"')|g' README.md
-
-        # Update stable download links (within STABLE_DOWNLOADS section only)
-        # Use perl for cross-platform compatibility (BSD sed doesn't support {block} syntax)
-        for SUFFIX in "win32-x64.exe" "darwin-arm64.dmg" "darwin-x64.dmg" "linux-x86_64.AppImage" "linux-amd64.deb"; do
-          perl -i -pe 'if (/<!-- STABLE_DOWNLOADS -->/ .. /<!-- STABLE_DOWNLOADS_END -->/) { s|Auto-Claude-[0-9.a-z-]*-'"$SUFFIX"'\]\(https://github.com/AndyMik90/Auto-Claude/releases/download/v[^/]*/Auto-Claude-[^)]*-'"$SUFFIX"'\)|Auto-Claude-'"$VERSION"'-'"$SUFFIX"'](https://github.com/AndyMik90/Auto-Claude/releases/download/v'"$VERSION"'/Auto-Claude-'"$VERSION"'-'"$SUFFIX"')|g }' README.md
-        done
-      fi
-
-      rm -f README.md.bak
-      git add README.md
-      echo "  Updated README.md to $VERSION"
-    fi
-
-    echo "Version sync complete: $VERSION"
-  fi
-fi
-
-# =============================================================================
-# BACKEND CHECKS (Python) - Run first, before frontend
-# =============================================================================
-
-# Check if there are staged Python files in apps/backend
-if git diff --cached --name-only | grep -q "^apps/backend/.*\.py$"; then
-  echo "Python changes detected, running backend checks..."
-
-  # Determine ruff command (venv or global)
-  RUFF=""
-  if [ -f "apps/backend/.venv/bin/ruff" ]; then
-    RUFF="apps/backend/.venv/bin/ruff"
-  elif [ -f "apps/backend/.venv/Scripts/ruff.exe" ]; then
-    RUFF="apps/backend/.venv/Scripts/ruff.exe"
-  elif command -v ruff >/dev/null 2>&1; then
-    RUFF="ruff"
-  fi
-
-  if [ -n "$RUFF" ]; then
-    # Get only staged Python files in apps/backend (process only what's being committed)
-    STAGED_PY_FILES=$(git diff --cached --name-only --diff-filter=ACM | grep "^apps/backend/.*\.py$" || true)
-
-    if [ -n "$STAGED_PY_FILES" ]; then
-      # Run ruff linting (auto-fix) only on staged files
-      echo "Running ruff lint on staged files..."
-      echo "$STAGED_PY_FILES" | xargs $RUFF check --fix
-      if [ $? -ne 0 ]; then
-        echo "Ruff lint failed. Please fix Python linting errors before committing."
-        exit 1
-      fi
-
-      # Run ruff format (auto-fix) only on staged files
-      echo "Running ruff format on staged files..."
-      echo "$STAGED_PY_FILES" | xargs $RUFF format
-
-      # Re-stage only the files that were originally staged (in case ruff modified them)
-      echo "$STAGED_PY_FILES" | xargs git add
-    fi
-  else
-    echo "Warning: ruff not found, skipping Python linting. Install with: uv pip install ruff"
-  fi
-
-  # Run pytest (skip slow/integration tests and Windows-incompatible tests for pre-commit speed)
-  # Run from repo root (not apps/backend) so tests that use Path.resolve() get correct CWD.
-  # PYTHONPATH includes apps/backend so imports resolve correctly.
-  echo "Running Python tests..."
-  (
-    # Tests to skip: graphiti (external deps), merge_file_tracker/service_orchestrator/worktree/workspace (Windows path/git issues)
-    # Also skip tests that require optional dependencies (pydantic structured outputs)
-    # Also skip gitlab_e2e (e2e test sensitive to test-ordering env contamination, validated by CI)
-    IGNORE_TESTS="--ignore=tests/test_graphiti.py --ignore=tests/test_merge_file_tracker.py --ignore=tests/test_service_orchestrator.py --ignore=tests/test_worktree.py --ignore=tests/test_workspace.py --ignore=tests/test_finding_validation.py --ignore=tests/test_sdk_structured_output.py --ignore=tests/test_structured_outputs.py --ignore=tests/test_gitlab_e2e.py"
-    # Determine Python executable from venv
-    VENV_PYTHON=""
-    if [ -f "apps/backend/.venv/bin/python" ]; then
-      VENV_PYTHON="apps/backend/.venv/bin/python"
-    elif [ -f "apps/backend/.venv/Scripts/python.exe" ]; then
-      VENV_PYTHON="apps/backend/.venv/Scripts/python.exe"
-    fi
-
-    # -k "not windows_path": skip tests using fake Windows paths that break
-    # Path.resolve() on macOS/Linux. These are validated by CI on all platforms.
-    if [ -n "$VENV_PYTHON" ]; then
-      # Check if pytest is installed in venv
-      if $VENV_PYTHON -c "import pytest" 2>/dev/null; then
-        PYTHONPATH=apps/backend $VENV_PYTHON -m pytest tests/ -v --tb=short -x -m "not slow and not integration" -k "not windows_path" $IGNORE_TESTS
-      else
-        echo "Warning: pytest not installed in venv. Installing test dependencies..."
-        $VENV_PYTHON -m pip install -q -r tests/requirements-test.txt
-        PYTHONPATH=apps/backend $VENV_PYTHON -m pytest tests/ -v --tb=short -x -m "not slow and not integration" -k "not windows_path" $IGNORE_TESTS
-      fi
-    elif [ -d "apps/backend/.venv" ]; then
-      echo "Warning: venv exists but Python not found in it, using system Python"
-      PYTHONPATH=apps/backend python -m pytest tests/ -v --tb=short -x -m "not slow and not integration" -k "not windows_path" $IGNORE_TESTS
-    else
-      echo "Warning: No .venv found in apps/backend, using system Python"
-      PYTHONPATH=apps/backend python -m pytest tests/ -v --tb=short -x -m "not slow and not integration" -k "not windows_path" $IGNORE_TESTS
-    fi
-  )
-  if [ $? -ne 0 ]; then
-    echo "Python tests failed. Please fix failing tests before committing."
-    exit 1
-  fi
-
-  echo "Backend checks passed!"
-fi
-
-# =============================================================================
-# FRONTEND CHECKS (TypeScript/React)
-# =============================================================================
-
-# Check if there are staged files in apps/frontend
-if git diff --cached --name-only | grep -q "^apps/frontend/"; then
-  echo "Frontend changes detected, running frontend checks..."
-
-  # Detect if we're in a worktree and check if dependencies are available
-  IS_WORKTREE=false
-  DEPS_AVAILABLE=true
-
-  if [ -f ".git" ]; then
-    # .git is a file (not directory) in worktrees
-    IS_WORKTREE=true
-    echo "Detected git worktree environment"
-  fi
-
-  # Check if node_modules has actual dependencies by looking for a known package
-  # @lydell/node-pty is required for terminal code and is a common source of TypeScript errors
-  # It may be in root node_modules (hoisted) or apps/frontend/node_modules
-  # Note: -d follows symlinks automatically, so this works for both real dirs and symlinks
-  # We check for the full package path (@lydell/node-pty) rather than just the namespace
-  # for precise detection - ensures the actual dependency is installed, not just any @lydell package
-  if [ ! -d "node_modules/@lydell/node-pty" ] && [ ! -d "apps/frontend/node_modules/@lydell/node-pty" ]; then
-    DEPS_AVAILABLE=false
-  fi
-
-  if [ "$DEPS_AVAILABLE" = false ]; then
-    if [ "$IS_WORKTREE" = true ]; then
-      # In worktree without dependencies - warn but allow commit
-      echo ""
-      echo "⚠️  WARNING: node_modules not available in this worktree."
-      echo "   TypeScript and lint checks will be skipped."
-      echo "   This is expected for auto-claude worktrees."
-      echo "   Full validation will occur when PR is created/merged."
-      echo ""
-    else
-      # Main repo without dependencies - this is an error
-      echo "Error: node_modules not found. Run 'npm install' first."
-      exit 1
-    fi
-  else
-    # Dependencies available - run full frontend checks
-    # Use subshell to isolate directory changes and prevent worktree corruption
-    (
-      cd apps/frontend
-
-      # Run lint-staged (handles staged .ts/.tsx files)
-      npm exec lint-staged
-      if [ $? -ne 0 ]; then
-        echo "lint-staged failed. Please fix linting errors before committing."
-        exit 1
-      fi
-
-      # Run TypeScript type check
-      echo "Running type check..."
-      npm run typecheck
-      if [ $? -ne 0 ]; then
-        echo "Type check failed. Please fix TypeScript errors before committing."
-        exit 1
-      fi
-
-      # Run linting
-      echo "Running lint..."
-      npm run lint
-      if [ $? -ne 0 ]; then
-        echo "Lint failed. Run 'npm run lint:fix' to auto-fix issues."
-        exit 1
-      fi
-
-      # Check for vulnerabilities (only critical severity)
-      # Note: Using critical level because electron-builder has a known high-severity
-      # tar vulnerability (CVE-2026-23745) that cannot be fixed until electron-builder
-      # releases an update with tar@7.x support. This is a build dependency, not runtime.
-      echo "Checking for vulnerabilities..."
-      npm audit --audit-level=critical
-      if [ $? -ne 0 ]; then
-        echo "Critical severity vulnerabilities found. Run 'npm audit fix' to resolve."
-        exit 1
-      fi
-    )
-    if [ $? -ne 0 ]; then
-      exit 1
-    fi
-    echo "Frontend checks passed!"
-  fi
-fi
-
-echo "All pre-commit checks passed!"

.pre-commit-config.yaml

@@ -1,173 +1,34 @@
 repos:
-  # Version sync - propagate root package.json version to all files
-  # NOTE: Skip in worktrees - version sync modifies root files which don't exist in worktree
-  - repo: local
-    hooks:
-      - id: version-sync
-        name: Version Sync
-        entry: bash
-        args:
-          - -c
-          - |
-            # Skip in worktrees - .git is a file pointing to main repo, not a directory
-            # Version sync modifies root-level files that may not exist in worktree context
-            if [ -f ".git" ]; then
-              echo "Skipping version-sync in worktree (root files not accessible)"
-              exit 0
-            fi
-            VERSION=$(node -p "require('./package.json').version")
-            if [ -n "$VERSION" ]; then
-
-              # Sync to apps/frontend/package.json
-              node -e "
-                const fs = require('fs');
-                const p = require('./apps/frontend/package.json');
-                const v = process.argv[1];
-                if (p.version !== v) {
-                  p.version = v;
-                  fs.writeFileSync('./apps/frontend/package.json', JSON.stringify(p, null, 2) + '\n');
-                }
-              " "$VERSION"
-
-              # Sync to apps/backend/__init__.py
-              sed -i.bak "s/__version__ = \"[^\"]*\"/__version__ = \"$VERSION\"/" apps/backend/__init__.py && rm -f apps/backend/__init__.py.bak
-
-              # Sync to README.md - section-aware updates (stable vs beta)
-              ESCAPED_VERSION=$(echo "$VERSION" | sed 's/-/--/g')
-
-              # Detect if this is a prerelease (contains - after base version)
-              if echo "$VERSION" | grep -q '-'; then
-                # PRERELEASE: Update only beta sections
-                echo "  Detected PRERELEASE version: $VERSION"
-
-                # Update beta version badge (orange)
-                sed -i.bak "s/beta-[0-9]*\.[0-9]*\.[0-9]*\(--[a-z]*\.[0-9]*\)*-orange/beta-$ESCAPED_VERSION-orange/g" README.md
-
-                # Update beta version badge link
-                sed -i.bak '/<!-- BETA_VERSION_BADGE -->/,/<!-- BETA_VERSION_BADGE_END -->/s|releases/tag/v[0-9.a-z-]*)|releases/tag/v'"$VERSION"')|g' README.md
-
-                # Update beta download links (within BETA_DOWNLOADS section only)
-                for SUFFIX in "win32-x64.exe" "darwin-arm64.dmg" "darwin-x64.dmg" "linux-x86_64.AppImage" "linux-amd64.deb" "linux-x86_64.flatpak"; do
-                  sed -i.bak '/<!-- BETA_DOWNLOADS -->/,/<!-- BETA_DOWNLOADS_END -->/{s|Auto-Claude-[0-9.a-z-]*-'"$SUFFIX"'](https://github.com/AndyMik90/Auto-Claude/releases/download/v[^/]*/Auto-Claude-[^)]*-'"$SUFFIX"')|Auto-Claude-'"$VERSION"'-'"$SUFFIX"'](https://github.com/AndyMik90/Auto-Claude/releases/download/v'"$VERSION"'/Auto-Claude-'"$VERSION"'-'"$SUFFIX"')|g}' README.md
-                done
-              else
-                # STABLE: Update stable sections and top badge
-                echo "  Detected STABLE version: $VERSION"
-
-                # Update top version badge (blue)
-                sed -i.bak '/<!-- TOP_VERSION_BADGE -->/,/<!-- TOP_VERSION_BADGE_END -->/s/version-[0-9]*\.[0-9]*\.[0-9]*\(--[a-z]*\.[0-9]*\)*-blue/version-'"$ESCAPED_VERSION"'-blue/g' README.md
-                sed -i.bak '/<!-- TOP_VERSION_BADGE -->/,/<!-- TOP_VERSION_BADGE_END -->/s|releases/tag/v[0-9.a-z-]*)|releases/tag/v'"$VERSION"')|g' README.md
-
-                # Update stable version badge (blue)
-                sed -i.bak '/<!-- STABLE_VERSION_BADGE -->/,/<!-- STABLE_VERSION_BADGE_END -->/s/stable-[0-9]*\.[0-9]*\.[0-9]*\(--[a-z]*\.[0-9]*\)*-blue/stable-'"$ESCAPED_VERSION"'-blue/g' README.md
-                sed -i.bak '/<!-- STABLE_VERSION_BADGE -->/,/<!-- STABLE_VERSION_BADGE_END -->/s|releases/tag/v[0-9.a-z-]*)|releases/tag/v'"$VERSION"')|g' README.md
-
-                # Update stable download links (within STABLE_DOWNLOADS section only)
-                for SUFFIX in "win32-x64.exe" "darwin-arm64.dmg" "darwin-x64.dmg" "linux-x86_64.AppImage" "linux-amd64.deb"; do
-                  sed -i.bak '/<!-- STABLE_DOWNLOADS -->/,/<!-- STABLE_DOWNLOADS_END -->/{s|Auto-Claude-[0-9.a-z-]*-'"$SUFFIX"'](https://github.com/AndyMik90/Auto-Claude/releases/download/v[^/]*/Auto-Claude-[^)]*-'"$SUFFIX"')|Auto-Claude-'"$VERSION"'-'"$SUFFIX"'](https://github.com/AndyMik90/Auto-Claude/releases/download/v'"$VERSION"'/Auto-Claude-'"$VERSION"'-'"$SUFFIX"')|g}' README.md
-                done
-              fi
-              rm -f README.md.bak
-
-              # Stage changes
-              git add apps/frontend/package.json apps/backend/__init__.py README.md 2>/dev/null || true
-            fi
-        language: system
-        files: ^package\.json$
-        pass_filenames: false
-
-  # Python encoding check - prevent regression of UTF-8 encoding fixes (PR #782)
-  - repo: local
-    hooks:
-      - id: check-file-encoding
-        name: Check file encoding parameters
-        entry: python scripts/check_encoding.py
-        language: system
-        types: [python]
-        files: ^apps/backend/
-        description: Ensures all file operations specify encoding="utf-8"
-
-  # Python linting (apps/backend/)
+  # Python linting (auto-claude/)
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.10
+    rev: v0.8.3
     hooks:
       - id: ruff
         args: [--fix]
-        files: ^apps/backend/
+        files: ^auto-claude/
       - id: ruff-format
-        files: ^apps/backend/
+        files: ^auto-claude/
 
-  # Python tests (apps/backend/) - run full test suite from project root
-  # Tests to skip: graphiti (external deps), merge_file_tracker/service_orchestrator/worktree/workspace (Windows path/git issues)
+  # Frontend linting (auto-claude-ui/)
   - repo: local
     hooks:
-      - id: pytest
-        name: Python Tests
-        entry: bash
-        args:
-          - -c
-          - |
-            # Run pytest directly from project root
-            if [ -f "apps/backend/.venv/bin/pytest" ]; then
-              PYTEST_CMD="apps/backend/.venv/bin/pytest"
-            elif [ -f "apps/backend/.venv/Scripts/pytest.exe" ]; then
-              PYTEST_CMD="apps/backend/.venv/Scripts/pytest.exe"
-            else
-              PYTEST_CMD="python -m pytest"
-            fi
-            $PYTEST_CMD tests/ \
-              -v \
-              --tb=short \
-              -x \
-              -m "not slow and not integration" \
-              --ignore=tests/test_graphiti.py \
-              --ignore=tests/test_merge_file_tracker.py \
-              --ignore=tests/test_service_orchestrator.py \
-              --ignore=tests/test_worktree.py \
-              --ignore=tests/test_workspace.py
+      - id: eslint
+        name: ESLint
+        entry: bash -c 'cd auto-claude-ui && pnpm lint'
         language: system
-        files: ^(apps/backend/.*\.py$|tests/.*\.py$)
-        pass_filenames: false
-
-  # Frontend linting (apps/frontend/) - Biome is 15-25x faster than ESLint
-  # NOTE: These hooks check for worktree context to avoid npm/node_modules issues
-  - repo: local
-    hooks:
-      - id: biome
-        name: Biome (lint + format)
-        entry: bash
-        args:
-          - -c
-          - |
-            # Skip in worktrees if node_modules doesn't exist (Biome not installed)
-            if [ -f ".git" ] && [ ! -d "apps/frontend/node_modules" ]; then
-              echo "Skipping Biome in worktree (node_modules not found)"
-              exit 0
-            fi
-            cd apps/frontend && npx biome check --write --no-errors-on-unmatched .
-        language: system
-        files: ^apps/frontend/.*\.(ts|tsx|js|jsx|json)$
+        files: ^auto-claude-ui/.*\.(ts|tsx|js|jsx)$
         pass_filenames: false
 
       - id: typecheck
         name: TypeScript Check
-        entry: bash
-        args:
-          - -c
-          - |
-            # Skip in worktrees if node_modules doesn't exist (dependencies not installed)
-            if [ -f ".git" ] && [ ! -d "apps/frontend/node_modules" ]; then
-              echo "Skipping TypeScript check in worktree (node_modules not found)"
-              exit 0
-            fi
-            cd apps/frontend && npm run typecheck
+        entry: bash -c 'cd auto-claude-ui && pnpm typecheck'
         language: system
-        files: ^apps/frontend/.*\.(ts|tsx)$
+        files: ^auto-claude-ui/.*\.(ts|tsx)$
         pass_filenames: false
 
   # General checks
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v6.0.0
+    rev: v5.0.0
     hooks:
       - id: trailing-whitespace
       - id: end-of-file-fixer

CLA.md

@@ -1,76 +0,0 @@
-# Auto Claude Individual Contributor License Agreement
-
-Thank you for your interest in contributing to Auto Claude. This Contributor License Agreement ("Agreement") documents the rights granted by contributors to the Project.
-
-By signing this Agreement, you accept and agree to the following terms and conditions for your present and future Contributions submitted to the Project.
-
-## 1. Definitions
-
-**"You" (or "Your")** means the individual who submits a Contribution to the Project.
-
-**"Contribution"** means any original work of authorship, including any modifications or additions to an existing work, that is intentionally submitted by You to the Project for inclusion in, or documentation of, the Project. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Project or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Project for the purpose of discussing and improving the Project.
-
-**"Project"** means Auto Claude, a multi-agent autonomous coding framework, currently available at https://github.com/AndyMik90/Auto-Claude.
-
-**"Project Owner"** means Andre Mikalsen and any designated successors or assignees.
-
-## 2. Grant of Copyright License
-
-Subject to the terms and conditions of this Agreement, You hereby grant to the Project Owner and to recipients of software distributed by the Project Owner a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to:
-
-- Reproduce, prepare derivative works of, publicly display, publicly perform, and distribute Your Contributions and such derivative works
-- Sublicense any or all of the foregoing rights to third parties
-
-## 3. Grant of Patent License
-
-Subject to the terms and conditions of this Agreement, You hereby grant to the Project Owner and to recipients of software distributed by the Project Owner a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer Your Contributions, where such license applies only to those patent claims licensable by You that are necessarily infringed by Your Contribution(s) alone or by combination of Your Contribution(s) with the Project to which such Contribution(s) was submitted.
-
-## 4. Future Licensing Flexibility
-
-You understand and agree that the Project Owner may, in the future, license the Project, including Your Contributions, under additional licenses beyond the current GNU Affero General Public License version 3.0 (AGPL-3.0). Such additional licenses may include commercial or enterprise licenses.
-
-This provision ensures the Project has proper licensing flexibility should such licensing options be introduced in the future. The open source version of the Project will continue to be available under AGPL-3.0.
-
-## 5. Representations
-
-You represent that:
-
-(a) You are legally entitled to grant the above licenses. If your employer(s) has rights to intellectual property that you create that includes your Contributions, you represent that you have received permission to make Contributions on behalf of that employer, or that your employer has waived such rights for your Contributions to the Project.
-
-(b) Each of Your Contributions is Your original creation. You represent that Your Contribution submissions include complete details of any third-party license or other restriction (including, but not limited to, related patents and trademarks) of which you are personally aware and which are associated with any part of Your Contributions.
-
-(c) Your Contribution does not violate any third-party rights, including but not limited to intellectual property rights, privacy rights, or contractual obligations.
-
-## 6. Support and Warranty Disclaimer
-
-You are not expected to provide support for Your Contributions, except to the extent You desire to provide support. You may provide support for free, for a fee, or not at all.
-
-UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING, YOU PROVIDE YOUR CONTRIBUTIONS ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY, OR FITNESS FOR A PARTICULAR PURPOSE.
-
-## 7. No Obligation to Use
-
-You understand that the decision to include Your Contribution in any project or source repository is entirely at the discretion of the Project Owner, and this Agreement does not guarantee that Your Contributions will be included in any product.
-
-## 8. Contributor Rights
-
-You retain full copyright ownership of Your Contributions. Nothing in this Agreement shall be interpreted to prohibit you from licensing Your Contributions under different terms to third parties or from using Your Contributions for any other purpose.
-
-## 9. Notification
-
-You agree to notify the Project Owner of any facts or circumstances of which you become aware that would make these representations inaccurate in any respect.
-
----
-
-## How to Sign
-
-To sign this CLA, comment on your Pull Request with:
-
-```
-I have read the CLA Document and I hereby sign the CLA
-```
-
-Your signature will be recorded automatically.
-
----
-
-*This CLA is based on the Apache Software Foundation Individual Contributor License Agreement v2.0.*

CLAUDE.md

@@ -1,295 +1,222 @@
 # CLAUDE.md
 
-This file provides guidance to Claude Code when working with this repository.
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
 
-Auto Claude is an autonomous multi-agent coding framework that plans, builds, and validates software for you. It's a monorepo with a Python backend (CLI + agent logic) and an Electron/React frontend (desktop UI).
+## Project Overview
 
-> **Deep-dive reference:** [ARCHITECTURE.md](shared_docs/ARCHITECTURE.md) | **Frontend contributing:** [apps/frontend/CONTRIBUTING.md](apps/frontend/CONTRIBUTING.md)
+Auto Claude is a multi-agent autonomous coding framework that builds software through coordinated AI agent sessions. It uses the Claude Code SDK to run agents in isolated workspaces with security controls.
 
-## Product Overview
-
-Auto Claude is a desktop application (+ CLI) where users describe a goal and AI agents autonomously handle planning, implementation, and QA validation. All work happens in isolated git worktrees so the main branch stays safe.
-
-**Core workflow:** User creates a task → Spec creation pipeline assesses complexity and writes a specification → Planner agent breaks it into subtasks → Coder agent implements (can spawn parallel subagents) → QA reviewer validates → QA fixer resolves issues → User reviews and merges.
-
-**Main features:**
-
-- **Autonomous Tasks** — Multi-agent pipeline (planner, coder, QA) that builds features end-to-end
-- **Kanban Board** — Visual task management from planning through completion
-- **Agent Terminals** — Up to 12 parallel AI-powered terminals with task context injection
-- **Insights** — AI chat interface for exploring and understanding your codebase
-- **Roadmap** — AI-assisted feature planning with strategic roadmap generation
-- **Ideation** — Discover improvements, performance issues, and security vulnerabilities
-- **GitHub/GitLab Integration** — Import issues, AI-powered investigation, PR/MR review and creation
-- **Changelog** — Generate release notes from completed tasks
-- **Memory System** — Graphiti-based knowledge graph retains insights across sessions
-- **Isolated Workspaces** — Git worktree isolation for every build; AI-powered semantic merge
-- **Flexible Authentication** — Use a Claude Code subscription (OAuth) or API profiles with any Anthropic-compatible endpoint (e.g., Anthropic API, z.ai for GLM models)
-- **Multi-Account Swapping** — Register multiple Claude accounts; when one hits a rate limit, Auto Claude automatically switches to an available account
-- **Cross-Platform** — Native desktop app for Windows, macOS, and Linux with auto-updates
-
-## Critical Rules
-
-**Claude Agent SDK only** — All AI interactions use `claude-agent-sdk`. NEVER use `anthropic.Anthropic()` directly. Always use `create_client()` from `core.client`.
-
-**i18n required** — All frontend user-facing text MUST use `react-i18next` translation keys. Never hardcode strings in JSX/TSX. Add keys to both `en/*.json` and `fr/*.json`.
-
-**Platform abstraction** — Never use `process.platform` directly. Import from `apps/frontend/src/main/platform/` or `apps/backend/core/platform/`. CI tests all three platforms.
-
-**No time estimates** — Never provide duration predictions. Use priority-based ordering instead.
-
-**PR target** — Always target the `develop` branch for PRs to AndyMik90/Auto-Claude, NOT `main`.
-
-## Work Approach
-
-**Investigate before speculating** — Always read the actual code before proposing root causes. Spawn agents to grep and read relevant source files before forming any hypothesis. Never guess at causes without evidence from the codebase.
-
-**Spawn agents for complex tasks** — When tackling complex tasks, spawn sub-agents/agent teams immediately rather than trying to handle everything in a single context window. Never attempt to analyze large codebases or multiple features monolithically.
-
-**Minimal fixes only** — Prefer the simplest approach (e.g., prompt-only changes, single guard clause) before suggesting multi-component solutions. If the user asks for X, implement X — don't bundle additional fixes they didn't request.
-
-## Known Gotchas
-
-**Electron path resolution** — For bug fixes in the Electron app, always check path resolution differences between dev and production builds (`app.isPackaged`, `process.resourcesPath`). Paths that work in dev often break when Electron is bundled for production — verify both contexts.
-
-## Project Structure
-
-```
-autonomous-coding/
-├── apps/
-│   ├── backend/                 # Python backend/CLI — ALL agent logic
-│   │   ├── core/                # client.py, auth.py, worktree.py, platform/
-│   │   ├── security/            # Command allowlisting, validators, hooks
-│   │   ├── agents/              # planner, coder, session management
-│   │   ├── qa/                  # reviewer, fixer, loop, criteria
-│   │   ├── spec/                # Spec creation pipeline
-│   │   ├── cli/                 # CLI commands (spec, build, workspace, QA)
-│   │   ├── context/             # Task context building, semantic search
-│   │   ├── runners/             # Standalone runners (spec, roadmap, insights, github)
-│   │   ├── services/            # Background services, recovery orchestration
-│   │   ├── integrations/        # graphiti/, linear, github
-│   │   ├── project/             # Project analysis, security profiles
-│   │   ├── merge/               # Intent-aware semantic merge for parallel agents
-│   │   └── prompts/             # Agent system prompts (.md)
-│   └── frontend/                # Electron desktop UI
-│       └── src/
-│           ├── main/            # Electron main process
-│           │   ├── agent/       # Agent queue, process, state, events
-│           │   ├── claude-profile/ # Multi-profile credentials, token refresh, usage
-│           │   ├── terminal/    # PTY daemon, lifecycle, Claude integration
-│           │   ├── platform/    # Cross-platform abstraction
-│           │   ├── ipc-handlers/# 40+ handler modules by domain
-│           │   ├── services/    # SDK session recovery, profile service
-│           │   └── changelog/   # Changelog generation and formatting
-│           ├── preload/         # Electron preload scripts (electronAPI bridge)
-│           ├── renderer/        # React UI
-│           │   ├── components/  # UI components (onboarding, settings, task, terminal, github, etc.)
-│           │   ├── stores/      # 24+ Zustand state stores
-│           │   ├── contexts/    # React contexts (ViewStateContext)
-│           │   ├── hooks/       # Custom hooks (useIpc, useTerminal, etc.)
-│           │   ├── styles/      # CSS / Tailwind styles
-│           │   └── App.tsx      # Root component
-│           ├── shared/          # Shared types, i18n, constants, utils
-│           │   ├── i18n/locales/# en/*.json, fr/*.json
-│           │   ├── constants/   # themes.ts, etc.
-│           │   ├── types/       # 19+ type definition files
-│           │   └── utils/       # ANSI sanitizer, shell escape, provider detection
-│           └── types/           # TypeScript type definitions
-├── guides/                      # Documentation
-├── tests/                       # Backend test suite
-└── scripts/                     # Build and utility scripts
-```
-
-## Commands Quick Reference
+## Commands
 
 ### Setup
 ```bash
-npm run install:all              # Install all dependencies from root
-# Or separately:
-cd apps/backend && uv venv && uv pip install -r requirements.txt
-cd apps/frontend && npm install
+# Install dependencies (from auto-claude/)
+uv venv && uv pip install -r requirements.txt
+# Or: python3 -m venv .venv && source .venv/bin/activate && pip install -r requirements.txt
+
+# Set up OAuth token
+claude setup-token
+# Add to auto-claude/.env: CLAUDE_CODE_OAUTH_TOKEN=your-token
+```
+
+### Creating and Running Specs
+```bash
+# Create a spec interactively
+python auto-claude/spec_runner.py --interactive
+
+# Create spec from task description
+python auto-claude/spec_runner.py --task "Add user authentication"
+
+# Force complexity level (simple/standard/complex)
+python auto-claude/spec_runner.py --task "Fix button" --complexity simple
+
+# Run autonomous build
+python auto-claude/run.py --spec 001
+
+# List all specs
+python auto-claude/run.py --list
+```
+
+### Workspace Management
+```bash
+# Review changes in isolated worktree
+python auto-claude/run.py --spec 001 --review
+
+# Merge completed build into project
+python auto-claude/run.py --spec 001 --merge
+
+# Discard build
+python auto-claude/run.py --spec 001 --discard
+```
+
+### QA Validation
+```bash
+# Run QA manually
+python auto-claude/run.py --spec 001 --qa
+
+# Check QA status
+python auto-claude/run.py --spec 001 --qa-status
 ```
 
 ### Testing
+```bash
+# Install test dependencies (required first time)
+cd auto-claude && uv pip install -r ../tests/requirements-test.txt
 
-| Stack | Command | Tool |
-|-------|---------|------|
-| Backend | `apps/backend/.venv/bin/pytest tests/ -v` | pytest |
-| Frontend unit | `cd apps/frontend && npm test` | Vitest |
-| Frontend E2E | `cd apps/frontend && npm run test:e2e` | Playwright |
-| All backend | `npm run test:backend` (from root) | pytest |
+# Run all tests (use virtual environment pytest)
+auto-claude/.venv/bin/pytest tests/ -v
+
+# Run single test file
+auto-claude/.venv/bin/pytest tests/test_security.py -v
+
+# Run specific test
+auto-claude/.venv/bin/pytest tests/test_security.py::test_bash_command_validation -v
+
+# Skip slow tests
+auto-claude/.venv/bin/pytest tests/ -m "not slow"
+```
+
+### Spec Validation
+```bash
+python auto-claude/validate_spec.py --spec-dir auto-claude/specs/001-feature --checkpoint all
+```
 
 ### Releases
 ```bash
-node scripts/bump-version.js patch|minor|major  # Bump version
-git push && gh pr create --base main             # PR to main triggers release
+# Automated version bump and release (recommended)
+node scripts/bump-version.js patch   # 2.5.5 -> 2.5.6
+node scripts/bump-version.js minor   # 2.5.5 -> 2.6.0
+node scripts/bump-version.js major   # 2.5.5 -> 3.0.0
+node scripts/bump-version.js 2.6.0   # Set specific version
+
+# Then push to trigger GitHub release workflows
+git push origin main
+git push origin v2.6.0
 ```
 
-See [RELEASE.md](RELEASE.md) for full release process.
+See [RELEASE.md](RELEASE.md) for detailed release process documentation.
 
-## Backend Development
+## Architecture
 
-### Claude Agent SDK Usage
+### Core Pipeline
 
-Client: `apps/backend/core/client.py` — `create_client()` returns a configured `ClaudeSDKClient` with security hooks, tool permissions, and MCP server integration.
+**Spec Creation (spec_runner.py)** - Dynamic 3-8 phase pipeline based on task complexity:
+- SIMPLE (3 phases): Discovery → Quick Spec → Validate
+- STANDARD (6-7 phases): Discovery → Requirements → [Research] → Context → Spec → Plan → Validate
+- COMPLEX (8 phases): Full pipeline with Research and Self-Critique phases
 
-Model and thinking level are user-configurable (via the Electron UI settings or CLI override). Use `phase_config.py` helpers to resolve the correct values
+**Implementation (run.py → agent.py)** - Multi-session build:
+1. Planner Agent creates subtask-based implementation plan
+2. Coder Agent implements subtasks (can spawn subagents for parallel work)
+3. QA Reviewer validates acceptance criteria
+4. QA Fixer resolves issues in a loop
 
-### Agent Prompts (`apps/backend/prompts/`)
+### Key Components
+
+- **client.py** - Claude SDK client with security hooks and tool permissions
+- **security.py** + **project_analyzer.py** - Dynamic command allowlisting based on detected project stack
+- **worktree.py** - Git worktree isolation for safe feature development
+- **memory.py** - File-based session memory (primary, always-available storage)
+- **graphiti_memory.py** - Optional graph-based cross-session memory with semantic search
+- **graphiti_providers.py** - Multi-provider factory for Graphiti (OpenAI, Anthropic, Azure, Ollama, Google AI)
+- **graphiti_config.py** - Configuration and validation for Graphiti integration
+- **linear_updater.py** - Optional Linear integration for progress tracking
+
+### Agent Prompts (auto-claude/prompts/)
 
 | Prompt | Purpose |
 |--------|---------|
-| planner.md | Implementation plan with subtasks |
-| coder.md / coder_recovery.md | Subtask implementation / recovery |
-| qa_reviewer.md / qa_fixer.md | Acceptance validation / issue fixes |
-| spec_gatherer/researcher/writer/critic.md | Spec creation pipeline |
+| planner.md | Creates implementation plan with subtasks |
+| coder.md | Implements individual subtasks |
+| coder_recovery.md | Recovers from stuck/failed subtasks |
+| qa_reviewer.md | Validates acceptance criteria |
+| qa_fixer.md | Fixes QA-reported issues |
+| spec_gatherer.md | Collects user requirements |
+| spec_researcher.md | Validates external integrations |
+| spec_writer.md | Creates spec.md document |
+| spec_critic.md | Self-critique using ultrathink |
 | complexity_assessor.md | AI-based complexity assessment |
 
 ### Spec Directory Structure
 
-Each spec in `.auto-claude/specs/XXX-name/` contains: `spec.md`, `requirements.json`, `context.json`, `implementation_plan.json`, `qa_report.md`, `QA_FIX_REQUEST.md`
+Each spec in `auto-claude/specs/XXX-name/` contains:
+- `spec.md` - Feature specification
+- `requirements.json` - Structured user requirements
+- `context.json` - Discovered codebase context
+- `implementation_plan.json` - Subtask-based plan with status tracking
+- `qa_report.md` - QA validation results
+- `QA_FIX_REQUEST.md` - Issues to fix (when rejected)
 
-### Memory System (Graphiti)
+### Branching & Worktree Strategy
 
-Graph-based semantic memory in `integrations/graphiti/`. Configured through the Electron app's onboarding/settings UI (CLI users can alternatively set `GRAPHITI_ENABLED=true` in `.env`). See [ARCHITECTURE.md](shared_docs/ARCHITECTURE.md#memory-system) for details.
+Auto Claude uses git worktrees for isolated builds. All branches stay LOCAL until user explicitly pushes:
 
-## Frontend Development
-
-### Tech Stack
-
-React 19, TypeScript (strict), Electron 39, Zustand 5, Tailwind CSS v4, Radix UI, xterm.js 6, Vite 7, Vitest 4, Biome 2, Motion (Framer Motion)
-
-### Path Aliases (tsconfig.json)
-
-| Alias | Maps to |
-|-------|---------|
-| `@/*` | `src/renderer/*` |
-| `@shared/*` | `src/shared/*` |
-| `@preload/*` | `src/preload/*` |
-| `@features/*` | `src/renderer/features/*` |
-| `@components/*` | `src/renderer/shared/components/*` |
-| `@hooks/*` | `src/renderer/shared/hooks/*` |
-| `@lib/*` | `src/renderer/shared/lib/*` |
-
-### State Management (Zustand)
-
-All state lives in `src/renderer/stores/`. Key stores:
-
-- `project-store.ts` — Active project, project list
-- `task-store.ts` — Tasks/specs management
-- `terminal-store.ts` — Terminal sessions and state
-- `settings-store.ts` — User preferences
-- `github/issues-store.ts`, `github/pr-review-store.ts` — GitHub integration
-- `insights-store.ts`, `roadmap-store.ts`, `kanban-settings-store.ts`
-
-Main process also has stores: `src/main/project-store.ts`, `src/main/terminal-session-store.ts`
-
-### Styling
-
-- **Tailwind CSS v4** with `@tailwindcss/postcss` plugin
-- **7 color themes** (Default, Dusk, Lime, Ocean, Retro, Neo + more) defined in `src/shared/constants/themes.ts`
-- Each theme has light/dark mode variants via CSS custom properties
-- Utility: `clsx` + `tailwind-merge` via `cn()` helper
-- Component variants: `class-variance-authority` (CVA)
-
-### IPC Communication
-
-Main ↔ Renderer communication via Electron IPC:
-- **Handlers:** `src/main/ipc-handlers/` — organized by domain (github, gitlab, ideation, context, etc.)
-- **Preload:** `src/preload/` — exposes safe APIs to renderer
-- Pattern: renderer calls via `window.electronAPI.*`, main handles in IPC handler modules
-
-### Agent Management (`src/main/agent/`)
-
-The frontend manages agent lifecycle end-to-end:
-- **`agent-queue.ts`** — Queue routing, prioritization, spec number locking
-- **`agent-process.ts`** — Spawns and manages agent subprocess communication
-- **`agent-state.ts`** — Tracks running agent state and status
-- **`agent-events.ts`** — Agent lifecycle events and state transitions
-
-### Claude Profile System (`src/main/claude-profile/`)
-
-Multi-profile credential management for switching between Claude accounts:
-- **`credential-utils.ts`** — OS credential storage (Keychain/Windows Credential Manager)
-- **`token-refresh.ts`** — OAuth token lifecycle and automatic refresh
-- **`usage-monitor.ts`** — API usage tracking and rate limiting per profile
-- **`profile-scorer.ts`** — Scores profiles by usage and availability
-
-### Terminal System (`src/main/terminal/`)
-
-Full PTY-based terminal integration:
-- **`pty-daemon.ts`** / **`pty-manager.ts`** — Background PTY process management
-- **`terminal-lifecycle.ts`** — Session creation, cleanup, event handling
-- **`claude-integration-handler.ts`** — Claude SDK integration within terminals
-- Renderer: xterm.js 6 with WebGL, fit, web-links, serialize addons. Store: `terminal-store.ts`
-
-## Code Quality
-
-### Frontend
-- **Linting:** Biome (`npm run lint` / `npm run lint:fix`)
-- **Type checking:** `npm run typecheck` (strict mode)
-- **Pre-commit:** Husky + lint-staged runs Biome on staged `.ts/.tsx/.js/.jsx/.json`
-- **Testing:** Vitest + React Testing Library + jsdom
-
-### Backend
-- **Linting:** Ruff
-- **Testing:** pytest (`apps/backend/.venv/bin/pytest tests/ -v`)
-
-## i18n Guidelines
-
-All frontend UI text uses `react-i18next`. Translation files: `apps/frontend/src/shared/i18n/locales/{en,fr}/*.json`
-
-**Namespaces:** `common`, `navigation`, `settings`, `dialogs`, `tasks`, `errors`, `onboarding`, `welcome`
-
-```tsx
-import { useTranslation } from 'react-i18next';
-const { t } = useTranslation(['navigation', 'common']);
-
-<span>{t('navigation:items.githubPRs')}</span>     // CORRECT
-<span>GitHub PRs</span>                             // WRONG
-
-// With interpolation:
-<span>{t('errors:task.parseError', { error })}</span>
+```
+main (user's branch)
+└── auto-claude/{spec-name}  ← spec branch (isolated worktree)
 ```
 
-When adding new UI text: add keys to ALL language files, use `namespace:section.key` format.
+**Key principles:**
+- ONE branch per spec (`auto-claude/{spec-name}`)
+- Parallel work uses subagents (agent decides when to spawn)
+- NO automatic pushes to GitHub - user controls when to push
+- User reviews in spec worktree (`.worktrees/{spec-name}/`)
+- Final merge: spec branch → main (after user approval)
 
-## Cross-Platform
+**Workflow:**
+1. Build runs in isolated worktree on spec branch
+2. Agent implements subtasks (can spawn subagents for parallel work)
+3. User tests feature in `.worktrees/{spec-name}/`
+4. User runs `--merge` to add to their project
+5. User pushes to remote when ready
 
-Supports Windows, macOS, Linux. CI tests all three.
+### Security Model
 
-**Platform modules:** `apps/frontend/src/main/platform/` and `apps/backend/core/platform/`
+Three-layer defense:
+1. **OS Sandbox** - Bash command isolation
+2. **Filesystem Permissions** - Operations restricted to project directory
+3. **Command Allowlist** - Dynamic allowlist from project analysis (security.py + project_analyzer.py)
 
-| Function | Purpose |
-|----------|---------|
-| `isWindows()` / `isMacOS()` / `isLinux()` | OS detection |
-| `getPathDelimiter()` | `;` (Win) or `:` (Unix) |
-| `findExecutable(name)` | Cross-platform executable lookup |
-| `requiresShell(command)` | `.cmd/.bat` shell detection (Win) |
+Security profile cached in `.auto-claude-security.json`.
 
-Never hardcode paths. Use `findExecutable()` and `joinPaths()`. See [ARCHITECTURE.md](shared_docs/ARCHITECTURE.md#cross-platform-development) for extended guide.
+### Memory System
 
-## E2E Testing (Electron MCP)
+Dual-layer memory architecture:
 
-QA agents can interact with the running Electron app via Chrome DevTools Protocol:
+**File-Based Memory (Primary)** - `memory.py`
+- Zero dependencies, always available
+- Human-readable files in `specs/XXX/memory/`
+- Session insights, patterns, gotchas, codebase map
 
-1. Start app: `npm run dev:debug` (debug mode for AI self-validation via Electron MCP)
-2. Set `ELECTRON_MCP_ENABLED=true` in `apps/backend/.env`
-3. Run QA: `python run.py --spec 001 --qa`
-
-Tools: `take_screenshot`, `click_by_text`, `fill_input`, `get_page_structure`, `send_keyboard_shortcut`, `eval`. See [ARCHITECTURE.md](shared_docs/ARCHITECTURE.md#end-to-end-testing) for full capabilities.
-
-## Running the Application
+**Graphiti Memory (Optional Enhancement)** - `graphiti_memory.py`
+- Graph database with semantic search (LadybugDB - embedded, no Docker)
+- Cross-session context retrieval
+- Requires Python 3.12+
+- Multi-provider support:
+  - LLM: OpenAI, Anthropic, Azure OpenAI, Ollama, Google AI (Gemini)
+  - Embedders: OpenAI, Voyage AI, Azure OpenAI, Ollama, Google AI
 
 ```bash
-# CLI only
-cd apps/backend && python run.py --spec 001
-
-# Desktop app
-npm start          # Production build + run
-npm run dev        # Development mode with HMR
-npm run dev:debug  # Debug mode with verbose output
-npm run dev:mcp    # Electron MCP server for AI debugging
-
-# Project data: .auto-claude/specs/ (gitignored)
+# Setup (requires Python 3.12+)
+pip install real_ladybug graphiti-core
 ```
+
+Enable with: `GRAPHITI_ENABLED=true` + provider credentials. See `.env.example`.
+
+## Project Structure
+
+Auto Claude can be used in two ways:
+
+**As a standalone CLI tool** (original project):
+```bash
+python auto-claude/run.py --spec 001
+```
+
+**With the optional Electron frontend** (`auto-claude-ui/`):
+- Provides a GUI for task management and progress tracking
+- Wraps the CLI commands - the backend works independently
+
+**Directory layout:**
+- `auto-claude/` - Python backend/CLI (the framework code)
+- `auto-claude-ui/` - Optional Electron frontend
+- `.auto-claude/specs/` - Per-project data (specs, plans, QA reports) - gitignored

CONTRIBUTING.md

@@ -2,209 +2,120 @@
 
 Thank you for your interest in contributing to Auto Claude! This document provides guidelines and instructions for contributing to the project.
 
-## How to Contribute
-
-| What you want to do | Where to start |
-|----------------------|----------------|
-| Bug fixes & small improvements | Open a PR directly |
-| New features / architecture changes | Start a [GitHub Discussion](https://github.com/AndyMik90/Auto-Claude/discussions) or ask in [Discord](https://discord.com/channels/1448614759996854284/1451298184612548779) first |
-| Questions & setup help | [Discord #setup-help](https://discord.com/channels/1448614759996854284/1451298184612548779) |
-
-## AI-Assisted Contributions
-
-PRs built with AI tools (Claude, Codex, Copilot, etc.) are welcome here -- given what this project does, it would be odd if they weren't.
-
-That said, we've seen AI-generated PRs that introduce regressions because the contributor didn't verify what the code actually does. To keep quality high, we ask that AI-assisted PRs include the following:
-
-- **Flag it** -- mention AI assistance in the PR description (the PR template has a section for this)
-- **State your testing level** -- untested, lightly tested, or fully tested
-- **Share context if you can** -- prompts or session logs help reviewers understand intent
-- **Confirm you understand the code** -- you should be able to describe what the PR does and how the underlying code works
-
-AI-assisted PRs go through the same review process as any other contribution. Transparency just helps reviewers know where to look more carefully.
-
 ## Table of Contents
 
-- [How to Contribute](#how-to-contribute)
-- [AI-Assisted Contributions](#ai-assisted-contributions)
-- [Contributor License Agreement (CLA)](#contributor-license-agreement-cla)
 - [Prerequisites](#prerequisites)
-- [Quick Start](#quick-start)
 - [Development Setup](#development-setup)
+  - [Python Backend](#python-backend)
+  - [Electron Frontend](#electron-frontend)
+- [Running from Source](#running-from-source)
 - [Pre-commit Hooks](#pre-commit-hooks)
 - [Code Style](#code-style)
 - [Testing](#testing)
 - [Continuous Integration](#continuous-integration)
 - [Git Workflow](#git-workflow)
-  - [Working with Forks](#working-with-forks)
-  - [Branch Overview](#branch-overview)
-  - [Main Branches](#main-branches)
-  - [Supporting Branches](#supporting-branches)
   - [Branch Naming](#branch-naming)
-  - [Where to Branch From](#where-to-branch-from)
-  - [Pull Request Targets](#pull-request-targets)
-  - [Release Process](#release-process-maintainers)
   - [Commit Messages](#commit-messages)
-  - [PR Hygiene](#pr-hygiene)
 - [Pull Request Process](#pull-request-process)
 - [Issue Reporting](#issue-reporting)
 - [Architecture Overview](#architecture-overview)
 
-## Contributor License Agreement (CLA)
-
-All contributors must sign our Contributor License Agreement (CLA) before contributions can be accepted.
-
-### Why We Require a CLA
-
-Auto Claude is currently licensed under AGPL-3.0. The CLA ensures the project has proper licensing flexibility should we introduce additional licensing options (such as commercial/enterprise licenses) in the future.
-
-You retain full copyright ownership of your contributions.
-
-### How to Sign
-
-1. Open a Pull Request
-2. The CLA bot will automatically comment with instructions
-3. Comment on the PR with: `I have read the CLA Document and I hereby sign the CLA`
-4. Done - you only need to sign once, and it applies to all future contributions
-
-Read the full CLA here: [CLA.md](CLA.md)
-
 ## Prerequisites
 
 Before contributing, ensure you have the following installed:
 
-- **Python 3.12+** - For the backend framework
-- **Node.js 24+** - For the Electron frontend
-- **npm 10+** - Package manager for the frontend (comes with Node.js)
+- **Python 3.8+** - For the backend framework
+- **Node.js 18+** - For the Electron frontend
+- **pnpm** - Package manager for the frontend (`npm install -g pnpm`)
 - **uv** (recommended) or **pip** - Python package manager
-- **CMake** - Required for building native dependencies (e.g., LadybugDB)
 - **Git** - Version control
 
-### Installing Python 3.12
-
-**Windows:**
-```bash
-winget install Python.Python.3.12
-```
-
-**macOS:**
-```bash
-brew install python@3.12
-```
-
-**Linux (Ubuntu/Debian):**
-```bash
-sudo apt install python3.12 python3.12-venv
-```
-
-**Linux (Fedora):**
-```bash
-sudo dnf install python3.12
-```
-
-### Installing Node.js 24+
-
-**Windows:**
-```bash
-winget install OpenJS.NodeJS.LTS
-```
-
-**macOS:**
-```bash
-brew install node@24
-```
-
-**Linux (Ubuntu/Debian):**
-```bash
-curl -fsSL https://deb.nodesource.com/setup_24.x | sudo -E bash -
-sudo apt install -y nodejs
-```
-
-**Linux (Fedora):**
-```bash
-sudo dnf install nodejs npm
-```
-
-### Installing CMake
-
-**Windows:**
-```bash
-winget install Kitware.CMake
-```
-
-**macOS:**
-```bash
-brew install cmake
-```
-
-**Linux (Ubuntu/Debian):**
-```bash
-sudo apt install cmake
-```
-
-**Linux (Fedora):**
-```bash
-sudo dnf install cmake
-```
-
-## Quick Start
-
-The fastest way to get started:
-
-```bash
-# Clone the repository
-git clone https://github.com/AndyMik90/Auto-Claude.git
-cd Auto-Claude
-
-# Install all dependencies (cross-platform)
-npm run install:all
-
-# Run in development mode
-npm run dev
-
-# Or build and run production
-npm start
-```
-
 ## Development Setup
 
 The project consists of two main components:
 
-1. **Python Backend** (`apps/backend/`) - The core autonomous coding framework
-2. **Electron Frontend** (`apps/frontend/`) - Desktop UI
+1. **Python Backend** (`auto-claude/`) - The core autonomous coding framework
+2. **Electron Frontend** (`auto-claude-ui/`) - Optional desktop UI
 
-From the repository root, two commands handle everything:
+### Python Backend
 
 ```bash
-# Install all dependencies (Python backend + Electron frontend)
-npm run install:all
+# Navigate to the auto-claude directory
+cd auto-claude
 
-# Start development mode (hot reload)
-npm run dev
+# Create virtual environment (using uv - recommended)
+uv venv
+source .venv/bin/activate  # On Windows: .venv\Scripts\activate
+uv pip install -r requirements.txt
+
+# Or using standard Python
+python3 -m venv .venv
+source .venv/bin/activate
+pip install -r requirements.txt
+
+# Install test dependencies
+pip install -r ../tests/requirements-test.txt
+
+# Set up environment
+cp .env.example .env
+# Edit .env and add your CLAUDE_CODE_OAUTH_TOKEN (get it via: claude setup-token)
 ```
 
-`npm run install:all` automatically:
-- Detects Python 3.12+ on your system
-- Creates a virtual environment (`apps/backend/.venv`)
-- Installs backend runtime and test dependencies
-- Copies `.env.example` to `.env` (if not already present)
-- Installs frontend npm dependencies
+### Electron Frontend
 
-After install, configure your credentials in `apps/backend/.env`:
 ```bash
-# Get your Claude Code OAuth token
-claude setup-token
+# Navigate to the UI directory
+cd auto-claude-ui
 
-# Then edit apps/backend/.env with your token and any other provider keys
+# Install dependencies
+pnpm install
+
+# Start development server
+pnpm dev
+
+# Build for production
+pnpm build
+
+# Package for distribution
+pnpm package
 ```
 
-### Other Useful Commands
+## Running from Source
+
+If you want to run Auto Claude from source (for development or testing unreleased features), follow these steps:
+
+### Step 1: Clone and Set Up Python Backend
 
 ```bash
-npm start              # Build and run production
-npm run build          # Build frontend for production
-npm run package        # Package for distribution
-npm run test:backend   # Run Python tests
+git clone https://github.com/AndyMik90/Auto-Claude.git
+cd Auto-Claude/auto-claude
+
+# Using uv (recommended)
+uv venv && uv pip install -r requirements.txt
+
+# Or using standard Python
+python3 -m venv .venv
+source .venv/bin/activate  # On Windows: .venv\Scripts\activate
+pip install -r requirements.txt
+
+# Set up environment
+cp .env.example .env
+# Edit .env and add your CLAUDE_CODE_OAUTH_TOKEN (get it via: claude setup-token)
+```
+
+### Step 2: Run the Desktop UI
+
+```bash
+cd ../auto-claude-ui
+
+# Install dependencies
+pnpm install
+
+# Development mode (hot reload)
+pnpm dev
+
+# Or production build
+pnpm run build && pnpm run start
 ```
 
 <details>
@@ -215,7 +126,7 @@ Auto Claude automatically downloads prebuilt binaries for Windows. If prebuilts
 1. Download [Visual Studio Build Tools 2022](https://visualstudio.microsoft.com/visual-cpp-build-tools/)
 2. Select "Desktop development with C++" workload
 3. In "Individual Components", add "MSVC v143 - VS 2022 C++ x64/x86 Spectre-mitigated libs"
-4. Restart terminal and run `npm install` again
+4. Restart terminal and run `pnpm install` again
 
 </details>
 
@@ -241,10 +152,10 @@ When you commit, the following checks run automatically:
 
 | Check | Scope | Description |
 |-------|-------|-------------|
-| **ruff** | `apps/backend/` | Python linter with auto-fix |
-| **ruff-format** | `apps/backend/` | Python code formatter |
-| **eslint** | `apps/frontend/` | TypeScript/React linter |
-| **typecheck** | `apps/frontend/` | TypeScript type checking |
+| **ruff** | `auto-claude/` | Python linter with auto-fix |
+| **ruff-format** | `auto-claude/` | Python code formatter |
+| **eslint** | `auto-claude-ui/` | TypeScript/React linter |
+| **typecheck** | `auto-claude-ui/` | TypeScript type checking |
 | **trailing-whitespace** | All files | Removes trailing whitespace |
 | **end-of-file-fixer** | All files | Ensures files end with newline |
 | **check-yaml** | All files | Validates YAML syntax |
@@ -301,7 +212,7 @@ def gnc(sd):
 ### TypeScript/React
 
 - Use TypeScript strict mode
-- Follow the existing component patterns in `apps/frontend/src/`
+- Follow the existing component patterns in `auto-claude-ui/src/`
 - Use functional components with hooks
 - Prefer named exports over default exports
 - Use the UI components from `src/renderer/components/ui/`
@@ -326,88 +237,25 @@ export default function(props) {
 - End files with a newline
 - Keep line length under 100 characters when practical
 
-### File Encoding (Python)
-
-**Always specify `encoding="utf-8"` for text file operations** to ensure Windows compatibility.
-
-Windows Python defaults to `cp1252` encoding instead of UTF-8, causing errors with:
-- Emoji (🚀, ✅, ❌)
-- International characters (ñ, é, 中文, العربية)
-- Special symbols (™, ©, ®)
-
-**DO:**
-
-```python
-# Reading files
-with open(path, encoding="utf-8") as f:
-    content = f.read()
-
-# Writing files
-with open(path, "w", encoding="utf-8") as f:
-    f.write(content)
-
-# Path methods
-from pathlib import Path
-content = Path(file).read_text(encoding="utf-8")
-Path(file).write_text(content, encoding="utf-8")
-
-# JSON files - reading
-import json
-with open(path, encoding="utf-8") as f:
-    data = json.load(f)
-
-# JSON files - writing
-with open(path, "w", encoding="utf-8") as f:
-    json.dump(data, f, ensure_ascii=False, indent=2)
-```
-
-**DON'T:**
-
-```python
-# Wrong - platform-dependent encoding
-with open(path) as f:
-    content = f.read()
-
-# Wrong - Path methods without encoding
-content = Path(file).read_text()
-
-# Wrong - encoding on json.dump (not open!)
-json.dump(data, f, encoding="utf-8")  # ERROR
-```
-
-**Binary files - NO encoding:**
-
-```python
-with open(path, "rb") as f:  # Correct
-    data = f.read()
-```
-
-Our pre-commit hooks automatically check for missing encoding parameters. See [PR #782](https://github.com/AndyMik90/Auto-Claude/pull/782) for the comprehensive encoding fix and [guides/windows-development.md](guides/windows-development.md) for Windows-specific development guidance.
-
 ## Testing
 
 ### Python Tests
 
 ```bash
-# Run all tests (from repository root)
-npm run test:backend
-
-# Or manually with pytest
-cd apps/backend
-.venv/Scripts/pytest.exe ../tests -v          # Windows
-.venv/bin/pytest ../tests -v                   # macOS/Linux
+# Run all tests
+pytest tests/ -v
 
 # Run a specific test file
-npm run test:backend -- tests/test_security.py -v
+pytest tests/test_security.py -v
 
 # Run a specific test
-npm run test:backend -- tests/test_security.py::test_bash_command_validation -v
+pytest tests/test_security.py::test_bash_command_validation -v
 
 # Skip slow tests
-npm run test:backend -- -m "not slow"
+pytest tests/ -m "not slow"
 
 # Run with coverage
-pytest tests/ --cov=apps/backend --cov-report=html
+pytest tests/ --cov=auto-claude --cov-report=html
 ```
 
 Test configuration is in `tests/pytest.ini`.
@@ -415,26 +263,26 @@ Test configuration is in `tests/pytest.ini`.
 ### Frontend Tests
 
 ```bash
-cd apps/frontend
+cd auto-claude-ui
 
 # Run unit tests
-npm test
+pnpm test
 
 # Run tests in watch mode
-npm run test:watch
+pnpm test:watch
 
 # Run with coverage
-npm run test:coverage
+pnpm test:coverage
 
 # Run E2E tests (requires built app)
-npm run build
-npm run test:e2e
+pnpm build
+pnpm test:e2e
 
 # Run linting
-npm run lint
+pnpm lint
 
 # Run type checking
-npm run typecheck
+pnpm typecheck
 ```
 
 ### Testing Requirements
@@ -456,6 +304,7 @@ All pull requests and pushes to `main` trigger automated CI checks via GitHub Ac
 |----------|---------|----------------|
 | **CI** | Push to `main`, PRs | Python tests (3.11 & 3.12), Frontend tests |
 | **Lint** | Push to `main`, PRs | Ruff (Python), ESLint + TypeScript (Frontend) |
+| **Test on Tag** | Version tags (`v*`) | Full test suite before release |
 
 ### PR Requirements
 
@@ -471,116 +320,19 @@ Before a PR can be merged:
 
 ```bash
 # Python tests
-cd apps/backend
+cd auto-claude
 source .venv/bin/activate
-pytest ../../tests/ -v
+pytest ../tests/ -v
 
 # Frontend tests
-cd apps/frontend
-npm test
-npm run lint
-npm run typecheck
+cd auto-claude-ui
+pnpm test
+pnpm lint
+pnpm typecheck
 ```
 
 ## Git Workflow
 
-We use a **Git Flow** branching strategy to manage releases and parallel development.
-
-### Working with Forks
-
-When contributing to Auto Claude, you'll typically fork the repository first. Proper fork configuration is essential to avoid sync issues.
-
-#### Initial Fork Setup
-
-```bash
-# 1. Fork on GitHub (click the Fork button on the repo page)
-
-# 2. Clone YOUR fork (not the original repo)
-git clone https://github.com/YOUR-USERNAME/Auto-Claude.git
-cd Auto-Claude
-
-# 3. Verify your remotes point to YOUR fork
-git remote -v
-# Should show:
-# origin  https://github.com/YOUR-USERNAME/Auto-Claude.git (fetch)
-# origin  https://github.com/YOUR-USERNAME/Auto-Claude.git (push)
-
-# 4. Add upstream remote to sync with the original repo
-git remote add upstream https://github.com/AndyMik90/Auto-Claude.git
-```
-
-#### Keeping Your Fork Updated
-
-```bash
-# Fetch latest changes from upstream
-git fetch upstream
-
-# Sync your develop branch with upstream
-git checkout develop
-git merge upstream/develop
-git push origin develop
-```
-
-#### Converting a Fork to Standalone
-
-> ⚠️ **Common Issue:** After making a fork standalone (e.g., disconnecting from the original repo on GitHub), your local git configuration may still reference the original forked repository, causing push/pull issues.
-
-If you convert your fork to a standalone repository:
-
-```bash
-# 1. Update origin to point to your standalone repo
-git remote set-url origin https://github.com/YOUR-USERNAME/Your-Standalone-Repo.git
-
-# 2. Remove the upstream remote (no longer applicable)
-git remote remove upstream
-
-# 3. Verify your configuration
-git remote -v
-# Should only show your standalone repo as origin
-
-# 4. Update your default branch tracking if needed
-git branch --set-upstream-to=origin/main main
-git branch --set-upstream-to=origin/develop develop
-```
-
-#### Troubleshooting Fork Issues
-
-| Problem | Cause | Solution |
-|---------|-------|----------|
-| `Permission denied` on push | Origin points to upstream repo | `git remote set-url origin <your-fork-url>` |
-| `Repository not found` | Fork was deleted or made standalone | Update remote URL to current repo location |
-| Can't push to develop | Local branch tracks wrong remote | `git branch --set-upstream-to=origin/develop` |
-| Commits show wrong author | Git config not set | `git config user.email "you@example.com"` |
-
-### Branch Overview
-
-```
-main (stable)          ← Only released, tested code (tagged versions)
-  │
-develop                ← Integration branch - all PRs merge here first
-  │
-├── feature/xxx        ← New features
-├── fix/xxx            ← Bug fixes
-├── release/vX.Y.Z     ← Release preparation
-└── hotfix/xxx         ← Emergency production fixes
-```
-
-### Main Branches
-
-| Branch | Purpose | Protected |
-|--------|---------|-----------|
-| `main` | Production-ready code. Only receives merges from `release/*` or `hotfix/*` branches. Every merge is tagged (v2.7.0, v2.8.0, etc.) | ✅ Yes |
-| `develop` | Integration branch where all features and fixes are combined. This is the default target for all PRs. | ✅ Yes |
-
-### Supporting Branches
-
-| Branch Type | Branch From | Merge To | Purpose |
-|-------------|-------------|----------|---------|
-| `feature/*` | `develop` | `develop` | New features and enhancements |
-| `fix/*` | `develop` | `develop` | Bug fixes (non-critical) |
-| `release/*` | `develop` | `main` + `develop` | Release preparation and final testing |
-| `hotfix/*` | `main` | `main` + `develop` | Critical production bug fixes |
-
 ### Branch Naming
 
 Use descriptive branch names with a prefix indicating the type of change:
@@ -589,146 +341,10 @@ Use descriptive branch names with a prefix indicating the type of change:
 |--------|---------|---------|
 | `feature/` | New feature | `feature/add-dark-mode` |
 | `fix/` | Bug fix | `fix/memory-leak-in-worker` |
-| `hotfix/` | Urgent production fix | `hotfix/critical-crash-fix` |
 | `docs/` | Documentation | `docs/update-readme` |
 | `refactor/` | Code refactoring | `refactor/simplify-auth-flow` |
 | `test/` | Test additions/fixes | `test/add-integration-tests` |
 | `chore/` | Maintenance tasks | `chore/update-dependencies` |
-| `release/` | Release preparation | `release/v2.8.0` |
-| `hotfix/` | Emergency fixes | `hotfix/critical-auth-bug` |
-
-### Where to Branch From
-
-```bash
-# For features and bug fixes - ALWAYS branch from develop
-git checkout develop
-git pull origin develop
-git checkout -b feature/my-new-feature
-
-# For hotfixes only - branch from main
-git checkout main
-git pull origin main
-git checkout -b hotfix/critical-fix
-```
-
-### Pull Request Targets
-
-> ⚠️ **Important:** All PRs should target `develop`, NOT `main`!
-
-| Your Branch Type | Target Branch |
-|------------------|---------------|
-| `feature/*` | `develop` |
-| `fix/*` | `develop` |
-| `docs/*` | `develop` |
-| `refactor/*` | `develop` |
-| `test/*` | `develop` |
-| `chore/*` | `develop` |
-| `hotfix/*` | `main` (maintainers only) |
-| `release/*` | `main` (maintainers only) |
-
-### Release Process (Maintainers)
-
-When ready to release a new version:
-
-```bash
-# 1. Create release branch from develop
-git checkout develop
-git pull origin develop
-git checkout -b release/v2.8.0
-
-# 2. Update version numbers, CHANGELOG, final fixes only
-# No new features allowed in release branches!
-
-# 3. Merge to main and tag
-git checkout main
-git merge release/v2.8.0
-git tag v2.8.0
-git push origin main --tags
-
-# 4. Merge back to develop (important!)
-git checkout develop
-git merge release/v2.8.0
-git push origin develop
-
-# 5. Delete release branch
-git branch -d release/v2.8.0
-git push origin --delete release/v2.8.0
-```
-
-### Beta Release Process (Maintainers)
-
-Beta releases allow users to test new features before they're included in a stable release. Beta releases are published from the `develop` branch.
-
-**Creating a Beta Release:**
-
-1. Go to **Actions** → **Beta Release** workflow in GitHub
-2. Click **Run workflow**
-3. Enter the beta version (e.g., `2.8.0-beta.1`)
-4. Optionally enable dry run to test without publishing
-5. Click **Run workflow**
-
-The workflow will:
-- Validate the version format
-- Update `package.json` on develop
-- Create and push a tag (e.g., `v2.8.0-beta.1`)
-- Build installers for all platforms
-- Create a GitHub pre-release
-
-**Version Format:**
-```
-X.Y.Z-beta.N   (e.g., 2.8.0-beta.1, 2.8.0-beta.2)
-X.Y.Z-alpha.N  (e.g., 2.8.0-alpha.1)
-X.Y.Z-rc.N     (e.g., 2.8.0-rc.1)
-```
-
-**For Users:**
-Users can opt into beta updates in Settings → Updates → "Beta Updates" toggle. When enabled, the app will check for and install beta versions. Users can switch back to stable at any time.
-
-### Hotfix Workflow
-
-For urgent production fixes that can't wait for the normal release cycle:
-
-**1. Create hotfix from main**
-
-```bash
-git checkout main
-git pull origin main
-git checkout -b hotfix/150-critical-fix
-```
-
-**2. Fix the issue**
-
-```bash
-# ... make changes ...
-git commit -m "hotfix: fix critical crash on startup"
-```
-
-**3. Open PR to main (fast-track review)**
-
-```bash
-gh pr create --base main --title "hotfix: fix critical crash on startup"
-```
-
-**4. After merge to main, sync to develop**
-
-```bash
-git checkout develop
-git pull origin develop
-git merge main
-git push origin develop
-```
-
-```
-main ─────●─────●─────●─────●───── (production)
-          ↑     ↑     ↑     ↑
-develop ──●─────●─────●─────●───── (integration)
-          ↑     ↑     ↑
-feature/123 ────●
-feature/124 ──────────●
-hotfix/125 ─────────────────●───── (from main, merge to both)
-```
-
-> **Note:** Hotfixes branch FROM `main` and merge TO `main` first, then sync back to `develop` to keep branches aligned.
 
 ### Commit Messages
 
@@ -760,60 +376,19 @@ git commit -m "WIP"
 - **body**: Detailed explanation if needed (wrap at 72 chars)
 - **footer**: Reference issues, breaking changes
 
-### PR Hygiene
-
-**Rebasing:**
-- **Rebase onto develop** before opening a PR and before merge to maintain linear history
-- Use `git fetch origin && git rebase origin/develop` to sync your branch
-- Use `--force-with-lease` when force-pushing rebased branches (safer than `--force`)
-- Notify reviewers after force-pushing during active review
-- **Exception:** Never rebase after PR is approved and others have reviewed specific commits
-
-**Commit organization:**
-- **Squash fixup commits** (typos, "oops", review feedback) into their parent commits
-- **Keep logically distinct changes** as separate commits that could be reverted independently
-- Each commit should compile and pass tests independently
-- No "WIP", "fix tests", or "lint" commits in final PR - squash these
-
-**Before requesting review:**
-```bash
-# Ensure up-to-date with develop
-git fetch origin && git rebase origin/develop
-
-# Clean up commit history (squash fixups, reword messages)
-git rebase -i origin/develop
-
-# Force push with safety check
-git push --force-with-lease
-
-# Verify everything works
-npm run test:backend
-cd apps/frontend && npm test && npm run lint && npm run typecheck
-```
-
-**PR size:**
-- Keep PRs small (<400 lines changed ideally)
-- Split large features into stacked PRs if possible
-
 ## Pull Request Process
 
-1. **Fork the repository** and create your branch from `develop` (not main!)
-
-   ```bash
-   git checkout develop
-   git pull origin develop
-   git checkout -b feature/your-feature-name
-   ```
+1. **Fork the repository** and create your branch from `main`
 
 2. **Make your changes** following the code style guidelines
 
 3. **Test thoroughly**:
    ```bash
-   # Python (from repository root)
-   npm run test:backend
+   # Python
+   pytest tests/ -v
 
    # Frontend
-   cd apps/frontend && npm test && npm run lint && npm run typecheck
+   cd auto-claude-ui && pnpm test && pnpm lint && pnpm typecheck
    ```
 
 4. **Update documentation** if your changes affect:
@@ -872,7 +447,7 @@ When requesting a feature:
 
 Auto Claude consists of two main parts:
 
-### Python Backend (`apps/backend/`)
+### Python Backend (`auto-claude/`)
 
 The core autonomous coding framework:
 
@@ -882,9 +457,9 @@ The core autonomous coding framework:
 - **Memory**: `memory.py` (file-based), `graphiti_memory.py` (graph-based)
 - **QA**: `qa_loop.py`, `prompts/qa_*.md`
 
-### Electron Frontend (`apps/frontend/`)
+### Electron Frontend (`auto-claude-ui/`)
 
-Desktop interface:
+Optional desktop interface:
 
 - **Main Process**: `src/main/` - Electron main process, IPC handlers
 - **Renderer**: `src/renderer/` - React UI components

INVESTIGATION.md

@@ -0,0 +1,641 @@
+# Investigation: v2.7.1 Release Artifacts Issue
+
+## Investigation Date
+
+2025-12-25
+
+## Summary
+
+The v2.7.1 release has **incorrect files attached**. All artifacts have v2.7.0 in their filenames, indicating the wrong build artifacts were uploaded.
+
+---
+
+## Phase 1: Reproduce and Verify Issue
+
+### Subtask 1-1: Current v2.7.1 Assets
+
+**Command:** `gh release view v2.7.1 --json assets -q '.assets[].name'`
+
+**Release Metadata:**
+- Tag Name: v2.7.1
+- Release Name: v2.7.1
+- Published At: 2025-12-22T13:35:38Z
+- Is Draft: false
+- Is Prerelease: false
+
+**Files Currently Attached to v2.7.1:**
+
+| File Name | Size (bytes) | Expected Name |
+|-----------|-------------|---------------|
+| Auto-Claude-2.7.0-darwin-arm64.dmg | 124,187,073 | Auto-Claude-2.7.1-darwin-arm64.dmg |
+| Auto-Claude-2.7.0-darwin-arm64.zip | 117,694,085 | Auto-Claude-2.7.1-darwin-arm64.zip |
+| Auto-Claude-2.7.0-darwin-x64.dmg | 130,635,398 | Auto-Claude-2.7.1-darwin-x64.dmg |
+| Auto-Claude-2.7.0-darwin-x64.zip | 124,176,354 | Auto-Claude-2.7.1-darwin-x64.zip |
+| Auto-Claude-2.7.0-linux-amd64.deb | 104,558,694 | Auto-Claude-2.7.1-linux-amd64.deb |
+| Auto-Claude-2.7.0-linux-x86_64.AppImage | 145,482,885 | Auto-Claude-2.7.1-linux-x86_64.AppImage |
+| Auto-Claude-2.7.0-win32-x64.exe | 101,941,972 | Auto-Claude-2.7.1-win32-x64.exe |
+| checksums.sha256 | 718 | checksums.sha256 (with v2.7.1 filenames) |
+
+### Issue Confirmed
+
+**Problem:** All 7 platform artifacts attached to v2.7.1 have "2.7.0" in their filename instead of "2.7.1".
+
+**Impact:**
+- Users downloading v2.7.1 are receiving v2.7.0 binaries
+- File naming does not match the release version
+- Checksums file likely references v2.7.0 filenames
+- Auto-update mechanisms may be confused by version mismatch
+
+**Evidence:**
+```
+Files attached to v2.7.1:
+- Auto-Claude-2.7.0-darwin-arm64.dmg   (WRONG - should be 2.7.1)
+- Auto-Claude-2.7.0-darwin-arm64.zip   (WRONG - should be 2.7.1)
+- Auto-Claude-2.7.0-darwin-x64.dmg     (WRONG - should be 2.7.1)
+- Auto-Claude-2.7.0-darwin-x64.zip     (WRONG - should be 2.7.1)
+- Auto-Claude-2.7.0-linux-amd64.deb    (WRONG - should be 2.7.1)
+- Auto-Claude-2.7.0-linux-x86_64.AppImage (WRONG - should be 2.7.1)
+- Auto-Claude-2.7.0-win32-x64.exe      (WRONG - should be 2.7.1)
+- checksums.sha256                      (likely references wrong filenames)
+```
+
+---
+
+### Subtask 1-2: Comparison with v2.7.0 and Expected Naming
+
+**Command:** `gh release view v2.7.0 --json assets -q '.assets[].name'`
+
+#### v2.7.0 Release Analysis
+
+**Release Metadata:**
+- Tag Name: v2.7.0
+- Release Name: v2.7.0
+- Published At: 2025-12-22T13:19:13Z
+- Target Commitish: main
+- Is Draft: false
+- Is Prerelease: false
+
+**Critical Finding:** v2.7.0 has **NO assets attached** (empty assets array).
+
+#### Release Timeline
+
+| Release | Published At | Assets Count | Status |
+|---------|-------------|--------------|--------|
+| v2.7.0  | 2025-12-22T13:19:13Z | 0 | No files attached |
+| v2.7.1  | 2025-12-22T13:35:38Z | 8 | Wrong version in filenames |
+| v2.7.2  | 2025-12-22T13:52:51Z | ? | Draft release |
+
+**Observation:** v2.7.0 was published 16 minutes before v2.7.1, but has no artifacts attached.
+
+#### Checksums File Analysis
+
+The `checksums.sha256` file attached to v2.7.1 contains:
+```
+0a0094ff3e52609665f6f0d6d54180dbfc592956f91ef2cdd94e43a61b6b24d2  ./Auto-Claude-2.7.0-darwin-arm64.dmg
+43b168f3073d60644bb111c8fa548369431dc448e67700ed526cb4cad61034e0  ./Auto-Claude-2.7.0-darwin-arm64.zip
+5150cbba934fbeb3d97309a493cc8ef3c035e9ec38b31f01382d628025f5c451  ./Auto-Claude-2.7.0-darwin-x64.dmg
+ea9139277290a8189f799d00bc3cd1aaf81a16e890ff90327eca01a4cce73e61  ./Auto-Claude-2.7.0-darwin-x64.zip
+078b2ba6a2594bf048932776dc31a45e59cd9cb23b34b2cf2f810f4101f04736  ./Auto-Claude-2.7.0-linux-amd64.deb
+1feb6b9be348a5e23238e009dbc1ce8b2788103a262cd856613332b3ab1711e9  ./Auto-Claude-2.7.0-linux-x86_64.AppImage
+25383314b3bc032ceaf8a8416d5383879ed351c906f03175b8533047647a612d  ./Auto-Claude-2.7.0-win32-x64.exe
+```
+
+**Issue:** Checksums file also references v2.7.0 filenames, confirming the build was run with v2.7.0 version.
+
+#### Expected Naming Pattern (from release.yml)
+
+Based on the release workflow analysis, artifacts follow this naming convention:
+```
+Auto-Claude-{version}-{platform}-{arch}.{ext}
+```
+
+Where version comes from `package.json` in `auto-claude-ui/`.
+
+**Expected v2.7.1 Artifacts:**
+| Expected Filename | Actual Filename (Wrong) |
+|-------------------|-------------------------|
+| Auto-Claude-2.7.1-darwin-arm64.dmg | Auto-Claude-2.7.0-darwin-arm64.dmg |
+| Auto-Claude-2.7.1-darwin-arm64.zip | Auto-Claude-2.7.0-darwin-arm64.zip |
+| Auto-Claude-2.7.1-darwin-x64.dmg | Auto-Claude-2.7.0-darwin-x64.dmg |
+| Auto-Claude-2.7.1-darwin-x64.zip | Auto-Claude-2.7.0-darwin-x64.zip |
+| Auto-Claude-2.7.1-linux-amd64.deb | Auto-Claude-2.7.0-linux-amd64.deb |
+| Auto-Claude-2.7.1-linux-x86_64.AppImage | Auto-Claude-2.7.0-linux-x86_64.AppImage |
+| Auto-Claude-2.7.1-win32-x64.exe | Auto-Claude-2.7.0-win32-x64.exe |
+| checksums.sha256 (v2.7.1 refs) | checksums.sha256 (v2.7.0 refs) |
+
+#### Hypothesis
+
+The evidence suggests one of the following scenarios:
+
+1. **Tag/Version Mismatch:** The v2.7.1 tag may point to a commit where `package.json` still had version `2.7.0`
+2. **Workflow Re-run:** The v2.7.1 release may have been created by re-running the v2.7.0 workflow artifacts
+3. **Manual Upload Error:** Artifacts from v2.7.0 were manually attached to the v2.7.1 release
+4. **Artifact Caching:** Old workflow artifacts were incorrectly reused for v2.7.1
+
+**Next step:** Check git tags and package.json versions to determine root cause.
+
+---
+
+### Subtask 1-3: Package.json Version and Git State Analysis
+
+**Commands Used:**
+- `git show v2.7.1:auto-claude-ui/package.json | jq -r '.version'`
+- `git show v2.7.0:auto-claude-ui/package.json | jq -r '.version'`
+- `git log --oneline v2.7.0..v2.7.1`
+- `git rev-parse v2.7.1^{commit}`
+
+#### Current Package.json State
+
+| Location | Current Version |
+|----------|-----------------|
+| `auto-claude-ui/package.json` (HEAD) | 2.7.1 |
+
+**Note:** The subtask referenced `apps/frontend/package.json`, but the actual path is `auto-claude-ui/package.json`.
+
+#### Version at Git Tags
+
+| Tag | Commit | package.json Version | Expected |
+|-----|--------|---------------------|----------|
+| v2.7.0 | `fe7290a8` | 2.6.5 | 2.7.0 |
+| v2.7.1 | `772a5006` | **2.7.0** ❌ | 2.7.1 |
+
+#### Commit Timeline
+
+```
+fc2075dd auto-claude: subtask-1-2 - Compare v2.7.1 artifacts...
+ff033a8e auto-claude: subtask-1-1 - List all files...
+8db71f3d Update version to 2.7.1 in package.json    <-- Version bump (AFTER tag)
+772a5006 2.7.1                                      <-- v2.7.1 TAG placed here
+d23fcd86 Enhance VirusTotal scan error handling...
+...more commits...
+fe7290a8 Release v2.7.0...                          <-- v2.7.0 TAG placed here
+```
+
+#### Root Cause Identified ✅
+
+**Problem:** The `v2.7.1` tag was placed on commit `772a5006` BEFORE the `package.json` version was updated to `2.7.1`.
+
+**Timeline of error:**
+1. Commit `772a5006` created with message "2.7.1" - tag `v2.7.1` placed here
+2. At this commit, `package.json` still contained version `2.7.0`
+3. The release workflow triggered on tag push, building with version `2.7.0` from `package.json`
+4. All artifacts named with `2.7.0` because that's what was in `package.json`
+5. Commit `8db71f3d` later updated `package.json` to `2.7.1` (but tag was already pushed)
+
+**This is a "tag before version bump" error.**
+
+The release workflow correctly read the version from `package.json`, but the tag was created before the version was bumped. The naming convention `${productName}-${version}-${platform}-${arch}.${ext}` correctly used version `2.7.0` because that's what was in `package.json` at the tagged commit.
+
+#### Verification of Build Configuration
+
+From `auto-claude-ui/package.json`:
+```json
+"build": {
+  "artifactName": "${productName}-${version}-${platform}-${arch}.${ext}",
+  ...
+}
+```
+
+This confirms the version is sourced from `package.json` during the build process.
+
+#### Git State Summary
+
+| Metric | Value |
+|--------|-------|
+| Current Branch | `auto-claude/009-latest-release-v2-7-1-has-wrong-files-attached` |
+| Working Tree | Clean |
+| Current HEAD package.json | 2.7.1 |
+| v2.7.1 tag package.json | 2.7.0 ❌ |
+| v2.7.0 tag package.json | 2.6.5 ❌ |
+
+**Note:** Both v2.7.0 and v2.7.1 tags have version mismatches in `package.json`, indicating a pattern of tagging before version bumping.
+
+---
+
+## Root Cause Summary
+
+| Factor | Finding |
+|--------|---------|
+| What happened? | v2.7.1 tag placed before package.json version bump |
+| Why? | Incorrect release process: tag first, version bump second |
+| Impact | All 7 artifacts have v2.7.0 in filename |
+| Evidence | `git show v2.7.1:auto-claude-ui/package.json` shows version 2.7.0 |
+
+---
+
+## Phase 2: Root Cause Analysis
+
+### Subtask 2-1: Inspect v2.7.1 Git Tag and Commit
+
+**Commands Used:**
+```bash
+git log -1 v2.7.1 --format='%H %s %ci'
+git show v2.7.1 --format='Commit: %H%nAuthor: %an <%ae>%nDate: %ci%nMessage: %s' --no-patch
+git tag -l v2.7.1 -n1
+git cat-file -t v2.7.1
+git show v2.7.1:auto-claude-ui/package.json | head -10 | grep version
+```
+
+#### Tag Details
+
+| Property | Value |
+|----------|-------|
+| Tag Name | v2.7.1 |
+| Tag Type | Lightweight (commit reference, not annotated) |
+| Points To | `772a5006d45487b600ce4079bae1c98f9ccf6b2e` |
+
+#### Tagged Commit Details
+
+| Property | Value |
+|----------|-------|
+| Commit Hash | `772a5006d45487b600ce4079bae1c98f9ccf6b2e` |
+| Author | AndyMik90 <andre@mikalsenutvikling.no> |
+| Commit Date | 2025-12-22 14:35:30 +0100 |
+| Commit Message | `2.7.1` |
+| package.json Version | **2.7.0** (MISMATCH) |
+
+#### Verification Output
+
+```
+$ git log -1 v2.7.1 --format='%H %s %ci'
+772a5006d45487b600ce4079bae1c98f9ccf6b2e 2.7.1 2025-12-22 14:35:30 +0100
+
+$ git show v2.7.1:auto-claude-ui/package.json | grep version
+  "version": "2.7.0",
+```
+
+#### Commit Context
+
+```
+$ git log -3 --oneline v2.7.1
+772a5006 2.7.1                                        <-- v2.7.1 TAG HERE
+d23fcd86 Enhance VirusTotal scan error handling...
+326118bd Refactor macOS build workflow...
+```
+
+#### Analysis
+
+1. **Tag Type:** The tag is a lightweight tag (just a commit reference), not an annotated tag. This means there's no separate tag object with metadata, author, or message.
+
+2. **Commit Message vs Version:** The commit message says "2.7.1" but the `package.json` at this commit still contains version `2.7.0`. This is the source of the mismatch.
+
+3. **Release Workflow Behavior:** When the GitHub release workflow triggered on tag push `v2.7.1`:
+   - It checked out commit `772a5006`
+   - It read version from `auto-claude-ui/package.json` which was `2.7.0`
+   - It built artifacts with `2.7.0` in the filename
+   - It uploaded these incorrectly-versioned artifacts to the v2.7.1 release
+
+4. **Timeline Confirmation:**
+   - Tag created: 2025-12-22 14:35:30 +0100
+   - Release published: 2025-12-22T13:35:38Z (same time, UTC)
+   - Version bump commit `8db71f3d` happened AFTER this
+
+#### Root Cause Confirmed
+
+The v2.7.1 tag points to a commit where `package.json` still had version `2.7.0`. This is a **"tag before version bump"** error in the release process.
+
+The correct sequence should have been:
+1. First: Bump package.json version to 2.7.1
+2. Second: Commit the version bump
+3. Third: Create and push the v2.7.1 tag
+
+What actually happened:
+1. Created tag v2.7.1 on commit with package.json version 2.7.0
+2. Workflow triggered and built with wrong version
+3. Version bump to 2.7.1 committed afterwards (too late)
+
+---
+
+### Subtask 2-2: GitHub Actions Workflow Run Analysis
+
+**Commands Used:**
+```bash
+gh run list --workflow=release.yml --limit=20
+gh run view 20433472030 --json conclusion,status,headSha,event,jobs
+gh run view 20433472034 --json conclusion,status,headSha,jobs  # Validate Version workflow
+```
+
+#### Release Workflow Run Details
+
+| Property | Value |
+|----------|-------|
+| Run ID | 20433472030 |
+| Status | Completed |
+| Conclusion | **success** |
+| Event | push (tag v2.7.1) |
+| Head SHA | `772a5006d45487b600ce4079bae1c98f9ccf6b2e` |
+| Created At | 2025-12-22T13:35:39Z |
+| Updated At | 2025-12-22T13:53:02Z |
+| Total Duration | ~17 minutes |
+
+#### Build Jobs Summary
+
+| Job | Status | Duration | Started | Completed |
+|-----|--------|----------|---------|-----------|
+| build-linux | ✅ success | ~2.5 min | 13:35:42Z | 13:38:15Z |
+| build-windows | ✅ success | ~4.5 min | 13:35:41Z | 13:40:11Z |
+| build-macos-intel | ✅ success | ~7 min | 13:35:42Z | 13:42:52Z |
+| build-macos-arm64 | ✅ success | ~5.5 min | 13:35:42Z | 13:41:12Z |
+| create-release | ✅ success | ~10 min | 13:42:55Z | 13:53:01Z |
+
+#### Create-Release Job Steps
+
+| Step | Conclusion |
+|------|------------|
+| Set up job | ✅ success |
+| Run actions/checkout@v4 | ✅ success |
+| Download all artifacts | ✅ success |
+| Flatten and validate artifacts | ✅ success |
+| Generate checksums | ✅ success |
+| Scan with VirusTotal | ✅ success |
+| Dry run summary | ⏭️ skipped |
+| Generate changelog | ✅ success |
+| Create Release | ✅ success |
+
+**Workflow Analysis:** The release workflow executed **successfully** - all build jobs and the release creation completed without errors. The workflow correctly:
+1. Checked out commit `772a5006d45487b600ce4079bae1c98f9ccf6b2e`
+2. Built artifacts for all platforms (Linux, Windows, macOS Intel, macOS ARM64)
+3. Generated checksums
+4. Ran VirusTotal scans
+5. Created the GitHub release with artifacts
+
+**Key Finding:** The workflow operated as designed. The problem was the **input** (source code at tagged commit), not the **workflow logic**.
+
+---
+
+#### 🚨 CRITICAL: Validate Version Workflow FAILED
+
+**Run ID:** 20433472034
+**Conclusion:** ❌ **FAILURE**
+
+| Step | Conclusion |
+|------|------------|
+| Set up job | ✅ success |
+| Checkout | ✅ success |
+| Extract version from tag | ✅ success |
+| Extract version from package.json | ✅ success |
+| **Compare versions** | ❌ **FAILURE** |
+| Version validation result | ⏭️ skipped |
+
+**What Happened:**
+1. The `validate-version.yml` workflow triggered on the v2.7.1 tag push
+2. It correctly detected that:
+   - Tag version: `2.7.1`
+   - package.json version: `2.7.0`
+3. It **FAILED** with an error because versions didn't match
+
+**Why Didn't This Stop the Release?**
+
+The `validate-version.yml` and `release.yml` workflows are **independent**:
+- Both trigger on `push: tags: - 'v*'`
+- They run in **parallel**, not sequentially
+- The release workflow has **no dependency** on the validation workflow
+- Even though validation failed, the release proceeded and succeeded
+
+**Validation Workflow (from `.github/workflows/validate-version.yml`):**
+```yaml
+on:
+  push:
+    tags:
+      - 'v*'
+```
+
+**Expected Output from Failed Validation:**
+```
+❌ ERROR: Version mismatch detected!
+
+The version in package.json (2.7.0) does not match
+the git tag version (2.7.1).
+
+To fix this:
+  1. Delete this tag: git tag -d v2.7.1
+  2. Update package.json version to 2.7.1
+  3. Commit the change
+  4. Recreate the tag: git tag -a v2.7.1 -m 'Release v2.7.1'
+```
+
+---
+
+#### Workflow Architecture Issue
+
+```
+Tag Push (v2.7.1)
+       │
+       ├──────────────────────────────────┐
+       │                                  │
+       ▼                                  ▼
+┌──────────────────┐            ┌──────────────────┐
+│  validate-version │            │     release      │
+│    ❌ FAILED      │            │   ✅ SUCCESS     │
+│ (detected error)  │  ← No    │  (built wrong     │
+│                   │   link →  │   version)        │
+└──────────────────┘            └──────────────────┘
+```
+
+**Problem:** The validation workflow runs but cannot **block** the release workflow.
+
+---
+
+#### Other v2.7.1 Workflows
+
+| Workflow | Run ID | Conclusion | Notes |
+|----------|--------|------------|-------|
+| Release | 20433472030 | ✅ success | Built and released v2.7.0 files |
+| Validate Version | 20433472034 | ❌ failure | Detected mismatch but couldn't stop release |
+| Discord Release Notification | 20433472029 | ✅ success | Notified Discord about "v2.7.1" |
+| Test on Tag | 20433472046 | ✅ success | Tests passed |
+| Build Native Module Prebuilds | 20433472017 | ❌ failure | Separate prebuilt module issue |
+
+---
+
+#### Root Cause Confirmation
+
+The GitHub Actions analysis confirms:
+
+1. **The release workflow worked correctly** - it built exactly what was in the source code at the tagged commit
+2. **The validation workflow detected the problem** - it correctly identified the version mismatch
+3. **The workflows are not connected** - validation failure could not prevent the release
+4. **The artifacts are from the right commit but wrong version** - v2.7.1 release contains v2.7.0 artifacts because that's what package.json said at commit `772a5006`
+
+---
+
+### Subtask 2-3: Root Cause Statement and Fix Options
+
+#### Root Cause Statement
+
+**Summary:** The v2.7.1 release contains v2.7.0 artifacts because the git tag was created BEFORE the `package.json` version was updated.
+
+**Root Cause:** "Tag Before Version Bump" Error
+
+| Factor | Details |
+|--------|---------|
+| **What happened** | The `v2.7.1` git tag was placed on commit `772a5006` which still had `package.json` version `2.7.0` |
+| **Why it happened** | Incorrect release procedure: tag was created before version bump was committed |
+| **How it propagated** | The release workflow correctly built from the tagged commit, reading version `2.7.0` from `package.json` |
+| **Why it wasn't caught** | The `validate-version.yml` workflow detected the mismatch but runs in parallel with `release.yml` and cannot block it |
+
+**Evidence Chain:**
+1. `git show v2.7.1:auto-claude-ui/package.json` → version `2.7.0`
+2. Release workflow run #20433472030 → built from commit `772a5006` → success
+3. Validate-version workflow run #20433472034 → detected mismatch → **FAILED** (but couldn't stop release)
+4. All 7 artifacts named `Auto-Claude-2.7.0-*` instead of `Auto-Claude-2.7.1-*`
+
+**Contributing Factors:**
+- Lightweight tag (no metadata) - easier to create on wrong commit
+- No pre-tag validation hook or script
+- Independent parallel workflows with no blocking dependency
+- Version in `package.json` is the single source of truth for artifact naming
+
+---
+
+#### Fix Options
+
+##### Option A: Recreate v2.7.1 Tag and Release (RECOMMENDED)
+
+**Description:** Delete the current v2.7.1 tag and release, then create a new tag on a commit where `package.json` has version `2.7.1`.
+
+**Steps:**
+1. Delete the v2.7.1 GitHub release: `gh release delete v2.7.1 --cleanup-tag --yes`
+2. Identify correct commit: `git log --oneline | grep -A1 "Update version to 2.7.1"`
+3. Create new tag at correct commit: `git tag v2.7.1 8db71f3d && git push origin v2.7.1`
+4. Release workflow will trigger automatically with correct version
+5. Verify new artifacts have `2.7.1` in filenames
+
+**Pros:**
+- ✅ Users get the correct version they expect (v2.7.1)
+- ✅ Maintains clean version history
+- ✅ Checksums will match the correct filenames
+- ✅ Auto-update mechanisms will work correctly
+- ✅ No need to update documentation or links
+
+**Cons:**
+- ⚠️ Users who already downloaded v2.7.1 (v2.7.0 files) may be confused
+- ⚠️ Requires deleting and recreating the release
+- ⚠️ Brief window where v2.7.1 doesn't exist
+
+**Risk Level:** Medium - temporary unavailability, but correct outcome
+
+---
+
+##### Option B: Publish v2.7.2 with Correct Files
+
+**Description:** Leave v2.7.1 as-is (deprecated) and publish v2.7.2 with the correct build.
+
+**Steps:**
+1. Mark v2.7.1 as deprecated in release notes
+2. Bump package.json to 2.7.2
+3. Create and push v2.7.2 tag
+4. Publish v2.7.2 release with correct artifacts
+5. Update download links/documentation to point to v2.7.2
+
+**Pros:**
+- ✅ No disruption to existing v2.7.1 downloads
+- ✅ Preserves release history for audit trail
+- ✅ Clear indication that v2.7.2 supersedes v2.7.1
+
+**Cons:**
+- ❌ Version number gap in release history (no "real" 2.7.1)
+- ❌ Confusing version progression for users
+- ❌ Requires updating all download links and documentation
+- ❌ Users may still download deprecated v2.7.1
+
+**Risk Level:** Low - no deletion, but messy version history
+
+---
+
+##### Option C: Manual File Upload with --clobber
+
+**Description:** Build correct v2.7.1 artifacts locally and upload to replace existing files.
+
+**Steps:**
+1. Checkout commit with package.json version 2.7.1
+2. Build all platform artifacts locally (or trigger workflow to download)
+3. Delete existing assets: `gh release delete-asset v2.7.1 Auto-Claude-2.7.0-* --yes`
+4. Upload correct files: `gh release upload v2.7.1 ./dist/* --clobber`
+5. Update checksums file
+
+**Pros:**
+- ✅ Keeps same release and tag
+- ✅ No temporary unavailability window
+
+**Cons:**
+- ❌ Complex manual process prone to errors
+- ❌ Requires local build environment for all platforms (macOS, Windows, Linux)
+- ❌ May not match workflow-built artifacts exactly
+- ❌ Code signing could be different than CI
+- ❌ Does not address underlying tag/commit mismatch
+
+**Risk Level:** High - manual process, potential signing issues
+
+---
+
+#### Recommendation
+
+**Recommended Option: A - Recreate v2.7.1 Tag and Release**
+
+**Rationale:**
+1. **Correctness**: The tag should point to a commit where the codebase reflects v2.7.1
+2. **Automation**: Letting the release workflow rebuild ensures identical CI artifacts
+3. **User Experience**: Users expect v2.7.1 to contain 2.7.1 code and files
+4. **Maintainability**: Clean version history is easier to manage long-term
+5. **Auto-updates**: Electron auto-updater relies on version matching
+
+**Implementation Priority:**
+1. First: Fix v2.7.1 release (Option A)
+2. Then: Update workflow to prevent recurrence (make validation blocking)
+
+---
+
+#### Process Improvements Required
+
+Regardless of fix option chosen, these changes should be implemented to prevent recurrence:
+
+| Improvement | Priority | Description |
+|-------------|----------|-------------|
+| Make validation blocking | HIGH | Modify `release.yml` to depend on `validate-version.yml` passing |
+| Add pre-tag script | MEDIUM | Create script that validates version before allowing tag creation |
+| Use annotated tags | LOW | Annotated tags include metadata and require explicit message |
+| Document release procedure | MEDIUM | Create runbook for correct release process |
+
+**Workflow Architecture Change:**
+```yaml
+# Before (parallel, independent):
+Tag Push → release.yml (runs)
+         → validate-version.yml (runs, but can't block)
+
+# After (sequential, dependent):
+Tag Push → validate-version.yml (runs first)
+           ↓ success required
+         → release.yml (only runs if validation passes)
+```
+
+---
+
+## Next Steps
+
+1. ~~**Subtask 1-1:** Verify v2.7.1 assets~~ ✅ Complete
+2. ~~**Subtask 1-2:** Compare with v2.7.0 release and verify expected naming pattern~~ ✅ Complete
+3. ~~**Subtask 1-3:** Check package.json version and git state~~ ✅ Complete - ROOT CAUSE IDENTIFIED
+4. ~~**Subtask 2-1:** Inspect v2.7.1 git tag and commit~~ ✅ Complete - TAG/COMMIT MISMATCH CONFIRMED
+5. ~~**Subtask 2-2:** Check release workflow runs~~ ✅ Complete - VALIDATION DETECTED BUT COULDN'T STOP RELEASE
+6. ~~**Subtask 2-3:** Document fix options~~ ✅ Complete - 3 OPTIONS DOCUMENTED, OPTION A RECOMMENDED
+7. **Phase 3:** Implement fix (re-upload correct files or publish v2.7.2)
+8. **Phase 4:** Add validation to prevent future occurrences
+
+---
+
+## Status: Phase 2 Complete ✅
+
+**Root Cause:** The v2.7.1 tag was created on commit `772a5006` which still had `package.json` version `2.7.0`. The validation workflow detected this but couldn't stop the release workflow.
+
+**Key Findings from Workflow Analysis:**
+- Release workflow (ID: 20433472030): ✅ Success - correctly built from tagged commit
+- Validate Version workflow (ID: 20433472034): ❌ Failed - correctly detected version mismatch
+- The workflows run in parallel with no dependency relationship
+
+**Recommended Fix:** Option A - Delete v2.7.1 tag and release, recreate tag at commit `8db71f3d` where `package.json` has version `2.7.1`, let workflow rebuild.
+
+**Process Improvement Needed:**
+- Version bump should ALWAYS happen BEFORE tagging
+- **Make release.yml depend on validate-version.yml** using `needs:` or combine them
+- Consider using a reusable workflow or job dependency to enforce validation

README.md

@@ -1,222 +1,269 @@
 # Auto Claude
 
-**Autonomous multi-agent coding framework that plans, builds, and validates software for you.**
+Your AI coding companion. Build features, fix bugs, and ship faster — with autonomous agents that plan, code, and validate for you.
 
 ![Auto Claude Kanban Board](.github/assets/Auto-Claude-Kanban.png)
 
-[![License](https://img.shields.io/badge/license-AGPL--3.0-green?style=flat-square)](./agpl-3.0.txt)
-[![Discord](https://img.shields.io/badge/Discord-Join%20Community-5865F2?style=flat-square&logo=discord&logoColor=white)](https://discord.gg/KCXaPBr4Dj)
-[![YouTube](https://img.shields.io/badge/YouTube-Subscribe-FF0000?style=flat-square&logo=youtube&logoColor=white)](https://www.youtube.com/@AndreMikalsen)
-[![CI](https://img.shields.io/github/actions/workflow/status/AndyMik90/Auto-Claude/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/AndyMik90/Auto-Claude/actions)
+[![Discord](https://img.shields.io/badge/Discord-Join%20Community-5865F2?style=for-the-badge&logo=discord&logoColor=white)](https://discord.gg/KCXaPBr4Dj)
 
----
+## What It Does ✨
 
-## Download
+**Auto Claude is a desktop app that supercharges your AI coding workflow.** Whether you're a vibe coder just getting started or an experienced developer, Auto Claude meets you where you are.
 
-### Stable Release
+- **Autonomous Tasks** — Describe what you want to build, and agents handle planning, coding, and validation while you focus on other work
+- **Agent Terminals** — Run Claude Code in up to 12 terminals with a clean layout, smart naming based on context, and one-click task context injection
+- **Safe by Default** — All work happens in git worktrees, keeping your main branch undisturbed until you're ready to merge
+- **Self-Validating** — Built-in QA agents check their own work before you review
 
-<!-- STABLE_VERSION_BADGE -->
-[![Stable](https://img.shields.io/badge/stable-2.7.5-blue?style=flat-square)](https://github.com/AndyMik90/Auto-Claude/releases/tag/v2.7.5)
-<!-- STABLE_VERSION_BADGE_END -->
+**The result?** 10x your output while maintaining code quality.
 
-<!-- STABLE_DOWNLOADS -->
-| Platform | Download |
-|----------|----------|
-| **Windows** | [Auto-Claude-2.7.5-win32-x64.exe](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.5/Auto-Claude-2.7.5-win32-x64.exe) |
-| **macOS (Apple Silicon)** | [Auto-Claude-2.7.5-darwin-arm64.dmg](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.5/Auto-Claude-2.7.5-darwin-arm64.dmg) |
-| **macOS (Intel)** | [Auto-Claude-2.7.5-darwin-x64.dmg](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.5/Auto-Claude-2.7.5-darwin-x64.dmg) |
-| **Linux** | [Auto-Claude-2.7.5-linux-x86_64.AppImage](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.5/Auto-Claude-2.7.5-linux-x86_64.AppImage) |
-| **Linux (Debian)** | [Auto-Claude-2.7.5-linux-amd64.deb](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.5/Auto-Claude-2.7.5-linux-amd64.deb) |
-| **Linux (Flatpak)** | [Auto-Claude-2.7.5-linux-x86_64.flatpak](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.5/Auto-Claude-2.7.5-linux-x86_64.flatpak) |
-<!-- STABLE_DOWNLOADS_END -->
+## Key Features
 
-### Beta Release
-
-> ⚠️ Beta releases may contain bugs and breaking changes. [View all releases](https://github.com/AndyMik90/Auto-Claude/releases)
-
-<!-- BETA_VERSION_BADGE -->
-[![Beta](https://img.shields.io/badge/beta-2.7.6--beta.3-orange?style=flat-square)](https://github.com/AndyMik90/Auto-Claude/releases/tag/v2.7.6-beta.3)
-<!-- BETA_VERSION_BADGE_END -->
-
-<!-- BETA_DOWNLOADS -->
-| Platform | Download |
-|----------|----------|
-| **Windows** | [Auto-Claude-2.7.6-beta.3-win32-x64.exe](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.6-beta.3/Auto-Claude-2.7.6-beta.3-win32-x64.exe) |
-| **macOS (Apple Silicon)** | [Auto-Claude-2.7.6-beta.3-darwin-arm64.dmg](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.6-beta.3/Auto-Claude-2.7.6-beta.3-darwin-arm64.dmg) |
-| **macOS (Intel)** | [Auto-Claude-2.7.6-beta.3-darwin-x64.dmg](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.6-beta.3/Auto-Claude-2.7.6-beta.3-darwin-x64.dmg) |
-| **Linux** | [Auto-Claude-2.7.6-beta.3-linux-x86_64.AppImage](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.6-beta.3/Auto-Claude-2.7.6-beta.3-linux-x86_64.AppImage) |
-| **Linux (Debian)** | [Auto-Claude-2.7.6-beta.3-linux-amd64.deb](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.6-beta.3/Auto-Claude-2.7.6-beta.3-linux-amd64.deb) |
-| **Linux (Flatpak)** | [Auto-Claude-2.7.6-beta.3-linux-x86_64.flatpak](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.6-beta.3/Auto-Claude-2.7.6-beta.3-linux-x86_64.flatpak) |
-<!-- BETA_DOWNLOADS_END -->
-
-> All releases include SHA256 checksums and VirusTotal scan results for security verification.
-
----
-
-## Requirements
-
-- **Claude Pro/Max subscription** - [Get one here](https://claude.ai/upgrade)
-- **Claude Code CLI** - `npm install -g @anthropic-ai/claude-code`
-- **Git repository** - Your project must be initialized as a git repo
-
----
+- **Parallel Agents**: Run multiple builds simultaneously while you focus on other work
+- **Context Engineering**: Agents understand your codebase structure before writing code
+- **Self-Validating**: Built-in QA loop catches issues before you review
+- **Isolated Workspaces**: All work happens in git worktrees — your code stays safe
+- **AI Merge Resolution**: Intelligent conflict resolution when merging back to main — no manual conflict fixing
+- **Cross-Platform**: Desktop app runs on Mac, Windows, and Linux
+- **Any Project Type**: Build web apps, APIs, CLIs — works with any software project
 
 ## Quick Start
 
-1. **Download and install** the app for your platform
-2. **Open your project** - Select a git repository folder
-3. **Connect Claude** - The app will guide you through OAuth setup
-4. **Create a task** - Describe what you want to build
-5. **Watch it work** - Agents plan, code, and validate autonomously
+### Download Auto Claude
+
+Download the latest release for your platform from [GitHub Releases](https://github.com/AndyMik90/Auto-Claude/releases/latest):
+
+| Platform | Download |
+|----------|----------|
+| **macOS (Apple Silicon M1-M4)** | `*-arm64.dmg` |
+| **macOS (Intel)** | `*-x64.dmg` |
+| **Windows** | `*.exe` |
+| **Linux** | `*.AppImage` or `*.deb` |
+
+> **Not sure which Mac?** Click the Apple menu () > "About This Mac". Look for "Chip" - M1/M2/M3/M4 = Apple Silicon, otherwise Intel.
+
+### Prerequisites
+
+Before using Auto Claude, you need:
+
+1. **Claude Subscription** - Requires [Claude Pro or Max](https://claude.ai/upgrade) for Claude Code access
+2. **Claude Code CLI** - Install with: `npm install -g @anthropic-ai/claude-code`
+
+### Install and Run
+
+1. **Download** the installer for your platform from the table above
+2. **Install**:
+   - **macOS**: Open the `.dmg`, drag Auto Claude to Applications
+   - **Windows**: Run the `.exe` installer (see note below about security warning)
+   - **Linux**: Make the AppImage executable (`chmod +x`) and run it, or install the `.deb`
+3. **Launch** Auto Claude
+4. **Add your project** and start building!
+
+<details>
+<summary><b>Windows users:</b> Security warning when installing</summary>
+
+The Windows installer is not yet code-signed, so you may see a "Windows protected your PC" warning from Microsoft Defender SmartScreen.
+
+**To proceed:**
+1. Click "More info"
+2. Click "Run anyway"
+
+This is safe — all releases are automatically scanned with VirusTotal before publishing. You can verify any installer by checking the **VirusTotal Scan Results** section in each [release's notes](https://github.com/AndyMik90/Auto-Claude/releases).
+
+We're working on obtaining a code signing certificate for future releases.
+
+</details>
+
+> **Want to build from source?** See [CONTRIBUTING.md](CONTRIBUTING.md#running-from-source) for development setup.
 
 ---
 
-## Features
-
-| Feature | Description |
-|---------|-------------|
-| **Autonomous Tasks** | Describe your goal; agents handle planning, implementation, and validation |
-| **Parallel Execution** | Run multiple builds simultaneously with up to 12 agent terminals |
-| **Isolated Workspaces** | All changes happen in git worktrees - your main branch stays safe |
-| **Self-Validating QA** | Built-in quality assurance loop catches issues before you review |
-| **AI-Powered Merge** | Automatic conflict resolution when integrating back to main |
-| **Memory Layer** | Agents retain insights across sessions for smarter builds |
-| **GitHub/GitLab Integration** | Import issues, investigate with AI, create merge requests |
-| **Linear Integration** | Sync tasks with Linear for team progress tracking |
-| **Cross-Platform** | Native desktop apps for Windows, macOS, and Linux |
-| **Auto-Updates** | App updates automatically when new versions are released |
-
----
-
-## Interface
+## 🎯 Features
 
 ### Kanban Board
-Visual task management from planning through completion. Create tasks and monitor agent progress in real-time.
+
+Plan tasks and let AI handle the planning, coding, and validation — all in a visual interface. Track progress from "Planning" to "Done" while agents work autonomously.
 
 ### Agent Terminals
-AI-powered terminals with one-click task context injection. Spawn multiple agents for parallel work.
 
-![Agent Terminals](.github/assets/Auto-Claude-Agents-terminals.png)
+Spawn up to 12 AI-powered terminals for hands-on coding. Inject task context with a click, reference files from your project, and work rapidly across multiple sessions.
+
+**Power users:** Connect multiple Claude Code subscriptions to run even more agents in parallel — perfect for teams or heavy workloads.
+
+![Auto Claude Agent Terminals](.github/assets/Auto-Claude-Agents-terminals.png)
+
+### Insights
+
+Have a conversation about your project in a ChatGPT-style interface. Ask questions, get explanations, and explore your codebase through natural dialogue.
 
 ### Roadmap
-AI-assisted feature planning with competitor analysis and audience targeting.
 
-![Roadmap](.github/assets/Auto-Claude-roadmap.png)
+Based on your target audience, AI anticipates and plans the most impactful features you should focus on. Prioritize what matters most to your users.
 
-### Additional Features
-- **Insights** - Chat interface for exploring your codebase
-- **Ideation** - Discover improvements, performance issues, and vulnerabilities
-- **Changelog** - Generate release notes from completed tasks
+![Auto Claude Roadmap](.github/assets/Auto-Claude-roadmap.png)
+
+### Ideation
+
+Let AI help you create a project that shines. Rapidly understand your codebase and discover:
+- Code improvements and refactoring opportunities
+- Performance bottlenecks
+- Security vulnerabilities
+- Documentation gaps
+- UI/UX enhancements
+- Overall code quality issues
+
+### Changelog
+
+Write professional changelogs effortlessly. Generate release notes from completed Auto Claude tasks or integrate with GitHub to create masterclass changelogs automatically.
+
+### Context
+
+See exactly what Auto Claude understands about your project — the tech stack, file structure, patterns, and insights it uses to write better code.
+
+### AI Merge Resolution
+
+When your main branch evolves while a build is in progress, Auto Claude automatically resolves merge conflicts using AI — no manual `<<<<<<< HEAD` fixing required.
+
+**How it works:**
+1. **Git Auto-Merge First** — Simple non-conflicting changes merge instantly without AI
+2. **Conflict-Only AI** — For actual conflicts, AI receives only the specific conflict regions (not entire files), achieving ~98% prompt reduction
+3. **Parallel Processing** — Multiple conflicting files resolve simultaneously for faster merges
+4. **Syntax Validation** — Every merge is validated before being applied
+
+**The result:** A build that was 50+ commits behind main merges in seconds instead of requiring manual conflict resolution.
 
 ---
 
+## CLI Usage (Terminal-Only)
+
+For terminal-based workflows, headless servers, or CI/CD integration, see **[guides/CLI-USAGE.md](guides/CLI-USAGE.md)**.
+
+## ⚙️ How It Works
+
+Auto Claude focuses on three core principles: **context engineering** (understanding your codebase before writing code), **good coding standards** (following best practices and patterns), and **validation logic** (ensuring code works before you see it).
+
+### The Agent Pipeline
+
+**Phase 1: Spec Creation** (3-8 phases based on complexity)
+
+Before any code is written, agents gather context and create a detailed specification:
+
+1. **Discovery** — Analyzes your project structure and tech stack
+2. **Requirements** — Gathers what you want to build through interactive conversation
+3. **Research** — Validates external integrations against real documentation
+4. **Context Discovery** — Finds relevant files in your codebase
+5. **Spec Writer** — Creates a comprehensive specification document
+6. **Spec Critic** — Self-critiques using extended thinking to find issues early
+7. **Planner** — Breaks work into subtasks with dependencies
+8. **Validation** — Ensures all outputs are valid before proceeding
+
+**Phase 2: Implementation**
+
+With a validated spec, coding agents execute the plan:
+
+1. **Planner Agent** — Creates subtask-based implementation plan
+2. **Coder Agent** — Implements subtasks one-by-one with verification
+3. **QA Reviewer** — Validates all acceptance criteria
+4. **QA Fixer** — Fixes issues in a self-healing loop (up to 50 iterations)
+
+Each session runs with a fresh context window. Progress is tracked via `implementation_plan.json` and Git commits.
+
+**Phase 3: Merge**
+
+When you're ready to merge, AI handles any conflicts that arose while you were working:
+
+1. **Conflict Detection** — Identifies files modified in both main and the build
+2. **3-Tier Resolution** — Git auto-merge → Conflict-only AI → Full-file AI (fallback)
+3. **Parallel Merge** — Multiple files resolve simultaneously
+4. **Staged for Review** — Changes are staged but not committed, so you can review before finalizing
+
+### 🔒 Security Model
+
+Three-layer defense keeps your code safe:
+- **OS Sandbox** — Bash commands run in isolation
+- **Filesystem Restrictions** — Operations limited to project directory
+- **Command Allowlist** — Only approved commands based on your project's stack
+
 ## Project Structure
 
 ```
-Auto-Claude/
-├── apps/
-│   ├── backend/     # Python agents, specs, QA pipeline
-│   └── frontend/    # Electron desktop application
-├── guides/          # Additional documentation
-├── tests/           # Test suite
-└── scripts/         # Build utilities
+your-project/
+├── .worktrees/               # Created during build (git-ignored)
+│   └── auto-claude/          # Isolated workspace for AI coding
+├── .auto-claude/             # Per-project data (specs, plans, QA reports)
+│   ├── specs/                # Task specifications
+│   ├── roadmap/              # Project roadmap
+│   └── ideation/             # Ideas and planning
+├── auto-claude/              # Python backend (framework code)
+│   ├── run.py                # Build entry point
+│   ├── spec_runner.py        # Spec creation orchestrator
+│   ├── prompts/              # Agent prompt templates
+│   └── ...
+└── auto-claude-ui/           # Electron desktop application
+    └── ...
 ```
 
----
+### Understanding the Folders
 
-## CLI Usage
+**You don't create these folders manually** - they serve different purposes:
 
-For headless operation, CI/CD integration, or terminal-only workflows:
+- **`auto-claude/`** - The framework repository itself (clone this once from GitHub)
+- **`.auto-claude/`** - Created automatically in YOUR project when you run Auto Claude (stores specs, plans, QA reports)
+- **`.worktrees/`** - Temporary isolated workspaces created during builds (git-ignored, deleted after merge)
 
+**When using Auto Claude on your project:**
 ```bash
-cd apps/backend
-
-# Create a spec interactively
-python spec_runner.py --interactive
-
-# Run autonomous build
-python run.py --spec 001
-
-# Review and merge
-python run.py --spec 001 --review
-python run.py --spec 001 --merge
+cd your-project/              # Your own project directory
+python /path/to/auto-claude/run.py --spec 001
+# Auto Claude creates .auto-claude/ automatically in your-project/
 ```
 
-See [guides/CLI-USAGE.md](guides/CLI-USAGE.md) for complete CLI documentation.
+**When developing Auto Claude itself:**
+```bash
+git clone https://github.com/yourusername/auto-claude
+cd auto-claude/               # You're working in the framework repo
+```
 
----
+The `.auto-claude/` directory is gitignored and project-specific - you'll have one per project you use Auto Claude on.
 
-## Development
+## Environment Variables (CLI Only)
 
-Want to build from source or contribute? See [CONTRIBUTING.md](CONTRIBUTING.md) for complete development setup instructions.
+> **Desktop UI users:** These are configured through the app settings — no manual setup needed.
 
-For Linux-specific builds (Flatpak, AppImage), see [guides/linux.md](guides/linux.md).
+| Variable | Required | Description |
+|----------|----------|-------------|
+| `CLAUDE_CODE_OAUTH_TOKEN` | Yes | OAuth token from `claude setup-token` |
+| `AUTO_BUILD_MODEL` | No | Model override (default: claude-opus-4-5-20251101) |
 
----
+See `auto-claude/.env.example` for complete configuration options.
 
-## Security
+## 💬 Community
 
-Auto Claude uses a three-layer security model:
+Join our Discord to get help, share what you're building, and connect with other Auto Claude users:
 
-1. **OS Sandbox** - Bash commands run in isolation
-2. **Filesystem Restrictions** - Operations limited to project directory
-3. **Dynamic Command Allowlist** - Only approved commands based on detected project stack
+[![Discord](https://img.shields.io/badge/Discord-Join%20Community-5865F2?style=for-the-badge&logo=discord&logoColor=white)](https://discord.gg/KCXaPBr4Dj)
 
-All releases are:
-- Scanned with VirusTotal before publishing
-- Include SHA256 checksums for verification
-- Code-signed where applicable (macOS)
+## 🤝 Contributing
 
----
+We welcome contributions! Whether it's bug fixes, new features, or documentation improvements.
 
-## Available Scripts
+See **[CONTRIBUTING.md](CONTRIBUTING.md)** for guidelines on how to get started.
 
-| Command | Description |
-|---------|-------------|
-| `npm run install:all` | Install backend and frontend dependencies |
-| `npm start` | Build and run the desktop app |
-| `npm run dev` | Run in development mode with hot reload |
-| `npm run package` | Package for current platform |
-| `npm run package:mac` | Package for macOS |
-| `npm run package:win` | Package for Windows |
-| `npm run package:linux` | Package for Linux |
-| `npm run package:flatpak` | Package as Flatpak (see [guides/linux.md](guides/linux.md)) |
-| `npm run lint` | Run linter |
-| `npm test` | Run frontend tests |
-| `npm run test:backend` | Run backend tests |
+## Acknowledgments
 
----
-
-## Contributing
-
-We welcome contributions! Please read [CONTRIBUTING.md](CONTRIBUTING.md) for:
-- Development setup instructions
-- Code style guidelines
-- Testing requirements
-- Pull request process
-
----
-
-## Community
-
-- **Discord** - [Join our community](https://discord.gg/KCXaPBr4Dj)
-- **Issues** - [Report bugs or request features](https://github.com/AndyMik90/Auto-Claude/issues)
-- **Discussions** - [Ask questions](https://github.com/AndyMik90/Auto-Claude/discussions)
-
----
+This framework was inspired by Anthropic's [Autonomous Coding Agent](https://github.com/anthropics/claude-quickstarts/tree/main/autonomous-coding). Thank you to the Anthropic team for their innovative work on autonomous coding systems.
 
 ## License
 
 **AGPL-3.0** - GNU Affero General Public License v3.0
 
-Auto Claude is free to use. If you modify and distribute it, or run it as a service, your code must also be open source under AGPL-3.0.
+This software is licensed under AGPL-3.0, which means:
 
-Commercial licensing available for closed-source use cases.
+- **Attribution Required**: You must give appropriate credit, provide a link to the license, and indicate if changes were made. When using Auto Claude, please credit the project.
+- **Open Source Required**: If you modify this software and distribute it or run it as a service, you must release your source code under AGPL-3.0.
+- **Network Use (Copyleft)**: If you run this software as a network service (e.g., SaaS), users interacting with it over a network must be able to receive the source code.
+- **No Closed-Source Usage**: You cannot use this software in proprietary/closed-source projects without open-sourcing your entire project under AGPL-3.0.
 
----
+**In simple terms**: You can use Auto Claude freely, but if you build on it, your code must also be open source under AGPL-3.0 and attribute this project. Closed-source commercial use requires a separate license.
 
-## Star History
-
-[![GitHub Repo stars](https://img.shields.io/github/stars/AndyMik90/Auto-Claude?style=social)](https://github.com/AndyMik90/Auto-Claude/stargazers)
-
-[![Star History Chart](https://api.star-history.com/svg?repos=AndyMik90/Auto-Claude&type=Date)](https://star-history.com/#AndyMik90/Auto-Claude&Date)
+For commercial licensing inquiries (closed-source usage), please contact the maintainers.

RELEASE.md

@@ -1,254 +1,186 @@
 # Release Process
 
-This document describes how releases are created for Auto Claude.
+This document describes how to create a new release of Auto Claude.
 
-## Overview
+## Automated Release Process (Recommended)
 
-Auto Claude uses an automated release pipeline that ensures releases are only published after all builds succeed. This prevents version mismatches between documentation and actual releases.
+We provide an automated script that handles version bumping, git commits, and tagging to ensure version consistency.
+
+### Prerequisites
+
+- Clean git working directory (no uncommitted changes)
+- You're on the branch you want to release from (usually `main`)
+
+### Steps
+
+1. **Run the version bump script:**
+
+   ```bash
+   # Bump patch version (2.5.5 -> 2.5.6)
+   node scripts/bump-version.js patch
+
+   # Bump minor version (2.5.5 -> 2.6.0)
+   node scripts/bump-version.js minor
+
+   # Bump major version (2.5.5 -> 3.0.0)
+   node scripts/bump-version.js major
+
+   # Set specific version
+   node scripts/bump-version.js 2.6.0
+   ```
+
+   This script will:
+   - ✅ Update `auto-claude-ui/package.json` with the new version
+   - ✅ Create a git commit with the version change
+   - ✅ Create a git tag (e.g., `v2.5.6`)
+   - ⚠️  **NOT** push to remote (you control when to push)
+
+2. **Review the changes:**
+
+   ```bash
+   git log -1              # View the commit
+   git show v2.5.6         # View the tag
+   ```
+
+3. **Push to GitHub:**
+
+   ```bash
+   # Push the commit
+   git push origin main
+
+   # Push the tag
+   git push origin v2.5.6
+   ```
+
+4. **Create GitHub Release:**
+
+   - Go to [GitHub Releases](https://github.com/AndyMik90/Auto-Claude/releases)
+   - Click "Draft a new release"
+   - Select the tag you just pushed (e.g., `v2.5.6`)
+   - Add release notes (describe what changed)
+   - Click "Publish release"
+
+5. **Automated builds will trigger:**
+
+   - ✅ Version validation workflow will verify version consistency
+   - ✅ Tests will run (`test-on-tag.yml`)
+   - ✅ Native module prebuilds will be created (`build-prebuilds.yml`)
+   - ✅ Discord notification will be sent (`discord-release.yml`)
+
+## Manual Release Process (Not Recommended)
+
+If you need to create a release manually, follow these steps **carefully** to avoid version mismatches:
+
+1. **Update `auto-claude-ui/package.json`:**
+
+   ```json
+   {
+     "version": "2.5.6"
+   }
+   ```
+
+2. **Commit the change:**
+
+   ```bash
+   git add auto-claude-ui/package.json
+   git commit -m "chore: bump version to 2.5.6"
+   ```
+
+3. **Create and push tag:**
+
+   ```bash
+   git tag -a v2.5.6 -m "Release v2.5.6"
+   git push origin main
+   git push origin v2.5.6
+   ```
+
+4. **Create GitHub Release** (same as step 4 above)
+
+## Version Validation
+
+A GitHub Action automatically validates that the version in `package.json` matches the git tag.
+
+If there's a mismatch, the workflow will **fail** with a clear error message:
 
 ```
-┌─────────────────────────────────────────────────────────────────────────────┐
-│                           RELEASE FLOW                                       │
-├─────────────────────────────────────────────────────────────────────────────┤
-│                                                                              │
-│   develop branch                    main branch                              │
-│   ──────────────                    ───────────                              │
-│        │                                 │                                   │
-│        │  1. bump-version.js             │                                   │
-│        │     (creates commit)            │                                   │
-│        │                                 │                                   │
-│        ▼                                 │                                   │
-│   ┌─────────┐                           │                                   │
-│   │ v2.8.0  │  2. Create PR             │                                   │
-│   │ commit  │ ────────────────────►     │                                   │
-│   └─────────┘                           │                                   │
-│                                          │                                   │
-│                           3. Merge PR    ▼                                   │
-│                                    ┌──────────┐                              │
-│                                    │ v2.8.0   │                              │
-│                                    │ on main  │                              │
-│                                    └────┬─────┘                              │
-│                                         │                                    │
-│                     ┌───────────────────┴───────────────────┐               │
-│                     │     GitHub Actions (automatic)         │               │
-│                     ├───────────────────────────────────────┤               │
-│                     │ 4. prepare-release.yml                 │               │
-│                     │    - Detects version > latest tag      │               │
-│                     │    - Creates tag v2.8.0                │               │
-│                     │                                        │               │
-│                     │ 5. release.yml (triggered by tag)      │               │
-│                     │    - Builds macOS (Intel + ARM)        │               │
-│                     │    - Builds Windows                    │               │
-│                     │    - Builds Linux                      │               │
-│                     │    - Generates changelog               │               │
-│                     │    - Creates GitHub release            │               │
-│                     │    - Updates README                    │               │
-│                     └───────────────────────────────────────┘               │
-│                                                                              │
-└─────────────────────────────────────────────────────────────────────────────┘
+❌ ERROR: Version mismatch detected!
+
+The version in package.json (2.5.0) does not match
+the git tag version (2.5.5).
+
+To fix this:
+  1. Delete this tag: git tag -d v2.5.5
+  2. Update package.json version to 2.5.5
+  3. Commit the change
+  4. Recreate the tag: git tag -a v2.5.5 -m 'Release v2.5.5'
 ```
 
-## For Maintainers: Creating a Release
-
-### Step 1: Bump the Version
-
-On your development branch (typically `develop` or a feature branch):
-
-```bash
-# Navigate to project root
-cd /path/to/auto-claude
-
-# Bump version (choose one)
-node scripts/bump-version.js patch   # 2.7.1 -> 2.7.2 (bug fixes)
-node scripts/bump-version.js minor   # 2.7.1 -> 2.8.0 (new features)
-node scripts/bump-version.js major   # 2.7.1 -> 3.0.0 (breaking changes)
-node scripts/bump-version.js 2.8.0   # Set specific version
-```
-
-This will:
-- Update `apps/frontend/package.json`
-- Update `package.json` (root)
-- Update `apps/backend/__init__.py`
-- Check if `CHANGELOG.md` has an entry for the new version (warns if missing)
-- Create a commit with message `chore: bump version to X.Y.Z`
-
-### Step 2: Update CHANGELOG.md (REQUIRED)
-
-**IMPORTANT: The release will fail if CHANGELOG.md doesn't have an entry for the new version.**
-
-Add release notes to `CHANGELOG.md` at the top of the file:
-
-```markdown
-## 2.8.0 - Your Release Title
-
-### ✨ New Features
-- Feature description
-
-### 🛠️ Improvements
-- Improvement description
-
-### 🐛 Bug Fixes
-- Fix description
-
----
-```
-
-Then amend the version bump commit:
-
-```bash
-git add CHANGELOG.md
-git commit --amend --no-edit
-```
-
-### Step 3: Push and Create PR
-
-```bash
-# Push your branch
-git push origin your-branch
-
-# Create PR to main (via GitHub UI or gh CLI)
-gh pr create --base main --title "Release v2.8.0"
-```
-
-### Step 4: Merge to Main
-
-Once the PR is approved and merged to `main`, GitHub Actions will automatically:
-
-1. **Detect the version bump** (`prepare-release.yml`)
-2. **Validate CHANGELOG.md** has an entry for the new version (FAILS if missing)
-3. **Extract release notes** from CHANGELOG.md
-4. **Create a git tag** (e.g., `v2.8.0`)
-5. **Trigger the release workflow** (`release.yml`)
-6. **Build binaries** for all platforms:
-   - macOS Intel (x64) - code signed & notarized
-   - macOS Apple Silicon (arm64) - code signed & notarized
-   - Windows (NSIS installer) - code signed
-   - Linux (AppImage + .deb)
-7. **Scan binaries** with VirusTotal
-8. **Create GitHub release** with release notes from CHANGELOG.md
-9. **Update README** with new version badge and download links
-
-### Step 5: Verify
-
-After merging, check:
-- [GitHub Actions](https://github.com/AndyMik90/Auto-Claude/actions) - ensure all workflows pass
-- [Releases](https://github.com/AndyMik90/Auto-Claude/releases) - verify release was created
-- [README](https://github.com/AndyMik90/Auto-Claude#download) - confirm version updated
-
-## Version Numbering
-
-We follow [Semantic Versioning](https://semver.org/):
-
-- **MAJOR** (X.0.0): Breaking changes, incompatible API changes
-- **MINOR** (0.X.0): New features, backwards compatible
-- **PATCH** (0.0.X): Bug fixes, backwards compatible
-
-## Changelog Management
-
-Release notes are managed in `CHANGELOG.md` and used for GitHub releases.
-
-### Changelog Format
-
-Each version entry in `CHANGELOG.md` should follow this format:
-
-```markdown
-## X.Y.Z - Release Title
-
-### ✨ New Features
-- Feature description with context
-
-### 🛠️ Improvements
-- Improvement description
-
-### 🐛 Bug Fixes
-- Fix description
-
----
-```
-
-### Changelog Validation
-
-The release workflow **validates** that `CHANGELOG.md` has an entry for the version being released:
-
-- If the entry is **missing**, the release is **blocked** with a clear error message
-- If the entry **exists**, its content is used for the GitHub release notes
-
-### Writing Good Release Notes
-
-- **Be specific**: Instead of "Fixed bug", write "Fixed crash when opening large files"
-- **Group by impact**: Features first, then improvements, then fixes
-- **Credit contributors**: Mention contributors for significant changes
-- **Link issues**: Reference GitHub issues where relevant (e.g., "Fixes #123")
-
-## Workflows
-
-| Workflow | Trigger | Purpose |
-|----------|---------|---------|
-| `prepare-release.yml` | Push to `main` | Detects version bump, **validates CHANGELOG.md**, creates tag |
-| `release.yml` | Tag `v*` pushed | Builds binaries, extracts changelog, creates release |
-| `update-readme` (in release.yml) | After release | Updates README with new version |
+This validation ensures we never ship a release where the updater shows the wrong version.
 
 ## Troubleshooting
 
-### Release didn't trigger after merge
+### Version Mismatch Error
 
-1. Check if version in `package.json` is greater than latest tag:
+If you see a version mismatch error in GitHub Actions:
+
+1. **Delete the incorrect tag:**
    ```bash
-   git tag -l 'v*' --sort=-version:refname | head -1
-   cat apps/frontend/package.json | grep version
+   git tag -d v2.5.6                    # Delete locally
+   git push origin :refs/tags/v2.5.6    # Delete remotely
    ```
 
-2. Ensure the merge commit touched `package.json`:
+2. **Use the automated script:**
    ```bash
-   git diff HEAD~1 --name-only | grep package.json
+   node scripts/bump-version.js 2.5.6
+   git push origin main
+   git push origin v2.5.6
    ```
 
-### Release blocked: Missing changelog entry
+### Git Working Directory Not Clean
 
-If you see "CHANGELOG VALIDATION FAILED" in the workflow:
-
-1. The `prepare-release.yml` workflow validated that `CHANGELOG.md` doesn't have an entry for the new version
-2. **Fix**: Add an entry to `CHANGELOG.md` with the format `## X.Y.Z - Title`
-3. Commit and push the changelog update
-4. The workflow will automatically retry when the changes are pushed to `main`
+If the version bump script fails with "Git working directory is not clean":
 
 ```bash
-# Add changelog entry, then:
-git add CHANGELOG.md
-git commit -m "docs: add changelog for vX.Y.Z"
-git push origin main
+# Commit or stash your changes first
+git status
+git add .
+git commit -m "your changes"
+
+# Then run the version bump script
+node scripts/bump-version.js patch
 ```
 
-### Build failed after tag was created
+## Release Checklist
 
-- The release won't be published if builds fail
-- Fix the issue and create a new patch version
-- Don't reuse failed version numbers
+Use this checklist when creating a new release:
 
-### README shows wrong version
+- [ ] All tests passing on main branch
+- [ ] CHANGELOG updated (if applicable)
+- [ ] Run `node scripts/bump-version.js <type>`
+- [ ] Review commit and tag
+- [ ] Push commit and tag to GitHub
+- [ ] Create GitHub Release with release notes
+- [ ] Verify version validation passed
+- [ ] Verify builds completed successfully
+- [ ] Test the updater shows correct version
 
-- README is only updated after successful release
-- If release failed, README keeps the previous version (this is intentional)
-- Once you successfully release, README will update automatically
+## What Gets Released
 
-## Manual Release (Emergency Only)
+When you create a release, the following are built and published:
 
-In rare cases where you need to bypass the automated flow:
+1. **Native module prebuilds** - Windows node-pty binaries
+2. **Electron app packages** - Desktop installers (triggered manually or via electron-builder)
+3. **Discord notification** - Sent to the Auto Claude community
 
-```bash
-# Create tag manually (NOT RECOMMENDED)
-git tag -a v2.8.0 -m "Release v2.8.0"
-git push origin v2.8.0
+## Version Numbering
 
-# This will trigger release.yml directly
-```
+We follow [Semantic Versioning (SemVer)](https://semver.org/):
 
-**Warning:** Only do this if you're certain the version in package.json matches the tag.
+- **MAJOR** version (X.0.0) - Breaking changes
+- **MINOR** version (0.X.0) - New features (backward compatible)
+- **PATCH** version (0.0.X) - Bug fixes (backward compatible)
 
-## Security
-
-- All macOS binaries are code signed with Apple Developer certificate
-- All macOS binaries are notarized by Apple
-- Windows binaries are code signed
-- All binaries are scanned with VirusTotal
-- SHA256 checksums are generated for all artifacts
+Examples:
+- `2.5.5 -> 2.5.6` - Bug fix
+- `2.5.6 -> 2.6.0` - New feature
+- `2.6.0 -> 3.0.0` - Breaking change

apps/backend/README.md

@@ -1,122 +0,0 @@
-# Auto Claude Backend
-
-Autonomous coding framework powered by Claude AI. Builds software features through coordinated multi-agent sessions.
-
-## Getting Started
-
-### 1. Install
-
-```bash
-cd apps/backend
-python -m pip install -r requirements.txt
-```
-
-### 2. Configure
-
-```bash
-cp .env.example .env
-```
-
-Authenticate with Claude Code (token auto-saved to Keychain):
-```bash
-claude
-# Type: /login
-# Press Enter to open browser
-```
-
-Token is auto-detected from macOS Keychain / Windows Credential Manager.
-
-### 3. Run
-
-```bash
-# List available specs
-python run.py --list
-
-# Run a spec
-python run.py --spec 001
-```
-
-## Requirements
-
-- Python 3.10+
-- Claude API token
-
-## Commands
-
-| Command | Description |
-|---------|-------------|
-| `--list` | List all specs |
-| `--spec 001` | Run spec 001 |
-| `--spec 001 --isolated` | Run in isolated workspace |
-| `--spec 001 --direct` | Run directly in repo |
-| `--spec 001 --merge` | Merge completed build |
-| `--spec 001 --review` | Review build changes |
-| `--spec 001 --discard` | Discard build |
-| `--spec 001 --qa` | Run QA validation |
-| `--list-worktrees` | List all worktrees |
-| `--help` | Show all options |
-
-## Configuration
-
-Optional `.env` settings:
-
-| Variable | Description |
-|----------|-------------|
-| `AUTO_BUILD_MODEL` | Override Claude model |
-| `DEBUG=true` | Enable debug logging |
-| `LINEAR_API_KEY` | Enable Linear integration |
-| `GRAPHITI_ENABLED=true` | Enable memory system |
-
-## Troubleshooting
-
-**"tree-sitter not available"** - Safe to ignore, uses regex fallback.
-
-**Missing module errors** - Run `python -m pip install -r requirements.txt`
-
-**Debug mode** - Set `DEBUG=true DEBUG_LEVEL=2` before running.
-
----
-
-## For Developers
-
-### Project Structure
-
-```
-backend/
-├── agents/          # AI agent execution
-├── analysis/        # Code analysis
-├── cli/             # Command-line interface
-├── core/            # Core utilities
-├── integrations/    # External services (Linear, Graphiti)
-├── merge/           # Git merge handling
-├── project/         # Project detection
-├── prompts/         # Prompt templates
-├── qa/              # QA validation
-├── spec/            # Spec management
-└── ui/              # Terminal UI
-```
-
-### Design Principles
-
-- **SOLID** - Single responsibility, clean interfaces
-- **DRY** - Shared utilities in `core/`
-- **KISS** - Simple flat imports via facade modules
-
-### Import Convention
-
-```python
-# Use facade modules for clean imports
-from debug import debug, debug_error
-from progress import count_subtasks
-from workspace import setup_workspace
-```
-
-### Adding Features
-
-1. Create module in appropriate folder
-2. Export API in `__init__.py`
-3. Add facade module at root if commonly imported
-
-## License
-
-AGPL-3.0

apps/backend/__init__.py

@@ -1,23 +0,0 @@
-"""
-Auto Claude Backend - Autonomous Coding Framework
-==================================================
-
-Multi-agent autonomous coding framework that builds software through
-coordinated AI agent sessions.
-
-This package provides:
-- Autonomous agent execution for building features from specs
-- Workspace isolation via git worktrees
-- QA validation loops
-- Memory management (Graphiti + file-based)
-- Linear integration for project management
-
-Quick Start:
-    python run.py --spec 001    # Run a spec
-    python run.py --list        # List all specs
-
-See README.md for full documentation.
-"""
-
-__version__ = "2.7.6-beta.3"
-__author__ = "Auto Claude Team"

apps/backend/agents/__init__.py

@@ -1,96 +0,0 @@
-"""
-Agents Module
-=============
-
-Modular agent system for autonomous coding.
-
-This module provides:
-- run_autonomous_agent: Main coder agent loop
-- run_followup_planner: Follow-up planner for completed specs
-- Memory management (Graphiti + file-based fallback)
-- Session management and post-processing
-- Utility functions for git and plan management
-
-Uses lazy imports to avoid circular dependencies.
-"""
-
-# Explicit import required by CodeQL static analysis
-# (CodeQL doesn't recognize __getattr__ dynamic exports)
-from .utils import sync_spec_to_source
-
-__all__ = [
-    # Main API
-    "run_autonomous_agent",
-    "run_followup_planner",
-    # Memory
-    "debug_memory_system_status",
-    "get_graphiti_context",
-    "save_session_memory",
-    "save_session_to_graphiti",
-    # Session
-    "run_agent_session",
-    "post_session_processing",
-    # Utils
-    "get_latest_commit",
-    "get_commit_count",
-    "load_implementation_plan",
-    "find_subtask_in_plan",
-    "find_phase_for_subtask",
-    "sync_spec_to_source",
-    # Constants
-    "AUTO_CONTINUE_DELAY_SECONDS",
-    "HUMAN_INTERVENTION_FILE",
-]
-
-
-def __getattr__(name):
-    """Lazy imports to avoid circular dependencies."""
-    if name in ("AUTO_CONTINUE_DELAY_SECONDS", "HUMAN_INTERVENTION_FILE"):
-        from .base import AUTO_CONTINUE_DELAY_SECONDS, HUMAN_INTERVENTION_FILE
-
-        return locals()[name]
-    elif name == "run_autonomous_agent":
-        from .coder import run_autonomous_agent
-
-        return run_autonomous_agent
-    elif name in (
-        "debug_memory_system_status",
-        "get_graphiti_context",
-        "save_session_memory",
-        "save_session_to_graphiti",
-    ):
-        from .memory_manager import (
-            debug_memory_system_status,
-            get_graphiti_context,
-            save_session_memory,
-            save_session_to_graphiti,
-        )
-
-        return locals()[name]
-    elif name == "run_followup_planner":
-        from .planner import run_followup_planner
-
-        return run_followup_planner
-    elif name in ("post_session_processing", "run_agent_session"):
-        from .session import post_session_processing, run_agent_session
-
-        return locals()[name]
-    elif name in (
-        "find_phase_for_subtask",
-        "find_subtask_in_plan",
-        "get_commit_count",
-        "get_latest_commit",
-        "load_implementation_plan",
-        "sync_spec_to_source",
-    ):
-        from .utils import (
-            find_phase_for_subtask,
-            find_subtask_in_plan,
-            get_commit_count,
-            get_latest_commit,
-            load_implementation_plan,
-            sync_spec_to_source,
-        )
-
-        return locals()[name]
-    raise AttributeError(f"module 'agents' has no attribute '{name}'")

apps/backend/agents/base.py

@@ -1,99 +0,0 @@
-"""
-Base Module for Agent System
-=============================
-
-Shared imports, types, and constants used across agent modules.
-"""
-
-import logging
-import re
-
-# Configure logging
-logger = logging.getLogger(__name__)
-
-# Configuration constants
-AUTO_CONTINUE_DELAY_SECONDS = 3
-HUMAN_INTERVENTION_FILE = "PAUSE"
-
-# Retry configuration for subtask execution
-MAX_SUBTASK_RETRIES = 5  # Maximum attempts before marking subtask as stuck
-
-# Retry configuration for 400 tool concurrency errors
-MAX_CONCURRENCY_RETRIES = 5  # Maximum number of retries for tool concurrency errors
-INITIAL_RETRY_DELAY_SECONDS = (
-    2  # Initial retry delay (doubles each retry: 2s, 4s, 8s, 16s, 32s)
-)
-MAX_RETRY_DELAY_SECONDS = 32  # Cap retry delay at 32 seconds
-
-# Pause file constants for intelligent error recovery
-# These files signal pause/resume between frontend and backend
-RATE_LIMIT_PAUSE_FILE = "RATE_LIMIT_PAUSE"  # Created when rate limited
-AUTH_FAILURE_PAUSE_FILE = "AUTH_PAUSE"  # Created when auth fails
-RESUME_FILE = "RESUME"  # Created by frontend to signal resume
-
-# Maximum time to wait for rate limit reset (2 hours)
-# If reset time is beyond this, task should fail rather than wait indefinitely
-MAX_RATE_LIMIT_WAIT_SECONDS = 7200
-
-# Wait intervals for pause/resume checking
-RATE_LIMIT_CHECK_INTERVAL_SECONDS = (
-    30  # Check for RESUME file every 30 seconds during rate limit wait
-)
-AUTH_RESUME_CHECK_INTERVAL_SECONDS = 10  # Check for re-authentication every 10 seconds
-AUTH_RESUME_MAX_WAIT_SECONDS = 86400  # Maximum wait for re-authentication (24 hours)
-
-
-def sanitize_error_message(error_message: str, max_length: int = 500) -> str:
-    """
-    Sanitize error messages to remove potentially sensitive information.
-
-    Redacts:
-    - API keys (sk-..., key-...)
-    - Bearer tokens
-    - Token/secret values
-
-    Args:
-        error_message: The raw error message to sanitize
-        max_length: Maximum length to truncate to (default 500)
-
-    Returns:
-        Sanitized and truncated error message
-    """
-    if not error_message:
-        return ""
-
-    # Redact patterns that look like API keys or tokens
-    # Pattern: sk-... (OpenAI/Anthropic keys like sk-ant-api03-...)
-    sanitized = re.sub(
-        r"\bsk-[a-zA-Z0-9._\-]{20,}\b", "[REDACTED_API_KEY]", error_message
-    )
-
-    # Pattern: key-... (generic API keys)
-    sanitized = re.sub(r"\bkey-[a-zA-Z0-9._\-]{20,}\b", "[REDACTED_API_KEY]", sanitized)
-
-    # Pattern: Bearer ... (bearer tokens)
-    sanitized = re.sub(
-        r"\bBearer\s+[a-zA-Z0-9._\-]{20,}\b", "Bearer [REDACTED_TOKEN]", sanitized
-    )
-
-    # Pattern: token= or token: followed by long strings
-    sanitized = re.sub(
-        r"(token[=:]\s*)[a-zA-Z0-9._\-]{20,}\b",
-        r"\1[REDACTED_TOKEN]",
-        sanitized,
-        flags=re.IGNORECASE,
-    )
-
-    # Pattern: secret= or secret: followed by strings
-    sanitized = re.sub(
-        r"(secret[=:]\s*)[a-zA-Z0-9._\-]{20,}\b",
-        r"\1[REDACTED_SECRET]",
-        sanitized,
-        flags=re.IGNORECASE,
-    )
-
-    # Truncate to max length
-    if len(sanitized) > max_length:
-        sanitized = sanitized[:max_length] + "..."
-
-    return sanitized

apps/backend/agents/pr_template_filler.py

@@ -1,347 +0,0 @@
-"""
-PR Template Filler Agent Module
-================================
-
-Detects GitHub PR templates in a project and uses Claude to intelligently
-fill them based on code changes, spec context, commit history, and branch info.
-"""
-
-import logging
-from pathlib import Path
-
-from core.client import create_client
-from task_logger import LogPhase, get_task_logger
-
-from .session import run_agent_session
-
-logger = logging.getLogger(__name__)
-
-# Maximum diff size (in characters) before truncating to file-level summaries
-MAX_DIFF_CHARS = 30_000
-
-
-def detect_pr_template(project_dir: Path | str) -> str | None:
-    """
-    Detect a GitHub PR template in the project.
-
-    Searches for:
-    1. .github/PULL_REQUEST_TEMPLATE.md (single template)
-    2. .github/PULL_REQUEST_TEMPLATE/ directory (picks the first .md file)
-
-    Args:
-        project_dir: Root directory of the project
-
-    Returns:
-        The template content as a string, or None if no template is found.
-    """
-    project_dir = Path(project_dir)
-    # Check for single template file
-    single_template = project_dir / ".github" / "PULL_REQUEST_TEMPLATE.md"
-    if single_template.is_file():
-        try:
-            content = single_template.read_text(encoding="utf-8")
-            if content.strip():
-                logger.info(f"Found PR template: {single_template}")
-                return content
-        except Exception as e:
-            logger.warning(f"Failed to read PR template {single_template}: {e}")
-
-    # Check for template directory (pick first .md file alphabetically)
-    template_dir = project_dir / ".github" / "PULL_REQUEST_TEMPLATE"
-    if template_dir.is_dir():
-        try:
-            md_files = sorted(template_dir.glob("*.md"))
-            if md_files:
-                content = md_files[0].read_text(encoding="utf-8")
-                if content.strip():
-                    logger.info(f"Found PR template: {md_files[0]}")
-                    return content
-        except Exception as e:
-            logger.warning(f"Failed to read PR template from {template_dir}: {e}")
-
-    logger.info("No GitHub PR template found in project")
-    return None
-
-
-def _truncate_diff(diff_summary: str) -> str:
-    """
-    Truncate a large diff to file-level summaries to stay within token limits.
-
-    If the diff is within MAX_DIFF_CHARS, return it unchanged.
-    Otherwise, extract only file-level change summaries (e.g. file names
-    with insertions/deletions counts) and discard line-level detail.
-
-    Args:
-        diff_summary: The full diff summary text
-
-    Returns:
-        The original or truncated diff summary.
-    """
-    if len(diff_summary) <= MAX_DIFF_CHARS:
-        return diff_summary
-
-    lines = diff_summary.splitlines()
-    summary_lines: list[str] = []
-    summary_lines.append("(Diff truncated to file-level summaries due to size)")
-    summary_lines.append("")
-
-    for line in lines:
-        # Keep file-level summary lines (stat lines, file headers, etc.)
-        stripped = line.strip()
-        if (
-            stripped.startswith("diff --git")
-            or stripped.startswith("---")
-            or stripped.startswith("+++")
-            or "file changed" in stripped.lower()
-            or "files changed" in stripped.lower()
-            or "insertion" in stripped.lower()
-            or "deletion" in stripped.lower()
-            or stripped.startswith("rename")
-            or stripped.startswith("new file")
-            or stripped.startswith("deleted file")
-            or stripped.startswith("Binary files")
-        ):
-            summary_lines.append(line)
-
-    # If we couldn't extract meaningful summaries, take the first chunk
-    if len(summary_lines) <= 2:
-        truncated = diff_summary[:MAX_DIFF_CHARS]
-        return truncated + "\n\n(... diff truncated due to size)"
-
-    return "\n".join(summary_lines)
-
-
-def _strip_markdown_fences(content: str) -> str:
-    """
-    Strip markdown code fences from the response if present.
-
-    The AI sometimes wraps the output in ```markdown ... ``` even when instructed
-    not to. This ensures the PR body renders correctly on GitHub.
-
-    Args:
-        content: The response content to clean
-
-    Returns:
-        The content with markdown fences stripped.
-    """
-    result = content
-
-    # Strip opening fence (```markdown or just ```)
-    if result.startswith("```markdown"):
-        result = result[len("```markdown") :].lstrip("\n")
-    elif result.startswith("```md"):
-        result = result[len("```md") :].lstrip("\n")
-    elif result.startswith("```"):
-        result = result[3:].lstrip("\n")
-
-    # Strip closing fence
-    if result.endswith("```"):
-        result = result[:-3].rstrip("\n")
-
-    return result.strip()
-
-
-def _build_prompt(
-    template_content: str,
-    diff_summary: str,
-    spec_overview: str,
-    commit_log: str,
-    branch_name: str,
-    target_branch: str,
-) -> str:
-    """
-    Build the prompt for the PR template filler agent.
-
-    Combines the system prompt context variables into a single message
-    that includes the template and all change context.
-
-    Args:
-        template_content: The PR template markdown
-        diff_summary: Git diff summary (possibly truncated)
-        spec_overview: Spec.md content or summary
-        commit_log: Git log of commits in the PR
-        branch_name: Source branch name
-        target_branch: Target branch name
-
-    Returns:
-        The assembled prompt string.
-    """
-    return f"""Fill out the following GitHub PR template using the provided context.
-Return ONLY the filled template markdown — no preamble, no explanation, no code fences.
-
-## Checkbox Guidelines
-
-IMPORTANT: Be accurate and honest about what has and hasn't been verified.
-
-**Check these based on context (you can infer from the diff/spec):**
-- Base Branch targeting — check based on target_branch value
-- Type of Change (bug fix, feature, docs, refactor, test) — infer from diff and spec
-- Area (Frontend, Backend, Fullstack) — infer from changed file paths
-- Feature Toggle "N/A" — if the feature appears complete and not behind a flag
-- Breaking Changes "No" — if changes appear backward compatible
-
-**Leave UNCHECKED (these require human verification you cannot perform):**
-- "I've tested my changes locally" — you have not tested anything
-- "All CI checks pass" — CI has not run yet
-- "Windows/macOS/Linux tested" — requires manual testing on each platform
-- "All existing tests pass" — CI has not run yet
-- "New features include test coverage" — unless test files are clearly visible in the diff
-- "Bug fixes include regression tests" — unless test files are clearly visible in the diff
-
-**For platform/code quality checkboxes:**
-- "Used centralized platform/ module" — leave unchecked unless you can verify from the diff
-- "No hardcoded paths" — leave unchecked unless you can verify from the diff
-- "PR is small and focused (< 400 lines)" — check only if diff stats show < 400 lines changed
-
-**For the "I've synced with develop branch" checkbox:**
-- Leave unchecked — you cannot verify the sync status
-
-## PR Template
-
-{template_content}
-
-## Change Context
-
-### Branch Information
-- **Source branch:** {branch_name}
-- **Target branch:** {target_branch}
-
-### Git Diff Summary
-```
-{diff_summary}
-```
-
-### Spec Overview
-{spec_overview}
-
-### Commit History
-```
-{commit_log}
-```
-
-Fill every section of the PR template. Follow the checkbox guidelines above carefully.
-Output ONLY the completed template — no code fences, no preamble."""
-
-
-def _load_spec_overview(spec_dir: Path) -> str:
-    """
-    Load the spec.md content for context. Falls back to a brief note if unavailable.
-
-    Args:
-        spec_dir: Directory containing the spec files
-
-    Returns:
-        The spec content or a fallback message.
-    """
-    spec_file = spec_dir / "spec.md"
-    if spec_file.is_file():
-        try:
-            content = spec_file.read_text(encoding="utf-8")
-            # Truncate very long specs to keep prompt manageable
-            if len(content) > 8000:
-                return content[:8000] + "\n\n(... spec truncated for brevity)"
-            return content
-        except Exception as e:
-            logger.warning(f"Failed to read spec.md: {e}")
-    return "(No spec overview available)"
-
-
-async def run_pr_template_filler(
-    project_dir: Path,
-    spec_dir: Path,
-    model: str,
-    thinking_budget: int | None = None,
-    branch_name: str = "",
-    target_branch: str = "develop",
-    diff_summary: str = "",
-    commit_log: str = "",
-    verbose: bool = False,
-) -> str | None:
-    """
-    Run the PR template filler agent to generate a filled PR body.
-
-    Detects the project's PR template, gathers change context, and invokes
-    Claude to intelligently fill out the template sections.
-
-    Args:
-        project_dir: Root directory of the project
-        spec_dir: Directory containing the spec files
-        model: Claude model to use
-        thinking_budget: Max thinking tokens (None to disable extended thinking)
-        branch_name: Source branch name for the PR
-        target_branch: Target branch name for the PR
-        diff_summary: Git diff summary of changes
-        commit_log: Git log of commits included in the PR
-        verbose: Whether to show detailed output
-
-    Returns:
-        The filled template markdown string, or None if template detection fails
-        or the agent encounters an error.
-    """
-    # Detect PR template
-    template_content = detect_pr_template(project_dir)
-    if template_content is None:
-        logger.info("No PR template detected — skipping template filler")
-        return None
-
-    # Load spec overview
-    spec_overview = _load_spec_overview(spec_dir)
-
-    # Truncate diff if too large
-    truncated_diff = _truncate_diff(diff_summary)
-
-    # Build the prompt
-    prompt = _build_prompt(
-        template_content=template_content,
-        diff_summary=truncated_diff,
-        spec_overview=spec_overview,
-        commit_log=commit_log,
-        branch_name=branch_name,
-        target_branch=target_branch,
-    )
-
-    # Initialize task logger
-    task_logger = get_task_logger(spec_dir)
-    if task_logger:
-        task_logger.start_phase(LogPhase.CODING, "PR template filling")
-
-    # Create client following the pattern from planner.py
-    client = create_client(
-        project_dir,
-        spec_dir,
-        model,
-        agent_type="pr_template_filler",
-        max_thinking_tokens=thinking_budget,
-    )
-
-    try:
-        async with client:
-            status, response, _ = await run_agent_session(
-                client, prompt, spec_dir, verbose, phase=LogPhase.CODING
-            )
-
-        if task_logger:
-            task_logger.end_phase(
-                LogPhase.CODING,
-                success=(status != "error"),
-                message="PR template filling completed",
-            )
-
-        if status == "error":
-            logger.error("PR template filler agent returned an error")
-            return None
-
-        # The agent should return only the filled template markdown
-        if response and response.strip():
-            result = _strip_markdown_fences(response.strip())
-            logger.info("PR template filled successfully")
-            return result
-
-        logger.warning("PR template filler returned empty response")
-        return None
-
-    except Exception as e:
-        logger.error(f"PR template filler error: {e}")
-        if task_logger:
-            task_logger.log_error(f"PR template filler error: {e}", LogPhase.CODING)
-        return None

apps/backend/agents/tools_pkg/models.py

@@ -1,530 +0,0 @@
-"""
-Tool Models and Constants
-==========================
-
-Defines tool name constants and configuration for auto-claude MCP tools.
-
-This module is the single source of truth for all tool definitions used by
-the Claude Agent SDK client. Tool lists are organized by category:
-
-- Base tools: Core file operations (Read, Write, Edit, etc.)
-- Web tools: Documentation and research (WebFetch, WebSearch)
-- MCP tools: External integrations (Context7, Linear, Graphiti, etc.)
-- Auto-Claude tools: Custom build management tools
-"""
-
-import os
-
-# =============================================================================
-# Base Tools (Built-in Claude Code tools)
-# =============================================================================
-
-# Core file operation tools
-BASE_READ_TOOLS = ["Read", "Glob", "Grep"]
-BASE_WRITE_TOOLS = ["Write", "Edit", "Bash"]
-
-# Web tools for documentation lookup and research
-# Always available to all agents for accessing external information
-WEB_TOOLS = ["WebFetch", "WebSearch"]
-
-# =============================================================================
-# Auto-Claude MCP Tools (Custom build management)
-# =============================================================================
-
-# Auto-Claude MCP tool names (prefixed with mcp__auto-claude__)
-TOOL_UPDATE_SUBTASK_STATUS = "mcp__auto-claude__update_subtask_status"
-TOOL_GET_BUILD_PROGRESS = "mcp__auto-claude__get_build_progress"
-TOOL_RECORD_DISCOVERY = "mcp__auto-claude__record_discovery"
-TOOL_RECORD_GOTCHA = "mcp__auto-claude__record_gotcha"
-TOOL_GET_SESSION_CONTEXT = "mcp__auto-claude__get_session_context"
-TOOL_UPDATE_QA_STATUS = "mcp__auto-claude__update_qa_status"
-
-# =============================================================================
-# External MCP Tools
-# =============================================================================
-
-# Context7 MCP tools for documentation lookup (always enabled)
-CONTEXT7_TOOLS = [
-    "mcp__context7__resolve-library-id",
-    "mcp__context7__query-docs",
-]
-
-# Linear MCP tools for project management (when LINEAR_API_KEY is set)
-LINEAR_TOOLS = [
-    "mcp__linear-server__list_teams",
-    "mcp__linear-server__get_team",
-    "mcp__linear-server__list_projects",
-    "mcp__linear-server__get_project",
-    "mcp__linear-server__create_project",
-    "mcp__linear-server__update_project",
-    "mcp__linear-server__list_issues",
-    "mcp__linear-server__get_issue",
-    "mcp__linear-server__create_issue",
-    "mcp__linear-server__update_issue",
-    "mcp__linear-server__list_comments",
-    "mcp__linear-server__create_comment",
-    "mcp__linear-server__list_issue_statuses",
-    "mcp__linear-server__list_issue_labels",
-    "mcp__linear-server__list_users",
-    "mcp__linear-server__get_user",
-]
-
-# Graphiti MCP tools for knowledge graph memory (when GRAPHITI_MCP_URL is set)
-# See: https://github.com/getzep/graphiti
-GRAPHITI_MCP_TOOLS = [
-    "mcp__graphiti-memory__search_nodes",  # Search entity summaries
-    "mcp__graphiti-memory__search_facts",  # Search relationships between entities
-    "mcp__graphiti-memory__add_episode",  # Add data to knowledge graph
-    "mcp__graphiti-memory__get_episodes",  # Retrieve recent episodes
-    "mcp__graphiti-memory__get_entity_edge",  # Get specific entity/relationship
-]
-
-# =============================================================================
-# Browser Automation MCP Tools (QA agents only)
-# =============================================================================
-
-# Puppeteer MCP tools for web browser automation
-# Used for web frontend validation (non-Electron web apps)
-# NOTE: Screenshots must be compressed (1280x720, quality 60, JPEG) to stay under
-# Claude SDK's 1MB JSON message buffer limit. See GitHub issue #74.
-PUPPETEER_TOOLS = [
-    "mcp__puppeteer__puppeteer_connect_active_tab",
-    "mcp__puppeteer__puppeteer_navigate",
-    "mcp__puppeteer__puppeteer_screenshot",
-    "mcp__puppeteer__puppeteer_click",
-    "mcp__puppeteer__puppeteer_fill",
-    "mcp__puppeteer__puppeteer_select",
-    "mcp__puppeteer__puppeteer_hover",
-    "mcp__puppeteer__puppeteer_evaluate",
-]
-
-# Electron MCP tools for desktop app automation (when ELECTRON_MCP_ENABLED is set)
-# Uses electron-mcp-server to connect to Electron apps via Chrome DevTools Protocol.
-# Electron app must be started with --remote-debugging-port=9222 (or ELECTRON_DEBUG_PORT).
-# These tools are only available to QA agents (qa_reviewer, qa_fixer), not Coder/Planner.
-# NOTE: Screenshots must be compressed to stay under Claude SDK's 1MB JSON message buffer limit.
-ELECTRON_TOOLS = [
-    "mcp__electron__get_electron_window_info",  # Get info about running Electron windows
-    "mcp__electron__take_screenshot",  # Capture screenshot of Electron window
-    "mcp__electron__send_command_to_electron",  # Send commands (click, fill, evaluate JS)
-    "mcp__electron__read_electron_logs",  # Read console logs from Electron app
-]
-
-# =============================================================================
-# Configuration
-# =============================================================================
-
-
-def is_electron_mcp_enabled() -> bool:
-    """
-    Check if Electron MCP server integration is enabled.
-
-    Requires ELECTRON_MCP_ENABLED to be set to 'true'.
-    When enabled, QA agents can use Electron MCP tools to connect to Electron apps
-    via Chrome DevTools Protocol on the configured debug port.
-    """
-    return os.environ.get("ELECTRON_MCP_ENABLED", "").lower() == "true"
-
-
-# =============================================================================
-# Agent Configuration Registry
-# =============================================================================
-# Single source of truth for phase → tools → MCP servers mapping.
-# This enables phase-aware tool control and context window optimization.
-
-AGENT_CONFIGS = {
-    # ═══════════════════════════════════════════════════════════════════════
-    # SPEC CREATION PHASES (Minimal tools, fast startup)
-    # ═══════════════════════════════════════════════════════════════════════
-    "spec_gatherer": {
-        "tools": BASE_READ_TOOLS + WEB_TOOLS,
-        "mcp_servers": [],  # No MCP needed - just reads project
-        "auto_claude_tools": [],
-        "thinking_default": "medium",
-    },
-    "spec_researcher": {
-        "tools": BASE_READ_TOOLS + WEB_TOOLS,
-        "mcp_servers": ["context7"],  # Needs docs lookup
-        "auto_claude_tools": [],
-        "thinking_default": "medium",
-    },
-    "spec_writer": {
-        "tools": BASE_READ_TOOLS + BASE_WRITE_TOOLS,
-        "mcp_servers": [],  # Just writes spec.md
-        "auto_claude_tools": [],
-        "thinking_default": "high",
-    },
-    "spec_critic": {
-        "tools": BASE_READ_TOOLS,
-        "mcp_servers": [],  # Self-critique, no external tools
-        "auto_claude_tools": [],
-        "thinking_default": "high",
-    },
-    "spec_discovery": {
-        "tools": BASE_READ_TOOLS + WEB_TOOLS,
-        "mcp_servers": [],
-        "auto_claude_tools": [],
-        "thinking_default": "medium",
-    },
-    "spec_context": {
-        "tools": BASE_READ_TOOLS,
-        "mcp_servers": [],
-        "auto_claude_tools": [],
-        "thinking_default": "medium",
-    },
-    "spec_validation": {
-        "tools": BASE_READ_TOOLS,
-        "mcp_servers": [],
-        "auto_claude_tools": [],
-        "thinking_default": "high",
-    },
-    "spec_compaction": {
-        "tools": BASE_READ_TOOLS + BASE_WRITE_TOOLS,
-        "mcp_servers": [],
-        "auto_claude_tools": [],
-        "thinking_default": "medium",
-    },
-    # ═══════════════════════════════════════════════════════════════════════
-    # BUILD PHASES (Full tools + Graphiti memory)
-    # Note: "linear" is conditional on project setting "update_linear_with_tasks"
-    # ═══════════════════════════════════════════════════════════════════════
-    "planner": {
-        "tools": BASE_READ_TOOLS + BASE_WRITE_TOOLS + WEB_TOOLS,
-        "mcp_servers": ["context7", "graphiti", "auto-claude"],
-        "mcp_servers_optional": ["linear"],  # Only if project setting enabled
-        "auto_claude_tools": [
-            TOOL_GET_BUILD_PROGRESS,
-            TOOL_GET_SESSION_CONTEXT,
-            TOOL_RECORD_DISCOVERY,
-        ],
-        "thinking_default": "high",
-    },
-    "coder": {
-        "tools": BASE_READ_TOOLS + BASE_WRITE_TOOLS + WEB_TOOLS,
-        "mcp_servers": ["context7", "graphiti", "auto-claude"],
-        "mcp_servers_optional": ["linear"],
-        "auto_claude_tools": [
-            TOOL_UPDATE_SUBTASK_STATUS,
-            TOOL_GET_BUILD_PROGRESS,
-            TOOL_RECORD_DISCOVERY,
-            TOOL_RECORD_GOTCHA,
-            TOOL_GET_SESSION_CONTEXT,
-        ],
-        "thinking_default": "low",  # Coding uses minimal thinking (effort: low for Opus, 1024 tokens for Sonnet/Haiku)
-    },
-    # ═══════════════════════════════════════════════════════════════════════
-    # QA PHASES (Read + test + browser + Graphiti memory)
-    # ═══════════════════════════════════════════════════════════════════════
-    "qa_reviewer": {
-        # Read + Write/Edit (for QA reports and plan updates) + Bash (for tests)
-        # Note: Reviewer writes to spec directory only (qa_report.md, implementation_plan.json)
-        "tools": BASE_READ_TOOLS + BASE_WRITE_TOOLS + WEB_TOOLS,
-        "mcp_servers": ["context7", "graphiti", "auto-claude", "browser"],
-        "mcp_servers_optional": ["linear"],  # For updating issue status
-        "auto_claude_tools": [
-            TOOL_GET_BUILD_PROGRESS,
-            TOOL_UPDATE_QA_STATUS,
-            TOOL_GET_SESSION_CONTEXT,
-        ],
-        "thinking_default": "high",
-    },
-    "qa_fixer": {
-        "tools": BASE_READ_TOOLS + BASE_WRITE_TOOLS + WEB_TOOLS,
-        "mcp_servers": ["context7", "graphiti", "auto-claude", "browser"],
-        "mcp_servers_optional": ["linear"],
-        "auto_claude_tools": [
-            TOOL_UPDATE_SUBTASK_STATUS,
-            TOOL_GET_BUILD_PROGRESS,
-            TOOL_UPDATE_QA_STATUS,
-            TOOL_RECORD_GOTCHA,
-        ],
-        "thinking_default": "medium",
-    },
-    # ═══════════════════════════════════════════════════════════════════════
-    # UTILITY PHASES (Minimal, no MCP)
-    # ═══════════════════════════════════════════════════════════════════════
-    "insights": {
-        "tools": BASE_READ_TOOLS + WEB_TOOLS,
-        "mcp_servers": [],
-        "auto_claude_tools": [],
-        # Note: Default to "low" for minimal thinking overhead
-        # Haiku doesn't support thinking; create_simple_client() handles this
-        "thinking_default": "low",
-    },
-    "merge_resolver": {
-        "tools": [],  # Text-only analysis
-        "mcp_servers": [],
-        "auto_claude_tools": [],
-        "thinking_default": "low",
-    },
-    "commit_message": {
-        "tools": [],
-        "mcp_servers": [],
-        "auto_claude_tools": [],
-        "thinking_default": "low",
-    },
-    "pr_template_filler": {
-        "tools": BASE_READ_TOOLS,  # Read-only — reads diff, template, spec
-        "mcp_servers": [],  # No MCP needed, context passed via prompt
-        "auto_claude_tools": [],
-        "thinking_default": "low",  # Fast utility task for structured fill-in
-    },
-    "pr_reviewer": {
-        "tools": BASE_READ_TOOLS + WEB_TOOLS,  # Read-only
-        "mcp_servers": ["context7"],
-        "auto_claude_tools": [],
-        "thinking_default": "high",
-    },
-    "pr_orchestrator_parallel": {
-        # Read-only for parallel PR orchestrator
-        # NOTE: Do NOT add "Task" here - the SDK auto-allows Task when agents are defined
-        # via the --agents flag. Explicitly adding it interferes with agent registration.
-        "tools": BASE_READ_TOOLS + WEB_TOOLS,
-        "mcp_servers": ["context7"],
-        "auto_claude_tools": [],
-        "thinking_default": "high",
-    },
-    "pr_followup_parallel": {
-        # Read-only for parallel followup reviewer
-        # NOTE: Do NOT add "Task" here - same reason as pr_orchestrator_parallel
-        "tools": BASE_READ_TOOLS + WEB_TOOLS,
-        "mcp_servers": ["context7"],
-        "auto_claude_tools": [],
-        "thinking_default": "high",
-    },
-    "pr_finding_validator": {
-        # Standalone validator for re-checking findings against actual code
-        # Called separately from orchestrator to validate findings with fresh context
-        "tools": BASE_READ_TOOLS,
-        "mcp_servers": [],
-        "auto_claude_tools": [],
-        "thinking_default": "medium",
-    },
-    # ═══════════════════════════════════════════════════════════════════════
-    # ANALYSIS PHASES
-    # ═══════════════════════════════════════════════════════════════════════
-    "analysis": {
-        "tools": BASE_READ_TOOLS + WEB_TOOLS,
-        "mcp_servers": ["context7"],
-        "auto_claude_tools": [],
-        "thinking_default": "medium",
-    },
-    "batch_analysis": {
-        "tools": BASE_READ_TOOLS + WEB_TOOLS,
-        "mcp_servers": [],
-        "auto_claude_tools": [],
-        "thinking_default": "low",
-    },
-    "batch_validation": {
-        "tools": BASE_READ_TOOLS,
-        "mcp_servers": [],
-        "auto_claude_tools": [],
-        "thinking_default": "low",
-    },
-    # ═══════════════════════════════════════════════════════════════════════
-    # ROADMAP & IDEATION
-    # ═══════════════════════════════════════════════════════════════════════
-    "roadmap_discovery": {
-        "tools": BASE_READ_TOOLS + WEB_TOOLS,
-        "mcp_servers": ["context7"],
-        "auto_claude_tools": [],
-        "thinking_default": "high",
-    },
-    "competitor_analysis": {
-        "tools": BASE_READ_TOOLS + WEB_TOOLS,
-        "mcp_servers": ["context7"],  # WebSearch for competitor research
-        "auto_claude_tools": [],
-        "thinking_default": "high",
-    },
-    "ideation": {
-        "tools": BASE_READ_TOOLS + WEB_TOOLS,
-        "mcp_servers": [],
-        "auto_claude_tools": [],
-        "thinking_default": "high",
-    },
-}
-
-
-# =============================================================================
-# Agent Config Helper Functions
-# =============================================================================
-
-
-def get_agent_config(agent_type: str) -> dict:
-    """
-    Get full configuration for an agent type.
-
-    Args:
-        agent_type: The agent type identifier (e.g., 'coder', 'planner', 'qa_reviewer')
-
-    Returns:
-        Configuration dict containing tools, mcp_servers, auto_claude_tools, thinking_default
-
-    Raises:
-        ValueError: If agent_type is not found in AGENT_CONFIGS (strict mode)
-    """
-    if agent_type not in AGENT_CONFIGS:
-        raise ValueError(
-            f"Unknown agent type: '{agent_type}'. "
-            f"Valid types: {sorted(AGENT_CONFIGS.keys())}"
-        )
-    return AGENT_CONFIGS[agent_type]
-
-
-def _map_mcp_server_name(
-    name: str, custom_server_ids: list[str] | None = None
-) -> str | None:
-    """
-    Map user-friendly MCP server names to internal identifiers.
-    Also accepts custom server IDs directly.
-
-    Args:
-        name: User-provided MCP server name
-        custom_server_ids: List of custom server IDs to accept as-is
-
-    Returns:
-        Internal server identifier or None if not recognized
-    """
-    if not name:
-        return None
-    mappings = {
-        "context7": "context7",
-        "graphiti-memory": "graphiti",
-        "graphiti": "graphiti",
-        "linear": "linear",
-        "electron": "electron",
-        "puppeteer": "puppeteer",
-        "auto-claude": "auto-claude",
-    }
-    # Check if it's a known mapping
-    mapped = mappings.get(name.lower().strip())
-    if mapped:
-        return mapped
-    # Check if it's a custom server ID (accept as-is)
-    if custom_server_ids and name in custom_server_ids:
-        return name
-    return None
-
-
-def get_required_mcp_servers(
-    agent_type: str,
-    project_capabilities: dict | None = None,
-    linear_enabled: bool = False,
-    mcp_config: dict | None = None,
-) -> list[str]:
-    """
-    Get MCP servers required for this agent type.
-
-    Handles dynamic server selection:
-    - "browser" → electron (if is_electron) or puppeteer (if is_web_frontend)
-    - "linear" → only if in mcp_servers_optional AND linear_enabled is True
-    - "graphiti" → only if GRAPHITI_MCP_URL is set
-    - Respects per-project MCP config overrides from .auto-claude/.env
-    - Applies per-agent ADD/REMOVE overrides from AGENT_MCP_<agent>_ADD/REMOVE
-
-    Args:
-        agent_type: The agent type identifier
-        project_capabilities: Dict from detect_project_capabilities() or None
-        linear_enabled: Whether Linear integration is enabled for this project
-        mcp_config: Per-project MCP server toggles from .auto-claude/.env
-                   Keys: CONTEXT7_ENABLED, LINEAR_MCP_ENABLED, ELECTRON_MCP_ENABLED,
-                         PUPPETEER_MCP_ENABLED, AGENT_MCP_<agent>_ADD/REMOVE
-
-    Returns:
-        List of MCP server names to start
-    """
-    config = get_agent_config(agent_type)
-    servers = list(config.get("mcp_servers", []))
-
-    # Load per-project config (or use defaults)
-    if mcp_config is None:
-        mcp_config = {}
-
-    # Filter context7 if explicitly disabled by project config
-    if "context7" in servers:
-        context7_enabled = mcp_config.get("CONTEXT7_ENABLED", "true")
-        if str(context7_enabled).lower() == "false":
-            servers = [s for s in servers if s != "context7"]
-
-    # Handle optional servers (e.g., Linear if project setting enabled)
-    optional = config.get("mcp_servers_optional", [])
-    if "linear" in optional and linear_enabled:
-        # Also check per-project LINEAR_MCP_ENABLED override
-        linear_mcp_enabled = mcp_config.get("LINEAR_MCP_ENABLED", "true")
-        if str(linear_mcp_enabled).lower() != "false":
-            servers.append("linear")
-
-    # Handle dynamic "browser" → electron/puppeteer based on project type and config
-    if "browser" in servers:
-        servers = [s for s in servers if s != "browser"]
-        if project_capabilities:
-            is_electron = project_capabilities.get("is_electron", False)
-            is_web_frontend = project_capabilities.get("is_web_frontend", False)
-
-            # Check per-project overrides (default false for both)
-            electron_enabled = mcp_config.get("ELECTRON_MCP_ENABLED", "false")
-            puppeteer_enabled = mcp_config.get("PUPPETEER_MCP_ENABLED", "false")
-
-            # Electron: enabled by project config OR global env var
-            if is_electron and (
-                str(electron_enabled).lower() == "true" or is_electron_mcp_enabled()
-            ):
-                servers.append("electron")
-            # Puppeteer: enabled by project config (no global env var)
-            elif is_web_frontend and not is_electron:
-                if str(puppeteer_enabled).lower() == "true":
-                    servers.append("puppeteer")
-
-    # Filter graphiti if not enabled
-    if "graphiti" in servers:
-        if not os.environ.get("GRAPHITI_MCP_URL"):
-            servers = [s for s in servers if s != "graphiti"]
-
-    # ========== Apply per-agent MCP overrides ==========
-    # Format: AGENT_MCP_<agent_type>_ADD=server1,server2
-    #         AGENT_MCP_<agent_type>_REMOVE=server1,server2
-    add_key = f"AGENT_MCP_{agent_type}_ADD"
-    remove_key = f"AGENT_MCP_{agent_type}_REMOVE"
-
-    # Extract custom server IDs for mapping (allows custom servers to be recognized)
-    custom_servers = mcp_config.get("CUSTOM_MCP_SERVERS", [])
-    custom_server_ids = [s.get("id") for s in custom_servers if s.get("id")]
-
-    # Process additions
-    if add_key in mcp_config:
-        additions = [
-            s.strip() for s in str(mcp_config[add_key]).split(",") if s.strip()
-        ]
-        for server in additions:
-            mapped = _map_mcp_server_name(server, custom_server_ids)
-            if mapped and mapped not in servers:
-                servers.append(mapped)
-
-    # Process removals (but never remove auto-claude)
-    if remove_key in mcp_config:
-        removals = [
-            s.strip() for s in str(mcp_config[remove_key]).split(",") if s.strip()
-        ]
-        for server in removals:
-            mapped = _map_mcp_server_name(server, custom_server_ids)
-            if mapped and mapped != "auto-claude":  # auto-claude cannot be removed
-                servers = [s for s in servers if s != mapped]
-
-    return servers
-
-
-def get_default_thinking_level(agent_type: str) -> str:
-    """
-    Get default thinking level string for agent type.
-
-    This returns the thinking level name (e.g., 'medium', 'high'), not the token budget.
-    To convert to tokens, use phase_config.get_thinking_budget(level).
-
-    Args:
-        agent_type: The agent type identifier
-
-    Returns:
-        Thinking level string (low, medium, high)
-    """
-    config = get_agent_config(agent_type)
-    return config.get("thinking_default", "medium")

apps/backend/agents/tools_pkg/permissions.py

@@ -1,120 +0,0 @@
-"""
-Agent Tool Permissions
-======================
-
-Manages which tools are allowed for each agent type to prevent context
-pollution and accidental misuse.
-
-Supports dynamic tool filtering based on project capabilities to optimize
-context window usage. For example, Electron tools are only included for
-Electron projects, not for Next.js or CLI projects.
-
-This module now uses AGENT_CONFIGS from models.py as the single source of truth
-for tool permissions. The get_allowed_tools() function remains the primary API
-for backwards compatibility.
-"""
-
-from .models import (
-    AGENT_CONFIGS,
-    CONTEXT7_TOOLS,
-    ELECTRON_TOOLS,
-    GRAPHITI_MCP_TOOLS,
-    LINEAR_TOOLS,
-    PUPPETEER_TOOLS,
-    get_agent_config,
-    get_required_mcp_servers,
-)
-from .registry import is_tools_available
-
-
-def get_allowed_tools(
-    agent_type: str,
-    project_capabilities: dict | None = None,
-    linear_enabled: bool = False,
-    mcp_config: dict | None = None,
-) -> list[str]:
-    """
-    Get the list of allowed tools for a specific agent type.
-
-    This ensures each agent only sees tools relevant to their role,
-    preventing context pollution and accidental misuse.
-
-    Uses AGENT_CONFIGS as the single source of truth for tool permissions.
-    Dynamic MCP tools are added based on project capabilities and required servers.
-
-    Args:
-        agent_type: Agent type identifier (e.g., 'coder', 'planner', 'qa_reviewer')
-        project_capabilities: Optional dict from detect_project_capabilities()
-                            containing flags like is_electron, is_web_frontend, etc.
-        linear_enabled: Whether Linear integration is enabled for this project
-        mcp_config: Per-project MCP server toggles from .auto-claude/.env
-
-    Returns:
-        List of allowed tool names
-
-    Raises:
-        ValueError: If agent_type is not found in AGENT_CONFIGS
-    """
-    # Get agent configuration (raises ValueError if unknown type)
-    config = get_agent_config(agent_type)
-
-    # Start with base tools from config
-    tools = list(config.get("tools", []))
-
-    # Get required MCP servers for this agent
-    required_servers = get_required_mcp_servers(
-        agent_type,
-        project_capabilities,
-        linear_enabled,
-        mcp_config,
-    )
-
-    # Add auto-claude tools ONLY if the MCP server is available
-    # This prevents allowing tools that won't work because the server isn't running
-    if "auto-claude" in required_servers and is_tools_available():
-        tools.extend(config.get("auto_claude_tools", []))
-
-    # Add MCP tool names based on required servers
-    tools.extend(_get_mcp_tools_for_servers(required_servers))
-
-    return tools
-
-
-def _get_mcp_tools_for_servers(servers: list[str]) -> list[str]:
-    """
-    Get the list of MCP tools for a list of required servers.
-
-    Maps server names to their corresponding tool lists.
-
-    Args:
-        servers: List of MCP server names (e.g., ['context7', 'linear', 'electron'])
-
-    Returns:
-        List of MCP tool names for all specified servers
-    """
-    tools = []
-
-    for server in servers:
-        if server == "context7":
-            tools.extend(CONTEXT7_TOOLS)
-        elif server == "linear":
-            tools.extend(LINEAR_TOOLS)
-        elif server == "graphiti":
-            tools.extend(GRAPHITI_MCP_TOOLS)
-        elif server == "electron":
-            tools.extend(ELECTRON_TOOLS)
-        elif server == "puppeteer":
-            tools.extend(PUPPETEER_TOOLS)
-        # auto-claude tools are already added via config["auto_claude_tools"]
-
-    return tools
-
-
-def get_all_agent_types() -> list[str]:
-    """
-    Get all registered agent types.
-
-    Returns:
-        Sorted list of all agent type identifiers
-    """
-    return sorted(AGENT_CONFIGS.keys())

apps/backend/agents/tools_pkg/tools/qa.py

@@ -1,204 +0,0 @@
-"""
-QA Management Tools
-===================
-
-Tools for managing QA status and sign-off in implementation_plan.json.
-"""
-
-import json
-import logging
-from datetime import datetime, timezone
-from pathlib import Path
-from typing import Any
-
-from core.file_utils import write_json_atomic
-from spec.validate_pkg.auto_fix import auto_fix_plan
-
-try:
-    from claude_agent_sdk import tool
-
-    SDK_TOOLS_AVAILABLE = True
-except ImportError:
-    SDK_TOOLS_AVAILABLE = False
-    tool = None
-
-
-def _apply_qa_update(
-    plan: dict[str, Any],
-    status: str,
-    issues: list[Any],
-    tests_passed: dict[str, Any],
-) -> int:
-    """
-    Apply QA update to the plan and return the new QA session number.
-
-    Args:
-        plan: The implementation plan dict
-        status: QA status (pending, in_review, approved, rejected, fixes_applied)
-        issues: List of issues found
-        tests_passed: Dict of test results
-
-    Returns:
-        The new QA session number
-    """
-    # Get current QA session number
-    current_qa = plan.get("qa_signoff", {})
-    qa_session = current_qa.get("qa_session", 0)
-    if status in ["in_review", "rejected"]:
-        qa_session += 1
-
-    plan["qa_signoff"] = {
-        "status": status,
-        "qa_session": qa_session,
-        "issues_found": issues,
-        "tests_passed": tests_passed,
-        "timestamp": datetime.now(timezone.utc).isoformat(),
-        "ready_for_qa_revalidation": status == "fixes_applied",
-    }
-
-    # NOTE: Do NOT write plan["status"] or plan["planStatus"] here.
-    # The frontend XState task state machine owns status transitions.
-    # Writing status here races with XState's persistPlanStatusAndReasonSync()
-    # and can clobber the reviewReason field, causing tasks to appear "incomplete".
-
-    plan["last_updated"] = datetime.now(timezone.utc).isoformat()
-
-    return qa_session
-
-
-def create_qa_tools(spec_dir: Path, project_dir: Path) -> list:
-    """
-    Create QA management tools.
-
-    Args:
-        spec_dir: Path to the spec directory
-        project_dir: Path to the project root
-
-    Returns:
-        List of QA tool functions
-    """
-    if not SDK_TOOLS_AVAILABLE:
-        return []
-
-    tools = []
-
-    # -------------------------------------------------------------------------
-    # Tool: update_qa_status
-    # -------------------------------------------------------------------------
-    @tool(
-        "update_qa_status",
-        "Update the QA sign-off status in implementation_plan.json. Use after QA review.",
-        {"status": str, "issues": str, "tests_passed": str},
-    )
-    async def update_qa_status(args: dict[str, Any]) -> dict[str, Any]:
-        """Update QA status in the implementation plan."""
-        status = args["status"]
-        issues_str = args.get("issues", "[]")
-        tests_str = args.get("tests_passed", "{}")
-
-        valid_statuses = [
-            "pending",
-            "in_review",
-            "approved",
-            "rejected",
-            "fixes_applied",
-        ]
-        if status not in valid_statuses:
-            return {
-                "content": [
-                    {
-                        "type": "text",
-                        "text": f"Error: Invalid QA status '{status}'. Must be one of: {valid_statuses}",
-                    }
-                ]
-            }
-
-        plan_file = spec_dir / "implementation_plan.json"
-        if not plan_file.exists():
-            return {
-                "content": [
-                    {
-                        "type": "text",
-                        "text": "Error: implementation_plan.json not found",
-                    }
-                ]
-            }
-
-        try:
-            # Parse issues and tests
-            try:
-                issues = json.loads(issues_str) if issues_str else []
-            except json.JSONDecodeError:
-                issues = [{"description": issues_str}] if issues_str else []
-
-            try:
-                tests_passed = json.loads(tests_str) if tests_str else {}
-            except json.JSONDecodeError:
-                tests_passed = {}
-
-            with open(plan_file, encoding="utf-8") as f:
-                plan = json.load(f)
-
-            qa_session = _apply_qa_update(plan, status, issues, tests_passed)
-
-            # Use atomic write to prevent file corruption
-            write_json_atomic(plan_file, plan, indent=2)
-
-            return {
-                "content": [
-                    {
-                        "type": "text",
-                        "text": f"Updated QA status to '{status}' (session {qa_session})",
-                    }
-                ]
-            }
-
-        except json.JSONDecodeError as e:
-            # Attempt to auto-fix the plan and retry
-            if auto_fix_plan(spec_dir):
-                # Retry after fix
-                try:
-                    with open(plan_file, encoding="utf-8") as f:
-                        plan = json.load(f)
-
-                    qa_session = _apply_qa_update(plan, status, issues, tests_passed)
-                    write_json_atomic(plan_file, plan, indent=2)
-
-                    return {
-                        "content": [
-                            {
-                                "type": "text",
-                                "text": f"Updated QA status to '{status}' (session {qa_session}) (after auto-fix)",
-                            }
-                        ]
-                    }
-                except Exception as retry_err:
-                    logging.warning(
-                        f"QA update retry failed after auto-fix: {retry_err} (original error: {e})"
-                    )
-                    return {
-                        "content": [
-                            {
-                                "type": "text",
-                                "text": f"Error: QA update failed after auto-fix: {retry_err} (original JSON error: {e})",
-                            }
-                        ]
-                    }
-
-            return {
-                "content": [
-                    {
-                        "type": "text",
-                        "text": f"Error: Invalid JSON in implementation_plan.json: {e}",
-                    }
-                ]
-            }
-
-        except Exception as e:
-            return {
-                "content": [{"type": "text", "text": f"Error updating QA status: {e}"}]
-            }
-
-    tools.append(update_qa_status)
-
-    return tools

apps/backend/agents/utils.py

@@ -1,181 +0,0 @@
-"""
-Utility Functions for Agent System
-===================================
-
-Helper functions for git operations, plan management, and file syncing.
-"""
-
-import json
-import logging
-import shutil
-from pathlib import Path
-
-from core.git_executable import run_git
-
-logger = logging.getLogger(__name__)
-
-
-def get_latest_commit(project_dir: Path) -> str | None:
-    """Get the hash of the latest git commit."""
-    result = run_git(
-        ["rev-parse", "HEAD"],
-        cwd=project_dir,
-        timeout=10,
-    )
-    if result.returncode == 0:
-        return result.stdout.strip()
-    return None
-
-
-def get_commit_count(project_dir: Path) -> int:
-    """Get the total number of commits."""
-    result = run_git(
-        ["rev-list", "--count", "HEAD"],
-        cwd=project_dir,
-        timeout=10,
-    )
-    if result.returncode == 0:
-        try:
-            return int(result.stdout.strip())
-        except ValueError:
-            return 0
-    return 0
-
-
-def load_implementation_plan(spec_dir: Path) -> dict | None:
-    """Load the implementation plan JSON."""
-    plan_file = spec_dir / "implementation_plan.json"
-    if not plan_file.exists():
-        return None
-    try:
-        with open(plan_file, encoding="utf-8") as f:
-            return json.load(f)
-    except (OSError, json.JSONDecodeError, UnicodeDecodeError):
-        return None
-
-
-def find_subtask_in_plan(plan: dict, subtask_id: str) -> dict | None:
-    """Find a subtask by ID in the plan."""
-    for phase in plan.get("phases", []):
-        for subtask in phase.get("subtasks", []):
-            if subtask.get("id") == subtask_id:
-                return subtask
-    return None
-
-
-def find_phase_for_subtask(plan: dict, subtask_id: str) -> dict | None:
-    """Find the phase containing a subtask."""
-    for phase in plan.get("phases", []):
-        for subtask in phase.get("subtasks", []):
-            if subtask.get("id") == subtask_id:
-                return phase
-    return None
-
-
-def sync_spec_to_source(spec_dir: Path, source_spec_dir: Path | None) -> bool:
-    """
-    Sync ALL spec files from worktree back to source spec directory.
-
-    When running in isolated mode (worktrees), the agent creates and updates
-    many files inside the worktree's spec directory. This function syncs ALL
-    of them back to the main project's spec directory.
-
-    IMPORTANT: Since .auto-claude/ is gitignored, this sync happens to the
-    local filesystem regardless of what branch the user is on. The worktree
-    may be on a different branch (e.g., auto-claude/093-task), but the sync
-    target is always the main project's .auto-claude/specs/ directory.
-
-    Files synced (all files in spec directory):
-    - implementation_plan.json - Task status and subtask completion
-    - build-progress.txt - Session-by-session progress notes
-    - task_logs.json - Execution logs
-    - review_state.json - QA review state
-    - critique_report.json - Spec critique findings
-    - suggested_commit_message.txt - Commit suggestions
-    - REGRESSION_TEST_REPORT.md - Test regression report
-    - spec.md, context.json, etc. - Original spec files (for completeness)
-    - memory/ directory - Codebase map, patterns, gotchas, session insights
-
-    Args:
-        spec_dir: Current spec directory (inside worktree)
-        source_spec_dir: Original spec directory in main project (outside worktree)
-
-    Returns:
-        True if sync was performed, False if not needed or failed
-    """
-    # Skip if no source specified or same path (not in worktree mode)
-    if not source_spec_dir:
-        return False
-
-    # Resolve paths and check if they're different
-    spec_dir_resolved = spec_dir.resolve()
-    source_spec_dir_resolved = source_spec_dir.resolve()
-
-    if spec_dir_resolved == source_spec_dir_resolved:
-        return False  # Same directory, no sync needed
-
-    synced_any = False
-
-    # Ensure source directory exists
-    source_spec_dir.mkdir(parents=True, exist_ok=True)
-
-    try:
-        # Sync all files and directories from worktree spec to source spec
-        for item in spec_dir.iterdir():
-            # Skip symlinks to prevent path traversal attacks
-            if item.is_symlink():
-                logger.warning(f"Skipping symlink during sync: {item.name}")
-                continue
-
-            source_item = source_spec_dir / item.name
-
-            if item.is_file():
-                # Copy file (preserves timestamps)
-                shutil.copy2(item, source_item)
-                logger.debug(f"Synced {item.name} to source")
-                synced_any = True
-
-            elif item.is_dir():
-                # Recursively sync directory
-                _sync_directory(item, source_item)
-                synced_any = True
-
-    except Exception as e:
-        logger.warning(f"Failed to sync spec directory to source: {e}")
-
-    return synced_any
-
-
-def _sync_directory(source_dir: Path, target_dir: Path) -> None:
-    """
-    Recursively sync a directory from source to target.
-
-    Args:
-        source_dir: Source directory (in worktree)
-        target_dir: Target directory (in main project)
-    """
-    # Create target directory if needed
-    target_dir.mkdir(parents=True, exist_ok=True)
-
-    for item in source_dir.iterdir():
-        # Skip symlinks to prevent path traversal attacks
-        if item.is_symlink():
-            logger.warning(
-                f"Skipping symlink during sync: {source_dir.name}/{item.name}"
-            )
-            continue
-
-        target_item = target_dir / item.name
-
-        if item.is_file():
-            shutil.copy2(item, target_item)
-            logger.debug(f"Synced {source_dir.name}/{item.name} to source")
-        elif item.is_dir():
-            # Recurse into subdirectories
-            _sync_directory(item, target_item)
-
-
-# Keep the old name as an alias for backward compatibility
-def sync_plan_to_source(spec_dir: Path, source_spec_dir: Path | None) -> bool:
-    """Alias for sync_spec_to_source for backward compatibility."""
-    return sync_spec_to_source(spec_dir, source_spec_dir)

apps/backend/analyzer.py

@@ -1,26 +0,0 @@
-#!/usr/bin/env python3
-"""
-Analyzer facade module.
-
-Provides backward compatibility for scripts that import from analyzer.py at the root.
-Actual implementation is in analysis/analyzer.py.
-"""
-
-from analysis.analyzer import (
-    ProjectAnalyzer,
-    ServiceAnalyzer,
-    analyze_project,
-    analyze_service,
-    main,
-)
-
-__all__ = [
-    "ServiceAnalyzer",
-    "ProjectAnalyzer",
-    "analyze_project",
-    "analyze_service",
-    "main",
-]
-
-if __name__ == "__main__":
-    main()

apps/backend/auto_claude_tools.py

@@ -1,36 +0,0 @@
-"""
-Auto Claude tools module facade.
-
-Provides MCP tools for agent operations.
-Re-exports from agents.tools_pkg for clean imports.
-"""
-
-from agents.tools_pkg.models import (  # noqa: F401
-    ELECTRON_TOOLS,
-    TOOL_GET_BUILD_PROGRESS,
-    TOOL_GET_SESSION_CONTEXT,
-    TOOL_RECORD_DISCOVERY,
-    TOOL_RECORD_GOTCHA,
-    TOOL_UPDATE_QA_STATUS,
-    TOOL_UPDATE_SUBTASK_STATUS,
-    is_electron_mcp_enabled,
-)
-from agents.tools_pkg.permissions import get_allowed_tools  # noqa: F401
-from agents.tools_pkg.registry import (  # noqa: F401
-    create_auto_claude_mcp_server,
-    is_tools_available,
-)
-
-__all__ = [
-    "create_auto_claude_mcp_server",
-    "get_allowed_tools",
-    "is_tools_available",
-    "TOOL_UPDATE_SUBTASK_STATUS",
-    "TOOL_GET_BUILD_PROGRESS",
-    "TOOL_RECORD_DISCOVERY",
-    "TOOL_RECORD_GOTCHA",
-    "TOOL_GET_SESSION_CONTEXT",
-    "TOOL_UPDATE_QA_STATUS",
-    "ELECTRON_TOOLS",
-    "is_electron_mcp_enabled",
-]

apps/backend/cli/batch_commands.py

@@ -1,279 +0,0 @@
-"""
-Batch Task Management Commands
-==============================
-
-Commands for creating and managing multiple tasks from batch files.
-"""
-
-import json
-import shutil
-import subprocess
-from pathlib import Path
-
-from qa.criteria import is_fixes_applied, is_qa_approved, is_qa_rejected
-from ui import highlight, print_status
-
-
-def handle_batch_create_command(batch_file: str, project_dir: str) -> bool:
-    """
-    Create multiple tasks from a batch JSON file.
-
-    Args:
-        batch_file: Path to JSON file with task definitions
-        project_dir: Project directory
-
-    Returns:
-        True if successful
-    """
-    batch_path = Path(batch_file)
-
-    if not batch_path.exists():
-        print_status(f"Batch file not found: {batch_file}", "error")
-        return False
-
-    try:
-        with open(batch_path, encoding="utf-8") as f:
-            batch_data = json.load(f)
-    except json.JSONDecodeError as e:
-        print_status(f"Invalid JSON in batch file: {e}", "error")
-        return False
-
-    tasks = batch_data.get("tasks", [])
-    if not tasks:
-        print_status("No tasks found in batch file", "warning")
-        return False
-
-    print_status(f"Creating {len(tasks)} tasks from batch file", "info")
-    print()
-
-    specs_dir = Path(project_dir) / ".auto-claude" / "specs"
-    specs_dir.mkdir(parents=True, exist_ok=True)
-
-    # Find next spec ID
-    existing_specs = [d.name for d in specs_dir.iterdir() if d.is_dir()]
-    next_id = (
-        max([int(s.split("-")[0]) for s in existing_specs if s[0].isdigit()] or [0]) + 1
-    )
-
-    created_specs = []
-
-    for idx, task in enumerate(tasks, 1):
-        spec_id = f"{next_id:03d}"
-        task_title = task.get("title", f"Task {idx}")
-        task_slug = task_title.lower().replace(" ", "-")[:50]
-        spec_name = f"{spec_id}-{task_slug}"
-        spec_dir = specs_dir / spec_name
-        spec_dir.mkdir(exist_ok=True)
-
-        # Create requirements.json
-        requirements = {
-            "task_description": task.get("description", task_title),
-            "description": task.get("description", task_title),
-            "workflow_type": task.get("workflow_type", "feature"),
-            "services_involved": task.get("services", ["frontend"]),
-            "priority": task.get("priority", 5),
-            "complexity_inferred": task.get("complexity", "standard"),
-            "inferred_from": {},
-            "created_at": Path(spec_dir).stat().st_mtime,
-            "estimate": {
-                "estimated_hours": task.get("estimated_hours", 4.0),
-                "estimated_days": task.get("estimated_days", 0.5),
-            },
-        }
-
-        req_file = spec_dir / "requirements.json"
-        with open(req_file, "w", encoding="utf-8") as f:
-            json.dump(requirements, f, indent=2, default=str)
-
-        created_specs.append(
-            {
-                "id": spec_id,
-                "name": spec_name,
-                "title": task_title,
-                "status": "pending_spec_creation",
-            }
-        )
-
-        print_status(
-            f"[{idx}/{len(tasks)}] Created {spec_id} - {task_title}", "success"
-        )
-        next_id += 1
-
-    print()
-    print_status(f"Created {len(created_specs)} spec(s) successfully", "success")
-    print()
-
-    # Show summary
-    print(highlight("Next steps:"))
-    print("  1. Generate specs: spec_runner.py --continue <spec_id>")
-    print("  2. Approve specs and build them")
-    print("  3. Run: python run.py --spec <id> to execute")
-
-    return True
-
-
-def handle_batch_status_command(project_dir: str) -> bool:
-    """
-    Show status of all specs in project.
-
-    Args:
-        project_dir: Project directory
-
-    Returns:
-        True if successful
-    """
-    specs_dir = Path(project_dir) / ".auto-claude" / "specs"
-
-    if not specs_dir.exists():
-        print_status("No specs found in project", "warning")
-        return True
-
-    specs = sorted([d for d in specs_dir.iterdir() if d.is_dir()])
-
-    if not specs:
-        print_status("No specs found", "warning")
-        return True
-
-    print_status(f"Found {len(specs)} spec(s)", "info")
-    print()
-
-    for spec_dir in specs:
-        spec_name = spec_dir.name
-        req_file = spec_dir / "requirements.json"
-
-        status = "unknown"
-        title = spec_name
-
-        if req_file.exists():
-            try:
-                with open(req_file, encoding="utf-8") as f:
-                    req = json.load(f)
-                    title = req.get("task_description", title)
-            except json.JSONDecodeError:
-                pass
-
-        # Determine status (highest priority first)
-        # Use authoritative QA status check, not just file existence
-        if is_qa_approved(spec_dir):
-            status = "qa_approved"
-        elif is_qa_rejected(spec_dir):
-            status = "qa_rejected"
-        elif is_fixes_applied(spec_dir):
-            status = "fixes_applied"
-        elif (spec_dir / "implementation_plan.json").exists():
-            # Check if there's a qa_report.md but no approval yet (QA in progress)
-            if (spec_dir / "qa_report.md").exists():
-                status = "qa_in_progress"
-            else:
-                status = "building"
-        elif (spec_dir / "spec.md").exists():
-            status = "spec_created"
-        else:
-            status = "pending_spec"
-
-        status_icon = {
-            "pending_spec": "⏳",
-            "spec_created": "📋",
-            "building": "⚙️",
-            "qa_in_progress": "🔍",
-            "qa_approved": "✅",
-            "qa_rejected": "❌",
-            "fixes_applied": "🔧",
-            "unknown": "❓",
-        }.get(status, "❓")
-
-        print(f"{status_icon} {spec_name:<40} {title}")
-
-    return True
-
-
-def handle_batch_cleanup_command(project_dir: str, dry_run: bool = True) -> bool:
-    """
-    Clean up completed specs and worktrees.
-
-    Args:
-        project_dir: Project directory
-        dry_run: If True, show what would be deleted
-
-    Returns:
-        True if successful
-    """
-    specs_dir = Path(project_dir) / ".auto-claude" / "specs"
-    worktrees_dir = Path(project_dir) / ".auto-claude" / "worktrees" / "tasks"
-
-    if not specs_dir.exists():
-        print_status("No specs directory found", "info")
-        return True
-
-    # Find completed specs (only QA-approved, matching status display logic)
-    completed = []
-    for spec_dir in specs_dir.iterdir():
-        if spec_dir.is_dir() and is_qa_approved(spec_dir):
-            completed.append(spec_dir.name)
-
-    if not completed:
-        print_status("No completed specs to clean up", "info")
-        return True
-
-    print_status(f"Found {len(completed)} completed spec(s)", "info")
-
-    if dry_run:
-        print()
-        print("Would remove:")
-        for spec_name in completed:
-            print(f"  - {spec_name}")
-            wt_path = worktrees_dir / spec_name
-            if wt_path.exists():
-                print(f"    └─ .auto-claude/worktrees/tasks/{spec_name}/")
-        print()
-        print("Run with --no-dry-run to actually delete")
-    else:
-        # Actually delete specs and worktrees
-        deleted_count = 0
-        for spec_name in completed:
-            spec_path = specs_dir / spec_name
-            wt_path = worktrees_dir / spec_name
-
-            # Remove worktree first (if exists)
-            if wt_path.exists():
-                try:
-                    result = subprocess.run(
-                        ["git", "worktree", "remove", "--force", str(wt_path)],
-                        cwd=project_dir,
-                        capture_output=True,
-                        text=True,
-                        timeout=30,
-                    )
-                    if result.returncode == 0:
-                        print_status(f"Removed worktree: {spec_name}", "success")
-                    else:
-                        # Fallback: remove directory manually if git fails
-                        shutil.rmtree(wt_path, ignore_errors=True)
-                        print_status(
-                            f"Removed worktree directory: {spec_name}", "success"
-                        )
-                except subprocess.TimeoutExpired:
-                    # Timeout: fall back to manual removal
-                    shutil.rmtree(wt_path, ignore_errors=True)
-                    print_status(
-                        f"Worktree removal timed out, removed directory: {spec_name}",
-                        "warning",
-                    )
-                except Exception as e:
-                    print_status(
-                        f"Failed to remove worktree {spec_name}: {e}", "warning"
-                    )
-
-            # Remove spec directory
-            if spec_path.exists():
-                try:
-                    shutil.rmtree(spec_path)
-                    print_status(f"Removed spec: {spec_name}", "success")
-                    deleted_count += 1
-                except Exception as e:
-                    print_status(f"Failed to remove spec {spec_name}: {e}", "error")
-
-        print()
-        print_status(f"Cleaned up {deleted_count} spec(s)", "info")
-
-    return True

apps/backend/cli/recovery.py

@@ -1,217 +0,0 @@
-#!/usr/bin/env python3
-"""
-JSON Recovery Utility
-=====================
-
-Detects and repairs corrupted JSON files in specs directories.
-
-Usage:
-    python -m cli.recovery --project-dir /path/to/project --detect
-    python -m cli.recovery --project-dir /path/to/project --spec-id 004-feature --delete
-    python -m cli.recovery --project-dir /path/to/project --all --delete
-"""
-
-import argparse
-import json
-import sys
-import uuid
-from pathlib import Path
-
-from cli.utils import find_specs_dir
-
-
-def check_json_file(filepath: Path) -> tuple[bool, str | None]:
-    """
-    Check if a JSON file is valid.
-
-    Returns:
-        (is_valid, error_message)
-    """
-    try:
-        with open(filepath, encoding="utf-8") as f:
-            json.load(f)
-        return True, None
-    except json.JSONDecodeError as e:
-        return False, str(e)
-    except Exception as e:
-        return False, str(e)
-
-
-def detect_corrupted_files(specs_dir: Path) -> list[tuple[Path, str]]:
-    """
-    Scan specs directory recursively for corrupted JSON files.
-
-    Returns:
-        List of (filepath, error_message) tuples
-    """
-    corrupted = []
-
-    if not specs_dir.exists():
-        return corrupted
-
-    # Recursively scan for JSON files (includes nested files like memory/*.json)
-    for json_file in specs_dir.rglob("*.json"):
-        is_valid, error = check_json_file(json_file)
-        if not is_valid:
-            # Type narrowing: error is str when is_valid is False
-            assert error is not None
-            corrupted.append((json_file, error))
-
-    return corrupted
-
-
-def backup_corrupted_file(filepath: Path) -> bool:
-    """
-    Backup a corrupted file by renaming it with a .corrupted suffix.
-
-    Args:
-        filepath: Path to the corrupted file
-
-    Returns:
-        True if backed up successfully, False otherwise
-    """
-    try:
-        # Create backup before deleting
-        base_backup_path = filepath.with_suffix(f"{filepath.suffix}.corrupted")
-        backup_path = base_backup_path
-
-        # Handle existing backup files by generating unique name with UUID
-        if backup_path.exists():
-            # Use UUID for unique naming to avoid races
-            unique_suffix = uuid.uuid4().hex[:8]
-            backup_path = filepath.with_suffix(
-                f"{filepath.suffix}.corrupted.{unique_suffix}"
-            )
-
-        filepath.rename(backup_path)
-        print(f"  [BACKUP] Moved corrupted file to: {backup_path}")
-        return True
-    except Exception as e:
-        print(f"  [ERROR] Failed to backup file: {e}")
-        return False
-
-
-def main() -> None:
-    parser = argparse.ArgumentParser(
-        description="Detect and repair corrupted JSON files in specs directories"
-    )
-    parser.add_argument(
-        "--project-dir",
-        type=Path,
-        default=Path.cwd(),
-        help="Project directory (default: current directory)",
-    )
-    parser.add_argument(
-        "--specs-dir",
-        type=Path,
-        help="Specs directory path (overrides auto-detection)",
-    )
-    parser.add_argument(
-        "--detect",
-        action="store_true",
-        help="Detect corrupted JSON files",
-    )
-    parser.add_argument(
-        "--spec-id",
-        type=str,
-        help="Specific spec ID to fix (e.g., 004-feature)",
-    )
-    parser.add_argument(
-        "--delete",
-        action="store_true",
-        help="Delete corrupted files (creates .corrupted backup)",
-    )
-    parser.add_argument(
-        "--all",
-        action="store_true",
-        help="Fix all corrupted files (requires --delete)",
-    )
-
-    args = parser.parse_args()
-
-    # Validate --all requires --delete
-    if args.all and not args.delete:
-        parser.error("--all requires --delete")
-
-    # Find specs directory
-    if args.specs_dir:
-        specs_dir = args.specs_dir
-    else:
-        specs_dir = find_specs_dir(args.project_dir)
-
-    print(f"[INFO] Scanning specs directory: {specs_dir}")
-
-    # Default to detect mode if no flags provided
-    if not args.detect and not args.delete:
-        args.detect = True
-
-    # Detect corrupted files (dry-run when detect-only, otherwise for deletion)
-    corrupted = detect_corrupted_files(specs_dir)
-
-    # Detect-only mode: show results and exit
-    if args.detect and not args.delete:
-        if not corrupted:
-            print("[OK] No corrupted JSON files found")
-            sys.exit(0)
-
-        print(f"\n[FOUND] {len(corrupted)} corrupted file(s):\n")
-        for filepath, error in corrupted:
-            print(f"  - {filepath.relative_to(specs_dir.parent)}")
-            print(f"    Error: {error}")
-        print()
-        # Exit with error code when corrupted files are found
-        sys.exit(1)
-
-    # Delete corrupted files
-    if args.delete:
-        if args.spec_id:
-            # Delete specific spec
-            spec_dir = (specs_dir / args.spec_id).resolve()
-            specs_dir_resolved = specs_dir.resolve()
-            # Validate path doesn't escape specs directory
-            if not spec_dir.is_relative_to(specs_dir_resolved):
-                print("[ERROR] Invalid spec ID: path traversal detected")
-                sys.exit(1)
-
-            if not spec_dir.exists():
-                print(f"[ERROR] Spec directory not found: {spec_dir}")
-                sys.exit(1)
-
-            print(f"[INFO] Processing spec: {args.spec_id}")
-            has_failures = False
-            for json_file in spec_dir.rglob("*.json"):
-                is_valid, error = check_json_file(json_file)
-                if not is_valid:
-                    print(f"  [CORRUPTED] {json_file.name}")
-                    if not backup_corrupted_file(json_file):
-                        has_failures = True
-
-            if has_failures:
-                sys.exit(1)
-
-        elif args.all:
-            # Delete all corrupted files
-            # Use the already-detected corrupted list, or re-scan if needed
-            if not corrupted:
-                corrupted = detect_corrupted_files(specs_dir)
-            if not corrupted:
-                print("[OK] No corrupted files to delete")
-                sys.exit(0)
-
-            print(f"\n[INFO] Backing up {len(corrupted)} corrupted file(s):\n")
-            has_failures = False
-            for filepath, _ in corrupted:
-                # backup_corrupted_file prints its own [BACKUP] message
-                if not backup_corrupted_file(filepath):
-                    has_failures = True
-
-            if has_failures:
-                sys.exit(1)
-
-        else:
-            print("[ERROR] Must specify --spec-id or --all with --delete")
-            sys.exit(1)
-
-
-if __name__ == "__main__":
-    main()

apps/backend/client.py

@@ -1,25 +0,0 @@
-"""
-Claude client module facade.
-
-Provides Claude API client utilities.
-Uses lazy imports to avoid circular dependencies.
-"""
-
-
-def __getattr__(name):
-    """Lazy import to avoid circular imports with auto_claude_tools."""
-    from core import client as _client
-
-    return getattr(_client, name)
-
-
-def create_client(*args, **kwargs):
-    """Create a Claude client instance."""
-    from core.client import create_client as _create_client
-
-    return _create_client(*args, **kwargs)
-
-
-__all__ = [
-    "create_client",
-]

apps/backend/core/client.py

@@ -1,883 +0,0 @@
-"""
-Claude SDK Client Configuration
-===============================
-
-Functions for creating and configuring the Claude Agent SDK client.
-
-All AI interactions should use `create_client()` to ensure consistent OAuth authentication
-and proper tool/MCP configuration. For simple message calls without full agent sessions,
-use `create_simple_client()` from `core.simple_client`.
-
-The client factory now uses AGENT_CONFIGS from agents/tools_pkg/models.py as the
-single source of truth for phase-aware tool and MCP server configuration.
-"""
-
-import copy
-import json
-import logging
-import os
-import threading
-import time
-from pathlib import Path
-from typing import Any
-
-from core.fast_mode import ensure_fast_mode_in_user_settings
-from core.platform import (
-    is_windows,
-    validate_cli_path,
-)
-
-logger = logging.getLogger(__name__)
-
-# =============================================================================
-# Project Index Cache
-# =============================================================================
-# Caches project index and capabilities to avoid reloading on every create_client() call.
-# This significantly reduces the time to create new agent sessions.
-
-_PROJECT_INDEX_CACHE: dict[str, tuple[dict[str, Any], dict[str, bool], float]] = {}
-_CACHE_TTL_SECONDS = 300  # 5 minute TTL
-_CACHE_LOCK = threading.Lock()  # Protects _PROJECT_INDEX_CACHE access
-
-
-def _get_cached_project_data(
-    project_dir: Path,
-) -> tuple[dict[str, Any], dict[str, bool]]:
-    """
-    Get project index and capabilities with caching.
-
-    Args:
-        project_dir: Path to the project directory
-
-    Returns:
-        Tuple of (project_index, project_capabilities)
-    """
-
-    key = str(project_dir.resolve())
-    now = time.time()
-    debug = os.environ.get("DEBUG", "").lower() in ("true", "1")
-
-    # Check cache with lock
-    with _CACHE_LOCK:
-        if key in _PROJECT_INDEX_CACHE:
-            cached_index, cached_capabilities, cached_time = _PROJECT_INDEX_CACHE[key]
-            cache_age = now - cached_time
-            if cache_age < _CACHE_TTL_SECONDS:
-                if debug:
-                    print(
-                        f"[ClientCache] Cache HIT for project index (age: {cache_age:.1f}s / TTL: {_CACHE_TTL_SECONDS}s)"
-                    )
-                logger.debug(f"Using cached project index for {project_dir}")
-                # Return deep copies to prevent callers from corrupting the cache
-                return copy.deepcopy(cached_index), copy.deepcopy(cached_capabilities)
-            elif debug:
-                print(
-                    f"[ClientCache] Cache EXPIRED for project index (age: {cache_age:.1f}s > TTL: {_CACHE_TTL_SECONDS}s)"
-                )
-
-    # Cache miss or expired - load fresh data (outside lock to avoid blocking)
-    load_start = time.time()
-    logger.debug(f"Loading project index for {project_dir}")
-    project_index = load_project_index(project_dir)
-    project_capabilities = detect_project_capabilities(project_index)
-
-    if debug:
-        load_duration = (time.time() - load_start) * 1000
-        print(
-            f"[ClientCache] Cache MISS - loaded project index in {load_duration:.1f}ms"
-        )
-
-    # Store in cache with lock - use double-checked locking pattern
-    # Re-check if another thread populated the cache while we were loading
-    with _CACHE_LOCK:
-        if key in _PROJECT_INDEX_CACHE:
-            cached_index, cached_capabilities, cached_time = _PROJECT_INDEX_CACHE[key]
-            cache_age = time.time() - cached_time
-            if cache_age < _CACHE_TTL_SECONDS:
-                # Another thread already cached valid data while we were loading
-                if debug:
-                    print(
-                        "[ClientCache] Cache was populated by another thread, using cached data"
-                    )
-                # Return deep copies to prevent callers from corrupting the cache
-                return copy.deepcopy(cached_index), copy.deepcopy(cached_capabilities)
-        # Either no cache entry or it's expired - store our fresh data
-        _PROJECT_INDEX_CACHE[key] = (project_index, project_capabilities, time.time())
-
-    # Return the freshly loaded data (no need to copy since it's not from cache)
-    return project_index, project_capabilities
-
-
-def invalidate_project_cache(project_dir: Path | None = None) -> None:
-    """
-    Invalidate the project index cache.
-
-    Args:
-        project_dir: Specific project to invalidate, or None to clear all
-    """
-    with _CACHE_LOCK:
-        if project_dir is None:
-            _PROJECT_INDEX_CACHE.clear()
-            logger.debug("Cleared all project index cache entries")
-        else:
-            key = str(project_dir.resolve())
-            if key in _PROJECT_INDEX_CACHE:
-                del _PROJECT_INDEX_CACHE[key]
-                logger.debug(f"Invalidated project index cache for {project_dir}")
-
-
-from agents.tools_pkg import (
-    CONTEXT7_TOOLS,
-    ELECTRON_TOOLS,
-    GRAPHITI_MCP_TOOLS,
-    LINEAR_TOOLS,
-    PUPPETEER_TOOLS,
-    create_auto_claude_mcp_server,
-    get_allowed_tools,
-    get_required_mcp_servers,
-    is_tools_available,
-)
-from claude_agent_sdk import ClaudeAgentOptions, ClaudeSDKClient
-from claude_agent_sdk.types import HookMatcher
-from core.auth import (
-    configure_sdk_authentication,
-    get_sdk_env_vars,
-)
-from linear_updater import is_linear_enabled
-from prompts_pkg.project_context import detect_project_capabilities, load_project_index
-from security import bash_security_hook
-
-
-def _validate_custom_mcp_server(server: dict) -> bool:
-    """
-    Validate a custom MCP server configuration for security.
-
-    Ensures only expected fields with valid types are present.
-    Rejects configurations that could lead to command injection.
-
-    Args:
-        server: Dict representing a custom MCP server configuration
-
-    Returns:
-        True if valid, False otherwise
-    """
-    if not isinstance(server, dict):
-        return False
-
-    # Required fields
-    required_fields = {"id", "name", "type"}
-    if not all(field in server for field in required_fields):
-        logger.warning(
-            f"Custom MCP server missing required fields: {required_fields - server.keys()}"
-        )
-        return False
-
-    # Validate field types
-    if not isinstance(server.get("id"), str) or not server["id"]:
-        return False
-    if not isinstance(server.get("name"), str) or not server["name"]:
-        return False
-    # FIX: Changed from ('command', 'url') to ('command', 'http') to match actual usage
-    if server.get("type") not in ("command", "http"):
-        logger.warning(f"Invalid MCP server type: {server.get('type')}")
-        return False
-
-    # Allowlist of safe executable commands for MCP servers
-    # Only allow known package managers and interpreters - NO shell commands
-    SAFE_COMMANDS = {
-        "npx",
-        "npm",
-        "node",
-        "python",
-        "python3",
-        "uv",
-        "uvx",
-    }
-
-    # Blocklist of dangerous shell commands that should never be allowed
-    DANGEROUS_COMMANDS = {
-        "bash",
-        "sh",
-        "cmd",
-        "powershell",
-        "pwsh",  # PowerShell Core
-        "/bin/bash",
-        "/bin/sh",
-        "/bin/zsh",
-        "/usr/bin/bash",
-        "/usr/bin/sh",
-        "zsh",
-        "fish",
-    }
-
-    # Dangerous interpreter flags that allow arbitrary code execution
-    # Covers Python (-e, -c, -m, -p), Node.js (--eval, --print, loaders), and general
-    DANGEROUS_FLAGS = {
-        "--eval",
-        "-e",
-        "-c",
-        "--exec",
-        "-m",  # Python module execution
-        "-p",  # Python eval+print
-        "--print",  # Node.js print
-        "--input-type=module",  # Node.js ES module mode
-        "--experimental-loader",  # Node.js custom loaders
-        "--require",  # Node.js require injection
-        "-r",  # Node.js require shorthand
-    }
-
-    # Type-specific validation
-    if server["type"] == "command":
-        if not isinstance(server.get("command"), str) or not server["command"]:
-            logger.warning("Command-type MCP server missing 'command' field")
-            return False
-
-        # SECURITY FIX: Validate command is in safe list and not in dangerous list
-        command = server.get("command", "")
-
-        # Reject paths - commands must be bare names only (no / or \)
-        # This prevents path traversal like '/custom/malicious' or './evil'
-        if "/" in command or "\\" in command:
-            logger.warning(
-                f"Rejected command with path in MCP server: {command}. "
-                f"Commands must be bare names without path separators."
-            )
-            return False
-
-        if command in DANGEROUS_COMMANDS:
-            logger.warning(
-                f"Rejected dangerous command in MCP server: {command}. "
-                f"Shell commands are not allowed for security reasons."
-            )
-            return False
-
-        if command not in SAFE_COMMANDS:
-            logger.warning(
-                f"Rejected unknown command in MCP server: {command}. "
-                f"Only allowed commands: {', '.join(sorted(SAFE_COMMANDS))}"
-            )
-            return False
-
-        # Validate args is a list of strings if present
-        if "args" in server:
-            if not isinstance(server["args"], list):
-                return False
-            if not all(isinstance(arg, str) for arg in server["args"]):
-                return False
-            # Check for dangerous interpreter flags that allow code execution
-            for arg in server["args"]:
-                if arg in DANGEROUS_FLAGS:
-                    logger.warning(
-                        f"Rejected dangerous flag '{arg}' in MCP server args. "
-                        f"Interpreter code execution flags are not allowed."
-                    )
-                    return False
-    elif server["type"] == "http":
-        if not isinstance(server.get("url"), str) or not server["url"]:
-            logger.warning("HTTP-type MCP server missing 'url' field")
-            return False
-        # Validate headers is a dict of strings if present
-        if "headers" in server:
-            if not isinstance(server["headers"], dict):
-                return False
-            if not all(
-                isinstance(k, str) and isinstance(v, str)
-                for k, v in server["headers"].items()
-            ):
-                return False
-
-    # Optional description must be string if present
-    if "description" in server and not isinstance(server.get("description"), str):
-        return False
-
-    # Reject any unexpected fields that could be exploited
-    allowed_fields = {
-        "id",
-        "name",
-        "type",
-        "command",
-        "args",
-        "url",
-        "headers",
-        "description",
-    }
-    unexpected_fields = set(server.keys()) - allowed_fields
-    if unexpected_fields:
-        logger.warning(f"Custom MCP server has unexpected fields: {unexpected_fields}")
-        return False
-
-    return True
-
-
-def load_project_mcp_config(project_dir: Path) -> dict:
-    """
-    Load MCP configuration from project's .auto-claude/.env file.
-
-    Returns a dict of MCP-related env vars:
-    - CONTEXT7_ENABLED (default: true)
-    - LINEAR_MCP_ENABLED (default: true)
-    - ELECTRON_MCP_ENABLED (default: false)
-    - PUPPETEER_MCP_ENABLED (default: false)
-    - AGENT_MCP_<agent>_ADD (per-agent MCP additions)
-    - AGENT_MCP_<agent>_REMOVE (per-agent MCP removals)
-    - CUSTOM_MCP_SERVERS (JSON array of custom server configs)
-
-    Args:
-        project_dir: Path to the project directory
-
-    Returns:
-        Dict of MCP configuration values (string values, except CUSTOM_MCP_SERVERS which is parsed JSON)
-    """
-    env_path = project_dir / ".auto-claude" / ".env"
-    if not env_path.exists():
-        return {}
-
-    config = {}
-    mcp_keys = {
-        "CONTEXT7_ENABLED",
-        "LINEAR_MCP_ENABLED",
-        "ELECTRON_MCP_ENABLED",
-        "PUPPETEER_MCP_ENABLED",
-    }
-
-    try:
-        with open(env_path, encoding="utf-8") as f:
-            for line in f:
-                line = line.strip()
-                if not line or line.startswith("#"):
-                    continue
-                if "=" in line:
-                    key, value = line.split("=", 1)
-                    key = key.strip()
-                    value = value.strip().strip("\"'")
-                    # Include global MCP toggles
-                    if key in mcp_keys:
-                        config[key] = value
-                    # Include per-agent MCP overrides (AGENT_MCP_<agent>_ADD/REMOVE)
-                    elif key.startswith("AGENT_MCP_"):
-                        config[key] = value
-                    # Include custom MCP servers (parse JSON with schema validation)
-                    elif key == "CUSTOM_MCP_SERVERS":
-                        try:
-                            parsed = json.loads(value)
-                            if not isinstance(parsed, list):
-                                logger.warning(
-                                    "CUSTOM_MCP_SERVERS must be a JSON array"
-                                )
-                                config["CUSTOM_MCP_SERVERS"] = []
-                            else:
-                                # Validate each server and filter out invalid ones
-                                valid_servers = []
-                                for i, server in enumerate(parsed):
-                                    if _validate_custom_mcp_server(server):
-                                        valid_servers.append(server)
-                                    else:
-                                        logger.warning(
-                                            f"Skipping invalid custom MCP server at index {i}"
-                                        )
-                                config["CUSTOM_MCP_SERVERS"] = valid_servers
-                        except json.JSONDecodeError:
-                            logger.warning(
-                                f"Failed to parse CUSTOM_MCP_SERVERS JSON: {value}"
-                            )
-                            config["CUSTOM_MCP_SERVERS"] = []
-    except Exception as e:
-        logger.debug(f"Failed to load project MCP config from {env_path}: {e}")
-
-    return config
-
-
-def is_graphiti_mcp_enabled() -> bool:
-    """
-    Check if Graphiti MCP server integration is enabled.
-
-    Requires GRAPHITI_MCP_URL to be set (e.g., http://localhost:8000/mcp/)
-    This is separate from GRAPHITI_ENABLED which controls the Python library integration.
-    """
-    return bool(os.environ.get("GRAPHITI_MCP_URL"))
-
-
-def get_graphiti_mcp_url() -> str:
-    """Get the Graphiti MCP server URL."""
-    return os.environ.get("GRAPHITI_MCP_URL", "http://localhost:8000/mcp/")
-
-
-def is_electron_mcp_enabled() -> bool:
-    """
-    Check if Electron MCP server integration is enabled.
-
-    Requires ELECTRON_MCP_ENABLED to be set to 'true'.
-    When enabled, QA agents can use Puppeteer MCP tools to connect to Electron apps
-    via Chrome DevTools Protocol on the configured debug port.
-    """
-    return os.environ.get("ELECTRON_MCP_ENABLED", "").lower() == "true"
-
-
-def get_electron_debug_port() -> int:
-    """Get the Electron remote debugging port (default: 9222)."""
-    return int(os.environ.get("ELECTRON_DEBUG_PORT", "9222"))
-
-
-def should_use_claude_md() -> bool:
-    """Check if CLAUDE.md instructions should be included in system prompt."""
-    return os.environ.get("USE_CLAUDE_MD", "").lower() == "true"
-
-
-def load_claude_md(project_dir: Path) -> str | None:
-    """
-    Load CLAUDE.md content from project root if it exists.
-
-    Args:
-        project_dir: Root directory of the project
-
-    Returns:
-        Content of CLAUDE.md if found, None otherwise
-    """
-    claude_md_path = project_dir / "CLAUDE.md"
-    if claude_md_path.exists():
-        try:
-            return claude_md_path.read_text(encoding="utf-8")
-        except Exception:
-            return None
-    return None
-
-
-def create_client(
-    project_dir: Path,
-    spec_dir: Path,
-    model: str,
-    agent_type: str = "coder",
-    max_thinking_tokens: int | None = None,
-    output_format: dict | None = None,
-    agents: dict | None = None,
-    betas: list[str] | None = None,
-    effort_level: str | None = None,
-    fast_mode: bool = False,
-) -> ClaudeSDKClient:
-    """
-    Create a Claude Agent SDK client with multi-layered security.
-
-    Uses AGENT_CONFIGS for phase-aware tool and MCP server configuration.
-    Only starts MCP servers that the agent actually needs, reducing context
-    window bloat and startup latency.
-
-    Args:
-        project_dir: Root directory for the project (working directory)
-        spec_dir: Directory containing the spec (for settings file)
-        model: Claude model to use
-        agent_type: Agent type identifier from AGENT_CONFIGS
-                   (e.g., 'coder', 'planner', 'qa_reviewer', 'spec_gatherer')
-        max_thinking_tokens: Token budget for extended thinking (None = disabled)
-                            - high: 16384 (spec creation, QA review)
-                            - medium: 4096 (planning, validation)
-                            - low: 1024 (coding)
-        output_format: Optional structured output format for validated JSON responses.
-                      Use {"type": "json_schema", "schema": Model.model_json_schema()}
-                      See: https://platform.claude.com/docs/en/agent-sdk/structured-outputs
-        agents: Optional dict of subagent definitions for SDK parallel execution.
-               Format: {"agent-name": {"description": "...", "prompt": "...",
-                        "tools": [...], "model": "inherit"}}
-               See: https://platform.claude.com/docs/en/agent-sdk/subagents
-        betas: Optional list of SDK beta header strings (e.g., ["context-1m-2025-08-07"]
-               for 1M context window). Use get_phase_model_betas() to compute from config.
-        effort_level: Optional effort level for adaptive thinking models (e.g., "low",
-                     "medium", "high"). When set, injected as CLAUDE_CODE_EFFORT_LEVEL
-                     env var for the SDK subprocess. Only meaningful for models that
-                     support adaptive thinking (e.g., Opus 4.6).
-        fast_mode: Enable Fast Mode for faster Opus 4.6 output. When True, enables
-                  the "user" setting source so the CLI reads fastMode from
-                  ~/.claude/settings.json. Requires extra usage enabled on Claude
-                  subscription; falls back to standard speed automatically.
-
-    Returns:
-        Configured ClaudeSDKClient
-
-    Raises:
-        ValueError: If agent_type is not found in AGENT_CONFIGS
-
-    Security layers (defense in depth):
-    1. Sandbox - OS-level bash command isolation prevents filesystem escape
-    2. Permissions - File operations restricted to project_dir only
-    3. Security hooks - Bash commands validated against an allowlist
-       (see security.py for ALLOWED_COMMANDS)
-    4. Tool filtering - Each agent type only sees relevant tools (prevents misuse)
-    """
-    # Collect env vars to pass to SDK (ANTHROPIC_BASE_URL, CLAUDE_CONFIG_DIR, etc.)
-    sdk_env = get_sdk_env_vars()
-
-    # Get the config dir for profile-specific credential lookup
-    # CLAUDE_CONFIG_DIR enables per-profile Keychain entries with SHA256-hashed service names
-    config_dir = sdk_env.get("CLAUDE_CONFIG_DIR")
-
-    # Configure SDK authentication (OAuth or API profile mode)
-    configure_sdk_authentication(config_dir)
-
-    if config_dir:
-        logger.info(f"Using CLAUDE_CONFIG_DIR for profile: {config_dir}")
-
-    # Inject effort level for adaptive thinking models (e.g., Opus 4.6)
-    if effort_level:
-        sdk_env["CLAUDE_CODE_EFFORT_LEVEL"] = effort_level
-
-    # Fast mode requires the CLI to read "fastMode" from user settings.
-    # The SDK default (setting_sources=None) passes --setting-sources "" which
-    # blocks ALL filesystem settings. We must explicitly enable "user" source
-    # so the CLI reads ~/.claude/settings.json where fastMode: true lives.
-    # See: https://code.claude.com/docs/en/fast-mode
-    if fast_mode:
-        ensure_fast_mode_in_user_settings()
-        logger.info("[Fast Mode] ACTIVE — will enable user setting source for fastMode")
-        print(
-            "[Fast Mode] ACTIVE — enabling user settings source for CLI to read fastMode"
-        )
-    else:
-        logger.info("[Fast Mode] inactive — not requested for this client")
-
-    # Debug: Log git-bash path detection on Windows
-    if "CLAUDE_CODE_GIT_BASH_PATH" in sdk_env:
-        logger.info(f"Git Bash path found: {sdk_env['CLAUDE_CODE_GIT_BASH_PATH']}")
-    elif is_windows():
-        logger.warning("Git Bash path not detected on Windows!")
-
-    # Check if Linear integration is enabled
-    linear_enabled = is_linear_enabled()
-    linear_api_key = os.environ.get("LINEAR_API_KEY", "")
-
-    # Check if custom auto-claude tools are available
-    auto_claude_tools_enabled = is_tools_available()
-
-    # Load project capabilities for dynamic MCP tool selection
-    # This enables context-aware tool injection based on project type
-    # Uses caching to avoid reloading on every create_client() call
-    project_index, project_capabilities = _get_cached_project_data(project_dir)
-
-    # Load per-project MCP configuration from .auto-claude/.env
-    mcp_config = load_project_mcp_config(project_dir)
-
-    # Get allowed tools using phase-aware configuration
-    # This respects AGENT_CONFIGS and only includes tools the agent needs
-    # Also respects per-project MCP configuration
-    allowed_tools_list = get_allowed_tools(
-        agent_type,
-        project_capabilities,
-        linear_enabled,
-        mcp_config,
-    )
-
-    # Get required MCP servers for this agent type
-    # This is the key optimization - only start servers the agent needs
-    # Now also respects per-project MCP configuration
-    required_servers = get_required_mcp_servers(
-        agent_type,
-        project_capabilities,
-        linear_enabled,
-        mcp_config,
-    )
-
-    # Check if Graphiti MCP is enabled (already filtered by get_required_mcp_servers)
-    graphiti_mcp_enabled = "graphiti" in required_servers
-
-    # Determine browser tools for permissions (already in allowed_tools_list)
-    browser_tools_permissions = []
-    if "electron" in required_servers:
-        browser_tools_permissions = ELECTRON_TOOLS
-    elif "puppeteer" in required_servers:
-        browser_tools_permissions = PUPPETEER_TOOLS
-
-    # Create comprehensive security settings
-    # Note: Using both relative paths ("./**") and absolute paths to handle
-    # cases where Claude uses absolute paths for file operations
-    project_path_str = str(project_dir.resolve())
-    spec_path_str = str(spec_dir.resolve())
-
-    # Detect if we're running in a worktree and get the original project directory
-    # Worktrees are located in either:
-    # - .auto-claude/worktrees/tasks/{spec-name}/ (new location)
-    # - .worktrees/{spec-name}/ (legacy location)
-    # When running in a worktree, we need to allow access to both the worktree
-    # and the original project's .auto-claude/ directory for spec files
-    original_project_permissions = []
-    resolved_project_path = project_dir.resolve()
-
-    # Check for worktree paths and extract original project directory
-    # This handles spec worktrees, PR review worktrees, and legacy worktrees
-    # Note: Windows paths are normalized to forward slashes before comparison
-    worktree_markers = [
-        "/.auto-claude/worktrees/tasks/",  # Spec/task worktrees
-        "/.auto-claude/github/pr/worktrees/",  # PR review worktrees
-        "/.worktrees/",  # Legacy worktree location
-    ]
-    project_path_posix = str(resolved_project_path).replace("\\", "/")
-
-    for marker in worktree_markers:
-        if marker in project_path_posix:
-            # Extract the original project directory (parent of worktree location)
-            # Use rsplit to get the rightmost occurrence (handles nested projects)
-            original_project_str = project_path_posix.rsplit(marker, 1)[0]
-            original_project_dir = Path(original_project_str)
-
-            # Grant permissions for relevant directories in the original project
-            permission_ops = ["Read", "Write", "Edit", "Glob", "Grep"]
-            dirs_to_permit = [
-                original_project_dir / ".auto-claude",
-                original_project_dir / ".worktrees",  # Legacy support
-            ]
-
-            for dir_path in dirs_to_permit:
-                if dir_path.exists():
-                    path_str = str(dir_path.resolve())
-                    original_project_permissions.extend(
-                        [f"{op}({path_str}/**)" for op in permission_ops]
-                    )
-            break
-
-    security_settings = {
-        "sandbox": {"enabled": True, "autoAllowBashIfSandboxed": True},
-        "permissions": {
-            "defaultMode": "acceptEdits",  # Auto-approve edits within allowed directories
-            "allow": [
-                # Allow all file operations within the project directory
-                # Include both relative (./**) and absolute paths for compatibility
-                "Read(./**)",
-                "Write(./**)",
-                "Edit(./**)",
-                "Glob(./**)",
-                "Grep(./**)",
-                # Also allow absolute paths (Claude sometimes uses full paths)
-                f"Read({project_path_str}/**)",
-                f"Write({project_path_str}/**)",
-                f"Edit({project_path_str}/**)",
-                f"Glob({project_path_str}/**)",
-                f"Grep({project_path_str}/**)",
-                # Allow spec directory explicitly (needed when spec is in worktree)
-                f"Read({spec_path_str}/**)",
-                f"Write({spec_path_str}/**)",
-                f"Edit({spec_path_str}/**)",
-                # Allow original project's .auto-claude/ and .worktrees/ directories
-                # when running in a worktree (fixes issue #385 - permission errors)
-                *original_project_permissions,
-                # Bash permission granted here, but actual commands are validated
-                # by the bash_security_hook (see security.py for allowed commands)
-                "Bash(*)",
-                # Allow web tools for documentation and research
-                "WebFetch(*)",
-                "WebSearch(*)",
-                # Allow MCP tools based on required servers
-                # Format: tool_name(*) allows all arguments
-                *(
-                    [f"{tool}(*)" for tool in CONTEXT7_TOOLS]
-                    if "context7" in required_servers
-                    else []
-                ),
-                *(
-                    [f"{tool}(*)" for tool in LINEAR_TOOLS]
-                    if "linear" in required_servers
-                    else []
-                ),
-                *(
-                    [f"{tool}(*)" for tool in GRAPHITI_MCP_TOOLS]
-                    if graphiti_mcp_enabled
-                    else []
-                ),
-                *[f"{tool}(*)" for tool in browser_tools_permissions],
-            ],
-        },
-    }
-
-    # Write settings to a file in the project directory
-    settings_file = project_dir / ".claude_settings.json"
-    with open(settings_file, "w", encoding="utf-8") as f:
-        json.dump(security_settings, f, indent=2)
-
-    print(f"Security settings: {settings_file}")
-    print("   - Sandbox enabled (OS-level bash isolation)")
-    print(f"   - Filesystem restricted to: {project_dir.resolve()}")
-    if original_project_permissions:
-        print("   - Worktree permissions: granted for original project directories")
-    print("   - Bash commands restricted to allowlist")
-    if max_thinking_tokens:
-        thinking_info = f"{max_thinking_tokens:,} tokens"
-        if effort_level:
-            thinking_info += f" + effort={effort_level}"
-        if fast_mode:
-            thinking_info += " + fast mode"
-        print(f"   - Extended thinking: {thinking_info}")
-    else:
-        print("   - Extended thinking: disabled")
-
-    # Build list of MCP servers for display based on required_servers
-    mcp_servers_list = []
-    if "context7" in required_servers:
-        mcp_servers_list.append("context7 (documentation)")
-    if "electron" in required_servers:
-        mcp_servers_list.append(
-            f"electron (desktop automation, port {get_electron_debug_port()})"
-        )
-    if "puppeteer" in required_servers:
-        mcp_servers_list.append("puppeteer (browser automation)")
-    if "linear" in required_servers:
-        mcp_servers_list.append("linear (project management)")
-    if graphiti_mcp_enabled:
-        mcp_servers_list.append("graphiti-memory (knowledge graph)")
-    if "auto-claude" in required_servers and auto_claude_tools_enabled:
-        mcp_servers_list.append(f"auto-claude ({agent_type} tools)")
-    if mcp_servers_list:
-        print(f"   - MCP servers: {', '.join(mcp_servers_list)}")
-    else:
-        print("   - MCP servers: none (minimal configuration)")
-
-    # Show detected project capabilities for QA agents
-    if agent_type in ("qa_reviewer", "qa_fixer") and any(project_capabilities.values()):
-        caps = [
-            k.replace("is_", "").replace("has_", "")
-            for k, v in project_capabilities.items()
-            if v
-        ]
-        print(f"   - Project capabilities: {', '.join(caps)}")
-    print()
-
-    # Configure MCP servers - ONLY start servers that are required
-    # This is the key optimization to reduce context bloat and startup latency
-    mcp_servers = {}
-
-    if "context7" in required_servers:
-        mcp_servers["context7"] = {
-            "command": "npx",
-            "args": ["-y", "@upstash/context7-mcp"],
-        }
-
-    if "electron" in required_servers:
-        # Electron MCP for desktop apps
-        # Electron app must be started with --remote-debugging-port=<port>
-        mcp_servers["electron"] = {
-            "command": "npm",
-            "args": ["exec", "electron-mcp-server"],
-        }
-
-    if "puppeteer" in required_servers:
-        # Puppeteer for web frontends (not Electron)
-        mcp_servers["puppeteer"] = {
-            "command": "npx",
-            "args": ["puppeteer-mcp-server"],
-        }
-
-    if "linear" in required_servers:
-        mcp_servers["linear"] = {
-            "type": "http",
-            "url": "https://mcp.linear.app/mcp",
-            "headers": {"Authorization": f"Bearer {linear_api_key}"},
-        }
-
-    # Graphiti MCP server for knowledge graph memory
-    if graphiti_mcp_enabled:
-        mcp_servers["graphiti-memory"] = {
-            "type": "http",
-            "url": get_graphiti_mcp_url(),
-        }
-
-    # Add custom auto-claude MCP server if required and available
-    if "auto-claude" in required_servers and auto_claude_tools_enabled:
-        auto_claude_mcp_server = create_auto_claude_mcp_server(spec_dir, project_dir)
-        if auto_claude_mcp_server:
-            mcp_servers["auto-claude"] = auto_claude_mcp_server
-
-    # Add custom MCP servers from project config
-    custom_servers = mcp_config.get("CUSTOM_MCP_SERVERS", [])
-    for custom in custom_servers:
-        server_id = custom.get("id")
-        if not server_id:
-            continue
-        # Only include if agent has it in their effective server list
-        if server_id not in required_servers:
-            continue
-        server_type = custom.get("type", "command")
-        if server_type == "command":
-            mcp_servers[server_id] = {
-                "command": custom.get("command", "npx"),
-                "args": custom.get("args", []),
-            }
-        elif server_type == "http":
-            server_config = {
-                "type": "http",
-                "url": custom.get("url", ""),
-            }
-            if custom.get("headers"):
-                server_config["headers"] = custom["headers"]
-            mcp_servers[server_id] = server_config
-
-    # Build system prompt
-    base_prompt = (
-        f"You are an expert full-stack developer building production-quality software. "
-        f"Your working directory is: {project_dir.resolve()}\n"
-        f"Your filesystem access is RESTRICTED to this directory only. "
-        f"Use relative paths (starting with ./) for all file operations. "
-        f"Never use absolute paths or try to access files outside your working directory.\n\n"
-        f"You follow existing code patterns, write clean maintainable code, and verify "
-        f"your work through thorough testing. You communicate progress through Git commits "
-        f"and build-progress.txt updates."
-    )
-
-    # Include CLAUDE.md if enabled and present
-    if should_use_claude_md():
-        claude_md_content = load_claude_md(project_dir)
-        if claude_md_content:
-            base_prompt = f"{base_prompt}\n\n# Project Instructions (from CLAUDE.md)\n\n{claude_md_content}"
-            print("   - CLAUDE.md: included in system prompt")
-        else:
-            print("   - CLAUDE.md: not found in project root")
-    else:
-        print("   - CLAUDE.md: disabled by project settings")
-    print()
-
-    # Build options dict, conditionally including output_format
-    options_kwargs: dict[str, Any] = {
-        "model": model,
-        "system_prompt": base_prompt,
-        "allowed_tools": allowed_tools_list,
-        "mcp_servers": mcp_servers,
-        "hooks": {
-            "PreToolUse": [
-                HookMatcher(matcher="Bash", hooks=[bash_security_hook]),
-            ],
-        },
-        "max_turns": 1000,
-        "cwd": str(project_dir.resolve()),
-        "settings": str(settings_file.resolve()),
-        "env": sdk_env,  # Pass ANTHROPIC_BASE_URL etc. to subprocess
-        "max_thinking_tokens": max_thinking_tokens,  # Extended thinking budget
-        "max_buffer_size": 10
-        * 1024
-        * 1024,  # 10MB buffer (default: 1MB) - fixes large tool results
-        # Enable file checkpointing to track file read/write state across tool calls
-        # This prevents "File has not been read yet" errors in recovery sessions
-        "enable_file_checkpointing": True,
-    }
-
-    # Fast mode: enable user setting source so CLI reads fastMode from
-    # ~/.claude/settings.json. Without this, the SDK's default --setting-sources ""
-    # blocks all filesystem settings and the CLI never sees fastMode: true.
-    if fast_mode:
-        options_kwargs["setting_sources"] = ["user"]
-
-    # Optional: Allow CLI path override via environment variable
-    # The SDK bundles its own CLI, but users can override if needed
-    env_cli_path = os.environ.get("CLAUDE_CLI_PATH")
-    if env_cli_path and validate_cli_path(env_cli_path):
-        options_kwargs["cli_path"] = env_cli_path
-        logger.info(f"Using CLAUDE_CLI_PATH override: {env_cli_path}")
-
-    # Add structured output format if specified
-    # See: https://platform.claude.com/docs/en/agent-sdk/structured-outputs
-    if output_format:
-        options_kwargs["output_format"] = output_format
-
-    # Add subagent definitions if specified
-    # See: https://platform.claude.com/docs/en/agent-sdk/subagents
-    if agents:
-        options_kwargs["agents"] = agents
-
-    # Add beta headers if specified (e.g., for 1M context window)
-    if betas:
-        options_kwargs["betas"] = betas
-
-    return ClaudeSDKClient(options=ClaudeAgentOptions(**options_kwargs))

apps/backend/core/dependency_validator.py

@@ -1,134 +0,0 @@
-"""
-Dependency Validator
-====================
-
-Validates platform-specific dependencies are installed before running agents.
-"""
-
-import sys
-from pathlib import Path
-
-from core.platform import is_linux, is_windows
-
-
-def validate_platform_dependencies() -> None:
-    """
-    Validate that platform-specific dependencies are installed.
-
-    Raises:
-        SystemExit: If required platform-specific dependencies are missing,
-                   with helpful installation instructions.
-    """
-    # Check Windows-specific dependencies (all Python versions per ACS-306)
-    # pywin32 is required on all Python versions on Windows - MCP library unconditionally imports win32api
-    if is_windows():
-        try:
-            import pywintypes  # noqa: F401
-        except ImportError:
-            _exit_with_pywin32_error()
-
-    # Check Linux-specific dependencies (ACS-310)
-    # Note: secretstorage is optional for app functionality (falls back to .env),
-    # but we validate it to ensure proper OAuth token storage via keyring
-    if is_linux():
-        try:
-            import secretstorage  # noqa: F401
-        except ImportError:
-            _warn_missing_secretstorage()
-
-
-def _exit_with_pywin32_error() -> None:
-    """Exit with helpful error message for missing pywin32."""
-    # Use sys.prefix to detect the virtual environment path
-    # This works for venv and poetry environments
-    # Check for common Windows activation scripts (activate, activate.bat, Activate.ps1)
-    scripts_dir = Path(sys.prefix) / "Scripts"
-    activation_candidates = [
-        scripts_dir / "activate",
-        scripts_dir / "activate.bat",
-        scripts_dir / "Activate.ps1",
-    ]
-    venv_activate = next((p for p in activation_candidates if p.exists()), None)
-
-    # Build activation step only if activate script exists
-    activation_step = ""
-    if venv_activate:
-        activation_step = (
-            "To fix this:\n"
-            "1. Activate your virtual environment:\n"
-            f"   {venv_activate}\n"
-            "\n"
-            "2. Install pywin32:\n"
-            "   pip install pywin32>=306\n"
-            "\n"
-            "   Or reinstall all dependencies:\n"
-            "   pip install -r requirements.txt\n"
-        )
-    else:
-        # For system Python or environments without activate script
-        activation_step = (
-            "To fix this:\n"
-            "Install pywin32:\n"
-            "   pip install pywin32>=306\n"
-            "\n"
-            "   Or reinstall all dependencies:\n"
-            "   pip install -r requirements.txt\n"
-        )
-
-    sys.exit(
-        "Error: Required Windows dependency 'pywin32' is not installed.\n"
-        "\n"
-        "Auto Claude requires pywin32 on Windows for:\n"
-        "  - MCP library (win32api, win32con, win32job modules)\n"
-        "  - LadybugDB/Graphiti memory integration\n"
-        "\n"
-        f"{activation_step}"
-        "\n"
-        f"Current Python: {sys.executable}\n"
-    )
-
-
-def _warn_missing_secretstorage() -> None:
-    """Emit warning message for missing secretstorage.
-
-    Note: This is a warning, not a hard error - the app will fall back to .env
-    file storage for OAuth tokens. We warn users to ensure they understand the
-    security implications.
-    """
-    # Use sys.prefix to detect the virtual environment path
-    venv_activate = Path(sys.prefix) / "bin" / "activate"
-    # Only include activation instruction if venv script actually exists
-    activation_prefix = (
-        f"1. Activate your virtual environment:\n   source {venv_activate}\n\n"
-        if venv_activate.exists()
-        else ""
-    )
-    # Adjust step number based on whether activation step is included
-    install_step = (
-        "2. Install secretstorage:\n"
-        if activation_prefix
-        else "Install secretstorage:\n"
-    )
-
-    sys.stderr.write(
-        "Warning: Linux dependency 'secretstorage' is not installed.\n"
-        "\n"
-        "Auto Claude can use secretstorage for secure OAuth token storage via\n"
-        "the system keyring (gnome-keyring, kwallet, etc.). Without it, tokens\n"
-        "will be stored in plaintext in your .env file.\n"
-        "\n"
-        "To enable keyring integration:\n"
-        f"{activation_prefix}"
-        f"{install_step}"
-        "   pip install 'secretstorage>=3.3.3'\n"
-        "\n"
-        "   Or reinstall all dependencies:\n"
-        "   pip install -r requirements.txt\n"
-        "\n"
-        "Note: The app will continue to work, but OAuth tokens will be stored\n"
-        "in your .env file instead of the system keyring.\n"
-        "\n"
-        f"Current Python: {sys.executable}\n"
-    )
-    sys.stderr.flush()
-    # Continue execution - this is a warning, not a blocking error

apps/backend/core/error_utils.py

@@ -1,120 +0,0 @@
-"""
-Shared Error Utilities
-======================
-
-Common error detection and classification functions used across
-agent sessions, QA, and other modules.
-"""
-
-import re
-
-
-def is_tool_concurrency_error(error: Exception) -> bool:
-    """
-    Check if an error is a 400 tool concurrency error from Claude API.
-
-    Tool concurrency errors occur when too many tools are used simultaneously
-    in a single API request, hitting Claude's concurrent tool use limit.
-
-    Args:
-        error: The exception to check
-
-    Returns:
-        True if this is a tool concurrency error, False otherwise
-    """
-    error_str = str(error).lower()
-    # Check for 400 status AND tool concurrency keywords
-    return "400" in error_str and (
-        ("tool" in error_str and "concurrency" in error_str)
-        or "too many tools" in error_str
-        or "concurrent tool" in error_str
-    )
-
-
-def is_rate_limit_error(error: Exception) -> bool:
-    """
-    Check if an error is a rate limit error (429 or similar).
-
-    Rate limit errors occur when the API usage quota is exceeded,
-    either for session limits or weekly limits.
-
-    Args:
-        error: The exception to check
-
-    Returns:
-        True if this is a rate limit error, False otherwise
-    """
-    error_str = str(error).lower()
-
-    # Check for HTTP 429 with word boundaries to avoid false positives
-    if re.search(r"\b429\b", error_str):
-        return True
-
-    # Check for other rate limit indicators
-    return any(
-        p in error_str
-        for p in [
-            "limit reached",
-            "rate limit",
-            "too many requests",
-            "usage limit",
-            "quota exceeded",
-        ]
-    )
-
-
-def is_authentication_error(error: Exception) -> bool:
-    """
-    Check if an error is an authentication error (401, token expired, etc.).
-
-    Authentication errors occur when OAuth tokens are invalid, expired,
-    or have been revoked (e.g., after token refresh on another process).
-
-    Validation approach:
-    - HTTP 401 status code is checked with word boundaries to minimize false positives
-    - Additional string patterns are validated against lowercase error messages
-    - Patterns are designed to match known Claude API and OAuth error formats
-
-    Known false positive risks:
-    - Generic error messages containing "unauthorized" or "access denied" may match
-      even if not related to authentication (e.g., file permission errors)
-    - Error messages containing these keywords in user-provided content could match
-    - Mitigation: HTTP 401 check provides strong signal; string patterns are secondary
-
-    Real-world validation:
-    - Pattern matching has been tested against actual Claude API error responses
-    - False positive rate is acceptable given the recovery mechanism (prompt user to re-auth)
-    - If false positive occurs, user can simply resume without re-authenticating
-
-    Args:
-        error: The exception to check
-
-    Returns:
-        True if this is an authentication error, False otherwise
-    """
-    error_str = str(error).lower()
-
-    # Check for HTTP 401 with word boundaries to avoid false positives
-    if re.search(r"\b401\b", error_str):
-        return True
-
-    # Check for other authentication indicators
-    # NOTE: "authentication failed" and "authentication error" are more specific patterns
-    # to reduce false positives from generic "authentication" mentions
-    return any(
-        p in error_str
-        for p in [
-            "authentication failed",
-            "authentication error",
-            "unauthorized",
-            "invalid token",
-            "token expired",
-            "authentication_error",
-            "invalid_token",
-            "token_expired",
-            "not authenticated",
-            "http 401",
-            "does not have access to claude",
-            "please login again",
-        ]
-    )

apps/backend/core/fast_mode.py

@@ -1,76 +0,0 @@
-"""
-Fast Mode Settings Helper
-=========================
-
-Manages the fastMode flag in ~/.claude/settings.json for temporary
-per-task fast mode overrides. Shared by both client.py and simple_client.py.
-"""
-
-import json
-import logging
-from pathlib import Path
-
-from core.file_utils import write_json_atomic
-
-logger = logging.getLogger(__name__)
-
-_fast_mode_atexit_registered = False
-
-
-def _write_fast_mode_setting(enabled: bool) -> None:
-    """Write fastMode value to ~/.claude/settings.json (atomic read-modify-write).
-
-    Uses write_json_atomic from core.file_utils to prevent corruption when
-    multiple concurrent task processes modify the file simultaneously.
-    """
-    settings_file = Path.home() / ".claude" / "settings.json"
-    try:
-        settings: dict = {}
-        if settings_file.exists():
-            settings = json.loads(settings_file.read_text(encoding="utf-8"))
-
-        if settings.get("fastMode") != enabled:
-            settings["fastMode"] = enabled
-            settings_file.parent.mkdir(parents=True, exist_ok=True)
-            # Atomic write using shared utility
-            write_json_atomic(settings_file, settings)
-            state = "true" if enabled else "false"
-            logger.info(
-                f"[Fast Mode] Wrote fastMode={state} to ~/.claude/settings.json"
-            )
-    except Exception as e:
-        logger.warning(f"[Fast Mode] Could not update ~/.claude/settings.json: {e}")
-
-
-def _disable_fast_mode_on_exit() -> None:
-    """atexit handler: restore fastMode=false so interactive CLI sessions stay standard."""
-    _write_fast_mode_setting(False)
-
-
-def ensure_fast_mode_in_user_settings() -> None:
-    """
-    Enable fastMode in ~/.claude/settings.json and register cleanup.
-
-    The CLI reads fastMode from user settings (loaded via --setting-sources user).
-    This function:
-    1. Writes fastMode=true before spawning the CLI subprocess
-    2. Registers an atexit handler to restore fastMode=false when the process exits
-
-    This ensures fast mode is a temporary override per task process, not a permanent
-    setting change. The CLI subprocess reads settings at startup, so restoring false
-    after exit doesn't affect running tasks — only prevents fast mode from leaking
-    into subsequent interactive CLI sessions or non-fast-mode tasks.
-    """
-    global _fast_mode_atexit_registered
-
-    _write_fast_mode_setting(True)
-
-    # Register cleanup once per process — idempotent on repeated calls
-    if not _fast_mode_atexit_registered:
-        import atexit
-
-        atexit.register(_disable_fast_mode_on_exit)
-        _fast_mode_atexit_registered = True
-        logger.info(
-            "[Fast Mode] Registered atexit cleanup (will restore fastMode=false)"
-        )

apps/backend/core/file_utils.py

@@ -1,121 +0,0 @@
-#!/usr/bin/env python3
-"""
-Atomic File Write Utilities
-============================
-
-Synchronous utilities for atomic file writes to prevent corruption.
-
-Uses temp file + os.replace() pattern which is atomic on POSIX systems
-and atomic on Windows when source and destination are on the same volume.
-
-Usage:
-    from core.file_utils import write_json_atomic
-
-    write_json_atomic("/path/to/file.json", {"key": "value"})
-"""
-
-import json
-import logging
-import os
-import tempfile
-from collections.abc import Iterator
-from contextlib import contextmanager
-from pathlib import Path
-from typing import IO, Any, Literal
-
-
-@contextmanager
-def atomic_write(
-    filepath: str | Path,
-    mode: Literal["w", "wb", "wt"] = "w",
-    encoding: str | None = "utf-8",
-) -> Iterator[IO]:
-    """
-    Atomic file write using temp file and rename.
-
-    Writes to .tmp file first, then atomically replaces target file
-    using os.replace() which is atomic on POSIX systems and same-volume Windows.
-
-    Note: This function supports both text and binary modes. For binary modes
-    (mode containing 'b'), encoding must be None.
-
-    Args:
-        filepath: Target file path
-        mode: File open mode (default: "w", text mode only)
-        encoding: File encoding for text modes, None for binary (default: "utf-8")
-
-    Example:
-        with atomic_write("/path/to/file.json") as f:
-            json.dump(data, f)
-
-    Yields:
-        File handle to temp file
-    """
-    filepath = Path(filepath)
-    filepath.parent.mkdir(parents=True, exist_ok=True)
-
-    # Binary modes require encoding=None
-    actual_encoding = None if "b" in mode else encoding
-
-    # Create temp file in same directory for atomic rename
-    fd, tmp_path = tempfile.mkstemp(
-        dir=filepath.parent, prefix=f".{filepath.name}.tmp.", suffix=""
-    )
-
-    # Open temp file with requested mode
-    # If fdopen fails, close fd and clean up temp file
-    try:
-        f = os.fdopen(fd, mode, encoding=actual_encoding)
-    except Exception:
-        os.close(fd)
-        os.unlink(tmp_path)
-        raise
-
-    try:
-        with f:
-            yield f
-    except Exception:
-        # Clean up temp file on error (replace didn't happen yet)
-        try:
-            os.unlink(tmp_path)
-        except Exception as cleanup_err:
-            # Best-effort cleanup, ignore errors to not mask original exception
-            # Log cleanup failure for debugging (orphaned temp files may accumulate)
-            logging.warning(
-                f"Failed to cleanup temp file {tmp_path}: {cleanup_err}",
-                exc_info=True,
-            )
-        raise
-    else:
-        # Atomic replace - only runs if no exception was raised
-        # If os.replace itself fails, do NOT clean up (may be partially renamed)
-        os.replace(tmp_path, filepath)
-
-
-def write_json_atomic(
-    filepath: str | Path,
-    data: Any,
-    indent: int = 2,
-    ensure_ascii: bool = False,
-    encoding: str = "utf-8",
-) -> None:
-    """
-    Write JSON data to file atomically.
-
-    This function prevents file corruption by:
-    1. Writing to a temporary file first
-    2. Only replacing the target file if the write succeeds
-    3. Using os.replace() for atomicity
-
-    Args:
-        filepath: Target file path
-        data: Data to serialize as JSON
-        indent: JSON indentation (default: 2)
-        ensure_ascii: Whether to escape non-ASCII characters (default: False)
-        encoding: File encoding (default: "utf-8")
-
-    Example:
-        write_json_atomic("/path/to/file.json", {"key": "value"})
-    """
-    with atomic_write(filepath, "w", encoding=encoding) as f:
-        json.dump(data, f, indent=indent, ensure_ascii=ensure_ascii)

apps/backend/core/gh_executable.py

@@ -1,192 +0,0 @@
-#!/usr/bin/env python3
-"""
-GitHub CLI Executable Finder
-============================
-
-Utility to find the gh (GitHub CLI) executable, with platform-specific fallbacks.
-"""
-
-import os
-import shutil
-import subprocess
-
-from core.platform import get_where_exe_path
-
-_cached_gh_path: str | None = None
-
-
-def invalidate_gh_cache() -> None:
-    """Invalidate the cached gh executable path.
-
-    Useful when gh may have been uninstalled, updated, or when
-    GITHUB_CLI_PATH environment variable has changed.
-    """
-    global _cached_gh_path
-    _cached_gh_path = None
-
-
-def _verify_gh_executable(path: str) -> bool:
-    """Verify that a path is a valid gh executable by checking version.
-
-    Args:
-        path: Path to the potential gh executable
-
-    Returns:
-        True if the path points to a valid gh executable, False otherwise
-    """
-    try:
-        result = subprocess.run(
-            [path, "--version"],
-            capture_output=True,
-            text=True,
-            encoding="utf-8",
-            timeout=5,
-        )
-        return result.returncode == 0
-    except (subprocess.TimeoutExpired, OSError):
-        return False
-
-
-def _run_where_command() -> str | None:
-    """Run Windows 'where gh' command to find gh executable.
-
-    Returns:
-        First path found, or None if command failed
-    """
-    try:
-        result = subprocess.run(
-            [get_where_exe_path(), "gh"],
-            capture_output=True,
-            text=True,
-            encoding="utf-8",
-            timeout=5,
-        )
-        if result.returncode == 0 and result.stdout.strip():
-            found_path = result.stdout.strip().split("\n")[0].strip()
-            if (
-                found_path
-                and os.path.isfile(found_path)
-                and _verify_gh_executable(found_path)
-            ):
-                return found_path
-    except (subprocess.TimeoutExpired, OSError):
-        # 'where' command failed or timed out - fall through to return None
-        pass
-    return None
-
-
-def get_gh_executable() -> str | None:
-    """Find the gh executable, with platform-specific fallbacks.
-
-    Returns the path to gh executable, or None if not found.
-
-    Priority order:
-    1. GITHUB_CLI_PATH env var (user-configured path from frontend)
-    2. shutil.which (if gh is in PATH)
-    3. Homebrew paths on macOS
-    4. Windows Program Files paths
-    5. Windows 'where' command
-
-    Caches the result after first successful find. Use invalidate_gh_cache()
-    to force re-detection (e.g., after gh installation/uninstallation).
-    """
-    global _cached_gh_path
-
-    # Return cached result if available AND still exists
-    if _cached_gh_path is not None and os.path.isfile(_cached_gh_path):
-        return _cached_gh_path
-
-    _cached_gh_path = _find_gh_executable()
-    return _cached_gh_path
-
-
-def _find_gh_executable() -> str | None:
-    """Internal function to find gh executable."""
-    # 1. Check GITHUB_CLI_PATH env var (set by Electron frontend)
-    env_path = os.environ.get("GITHUB_CLI_PATH")
-    if env_path and os.path.isfile(env_path) and _verify_gh_executable(env_path):
-        return env_path
-
-    # 2. Try shutil.which (works if gh is in PATH)
-    gh_path = shutil.which("gh")
-    if gh_path and _verify_gh_executable(gh_path):
-        return gh_path
-
-    # 3. macOS-specific: check Homebrew paths
-    if os.name != "nt":  # Unix-like systems (macOS, Linux)
-        homebrew_paths = [
-            "/opt/homebrew/bin/gh",  # Apple Silicon
-            "/usr/local/bin/gh",  # Intel Mac
-            "/home/linuxbrew/.linuxbrew/bin/gh",  # Linux Homebrew
-        ]
-        for path in homebrew_paths:
-            if os.path.isfile(path) and _verify_gh_executable(path):
-                return path
-
-    # 4. Windows-specific: check Program Files paths
-    if os.name == "nt":
-        windows_paths = [
-            os.path.expandvars(r"%PROGRAMFILES%\GitHub CLI\gh.exe"),
-            os.path.expandvars(r"%PROGRAMFILES(X86)%\GitHub CLI\gh.exe"),
-            os.path.expandvars(r"%LOCALAPPDATA%\Programs\GitHub CLI\gh.exe"),
-        ]
-        for path in windows_paths:
-            if os.path.isfile(path) and _verify_gh_executable(path):
-                return path
-
-        # 5. Try 'where' command with full path (works even when System32 isn't in PATH)
-        return _run_where_command()
-
-    return None
-
-
-def run_gh(
-    args: list[str],
-    cwd: str | None = None,
-    timeout: int = 60,
-    input_data: str | None = None,
-) -> subprocess.CompletedProcess:
-    """Run a gh command with proper executable finding.
-
-    Args:
-        args: gh command arguments (without 'gh' prefix)
-        cwd: Working directory for the command
-        timeout: Command timeout in seconds (default: 60)
-        input_data: Optional string data to pass to stdin
-
-    Returns:
-        CompletedProcess with command results.
-    """
-    gh = get_gh_executable()
-    if not gh:
-        return subprocess.CompletedProcess(
-            args=["gh"] + args,
-            returncode=-1,
-            stdout="",
-            stderr="GitHub CLI (gh) not found. Install from https://cli.github.com/",
-        )
-    try:
-        return subprocess.run(
-            [gh] + args,
-            cwd=cwd,
-            input=input_data,
-            capture_output=True,
-            text=True,
-            encoding="utf-8",
-            errors="replace",
-            timeout=timeout,
-        )
-    except subprocess.TimeoutExpired:
-        return subprocess.CompletedProcess(
-            args=[gh] + args,
-            returncode=-1,
-            stdout="",
-            stderr=f"Command timed out after {timeout} seconds",
-        )
-    except FileNotFoundError:
-        return subprocess.CompletedProcess(
-            args=[gh] + args,
-            returncode=-1,
-            stdout="",
-            stderr="GitHub CLI (gh) executable not found. Install from https://cli.github.com/",
-        )

apps/backend/core/git_executable.py

@@ -1,199 +0,0 @@
-#!/usr/bin/env python3
-"""
-Git Executable Finder and Isolation
-====================================
-
-Utility to find the git executable, with Windows-specific fallbacks.
-Also provides environment isolation to prevent pre-commit hooks and
-other git configurations from affecting worktree operations.
-
-Separated into its own module to avoid circular imports.
-"""
-
-import os
-import shutil
-import subprocess
-from pathlib import Path
-
-from core.platform import get_where_exe_path
-
-# Git environment variables that can interfere with worktree operations
-# when set by pre-commit hooks or other git configurations.
-# These must be cleared to prevent cross-worktree contamination.
-GIT_ENV_VARS_TO_CLEAR = [
-    "GIT_DIR",
-    "GIT_WORK_TREE",
-    "GIT_INDEX_FILE",
-    "GIT_OBJECT_DIRECTORY",
-    "GIT_ALTERNATE_OBJECT_DIRECTORIES",
-    # Identity variables that could be set by hooks
-    "GIT_AUTHOR_NAME",
-    "GIT_AUTHOR_EMAIL",
-    "GIT_AUTHOR_DATE",
-    "GIT_COMMITTER_NAME",
-    "GIT_COMMITTER_EMAIL",
-    "GIT_COMMITTER_DATE",
-]
-
-_cached_git_path: str | None = None
-
-
-def get_isolated_git_env(base_env: dict | None = None) -> dict:
-    """
-    Create an isolated environment for git operations.
-
-    Clears git environment variables that may be set by pre-commit hooks
-    or other git configurations, preventing cross-worktree contamination
-    and ensuring git operations target the intended repository.
-
-    Args:
-        base_env: Base environment dict to copy from. If None, uses os.environ.
-
-    Returns:
-        Environment dict safe for git subprocess operations.
-    """
-    env = dict(base_env) if base_env is not None else os.environ.copy()
-
-    for key in GIT_ENV_VARS_TO_CLEAR:
-        env.pop(key, None)
-
-    # Disable user's pre-commit hooks during Auto-Claude managed git operations
-    # to prevent double-hook execution and potential conflicts
-    env["HUSKY"] = "0"
-
-    return env
-
-
-def get_git_executable() -> str:
-    """Find the git executable, with Windows-specific fallbacks.
-
-    Returns the path to git executable. On Windows, checks multiple sources:
-    1. CLAUDE_CODE_GIT_BASH_PATH env var (set by Electron frontend)
-    2. shutil.which (if git is in PATH)
-    3. Common installation locations
-    4. Windows 'where' command
-
-    Caches the result after first successful find.
-    """
-    global _cached_git_path
-
-    # Return cached result if available
-    if _cached_git_path is not None:
-        return _cached_git_path
-
-    git_path = _find_git_executable()
-    _cached_git_path = git_path
-    return git_path
-
-
-def _find_git_executable() -> str:
-    """Internal function to find git executable."""
-    # 1. Check CLAUDE_CODE_GIT_BASH_PATH (set by Electron frontend)
-    # This env var points to bash.exe, we can derive git.exe from it
-    bash_path = os.environ.get("CLAUDE_CODE_GIT_BASH_PATH")
-    if bash_path:
-        try:
-            bash_path_obj = Path(bash_path)
-            if bash_path_obj.exists():
-                git_dir = bash_path_obj.parent.parent
-                # Try cmd/git.exe first (preferred), then bin/git.exe
-                for git_subpath in ["cmd/git.exe", "bin/git.exe"]:
-                    git_path = git_dir / git_subpath
-                    if git_path.is_file():
-                        return str(git_path)
-        except (OSError, ValueError):
-            pass  # Invalid path or permission error - try next method
-
-    # 2. Try shutil.which (works if git is in PATH)
-    git_path = shutil.which("git")
-    if git_path:
-        return git_path
-
-    # 3. Windows-specific: check common installation locations
-    if os.name == "nt":
-        common_paths = [
-            os.path.expandvars(r"%PROGRAMFILES%\Git\cmd\git.exe"),
-            os.path.expandvars(r"%PROGRAMFILES%\Git\bin\git.exe"),
-            os.path.expandvars(r"%PROGRAMFILES(X86)%\Git\cmd\git.exe"),
-            os.path.expandvars(r"%LOCALAPPDATA%\Programs\Git\cmd\git.exe"),
-            r"C:\Program Files\Git\cmd\git.exe",
-            r"C:\Program Files (x86)\Git\cmd\git.exe",
-        ]
-        for path in common_paths:
-            try:
-                if os.path.isfile(path):
-                    return path
-            except OSError:
-                continue
-
-        # 4. Try 'where' command with full path (works even when System32 isn't in PATH)
-        try:
-            result = subprocess.run(
-                [get_where_exe_path(), "git"],
-                capture_output=True,
-                text=True,
-                timeout=5,
-            )
-            if result.returncode == 0 and result.stdout.strip():
-                found_path = result.stdout.strip().split("\n")[0].strip()
-                if found_path and os.path.isfile(found_path):
-                    return found_path
-        except (subprocess.TimeoutExpired, OSError):
-            pass  # 'where' command failed - fall through to default
-
-    # Default fallback - let subprocess handle it (may fail)
-    return "git"
-
-
-def run_git(
-    args: list[str],
-    cwd: Path | str | None = None,
-    timeout: int = 60,
-    input_data: str | None = None,
-    env: dict | None = None,
-    isolate_env: bool = True,
-) -> subprocess.CompletedProcess:
-    """Run a git command with proper executable finding and environment isolation.
-
-    Args:
-        args: Git command arguments (without 'git' prefix)
-        cwd: Working directory for the command
-        timeout: Command timeout in seconds (default: 60)
-        input_data: Optional string data to pass to stdin
-        env: Custom environment dict. If None and isolate_env=True, uses isolated env.
-        isolate_env: If True (default), clears git env vars to prevent hook interference.
-
-    Returns:
-        CompletedProcess with command results.
-    """
-    git = get_git_executable()
-
-    if env is None and isolate_env:
-        env = get_isolated_git_env()
-
-    try:
-        return subprocess.run(
-            [git] + args,
-            cwd=cwd,
-            input=input_data,
-            capture_output=True,
-            text=True,
-            encoding="utf-8",
-            errors="replace",
-            timeout=timeout,
-            env=env,
-        )
-    except subprocess.TimeoutExpired:
-        return subprocess.CompletedProcess(
-            args=[git] + args,
-            returncode=-1,
-            stdout="",
-            stderr=f"Command timed out after {timeout} seconds",
-        )
-    except FileNotFoundError:
-        return subprocess.CompletedProcess(
-            args=[git] + args,
-            returncode=-1,
-            stdout="",
-            stderr="Git executable not found. Please ensure git is installed and in PATH.",
-        )

apps/backend/core/git_provider.py

@@ -1,115 +0,0 @@
-#!/usr/bin/env python3
-"""
-Git Provider Detection
-======================
-
-Utility to detect git hosting provider (GitHub, GitLab, or unknown) from git remote URLs.
-Supports both SSH and HTTPS remote formats, and self-hosted GitLab instances.
-"""
-
-import re
-from pathlib import Path
-
-from .git_executable import run_git
-
-
-def detect_git_provider(project_dir: str | Path, remote_name: str | None = None) -> str:
-    """Detect the git hosting provider from the git remote URL.
-
-    Args:
-        project_dir: Path to the git repository
-        remote_name: Name of the remote to check (defaults to "origin")
-
-    Returns:
-        'github' if GitHub remote detected
-        'gitlab' if GitLab remote detected (cloud or self-hosted)
-        'unknown' if no remote or unsupported provider
-
-    Examples:
-        >>> detect_git_provider('/path/to/repo')
-        'github'  # for git@github.com:user/repo.git
-        'gitlab'  # for git@gitlab.com:user/repo.git
-        'gitlab'  # for https://gitlab.company.com/user/repo.git
-        'unknown' # for no remote or other providers
-    """
-    try:
-        # Get the remote URL (use specified remote or default to origin)
-        remote = remote_name if remote_name else "origin"
-        result = run_git(
-            ["remote", "get-url", remote],
-            cwd=project_dir,
-            timeout=5,
-        )
-
-        # If command failed or no output, return unknown
-        if result.returncode != 0 or not result.stdout.strip():
-            return "unknown"
-
-        remote_url = result.stdout.strip()
-
-        # Parse ssh:// URL format: ssh://[user@]host[:port]/path
-        ssh_url_match = re.match(r"^ssh://(?:[^@]+@)?([^:/]+)(?::\d+)?/", remote_url)
-        if ssh_url_match:
-            hostname = ssh_url_match.group(1)
-            return _classify_hostname(hostname)
-
-        # Parse HTTPS/HTTP format: https://host/path or http://host/path
-        # Must check before scp-like format to avoid matching "https" as hostname
-        https_match = re.match(r"^https?://([^/]+)/", remote_url)
-        if https_match:
-            hostname = https_match.group(1)
-            return _classify_hostname(hostname)
-
-        # Parse scp-like format: [user@]host:path (any username, not just 'git')
-        # This handles git@github.com:user/repo.git and similar formats
-        scp_match = re.match(r"^(?:[^@]+@)?([^:]+):", remote_url)
-        if scp_match:
-            hostname = scp_match.group(1)
-            # Exclude paths that look like Windows drives (e.g., C:)
-            if len(hostname) > 1:
-                return _classify_hostname(hostname)
-
-        # Unrecognized URL format
-        return "unknown"
-
-    except Exception:
-        # Any error (subprocess issues, etc.) -> unknown
-        return "unknown"
-
-
-def _classify_hostname(hostname: str) -> str:
-    """Classify a hostname as github, gitlab, or unknown.
-
-    Args:
-        hostname: The git remote hostname (e.g., 'github.com', 'gitlab.example.com')
-
-    Returns:
-        'github', 'gitlab', or 'unknown'
-    """
-    hostname_lower = hostname.lower()
-
-    # Check for GitHub (cloud and self-hosted/enterprise)
-    # Match github.com, *.github.com, or domains where a segment is or starts with 'github'
-    hostname_parts = hostname_lower.split(".")
-    if (
-        hostname_lower == "github.com"
-        or hostname_lower.endswith(".github.com")
-        or any(
-            part == "github" or part.startswith("github-") for part in hostname_parts
-        )
-    ):
-        return "github"
-
-    # Check for GitLab (cloud and self-hosted)
-    # Match gitlab.com, *.gitlab.com, or domains where a segment is or starts with 'gitlab'
-    if (
-        hostname_lower == "gitlab.com"
-        or hostname_lower.endswith(".gitlab.com")
-        or any(
-            part == "gitlab" or part.startswith("gitlab-") for part in hostname_parts
-        )
-    ):
-        return "gitlab"
-
-    # Unknown provider
-    return "unknown"

apps/backend/core/glab_executable.py

@@ -1,193 +0,0 @@
-#!/usr/bin/env python3
-"""
-GitLab CLI Executable Finder
-============================
-
-Utility to find the glab (GitLab CLI) executable, with platform-specific fallbacks.
-"""
-
-import os
-import shutil
-import subprocess
-
-from core.platform import get_where_exe_path
-
-_cached_glab_path: str | None = None
-
-
-def invalidate_glab_cache() -> None:
-    """Invalidate the cached glab executable path.
-
-    Useful when glab may have been uninstalled, updated, or when
-    GITLAB_CLI_PATH environment variable has changed.
-    """
-    global _cached_glab_path
-    _cached_glab_path = None
-
-
-def _verify_glab_executable(path: str) -> bool:
-    """Verify that a path is a valid glab executable by checking version.
-
-    Args:
-        path: Path to the potential glab executable
-
-    Returns:
-        True if the path points to a valid glab executable, False otherwise
-    """
-    try:
-        result = subprocess.run(
-            [path, "--version"],
-            capture_output=True,
-            text=True,
-            encoding="utf-8",
-            timeout=5,
-        )
-        return result.returncode == 0
-    except (subprocess.TimeoutExpired, OSError):
-        return False
-
-
-def _run_where_command() -> str | None:
-    """Run Windows 'where glab' command to find glab executable.
-
-    Returns:
-        First path found, or None if command failed
-    """
-    try:
-        result = subprocess.run(
-            [get_where_exe_path(), "glab"],
-            capture_output=True,
-            text=True,
-            encoding="utf-8",
-            timeout=5,
-        )
-        if result.returncode == 0 and result.stdout.strip():
-            found_path = result.stdout.strip().split("\n")[0].strip()
-            if (
-                found_path
-                and os.path.isfile(found_path)
-                and _verify_glab_executable(found_path)
-            ):
-                return found_path
-    except (subprocess.TimeoutExpired, OSError):
-        # 'where' command failed or timed out - fall through to return None
-        pass
-    return None
-
-
-def get_glab_executable() -> str | None:
-    """Find the glab executable, with platform-specific fallbacks.
-
-    Returns the path to glab executable, or None if not found.
-
-    Priority order:
-    1. GITLAB_CLI_PATH env var (user-configured path from frontend)
-    2. shutil.which (if glab is in PATH)
-    3. Homebrew paths on macOS
-    4. Windows Program Files paths
-    5. Windows 'where' command
-
-    Caches the result after first successful find. Use invalidate_glab_cache()
-    to force re-detection (e.g., after glab installation/uninstallation).
-    """
-    global _cached_glab_path
-
-    # Return cached result if available AND still exists
-    if _cached_glab_path is not None and os.path.isfile(_cached_glab_path):
-        return _cached_glab_path
-
-    _cached_glab_path = _find_glab_executable()
-    return _cached_glab_path
-
-
-def _find_glab_executable() -> str | None:
-    """Internal function to find glab executable."""
-    # 1. Check GITLAB_CLI_PATH env var (set by Electron frontend)
-    env_path = os.environ.get("GITLAB_CLI_PATH")
-    if env_path and os.path.isfile(env_path) and _verify_glab_executable(env_path):
-        return env_path
-
-    # 2. Try shutil.which (works if glab is in PATH)
-    glab_path = shutil.which("glab")
-    if glab_path and _verify_glab_executable(glab_path):
-        return glab_path
-
-    # 3. macOS-specific: check Homebrew paths
-    if os.name != "nt":  # Unix-like systems (macOS, Linux)
-        homebrew_paths = [
-            "/opt/homebrew/bin/glab",  # Apple Silicon
-            "/usr/local/bin/glab",  # Intel Mac
-            "/home/linuxbrew/.linuxbrew/bin/glab",  # Linux Homebrew
-        ]
-        for path in homebrew_paths:
-            if os.path.isfile(path) and _verify_glab_executable(path):
-                return path
-
-    # 4. Windows-specific: check Program Files paths
-    # glab uses Inno Setup with DefaultDirName={autopf}\glab
-    if os.name == "nt":
-        windows_paths = [
-            os.path.expandvars(r"%PROGRAMFILES%\glab\glab.exe"),
-            os.path.expandvars(r"%PROGRAMFILES(X86)%\glab\glab.exe"),
-            os.path.expandvars(r"%LOCALAPPDATA%\Programs\glab\glab.exe"),
-        ]
-        for path in windows_paths:
-            if os.path.isfile(path) and _verify_glab_executable(path):
-                return path
-
-        # 5. Try 'where' command with full path (works even when System32 isn't in PATH)
-        return _run_where_command()
-
-    return None
-
-
-def run_glab(
-    args: list[str],
-    cwd: str | None = None,
-    timeout: int = 60,
-    input_data: str | None = None,
-) -> subprocess.CompletedProcess:
-    """Run a glab command with proper executable finding.
-
-    Args:
-        args: glab command arguments (without 'glab' prefix)
-        cwd: Working directory for the command
-        timeout: Command timeout in seconds (default: 60)
-        input_data: Optional string data to pass to stdin
-
-    Returns:
-        CompletedProcess with command results.
-    """
-    glab = get_glab_executable()
-    if not glab:
-        return subprocess.CompletedProcess(
-            args=["glab"] + args,
-            returncode=-1,
-            stdout="",
-            stderr="GitLab CLI (glab) not found. Install from https://gitlab.com/gitlab-org/cli",
-        )
-    try:
-        return subprocess.run(
-            [glab] + args,
-            cwd=cwd,
-            input=input_data,
-            capture_output=True,
-            text=True,
-            encoding="utf-8",
-            errors="replace",
-            timeout=timeout,
-        )
-    except subprocess.TimeoutExpired:
-        return subprocess.CompletedProcess(
-            args=[glab] + args,
-            returncode=-1,
-            stdout="",
-            stderr=f"Command timed out after {timeout} seconds",
-        )
-    except FileNotFoundError:
-        return subprocess.CompletedProcess(
-            args=[glab] + args,
-            returncode=-1,
-            stdout="",
-            stderr="GitLab CLI (glab) executable not found. Install from https://gitlab.com/gitlab-org/cli",
-        )

apps/backend/core/io_utils.py

@@ -1,94 +0,0 @@
-"""
-I/O Utilities for Safe Console Output
-=====================================
-
-Safe I/O operations for processes running as subprocesses.
-
-When the backend runs as a subprocess of the Electron app, the parent
-process may close the pipe at any time (e.g., user closes the app,
-process killed, etc.). This module provides utilities to handle these
-cases gracefully.
-"""
-
-from __future__ import annotations
-
-import logging
-import sys
-
-logger = logging.getLogger(__name__)
-
-# Track if pipe is broken to avoid repeated failed writes
-_pipe_broken = False
-
-
-def safe_print(message: str, flush: bool = True) -> None:
-    """
-    Print to stdout with BrokenPipeError handling.
-
-    When running as a subprocess (e.g., from Electron), the parent process
-    may close the pipe at any time. This function gracefully handles that
-    case instead of raising an exception.
-
-    Args:
-        message: The message to print
-        flush: Whether to flush stdout after printing (default True)
-    """
-    global _pipe_broken
-
-    # Skip if we already know the pipe is broken
-    if _pipe_broken:
-        return
-
-    try:
-        print(message, flush=flush)
-    except BrokenPipeError:
-        # Pipe closed by parent process - this is expected during shutdown
-        _pipe_broken = True
-        # Quietly close stdout to prevent further errors
-        try:
-            sys.stdout.close()
-        except Exception:
-            pass
-        logger.debug("Output pipe closed by parent process")
-    except ValueError as e:
-        # Handle writes to closed file (can happen after stdout.close())
-        if "closed file" in str(e).lower():
-            _pipe_broken = True
-            logger.debug("Output stream closed")
-        else:
-            # Re-raise unexpected ValueErrors
-            raise
-    except OSError as e:
-        # Handle other pipe-related errors (EPIPE, etc.)
-        if e.errno == 32:  # EPIPE - Broken pipe
-            _pipe_broken = True
-            try:
-                sys.stdout.close()
-            except Exception:
-                pass
-            logger.debug("Output pipe closed (EPIPE)")
-        else:
-            # Re-raise unexpected OS errors
-            raise
-
-
-def is_pipe_broken() -> bool:
-    """Check if the output pipe has been closed."""
-    return _pipe_broken
-
-
-def reset_pipe_state() -> None:
-    """
-    Reset pipe broken state.
-
-    Useful for testing or when starting a new subprocess context where
-    stdout has been reopened. Should only be called when stdout is known
-    to be functional (e.g., in a fresh subprocess with a new stdout).
-
-    Warning:
-        Calling this after stdout has been closed will result in safe_print()
-        attempting to write to the closed stream. The ValueError will be
-        caught and the pipe will be marked as broken again.
-    """
-    global _pipe_broken
-    _pipe_broken = False

apps/backend/core/model_config.py

@@ -1,68 +0,0 @@
-"""
-Model Configuration Utilities
-==============================
-
-Shared utilities for reading and parsing model configuration from environment variables.
-Used by both commit_message.py and merge resolver.
-"""
-
-import logging
-import os
-
-logger = logging.getLogger(__name__)
-
-# Default model for utility operations (commit messages, merge resolution)
-DEFAULT_UTILITY_MODEL = "claude-haiku-4-5-20251001"
-
-
-def get_utility_model_config(
-    default_model: str = DEFAULT_UTILITY_MODEL,
-) -> tuple[str, int | None]:
-    """
-    Get utility model configuration from environment variables.
-
-    Reads UTILITY_MODEL_ID and UTILITY_THINKING_BUDGET from environment,
-    with sensible defaults and validation.
-
-    Args:
-        default_model: Default model ID to use if UTILITY_MODEL_ID not set
-
-    Returns:
-        Tuple of (model_id, thinking_budget) where thinking_budget is None
-        if extended thinking is disabled, or an int representing token budget
-    """
-    model = os.environ.get("UTILITY_MODEL_ID", default_model)
-    thinking_budget_str = os.environ.get("UTILITY_THINKING_BUDGET", "")
-
-    # Parse thinking budget: empty string = disabled (None), number = budget tokens
-    # Note: 0 is treated as "disable thinking" (same as None) since 0 tokens is meaningless
-    thinking_budget: int | None
-    if not thinking_budget_str:
-        # Empty string means "none" level - disable extended thinking
-        thinking_budget = None
-    else:
-        try:
-            parsed_budget = int(thinking_budget_str)
-            # Validate positive values - 0 or negative are invalid
-            # 0 would mean "thinking enabled but 0 tokens" which is meaningless
-            if parsed_budget <= 0:
-                if parsed_budget == 0:
-                    # Zero means disable thinking (same as empty string)
-                    logger.debug(
-                        "UTILITY_THINKING_BUDGET=0 interpreted as 'disable thinking'"
-                    )
-                    thinking_budget = None
-                else:
-                    logger.warning(
-                        f"Negative UTILITY_THINKING_BUDGET value '{thinking_budget_str}' not allowed, using default 1024"
-                    )
-                    thinking_budget = 1024
-            else:
-                thinking_budget = parsed_budget
-        except ValueError:
-            logger.warning(
-                f"Invalid UTILITY_THINKING_BUDGET value '{thinking_budget_str}', using default 1024"
-            )
-            thinking_budget = 1024
-
-    return model, thinking_budget

apps/backend/core/phase_event.py

@@ -1,79 +0,0 @@
-"""
-Execution phase event protocol for frontend synchronization.
-
-Protocol: __EXEC_PHASE__:{"phase":"coding","message":"Starting"}
-"""
-
-import json
-import os
-import sys
-from enum import Enum
-from typing import Any
-
-PHASE_MARKER_PREFIX = "__EXEC_PHASE__:"
-_DEBUG = os.environ.get("DEBUG", "").lower() in ("1", "true", "yes")
-
-
-class ExecutionPhase(str, Enum):
-    """Maps to frontend's ExecutionPhase type for task card badges."""
-
-    PLANNING = "planning"
-    CODING = "coding"
-    QA_REVIEW = "qa_review"
-    QA_FIXING = "qa_fixing"
-    COMPLETE = "complete"
-    FAILED = "failed"
-    # Pause states for intelligent error recovery
-    RATE_LIMIT_PAUSED = "rate_limit_paused"
-    AUTH_FAILURE_PAUSED = "auth_failure_paused"
-
-
-def emit_phase(
-    phase: ExecutionPhase | str,
-    message: str = "",
-    *,
-    progress: int | None = None,
-    subtask: str | None = None,
-    reset_timestamp: int | None = None,
-    profile_id: str | None = None,
-) -> None:
-    """Emit structured phase event to stdout for frontend parsing.
-
-    Args:
-        phase: The execution phase (e.g., PLANNING, CODING, RATE_LIMIT_PAUSED)
-        message: Optional message describing the phase state
-        progress: Optional progress percentage (0-100)
-        subtask: Optional subtask identifier
-        reset_timestamp: Optional Unix timestamp for rate limit reset time
-        profile_id: Optional profile ID that triggered the pause
-    """
-    phase_value = phase.value if isinstance(phase, ExecutionPhase) else phase
-
-    payload: dict[str, Any] = {
-        "phase": phase_value,
-        "message": message,
-    }
-
-    if progress is not None:
-        if not (0 <= progress <= 100):
-            progress = max(0, min(100, progress))
-        payload["progress"] = progress
-
-    if subtask is not None:
-        payload["subtask"] = subtask
-
-    if reset_timestamp is not None:
-        payload["reset_timestamp"] = reset_timestamp
-
-    if profile_id is not None:
-        payload["profile_id"] = profile_id
-
-    try:
-        print(f"{PHASE_MARKER_PREFIX}{json.dumps(payload, default=str)}", flush=True)
-    except (OSError, UnicodeEncodeError) as e:
-        if _DEBUG:
-            try:
-                sys.stderr.write(f"[phase_event] emit failed: {e}\n")
-                sys.stderr.flush()
-            except (OSError, UnicodeEncodeError):
-                pass  # Truly silent on complete I/O failure

apps/backend/core/plan_normalization.py

@@ -1,50 +0,0 @@
-"""
-Implementation Plan Normalization Utilities
-===========================================
-
-Small helpers for normalizing common LLM/legacy field variants in
-implementation_plan.json without changing status semantics.
-"""
-
-from typing import Any
-
-
-def normalize_subtask_aliases(subtask: dict[str, Any]) -> tuple[dict[str, Any], bool]:
-    """Normalize common subtask field aliases.
-
-    - If `id` is missing and `subtask_id` exists, copy it into `id` as a string.
-    - If `description` is missing/empty and `title` is a non-empty string, copy it
-      into `description`.
-    """
-
-    normalized = dict(subtask)
-    changed = False
-
-    id_value = normalized.get("id")
-    id_missing = (
-        "id" not in normalized
-        or id_value is None
-        or (isinstance(id_value, str) and not id_value.strip())
-    )
-    if id_missing and "subtask_id" in normalized:
-        subtask_id = normalized.get("subtask_id")
-        if subtask_id is not None:
-            subtask_id_str = str(subtask_id).strip()
-            if subtask_id_str:
-                normalized["id"] = subtask_id_str
-                changed = True
-
-    description_value = normalized.get("description")
-    description_missing = (
-        "description" not in normalized
-        or description_value is None
-        or (isinstance(description_value, str) and not description_value.strip())
-    )
-    title = normalized.get("title")
-    if description_missing and isinstance(title, str):
-        title_str = title.strip()
-        if title_str:
-            normalized["description"] = title_str
-            changed = True
-
-    return normalized, changed

apps/backend/core/platform/__init__.py

@@ -1,532 +0,0 @@
-"""
-Platform Abstraction Layer
-
-Centralized platform-specific operations for the Python backend.
-All code that checks sys.platform or handles OS differences should use this module.
-
-Design principles:
-- Single source of truth for platform detection
-- Feature detection over platform detection when possible
-- Clear, intention-revealing names
-- Immutable configurations where possible
-"""
-
-import os
-import platform
-import re
-import shutil
-import subprocess
-from enum import Enum
-from pathlib import Path
-
-# ============================================================================
-# Type Definitions
-# ============================================================================
-
-
-class OS(Enum):
-    """Supported operating systems."""
-
-    WINDOWS = "Windows"
-    MACOS = "Darwin"
-    LINUX = "Linux"
-
-
-class ShellType(Enum):
-    """Available shell types."""
-
-    POWERSHELL = "powershell"
-    CMD = "cmd"
-    BASH = "bash"
-    ZSH = "zsh"
-    FISH = "fish"
-    UNKNOWN = "unknown"
-
-
-# ============================================================================
-# Platform Detection
-# ============================================================================
-
-
-def get_current_os() -> OS:
-    """Get the current operating system.
-
-    Returns the OS enum for the current platform. For unsupported Unix-like
-    systems (e.g., FreeBSD, SunOS), defaults to Linux for compatibility.
-    """
-    system = platform.system()
-    if system == "Windows":
-        return OS.WINDOWS
-    elif system == "Darwin":
-        return OS.MACOS
-    # Default to Linux for other Unix-like systems (FreeBSD, SunOS, etc.)
-    return OS.LINUX
-
-
-def is_windows() -> bool:
-    """Check if running on Windows."""
-    return platform.system() == "Windows"
-
-
-def is_macos() -> bool:
-    """Check if running on macOS."""
-    return platform.system() == "Darwin"
-
-
-def is_linux() -> bool:
-    """Check if running on Linux."""
-    return platform.system() == "Linux"
-
-
-def is_unix() -> bool:
-    """Check if running on a Unix-like system (macOS or Linux)."""
-    return not is_windows()
-
-
-# ============================================================================
-# Path Configuration
-# ============================================================================
-
-
-def get_path_delimiter() -> str:
-    """Get the PATH separator for environment variables."""
-    return ";" if is_windows() else ":"
-
-
-def get_executable_extension() -> str:
-    """Get the default file extension for executables."""
-    return ".exe" if is_windows() else ""
-
-
-def with_executable_extension(base_name: str) -> str:
-    """Add executable extension to a base name if needed."""
-    if not base_name:
-        return base_name
-
-    # Check if already has extension
-    if os.path.splitext(base_name)[1]:
-        return base_name
-
-    exe_ext = get_executable_extension()
-    return f"{base_name}{exe_ext}" if exe_ext else base_name
-
-
-# ============================================================================
-# Binary Directories
-# ============================================================================
-
-
-def get_binary_directories() -> dict[str, list[str]]:
-    """
-    Get common binary directories for the current platform.
-
-    Returns:
-        Dict with 'user' and 'system' keys containing lists of directories.
-    """
-    home_dir = Path.home()
-
-    if is_windows():
-        return {
-            "user": [
-                str(home_dir / "AppData" / "Local" / "Programs"),
-                str(home_dir / "AppData" / "Roaming" / "npm"),
-                str(home_dir / ".local" / "bin"),
-            ],
-            "system": [
-                os.environ.get("ProgramFiles", "C:\\Program Files"),
-                os.environ.get("ProgramFiles(x86)", "C:\\Program Files (x86)"),
-                os.path.join(os.environ.get("SystemRoot", "C:\\Windows"), "System32"),
-            ],
-        }
-
-    if is_macos():
-        return {
-            "user": [
-                str(home_dir / ".local" / "bin"),
-                str(home_dir / "bin"),
-            ],
-            "system": [
-                "/opt/homebrew/bin",
-                "/usr/local/bin",
-                "/usr/bin",
-            ],
-        }
-
-    # Linux
-    return {
-        "user": [
-            str(home_dir / ".local" / "bin"),
-            str(home_dir / "bin"),
-        ],
-        "system": [
-            "/usr/bin",
-            "/usr/local/bin",
-            "/snap/bin",
-        ],
-    }
-
-
-def get_homebrew_path() -> str | None:
-    """
-    Get Homebrew binary directory (macOS only).
-
-    Returns:
-        Homebrew bin path or None if not on macOS.
-    """
-    if not is_macos():
-        return None
-
-    homebrew_paths = [
-        "/opt/homebrew/bin",  # Apple Silicon
-        "/usr/local/bin",  # Intel
-    ]
-
-    for brew_path in homebrew_paths:
-        if os.path.exists(brew_path):
-            return brew_path
-
-    return homebrew_paths[0]  # Default to Apple Silicon
-
-
-# ============================================================================
-# Tool Detection
-# ============================================================================
-
-
-def find_executable(name: str, additional_paths: list[str] | None = None) -> str | None:
-    """
-    Find an executable in standard locations.
-
-    Searches:
-    1. System PATH
-    2. Platform-specific binary directories
-    3. Additional custom paths
-
-    Args:
-        name: Name of the executable (without extension)
-        additional_paths: Optional list of additional paths to search
-
-    Returns:
-        Full path to executable if found, None otherwise
-    """
-    # First check system PATH
-    in_path = shutil.which(name)
-    if in_path:
-        return in_path
-
-    # Check with extension on Windows
-    if is_windows():
-        for ext in [".exe", ".cmd", ".bat"]:
-            in_path = shutil.which(f"{name}{ext}")
-            if in_path:
-                return in_path
-
-    # Search in platform-specific directories
-    bins = get_binary_directories()
-    search_dirs = bins["user"] + bins["system"]
-
-    if additional_paths:
-        search_dirs.extend(additional_paths)
-
-    for directory in search_dirs:
-        if not os.path.isdir(directory):
-            continue
-
-        # Try without extension
-        exe_path = os.path.join(directory, with_executable_extension(name))
-        if os.path.isfile(exe_path):
-            return exe_path
-
-        # Try common extensions on Windows
-        if is_windows():
-            for ext in [".exe", ".cmd", ".bat"]:
-                exe_path = os.path.join(directory, f"{name}{ext}")
-                if os.path.isfile(exe_path):
-                    return exe_path
-
-    return None
-
-
-def get_claude_detection_paths() -> list[str]:
-    """
-    Get platform-specific paths for Claude CLI detection.
-
-    Returns:
-        List of possible Claude CLI executable paths.
-    """
-    home_dir = Path.home()
-    paths = []
-
-    if is_windows():
-        paths.extend(
-            [
-                str(
-                    home_dir
-                    / "AppData"
-                    / "Local"
-                    / "Programs"
-                    / "claude"
-                    / "claude.exe"
-                ),
-                str(home_dir / "AppData" / "Roaming" / "npm" / "claude.cmd"),
-                str(home_dir / ".local" / "bin" / "claude.exe"),
-                r"C:\Program Files\Claude\claude.exe",
-                r"C:\Program Files (x86)\Claude\claude.exe",
-            ]
-        )
-    else:
-        paths.extend(
-            [
-                str(home_dir / ".local" / "bin" / "claude"),
-                str(home_dir / "bin" / "claude"),
-            ]
-        )
-
-    # Add Homebrew path on macOS
-    if is_macos():
-        brew_path = get_homebrew_path()
-        if brew_path:
-            paths.append(os.path.join(brew_path, "claude"))
-
-    return paths
-
-
-def get_claude_detection_paths_structured() -> dict[str, list[str] | str]:
-    """
-    Get platform-specific paths for Claude CLI detection in structured format.
-
-    Returns a dict with categorized paths for different detection strategies:
-    - 'homebrew': Homebrew installation paths (macOS)
-    - 'platform': Platform-specific standard installation locations
-    - 'nvm_versions_dir': NVM versions directory path for scanning Node installations
-
-    This structured format allows callers to implement custom detection logic
-    for each category (e.g., iterating NVM version directories).
-
-    Returns:
-        Dict with 'homebrew', 'platform', and 'nvm_versions_dir' keys
-    """
-    home_dir = Path.home()
-
-    homebrew_paths = [
-        "/opt/homebrew/bin/claude",  # Apple Silicon
-        "/usr/local/bin/claude",  # Intel Mac
-    ]
-
-    if is_windows():
-        platform_paths = [
-            str(home_dir / "AppData/Local/Programs/claude/claude.exe"),
-            str(home_dir / "AppData/Roaming/npm/claude.cmd"),
-            str(home_dir / ".local/bin/claude.exe"),
-            r"C:\Program Files\Claude\claude.exe",
-            r"C:\Program Files (x86)\Claude\claude.exe",
-        ]
-    else:
-        platform_paths = [
-            str(home_dir / ".local" / "bin" / "claude"),
-            str(home_dir / "bin" / "claude"),
-        ]
-
-    nvm_versions_dir = str(home_dir / ".nvm" / "versions" / "node")
-
-    return {
-        "homebrew": homebrew_paths,
-        "platform": platform_paths,
-        "nvm_versions_dir": nvm_versions_dir,
-    }
-
-
-def get_python_commands() -> list[list[str]]:
-    """
-    Get platform-specific Python command variations as argument sequences.
-
-    Returns command arguments as sequences so callers can pass each entry
-    directly to subprocess.run(cmd) or use cmd[0] with shutil.which().
-
-    Returns:
-        List of command argument lists to try, in order of preference.
-        Each inner list contains the executable and any required arguments.
-
-    Example:
-        for cmd in get_python_commands():
-            if shutil.which(cmd[0]):
-                subprocess.run(cmd + ["--version"])
-                break
-    """
-    if is_windows():
-        return [["py", "-3"], ["python"], ["python3"], ["py"]]
-    return [["python3"], ["python"]]
-
-
-def validate_cli_path(cli_path: str) -> bool:
-    """
-    Validate that a CLI path is secure and executable.
-
-    Prevents command injection attacks by rejecting paths with shell metacharacters,
-    directory traversal patterns, or environment variable expansion.
-
-    Args:
-        cli_path: Path to validate
-
-    Returns:
-        True if path is secure, False otherwise
-    """
-    if not cli_path or not cli_path.strip():
-        return False
-
-    # Security validation: reject paths with shell metacharacters or other dangerous patterns
-    dangerous_patterns = [
-        r'[;&|`${}[\]<>!"^]',  # Shell metacharacters
-        r"%[^%]+%",  # Windows environment variable expansion
-        r"\.\./",  # Unix directory traversal
-        r"\.\.\\",  # Windows directory traversal
-        r"[\r\n\x00]",  # Newlines (command injection), null bytes (path truncation)
-    ]
-
-    for pattern in dangerous_patterns:
-        if re.search(pattern, cli_path):
-            return False
-
-    # On Windows, validate executable name additionally
-    if is_windows():
-        # Extract just the executable name
-        exe_name = os.path.basename(cli_path)
-        name_without_ext = os.path.splitext(exe_name)[0]
-
-        # Allow only alphanumeric, dots, hyphens, underscores in the name
-        if not name_without_ext or not all(
-            c.isalnum() or c in "._-" for c in name_without_ext
-        ):
-            return False
-
-    # Check if path exists (if absolute)
-    if os.path.isabs(cli_path):
-        return os.path.isfile(cli_path)
-
-    return True
-
-
-# ============================================================================
-# Shell Execution
-# ============================================================================
-
-
-def requires_shell(command: str) -> bool:
-    """
-    Check if a command requires shell execution on Windows.
-
-    Windows needs shell execution for .cmd and .bat files.
-
-    Args:
-        command: Command string to check
-
-    Returns:
-        True if shell execution is required
-    """
-    if not is_windows():
-        return False
-
-    _, ext = os.path.splitext(command)
-    return ext.lower() in {".cmd", ".bat", ".ps1"}
-
-
-def get_where_exe_path() -> str:
-    """Get full path to where.exe on Windows.
-
-    Using the full path ensures where.exe works even when System32 isn't in PATH,
-    which can happen in restricted environments or when the app doesn't inherit
-    the full system PATH.
-
-    Returns:
-        Full path to where.exe (e.g., C:\\Windows\\System32\\where.exe)
-    """
-    system_root = os.environ.get(
-        "SystemRoot", os.environ.get("SYSTEMROOT", "C:\\Windows")
-    )
-    return os.path.join(system_root, "System32", "where.exe")
-
-
-def get_comspec_path() -> str:
-    """
-    Get the path to cmd.exe on Windows.
-
-    Returns:
-        Path to cmd.exe or default location.
-    """
-    if is_windows():
-        return os.environ.get(
-            "ComSpec",
-            os.path.join(
-                os.environ.get("SystemRoot", "C:\\Windows"), "System32", "cmd.exe"
-            ),
-        )
-    return "/bin/sh"
-
-
-def build_windows_command(cli_path: str, args: list[str]) -> list[str]:
-    """
-    Build a command array for Windows execution.
-
-    Handles .cmd/.bat files that require shell execution.
-
-    Args:
-        cli_path: Path to the CLI executable
-        args: Command arguments
-
-    Returns:
-        Command array suitable for subprocess.run
-    """
-    if is_windows() and cli_path.lower().endswith((".cmd", ".bat")):
-        # Use cmd.exe to execute .cmd/.bat files
-        cmd_exe = get_comspec_path()
-        # Properly escape arguments for Windows command line
-        escaped_args = subprocess.list2cmdline(args)
-        return [cmd_exe, "/d", "/s", "/c", f'"{cli_path}" {escaped_args}']
-
-    return [cli_path] + args
-
-
-# ============================================================================
-# Environment Variables
-# ============================================================================
-
-
-def get_env_var(name: str, default: str | None = None) -> str | None:
-    """
-    Get environment variable value with case-insensitive support on Windows.
-
-    Args:
-        name: Environment variable name
-        default: Default value if not found
-
-    Returns:
-        Environment variable value or default
-    """
-    if is_windows():
-        # Case-insensitive lookup on Windows
-        for key, value in os.environ.items():
-            if key.lower() == name.lower():
-                return value
-        return default
-
-    return os.environ.get(name, default)
-
-
-# ============================================================================
-# Platform Description
-# ============================================================================
-
-
-def get_platform_description() -> str:
-    """
-    Get a human-readable platform description.
-
-    Returns:
-        String like "Windows (AMD64)" or "macOS (arm64)"
-    """
-    os_name = {OS.WINDOWS: "Windows", OS.MACOS: "macOS", OS.LINUX: "Linux"}.get(
-        get_current_os(), platform.system()
-    )
-
-    arch = platform.machine()
-    return f"{os_name} ({arch})"

apps/backend/core/sentry.py

@@ -1,417 +0,0 @@
-"""
-Sentry Error Tracking for Python Backend
-=========================================
-
-Initializes Sentry for the Python backend with:
-- Privacy-preserving path masking (usernames removed)
-- Release tracking matching the Electron frontend
-- Environment variable configuration (same as frontend)
-
-Configuration:
-- SENTRY_DSN: Required to enable Sentry (same as frontend)
-- SENTRY_TRACES_SAMPLE_RATE: Performance monitoring sample rate (0-1, default: 0.1)
-- SENTRY_ENVIRONMENT: Override environment (default: auto-detected)
-
-Privacy Note:
-- Usernames are masked from all file paths
-- Project paths remain visible for debugging (this is expected)
-- No user identifiers are collected
-"""
-
-from __future__ import annotations
-
-import logging
-import os
-import re
-import sys
-from pathlib import Path
-from typing import Any
-
-logger = logging.getLogger(__name__)
-
-# Track initialization state
-_sentry_initialized = False
-_sentry_enabled = False
-
-# Production trace sample rate (10%)
-PRODUCTION_TRACE_SAMPLE_RATE = 0.1
-
-
-def _get_version() -> str:
-    """
-    Get the application version.
-
-    Tries to read from package.json in the frontend directory,
-    falling back to a default version.
-    """
-    try:
-        # Try to find package.json relative to this file
-        backend_dir = Path(__file__).parent.parent
-        frontend_dir = backend_dir.parent / "frontend"
-        package_json = frontend_dir / "package.json"
-
-        if package_json.exists():
-            import json
-
-            with open(package_json, encoding="utf-8") as f:
-                data = json.load(f)
-                return data.get("version", "0.0.0")
-    except Exception as e:
-        logger.debug(f"Version detection failed: {e}")
-
-    return "0.0.0"
-
-
-def _mask_user_paths(text: str) -> str:
-    """
-    Mask user-specific paths for privacy.
-
-    Replaces usernames in common OS path patterns:
-    - macOS: /Users/username/... becomes /Users/***/...
-    - Windows: C:\\Users\\username\\... becomes C:\\Users\\***\\...
-    - Linux: /home/username/... becomes /home/***/...
-    - WSL: /mnt/c/Users/username/... becomes /mnt/c/Users/***/...
-
-    Note: Project paths remain visible for debugging purposes.
-    """
-    if not text:
-        return text
-
-    # macOS: /Users/username/...
-    text = re.sub(r"/Users/[^/]+(?=/|$)", "/Users/***", text)
-
-    # Windows: C:\Users\username\...
-    text = re.sub(
-        r"[A-Za-z]:\\Users\\[^\\]+(?=\\|$)",
-        lambda m: f"{m.group(0)[0]}:\\Users\\***",
-        text,
-    )
-
-    # Linux: /home/username/...
-    text = re.sub(r"/home/[^/]+(?=/|$)", "/home/***", text)
-
-    # WSL: /mnt/c/Users/username/... (accessing Windows filesystem from WSL)
-    text = re.sub(
-        r"/mnt/[a-z]/Users/[^/]+(?=/|$)",
-        lambda m: f"{m.group(0)[:6]}/Users/***",
-        text,
-    )
-
-    return text
-
-
-def _mask_object_paths(obj: Any, _depth: int = 0) -> Any:
-    """
-    Recursively mask paths in an object.
-
-    Args:
-        obj: The object to mask paths in
-        _depth: Current recursion depth (internal use)
-
-    Returns:
-        Object with paths masked
-    """
-    # Prevent stack overflow on deeply nested or circular structures
-    if _depth > 50:
-        return obj
-
-    if obj is None:
-        return obj
-
-    if isinstance(obj, str):
-        return _mask_user_paths(obj)
-
-    if isinstance(obj, list):
-        return [_mask_object_paths(item, _depth + 1) for item in obj]
-
-    if isinstance(obj, dict):
-        return {
-            key: _mask_object_paths(value, _depth + 1) for key, value in obj.items()
-        }
-
-    return obj
-
-
-def _before_send(event: dict, hint: dict) -> dict | None:
-    """
-    Process event before sending to Sentry.
-
-    Applies privacy masking to all paths in the event.
-    """
-    if not _sentry_enabled:
-        return None
-
-    # Mask paths in exception stack traces
-    if "exception" in event and "values" in event["exception"]:
-        for exception in event["exception"]["values"]:
-            if "stacktrace" in exception and "frames" in exception["stacktrace"]:
-                for frame in exception["stacktrace"]["frames"]:
-                    if "filename" in frame:
-                        frame["filename"] = _mask_user_paths(frame["filename"])
-                    if "abs_path" in frame:
-                        frame["abs_path"] = _mask_user_paths(frame["abs_path"])
-            if "value" in exception:
-                exception["value"] = _mask_user_paths(exception["value"])
-
-    # Mask paths in breadcrumbs
-    if "breadcrumbs" in event:
-        for breadcrumb in event.get("breadcrumbs", {}).get("values", []):
-            if "message" in breadcrumb:
-                breadcrumb["message"] = _mask_user_paths(breadcrumb["message"])
-            if "data" in breadcrumb:
-                breadcrumb["data"] = _mask_object_paths(breadcrumb["data"])
-
-    # Mask paths in message
-    if "message" in event:
-        event["message"] = _mask_user_paths(event["message"])
-
-    # Mask paths in tags
-    if "tags" in event:
-        event["tags"] = _mask_object_paths(event["tags"])
-
-    # Mask paths in contexts
-    if "contexts" in event:
-        event["contexts"] = _mask_object_paths(event["contexts"])
-
-    # Mask paths in extra data
-    if "extra" in event:
-        event["extra"] = _mask_object_paths(event["extra"])
-
-    # Clear user info for privacy
-    if "user" in event:
-        event["user"] = {}
-
-    return event
-
-
-def init_sentry(
-    component: str = "backend",
-    force_enable: bool = False,
-) -> bool:
-    """
-    Initialize Sentry for the Python backend.
-
-    Args:
-        component: Component name for tagging (e.g., "backend", "github-runner")
-        force_enable: Force enable even without packaged app detection
-
-    Returns:
-        True if Sentry was initialized, False otherwise
-    """
-    global _sentry_initialized, _sentry_enabled
-
-    if _sentry_initialized:
-        return _sentry_enabled
-
-    _sentry_initialized = True
-
-    # Get DSN from environment variable
-    dsn = os.environ.get("SENTRY_DSN", "")
-
-    if not dsn:
-        logger.debug("[Sentry] No SENTRY_DSN configured - error reporting disabled")
-        return False
-
-    # Check if we should enable Sentry
-    # Enable if:
-    # - Running from packaged app (detected by __compiled__ or frozen)
-    # - SENTRY_DEV=true is set
-    # - force_enable is True
-    is_packaged = getattr(sys, "frozen", False) or hasattr(sys, "__compiled__")
-    sentry_dev = os.environ.get("SENTRY_DEV", "").lower() in ("true", "1", "yes")
-    should_enable = is_packaged or sentry_dev or force_enable
-
-    if not should_enable:
-        logger.debug(
-            "[Sentry] Development mode - error reporting disabled (set SENTRY_DEV=true to enable)"
-        )
-        return False
-
-    try:
-        import sentry_sdk
-        from sentry_sdk.integrations.logging import LoggingIntegration
-    except ImportError:
-        logger.warning("[Sentry] sentry-sdk not installed - error reporting disabled")
-        return False
-
-    # Get configuration from environment variables
-    version = _get_version()
-    environment = os.environ.get(
-        "SENTRY_ENVIRONMENT", "production" if is_packaged else "development"
-    )
-
-    # Get sample rates
-    traces_sample_rate = PRODUCTION_TRACE_SAMPLE_RATE
-    try:
-        env_rate = os.environ.get("SENTRY_TRACES_SAMPLE_RATE")
-        if env_rate:
-            parsed = float(env_rate)
-            if 0 <= parsed <= 1:
-                traces_sample_rate = parsed
-    except (ValueError, TypeError):
-        pass
-
-    # Configure logging integration to capture errors and warnings
-    logging_integration = LoggingIntegration(
-        level=logging.INFO,  # Capture INFO and above as breadcrumbs
-        event_level=logging.ERROR,  # Send ERROR and above as events
-    )
-
-    # Initialize Sentry with exception handling for malformed DSN
-    try:
-        sentry_sdk.init(
-            dsn=dsn,
-            environment=environment,
-            release=f"auto-claude@{version}",
-            traces_sample_rate=traces_sample_rate,
-            before_send=_before_send,
-            integrations=[logging_integration],
-            # Don't send PII
-            send_default_pii=False,
-        )
-    except Exception as e:
-        # Handle malformed DSN (e.g., missing public key) gracefully
-        # This prevents crashes when SENTRY_DSN is misconfigured
-        logger.warning(
-            f"[Sentry] Failed to initialize - invalid DSN configuration: {e}"
-        )
-        logger.debug(
-            "[Sentry] DSN should be in format: https://PUBLIC_KEY@o123.ingest.sentry.io/PROJECT_ID"
-        )
-        return False
-
-    # Set component tag
-    sentry_sdk.set_tag("component", component)
-
-    _sentry_enabled = True
-    logger.info(
-        f"[Sentry] Backend initialized (component: {component}, release: auto-claude@{version}, traces: {traces_sample_rate})"
-    )
-
-    return True
-
-
-def capture_exception(error: Exception, **kwargs) -> None:
-    """
-    Capture an exception and send to Sentry.
-
-    Safe to call even if Sentry is not initialized.
-
-    Args:
-        error: The exception to capture
-        **kwargs: Additional context to attach to the event
-    """
-    if not _sentry_enabled:
-        logger.error(f"[Sentry] Not enabled, exception not captured: {error}")
-        return
-
-    try:
-        import sentry_sdk
-
-        with sentry_sdk.push_scope() as scope:
-            for key, value in kwargs.items():
-                # Apply defensive path masking for extra data
-                masked_value = (
-                    _mask_object_paths(value)
-                    if isinstance(value, (str, dict, list))
-                    else value
-                )
-                scope.set_extra(key, masked_value)
-            sentry_sdk.capture_exception(error)
-    except ImportError:
-        logger.error(f"[Sentry] SDK not installed, exception not captured: {error}")
-    except Exception as e:
-        logger.error(f"[Sentry] Failed to capture exception: {e}")
-
-
-def capture_message(message: str, level: str = "info", **kwargs) -> None:
-    """
-    Capture a message and send to Sentry.
-
-    Safe to call even if Sentry is not initialized.
-
-    Args:
-        message: The message to capture
-        level: Log level (debug, info, warning, error, fatal)
-        **kwargs: Additional context to attach to the event
-    """
-    if not _sentry_enabled:
-        return
-
-    try:
-        import sentry_sdk
-
-        with sentry_sdk.push_scope() as scope:
-            for key, value in kwargs.items():
-                # Apply defensive path masking for extra data (same as capture_exception)
-                masked_value = (
-                    _mask_object_paths(value)
-                    if isinstance(value, (str, dict, list))
-                    else value
-                )
-                scope.set_extra(key, masked_value)
-            sentry_sdk.capture_message(message, level=level)
-    except ImportError:
-        logger.debug("[Sentry] SDK not installed")
-    except Exception as e:
-        logger.error(f"[Sentry] Failed to capture message: {e}")
-
-
-def set_context(name: str, data: dict) -> None:
-    """
-    Set context data for subsequent events.
-
-    Safe to call even if Sentry is not initialized.
-
-    Args:
-        name: Context name (e.g., "pr_review", "spec")
-        data: Context data dictionary
-    """
-    if not _sentry_enabled:
-        return
-
-    try:
-        import sentry_sdk
-
-        # Apply path masking to context data before sending to Sentry
-        masked_data = _mask_object_paths(data)
-        sentry_sdk.set_context(name, masked_data)
-    except ImportError:
-        logger.debug("[Sentry] SDK not installed")
-    except Exception as e:
-        logger.debug(f"Failed to set context '{name}': {e}")
-
-
-def set_tag(key: str, value: str) -> None:
-    """
-    Set a tag for subsequent events.
-
-    Safe to call even if Sentry is not initialized.
-
-    Args:
-        key: Tag key
-        value: Tag value
-    """
-    if not _sentry_enabled:
-        return
-
-    try:
-        import sentry_sdk
-
-        # Apply path masking to tag value
-        masked_value = _mask_user_paths(value) if isinstance(value, str) else value
-        sentry_sdk.set_tag(key, masked_value)
-    except ImportError:
-        logger.debug("[Sentry] SDK not installed")
-    except Exception as e:
-        logger.debug(f"Failed to set tag '{key}': {e}")
-
-
-def is_enabled() -> bool:
-    """Check if Sentry is enabled."""
-    return _sentry_enabled
-
-
-def is_initialized() -> bool:
-    """Check if Sentry initialization has been attempted."""
-    return _sentry_initialized

apps/backend/core/simple_client.py

@@ -1,146 +0,0 @@
-"""
-Simple Claude SDK Client Factory
-================================
-
-Factory for creating minimal Claude SDK clients for single-turn utility operations
-like commit message generation, merge conflict resolution, and batch analysis.
-
-These clients don't need full security configurations, MCP servers, or hooks.
-Use `create_client()` from `core.client` for full agent sessions with security.
-
-Example usage:
-    from core.simple_client import create_simple_client
-
-    # For commit message generation (text-only, no tools)
-    client = create_simple_client(agent_type="commit_message")
-
-    # For merge conflict resolution (text-only, no tools)
-    client = create_simple_client(agent_type="merge_resolver")
-
-    # For insights extraction (read tools only)
-    client = create_simple_client(agent_type="insights", cwd=project_dir)
-"""
-
-import logging
-import os
-from pathlib import Path
-
-from agents.tools_pkg import get_agent_config, get_default_thinking_level
-from claude_agent_sdk import ClaudeAgentOptions, ClaudeSDKClient
-from core.auth import (
-    configure_sdk_authentication,
-    get_sdk_env_vars,
-)
-from core.fast_mode import ensure_fast_mode_in_user_settings
-from core.platform import validate_cli_path
-from phase_config import get_thinking_budget
-
-logger = logging.getLogger(__name__)
-
-
-def create_simple_client(
-    agent_type: str = "merge_resolver",
-    model: str = "claude-haiku-4-5-20251001",
-    system_prompt: str | None = None,
-    cwd: Path | None = None,
-    max_turns: int = 1,
-    max_thinking_tokens: int | None = None,
-    betas: list[str] | None = None,
-    effort_level: str | None = None,
-    fast_mode: bool = False,
-) -> ClaudeSDKClient:
-    """
-    Create a minimal Claude SDK client for single-turn utility operations.
-
-    This factory creates lightweight clients without MCP servers, security hooks,
-    or full permission configurations. Use for text-only analysis tasks.
-
-    Args:
-        agent_type: Agent type from AGENT_CONFIGS. Determines available tools.
-                   Common utility types:
-                   - "merge_resolver" - Text-only merge conflict analysis
-                   - "commit_message" - Text-only commit message generation
-                   - "insights" - Read-only code insight extraction
-                   - "batch_analysis" - Read-only batch issue analysis
-                   - "batch_validation" - Read-only validation
-        model: Claude model to use (defaults to Haiku for fast/cheap operations)
-        system_prompt: Optional custom system prompt (for specialized tasks)
-        cwd: Working directory for file operations (optional)
-        max_turns: Maximum conversation turns (default: 1 for single-turn)
-        max_thinking_tokens: Override thinking budget (None = use agent default from
-                            AGENT_CONFIGS, converted using phase_config.THINKING_BUDGET_MAP)
-        betas: Optional list of SDK beta header strings (e.g., ["context-1m-2025-08-07"])
-        effort_level: Optional effort level for adaptive thinking models (e.g., "low",
-                     "medium", "high"). Injected as CLAUDE_CODE_EFFORT_LEVEL env var.
-        fast_mode: Enable Fast Mode for faster Opus 4.6 output. Enables the "user"
-                  setting source so the CLI reads fastMode from ~/.claude/settings.json.
-
-    Returns:
-        Configured ClaudeSDKClient for single-turn operations
-
-    Raises:
-        ValueError: If agent_type is not found in AGENT_CONFIGS
-    """
-    # Get environment variables for SDK (including CLAUDE_CONFIG_DIR if set)
-    sdk_env = get_sdk_env_vars()
-
-    # Get the config dir for profile-specific credential lookup
-    # CLAUDE_CONFIG_DIR enables per-profile Keychain entries with SHA256-hashed service names
-    config_dir = sdk_env.get("CLAUDE_CONFIG_DIR")
-
-    # Configure SDK authentication (OAuth or API profile mode)
-    configure_sdk_authentication(config_dir)
-
-    # Inject effort level for adaptive thinking models (e.g., Opus 4.6)
-    if effort_level:
-        sdk_env["CLAUDE_CODE_EFFORT_LEVEL"] = effort_level
-
-    # Fast mode: the CLI reads "fastMode" from user settings (~/.claude/settings.json).
-    # By default the SDK passes --setting-sources "" which blocks all filesystem settings.
-    # We enable "user" source so the CLI can read fastMode from user settings.
-    if fast_mode:
-        ensure_fast_mode_in_user_settings()
-        logger.info("[Fast Mode] ACTIVE — will enable user setting source for fastMode")
-
-    # Get agent configuration (raises ValueError if unknown type)
-    config = get_agent_config(agent_type)
-
-    # Get tools from config (no MCP tools for simple clients)
-    allowed_tools = list(config.get("tools", []))
-
-    # Determine thinking budget using the single source of truth (phase_config.py)
-    if max_thinking_tokens is None:
-        thinking_level = get_default_thinking_level(agent_type)
-        max_thinking_tokens = get_thinking_budget(thinking_level)
-
-    # Build options dict
-    # Note: SDK bundles its own CLI, so no cli_path detection needed
-    options_kwargs = {
-        "model": model,
-        "system_prompt": system_prompt,
-        "allowed_tools": allowed_tools,
-        "max_turns": max_turns,
-        "cwd": str(cwd.resolve()) if cwd else None,
-        "env": sdk_env,
-    }
-
-    # Fast mode: enable user setting source so CLI reads fastMode from
-    # ~/.claude/settings.json. Without this, --setting-sources "" blocks it.
-    if fast_mode:
-        options_kwargs["setting_sources"] = ["user"]
-
-    # Only add max_thinking_tokens if not None (Haiku doesn't support extended thinking)
-    if max_thinking_tokens is not None:
-        options_kwargs["max_thinking_tokens"] = max_thinking_tokens
-
-    # Add beta headers if specified (e.g., for 1M context window)
-    if betas:
-        options_kwargs["betas"] = betas
-
-    # Optional: Allow CLI path override via environment variable
-    env_cli_path = os.environ.get("CLAUDE_CLI_PATH")
-    if env_cli_path and validate_cli_path(env_cli_path):
-        options_kwargs["cli_path"] = env_cli_path
-        logger.info(f"Using CLAUDE_CLI_PATH override: {env_cli_path}")
-
-    return ClaudeSDKClient(options=ClaudeAgentOptions(**options_kwargs))

apps/backend/core/task_event.py

@@ -1,101 +0,0 @@
-"""
-Task event protocol for frontend XState synchronization.
-
-Protocol: __TASK_EVENT__:{...}
-"""
-
-from __future__ import annotations
-
-import json
-import os
-import sys
-from dataclasses import dataclass
-from datetime import datetime, timezone
-from pathlib import Path
-from uuid import uuid4
-
-TASK_EVENT_PREFIX = "__TASK_EVENT__:"
-_DEBUG = os.environ.get("DEBUG", "").lower() in ("1", "true", "yes")
-
-
-@dataclass
-class TaskEventContext:
-    task_id: str
-    spec_id: str
-    project_id: str
-    sequence_start: int = 0
-
-
-def _load_task_metadata(spec_dir: Path) -> dict:
-    metadata_path = spec_dir / "task_metadata.json"
-    if not metadata_path.exists():
-        return {}
-    try:
-        with open(metadata_path, encoding="utf-8") as f:
-            return json.load(f)
-    except (OSError, json.JSONDecodeError, UnicodeDecodeError):
-        return {}
-
-
-def _load_last_sequence(spec_dir: Path) -> int:
-    plan_path = spec_dir / "implementation_plan.json"
-    if not plan_path.exists():
-        return 0
-    try:
-        with open(plan_path, encoding="utf-8") as f:
-            plan = json.load(f)
-        last_event = plan.get("lastEvent") or {}
-        seq = last_event.get("sequence")
-        if isinstance(seq, int) and seq >= 0:
-            return seq + 1
-    except (OSError, json.JSONDecodeError, UnicodeDecodeError):
-        return 0
-    return 0
-
-
-def load_task_event_context(spec_dir: Path) -> TaskEventContext:
-    metadata = _load_task_metadata(spec_dir)
-    task_id = metadata.get("taskId") or metadata.get("task_id") or spec_dir.name
-    spec_id = metadata.get("specId") or metadata.get("spec_id") or spec_dir.name
-    project_id = metadata.get("projectId") or metadata.get("project_id") or ""
-    sequence_start = _load_last_sequence(spec_dir)
-    return TaskEventContext(
-        task_id=str(task_id),
-        spec_id=str(spec_id),
-        project_id=str(project_id),
-        sequence_start=sequence_start,
-    )
-
-
-class TaskEventEmitter:
-    def __init__(self, context: TaskEventContext) -> None:
-        self._context = context
-        self._sequence = context.sequence_start
-
-    @classmethod
-    def from_spec_dir(cls, spec_dir: Path) -> TaskEventEmitter:
-        return cls(load_task_event_context(spec_dir))
-
-    def emit(self, event_type: str, payload: dict | None = None) -> None:
-        event = {
-            "type": event_type,
-            "taskId": self._context.task_id,
-            "specId": self._context.spec_id,
-            "projectId": self._context.project_id,
-            "timestamp": datetime.now(timezone.utc).isoformat(),
-            "eventId": str(uuid4()),
-            "sequence": self._sequence,
-        }
-        if payload:
-            event.update(payload)
-
-        try:
-            print(f"{TASK_EVENT_PREFIX}{json.dumps(event, default=str)}", flush=True)
-            self._sequence += 1
-        except (OSError, UnicodeEncodeError) as e:
-            if _DEBUG:
-                try:
-                    sys.stderr.write(f"[task_event] emit failed: {e}\n")
-                    sys.stderr.flush()
-                except (OSError, UnicodeEncodeError):
-                    pass  # Silent on complete I/O failure

apps/backend/core/workspace/models.py

@@ -1,275 +0,0 @@
-#!/usr/bin/env python3
-"""
-Workspace Models
-================
-
-Data classes and enums for workspace management.
-"""
-
-from dataclasses import dataclass
-from enum import Enum
-from pathlib import Path
-
-
-class WorkspaceMode(Enum):
-    """How auto-claude should work."""
-
-    ISOLATED = "isolated"  # Work in a separate worktree (safe)
-    DIRECT = "direct"  # Work directly in user's project
-
-
-class WorkspaceChoice(Enum):
-    """User's choice after build completes."""
-
-    MERGE = "merge"  # Add changes to project
-    REVIEW = "review"  # Show what changed
-    TEST = "test"  # Test the feature in the staging worktree
-    LATER = "later"  # Decide later
-
-
-@dataclass
-class ParallelMergeTask:
-    """A file merge task to be executed in parallel."""
-
-    file_path: str
-    main_content: str
-    worktree_content: str
-    base_content: str | None
-    spec_name: str
-    project_dir: Path
-
-
-@dataclass
-class ParallelMergeResult:
-    """Result of a parallel merge task."""
-
-    file_path: str
-    merged_content: str | None
-    success: bool
-    error: str | None = None
-    was_auto_merged: bool = False  # True if git auto-merged without AI
-
-
-class MergeLockError(Exception):
-    """Raised when a merge lock cannot be acquired."""
-
-    pass
-
-
-class MergeLock:
-    """
-    Context manager for merge locking to prevent concurrent merges.
-
-    Uses a lock file in .auto-claude/ to ensure only one merge operation
-    runs at a time for a given project.
-    """
-
-    def __init__(self, project_dir: Path, spec_name: str):
-        self.project_dir = project_dir
-        self.spec_name = spec_name
-        self.lock_dir = project_dir / ".auto-claude" / ".locks"
-        self.lock_file = self.lock_dir / f"merge-{spec_name}.lock"
-        self.acquired = False
-
-    def __enter__(self):
-        """Acquire the merge lock."""
-        import os
-        import time
-
-        self.lock_dir.mkdir(parents=True, exist_ok=True)
-
-        # Try to acquire lock with timeout
-        max_wait = 30  # seconds
-        start_time = time.time()
-
-        while True:
-            try:
-                # Try to create lock file exclusively
-                fd = os.open(
-                    str(self.lock_file),
-                    os.O_CREAT | os.O_EXCL | os.O_WRONLY,
-                    0o644,
-                )
-                os.close(fd)
-
-                # Write our PID to the lock file
-                self.lock_file.write_text(str(os.getpid()), encoding="utf-8")
-                self.acquired = True
-                return self
-
-            except FileExistsError:
-                # Lock file exists - check if process is still running
-                if self.lock_file.exists():
-                    try:
-                        pid = int(self.lock_file.read_text(encoding="utf-8").strip())
-                        # Import locally to avoid circular dependency
-                        import os as _os
-
-                        try:
-                            _os.kill(pid, 0)
-                            is_running = True
-                        except (OSError, ProcessLookupError):
-                            is_running = False
-
-                        if not is_running:
-                            # Stale lock - remove it
-                            self.lock_file.unlink()
-                            continue
-                    except (ValueError, ProcessLookupError):
-                        # Invalid PID or can't check - remove stale lock
-                        self.lock_file.unlink()
-                        continue
-
-                # Active lock - wait or timeout
-                if time.time() - start_time >= max_wait:
-                    raise MergeLockError(
-                        f"Could not acquire merge lock for {self.spec_name} after {max_wait}s"
-                    )
-
-                time.sleep(0.5)
-
-    def __exit__(self, exc_type, exc_val, exc_tb):
-        """Release the merge lock."""
-        if self.acquired and self.lock_file.exists():
-            try:
-                self.lock_file.unlink()
-            except Exception:
-                pass  # Best effort cleanup
-
-
-class SpecNumberLockError(Exception):
-    """Raised when a spec number lock cannot be acquired."""
-
-    pass
-
-
-class SpecNumberLock:
-    """
-    Context manager for spec number coordination across main project and worktrees.
-
-    Prevents race conditions when creating specs by:
-    1. Acquiring an exclusive file lock
-    2. Scanning ALL spec locations (main + worktrees)
-    3. Finding global maximum spec number
-    4. Allowing atomic spec directory creation
-    5. Releasing lock
-    """
-
-    def __init__(self, project_dir: Path):
-        self.project_dir = project_dir
-        self.lock_dir = project_dir / ".auto-claude" / ".locks"
-        self.lock_file = self.lock_dir / "spec-numbering.lock"
-        self.acquired = False
-        self._global_max: int | None = None
-
-    def __enter__(self) -> "SpecNumberLock":
-        """Acquire the spec numbering lock."""
-        import os
-        import time
-
-        self.lock_dir.mkdir(parents=True, exist_ok=True)
-
-        max_wait = 30  # seconds
-        start_time = time.time()
-
-        while True:
-            try:
-                # Try to create lock file exclusively (atomic operation)
-                fd = os.open(
-                    str(self.lock_file),
-                    os.O_CREAT | os.O_EXCL | os.O_WRONLY,
-                    0o644,
-                )
-                os.close(fd)
-
-                # Write our PID to the lock file
-                self.lock_file.write_text(str(os.getpid()), encoding="utf-8")
-                self.acquired = True
-                return self
-
-            except FileExistsError:
-                # Lock file exists - check if process is still running
-                if self.lock_file.exists():
-                    try:
-                        pid = int(self.lock_file.read_text(encoding="utf-8").strip())
-                        import os as _os
-
-                        try:
-                            _os.kill(pid, 0)
-                            is_running = True
-                        except (OSError, ProcessLookupError):
-                            is_running = False
-
-                        if not is_running:
-                            # Stale lock - remove it
-                            self.lock_file.unlink()
-                            continue
-                    except (ValueError, ProcessLookupError):
-                        # Invalid PID or can't check - remove stale lock
-                        self.lock_file.unlink()
-                        continue
-
-                # Active lock - wait or timeout
-                if time.time() - start_time >= max_wait:
-                    raise SpecNumberLockError(
-                        f"Could not acquire spec numbering lock after {max_wait}s"
-                    )
-
-                time.sleep(0.1)  # Shorter sleep for spec creation
-
-    def __exit__(self, exc_type, exc_val, exc_tb):
-        """Release the spec numbering lock."""
-        if self.acquired and self.lock_file.exists():
-            try:
-                self.lock_file.unlink()
-            except Exception:
-                pass  # Best effort cleanup
-
-    def get_next_spec_number(self) -> int:
-        """
-        Scan all spec locations and return the next available spec number.
-
-        Must be called while lock is held.
-
-        Returns:
-            Next available spec number (global max + 1)
-        """
-        if not self.acquired:
-            raise SpecNumberLockError(
-                "Lock must be acquired before getting next spec number"
-            )
-
-        if self._global_max is not None:
-            return self._global_max + 1
-
-        max_number = 0
-
-        # 1. Scan main project specs
-        main_specs_dir = self.project_dir / ".auto-claude" / "specs"
-        max_number = max(max_number, self._scan_specs_dir(main_specs_dir))
-
-        # 2. Scan all worktree specs
-        worktrees_dir = self.project_dir / ".auto-claude" / "worktrees" / "tasks"
-        if worktrees_dir.exists():
-            for worktree in worktrees_dir.iterdir():
-                if worktree.is_dir():
-                    worktree_specs = worktree / ".auto-claude" / "specs"
-                    max_number = max(max_number, self._scan_specs_dir(worktree_specs))
-
-        self._global_max = max_number
-        return max_number + 1
-
-    def _scan_specs_dir(self, specs_dir: Path) -> int:
-        """Scan a specs directory and return the highest spec number found."""
-        if not specs_dir.exists():
-            return 0
-
-        max_num = 0
-        for folder in specs_dir.glob("[0-9][0-9][0-9]-*"):
-            try:
-                num = int(folder.name[:3])
-                max_num = max(max_num, num)
-            except ValueError:
-                pass
-
-        return max_num

apps/backend/core/workspace/tests/conftest.py

@@ -1,250 +0,0 @@
-#!/usr/bin/env python3
-"""
-Pytest Configuration and Shared Fixtures for Workspace Tests
-==============================================================
-
-Provides test fixtures for the workspace module tests.
-"""
-
-import os
-import shutil
-import subprocess
-import sys
-import tempfile
-from collections.abc import Generator
-from pathlib import Path
-from unittest.mock import MagicMock
-
-import pytest
-
-# =============================================================================
-# MODULE MOCK CLEANUP - Prevents test isolation issues
-# =============================================================================
-
-# List of modules that might be mocked by test files
-_POTENTIALLY_MOCKED_MODULES = [
-    "claude_code_sdk",
-    "claude_code_sdk.types",
-    "claude_agent_sdk",
-    "claude_agent_sdk.types",
-]
-
-# Store original module references at import time (BEFORE pre-mocking)
-_original_module_state = {}
-for _name in _POTENTIALLY_MOCKED_MODULES:
-    if _name in sys.modules:
-        _original_module_state[_name] = sys.modules[_name]
-
-
-# =============================================================================
-# PRE-MOCK EXTERNAL SDK MODULES - Must happen BEFORE adding auto-claude to path
-# =============================================================================
-# These SDK modules may not be installed, so we mock them before any imports
-# that might trigger loading code that depends on them.
-
-
-def _create_sdk_mock():
-    """Create a comprehensive mock for SDK modules."""
-    mock = MagicMock()
-    mock.ClaudeAgentOptions = MagicMock
-    mock.ClaudeSDKClient = MagicMock
-    mock.HookMatcher = MagicMock
-    return mock
-
-
-# Pre-mock claude_agent_sdk if not installed
-if "claude_agent_sdk" not in sys.modules:
-    sys.modules["claude_agent_sdk"] = _create_sdk_mock()
-    sys.modules["claude_agent_sdk.types"] = MagicMock()
-
-# Pre-mock claude_code_sdk if not installed
-if "claude_code_sdk" not in sys.modules:
-    sys.modules["claude_code_sdk"] = _create_sdk_mock()
-    sys.modules["claude_code_sdk.types"] = MagicMock()
-
-# Add backend directory to path for imports
-# When co-located at workspace/tests/, go up to backend directory
-# workspace/tests -> workspace -> core -> backend (4 levels up)
-_backend = Path(__file__).resolve().parent.parent.parent.parent
-sys.path.insert(0, str(_backend))
-
-# Add repo root to sys.path for test_fixtures import fallback
-_repo_root = _backend.parent.parent
-sys.path.insert(0, str(_repo_root))
-
-
-def _cleanup_mocked_modules():
-    """Remove any MagicMock modules from sys.modules."""
-    for name in _POTENTIALLY_MOCKED_MODULES:
-        if name in sys.modules:
-            module = sys.modules[name]
-            if isinstance(module, MagicMock):
-                if name in _original_module_state:
-                    sys.modules[name] = _original_module_state[name]
-                else:
-                    del sys.modules[name]
-
-
-def pytest_sessionstart(session):
-    """Clean up any mocked modules before the test session starts."""
-    _cleanup_mocked_modules()
-
-
-# =============================================================================
-# DIRECTORY FIXTURES
-# =============================================================================
-
-
-@pytest.fixture
-def temp_dir() -> Generator[Path, None, None]:
-    """Create a temporary directory that's cleaned up after the test."""
-    temp_path = Path(tempfile.mkdtemp())
-    yield temp_path
-    shutil.rmtree(temp_path, ignore_errors=True)
-
-
-@pytest.fixture
-def temp_git_repo(temp_dir: Path) -> Generator[Path, None, None]:
-    """Create a temporary git repository with initial commit.
-
-    IMPORTANT: This fixture properly isolates git operations by clearing
-    git environment variables that may be set by pre-commit hooks. Without
-    this isolation, git operations could affect the parent repository when
-    tests run inside a git worktree (e.g., during pre-commit validation).
-
-    See: https://git-scm.com/docs/git#_environment_variables
-    """
-    # Save original environment values to restore later
-    orig_env = {}
-
-    # These git env vars may be set by pre-commit hooks and MUST be cleared
-    # to avoid git operations affecting the parent repository instead of
-    # our isolated test repo. This is critical when running inside worktrees.
-    git_vars_to_clear = [
-        "GIT_DIR",
-        "GIT_WORK_TREE",
-        "GIT_INDEX_FILE",
-        "GIT_OBJECT_DIRECTORY",
-        "GIT_ALTERNATE_OBJECT_DIRECTORIES",
-    ]
-
-    # Clear interfering git environment variables
-    for key in git_vars_to_clear:
-        orig_env[key] = os.environ.get(key)
-        if key in os.environ:
-            del os.environ[key]
-
-    # Set GIT_CEILING_DIRECTORIES to prevent git from discovering parent .git
-    # directories. This is critical for test isolation when running inside
-    # another git repo (like during pre-commit hooks in worktrees).
-    orig_env["GIT_CEILING_DIRECTORIES"] = os.environ.get("GIT_CEILING_DIRECTORIES")
-    os.environ["GIT_CEILING_DIRECTORIES"] = str(temp_dir.parent)
-
-    try:
-        # Initialize git repo
-        subprocess.run(["git", "init"], cwd=temp_dir, capture_output=True, check=True)
-        subprocess.run(
-            ["git", "config", "user.email", "test@example.com"],
-            cwd=temp_dir,
-            capture_output=True,
-        )
-        subprocess.run(
-            ["git", "config", "user.name", "Test User"],
-            cwd=temp_dir,
-            capture_output=True,
-        )
-
-        # Create initial commit
-        test_file = temp_dir / "README.md"
-        test_file.write_text("# Test Project\n", encoding="utf-8")
-        subprocess.run(["git", "add", "."], cwd=temp_dir, capture_output=True)
-        subprocess.run(
-            ["git", "commit", "-m", "Initial commit"], cwd=temp_dir, capture_output=True
-        )
-
-        # Ensure branch is named 'main' (some git configs default to 'master')
-        subprocess.run(
-            ["git", "branch", "-M", "main"], cwd=temp_dir, capture_output=True
-        )
-
-        yield temp_dir
-    finally:
-        # Restore original environment variables
-        for key, value in orig_env.items():
-            if value is None:
-                os.environ.pop(key, None)
-            else:
-                os.environ[key] = value
-
-
-@pytest.fixture
-def spec_dir(temp_dir: Path) -> Path:
-    """Create a spec directory inside temp_dir."""
-    spec_path = temp_dir / "spec"
-    spec_path.mkdir(parents=True)
-    return spec_path
-
-
-@pytest.fixture
-def project_dir(temp_dir: Path) -> Path:
-    """Create a project directory inside temp_dir."""
-    project_path = temp_dir / "project"
-    project_path.mkdir(parents=True)
-    return project_path
-
-
-@pytest.fixture
-def make_commit(temp_git_repo: Path):
-    """Fixture to make commits in the test git repo.
-
-    Usage:
-        def test_something(make_commit):
-            make_commit("message", files={"file.txt": "content"})
-    """
-
-    def _make_commit(message: str, files: dict[str, str] | None = None):
-        """Create a commit with the given message and files.
-
-        Args:
-            message: Commit message
-            files: Optional dict of {filepath: content} to create before committing
-        """
-        if files:
-            for file_path, content in files.items():
-                full_path = temp_git_repo / file_path
-                full_path.parent.mkdir(parents=True, exist_ok=True)
-                full_path.write_text(content, encoding="utf-8")
-
-        subprocess.run(["git", "add", "."], cwd=temp_git_repo, capture_output=True)
-        subprocess.run(
-            ["git", "commit", "-m", message],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-
-    return _make_commit
-
-
-@pytest.fixture
-def stage_files(temp_git_repo: Path):
-    """Fixture to stage files in the test git repo.
-
-    Usage:
-        def test_something(stage_files):
-            stage_files({"file.txt": "content"})
-    """
-
-    def _stage_files(files: dict[str, str]):
-        """Stage files for commit.
-
-        Args:
-            files: Dict of {filepath: content} to create and stage
-        """
-        for file_path, content in files.items():
-            full_path = temp_git_repo / file_path
-            full_path.parent.mkdir(parents=True, exist_ok=True)
-            full_path.write_text(content, encoding="utf-8")
-
-        subprocess.run(["git", "add", "."], cwd=temp_git_repo, capture_output=True)
-
-    return _stage_files

apps/backend/core/workspace/tests/pytest.ini

@@ -1,10 +0,0 @@
-[pytest]
-# Pytest configuration for workspace module tests
-
-# Async test mode
-asyncio_mode = auto
-
-# Register custom markers
-markers =
-    slow: marks tests as slow (deselect with '-m "not slow"')
-    integration: marks tests as integration tests (deselect with '-m "not integration"')

apps/backend/core/workspace/tests/test_display.py

@@ -1,856 +0,0 @@
-#!/usr/bin/env python3
-"""
-Tests for Workspace Display Functions
-======================================
-
-Tests the display.py module functionality including:
-- Build summary display
-- Changed files display
-- Merge success printing
-- Conflict info display
-- Environment file operations
-- Node modules symlink operations
-"""
-
-import json
-import os
-import shutil
-import subprocess
-import sys
-from pathlib import Path
-
-import pytest
-
-# Test constant - in the new per-spec architecture, each spec has its own worktree
-# named after the spec itself. This constant is used for test assertions.
-TEST_SPEC_NAME = "test-spec"
-
-
-class TestShowBuildSummary:
-    """Tests for show_build_summary display function."""
-
-    def test_show_build_summary_no_changes(self, capsys):
-        """show_build_summary prints info message when no changes."""
-        from unittest.mock import MagicMock
-
-        from core.workspace.display import show_build_summary
-
-        mock_manager = MagicMock()
-        mock_manager.get_change_summary.return_value = {
-            "new_files": 0,
-            "modified_files": 0,
-            "deleted_files": 0,
-        }
-        mock_manager.get_changed_files.return_value = []
-
-        show_build_summary(mock_manager, "test-spec")
-
-        captured = capsys.readouterr()
-        assert "No changes were made" in captured.out
-
-    def test_show_build_summary_with_new_files(self, capsys):
-        """show_build_summary displays new files count correctly."""
-        from unittest.mock import MagicMock
-
-        from core.workspace.display import show_build_summary
-
-        mock_manager = MagicMock()
-        mock_manager.get_change_summary.return_value = {
-            "new_files": 3,
-            "modified_files": 0,
-            "deleted_files": 0,
-        }
-        mock_manager.get_changed_files.return_value = [
-            ("A", "file1.py"),
-            ("A", "file2.py"),
-            ("A", "file3.py"),
-        ]
-
-        show_build_summary(mock_manager, "test-spec")
-
-        captured = capsys.readouterr()
-        assert "What was built" in captured.out
-        assert "+ 3 new files" in captured.out
-
-    def test_show_build_summary_singular_new_file(self, capsys):
-        """show_build_summary uses singular form for one new file."""
-        from unittest.mock import MagicMock
-
-        from core.workspace.display import show_build_summary
-
-        mock_manager = MagicMock()
-        mock_manager.get_change_summary.return_value = {
-            "new_files": 1,
-            "modified_files": 0,
-            "deleted_files": 0,
-        }
-        mock_manager.get_changed_files.return_value = [("A", "file1.py")]
-
-        show_build_summary(mock_manager, "test-spec")
-
-        captured = capsys.readouterr()
-        assert "+ 1 new file" in captured.out
-        assert "files" not in captured.out.split("new file")[1].split("\n")[0]
-
-    def test_show_build_summary_with_modified_files(self, capsys):
-        """show_build_summary displays modified files count correctly."""
-        from unittest.mock import MagicMock
-
-        from core.workspace.display import show_build_summary
-
-        mock_manager = MagicMock()
-        mock_manager.get_change_summary.return_value = {
-            "new_files": 0,
-            "modified_files": 2,
-            "deleted_files": 0,
-        }
-        mock_manager.get_changed_files.return_value = [
-            ("M", "file1.py"),
-            ("M", "file2.py"),
-        ]
-
-        show_build_summary(mock_manager, "test-spec")
-
-        captured = capsys.readouterr()
-        assert "~ 2 modified files" in captured.out
-
-    def test_show_build_summary_with_deleted_files(self, capsys):
-        """show_build_summary displays deleted files count correctly."""
-        from unittest.mock import MagicMock
-
-        from core.workspace.display import show_build_summary
-
-        mock_manager = MagicMock()
-        mock_manager.get_change_summary.return_value = {
-            "new_files": 0,
-            "modified_files": 0,
-            "deleted_files": 1,
-        }
-        mock_manager.get_changed_files.return_value = [("D", "old.py")]
-
-        show_build_summary(mock_manager, "test-spec")
-
-        captured = capsys.readouterr()
-        assert "- 1 deleted file" in captured.out
-
-    def test_show_build_summary_mixed_changes(self, capsys):
-        """show_build_summary displays all change types together."""
-        from unittest.mock import MagicMock
-
-        from core.workspace.display import show_build_summary
-
-        mock_manager = MagicMock()
-        mock_manager.get_change_summary.return_value = {
-            "new_files": 2,
-            "modified_files": 3,
-            "deleted_files": 1,
-        }
-        mock_manager.get_changed_files.return_value = [
-            ("A", "new1.py"),
-            ("A", "new2.py"),
-            ("M", "mod1.py"),
-            ("M", "mod2.py"),
-            ("M", "mod3.py"),
-            ("D", "old.py"),
-        ]
-
-        show_build_summary(mock_manager, "test-spec")
-
-        captured = capsys.readouterr()
-        assert "+ 2 new files" in captured.out
-        assert "~ 3 modified files" in captured.out
-        assert "- 1 deleted file" in captured.out
-
-
-class TestShowChangedFiles:
-    """Tests for show_changed_files display function."""
-
-    def test_show_changed_files_empty_list(self, capsys):
-        """show_changed_files prints info message when no files changed."""
-        from unittest.mock import MagicMock
-
-        from core.workspace.display import show_changed_files
-
-        mock_manager = MagicMock()
-        mock_manager.get_changed_files.return_value = []
-
-        show_changed_files(mock_manager, "test-spec")
-
-        captured = capsys.readouterr()
-        assert "No changes" in captured.out
-
-    def test_show_changed_files_with_added_file(self, capsys):
-        """show_changed_files displays added file with + prefix."""
-        from unittest.mock import MagicMock
-
-        from core.workspace.display import show_changed_files
-
-        mock_manager = MagicMock()
-        mock_manager.get_changed_files.return_value = [("A", "new_file.py")]
-
-        show_changed_files(mock_manager, "test-spec")
-
-        captured = capsys.readouterr()
-        assert "Changed files" in captured.out
-        assert "+ new_file.py" in captured.out
-
-    def test_show_changed_files_with_modified_file(self, capsys):
-        """show_changed_files displays modified file with ~ prefix."""
-        from unittest.mock import MagicMock
-
-        from core.workspace.display import show_changed_files
-
-        mock_manager = MagicMock()
-        mock_manager.get_changed_files.return_value = [("M", "changed.py")]
-
-        show_changed_files(mock_manager, "test-spec")
-
-        captured = capsys.readouterr()
-        assert "~ changed.py" in captured.out
-
-    def test_show_changed_files_with_deleted_file(self, capsys):
-        """show_changed_files displays deleted file with - prefix."""
-        from unittest.mock import MagicMock
-
-        from core.workspace.display import show_changed_files
-
-        mock_manager = MagicMock()
-        mock_manager.get_changed_files.return_value = [("D", "removed.py")]
-
-        show_changed_files(mock_manager, "test-spec")
-
-        captured = capsys.readouterr()
-        assert "- removed.py" in captured.out
-
-    def test_show_changed_files_with_unknown_status(self, capsys):
-        """show_changed_files displays unknown status code without decoration."""
-        from unittest.mock import MagicMock
-
-        from core.workspace.display import show_changed_files
-
-        mock_manager = MagicMock()
-        mock_manager.get_changed_files.return_value = [("R", "renamed.py")]
-
-        show_changed_files(mock_manager, "test-spec")
-
-        captured = capsys.readouterr()
-        assert "R renamed.py" in captured.out
-
-    def test_show_changed_files_multiple_files(self, capsys):
-        """show_changed_files displays all changed files."""
-        from unittest.mock import MagicMock
-
-        from core.workspace.display import show_changed_files
-
-        mock_manager = MagicMock()
-        mock_manager.get_changed_files.return_value = [
-            ("A", "new.py"),
-            ("M", "modified.py"),
-            ("D", "deleted.py"),
-            ("R", "renamed.py"),
-        ]
-
-        show_changed_files(mock_manager, "test-spec")
-
-        captured = capsys.readouterr()
-        assert "+ new.py" in captured.out
-        assert "~ modified.py" in captured.out
-        assert "- deleted.py" in captured.out
-        assert "R renamed.py" in captured.out
-
-
-class TestPrintMergeSuccess:
-    """Tests for print_merge_success display function."""
-
-    def test_print_merge_success_no_commit_basic(self, capsys):
-        """print_merge_success with no_commit=True shows basic message."""
-        from core.workspace.display import print_merge_success
-
-        print_merge_success(no_commit=True)
-
-        captured = capsys.readouterr()
-        assert "CHANGES ADDED TO YOUR PROJECT" in captured.out
-        assert "working directory" in captured.out
-        assert "Review the changes" in captured.out
-        assert "commit when ready" in captured.out
-
-    def test_print_merge_success_no_commit_with_lock_files(self, capsys):
-        """print_merge_success with lock_files_excluded shows lock file note."""
-        from core.workspace.display import print_merge_success
-
-        stats = {"lock_files_excluded": 2}
-        print_merge_success(no_commit=True, stats=stats)
-
-        captured = capsys.readouterr()
-        assert "CHANGES ADDED TO YOUR PROJECT" in captured.out
-        assert "Lock files kept from main" in captured.out
-        assert "npm install" in captured.out
-
-    def test_print_merge_success_no_commit_with_keep_worktree(self, capsys):
-        """print_merge_success with keep_worktree shows discard command."""
-        from core.workspace.display import print_merge_success
-
-        print_merge_success(no_commit=True, spec_name="spec-001", keep_worktree=True)
-
-        captured = capsys.readouterr()
-        assert "CHANGES ADDED TO YOUR PROJECT" in captured.out
-        assert "Worktree kept for testing" in captured.out
-        assert "python auto-claude/run.py --spec spec-001 --discard" in captured.out
-
-    def test_print_merge_success_no_commit_full_scenario(self, capsys):
-        """print_merge_success with all optional parameters."""
-        from core.workspace.display import print_merge_success
-
-        stats = {"lock_files_excluded": 1}
-        print_merge_success(
-            no_commit=True,
-            stats=stats,
-            spec_name="test-spec",
-            keep_worktree=True,
-        )
-
-        captured = capsys.readouterr()
-        assert "CHANGES ADDED TO YOUR PROJECT" in captured.out
-        assert "Lock files kept from main" in captured.out
-        assert "Worktree kept for testing" in captured.out
-        assert "--spec test-spec --discard" in captured.out
-
-    def test_print_merge_success_with_commit_basic(self, capsys):
-        """print_merge_success with no_commit=False shows commit message."""
-        from core.workspace.display import print_merge_success
-
-        print_merge_success(no_commit=False)
-
-        captured = capsys.readouterr()
-        assert "FEATURE ADDED TO YOUR PROJECT" in captured.out
-        assert "separate workspace has been cleaned up" in captured.out
-
-    def test_print_merge_success_with_commit_and_stats(self, capsys):
-        """print_merge_success with stats shows file counts."""
-        from core.workspace.display import print_merge_success
-
-        stats = {
-            "files_added": 5,
-            "files_modified": 3,
-            "files_deleted": 1,
-        }
-        print_merge_success(no_commit=False, stats=stats)
-
-        captured = capsys.readouterr()
-        assert "FEATURE ADDED TO YOUR PROJECT" in captured.out
-        assert "What changed" in captured.out
-        assert "+ 5 files added" in captured.out
-        assert "~ 3 files modified" in captured.out
-        assert "- 1 file deleted" in captured.out
-
-    def test_print_merge_success_singular_file_counts(self, capsys):
-        """print_merge_success uses singular form for single file counts."""
-        from core.workspace.display import print_merge_success
-
-        stats = {
-            "files_added": 1,
-            "files_modified": 1,
-            "files_deleted": 1,
-        }
-        print_merge_success(no_commit=False, stats=stats)
-
-        captured = capsys.readouterr()
-        assert "+ 1 file added" in captured.out
-        assert "~ 1 file modified" in captured.out
-        assert "- 1 file deleted" in captured.out
-
-    def test_print_merge_success_with_keep_worktree(self, capsys):
-        """print_merge_success with keep_worktree shows discard command."""
-        from core.workspace.display import print_merge_success
-
-        print_merge_success(no_commit=False, keep_worktree=True, spec_name="my-spec")
-
-        captured = capsys.readouterr()
-        assert "FEATURE ADDED TO YOUR PROJECT" in captured.out
-        assert "Worktree kept for testing" in captured.out
-        assert "--spec my-spec --discard" in captured.out
-        assert "separate workspace has been cleaned up" not in captured.out
-
-    def test_print_merge_success_zero_file_counts_not_shown(self, capsys):
-        """print_merge_success doesn't show file types with zero count."""
-        from core.workspace.display import print_merge_success
-
-        stats = {
-            "files_added": 2,
-            "files_modified": 0,
-            "files_deleted": 0,
-        }
-        print_merge_success(no_commit=False, stats=stats)
-
-        captured = capsys.readouterr()
-        assert "+ 2 files added" in captured.out
-        assert "files modified" not in captured.out
-        assert "files deleted" not in captured.out
-
-
-class TestPrintConflictInfoExtended:
-    """Extended tests for print_conflict_info display function."""
-
-    def test_print_conflict_info_empty_conflicts(self, capsys):
-        """print_conflict_info returns early with empty conflicts list."""
-        from core.workspace.display import print_conflict_info
-
-        result = {"conflicts": []}
-
-        print_conflict_info(result)
-
-        captured = capsys.readouterr()
-        assert captured.out == ""
-
-    def test_print_conflict_info_no_conflicts_key(self, capsys):
-        """print_conflict_info returns early when conflicts key missing."""
-        from core.workspace.display import print_conflict_info
-
-        result = {}
-
-        print_conflict_info(result)
-
-        captured = capsys.readouterr()
-        assert captured.out == ""
-
-    def test_print_conflict_info_critical_severity(self, capsys):
-        """print_conflict_info shows critical severity icon."""
-        from core.workspace.display import print_conflict_info
-
-        result = {
-            "conflicts": [
-                {
-                    "file": "critical.py",
-                    "reason": "Breaking change",
-                    "severity": "critical",
-                }
-            ]
-        }
-
-        print_conflict_info(result)
-
-        captured = capsys.readouterr()
-        assert "critical.py" in captured.out
-        assert "⛔" in captured.out
-        assert "Breaking change" in captured.out
-
-    def test_print_conflict_info_high_severity(self, capsys):
-        """print_conflict_info shows high severity icon."""
-        from core.workspace.display import print_conflict_info
-
-        result = {
-            "conflicts": [
-                {"file": "high.py", "reason": "Major conflict", "severity": "high"}
-            ]
-        }
-
-        print_conflict_info(result)
-
-        captured = capsys.readouterr()
-        assert "high.py" in captured.out
-        assert "🔴" in captured.out
-        assert "Major conflict" in captured.out
-
-    def test_print_conflict_info_medium_severity(self, capsys):
-        """print_conflict_info shows medium severity icon."""
-        from core.workspace.display import print_conflict_info
-
-        result = {
-            "conflicts": [
-                {"file": "medium.py", "reason": "Minor conflict", "severity": "medium"}
-            ]
-        }
-
-        print_conflict_info(result)
-
-        captured = capsys.readouterr()
-        assert "medium.py" in captured.out
-        assert "🟡" in captured.out
-        assert "Minor conflict" in captured.out
-
-    def test_print_conflict_info_low_severity_no_icon(self, capsys):
-        """print_conflict_info shows no icon for low severity."""
-        from core.workspace.display import print_conflict_info
-
-        result = {
-            "conflicts": [
-                {"file": "low.py", "reason": "Trivial issue", "severity": "low"}
-            ]
-        }
-
-        print_conflict_info(result)
-
-        captured = capsys.readouterr()
-        assert "low.py" in captured.out
-        assert "Trivial issue" in captured.out
-        assert "⛔" not in captured.out
-        assert "🔴" not in captured.out
-        assert "🟡" not in captured.out
-
-    def test_print_conflict_info_unknown_severity(self, capsys):
-        """print_conflict_info handles unknown severity gracefully."""
-        from core.workspace.display import print_conflict_info
-
-        result = {
-            "conflicts": [
-                {"file": "unknown.py", "reason": "Unknown", "severity": "unknown"}
-            ]
-        }
-
-        print_conflict_info(result)
-
-        captured = capsys.readouterr()
-        assert "unknown.py" in captured.out
-        assert "Unknown" in captured.out
-
-    def test_print_conflict_info_missing_file_key(self, capsys):
-        """print_conflict_info handles missing file key."""
-        from core.workspace.display import print_conflict_info
-
-        result = {"conflicts": [{"reason": "No file specified", "severity": "high"}]}
-
-        print_conflict_info(result)
-
-        captured = capsys.readouterr()
-        assert "unknown" in captured.out
-        assert "No file specified" in captured.out
-
-    def test_print_conflict_info_missing_reason_key(self, capsys):
-        """print_conflict_info handles missing reason key."""
-        from core.workspace.display import print_conflict_info
-
-        result = {"conflicts": [{"file": "noreason.py", "severity": "medium"}]}
-
-        print_conflict_info(result)
-
-        captured = capsys.readouterr()
-        assert "noreason.py" in captured.out
-
-    def test_print_conflict_info_dict_no_reason(self, capsys):
-        """print_conflict_info with dict missing reason."""
-        from core.workspace.display import print_conflict_info
-
-        result = {"conflicts": [{"file": "test.py", "severity": "high"}]}
-
-        print_conflict_info(result)
-
-        captured = capsys.readouterr()
-        assert "test.py" in captured.out
-        assert "🔴" in captured.out
-
-    def test_print_conflict_info_multiple_conflicts(self, capsys):
-        """print_conflict_info handles multiple conflicts."""
-        from core.workspace.display import print_conflict_info
-
-        result = {
-            "conflicts": [
-                {"file": "critical.py", "reason": "Critical", "severity": "critical"},
-                {"file": "high.py", "reason": "High", "severity": "high"},
-                {"file": "medium.py", "reason": "Medium", "severity": "medium"},
-            ]
-        }
-
-        print_conflict_info(result)
-
-        captured = capsys.readouterr()
-        assert "3 file" in captured.out
-        assert "⛔" in captured.out
-        assert "🔴" in captured.out
-        assert "🟡" in captured.out
-
-    def test_print_conflict_info_shows_marker_conflict_message(self, capsys):
-        """print_conflict_info shows marker conflict message for string conflicts."""
-        from core.workspace.display import print_conflict_info
-
-        result = {"conflicts": ["conflict.py"]}
-
-        print_conflict_info(result)
-
-        captured = capsys.readouterr()
-        assert "conflict markers" in captured.out
-        # Check that the conflict markers are mentioned in the message
-
-    def test_print_conflict_info_shows_ai_conflict_message(self, capsys):
-        """print_conflict_info shows AI conflict message for dict conflicts."""
-        from core.workspace.display import print_conflict_info
-
-        result = {
-            "conflicts": [
-                {
-                    "file": "ai-conflict.py",
-                    "reason": "AI merge failed",
-                    "severity": "high",
-                }
-            ]
-        }
-
-        print_conflict_info(result)
-
-        captured = capsys.readouterr()
-        assert "could not be auto-merged" in captured.out
-
-    def test_print_conflict_info_shows_both_messages_mixed(self, capsys):
-        """print_conflict_info shows both messages for mixed conflicts."""
-        from core.workspace.display import print_conflict_info
-
-        result = {
-            "conflicts": [
-                "marker.py",
-                {"file": "ai.py", "reason": "AI failed", "severity": "high"},
-            ]
-        }
-
-        print_conflict_info(result)
-
-        captured = capsys.readouterr()
-        assert "conflict markers" in captured.out
-        assert "could not be auto-merged" in captured.out
-
-    def test_print_conflict_info_shows_git_commands(self, capsys):
-        """print_conflict_info shows git add and commit commands."""
-        from core.workspace.display import print_conflict_info
-
-        result = {"conflicts": ["file1.py", "file2.py"]}
-
-        print_conflict_info(result)
-
-        captured = capsys.readouterr()
-        assert "git add" in captured.out
-        assert "git commit" in captured.out
-
-    def test_print_conflict_info_quotes_special_paths(self, capsys):
-        """print_conflict_info properly quotes file paths with special characters."""
-        from core.workspace.display import print_conflict_info
-
-        result = {"conflicts": ["file with spaces.py", "file'with'quotes.py"]}
-
-        print_conflict_info(result)
-
-        captured = capsys.readouterr()
-        # shlex.quote should quote paths with spaces
-        assert "git add" in captured.out
-        assert "file with spaces.py" in captured.out
-
-    def test_print_conflict_info_deduplicates_files(self, capsys):
-        """print_conflict_info deduplicates file paths in git command."""
-        from core.workspace.display import print_conflict_info
-
-        result = {
-            "conflicts": [
-                "file1.py",
-                {"file": "file1.py", "reason": "Also here", "severity": "medium"},
-                "file2.py",
-            ]
-        }
-
-        print_conflict_info(result)
-
-        captured = capsys.readouterr()
-        # Count occurrences of file1.py
-        count = captured.out.count("file1.py")
-        assert count == 3  # Display shows it twice (string + dict), once in git add
-
-    def test_print_conflict_info_preserves_order(self, capsys):
-        """print_conflict_info preserves file order while deduplicating."""
-        from core.workspace.display import print_conflict_info
-
-        result = {
-            "conflicts": [
-                "first.py",
-                {"file": "second.py", "severity": "high"},
-                "first.py",  # Duplicate
-                {"file": "third.py", "severity": "medium"},
-            ]
-        }
-
-        print_conflict_info(result)
-
-        captured = capsys.readouterr()
-        # First occurrence should be preserved
-        lines = captured.out.split("\n")
-        first_idx = None
-        second_idx = None
-        for i, line in enumerate(lines):
-            if "first.py" in line:
-                if first_idx is None:
-                    first_idx = i
-            if "second.py" in line:
-                if second_idx is None:
-                    second_idx = i
-        assert first_idx is not None
-        assert second_idx is not None
-
-
-class TestCopyEnvFilesToWorktree:
-    """Tests for copy_env_files_to_worktree function."""
-
-    def test_copies_all_env_files(self, temp_git_repo: Path):
-        """Copies all .env files when they exist in project dir."""
-        from core.workspace.setup import copy_env_files_to_worktree
-
-        # Create .env files in project
-        (temp_git_repo / ".env").write_text("FOO=bar", encoding="utf-8")
-        (temp_git_repo / ".env.local").write_text("LOCAL=1", encoding="utf-8")
-        (temp_git_repo / ".env.development").write_text("DEV=1", encoding="utf-8")
-
-        # Create worktree directory
-        worktree_path = (
-            temp_git_repo / ".auto-claude" / "worktrees" / "tasks" / "test-spec"
-        )
-        worktree_path.mkdir(parents=True)
-
-        # Copy env files
-        copied = copy_env_files_to_worktree(temp_git_repo, worktree_path)
-
-        # Check all files were copied
-        assert ".env" in copied
-        assert ".env.local" in copied
-        assert ".env.development" in copied
-        assert len(copied) == 3
-
-        # Verify files exist in worktree
-        assert (worktree_path / ".env").exists()
-        assert (worktree_path / ".env.local").exists()
-        assert (worktree_path / ".env.development").exists()
-
-    def test_skips_nonexistent_env_files(self, temp_git_repo: Path):
-        """Only copies env files that exist."""
-        from core.workspace.setup import copy_env_files_to_worktree
-
-        worktree_path = (
-            temp_git_repo / ".auto-claude" / "worktrees" / "tasks" / "test-spec"
-        )
-        worktree_path.mkdir(parents=True)
-
-        copied = copy_env_files_to_worktree(temp_git_repo, worktree_path)
-
-        assert len(copied) == 0
-
-    def test_does_not_overwrite_existing_env_files(self, temp_git_repo: Path):
-        """Does not overwrite .env files that already exist in worktree."""
-        from core.workspace.setup import copy_env_files_to_worktree
-
-        # Create .env in project
-        (temp_git_repo / ".env").write_text("PROJECT=1", encoding="utf-8")
-
-        worktree_path = (
-            temp_git_repo / ".auto-claude" / "worktrees" / "tasks" / "test-spec"
-        )
-        worktree_path.mkdir(parents=True)
-
-        # Create existing .env in worktree with different content
-        (worktree_path / ".env").write_text("WORKTREE=1", encoding="utf-8")
-
-        copied = copy_env_files_to_worktree(temp_git_repo, worktree_path)
-
-        # .env should not be in copied list since it already existed
-        assert ".env" not in copied
-
-        # Worktree .env should keep its original content
-        assert (worktree_path / ".env").read_text(encoding="utf-8") == "WORKTREE=1"
-
-
-class TestSymlinkNodeModulesToWorktree:
-    """Tests for symlink_node_modules_to_worktree function."""
-
-    @pytest.mark.skipif(sys.platform != "linux", reason="Unix-specific test")
-    def test_symlinks_node_modules_on_unix(self, temp_git_repo: Path):
-        """Creates relative symlinks on Unix systems."""
-        from core.workspace.setup import symlink_node_modules_to_worktree
-
-        # Create node_modules in project
-        node_modules = temp_git_repo / "node_modules"
-        node_modules.mkdir()
-        (node_modules / "test.txt").write_text("test", encoding="utf-8")
-
-        # Create apps/frontend/node_modules
-        frontend_node_modules = temp_git_repo / "apps" / "frontend" / "node_modules"
-        frontend_node_modules.mkdir(parents=True)
-        (frontend_node_modules / "test2.txt").write_text("test2", encoding="utf-8")
-
-        # Create worktree
-        worktree_path = (
-            temp_git_repo / ".auto-claude" / "worktrees" / "tasks" / "test-spec"
-        )
-        worktree_path.mkdir(parents=True)
-        (worktree_path / "apps" / "frontend").mkdir(parents=True)
-
-        # Create symlinks
-        symlinked = symlink_node_modules_to_worktree(temp_git_repo, worktree_path)
-
-        assert len(symlinked) == 2
-        assert "node_modules" in symlinked
-        assert "apps/frontend/node_modules" in symlinked
-
-        # Verify symlinks exist and point to correct location
-        assert (worktree_path / "node_modules").is_symlink()
-        assert (worktree_path / "apps" / "frontend" / "node_modules").is_symlink()
-
-    @pytest.mark.skipif(sys.platform != "win32", reason="Windows-specific test")
-    def test_creates_junctions_on_windows(self, temp_git_repo: Path, monkeypatch):
-        """Creates junctions on Windows systems."""
-        from unittest.mock import patch
-
-        from core.workspace.setup import symlink_node_modules_to_worktree
-
-        # Create node_modules in project
-        node_modules = temp_git_repo / "node_modules"
-        node_modules.mkdir()
-        (node_modules / "test.txt").write_text("test", encoding="utf-8")
-
-        # Create worktree
-        worktree_path = (
-            temp_git_repo / ".auto-claude" / "worktrees" / "tasks" / "test-spec"
-        )
-        worktree_path.mkdir(parents=True)
-
-        # Mock subprocess.run to simulate mklink /J success
-        def mock_subprocess_run(cmd, capture_output=False, text=False):
-            result = type("obj", (object,), {"returncode": 0, "stderr": ""})()
-            return result
-
-        with patch("subprocess.run", side_effect=mock_subprocess_run):
-            with monkeypatch.context() as m:
-                m.setattr("sys.platform", "win32")
-                symlinked = symlink_node_modules_to_worktree(
-                    temp_git_repo, worktree_path
-                )
-
-        assert "node_modules" in symlinked
-
-    def test_skips_nonexistent_node_modules(self, temp_git_repo: Path):
-        """Skips node_modules that don't exist in project."""
-        from core.workspace.setup import symlink_node_modules_to_worktree
-
-        worktree_path = (
-            temp_git_repo / ".auto-claude" / "worktrees" / "tasks" / "test-spec"
-        )
-        worktree_path.mkdir(parents=True)
-
-        symlinked = symlink_node_modules_to_worktree(temp_git_repo, worktree_path)
-
-        assert len(symlinked) == 0
-
-    def test_skips_existing_symlinks(self, temp_git_repo: Path):
-        """Does not recreate symlinks that already exist."""
-        from core.workspace.setup import symlink_node_modules_to_worktree
-
-        # Create node_modules in project
-        node_modules = temp_git_repo / "node_modules"
-        node_modules.mkdir()
-        (node_modules / "test.txt").write_text("test", encoding="utf-8")
-
-        # Create worktree
-        worktree_path = (
-            temp_git_repo / ".auto-claude" / "worktrees" / "tasks" / "test-spec"
-        )
-        worktree_path.mkdir(parents=True)
-
-        # Create existing symlink
-        if sys.platform != "win32":
-            os.symlink(temp_git_repo / "node_modules", worktree_path / "node_modules")
-
-        symlinked = symlink_node_modules_to_worktree(temp_git_repo, worktree_path)
-
-        # Should skip existing symlink
-        assert "node_modules" not in symlinked

apps/backend/core/workspace/tests/test_finalization.py

@@ -1,805 +0,0 @@
-#!/usr/bin/env python3
-"""
-Tests for Workspace Selection and Management
-=============================================
-
-Tests the workspace.py module functionality including:
-- Workspace mode selection (isolated vs direct)
-- Uncommitted changes detection
-- Workspace setup
-- Build finalization workflows
-"""
-
-import json
-import os
-import shutil
-import subprocess
-import sys
-from pathlib import Path
-
-import pytest
-
-# Add parent directory to path so we can import the workspace module
-# When co-located at workspace/tests/, we need to add backend to path
-# workspace/tests -> workspace -> core -> backend (4 levels up)
-_backend = Path(__file__).resolve().parent.parent.parent.parent
-sys.path.insert(0, str(_backend))
-
-from core.workspace import (
-    WorkspaceChoice,
-    WorkspaceMode,
-    get_current_branch,
-    get_existing_build_worktree,
-    has_uncommitted_changes,
-    setup_workspace,
-)
-from worktree import WorktreeError, WorktreeManager
-
-# Test constant - in the new per-spec architecture, each spec has its own worktree
-# named after the spec itself. This constant is used for test assertions.
-TEST_SPEC_NAME = "test-spec"
-
-# =============================================================================
-# TESTS FOR finalization.py
-# =============================================================================
-
-
-class TestFinalizeWorkspace:
-    """Tests for finalize_workspace function."""
-
-    def test_direct_mode_returns_merge(self, temp_git_repo: Path, monkeypatch, capsys):
-        """Direct mode returns MERGE choice and shows completion message."""
-        from core.workspace.finalization import finalize_workspace
-
-        # Mock the UI functions
-        def mock_box(content, width=60, style="heavy"):
-            return content
-
-        monkeypatch.setattr("core.workspace.finalization.box", mock_box)
-
-        result = finalize_workspace(
-            temp_git_repo,
-            "test-spec",
-            manager=None,
-            auto_continue=False,
-        )
-
-        assert result == WorkspaceChoice.MERGE
-
-        captured = capsys.readouterr()
-        assert "BUILD COMPLETE" in captured.out
-        assert "directly to your project" in captured.out
-
-    def test_auto_continue_mode_returns_later(self, temp_git_repo: Path):
-        """Auto-continue mode returns LATER choice."""
-        from core.workspace.finalization import finalize_workspace
-
-        manager = WorktreeManager(temp_git_repo)
-        spec_name = "test-spec"
-
-        # Create worktree info
-        worktrees_dir = temp_git_repo / ".auto-claude" / "worktrees" / "tasks"
-        worktrees_dir.mkdir(parents=True)
-        worktree_path = worktrees_dir / spec_name
-        worktree_path.mkdir(parents=True)
-
-        result = finalize_workspace(
-            temp_git_repo,
-            spec_name,
-            manager=manager,
-            auto_continue=True,
-        )
-
-        assert result == WorkspaceChoice.LATER
-
-    def test_isolated_mode_shows_menu(self, temp_git_repo: Path, monkeypatch):
-        """Isolated mode shows menu with test/review/merge/later options."""
-        from core.workspace.finalization import finalize_workspace
-
-        manager = WorktreeManager(temp_git_repo)
-        spec_name = "test-spec"
-
-        # Create worktree
-        worktrees_dir = temp_git_repo / ".auto-claude" / "worktrees" / "tasks"
-        worktrees_dir.mkdir(parents=True)
-        worktree_path = worktrees_dir / spec_name
-        worktree_path.mkdir(parents=True)
-
-        # Mock select_menu to return "test"
-        def mock_select_menu(title, options, allow_quit):
-            return "test"
-
-        monkeypatch.setattr("core.workspace.finalization.select_menu", mock_select_menu)
-
-        result = finalize_workspace(
-            temp_git_repo,
-            spec_name,
-            manager=manager,
-            auto_continue=False,
-        )
-
-        assert result == WorkspaceChoice.TEST
-
-
-class TestHandleWorkspaceChoice:
-    """Tests for handle_workspace_choice function."""
-
-    def test_choice_test_shows_instructions(
-        self, temp_git_repo: Path, monkeypatch, capsys
-    ):
-        """TEST choice shows testing instructions."""
-        from core.workspace.finalization import handle_workspace_choice
-
-        manager = WorktreeManager(temp_git_repo)
-        spec_name = "test-spec"
-
-        # Create worktree
-        worktrees_dir = temp_git_repo / ".auto-claude" / "worktrees" / "tasks"
-        worktrees_dir.mkdir(parents=True)
-        worktree_path = worktrees_dir / spec_name
-        worktree_path.mkdir(parents=True)
-
-        handle_workspace_choice(WorkspaceChoice.TEST, temp_git_repo, spec_name, manager)
-
-        captured = capsys.readouterr()
-        assert "TEST YOUR FEATURE" in captured.out
-        assert str(worktree_path) in captured.out
-
-    def test_choice_merge_calls_merge_worktree(
-        self, temp_git_repo: Path, monkeypatch, capsys
-    ):
-        """MERGE choice calls manager.merge_worktree."""
-        from core.workspace.finalization import handle_workspace_choice
-
-        manager = WorktreeManager(temp_git_repo)
-        spec_name = "test-spec"
-
-        # Create worktree and commit something
-        worktrees_dir = temp_git_repo / ".auto-claude" / "worktrees" / "tasks"
-        worktrees_dir.mkdir(parents=True)
-        worktree_path = worktrees_dir / spec_name
-        worktree_path.mkdir(parents=True)
-        (worktree_path / "test.py").write_text("test", encoding="utf-8")
-
-        # Initialize git in worktree and commit
-        subprocess.run(["git", "init"], cwd=worktree_path, capture_output=True)
-        subprocess.run(
-            ["git", "config", "user.email", "test@example.com"],
-            cwd=worktree_path,
-            capture_output=True,
-        )
-        subprocess.run(
-            ["git", "config", "user.name", "Test"],
-            cwd=worktree_path,
-            capture_output=True,
-        )
-        subprocess.run(["git", "add", "."], cwd=worktree_path, capture_output=True)
-        subprocess.run(
-            ["git", "commit", "-m", "Test"], cwd=worktree_path, capture_output=True
-        )
-
-        handle_workspace_choice(
-            WorkspaceChoice.MERGE, temp_git_repo, spec_name, manager
-        )
-
-        captured = capsys.readouterr()
-        assert "Adding changes" in captured.out
-
-    def test_choice_review_shows_changed_files(
-        self, temp_git_repo: Path, monkeypatch, capsys
-    ):
-        """REVIEW choice shows changed files."""
-        from core.workspace.finalization import handle_workspace_choice
-
-        manager = WorktreeManager(temp_git_repo)
-        spec_name = "test-spec"
-
-        # Create worktree
-        worktrees_dir = temp_git_repo / ".auto-claude" / "worktrees" / "tasks"
-        worktrees_dir.mkdir(parents=True)
-        worktree_path = worktrees_dir / spec_name
-        worktree_path.mkdir(parents=True)
-
-        # Mock show_changed_files
-        mock_shown = []
-
-        def mock_show_changed_files(manager, spec_name):
-            mock_shown.append(spec_name)
-
-        monkeypatch.setattr(
-            "core.workspace.finalization.show_changed_files", mock_show_changed_files
-        )
-
-        handle_workspace_choice(
-            WorkspaceChoice.REVIEW, temp_git_repo, spec_name, manager
-        )
-
-        assert len(mock_shown) == 1
-        assert mock_shown[0] == spec_name
-
-        captured = capsys.readouterr()
-        assert "To see full details" in captured.out
-
-    def test_choice_later_shows_deferred_message(
-        self, temp_git_repo: Path, monkeypatch, capsys
-    ):
-        """LATER choice shows deferral message."""
-        from core.workspace.finalization import handle_workspace_choice
-
-        manager = WorktreeManager(temp_git_repo)
-        spec_name = "test-spec"
-
-        # Create worktree
-        worktrees_dir = temp_git_repo / ".auto-claude" / "worktrees" / "tasks"
-        worktrees_dir.mkdir(parents=True)
-        worktree_path = worktrees_dir / spec_name
-        worktree_path.mkdir(parents=True)
-
-        handle_workspace_choice(
-            WorkspaceChoice.LATER, temp_git_repo, spec_name, manager
-        )
-
-        captured = capsys.readouterr()
-        assert "No problem!" in captured.out
-        assert "saved" in captured.out
-
-
-class TestReviewExistingBuild:
-    """Tests for review_existing_build function."""
-
-    def test_no_existing_build_shows_warning(self, temp_git_repo: Path, capsys):
-        """Shows warning when no existing build found."""
-        from core.workspace.finalization import review_existing_build
-
-        result = review_existing_build(temp_git_repo, "nonexistent-spec")
-
-        assert result is False
-
-        captured = capsys.readouterr()
-        assert "No existing build found" in captured.out
-
-    def test_shows_build_contents(self, temp_git_repo: Path, capsys):
-        """Shows build summary and changed files when build exists."""
-        from core.workspace.finalization import review_existing_build
-
-        spec_name = "test-spec"
-        worktrees_dir = temp_git_repo / ".auto-claude" / "worktrees" / "tasks"
-        worktrees_dir.mkdir(parents=True)
-        worktree_path = worktrees_dir / spec_name
-        worktree_path.mkdir(parents=True)
-
-        result = review_existing_build(temp_git_repo, spec_name)
-
-        assert result is True
-
-        captured = capsys.readouterr()
-        assert "BUILD CONTENTS" in captured.out
-
-
-class TestDiscardExistingBuild:
-    """Tests for discard_existing_build function."""
-
-    def test_no_existing_build_returns_false(self, temp_git_repo: Path, capsys):
-        """Returns False when no existing build found."""
-        from core.workspace.finalization import discard_existing_build
-
-        result = discard_existing_build(temp_git_repo, "nonexistent-spec")
-
-        assert result is False
-
-        captured = capsys.readouterr()
-        assert "No existing build found" in captured.out
-
-    def test_confirmation_deletes_build(self, temp_git_repo: Path, monkeypatch, capsys):
-        """Deletes build when user types 'delete' to confirm."""
-        from core.workspace.finalization import discard_existing_build
-
-        spec_name = "test-spec"
-        worktrees_dir = temp_git_repo / ".auto-claude" / "worktrees" / "tasks"
-        worktrees_dir.mkdir(parents=True)
-        worktree_path = worktrees_dir / spec_name
-        worktree_path.mkdir(parents=True)
-
-        # Mock input to return "delete"
-        monkeypatch.setattr("builtins.input", lambda: "delete")
-
-        result = discard_existing_build(temp_git_repo, spec_name)
-
-        assert result is True
-        captured = capsys.readouterr()
-        assert "Build deleted" in captured.out
-
-    def test_cancelled_confirmation_returns_false(
-        self, temp_git_repo: Path, monkeypatch, capsys
-    ):
-        """Returns False when user doesn't confirm."""
-        from core.workspace.finalization import discard_existing_build
-
-        spec_name = "test-spec"
-        worktrees_dir = temp_git_repo / ".auto-claude" / "worktrees" / "tasks"
-        worktrees_dir.mkdir(parents=True)
-        worktree_path = worktrees_dir / spec_name
-        worktree_path.mkdir(parents=True)
-
-        # Mock input to return "no"
-        monkeypatch.setattr("builtins.input", lambda: "no")
-
-        result = discard_existing_build(temp_git_repo, spec_name)
-
-        assert result is False
-        captured = capsys.readouterr()
-        assert "Cancelled" in captured.out
-
-
-class TestCheckExistingBuild:
-    """Tests for check_existing_build function."""
-
-    def test_no_existing_build_returns_false(self, temp_git_repo: Path):
-        """Returns False when no existing build."""
-        from core.workspace.finalization import check_existing_build
-
-        result = check_existing_build(temp_git_repo, "nonexistent-spec")
-
-        assert result is False
-
-    def test_shows_menu_for_existing_build(self, temp_git_repo: Path, monkeypatch):
-        """Shows menu when existing build found."""
-        from core.workspace.finalization import check_existing_build
-
-        spec_name = "test-spec"
-        worktrees_dir = temp_git_repo / ".auto-claude" / "worktrees" / "tasks"
-        worktrees_dir.mkdir(parents=True)
-        worktree_path = worktrees_dir / spec_name
-        worktree_path.mkdir(parents=True)
-
-        # Mock select_menu to return "continue"
-        def mock_select_menu(title, options, allow_quit):
-            return "continue"
-
-        monkeypatch.setattr("core.workspace.finalization.select_menu", mock_select_menu)
-
-        result = check_existing_build(temp_git_repo, spec_name)
-
-        assert result is True
-
-    def test_review_choice_reviews_and_continues(
-        self, temp_git_repo: Path, monkeypatch
-    ):
-        """Review choice reviews build then continues."""
-        from core.workspace.finalization import check_existing_build
-
-        spec_name = "test-spec"
-        worktrees_dir = temp_git_repo / ".auto-claude" / "worktrees" / "tasks"
-        worktrees_dir.mkdir(parents=True)
-        worktree_path = worktrees_dir / spec_name
-        worktree_path.mkdir(parents=True)
-
-        review_called = []
-
-        def mock_review(project_dir, spec_name):
-            review_called.append(spec_name)
-            return True
-
-        def mock_select_menu(title, options, allow_quit):
-            return "review"
-
-        def mock_input(prompt):
-            return ""
-
-        monkeypatch.setattr(
-            "core.workspace.finalization.review_existing_build", mock_review
-        )
-        monkeypatch.setattr("core.workspace.finalization.select_menu", mock_select_menu)
-        monkeypatch.setattr("builtins.input", mock_input)
-
-        result = check_existing_build(temp_git_repo, spec_name)
-
-        assert result is True
-        assert spec_name in review_called
-
-
-class TestListAllWorktrees:
-    """Tests for list_all_worktrees function."""
-
-    def test_returns_empty_list_when_no_worktrees(self, temp_git_repo: Path):
-        """Returns empty list when no worktrees exist."""
-        from core.workspace.finalization import list_all_worktrees
-
-        result = list_all_worktrees(temp_git_repo)
-
-        assert result == []
-
-    def test_lists_existing_worktrees(self, temp_git_repo: Path):
-        """Returns list of existing worktrees."""
-        from core.workspace.finalization import list_all_worktrees
-
-        # Create worktrees
-        worktrees_dir = temp_git_repo / ".auto-claude" / "worktrees" / "tasks"
-        worktrees_dir.mkdir(parents=True)
-        (worktrees_dir / "spec-001").mkdir()
-        (worktrees_dir / "spec-002").mkdir()
-
-        result = list_all_worktrees(temp_git_repo)
-
-        assert len(result) == 2
-        spec_names = {wt.spec_name for wt in result}
-        assert "spec-001" in spec_names
-        assert "spec-002" in spec_names
-
-
-class TestCleanupAllWorktrees:
-    """Tests for cleanup_all_worktrees function."""
-
-    def test_no_worktrees_returns_false(self, temp_git_repo: Path, capsys):
-        """Returns False when no worktrees found."""
-        from core.workspace.finalization import cleanup_all_worktrees
-
-        result = cleanup_all_worktrees(temp_git_repo, confirm=False)
-
-        assert result is False
-
-        captured = capsys.readouterr()
-        assert "No worktrees found" in captured.out
-
-    def test_cleanup_without_confirmation(self, temp_git_repo: Path):
-        """Cleans up worktrees when confirm=False."""
-        from core.workspace.finalization import cleanup_all_worktrees
-
-        # Create worktrees
-        worktrees_dir = temp_git_repo / ".auto-claude" / "worktrees" / "tasks"
-        worktrees_dir.mkdir(parents=True)
-        spec1_path = worktrees_dir / "spec-001"
-        spec1_path.mkdir()
-        spec2_path = worktrees_dir / "spec-002"
-        spec2_path.mkdir()
-
-        result = cleanup_all_worktrees(temp_git_repo, confirm=False)
-
-        assert result is True
-        assert not spec1_path.exists()
-        assert not spec2_path.exists()
-
-    def test_cleanup_with_confirmation_yes(self, temp_git_repo: Path, monkeypatch):
-        """Cleans up worktrees when user confirms with 'yes'."""
-        from core.workspace.finalization import cleanup_all_worktrees
-
-        # Create worktrees
-        worktrees_dir = temp_git_repo / ".auto-claude" / "worktrees" / "tasks"
-        worktrees_dir.mkdir(parents=True)
-        spec1_path = worktrees_dir / "spec-001"
-        spec1_path.mkdir()
-
-        # Mock input to return "yes"
-        monkeypatch.setattr("builtins.input", lambda: "yes")
-
-        result = cleanup_all_worktrees(temp_git_repo, confirm=True)
-
-        assert result is True
-        assert not spec1_path.exists()
-
-    def test_cleanup_with_confirmation_no(self, temp_git_repo: Path, monkeypatch):
-        """Cancels cleanup when user doesn't confirm."""
-        from core.workspace.finalization import cleanup_all_worktrees
-
-        # Create worktrees
-        worktrees_dir = temp_git_repo / ".auto-claude" / "worktrees" / "tasks"
-        worktrees_dir.mkdir(parents=True)
-        spec1_path = worktrees_dir / "spec-001"
-        spec1_path.mkdir()
-
-        # Mock input to return "no"
-        monkeypatch.setattr("builtins.input", lambda: "no")
-
-        result = cleanup_all_worktrees(temp_git_repo, confirm=True)
-
-        assert result is False
-        assert spec1_path.exists()  # Should still exist
-
-    def test_cleanup_with_confirmation_keyboard_interrupt(
-        self, temp_git_repo: Path, monkeypatch, capsys
-    ):
-        """Cancels cleanup when user presses Ctrl+C (KeyboardInterrupt)."""
-        from core.workspace.finalization import cleanup_all_worktrees
-
-        # Create worktrees
-        worktrees_dir = temp_git_repo / ".auto-claude" / "worktrees" / "tasks"
-        worktrees_dir.mkdir(parents=True)
-        spec1_path = worktrees_dir / "spec-001"
-        spec1_path.mkdir()
-
-        # Mock input to raise KeyboardInterrupt
-        def mock_input(prompt=""):
-            raise KeyboardInterrupt()
-
-        monkeypatch.setattr("builtins.input", mock_input)
-
-        result = cleanup_all_worktrees(temp_git_repo, confirm=True)
-
-        assert result is False
-        assert spec1_path.exists()  # Should still exist
-
-        captured = capsys.readouterr()
-        assert "Cancelled" in captured.out
-
-
-class TestFinalizeWorkspaceBranchCoverage:
-    """Additional tests for finalize_workspace to cover missing branches."""
-
-    def test_isolated_mode_merge_choice(self, temp_git_repo: Path, monkeypatch):
-        """Isolated mode returns MERGE when user selects merge."""
-        from core.workspace.finalization import finalize_workspace
-
-        manager = WorktreeManager(temp_git_repo)
-        spec_name = "test-spec"
-
-        # Create worktree
-        worktrees_dir = temp_git_repo / ".auto-claude" / "worktrees" / "tasks"
-        worktrees_dir.mkdir(parents=True)
-        worktree_path = worktrees_dir / spec_name
-        worktree_path.mkdir(parents=True)
-
-        # Mock select_menu to return "merge"
-        def mock_select_menu(title, options, allow_quit):
-            return "merge"
-
-        monkeypatch.setattr("core.workspace.finalization.select_menu", mock_select_menu)
-
-        result = finalize_workspace(
-            temp_git_repo,
-            spec_name,
-            manager=manager,
-            auto_continue=False,
-        )
-
-        assert result == WorkspaceChoice.MERGE
-
-    def test_isolated_mode_review_choice(self, temp_git_repo: Path, monkeypatch):
-        """Isolated mode returns REVIEW when user selects review."""
-        from core.workspace.finalization import finalize_workspace
-
-        manager = WorktreeManager(temp_git_repo)
-        spec_name = "test-spec"
-
-        # Create worktree
-        worktrees_dir = temp_git_repo / ".auto-claude" / "worktrees" / "tasks"
-        worktrees_dir.mkdir(parents=True)
-        worktree_path = worktrees_dir / spec_name
-        worktree_path.mkdir(parents=True)
-
-        # Mock select_menu to return "review"
-        def mock_select_menu(title, options, allow_quit):
-            return "review"
-
-        monkeypatch.setattr("core.workspace.finalization.select_menu", mock_select_menu)
-
-        result = finalize_workspace(
-            temp_git_repo,
-            spec_name,
-            manager=manager,
-            auto_continue=False,
-        )
-
-        assert result == WorkspaceChoice.REVIEW
-
-    def test_isolated_mode_later_choice(self, temp_git_repo: Path, monkeypatch):
-        """Isolated mode returns LATER when user selects later."""
-        from core.workspace.finalization import finalize_workspace
-
-        manager = WorktreeManager(temp_git_repo)
-        spec_name = "test-spec"
-
-        # Create worktree
-        worktrees_dir = temp_git_repo / ".auto-claude" / "worktrees" / "tasks"
-        worktrees_dir.mkdir(parents=True)
-        worktree_path = worktrees_dir / spec_name
-        worktree_path.mkdir(parents=True)
-
-        # Mock select_menu to return "later"
-        def mock_select_menu(title, options, allow_quit):
-            return "later"
-
-        monkeypatch.setattr("core.workspace.finalization.select_menu", mock_select_menu)
-
-        result = finalize_workspace(
-            temp_git_repo,
-            spec_name,
-            manager=manager,
-            auto_continue=False,
-        )
-
-        assert result == WorkspaceChoice.LATER
-
-
-class TestHandleWorkspaceChoiceBranchCoverage:
-    """Additional tests for handle_workspace_choice to cover missing branches."""
-
-    def test_choice_test_without_staging_path(self, temp_git_repo: Path, capsys):
-        """TEST choice shows fallback instructions when staging_path is None."""
-        from core.workspace.finalization import handle_workspace_choice
-
-        manager = WorktreeManager(temp_git_repo)
-        spec_name = "test-spec"
-
-        # Create worktree directory (but not through manager, so no staging_path)
-        worktrees_dir = temp_git_repo / ".auto-claude" / "worktrees" / "tasks"
-        worktrees_dir.mkdir(parents=True)
-        worktree_path = worktrees_dir / spec_name
-        worktree_path.mkdir(parents=True)
-
-        handle_workspace_choice(WorkspaceChoice.TEST, temp_git_repo, spec_name, manager)
-
-        captured = capsys.readouterr()
-        assert "TEST YOUR FEATURE" in captured.out
-        # Should show the fallback path
-        assert (
-            str(worktree_path) in captured.out
-            or f".auto-claude/worktrees/tasks/{spec_name}" in captured.out
-        )
-
-    def test_choice_merge_success(self, temp_git_repo: Path, capsys):
-        """MERGE choice shows success message when merge succeeds."""
-        from core.workspace.finalization import handle_workspace_choice
-        from worktree import WorktreeManager
-
-        # Setup a proper isolated workspace with git worktree
-        working_dir, manager, _ = setup_workspace(
-            temp_git_repo,
-            "test-spec",
-            WorkspaceMode.ISOLATED,
-        )
-
-        # Make changes and commit
-        (working_dir / "test.py").write_text("test content", encoding="utf-8")
-        subprocess.run(["git", "add", "."], cwd=working_dir, capture_output=True)
-        subprocess.run(
-            ["git", "commit", "-m", "Add test"], cwd=working_dir, capture_output=True
-        )
-
-        handle_workspace_choice(
-            WorkspaceChoice.MERGE, temp_git_repo, "test-spec", manager
-        )
-
-        captured = capsys.readouterr()
-        assert "Your feature has been added" in captured.out
-
-    def test_choice_later_without_staging_path(self, temp_git_repo: Path, capsys):
-        """LATER choice shows fallback path when staging_path is None."""
-        from core.workspace.finalization import handle_workspace_choice
-
-        manager = WorktreeManager(temp_git_repo)
-        spec_name = "test-spec"
-
-        # Create worktree directory (but not through manager, so no staging_path)
-        worktrees_dir = temp_git_repo / ".auto-claude" / "worktrees" / "tasks"
-        worktrees_dir.mkdir(parents=True)
-        worktree_path = worktrees_dir / spec_name
-        worktree_path.mkdir(parents=True)
-
-        handle_workspace_choice(
-            WorkspaceChoice.LATER, temp_git_repo, spec_name, manager
-        )
-
-        captured = capsys.readouterr()
-        assert "No problem!" in captured.out
-        # Should show the fallback path
-        assert (
-            str(worktree_path) in captured.out
-            or f".auto-claude/worktrees/tasks/{spec_name}" in captured.out
-        )
-
-
-class TestDiscardExistingBuildBranchCoverage:
-    """Additional tests for discard_existing_build to cover missing branches."""
-
-    def test_keyboard_interrupt_cancels_discard(
-        self, temp_git_repo: Path, monkeypatch, capsys
-    ):
-        """KeyboardInterrupt during confirmation returns False."""
-        from core.workspace.finalization import discard_existing_build
-
-        spec_name = "test-spec"
-        worktrees_dir = temp_git_repo / ".auto-claude" / "worktrees" / "tasks"
-        worktrees_dir.mkdir(parents=True)
-        worktree_path = worktrees_dir / spec_name
-        worktree_path.mkdir(parents=True)
-
-        # Mock input to raise KeyboardInterrupt
-        def mock_input(prompt=""):
-            raise KeyboardInterrupt()
-
-        monkeypatch.setattr("builtins.input", mock_input)
-
-        result = discard_existing_build(temp_git_repo, spec_name)
-
-        assert result is False
-
-        captured = capsys.readouterr()
-        assert "Cancelled" in captured.out
-
-
-class TestCheckExistingBuildBranchCoverage:
-    """Additional tests for check_existing_build to cover missing branches."""
-
-    def test_none_choice_exits(self, temp_git_repo: Path, monkeypatch):
-        """None choice (quit) calls sys.exit(0)."""
-        import sys
-
-        from core.workspace.finalization import check_existing_build
-
-        spec_name = "test-spec"
-        worktrees_dir = temp_git_repo / ".auto-claude" / "worktrees" / "tasks"
-        worktrees_dir.mkdir(parents=True)
-        worktree_path = worktrees_dir / spec_name
-        worktree_path.mkdir(parents=True)
-
-        # Mock select_menu to return None (quit)
-        def mock_select_menu(title, options, allow_quit):
-            return None
-
-        monkeypatch.setattr("core.workspace.finalization.select_menu", mock_select_menu)
-
-        # Should raise SystemExit
-        with pytest.raises(SystemExit) as exc_info:
-            check_existing_build(temp_git_repo, spec_name)
-
-        assert exc_info.value.code == 0
-
-    def test_merge_choice_merges_and_returns_false(
-        self, temp_git_repo: Path, monkeypatch
-    ):
-        """Merge choice calls merge_existing_build and returns False."""
-        from unittest.mock import MagicMock
-
-        from core.workspace.finalization import check_existing_build
-
-        spec_name = "test-spec"
-        worktrees_dir = temp_git_repo / ".auto-claude" / "worktrees" / "tasks"
-        worktrees_dir.mkdir(parents=True)
-        worktree_path = worktrees_dir / spec_name
-        worktree_path.mkdir(parents=True)
-
-        merge_called = []
-
-        def mock_merge_existing_build(project_dir, spec_name):
-            merge_called.append(spec_name)
-
-        def mock_select_menu(title, options, allow_quit):
-            return "merge"
-
-        monkeypatch.setattr("core.workspace.finalization.select_menu", mock_select_menu)
-
-        # Mock the workspace module import
-        import workspace as ws
-
-        original_merge = getattr(ws, "merge_existing_build", None)
-        ws.merge_existing_build = mock_merge_existing_build
-
-        try:
-            result = check_existing_build(temp_git_repo, spec_name)
-            assert result is False
-            assert spec_name in merge_called
-        finally:
-            if original_merge:
-                ws.merge_existing_build = original_merge
-
-    def test_fresh_choice_discards_and_returns_false(
-        self, temp_git_repo: Path, monkeypatch
-    ):
-        """Fresh choice discards build and returns False (start fresh)."""
-        from core.workspace.finalization import check_existing_build
-
-        spec_name = "test-spec"
-        worktrees_dir = temp_git_repo / ".auto-claude" / "worktrees" / "tasks"
-        worktrees_dir.mkdir(parents=True)
-        worktree_path = worktrees_dir / spec_name
-        worktree_path.mkdir(parents=True)
-
-        def mock_select_menu(title, options, allow_quit):
-            return "fresh"
-
-        monkeypatch.setattr("core.workspace.finalization.select_menu", mock_select_menu)
-        # Mock input to return "delete" for confirmation
-        monkeypatch.setattr("builtins.input", lambda: "delete")
-
-        result = check_existing_build(temp_git_repo, spec_name)
-        assert result is False, "Fresh choice should return False"

apps/backend/core/workspace/tests/test_models.py

@@ -1,638 +0,0 @@
-#!/usr/bin/env python3
-"""
-Tests for Workspace Models
-==========================
-
-Tests the workspace.py module models including:
-- WorkspaceMode enum
-- WorkspaceChoice enum
-- ParallelMergeTask
-- ParallelMergeResult
-- MergeLock and MergeLockError
-- SpecNumberLock and SpecNumberLockError
-"""
-
-import os
-import subprocess
-import sys
-from pathlib import Path
-
-import pytest
-
-# Add parent directory to path so we can import the workspace module
-# When co-located at workspace/tests/, we need to add backend to path
-# workspace/tests -> workspace -> core -> backend (4 levels up)
-_backend = Path(__file__).resolve().parent.parent.parent.parent
-sys.path.insert(0, str(_backend))
-
-from core.workspace.models import (
-    MergeLock,
-    MergeLockError,
-    ParallelMergeResult,
-    ParallelMergeTask,
-    SpecNumberLock,
-    SpecNumberLockError,
-)
-from worktree import WorktreeError, WorktreeManager
-
-# Test constant - in the new per-spec architecture, each spec has its own worktree
-# named after the spec itself. This constant is used for test assertions.
-TEST_SPEC_NAME = "test-spec"
-
-
-class TestWorkspaceMode:
-    """Tests for WorkspaceMode enum."""
-
-    def test_isolated_mode(self):
-        """ISOLATED mode value is correct."""
-        from core.workspace.models import WorkspaceMode
-
-        assert WorkspaceMode.ISOLATED.value == "isolated"
-
-    def test_direct_mode(self):
-        """DIRECT mode value is correct."""
-        from core.workspace.models import WorkspaceMode
-
-        assert WorkspaceMode.DIRECT.value == "direct"
-
-
-class TestWorkspaceChoice:
-    """Tests for WorkspaceChoice enum."""
-
-    def test_merge_choice(self):
-        """MERGE choice value is correct."""
-        from core.workspace.models import WorkspaceChoice
-
-        assert WorkspaceChoice.MERGE.value == "merge"
-
-    def test_review_choice(self):
-        """REVIEW choice value is correct."""
-        from core.workspace.models import WorkspaceChoice
-
-        assert WorkspaceChoice.REVIEW.value == "review"
-
-    def test_test_choice(self):
-        """TEST choice value is correct."""
-        from core.workspace.models import WorkspaceChoice
-
-        assert WorkspaceChoice.TEST.value == "test"
-
-    def test_later_choice(self):
-        """LATER choice value is correct."""
-        from core.workspace.models import WorkspaceChoice
-
-        assert WorkspaceChoice.LATER.value == "later"
-
-
-class TestParallelMergeTask:
-    """Tests for ParallelMergeTask dataclass."""
-
-    def test_create_merge_task(self):
-        """ParallelMergeTask can be instantiated with all fields."""
-        task = ParallelMergeTask(
-            file_path="src/example.py",
-            main_content="main content",
-            worktree_content="worktree content",
-            base_content="base content",
-            spec_name="test-spec",
-            project_dir=Path("/project"),
-        )
-
-        assert task.file_path == "src/example.py"
-        assert task.main_content == "main content"
-        assert task.worktree_content == "worktree content"
-        assert task.base_content == "base content"
-        assert task.spec_name == "test-spec"
-        assert task.project_dir == Path("/project")
-
-    def test_merge_task_with_none_base(self):
-        """ParallelMergeTask can have None for base_content."""
-        task = ParallelMergeTask(
-            file_path="src/example.py",
-            main_content="main content",
-            worktree_content="worktree content",
-            base_content=None,
-            spec_name="test-spec",
-            project_dir=Path("/project"),
-        )
-
-        assert task.base_content is None
-
-    def test_merge_task_field_assignment(self):
-        """ParallelMergeTask fields can be reassigned."""
-        task = ParallelMergeTask(
-            file_path="src/example.py",
-            main_content="main",
-            worktree_content="worktree",
-            base_content=None,
-            spec_name="spec-1",
-            project_dir=Path("/project"),
-        )
-
-        task.file_path = "src/updated.py"
-        task.main_content = "updated main"
-        task.worktree_content = "updated worktree"
-        task.base_content = "updated base"
-        task.spec_name = "spec-2"
-        task.project_dir = Path("/updated")
-
-        assert task.file_path == "src/updated.py"
-        assert task.main_content == "updated main"
-        assert task.worktree_content == "updated worktree"
-        assert task.base_content == "updated base"
-        assert task.spec_name == "spec-2"
-        assert task.project_dir == Path("/updated")
-
-
-class TestParallelMergeResult:
-    """Tests for ParallelMergeResult dataclass."""
-
-    def test_create_successful_result(self):
-        """ParallelMergeResult can represent a successful merge."""
-        result = ParallelMergeResult(
-            file_path="src/example.py",
-            merged_content="merged content",
-            success=True,
-            error=None,
-            was_auto_merged=True,
-        )
-
-        assert result.file_path == "src/example.py"
-        assert result.merged_content == "merged content"
-        assert result.success is True
-        assert result.error is None
-        assert result.was_auto_merged is True
-
-    def test_create_failed_result(self):
-        """ParallelMergeResult can represent a failed merge."""
-        result = ParallelMergeResult(
-            file_path="src/example.py",
-            merged_content=None,
-            success=False,
-            error="Merge conflict occurred",
-            was_auto_merged=False,
-        )
-
-        assert result.file_path == "src/example.py"
-        assert result.merged_content is None
-        assert result.success is False
-        assert result.error == "Merge conflict occurred"
-        assert result.was_auto_merged is False
-
-    def test_result_default_values(self):
-        """ParallelMergeResult has correct default values."""
-        result = ParallelMergeResult(
-            file_path="src/example.py",
-            merged_content="content",
-            success=True,
-        )
-
-        assert result.error is None
-        assert result.was_auto_merged is False
-
-    def test_result_field_assignment(self):
-        """ParallelMergeResult fields can be reassigned."""
-        result = ParallelMergeResult(
-            file_path="src/example.py",
-            merged_content="merged",
-            success=True,
-            error=None,
-            was_auto_merged=False,
-        )
-
-        result.file_path = "src/updated.py"
-        result.merged_content = "updated merged"
-        result.success = False
-        result.error = "New error"
-        result.was_auto_merged = True
-
-        assert result.file_path == "src/updated.py"
-        assert result.merged_content == "updated merged"
-        assert result.success is False
-        assert result.error == "New error"
-        assert result.was_auto_merged is True
-
-
-class TestMergeLockError:
-    """Tests for MergeLockError exception."""
-
-    def test_merge_lock_error_creation(self):
-        """MergeLockError can be instantiated with a message."""
-        error = MergeLockError("Could not acquire lock")
-        assert str(error) == "Could not acquire lock"
-
-    def test_merge_lock_error_is_exception(self):
-        """MergeLockError is an Exception subclass."""
-        error = MergeLockError("test")
-        assert isinstance(error, Exception)
-        assert isinstance(error, MergeLockError)
-
-    def test_raise_merge_lock_error(self):
-        """MergeLockError can be raised and caught."""
-        with pytest.raises(MergeLockError) as exc_info:
-            raise MergeLockError("Lock timeout")
-            assert str(exc_info.value) == "Lock timeout"
-
-
-class TestMergeLock:
-    """Tests for MergeLock context manager."""
-
-    def test_merge_lock_initialization(self, temp_git_repo: Path):
-        """MergeLock initializes with correct paths."""
-        lock = MergeLock(temp_git_repo, "test-spec")
-
-        assert lock.project_dir == temp_git_repo
-        assert lock.spec_name == "test-spec"
-        assert lock.lock_dir == temp_git_repo / ".auto-claude" / ".locks"
-        assert lock.lock_file == lock.lock_dir / "merge-test-spec.lock"
-        assert lock.acquired is False
-
-    def test_merge_lock_acquire_and_release(self, temp_git_repo: Path):
-        """MergeLock can be acquired and released."""
-        lock = MergeLock(temp_git_repo, "test-spec")
-
-        with lock:
-            assert lock.acquired is True
-            assert lock.lock_file.exists()
-
-        # After context, lock should be released
-        assert lock.lock_file.exists() is False
-
-    def test_merge_lock_creates_lock_dir(self, temp_git_repo: Path):
-        """MergeLock creates lock directory if it doesn't exist."""
-        lock = MergeLock(temp_git_repo, "test-spec")
-
-        # Remove lock dir if it exists
-        if lock.lock_dir.exists():
-            lock.lock_dir.rmdir()
-
-        with lock:
-            assert lock.lock_dir.exists()
-
-    def test_merge_lock_writes_pid(self, temp_git_repo: Path):
-        """MergeLock writes current PID to lock file."""
-        lock = MergeLock(temp_git_repo, "test-spec")
-
-        with lock:
-            pid_content = lock.lock_file.read_text(encoding="utf-8").strip()
-            assert pid_content == str(os.getpid())
-
-    @pytest.mark.slow
-    def test_merge_lock_timeout_on_contention(self, temp_git_repo: Path):
-        """MergeLock raises MergeLockError when lock is held by another process."""
-        lock1 = MergeLock(temp_git_repo, "test-spec")
-
-        # Acquire first lock
-        lock1.__enter__()
-
-        try:
-            # Create a second lock for the same spec
-            lock2 = MergeLock(temp_git_repo, "test-spec")
-
-            # This should timeout because lock1 holds the lock
-            with pytest.raises(MergeLockError) as exc_info:
-                lock2.__enter__()
-
-            assert "Could not acquire merge lock" in str(exc_info.value)
-            assert "test-spec" in str(exc_info.value)
-            assert "after 30s" in str(exc_info.value)
-        finally:
-            lock1.__exit__(None, None, None)
-
-    def test_merge_lock_removes_stale_lock(self, temp_git_repo: Path):
-        """MergeLock removes stale lock from dead process."""
-        lock1 = MergeLock(temp_git_repo, "test-spec")
-
-        with lock1:
-            # Write a fake PID that doesn't exist
-            fake_pid = 999999
-            lock1.lock_file.write_text(str(fake_pid), encoding="utf-8")
-
-            # Create a new lock - it should remove the stale lock
-            lock2 = MergeLock(temp_git_repo, "test-spec")
-            with lock2:
-                assert lock2.acquired is True
-
-    def test_merge_lock_handles_invalid_pid(self, temp_git_repo: Path):
-        """MergeLock handles invalid PID in lock file."""
-        lock1 = MergeLock(temp_git_repo, "test-spec")
-
-        with lock1:
-            # Write invalid content to lock file
-            lock1.lock_file.write_text("invalid-pid", encoding="utf-8")
-
-            # Create a new lock - it should remove the invalid lock
-            lock2 = MergeLock(temp_git_repo, "test-spec")
-            with lock2:
-                assert lock2.acquired is True
-
-    def test_merge_lock_cleanup_on_exception(self, temp_git_repo: Path):
-        """MergeLock releases lock even if exception occurs in context."""
-        lock = MergeLock(temp_git_repo, "test-spec")
-
-        try:
-            with lock:
-                assert lock.acquired is True
-                raise ValueError("Test exception")
-        except ValueError:
-            pass
-
-        # Lock should be released despite exception
-        assert lock.lock_file.exists() is False
-
-    def test_merge_lock_idempotent_release(self, temp_git_repo: Path):
-        """MergeLock __exit__ can be called multiple times safely."""
-        lock = MergeLock(temp_git_repo, "test-spec")
-
-        with lock:
-            pass
-
-        # Call __exit__ again - should not raise
-        lock.__exit__(None, None, None)
-        lock.__exit__(None, None, None)
-
-    def test_merge_lock_different_specs_dont_conflict(self, temp_git_repo: Path):
-        """MergeLock for different specs can be held simultaneously."""
-        lock1 = MergeLock(temp_git_repo, "spec-1")
-        lock2 = MergeLock(temp_git_repo, "spec-2")
-
-        with lock1:
-            with lock2:
-                assert lock1.acquired is True
-                assert lock2.acquired is True
-                assert lock1.lock_file != lock2.lock_file
-
-
-class TestSpecNumberLockError:
-    """Tests for SpecNumberLockError exception."""
-
-    def test_spec_number_lock_error_creation(self):
-        """SpecNumberLockError can be instantiated with a message."""
-        error = SpecNumberLockError("Could not acquire spec numbering lock")
-        assert str(error) == "Could not acquire spec numbering lock"
-
-    def test_spec_number_lock_error_is_exception(self):
-        """SpecNumberLockError is an Exception subclass."""
-        error = SpecNumberLockError("test")
-        assert isinstance(error, Exception)
-        assert isinstance(error, SpecNumberLockError)
-
-    def test_raise_spec_number_lock_error(self):
-        """SpecNumberLockError can be raised and caught."""
-        with pytest.raises(SpecNumberLockError) as exc_info:
-            raise SpecNumberLockError("Lock timeout")
-            assert str(exc_info.value) == "Lock timeout"
-
-
-class TestSpecNumberLock:
-    """Tests for SpecNumberLock context manager."""
-
-    def test_spec_number_lock_initialization(self, temp_git_repo: Path):
-        """SpecNumberLock initializes with correct paths."""
-        lock = SpecNumberLock(temp_git_repo)
-
-        assert lock.project_dir == temp_git_repo
-        assert lock.lock_dir == temp_git_repo / ".auto-claude" / ".locks"
-        assert lock.lock_file == lock.lock_dir / "spec-numbering.lock"
-        assert lock.acquired is False
-        assert lock._global_max is None
-
-    def test_spec_number_lock_acquire_and_release(self, temp_git_repo: Path):
-        """SpecNumberLock can be acquired and released."""
-        lock = SpecNumberLock(temp_git_repo)
-
-        with lock:
-            assert lock.acquired is True
-            assert lock.lock_file.exists()
-
-        # After context, lock should be released
-        assert lock.lock_file.exists() is False
-
-    def test_spec_number_lock_creates_lock_dir(self, temp_git_repo: Path):
-        """SpecNumberLock creates lock directory if it doesn't exist."""
-        lock = SpecNumberLock(temp_git_repo)
-
-        # Remove lock dir if it exists
-        if lock.lock_dir.exists():
-            lock.lock_dir.rmdir()
-
-        with lock:
-            assert lock.lock_dir.exists()
-
-    def test_spec_number_lock_writes_pid(self, temp_git_repo: Path):
-        """SpecNumberLock writes current PID to lock file."""
-        lock = SpecNumberLock(temp_git_repo)
-
-        with lock:
-            pid_content = lock.lock_file.read_text(encoding="utf-8").strip()
-            assert pid_content == str(os.getpid())
-
-    def test_get_next_spec_number_no_existing_specs(self, temp_git_repo: Path):
-        """get_next_spec_number returns 1 when no specs exist."""
-        lock = SpecNumberLock(temp_git_repo)
-
-        with lock:
-            next_num = lock.get_next_spec_number()
-            assert next_num == 1
-
-    def test_get_next_spec_number_with_existing_specs(self, temp_git_repo: Path):
-        """get_next_spec_number returns max existing spec number + 1."""
-        # Create spec directories
-        specs_dir = temp_git_repo / ".auto-claude" / "specs"
-        specs_dir.mkdir(parents=True)
-        (specs_dir / "001-first").mkdir()
-        (specs_dir / "003-third").mkdir()
-
-        lock = SpecNumberLock(temp_git_repo)
-
-        with lock:
-            next_num = lock.get_next_spec_number()
-            assert next_num == 4
-
-    def test_get_next_spec_number_caches_result(self, temp_git_repo: Path):
-        """get_next_spec_number caches the global max."""
-        specs_dir = temp_git_repo / ".auto-claude" / "specs"
-        specs_dir.mkdir(parents=True)
-        (specs_dir / "005-test").mkdir()
-
-        lock = SpecNumberLock(temp_git_repo)
-
-        with lock:
-            next_num1 = lock.get_next_spec_number()
-            next_num2 = lock.get_next_spec_number()
-
-            # Should return the same value (cached)
-            assert next_num1 == next_num2 == 6
-            assert lock._global_max == 5
-
-    def test_get_next_spec_number_requires_lock(self, temp_git_repo: Path):
-        """get_next_spec_number raises SpecNumberLockError if lock not acquired."""
-        lock = SpecNumberLock(temp_git_repo)
-
-        with pytest.raises(SpecNumberLockError) as exc_info:
-            lock.get_next_spec_number()
-
-        assert "Lock must be acquired" in str(exc_info.value)
-
-    def test_get_next_spec_number_scans_worktrees(self, temp_git_repo: Path):
-        """get_next_spec_number scans all worktree spec directories."""
-        # Create main project specs
-        main_specs = temp_git_repo / ".auto-claude" / "specs"
-        main_specs.mkdir(parents=True)
-        (main_specs / "002-main").mkdir()
-
-        # Create worktree with specs
-        worktrees_dir = temp_git_repo / ".auto-claude" / "worktrees" / "tasks"
-        worktrees_dir.mkdir(parents=True)
-        worktree_spec_dir = worktrees_dir / "test-worktree" / ".auto-claude" / "specs"
-        worktree_spec_dir.mkdir(parents=True)
-        (worktree_spec_dir / "005-worktree").mkdir()
-
-        lock = SpecNumberLock(temp_git_repo)
-
-        with lock:
-            next_num = lock.get_next_spec_number()
-            # Should find max of 2 and 5, return 6
-            assert next_num == 6
-
-    def test_scan_specs_dir_nonexistent(self, temp_git_repo: Path):
-        """_scan_specs_dir returns 0 for nonexistent directory."""
-        lock = SpecNumberLock(temp_git_repo)
-
-        with lock:
-            # Use a path inside temp_dir that doesn't exist
-            nonexistent = temp_git_repo / "this_does_not_exist_specs"
-            result = lock._scan_specs_dir(nonexistent)
-            assert result == 0
-
-    def test_scan_specs_dir_ignores_invalid_names(self, temp_git_repo: Path):
-        """_scan_specs_dir ignores directories with invalid spec names."""
-        specs_dir = temp_git_repo / ".auto-claude" / "specs"
-        specs_dir.mkdir(parents=True)
-        (specs_dir / "001-valid").mkdir()
-        (specs_dir / "invalid-name").mkdir()
-        (specs_dir / "abc").mkdir()
-        (specs_dir / "100-valid").mkdir()
-
-        lock = SpecNumberLock(temp_git_repo)
-
-        with lock:
-            result = lock._scan_specs_dir(specs_dir)
-            # Should only count 001 and 100
-            assert result == 100
-
-    @pytest.mark.slow
-    def test_spec_number_lock_timeout_on_contention(self, temp_git_repo: Path):
-        """SpecNumberLock raises SpecNumberLockError when lock is held."""
-        lock1 = SpecNumberLock(temp_git_repo)
-
-        # Acquire first lock
-        lock1.__enter__()
-
-        try:
-            # Create a second lock
-            lock2 = SpecNumberLock(temp_git_repo)
-
-            # This should timeout because lock1 holds the lock
-            with pytest.raises(SpecNumberLockError) as exc_info:
-                lock2.__enter__()
-
-            assert "Could not acquire spec numbering lock" in str(exc_info.value)
-            assert "after 30s" in str(exc_info.value)
-        finally:
-            lock1.__exit__(None, None, None)
-
-    def test_spec_number_lock_removes_stale_lock(self, temp_git_repo: Path):
-        """SpecNumberLock removes stale lock from dead process."""
-        lock1 = SpecNumberLock(temp_git_repo)
-
-        with lock1:
-            # Write a fake PID that doesn't exist
-            fake_pid = 999999
-            lock1.lock_file.write_text(str(fake_pid), encoding="utf-8")
-
-            # Create a new lock - it should remove the stale lock
-            lock2 = SpecNumberLock(temp_git_repo)
-            with lock2:
-                assert lock2.acquired is True
-
-    def test_spec_number_lock_handles_invalid_pid(self, temp_git_repo: Path):
-        """SpecNumberLock handles invalid PID in lock file."""
-        lock1 = SpecNumberLock(temp_git_repo)
-
-        with lock1:
-            # Write invalid content to lock file
-            lock1.lock_file.write_text("invalid-pid", encoding="utf-8")
-
-            # Create a new lock - it should remove the invalid lock
-            lock2 = SpecNumberLock(temp_git_repo)
-            with lock2:
-                assert lock2.acquired is True
-
-    def test_spec_number_lock_cleanup_on_exception(self, temp_git_repo: Path):
-        """SpecNumberLock releases lock even if exception occurs in context."""
-        lock = SpecNumberLock(temp_git_repo)
-
-        try:
-            with lock:
-                assert lock.acquired is True
-                raise ValueError("Test exception")
-        except ValueError:
-            pass
-
-        # Lock should be released despite exception
-        assert lock.lock_file.exists() is False
-
-    def test_spec_number_lock_idempotent_release(self, temp_git_repo: Path):
-        """SpecNumberLock __exit__ can be called multiple times safely."""
-        lock = SpecNumberLock(temp_git_repo)
-
-        with lock:
-            pass
-
-        # Call __exit__ again - should not raise
-        lock.__exit__(None, None, None)
-        lock.__exit__(None, None, None)
-
-    def test_spec_number_lock_returns_self(self, temp_git_repo: Path):
-        """SpecNumberLock __enter__ returns self."""
-        lock = SpecNumberLock(temp_git_repo)
-
-        with lock as entered_lock:
-            assert entered_lock is lock
-
-    def test_merge_success_returns_true(self, temp_git_repo: Path):
-        """Successful merge returns True (ACS-163 verification)."""
-        manager = WorktreeManager(temp_git_repo)
-        manager.setup()
-
-        # Create a worktree with non-conflicting changes
-        worker_info = manager.create_worktree("worker-spec")
-        (worker_info.path / "worker-file.txt").write_text(
-            "worker content", encoding="utf-8"
-        )
-        subprocess.run(["git", "add", "."], cwd=worker_info.path, capture_output=True)
-        subprocess.run(
-            ["git", "commit", "-m", "Worker commit"],
-            cwd=worker_info.path,
-            capture_output=True,
-        )
-
-        # Merge should succeed
-        result = manager.merge_worktree("worker-spec", delete_after=False)
-
-        assert result is True
-
-        # Verify the file was merged into base branch
-        subprocess.run(
-            ["git", "checkout", manager.base_branch],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-        assert (temp_git_repo / "worker-file.txt").exists(), (
-            "Merged file should exist in base branch"
-        )
-        merged_content = (temp_git_repo / "worker-file.txt").read_text(encoding="utf-8")
-        assert merged_content == "worker content", (
-            "Merged file should have worktree content"
-        )

apps/backend/core/workspace/tests/test_rebase.py

@@ -1,565 +0,0 @@
-#!/usr/bin/env python3
-"""
-Tests for Workspace Rebase Operations
-======================================
-
-Tests the rebase functionality including:
-- Rebase detection (_check_git_conflicts)
-- Spec branch rebase operations
-- Rebase integration tests
-- Rebase error handling
-"""
-
-import json
-import os
-import shutil
-import subprocess
-import sys
-from pathlib import Path
-
-import pytest
-from worktree import WorktreeError, WorktreeManager
-
-# Test constant - in the new per-spec architecture, each spec has its own worktree
-# named after the spec itself. This constant is used for test assertions.
-TEST_SPEC_NAME = "test-spec"
-
-
-class TestRebaseDetection:
-    def test_check_git_conflicts_detects_branch_behind(self, temp_git_repo: Path):
-        """_check_git_conflicts detects when spec branch is behind base branch (ACS-224)."""
-        from core.workspace import _check_git_conflicts
-
-        # Create a spec branch
-        spec_branch = "auto-claude/test-spec"
-        subprocess.run(
-            ["git", "checkout", "-b", spec_branch],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-
-        # Add a commit to spec branch
-        (temp_git_repo / "spec-file.txt").write_text("spec content", encoding="utf-8")
-        subprocess.run(["git", "add", "."], cwd=temp_git_repo, capture_output=True)
-        subprocess.run(
-            ["git", "commit", "-m", "Spec commit"],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-
-        # Go back to main and add a commit (making spec branch behind)
-        subprocess.run(
-            ["git", "checkout", "main"],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-        (temp_git_repo / "main-file.txt").write_text("main content", encoding="utf-8")
-        subprocess.run(["git", "add", "."], cwd=temp_git_repo, capture_output=True)
-        subprocess.run(
-            ["git", "commit", "-m", "Main commit after spec"],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-
-        # Check git conflicts - should detect spec branch is behind
-        result = _check_git_conflicts(temp_git_repo, "test-spec")
-
-        assert result is not None
-        assert result.get("needs_rebase") is True, "Should detect branch is behind"
-        assert result.get("commits_behind") == 1, (
-            "Should count commits behind correctly"
-        )
-        assert result.get("spec_branch") == spec_branch
-
-    def test_check_git_conflicts_no_commits_behind(self, temp_git_repo: Path):
-        """_check_git_conflicts returns commits_behind=0 when branch is up to date (ACS-224)."""
-        from core.workspace import _check_git_conflicts
-
-        # Create a spec branch that's ahead (not behind)
-        spec_branch = "auto-claude/test-spec"
-        subprocess.run(
-            ["git", "checkout", "-b", spec_branch],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-        (temp_git_repo / "spec-file.txt").write_text("spec content", encoding="utf-8")
-        subprocess.run(["git", "add", "."], cwd=temp_git_repo, capture_output=True)
-        subprocess.run(
-            ["git", "commit", "-m", "Spec commit"],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-
-        # Switch back to main before checking conflicts
-        # (otherwise _check_git_conflicts would compare spec to itself)
-        subprocess.run(
-            ["git", "checkout", "main"],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-
-        # Check git conflicts - spec branch is ahead, not behind
-        result = _check_git_conflicts(temp_git_repo, "test-spec")
-
-        assert result is not None
-        assert result.get("needs_rebase") is False, "Should not need rebase when ahead"
-        assert result.get("commits_behind") == 0, "Should have 0 commits behind"
-
-    def test_check_git_conflicts_multiple_commits_behind(self, temp_git_repo: Path):
-        """_check_git_conflicts correctly counts multiple commits behind (ACS-224)."""
-        from core.workspace import _check_git_conflicts
-
-        # Create a spec branch
-        spec_branch = "auto-claude/test-spec"
-        subprocess.run(
-            ["git", "checkout", "-b", spec_branch],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-
-        # Add a commit to spec branch
-        (temp_git_repo / "spec-file.txt").write_text("spec content", encoding="utf-8")
-        subprocess.run(["git", "add", "."], cwd=temp_git_repo, capture_output=True)
-        subprocess.run(
-            ["git", "commit", "-m", "Spec commit"],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-
-        # Go back to main and add multiple commits
-        subprocess.run(
-            ["git", "checkout", "main"],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-        for i in range(3):
-            (temp_git_repo / f"main-file-{i}.txt").write_text(
-                f"main content {i}", encoding="utf-8"
-            )
-            subprocess.run(["git", "add", "."], cwd=temp_git_repo, capture_output=True)
-            subprocess.run(
-                ["git", "commit", "-m", f"Main commit {i}"],
-                cwd=temp_git_repo,
-                capture_output=True,
-            )
-
-        # Check git conflicts - should detect 3 commits behind
-        result = _check_git_conflicts(temp_git_repo, "test-spec")
-
-        assert result is not None
-        assert result.get("needs_rebase") is True
-        assert result.get("commits_behind") == 3, "Should count all commits behind"
-
-
-class TestRebaseSpecBranch:
-    """Tests for _rebase_spec_branch function (ACS-224)."""
-
-    def test_rebase_spec_branch_clean_rebase(self, temp_git_repo: Path):
-        """_rebase_spec_branch successfully rebases clean branch (ACS-224)."""
-        from core.workspace import _rebase_spec_branch
-
-        # Create a spec branch
-        spec_branch = "auto-claude/test-spec"
-        subprocess.run(
-            ["git", "checkout", "-b", spec_branch],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-
-        # Add a commit to spec branch
-        (temp_git_repo / "spec-file.txt").write_text("spec content", encoding="utf-8")
-        subprocess.run(["git", "add", "."], cwd=temp_git_repo, capture_output=True)
-        subprocess.run(
-            ["git", "commit", "-m", "Spec commit"],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-
-        # Add a commit to main (making spec behind)
-        subprocess.run(
-            ["git", "checkout", "main"],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-        (temp_git_repo / "main-file.txt").write_text("main content", encoding="utf-8")
-        subprocess.run(["git", "add", "."], cwd=temp_git_repo, capture_output=True)
-        subprocess.run(
-            ["git", "commit", "-m", "Main commit"],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-
-        # Get spec branch commit before rebase
-        before_commit = subprocess.run(
-            ["git", "rev-parse", spec_branch],
-            cwd=temp_git_repo,
-            capture_output=True,
-            text=True,
-        ).stdout.strip()
-
-        # Rebase the spec branch
-        result = _rebase_spec_branch(temp_git_repo, "test-spec", "main")
-
-        assert result is True, "Rebase should succeed"
-
-        # Get spec branch commit after rebase
-        after_commit = subprocess.run(
-            ["git", "rev-parse", spec_branch],
-            cwd=temp_git_repo,
-            capture_output=True,
-            text=True,
-        ).stdout.strip()
-
-        # Commits should be different (rebase changed the commit hash)
-        assert before_commit != after_commit, "Rebase should change commit hash"
-
-        # Verify spec branch now has main's commit in its history
-        log = subprocess.run(
-            ["git", "log", "--oneline", spec_branch],
-            cwd=temp_git_repo,
-            capture_output=True,
-            text=True,
-        ).stdout
-        assert "Main commit" in log, "Spec branch should have main commit after rebase"
-
-    def test_rebase_spec_branch_with_conflicts_aborts_cleanly(
-        self, temp_git_repo: Path
-    ):
-        """_rebase_spec_branch handles conflicts by aborting and returning False (ACS-224)."""
-        from core.workspace import _rebase_spec_branch
-
-        # Create a spec branch
-        spec_branch = "auto-claude/test-spec"
-        subprocess.run(
-            ["git", "checkout", "-b", spec_branch],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-
-        # Create a file that will conflict
-        (temp_git_repo / "conflict.txt").write_text("spec version", encoding="utf-8")
-        subprocess.run(["git", "add", "."], cwd=temp_git_repo, capture_output=True)
-        subprocess.run(
-            ["git", "commit", "-m", "Spec conflict"],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-
-        # Modify the same file on main
-        subprocess.run(
-            ["git", "checkout", "main"],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-        (temp_git_repo / "conflict.txt").write_text("main version", encoding="utf-8")
-        subprocess.run(["git", "add", "."], cwd=temp_git_repo, capture_output=True)
-        subprocess.run(
-            ["git", "commit", "-m", "Main conflict"],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-
-        # Rebase should handle conflict by aborting
-        result = _rebase_spec_branch(temp_git_repo, "test-spec", "main")
-
-        # Should return False (rebase was aborted due to conflicts, no ref movement)
-        assert result is False, "Rebase with conflicts should return False after abort"
-
-        # Verify we're not in a rebase state (was aborted)
-        # Check both possible rebase state directories across git versions
-        rebase_merge_dir = temp_git_repo / ".git" / "rebase-merge"
-        rebase_apply_dir = temp_git_repo / ".git" / "rebase-apply"
-        assert not rebase_merge_dir.exists(), (
-            "Should not be in rebase-merge state after abort"
-        )
-        assert not rebase_apply_dir.exists(), (
-            "Should not be in rebase-apply state after abort"
-        )
-
-    def test_rebase_spec_branch_invalid_branch(self, temp_git_repo: Path):
-        """_rebase_spec_branch handles invalid branch gracefully (ACS-224)."""
-        from core.workspace import _rebase_spec_branch
-
-        # Try to rebase a non-existent spec branch
-        result = _rebase_spec_branch(temp_git_repo, "nonexistent-spec", "main")
-
-        assert result is False, "Rebase of non-existent branch should fail"
-
-        # NEW-004: Verify repo state after failure - should be clean and unchanged
-        # (1) Current branch should still be 'main'
-        current_branch = subprocess.run(
-            ["git", "rev-parse", "--abbrev-ref", "HEAD"],
-            cwd=temp_git_repo,
-            capture_output=True,
-            text=True,
-        )
-        assert current_branch.stdout.strip() == "main", "Should still be on main branch"
-
-        # (2) No rebase state directories should exist
-        rebase_merge_dir = temp_git_repo / ".git" / "rebase-merge"
-        rebase_apply_dir = temp_git_repo / ".git" / "rebase-apply"
-        assert not rebase_merge_dir.exists(), "Should not be in rebase-merge state"
-        assert not rebase_apply_dir.exists(), "Should not be in rebase-apply state"
-
-        # (3) Git status should show clean state
-        status_result = subprocess.run(
-            ["git", "status", "--porcelain"],
-            cwd=temp_git_repo,
-            capture_output=True,
-            text=True,
-        )
-        assert status_result.stdout.strip() == "", "Git status should be clean"
-
-    def test_rebase_spec_branch_already_up_to_date(self, temp_git_repo: Path):
-        """_rebase_spec_branch returns True when spec branch is already up-to-date (ACS-224)."""
-        from core.workspace import _rebase_spec_branch
-
-        # Create a spec branch and add a commit
-        spec_branch = "auto-claude/test-spec"
-        subprocess.run(
-            ["git", "checkout", "-b", spec_branch],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-        (temp_git_repo / "spec-file.txt").write_text("spec content", encoding="utf-8")
-        subprocess.run(["git", "add", "."], cwd=temp_git_repo, capture_output=True)
-        subprocess.run(
-            ["git", "commit", "-m", "Spec commit"],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-
-        # Switch back to main (no new commits added to main)
-        subprocess.run(
-            ["git", "checkout", "main"],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-
-        # Spec branch is ahead of main (not behind), so rebase should return True
-        # (branch already up-to-date is a success condition)
-        result = _rebase_spec_branch(temp_git_repo, "test-spec", "main")
-
-        assert result is True, (
-            "Rebase should return True when branch is already up-to-date"
-        )
-
-
-class TestRebaseIntegration:
-    """Integration tests for automatic rebase in merge flow (ACS-224)."""
-
-    def test_smart_merge_auto_rebases_when_behind(self, temp_git_repo: Path):
-        """Smart merge automatically rebases spec branch when behind (ACS-224)."""
-        from core.workspace import merge_existing_build
-
-        # Create a spec worktree
-        manager = WorktreeManager(temp_git_repo)
-        manager.setup()
-
-        worker_info = manager.create_worktree("test-spec")
-
-        # Add a file in spec worktree and commit
-        (worker_info.path / "spec-file.txt").write_text(
-            "spec content", encoding="utf-8"
-        )
-        subprocess.run(["git", "add", "."], cwd=worker_info.path, capture_output=True)
-        subprocess.run(
-            ["git", "commit", "-m", "Spec commit"],
-            cwd=worker_info.path,
-            capture_output=True,
-        )
-
-        # Add commits to main (making spec branch behind)
-        subprocess.run(
-            ["git", "checkout", manager.base_branch],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-        for i in range(2):
-            (temp_git_repo / f"main-{i}.txt").write_text(f"main {i}", encoding="utf-8")
-            subprocess.run(["git", "add", "."], cwd=temp_git_repo, capture_output=True)
-            subprocess.run(
-                ["git", "commit", "-m", f"Main {i}"],
-                cwd=temp_git_repo,
-                capture_output=True,
-            )
-
-        # Merge should succeed (auto-rebase + merge)
-        result = merge_existing_build(
-            temp_git_repo,
-            "test-spec",
-            no_commit=True,
-            use_smart_merge=True,
-        )
-
-        # Merge should return True (success)
-        assert result is True, "Merge with auto-rebase should succeed"
-
-    def test_check_git_conflicts_with_diverged_branches(self, temp_git_repo: Path):
-        """_check_git_conflicts correctly detects diverged branches (ACS-224)."""
-        from core.workspace import _check_git_conflicts
-
-        # Create a spec branch
-        spec_branch = "auto-claude/test-spec"
-        subprocess.run(
-            ["git", "checkout", "-b", spec_branch],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-
-        # Add a commit to spec
-        (temp_git_repo / "spec.txt").write_text("spec", encoding="utf-8")
-        subprocess.run(["git", "add", "."], cwd=temp_git_repo, capture_output=True)
-        subprocess.run(
-            ["git", "commit", "-m", "Spec"],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-
-        # Add different commits to main
-        subprocess.run(
-            ["git", "checkout", "main"],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-        (temp_git_repo / "main.txt").write_text("main", encoding="utf-8")
-        subprocess.run(["git", "add", "."], cwd=temp_git_repo, capture_output=True)
-        subprocess.run(
-            ["git", "commit", "-m", "Main"],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-
-        # Check git conflicts
-        result = _check_git_conflicts(temp_git_repo, "test-spec")
-
-        assert result is not None
-        assert result.get("needs_rebase") is True
-        assert result.get("commits_behind") == 1
-        assert result.get("base_branch") == "main"
-        assert result.get("spec_branch") == spec_branch
-
-
-class TestRebaseErrorHandling:
-    """Tests for rebase error handling (ACS-224)."""
-
-    def test_check_git_conflicts_handles_invalid_spec(self, temp_git_repo: Path):
-        """_check_git_conflicts handles non-existent spec branch gracefully (ACS-224)."""
-        from core.workspace import _check_git_conflicts
-
-        # Check conflicts for non-existent spec
-        result = _check_git_conflicts(temp_git_repo, "nonexistent-spec")
-
-        # Should return a valid dict structure even for non-existent branch
-        assert result is not None
-        assert "needs_rebase" in result
-        assert "commits_behind" in result
-        assert result.get("needs_rebase") is False
-        assert result.get("commits_behind") == 0
-
-    def test_check_git_conflicts_handles_detached_head(self, temp_git_repo: Path):
-        """_check_git_conflicts handles detached HEAD state gracefully (ACS-224)."""
-        from core.workspace import _check_git_conflicts
-
-        # Create a spec branch first
-        spec_branch = "auto-claude/test-spec"
-        subprocess.run(
-            ["git", "checkout", "-b", spec_branch],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-        (temp_git_repo / "spec-file.txt").write_text("spec content", encoding="utf-8")
-        subprocess.run(["git", "add", "."], cwd=temp_git_repo, capture_output=True)
-        subprocess.run(
-            ["git", "commit", "-m", "Spec commit"],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-
-        # Get the commit hash and checkout to detached HEAD state
-        commit_result = subprocess.run(
-            ["git", "rev-parse", "HEAD"],
-            cwd=temp_git_repo,
-            capture_output=True,
-            text=True,
-        )
-        commit_hash = commit_result.stdout.strip()
-        subprocess.run(
-            ["git", "checkout", commit_hash],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-
-        # Check conflicts while in detached HEAD state
-        result = _check_git_conflicts(temp_git_repo, "test-spec")
-
-        # Should return a valid dict structure with safe defaults
-        assert result is not None
-        assert "needs_rebase" in result
-        assert "commits_behind" in result
-        # In detached HEAD, base_branch will be "HEAD" and results may vary
-        # The important thing is it doesn't crash
-
-        # Cleanup: return to main branch
-        subprocess.run(
-            ["git", "checkout", "main"],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-
-    def test_check_git_conflicts_handles_corrupted_repo(self, temp_git_repo: Path):
-        """_check_git_conflicts handles corrupted repo metadata gracefully (ACS-224)."""
-
-        from core.workspace import _check_git_conflicts
-
-        # Create a spec branch
-        spec_branch = "auto-claude/test-spec"
-        subprocess.run(
-            ["git", "checkout", "-b", spec_branch],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-        (temp_git_repo / "spec-file.txt").write_text("spec content", encoding="utf-8")
-        subprocess.run(["git", "add", "."], cwd=temp_git_repo, capture_output=True)
-        subprocess.run(
-            ["git", "commit", "-m", "Spec commit"],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-
-        # Return to main
-        subprocess.run(
-            ["git", "checkout", "main"],
-            cwd=temp_git_repo,
-            capture_output=True,
-        )
-
-        # Backup .git directory
-        git_dir = temp_git_repo / ".git"
-        backup_dir = temp_git_repo / ".git.backup"
-
-        try:
-            # Simulate corrupted repo by temporarily moving .git
-            shutil.move(str(git_dir), str(backup_dir))
-
-            # Check conflicts should handle gracefully (no exception)
-            result = _check_git_conflicts(temp_git_repo, "test-spec")
-
-            # Should return a valid dict structure with default/false values
-            assert result is not None
-            assert "needs_rebase" in result
-            assert "commits_behind" in result
-            # When repo is corrupted, should return safe defaults
-            assert result.get("needs_rebase") is False
-            assert result.get("commits_behind") == 0
-
-        finally:
-            # Restore .git directory
-            if backup_dir.exists():
-                shutil.move(str(backup_dir), str(git_dir))
-            # Ensure we're back on main
-            subprocess.run(
-                ["git", "checkout", "main"],
-                cwd=temp_git_repo,
-                capture_output=True,
-            )

apps/backend/core/workspace/tests/test_setup.py

@@ -1,293 +0,0 @@
-#!/usr/bin/env python3
-"""
-Tests for Workspace Setup Operations
-=====================================
-
-Tests the setup functionality including:
-- Spec copy to workspace operations
-- Timeline hook installation
-- Timeline tracking initialization
-"""
-
-import json
-import os
-import shutil
-import subprocess
-import sys
-from pathlib import Path
-
-import pytest
-
-# Test constant - in the new per-spec architecture, each spec has its own worktree
-# named after the spec itself. This constant is used for test assertions.
-TEST_SPEC_NAME = "test-spec"
-
-
-class TestCopySpecToWorktree:
-    """Tests for copy_spec_to_worktree function."""
-
-    def test_copies_spec_files_to_worktree(self, temp_git_repo: Path):
-        """Copies spec directory to worktree .auto-claude/specs/ location."""
-        from core.workspace.setup import copy_spec_to_worktree
-
-        # Create source spec directory
-        source_spec = temp_git_repo / "specs" / "test-spec"
-        source_spec.mkdir(parents=True)
-        (source_spec / "spec.md").write_text("# Test Spec", encoding="utf-8")
-        (source_spec / "requirements.json").write_text("{}", encoding="utf-8")
-
-        # Create worktree
-        worktree_path = (
-            temp_git_repo / ".auto-claude" / "worktrees" / "tasks" / "test-spec"
-        )
-        worktree_path.mkdir(parents=True)
-
-        # Copy spec
-        result = copy_spec_to_worktree(source_spec, worktree_path, "test-spec")
-
-        # Verify path is correct
-        expected = worktree_path / ".auto-claude" / "specs" / "test-spec"
-        assert result == expected
-
-        # Verify files were copied
-        assert (expected / "spec.md").exists()
-        assert (expected / "requirements.json").exists()
-        assert (expected / "spec.md").read_text(encoding="utf-8") == "# Test Spec"
-
-    def test_overwrites_existing_spec_in_worktree(self, temp_git_repo: Path):
-        """Overwrites spec files if they already exist in worktree."""
-        from core.workspace.setup import copy_spec_to_worktree
-
-        # Create source spec
-        source_spec = temp_git_repo / "specs" / "test-spec"
-        source_spec.mkdir(parents=True)
-        (source_spec / "spec.md").write_text("# New Spec", encoding="utf-8")
-
-        # Create worktree with existing spec
-        worktree_path = (
-            temp_git_repo / ".auto-claude" / "worktrees" / "tasks" / "test-spec"
-        )
-        worktree_path.mkdir(parents=True)
-        existing_spec = worktree_path / ".auto-claude" / "specs" / "test-spec"
-        existing_spec.mkdir(parents=True)
-        (existing_spec / "spec.md").write_text("# Old Spec", encoding="utf-8")
-
-        # Copy spec
-        result = copy_spec_to_worktree(source_spec, worktree_path, "test-spec")
-
-        # Verify new content was copied
-        assert (result / "spec.md").read_text(encoding="utf-8") == "# New Spec"
-
-    def test_creates_parent_directories(self, temp_git_repo: Path):
-        """Creates .auto-claude/specs directory if it doesn't exist."""
-        from core.workspace.setup import copy_spec_to_worktree
-
-        source_spec = temp_git_repo / "specs" / "test-spec"
-        source_spec.mkdir(parents=True)
-        (source_spec / "spec.md").write_text("# Test", encoding="utf-8")
-
-        worktree_path = (
-            temp_git_repo / ".auto-claude" / "worktrees" / "tasks" / "test-spec"
-        )
-        worktree_path.mkdir(parents=True)
-
-        result = copy_spec_to_worktree(source_spec, worktree_path, "test-spec")
-
-        # Parent directories should be created
-        assert result.exists()
-        assert (result.parent).exists()
-
-
-class TestEnsureTimelineHookInstalled:
-    """Tests for ensure_timeline_hook_installed function."""
-
-    def test_skips_if_not_git_repo(self, temp_dir: Path):
-        """Skips hook installation if directory is not a git repo."""
-        from core.workspace.setup import ensure_timeline_hook_installed
-
-        # Should not raise exception
-        ensure_timeline_hook_installed(temp_dir)
-
-    def test_skips_if_hook_already_installed(self, temp_git_repo: Path, monkeypatch):
-        """Skips if FileTimelineTracker hook is already installed."""
-        from core.workspace.setup import ensure_timeline_hook_installed
-
-        # Create hooks directory
-        hooks_dir = temp_git_repo / ".git" / "hooks"
-        hooks_dir.mkdir(parents=True, exist_ok=True)
-
-        # Create hook with FileTimelineTracker marker
-        hook_file = hooks_dir / "post-commit"
-        hook_file.write_text(
-            "#!/bin/sh\n# FileTimelineTracker hook\necho 'tracked'", encoding="utf-8"
-        )
-
-        # Mock install_hook to track if it was called
-        install_called = []
-
-        def mock_install_hook(project_dir):
-            install_called.append(True)
-
-        monkeypatch.setattr("merge.install_hook.install_hook", mock_install_hook)
-
-        ensure_timeline_hook_installed(temp_git_repo)
-
-        # install_hook should not be called
-        assert len(install_called) == 0
-
-    def test_installs_hook_if_missing(self, temp_git_repo: Path):
-        """Installs hook if it doesn't exist."""
-        from core.workspace.setup import ensure_timeline_hook_installed
-
-        # Create hooks directory but no hook file
-        hooks_dir = temp_git_repo / ".git" / "hooks"
-        hooks_dir.mkdir(parents=True, exist_ok=True)
-
-        # This test verifies the function runs without error
-        # The actual install_hook call is hard to mock because it's imported locally
-        # In production, the real install_hook would be called
-        ensure_timeline_hook_installed(temp_git_repo)
-
-        # Verify hooks directory exists (function ran)
-        assert hooks_dir.exists()
-
-
-class TestInitializeTimelineTracking:
-    """Tests for initialize_timeline_tracking function."""
-
-    def test_with_implementation_plan(self, temp_git_repo: Path, monkeypatch):
-        """Initializes tracking with files from implementation plan."""
-        from core.workspace.setup import initialize_timeline_tracking
-
-        # Create source spec with implementation plan
-        spec_name = "test-spec"
-        source_spec = temp_git_repo / ".auto-claude" / "specs" / spec_name
-        source_spec.mkdir(parents=True)
-
-        plan = {
-            "title": "Test Feature",
-            "description": "Test description",
-            "phases": [
-                {
-                    "subtasks": [
-                        {"files": ["app/main.py", "app/utils.py"]},
-                        {"files": ["tests/test_main.py"]},
-                    ]
-                }
-            ],
-        }
-        (source_spec / "implementation_plan.json").write_text(
-            json.dumps(plan), encoding="utf-8"
-        )
-
-        # Create worktree
-        worktree_path = (
-            temp_git_repo / ".auto-claude" / "worktrees" / "tasks" / spec_name
-        )
-        worktree_path.mkdir(parents=True)
-
-        # Mock FileTimelineTracker
-        mock_tracker_calls = []
-
-        class MockTracker:
-            def __init__(self, project_dir):
-                pass
-
-            def on_task_start(
-                self,
-                task_id,
-                files_to_modify,
-                branch_point_commit,
-                task_intent,
-                task_title,
-            ):
-                mock_tracker_calls.append(
-                    {
-                        "task_id": task_id,
-                        "files": files_to_modify,
-                        "branch": branch_point_commit,
-                        "intent": task_intent,
-                        "title": task_title,
-                    }
-                )
-
-        monkeypatch.setattr("core.workspace.setup.FileTimelineTracker", MockTracker)
-
-        initialize_timeline_tracking(
-            temp_git_repo, spec_name, worktree_path, source_spec
-        )
-
-        # Verify tracker was called with correct parameters
-        assert len(mock_tracker_calls) == 1
-        call = mock_tracker_calls[0]
-        assert call["task_id"] == spec_name
-        assert set(call["files"]) == {
-            "app/main.py",
-            "app/utils.py",
-            "tests/test_main.py",
-        }
-        assert call["title"] == "Test Feature"
-        assert call["intent"] == "Test description"
-
-    def test_without_implementation_plan(self, temp_git_repo: Path, monkeypatch):
-        """Initializes tracking retroactively from worktree if no plan."""
-        from core.workspace.setup import initialize_timeline_tracking
-
-        spec_name = "test-spec"
-        worktree_path = (
-            temp_git_repo / ".auto-claude" / "worktrees" / "tasks" / spec_name
-        )
-        worktree_path.mkdir(parents=True)
-
-        # Mock FileTimelineTracker
-        mock_calls = []
-
-        class MockTracker:
-            def __init__(self, project_dir):
-                pass
-
-            def initialize_from_worktree(
-                self, task_id, worktree_path, task_intent, task_title
-            ):
-                mock_calls.append(
-                    {
-                        "task_id": task_id,
-                        "worktree": worktree_path,
-                        "intent": task_intent,
-                        "title": task_title,
-                    }
-                )
-
-        monkeypatch.setattr("core.workspace.setup.FileTimelineTracker", MockTracker)
-
-        initialize_timeline_tracking(temp_git_repo, spec_name, worktree_path, None)
-
-        # Should use retroactive initialization
-        assert len(mock_calls) == 1
-        assert mock_calls[0]["task_id"] == spec_name
-
-    def test_handles_exception_gracefully(
-        self, temp_git_repo: Path, monkeypatch, capsys
-    ):
-        """Logs warning but doesn't raise exception on error."""
-        from core.workspace.setup import initialize_timeline_tracking
-
-        spec_name = "test-spec"
-        worktree_path = (
-            temp_git_repo / ".auto-claude" / "worktrees" / "tasks" / spec_name
-        )
-        worktree_path.mkdir(parents=True)
-
-        # Mock FileTimelineTracker to raise exception
-        class FailingTracker:
-            def __init__(self, project_dir):
-                raise Exception("Tracker init failed")
-
-        monkeypatch.setattr("core.workspace.setup.FileTimelineTracker", FailingTracker)
-
-        # Should not raise
-        initialize_timeline_tracking(temp_git_repo, spec_name, worktree_path, None)
-
-        # Should print warning
-        captured = capsys.readouterr()
-        assert "Timeline tracking" in captured.out or "Note:" in captured.out

apps/backend/debug.py

@@ -1,40 +0,0 @@
-"""
-Debug module facade.
-
-Provides debug logging utilities for the Auto-Claude framework.
-Re-exports from core.debug for clean imports.
-"""
-
-from core.debug import (
-    Colors,
-    debug,
-    debug_async_timer,
-    debug_detailed,
-    debug_env_status,
-    debug_error,
-    debug_info,
-    debug_section,
-    debug_success,
-    debug_timer,
-    debug_verbose,
-    debug_warning,
-    get_debug_level,
-    is_debug_enabled,
-)
-
-__all__ = [
-    "Colors",
-    "debug",
-    "debug_async_timer",
-    "debug_detailed",
-    "debug_env_status",
-    "debug_error",
-    "debug_info",
-    "debug_section",
-    "debug_success",
-    "debug_timer",
-    "debug_verbose",
-    "debug_warning",
-    "get_debug_level",
-    "is_debug_enabled",
-]

apps/backend/init.py

@@ -1,306 +0,0 @@
-"""
-Auto Claude project initialization utilities.
-
-Handles first-time setup of .auto-claude directory and ensures proper gitignore configuration.
-"""
-
-import logging
-import os
-import subprocess
-from pathlib import Path
-
-from core.git_executable import get_git_executable
-
-logger = logging.getLogger(__name__)
-
-# All entries that should be added to .gitignore for auto-claude projects
-AUTO_CLAUDE_GITIGNORE_ENTRIES = [
-    ".auto-claude/",
-    ".auto-claude-security.json",
-    ".auto-claude-status",
-    ".claude_settings.json",
-    ".worktrees/",
-    ".security-key",
-    "logs/security/",
-]
-
-
-def _entry_exists_in_gitignore(lines: list[str], entry: str) -> bool:
-    """Check if an entry already exists in gitignore (handles trailing slash variations)."""
-    entry_normalized = entry.rstrip("/")
-    for line in lines:
-        line_stripped = line.strip()
-        # Match both "entry" and "entry/"
-        if (
-            line_stripped == entry
-            or line_stripped == entry_normalized
-            or line_stripped == entry_normalized + "/"
-        ):
-            return True
-    return False
-
-
-def ensure_gitignore_entry(project_dir: Path, entry: str = ".auto-claude/") -> bool:
-    """
-    Ensure an entry exists in the project's .gitignore file.
-
-    Creates .gitignore if it doesn't exist.
-
-    Args:
-        project_dir: The project root directory
-        entry: The gitignore entry to add (default: ".auto-claude/")
-
-    Returns:
-        True if entry was added, False if it already existed
-    """
-    gitignore_path = project_dir / ".gitignore"
-
-    # Check if .gitignore exists and if entry is already present
-    if gitignore_path.exists():
-        content = gitignore_path.read_text(encoding="utf-8")
-        lines = content.splitlines()
-
-        if _entry_exists_in_gitignore(lines, entry):
-            return False  # Already exists
-
-        # Entry doesn't exist, append it
-        # Ensure file ends with newline before adding our entry
-        if content and not content.endswith("\n"):
-            content += "\n"
-
-        # Add a comment and the entry
-        content += "\n# Auto Claude data directory\n"
-        content += entry + "\n"
-
-        gitignore_path.write_text(content, encoding="utf-8")
-        return True
-    else:
-        # Create new .gitignore with the entry
-        content = "# Auto Claude data directory\n"
-        content += entry + "\n"
-
-        gitignore_path.write_text(content, encoding="utf-8")
-        return True
-
-
-def _is_git_repo(project_dir: Path) -> bool:
-    """Check if the directory is a git repository."""
-    try:
-        result = subprocess.run(
-            [get_git_executable(), "rev-parse", "--is-inside-work-tree"],
-            cwd=project_dir,
-            capture_output=True,
-            text=True,
-            timeout=10,
-        )
-        return result.returncode == 0
-    except (subprocess.TimeoutExpired, Exception) as e:
-        logger.debug("Git repo check failed: %s", e)
-        return False
-
-
-def _commit_gitignore(project_dir: Path) -> bool:
-    """
-    Commit .gitignore changes with a standard message.
-
-    FIX (#1087): Auto-commit .gitignore changes to prevent merge failures.
-    Without this, merging tasks fails with "local changes would be overwritten".
-
-    Args:
-        project_dir: The project root directory
-
-    Returns:
-        True if commit succeeded, False otherwise
-    """
-    if not _is_git_repo(project_dir):
-        return False
-
-    try:
-        # Use LC_ALL=C to ensure English git output for reliable parsing
-        git_env = {**os.environ, "LC_ALL": "C"}
-
-        # Stage .gitignore
-        result = subprocess.run(
-            [get_git_executable(), "add", ".gitignore"],
-            cwd=project_dir,
-            capture_output=True,
-            text=True,
-            timeout=30,
-            env=git_env,
-        )
-        if result.returncode != 0:
-            return False
-
-        # Commit with standard message - explicitly specify .gitignore to avoid
-        # committing other staged files the user may have
-        result = subprocess.run(
-            [
-                get_git_executable(),
-                "commit",
-                ".gitignore",
-                "-m",
-                "chore: add auto-claude entries to .gitignore",
-            ],
-            cwd=project_dir,
-            capture_output=True,
-            text=True,
-            timeout=30,
-            env=git_env,
-        )
-        # Return True even if commit "fails" due to nothing to commit
-        # Check both stdout and stderr as message location varies by git version
-        combined_output = result.stdout + result.stderr
-        return result.returncode == 0 or "nothing to commit" in combined_output
-
-    except (subprocess.TimeoutExpired, Exception) as e:
-        logger.debug("Git commit failed: %s", e)
-        return False
-
-
-def ensure_all_gitignore_entries(
-    project_dir: Path, auto_commit: bool = False
-) -> list[str]:
-    """
-    Ensure all auto-claude related entries exist in the project's .gitignore file.
-
-    Creates .gitignore if it doesn't exist.
-
-    Args:
-        project_dir: The project root directory
-        auto_commit: If True, automatically commit the .gitignore changes
-
-    Returns:
-        List of entries that were added (empty if all already existed)
-    """
-    gitignore_path = project_dir / ".gitignore"
-    added_entries: list[str] = []
-
-    # Read existing content or start fresh
-    if gitignore_path.exists():
-        content = gitignore_path.read_text(encoding="utf-8")
-        lines = content.splitlines()
-    else:
-        content = ""
-        lines = []
-
-    # Find entries that need to be added
-    entries_to_add = [
-        entry
-        for entry in AUTO_CLAUDE_GITIGNORE_ENTRIES
-        if not _entry_exists_in_gitignore(lines, entry)
-    ]
-
-    if not entries_to_add:
-        return []
-
-    # Build the new content to append
-    # Ensure file ends with newline before adding our entries
-    if content and not content.endswith("\n"):
-        content += "\n"
-
-    content += "\n# Auto Claude generated files\n"
-    for entry in entries_to_add:
-        content += entry + "\n"
-        added_entries.append(entry)
-
-    gitignore_path.write_text(content, encoding="utf-8")
-
-    # Auto-commit if requested and entries were added
-    if auto_commit and added_entries:
-        if not _commit_gitignore(project_dir):
-            logger.warning(
-                "Failed to auto-commit .gitignore changes in %s. "
-                "Manual commit may be required to avoid merge conflicts.",
-                project_dir,
-            )
-
-    return added_entries
-
-
-def init_auto_claude_dir(project_dir: Path) -> tuple[Path, bool]:
-    """
-    Initialize the .auto-claude directory for a project.
-
-    Creates the directory if needed and ensures all auto-claude files are in .gitignore.
-
-    Args:
-        project_dir: The project root directory
-
-    Returns:
-        Tuple of (auto_claude_dir path, gitignore_was_updated)
-    """
-    project_dir = Path(project_dir)
-    auto_claude_dir = project_dir / ".auto-claude"
-
-    # Create the directory if it doesn't exist
-    dir_created = not auto_claude_dir.exists()
-    auto_claude_dir.mkdir(parents=True, exist_ok=True)
-
-    # Ensure all auto-claude entries are in .gitignore (only on first creation)
-    # FIX (#1087): Auto-commit the changes to prevent merge failures
-    gitignore_updated = False
-    if dir_created:
-        added = ensure_all_gitignore_entries(project_dir, auto_commit=True)
-        gitignore_updated = len(added) > 0
-    else:
-        # Even if dir exists, check gitignore on first run
-        # Use a marker file to track if we've already checked
-        marker = auto_claude_dir / ".gitignore_checked"
-        if not marker.exists():
-            added = ensure_all_gitignore_entries(project_dir, auto_commit=True)
-            gitignore_updated = len(added) > 0
-            marker.touch()
-
-    return auto_claude_dir, gitignore_updated
-
-
-def get_auto_claude_dir(project_dir: Path, ensure_exists: bool = True) -> Path:
-    """
-    Get the .auto-claude directory path, optionally ensuring it exists.
-
-    Args:
-        project_dir: The project root directory
-        ensure_exists: If True, create directory and update gitignore if needed
-
-    Returns:
-        Path to the .auto-claude directory
-    """
-    if ensure_exists:
-        auto_claude_dir, _ = init_auto_claude_dir(project_dir)
-        return auto_claude_dir
-
-    return Path(project_dir) / ".auto-claude"
-
-
-def repair_gitignore(project_dir: Path) -> list[str]:
-    """
-    Repair an existing project's .gitignore to include all auto-claude entries.
-
-    This is useful for projects created before all entries were being added,
-    or when gitignore entries were manually removed.
-
-    Also resets the .gitignore_checked marker to allow future updates.
-    Changes are automatically committed if the project is a git repository.
-
-    Args:
-        project_dir: The project root directory
-
-    Returns:
-        List of entries that were added (empty if all already existed)
-    """
-    project_dir = Path(project_dir)
-    auto_claude_dir = project_dir / ".auto-claude"
-
-    # Remove the marker file so future checks will also run
-    marker = auto_claude_dir / ".gitignore_checked"
-    if marker.exists():
-        marker.unlink()
-
-    # Add all missing entries and auto-commit
-    added = ensure_all_gitignore_entries(project_dir, auto_commit=True)
-
-    # Re-create the marker
-    if auto_claude_dir.exists():
-        marker.touch()
-
-    return added

apps/backend/integrations/graphiti/providers_pkg/embedder_providers/openrouter_embedder.py

@@ -1,60 +0,0 @@
-"""
-OpenRouter Embedder Provider
-=============================
-
-OpenRouter embedder implementation for Graphiti.
-Uses OpenAI-compatible embedding API.
-"""
-
-from typing import TYPE_CHECKING, Any
-
-if TYPE_CHECKING:
-    from ...config import GraphitiConfig
-
-from ..exceptions import ProviderError, ProviderNotInstalled
-
-
-def create_openrouter_embedder(config: "GraphitiConfig") -> Any:
-    """
-    Create OpenRouter embedder client.
-
-    OpenRouter uses OpenAI-compatible API, so we use the OpenAI embedder
-    with custom base URL.
-
-    Args:
-        config: GraphitiConfig with OpenRouter settings
-
-    Returns:
-        OpenAI-compatible embedder instance
-
-    Raises:
-        ProviderNotInstalled: If graphiti-core is not installed
-        ProviderError: If API key is missing
-
-    Example:
-        >>> from auto_claude.integrations.graphiti.config import GraphitiConfig
-        >>> config = GraphitiConfig(
-        ...     openrouter_api_key="sk-or-...",
-        ...     openrouter_embedding_model="openai/text-embedding-3-small"
-        ... )
-        >>> embedder = create_openrouter_embedder(config)
-    """
-    try:
-        from graphiti_core.embedder import EmbedderConfig, OpenAIEmbedder
-    except ImportError as e:
-        raise ProviderNotInstalled(
-            f"OpenRouter provider requires graphiti-core. "
-            f"Install with: pip install graphiti-core\n"
-            f"Error: {e}"
-        )
-
-    if not config.openrouter_api_key:
-        raise ProviderError("OpenRouter provider requires OPENROUTER_API_KEY")
-
-    embedder_config = EmbedderConfig(
-        api_key=config.openrouter_api_key,
-        model=config.openrouter_embedding_model,
-        base_url=config.openrouter_base_url,
-    )
-
-    return OpenAIEmbedder(config=embedder_config)

apps/backend/integrations/graphiti/providers_pkg/llm_providers/openrouter_llm.py

@@ -1,63 +0,0 @@
-"""
-OpenRouter LLM Provider
-=======================
-
-OpenRouter LLM client implementation for Graphiti.
-Uses OpenAI-compatible API.
-"""
-
-from typing import TYPE_CHECKING, Any
-
-if TYPE_CHECKING:
-    from ...config import GraphitiConfig
-
-from ..exceptions import ProviderError, ProviderNotInstalled
-
-
-def create_openrouter_llm_client(config: "GraphitiConfig") -> Any:
-    """
-    Create OpenRouter LLM client.
-
-    OpenRouter uses OpenAI-compatible API, so we use the OpenAI client
-    with custom base URL.
-
-    Args:
-        config: GraphitiConfig with OpenRouter settings
-
-    Returns:
-        OpenAI-compatible LLM client instance
-
-    Raises:
-        ProviderNotInstalled: If graphiti-core is not installed
-        ProviderError: If API key is missing
-
-    Example:
-        >>> from auto_claude.integrations.graphiti.config import GraphitiConfig
-        >>> config = GraphitiConfig(
-        ...     openrouter_api_key="sk-or-...",
-        ...     openrouter_llm_model="anthropic/claude-sonnet-4"
-        ... )
-        >>> client = create_openrouter_llm_client(config)
-    """
-    try:
-        from graphiti_core.llm_client.config import LLMConfig
-        from graphiti_core.llm_client.openai_client import OpenAIClient
-    except ImportError as e:
-        raise ProviderNotInstalled(
-            f"OpenRouter provider requires graphiti-core. "
-            f"Install with: pip install graphiti-core\n"
-            f"Error: {e}"
-        )
-
-    if not config.openrouter_api_key:
-        raise ProviderError("OpenRouter provider requires OPENROUTER_API_KEY")
-
-    llm_config = LLMConfig(
-        api_key=config.openrouter_api_key,
-        model=config.openrouter_llm_model,
-        base_url=config.openrouter_base_url,
-    )
-
-    # OpenRouter uses OpenAI-compatible API
-    # Disable reasoning/verbosity for compatibility
-    return OpenAIClient(config=llm_config, reasoning=None, verbosity=None)

apps/backend/integrations/graphiti/queries_pkg/kuzu_driver_patched.py

@@ -1,179 +0,0 @@
-"""
-Patched KuzuDriver that properly creates FTS indexes and fixes parameter handling.
-
-The original graphiti-core KuzuDriver has two bugs:
-1. build_indices_and_constraints() is a no-op, so FTS indexes are never created
-2. execute_query() filters out None parameters, but queries still reference them
-
-This patched driver fixes both issues for LadybugDB compatibility.
-"""
-
-import logging
-import re
-from typing import Any
-
-# Import kuzu (might be real_ladybug via monkeypatch)
-try:
-    import kuzu
-except ImportError:  # pragma: no cover
-    # Fallback to real_ladybug if kuzu is not available.
-    # This import-time fallback is hard to test in normal unit tests
-    # since the module is imported once before tests can mock anything.
-    import real_ladybug as kuzu  # type: ignore
-
-logger = logging.getLogger(__name__)
-
-
-def create_patched_kuzu_driver(db: str = ":memory:", max_concurrent_queries: int = 1):
-    from graphiti_core.driver.driver import GraphProvider
-    from graphiti_core.driver.kuzu_driver import KuzuDriver as OriginalKuzuDriver
-    from graphiti_core.graph_queries import get_fulltext_indices
-
-    class PatchedKuzuDriver(OriginalKuzuDriver):
-        """
-        KuzuDriver with proper FTS index creation and parameter handling.
-
-        Fixes two bugs in graphiti-core:
-        1. FTS indexes are never created (build_indices_and_constraints is a no-op)
-        2. None parameters are filtered out, causing "Parameter not found" errors
-        """
-
-        def __init__(
-            self,
-            db: str = ":memory:",
-            max_concurrent_queries: int = 1,
-        ):
-            # Store database path before calling parent (which creates the Database)
-            self._database = db  # Required by Graphiti for group_id checks
-            super().__init__(db, max_concurrent_queries)
-
-        async def execute_query(
-            self, cypher_query_: str, **kwargs: Any
-        ) -> tuple[list[dict[str, Any]] | list[list[dict[str, Any]]], None, None]:
-            """
-            Execute a Cypher query with proper None parameter handling.
-
-            The original driver filters out None values, but LadybugDB requires
-            all referenced parameters to exist. This override keeps None values
-            in the parameters dict.
-            """
-            # Don't filter out None values - LadybugDB needs them
-            params = {k: v for k, v in kwargs.items()}
-            # Still remove these unsupported parameters
-            params.pop("database_", None)
-            params.pop("routing_", None)
-
-            try:
-                results = await self.client.execute(cypher_query_, parameters=params)
-            except Exception as e:
-                # Truncate long values for logging
-                log_params = {
-                    k: (v[:5] if isinstance(v, list) else v) for k, v in params.items()
-                }
-                logger.error(
-                    f"Error executing Kuzu query: {e}\n{cypher_query_}\n{log_params}"
-                )
-                raise
-
-            if not results:
-                return [], None, None
-
-            if isinstance(results, list):
-                dict_results = [list(result.rows_as_dict()) for result in results]
-            else:
-                dict_results = list(results.rows_as_dict())
-            return dict_results, None, None  # type: ignore
-
-        async def build_indices_and_constraints(self, delete_existing: bool = False):
-            """
-            Build FTS indexes required for Graphiti's hybrid search.
-
-            The original KuzuDriver has this as a no-op, but we need to actually
-            create the FTS indexes for search to work.
-
-            Args:
-                delete_existing: If True, drop and recreate indexes (default: False)
-            """
-            logger.info("Building FTS indexes for Kuzu/LadybugDB...")
-
-            # Get the FTS index creation queries from Graphiti
-            fts_queries = get_fulltext_indices(GraphProvider.KUZU)
-
-            # Create a sync connection for index creation
-            conn = kuzu.Connection(self.db)
-
-            try:
-                for query in fts_queries:
-                    try:
-                        # Check if we need to drop existing index first
-                        if delete_existing:
-                            # Extract index name from query
-                            # Format: CALL CREATE_FTS_INDEX('TableName', 'index_name', [...])
-                            match = re.search(
-                                r"CREATE_FTS_INDEX\('([^']+)',\s*'([^']+)'", query
-                            )
-                            if match:
-                                table_name, index_name = match.groups()
-                                drop_query = f"CALL DROP_FTS_INDEX('{table_name}', '{index_name}')"
-                                try:
-                                    conn.execute(drop_query)
-                                    logger.debug(
-                                        f"Dropped existing FTS index: {index_name}"
-                                    )
-                                except Exception:
-                                    # Index might not exist, that's fine
-                                    pass
-
-                        # Create the FTS index
-                        conn.execute(query)
-                        logger.debug(f"Created FTS index: {query[:80]}...")
-
-                    except Exception as e:
-                        error_msg = str(e).lower()
-                        # Handle "index already exists" gracefully
-                        if "already exists" in error_msg or "duplicate" in error_msg:
-                            logger.debug(
-                                f"FTS index already exists (skipping): {query[:60]}..."
-                            )
-                        else:
-                            # Log but don't fail - some indexes might fail in certain Kuzu versions
-                            logger.warning(f"Failed to create FTS index: {e}")
-                            logger.debug(f"Query was: {query}")
-
-                logger.info("FTS indexes created successfully")
-            finally:
-                conn.close()
-
-        def setup_schema(self):
-            """
-            Set up the database schema and install/load the FTS extension.
-
-            Extends the parent setup_schema() to properly set up FTS support.
-            """
-            conn = kuzu.Connection(self.db)
-
-            try:
-                # First, install the FTS extension (required before loading)
-                try:
-                    conn.execute("INSTALL fts")
-                    logger.debug("Installed FTS extension")
-                except Exception as e:
-                    error_msg = str(e).lower()
-                    if "already" not in error_msg:
-                        logger.debug(f"FTS extension install note: {e}")
-
-                # Then load the FTS extension
-                try:
-                    conn.execute("LOAD EXTENSION fts")
-                    logger.debug("Loaded FTS extension")
-                except Exception as e:
-                    error_msg = str(e).lower()
-                    if "already loaded" not in error_msg:
-                        logger.debug(f"FTS extension load note: {e}")
-            finally:
-                conn.close()
-
-            # Run the parent schema setup (creates tables)
-            super().setup_schema()
-
-    return PatchedKuzuDriver(db=db, max_concurrent_queries=max_concurrent_queries)

apps/backend/integrations/graphiti/queries_pkg/search.py

@@ -1,376 +0,0 @@
-"""
-Semantic search operations for Graphiti memory.
-
-Handles context retrieval, history queries, and similarity searches.
-"""
-
-import hashlib
-import json
-import logging
-from pathlib import Path
-
-from core.sentry import capture_exception
-
-from .schema import (
-    EPISODE_TYPE_GOTCHA,
-    EPISODE_TYPE_PATTERN,
-    EPISODE_TYPE_SESSION_INSIGHT,
-    EPISODE_TYPE_TASK_OUTCOME,
-    MAX_CONTEXT_RESULTS,
-    GroupIdMode,
-)
-
-logger = logging.getLogger(__name__)
-
-
-class GraphitiSearch:
-    """
-    Manages semantic search and context retrieval operations.
-
-    Provides methods for finding relevant knowledge from the graph.
-    """
-
-    def __init__(
-        self,
-        client,
-        group_id: str,
-        spec_context_id: str,
-        group_id_mode: str,
-        project_dir: Path,
-    ):
-        """
-        Initialize search manager.
-
-        Args:
-            client: GraphitiClient instance
-            group_id: Group ID for memory namespace
-            spec_context_id: Spec-specific context ID
-            group_id_mode: "spec" or "project" mode
-            project_dir: Project root directory
-        """
-        self.client = client
-        self.group_id = group_id
-        self.spec_context_id = spec_context_id
-        self.group_id_mode = group_id_mode
-        self.project_dir = project_dir
-
-    async def get_relevant_context(
-        self,
-        query: str,
-        num_results: int = MAX_CONTEXT_RESULTS,
-        include_project_context: bool = True,
-        min_score: float = 0.0,
-    ) -> list[dict]:
-        """
-        Search for relevant context based on a query.
-
-        Args:
-            query: Search query
-            num_results: Maximum number of results to return
-            include_project_context: If True and in SPEC mode, also search project-wide
-            min_score: Minimum relevance score threshold (0.0 to 1.0)
-
-        Returns:
-            List of relevant context items with content, score, and type
-        """
-        try:
-            # Determine which group IDs to search
-            group_ids = [self.group_id]
-
-            # In spec mode, optionally include project context too
-            if self.group_id_mode == GroupIdMode.SPEC and include_project_context:
-                project_name = self.project_dir.name
-                path_hash = hashlib.md5(
-                    str(self.project_dir.resolve()).encode(), usedforsecurity=False
-                ).hexdigest()[:8]
-                project_group_id = f"project_{project_name}_{path_hash}"
-                if project_group_id != self.group_id:
-                    group_ids.append(project_group_id)
-
-            results = await self.client.graphiti.search(
-                query=query,
-                group_ids=group_ids,
-                num_results=min(num_results, MAX_CONTEXT_RESULTS),
-            )
-
-            context_items = []
-            for result in results:
-                # Extract content from result
-                content = (
-                    getattr(result, "content", None)
-                    or getattr(result, "fact", None)
-                    or str(result)
-                )
-
-                # Normalize score to float, treating None as 0.0
-                raw_score = getattr(result, "score", None)
-                score = raw_score if raw_score is not None else 0.0
-
-                context_items.append(
-                    {
-                        "content": content,
-                        "score": score,
-                        "type": getattr(result, "type", "unknown"),
-                    }
-                )
-
-            # Filter by minimum score if specified
-            if min_score > 0:
-                context_items = [
-                    item
-                    for item in context_items
-                    if (item.get("score", 0.0)) >= min_score
-                ]
-
-            logger.info(
-                f"Found {len(context_items)} relevant context items for: {query[:50]}..."
-            )
-            return context_items
-
-        except Exception as e:
-            logger.warning(f"Failed to search context: {e}")
-            capture_exception(
-                e,
-                query_summary=query[:100] if query else "",
-                group_id=self.group_id,
-                operation="get_relevant_context",
-            )
-            return []
-
-    async def get_session_history(
-        self,
-        limit: int = 5,
-        spec_only: bool = True,
-    ) -> list[dict]:
-        """
-        Get recent session insights from the knowledge graph.
-
-        Args:
-            limit: Maximum number of sessions to return
-            spec_only: If True, only return sessions from this spec
-
-        Returns:
-            List of session insight summaries
-        """
-        try:
-            results = await self.client.graphiti.search(
-                query="session insight completed subtasks recommendations",
-                group_ids=[self.group_id],
-                num_results=limit * 2,  # Get more to filter
-            )
-
-            sessions = []
-            for result in results:
-                content = getattr(result, "content", None) or getattr(
-                    result, "fact", None
-                )
-                if content and EPISODE_TYPE_SESSION_INSIGHT in str(content):
-                    try:
-                        data = (
-                            json.loads(content) if isinstance(content, str) else content
-                        )
-                        # Ensure data is a dict before processing (fixes ACS-215)
-                        if not isinstance(data, dict):
-                            continue
-                        if data.get("type") == EPISODE_TYPE_SESSION_INSIGHT:
-                            # Filter by spec if requested
-                            if (
-                                spec_only
-                                and data.get("spec_id") != self.spec_context_id
-                            ):
-                                continue
-                            sessions.append(data)
-                    except (json.JSONDecodeError, TypeError, AttributeError):
-                        continue
-
-            # Sort by session number and return latest
-            sessions.sort(key=lambda x: x.get("session_number", 0), reverse=True)
-            return sessions[:limit]
-
-        except Exception as e:
-            logger.warning(f"Failed to get session history: {e}")
-            capture_exception(
-                e,
-                group_id=self.group_id,
-                operation="get_session_history",
-            )
-            return []
-
-    async def get_similar_task_outcomes(
-        self,
-        task_description: str,
-        limit: int = 5,
-    ) -> list[dict]:
-        """
-        Find similar past task outcomes to learn from.
-
-        Args:
-            task_description: Description of the current task
-            limit: Maximum number of results
-
-        Returns:
-            List of similar task outcomes with success/failure info
-        """
-        try:
-            results = await self.client.graphiti.search(
-                query=f"task outcome: {task_description}",
-                group_ids=[self.group_id],
-                num_results=limit * 2,
-            )
-
-            outcomes = []
-            for result in results:
-                content = getattr(result, "content", None) or getattr(
-                    result, "fact", None
-                )
-                if content and EPISODE_TYPE_TASK_OUTCOME in str(content):
-                    try:
-                        data = (
-                            json.loads(content) if isinstance(content, str) else content
-                        )
-                        # Ensure data is a dict before processing (fixes ACS-215)
-                        if not isinstance(data, dict):
-                            continue
-                        if data.get("type") == EPISODE_TYPE_TASK_OUTCOME:
-                            raw_score = getattr(result, "score", None)
-                            score = raw_score if raw_score is not None else 0.0
-                            outcomes.append(
-                                {
-                                    "task_id": data.get("task_id"),
-                                    "success": data.get("success"),
-                                    "outcome": data.get("outcome"),
-                                    "score": score,
-                                }
-                            )
-                    except (json.JSONDecodeError, TypeError, AttributeError):
-                        continue
-
-            return outcomes[:limit]
-
-        except Exception as e:
-            logger.warning(f"Failed to get similar task outcomes: {e}")
-            capture_exception(
-                e,
-                query_summary=task_description[:100] if task_description else "",
-                group_id=self.group_id,
-                operation="get_similar_task_outcomes",
-            )
-            return []
-
-    async def get_patterns_and_gotchas(
-        self,
-        query: str,
-        num_results: int = 5,
-        min_score: float = 0.5,
-    ) -> tuple[list[dict], list[dict]]:
-        """
-        Retrieve patterns and gotchas relevant to the current task.
-
-        Unlike get_relevant_context(), this specifically filters for
-        EPISODE_TYPE_PATTERN and EPISODE_TYPE_GOTCHA episodes to enable
-        cross-session learning.
-
-        Args:
-            query: Search query (task description)
-            num_results: Max results per type
-            min_score: Minimum relevance score (0.0-1.0)
-
-        Returns:
-            Tuple of (patterns, gotchas) lists
-        """
-        patterns = []
-        gotchas = []
-
-        try:
-            # Search with query focused on patterns
-            pattern_results = await self.client.graphiti.search(
-                query=f"pattern: {query}",
-                group_ids=[self.group_id],
-                num_results=num_results * 2,
-            )
-
-            for result in pattern_results:
-                content = getattr(result, "content", None) or getattr(
-                    result, "fact", None
-                )
-                raw_score = getattr(result, "score", None)
-                score = raw_score if raw_score is not None else 0.0
-
-                if score < min_score:
-                    continue
-
-                if content and EPISODE_TYPE_PATTERN in str(content):
-                    try:
-                        data = (
-                            json.loads(content) if isinstance(content, str) else content
-                        )
-                        # Ensure data is a dict before processing (fixes ACS-215)
-                        if not isinstance(data, dict):
-                            continue
-                        if data.get("type") == EPISODE_TYPE_PATTERN:
-                            patterns.append(
-                                {
-                                    "pattern": data.get("pattern", ""),
-                                    "applies_to": data.get("applies_to", ""),
-                                    "example": data.get("example", ""),
-                                    "score": score,
-                                }
-                            )
-                    except (json.JSONDecodeError, TypeError, AttributeError):
-                        continue
-
-            # Search with query focused on gotchas
-            gotcha_results = await self.client.graphiti.search(
-                query=f"gotcha pitfall avoid: {query}",
-                group_ids=[self.group_id],
-                num_results=num_results * 2,
-            )
-
-            for result in gotcha_results:
-                content = getattr(result, "content", None) or getattr(
-                    result, "fact", None
-                )
-                raw_score = getattr(result, "score", None)
-                score = raw_score if raw_score is not None else 0.0
-
-                if score < min_score:
-                    continue
-
-                if content and EPISODE_TYPE_GOTCHA in str(content):
-                    try:
-                        data = (
-                            json.loads(content) if isinstance(content, str) else content
-                        )
-                        # Ensure data is a dict before processing (fixes ACS-215)
-                        if not isinstance(data, dict):
-                            continue
-                        if data.get("type") == EPISODE_TYPE_GOTCHA:
-                            gotchas.append(
-                                {
-                                    "gotcha": data.get("gotcha", ""),
-                                    "trigger": data.get("trigger", ""),
-                                    "solution": data.get("solution", ""),
-                                    "score": score,
-                                }
-                            )
-                    except (json.JSONDecodeError, TypeError, AttributeError):
-                        continue
-
-            # Sort by score and limit
-            patterns.sort(key=lambda x: x.get("score", 0), reverse=True)
-            gotchas.sort(key=lambda x: x.get("score", 0), reverse=True)
-
-            logger.info(
-                f"Found {len(patterns)} patterns and {len(gotchas)} gotchas for: {query[:50]}..."
-            )
-            return patterns[:num_results], gotchas[:num_results]
-
-        except Exception as e:
-            logger.warning(f"Failed to get patterns/gotchas: {e}")
-            capture_exception(
-                e,
-                query_summary=query[:100] if query else "",
-                group_id=self.group_id,
-                operation="get_patterns_and_gotchas",
-            )
-            return [], []

apps/backend/integrations/graphiti/run_ollama_embedding_test.py

@@ -1,862 +0,0 @@
-#!/usr/bin/env python3
-"""
-Test Script for Ollama Embedding Memory Integration
-====================================================
-
-This test validates that the memory system works correctly with local Ollama
-embedding models (like embeddinggemma, nomic-embed-text) for creating and
-retrieving memories in the hybrid RAG system.
-
-The test covers:
-1. Ollama embedding generation (direct API test)
-2. Creating memories with Ollama embeddings via GraphitiMemory
-3. Retrieving memories via semantic search
-4. Verifying the full create → store → retrieve cycle
-
-Prerequisites:
-    1. Install Ollama: https://ollama.ai/
-    2. Pull an embedding model:
-       ollama pull embeddinggemma    # 768 dimensions (lightweight)
-       ollama pull nomic-embed-text  # 768 dimensions (good quality)
-    3. Pull an LLM model (for knowledge graph construction):
-       ollama pull deepseek-r1:7b    # or llama3.2:3b, mistral:7b
-    4. Start Ollama server: ollama serve
-    5. Configure environment:
-       export GRAPHITI_ENABLED=true
-       export GRAPHITI_LLM_PROVIDER=ollama
-       export GRAPHITI_EMBEDDER_PROVIDER=ollama
-       export OLLAMA_LLM_MODEL=deepseek-r1:7b
-       export OLLAMA_EMBEDDING_MODEL=embeddinggemma
-       export OLLAMA_EMBEDDING_DIM=768
-
-NOTE: graphiti-core internally uses an OpenAI reranker for search ranking.
-      For full offline operation, set a dummy key: export OPENAI_API_KEY=dummy
-      The reranker will fail at search time, but embedding creation works.
-      For production, use OpenAI API key for best search quality.
-
-Usage:
-    cd apps/backend
-    python integrations/graphiti/run_ollama_embedding_test.py
-
-    # Run specific tests:
-    python integrations/graphiti/run_ollama_embedding_test.py --test embeddings
-    python integrations/graphiti/run_ollama_embedding_test.py --test create
-    python integrations/graphiti/run_ollama_embedding_test.py --test retrieve
-    python integrations/graphiti/run_ollama_embedding_test.py --test full-cycle
-"""
-
-import argparse
-import asyncio
-import os
-import shutil
-import sys
-import tempfile
-from datetime import datetime
-from pathlib import Path
-
-# Add backend to path
-backend_dir = Path(__file__).parent.parent.parent.parent
-sys.path.insert(0, str(backend_dir))
-
-# Load .env file
-try:
-    from dotenv import load_dotenv
-
-    env_file = backend_dir / ".env"
-    if env_file.exists():
-        load_dotenv(env_file)
-        print(f"Loaded .env from {env_file}")
-except ImportError:
-    print("Note: python-dotenv not installed, using environment variables only")
-
-
-# ============================================================================
-# Helper Functions
-# ============================================================================
-
-
-def print_header(title: str):
-    """Print a section header."""
-    print("\n" + "=" * 70)
-    print(f"  {title}")
-    print("=" * 70 + "\n")
-
-
-def print_result(label: str, value: str, success: bool = True):
-    """Print a result line."""
-    status = "PASS" if success else "FAIL"
-    print(f"  [{status}] {label}: {value}")
-
-
-def print_info(message: str):
-    """Print an info line."""
-    print(f"  INFO: {message}")
-
-
-def print_step(step: int, message: str):
-    """Print a step indicator."""
-    print(f"\n  Step {step}: {message}")
-
-
-def apply_ladybug_monkeypatch():
-    """Apply LadybugDB monkeypatch for embedded database support."""
-    try:
-        import real_ladybug
-
-        sys.modules["kuzu"] = real_ladybug
-        return True
-    except ImportError:
-        pass
-
-    # Try native kuzu as fallback
-    try:
-        import kuzu  # noqa: F401
-
-        return True
-    except ImportError:
-        return False
-
-
-# ============================================================================
-# Test 1: Ollama Embedding Generation
-# ============================================================================
-
-
-async def test_ollama_embeddings() -> bool:
-    """
-    Test Ollama embedding generation directly via API.
-
-    This validates that Ollama is running and can generate embeddings
-    with the configured model.
-    """
-    print_header("Test 1: Ollama Embedding Generation")
-
-    ollama_model = os.environ.get("OLLAMA_EMBEDDING_MODEL", "embeddinggemma")
-    ollama_base_url = os.environ.get("OLLAMA_BASE_URL", "http://localhost:11434")
-    expected_dim = int(os.environ.get("OLLAMA_EMBEDDING_DIM", "768"))
-
-    print(f"  Ollama Model: {ollama_model}")
-    print(f"  Base URL: {ollama_base_url}")
-    print(f"  Expected Dimension: {expected_dim}")
-    print()
-
-    try:
-        import requests
-    except ImportError:
-        print_result("requests library", "Not installed - pip install requests", False)
-        return False
-
-    # Step 1: Check Ollama is running
-    print_step(1, "Checking Ollama server status")
-    try:
-        resp = requests.get(f"{ollama_base_url}/api/tags", timeout=10)
-        if resp.status_code != 200:
-            print_result(
-                "Ollama server",
-                f"Not responding (status {resp.status_code})",
-                False,
-            )
-            return False
-
-        models = resp.json().get("models", [])
-        model_names = [m.get("name", "") for m in models]
-        print_result("Ollama server", f"Running with {len(models)} models", True)
-
-        # Check if embedding model is available
-        embedding_model_found = any(
-            ollama_model in name or ollama_model.split(":")[0] in name
-            for name in model_names
-        )
-        if not embedding_model_found:
-            print_info(f"Model '{ollama_model}' not found. Available: {model_names}")
-            print_info(f"Pull it with: ollama pull {ollama_model}")
-
-    except requests.exceptions.ConnectionError:
-        print_result(
-            "Ollama server",
-            "Not running - start with 'ollama serve'",
-            False,
-        )
-        return False
-
-    # Step 2: Generate test embedding
-    print_step(2, "Generating test embeddings")
-
-    test_texts = [
-        "This is a test memory about implementing OAuth authentication.",
-        "The user prefers using TypeScript for frontend development.",
-        "A gotcha discovered: always validate JWT tokens on the server side.",
-    ]
-
-    embeddings = []
-    for i, text in enumerate(test_texts):
-        resp = requests.post(
-            f"{ollama_base_url}/api/embeddings",
-            json={"model": ollama_model, "prompt": text},
-            timeout=60,
-        )
-
-        if resp.status_code != 200:
-            print_result(
-                f"Embedding {i + 1}",
-                f"Failed: {resp.status_code} - {resp.text[:100]}",
-                False,
-            )
-            return False
-
-        data = resp.json()
-        embedding = data.get("embedding", [])
-        embeddings.append(embedding)
-
-        print_result(
-            f"Embedding {i + 1}",
-            f"Generated {len(embedding)} dimensions",
-            True,
-        )
-
-    # Step 3: Validate embedding dimensions
-    print_step(3, "Validating embedding dimensions")
-
-    for i, embedding in enumerate(embeddings):
-        if len(embedding) != expected_dim:
-            print_result(
-                f"Embedding {i + 1} dimension",
-                f"Mismatch! Got {len(embedding)}, expected {expected_dim}",
-                False,
-            )
-            print_info(f"Update OLLAMA_EMBEDDING_DIM={len(embedding)} in your config")
-            return False
-        print_result(
-            f"Embedding {i + 1} dimension", f"{len(embedding)} matches expected", True
-        )
-
-    # Step 4: Test embedding similarity (basic sanity check)
-    print_step(4, "Testing embedding similarity")
-
-    def cosine_similarity(a, b):
-        """Calculate cosine similarity between two vectors."""
-        dot_product = sum(x * y for x, y in zip(a, b))
-        norm_a = sum(x * x for x in a) ** 0.5
-        norm_b = sum(x * x for x in b) ** 0.5
-        return dot_product / (norm_a * norm_b) if norm_a and norm_b else 0
-
-    # Generate embedding for a similar query
-    query = "OAuth authentication implementation"
-    resp = requests.post(
-        f"{ollama_base_url}/api/embeddings",
-        json={"model": ollama_model, "prompt": query},
-        timeout=60,
-    )
-    query_embedding = resp.json().get("embedding", [])
-
-    similarities = [cosine_similarity(query_embedding, emb) for emb in embeddings]
-
-    print(f"  Query: '{query}'")
-    print("  Similarities to test texts:")
-    for i, (text, sim) in enumerate(zip(test_texts, similarities)):
-        print(f"    {i + 1}. {sim:.4f} - '{text[:50]}...'")
-
-    # First text (about OAuth) should have highest similarity to OAuth query
-    if similarities[0] > similarities[1] and similarities[0] > similarities[2]:
-        print_result("Semantic similarity", "OAuth query matches OAuth text best", True)
-    else:
-        print_info("Similarity ordering may vary - embeddings are still working")
-
-    print()
-    print_result("Ollama Embeddings", "All tests passed", True)
-    return True
-
-
-# ============================================================================
-# Test 2: Memory Creation with Ollama
-# ============================================================================
-
-
-async def test_memory_creation(test_db_path: Path) -> tuple[Path, Path, bool]:
-    """
-    Test creating memories using GraphitiMemory with Ollama embeddings.
-
-    Returns:
-        Tuple of (spec_dir, project_dir, success)
-    """
-    print_header("Test 2: Memory Creation with Ollama Embeddings")
-
-    # Create test directories
-    spec_dir = test_db_path / "test_spec"
-    project_dir = test_db_path / "test_project"
-    spec_dir.mkdir(parents=True, exist_ok=True)
-    project_dir.mkdir(parents=True, exist_ok=True)
-
-    print(f"  Spec dir: {spec_dir}")
-    print(f"  Project dir: {project_dir}")
-    print(f"  Database path: {test_db_path}")
-    print()
-
-    # Override database path for testing
-    os.environ["GRAPHITI_DB_PATH"] = str(test_db_path / "graphiti_db")
-    os.environ["GRAPHITI_DATABASE"] = "test_ollama_memory"
-
-    try:
-        from integrations.graphiti.memory import GraphitiMemory
-    except ImportError as e:
-        print_result("Import GraphitiMemory", f"Failed: {e}", False)
-        return spec_dir, project_dir, False
-
-    # Step 1: Initialize GraphitiMemory
-    print_step(1, "Initializing GraphitiMemory")
-
-    memory = GraphitiMemory(spec_dir, project_dir)
-    print(f"  Is enabled: {memory.is_enabled}")
-    print(f"  Group ID: {memory.group_id}")
-
-    if not memory.is_enabled:
-        print_result(
-            "GraphitiMemory",
-            "Not enabled - check GRAPHITI_ENABLED=true",
-            False,
-        )
-        return spec_dir, project_dir, False
-
-    init_result = await memory.initialize()
-    if not init_result:
-        print_result("Initialize", "Failed to initialize", False)
-        return spec_dir, project_dir, False
-
-    print_result("Initialize", "SUCCESS", True)
-
-    # Step 2: Save session insights
-    print_step(2, "Saving session insights")
-
-    session_insights = {
-        "subtasks_completed": ["implement-oauth-login", "add-jwt-validation"],
-        "discoveries": {
-            "files_understood": {
-                "auth/oauth.py": "OAuth 2.0 flow implementation with Google/GitHub",
-                "auth/jwt.py": "JWT token generation and validation utilities",
-            },
-            "patterns_found": [
-                "Pattern: Use refresh tokens for long-lived sessions",
-                "Pattern: Store tokens in httpOnly cookies for security",
-            ],
-            "gotchas_encountered": [
-                "Gotcha: Always validate JWT signature on server side",
-                "Gotcha: OAuth state parameter prevents CSRF attacks",
-            ],
-        },
-        "what_worked": [
-            "Using PyJWT for token handling",
-            "Separating OAuth providers into individual modules",
-        ],
-        "what_failed": [],
-        "recommendations_for_next_session": [
-            "Consider adding refresh token rotation",
-            "Add rate limiting to auth endpoints",
-        ],
-    }
-
-    save_result = await memory.save_session_insights(
-        session_num=1, insights=session_insights
-    )
-    print_result(
-        "save_session_insights", "SUCCESS" if save_result else "FAILED", save_result
-    )
-
-    # Step 3: Save patterns
-    print_step(3, "Saving code patterns")
-
-    patterns = [
-        "OAuth implementation uses authorization code flow for web apps",
-        "JWT tokens include user ID, roles, and expiration in payload",
-        "Token refresh happens automatically when access token expires",
-    ]
-
-    for i, pattern in enumerate(patterns):
-        result = await memory.save_pattern(pattern)
-        print_result(f"save_pattern {i + 1}", "SUCCESS" if result else "FAILED", result)
-
-    # Step 4: Save gotchas
-    print_step(4, "Saving gotchas (pitfalls)")
-
-    gotchas = [
-        "Never store config values in frontend code or files checked into git",
-        "API redirect URIs must exactly match the registered URIs",
-        "Cache expiration times should be short for performance (15 min default)",
-    ]
-
-    for i, gotcha in enumerate(gotchas):
-        result = await memory.save_gotcha(gotcha)
-        print_result(f"save_gotcha {i + 1}", "SUCCESS" if result else "FAILED", result)
-
-    # Step 5: Save codebase discoveries
-    print_step(5, "Saving codebase discoveries")
-
-    discoveries = {
-        "api/routes/users.py": "User management API endpoints (list, create, update)",
-        "middleware/logging.py": "Request logging middleware for all routes",
-        "models/user.py": "User model with profile data and role management",
-        "services/notifications.py": "Notification service integrations (email, SMS, push)",
-    }
-
-    discovery_result = await memory.save_codebase_discoveries(discoveries)
-    print_result(
-        "save_codebase_discoveries",
-        "SUCCESS" if discovery_result else "FAILED",
-        discovery_result,
-    )
-
-    # Brief wait for embedding processing
-    print()
-    print_info("Waiting 3 seconds for embedding processing...")
-    await asyncio.sleep(3)
-
-    await memory.close()
-
-    print()
-    print_result("Memory Creation", "All memories saved successfully", True)
-    return spec_dir, project_dir, True
-
-
-# ============================================================================
-# Test 3: Memory Retrieval with Semantic Search
-# ============================================================================
-
-
-async def test_memory_retrieval(spec_dir: Path, project_dir: Path) -> bool:
-    """
-    Test retrieving memories using semantic search with Ollama embeddings.
-
-    This validates that saved memories can be found via semantic similarity.
-    """
-    print_header("Test 3: Memory Retrieval with Semantic Search")
-
-    try:
-        from integrations.graphiti.memory import GraphitiMemory
-    except ImportError as e:
-        print_result("Import GraphitiMemory", f"Failed: {e}", False)
-        return False
-
-    # Step 1: Initialize memory (reconnect)
-    print_step(1, "Reconnecting to GraphitiMemory")
-
-    memory = GraphitiMemory(spec_dir, project_dir)
-    init_result = await memory.initialize()
-
-    if not init_result:
-        print_result("Initialize", "Failed to reconnect", False)
-        return False
-
-    print_result("Initialize", "Reconnected successfully", True)
-
-    # Step 2: Semantic search for API-related content
-    print_step(2, "Searching for API-related memories")
-
-    api_query = "How do the API endpoints work in this project?"
-    results = await memory.get_relevant_context(api_query, num_results=5)
-
-    print(f"  Query: '{api_query}'")
-    print(f"  Found {len(results)} results:")
-
-    api_found = False
-    for i, result in enumerate(results):
-        content = result.get("content", "")[:100]
-        result_type = result.get("type", "unknown")
-        score = result.get("score", 0)
-        print(f"    {i + 1}. [{result_type}] (score: {score:.4f}) {content}...")
-        if "api" in content.lower() or "routes" in content.lower():
-            api_found = True
-
-    if api_found:
-        print_result("API search", "Found API-related content", True)
-    else:
-        print_info("API content may not be in top results - checking other queries")
-
-    # Step 3: Search for middleware-related content
-    print_step(3, "Searching for middleware patterns")
-
-    middleware_query = "middleware and request handling best practices"
-    results = await memory.get_relevant_context(middleware_query, num_results=5)
-
-    print(f"  Query: '{middleware_query}'")
-    print(f"  Found {len(results)} results:")
-
-    middleware_found = False
-    for i, result in enumerate(results):
-        content = result.get("content", "")[:100]
-        result_type = result.get("type", "unknown")
-        score = result.get("score", 0)
-        print(f"    {i + 1}. [{result_type}] (score: {score:.4f}) {content}...")
-        if "middleware" in content.lower() or "routes" in content.lower():
-            middleware_found = True
-
-    print_result(
-        "Middleware search",
-        "Found middleware-related content" if middleware_found else "No direct matches",
-        middleware_found or len(results) > 0,
-    )
-
-    # Step 4: Get session history
-    print_step(4, "Retrieving session history")
-
-    history = await memory.get_session_history(limit=3)
-    print(f"  Found {len(history)} session records:")
-
-    for i, session in enumerate(history):
-        session_num = session.get("session_number", "?")
-        subtasks = session.get("subtasks_completed", [])
-        print(f"    Session {session_num}: {len(subtasks)} subtasks completed")
-        for subtask in subtasks[:3]:
-            print(f"      - {subtask}")
-
-    print_result(
-        "Session history", f"Retrieved {len(history)} sessions", len(history) > 0
-    )
-
-    # Step 5: Get status summary
-    print_step(5, "Memory status summary")
-
-    status = memory.get_status_summary()
-    for key, value in status.items():
-        print(f"    {key}: {value}")
-
-    await memory.close()
-
-    print()
-    all_passed = len(results) > 0 and len(history) > 0
-    print_result(
-        "Memory Retrieval",
-        "All retrieval tests passed" if all_passed else "Some tests had issues",
-        all_passed,
-    )
-    return all_passed
-
-
-# ============================================================================
-# Test 4: Full Create → Store → Retrieve Cycle
-# ============================================================================
-
-
-async def test_full_cycle(test_db_path: Path) -> bool:
-    """
-    Test the complete memory lifecycle:
-    1. Create unique test data
-    2. Store in graph database with Ollama embeddings
-    3. Search and retrieve via semantic similarity
-    4. Verify retrieved data matches what was stored
-    """
-    print_header("Test 4: Full Create-Store-Retrieve Cycle")
-
-    # Create fresh test directories
-    spec_dir = test_db_path / "cycle_test_spec"
-    project_dir = test_db_path / "cycle_test_project"
-    spec_dir.mkdir(parents=True, exist_ok=True)
-    project_dir.mkdir(parents=True, exist_ok=True)
-
-    # Override database path for testing
-    os.environ["GRAPHITI_DB_PATH"] = str(test_db_path / "graphiti_db")
-    os.environ["GRAPHITI_DATABASE"] = "test_full_cycle"
-
-    try:
-        from integrations.graphiti.memory import GraphitiMemory
-    except ImportError as e:
-        print_result("Import", f"Failed: {e}", False)
-        return False
-
-    # Step 1: Create unique test content
-    print_step(1, "Creating unique test content")
-
-    unique_id = datetime.now().strftime("%Y%m%d_%H%M%S")
-    unique_pattern = (
-        f"Unique pattern {unique_id}: Use dependency injection for database connections"
-    )
-    unique_gotcha = f"Unique gotcha {unique_id}: Always close database connections in finally blocks"
-
-    print(f"  Unique ID: {unique_id}")
-    print(f"  Pattern: {unique_pattern[:60]}...")
-    print(f"  Gotcha: {unique_gotcha[:60]}...")
-
-    # Step 2: Store the content
-    print_step(2, "Storing content in memory system")
-
-    memory = GraphitiMemory(spec_dir, project_dir)
-    init_result = await memory.initialize()
-
-    if not init_result:
-        print_result("Initialize", "Failed", False)
-        return False
-
-    print_result("Initialize", "SUCCESS", True)
-
-    pattern_result = await memory.save_pattern(unique_pattern)
-    print_result(
-        "save_pattern", "SUCCESS" if pattern_result else "FAILED", pattern_result
-    )
-
-    gotcha_result = await memory.save_gotcha(unique_gotcha)
-    print_result("save_gotcha", "SUCCESS" if gotcha_result else "FAILED", gotcha_result)
-
-    # Wait for embedding processing
-    print()
-    print_info("Waiting 4 seconds for embedding processing and indexing...")
-    await asyncio.sleep(4)
-
-    # Step 3: Search for the unique content
-    print_step(3, "Searching for unique content")
-
-    # Search for the pattern
-    pattern_query = "dependency injection database connections"
-    pattern_results = await memory.get_relevant_context(pattern_query, num_results=5)
-
-    print(f"  Query: '{pattern_query}'")
-    print(f"  Found {len(pattern_results)} results")
-
-    pattern_found = False
-    for result in pattern_results:
-        content = result.get("content", "")
-        if unique_id in content:
-            pattern_found = True
-            print(f"    MATCH: {content[:80]}...")
-
-    print_result(
-        "Pattern retrieval",
-        f"Found unique pattern (ID: {unique_id})"
-        if pattern_found
-        else "Unique pattern not in top results",
-        pattern_found,
-    )
-
-    # Search for the gotcha
-    gotcha_query = "database connection cleanup finally block"
-    gotcha_results = await memory.get_relevant_context(gotcha_query, num_results=5)
-
-    print(f"  Query: '{gotcha_query}'")
-    print(f"  Found {len(gotcha_results)} results")
-
-    gotcha_found = False
-    for result in gotcha_results:
-        content = result.get("content", "")
-        if unique_id in content:
-            gotcha_found = True
-            print(f"    MATCH: {content[:80]}...")
-
-    print_result(
-        "Gotcha retrieval",
-        f"Found unique gotcha (ID: {unique_id})"
-        if gotcha_found
-        else "Unique gotcha not in top results",
-        gotcha_found,
-    )
-
-    # Step 4: Verify semantic similarity works
-    print_step(4, "Verifying semantic similarity")
-
-    # Search with semantically similar but different wording
-    alt_query = "closing connections properly in error handling"
-    alt_results = await memory.get_relevant_context(alt_query, num_results=3)
-
-    print(f"  Alternative query: '{alt_query}'")
-    print(f"  Found {len(alt_results)} semantically similar results:")
-
-    for i, result in enumerate(alt_results):
-        content = result.get("content", "")[:80]
-        score = result.get("score", 0)
-        print(f"    {i + 1}. (score: {score:.4f}) {content}...")
-
-    semantic_works = len(alt_results) > 0
-    print_result(
-        "Semantic similarity",
-        "Working - found related content" if semantic_works else "No results",
-        semantic_works,
-    )
-
-    await memory.close()
-
-    # Summary
-    print()
-    cycle_passed = (
-        pattern_result
-        and gotcha_result
-        and (pattern_found or gotcha_found or len(alt_results) > 0)
-    )
-    print_result(
-        "Full Cycle Test",
-        "Create-Store-Retrieve cycle verified"
-        if cycle_passed
-        else "Some steps had issues",
-        cycle_passed,
-    )
-
-    return cycle_passed
-
-
-# ============================================================================
-# Main Entry Point
-# ============================================================================
-
-
-async def main():
-    """Run Ollama embedding memory tests."""
-    parser = argparse.ArgumentParser(
-        description="Test Ollama Embedding Memory Integration"
-    )
-    parser.add_argument(
-        "--test",
-        choices=["all", "embeddings", "create", "retrieve", "full-cycle"],
-        default="all",
-        help="Which test to run",
-    )
-    parser.add_argument(
-        "--keep-db",
-        action="store_true",
-        help="Keep test database after completion (default: cleanup)",
-    )
-
-    args = parser.parse_args()
-
-    print("\n" + "=" * 70)
-    print("  OLLAMA EMBEDDING MEMORY TEST SUITE")
-    print("=" * 70)
-
-    # Configuration check
-    print_header("Configuration Check")
-
-    config_items = {
-        "GRAPHITI_ENABLED": os.environ.get("GRAPHITI_ENABLED", ""),
-        "GRAPHITI_LLM_PROVIDER": os.environ.get("GRAPHITI_LLM_PROVIDER", ""),
-        "GRAPHITI_EMBEDDER_PROVIDER": os.environ.get("GRAPHITI_EMBEDDER_PROVIDER", ""),
-        "OLLAMA_LLM_MODEL": os.environ.get("OLLAMA_LLM_MODEL", ""),
-        "OLLAMA_EMBEDDING_MODEL": os.environ.get("OLLAMA_EMBEDDING_MODEL", ""),
-        "OLLAMA_EMBEDDING_DIM": os.environ.get("OLLAMA_EMBEDDING_DIM", ""),
-        "OLLAMA_BASE_URL": os.environ.get("OLLAMA_BASE_URL", "http://localhost:11434"),
-        "OPENAI_API_KEY": "(set)"
-        if os.environ.get("OPENAI_API_KEY")
-        else "(not set - needed for reranker)",
-    }
-
-    all_configured = True
-    required_keys = [
-        "GRAPHITI_ENABLED",
-        "GRAPHITI_LLM_PROVIDER",
-        "GRAPHITI_EMBEDDER_PROVIDER",
-        "OLLAMA_LLM_MODEL",
-        "OLLAMA_EMBEDDING_MODEL",
-    ]
-
-    for key, value in config_items.items():
-        is_optional = key in [
-            "OLLAMA_BASE_URL",
-            "OPENAI_API_KEY",
-            "OLLAMA_EMBEDDING_DIM",
-        ]
-        is_set = bool(value) if not is_optional else True
-        display_value = value or "(not set)"
-        if key == "OPENAI_API_KEY":
-            display_value = value  # Already formatted above
-            is_set = True  # Optional for testing
-        print_result(key, display_value, is_set)
-        if key in required_keys and not bool(os.environ.get(key)):
-            all_configured = False
-
-    if not all_configured:
-        print()
-        print("  Missing required configuration. Please set:")
-        print("    export GRAPHITI_ENABLED=true")
-        print("    export GRAPHITI_LLM_PROVIDER=ollama")
-        print("    export GRAPHITI_EMBEDDER_PROVIDER=ollama")
-        print("    export OLLAMA_LLM_MODEL=deepseek-r1:7b")
-        print("    export OLLAMA_EMBEDDING_MODEL=embeddinggemma")
-        print("    export OLLAMA_EMBEDDING_DIM=768")
-        print("    export OPENAI_API_KEY=dummy  # For graphiti-core reranker")
-        print()
-        return
-
-    # Check LadybugDB
-    if not apply_ladybug_monkeypatch():
-        print()
-        print_result("LadybugDB", "Not installed - pip install real-ladybug", False)
-        return
-
-    print_result("LadybugDB", "Installed", True)
-
-    # Create temp directory for test database
-    test_db_path = Path(tempfile.mkdtemp(prefix="ollama_memory_test_"))
-    print()
-    print_info(f"Test database: {test_db_path}")
-
-    # Run tests
-    test = args.test
-    results = {}
-
-    try:
-        if test in ["all", "embeddings"]:
-            results["embeddings"] = await test_ollama_embeddings()
-
-        spec_dir = None
-        project_dir = None
-
-        if test in ["all", "create"]:
-            spec_dir, project_dir, results["create"] = await test_memory_creation(
-                test_db_path
-            )
-
-        if test in ["all", "retrieve"]:
-            if spec_dir and project_dir:
-                results["retrieve"] = await test_memory_retrieval(spec_dir, project_dir)
-            else:
-                print_info(
-                    "Skipping retrieve test - no spec/project dir from create test"
-                )
-
-        if test in ["all", "full-cycle"]:
-            results["full-cycle"] = await test_full_cycle(test_db_path)
-
-    finally:
-        # Cleanup unless --keep-db specified
-        if not args.keep_db and test_db_path.exists():
-            print()
-            print_info(f"Cleaning up test database: {test_db_path}")
-            shutil.rmtree(test_db_path, ignore_errors=True)
-
-    # Summary
-    print_header("TEST SUMMARY")
-
-    all_passed = True
-    for test_name, passed in results.items():
-        status = "PASSED" if passed else "FAILED"
-        print(f"  {test_name}: {status}")
-        if not passed:
-            all_passed = False
-
-    print()
-    if all_passed:
-        print("  All tests PASSED!")
-        print()
-        print("  The memory system is working correctly with Ollama embeddings.")
-        print("  Memories can be created and retrieved using semantic search.")
-    else:
-        print("  Some tests FAILED. Check the output above for details.")
-        print()
-        print("  Common issues:")
-        print("    - Ollama not running: ollama serve")
-        print("    - Model not pulled: ollama pull embeddinggemma")
-        print("    - Wrong dimension: Update OLLAMA_EMBEDDING_DIM to match model")
-
-    print()
-    print("  Commands:")
-    print("    # Run all tests:")
-    print("    python integrations/graphiti/run_ollama_embedding_test.py")
-    print()
-    print("    # Run specific test:")
-    print(
-        "    python integrations/graphiti/run_ollama_embedding_test.py --test embeddings"
-    )
-    print(
-        "    python integrations/graphiti/run_ollama_embedding_test.py --test full-cycle"
-    )
-    print()
-    print("    # Keep database for inspection:")
-    print("    python integrations/graphiti/run_ollama_embedding_test.py --keep-db")
-    print()
-
-
-if __name__ == "__main__":
-    asyncio.run(main())

apps/backend/integrations/graphiti/tests/__init__.py

@@ -1 +0,0 @@
-"""Tests for Graphiti memory integration."""

apps/backend/integrations/graphiti/tests/conftest.py

@@ -1,610 +0,0 @@
-"""
-Pytest configuration and fixtures for graphiti integration tests.
-
-This module provides shared fixtures for testing the memory system integration,
-including mocks for external dependencies, test configurations, and client fixtures.
-"""
-
-import os
-import sys
-from pathlib import Path
-from unittest.mock import AsyncMock, MagicMock, Mock, patch
-
-import pytest
-
-# Add the backend directory to sys.path to allow imports
-backend_dir = Path(__file__).parent.parent.parent.parent
-sys.path.insert(0, str(backend_dir))
-
-
-def pytest_collection_modifyitems(config, items):
-    """
-    Exclude validator functions from test collection.
-
-    The validators.py module contains functions named test_llm_connection and
-    test_embedder_connection which are not pytest tests but validator functions.
-    """
-    # Filter out items that are from validators.py and are not in test classes
-    filtered_items = []
-    for item in items:
-        # Get the full path of the test
-        item_path = str(item.fspath) if hasattr(item, "fspath") else str(item.path)
-
-        # Skip the standalone test_llm_connection and test_embedder_connection
-        # functions from validators.py (they're not pytest tests)
-        if item.name in [
-            "test_llm_connection",
-            "test_embedder_connection",
-            "test_ollama_connection",
-        ]:
-            # Check if it's from validators.py
-            if "validators.py" in item_path or "test_providers.py" in item_path:
-                # Only skip if it's a standalone function (not in a TestClass)
-                if not item.parent.name.startswith("Test"):
-                    continue
-
-        filtered_items.append(item)
-
-    items[:] = filtered_items
-
-
-# =============================================================================
-# External Dependency Mocks
-# =============================================================================
-
-
-@pytest.fixture
-def mock_graphiti_core():
-    """Mock graphiti_core.Graphiti and related classes.
-
-    Patches the graphiti_core library to prevent actual graph database connections
-    during tests.
-
-    Yields:
-        tuple: (mock_graphiti_class, mock_graphiti_instance)
-    """
-    with patch(
-        "integrations.graphiti.queries_pkg.graphiti.graphiti_core.Graphiti"
-    ) as mock_graphiti:
-        # Configure the mock to return a mock instance
-        mock_instance = MagicMock()
-        mock_graphiti.return_value = mock_instance
-
-        # Mock common methods that might be called
-        mock_instance.add_edges = AsyncMock()
-        mock_instance.add_nodes = AsyncMock()
-        mock_instance.search = AsyncMock(return_value=[])
-        mock_instance.delete_graph = AsyncMock()
-        mock_instance.close = AsyncMock()
-
-        yield mock_graphiti, mock_instance
-
-
-@pytest.fixture
-def mock_falkor_driver():
-    """Mock graphiti_core.driver.falkordb_driver.FalkorDriver.
-
-    Prevents actual FalkorDB connections during tests.
-
-    Yields:
-        tuple: (mock_driver_class, mock_driver_instance)
-    """
-    with patch(
-        "integrations.graphiti.queries_pkg.graphiti.graphiti_core.driver.falkordb_driver.FalkorDriver"
-    ) as mock_driver:
-        mock_instance = MagicMock()
-        mock_driver.return_value = mock_instance
-
-        # Mock driver methods
-        mock_instance.close = MagicMock()
-        mock_instance.execute_query = MagicMock(return_value=[])
-
-        yield mock_driver, mock_instance
-
-
-@pytest.fixture
-def mock_graphiti_providers():
-    """Mock graphiti_providers module.
-
-    Patches the graphiti_providers module to prevent actual LLM/embedder calls.
-
-    Yields:
-        tuple: (mock_get_client, mock_client_instance)
-    """
-    with patch(
-        "integrations.graphiti.providers_pkg.providers.get_client"
-    ) as mock_get_client:
-        mock_client = MagicMock()
-        mock_get_client.return_value = mock_client
-        yield mock_get_client, mock_client
-
-
-@pytest.fixture
-def mock_ladybug_db():
-    """Mock real_ladybug and kuzu database connections.
-
-    Prevents actual database connections during tests.
-
-    Yields:
-        dict: Dictionary with 'ladybug' and 'kuzu' keys, each containing
-              (mock_class, mock_instance) tuples.
-    """
-    with (
-        patch(
-            "integrations.graphiti.queries_pkg.client.real_ladybug.Ladybug"
-        ) as mock_ladybug,
-        patch("integrations.graphiti.queries_pkg.client.kuzu.Connection") as mock_kuzu,
-    ):
-        # Mock Ladybug instance
-        ladybug_instance = MagicMock()
-        mock_ladybug.return_value = ladybug_instance
-        ladybug_instance.close = MagicMock()
-
-        # Mock Kuzu connection
-        kuzu_instance = MagicMock()
-        mock_kuzu.return_value = kuzu_instance
-        kuzu_instance.close = MagicMock()
-
-        yield {
-            "ladybug": (mock_ladybug, ladybug_instance),
-            "kuzu": (mock_kuzu, kuzu_instance),
-        }
-
-
-# =============================================================================
-# Config Fixtures
-# =============================================================================
-
-
-@pytest.fixture
-def mock_config():
-    """Return a GraphitiConfig with test values.
-
-    Provides a test configuration that doesn't require real environment variables
-    or database connections.
-
-    Returns:
-        GraphitiConfig: Configuration with test values.
-    """
-    from integrations.graphiti.config import GraphitiConfig
-
-    config = GraphitiConfig(
-        enabled=True,
-        database="test_dataset",
-        db_path="/tmp/test_graphiti.db",
-        llm_provider="openai",
-        openai_model="gpt-5-mini",
-        embedder_provider="openai",
-        openai_embedding_model="text-embedding-3-small",
-        openai_api_key="sk-test-key-for-testing",
-    )
-
-    return config
-
-
-@pytest.fixture
-def mock_env_vars(tmp_path):
-    """Set test environment variables for Graphiti configuration.
-
-    Sets up a clean environment with test values for all Graphiti-related
-    environment variables.
-
-    Yields:
-        dict: Dictionary of environment variables that were set.
-    """
-    test_db_path = str(tmp_path / "test_graphiti.db")
-
-    env_vars = {
-        "GRAPHITI_ENABLED": "true",
-        "GRAPHITI_LLM_PROVIDER": "openai",
-        "GRAPHITI_EMBEDDER_PROVIDER": "openai",
-        "GRAPHITI_DATABASE": "test_dataset",
-        "GRAPHITI_DB_PATH": test_db_path,
-        "OPENAI_MODEL": "gpt-5-mini",
-        "OPENAI_EMBEDDING_MODEL": "text-embedding-3-small",
-        "OPENAI_API_KEY": "sk-test-key-for-testing",
-    }
-
-    # Save original values
-    original = {k: os.environ.get(k) for k in env_vars}
-
-    # Set test values
-    for key, value in env_vars.items():
-        os.environ[key] = value
-
-    yield env_vars
-
-    # Restore original values
-    for key, original_value in original.items():
-        if original_value is None:
-            os.environ.pop(key, None)
-        else:
-            os.environ[key] = original_value
-
-
-# =============================================================================
-# Client Fixtures
-# =============================================================================
-
-
-@pytest.fixture
-def mock_graphiti_client():
-    """Mock GraphitiClient with all necessary methods.
-
-    Provides a mock client that simulates the behavior of the GraphitiClient
-    without requiring actual graph database connections.
-
-    Returns:
-        Mock: Mocked GraphitiClient with typical methods mocked.
-    """
-    client = Mock()
-    client.graphiti = Mock()
-
-    # Core client methods
-    client.is_initialized = Mock(return_value=True)
-    client.initialize = AsyncMock()
-    client.get_session_id = Mock(return_value="test_session")
-    client.get_user_id = Mock(return_value="test_user")
-    client.get_project_id = Mock(return_value="test_project")
-
-    # Memory operations (async)
-    client.add_episode = AsyncMock(return_value="episode_id_123")
-    client.add_episodic_memories = AsyncMock(return_value=["mem_id_1", "mem_id_2"])
-    client.add_abstract_memories = AsyncMock(return_value=["abstract_id_1"])
-    client.search = AsyncMock(return_value=[])
-    client.delete_graph = AsyncMock()
-
-    # Graphiti instance methods
-    client.graphiti.search = AsyncMock(return_value=[])
-
-    # Configuration
-    client.get_config = Mock(
-        return_value=Mock(
-            enabled=True, database="test_dataset", db_path="/tmp/test_graphiti.db"
-        )
-    )
-
-    return client
-
-
-@pytest.fixture
-def mock_graphiti_instance():
-    """Mock the Graphiti instance from graphiti_core.
-
-    Provides a mock of the actual Graphiti core instance with all methods
-    that might be called during operations.
-
-    Returns:
-        Mock: Mocked Graphiti instance with typical methods mocked.
-    """
-    instance = MagicMock()
-
-    # Search methods (async)
-    instance.search = AsyncMock(return_value=[])
-    instance.search_by_abstract = AsyncMock(return_value=[])
-    instance.search_by_vector = AsyncMock(return_value=[])
-
-    # Add methods (async)
-    instance.add_episode = AsyncMock(return_value="episode_id")
-    instance.add_edges = AsyncMock()
-    instance.add_nodes = AsyncMock()
-
-    # Graph management
-    instance.delete_graph = AsyncMock()
-    instance.close = AsyncMock()
-    instance.get_graph_summary = Mock(return_value={"nodes": 0, "edges": 0})
-
-    # Configuration
-    instance.database = "test_dataset"
-
-    return instance
-
-
-# =============================================================================
-# Test Directory Fixtures
-# =============================================================================
-
-
-@pytest.fixture
-def temp_spec_dir(tmp_path):
-    """Create a temporary directory for spec testing.
-
-    Provides a temporary directory with spec-like structure for testing
-    spec-related functionality.
-
-    Args:
-        tmp_path: pytest's built-in tmp_path fixture.
-
-    Returns:
-        Path: Path to the temporary spec directory.
-    """
-    spec_dir = tmp_path / "spec_001_test"
-    spec_dir.mkdir()
-
-    # Create common spec subdirectories
-    (spec_dir / ".auto-claude").mkdir()
-    (spec_dir / "context").mkdir()
-
-    return spec_dir
-
-
-@pytest.fixture
-def temp_project_dir(tmp_path):
-    """Create a temporary directory for project testing.
-
-    Provides a temporary directory with project-like structure for testing
-    project-related functionality.
-
-    Args:
-        tmp_path: pytest's built-in tmp_path fixture.
-
-    Returns:
-        Path: Path to the temporary project directory.
-    """
-    project_dir = tmp_path / "test_project"
-    project_dir.mkdir()
-
-    # Create common project subdirectories
-    (project_dir / "src").mkdir()
-    (project_dir / "tests").mkdir()
-    (project_dir / ".auto-claude").mkdir()
-
-    return project_dir
-
-
-@pytest.fixture
-def temp_db_path(tmp_path):
-    """Create a temporary path for test database.
-
-    Provides a temporary file path that can be used for database testing
-    without affecting real databases.
-
-    Args:
-        tmp_path: pytest's built-in tmp_path fixture.
-
-    Returns:
-        str: Path to temporary database file.
-    """
-    db_path = str(tmp_path / "test_graphiti.db")
-    return db_path
-
-
-# =============================================================================
-# Provider Fixtures
-# =============================================================================
-
-
-@pytest.fixture
-def mock_llm_client():
-    """Mocked LLM client for testing.
-
-    Provides a mock client that simulates LLM responses without making
-    actual API calls.
-
-    Returns:
-        Mock: Mocked LLM client.
-    """
-    client = Mock()
-
-    # Message methods
-    client.messages = Mock()
-    mock_response = Mock()
-    mock_response.id = "msg_test_123"
-    mock_response.content = []
-    mock_response.model = "claude-3-5-sonnet-20241022"
-    mock_response.role = "assistant"
-    client.messages.create = Mock(return_value=mock_response)
-
-    # Streaming support
-    client.messages.stream = Mock(return_value=iter([]))
-
-    # Token counting
-    client.count_tokens = Mock(return_value=100)
-
-    return client
-
-
-@pytest.fixture
-def mock_embedder():
-    """Mocked embedder with get_embedding() method.
-
-    Provides a mock embedder that returns fake embeddings without making
-    actual API calls. Uses deterministic values for reproducibility.
-
-    Returns:
-        tuple: (mock_embedder, test_embedding_list)
-    """
-    embedder = Mock()
-
-    # Return a deterministic embedding vector (1536 dimensions is common for OpenAI)
-    # Using 0.1 for all values makes tests reproducible
-    test_embedding = [0.1] * 1536
-
-    embedder.get_embedding = Mock(return_value=test_embedding)
-    embedder.get_embeddings = Mock(return_value=[test_embedding])
-
-    return embedder, test_embedding
-
-
-# =============================================================================
-# State Fixtures
-# =============================================================================
-
-
-@pytest.fixture
-def mock_state():
-    """GraphitiState with test values.
-
-    Provides a mock state object with typical values for testing state-related
-    functionality.
-
-    Returns:
-        Mock: Mocked GraphitiState with test values.
-    """
-    from integrations.graphiti.config import GraphitiState
-
-    state = GraphitiState(
-        initialized=True,
-        database="test_dataset",
-        indices_built=True,
-        llm_provider="openai",
-        embedder_provider="openai",
-    )
-
-    return state
-
-
-@pytest.fixture
-def mock_empty_state():
-    """Empty GraphitiState.
-
-    Provides a mock state object with default/uninitialized values for testing
-    initialization logic.
-
-    Returns:
-        Mock: Mocked GraphitiState with empty/default values.
-    """
-    from integrations.graphiti.config import GraphitiState
-
-    state = GraphitiState()
-
-    return state
-
-
-# =============================================================================
-# Test Data Fixtures
-# =============================================================================
-
-
-@pytest.fixture
-def sample_episode_data():
-    """Sample episode data for testing.
-
-    Provides realistic episode data structure for testing memory operations.
-
-    Returns:
-        dict: Sample episode data.
-    """
-    return {
-        "episode_id": "episode_123",
-        "content": "Test episode content about a feature implementation",
-        "metadata": {
-            "task_id": "task_001",
-            "timestamp": "2024-01-01T00:00:00Z",
-            "type": "implementation",
-        },
-        "session_id": "test_session",
-        "user_id": "test_user",
-    }
-
-
-@pytest.fixture
-def sample_memory_nodes():
-    """Sample memory nodes for testing.
-
-    Provides realistic node data for testing graph operations.
-
-    Returns:
-        list: List of sample memory node dictionaries.
-    """
-    return [
-        {
-            "uuid": "node_1",
-            "name": "Feature Implementation",
-            "label": "CONCEPT",
-            "summary": "Implementation of new feature",
-            "created_at": "2024-01-01T00:00:00Z",
-        },
-        {
-            "uuid": "node_2",
-            "name": "Bug Fix",
-            "label": "CONCEPT",
-            "summary": "Fixed critical bug",
-            "created_at": "2024-01-02T00:00:00Z",
-        },
-    ]
-
-
-@pytest.fixture
-def sample_search_results():
-    """Sample search results for testing.
-
-    Provides realistic search result data for testing search operations.
-
-    Returns:
-        list: List of sample search result dictionaries.
-    """
-    return [
-        {
-            "uuid": "result_1",
-            "name": "Search Result 1",
-            "summary": "First search result",
-            "score": 0.95,
-        },
-        {
-            "uuid": "result_2",
-            "name": "Search Result 2",
-            "summary": "Second search result",
-            "score": 0.87,
-        },
-    ]
-
-
-# =============================================================================
-# Helper Fixtures
-# =============================================================================
-
-
-@pytest.fixture
-def clean_env():
-    """Fixture to ensure clean environment for each test.
-
-    Removes all Graphiti-related environment variables before the test
-    and restores them afterward.
-
-    Yields:
-        dict: Dictionary of original environment values.
-    """
-    # Store original env vars
-    env_keys = [
-        "GRAPHITI_ENABLED",
-        "GRAPHITI_LLM_PROVIDER",
-        "GRAPHITI_EMBEDDER_PROVIDER",
-        "GRAPHITI_DATABASE",
-        "GRAPHITI_DB_PATH",
-        "OPENAI_API_KEY",
-        "OPENAI_MODEL",
-        "OPENAI_EMBEDDING_MODEL",
-        "ANTHROPIC_API_KEY",
-        "GRAPHITI_ANTHROPIC_MODEL",
-        "AZURE_OPENAI_API_KEY",
-        "AZURE_OPENAI_BASE_URL",
-        "AZURE_OPENAI_LLM_DEPLOYMENT",
-        "AZURE_OPENAI_EMBEDDING_DEPLOYMENT",
-        "VOYAGE_API_KEY",
-        "VOYAGE_EMBEDDING_MODEL",
-        "GOOGLE_API_KEY",
-        "GOOGLE_LLM_MODEL",
-        "GOOGLE_EMBEDDING_MODEL",
-        "OPENROUTER_API_KEY",
-        "OPENROUTER_BASE_URL",
-        "OPENROUTER_LLM_MODEL",
-        "OPENROUTER_EMBEDDING_MODEL",
-        "OLLAMA_BASE_URL",
-        "OLLAMA_LLM_MODEL",
-        "OLLAMA_EMBEDDING_MODEL",
-        "OLLAMA_EMBEDDING_DIM",
-    ]
-
-    original = {}
-    for key in env_keys:
-        original[key] = os.environ.get(key)
-        if key in os.environ:
-            os.environ.pop(key)
-
-    yield original
-
-    # Restore original values
-    for key, value in original.items():
-        if value is not None:
-            os.environ[key] = value