fix(python): use venv Python for all services to fix dotenv errors (#311)

* fix(python): use venv Python for all services to fix dotenv errors

Services were spawning Python processes using findPythonCommand() which
returns the bundled Python directly. However, dependencies like python-dotenv
are only installed in the venv created from the bundled Python.

Changes:
- Add getConfiguredPythonPath() helper that returns venv Python when ready
- Update all services to use venv Python instead of bundled Python directly:
  - memory-service.ts
  - memory-handlers.ts
  - agent-process.ts
  - changelog-service.ts
  - title-generator.ts
  - insights/config.ts
  - project-context-handlers.ts
  - worktree-handlers.ts
- Fix availability checks to use findPythonCommand() (can return null)
- Add python:verify script for bundling verification

The flow now works correctly:
1. App starts → findPythonCommand() finds bundled Python
2. pythonEnvManager creates venv using bundled Python
3. pip installs dependencies (dotenv, claude-agent-sdk, etc.)
4. All services use venv Python → has all dependencies

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix lintin and test

---------

Co-authored-by: Claude <noreply@anthropic.com>

.coderabbit.yaml

@@ -0,0 +1,65 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+
+# CodeRabbit Configuration
+# Documentation: https://docs.coderabbit.ai/reference/configuration
+
+language: "en-US"
+
+reviews:
+  # Review profile: "chill" for fewer comments, "assertive" for more thorough feedback
+  profile: "assertive"
+
+  # Generate high-level summary in PR description
+  high_level_summary: true
+
+  # Automatic review settings
+  auto_review:
+    enabled: true
+    auto_incremental_review: true
+    # Target branches for review (in addition to default branch)
+    base_branches:
+      - develop
+      - "release/*"
+      - "hotfix/*"
+    # Skip review for PRs with these title keywords (case-insensitive)
+    ignore_title_keywords:
+      - "[WIP]"
+      - "WIP:"
+      - "DO NOT MERGE"
+    # Don't review draft PRs
+    drafts: false
+
+  # Path filters - exclude generated/vendor files
+  path_filters:
+    - "!**/node_modules/**"
+    - "!**/.venv/**"
+    - "!**/dist/**"
+    - "!**/build/**"
+    - "!**/*.lock"
+    - "!**/package-lock.json"
+    - "!**/*.min.js"
+    - "!**/*.min.css"
+
+  # Path-specific review instructions
+  path_instructions:
+    - path: "apps/backend/**/*.py"
+      instructions: |
+        Focus on Python best practices, type hints, and async patterns.
+        Check for proper error handling and security considerations.
+        Verify compatibility with Python 3.12+.
+    - path: "apps/frontend/**/*.{ts,tsx}"
+      instructions: |
+        Review React patterns and TypeScript type safety.
+        Check for proper state management and component composition.
+    - path: "tests/**"
+      instructions: |
+        Ensure tests are comprehensive and follow pytest conventions.
+        Check for proper mocking and test isolation.
+
+chat:
+  auto_reply: true
+
+knowledge_base:
+  opt_out: false
+  learnings:
+    scope: "auto"

.design-system/src/lib/icons.ts

@@ -0,0 +1,39 @@
+/**
+ * Centralized Icon Exports for Design System
+ *
+ * This file serves as the single source of truth for all lucide-react icons used
+ * throughout the design system demo app. By consolidating imports here, we enable:
+ *
+ * 1. Better tracking of which icons are actually used
+ * 2. Potential code-splitting opportunities
+ * 3. Easier future migration to alternative icon solutions
+ * 4. Reduced bundle size through optimized tree-shaking
+ *
+ * Usage:
+ *   import { Check, ChevronLeft, X } from '../lib/icons';
+ *
+ * When adding new icons:
+ *   1. Import the icon from 'lucide-react'
+ *   2. Add it to the export statement in alphabetical order
+ */
+
+export {
+  Check,
+  ChevronLeft,
+  ChevronRight,
+  Github,
+  Heart,
+  MessageSquare,
+  Minus,
+  Moon,
+  MoreVertical,
+  Plus,
+  RotateCcw,
+  Slack,
+  Sparkles,
+  Star,
+  Sun,
+  Video,
+  X,
+  Zap,
+} from 'lucide-react';

.github/FUNDING.yml

@@ -0,0 +1,3 @@
+# These are supported funding model platforms
+
+github: AndyMik90

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,75 +1,27 @@
-name: Bug Report
-description: Report a bug or unexpected behavior
-labels: ["bug", "triage"]
+name: 🐛 Bug Report
+description: Something isn't working
+labels: ["bug", "needs-triage"]
 body:
-  - type: markdown
+  - type: checkboxes
+    id: checklist
     attributes:
-      value: |
-        Thanks for taking the time to report a bug! Please fill out the sections below.
-
-  - type: textarea
-    id: description
-    attributes:
-      label: Bug Description
-      description: A clear and concise description of the bug.
-      placeholder: What happened?
-    validations:
-      required: true
-
-  - type: textarea
-    id: expected
-    attributes:
-      label: Expected Behavior
-      description: What did you expect to happen?
-      placeholder: What should have happened?
-    validations:
-      required: true
-
-  - type: textarea
-    id: reproduce
-    attributes:
-      label: Steps to Reproduce
-      description: Steps to reproduce the behavior.
-      placeholder: |
-        1. Run command '...'
-        2. Click on '...'
-        3. See error
-    validations:
-      required: true
-
-  - type: textarea
-    id: logs
-    attributes:
-      label: Error Messages / Logs
-      description: If applicable, paste any error messages or logs.
-      render: shell
-
-  - type: textarea
-    id: screenshots
-    attributes:
-      label: Screenshots
-      description: If applicable, add screenshots to help explain the problem.
+      label: Checklist
+      options:
+        - label: I searched existing issues and this hasn't been reported
+          required: true
 
   - type: dropdown
-    id: component
+    id: area
     attributes:
-      label: Component
-      description: Which part of Auto Claude is affected?
+      label: Area
       options:
-        - Python Backend (auto-claude/)
-        - Electron UI (auto-claude-ui/)
-        - Both
+        - Frontend
+        - Backend
+        - Fullstack
         - Not sure
     validations:
       required: true
 
-  - type: input
-    id: version
-    attributes:
-      label: Auto Claude Version
-      description: What version are you running? (check package.json or git tag)
-      placeholder: "v2.0.1"
-
   - type: dropdown
     id: os
     attributes:
@@ -78,26 +30,47 @@ body:
         - macOS
         - Windows
         - Linux
-        - Other
     validations:
       required: true
 
   - type: input
-    id: python-version
+    id: version
     attributes:
-      label: Python Version
-      description: Output of `python --version`
-      placeholder: "3.12.0"
-
-  - type: input
-    id: node-version
-    attributes:
-      label: Node.js Version (for UI issues)
-      description: Output of `node --version`
-      placeholder: "20.10.0"
+      label: Version
+      placeholder: "e.g., 2.5.5"
+    validations:
+      required: true
 
   - type: textarea
-    id: additional
+    id: description
     attributes:
-      label: Additional Context
-      description: Any other context about the problem.
+      label: What happened?
+      placeholder: Describe the bug clearly and concisely. Include any error messages you encountered.
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Run command '...' or click on '...'
+        2. Observe behavior '...'
+        3. See error or unexpected result
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      placeholder: What did you expect to happen instead? Describe the correct behavior.
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs / Screenshots
+      description: Required for UI bugs. Attach relevant logs, screenshots, or error output.
+      render: shell

.github/ISSUE_TEMPLATE/config.yml

@@ -1,8 +1,8 @@
 blank_issues_enabled: false
 contact_links:
-  - name: Questions & Discussions
+  - name: 💡 Feature Request
     url: https://github.com/AndyMik90/Auto-Claude/discussions
-    about: Ask questions and discuss ideas with the community
-  - name: Documentation
-    url: https://github.com/AndyMik90/Auto-Claude#readme
-    about: Check the documentation before opening an issue
+    about: Suggest new features in GitHub Discussions
+  - name: 💬 Discord Community
+    url: https://discord.gg/QhRnz9m5HE
+    about: Questions and discussions - join our Discord!

.github/ISSUE_TEMPLATE/docs.yml

@@ -0,0 +1,37 @@
+name: 📚 Documentation
+description: Improvements or additions to documentation
+labels: ["documentation", "needs-triage", "help wanted"]
+body:
+  - type: dropdown
+    id: type
+    attributes:
+      label: Type
+      options:
+        - Missing documentation
+        - Incorrect/outdated info
+        - Improvement suggestion
+        - Typo/grammar fix
+    validations:
+      required: true
+
+  - type: input
+    id: location
+    attributes:
+      label: Location
+      description: Which file or page?
+      placeholder: "e.g., README.md or guides/setup.md"
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: What needs to change?
+    validations:
+      required: true
+
+  - type: checkboxes
+    id: contribute
+    attributes:
+      label: Contribution
+      options:
+        - label: I'm willing to submit a PR for this

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,70 +0,0 @@
-name: Feature Request
-description: Suggest a new feature or enhancement
-labels: ["enhancement", "triage"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Thanks for suggesting a feature! Please describe your idea below.
-
-  - type: textarea
-    id: problem
-    attributes:
-      label: Problem Statement
-      description: What problem does this feature solve? Is this related to a frustration?
-      placeholder: I'm always frustrated when...
-    validations:
-      required: true
-
-  - type: textarea
-    id: solution
-    attributes:
-      label: Proposed Solution
-      description: Describe the solution you'd like to see.
-      placeholder: I would like Auto Claude to...
-    validations:
-      required: true
-
-  - type: textarea
-    id: alternatives
-    attributes:
-      label: Alternatives Considered
-      description: Have you considered any alternative solutions or workarounds?
-      placeholder: I've tried...
-
-  - type: dropdown
-    id: component
-    attributes:
-      label: Component
-      description: Which part of Auto Claude would this affect?
-      options:
-        - Python Backend (auto-claude/)
-        - Electron UI (auto-claude-ui/)
-        - Both
-        - New component
-        - Not sure
-    validations:
-      required: true
-
-  - type: dropdown
-    id: priority
-    attributes:
-      label: How important is this feature to you?
-      options:
-        - Nice to have
-        - Important for my workflow
-        - Critical / Blocking my use
-
-  - type: checkboxes
-    id: contribution
-    attributes:
-      label: Contribution
-      description: Would you be willing to help implement this?
-      options:
-        - label: I'm willing to submit a PR for this feature
-
-  - type: textarea
-    id: additional
-    attributes:
-      label: Additional Context
-      description: Add any other context, mockups, or screenshots about the feature request.

.github/ISSUE_TEMPLATE/question.yml

@@ -0,0 +1,61 @@
+name: ❓ Question
+description: Needs clarification
+labels: ["question", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        **Before asking:** Check [Discord](https://discord.gg/QhRnz9m5HE) - your question may already be answered there!
+
+  - type: checkboxes
+    id: checklist
+    attributes:
+      label: Checklist
+      options:
+        - label: I searched existing issues and Discord for similar questions
+          required: true
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - Setup/Installation
+        - Frontend
+        - Backend
+        - Configuration
+        - Other
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: Which version are you using?
+      placeholder: "e.g., 2.7.1"
+    validations:
+      required: true
+
+  - type: textarea
+    id: question
+    attributes:
+      label: Question
+      placeholder: "Describe your question in detail..."
+    validations:
+      required: true
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Context
+      description: What are you trying to achieve?
+    validations:
+      required: true
+
+  - type: textarea
+    id: attempts
+    attributes:
+      label: What have you already tried?
+      description: What steps have you taken to resolve this?
+      placeholder: "e.g., I tried reading the docs, searched for..."

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,44 +1,76 @@
-## Summary
+## Base Branch
 
-<!-- Brief description of what this PR does -->
+- [ ] This PR targets the `develop` branch (required for all feature/fix PRs)
+- [ ] This PR targets `main` (hotfix only - maintainers)
+
+## Description
+
+<!-- What does this PR do? 2-3 sentences -->
+
+## Related Issue
+
+Closes #
 
 ## Type of Change
 
-- [ ] Bug fix (non-breaking change that fixes an issue)
-- [ ] New feature (non-breaking change that adds functionality)
-- [ ] Breaking change (fix or feature that would cause existing functionality to change)
-- [ ] Documentation update
-- [ ] Refactoring (no functional changes)
-- [ ] Tests (adding or updating tests)
+- [ ] 🐛 Bug fix
+- [ ] ✨ New feature
+- [ ] 📚 Documentation
+- [ ] ♻️ Refactor
+- [ ] 🧪 Test
 
-## Related Issues
+## Area
 
-<!-- Link any related issues: Fixes #123, Closes #456 -->
+- [ ] Frontend
+- [ ] Backend
+- [ ] Fullstack
 
-## Changes Made
+## Commit Message Format
 
-<!-- List the main changes in this PR -->
+Follow conventional commits: `<type>: <subject>`
 
--
--
--
+**Types:** feat, fix, docs, style, refactor, test, chore
 
-## Screenshots
-
-<!-- If applicable, add screenshots for UI changes -->
+**Example:** `feat: add user authentication system`
 
 ## Checklist
 
-- [ ] I have run `pre-commit run --all-files` and fixed any issues
-- [ ] I have added tests for my changes (if applicable)
-- [ ] All existing tests pass locally
-- [ ] I have updated documentation (if applicable)
-- [ ] My code follows the project's code style
+- [ ] I've synced with `develop` branch
+- [ ] I've tested my changes locally
+- [ ] I've followed the code principles (SOLID, DRY, KISS)
+- [ ] My PR is small and focused (< 400 lines ideally)
 
-## Testing
+## CI/Testing Requirements
 
-<!-- Describe how you tested these changes -->
+- [ ] All CI checks pass
+- [ ] All existing tests pass
+- [ ] New features include test coverage
+- [ ] Bug fixes include regression tests
 
-## Additional Notes
+## Screenshots
 
-<!-- Any additional context or notes for reviewers -->
+<!-- Required for UI changes. Delete if not applicable. -->
+
+| Before | After |
+|--------|-------|
+|        |       |
+
+## Feature Toggle
+
+<!-- If feature is incomplete or experimental, how is it hidden from users? -->
+<!-- This ensures incomplete work can be merged without affecting production. -->
+
+- [ ] Behind localStorage flag: `use_feature_name`
+- [ ] Behind settings toggle
+- [ ] Behind environment variable/config
+- [ ] N/A - Feature is complete and ready for all users
+
+## Breaking Changes
+
+<!-- Does this PR introduce breaking changes? If yes, describe what breaks and migration steps. -->
+<!-- Delete this section if not applicable. -->
+
+**Breaking:** Yes / No
+
+**Details:**
+<!-- What breaks? What do users/developers need to change? -->

.github/dependabot.yml

@@ -0,0 +1,37 @@
+version: 2
+updates:
+  # Python dependencies
+  - package-ecosystem: pip
+    directory: /apps/backend
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - python
+    commit-message:
+      prefix: "chore(deps)"
+
+  # npm dependencies
+  - package-ecosystem: npm
+    directory: /apps/frontend
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - javascript
+    commit-message:
+      prefix: "chore(deps)"
+
+  # GitHub Actions
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - ci
+    commit-message:
+      prefix: "ci(deps)"

.github/release-drafter.yml

@@ -0,0 +1,35 @@
+name-template: 'v$RESOLVED_VERSION'
+tag-template: 'v$RESOLVED_VERSION'
+
+categories:
+  - title: '## New Features'
+    labels:
+      - 'feature'
+      - 'enhancement'
+  - title: '## Bug Fixes'
+    labels:
+      - 'bug'
+      - 'fix'
+  - title: '## Improvements'
+    labels:
+      - 'improvement'
+      - 'refactor'
+  - title: '## Documentation'
+    labels:
+      - 'documentation'
+  - title: '## Other Changes'
+    labels:
+      - '*'
+
+change-template: '* $TITLE (#$NUMBER) @$AUTHOR'
+
+sort-by: merged_at
+sort-direction: ascending
+
+template: |
+  $CHANGES
+
+  **Full Changelog**: https://github.com/$OWNER/$REPOSITORY/compare/$PREVIOUS_TAG...$RESOLVED_VERSION
+
+  ## Contributors
+  $CONTRIBUTORS

.github/workflows/beta-release.yml

@@ -0,0 +1,409 @@
+name: Beta Release
+
+# Manual trigger for beta releases from develop branch
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Beta version (e.g., 2.8.0-beta.1)'
+        required: true
+        type: string
+      dry_run:
+        description: 'Test build without creating release'
+        required: false
+        default: false
+        type: boolean
+
+jobs:
+  validate-version:
+    name: Validate beta version format
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate version format
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+
+          # Check if version matches beta semver pattern
+          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+-(beta|alpha|rc)\.[0-9]+$ ]]; then
+            echo "::error::Invalid version format: $VERSION"
+            echo "Version must match pattern: X.Y.Z-beta.N (e.g., 2.8.0-beta.1)"
+            exit 1
+          fi
+
+          echo "Valid beta version: $VERSION"
+
+  create-tag:
+    name: Create beta tag
+    needs: validate-version
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    outputs:
+      version: ${{ github.event.inputs.version }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: develop
+
+      - name: Create and push tag
+        if: ${{ github.event.inputs.dry_run != 'true' }}
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git tag -a "v$VERSION" -m "Beta release v$VERSION"
+          git push origin "v$VERSION"
+          echo "Created tag v$VERSION"
+
+  # Intel build on Intel runner for native compilation
+  build-macos-intel:
+    needs: create-tag
+    runs-on: macos-15-intel
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Use tag for real releases, develop branch for dry runs
+          ref: ${{ github.event.inputs.dry_run == 'true' && 'develop' || format('v{0}', needs.create-tag.outputs.version) }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+
+      - name: Get npm cache directory
+        id: npm-cache
+        run: echo "dir=$(npm config get cache)" >> $GITHUB_OUTPUT
+
+      - uses: actions/cache@v4
+        with:
+          path: ${{ steps.npm-cache.outputs.dir }}
+          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: ${{ runner.os }}-npm-
+
+      - name: Install dependencies
+        run: cd apps/frontend && npm ci
+
+      - name: Cache bundled Python
+        uses: actions/cache@v4
+        with:
+          path: apps/frontend/python-runtime
+          key: python-bundle-${{ runner.os }}-x64-3.12.8
+          restore-keys: |
+            python-bundle-${{ runner.os }}-x64-
+
+      - name: Build application
+        run: cd apps/frontend && npm run build
+
+      - name: Package macOS (Intel)
+        run: |
+          VERSION="${{ needs.create-tag.outputs.version }}"
+          cd apps/frontend && npm run package:mac -- --x64 --config.extraMetadata.version="$VERSION"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CSC_LINK: ${{ secrets.MAC_CERTIFICATE }}
+          CSC_KEY_PASSWORD: ${{ secrets.MAC_CERTIFICATE_PASSWORD }}
+
+      - name: Notarize macOS Intel app
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          if [ -z "$APPLE_ID" ]; then
+            echo "Skipping notarization: APPLE_ID not configured"
+            exit 0
+          fi
+          cd apps/frontend
+          for dmg in dist/*.dmg; do
+            echo "Notarizing $dmg..."
+            xcrun notarytool submit "$dmg" \
+              --apple-id "$APPLE_ID" \
+              --password "$APPLE_APP_SPECIFIC_PASSWORD" \
+              --team-id "$APPLE_TEAM_ID" \
+              --wait
+            xcrun stapler staple "$dmg"
+            echo "Successfully notarized and stapled $dmg"
+          done
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: macos-intel-builds
+          path: |
+            apps/frontend/dist/*.dmg
+            apps/frontend/dist/*.zip
+
+  # Apple Silicon build on ARM64 runner for native compilation
+  build-macos-arm64:
+    needs: create-tag
+    runs-on: macos-15
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Use tag for real releases, develop branch for dry runs
+          ref: ${{ github.event.inputs.dry_run == 'true' && 'develop' || format('v{0}', needs.create-tag.outputs.version) }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+
+      - name: Get npm cache directory
+        id: npm-cache
+        run: echo "dir=$(npm config get cache)" >> $GITHUB_OUTPUT
+
+      - uses: actions/cache@v4
+        with:
+          path: ${{ steps.npm-cache.outputs.dir }}
+          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: ${{ runner.os }}-npm-
+
+      - name: Install dependencies
+        run: cd apps/frontend && npm ci
+
+      - name: Cache bundled Python
+        uses: actions/cache@v4
+        with:
+          path: apps/frontend/python-runtime
+          key: python-bundle-${{ runner.os }}-arm64-3.12.8
+          restore-keys: |
+            python-bundle-${{ runner.os }}-arm64-
+
+      - name: Build application
+        run: cd apps/frontend && npm run build
+
+      - name: Package macOS (Apple Silicon)
+        run: |
+          VERSION="${{ needs.create-tag.outputs.version }}"
+          cd apps/frontend && npm run package:mac -- --arm64 --config.extraMetadata.version="$VERSION"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CSC_LINK: ${{ secrets.MAC_CERTIFICATE }}
+          CSC_KEY_PASSWORD: ${{ secrets.MAC_CERTIFICATE_PASSWORD }}
+
+      - name: Notarize macOS ARM64 app
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          if [ -z "$APPLE_ID" ]; then
+            echo "Skipping notarization: APPLE_ID not configured"
+            exit 0
+          fi
+          cd apps/frontend
+          for dmg in dist/*.dmg; do
+            echo "Notarizing $dmg..."
+            xcrun notarytool submit "$dmg" \
+              --apple-id "$APPLE_ID" \
+              --password "$APPLE_APP_SPECIFIC_PASSWORD" \
+              --team-id "$APPLE_TEAM_ID" \
+              --wait
+            xcrun stapler staple "$dmg"
+            echo "Successfully notarized and stapled $dmg"
+          done
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: macos-arm64-builds
+          path: |
+            apps/frontend/dist/*.dmg
+            apps/frontend/dist/*.zip
+
+  build-windows:
+    needs: create-tag
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Use tag for real releases, develop branch for dry runs
+          ref: ${{ github.event.inputs.dry_run == 'true' && 'develop' || format('v{0}', needs.create-tag.outputs.version) }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+
+      - name: Get npm cache directory
+        id: npm-cache
+        shell: bash
+        run: echo "dir=$(npm config get cache)" >> $GITHUB_OUTPUT
+
+      - uses: actions/cache@v4
+        with:
+          path: ${{ steps.npm-cache.outputs.dir }}
+          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: ${{ runner.os }}-npm-
+
+      - name: Install dependencies
+        run: cd apps/frontend && npm ci
+
+      - name: Cache bundled Python
+        uses: actions/cache@v4
+        with:
+          path: apps/frontend/python-runtime
+          key: python-bundle-${{ runner.os }}-x64-3.12.8
+          restore-keys: |
+            python-bundle-${{ runner.os }}-x64-
+
+      - name: Build application
+        run: cd apps/frontend && npm run build
+
+      - name: Package Windows
+        shell: bash
+        run: |
+          VERSION="${{ needs.create-tag.outputs.version }}"
+          cd apps/frontend && npm run package:win -- --config.extraMetadata.version="$VERSION"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CSC_LINK: ${{ secrets.WIN_CERTIFICATE }}
+          CSC_KEY_PASSWORD: ${{ secrets.WIN_CERTIFICATE_PASSWORD }}
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: windows-builds
+          path: |
+            apps/frontend/dist/*.exe
+
+  build-linux:
+    needs: create-tag
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Use tag for real releases, develop branch for dry runs
+          ref: ${{ github.event.inputs.dry_run == 'true' && 'develop' || format('v{0}', needs.create-tag.outputs.version) }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+
+      - name: Get npm cache directory
+        id: npm-cache
+        run: echo "dir=$(npm config get cache)" >> $GITHUB_OUTPUT
+
+      - uses: actions/cache@v4
+        with:
+          path: ${{ steps.npm-cache.outputs.dir }}
+          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: ${{ runner.os }}-npm-
+
+      - name: Install dependencies
+        run: cd apps/frontend && npm ci
+
+      - name: Cache bundled Python
+        uses: actions/cache@v4
+        with:
+          path: apps/frontend/python-runtime
+          key: python-bundle-${{ runner.os }}-x64-3.12.8
+          restore-keys: |
+            python-bundle-${{ runner.os }}-x64-
+
+      - name: Build application
+        run: cd apps/frontend && npm run build
+
+      - name: Package Linux
+        run: |
+          VERSION="${{ needs.create-tag.outputs.version }}"
+          cd apps/frontend && npm run package:linux -- --config.extraMetadata.version="$VERSION"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: linux-builds
+          path: |
+            apps/frontend/dist/*.AppImage
+            apps/frontend/dist/*.deb
+
+  create-release:
+    needs: [create-tag, build-macos-intel, build-macos-arm64, build-windows, build-linux]
+    runs-on: ubuntu-latest
+    if: ${{ github.event.inputs.dry_run != 'true' }}
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: v${{ needs.create-tag.outputs.version }}
+          fetch-depth: 0
+
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: dist
+
+      - name: Flatten and validate artifacts
+        run: |
+          mkdir -p release-assets
+          find dist -type f \( -name "*.dmg" -o -name "*.zip" -o -name "*.exe" -o -name "*.AppImage" -o -name "*.deb" \) -exec cp {} release-assets/ \;
+
+          # Validate that at least one artifact was copied
+          artifact_count=$(find release-assets -type f \( -name "*.dmg" -o -name "*.zip" -o -name "*.exe" -o -name "*.AppImage" -o -name "*.deb" \) | wc -l)
+          if [ "$artifact_count" -eq 0 ]; then
+            echo "::error::No build artifacts found! Expected .dmg, .zip, .exe, .AppImage, or .deb files."
+            exit 1
+          fi
+
+          echo "Found $artifact_count artifact(s):"
+          ls -la release-assets/
+
+      - name: Generate checksums
+        run: |
+          cd release-assets
+          sha256sum ./* > checksums.sha256
+          cat checksums.sha256
+
+      - name: Create Beta Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: v${{ needs.create-tag.outputs.version }}
+          name: v${{ needs.create-tag.outputs.version }} (Beta)
+          body: |
+            ## Beta Release v${{ needs.create-tag.outputs.version }}
+
+            This is a **beta release** for testing new features. It may contain bugs or incomplete functionality.
+
+            ### How to opt-in to beta updates
+            1. Open Auto Claude
+            2. Go to Settings > Updates
+            3. Enable "Beta Updates" toggle
+
+            ### Reporting Issues
+            Please report any issues at https://github.com/AndyMik90/Auto-Claude/issues
+
+            ---
+
+            **Full Changelog**: https://github.com/${{ github.repository }}/compare/main...v${{ needs.create-tag.outputs.version }}
+          files: release-assets/*
+          draft: false
+          prerelease: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  dry-run-summary:
+    needs: [create-tag, build-macos-intel, build-macos-arm64, build-windows, build-linux]
+    runs-on: ubuntu-latest
+    if: ${{ github.event.inputs.dry_run == 'true' }}
+    steps:
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: dist
+
+      - name: Dry run summary
+        run: |
+          echo "## Beta Release Dry Run Complete" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Version:** ${{ needs.create-tag.outputs.version }}" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "Build artifacts created successfully:" >> $GITHUB_STEP_SUMMARY
+          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+          find dist -type f \( -name "*.dmg" -o -name "*.zip" -o -name "*.exe" -o -name "*.AppImage" -o -name "*.deb" \) >> $GITHUB_STEP_SUMMARY
+          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "To create a real release, run this workflow again with dry_run unchecked." >> $GITHUB_STEP_SUMMARY

.github/workflows/build-prebuilds.yml

@@ -0,0 +1,127 @@
+name: Build Native Module Prebuilds
+
+on:
+  # Build on releases
+  release:
+    types: [published]
+  # Manual trigger for testing
+  workflow_dispatch:
+    inputs:
+      electron_version:
+        description: 'Electron version to build for'
+        required: false
+        default: '39.2.6'
+
+env:
+  # Default Electron version - update when upgrading Electron in package.json
+  ELECTRON_VERSION: ${{ github.event.inputs.electron_version || '39.2.6' }}
+
+jobs:
+  build-windows:
+    runs-on: windows-latest
+    strategy:
+      matrix:
+        arch: [x64]
+        # Add arm64 when GitHub Actions supports Windows ARM runners
+        # arch: [x64, arm64]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+
+      - name: Install Visual Studio Build Tools
+        uses: microsoft/setup-msbuild@v2
+
+      - name: Install node-pty and rebuild for Electron
+        working-directory: apps/frontend
+        shell: pwsh
+        run: |
+          # Install only node-pty
+          npm install node-pty@1.1.0-beta42
+
+          # Get Electron ABI version
+          $electronAbi = (npx electron-abi $env:ELECTRON_VERSION)
+          Write-Host "Building for Electron $env:ELECTRON_VERSION (ABI: $electronAbi)"
+
+          # Rebuild node-pty for Electron
+          npx @electron/rebuild --version $env:ELECTRON_VERSION --module-dir node_modules/node-pty --arch ${{ matrix.arch }}
+
+      - name: Package prebuilt binaries
+        working-directory: apps/frontend
+        shell: pwsh
+        run: |
+          $electronAbi = (npx electron-abi $env:ELECTRON_VERSION)
+          $prebuildDir = "prebuilds/win32-${{ matrix.arch }}-electron-$electronAbi"
+
+          New-Item -ItemType Directory -Force -Path $prebuildDir
+
+          # Copy all built native files
+          $buildDir = "node_modules/node-pty/build/Release"
+          if (Test-Path $buildDir) {
+            Copy-Item "$buildDir/*.node" $prebuildDir/ -Force
+            Copy-Item "$buildDir/*.dll" $prebuildDir/ -Force -ErrorAction SilentlyContinue
+            Copy-Item "$buildDir/*.exe" $prebuildDir/ -Force -ErrorAction SilentlyContinue
+
+            # Also copy conpty files if they exist in subdirectory
+            if (Test-Path "$buildDir/conpty") {
+              Copy-Item "$buildDir/conpty/*" $prebuildDir/ -Force
+            }
+          }
+
+          # List what we packaged
+          Write-Host "Packaged prebuilds:"
+          Get-ChildItem $prebuildDir
+
+      - name: Create archive
+        working-directory: apps/frontend
+        shell: pwsh
+        run: |
+          $electronAbi = (npx electron-abi $env:ELECTRON_VERSION)
+          $archiveName = "node-pty-win32-${{ matrix.arch }}-electron-$electronAbi.zip"
+
+          Compress-Archive -Path "prebuilds/*" -DestinationPath $archiveName
+
+          Write-Host "Created archive: $archiveName"
+          Get-ChildItem $archiveName
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: node-pty-win32-${{ matrix.arch }}
+          path: apps/frontend/node-pty-*.zip
+          retention-days: 90
+
+      - name: Upload to release
+        if: github.event_name == 'release'
+        uses: softprops/action-gh-release@v1
+        with:
+          files: apps/frontend/node-pty-*.zip
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  # Create a combined prebuilds package
+  package-prebuilds:
+    needs: build-windows
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+
+      - name: List artifacts
+        run: |
+          echo "Downloaded artifacts:"
+          find artifacts -type f -name "*.zip"
+
+      - name: Upload combined artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: node-pty-prebuilds-all
+          path: artifacts/**/*.zip
+          retention-days: 90

.github/workflows/ci.yml

@@ -2,9 +2,17 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, develop]
   pull_request:
-    branches: [main]
+    branches: [main, develop]
+
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  actions: read
 
 jobs:
   # Python tests
@@ -29,35 +37,40 @@ jobs:
           version: "latest"
 
       - name: Install dependencies
-        working-directory: auto-claude
+        working-directory: apps/backend
         run: |
           uv venv
           uv pip install -r requirements.txt
-          uv pip install -r ../tests/requirements-test.txt
+          uv pip install -r ../../tests/requirements-test.txt
 
       - name: Run tests
-        working-directory: auto-claude
+        if: matrix.python-version != '3.12'
+        working-directory: apps/backend
+        env:
+          PYTHONPATH: ${{ github.workspace }}/apps/backend
         run: |
           source .venv/bin/activate
-          pytest ../tests/ -v --tb=short -x
+          pytest ../../tests/ -v --tb=short -x
 
       - name: Run tests with coverage
         if: matrix.python-version == '3.12'
-        working-directory: auto-claude
+        working-directory: apps/backend
+        env:
+          PYTHONPATH: ${{ github.workspace }}/apps/backend
         run: |
           source .venv/bin/activate
-          pytest ../tests/ -v --cov=. --cov-report=xml --cov-report=term-missing
+          pytest ../../tests/ -v --cov=. --cov-report=xml --cov-report=term-missing --cov-fail-under=20
 
       - name: Upload coverage reports
         if: matrix.python-version == '3.12'
         uses: codecov/codecov-action@v4
         with:
-          file: ./auto-claude/coverage.xml
+          file: ./apps/backend/coverage.xml
           fail_ci_if_error: false
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
-  # Frontend tests
+  # Frontend lint, typecheck, test, and build
   test-frontend:
     runs-on: ubuntu-latest
     steps:
@@ -67,17 +80,34 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '24'
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+      - name: Get npm cache directory
+        id: npm-cache
+        run: echo "dir=$(npm config get cache)" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/cache@v4
         with:
-          version: 9
+          path: ${{ steps.npm-cache.outputs.dir }}
+          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: ${{ runner.os }}-npm-
 
       - name: Install dependencies
-        working-directory: auto-claude-ui
-        run: pnpm install --frozen-lockfile --ignore-scripts
+        working-directory: apps/frontend
+        run: npm ci --ignore-scripts
+
+      - name: Lint
+        working-directory: apps/frontend
+        run: npm run lint
+
+      - name: Type check
+        working-directory: apps/frontend
+        run: npm run typecheck
 
       - name: Run tests
-        working-directory: auto-claude-ui
-        run: pnpm test
+        working-directory: apps/frontend
+        run: npm run test
+
+      - name: Build
+        working-directory: apps/frontend
+        run: npm run build

.github/workflows/discord-release.yml

@@ -22,4 +22,3 @@ jobs:
           footer_timestamp: true
           reduce_headings: true
           remove_github_reference_links: true
-

.github/workflows/issue-auto-label.yml

@@ -0,0 +1,53 @@
+name: Issue Auto Label
+
+on:
+  issues:
+    types: [opened]
+
+jobs:
+  label-area:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+    steps:
+      - name: Add area label from form
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const issue = context.payload.issue;
+            const body = issue.body || '';
+
+            console.log(`Processing issue #${issue.number}: ${issue.title}`);
+
+            // Map form selection to label
+            const areaMap = {
+              'Frontend': 'area/frontend',
+              'Backend': 'area/backend',
+              'Fullstack': 'area/fullstack'
+            };
+
+            const labels = [];
+
+            for (const [key, label] of Object.entries(areaMap)) {
+              if (body.includes(key)) {
+                console.log(`Found area: ${key}, adding label: ${label}`);
+                labels.push(label);
+                break;
+              }
+            }
+
+            if (labels.length > 0) {
+              try {
+                await github.rest.issues.addLabels({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: issue.number,
+                  labels: labels
+                });
+                console.log(`Successfully added labels: ${labels.join(', ')}`);
+              } catch (error) {
+                core.setFailed(`Failed to add labels: ${error.message}`);
+              }
+            } else {
+              console.log('No matching area found in issue body');
+            }

.github/workflows/lint.yml

@@ -2,9 +2,13 @@ name: Lint
 
 on:
   push:
-    branches: [main]
+    branches: [main, develop]
   pull_request:
-    branches: [main]
+    branches: [main, develop]
+
+concurrency:
+  group: lint-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
 jobs:
   # Python linting
@@ -23,36 +27,8 @@ jobs:
         run: pip install ruff
 
       - name: Run ruff check
-        run: ruff check auto-claude/ --output-format=github
+        run: ruff check apps/backend/ --output-format=github
 
       - name: Run ruff format check
-        run: ruff format auto-claude/ --check --diff
+        run: ruff format apps/backend/ --check --diff
 
-  # TypeScript/React linting
-  frontend:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9
-
-      - name: Install dependencies
-        working-directory: auto-claude-ui
-        run: pnpm install --frozen-lockfile --ignore-scripts
-
-      - name: Run ESLint
-        working-directory: auto-claude-ui
-        run: pnpm lint
-
-      - name: Run TypeScript check
-        working-directory: auto-claude-ui
-        run: pnpm typecheck

.github/workflows/pr-auto-label.yml

@@ -0,0 +1,227 @@
+name: PR Auto Label
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+# Cancel in-progress runs for the same PR
+concurrency:
+  group: pr-auto-label-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  label:
+    name: Auto Label PR
+    runs-on: ubuntu-latest
+    # Don't run on fork PRs (they can't write labels)
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    timeout-minutes: 5
+    steps:
+      - name: Auto-label PR
+        uses: actions/github-script@v7
+        with:
+          retries: 3
+          retry-exempt-status-codes: 400,401,403,404,422
+          script: |
+            const { owner, repo } = context.repo;
+            const pr = context.payload.pull_request;
+            const prNumber = pr.number;
+            const title = pr.title;
+
+            console.log(`::group::PR #${prNumber} - Auto-labeling`);
+            console.log(`Title: ${title}`);
+
+            const labelsToAdd = new Set();
+            const labelsToRemove = new Set();
+
+            // ═══════════════════════════════════════════════════════════════
+            // TYPE LABELS (from PR title - Conventional Commits)
+            // ═══════════════════════════════════════════════════════════════
+            const typeMap = {
+              'feat': 'feature',
+              'fix': 'bug',
+              'docs': 'documentation',
+              'refactor': 'refactor',
+              'test': 'test',
+              'ci': 'ci',
+              'chore': 'chore',
+              'perf': 'performance',
+              'style': 'style',
+              'build': 'build'
+            };
+
+            const typeMatch = title.match(/^(\w+)(\(.+?\))?(!)?:/);
+            if (typeMatch) {
+              const type = typeMatch[1].toLowerCase();
+              const isBreaking = typeMatch[3] === '!';
+
+              if (typeMap[type]) {
+                labelsToAdd.add(typeMap[type]);
+                console.log(`  📝 Type: ${type} → ${typeMap[type]}`);
+              }
+
+              if (isBreaking) {
+                labelsToAdd.add('breaking-change');
+                console.log(`  ⚠️ Breaking change detected`);
+              }
+            } else {
+              console.log(`  ⚠️ No conventional commit prefix found in title`);
+            }
+
+            // ═══════════════════════════════════════════════════════════════
+            // AREA LABELS (from changed files)
+            // ═══════════════════════════════════════════════════════════════
+            let files = [];
+            try {
+              const { data } = await github.rest.pulls.listFiles({
+                owner,
+                repo,
+                pull_number: prNumber,
+                per_page: 100
+              });
+              files = data;
+            } catch (e) {
+              console.log(`  ⚠️ Could not fetch files: ${e.message}`);
+            }
+
+            const areas = {
+              frontend: false,
+              backend: false,
+              ci: false,
+              docs: false,
+              tests: false
+            };
+
+            for (const file of files) {
+              const path = file.filename;
+              if (path.startsWith('apps/frontend/')) areas.frontend = true;
+              if (path.startsWith('apps/backend/')) areas.backend = true;
+              if (path.startsWith('.github/')) areas.ci = true;
+              if (path.endsWith('.md') || path.startsWith('docs/')) areas.docs = true;
+              if (path.startsWith('tests/') || path.includes('.test.') || path.includes('.spec.')) areas.tests = true;
+            }
+
+            // Determine area label (mutually exclusive)
+            const areaLabels = ['area/frontend', 'area/backend', 'area/fullstack', 'area/ci'];
+
+            if (areas.frontend && areas.backend) {
+              labelsToAdd.add('area/fullstack');
+              areaLabels.filter(l => l !== 'area/fullstack').forEach(l => labelsToRemove.add(l));
+              console.log(`  📁 Area: fullstack (${files.length} files)`);
+            } else if (areas.frontend) {
+              labelsToAdd.add('area/frontend');
+              areaLabels.filter(l => l !== 'area/frontend').forEach(l => labelsToRemove.add(l));
+              console.log(`  📁 Area: frontend (${files.length} files)`);
+            } else if (areas.backend) {
+              labelsToAdd.add('area/backend');
+              areaLabels.filter(l => l !== 'area/backend').forEach(l => labelsToRemove.add(l));
+              console.log(`  📁 Area: backend (${files.length} files)`);
+            } else if (areas.ci) {
+              labelsToAdd.add('area/ci');
+              areaLabels.filter(l => l !== 'area/ci').forEach(l => labelsToRemove.add(l));
+              console.log(`  📁 Area: ci (${files.length} files)`);
+            }
+
+            // ═══════════════════════════════════════════════════════════════
+            // SIZE LABELS (from lines changed)
+            // ═══════════════════════════════════════════════════════════════
+            const additions = pr.additions || 0;
+            const deletions = pr.deletions || 0;
+            const totalLines = additions + deletions;
+
+            const sizeLabels = ['size/XS', 'size/S', 'size/M', 'size/L', 'size/XL'];
+            let sizeLabel;
+
+            if (totalLines < 10) sizeLabel = 'size/XS';
+            else if (totalLines < 100) sizeLabel = 'size/S';
+            else if (totalLines < 500) sizeLabel = 'size/M';
+            else if (totalLines < 1000) sizeLabel = 'size/L';
+            else sizeLabel = 'size/XL';
+
+            labelsToAdd.add(sizeLabel);
+            sizeLabels.filter(l => l !== sizeLabel).forEach(l => labelsToRemove.add(l));
+            console.log(`  📏 Size: ${sizeLabel} (+${additions}/-${deletions} = ${totalLines} lines)`);
+
+            console.log('::endgroup::');
+
+            // ═══════════════════════════════════════════════════════════════
+            // APPLY LABELS
+            // ═══════════════════════════════════════════════════════════════
+            console.log(`::group::Applying labels`);
+
+            // Remove old labels (in parallel)
+            const removeArray = [...labelsToRemove].filter(l => !labelsToAdd.has(l));
+            if (removeArray.length > 0) {
+              const removePromises = removeArray.map(async (label) => {
+                try {
+                  await github.rest.issues.removeLabel({
+                    owner,
+                    repo,
+                    issue_number: prNumber,
+                    name: label
+                  });
+                  console.log(`  ✓ Removed: ${label}`);
+                } catch (e) {
+                  if (e.status !== 404) {
+                    console.log(`  ⚠ Could not remove ${label}: ${e.message}`);
+                  }
+                }
+              });
+              await Promise.all(removePromises);
+            }
+
+            // Add new labels
+            const addArray = [...labelsToAdd];
+            if (addArray.length > 0) {
+              try {
+                await github.rest.issues.addLabels({
+                  owner,
+                  repo,
+                  issue_number: prNumber,
+                  labels: addArray
+                });
+                console.log(`  ✓ Added: ${addArray.join(', ')}`);
+              } catch (e) {
+                // Some labels might not exist
+                if (e.status === 404) {
+                  core.warning(`Some labels do not exist. Please create them in repository settings.`);
+                  // Try adding one by one
+                  for (const label of addArray) {
+                    try {
+                      await github.rest.issues.addLabels({
+                        owner,
+                        repo,
+                        issue_number: prNumber,
+                        labels: [label]
+                      });
+                    } catch (e2) {
+                      console.log(`  ⚠ Label '${label}' does not exist`);
+                    }
+                  }
+                } else {
+                  throw e;
+                }
+              }
+            }
+
+            console.log('::endgroup::');
+
+            // Summary
+            console.log(`✅ PR #${prNumber} labeled: ${addArray.join(', ')}`);
+
+            // Write job summary
+            core.summary
+              .addHeading(`PR #${prNumber} Auto-Labels`, 3)
+              .addTable([
+                [{data: 'Category', header: true}, {data: 'Label', header: true}],
+                ['Type', typeMatch ? typeMap[typeMatch[1].toLowerCase()] || 'none' : 'none'],
+                ['Area', areas.frontend && areas.backend ? 'fullstack' : areas.frontend ? 'frontend' : areas.backend ? 'backend' : 'other'],
+                ['Size', sizeLabel]
+              ])
+              .addRaw(`\n**Files changed:** ${files.length}\n`)
+              .addRaw(`**Lines:** +${additions} / -${deletions}\n`);
+            await core.summary.write();

.github/workflows/pr-status-check.yml

@@ -0,0 +1,72 @@
+name: PR Status Check
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+# Cancel in-progress runs for the same PR
+concurrency:
+  group: pr-status-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions:
+  pull-requests: write
+
+jobs:
+  mark-checking:
+    name: Set Checking Status
+    runs-on: ubuntu-latest
+    # Don't run on fork PRs (they can't write labels)
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    timeout-minutes: 5
+    steps:
+      - name: Update PR status label
+        uses: actions/github-script@v7
+        with:
+          retries: 3
+          retry-exempt-status-codes: 400,401,403,404,422
+          script: |
+            const { owner, repo } = context.repo;
+            const prNumber = context.payload.pull_request.number;
+            const statusLabels = ['🔄 Checking', '✅ Ready for Review', '❌ Checks Failed'];
+
+            console.log(`::group::PR #${prNumber} - Setting status to Checking`);
+
+            // Remove old status labels (parallel for speed)
+            const removePromises = statusLabels.map(async (label) => {
+              try {
+                await github.rest.issues.removeLabel({
+                  owner,
+                  repo,
+                  issue_number: prNumber,
+                  name: label
+                });
+                console.log(`  ✓ Removed: ${label}`);
+              } catch (e) {
+                if (e.status !== 404) {
+                  console.log(`  ⚠ Could not remove ${label}: ${e.message}`);
+                }
+              }
+            });
+
+            await Promise.all(removePromises);
+
+            // Add checking label
+            try {
+              await github.rest.issues.addLabels({
+                owner,
+                repo,
+                issue_number: prNumber,
+                labels: ['🔄 Checking']
+              });
+              console.log(`  ✓ Added: 🔄 Checking`);
+            } catch (e) {
+              // Label might not exist - create helpful error
+              if (e.status === 404) {
+                core.warning(`Label '🔄 Checking' does not exist. Please create it in repository settings.`);
+              }
+              throw e;
+            }
+
+            console.log('::endgroup::');
+            console.log(`✅ PR #${prNumber} marked as checking`);

.github/workflows/pr-status-gate.yml

@@ -0,0 +1,195 @@
+name: PR Status Gate
+
+on:
+  workflow_run:
+    workflows: [CI, Lint, Quality Security, Quality DCO, Quality Commit Lint]
+    types: [completed]
+
+permissions:
+  pull-requests: write
+  checks: read
+
+jobs:
+  update-status:
+    name: Update PR Status
+    runs-on: ubuntu-latest
+    # Only run if this workflow_run is associated with a PR
+    if: github.event.workflow_run.pull_requests[0] != null
+    timeout-minutes: 5
+    steps:
+      - name: Check all required checks and update label
+        uses: actions/github-script@v7
+        with:
+          retries: 3
+          retry-exempt-status-codes: 400,401,403,404,422
+          script: |
+            const { owner, repo } = context.repo;
+            const prNumber = context.payload.workflow_run.pull_requests[0].number;
+            const headSha = context.payload.workflow_run.head_sha;
+            const triggerWorkflow = context.payload.workflow_run.name;
+
+            // ═══════════════════════════════════════════════════════════════════════
+            // REQUIRED CHECK RUNS - Job-level checks (not workflow-level)
+            // ═══════════════════════════════════════════════════════════════════════
+            // Format: "{Workflow Name} / {Job Name} (pull_request)"
+            //
+            // To find check names: Go to PR → Checks tab → copy exact name
+            // To update: Edit this list when workflow jobs are added/renamed/removed
+            //
+            // Last validated: 2025-12-26
+            // ═══════════════════════════════════════════════════════════════════════
+            const requiredChecks = [
+              // CI workflow (ci.yml) - 3 checks
+              'CI / test-frontend (pull_request)',
+              'CI / test-python (3.12) (pull_request)',
+              'CI / test-python (3.13) (pull_request)',
+              // Lint workflow (lint.yml) - 1 check
+              'Lint / python (pull_request)',
+              // Quality Security workflow (quality-security.yml) - 4 checks
+              'Quality Security / CodeQL (javascript-typescript) (pull_request)',
+              'Quality Security / CodeQL (python) (pull_request)',
+              'Quality Security / Python Security (Bandit) (pull_request)',
+              'Quality Security / Security Summary (pull_request)',
+              // Quality DCO workflow (quality-dco.yml) - 1 check
+              'Quality DCO / DCO Check (pull_request)',
+              // Quality Commit Lint workflow (quality-commit-lint.yml) - 1 check
+              'Quality Commit Lint / Conventional Commits (pull_request)'
+            ];
+
+            const statusLabels = {
+              checking: '🔄 Checking',
+              passed: '✅ Ready for Review',
+              failed: '❌ Checks Failed'
+            };
+
+            console.log(`::group::PR #${prNumber} - Checking required checks`);
+            console.log(`Triggered by: ${triggerWorkflow}`);
+            console.log(`Head SHA: ${headSha}`);
+            console.log(`Required checks: ${requiredChecks.length}`);
+            console.log('');
+
+            // Fetch all check runs for this commit
+            let allCheckRuns = [];
+            try {
+              const { data } = await github.rest.checks.listForRef({
+                owner,
+                repo,
+                ref: headSha,
+                per_page: 100
+              });
+              allCheckRuns = data.check_runs;
+              console.log(`Found ${allCheckRuns.length} total check runs`);
+            } catch (error) {
+              // Add warning annotation so maintainers are alerted
+              core.warning(`Failed to fetch check runs for PR #${prNumber}: ${error.message}. PR label may be outdated.`);
+              console.log(`::error::Failed to fetch check runs: ${error.message}`);
+              console.log('::endgroup::');
+              return;
+            }
+
+            let allComplete = true;
+            let anyFailed = false;
+            const results = [];
+
+            // Check each required check
+            for (const checkName of requiredChecks) {
+              const check = allCheckRuns.find(c => c.name === checkName);
+
+              if (!check) {
+                results.push({ name: checkName, status: '⏳ Pending', complete: false });
+                allComplete = false;
+              } else if (check.status !== 'completed') {
+                results.push({ name: checkName, status: '🔄 Running', complete: false });
+                allComplete = false;
+              } else if (check.conclusion === 'success') {
+                results.push({ name: checkName, status: '✅ Passed', complete: true });
+              } else if (check.conclusion === 'skipped') {
+                // Skipped checks are treated as passed (e.g., path filters, conditional jobs)
+                results.push({ name: checkName, status: '⏭️ Skipped', complete: true, skipped: true });
+              } else {
+                results.push({ name: checkName, status: '❌ Failed', complete: true, failed: true });
+                anyFailed = true;
+              }
+            }
+
+            // Print results table
+            console.log('');
+            console.log('Check Status:');
+            console.log('─'.repeat(70));
+            for (const r of results) {
+              const shortName = r.name.length > 55 ? r.name.substring(0, 52) + '...' : r.name;
+              console.log(`  ${r.status.padEnd(12)} ${shortName}`);
+            }
+            console.log('─'.repeat(70));
+            console.log('::endgroup::');
+
+            // Only update label if all required checks are complete
+            if (!allComplete) {
+              const pending = results.filter(r => !r.complete).length;
+              console.log(`⏳ ${pending}/${requiredChecks.length} checks still pending - keeping current label`);
+              return;
+            }
+
+            // Determine final label
+            const newLabel = anyFailed ? statusLabels.failed : statusLabels.passed;
+
+            console.log(`::group::Updating PR #${prNumber} label`);
+
+            // Remove old status labels
+            for (const label of Object.values(statusLabels)) {
+              try {
+                await github.rest.issues.removeLabel({
+                  owner,
+                  repo,
+                  issue_number: prNumber,
+                  name: label
+                });
+                console.log(`  ✓ Removed: ${label}`);
+              } catch (e) {
+                if (e.status !== 404) {
+                  console.log(`  ⚠ Could not remove ${label}: ${e.message}`);
+                }
+              }
+            }
+
+            // Add final status label
+            try {
+              await github.rest.issues.addLabels({
+                owner,
+                repo,
+                issue_number: prNumber,
+                labels: [newLabel]
+              });
+              console.log(`  ✓ Added: ${newLabel}`);
+            } catch (e) {
+              if (e.status === 404) {
+                core.warning(`Label '${newLabel}' does not exist. Please create it in repository settings.`);
+              }
+              throw e;
+            }
+
+            console.log('::endgroup::');
+
+            // Summary
+            const passedCount = results.filter(r => r.status === '✅ Passed').length;
+            const skippedCount = results.filter(r => r.skipped).length;
+            const failedCount = results.filter(r => r.failed).length;
+
+            if (anyFailed) {
+              console.log(`❌ PR #${prNumber} has ${failedCount} failing check(s)`);
+              core.summary.addRaw(`## ❌ PR #${prNumber} - Checks Failed\n\n`);
+              core.summary.addRaw(`**${failedCount}** of **${requiredChecks.length}** required checks failed.\n\n`);
+            } else {
+              const skippedNote = skippedCount > 0 ? ` (${skippedCount} skipped)` : '';
+              const totalSuccessful = passedCount + skippedCount;
+              console.log(`✅ PR #${prNumber} is ready for review (${totalSuccessful}/${requiredChecks.length} checks succeeded${skippedNote})`);
+              core.summary.addRaw(`## ✅ PR #${prNumber} - Ready for Review\n\n`);
+              core.summary.addRaw(`All **${requiredChecks.length}** required checks succeeded${skippedNote}.\n\n`);
+            }
+
+            // Add results to summary
+            core.summary.addTable([
+              [{data: 'Check', header: true}, {data: 'Status', header: true}],
+              ...results.map(r => [r.name, r.status])
+            ]);
+            await core.summary.write();

.github/workflows/prepare-release.yml

@@ -0,0 +1,109 @@
+name: Prepare Release
+
+# Triggers when code is pushed to main (e.g., merging develop → main)
+# If package.json version is newer than the latest tag, creates a new tag
+# which then triggers the release.yml workflow
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'apps/frontend/package.json'
+      - 'package.json'
+
+jobs:
+  check-and-tag:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    outputs:
+      should_release: ${{ steps.check.outputs.should_release }}
+      new_version: ${{ steps.check.outputs.new_version }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Get package version
+        id: package
+        run: |
+          VERSION=$(node -p "require('./apps/frontend/package.json').version")
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "Package version: $VERSION"
+
+      - name: Get latest tag version
+        id: latest_tag
+        run: |
+          # Get the latest version tag (v*)
+          LATEST_TAG=$(git tag -l 'v*' --sort=-version:refname | head -n1)
+          if [ -z "$LATEST_TAG" ]; then
+            echo "No existing tags found"
+            echo "version=0.0.0" >> $GITHUB_OUTPUT
+          else
+            # Remove 'v' prefix
+            LATEST_VERSION=${LATEST_TAG#v}
+            echo "version=$LATEST_VERSION" >> $GITHUB_OUTPUT
+            echo "Latest tag: $LATEST_TAG (version: $LATEST_VERSION)"
+          fi
+
+      - name: Check if release needed
+        id: check
+        run: |
+          PACKAGE_VERSION="${{ steps.package.outputs.version }}"
+          LATEST_VERSION="${{ steps.latest_tag.outputs.version }}"
+
+          echo "Comparing: package=$PACKAGE_VERSION vs latest_tag=$LATEST_VERSION"
+
+          # Use sort -V for version comparison
+          HIGHER=$(printf '%s\n%s' "$PACKAGE_VERSION" "$LATEST_VERSION" | sort -V | tail -n1)
+
+          if [ "$HIGHER" = "$PACKAGE_VERSION" ] && [ "$PACKAGE_VERSION" != "$LATEST_VERSION" ]; then
+            echo "should_release=true" >> $GITHUB_OUTPUT
+            echo "new_version=$PACKAGE_VERSION" >> $GITHUB_OUTPUT
+            echo "✅ New release needed: v$PACKAGE_VERSION"
+          else
+            echo "should_release=false" >> $GITHUB_OUTPUT
+            echo "⏭️ No release needed (package version not newer than latest tag)"
+          fi
+
+      - name: Create and push tag
+        if: steps.check.outputs.should_release == 'true'
+        run: |
+          VERSION="${{ steps.check.outputs.new_version }}"
+          TAG="v$VERSION"
+
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          echo "Creating tag: $TAG"
+          git tag -a "$TAG" -m "Release $TAG"
+          git push origin "$TAG"
+
+          echo "✅ Tag $TAG created and pushed"
+          echo "🚀 This will trigger the release workflow"
+
+      - name: Summary
+        run: |
+          if [ "${{ steps.check.outputs.should_release }}" = "true" ]; then
+            echo "## 🚀 Release Triggered" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "**Version:** v${{ steps.check.outputs.new_version }}" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "The release workflow has been triggered and will:" >> $GITHUB_STEP_SUMMARY
+            echo "1. Build binaries for all platforms" >> $GITHUB_STEP_SUMMARY
+            echo "2. Generate changelog from PRs" >> $GITHUB_STEP_SUMMARY
+            echo "3. Create GitHub release" >> $GITHUB_STEP_SUMMARY
+            echo "4. Update README with new version" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "## ⏭️ No Release Needed" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "**Package version:** ${{ steps.package.outputs.version }}" >> $GITHUB_STEP_SUMMARY
+            echo "**Latest tag:** v${{ steps.latest_tag.outputs.version }}" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "The package version is not newer than the latest tag." >> $GITHUB_STEP_SUMMARY
+            echo "To trigger a release, bump the version using:" >> $GITHUB_STEP_SUMMARY
+            echo "\`\`\`bash" >> $GITHUB_STEP_SUMMARY
+            echo "node scripts/bump-version.js patch  # or minor/major" >> $GITHUB_STEP_SUMMARY
+            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+          fi

.github/workflows/quality-commit-lint.yml

@@ -0,0 +1,115 @@
+name: Quality Commit Lint
+
+on:
+  pull_request:
+    branches: [main, develop]
+    types: [opened, edited, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  check:
+    name: Conventional Commits
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Validate PR title
+        uses: actions/github-script@v7
+        with:
+          retries: 3
+          script: |
+            const pr = context.payload.pull_request;
+            const title = pr.title;
+            // Sanitize title for safe markdown interpolation (prevent injection)
+            const sanitizedTitle = title.replace(/`/g, "'").replace(/\[/g, '\\[').replace(/\]/g, '\\]');
+
+            console.log(`::group::PR #${pr.number} - Validating PR title`);
+            console.log(`Title: ${title}`);
+
+            // Conventional Commits pattern for PR title
+            // type(scope)?: description (max 100 chars)
+            // Optional ! for breaking changes: feat!: or feat(scope)!:
+            // Scope allows: letters, numbers, hyphens, underscores, slashes, dots
+            const pattern = /^(feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(\([a-zA-Z0-9_\-\/\.]+\))?!?: .{1,100}$/;
+
+            const isValid = pattern.test(title);
+            console.log(`Valid: ${isValid}`);
+            console.log('::endgroup::');
+
+            if (!isValid) {
+              // Log helpful error message to console (visible in workflow logs)
+              console.log('');
+              console.log('❌ PR title does not follow Conventional Commits format');
+              console.log('');
+              console.log('Expected format: type(scope): description');
+              console.log('');
+              console.log('Valid types: feat, fix, docs, style, refactor, perf, test, build, ci, chore, revert');
+              console.log('');
+              console.log('Examples of valid PR titles:');
+              console.log('  ✓ feat(auth): add OAuth2 login support');
+              console.log('  ✓ fix(api): handle null response correctly');
+              console.log('  ✓ docs: update README installation steps');
+              console.log('  ✓ chore: update dependencies');
+              console.log('');
+              console.log(`Your title: "${title}"`);
+              console.log('');
+              console.log('Suggested fix for your title:');
+              // Try to suggest a fix based on the title
+              const lowerTitle = title.toLowerCase();
+              const placeholder = '[add description here]';
+              if (lowerTitle.includes('fix') || lowerTitle.includes('bug')) {
+                const cleaned = title.replace(/^(fix(ed|es|ing)?|bug)[:\s]*/i, '').trim();
+                console.log(`  → fix: ${cleaned || placeholder}`);
+              } else if (lowerTitle.includes('add') || lowerTitle.includes('new') || lowerTitle.includes('feature')) {
+                const cleaned = title.replace(/^(add(ed|s|ing)?|new|features?)[:\s]*/i, '').trim();
+                console.log(`  → feat: ${cleaned || placeholder}`);
+              } else if (lowerTitle.includes('update') || lowerTitle.includes('change')) {
+                const cleaned = title.replace(/^(update[ds]?|chang(ed|es|ing)?)[:\s]*/i, '').trim();
+                console.log(`  → chore: ${cleaned || placeholder}`);
+              } else if (lowerTitle.includes('doc') || lowerTitle.includes('readme')) {
+                const cleaned = title.replace(/^(docs?|readme)[:\s]*/i, '').trim();
+                console.log(`  → docs: ${cleaned || placeholder}`);
+              } else {
+                console.log(`  → feat: ${title}`);
+                console.log(`  → fix: ${title}`);
+                console.log(`  → chore: ${title}`);
+              }
+              console.log('');
+
+              let errorMsg = '## ❌ PR Title Validation Failed\n\n';
+              errorMsg += `Your PR title does not follow [Conventional Commits](https://www.conventionalcommits.org/) format:\n\n`;
+              errorMsg += `> \`${sanitizedTitle}\`\n\n`;
+              errorMsg += '### Expected Format\n\n';
+              errorMsg += '```\ntype(scope): description\n```\n\n';
+              errorMsg += '| Type | Description |\n';
+              errorMsg += '|------|-------------|\n';
+              errorMsg += '| `feat` | New feature |\n';
+              errorMsg += '| `fix` | Bug fix |\n';
+              errorMsg += '| `docs` | Documentation only |\n';
+              errorMsg += '| `style` | Code style (formatting, etc.) |\n';
+              errorMsg += '| `refactor` | Code refactoring |\n';
+              errorMsg += '| `perf` | Performance improvement |\n';
+              errorMsg += '| `test` | Adding/updating tests |\n';
+              errorMsg += '| `build` | Build system changes |\n';
+              errorMsg += '| `ci` | CI/CD changes |\n';
+              errorMsg += '| `chore` | Maintenance tasks |\n';
+              errorMsg += '| `revert` | Reverting changes |\n\n';
+              errorMsg += '### Examples\n\n';
+              errorMsg += '```\nfeat(auth): add OAuth2 login support\nfix(api/users): handle null response correctly\nfix(package.json): update dependencies\ndocs: update README installation steps\nci: add automated release workflow\n```\n\n';
+              errorMsg += '### How to Fix\n\n';
+              errorMsg += 'Edit your PR title to follow the format above.\n';
+
+              core.summary.addRaw(errorMsg);
+              await core.summary.write();
+
+              core.setFailed('PR title does not follow Conventional Commits format');
+            } else {
+              console.log(`✅ PR title follows Conventional Commits format`);
+
+              core.summary
+                .addHeading('✅ PR Title Valid', 3)
+                .addRaw(`PR title follows Conventional Commits format: \`${sanitizedTitle}\``);
+              await core.summary.write();
+            }

.github/workflows/quality-dco.yml

@@ -0,0 +1,70 @@
+name: Quality DCO
+
+on:
+  pull_request:
+    branches: [main, develop]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  check:
+    name: DCO Check
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Check DCO Sign-off
+        uses: dcoapp/dco-check@v1
+        with:
+          require-signoff: true
+
+      - name: DCO Help on Failure
+        if: failure()
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const helpMsg = `## ❌ DCO Sign-off Required
+
+This project requires all commits to be signed off with the Developer Certificate of Origin (DCO).
+
+### How to Fix
+
+**Option 1: Sign off your last commit**
+\`\`\`bash
+git commit --amend --signoff
+git push --force-with-lease
+\`\`\`
+
+**Option 2: Sign off all commits in this PR**
+\`\`\`bash
+git rebase HEAD~N --signoff  # Replace N with number of commits
+git push --force-with-lease
+\`\`\`
+
+**Option 3: Configure git to always sign off**
+\`\`\`bash
+git config --global format.signoff true
+\`\`\`
+
+### What is DCO?
+
+The [Developer Certificate of Origin](https://developercertificate.org/) is a lightweight way for contributors to certify that they wrote or have the right to submit the code they are contributing.
+
+By signing off, you agree to the DCO terms:
+- The contribution was created by you
+- You have the right to submit it under the project's license
+- You understand the contribution is public and recorded
+
+### Sign-off Format
+
+Your commit message should end with:
+\`\`\`
+Signed-off-by: Your Name <your.email@example.com>
+\`\`\`
+
+This line is automatically added when you use \`git commit -s\` or \`git commit --signoff\`.
+`;
+
+            core.summary.addRaw(helpMsg);
+            await core.summary.write();

.github/workflows/quality-security.yml

@@ -0,0 +1,178 @@
+name: Quality Security
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main, develop]
+  schedule:
+    - cron: '0 0 * * 1' # Weekly on Monday at midnight UTC
+
+# Cancel in-progress runs for the same branch/PR
+concurrency:
+  group: security-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  security-events: write
+  actions: read
+
+jobs:
+  codeql:
+    name: CodeQL (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [python, javascript-typescript]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          queries: +security-extended,security-and-quality
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"
+
+  python-security:
+    name: Python Security (Bandit)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install Bandit
+        run: pip install bandit
+
+      - name: Run Bandit security scan
+        id: bandit
+        run: |
+          echo "::group::Running Bandit security scan"
+          # Run Bandit; exit code 1 means issues found (expected), other codes are errors
+          # Flags: -r=recursive, -ll=severity LOW+, -ii=confidence LOW+, -f=format, -o=output
+          bandit -r apps/backend/ -ll -ii -f json -o bandit-report.json || BANDIT_EXIT=$?
+          if [ "${BANDIT_EXIT:-0}" -gt 1 ]; then
+            echo "::error::Bandit scan failed with exit code $BANDIT_EXIT"
+            exit 1
+          fi
+          echo "::endgroup::"
+
+      - name: Analyze Bandit results
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+
+            // Check if report exists
+            if (!fs.existsSync('bandit-report.json')) {
+              core.setFailed('Bandit report not found - scan may have failed');
+              return;
+            }
+
+            const report = JSON.parse(fs.readFileSync('bandit-report.json', 'utf8'));
+            const results = report.results || [];
+
+            // Categorize by severity
+            const high = results.filter(r => r.issue_severity === 'HIGH');
+            const medium = results.filter(r => r.issue_severity === 'MEDIUM');
+            const low = results.filter(r => r.issue_severity === 'LOW');
+
+            console.log(`::group::Bandit Security Scan Results`);
+            console.log(`Found ${results.length} issues:`);
+            console.log(`  🔴 HIGH:   ${high.length}`);
+            console.log(`  🟡 MEDIUM: ${medium.length}`);
+            console.log(`  🟢 LOW:    ${low.length}`);
+            console.log('');
+
+            // Print high severity issues
+            if (high.length > 0) {
+              console.log('High Severity Issues:');
+              console.log('─'.repeat(60));
+              for (const issue of high) {
+                console.log(`  ${issue.filename}:${issue.line_number}`);
+                console.log(`    ${issue.issue_text}`);
+                console.log(`    Test: ${issue.test_id} (${issue.test_name})`);
+                console.log('');
+              }
+            }
+            console.log('::endgroup::');
+
+            // Build summary
+            let summary = `## 🔒 Python Security Scan (Bandit)\n\n`;
+            summary += `| Severity | Count |\n`;
+            summary += `|----------|-------|\n`;
+            summary += `| 🔴 High | ${high.length} |\n`;
+            summary += `| 🟡 Medium | ${medium.length} |\n`;
+            summary += `| 🟢 Low | ${low.length} |\n\n`;
+
+            if (high.length > 0) {
+              summary += `### High Severity Issues\n\n`;
+              for (const issue of high) {
+                summary += `- **${issue.filename}:${issue.line_number}**\n`;
+                summary += `  - ${issue.issue_text}\n`;
+                summary += `  - Test: \`${issue.test_id}\` (${issue.test_name})\n\n`;
+              }
+            }
+
+            core.summary.addRaw(summary);
+            await core.summary.write();
+
+            // Fail if high severity issues found
+            if (high.length > 0) {
+              core.setFailed(`Found ${high.length} high severity security issue(s)`);
+            } else {
+              console.log('✅ No high severity security issues found');
+            }
+
+  # Summary job that waits for all security checks
+  security-summary:
+    name: Security Summary
+    runs-on: ubuntu-latest
+    needs: [codeql, python-security]
+    if: always()
+    timeout-minutes: 5
+    steps:
+      - name: Check security results
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const codeql = '${{ needs.codeql.result }}';
+            const bandit = '${{ needs.python-security.result }}';
+
+            console.log('Security Check Results:');
+            console.log(`  CodeQL:        ${codeql}`);
+            console.log(`  Bandit:        ${bandit}`);
+
+            // Only 'failure' is a real failure; 'skipped' is acceptable (e.g., path filters)
+            const acceptable = ['success', 'skipped'];
+            const codeqlOk = acceptable.includes(codeql);
+            const banditOk = acceptable.includes(bandit);
+            const allPassed = codeqlOk && banditOk;
+
+            if (allPassed) {
+              console.log('\n✅ All security checks passed');
+              core.summary.addRaw('## ✅ Security Checks Passed\n\nAll security scans completed successfully.');
+            } else {
+              console.log('\n❌ Some security checks failed');
+              core.summary.addRaw('## ❌ Security Checks Failed\n\nOne or more security scans found issues.');
+              core.setFailed('Security checks failed');
+            }
+
+            await core.summary.write();

.github/workflows/release.yml

@@ -0,0 +1,534 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Test build without creating release'
+        required: false
+        default: true
+        type: boolean
+
+jobs:
+  # Intel build on Intel runner for native compilation
+  # Note: macos-15-intel is the last Intel runner, supported until Fall 2027
+  build-macos-intel:
+    runs-on: macos-15-intel
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+
+      - name: Get npm cache directory
+        id: npm-cache
+        run: echo "dir=$(npm config get cache)" >> $GITHUB_OUTPUT
+
+      - uses: actions/cache@v4
+        with:
+          path: ${{ steps.npm-cache.outputs.dir }}
+          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: ${{ runner.os }}-npm-
+
+      - name: Install dependencies
+        run: cd apps/frontend && npm ci
+
+      - name: Cache bundled Python
+        uses: actions/cache@v4
+        with:
+          path: apps/frontend/python-runtime
+          key: python-bundle-${{ runner.os }}-x64-3.12.8
+          restore-keys: |
+            python-bundle-${{ runner.os }}-x64-
+
+      - name: Build application
+        run: cd apps/frontend && npm run build
+
+      - name: Package macOS (Intel)
+        run: cd apps/frontend && npm run package:mac -- --x64
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CSC_LINK: ${{ secrets.MAC_CERTIFICATE }}
+          CSC_KEY_PASSWORD: ${{ secrets.MAC_CERTIFICATE_PASSWORD }}
+
+      - name: Notarize macOS Intel app
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          if [ -z "$APPLE_ID" ]; then
+            echo "Skipping notarization: APPLE_ID not configured"
+            exit 0
+          fi
+          cd apps/frontend
+          for dmg in dist/*.dmg; do
+            echo "Notarizing $dmg..."
+            xcrun notarytool submit "$dmg" \
+              --apple-id "$APPLE_ID" \
+              --password "$APPLE_APP_SPECIFIC_PASSWORD" \
+              --team-id "$APPLE_TEAM_ID" \
+              --wait
+            xcrun stapler staple "$dmg"
+            echo "Successfully notarized and stapled $dmg"
+          done
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: macos-intel-builds
+          path: |
+            apps/frontend/dist/*.dmg
+            apps/frontend/dist/*.zip
+
+  # Apple Silicon build on ARM64 runner for native compilation
+  build-macos-arm64:
+    runs-on: macos-15
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+
+      - name: Get npm cache directory
+        id: npm-cache
+        run: echo "dir=$(npm config get cache)" >> $GITHUB_OUTPUT
+
+      - uses: actions/cache@v4
+        with:
+          path: ${{ steps.npm-cache.outputs.dir }}
+          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: ${{ runner.os }}-npm-
+
+      - name: Install dependencies
+        run: cd apps/frontend && npm ci
+
+      - name: Cache bundled Python
+        uses: actions/cache@v4
+        with:
+          path: apps/frontend/python-runtime
+          key: python-bundle-${{ runner.os }}-arm64-3.12.8
+          restore-keys: |
+            python-bundle-${{ runner.os }}-arm64-
+
+      - name: Build application
+        run: cd apps/frontend && npm run build
+
+      - name: Package macOS (Apple Silicon)
+        run: cd apps/frontend && npm run package:mac -- --arm64
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CSC_LINK: ${{ secrets.MAC_CERTIFICATE }}
+          CSC_KEY_PASSWORD: ${{ secrets.MAC_CERTIFICATE_PASSWORD }}
+
+      - name: Notarize macOS ARM64 app
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          if [ -z "$APPLE_ID" ]; then
+            echo "Skipping notarization: APPLE_ID not configured"
+            exit 0
+          fi
+          cd apps/frontend
+          for dmg in dist/*.dmg; do
+            echo "Notarizing $dmg..."
+            xcrun notarytool submit "$dmg" \
+              --apple-id "$APPLE_ID" \
+              --password "$APPLE_APP_SPECIFIC_PASSWORD" \
+              --team-id "$APPLE_TEAM_ID" \
+              --wait
+            xcrun stapler staple "$dmg"
+            echo "Successfully notarized and stapled $dmg"
+          done
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: macos-arm64-builds
+          path: |
+            apps/frontend/dist/*.dmg
+            apps/frontend/dist/*.zip
+
+  build-windows:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+
+      - name: Get npm cache directory
+        id: npm-cache
+        shell: bash
+        run: echo "dir=$(npm config get cache)" >> $GITHUB_OUTPUT
+
+      - uses: actions/cache@v4
+        with:
+          path: ${{ steps.npm-cache.outputs.dir }}
+          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: ${{ runner.os }}-npm-
+
+      - name: Install dependencies
+        run: cd apps/frontend && npm ci
+
+      - name: Cache bundled Python
+        uses: actions/cache@v4
+        with:
+          path: apps/frontend/python-runtime
+          key: python-bundle-${{ runner.os }}-x64-3.12.8
+          restore-keys: |
+            python-bundle-${{ runner.os }}-x64-
+
+      - name: Build application
+        run: cd apps/frontend && npm run build
+
+      - name: Package Windows
+        run: cd apps/frontend && npm run package:win
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CSC_LINK: ${{ secrets.WIN_CERTIFICATE }}
+          CSC_KEY_PASSWORD: ${{ secrets.WIN_CERTIFICATE_PASSWORD }}
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: windows-builds
+          path: |
+            apps/frontend/dist/*.exe
+
+  build-linux:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+
+      - name: Get npm cache directory
+        id: npm-cache
+        run: echo "dir=$(npm config get cache)" >> $GITHUB_OUTPUT
+
+      - uses: actions/cache@v4
+        with:
+          path: ${{ steps.npm-cache.outputs.dir }}
+          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: ${{ runner.os }}-npm-
+
+      - name: Install dependencies
+        run: cd apps/frontend && npm ci
+
+      - name: Cache bundled Python
+        uses: actions/cache@v4
+        with:
+          path: apps/frontend/python-runtime
+          key: python-bundle-${{ runner.os }}-x64-3.12.8
+          restore-keys: |
+            python-bundle-${{ runner.os }}-x64-
+
+      - name: Build application
+        run: cd apps/frontend && npm run build
+
+      - name: Package Linux
+        run: cd apps/frontend && npm run package:linux
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: linux-builds
+          path: |
+            apps/frontend/dist/*.AppImage
+            apps/frontend/dist/*.deb
+
+  create-release:
+    needs: [build-macos-intel, build-macos-arm64, build-windows, build-linux]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: dist
+
+      - name: Flatten and validate artifacts
+        run: |
+          mkdir -p release-assets
+          find dist -type f \( -name "*.dmg" -o -name "*.zip" -o -name "*.exe" -o -name "*.AppImage" -o -name "*.deb" \) -exec cp {} release-assets/ \;
+
+          # Validate that at least one artifact was copied
+          artifact_count=$(find release-assets -type f \( -name "*.dmg" -o -name "*.zip" -o -name "*.exe" -o -name "*.AppImage" -o -name "*.deb" \) | wc -l)
+          if [ "$artifact_count" -eq 0 ]; then
+            echo "::error::No build artifacts found! Expected .dmg, .zip, .exe, .AppImage, or .deb files."
+            exit 1
+          fi
+
+          echo "Found $artifact_count artifact(s):"
+          ls -la release-assets/
+
+      - name: Generate checksums
+        run: |
+          cd release-assets
+          sha256sum ./* > checksums.sha256
+          cat checksums.sha256
+
+      - name: Scan with VirusTotal
+        id: virustotal
+        continue-on-error: true
+        if: ${{ github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.dry_run != true) }}
+        env:
+          VT_API_KEY: ${{ secrets.VIRUSTOTAL_API_KEY }}
+        run: |
+          if [ -z "$VT_API_KEY" ]; then
+            echo "::warning::VIRUSTOTAL_API_KEY not configured, skipping scan"
+            echo "vt_results=" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          echo "## VirusTotal Scan Results" > vt_results.md
+          echo "" >> vt_results.md
+
+          for file in release-assets/*.{exe,dmg,AppImage,deb}; do
+            [ -f "$file" ] || continue
+            filename=$(basename "$file")
+            filesize=$(stat -c%s "$file" 2>/dev/null || stat -f%z "$file")
+            echo "Scanning $filename (${filesize} bytes)..."
+
+            # For files > 32MB, get a special upload URL first
+            if [ "$filesize" -gt 33554432 ]; then
+              echo "  Large file detected, requesting upload URL..."
+              upload_url_response=$(curl -s --request GET \
+                --url "https://www.virustotal.com/api/v3/files/upload_url" \
+                --header "x-apikey: $VT_API_KEY")
+
+              upload_url=$(echo "$upload_url_response" | jq -r '.data // empty')
+              if [ -z "$upload_url" ]; then
+                echo "::warning::Failed to get upload URL for large file $filename"
+                echo "Response: $upload_url_response"
+                echo "- $filename - ⚠️ Upload failed (large file)" >> vt_results.md
+                continue
+              fi
+              api_url="$upload_url"
+            else
+              api_url="https://www.virustotal.com/api/v3/files"
+            fi
+
+            # Upload file to VirusTotal
+            response=$(curl -s --request POST \
+              --url "$api_url" \
+              --header "x-apikey: $VT_API_KEY" \
+              --form "file=@$file")
+
+            # Check if response is valid JSON before parsing
+            if ! echo "$response" | jq -e . >/dev/null 2>&1; then
+              echo "::warning::VirusTotal returned invalid JSON for $filename"
+              echo "Response (first 500 chars): ${response:0:500}"
+              echo "- $filename - ⚠️ Scan failed (invalid response)" >> vt_results.md
+              continue
+            fi
+
+            # Check for API error response
+            error_code=$(echo "$response" | jq -r '.error.code // empty')
+            if [ -n "$error_code" ]; then
+              error_msg=$(echo "$response" | jq -r '.error.message // "Unknown error"')
+              echo "::warning::VirusTotal API error for $filename: $error_code - $error_msg"
+              echo "- $filename - ⚠️ Scan failed ($error_code)" >> vt_results.md
+              continue
+            fi
+
+            # Extract analysis ID
+            analysis_id=$(echo "$response" | jq -r '.data.id // empty')
+
+            if [ -z "$analysis_id" ]; then
+              echo "::warning::Failed to upload $filename to VirusTotal"
+              echo "Response: $response"
+              echo "- $filename - ⚠️ Upload failed" >> vt_results.md
+              continue
+            fi
+
+            echo "Uploaded $filename, analysis ID: $analysis_id"
+
+            # Wait for analysis to complete (max 5 minutes per file)
+            analysis=""
+            for i in {1..30}; do
+              sleep 10
+              analysis=$(curl -s --request GET \
+                --url "https://www.virustotal.com/api/v3/analyses/$analysis_id" \
+                --header "x-apikey: $VT_API_KEY")
+
+              # Validate JSON response
+              if ! echo "$analysis" | jq -e . >/dev/null 2>&1; then
+                echo "  Warning: Invalid JSON response on attempt $i, retrying..."
+                continue
+              fi
+
+              status=$(echo "$analysis" | jq -r '.data.attributes.status // "unknown"')
+              echo "  Status: $status (attempt $i/30)"
+
+              if [ "$status" = "completed" ]; then
+                break
+              fi
+            done
+
+            # Final validation that we have valid analysis data
+            if ! echo "$analysis" | jq -e '.data.attributes.stats' >/dev/null 2>&1; then
+              echo "::warning::Could not get complete analysis for $filename, using local hash"
+              file_hash=$(sha256sum "$file" | cut -d' ' -f1)
+              echo "- [$filename](https://www.virustotal.com/gui/file/$file_hash) - ⚠️ Analysis incomplete" >> vt_results.md
+              continue
+            fi
+
+            # Get file hash for permanent URL
+            file_hash=$(echo "$analysis" | jq -r '.meta.file_info.sha256 // empty')
+
+            if [ -z "$file_hash" ]; then
+              # Fallback: calculate hash locally
+              file_hash=$(sha256sum "$file" | cut -d' ' -f1)
+            fi
+
+            # Get detection stats
+            malicious=$(echo "$analysis" | jq -r '.data.attributes.stats.malicious // 0')
+            suspicious=$(echo "$analysis" | jq -r '.data.attributes.stats.suspicious // 0')
+            undetected=$(echo "$analysis" | jq -r '.data.attributes.stats.undetected // 0')
+
+            vt_url="https://www.virustotal.com/gui/file/$file_hash"
+
+            if [ "$malicious" -gt 0 ] || [ "$suspicious" -gt 0 ]; then
+              echo "::warning::$filename has $malicious malicious and $suspicious suspicious detections (likely false positives)"
+              echo "- [$filename]($vt_url) - ⚠️ **$malicious malicious, $suspicious suspicious** detections (review recommended)" >> vt_results.md
+            else
+              echo "$filename is clean ($undetected engines, 0 detections)"
+              echo "- [$filename]($vt_url) - ✅ Clean ($undetected engines, 0 detections)" >> vt_results.md
+            fi
+          done
+
+          echo "" >> vt_results.md
+
+          # Save results for release notes
+          cat vt_results.md
+          echo "vt_results<<EOF" >> $GITHUB_OUTPUT
+          cat vt_results.md >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
+      - name: Dry run summary
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run == true }}
+        run: |
+          echo "## Dry Run Complete" >> $GITHUB_STEP_SUMMARY
+          echo "Build artifacts created successfully:" >> $GITHUB_STEP_SUMMARY
+          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+          ls -la release-assets/ >> $GITHUB_STEP_SUMMARY
+          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+          echo "### Checksums" >> $GITHUB_STEP_SUMMARY
+          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+          cat release-assets/checksums.sha256 >> $GITHUB_STEP_SUMMARY
+          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+
+      - name: Generate changelog
+        if: ${{ github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.dry_run != true) }}
+        id: changelog
+        uses: release-drafter/release-drafter@v6
+        with:
+          config-name: release-drafter.yml
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create Release
+        if: ${{ github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.dry_run != true) }}
+        uses: softprops/action-gh-release@v2
+        with:
+          body: |
+            ${{ steps.changelog.outputs.body }}
+
+            ${{ steps.virustotal.outputs.vt_results }}
+          files: release-assets/*
+          draft: false
+          prerelease: ${{ contains(github.ref, 'beta') || contains(github.ref, 'alpha') }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  # Update README with new version after successful release
+  update-readme:
+    needs: [create-release]
+    runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.dry_run != true) }}
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: main
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract version from tag
+        id: version
+        run: |
+          # Extract version from tag (v2.7.2 -> 2.7.2)
+          VERSION=${GITHUB_REF_NAME#v}
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "Updating README to version: $VERSION"
+
+      - name: Update README.md
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+
+          # Update version badge: version-X.Y.Z-blue
+          sed -i "s/version-[0-9]*\.[0-9]*\.[0-9]*-blue/version-${VERSION}-blue/g" README.md
+
+          # Update download links: Auto-Claude-X.Y.Z
+          sed -i "s/Auto-Claude-[0-9]*\.[0-9]*\.[0-9]*/Auto-Claude-${VERSION}/g" README.md
+
+          echo "README.md updated to version $VERSION"
+          grep -E "(version-|Auto-Claude-)" README.md | head -10
+
+      - name: Commit and push README update
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          # Check if there are changes to commit
+          if git diff --quiet README.md; then
+            echo "No changes to README.md, skipping commit"
+            exit 0
+          fi
+
+          git add README.md
+          git commit -m "docs: update README to v${{ steps.version.outputs.version }} [skip ci]"
+          git push origin main

.github/workflows/stale.yml

@@ -0,0 +1,25 @@
+name: Stale Issues
+
+on:
+  schedule:
+    - cron: '0 0 * * 0'  # Every Sunday
+  workflow_dispatch:
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+    steps:
+      - uses: actions/stale@v9
+        with:
+          stale-issue-message: |
+            This issue has been inactive for 60 days. It will be closed in 14 days if there's no activity.
+            
+            - If this is still relevant, please comment or update the issue
+            - If you're working on this, add the `in-progress` label
+          close-issue-message: 'Closed due to inactivity. Feel free to reopen if still relevant.'
+          stale-issue-label: 'stale'
+          days-before-stale: 60
+          days-before-close: 14
+          exempt-issue-labels: 'priority/critical,priority/high,in-progress,blocked'

.github/workflows/test-on-tag.yml

@@ -28,17 +28,19 @@ jobs:
           version: "latest"
 
       - name: Install dependencies
-        working-directory: auto-claude
+        working-directory: apps/backend
         run: |
           uv venv
           uv pip install -r requirements.txt
-          uv pip install -r ../tests/requirements-test.txt
+          uv pip install -r ../../tests/requirements-test.txt
 
       - name: Run tests
-        working-directory: auto-claude
+        working-directory: apps/backend
+        env:
+          PYTHONPATH: ${{ github.workspace }}/apps/backend
         run: |
           source .venv/bin/activate
-          pytest ../tests/ -v --tb=short
+          pytest ../../tests/ -v --tb=short
 
   # Frontend tests
   test-frontend:
@@ -50,17 +52,12 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9
+          node-version: '24'
 
       - name: Install dependencies
-        working-directory: auto-claude-ui
-        run: pnpm install --frozen-lockfile --ignore-scripts
+        working-directory: apps/frontend
+        run: npm ci --ignore-scripts
 
       - name: Run tests
-        working-directory: auto-claude-ui
-        run: pnpm test
+        working-directory: apps/frontend
+        run: npm run test

.github/workflows/validate-version.yml

@@ -0,0 +1,71 @@
+name: Validate Version
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  validate-version:
+    name: Validate package.json version matches tag
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Extract version from tag
+        id: tag_version
+        run: |
+          # Extract version from tag (e.g., v2.5.5 -> 2.5.5)
+          TAG_VERSION=${GITHUB_REF#refs/tags/v}
+          echo "version=$TAG_VERSION" >> $GITHUB_OUTPUT
+          echo "Tag version: $TAG_VERSION"
+
+      - name: Extract version from package.json
+        id: package_version
+        run: |
+          # Read version from package.json
+          PACKAGE_VERSION=$(node -p "require('./apps/frontend/package.json').version")
+          echo "version=$PACKAGE_VERSION" >> $GITHUB_OUTPUT
+          echo "Package.json version: $PACKAGE_VERSION"
+
+      - name: Compare versions
+        run: |
+          TAG_VERSION="${{ steps.tag_version.outputs.version }}"
+          PACKAGE_VERSION="${{ steps.package_version.outputs.version }}"
+
+          echo "=========================================="
+          echo "Version Validation"
+          echo "=========================================="
+          echo "Git tag version:      v$TAG_VERSION"
+          echo "package.json version: $PACKAGE_VERSION"
+          echo "=========================================="
+
+          if [ "$TAG_VERSION" != "$PACKAGE_VERSION" ]; then
+            echo ""
+            echo "❌ ERROR: Version mismatch detected!"
+            echo ""
+            echo "The version in package.json ($PACKAGE_VERSION) does not match"
+            echo "the git tag version ($TAG_VERSION)."
+            echo ""
+            echo "To fix this:"
+            echo "  1. Delete this tag: git tag -d v$TAG_VERSION"
+            echo "  2. Update package.json version to $TAG_VERSION"
+            echo "  3. Commit the change"
+            echo "  4. Recreate the tag: git tag -a v$TAG_VERSION -m 'Release v$TAG_VERSION'"
+            echo ""
+            echo "Or use the automated script:"
+            echo "  node scripts/bump-version.js $TAG_VERSION"
+            echo ""
+            exit 1
+          fi
+
+          echo ""
+          echo "✅ SUCCESS: Versions match!"
+          echo ""
+
+      - name: Version validation result
+        if: success()
+        run: |
+          echo "::notice::Version validation passed - package.json version matches tag v${{ steps.tag_version.outputs.version }}"

.github/workflows/welcome.yml

@@ -0,0 +1,33 @@
+name: Welcome
+
+on:
+  pull_request_target:
+    types: [opened]
+  issues:
+    types: [opened]
+
+jobs:
+  welcome:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
+    steps:
+      - uses: actions/first-interaction@v1
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          issue-message: |
+            👋 Thanks for opening your first issue!
+
+            A maintainer will triage this soon. In the meantime:
+            - Make sure you've provided all the requested info
+            - Join our [Discord](https://discord.gg/QhRnz9m5HE) for faster help
+          pr-message: |
+            🎉 Thanks for your first PR!
+
+            A maintainer will review it soon. Please make sure:
+            - Your branch is synced with `develop`
+            - CI checks pass
+            - You've followed our [contribution guide](https://github.com/AndyMik90/Auto-Claude/blob/develop/CONTRIBUTING.md)
+
+            Welcome to the Auto Claude community!

.gitignore

@@ -1,31 +1,69 @@
-# OS
+# ===========================
+# OS Files
+# ===========================
 .DS_Store
+.DS_Store?
+._*
 Thumbs.db
+ehthumbs.db
+Desktop.ini
 
-# Environment files (contain API keys)
+# ===========================
+# Security - Environment & Secrets
+# ===========================
 .env
-.env.local
+.env.*
+!.env.example
+*.pem
+*.key
+*.crt
+*.p12
+*.pfx
+.secrets
+secrets/
+credentials/
 
-# Git worktrees (used by auto-build parallel mode)
-.worktrees/
-
-# IDE
+# ===========================
+# IDE & Editors
+# ===========================
 .idea/
 .vscode/
 *.swp
 *.swo
+*.sublime-workspace
+*.sublime-project
+.project
+.classpath
+.settings/
 
+# ===========================
 # Logs
+# ===========================
 logs/
 *.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+lerna-debug.log*
 
-# Personal notes
-OPUS_ANALYSIS_AND_IDEAS.md
+# ===========================
+# Git Worktrees (parallel builds)
+# ===========================
+.worktrees/
 
-# Documentation
-docs/
+# ===========================
+# Auto Claude Generated
+# ===========================
+.auto-claude/
+.auto-build-security.json
+.auto-claude-security.json
+.auto-claude-status
+.claude_settings.json
+.update-metadata.json
 
-# Python
+# ===========================
+# Python (apps/backend)
+# ===========================
 __pycache__/
 *.py[cod]
 *$py.class
@@ -33,25 +71,19 @@ __pycache__/
 .Python
 build/
 develop-eggs/
-dist/
-downloads/
 eggs/
 .eggs/
-/lib/
-/lib64/
-parts/
-sdist/
-var/
-wheels/
 *.egg-info/
 .installed.cfg
 *.egg
+MANIFEST
 
 # Virtual environments
 .venv/
 venv/
 ENV/
 env/
+.conda/
 
 # Testing
 .pytest_cache/
@@ -64,25 +96,70 @@ coverage.xml
 *.py,cover
 .hypothesis/
 
-# mypy
+# Type checking
 .mypy_cache/
 .dmypy.json
 dmypy.json
+.pytype/
+.pyre/
 
-# Auto-build generated files
-.auto-build-security.json
-.auto-claude-security.json
-.auto-claude-status
-.claude_settings.json
+# ===========================
+# Node.js (apps/frontend)
+# ===========================
+node_modules/
+.npm
+.yarn/
+.pnp.*
 
-# Development of Auto Build with Auto Build
+# Build output
+dist/
+out/
+*.tsbuildinfo
+apps/frontend/python-runtime/
+
+# Cache
+.cache/
+.parcel-cache/
+.turbo/
+.eslintcache
+.prettiercache
+
+# ===========================
+# Electron
+# ===========================
+apps/frontend/dist/
+apps/frontend/out/
+*.asar
+*.blockmap
+*.snap
+*.deb
+*.rpm
+*.AppImage
+*.dmg
+*.exe
+*.msi
+
+# ===========================
+# Testing
+# ===========================
+coverage/
+.nyc_output/
+test-results/
+playwright-report/
+playwright/.cache/
+
+# ===========================
+# Misc
+# ===========================
+*.local
+*.bak
+*.tmp
+*.temp
+
+# Development
 dev/
-
-.auto-claude/
-
+_bmad/
+_bmad-output/
+.claude/
 /docs
-
-_bmad
-_bmad-output
-
-.claude
+OPUS_ANALYSIS_AND_IDEAS.md

.husky/commit-msg

@@ -0,0 +1,73 @@
+#!/bin/sh
+
+# Commit message validation
+# Enforces conventional commit format: type(scope): description
+#
+# Valid types: feat, fix, docs, style, refactor, perf, test, build, ci, chore, revert
+# Examples:
+#   feat(tasks): add drag and drop support
+#   fix(terminal): resolve scroll position issue
+#   docs: update README with setup instructions
+#   chore: update dependencies
+
+commit_msg_file=$1
+commit_msg=$(cat "$commit_msg_file")
+
+# Regex for conventional commits
+# Format: type(optional-scope): description
+pattern="^(feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(\([a-z0-9-]+\))?: .{1,100}$"
+
+# Allow merge commits
+if echo "$commit_msg" | grep -qE "^Merge "; then
+  exit 0
+fi
+
+# Allow revert commits
+if echo "$commit_msg" | grep -qE "^Revert "; then
+  exit 0
+fi
+
+# Check first line against pattern
+first_line=$(echo "$commit_msg" | head -n 1)
+
+if ! echo "$first_line" | grep -qE "$pattern"; then
+  echo ""
+  echo "ERROR: Invalid commit message format!"
+  echo ""
+  echo "Your message: $first_line"
+  echo ""
+  echo "Expected format: type(scope): description"
+  echo ""
+  echo "Valid types:"
+  echo "  feat     - A new feature"
+  echo "  fix      - A bug fix"
+  echo "  docs     - Documentation changes"
+  echo "  style    - Code style changes (formatting, semicolons, etc.)"
+  echo "  refactor - Code refactoring (no feature/fix)"
+  echo "  perf     - Performance improvements"
+  echo "  test     - Adding or updating tests"
+  echo "  build    - Build system or dependencies"
+  echo "  ci       - CI/CD configuration"
+  echo "  chore    - Other changes (maintenance)"
+  echo "  revert   - Reverting a previous commit"
+  echo ""
+  echo "Examples:"
+  echo "  feat(tasks): add drag and drop support"
+  echo "  fix(terminal): resolve scroll position issue"
+  echo "  docs: update README"
+  echo "  chore: update dependencies"
+  echo ""
+  exit 1
+fi
+
+# Check description length (max 100 chars for first line)
+if [ ${#first_line} -gt 100 ]; then
+  echo ""
+  echo "ERROR: Commit message first line is too long!"
+  echo "Maximum: 100 characters"
+  echo "Current: ${#first_line} characters"
+  echo ""
+  exit 1
+fi
+
+exit 0

.husky/pre-commit

@@ -1,6 +1,158 @@
 #!/bin/sh
 
-# Run lint-staged in auto-claude-ui if there are staged files there
-if git diff --cached --name-only | grep -q "^auto-claude-ui/"; then
-  cd auto-claude-ui && pnpm exec lint-staged
+echo "Running pre-commit checks..."
+
+# =============================================================================
+# VERSION SYNC - Keep all version references in sync with root package.json
+# =============================================================================
+
+# Check if package.json is staged
+if git diff --cached --name-only | grep -q "^package.json$"; then
+  echo "package.json changed, syncing version to all files..."
+
+  # Extract version from root package.json
+  VERSION=$(node -p "require('./package.json').version")
+
+  if [ -n "$VERSION" ]; then
+    # Sync to apps/frontend/package.json
+    if [ -f "apps/frontend/package.json" ]; then
+      node -e "
+        const fs = require('fs');
+        const pkg = require('./apps/frontend/package.json');
+        if (pkg.version !== '$VERSION') {
+          pkg.version = '$VERSION';
+          fs.writeFileSync('./apps/frontend/package.json', JSON.stringify(pkg, null, 2) + '\n');
+          console.log('  Updated apps/frontend/package.json to $VERSION');
+        }
+      "
+      git add apps/frontend/package.json
+    fi
+
+    # Sync to apps/backend/__init__.py
+    if [ -f "apps/backend/__init__.py" ]; then
+      sed -i.bak "s/__version__ = \"[^\"]*\"/__version__ = \"$VERSION\"/" apps/backend/__init__.py
+      rm -f apps/backend/__init__.py.bak
+      git add apps/backend/__init__.py
+      echo "  Updated apps/backend/__init__.py to $VERSION"
+    fi
+
+    # Sync to README.md
+    if [ -f "README.md" ]; then
+      # Update version badge
+      sed -i.bak "s/version-[0-9]*\.[0-9]*\.[0-9]*-blue/version-$VERSION-blue/g" README.md
+      # Update download links
+      sed -i.bak "s/Auto-Claude-[0-9]*\.[0-9]*\.[0-9]*/Auto-Claude-$VERSION/g" README.md
+      rm -f README.md.bak
+      git add README.md
+      echo "  Updated README.md to $VERSION"
+    fi
+
+    echo "Version sync complete: $VERSION"
+  fi
 fi
+
+# =============================================================================
+# BACKEND CHECKS (Python) - Run first, before frontend
+# =============================================================================
+
+# Check if there are staged Python files in apps/backend
+if git diff --cached --name-only | grep -q "^apps/backend/.*\.py$"; then
+  echo "Python changes detected, running backend checks..."
+
+  # Determine ruff command (venv or global)
+  RUFF=""
+  if [ -f "apps/backend/.venv/bin/ruff" ]; then
+    RUFF="apps/backend/.venv/bin/ruff"
+  elif [ -f "apps/backend/.venv/Scripts/ruff.exe" ]; then
+    RUFF="apps/backend/.venv/Scripts/ruff.exe"
+  elif command -v ruff >/dev/null 2>&1; then
+    RUFF="ruff"
+  fi
+
+  if [ -n "$RUFF" ]; then
+    # Run ruff linting (auto-fix)
+    echo "Running ruff lint..."
+    $RUFF check apps/backend/ --fix
+    if [ $? -ne 0 ]; then
+      echo "Ruff lint failed. Please fix Python linting errors before committing."
+      exit 1
+    fi
+
+    # Run ruff format (auto-fix)
+    echo "Running ruff format..."
+    $RUFF format apps/backend/
+
+    # Stage any files that were auto-fixed by ruff (POSIX-compliant)
+    find apps/backend -name "*.py" -type f -exec git add {} + 2>/dev/null || true
+  else
+    echo "Warning: ruff not found, skipping Python linting. Install with: uv pip install ruff"
+  fi
+
+  # Run pytest (skip slow/integration tests and Windows-incompatible tests for pre-commit speed)
+  echo "Running Python tests..."
+  cd apps/backend
+  # Tests to skip: graphiti (external deps), merge_file_tracker/service_orchestrator/worktree/workspace (Windows path/git issues)
+  IGNORE_TESTS="--ignore=../../tests/test_graphiti.py --ignore=../../tests/test_merge_file_tracker.py --ignore=../../tests/test_service_orchestrator.py --ignore=../../tests/test_worktree.py --ignore=../../tests/test_workspace.py"
+  if [ -d ".venv" ]; then
+    # Use venv if it exists
+    if [ -f ".venv/bin/pytest" ]; then
+      PYTHONPATH=. .venv/bin/pytest ../../tests/ -v --tb=short -x -m "not slow and not integration" $IGNORE_TESTS
+    elif [ -f ".venv/Scripts/pytest.exe" ]; then
+      # Windows
+      PYTHONPATH=. .venv/Scripts/pytest.exe ../../tests/ -v --tb=short -x -m "not slow and not integration" $IGNORE_TESTS
+    else
+      PYTHONPATH=. python -m pytest ../../tests/ -v --tb=short -x -m "not slow and not integration" $IGNORE_TESTS
+    fi
+  else
+    PYTHONPATH=. python -m pytest ../../tests/ -v --tb=short -x -m "not slow and not integration" $IGNORE_TESTS
+  fi
+  if [ $? -ne 0 ]; then
+    echo "Python tests failed. Please fix failing tests before committing."
+    exit 1
+  fi
+  cd ../..
+  
+  echo "Backend checks passed!"
+fi
+
+# =============================================================================
+# FRONTEND CHECKS (TypeScript/React)
+# =============================================================================
+
+# Check if there are staged files in apps/frontend
+if git diff --cached --name-only | grep -q "^apps/frontend/"; then
+  echo "Frontend changes detected, running frontend checks..."
+  cd apps/frontend
+  
+  # Run lint-staged (handles staged .ts/.tsx files)
+  npm exec lint-staged
+  
+  # Run TypeScript type check
+  echo "Running type check..."
+  npm run typecheck
+  if [ $? -ne 0 ]; then
+    echo "Type check failed. Please fix TypeScript errors before committing."
+    exit 1
+  fi
+  
+  # Run linting
+  echo "Running lint..."
+  npm run lint
+  if [ $? -ne 0 ]; then
+    echo "Lint failed. Run 'npm run lint:fix' to auto-fix issues."
+    exit 1
+  fi
+  
+  # Check for vulnerabilities (only high severity)
+  echo "Checking for vulnerabilities..."
+  npm audit --audit-level=high
+  if [ $? -ne 0 ]; then
+    echo "High severity vulnerabilities found. Run 'npm audit fix' to resolve."
+    exit 1
+  fi
+  
+  cd ../..
+  echo "Frontend checks passed!"
+fi
+
+echo "All pre-commit checks passed!"

.pre-commit-config.yaml

@@ -1,29 +1,62 @@
 repos:
-  # Python linting (auto-claude/)
+  # Version sync - propagate root package.json version to all files
+  - repo: local
+    hooks:
+      - id: version-sync
+        name: Version Sync
+        entry: bash -c '
+          VERSION=$(node -p "require(\"./package.json\").version");
+          if [ -n "$VERSION" ]; then
+            # Sync to apps/frontend/package.json
+            node -e "const fs=require(\"fs\");const p=require(\"./apps/frontend/package.json\");if(p.version!==\"$VERSION\"){p.version=\"$VERSION\";fs.writeFileSync(\"./apps/frontend/package.json\",JSON.stringify(p,null,2)+\"\n\");}";
+            # Sync to apps/backend/__init__.py
+            sed -i.bak "s/__version__ = \"[^\"]*\"/__version__ = \"$VERSION\"/" apps/backend/__init__.py && rm -f apps/backend/__init__.py.bak;
+            # Sync to README.md
+            sed -i.bak "s/version-[0-9]*\.[0-9]*\.[0-9]*-blue/version-$VERSION-blue/g" README.md;
+            sed -i.bak "s/Auto-Claude-[0-9]*\.[0-9]*\.[0-9]*/Auto-Claude-$VERSION/g" README.md && rm -f README.md.bak;
+            git add apps/frontend/package.json apps/backend/__init__.py README.md 2>/dev/null || true;
+          fi
+        '
+        language: system
+        files: ^package\.json$
+        pass_filenames: false
+
+  # Python linting (apps/backend/)
   - repo: https://github.com/astral-sh/ruff-pre-commit
     rev: v0.8.3
     hooks:
       - id: ruff
         args: [--fix]
-        files: ^auto-claude/
+        files: ^apps/backend/
       - id: ruff-format
-        files: ^auto-claude/
+        files: ^apps/backend/
 
-  # Frontend linting (auto-claude-ui/)
+  # Python tests (apps/backend/) - skip slow/integration tests for pre-commit speed
+  # Tests to skip: graphiti (external deps), merge_file_tracker/service_orchestrator/worktree/workspace (Windows path/git issues)
+  - repo: local
+    hooks:
+      - id: pytest
+        name: Python Tests
+        entry: bash -c 'cd apps/backend && PYTHONPATH=. python -m pytest ../../tests/ -v --tb=short -x -m "not slow and not integration" --ignore=../../tests/test_graphiti.py --ignore=../../tests/test_merge_file_tracker.py --ignore=../../tests/test_service_orchestrator.py --ignore=../../tests/test_worktree.py --ignore=../../tests/test_workspace.py'
+        language: system
+        files: ^(apps/backend/.*\.py$|tests/.*\.py$)
+        pass_filenames: false
+
+  # Frontend linting (apps/frontend/)
   - repo: local
     hooks:
       - id: eslint
         name: ESLint
-        entry: bash -c 'cd auto-claude-ui && pnpm lint'
+        entry: bash -c 'cd apps/frontend && npm run lint'
         language: system
-        files: ^auto-claude-ui/.*\.(ts|tsx|js|jsx)$
+        files: ^apps/frontend/.*\.(ts|tsx|js|jsx)$
         pass_filenames: false
 
       - id: typecheck
         name: TypeScript Check
-        entry: bash -c 'cd auto-claude-ui && pnpm typecheck'
+        entry: bash -c 'cd apps/frontend && npm run typecheck'
         language: system
-        files: ^auto-claude-ui/.*\.(ts|tsx)$
+        files: ^apps/frontend/.*\.(ts|tsx)$
         pass_filenames: false
 
   # General checks
@@ -33,4 +66,5 @@ repos:
       - id: trailing-whitespace
       - id: end-of-file-fixer
       - id: check-yaml
+        exclude: pnpm-lock\.yaml$
       - id: check-added-large-files

CHANGELOG.md

@@ -1,3 +1,637 @@
+## 2.7.1 - Build Pipeline Enhancements
+
+### 🛠️ Improvements
+
+- Enhanced VirusTotal scan error handling in release workflow with graceful failure recovery and improved reporting visibility
+
+- Refactored macOS build workflow to support both Intel and ARM64 architectures with notarization for Intel builds and improved artifact handling
+
+- Streamlined CI/CD processes with updated caching strategies and enhanced error handling for external API interactions
+
+### 📚 Documentation
+
+- Clarified README documentation
+
+---
+
+## What's Changed
+
+- chore: Enhance VirusTotal scan error handling in release workflow by @AndyMik90 in d23fcd8
+
+- chore: Refactor macOS build workflow to support Intel and ARM64 architectures by @AndyMik90 in 326118b
+
+- docs: readme clarification by @AndyMik90 in 6afcc92
+
+- fix: version by @AndyMik90 in 2c93890
+
+## Thanks to all contributors
+
+@AndyMik90
+
+## 2.7.0 - Tab Persistence & Memory System Modernization
+
+### ✨ New Features
+
+- Project tab bar with persistent tab management and GitHub organization initialization on project creation
+
+- Task creation enhanced with @ autocomplete for agent profiles and improved drag-and-drop support
+
+- Keyboard shortcuts and tooltips added to project tabs for better navigation
+
+- Agent task restart functionality with new profile support for flexible task recovery
+
+- Ollama embedding model support with automatic dimension detection for self-hosted deployments
+
+### 🛠️ Improvements
+
+- Memory system completely redesigned with embedded LadybugDB, eliminating Docker/FalkorDB dependency and improving performance
+
+- Tab persistence implemented via IPC-based mechanism for reliable session state management
+
+- Terminal environment improved by using virtual environment Python for proper terminal name generation
+
+- AI merge operations timeout increased from 2 to 10 minutes for reliability with larger changes
+
+- Merge operations now use stored baseBranch metadata for consistent branch targeting
+
+- Memory configuration UI simplified and rebranded with improved Ollama integration and detection
+
+- CI/CD workflows enhanced with code signing support and automated release process
+
+- Cross-platform compatibility improved by replacing Unix shell syntax with portable git commands
+
+- Python venv created in userData for packaged applications to ensure proper environment isolation
+
+### 🐛 Bug Fixes
+
+- Task title no longer blocks edit/close buttons in UI
+
+- Tab persistence and terminal shortcuts properly scoped to prevent conflicts
+
+- Agent profile fallback corrected from 'Balanced' to 'Auto (Optimized)'
+
+- macOS notarization made optional and improved with private artifact storage
+
+- Embedding provider changes now properly detected during migration
+
+- Memory query CLI respects user's memory enabled flag
+
+- CodeRabbit review issues and linting errors resolved across codebase
+
+- F-string prefixes removed from strings without placeholders
+
+- Import ordering fixed for ruff compliance
+
+- Preview panel now receives projectPath prop correctly for image component functionality
+
+- Default database path unified to ~/.auto-claude/memories for consistency
+
+- @lydell/node-pty build scripts compatibility improved for pnpm v10
+
+---
+
+## What's Changed
+
+- feat(ui): add project tab bar from PR #101 by @AndyMik90 in c400fe9
+
+- feat: improve task creation UX with @ autocomplete and better drag-drop by @AndyMik90 in 20d1487
+
+- feat(ui): add keyboard shortcuts and tooltips for project tabs by @AndyMik90 in ed73265
+
+- feat(agent): enhance task restart functionality with new profile support by @AndyMik90 in c8452a5
+
+- feat: add Ollama embedding model support with auto-detected dimensions by @AndyMik90 in 45901f3
+
+- feat(memory): replace FalkorDB with LadybugDB embedded database by @AndyMik90 in 87d0b52
+
+- feat: add automated release workflow with code signing by @AndyMik90 in 6819b00
+
+- feat: add embedding provider change detection and fix import ordering by @AndyMik90 in 36f8006
+
+- fix(tests): update tab management tests for IPC-based persistence by @AndyMik90 in ea25d6e
+
+- fix(ui): address CodeRabbit PR review issues by @AndyMik90 in 39ce754
+
+- fix: address CodeRabbit review issues by @AndyMik90 in 95ae0b0
+
+- fix: prevent task title from blocking edit/close buttons by @AndyMik90 in 8a0fb26
+
+- fix: use venv Python for terminal name generation by @AndyMik90 in 325cb54
+
+- fix(merge): increase AI merge timeout from 2 to 10 minutes by @AndyMik90 in 4477538
+
+- fix(merge): use stored baseBranch from task metadata for merge operations by @AndyMik90 in 8d56474
+
+- fix: unify default database path to ~/.auto-claude/memories by @AndyMik90 in 684e3f9
+
+- fix(ui): fix tab persistence and scope terminal shortcuts by @AndyMik90 in 2d1168b
+
+- fix: create Python venv in userData for packaged apps by @AndyMik90 in b83377c
+
+- fix(ui): change agent profile fallback from 'Balanced' to 'Auto (Optimized)' by @AndyMik90 in 385dcc1
+
+- fix: check APPLE_ID in shell instead of workflow if condition by @AndyMik90 in 9eece01
+
+- fix: allow @lydell/node-pty build scripts in pnpm v10 by @AndyMik90 in 1f6963f
+
+- fix: use shell guard for notarization credentials check by @AndyMik90 in 4cbddd3
+
+- fix: improve migrate_embeddings robustness and correctness by @AndyMik90 in 61f0238
+
+- fix: respect user's memory enabled flag in query_memory CLI by @AndyMik90 in 45b2c83
+
+- fix: save notarization logs to private artifact instead of public logs by @AndyMik90 in a82525d
+
+- fix: make macOS notarization optional by @AndyMik90 in f2b7b56
+
+- fix: add author email for Linux builds by @AndyMik90 in 5f66127
+
+- fix: add GH_TOKEN and homepage for release workflow by @AndyMik90 in 568ea18
+
+- fix(ci): quote GITHUB_OUTPUT for shell safety by @AndyMik90 in 1e891e1
+
+- fix: address CodeRabbit review feedback by @AndyMik90 in 8e4b1da
+
+- fix: update test and apply ruff formatting by @AndyMik90 in a087ba3
+
+- fix: address additional CodeRabbit review comments by @AndyMik90 in 461fad6
+
+- fix: sort imports in memory.py for ruff I001 by @AndyMik90 in b3c257d
+
+- fix: address CodeRabbit review comments from PR #100 by @AndyMik90 in 1ed237a
+
+- fix: remove f-string prefixes from strings without placeholders by @AndyMik90 in bcd453a
+
+- fix: resolve remaining CI failures by @AndyMik90 in cfbccda
+
+- fix: resolve all CI failures in PR #100 by @AndyMik90 in c493d6c
+
+- fix(cli): update graphiti status display for LadybugDB by @AndyMik90 in 049c60c
+
+- fix(ui): replace Unix shell syntax with cross-platform git commands by @AndyMik90 in 83aa3f0
+
+- fix: correct model name and release workflow conditionals by @AndyMik90 in de41dfc
+
+- style: fix ruff linting errors in graphiti queries by @AndyMik90 in 127559f
+
+- style: apply ruff formatting to 4 files by @AndyMik90 in 9d5d075
+
+- refactor: update memory test suite for LadybugDB by @AndyMik90 in f0b5efc
+
+- refactor(ui): simplify reference files and images handling in task modal by @AndyMik90 in 1975e4d
+
+- refactor: rebrand memory system UI and simplify configuration by @AndyMik90 in 2b3cd49
+
+- refactor: replace Docker/FalkorDB with embedded LadybugDB for memory system by @AndyMik90 in 325458d
+
+- docs: add CodeRabbit review response tracking by @AndyMik90 in 3452548
+
+- chore: use GitHub noreply email for author field by @AndyMik90 in 18f2045
+
+- chore: simplify notarization step after successful setup by @AndyMik90 in e4fe7cd
+
+- chore: update CI and release workflows, remove changelog config by @AndyMik90 in 6f891b7
+
+- chore: remove docker-compose.yml (FalkorDB no longer used) by @AndyMik90 in 68f3f06
+
+- fix: Replace space with hyphen in productName to fix PTY daemon spawn (#65) by @Craig Van in 8f1f7a7
+
+- fix: update npm scripts to use hyphenated product name by @AndyMik90 in 89978ed
+
+- fix(ui): improve Ollama UX in memory settings by @AndyMik90 in dea1711
+
+- auto-claude: subtask-1-1 - Add projectPath prop to PreviewPanel and implement custom img component by @AndyMik90 in e6529e0
+
+- Project tab persistence and github org init on project creation by @AndyMik90 in ae1dac9
+
+- Readme for installors by @AndyMik90 in 1855d7d
+
+---
+
+## Thanks to all contributors
+
+@AndyMik90, @Craig Van
+
+## 2.6.0 - Improved User Experience and Agent Configuration
+
+### ✨ New Features
+
+- Add customizable phase configuration in app settings, allowing users to tailor the AI build pipeline to their workflow
+
+- Implement parallel AI merge functionality for faster integration of completed builds
+
+- Add Google AI as LLM and embedding provider for Graphiti memory system
+
+- Implement device code authentication flow with timeout handling, browser launch fallback, and comprehensive testing
+
+### 🛠️ Improvements
+
+- Move Agent Profiles from dashboard to Settings for better organization and discoverability
+
+- Default agent profile to 'Auto (Optimized)' for streamlined out-of-the-box experience
+
+- Enhance WorkspaceStatus component UI with improved visual design
+
+- Refactor task management from sidebar to modal interface for cleaner navigation
+
+- Add comprehensive theme system with multiple color schemes (Forest, Neo, Retro, Dusk, Ocean, Lime) and light/dark mode support
+
+- Extract human-readable feature titles from spec.md for better task identification
+
+- Improve task description display for specs with compact markdown formatting
+
+### 🐛 Bug Fixes
+
+- Fix asyncio coroutine creation in worker threads to properly support async operations
+
+- Improve UX for phase configuration in task creation workflow
+
+- Address CodeRabbit PR #69 feedback and additional review comments
+
+- Fix auto-close behavior for task modal when marking tasks as done
+
+- Resolve Python lint errors and import sorting issues (ruff I001 compliance)
+
+- Ensure planner agent properly writes implementation_plan.json
+
+- Add platform detection for terminal profile commands on Windows
+
+- Set default selected agent profile to 'auto' across all users
+
+- Fix display of correct merge target branch in worktree UI
+
+- Add validation for invalid colorTheme fallback to prevent UI errors
+
+- Remove outdated Sun/Moon toggle button from sidebar
+
+---
+
+## What's Changed
+
+- feat: add customizable phase configuration in app settings by @AndyMik90 in aee0ba4
+
+- feat: implement parallel AI merge functionality by @AndyMik90 in 458d4bb
+
+- feat(graphiti): add Google AI as LLM and embedding provider by @adryserage in fe69106
+
+- fix: create coroutine inside worker thread for asyncio.run by @AndyMik90 in f89e4e6
+
+- fix: improve UX for phase configuration in task creation by @AndyMik90 in b9797cb
+
+- fix: address CodeRabbit PR #69 feedback by @AndyMik90 in cc38a06
+
+- fix: sort imports in workspace.py to pass ruff I001 check by @AndyMik90 in 9981ee4
+
+- fix(ui): auto-close task modal when marking task as done by @AndyMik90 in 297d380
+
+- fix: resolve Python lint errors in workspace.py by @AndyMik90 in 0506256
+
+- refactor: move Agent Profiles from dashboard to Settings by @AndyMik90 in 1094990
+
+- fix(planning): ensure planner agent writes implementation_plan.json by @AndyMik90 in 9ab5a4f
+
+- fix(windows): add platform detection for terminal profile commands by @AndyMik90 in f0a6a0a
+
+- fix: default agent profile to 'Auto (Optimized)' for all users by @AndyMik90 in 08aa2ff
+
+- fix: update default selected agent profile to 'auto' by @AndyMik90 in 37ace0a
+
+- style: enhance WorkspaceStatus component UI by @AndyMik90 in 3092155
+
+- fix: display correct merge target branch in worktree UI by @AndyMik90 in 2b96160
+
+- Improvement/refactor task sidebar to task modal by @AndyMik90 in 2a96f85
+
+- fix: extract human-readable title from spec.md when feature field is spec ID by @AndyMik90 in 8b59375
+
+- fix: task descriptions not showing for specs with compact markdown by @AndyMik90 in 7f12ef0
+
+- Add comprehensive theme system with Forest, Neo, Retro, Dusk, Ocean, and Lime color schemes by @AndyMik90 in ba776a3, e2b24e2, 7589046, e248256, 76c1bd7, bcbced2
+
+- Add ColorTheme type and configuration to app settings by @AndyMik90 in 2ca89ce, c505d6e, a75c0a9
+
+- Implement device code authentication flow with timeout handling and fallback URL display by @AndyMik90 in 5f26d39, 81e1536, 1a7cf40, 4a4ad6b, 6a4c1b4, b75a09c, e134c4c
+
+- fix(graphiti): address CodeRabbit review comments by @adryserage in 679b8cd
+
+- fix(lint): sort imports in Google provider files by @adryserage in 1a38a06
+
+## 2.6.0 - Multi-Provider Graphiti Support & Platform Fixes
+
+### ✨ New Features
+
+- **Google AI Provider for Graphiti**: Full Google AI (Gemini) support for both LLM and embeddings in the Memory Layer
+  - Add GoogleLLMClient with gemini-2.0-flash default model
+  - Add GoogleEmbedder with text-embedding-004 default model
+  - UI integration for Google API key configuration with link to Google AI Studio
+- **Ollama LLM Provider in UI**: Add Ollama as an LLM provider option in Graphiti onboarding wizard
+  - Ollama runs locally and doesn't require an API key
+  - Configure Base URL instead of API key for local inference
+- **LLM Provider Selection UI**: Add provider selection dropdown to Graphiti setup wizard for flexible backend configuration
+- **Per-Project GitHub Configuration**: UI clarity improvements for per-project GitHub org/repo settings
+
+### 🛠️ Improvements
+
+- Enhanced Graphiti provider factory to support Google AI alongside existing providers
+- Updated env-handlers to properly populate graphitiProviderConfig from .env files
+- Improved type definitions with proper Graphiti provider config properties in AppSettings
+- Better API key loading when switching between providers in settings
+
+### 🐛 Bug Fixes
+
+- **node-pty Migration**: Replaced node-pty with @lydell/node-pty for prebuilt Windows binaries
+  - Updated all imports to use @lydell/node-pty directly
+  - Fixed "Cannot find module 'node-pty'" startup error
+- **GitHub Organization Support**: Fixed repository support for GitHub organization accounts
+  - Add defensive array validation for GitHub issues API response
+- **Asyncio Deprecation**: Fixed asyncio deprecation warning by using get_running_loop() instead of get_event_loop()
+- Applied ruff formatting and fixed import sorting (I001) in Google provider files
+
+### 🔧 Other Changes
+
+- Added google-generativeai dependency to requirements.txt
+- Updated provider validation to include Google/Groq/HuggingFace type assertions
+
+---
+
+## What's Changed
+
+- fix(graphiti): address CodeRabbit review comments by @adryserage in 679b8cd
+- fix(lint): sort imports in Google provider files by @adryserage in 1a38a06
+- feat(graphiti): add Google AI as LLM and embedding provider by @adryserage in fe69106
+- fix: GitHub organization repository support by @mojaray2k in 873cafa
+- feat(ui): add LLM provider selection to Graphiti onboarding by @adryserage in 4750869
+- fix(types): add missing AppSettings properties for Graphiti providers by @adryserage in 6680ed4
+- feat(ui): add Ollama as LLM provider option for Graphiti by @adryserage in a3eee92
+- fix(ui): address PR review feedback for Graphiti provider selection by @adryserage in b8a419a
+- fix(deps): update imports to use @lydell/node-pty directly by @adryserage in 2b61ebb
+- fix(deps): replace node-pty with @lydell/node-pty for prebuilt binaries by @adryserage in e1aee6a
+- fix: add UI clarity for per-project GitHub configuration by @mojaray2k in c9745b6
+- fix: add defensive array validation for GitHub issues API response by @mojaray2k in b3636a5
+
+---
+
+## 2.5.5 - Enhanced Agent Reliability & Build Workflow
+
+### ✨ New Features
+
+- Required GitHub setup flow after Auto Claude initialization to ensure proper configuration
+- Atomic log saving mechanism to prevent log file corruption during concurrent operations
+- Per-session model and thinking level selection in insights management
+- Multi-auth token support and ANTHROPIC_BASE_URL passthrough for flexible authentication
+- Comprehensive DEBUG logging at Claude SDK invocation points for improved troubleshooting
+- Auto-download of prebuilt node-pty binaries for Windows environments
+- Enhanced merge workflow with current branch detection for accurate change previews
+- Phase configuration module and enhanced agent profiles for improved flexibility
+- Stage-only merge handling with comprehensive verification checks
+- Authentication failure detection system with patterns and validation checks across agent pipeline
+
+### 🛠️ Improvements
+
+- Changed default agent profile from 'balanced' to 'auto' for more adaptive behavior
+- Better GitHub issue tracking and improved user experience in issue management
+- Improved merge preview accuracy using git diff counts for file statistics
+- Preserved roadmap generation state when switching between projects
+- Enhanced agent profiles with phase configuration support
+
+### 🐛 Bug Fixes
+
+- Resolved CI test failures and improved merge preview reliability
+- Fixed CI failures related to linting, formatting, and tests
+- Prevented dialog skip during project initialization flow
+- Updated model IDs for Sonnet and Haiku to match current Claude versions
+- Fixed branch namespace conflict detection to prevent worktree creation failures
+- Removed duplicate LINEAR_API_KEY checks and consolidated imports
+- Python 3.10+ version requirement enforced with proper version checking
+- Prevented command injection vulnerabilities in GitHub API calls
+
+### 🔧 Other Changes
+
+- Code cleanup and test fixture updates
+- Removed redundant auto-claude/specs directory structure
+- Untracked .auto-claude directory to respect gitignore rules
+
+---
+
+## What's Changed
+
+- fix: resolve CI test failures and improve merge preview by @AndyMik90 in de2eccd
+- chore: code cleanup and test fixture updates by @AndyMik90 in 948db57
+- refactor: change default agent profile from 'balanced' to 'auto' by @AndyMik90 in f98a13e
+- security: prevent command injection in GitHub API calls by @AndyMik90 in 24ff491
+- fix: resolve CI failures (lint, format, test) by @AndyMik90 in a8f2d0b
+- fix: use git diff count for totalFiles in merge preview by @AndyMik90 in 46d2536
+- feat: enhance stage-only merge handling with verification checks by @AndyMik90 in 7153558
+- feat: introduce phase configuration module and enhance agent profiles by @AndyMik90 in 2672528
+- fix: preserve roadmap generation state when switching projects by @AndyMik90 in 569e921
+- feat: add required GitHub setup flow after Auto Claude initialization by @AndyMik90 in 03ccce5
+- chore: remove redundant auto-claude/specs directory by @AndyMik90 in 64d5170
+- chore: untrack .auto-claude directory (should be gitignored) by @AndyMik90 in 0710c13
+- fix: prevent dialog skip during project initialization by @AndyMik90 in 56cedec
+- feat: enhance merge workflow by detecting current branch by @AndyMik90 in c0c8067
+- fix: update model IDs for Sonnet and Haiku by @AndyMik90 in 059315d
+- feat: add comprehensive DEBUG logging and fix lint errors by @AndyMik90 in 99cf21e
+- feat: implement atomic log saving to prevent corruption by @AndyMik90 in da5e26b
+- feat: add better github issue tracking and UX by @AndyMik90 in c957eaa
+- feat: add comprehensive DEBUG logging to Claude SDK invocation points by @AndyMik90 in 73d01c0
+- feat: auto-download prebuilt node-pty binaries for Windows by @AndyMik90 in 41a507f
+- feat(insights): add per-session model and thinking level selection by @AndyMik90 in e02aa59
+- fix: require Python 3.10+ and add version check by @AndyMik90 in 9a5ca8c
+- fix: detect branch namespace conflict blocking worktree creation by @AndyMik90 in 63a1d3c
+- fix: remove duplicate LINEAR_API_KEY check and consolidate imports by @Jacob in 7d351e3
+- feat: add multi-auth token support and ANTHROPIC_BASE_URL passthrough by @Jacob in 9dea155
+
+## 2.5.0 - Roadmap Intelligence & Workflow Refinements
+
+### ✨ New Features
+
+- Interactive competitor analysis viewer for roadmap planning with real-time data visualization
+
+- GitHub issue label mapping to task categories for improved organization and tracking
+
+- GitHub issue comment selection in task creation workflow for better context integration
+
+- TaskCreationWizard enhanced with drag-and-drop support for file references and inline @mentions
+
+- Roadmap generation now includes stop functionality and comprehensive debug logging
+
+### 🛠️ Improvements
+
+- Refined visual drop zone feedback in file reference system for more subtle user guidance
+
+- Remove auto-expand behavior for referenced files on draft restore to improve UX
+
+- Always-visible referenced files section in TaskCreationWizard for better discoverability
+
+- Drop zone wrapper added around main modal content area for improved drag-and-drop ergonomics
+
+- Stuck task detection now enabled for ai_review status to better track blocked work
+
+- Enhanced React component stability with proper key usage in RoadmapHeader and PhaseProgressIndicator
+
+### 🐛 Bug Fixes
+
+- Corrected CompetitorAnalysisViewer type definitions for proper TypeScript compliance
+
+- Fixed multiple CodeRabbit review feedback items for improved code quality
+
+- Resolved React key warnings in PhaseProgressIndicator component
+
+- Fixed git status parsing in merge preview for accurate worktree state detection
+
+- Corrected path resolution in runners for proper module imports and .env loading
+
+- Resolved CI lint and TypeScript errors across codebase
+
+- Fixed HTTP error handling and path resolution issues in core modules
+
+- Corrected worktree test to match intended branch detection behavior
+
+- Refined TaskReview component conditional rendering for proper staged task display
+
+---
+
+## What's Changed
+
+- feat: add interactive competitor analysis viewer for roadmap by @AndyMik90 in 7ff326d
+
+- fix: correct CompetitorAnalysisViewer to match type definitions by @AndyMik90 in 4f1766b
+
+- fix: address multiple CodeRabbit review feedback items by @AndyMik90 in 48f7c3c
+
+- fix: use stable React keys instead of array indices in RoadmapHeader by @AndyMik90 in 892e01d
+
+- fix: additional fixes for http error handling and path resolution by @AndyMik90 in 54501cb
+
+- fix: update worktree test to match intended branch detection behavior by @AndyMik90 in f1d578f
+
+- fix: resolve CI lint and TypeScript errors by @AndyMik90 in 2e3a5d9
+
+- feat: enhance roadmap generation with stop functionality and debug logging by @AndyMik90 in a6dad42
+
+- fix: correct path resolution in runners for module imports and .env loading by @AndyMik90 in 3d24f8f
+
+- fix: resolve React key warning in PhaseProgressIndicator by @AndyMik90 in 9106038
+
+- fix: enable stuck task detection for ai_review status by @AndyMik90 in 895ed9f
+
+- feat: map GitHub issue labels to task categories by @AndyMik90 in cbe14fd
+
+- feat: add GitHub issue comment selection and fix auto-start bug by @AndyMik90 in 4c1dd89
+
+- feat: enhance TaskCreationWizard with drag-and-drop support for file references and inline @mentions by @AndyMik90 in d93eefe
+
+- cleanup docs by @AndyMik90 in 8e891df
+
+- fix: correct git status parsing in merge preview by @AndyMik90 in c721dc2
+
+- Update TaskReview component to refine conditional rendering for staged tasks, ensuring proper display when staging is unsuccessful by @AndyMik90 in 1a2b7a1
+
+- auto-claude: subtask-2-3 - Refine visual drop zone feedback to be more subtle by @AndyMik90 in 6cff442
+
+- auto-claude: subtask-2-1 - Remove showFiles auto-expand on draft restore by @AndyMik90 in 12bf69d
+
+- auto-claude: subtask-1-3 - Create an always-visible referenced files section by @AndyMik90 in 3818b46
+
+- auto-claude: subtask-1-2 - Add drop zone wrapper around main modal content area by @AndyMik90 in 219b66d
+
+- auto-claude: subtask-1-1 - Remove Reference Files toggle button by @AndyMik90 in 4e63e85
+
+## 2.4.0 - Enhanced Cross-Platform Experience with OAuth & Auto-Updates
+
+### ✨ New Features
+
+- Claude account OAuth implementation on onboarding for seamless token setup
+
+- Integrated release workflow with AI-powered version suggestion capabilities
+
+- Auto-upgrading functionality supporting Windows, Linux, and macOS with automatic app updates
+
+- Git repository initialization on app startup with project addition checks
+
+- Debug logging for app updater to track update processes
+
+- Auto-open settings to updates section when app update is ready
+
+### 🛠️ Improvements
+
+- Major Windows and Linux compatibility enhancements for cross-platform reliability
+
+- Enhanced task status handling to support 'done' status in limbo state with worktree existence checks
+
+- Better handling of lock files from worktrees upon merging
+
+- Improved README documentation and build process
+
+- Refined visual drop zone feedback for more subtle user experience
+
+- Removed showFiles auto-expand on draft restore for better UX consistency
+
+- Created always-visible referenced files section in task creation wizard
+
+- Removed Reference Files toggle button for streamlined interface
+
+- Worktree manual deletion enforcement for early access safety (prevents accidental work loss)
+
+### 🐛 Bug Fixes
+
+- Corrected git status parsing in merge preview functionality
+
+- Fixed ESLint warnings and failing tests
+
+- Fixed Windows/Linux Python handling for cross-platform compatibility
+
+- Fixed Windows/Linux source path detection
+
+- Refined TaskReview component conditional rendering for proper staged task display
+
+---
+
+## What's Changed
+
+- docs: cleanup docs by @AndyMik90 in 8e891df
+- fix: correct git status parsing in merge preview by @AndyMik90 in c721dc2
+- refactor: Update TaskReview component to refine conditional rendering for staged tasks by @AndyMik90 in 1a2b7a1
+- feat: Enhance task status handling to allow 'done' status in limbo state by @AndyMik90 in a20b8cf
+- improvement: Worktree needs to be manually deleted for early access safety by @AndyMik90 in 0ed6afb
+- feat: Claude account OAuth implementation on onboarding by @AndyMik90 in 914a09d
+- fix: Better handling of lock files from worktrees upon merging by @AndyMik90 in e44202a
+- feat: GitHub OAuth integration upon onboarding by @AndyMik90 in 4249644
+- chore: lock update by @AndyMik90 in b0fc497
+- improvement: Improved README and build process by @AndyMik90 in 462edcd
+- fix: ESLint warnings and failing tests by @AndyMik90 in affbc48
+- feat: Major Windows and Linux compatibility enhancements with auto-upgrade by @AndyMik90 in d7fd1a2
+- feat: Add debug logging to app updater by @AndyMik90 in 96dd04d
+- feat: Auto-open settings to updates section when app update is ready by @AndyMik90 in 1d0566f
+- feat: Add integrated release workflow with AI version suggestion by @AndyMik90 in 7f3cd59
+- fix: Windows/Linux Python handling by @AndyMik90 in 0ef0e15
+- feat: Implement Electron app auto-updater by @AndyMik90 in efc112a
+- fix: Windows/Linux source path detection by @AndyMik90 in d33a0aa
+- refactor: Refine visual drop zone feedback to be more subtle by @AndyMik90 in 6cff442
+- refactor: Remove showFiles auto-expand on draft restore by @AndyMik90 in 12bf69d
+- feat: Create always-visible referenced files section by @AndyMik90 in 3818b46
+- feat: Add drop zone wrapper around main modal content by @AndyMik90 in 219b66d
+- feat: Remove Reference Files toggle button by @AndyMik90 in 4e63e85
+- docs: Update README with git initialization and folder structure by @AndyMik90 in 2fa3c51
+- chore: Version bump to 2.3.2 by @AndyMik90 in 59b091a
+
+## 2.3.2 - UI Polish & Build Improvements
+
+### 🛠️ Improvements
+
+- Restructured SortableFeatureCard badge layout for improved visual presentation
+
+Bug Fixes:
+- Fixed spec runner path configuration for more reliable task execution
+
+---
+
+## What's Changed
+
+- fix: fix to spec runner paths by @AndyMik90 in 9babdc2
+
+- feat: auto-claude: subtask-1-1 - Restructure SortableFeatureCard badge layout by @AndyMik90 in dc886dc
+
 ## 2.3.1 - Linux Compatibility Fix
 
 ### 🐛 Bug Fixes
@@ -290,4 +924,4 @@
 - **Draft Auto-Save**: Task creation state is now automatically saved when you navigate away, preventing accidental loss of work-in-progress.
 
 ### Bug Fixes
-- Fixed task editing to support the same comprehensive options available in new task creation
+- Fixed task editing to support the same comprehensive options available in new task creation

CLAUDE.md

@@ -4,83 +4,154 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## Project Overview
 
-Auto Claude is a multi-agent autonomous coding framework that builds software through coordinated AI agent sessions. It uses the Claude Code SDK to run agents in isolated workspaces with security controls.
+Auto Claude is a multi-agent autonomous coding framework that builds software through coordinated AI agent sessions. It uses the Claude Agent SDK to run agents in isolated workspaces with security controls.
+
+**CRITICAL: All AI interactions use the Claude Agent SDK (`claude-agent-sdk` package), NOT the Anthropic API directly.**
+
+## Project Structure
+
+```
+autonomous-coding/
+├── apps/
+│   ├── backend/           # Python backend/CLI - ALL agent logic lives here
+│   │   ├── core/          # Client, auth, security
+│   │   ├── agents/        # Agent implementations
+│   │   ├── spec_agents/   # Spec creation agents
+│   │   ├── integrations/  # Graphiti, Linear, GitHub
+│   │   └── prompts/       # Agent system prompts
+│   └── frontend/          # Electron desktop UI
+├── guides/                # Documentation
+├── tests/                 # Test suite
+└── scripts/               # Build and utility scripts
+```
+
+**When working with AI/LLM code:**
+- Look in `apps/backend/core/client.py` for the Claude SDK client setup
+- Reference `apps/backend/agents/` for working agent implementations
+- Check `apps/backend/spec_agents/` for spec creation agent examples
+- NEVER use `anthropic.Anthropic()` directly - always use `create_client()` from `core.client`
+
+**Frontend (Electron Desktop App):**
+- Built with Electron, React, TypeScript
+- AI agents can perform E2E testing using the Electron MCP server
+- When bug fixing or implementing features, use the Electron MCP server for automated testing
+- See "End-to-End Testing" section below for details
 
 ## Commands
 
 ### Setup
+
+**Requirements:**
+- Python 3.12+ (required for backend)
+- Node.js (for frontend)
+
 ```bash
-# Install dependencies (from auto-claude/)
-uv venv && uv pip install -r requirements.txt
-# Or: python3 -m venv .venv && source .venv/bin/activate && pip install -r requirements.txt
+# Install all dependencies from root
+npm run install:all
+
+# Or install separately:
+# Backend (from apps/backend/)
+cd apps/backend && uv venv && uv pip install -r requirements.txt
+
+# Frontend (from apps/frontend/)
+cd apps/frontend && npm install
 
 # Set up OAuth token
 claude setup-token
-# Add to auto-claude/.env: CLAUDE_CODE_OAUTH_TOKEN=your-token
+# Add to apps/backend/.env: CLAUDE_CODE_OAUTH_TOKEN=your-token
 ```
 
 ### Creating and Running Specs
 ```bash
+cd apps/backend
+
 # Create a spec interactively
-python auto-claude/spec_runner.py --interactive
+python spec_runner.py --interactive
 
 # Create spec from task description
-python auto-claude/spec_runner.py --task "Add user authentication"
+python spec_runner.py --task "Add user authentication"
 
 # Force complexity level (simple/standard/complex)
-python auto-claude/spec_runner.py --task "Fix button" --complexity simple
+python spec_runner.py --task "Fix button" --complexity simple
 
 # Run autonomous build
-python auto-claude/run.py --spec 001
+python run.py --spec 001
 
 # List all specs
-python auto-claude/run.py --list
+python run.py --list
 ```
 
 ### Workspace Management
 ```bash
+cd apps/backend
+
 # Review changes in isolated worktree
-python auto-claude/run.py --spec 001 --review
+python run.py --spec 001 --review
 
 # Merge completed build into project
-python auto-claude/run.py --spec 001 --merge
+python run.py --spec 001 --merge
 
 # Discard build
-python auto-claude/run.py --spec 001 --discard
+python run.py --spec 001 --discard
 ```
 
 ### QA Validation
 ```bash
+cd apps/backend
+
 # Run QA manually
-python auto-claude/run.py --spec 001 --qa
+python run.py --spec 001 --qa
 
 # Check QA status
-python auto-claude/run.py --spec 001 --qa-status
+python run.py --spec 001 --qa-status
 ```
 
 ### Testing
 ```bash
 # Install test dependencies (required first time)
-cd auto-claude && uv pip install -r ../tests/requirements-test.txt
+cd apps/backend && uv pip install -r ../../tests/requirements-test.txt
 
 # Run all tests (use virtual environment pytest)
-auto-claude/.venv/bin/pytest tests/ -v
+apps/backend/.venv/bin/pytest tests/ -v
 
 # Run single test file
-auto-claude/.venv/bin/pytest tests/test_security.py -v
+apps/backend/.venv/bin/pytest tests/test_security.py -v
 
 # Run specific test
-auto-claude/.venv/bin/pytest tests/test_security.py::test_bash_command_validation -v
+apps/backend/.venv/bin/pytest tests/test_security.py::test_bash_command_validation -v
 
 # Skip slow tests
-auto-claude/.venv/bin/pytest tests/ -m "not slow"
+apps/backend/.venv/bin/pytest tests/ -m "not slow"
+
+# Or from root
+npm run test:backend
 ```
 
 ### Spec Validation
 ```bash
-python auto-claude/validate_spec.py --spec-dir auto-claude/specs/001-feature --checkpoint all
+python apps/backend/validate_spec.py --spec-dir apps/backend/specs/001-feature --checkpoint all
 ```
 
+### Releases
+```bash
+# 1. Bump version on your branch (creates commit, no tag)
+node scripts/bump-version.js patch   # 2.8.0 -> 2.8.1
+node scripts/bump-version.js minor   # 2.8.0 -> 2.9.0
+node scripts/bump-version.js major   # 2.8.0 -> 3.0.0
+
+# 2. Push and create PR to main
+git push origin your-branch
+gh pr create --base main
+
+# 3. Merge PR → GitHub Actions automatically:
+#    - Creates tag
+#    - Builds all platforms
+#    - Creates release with changelog
+#    - Updates README
+```
+
+See [RELEASE.md](RELEASE.md) for detailed release process documentation.
+
 ## Architecture
 
 ### Core Pipeline
@@ -93,21 +164,43 @@ python auto-claude/validate_spec.py --spec-dir auto-claude/specs/001-feature --c
 **Implementation (run.py → agent.py)** - Multi-session build:
 1. Planner Agent creates subtask-based implementation plan
 2. Coder Agent implements subtasks (can spawn subagents for parallel work)
-3. QA Reviewer validates acceptance criteria
-4. QA Fixer resolves issues in a loop
+3. QA Reviewer validates acceptance criteria (can perform E2E testing via Electron MCP for frontend changes)
+4. QA Fixer resolves issues in a loop (with E2E testing to verify fixes)
 
-### Key Components
+### Key Components (apps/backend/)
 
-- **client.py** - Claude SDK client with security hooks and tool permissions
-- **security.py** + **project_analyzer.py** - Dynamic command allowlisting based on detected project stack
-- **worktree.py** - Git worktree isolation for safe feature development
-- **memory.py** - File-based session memory (primary, always-available storage)
-- **graphiti_memory.py** - Optional graph-based cross-session memory with semantic search
-- **graphiti_providers.py** - Multi-provider factory for Graphiti (OpenAI, Anthropic, Azure, Ollama)
+**Core Infrastructure:**
+- **core/client.py** - Claude Agent SDK client factory with security hooks and tool permissions
+- **core/security.py** - Dynamic command allowlisting based on detected project stack
+- **core/auth.py** - OAuth token management for Claude SDK authentication
+- **agents/** - Agent implementations (planner, coder, qa_reviewer, qa_fixer)
+- **spec_agents/** - Spec creation agents (gatherer, researcher, writer, critic)
+
+**Memory & Context:**
+- **integrations/graphiti/** - Graphiti memory system (mandatory)
+  - `queries_pkg/graphiti.py` - Main GraphitiMemory class
+  - `queries_pkg/client.py` - LadybugDB client wrapper
+  - `queries_pkg/queries.py` - Graph query operations
+  - `queries_pkg/search.py` - Semantic search logic
+  - `queries_pkg/schema.py` - Graph schema definitions
 - **graphiti_config.py** - Configuration and validation for Graphiti integration
-- **linear_updater.py** - Optional Linear integration for progress tracking
+- **graphiti_providers.py** - Multi-provider factory (OpenAI, Anthropic, Azure, Ollama, Google AI)
+- **agents/memory_manager.py** - Session memory orchestration
 
-### Agent Prompts (auto-claude/prompts/)
+**Workspace & Security:**
+- **cli/worktree.py** - Git worktree isolation for safe feature development
+- **context/project_analyzer.py** - Project stack detection for dynamic tooling
+- **auto_claude_tools.py** - Custom MCP tools integration
+
+**Integrations:**
+- **linear_updater.py** - Optional Linear integration for progress tracking
+- **runners/github/** - GitHub Issues & PRs automation
+- **Electron MCP** - E2E testing integration for QA agents (Chrome DevTools Protocol)
+  - Enabled with `ELECTRON_MCP_ENABLED=true` in `.env`
+  - Allows QA agents to interact with running Electron app
+  - See "End-to-End Testing" section for details
+
+### Agent Prompts (apps/backend/prompts/)
 
 | Prompt | Purpose |
 |--------|---------|
@@ -124,7 +217,7 @@ python auto-claude/validate_spec.py --spec-dir auto-claude/specs/001-feature --c
 
 ### Spec Directory Structure
 
-Each spec in `auto-claude/specs/XXX-name/` contains:
+Each spec in `.auto-claude/specs/XXX-name/` contains:
 - `spec.md` - Feature specification
 - `requirements.json` - Structured user requirements
 - `context.json` - Discovered codebase context
@@ -164,38 +257,225 @@ Three-layer defense:
 
 Security profile cached in `.auto-claude-security.json`.
 
-### Memory System
+### Claude Agent SDK Integration
 
-Dual-layer memory architecture:
+**CRITICAL: Auto Claude uses the Claude Agent SDK for ALL AI interactions. Never use the Anthropic API directly.**
 
-**File-Based Memory (Primary)** - `memory.py`
-- Zero dependencies, always available
-- Human-readable files in `specs/XXX/memory/`
-- Session insights, patterns, gotchas, codebase map
+**Client Location:** `apps/backend/core/client.py`
 
-**Graphiti Memory (Optional Enhancement)** - `graphiti_memory.py`
-- Graph database with semantic search (FalkorDB)
-- Cross-session context retrieval
-- Multi-provider support (V2):
-  - LLM: OpenAI, Anthropic, Azure OpenAI, Ollama
-  - Embedders: OpenAI, Voyage AI, Azure OpenAI, Ollama
+The `create_client()` function creates a configured `ClaudeSDKClient` instance with:
+- Multi-layered security (sandbox, permissions, security hooks)
+- Agent-specific tool permissions (planner, coder, qa_reviewer, qa_fixer)
+- Dynamic MCP server integration based on project capabilities
+- Extended thinking token budget control
 
-Enable with: `GRAPHITI_ENABLED=true` + provider credentials. See `.env.example`.
+**Example usage in agents:**
+```python
+from core.client import create_client
 
-## Project Structure
+# Create SDK client (NOT raw Anthropic API client)
+client = create_client(
+    project_dir=project_dir,
+    spec_dir=spec_dir,
+    model="claude-sonnet-4-5-20250929",
+    agent_type="coder",
+    max_thinking_tokens=None  # or 5000/10000/16000
+)
 
-Auto Claude can be used in two ways:
-
-**As a standalone CLI tool** (original project):
-```bash
-python auto-claude/run.py --spec 001
+# Run agent session
+response = client.create_agent_session(
+    name="coder-agent-session",
+    starting_message="Implement the authentication feature"
+)
 ```
 
-**With the optional Electron frontend** (`auto-claude-ui/`):
-- Provides a GUI for task management and progress tracking
-- Wraps the CLI commands - the backend works independently
+**Why use the SDK:**
+- Pre-configured security (sandbox, allowlists, hooks)
+- Automatic MCP server integration (Context7, Linear, Graphiti, Electron, Puppeteer)
+- Tool permissions based on agent role
+- Session management and recovery
+- Unified API across all agent types
 
-**Directory layout:**
-- `auto-claude/` - Python backend/CLI (the framework code)
-- `auto-claude-ui/` - Optional Electron frontend
-- `.auto-claude/specs/` - Per-project data (specs, plans, QA reports) - gitignored
+**Where to find working examples:**
+- `apps/backend/agents/planner.py` - Planner agent
+- `apps/backend/agents/coder.py` - Coder agent
+- `apps/backend/agents/qa_reviewer.py` - QA reviewer
+- `apps/backend/agents/qa_fixer.py` - QA fixer
+- `apps/backend/spec_agents/` - Spec creation agents
+
+### Memory System
+
+**Graphiti Memory (Mandatory)** - `integrations/graphiti/`
+
+Auto Claude uses Graphiti as its primary memory system with embedded LadybugDB (no Docker required):
+
+- **Graph database with semantic search** - Knowledge graph for cross-session context
+- **Session insights** - Patterns, gotchas, discoveries automatically extracted
+- **Multi-provider support:**
+  - LLM: OpenAI, Anthropic, Azure OpenAI, Ollama, Google AI (Gemini)
+  - Embedders: OpenAI, Voyage AI, Azure OpenAI, Ollama, Google AI
+- **Modular architecture:** (`integrations/graphiti/queries_pkg/`)
+  - `graphiti.py` - Main GraphitiMemory class
+  - `client.py` - LadybugDB client wrapper
+  - `queries.py` - Graph query operations
+  - `search.py` - Semantic search logic
+  - `schema.py` - Graph schema definitions
+
+**Configuration:**
+- Set provider credentials in `apps/backend/.env` (see `.env.example`)
+- Required env vars: `GRAPHITI_ENABLED=true`, `ANTHROPIC_API_KEY` or other provider keys
+- Memory data stored in `.auto-claude/specs/XXX/graphiti/`
+
+**Usage in agents:**
+```python
+from integrations.graphiti.memory import get_graphiti_memory
+
+memory = get_graphiti_memory(spec_dir, project_dir)
+context = memory.get_context_for_session("Implementing feature X")
+memory.add_session_insight("Pattern: use React hooks for state")
+```
+
+## Development Guidelines
+
+### Frontend Internationalization (i18n)
+
+**CRITICAL: Always use i18n translation keys for all user-facing text in the frontend.**
+
+The frontend uses `react-i18next` for internationalization. All labels, buttons, messages, and user-facing text MUST use translation keys.
+
+**Translation file locations:**
+- `apps/frontend/src/shared/i18n/locales/en/*.json` - English translations
+- `apps/frontend/src/shared/i18n/locales/fr/*.json` - French translations
+
+**Translation namespaces:**
+- `common.json` - Shared labels, buttons, common terms
+- `navigation.json` - Sidebar navigation items, sections
+- `settings.json` - Settings page content
+- `dialogs.json` - Dialog boxes and modals
+- `tasks.json` - Task/spec related content
+- `onboarding.json` - Onboarding wizard content
+- `welcome.json` - Welcome screen content
+
+**Usage pattern:**
+```tsx
+import { useTranslation } from 'react-i18next';
+
+// In component
+const { t } = useTranslation(['navigation', 'common']);
+
+// Use translation keys, NOT hardcoded strings
+<span>{t('navigation:items.githubPRs')}</span>  // ✅ CORRECT
+<span>GitHub PRs</span>                          // ❌ WRONG
+```
+
+**When adding new UI text:**
+1. Add the translation key to ALL language files (at minimum: `en/*.json` and `fr/*.json`)
+2. Use `namespace:section.key` format (e.g., `navigation:items.githubPRs`)
+3. Never use hardcoded strings in JSX/TSX files
+
+### End-to-End Testing (Electron App)
+
+**IMPORTANT: When bug fixing or implementing new features in the frontend, AI agents can perform automated E2E testing using the Electron MCP server.**
+
+The Electron MCP server allows QA agents to interact with the running Electron app via Chrome DevTools Protocol:
+
+**Setup:**
+1. Start the Electron app with remote debugging enabled:
+   ```bash
+   npm run dev  # Already configured with --remote-debugging-port=9222
+   ```
+
+2. Enable Electron MCP in `apps/backend/.env`:
+   ```bash
+   ELECTRON_MCP_ENABLED=true
+   ELECTRON_DEBUG_PORT=9222  # Default port
+   ```
+
+**Available Testing Capabilities:**
+
+QA agents (`qa_reviewer` and `qa_fixer`) automatically get access to Electron MCP tools:
+
+1. **Window Management**
+   - `mcp__electron__get_electron_window_info` - Get info about running windows
+   - `mcp__electron__take_screenshot` - Capture screenshots for visual verification
+
+2. **UI Interaction**
+   - `mcp__electron__send_command_to_electron` with commands:
+     - `click_by_text` - Click buttons/links by visible text
+     - `click_by_selector` - Click elements by CSS selector
+     - `fill_input` - Fill form fields by placeholder or selector
+     - `select_option` - Select dropdown options
+     - `send_keyboard_shortcut` - Send keyboard shortcuts (Enter, Ctrl+N, etc.)
+     - `navigate_to_hash` - Navigate to hash routes (#settings, #create, etc.)
+
+3. **Page Inspection**
+   - `get_page_structure` - Get organized overview of page elements
+   - `debug_elements` - Get debugging info about buttons and forms
+   - `verify_form_state` - Check form state and validation
+   - `eval` - Execute custom JavaScript code
+
+4. **Logging**
+   - `mcp__electron__read_electron_logs` - Read console logs for debugging
+
+**Example E2E Test Flow:**
+
+```python
+# 1. Agent takes screenshot to see current state
+agent: "Take a screenshot to see the current UI"
+# Uses: mcp__electron__take_screenshot
+
+# 2. Agent inspects page structure
+agent: "Get page structure to find available buttons"
+# Uses: mcp__electron__send_command_to_electron (command: "get_page_structure")
+
+# 3. Agent clicks a button to navigate
+agent: "Click the 'Create New Spec' button"
+# Uses: mcp__electron__send_command_to_electron (command: "click_by_text", args: {text: "Create New Spec"})
+
+# 4. Agent fills out a form
+agent: "Fill the task description field"
+# Uses: mcp__electron__send_command_to_electron (command: "fill_input", args: {placeholder: "Describe your task", value: "Add login feature"})
+
+# 5. Agent submits and verifies
+agent: "Click Submit and verify success"
+# Uses: click_by_text → take_screenshot → verify result
+```
+
+**When to Use E2E Testing:**
+
+- **Bug Fixes**: Reproduce the bug, apply fix, verify it's resolved
+- **New Features**: Implement feature, test the UI flow end-to-end
+- **UI Changes**: Verify visual changes and interactions work correctly
+- **Form Validation**: Test form submission, validation, error handling
+
+**Configuration in `core/client.py`:**
+
+The client automatically enables Electron MCP tools for QA agents when:
+- Project is detected as Electron (`is_electron` capability)
+- `ELECTRON_MCP_ENABLED=true` is set
+- Agent type is `qa_reviewer` or `qa_fixer`
+
+**Note:** Screenshots are automatically compressed (1280x720, quality 60, JPEG) to stay under Claude SDK's 1MB JSON message buffer limit.
+
+## Running the Application
+
+**As a standalone CLI tool**:
+```bash
+cd apps/backend
+python run.py --spec 001
+```
+
+**With the Electron frontend**:
+```bash
+npm start        # Build and run desktop app
+npm run dev      # Run in development mode (includes --remote-debugging-port=9222 for E2E testing)
+```
+
+**For E2E Testing with QA Agents:**
+1. Start the Electron app: `npm run dev`
+2. Enable Electron MCP in `apps/backend/.env`: `ELECTRON_MCP_ENABLED=true`
+3. Run QA: `python run.py --spec 001 --qa`
+4. QA agents will automatically interact with the running app for testing
+
+**Project data storage:**
+- `.auto-claude/specs/` - Per-project data (specs, plans, QA reports, memory) - gitignored

CONTRIBUTING.md

@@ -5,15 +5,23 @@ Thank you for your interest in contributing to Auto Claude! This document provid
 ## Table of Contents
 
 - [Prerequisites](#prerequisites)
+- [Quick Start](#quick-start)
 - [Development Setup](#development-setup)
   - [Python Backend](#python-backend)
   - [Electron Frontend](#electron-frontend)
+- [Running from Source](#running-from-source)
 - [Pre-commit Hooks](#pre-commit-hooks)
 - [Code Style](#code-style)
 - [Testing](#testing)
 - [Continuous Integration](#continuous-integration)
 - [Git Workflow](#git-workflow)
+  - [Branch Overview](#branch-overview)
+  - [Main Branches](#main-branches)
+  - [Supporting Branches](#supporting-branches)
   - [Branch Naming](#branch-naming)
+  - [Where to Branch From](#where-to-branch-from)
+  - [Pull Request Targets](#pull-request-targets)
+  - [Release Process](#release-process-maintainers)
   - [Commit Messages](#commit-messages)
 - [Pull Request Process](#pull-request-process)
 - [Issue Reporting](#issue-reporting)
@@ -23,38 +31,77 @@ Thank you for your interest in contributing to Auto Claude! This document provid
 
 Before contributing, ensure you have the following installed:
 
-- **Python 3.8+** - For the backend framework
-- **Node.js 18+** - For the Electron frontend
-- **pnpm** - Package manager for the frontend (`npm install -g pnpm`)
+- **Python 3.12+** - For the backend framework
+- **Node.js 24+** - For the Electron frontend
+- **npm 10+** - Package manager for the frontend (comes with Node.js)
 - **uv** (recommended) or **pip** - Python package manager
 - **Git** - Version control
-- **Docker** (optional) - For running FalkorDB if using Graphiti memory
+
+### Installing Python 3.12
+
+**Windows:**
+```bash
+winget install Python.Python.3.12
+```
+
+**macOS:**
+```bash
+brew install python@3.12
+```
+
+**Linux (Ubuntu/Debian):**
+```bash
+sudo apt install python3.12 python3.12-venv
+```
+
+## Quick Start
+
+The fastest way to get started:
+
+```bash
+# Clone the repository
+git clone https://github.com/AndyMik90/Auto-Claude.git
+cd Auto-Claude
+
+# Install all dependencies (cross-platform)
+npm run install:all
+
+# Run in development mode
+npm run dev
+
+# Or build and run production
+npm start
+```
 
 ## Development Setup
 
 The project consists of two main components:
 
-1. **Python Backend** (`auto-claude/`) - The core autonomous coding framework
-2. **Electron Frontend** (`auto-claude-ui/`) - Optional desktop UI
+1. **Python Backend** (`apps/backend/`) - The core autonomous coding framework
+2. **Electron Frontend** (`apps/frontend/`) - Optional desktop UI
 
 ### Python Backend
 
+The recommended way is to use `npm run install:backend`, but you can also set up manually:
+
 ```bash
-# Navigate to the auto-claude directory
-cd auto-claude
+# Navigate to the backend directory
+cd apps/backend
 
-# Create virtual environment (using uv - recommended)
-uv venv
-source .venv/bin/activate  # On Windows: .venv\Scripts\activate
-uv pip install -r requirements.txt
+# Create virtual environment
+# Windows:
+py -3.12 -m venv .venv
+.venv\Scripts\activate
 
-# Or using standard Python
-python3 -m venv .venv
+# macOS/Linux:
+python3.12 -m venv .venv
 source .venv/bin/activate
+
+# Install dependencies
 pip install -r requirements.txt
 
 # Install test dependencies
-pip install -r ../tests/requirements-test.txt
+pip install -r ../../tests/requirements-test.txt
 
 # Set up environment
 cp .env.example .env
@@ -64,22 +111,75 @@ cp .env.example .env
 ### Electron Frontend
 
 ```bash
-# Navigate to the UI directory
-cd auto-claude-ui
+# Navigate to the frontend directory
+cd apps/frontend
 
 # Install dependencies
-pnpm install
+npm install
 
 # Start development server
-pnpm dev
+npm run dev
 
 # Build for production
-pnpm build
+npm run build
 
 # Package for distribution
-pnpm package
+npm run package
 ```
 
+## Running from Source
+
+If you want to run Auto Claude from source (for development or testing unreleased features), follow these steps:
+
+### Step 1: Clone and Set Up
+
+```bash
+git clone https://github.com/AndyMik90/Auto-Claude.git
+cd Auto-Claude/apps/backend
+
+# Using uv (recommended)
+uv venv && uv pip install -r requirements.txt
+
+# Or using standard Python
+python3 -m venv .venv
+source .venv/bin/activate  # On Windows: .venv\Scripts\activate
+pip install -r requirements.txt
+
+# Set up environment
+cd apps/backend
+cp .env.example .env
+# Edit .env and add your CLAUDE_CODE_OAUTH_TOKEN (get it via: claude setup-token)
+```
+
+### Step 2: Run the Desktop UI
+
+```bash
+cd ../frontend
+
+# Install dependencies
+npm install
+
+# Development mode (hot reload)
+npm run dev
+
+# Or production build
+npm run build && npm run start
+```
+
+<details>
+<summary><b>Windows users:</b> If installation fails with node-gyp errors, click here</summary>
+
+Auto Claude automatically downloads prebuilt binaries for Windows. If prebuilts aren't available for your Electron version yet, you'll need Visual Studio Build Tools:
+
+1. Download [Visual Studio Build Tools 2022](https://visualstudio.microsoft.com/visual-cpp-build-tools/)
+2. Select "Desktop development with C++" workload
+3. In "Individual Components", add "MSVC v143 - VS 2022 C++ x64/x86 Spectre-mitigated libs"
+4. Restart terminal and run `npm install` again
+
+</details>
+
+> **Note:** For regular usage, we recommend downloading the pre-built releases from [GitHub Releases](https://github.com/AndyMik90/Auto-Claude/releases). Running from source is primarily for contributors and those testing unreleased features.
+
 ## Pre-commit Hooks
 
 We use [pre-commit](https://pre-commit.com/) to run linting and formatting checks before each commit. This ensures code quality and consistency across the project.
@@ -100,10 +200,10 @@ When you commit, the following checks run automatically:
 
 | Check | Scope | Description |
 |-------|-------|-------------|
-| **ruff** | `auto-claude/` | Python linter with auto-fix |
-| **ruff-format** | `auto-claude/` | Python code formatter |
-| **eslint** | `auto-claude-ui/` | TypeScript/React linter |
-| **typecheck** | `auto-claude-ui/` | TypeScript type checking |
+| **ruff** | `apps/backend/` | Python linter with auto-fix |
+| **ruff-format** | `apps/backend/` | Python code formatter |
+| **eslint** | `apps/frontend/` | TypeScript/React linter |
+| **typecheck** | `apps/frontend/` | TypeScript type checking |
 | **trailing-whitespace** | All files | Removes trailing whitespace |
 | **end-of-file-fixer** | All files | Ensures files end with newline |
 | **check-yaml** | All files | Validates YAML syntax |
@@ -160,7 +260,7 @@ def gnc(sd):
 ### TypeScript/React
 
 - Use TypeScript strict mode
-- Follow the existing component patterns in `auto-claude-ui/src/`
+- Follow the existing component patterns in `apps/frontend/src/`
 - Use functional components with hooks
 - Prefer named exports over default exports
 - Use the UI components from `src/renderer/components/ui/`
@@ -190,20 +290,25 @@ export default function(props) {
 ### Python Tests
 
 ```bash
-# Run all tests
-pytest tests/ -v
+# Run all tests (from repository root)
+npm run test:backend
+
+# Or manually with pytest
+cd apps/backend
+.venv/Scripts/pytest.exe ../tests -v          # Windows
+.venv/bin/pytest ../tests -v                   # macOS/Linux
 
 # Run a specific test file
-pytest tests/test_security.py -v
+npm run test:backend -- tests/test_security.py -v
 
 # Run a specific test
-pytest tests/test_security.py::test_bash_command_validation -v
+npm run test:backend -- tests/test_security.py::test_bash_command_validation -v
 
 # Skip slow tests
-pytest tests/ -m "not slow"
+npm run test:backend -- -m "not slow"
 
 # Run with coverage
-pytest tests/ --cov=auto-claude --cov-report=html
+pytest tests/ --cov=apps/backend --cov-report=html
 ```
 
 Test configuration is in `tests/pytest.ini`.
@@ -211,26 +316,26 @@ Test configuration is in `tests/pytest.ini`.
 ### Frontend Tests
 
 ```bash
-cd auto-claude-ui
+cd apps/frontend
 
 # Run unit tests
-pnpm test
+npm test
 
 # Run tests in watch mode
-pnpm test:watch
+npm run test:watch
 
 # Run with coverage
-pnpm test:coverage
+npm run test:coverage
 
 # Run E2E tests (requires built app)
-pnpm build
-pnpm test:e2e
+npm run build
+npm run test:e2e
 
 # Run linting
-pnpm lint
+npm run lint
 
 # Run type checking
-pnpm typecheck
+npm run typecheck
 ```
 
 ### Testing Requirements
@@ -268,19 +373,50 @@ Before a PR can be merged:
 
 ```bash
 # Python tests
-cd auto-claude
+cd apps/backend
 source .venv/bin/activate
-pytest ../tests/ -v
+pytest ../../tests/ -v
 
 # Frontend tests
-cd auto-claude-ui
-pnpm test
-pnpm lint
-pnpm typecheck
+cd apps/frontend
+npm test
+npm run lint
+npm run typecheck
 ```
 
 ## Git Workflow
 
+We use a **Git Flow** branching strategy to manage releases and parallel development.
+
+### Branch Overview
+
+```
+main (stable)          ← Only released, tested code (tagged versions)
+  │
+develop                ← Integration branch - all PRs merge here first
+  │
+├── feature/xxx        ← New features
+├── fix/xxx            ← Bug fixes
+├── release/vX.Y.Z     ← Release preparation
+└── hotfix/xxx         ← Emergency production fixes
+```
+
+### Main Branches
+
+| Branch | Purpose | Protected |
+|--------|---------|-----------|
+| `main` | Production-ready code. Only receives merges from `release/*` or `hotfix/*` branches. Every merge is tagged (v2.7.0, v2.8.0, etc.) | ✅ Yes |
+| `develop` | Integration branch where all features and fixes are combined. This is the default target for all PRs. | ✅ Yes |
+
+### Supporting Branches
+
+| Branch Type | Branch From | Merge To | Purpose |
+|-------------|-------------|----------|---------|
+| `feature/*` | `develop` | `develop` | New features and enhancements |
+| `fix/*` | `develop` | `develop` | Bug fixes (non-critical) |
+| `release/*` | `develop` | `main` + `develop` | Release preparation and final testing |
+| `hotfix/*` | `main` | `main` + `develop` | Critical production bug fixes |
+
 ### Branch Naming
 
 Use descriptive branch names with a prefix indicating the type of change:
@@ -289,10 +425,146 @@ Use descriptive branch names with a prefix indicating the type of change:
 |--------|---------|---------|
 | `feature/` | New feature | `feature/add-dark-mode` |
 | `fix/` | Bug fix | `fix/memory-leak-in-worker` |
+| `hotfix/` | Urgent production fix | `hotfix/critical-crash-fix` |
 | `docs/` | Documentation | `docs/update-readme` |
 | `refactor/` | Code refactoring | `refactor/simplify-auth-flow` |
 | `test/` | Test additions/fixes | `test/add-integration-tests` |
 | `chore/` | Maintenance tasks | `chore/update-dependencies` |
+| `release/` | Release preparation | `release/v2.8.0` |
+| `hotfix/` | Emergency fixes | `hotfix/critical-auth-bug` |
+
+### Where to Branch From
+
+```bash
+# For features and bug fixes - ALWAYS branch from develop
+git checkout develop
+git pull origin develop
+git checkout -b feature/my-new-feature
+
+# For hotfixes only - branch from main
+git checkout main
+git pull origin main
+git checkout -b hotfix/critical-fix
+```
+
+### Pull Request Targets
+
+> ⚠️ **Important:** All PRs should target `develop`, NOT `main`!
+
+| Your Branch Type | Target Branch |
+|------------------|---------------|
+| `feature/*` | `develop` |
+| `fix/*` | `develop` |
+| `docs/*` | `develop` |
+| `refactor/*` | `develop` |
+| `test/*` | `develop` |
+| `chore/*` | `develop` |
+| `hotfix/*` | `main` (maintainers only) |
+| `release/*` | `main` (maintainers only) |
+
+### Release Process (Maintainers)
+
+When ready to release a new version:
+
+```bash
+# 1. Create release branch from develop
+git checkout develop
+git pull origin develop
+git checkout -b release/v2.8.0
+
+# 2. Update version numbers, CHANGELOG, final fixes only
+# No new features allowed in release branches!
+
+# 3. Merge to main and tag
+git checkout main
+git merge release/v2.8.0
+git tag v2.8.0
+git push origin main --tags
+
+# 4. Merge back to develop (important!)
+git checkout develop
+git merge release/v2.8.0
+git push origin develop
+
+# 5. Delete release branch
+git branch -d release/v2.8.0
+git push origin --delete release/v2.8.0
+```
+
+### Beta Release Process (Maintainers)
+
+Beta releases allow users to test new features before they're included in a stable release. Beta releases are published from the `develop` branch.
+
+**Creating a Beta Release:**
+
+1. Go to **Actions** → **Beta Release** workflow in GitHub
+2. Click **Run workflow**
+3. Enter the beta version (e.g., `2.8.0-beta.1`)
+4. Optionally enable dry run to test without publishing
+5. Click **Run workflow**
+
+The workflow will:
+- Validate the version format
+- Update `package.json` on develop
+- Create and push a tag (e.g., `v2.8.0-beta.1`)
+- Build installers for all platforms
+- Create a GitHub pre-release
+
+**Version Format:**
+```
+X.Y.Z-beta.N   (e.g., 2.8.0-beta.1, 2.8.0-beta.2)
+X.Y.Z-alpha.N  (e.g., 2.8.0-alpha.1)
+X.Y.Z-rc.N     (e.g., 2.8.0-rc.1)
+```
+
+**For Users:**
+Users can opt into beta updates in Settings → Updates → "Beta Updates" toggle. When enabled, the app will check for and install beta versions. Users can switch back to stable at any time.
+
+### Hotfix Workflow
+
+For urgent production fixes that can't wait for the normal release cycle:
+
+**1. Create hotfix from main**
+
+```bash
+git checkout main
+git pull origin main
+git checkout -b hotfix/150-critical-fix
+```
+
+**2. Fix the issue**
+
+```bash
+# ... make changes ...
+git commit -m "hotfix: fix critical crash on startup"
+```
+
+**3. Open PR to main (fast-track review)**
+
+```bash
+gh pr create --base main --title "hotfix: fix critical crash on startup"
+```
+
+**4. After merge to main, sync to develop**
+
+```bash
+git checkout develop
+git pull origin develop
+git merge main
+git push origin develop
+```
+
+```
+main ─────●─────●─────●─────●───── (production)
+          ↑     ↑     ↑     ↑
+develop ──●─────●─────●─────●───── (integration)
+          ↑     ↑     ↑
+feature/123 ────●
+feature/124 ──────────●
+hotfix/125 ─────────────────●───── (from main, merge to both)
+```
+
+> **Note:** Hotfixes branch FROM `main` and merge TO `main` first, then sync back to `develop` to keep branches aligned.
 
 ### Commit Messages
 
@@ -326,17 +598,23 @@ git commit -m "WIP"
 
 ## Pull Request Process
 
-1. **Fork the repository** and create your branch from `main`
+1. **Fork the repository** and create your branch from `develop` (not main!)
+
+   ```bash
+   git checkout develop
+   git pull origin develop
+   git checkout -b feature/your-feature-name
+   ```
 
 2. **Make your changes** following the code style guidelines
 
 3. **Test thoroughly**:
    ```bash
-   # Python
-   pytest tests/ -v
+   # Python (from repository root)
+   npm run test:backend
 
    # Frontend
-   cd auto-claude-ui && pnpm test && pnpm lint && pnpm typecheck
+   cd apps/frontend && npm test && npm run lint && npm run typecheck
    ```
 
 4. **Update documentation** if your changes affect:
@@ -395,7 +673,7 @@ When requesting a feature:
 
 Auto Claude consists of two main parts:
 
-### Python Backend (`auto-claude/`)
+### Python Backend (`apps/backend/`)
 
 The core autonomous coding framework:
 
@@ -405,9 +683,9 @@ The core autonomous coding framework:
 - **Memory**: `memory.py` (file-based), `graphiti_memory.py` (graph-based)
 - **QA**: `qa_loop.py`, `prompts/qa_*.md`
 
-### Electron Frontend (`auto-claude-ui/`)
+### Electron Frontend (`apps/frontend/`)
 
-Optional desktop interface:
+Desktop interface:
 
 - **Main Process**: `src/main/` - Electron main process, IPC handlers
 - **Renderer**: `src/renderer/` - React UI components

README.md

@@ -1,300 +1,222 @@
 # Auto Claude
 
-Your AI coding companion. Build features, fix bugs, and ship faster — with autonomous agents that plan, code, and validate for you.
+**Autonomous multi-agent coding framework that plans, builds, and validates software for you.**
 
 ![Auto Claude Kanban Board](.github/assets/Auto-Claude-Kanban.png)
 
-[![Discord](https://img.shields.io/badge/Discord-Join%20Community-5865F2?style=for-the-badge&logo=discord&logoColor=white)](https://discord.gg/maj9EWmY)
-
-## What It Does ✨
-
-**Auto Claude is a desktop app that supercharges your AI coding workflow.** Whether you're a vibe coder just getting started or an experienced developer, Auto Claude meets you where you are.
-
-- **Autonomous Tasks** — Describe what you want to build, and agents handle planning, coding, and validation while you focus on other work
-- **Agent Terminals** — Run Claude Code in up to 12 terminals with a clean layout, smart naming based on context, and one-click task context injection
-- **Safe by Default** — All work happens in git worktrees, keeping your main branch undisturbed until you're ready to merge
-- **Self-Validating** — Built-in QA agents check their own work before you review
-
-**The result?** 10x your output while maintaining code quality.
-
-## Key Features
-
-- **Parallel Agents**: Run multiple builds simultaneously while you focus on other work
-- **Context Engineering**: Agents understand your codebase structure before writing code
-- **Self-Validating**: Built-in QA loop catches issues before you review
-- **Isolated Workspaces**: All work happens in git worktrees — your code stays safe
-- **AI Merge Resolution**: Intelligent conflict resolution when merging back to main — no manual conflict fixing
-- **Memory Layer**: Agents remember insights across sessions for smarter decisions
-- **Cross-Platform**: Desktop app runs on Mac, Windows, and Linux
-- **Any Project Type**: Build web apps, APIs, CLIs — works with any software project
-
-## 🚀 Quick Start (Desktop UI)
-
-The Desktop UI is the recommended way to use Auto Claude. It provides visual task management, real-time progress tracking, and a Kanban board interface.
-
-### Prerequisites
-
-1. **Node.js 18+** - [Download Node.js](https://nodejs.org/)
-2. **Python 3.9+** - [Download Python](https://www.python.org/downloads/)
-3. **Docker Desktop** - Required for the Memory Layer
-4. **Claude Code CLI** - `npm install -g @anthropic-ai/claude-code`
-5. **Claude Subscription** - Requires [Claude Pro or Max](https://claude.ai/upgrade) for Claude Code access
+[![Version](https://img.shields.io/badge/version-2.7.2-blue?style=flat-square)](https://github.com/AndyMik90/Auto-Claude/releases/latest)
+[![License](https://img.shields.io/badge/license-AGPL--3.0-green?style=flat-square)](./agpl-3.0.txt)
+[![Discord](https://img.shields.io/badge/Discord-Join%20Community-5865F2?style=flat-square&logo=discord&logoColor=white)](https://discord.gg/KCXaPBr4Dj)
+[![CI](https://img.shields.io/github/actions/workflow/status/AndyMik90/Auto-Claude/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/AndyMik90/Auto-Claude/actions)
 
 ---
 
-### Installing Docker Desktop
+## Download
 
-Docker runs the FalkorDB database that powers Auto Claude's cross-session memory.
+Get the latest pre-built release for your platform:
 
-| Operating System | Download Link |
-|------------------|---------------|
-| **Mac (Apple Silicon M1/M2/M3/M4)** | [Download for Apple Chip](https://desktop.docker.com/mac/main/arm64/Docker.dmg) |
-| **Mac (Intel)** | [Download for Intel Chip](https://desktop.docker.com/mac/main/amd64/Docker.dmg) |
-| **Windows** | [Download for Windows](https://desktop.docker.com/win/main/amd64/Docker%20Desktop%20Installer.exe) |
-| **Linux** | [Installation Guide](https://docs.docker.com/desktop/install/linux-install/) |
+| Platform | Download | Notes |
+|----------|----------|-------|
+| **Windows** | [Auto-Claude-2.7.2.exe](https://github.com/AndyMik90/Auto-Claude/releases/latest) | Installer (NSIS) |
+| **macOS (Apple Silicon)** | [Auto-Claude-2.7.2-arm64.dmg](https://github.com/AndyMik90/Auto-Claude/releases/latest) | M1/M2/M3 Macs |
+| **macOS (Intel)** | [Auto-Claude-2.7.2-x64.dmg](https://github.com/AndyMik90/Auto-Claude/releases/latest) | Intel Macs |
+| **Linux** | [Auto-Claude-2.7.2.AppImage](https://github.com/AndyMik90/Auto-Claude/releases/latest) | Universal |
+| **Linux (Debian)** | [Auto-Claude-2.7.2.deb](https://github.com/AndyMik90/Auto-Claude/releases/latest) | Ubuntu/Debian |
 
-> **Not sure which Mac?** Click the Apple menu (🍎) → "About This Mac". Look for "Chip" - M1/M2/M3/M4 = Apple Silicon, otherwise Intel.
-
-**After installing:** Open Docker Desktop and wait for the whale icon (🐳) to appear in your menu bar/system tray.
-
-> **Using the Desktop UI?** It automatically detects Docker status and offers one-click FalkorDB setup. No terminal commands needed!
-
-📚 **For detailed installation steps, troubleshooting, and advanced configuration, see [guides/DOCKER-SETUP.md](guides/DOCKER-SETUP.md)**
+> All releases include SHA256 checksums and VirusTotal scan results for security verification.
 
 ---
 
-### Step 1: Set Up the Python Backend
+## Requirements
 
-The Desktop UI runs Python scripts behind the scenes. Set up the Python environment:
-
-```bash
-cd auto-claude
-
-# Using uv (recommended)
-uv venv && uv pip install -r requirements.txt
-
-# Or using standard Python
-python3 -m venv .venv && source .venv/bin/activate && pip install -r requirements.txt
-```
-
-### Step 2: Start the Memory Layer
-
-The Auto Claude Memory Layer provides cross-session context retention using a graph database:
-
-```bash
-# Make sure Docker Desktop is running, then:
-docker-compose up -d falkordb
-```
-
-### Step 3: Install and Launch the Desktop UI
-
-```bash
-cd auto-claude-ui
-
-# Install dependencies (pnpm recommended, npm works too)
-pnpm install
-# or: npm install
-
-# Build and start the application
-pnpm run build && pnpm run start
-# or: npm run build && npm run start
-```
-
-### Step 4: Start Building
-
-1. Add your project in the UI
-2. Create a new task describing what you want to build
-3. Watch as Auto Claude creates a spec, plans, and implements your feature
-4. Review changes and merge when satisfied
+- **Claude Pro/Max subscription** - [Get one here](https://claude.ai/upgrade)
+- **Claude Code CLI** - `npm install -g @anthropic-ai/claude-code`
+- **Git repository** - Your project must be initialized as a git repo
+- **Python 3.12+** - Required for the backend and Memory Layer
 
 ---
 
-## 🎯 Features
+## Quick Start
+
+1. **Download and install** the app for your platform
+2. **Open your project** - Select a git repository folder
+3. **Connect Claude** - The app will guide you through OAuth setup
+4. **Create a task** - Describe what you want to build
+5. **Watch it work** - Agents plan, code, and validate autonomously
+
+---
+
+## Features
+
+| Feature | Description |
+|---------|-------------|
+| **Autonomous Tasks** | Describe your goal; agents handle planning, implementation, and validation |
+| **Parallel Execution** | Run multiple builds simultaneously with up to 12 agent terminals |
+| **Isolated Workspaces** | All changes happen in git worktrees - your main branch stays safe |
+| **Self-Validating QA** | Built-in quality assurance loop catches issues before you review |
+| **AI-Powered Merge** | Automatic conflict resolution when integrating back to main |
+| **Memory Layer** | Agents retain insights across sessions for smarter builds |
+| **Cross-Platform** | Native desktop apps for Windows, macOS, and Linux |
+| **Auto-Updates** | App updates automatically when new versions are released |
+
+---
+
+## Interface
 
 ### Kanban Board
-
-Plan tasks and let AI handle the planning, coding, and validation — all in a visual interface. Track progress from "Planning" to "Done" while agents work autonomously.
+Visual task management from planning through completion. Create tasks and monitor agent progress in real-time.
 
 ### Agent Terminals
+AI-powered terminals with one-click task context injection. Spawn multiple agents for parallel work.
 
-Spawn up to 12 AI-powered terminals for hands-on coding. Inject task context with a click, reference files from your project, and work rapidly across multiple sessions.
-
-**Power users:** Connect multiple Claude Code subscriptions to run even more agents in parallel — perfect for teams or heavy workloads.
-
-![Auto Claude Agent Terminals](.github/assets/Auto-Claude-Agents-terminals.png)
-
-### Insights
-
-Have a conversation about your project in a ChatGPT-style interface. Ask questions, get explanations, and explore your codebase through natural dialogue.
+![Agent Terminals](.github/assets/Auto-Claude-Agents-terminals.png)
 
 ### Roadmap
+AI-assisted feature planning with competitor analysis and audience targeting.
 
-Based on your target audience, AI anticipates and plans the most impactful features you should focus on. Prioritize what matters most to your users.
+![Roadmap](.github/assets/Auto-Claude-roadmap.png)
 
-![Auto Claude Roadmap](.github/assets/Auto-Claude-roadmap.png)
-
-### Ideation
-
-Let AI help you create a project that shines. Rapidly understand your codebase and discover:
-- Code improvements and refactoring opportunities
-- Performance bottlenecks
-- Security vulnerabilities
-- Documentation gaps
-- UI/UX enhancements
-- Overall code quality issues
-
-### Changelog
-
-Write professional changelogs effortlessly. Generate release notes from completed Auto Claude tasks or integrate with GitHub to create masterclass changelogs automatically.
-
-### Context
-
-See exactly what Auto Claude understands about your project — the tech stack, file structure, patterns, and insights it uses to write better code.
-
-### AI Merge Resolution
-
-When your main branch evolves while a build is in progress, Auto Claude automatically resolves merge conflicts using AI — no manual `<<<<<<< HEAD` fixing required.
-
-**How it works:**
-1. **Git Auto-Merge First** — Simple non-conflicting changes merge instantly without AI
-2. **Conflict-Only AI** — For actual conflicts, AI receives only the specific conflict regions (not entire files), achieving ~98% prompt reduction
-3. **Parallel Processing** — Multiple conflicting files resolve simultaneously for faster merges
-4. **Syntax Validation** — Every merge is validated before being applied
-
-**The result:** A build that was 50+ commits behind main merges in seconds instead of requiring manual conflict resolution.
+### Additional Features
+- **Insights** - Chat interface for exploring your codebase
+- **Ideation** - Discover improvements, performance issues, and vulnerabilities
+- **Changelog** - Generate release notes from completed tasks
 
 ---
 
-## CLI Usage (Terminal-Only)
-
-For terminal-based workflows, headless servers, or CI/CD integration, see **[guides/CLI-USAGE.md](guides/CLI-USAGE.md)**.
-
-## ⚙️ How It Works
-
-Auto Claude focuses on three core principles: **context engineering** (understanding your codebase before writing code), **good coding standards** (following best practices and patterns), and **validation logic** (ensuring code works before you see it).
-
-### The Agent Pipeline
-
-**Phase 1: Spec Creation** (3-8 phases based on complexity)
-
-Before any code is written, agents gather context and create a detailed specification:
-
-1. **Discovery** — Analyzes your project structure and tech stack
-2. **Requirements** — Gathers what you want to build through interactive conversation
-3. **Research** — Validates external integrations against real documentation
-4. **Context Discovery** — Finds relevant files in your codebase
-5. **Spec Writer** — Creates a comprehensive specification document
-6. **Spec Critic** — Self-critiques using extended thinking to find issues early
-7. **Planner** — Breaks work into subtasks with dependencies
-8. **Validation** — Ensures all outputs are valid before proceeding
-
-**Phase 2: Implementation**
-
-With a validated spec, coding agents execute the plan:
-
-1. **Planner Agent** — Creates subtask-based implementation plan
-2. **Coder Agent** — Implements subtasks one-by-one with verification
-3. **QA Reviewer** — Validates all acceptance criteria
-4. **QA Fixer** — Fixes issues in a self-healing loop (up to 50 iterations)
-
-Each session runs with a fresh context window. Progress is tracked via `implementation_plan.json` and Git commits.
-
-**Phase 3: Merge**
-
-When you're ready to merge, AI handles any conflicts that arose while you were working:
-
-1. **Conflict Detection** — Identifies files modified in both main and the build
-2. **3-Tier Resolution** — Git auto-merge → Conflict-only AI → Full-file AI (fallback)
-3. **Parallel Merge** — Multiple files resolve simultaneously
-4. **Staged for Review** — Changes are staged but not committed, so you can review before finalizing
-
-### 🔒 Security Model
-
-Three-layer defense keeps your code safe:
-- **OS Sandbox** — Bash commands run in isolation
-- **Filesystem Restrictions** — Operations limited to project directory
-- **Command Allowlist** — Only approved commands based on your project's stack
-
-### 🧠 Memory Layer
-
-The Memory Layer is a **hybrid RAG system** combining graph nodes with semantic search to deliver the best possible context during AI coding. Agents remember insights from previous sessions, discovered codebase patterns persist and are reusable, and historical context helps agents make smarter decisions.
-
-**Architecture:**
-- **Backend**: FalkorDB (graph database) via Docker
-- **Library**: Graphiti for knowledge graph operations
-- **Providers**: OpenAI, Anthropic, Azure OpenAI, or Ollama (local/offline)
-
-| Setup | LLM | Embeddings | Notes |
-|-------|-----|------------|-------|
-| **OpenAI** | OpenAI | OpenAI | Simplest - single API key |
-| **Anthropic + Voyage** | Anthropic | Voyage AI | High quality |
-| **Ollama** | Ollama | Ollama | Fully offline |
-| **Azure** | Azure OpenAI | Azure OpenAI | Enterprise |
-
 ## Project Structure
 
 ```
-your-project/
-├── .worktrees/               # Created during build (git-ignored)
-│   └── auto-claude/          # Isolated workspace for AI coding
-├── .auto-claude/             # Per-project data (specs, plans, QA reports)
-│   ├── specs/                # Task specifications
-│   ├── roadmap/              # Project roadmap
-│   └── ideation/             # Ideas and planning
-├── auto-claude/              # Python backend (framework code)
-│   ├── run.py                # Build entry point
-│   ├── spec_runner.py        # Spec creation orchestrator
-│   ├── prompts/              # Agent prompt templates
-│   └── ...
-├── auto-claude-ui/           # Electron desktop application
-│   └── ...
-└── docker-compose.yml        # FalkorDB for Memory Layer
+Auto-Claude/
+├── apps/
+│   ├── backend/     # Python agents, specs, QA pipeline
+│   └── frontend/    # Electron desktop application
+├── guides/          # Additional documentation
+├── tests/           # Test suite
+└── scripts/         # Build utilities
 ```
 
-## Environment Variables (CLI Only)
+---
 
-> **Desktop UI users:** These are configured through the app settings — no manual setup needed.
+## CLI Usage
+
+For headless operation, CI/CD integration, or terminal-only workflows:
+
+```bash
+cd apps/backend
+
+# Create a spec interactively
+python spec_runner.py --interactive
+
+# Run autonomous build
+python run.py --spec 001
+
+# Review and merge
+python run.py --spec 001 --review
+python run.py --spec 001 --merge
+```
+
+See [guides/CLI-USAGE.md](guides/CLI-USAGE.md) for complete CLI documentation.
+
+---
+
+## Configuration
+
+Create `apps/backend/.env` from the example:
+
+```bash
+cp apps/backend/.env.example apps/backend/.env
+```
 
 | Variable | Required | Description |
 |----------|----------|-------------|
 | `CLAUDE_CODE_OAUTH_TOKEN` | Yes | OAuth token from `claude setup-token` |
-| `AUTO_BUILD_MODEL` | No | Model override (default: claude-opus-4-5-20251101) |
-| `GRAPHITI_ENABLED` | Recommended | Set to `true` to enable Memory Layer |
-| `GRAPHITI_LLM_PROVIDER` | For Memory | LLM provider: openai, anthropic, azure_openai, ollama |
-| `GRAPHITI_EMBEDDER_PROVIDER` | For Memory | Embedder: openai, voyage, azure_openai, ollama |
-| `OPENAI_API_KEY` | For OpenAI | Required for OpenAI provider |
-| `ANTHROPIC_API_KEY` | For Anthropic | Required for Anthropic LLM |
-| `VOYAGE_API_KEY` | For Voyage | Required for Voyage embeddings |
+| `GRAPHITI_ENABLED` | No | Enable Memory Layer for cross-session context |
+| `AUTO_BUILD_MODEL` | No | Override the default Claude model |
 
-See `auto-claude/.env.example` for complete configuration options.
+---
 
-## 💬 Community
+## Building from Source
 
-Join our Discord to get help, share what you're building, and connect with other Auto Claude users:
+For contributors and development:
 
-[![Discord](https://img.shields.io/badge/Discord-Join%20Community-5865F2?style=for-the-badge&logo=discord&logoColor=white)](https://discord.gg/maj9EWmY)
+```bash
+# Clone the repository
+git clone https://github.com/AndyMik90/Auto-Claude.git
+cd Auto-Claude
 
-## 🤝 Contributing
+# Install all dependencies
+npm run install:all
 
-We welcome contributions! Whether it's bug fixes, new features, or documentation improvements.
+# Run in development mode
+npm run dev
 
-See **[CONTRIBUTING.md](CONTRIBUTING.md)** for guidelines on how to get started.
+# Or build and run
+npm start
+```
 
-## Acknowledgments
+**System requirements for building:**
+- Node.js 24+
+- Python 3.12+
+- npm 10+
 
-This framework was inspired by Anthropic's [Autonomous Coding Agent](https://github.com/anthropics/claude-quickstarts/tree/main/autonomous-coding). Thank you to the Anthropic team for their innovative work on autonomous coding systems.
+See [CONTRIBUTING.md](CONTRIBUTING.md) for detailed development setup.
+
+---
+
+## Security
+
+Auto Claude uses a three-layer security model:
+
+1. **OS Sandbox** - Bash commands run in isolation
+2. **Filesystem Restrictions** - Operations limited to project directory
+3. **Dynamic Command Allowlist** - Only approved commands based on detected project stack
+
+All releases are:
+- Scanned with VirusTotal before publishing
+- Include SHA256 checksums for verification
+- Code-signed where applicable (macOS)
+
+---
+
+## Available Scripts
+
+| Command | Description |
+|---------|-------------|
+| `npm run install:all` | Install backend and frontend dependencies |
+| `npm start` | Build and run the desktop app |
+| `npm run dev` | Run in development mode with hot reload |
+| `npm run package` | Package for current platform |
+| `npm run package:mac` | Package for macOS |
+| `npm run package:win` | Package for Windows |
+| `npm run package:linux` | Package for Linux |
+| `npm run lint` | Run linter |
+| `npm test` | Run frontend tests |
+| `npm run test:backend` | Run backend tests |
+
+---
+
+## Contributing
+
+We welcome contributions! Please read [CONTRIBUTING.md](CONTRIBUTING.md) for:
+- Development setup instructions
+- Code style guidelines
+- Testing requirements
+- Pull request process
+
+---
+
+## Community
+
+- **Discord** - [Join our community](https://discord.gg/KCXaPBr4Dj)
+- **Issues** - [Report bugs or request features](https://github.com/AndyMik90/Auto-Claude/issues)
+- **Discussions** - [Ask questions](https://github.com/AndyMik90/Auto-Claude/discussions)
+
+---
 
 ## License
 
 **AGPL-3.0** - GNU Affero General Public License v3.0
 
-This software is licensed under AGPL-3.0, which means:
+Auto Claude is free to use. If you modify and distribute it, or run it as a service, your code must also be open source under AGPL-3.0.
 
-- **Attribution Required**: You must give appropriate credit, provide a link to the license, and indicate if changes were made. When using Auto Claude, please credit the project.
-- **Open Source Required**: If you modify this software and distribute it or run it as a service, you must release your source code under AGPL-3.0.
-- **Network Use (Copyleft)**: If you run this software as a network service (e.g., SaaS), users interacting with it over a network must be able to receive the source code.
-- **No Closed-Source Usage**: You cannot use this software in proprietary/closed-source projects without open-sourcing your entire project under AGPL-3.0.
-
-**In simple terms**: You can use Auto Claude freely, but if you build on it, your code must also be open source under AGPL-3.0 and attribute this project. Closed-source commercial use requires a separate license.
-
-For commercial licensing inquiries (closed-source usage), please contact the maintainers.
+Commercial licensing available for closed-source use cases.

RELEASE.md

@@ -0,0 +1,188 @@
+# Release Process
+
+This document describes how releases are created for Auto Claude.
+
+## Overview
+
+Auto Claude uses an automated release pipeline that ensures releases are only published after all builds succeed. This prevents version mismatches between documentation and actual releases.
+
+```
+┌─────────────────────────────────────────────────────────────────────────────┐
+│                           RELEASE FLOW                                       │
+├─────────────────────────────────────────────────────────────────────────────┤
+│                                                                              │
+│   develop branch                    main branch                              │
+│   ──────────────                    ───────────                              │
+│        │                                 │                                   │
+│        │  1. bump-version.js             │                                   │
+│        │     (creates commit)            │                                   │
+│        │                                 │                                   │
+│        ▼                                 │                                   │
+│   ┌─────────┐                           │                                   │
+│   │ v2.8.0  │  2. Create PR             │                                   │
+│   │ commit  │ ────────────────────►     │                                   │
+│   └─────────┘                           │                                   │
+│                                          │                                   │
+│                           3. Merge PR    ▼                                   │
+│                                    ┌──────────┐                              │
+│                                    │ v2.8.0   │                              │
+│                                    │ on main  │                              │
+│                                    └────┬─────┘                              │
+│                                         │                                    │
+│                     ┌───────────────────┴───────────────────┐               │
+│                     │     GitHub Actions (automatic)         │               │
+│                     ├───────────────────────────────────────┤               │
+│                     │ 4. prepare-release.yml                 │               │
+│                     │    - Detects version > latest tag      │               │
+│                     │    - Creates tag v2.8.0                │               │
+│                     │                                        │               │
+│                     │ 5. release.yml (triggered by tag)      │               │
+│                     │    - Builds macOS (Intel + ARM)        │               │
+│                     │    - Builds Windows                    │               │
+│                     │    - Builds Linux                      │               │
+│                     │    - Generates changelog               │               │
+│                     │    - Creates GitHub release            │               │
+│                     │    - Updates README                    │               │
+│                     └───────────────────────────────────────┘               │
+│                                                                              │
+└─────────────────────────────────────────────────────────────────────────────┘
+```
+
+## For Maintainers: Creating a Release
+
+### Step 1: Bump the Version
+
+On your development branch (typically `develop` or a feature branch):
+
+```bash
+# Navigate to project root
+cd /path/to/auto-claude
+
+# Bump version (choose one)
+node scripts/bump-version.js patch   # 2.7.1 -> 2.7.2 (bug fixes)
+node scripts/bump-version.js minor   # 2.7.1 -> 2.8.0 (new features)
+node scripts/bump-version.js major   # 2.7.1 -> 3.0.0 (breaking changes)
+node scripts/bump-version.js 2.8.0   # Set specific version
+```
+
+This will:
+- Update `apps/frontend/package.json`
+- Update `package.json` (root)
+- Update `apps/backend/__init__.py`
+- Create a commit with message `chore: bump version to X.Y.Z`
+
+### Step 2: Push and Create PR
+
+```bash
+# Push your branch
+git push origin your-branch
+
+# Create PR to main (via GitHub UI or gh CLI)
+gh pr create --base main --title "Release v2.8.0"
+```
+
+### Step 3: Merge to Main
+
+Once the PR is approved and merged to `main`, GitHub Actions will automatically:
+
+1. **Detect the version bump** (`prepare-release.yml`)
+2. **Create a git tag** (e.g., `v2.8.0`)
+3. **Trigger the release workflow** (`release.yml`)
+4. **Build binaries** for all platforms:
+   - macOS Intel (x64) - code signed & notarized
+   - macOS Apple Silicon (arm64) - code signed & notarized
+   - Windows (NSIS installer) - code signed
+   - Linux (AppImage + .deb)
+5. **Generate changelog** from merged PRs (using release-drafter)
+6. **Scan binaries** with VirusTotal
+7. **Create GitHub release** with all artifacts
+8. **Update README** with new version badge and download links
+
+### Step 4: Verify
+
+After merging, check:
+- [GitHub Actions](https://github.com/AndyMik90/Auto-Claude/actions) - ensure all workflows pass
+- [Releases](https://github.com/AndyMik90/Auto-Claude/releases) - verify release was created
+- [README](https://github.com/AndyMik90/Auto-Claude#download) - confirm version updated
+
+## Version Numbering
+
+We follow [Semantic Versioning](https://semver.org/):
+
+- **MAJOR** (X.0.0): Breaking changes, incompatible API changes
+- **MINOR** (0.X.0): New features, backwards compatible
+- **PATCH** (0.0.X): Bug fixes, backwards compatible
+
+## Changelog Generation
+
+Changelogs are automatically generated from merged PRs using [Release Drafter](https://github.com/release-drafter/release-drafter).
+
+### PR Labels for Changelog Categories
+
+| Label | Category |
+|-------|----------|
+| `feature`, `enhancement` | New Features |
+| `bug`, `fix` | Bug Fixes |
+| `improvement`, `refactor` | Improvements |
+| `documentation` | Documentation |
+| (any other) | Other Changes |
+
+**Tip:** Add appropriate labels to your PRs for better changelog organization.
+
+## Workflows
+
+| Workflow | Trigger | Purpose |
+|----------|---------|---------|
+| `prepare-release.yml` | Push to `main` | Detects version bump, creates tag |
+| `release.yml` | Tag `v*` pushed | Builds binaries, creates release |
+| `validate-version.yml` | Tag `v*` pushed | Validates tag matches package.json |
+| `update-readme` (in release.yml) | After release | Updates README with new version |
+
+## Troubleshooting
+
+### Release didn't trigger after merge
+
+1. Check if version in `package.json` is greater than latest tag:
+   ```bash
+   git tag -l 'v*' --sort=-version:refname | head -1
+   cat apps/frontend/package.json | grep version
+   ```
+
+2. Ensure the merge commit touched `package.json`:
+   ```bash
+   git diff HEAD~1 --name-only | grep package.json
+   ```
+
+### Build failed after tag was created
+
+- The release won't be published if builds fail
+- Fix the issue and create a new patch version
+- Don't reuse failed version numbers
+
+### README shows wrong version
+
+- README is only updated after successful release
+- If release failed, README keeps the previous version (this is intentional)
+- Once you successfully release, README will update automatically
+
+## Manual Release (Emergency Only)
+
+In rare cases where you need to bypass the automated flow:
+
+```bash
+# Create tag manually (NOT RECOMMENDED)
+git tag -a v2.8.0 -m "Release v2.8.0"
+git push origin v2.8.0
+
+# This will trigger release.yml directly
+```
+
+**Warning:** Only do this if you're certain the version in package.json matches the tag.
+
+## Security
+
+- All macOS binaries are code signed with Apple Developer certificate
+- All macOS binaries are notarized by Apple
+- Windows binaries are code signed
+- All binaries are scanned with VirusTotal
+- SHA256 checksums are generated for all artifacts

agpl-3.0.txt

@@ -658,4 +658,4 @@ specific requirements.
   You should also get your employer (if you work as a programmer) or school,
 if any, to sign a "copyright disclaimer" for the program, if necessary.
 For more information on this, and how to apply and follow the GNU AGPL, see
-<https://www.gnu.org/licenses/>.
+<https://www.gnu.org/licenses/>.

apps/backend/.env.example

@@ -1,14 +1,40 @@
 # Auto Claude Environment Variables
 # Copy this file to .env and fill in your values
 
-# Claude Code OAuth Token (REQUIRED)
-# Get this by running: claude setup-token
-CLAUDE_CODE_OAUTH_TOKEN=your-oauth-token-here
+# =============================================================================
+# AUTHENTICATION (REQUIRED)
+# =============================================================================
+# Auto Claude uses Claude Code OAuth authentication.
+# Direct API keys (ANTHROPIC_API_KEY) are NOT supported to prevent silent billing.
+#
+# Option 1: Run `claude setup-token` to save token to macOS Keychain (recommended)
+# Option 2: Set the token explicitly:
+# CLAUDE_CODE_OAUTH_TOKEN=your-oauth-token-here
+#
+# For enterprise/proxy setups (CCR):
+# ANTHROPIC_AUTH_TOKEN=sk-zcf-x-ccr
+
+# =============================================================================
+# CUSTOM API ENDPOINT (OPTIONAL)
+# =============================================================================
+# Override the default Anthropic API endpoint. Useful for:
+#   - Local proxies (ccr, litellm)
+#   - API gateways
+#   - Self-hosted Claude instances
+#
+# ANTHROPIC_BASE_URL=http://127.0.0.1:3456
+#
+# Related settings (usually set together with ANTHROPIC_BASE_URL):
+# NO_PROXY=127.0.0.1
+# DISABLE_TELEMETRY=true
+# DISABLE_COST_WARNINGS=true
+# API_TIMEOUT_MS=600000
 
 # Model override (OPTIONAL)
 # Default: claude-opus-4-5-20251101
 # AUTO_BUILD_MODEL=claude-opus-4-5-20251101
 
+
 # =============================================================================
 # GIT/WORKTREE SETTINGS (OPTIONAL)
 # =============================================================================
@@ -72,10 +98,11 @@ CLAUDE_CODE_OAUTH_TOKEN=your-oauth-token-here
 #   1. Start your Electron app with remote debugging:
 #      ./YourElectronApp --remote-debugging-port=9222
 #
-#   2. For auto-claude-ui specifically:
+#   2. For auto-claude-ui specifically (use the MCP-enabled scripts):
 #      cd auto-claude-ui
-#      pnpm build
-#      ./dist/mac-arm64/Auto\ Claude.app/Contents/MacOS/Auto\ Claude --remote-debugging-port=9222
+#      pnpm run dev:mcp     # Development mode with MCP debugging
+#      # OR for production build:
+#      pnpm run start:mcp   # Production mode with MCP debugging
 #
 # Note: Only QA agents (qa_reviewer, qa_fixer) receive Electron MCP tools.
 # Coder and Planner agents do NOT have access to these tools to minimize
@@ -90,24 +117,35 @@ CLAUDE_CODE_OAUTH_TOKEN=your-oauth-token-here
 # ELECTRON_DEBUG_PORT=9222
 
 # =============================================================================
-# GRAPHITI MEMORY INTEGRATION V2 (OPTIONAL)
+# GRAPHITI MEMORY INTEGRATION (REQUIRED)
 # =============================================================================
-# Enable Graphiti-based persistent memory layer for cross-session context
-# retention. Uses FalkorDB as the graph database backend.
+# Graphiti-based persistent memory layer for cross-session context
+# retention. Uses LadybugDB as the embedded graph database.
 #
-# V2 supports multiple LLM and embedder providers:
+# REQUIREMENTS:
+#   - Python 3.12 or higher
+#   - Install: pip install real_ladybug graphiti-core
+#
+# Supports multiple LLM and embedder providers:
 #   - OpenAI (default)
 #   - Anthropic (LLM only, use with Voyage for embeddings)
 #   - Azure OpenAI
 #   - Ollama (local, fully offline)
-#
-# Prerequisites:
-#   1. Start FalkorDB: docker-compose up -d falkordb
-#   2. Install Graphiti: pip install graphiti-core[falkordb]
-#   3. Configure your chosen provider (see below)
+#   - Google AI (Gemini)
 
-# Enable Graphiti integration (default: false)
-# GRAPHITI_ENABLED=true
+# Graphiti is enabled by default. Set to false to disable memory features.
+GRAPHITI_ENABLED=true
+
+# =============================================================================
+# GRAPHITI: Database Settings
+# =============================================================================
+# LadybugDB stores data in a local directory (no Docker required).
+
+# Database name (default: auto_claude_memory)
+# GRAPHITI_DATABASE=auto_claude_memory
+
+# Database storage path (default: ~/.auto-claude/memories)
+# GRAPHITI_DB_PATH=~/.auto-claude/memories
 
 # =============================================================================
 # GRAPHITI: Provider Selection
@@ -115,10 +153,10 @@ CLAUDE_CODE_OAUTH_TOKEN=your-oauth-token-here
 # Choose which providers to use for LLM and embeddings.
 # Default is "openai" for both.
 
-# LLM provider: openai | anthropic | azure_openai | ollama
+# LLM provider: openai | anthropic | azure_openai | ollama | google | openrouter
 # GRAPHITI_LLM_PROVIDER=openai
 
-# Embedder provider: openai | voyage | azure_openai | ollama
+# Embedder provider: openai | voyage | azure_openai | ollama | google | openrouter
 # GRAPHITI_EMBEDDER_PROVIDER=openai
 
 # =============================================================================
@@ -130,8 +168,8 @@ CLAUDE_CODE_OAUTH_TOKEN=your-oauth-token-here
 # OpenAI API Key
 # OPENAI_API_KEY=sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
 
-# OpenAI Model for LLM (default: gpt-5-mini)
-# OPENAI_MODEL=gpt-5-mini
+# OpenAI Model for LLM (default: gpt-4o-mini)
+# OPENAI_MODEL=gpt-4o-mini
 
 # OpenAI Model for embeddings (default: text-embedding-3-small)
 # Available: text-embedding-3-small (1536 dim), text-embedding-3-large (3072 dim)
@@ -166,6 +204,45 @@ CLAUDE_CODE_OAUTH_TOKEN=your-oauth-token-here
 # Available: voyage-3 (1024 dim), voyage-3-lite (512 dim)
 # VOYAGE_EMBEDDING_MODEL=voyage-3
 
+# =============================================================================
+# GRAPHITI: Google AI Provider
+# =============================================================================
+# Use Google AI (Gemini) for both LLM and embeddings.
+# Get API key from: https://aistudio.google.com/apikey
+#
+# Required: GOOGLE_API_KEY
+
+# Google AI API Key
+# GOOGLE_API_KEY=AIzaSyxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+
+# Google LLM Model (default: gemini-2.0-flash)
+# GOOGLE_LLM_MODEL=gemini-2.0-flash
+
+# Google Embedding Model (default: text-embedding-004)
+# GOOGLE_EMBEDDING_MODEL=text-embedding-004
+
+# =============================================================================
+# GRAPHITI: OpenRouter Provider (Multi-provider aggregator)
+# =============================================================================
+# Use OpenRouter to access multiple LLM providers through a single API.
+# OpenRouter provides access to Anthropic, OpenAI, Google, and many other models.
+# Get API key from: https://openrouter.ai/keys
+#
+# Required: OPENROUTER_API_KEY
+
+# OpenRouter API Key
+# OPENROUTER_API_KEY=sk-or-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+
+# OpenRouter Base URL (default: https://openrouter.ai/api/v1)
+# OPENROUTER_BASE_URL=https://openrouter.ai/api/v1
+
+# OpenRouter LLM Model (default: anthropic/claude-3.5-sonnet)
+# Popular choices: anthropic/claude-3.5-sonnet, openai/gpt-4o, google/gemini-2.0-flash
+# OPENROUTER_LLM_MODEL=anthropic/claude-3.5-sonnet
+
+# OpenRouter Embedding Model (default: openai/text-embedding-3-small)
+# OPENROUTER_EMBEDDING_MODEL=openai/text-embedding-3-small
+
 # =============================================================================
 # GRAPHITI: Azure OpenAI Provider
 # =============================================================================
@@ -181,7 +258,7 @@ CLAUDE_CODE_OAUTH_TOKEN=your-oauth-token-here
 # AZURE_OPENAI_BASE_URL=https://your-resource.openai.azure.com/openai/deployments/your-deployment
 
 # Azure OpenAI Deployment Names
-# AZURE_OPENAI_LLM_DEPLOYMENT=gpt-5
+# AZURE_OPENAI_LLM_DEPLOYMENT=gpt-4
 # AZURE_OPENAI_EMBEDDING_DEPLOYMENT=text-embedding-3-small
 
 # =============================================================================
@@ -213,66 +290,6 @@ CLAUDE_CODE_OAUTH_TOKEN=your-oauth-token-here
 # Common values: nomic-embed-text=768, mxbai-embed-large=1024, all-minilm=384
 # OLLAMA_EMBEDDING_DIM=768
 
-# =============================================================================
-# GRAPHITI MCP SERVER (OPTIONAL - Agent-accessible knowledge graph)
-# =============================================================================
-# Enable Graphiti MCP server for direct agent access to knowledge graph.
-# This is SEPARATE from GRAPHITI_ENABLED (Python library integration).
-#
-# With MCP server enabled, Claude agents can directly:
-#   - Search for relevant context (search_nodes, search_facts)
-#   - Add discoveries to the graph (add_episode)
-#   - Retrieve recent sessions (get_episodes)
-#
-# Quick Start (uses docker-compose.yml in project root):
-#   1. Set OPENAI_API_KEY in your .env file (or export it)
-#   2. Run: docker-compose up -d
-#   3. Set GRAPHITI_MCP_URL below
-#
-# Manual Docker (alternative):
-#   docker run -d -p 8000:8000 \
-#     -e DATABASE_TYPE=falkordb \
-#     -e OPENAI_API_KEY=$OPENAI_API_KEY \
-#     -e FALKORDB_URI=redis://host.docker.internal:6379 \
-#     falkordb/graphiti-knowledge-graph-mcp
-#
-# See: https://docs.falkordb.com/agentic-memory/graphiti-mcp-server.html
-
-# Graphiti MCP Server URL (setting this enables MCP integration)
-# GRAPHITI_MCP_URL=http://localhost:8000/mcp/
-
-# Graphiti MCP Server Port (for docker-compose, default: 8000)
-# GRAPHITI_MCP_PORT=8000
-
-# Optional: Override model settings for MCP server
-# GRAPHITI_MODEL_NAME=gpt-4o-mini
-# GRAPHITI_EMBEDDING_MODEL=text-embedding-3-small
-
-# =============================================================================
-# GRAPHITI: FalkorDB Connection Settings
-# =============================================================================
-# Configure the FalkorDB graph database connection.
-# Start FalkorDB: docker run -p 6379:6379 falkordb/falkordb:latest
-
-# FalkorDB Host (default: localhost)
-# GRAPHITI_FALKORDB_HOST=localhost
-
-# FalkorDB Port (default: 6379)
-# GRAPHITI_FALKORDB_PORT=6379
-
-# FalkorDB Password (default: empty)
-# GRAPHITI_FALKORDB_PASSWORD=
-
-# Graph Database Name (default: auto_claude_memory)
-# GRAPHITI_DATABASE=auto_claude_memory
-
-# =============================================================================
-# GRAPHITI: Miscellaneous Settings
-# =============================================================================
-
-# Disable Graphiti telemetry (default: true)
-# GRAPHITI_TELEMETRY_ENABLED=false
-
 # =============================================================================
 # GRAPHITI: Example Configurations
 # =============================================================================
@@ -304,5 +321,19 @@ CLAUDE_CODE_OAUTH_TOKEN=your-oauth-token-here
 # GRAPHITI_EMBEDDER_PROVIDER=azure_openai
 # AZURE_OPENAI_API_KEY=xxxxxxxx
 # AZURE_OPENAI_BASE_URL=https://your-resource.openai.azure.com/...
-# AZURE_OPENAI_LLM_DEPLOYMENT=gpt-5
+# AZURE_OPENAI_LLM_DEPLOYMENT=gpt-4
 # AZURE_OPENAI_EMBEDDING_DEPLOYMENT=text-embedding-3-small
+#
+# --- Example 5: Google AI (Gemini) ---
+# GRAPHITI_ENABLED=true
+# GRAPHITI_LLM_PROVIDER=google
+# GRAPHITI_EMBEDDER_PROVIDER=google
+# GOOGLE_API_KEY=AIzaSyxxxxxxxx
+#
+# --- Example 6: OpenRouter (multi-provider aggregator) ---
+# GRAPHITI_ENABLED=true
+# GRAPHITI_LLM_PROVIDER=openrouter
+# GRAPHITI_EMBEDDER_PROVIDER=openrouter
+# OPENROUTER_API_KEY=sk-or-xxxxxxxx
+# OPENROUTER_LLM_MODEL=anthropic/claude-3.5-sonnet
+# OPENROUTER_EMBEDDING_MODEL=openai/text-embedding-3-small

apps/backend/.gitignore

@@ -5,6 +5,7 @@
 
 # Virtual environment
 .venv/
+.venv*/
 venv/
 env/
 
@@ -60,3 +61,6 @@ Thumbs.db
 
 # Tests (development only)
 tests/
+
+# Auto Claude data directory
+.auto-claude/

apps/backend/README.md

@@ -0,0 +1,120 @@
+# Auto Claude Backend
+
+Autonomous coding framework powered by Claude AI. Builds software features through coordinated multi-agent sessions.
+
+## Getting Started
+
+### 1. Install
+
+```bash
+cd apps/backend
+python -m pip install -r requirements.txt
+```
+
+### 2. Configure
+
+```bash
+cp .env.example .env
+```
+
+Set your Claude API token in `.env`:
+```
+CLAUDE_CODE_OAUTH_TOKEN=your-token-here
+```
+
+Get your token by running: `claude setup-token`
+
+### 3. Run
+
+```bash
+# List available specs
+python run.py --list
+
+# Run a spec
+python run.py --spec 001
+```
+
+## Requirements
+
+- Python 3.10+
+- Claude API token
+
+## Commands
+
+| Command | Description |
+|---------|-------------|
+| `--list` | List all specs |
+| `--spec 001` | Run spec 001 |
+| `--spec 001 --isolated` | Run in isolated workspace |
+| `--spec 001 --direct` | Run directly in repo |
+| `--spec 001 --merge` | Merge completed build |
+| `--spec 001 --review` | Review build changes |
+| `--spec 001 --discard` | Discard build |
+| `--spec 001 --qa` | Run QA validation |
+| `--list-worktrees` | List all worktrees |
+| `--help` | Show all options |
+
+## Configuration
+
+Optional `.env` settings:
+
+| Variable | Description |
+|----------|-------------|
+| `AUTO_BUILD_MODEL` | Override Claude model |
+| `DEBUG=true` | Enable debug logging |
+| `LINEAR_API_KEY` | Enable Linear integration |
+| `GRAPHITI_ENABLED=true` | Enable memory system |
+
+## Troubleshooting
+
+**"tree-sitter not available"** - Safe to ignore, uses regex fallback.
+
+**Missing module errors** - Run `python -m pip install -r requirements.txt`
+
+**Debug mode** - Set `DEBUG=true DEBUG_LEVEL=2` before running.
+
+---
+
+## For Developers
+
+### Project Structure
+
+```
+backend/
+├── agents/          # AI agent execution
+├── analysis/        # Code analysis
+├── cli/             # Command-line interface
+├── core/            # Core utilities
+├── integrations/    # External services (Linear, Graphiti)
+├── merge/           # Git merge handling
+├── project/         # Project detection
+├── prompts/         # Prompt templates
+├── qa/              # QA validation
+├── spec/            # Spec management
+└── ui/              # Terminal UI
+```
+
+### Design Principles
+
+- **SOLID** - Single responsibility, clean interfaces
+- **DRY** - Shared utilities in `core/`
+- **KISS** - Simple flat imports via facade modules
+
+### Import Convention
+
+```python
+# Use facade modules for clean imports
+from debug import debug, debug_error
+from progress import count_subtasks
+from workspace import setup_workspace
+```
+
+### Adding Features
+
+1. Create module in appropriate folder
+2. Export API in `__init__.py`
+3. Add facade module at root if commonly imported
+
+## License
+
+AGPL-3.0

apps/backend/__init__.py

@@ -0,0 +1,23 @@
+"""
+Auto Claude Backend - Autonomous Coding Framework
+==================================================
+
+Multi-agent autonomous coding framework that builds software through
+coordinated AI agent sessions.
+
+This package provides:
+- Autonomous agent execution for building features from specs
+- Workspace isolation via git worktrees
+- QA validation loops
+- Memory management (Graphiti + file-based)
+- Linear integration for project management
+
+Quick Start:
+    python run.py --spec 001    # Run a spec
+    python run.py --list        # List all specs
+
+See README.md for full documentation.
+"""
+
+__version__ = "2.7.2"
+__author__ = "Auto Claude Team"

apps/backend/agents/__init__.py

@@ -0,0 +1,92 @@
+"""
+Agents Module
+=============
+
+Modular agent system for autonomous coding.
+
+This module provides:
+- run_autonomous_agent: Main coder agent loop
+- run_followup_planner: Follow-up planner for completed specs
+- Memory management (Graphiti + file-based fallback)
+- Session management and post-processing
+- Utility functions for git and plan management
+
+Uses lazy imports to avoid circular dependencies.
+"""
+
+__all__ = [
+    # Main API
+    "run_autonomous_agent",
+    "run_followup_planner",
+    # Memory
+    "debug_memory_system_status",
+    "get_graphiti_context",
+    "save_session_memory",
+    "save_session_to_graphiti",
+    # Session
+    "run_agent_session",
+    "post_session_processing",
+    # Utils
+    "get_latest_commit",
+    "get_commit_count",
+    "load_implementation_plan",
+    "find_subtask_in_plan",
+    "find_phase_for_subtask",
+    "sync_plan_to_source",
+    # Constants
+    "AUTO_CONTINUE_DELAY_SECONDS",
+    "HUMAN_INTERVENTION_FILE",
+]
+
+
+def __getattr__(name):
+    """Lazy imports to avoid circular dependencies."""
+    if name in ("AUTO_CONTINUE_DELAY_SECONDS", "HUMAN_INTERVENTION_FILE"):
+        from .base import AUTO_CONTINUE_DELAY_SECONDS, HUMAN_INTERVENTION_FILE
+
+        return locals()[name]
+    elif name == "run_autonomous_agent":
+        from .coder import run_autonomous_agent
+
+        return run_autonomous_agent
+    elif name in (
+        "debug_memory_system_status",
+        "get_graphiti_context",
+        "save_session_memory",
+        "save_session_to_graphiti",
+    ):
+        from .memory_manager import (
+            debug_memory_system_status,
+            get_graphiti_context,
+            save_session_memory,
+            save_session_to_graphiti,
+        )
+
+        return locals()[name]
+    elif name == "run_followup_planner":
+        from .planner import run_followup_planner
+
+        return run_followup_planner
+    elif name in ("post_session_processing", "run_agent_session"):
+        from .session import post_session_processing, run_agent_session
+
+        return locals()[name]
+    elif name in (
+        "find_phase_for_subtask",
+        "find_subtask_in_plan",
+        "get_commit_count",
+        "get_latest_commit",
+        "load_implementation_plan",
+        "sync_plan_to_source",
+    ):
+        from .utils import (
+            find_phase_for_subtask,
+            find_subtask_in_plan,
+            get_commit_count,
+            get_latest_commit,
+            load_implementation_plan,
+            sync_plan_to_source,
+        )
+
+        return locals()[name]
+    raise AttributeError(f"module 'agents' has no attribute '{name}'")

apps/backend/agents/coder.py

@@ -9,7 +9,7 @@ import asyncio
 import logging
 from pathlib import Path
 
-from client import create_client
+from core.client import create_client
 from linear_updater import (
     LinearTaskState,
     is_linear_enabled,
@@ -17,6 +17,7 @@ from linear_updater import (
     linear_task_started,
     linear_task_stuck,
 )
+from phase_config import get_phase_model, get_phase_thinking_budget
 from progress import (
     count_subtasks,
     count_subtasks_detailed,
@@ -244,8 +245,19 @@ async def run_autonomous_agent(
         commit_before = get_latest_commit(project_dir)
         commit_count_before = get_commit_count(project_dir)
 
-        # Create client (fresh context)
-        client = create_client(project_dir, spec_dir, model)
+        # Get the phase-specific model and thinking level (respects task_metadata.json configuration)
+        # first_run means we're in planning phase, otherwise coding phase
+        current_phase = "planning" if first_run else "coding"
+        phase_model = get_phase_model(spec_dir, current_phase, model)
+        phase_thinking_budget = get_phase_thinking_budget(spec_dir, current_phase)
+
+        # Create client (fresh context) with phase-specific model and thinking
+        client = create_client(
+            project_dir,
+            spec_dir,
+            phase_model,
+            max_thinking_tokens=phase_thinking_budget,
+        )
 
         # Generate appropriate prompt
         if first_run:

apps/backend/agents/planner.py

@@ -8,7 +8,8 @@ Handles follow-up planner sessions for adding new subtasks to completed specs.
 import logging
 from pathlib import Path
 
-from client import create_client
+from core.client import create_client
+from phase_config import get_phase_thinking_budget
 from task_logger import (
     LogPhase,
     get_task_logger,
@@ -88,8 +89,14 @@ async def run_followup_planner(
         task_logger.start_phase(LogPhase.PLANNING, "Starting follow-up planning...")
         task_logger.set_session(1)
 
-    # Create client (fresh context)
-    client = create_client(project_dir, spec_dir, model)
+    # Create client (fresh context) with planning phase thinking budget
+    planning_thinking_budget = get_phase_thinking_budget(spec_dir, "planning")
+    client = create_client(
+        project_dir,
+        spec_dir,
+        model,
+        max_thinking_tokens=planning_thinking_budget,
+    )
 
     # Generate follow-up planner prompt
     prompt = get_followup_planner_prompt(spec_dir)

apps/backend/agents/session.py

@@ -10,6 +10,7 @@ import logging
 from pathlib import Path
 
 from claude_agent_sdk import ClaudeSDKClient
+from debug import debug, debug_detailed, debug_error, debug_section, debug_success
 from insight_extractor import extract_session_insights
 from linear_updater import (
     linear_subtask_completed,
@@ -332,20 +333,40 @@ async def run_agent_session(
         - "complete" if all subtasks complete
         - "error" if an error occurred
     """
+    debug_section("session", f"Agent Session - {phase.value}")
+    debug(
+        "session",
+        "Starting agent session",
+        spec_dir=str(spec_dir),
+        phase=phase.value,
+        prompt_length=len(message),
+        prompt_preview=message[:200] + "..." if len(message) > 200 else message,
+    )
     print("Sending prompt to Claude Agent SDK...\n")
 
     # Get task logger for this spec
     task_logger = get_task_logger(spec_dir)
     current_tool = None
+    message_count = 0
+    tool_count = 0
 
     try:
         # Send the query
+        debug("session", "Sending query to Claude SDK...")
         await client.query(message)
+        debug_success("session", "Query sent successfully")
 
         # Collect response text and show tool use
         response_text = ""
+        debug("session", "Starting to receive response stream...")
         async for msg in client.receive_response():
             msg_type = type(msg).__name__
+            message_count += 1
+            debug_detailed(
+                "session",
+                f"Received message #{message_count}",
+                msg_type=msg_type,
+            )
 
             # Handle AssistantMessage (text and tool use)
             if msg_type == "AssistantMessage" and hasattr(msg, "content"):
@@ -366,6 +387,7 @@ async def run_agent_session(
                     elif block_type == "ToolUseBlock" and hasattr(block, "name"):
                         tool_name = block.name
                         tool_input = None
+                        tool_count += 1
 
                         # Extract meaningful tool input for display
                         if hasattr(block, "input") and block.input:
@@ -386,6 +408,15 @@ async def run_agent_session(
                                 elif "path" in inp:
                                     tool_input = inp["path"]
 
+                        debug(
+                            "session",
+                            f"Tool call #{tool_count}: {tool_name}",
+                            tool_input=tool_input,
+                            full_input=str(block.input)[:500]
+                            if hasattr(block, "input")
+                            else None,
+                        )
+
                         # Log tool start (handles printing too)
                         if task_logger:
                             task_logger.tool_start(
@@ -413,6 +444,11 @@ async def run_agent_session(
 
                         # Check if command was blocked by security hook
                         if "blocked" in str(result_content).lower():
+                            debug_error(
+                                "session",
+                                f"Tool BLOCKED: {current_tool}",
+                                result=str(result_content)[:300],
+                            )
                             print(f"   [BLOCKED] {result_content}", flush=True)
                             if task_logger and current_tool:
                                 task_logger.tool_end(
@@ -425,6 +461,11 @@ async def run_agent_session(
                         elif is_error:
                             # Show errors (truncated)
                             error_str = str(result_content)[:500]
+                            debug_error(
+                                "session",
+                                f"Tool error: {current_tool}",
+                                error=error_str[:200],
+                            )
                             print(f"   [Error] {error_str}", flush=True)
                             if task_logger and current_tool:
                                 # Store full error in detail for expandable view
@@ -437,6 +478,11 @@ async def run_agent_session(
                                 )
                         else:
                             # Tool succeeded
+                            debug_detailed(
+                                "session",
+                                f"Tool success: {current_tool}",
+                                result_length=len(str(result_content)),
+                            )
                             if verbose:
                                 result_str = str(result_content)[:200]
                                 print(f"   [Done] {result_str}", flush=True)
@@ -472,11 +518,32 @@ async def run_agent_session(
 
         # Check if build is complete
         if is_build_complete(spec_dir):
+            debug_success(
+                "session",
+                "Session completed - build is complete",
+                message_count=message_count,
+                tool_count=tool_count,
+                response_length=len(response_text),
+            )
             return "complete", response_text
 
+        debug_success(
+            "session",
+            "Session completed - continuing",
+            message_count=message_count,
+            tool_count=tool_count,
+            response_length=len(response_text),
+        )
         return "continue", response_text
 
     except Exception as e:
+        debug_error(
+            "session",
+            f"Session error: {e}",
+            exception_type=type(e).__name__,
+            message_count=message_count,
+            tool_count=tool_count,
+        )
         print(f"Error during agent session: {e}")
         if task_logger:
             task_logger.log_error(f"Session error: {e}", phase)

apps/backend/agents/tools_pkg/models.py

@@ -19,18 +19,28 @@ TOOL_RECORD_GOTCHA = "mcp__auto-claude__record_gotcha"
 TOOL_GET_SESSION_CONTEXT = "mcp__auto-claude__get_session_context"
 TOOL_UPDATE_QA_STATUS = "mcp__auto-claude__update_qa_status"
 
+# Puppeteer MCP tools for web browser automation
+# Used for web frontend validation (non-Electron web apps)
+PUPPETEER_TOOLS = [
+    "mcp__puppeteer__puppeteer_connect_active_tab",
+    "mcp__puppeteer__puppeteer_navigate",
+    "mcp__puppeteer__puppeteer_screenshot",
+    "mcp__puppeteer__puppeteer_click",
+    "mcp__puppeteer__puppeteer_fill",
+    "mcp__puppeteer__puppeteer_select",
+    "mcp__puppeteer__puppeteer_hover",
+    "mcp__puppeteer__puppeteer_evaluate",
+]
+
 # Electron MCP tools for desktop app automation (when ELECTRON_MCP_ENABLED is set)
-# Uses puppeteer-mcp-server to connect to Electron apps via Chrome DevTools Protocol.
+# Uses electron-mcp-server to connect to Electron apps via Chrome DevTools Protocol.
 # Electron app must be started with --remote-debugging-port=9222 (or ELECTRON_DEBUG_PORT).
 # These tools are only available to QA agents (qa_reviewer, qa_fixer), not Coder/Planner.
 ELECTRON_TOOLS = [
-    "mcp__electron__electron_connect",  # Connect to Electron app via DevTools
-    "mcp__electron__electron_screenshot",  # Take screenshot of Electron window
-    "mcp__electron__electron_click",  # Click element in Electron app
-    "mcp__electron__electron_fill",  # Fill input field in Electron app
-    "mcp__electron__electron_evaluate",  # Execute JS in Electron renderer
-    "mcp__electron__electron_get_window_info",  # Get window state/bounds
-    "mcp__electron__electron_get_console",  # Get console logs from renderer
+    "mcp__electron__get_electron_window_info",  # Get info about running Electron windows
+    "mcp__electron__take_screenshot",  # Capture screenshot of Electron window
+    "mcp__electron__send_command_to_electron",  # Send commands (click, fill, evaluate JS)
+    "mcp__electron__read_electron_logs",  # Read console logs from Electron app
 ]
 
 # Base tools available to all agents

apps/backend/agents/tools_pkg/permissions.py

@@ -0,0 +1,147 @@
+"""
+Agent Tool Permissions
+======================
+
+Manages which tools are allowed for each agent type to prevent context
+pollution and accidental misuse.
+
+Supports dynamic tool filtering based on project capabilities to optimize
+context window usage. For example, Electron tools are only included for
+Electron projects, not for Next.js or CLI projects.
+"""
+
+from .models import (
+    BASE_READ_TOOLS,
+    BASE_WRITE_TOOLS,
+    ELECTRON_TOOLS,
+    PUPPETEER_TOOLS,
+    TOOL_GET_BUILD_PROGRESS,
+    TOOL_GET_SESSION_CONTEXT,
+    TOOL_RECORD_DISCOVERY,
+    TOOL_RECORD_GOTCHA,
+    TOOL_UPDATE_QA_STATUS,
+    TOOL_UPDATE_SUBTASK_STATUS,
+    is_electron_mcp_enabled,
+)
+
+
+def get_allowed_tools(
+    agent_type: str,
+    project_capabilities: dict | None = None,
+) -> list[str]:
+    """
+    Get the list of allowed tools for a specific agent type.
+
+    This ensures each agent only sees tools relevant to their role,
+    preventing context pollution and accidental misuse.
+
+    When project_capabilities is provided, MCP tools are filtered based on
+    the project type. For example:
+    - Electron projects get Electron MCP tools
+    - Web frontends (non-Electron) get Puppeteer MCP tools
+    - CLI projects get neither
+
+    Args:
+        agent_type: One of 'planner', 'coder', 'qa_reviewer', 'qa_fixer'
+        project_capabilities: Optional dict from detect_project_capabilities()
+                            containing flags like is_electron, is_web_frontend, etc.
+
+    Returns:
+        List of allowed tool names
+    """
+    # Auto-claude tool mappings by agent type
+    tool_mappings = {
+        "planner": {
+            "base": BASE_READ_TOOLS + BASE_WRITE_TOOLS,
+            "auto_claude": [
+                TOOL_GET_BUILD_PROGRESS,
+                TOOL_GET_SESSION_CONTEXT,
+                TOOL_RECORD_DISCOVERY,
+            ],
+        },
+        "coder": {
+            "base": BASE_READ_TOOLS + BASE_WRITE_TOOLS,
+            "auto_claude": [
+                TOOL_UPDATE_SUBTASK_STATUS,
+                TOOL_GET_BUILD_PROGRESS,
+                TOOL_RECORD_DISCOVERY,
+                TOOL_RECORD_GOTCHA,
+                TOOL_GET_SESSION_CONTEXT,
+            ],
+        },
+        "qa_reviewer": {
+            "base": BASE_READ_TOOLS + ["Bash"],  # Can run tests but not edit
+            "auto_claude": [
+                TOOL_GET_BUILD_PROGRESS,
+                TOOL_UPDATE_QA_STATUS,
+                TOOL_GET_SESSION_CONTEXT,
+            ],
+        },
+        "pr_reviewer": {
+            # PR reviewers can ONLY read - no bash, no edits, no writes
+            # This prevents the agent from switching branches or making changes
+            "base": BASE_READ_TOOLS,
+            "auto_claude": [],  # No auto-claude tools needed for PR review
+        },
+        "qa_fixer": {
+            "base": BASE_READ_TOOLS + BASE_WRITE_TOOLS,
+            "auto_claude": [
+                TOOL_UPDATE_SUBTASK_STATUS,
+                TOOL_GET_BUILD_PROGRESS,
+                TOOL_UPDATE_QA_STATUS,
+                TOOL_RECORD_GOTCHA,
+            ],
+        },
+    }
+
+    if agent_type not in tool_mappings:
+        # Default to coder tools
+        agent_type = "coder"
+
+    mapping = tool_mappings[agent_type]
+    tools = mapping["base"] + mapping["auto_claude"]
+
+    # Add MCP tools for QA agents only, based on project capabilities
+    if agent_type in ("qa_reviewer", "qa_fixer"):
+        tools.extend(_get_qa_mcp_tools(project_capabilities))
+
+    return tools
+
+
+def _get_qa_mcp_tools(project_capabilities: dict | None) -> list[str]:
+    """
+    Get the list of MCP tools for QA agents based on project capabilities.
+
+    This function determines which MCP tools to include based on:
+    1. Project type detection (Electron, web frontend, etc.)
+    2. Environment variables (ELECTRON_MCP_ENABLED)
+
+    Args:
+        project_capabilities: Dict from detect_project_capabilities() or None
+
+    Returns:
+        List of MCP tool names to include
+    """
+    tools = []
+
+    # If no capabilities provided, fall back to legacy behavior
+    # (check env var only)
+    if project_capabilities is None:
+        if is_electron_mcp_enabled():
+            tools.extend(ELECTRON_TOOLS)
+        return tools
+
+    # Project-capability-based tool selection
+    is_electron = project_capabilities.get("is_electron", False)
+    is_web_frontend = project_capabilities.get("is_web_frontend", False)
+
+    # Electron projects get Electron MCP tools (if enabled)
+    if is_electron and is_electron_mcp_enabled():
+        tools.extend(ELECTRON_TOOLS)
+
+    # Web frontends (non-Electron) get Puppeteer tools
+    # Puppeteer is always available, no env var check needed
+    if is_web_frontend and not is_electron:
+        tools.extend(PUPPETEER_TOOLS)
+
+    return tools

apps/backend/analysis/__init__.py

@@ -6,6 +6,9 @@ Code analysis and project scanning tools.
 """
 
 # Import from analyzers subpackage (these are the modular analyzers)
+
+from __future__ import annotations
+
 from .analyzers import (
     ProjectAnalyzer as ModularProjectAnalyzer,
 )

apps/backend/analysis/analyzer.py

@@ -27,6 +27,8 @@ This module now serves as a facade to the modular analyzer system in the analyze
 All actual implementation is in focused submodules for better maintainability.
 """
 
+from __future__ import annotations
+
 import json
 from pathlib import Path
 

apps/backend/analysis/analyzers/__init__.py

@@ -11,6 +11,8 @@ Main exports:
 - analyze_service: Convenience function for service analysis
 """
 
+from __future__ import annotations
+
 from pathlib import Path
 from typing import Any
 

apps/backend/analysis/analyzers/base.py

@@ -5,6 +5,8 @@ Base Analyzer Module
 Provides common constants, utilities, and base functionality shared across all analyzers.
 """
 
+from __future__ import annotations
+
 import json
 from pathlib import Path
 

apps/backend/analysis/analyzers/context/__init__.py

@@ -5,6 +5,8 @@ Context Analyzer Package
 Contains specialized detectors for comprehensive project context analysis.
 """
 
+from __future__ import annotations
+
 from .api_docs_detector import ApiDocsDetector
 from .auth_detector import AuthDetector
 from .env_detector import EnvironmentDetector

apps/backend/analysis/analyzers/context/api_docs_detector.py

@@ -8,6 +8,8 @@ Detects API documentation tools and configurations:
 - API documentation endpoints
 """
 
+from __future__ import annotations
+
 from pathlib import Path
 from typing import Any
 

apps/backend/analysis/analyzers/context/auth_detector.py

@@ -11,6 +11,8 @@ Detects authentication and authorization patterns:
 - Auth middleware and decorators
 """
 
+from __future__ import annotations
+
 import re
 from pathlib import Path
 from typing import Any

apps/backend/analysis/analyzers/context/env_detector.py

@@ -9,6 +9,8 @@ Detects and analyzes environment variables from multiple sources:
 - Source code (os.getenv, process.env)
 """
 
+from __future__ import annotations
+
 import re
 from pathlib import Path
 from typing import Any

apps/backend/analysis/analyzers/context/jobs_detector.py

@@ -9,6 +9,8 @@ Detects background job and task queue systems:
 - Scheduled tasks and cron jobs
 """
 
+from __future__ import annotations
+
 import re
 from pathlib import Path
 from typing import Any

apps/backend/analysis/analyzers/context/migrations_detector.py

@@ -10,6 +10,8 @@ Detects database migration tools and configurations:
 - Prisma
 """
 
+from __future__ import annotations
+
 from pathlib import Path
 from typing import Any
 

apps/backend/analysis/analyzers/context/monitoring_detector.py

@@ -9,6 +9,8 @@ Detects monitoring and observability setup:
 - Logging infrastructure
 """
 
+from __future__ import annotations
+
 from pathlib import Path
 from typing import Any
 

apps/backend/analysis/analyzers/context/services_detector.py

@@ -13,6 +13,8 @@ Detects external service integrations based on dependencies:
 - Monitoring tools (Sentry, Datadog, New Relic)
 """
 
+from __future__ import annotations
+
 import re
 from pathlib import Path
 from typing import Any

apps/backend/analysis/analyzers/context_analyzer.py

@@ -14,6 +14,8 @@ Orchestrates comprehensive project context analysis including:
 This module delegates to specialized detectors for clean separation of concerns.
 """
 
+from __future__ import annotations
+
 from pathlib import Path
 from typing import Any
 

apps/backend/analysis/analyzers/database_detector.py

@@ -7,6 +7,8 @@ Detects database models and schemas across different ORMs:
 - JavaScript/TypeScript: Prisma, TypeORM, Drizzle, Mongoose
 """
 
+from __future__ import annotations
+
 import re
 from pathlib import Path
 

apps/backend/analysis/analyzers/framework_analyzer.py

@@ -6,6 +6,8 @@ Detects programming languages, frameworks, and related technologies across diffe
 Supports Python, Node.js/TypeScript, Go, Rust, and Ruby frameworks.
 """
 
+from __future__ import annotations
+
 from pathlib import Path
 from typing import Any
 

apps/backend/analysis/analyzers/port_detector.py

@@ -6,6 +6,8 @@ Detects application ports from multiple sources including entry points,
 environment files, Docker Compose, configuration files, and scripts.
 """
 
+from __future__ import annotations
+
 import re
 from pathlib import Path
 from typing import Any

apps/backend/analysis/analyzers/project_analyzer_module.py

@@ -5,6 +5,8 @@ Project Analyzer Module
 Analyzes entire projects, detecting monorepo structures, services, infrastructure, and conventions.
 """
 
+from __future__ import annotations
+
 from pathlib import Path
 from typing import Any
 

apps/backend/analysis/analyzers/route_detector.py

@@ -9,6 +9,8 @@ Detects API routes and endpoints across different frameworks:
 - Rust: Axum, Actix
 """
 
+from __future__ import annotations
+
 import re
 from pathlib import Path
 

apps/backend/analysis/analyzers/service_analyzer.py

@@ -6,6 +6,8 @@ Main ServiceAnalyzer class that coordinates all analysis for a single service/pa
 Integrates framework detection, route analysis, database models, and context extraction.
 """
 
+from __future__ import annotations
+
 import re
 from pathlib import Path
 from typing import Any

apps/backend/analysis/ci_discovery.py

@@ -22,6 +22,8 @@ Usage:
         print(f"Test Commands: {result.test_commands}")
 """
 
+from __future__ import annotations
+
 import json
 import re
 from dataclasses import dataclass, field

apps/backend/analysis/insight_extractor.py

@@ -9,6 +9,8 @@ Uses the Claude Agent SDK (same as the rest of the system) for extraction.
 Falls back to generic insights if extraction fails (never blocks the build).
 """
 
+from __future__ import annotations
+
 import json
 import logging
 import os
@@ -28,6 +30,8 @@ except ImportError:
     ClaudeAgentOptions = None
     ClaudeSDKClient = None
 
+from core.auth import ensure_claude_code_oauth_token, get_auth_token
+
 # Default model for insight extraction (fast and cheap)
 DEFAULT_EXTRACTION_MODEL = "claude-3-5-haiku-latest"
 
@@ -40,10 +44,10 @@ MAX_ATTEMPTS_TO_INCLUDE = 3
 
 def is_extraction_enabled() -> bool:
     """Check if insight extraction is enabled."""
-    # Extraction requires Claude SDK and OAuth token
+    # Extraction requires Claude SDK and authentication token
     if not SDK_AVAILABLE:
         return False
-    if not os.environ.get("CLAUDE_CODE_OAUTH_TOKEN"):
+    if not get_auth_token():
         return False
     enabled_str = os.environ.get("INSIGHT_EXTRACTION_ENABLED", "true").lower()
     return enabled_str in ("true", "1", "yes")
@@ -348,11 +352,13 @@ async def run_insight_extraction(
         logger.warning("Claude SDK not available, skipping insight extraction")
         return None
 
-    oauth_token = os.environ.get("CLAUDE_CODE_OAUTH_TOKEN")
-    if not oauth_token:
-        logger.warning("CLAUDE_CODE_OAUTH_TOKEN not set, skipping insight extraction")
+    if not get_auth_token():
+        logger.warning("No authentication token found, skipping insight extraction")
         return None
 
+    # Ensure SDK can find the token
+    ensure_claude_code_oauth_token()
+
     model = get_extraction_model()
     prompt = _build_extraction_prompt(inputs)
 

apps/backend/analysis/project_analyzer.py

@@ -28,6 +28,9 @@ needed for the detected tech stack, while blocking dangerous operations.
 """
 
 # Re-export all public API from the project module
+
+from __future__ import annotations
+
 from project import (
     # Command registries
     BASE_COMMANDS,

apps/backend/analysis/risk_classifier.py

@@ -21,6 +21,8 @@ Usage:
     test_types = classifier.get_required_test_types(spec_dir)
 """
 
+from __future__ import annotations
+
 import json
 from dataclasses import dataclass, field
 from pathlib import Path

apps/backend/analysis/security_scanner.py

@@ -21,6 +21,8 @@ Usage:
         print("Security issues found - blocking QA approval")
 """
 
+from __future__ import annotations
+
 import json
 import subprocess
 from dataclasses import dataclass, field

apps/backend/analysis/test_discovery.py

@@ -22,6 +22,8 @@ Usage:
     print(f"Test command: {result['test_command']}")
 """
 
+from __future__ import annotations
+
 import json
 from dataclasses import dataclass, field
 from pathlib import Path

apps/backend/analyzer.py

@@ -0,0 +1,26 @@
+#!/usr/bin/env python3
+"""
+Analyzer facade module.
+
+Provides backward compatibility for scripts that import from analyzer.py at the root.
+Actual implementation is in analysis/analyzer.py.
+"""
+
+from analysis.analyzer import (
+    ProjectAnalyzer,
+    ServiceAnalyzer,
+    analyze_project,
+    analyze_service,
+    main,
+)
+
+__all__ = [
+    "ServiceAnalyzer",
+    "ProjectAnalyzer",
+    "analyze_project",
+    "analyze_service",
+    "main",
+]
+
+if __name__ == "__main__":
+    main()

apps/backend/auto_claude_tools.py

@@ -0,0 +1,36 @@
+"""
+Auto Claude tools module facade.
+
+Provides MCP tools for agent operations.
+Re-exports from agents.tools_pkg for clean imports.
+"""
+
+from agents.tools_pkg.models import (  # noqa: F401
+    ELECTRON_TOOLS,
+    TOOL_GET_BUILD_PROGRESS,
+    TOOL_GET_SESSION_CONTEXT,
+    TOOL_RECORD_DISCOVERY,
+    TOOL_RECORD_GOTCHA,
+    TOOL_UPDATE_QA_STATUS,
+    TOOL_UPDATE_SUBTASK_STATUS,
+    is_electron_mcp_enabled,
+)
+from agents.tools_pkg.permissions import get_allowed_tools  # noqa: F401
+from agents.tools_pkg.registry import (  # noqa: F401
+    create_auto_claude_mcp_server,
+    is_tools_available,
+)
+
+__all__ = [
+    "create_auto_claude_mcp_server",
+    "get_allowed_tools",
+    "is_tools_available",
+    "TOOL_UPDATE_SUBTASK_STATUS",
+    "TOOL_GET_BUILD_PROGRESS",
+    "TOOL_RECORD_DISCOVERY",
+    "TOOL_RECORD_GOTCHA",
+    "TOOL_GET_SESSION_CONTEXT",
+    "TOOL_UPDATE_QA_STATUS",
+    "ELECTRON_TOOLS",
+    "is_electron_mcp_enabled",
+]

apps/backend/cli/batch_commands.py

@@ -0,0 +1,216 @@
+"""
+Batch Task Management Commands
+==============================
+
+Commands for creating and managing multiple tasks from batch files.
+"""
+
+import json
+from pathlib import Path
+
+from ui import highlight, print_status
+
+
+def handle_batch_create_command(batch_file: str, project_dir: str) -> bool:
+    """
+    Create multiple tasks from a batch JSON file.
+
+    Args:
+        batch_file: Path to JSON file with task definitions
+        project_dir: Project directory
+
+    Returns:
+        True if successful
+    """
+    batch_path = Path(batch_file)
+
+    if not batch_path.exists():
+        print_status(f"Batch file not found: {batch_file}", "error")
+        return False
+
+    try:
+        with open(batch_path) as f:
+            batch_data = json.load(f)
+    except json.JSONDecodeError as e:
+        print_status(f"Invalid JSON in batch file: {e}", "error")
+        return False
+
+    tasks = batch_data.get("tasks", [])
+    if not tasks:
+        print_status("No tasks found in batch file", "warning")
+        return False
+
+    print_status(f"Creating {len(tasks)} tasks from batch file", "info")
+    print()
+
+    specs_dir = Path(project_dir) / ".auto-claude" / "specs"
+    specs_dir.mkdir(parents=True, exist_ok=True)
+
+    # Find next spec ID
+    existing_specs = [d.name for d in specs_dir.iterdir() if d.is_dir()]
+    next_id = (
+        max([int(s.split("-")[0]) for s in existing_specs if s[0].isdigit()] or [0]) + 1
+    )
+
+    created_specs = []
+
+    for idx, task in enumerate(tasks, 1):
+        spec_id = f"{next_id:03d}"
+        task_title = task.get("title", f"Task {idx}")
+        task_slug = task_title.lower().replace(" ", "-")[:50]
+        spec_name = f"{spec_id}-{task_slug}"
+        spec_dir = specs_dir / spec_name
+        spec_dir.mkdir(exist_ok=True)
+
+        # Create requirements.json
+        requirements = {
+            "task_description": task.get("description", task_title),
+            "description": task.get("description", task_title),
+            "workflow_type": task.get("workflow_type", "feature"),
+            "services_involved": task.get("services", ["frontend"]),
+            "priority": task.get("priority", 5),
+            "complexity_inferred": task.get("complexity", "standard"),
+            "inferred_from": {},
+            "created_at": Path(spec_dir).stat().st_mtime,
+            "estimate": {
+                "estimated_hours": task.get("estimated_hours", 4.0),
+                "estimated_days": task.get("estimated_days", 0.5),
+            },
+        }
+
+        req_file = spec_dir / "requirements.json"
+        with open(req_file, "w") as f:
+            json.dump(requirements, f, indent=2, default=str)
+
+        created_specs.append(
+            {
+                "id": spec_id,
+                "name": spec_name,
+                "title": task_title,
+                "status": "pending_spec_creation",
+            }
+        )
+
+        print_status(
+            f"[{idx}/{len(tasks)}] Created {spec_id} - {task_title}", "success"
+        )
+        next_id += 1
+
+    print()
+    print_status(f"Created {len(created_specs)} spec(s) successfully", "success")
+    print()
+
+    # Show summary
+    print(highlight("Next steps:"))
+    print("  1. Generate specs: spec_runner.py --continue <spec_id>")
+    print("  2. Approve specs and build them")
+    print("  3. Run: python run.py --spec <id> to execute")
+
+    return True
+
+
+def handle_batch_status_command(project_dir: str) -> bool:
+    """
+    Show status of all specs in project.
+
+    Args:
+        project_dir: Project directory
+
+    Returns:
+        True if successful
+    """
+    specs_dir = Path(project_dir) / ".auto-claude" / "specs"
+
+    if not specs_dir.exists():
+        print_status("No specs found in project", "warning")
+        return True
+
+    specs = sorted([d for d in specs_dir.iterdir() if d.is_dir()])
+
+    if not specs:
+        print_status("No specs found", "warning")
+        return True
+
+    print_status(f"Found {len(specs)} spec(s)", "info")
+    print()
+
+    for spec_dir in specs:
+        spec_name = spec_dir.name
+        req_file = spec_dir / "requirements.json"
+
+        status = "unknown"
+        title = spec_name
+
+        if req_file.exists():
+            try:
+                with open(req_file) as f:
+                    req = json.load(f)
+                    title = req.get("task_description", title)
+            except json.JSONDecodeError:
+                pass
+
+        # Determine status
+        if (spec_dir / "spec.md").exists():
+            status = "spec_created"
+        elif (spec_dir / "implementation_plan.json").exists():
+            status = "building"
+        elif (spec_dir / "qa_report.md").exists():
+            status = "qa_approved"
+        else:
+            status = "pending_spec"
+
+        status_icon = {
+            "pending_spec": "⏳",
+            "spec_created": "📋",
+            "building": "⚙️",
+            "qa_approved": "✅",
+            "unknown": "❓",
+        }.get(status, "❓")
+
+        print(f"{status_icon} {spec_name:<40} {title}")
+
+    return True
+
+
+def handle_batch_cleanup_command(project_dir: str, dry_run: bool = True) -> bool:
+    """
+    Clean up completed specs and worktrees.
+
+    Args:
+        project_dir: Project directory
+        dry_run: If True, show what would be deleted
+
+    Returns:
+        True if successful
+    """
+    specs_dir = Path(project_dir) / ".auto-claude" / "specs"
+    worktrees_dir = Path(project_dir) / ".worktrees"
+
+    if not specs_dir.exists():
+        print_status("No specs directory found", "info")
+        return True
+
+    # Find completed specs
+    completed = []
+    for spec_dir in specs_dir.iterdir():
+        if spec_dir.is_dir() and (spec_dir / "qa_report.md").exists():
+            completed.append(spec_dir.name)
+
+    if not completed:
+        print_status("No completed specs to clean up", "info")
+        return True
+
+    print_status(f"Found {len(completed)} completed spec(s)", "info")
+
+    if dry_run:
+        print()
+        print("Would remove:")
+        for spec_name in completed:
+            print(f"  - {spec_name}")
+            wt_path = worktrees_dir / spec_name
+            if wt_path.exists():
+                print(f"    └─ .worktrees/{spec_name}/")
+        print()
+        print("Run with --no-dry-run to actually delete")
+
+    return True

apps/backend/cli/build_commands.py

@@ -68,7 +68,7 @@ def handle_build_command(
     Args:
         project_dir: Project root directory
         spec_dir: Spec directory path
-        model: Model to use
+        model: Model to use (used as default; may be overridden by task_metadata.json)
         max_iterations: Maximum number of iterations (None for unlimited)
         verbose: Enable verbose output
         force_isolated: Force isolated workspace mode
@@ -86,14 +86,29 @@ def handle_build_command(
         debug_section,
         debug_success,
     )
+    from phase_config import get_phase_model
     from qa_loop import run_qa_validation_loop, should_run_qa
 
     from .utils import print_banner, validate_environment
 
+    # Get the resolved model for the planning phase (first phase of build)
+    # This respects task_metadata.json phase configuration from the UI
+    planning_model = get_phase_model(spec_dir, "planning", model)
+    coding_model = get_phase_model(spec_dir, "coding", model)
+    qa_model = get_phase_model(spec_dir, "qa", model)
+
     print_banner()
     print(f"\nProject directory: {project_dir}")
     print(f"Spec: {spec_dir.name}")
-    print(f"Model: {model}")
+    # Show phase-specific models if they differ
+    if planning_model != coding_model or coding_model != qa_model:
+        print(
+            f"Models: Planning={planning_model.split('-')[1] if '-' in planning_model else planning_model}, "
+            f"Coding={coding_model.split('-')[1] if '-' in coding_model else coding_model}, "
+            f"QA={qa_model.split('-')[1] if '-' in qa_model else qa_model}"
+        )
+    else:
+        print(f"Model: {planning_model}")
 
     if max_iterations:
         print(f"Max iterations: {max_iterations}")

apps/backend/cli/main.py

@@ -20,6 +20,11 @@ from ui import (
     icon,
 )
 
+from .batch_commands import (
+    handle_batch_cleanup_command,
+    handle_batch_create_command,
+    handle_batch_status_command,
+)
 from .build_commands import handle_build_command
 from .followup_commands import handle_followup_command
 from .qa_commands import (
@@ -237,6 +242,30 @@ Environment Variables:
         help="Base branch for creating worktrees (default: auto-detect or current branch)",
     )
 
+    # Batch task management
+    parser.add_argument(
+        "--batch-create",
+        type=str,
+        default=None,
+        metavar="FILE",
+        help="Create multiple tasks from a batch JSON file",
+    )
+    parser.add_argument(
+        "--batch-status",
+        action="store_true",
+        help="Show status of all specs in the project",
+    )
+    parser.add_argument(
+        "--batch-cleanup",
+        action="store_true",
+        help="Clean up completed specs (dry-run by default)",
+    )
+    parser.add_argument(
+        "--no-dry-run",
+        action="store_true",
+        help="Actually delete files in cleanup (not just preview)",
+    )
+
     return parser.parse_args()
 
 
@@ -283,6 +312,19 @@ def main() -> None:
         handle_cleanup_worktrees_command(project_dir)
         return
 
+    # Handle batch commands
+    if args.batch_create:
+        handle_batch_create_command(args.batch_create, str(project_dir))
+        return
+
+    if args.batch_status:
+        handle_batch_status_command(str(project_dir))
+        return
+
+    if args.batch_cleanup:
+        handle_batch_cleanup_command(str(project_dir), dry_run=not args.no_dry_run)
+        return
+
     # Require --spec if not listing
     if not args.spec:
         print_banner()
@@ -311,7 +353,9 @@ def main() -> None:
     if args.merge_preview:
         from cli.workspace_commands import handle_merge_preview_command
 
-        result = handle_merge_preview_command(project_dir, spec_dir.name)
+        result = handle_merge_preview_command(
+            project_dir, spec_dir.name, base_branch=args.base_branch
+        )
         # Output as JSON for the UI to parse
         import json
 
@@ -320,7 +364,10 @@ def main() -> None:
 
     if args.merge:
         success = handle_merge_command(
-            project_dir, spec_dir.name, no_commit=args.no_commit
+            project_dir,
+            spec_dir.name,
+            no_commit=args.no_commit,
+            base_branch=args.base_branch,
         )
         if not success:
             sys.exit(1)