Fix/electron local file browser

.github/workflows/release-electron.yml

@@ -0,0 +1,218 @@
+name: Release Electron
+
+# Builds and publishes the public Lody OSS desktop app for macOS, Windows and
+# Linux, plus the electron-updater metadata that drives in-app auto-update.
+#
+# The tag is the source of truth for the released version: `package-electron.mjs`
+# injects it through extraMetadata so apps/electron/package.json never silently
+# ships a stale version. electron-updater resolves its feed from the `publish`
+# block in electron-builder.yml, which electron-builder bakes into the packaged
+# app-update.yml — the public renderer build strips every VITE_* value, so the
+# cloud composition's VITE_ELECTRON_UPDATE_URL injection is not available here.
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version to package, e.g. 0.80.1 (defaults to apps/electron/package.json)'
+        required: false
+        type: string
+      publish:
+        description: 'Create/update the GitHub Release with the built artifacts'
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-electron-${{ github.ref }}
+  cancel-in-progress: false
+
+env:
+  NODE_VERSION: 22
+  COREPACK_ENABLE_DOWNLOAD_PROMPT: 0
+
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-latest
+            target: mac
+            # Both slices from one runner: beforePack swaps the embedded CLI's
+            # native bindings per arch, so a universal build is rejected upstream.
+            package_args: '--mac --arm64 --x64'
+          - os: windows-2022
+            target: win
+            package_args: '--win'
+          - os: ubuntu-latest
+            target: linux
+            # snap is deliberately omitted: electron-builder needs snapcraft on the
+            # runner to produce it. `pnpm --dir apps/electron build:linux` still
+            # builds it locally for anyone who has snapcraft installed.
+            package_args: '--linux AppImage deb'
+    runs-on: ${{ matrix.os }}
+    environment: release
+    env:
+      CSC_LINK: ${{ matrix.target == 'mac' && secrets.MACOS_CERTIFICATE_P12_BASE64 || '' }}
+      CSC_KEY_PASSWORD: ${{ matrix.target == 'mac' && secrets.MACOS_CERTIFICATE_PASSWORD || '' }}
+      CSC_NAME: ${{ matrix.target == 'mac' && secrets.MACOS_CERTIFICATE_NAME || '' }}
+      APPLE_API_KEY_P8: ${{ matrix.target == 'mac' && secrets.APPLE_API_KEY_P8 || '' }}
+      APPLE_API_KEY_ID: ${{ matrix.target == 'mac' && secrets.APPLE_API_KEY_ID || '' }}
+      APPLE_API_ISSUER: ${{ matrix.target == 'mac' && secrets.APPLE_API_ISSUER || '' }}
+      # Signing identities come from the secrets above only; never from whatever
+      # happens to be in the runner keychain.
+      CSC_IDENTITY_AUTO_DISCOVERY: 'false'
+      npm_config_msvs_version: ${{ matrix.target == 'win' && '2022' || '' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          # All four acp-extension submodules are public, so no deploy key is needed.
+          submodules: recursive
+          persist-credentials: false
+
+      - name: Resolve release version
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ "${{ github.event_name }}" == "push" ]]; then
+            version="${GITHUB_REF_NAME#v}"
+          else
+            version="${{ inputs.version }}"
+            version="${version#v}"
+          fi
+
+          if [[ -z "${version}" ]]; then
+            version="$(node -p "require('./apps/electron/package.json').version")"
+          fi
+
+          if [[ ! "${version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
+            echo "Refusing to package unparseable version: ${version}"
+            exit 1
+          fi
+
+          echo "LODY_OSS_RELEASE_VERSION=${version}" >> "$GITHUB_ENV"
+          echo "Packaging Lody OSS ${version}"
+
+      - name: Prepare macOS signing and notarization credentials
+        if: matrix.target == 'mac'
+        shell: bash
+        run: |
+          set -euo pipefail
+          required_envs=(
+            "CSC_LINK"
+            "CSC_KEY_PASSWORD"
+            "APPLE_API_KEY_P8"
+            "APPLE_API_KEY_ID"
+            "APPLE_API_ISSUER"
+          )
+          for key in "${required_envs[@]}"; do
+            if [[ -z "${!key:-}" ]]; then
+              echo "Missing required macOS signing secret: ${key}"
+              echo "macOS auto-update cannot work from an unsigned build, so this is fatal."
+              exit 1
+            fi
+          done
+
+          api_key_path="${RUNNER_TEMP}/AuthKey_${APPLE_API_KEY_ID}.p8"
+          printf '%s' "${APPLE_API_KEY_P8}" > "${api_key_path}"
+          chmod 600 "${api_key_path}"
+          echo "APPLE_API_KEY=${api_key_path}" >> "$GITHUB_ENV"
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build bundled CLI and renderer
+        run: pnpm --dir apps/electron run build
+
+      - name: Package (${{ matrix.target }})
+        run: pnpm --dir apps/electron run package -- ${{ matrix.package_args }} --publish never
+
+      - name: Collect release assets
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p release-assets
+          find apps/electron/dist -maxdepth 1 -type f \
+            \( \
+              -name 'latest*.yml' -o \
+              -name '*.blockmap' -o \
+              -name '*.exe' -o \
+              -name '*.dmg' -o \
+              -name '*.zip' -o \
+              -name '*.AppImage' -o \
+              -name '*.deb' \
+            \) \
+            -exec cp {} release-assets/ \;
+
+          if [[ -z "$(ls -A release-assets)" ]]; then
+            echo "No release assets were produced"
+            exit 1
+          fi
+          ls -la release-assets
+
+      - name: Upload release assets
+        uses: actions/upload-artifact@v4
+        with:
+          name: lody-oss-release-${{ matrix.target }}
+          path: release-assets/*
+          if-no-files-found: error
+
+  publish:
+    needs: build
+    if: github.event_name == 'push' || inputs.publish
+    runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      contents: write
+    steps:
+      - name: Download release assets
+        uses: actions/download-artifact@v4
+        with:
+          pattern: lody-oss-release-*
+          path: release-assets
+          merge-multiple: true
+
+      - name: Publish GitHub Release
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+
+          if [[ "${{ github.event_name }}" == "push" ]]; then
+            tag="${GITHUB_REF_NAME}"
+          else
+            version="${{ inputs.version }}"
+            tag="v${version#v}"
+          fi
+
+          # electron-updater's GitHub provider resolves assets from the tag that
+          # matches `v${version}`, so the tag name is part of the update contract.
+          echo "Publishing ${tag}"
+          ls -la release-assets
+
+          if gh release view "${tag}" >/dev/null 2>&1; then
+            gh release upload "${tag}" release-assets/* --clobber
+          else
+            gh release create "${tag}" release-assets/* \
+              --title "Lody OSS ${tag#v}" \
+              --generate-notes
+          fi

.gitmodules

@@ -1,6 +1,18 @@
 [submodule "packages/acp-extension-codex"]
 	path = packages/acp-extension-codex
-	url = https://github.com/loro-dev/acp-extension-codex.git
+	url = https://github.com/LodyAI/acp-extension-codex.git
 [submodule "packages/acp-extension-claude"]
 	path = packages/acp-extension-claude
-	url = https://github.com/loro-dev/acp-extension-claude.git
+	url = https://github.com/LodyAI/acp-extension-claude.git
+[submodule "packages/acp-extension-core"]
+	path = packages/acp-extension-core
+	url = https://github.com/LodyAI/acp-extension-core.git
+[submodule "packages/acp-extension-grok"]
+	path = packages/acp-extension-grok
+	url = https://github.com/LodyAI/acp-extension-grok.git
+[submodule "packages/acp-extension-kimi"]
+	path = packages/acp-extension-kimi
+	url = https://github.com/LodyAI/acp-extension-kimi.git
+[submodule "packages/acp-extension-dsh"]
+	path = packages/acp-extension-dsh
+	url = https://github.com/LodyAI/acp-extension-dsh.git

.oxlintrc.json

@@ -10,6 +10,8 @@
     "site-docs/scripts/**/*",
     "packages/acp-extension-claude/**/*",
     "packages/acp-extension-codex/**/*",
+    "packages/acp-extension-grok/**/*",
+    "packages/acp-extension-kimi/**/*",
     "site/**/*",
     "functions/**/*",
     ".codex/**/*",

AGENTS.md

@@ -36,10 +36,45 @@ private service secrets, and the Web and mobile app sources.
   not accept or discover staging/production deployment presets.
 - Local CLI, renderer, and Electron-main telemetry is hard-disabled even when
   unrelated PostHog variables exist in the caller's shell.
+- Client workflows that require daemon support negotiate integer protocol versions through
+  `MachineMeta.protocolCapabilities`; never infer support from the CLI release version. Missing
+  capabilities mean legacy/unsupported. Advertised set and version checks share one binding in
+  `packages/shared/src/machine-protocol-capabilities.ts` so a key never travels without its version.
 - Managed runtime downloads default to the public R2-backed channel owned by
   `packages/platform/src/runtime-artifacts.ts`; local and cloud assembly must use that
   same constant. `LODY_RUNTIME_BASE_URL` is only an explicit mirror override.
+- `packages/acp-extension-kimi` is an isolated submodule workspace. Do not add it
+  to the root pnpm dependency graph; Lody consumes only its separately built,
+  checksummed managed-runtime artifact and versioned ACP extension contract.
+- `packages/acp-extension-core` is a public submodule workspace sourced from
+  `LodyAI/acp-extension-core`. Keep shared ACP extension contracts there and consume
+  them through the root pnpm workspace; do not duplicate those contracts locally.
 - Never commit captured user/agent transcripts; fixtures must be synthetic.
+- Workspace MCP has exactly two durable layers: catalog entries in the workspace Flock
+  document and selected ids in each user turn input config. Do not add machine bindings.
+  Preserve `mcpServerIds: []` as an explicit empty selection; dispatch must carry the
+  driving turn's selection into ACP startup rather than rereading session history.
+- Workspace catalog mutations (MCP servers and Agent Roles) are durable on the local
+  Flock write and shared by an explicit upload that follows it. Settings surfaces resolve
+  on durability and do not wait on or report that upload: the row already exists, the
+  joined room carries the document when a one-shot upload cannot, and a banner about it is
+  something the user can neither act on nor dismiss. What is forbidden is the opposite —
+  reporting a durable write as failed, or rolling one back, because the upload did not go
+  through. The CLI still reports its own sync result to the terminal.
+- Agent Roles are one `agentRole` row family in the same workspace Flock document, not a
+  private and a shared catalog: sharing is an ordinary update of `visibility` on the row.
+  A Role stores no secret — no API key, MCP selection, memory, or permission default —
+  and `isSensitiveAgentRoleConfigOptionKey` is applied on read as well as on write,
+  because a workspace row reaches every member's client. Access is
+  `canReadAgentRole`/`canManageAgentRole` everywhere; hiding a private Role in the UI is
+  not an access check.
+- A Role never falls back. `machineId + agentConfigId` bind the execution site exactly;
+  when the machine, config, or a stored model/mode is unavailable the Role stays listed
+  with the precise reason and stops being mentionable. What a user Turn authorized is
+  frozen into its input config as `agentRoleInvocations`, so a later Role edit or delete
+  cannot change an accepted operation or a retry. `SessionMeta.agentRoleId` /
+  `agentRoleRevision` record where a Session came from and are display-only; execution,
+  recovery, and retry read the already-frozen dispatch config, never the Role catalog.
 
 `pnpm check:public-boundary` is the executable repository boundary and must pass
 after changing package scope or cloud/local composition.
@@ -53,6 +88,8 @@ after changing package scope or cloud/local composition.
 - `packages/cloud-api`: public optional-cloud client contract
 - `packages/shared`: schemas, protocols, and cross-runtime utilities
 - `packages/loro-streams-rpc`: public Streams RPC protocol/client
+- `packages/acp-extension-core`: shared public ACP extension contracts
+- `packages/acp-extension-kimi`: independently built Kimi runtime source and Lody ACP extensions
 - `site-docs`: public documentation site
 
 ## Checks and commits

THIRD_PARTY_NOTICES.md

@@ -616,7 +616,7 @@ This list covers shipped production dependencies plus vendored third-party asset
   - Author: Ben Coe
   - Description: the mighty option parser used by yargs
 
-### MIT (787)
+### MIT (789)
 
 - `@antfu/install-pkg @ 1.1.0` — https://github.com/antfu/install-pkg#readme
   - Author: Anthony Fu
@@ -1503,6 +1503,9 @@ This list covers shipped production dependencies plus vendored third-party asset
 - `emoji-regex @ 8.0.0` — https://mths.be/emoji-regex
   - Author: Mathias Bynens
   - Description: A regular expression to match all Emoji-only symbols as per the Unicode Standard.
+- `emojibase-data @ 17.0.0` — https://emojibase.dev
+  - Author: Miles Johnson
+  - Description: Aggregated emoji, shortcode, and emoticon data.
 - `empathic @ 2.0.0` — https://github.com/lukeed/empathic#readme
   - Author: Luke Edwards
   - Description: A set of small and fast Node.js utilities to understand your pathing needs.
@@ -1593,6 +1596,8 @@ This list covers shipped production dependencies plus vendored third-party asset
 - `framer-motion @ 12.34.0` — https://github.com/motiondivision/motion#readme
   - Author: Matt Perry
   - Description: A simple and powerful JavaScript animation library
+- `frimousse @ 0.3.0` — https://frimousse.liveblocks.io
+  - Description: A lightweight, unstyled, and composable emoji picker for React.
 - `fs-constants @ 1.0.0` — https://github.com/mafintosh/fs-constants
   - Author: Mathias Buus
   - Description: Require constants across node and the browser