Merge branch 'master' into chenyu/code-527

Author: AprilNEA

apps/daemon/src/__tests__/config.test.ts

@@ -269,6 +269,30 @@ describe('loadConfig accounts', () => {
   });
 });
 
+describe('saveProviderConfiguration', () => {
+  it('atomically persists providers and accounts without exposing their secrets', () => {
+    const dir = join(process.env.HOME ?? '', '.linkcode');
+    mkdirSync(dir, { recursive: true });
+    const path = join(dir, 'config.json');
+    writeFileSync(path, JSON.stringify({ hostname: '127.0.0.1' }));
+
+    saveProviderConfiguration(
+      vault,
+      { codex: { enabled: true, activeAccountId: 'acc_1', apiKey: 'sk-provider' } },
+      [validAccount],
+    );
+
+    expect(JSON.parse(readFileSync(path, 'utf8'))).toEqual({
+      hostname: '127.0.0.1',
+      providers: { codex: { enabled: true, activeAccountId: 'acc_1' } },
+      accounts: [{ ...validAccount, credential: { type: 'api-key' } }],
+    });
+    expect(vault.refs.get('provider:codex')).toBe('sk-provider');
+    expect(vault.refs.get('account:acc_1')).toBe('sk-test');
+    expect(statSync(path).mode & 0o777).toBe(0o600);
+  });
+});
+
 describe('loadConfig custom MCP servers', () => {
   const validServer = {
     id: 'custom-1',

apps/daemon/src/provider-store.ts

@@ -1,4 +1,5 @@
 import type { ProviderConfigStore } from '@linkcode/engine';
+import { accountBinding } from '@linkcode/engine';
 import type { Accounts, CustomMcpServer, ProvidersConfig } from '@linkcode/schema';
 import { saveCustomMcpServers, saveProviderConfiguration } from './config';
 import type { SecretVault } from './secrets';
@@ -33,5 +34,11 @@ export function createProviderConfigStore(
       saveCustomMcpServers(vault, next, customMcpServers);
       customMcpServers = next;
     },
+    createAndBindAccount(agent, account) {
+      const next = accountBinding(providers, accounts, agent, account);
+      saveProviderConfiguration(vault, next.providers, next.accounts);
+      providers = next.providers;
+      accounts = next.accounts;
+    },
   };
 }

apps/desktop/electron-builder.yml

@@ -78,6 +78,9 @@ extraResources:
 publish:
   provider: generic
   url: https://releases.linkcode.ai/desktop
+  # electron-updater's DifferentialDownloader wires its progress callback only on the sequential
+  # range path, so leaving this at its default true means a differential update reports no progress.
+  useMultipleRangeRequest: false
 
 # Per-arch artifacts on every platform (half the download of a universal binary). The explicit
 # ${arch} suffix is load-bearing: electron-updater picks the feed entry whose filename contains

apps/desktop/src/renderer/src/settings/__tests__/about-tab.test.tsx

@@ -1,38 +1,53 @@
 // @vitest-environment jsdom
 
-import { cleanup, render, screen } from '@testing-library/react';
-import { afterEach, describe, expect, it, vi } from 'vitest';
+import type { UpdaterState } from '@linkcode/ipc';
+import { cleanup, fireEvent, render, screen } from '@testing-library/react';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { AboutTab } from '../about-tab';
 
+const mocks = vi.hoisted(() => ({
+  useUpdaterState: vi.fn(),
+  checkForUpdates: vi.fn(),
+  installUpdate: vi.fn(),
+}));
+
 vi.mock('../../ipc', () => ({
   systemBridge: {
     app: {
-      checkForUpdates: vi.fn(),
+      checkForUpdates: mocks.checkForUpdates,
+      installUpdate: mocks.installUpdate,
       version: vi.fn(() => Promise.resolve('0.15.0')),
     },
   },
 }));
 
 vi.mock('../../updater', () => ({
-  useUpdaterState: () => ({
-    status: 'downloading',
-    version: '0.16.0',
-    progress: 42.4,
-  }),
+  useUpdaterState: mocks.useUpdaterState,
 }));
 
 vi.mock('use-intl', () => ({
   useTranslations() {
     const messages: Record<string, string> = {
       version: 'Version',
       checkForUpdates: 'Check for updates',
+      restartToInstall: 'Restart to update',
       'status.downloading': 'Downloading update…',
+      'status.downloaded': 'Update ready — restart to install.',
     };
     return (key: string) => messages[key] ?? key;
   },
 }));
 
 describe('AboutTab', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.useUpdaterState.mockReturnValue({
+      status: 'downloading',
+      version: '0.16.0',
+      progress: 42.4,
+    } satisfies UpdaterState);
+  });
+
   afterEach(cleanup);
 
   it('shows accessible update download progress', async () => {
@@ -43,4 +58,20 @@ describe('AboutTab', () => {
     expect(progress.getAttribute('aria-valuenow')).toBe('42');
     expect(screen.getByText('42%')).toBeTruthy();
   });
+
+  // Main refuses a re-check while an update sits downloaded, so the check button must not be offered.
+  it('offers the install instead of a check once the update is downloaded', () => {
+    mocks.useUpdaterState.mockReturnValue({
+      status: 'downloaded',
+      version: '0.16.0',
+      progress: null,
+    } satisfies UpdaterState);
+    render(<AboutTab />);
+
+    expect(screen.queryByRole('button', { name: 'Check for updates' })).toBeNull();
+
+    fireEvent.click(screen.getByRole('button', { name: 'Restart to update' }));
+    expect(mocks.installUpdate).toHaveBeenCalledOnce();
+    expect(mocks.checkForUpdates).not.toHaveBeenCalled();
+  });
 });

apps/desktop/src/renderer/src/settings/about-tab.tsx

@@ -41,15 +41,27 @@ export function AboutTab(): React.ReactNode {
       </Field>
       <div className="flex flex-col gap-2">
         <div className="flex items-center gap-3">
-          <Button
-            size="sm"
-            variant="outline"
-            onClick={() => {
-              void systemBridge.app.checkForUpdates();
-            }}
-          >
-            {t('checkForUpdates')}
-          </Button>
+          {/* Main refuses a re-check once an update is downloaded, so offer the install instead of a dead button. */}
+          {status === 'downloaded' ? (
+            <Button
+              size="sm"
+              onClick={() => {
+                void systemBridge.app.installUpdate();
+              }}
+            >
+              {t('restartToInstall')}
+            </Button>
+          ) : (
+            <Button
+              size="sm"
+              variant="outline"
+              onClick={() => {
+                void systemBridge.app.checkForUpdates();
+              }}
+            >
+              {t('checkForUpdates')}
+            </Button>
+          )}
           {statusKey && progressPercent === null ? (
             <span className="text-muted-foreground text-xs">{t(statusKey)}</span>
           ) : null}

apps/desktop/src/renderer/src/shell/desktop-shell.tsx

@@ -86,9 +86,7 @@ export function DesktopShell({
   NewSessionBranchPickerComponent,
   onDownloadAgent,
   onContinueUnverified,
-  onLoginAgent,
-  onSubmitLoginCode,
-  onCancelLogin,
+  onOpenProviderSettings,
   conversation,
   respondingRequestIds,
   responseErrors,
@@ -438,9 +436,7 @@ export function DesktopShell({
           topContent={<ErrorBanner errorMessage={errorMessage} onDismissError={onDismissError} />}
           onContinueUnverified={onContinueUnverified}
           onDownloadAgent={onDownloadAgent}
-          onLoginAgent={onLoginAgent}
-          onSubmitLoginCode={onSubmitLoginCode}
-          onCancelLogin={onCancelLogin}
+          onOpenProviderSettings={onOpenProviderSettings}
           onMentionQueryChange={onMentionQueryChange}
           onSubmit={onSubmitDraft}
           onPickDirectory={pickDirectory}
@@ -459,9 +455,7 @@ export function DesktopShell({
           attachmentsSupported={Boolean(active && attachmentSupport?.[active.kind])}
           cwd={active?.cwd}
           runtimeCues={runtimeCues}
-          onLoginAgent={onLoginAgent}
-          onSubmitLoginCode={onSubmitLoginCode}
-          onCancelLogin={onCancelLogin}
+          onOpenProviderSettings={onOpenProviderSettings}
           respondingRequestIds={respondingRequestIds}
           responseErrors={responseErrors}
           TerminalBlockComponent={TerminalBlockComponent}

apps/desktop/src/renderer/src/shell/desktop-workbench-shell.tsx

@@ -1,5 +1,5 @@
 import type { WorkbenchShellProps } from '@linkcode/workbench';
-import { useNavigationHistoryStore } from '@linkcode/workbench';
+import { useNavigationHistoryStore, useProvidersSettingsStore } from '@linkcode/workbench';
 import { systemBridge } from '@renderer/ipc';
 import { openDesktopSettings, useDesktopSettingsStore } from '../settings/store';
 import { DesktopShell } from './desktop-shell';
@@ -8,13 +8,17 @@ export function DesktopWorkbenchShell({ header, ...props }: WorkbenchShellProps)
   const theme = useDesktopSettingsStore((state) => state.theme);
   return (
     <DesktopShell
+      {...props}
       systemBridge={systemBridge}
       header={header}
       onOpenSettings={() => openDesktopSettings()}
+      onOpenProviderSettings={() => {
+        useProvidersSettingsStore.getState().startAdd();
+        openDesktopSettings('providers');
+      }}
       onOpenAutomations={() => useNavigationHistoryStore.getState().openOverlay('automations')}
       onImportHistory={() => openDesktopSettings('history-import')}
       themeType={theme}
-      {...props}
     />
   );
 }

apps/webview/src/shell/web-workbench-shell.tsx

@@ -4,6 +4,7 @@ import {
   getResourcesPanelPresentation,
   RESOURCES_FLOATING_COLUMN_WIDTH,
   RESOURCES_FLOATING_MIN_WORKSPACE_WIDTH,
+  useProvidersSettingsStore,
   useResourcesPanelStore,
   WorkspaceServicesMenu,
 } from '@linkcode/workbench';
@@ -58,6 +59,10 @@ export function WebWorkbenchShell({
         <ShellFrame
           {...props}
           showPlanInPromptDock={!resourcesSurfaceOpen}
+          onOpenProviderSettings={() => {
+            useProvidersSettingsStore.getState().startAdd();
+            void navigate('/settings/providers');
+          }}
           onOpenAutomations={() => {
             void navigate('/automations');
           }}

packages/client/core/src/client.ts

@@ -1,4 +1,8 @@
 import type {
+  Account,
+  AccountEndpoint,
+  AccountModel,
+  AccountSecret,
   Accounts,
   AgentEvent,
   AgentHistoryId,
@@ -416,6 +420,9 @@ export class LinkCodeClient {
       case 'skill.updated':
         this.pending.resolve('skillSetEnabled', p.replyTo, p.skill);
         break;
+      case 'config.probe-models.result':
+        this.pending.resolve('accountModels', p.replyTo, p.models);
+        break;
       case 'agent-runtime.listed':
         this.pending.resolve('agentRuntimeList', p.replyTo, p.runtimes);
         break;
@@ -821,6 +828,11 @@ export class LinkCodeClient {
     return this.control.getAccounts();
   }
 
+  /** Model list an endpoint serves, read daemon-side with a not-yet-saved secret. */
+  probeAccountModels(endpoint: AccountEndpoint, secret: AccountSecret): Promise<AccountModel[]> {
+    return this.control.probeAccountModels(endpoint, secret);
+  }
+
   /** Masked custom MCP servers (env/header keys only — the daemon never returns values). */
   getCustomMcpServers(): Promise<CustomMcpServerPublic[]> {
     return this.control.getCustomMcpServers();
@@ -1108,6 +1120,10 @@ export class LinkCodeClient {
     return this.control.setProviderConfig(providers);
   }
 
+  createAndBindAccount(agent: AgentKind, account: Account): Promise<RequestAck> {
+    return this.control.createAndBindAccount(agent, account);
+  }
+
   setAccounts(accounts: Accounts): Promise<RequestAck> {
     return this.control.setAccounts(accounts);
   }

packages/client/core/src/client/control-channel.ts

@@ -1,4 +1,8 @@
 import type {
+  Account,
+  AccountEndpoint,
+  AccountModel,
+  AccountSecret,
   Accounts,
   AgentHistoryId,
   AgentHistoryListOptions,
@@ -548,6 +552,26 @@ export class ControlChannel {
     }));
   }
 
+  createAndBindAccount(agent: AgentKind, account: Account): Promise<RequestAck> {
+    return this.sendCorrelated('ack', (clientReqId) => ({
+      kind: 'config.account.create-and-bind',
+      clientReqId,
+      agent,
+      account,
+    }));
+  }
+
+  /** Ask the daemon what an endpoint serves, using a not-yet-saved secret: the account forms offer
+   * the answer as the model picker. The daemon must do it — the renderer's CSP blocks the fetch. */
+  probeAccountModels(endpoint: AccountEndpoint, secret: AccountSecret): Promise<AccountModel[]> {
+    return this.sendCorrelated('accountModels', (clientReqId) => ({
+      kind: 'config.probe-models',
+      clientReqId,
+      endpoint,
+      secret,
+    }));
+  }
+
   /** Persist the daemon-owned global account pool (data plane). Preserves the provider config. */
   setAccounts(accounts: Accounts): Promise<RequestAck> {
     return this.sendCorrelated('ack', (clientReqId) => ({