Merge main to validate refreshed model scores

Author: Jonathan Kingston

.github/workflows/sync-model-cards.yml

@@ -2,7 +2,7 @@ name: Sync model cards
 
 # Refreshes packages/llm/src/model-cards.generated.ts from the reviewed link file
 # scripts/data/model-cards.json, discovering cards for any model still listed in
-# `wanted` and verifying that every link resolves. Opens a PR if anything moved.
+# `wanted` and checking every link for definitive link rot. Opens a PR if anything moved.
 # See packages/llm/src/model-cards.ts for the data flow.
 #
 # Discovery and verification need direct egress to vendor sites (anthropic.com,
@@ -36,8 +36,9 @@ jobs:
 
       - name: Discover and verify model cards
         # --discover fills models listed in `wanted` from each vendor's card
-        # index; --verify GETs every link and fails on link rot, so a dead card
-        # breaks this workflow instead of shipping to the value map.
+        # index; --verify GETs every link and fails on definitive 404/410 link
+        # rot. Access-control and transient failures remain warnings because
+        # they do not prove that a reviewed link is dead.
         run: npm run sync:model-cards -- --discover --verify --delay=1.5
 
       # `npm run check` covers typecheck + lint + format:check + unit tests,

Makefile

@@ -61,6 +61,12 @@ NODE_MIN_MINOR := 0
 NVM_DIR ?= $(HOME)/.nvm
 USE_NVM := if [ -s "$(NVM_DIR)/nvm.sh" ]; then set +u; . "$(NVM_DIR)/nvm.sh"; nvm use >/dev/null || true; set -u; fi
 
+# A prepared portable launcher supplies its own Node and package manager.
+# Keep the same opt-in as Electron startup and tool-availability probes.
+ifeq ($(COPSE_PRESERVE_PATH),1)
+USE_NVM := :
+endif
+
 DEV_SYNC := node scripts/sync-dev.mts
 
 # ----------------------------------------------------------------------------

docs/plans/copse-cloud-workspaces.md

@@ -183,6 +183,12 @@ loop and tool policy in control and uses a runtime Copse provisions and reconcil
   safely on human approval; and let desktop clients observe or take over after an
   explicit handoff. Start with one task in one repo. Fleet campaigns and external
   trigger ingress consume this only after single-task crash/replay behavior is proven.
+  Initial credentials use the explicitly reduced-guarantee
+  [trusted-host container delegation scope](device-bound-profile-encryption.md#initial-scope-direct-delegation-to-a-trusted-host-container):
+  short-lived read-only GitHub access, no renewal or desktop vault keys, and model
+  inference available independently of the desktop. Protected credential brokers
+  and confidential-computing infrastructure are deferred; credential-session loss
+  parks work for reauthorization rather than silently restoring secrets.
   Exit gate: disconnect the initiating desktop during model and tool execution, restart
   both sides in adversarial order, and observe one converged task with no duplicate
   provider turn, GitHub action, commit, or spine append.

docs/plans/device-bound-profile-encryption.md

@@ -0,0 +1,77 @@
+# Drive portability audit beyond #2652
+
+Audit base: `f5f1764c2` on `origin/main`, 11 September 2026. Scope: one
+external-drive development kit used sequentially on compatible Macs, following
+[PR #2652](https://github.com/copse-dev/agent-pane/pull/2652). That PR is a
+documentation proposal; its encryption, launchers and portability acceptance
+gates are not implemented by opening it. This audit leaves encryption to that
+work and identifies independently reviewable implementation slices.
+
+## Already present
+
+- `packages/store-kit/src/copse-paths.ts` centralizes profile, user-data,
+  workspace, worktree and scratch paths under `COPSE_DIR`, with granular overrides.
+- Threads and per-project stores use stable IDs; moving the root does not require
+  rewriting transcript text. Project repositories themselves are separate data.
+- `src/main/app-init.ts` resolves Electron user data before constructing stores.
+  Set both `COPSE_DIR` and `COPSE_PANEL_USER_DATA` for a prepared kit: the latter
+  bypasses automatic migration of a host's legacy profile.
+- Local provider routes already exist. A new model-provider protocol is not
+  required to use a disk-hosted local model server.
+
+## Implemented independently
+
+### Build-cache relocation
+
+The cache PR makes `scripts/patch-dev-name.mts` and `scripts/fetch-gortex.mts`
+derive their default caches from `COPSE_DIR`, while retaining dedicated cache
+overrides. Relative links allow a checkout and its cache to move together.
+Canonical parent paths handle macOS path aliases; dangling Electron links are
+recognized with `lstat`, and gortex links can be repaired from a populated cache.
+Tests move an actual directory tree and run the gortex installer against a local
+fixture cache without a download.
+
+This does not relocate pnpm/Corepack/download caches, provide missing binaries,
+or make a host-linked Git worktree an independent repository. It does not depend
+on the launch-PATH PR or encryption.
+
+### Preserve the launcher's tool selection
+
+The launch-PATH PR adds the supported `COPSE_PRESERVE_PATH=1` opt-in: Electron
+does not augment the supplied PATH, availability probes do not prepend host
+paths, and Make does not activate host nvm. Ordinary launches retain their
+existing behavior. A kit launcher must supply its own complete PATH, including
+the system commands it needs. This does not replace `HOME` or relax sandbox or
+credential filtering rules.
+
+The scope is deterministic PATH handling at these entry points. An interactive
+shell, external agent, MCP configuration, hardcoded executable or an executable's
+own dependencies can still refer to the host. No UI/layout change is involved.
+
+## Remaining PRs, in dependency order
+
+| Proposed PR                                           | Current evidence / problem                                                                                                                                                                                                                                                                                                              | Acceptance gate                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| ----------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Portable-kit manifest, inventory and launch preflight | No kit manifest or launcher exists. `package.json` releases are OS/architecture specific and macOS requires 26.0. `Makefile`, `scripts/sync-dev.mts`, postinstall scripts and native modules require supporting tools. Experimental `scripts/tauri-shell.mts` has its own home-rooted cache.                                            | A read-only report inventories app/tool/model versions, resolved executable/library/symlink paths, free space, granular overrides and paths outside the kit. Missing disk/profile/tools stop launch before creating stores or downloading anything. Both Macs pass from a clean launch environment.                                                                                                                             |
+| Structured project relocation and Git repair          | Projects persist absolute paths (`src/shared/types/state.ts`). Worktree operations resolve Git's administrative directories (`src/main/services/worktree-manager.ts`); a Copse profile alone does not contain each project's Git objects. This investigation checkout itself is a linked worktree with its admin directory on the host. | Move the kit to a different mount path containing spaces; retain project/thread IDs, current edits and active checkout associations. Check `.git`, `commondir`, submodule links and object alternates. Use independent clones and repair linked worktrees; do not replace strings in historical chat. Back up and validate a structured migration before writing.                                                               |
+| Controlled integration and child-process environment  | `src/main/services/mcp/mcp-registry.ts` reads host `.cursor/mcp.json`; skill/plugin discovery and Cursor/Claude adapters consult host homes. Terminal startup inherits `SHELL` and shell configuration. `Makefile` and app startup are only two of the environment entry points.                                                        | Prepared local MCP/skills/plugins and shell tools run on both Macs with host profiles absent. Disable automatic package downloads; isolate configuration/cache paths per tool. Preserve provider-secret stripping in `child-process-env.ts` and existing shell permissions. Hook changes must follow the binding hooks/feature-packs plan.                                                                                      |
+| Local-only operation policy                           | `resolve-agent-model.ts` can fall back to cloud models; `small-tasks-provider.ts` can fall back to the chat model. Update checks, model catalogs, external agents, web integrations and downloads are independent network users.                                                                                                        | Explicitly route every enabled role locally; prevent cloud fallback and defer external refresh/download work while retaining localhost models, MCP and previews. Complete a real edit/test task with external networking disabled, including review and title generation.                                                                                                                                                       |
+| Profile writer guard and owned-service shutdown       | `src/main/index.ts` uses Electron's local single-instance lock and bypasses it for ACP. Gortex PID validation in `semantic-index.ts` checks that a process command names gortex, not that it belongs to this profile/host/boot. Shutdown cleanup exists but is not an eject protocol.                                                   | Concurrent writers are rejected across supported entry points. A PID copied from Mac A must never authorize signaling an unrelated gortex on Mac B. Bind owned services to profile and process identity, recover stale locks carefully, flush writes and stop owned processes before reporting safe shutdown. Test interruption, unplug/reconnect and failed flush without overwriting state.                                   |
+| Pinned offline toolchain/model bundle and updates     | `COPSE_DIR` is profile relocation, not a software distribution. `make run` may install/build; native dependencies, Git helpers, browser binaries, model runtimes, compiler/SDK inputs and package caches are separate. Browser sessions also have OS-bound storage outside Copse's application cipher.                                  | Prepare artifacts online, then cold-start packaged Copse and `make run` offline on both Macs. Execute Git/worktree, PTY, search, browser and real model/tool tasks. Restore dependencies and rebuild native modules offline in a disposable checkout. Audit non-system libraries and absolute shebangs. Verify forward recovery from an interrupted update; browser authentication needs its own explicit portability decision. |
+
+The manifest/preflight and process-ownership work can start without encryption.
+Project relocation and integration policy also have independent code boundaries,
+but need migrations or behavioral decisions beyond a small path fix. The full
+launcher should compose those contracts rather than claim the two implemented
+changes establish a portable environment.
+
+## Validation and limits
+
+The implementation PRs carry their own check results. No external drive was
+modified, no user profile was migrated, and no credentials were copied during
+this audit. No two-Mac/offline/native-runtime acceptance is claimed.
+
+The final release gate remains the sequential rehearsal in #2652: cold-start
+both packaged and development builds offline on each Mac, perform a real coding
+task, stop/flush/eject, change the mount point, continue the same project/thread
+on the second Mac, then return to the first. Preserve an independent backup.

docs/plans/drive-portability-audit.md

@@ -71,6 +71,11 @@ to enforced containment.
    attaches a credential only to an authorized request and records use by opaque
    credential identity, never by value. Any temporary raw-secret injection must be
    named as a reduced guarantee, scoped, short-lived, and removed after use.
+   The initial detached-worker exception is explicit, read-only, expiring GitHub
+   user-token delegation to one task/repository container on a trusted host, as
+   specified in [the device-bound profile plan](device-bound-profile-encryption.md#initial-scope-direct-delegation-to-a-trusted-host-container).
+   It does not protect the token from the workload or host administrator, widen
+   network permissions, or delegate the desktop vault or renewal credentials.
 6. **Policy decisions and observed effects are canonical events.** Runtime state,
    approvals, process start/exit, network allow/deny, credential use, checkpoints,
    restores, and teardown append to the thread spine. Optional hooks may subscribe;

docs/plans/execution-runtime-security.md

@@ -345,6 +345,40 @@ revisiting this document, not silently diverging in an implementation PR.
     vocabulary, re-exported by the spine under its old name. Rule 4 of the execution guidance
     names the new layout.
 
+26. **First-party development actions use actor-specific consent.** For Apple Development, a
+    panel button click is the consent for that operation and does not open another approval modal.
+    The panel keeps Copse's typed, thread-owned driver: it validates the selected target, constructs
+    fixed `xcodebuild` and `simctl` arguments, records a supervised task, bounds logs and duration,
+    and resolves a macOS executable only inside the validated built app bundle. These operations run
+    with normal host access because Xcode requires package, cache, signing, developer-service, and
+    Simulator access and may execute project-controlled build phases.
+    Destination choices come from Xcode's eligible destinations for the selected scheme; a valid
+    saved choice is retained, otherwise simulator-only schemes prefer an already booted device.
+    After a successful user-triggered simulator Run, the panel opens that simulator in Copse's
+    Desktop pane. Preview presentation failure does not change the recorded Run result.
+    The project overflow menu uses a bounded filesystem-only scan to reveal Apple Development for
+    likely Xcode workspaces and already-enrolled projects. It deep-links to the existing setup panel;
+    detection alone never enrolls a project or starts the MCP server.
+
+    Agent-facing Apple tools come from the exact XcodeBuildMCP production dependency bundled with
+    Copse, rather than a smaller parallel wrapper API. Enabling the pack and enrolling a local macOS
+    project starts the server in that project root with every upstream workflow enabled; disabling
+    or unenrolling tears it down. The server is first-party configuration but its calls retain the
+    normal MCP permission policy: they prompt unless a per-tool grant or the corroborated read-only
+    policy allows them. It runs outside the generic shell sandbox after that gate because its Xcode,
+    Simulator, device, debugger, UI-automation, and package operations need host services. Build,
+    Test, and Build-and-Run calls receive `-allowProvisioningUpdates`; unrelated tools do not.
+    XcodeBuildMCP image blocks are bounded before being attached to tool results.
+
+    The pack also declares one host-native presentation tool, `open_simulator_desktop`. It does not
+    duplicate any XcodeBuildMCP build, boot, launch, or automation operation: after those operations
+    boot a Simulator, it asks Copse's existing Desktop pane to connect to that validated booted UDID.
+    The pane opens view-only and mouse/keyboard control remains an explicit user toggle. This small
+    host bridge is necessary because an external MCP server cannot address Copse renderer state.
+
+    Operation authority for the Copse panel remains process-lifetime scoped: recovery after a host
+    restart blocks before relaunch because the prior Xcode process may still be alive.
+
 ## Target architecture
 
 ```mermaid