feat(desktop): add App Dock sidecar tools

.github/workflows/corpus-regen.yml

@@ -0,0 +1,75 @@
+name: corpus-regen
+
+on:
+  push:
+    branches: [dev, 'feat/**']
+  pull_request:
+    branches: [dev, 'feat/**']
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  corpus-regen:
+    name: corpus regen check
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+
+      - name: Setup Bun
+        uses: ./.github/actions/setup-bun
+
+      - name: Regenerate corpus
+        working-directory: packages/desktop/docs/corpus/app-dock
+        run: node generate-corpus.mjs
+
+      - name: Verify corpus up-to-date
+        run: git diff --exit-code
+
+      - name: Lint corpus source
+        run: bunx oxlint packages/desktop/docs/corpus/app-dock/generate-corpus.mjs
+
+  typecheck:
+    name: typecheck
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+
+      - name: Setup Bun
+        uses: ./.github/actions/setup-bun
+
+      - name: Run typecheck
+        run: bun typecheck
+
+  lint:
+    name: lint
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+
+      - name: Setup Bun
+        uses: ./.github/actions/setup-bun
+
+      - name: Run oxlint
+        run: bunx oxlint packages/desktop/src/main/app-dock-live.test.ts packages/desktop/src/main/app-dock-rpc.ts packages/desktop/src/main/server.ts
+
+  live-test:
+    name: live test (macOS)
+    runs-on: macos-14
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+
+      - name: Setup Bun
+        uses: ./.github/actions/setup-bun
+
+      - name: Run live harness
+        working-directory: packages/desktop
+        run: timeout 300 bun run src/main/app-dock-live.test.ts
+        env:
+          ELECTRON_DISABLE_SECURITY_WARNINGS: "true"

packages/app/src/app.tsx

@@ -272,6 +272,68 @@ declare global {
       deepLinks?: string[]
     }
     api?: {
+      appDockOpen?: (
+        url: string,
+        bounds: { x: number; y: number; width: number; height: number },
+        profile?: string,
+      ) => Promise<{ id: string; tabID: string; generation: number; url: string }>
+      appDockDeleteProfile?: (profileID: string) => Promise<void>
+      appDockResize?: (bounds: { x: number; y: number; width: number; height: number }) => Promise<void>
+      appDockHide?: () => Promise<void>
+      appDockClose?: () => Promise<void>
+      appDockCloseTab?: (id: string) => Promise<void>
+      appDockSelect?: (id: string, bounds: { x: number; y: number; width: number; height: number }) => Promise<void>
+      appDockNavigate?: (id: string, url: string) => Promise<void>
+      appDockCommand?: (id: string, command: "back" | "forward" | "reload") => Promise<void>
+      appDockEvent?: (
+        callback: (
+          event:
+            | {
+                type: "state"
+                payload: {
+                  tabID: string
+                  generation: number
+                  url: string
+                  title: string
+                  favicon?: string
+                  loading: boolean
+                  audible: boolean
+                }
+              }
+            | {
+                type: "download"
+                payload: {
+                  id: string
+                  tabID: string
+                  generation: number
+                  filename: string
+                  receivedBytes: number
+                  totalBytes: number
+                  state: "progressing" | "paused" | "completed" | "cancelled" | "interrupted"
+                }
+              }
+            | { type: "fullscreen"; payload: { identity: { tabID: string; generation: number }; enabled: boolean } }
+            | {
+                type: "navigation-error"
+                payload: { identity: { tabID: string; generation: number }; code: "blocked" | "failed"; url: string }
+              },
+        ) => void,
+      ) => () => void
+      appDockFind?: (id: string, text: string, forward: boolean) => Promise<number>
+      appDockStopFind?: (id: string) => Promise<void>
+      appDockFindResult?: (
+        callback: (result: {
+          tabID: string
+          requestID: number
+          activeMatchOrdinal: number
+          matches: number
+          finalUpdate: boolean
+        }) => void,
+      ) => () => void
+      appDockZoom?: (id: string, factor?: number) => Promise<number>
+      appDockCancelDownload?: (id: string) => Promise<void>
+      appDockOpenDownload?: (id: string) => Promise<void>
+      appDockFullscreen?: (id: string, enabled: boolean) => Promise<void>
       setTitlebar?: (theme: { mode: "light" | "dark"; scheme?: "system" | "light" | "dark" }) => Promise<void>
       exportDebugLogs?: () => Promise<string>
     }

packages/app/src/components/dialog-connect-provider.tsx

@@ -804,9 +804,11 @@ function ProviderConnection(props: {
 
   function ApiAuthView() {
     let apiKey: HTMLInputElement | undefined
+    let labelInput: HTMLInputElement | undefined
     const errorID = createUniqueId()
     const [formStore, setFormStore] = createStore({
       value: "",
+      label: "",
       error: undefined as string | undefined,
     })
 
@@ -821,6 +823,7 @@ function ProviderConnection(props: {
       const form = e.currentTarget as HTMLFormElement
       const formData = new FormData(form)
       const apiKey = formData.get("apiKey") as string
+      const label = formData.get("label") as string
 
       if (!apiKey?.trim()) {
         setFormStore("error", language.t("provider.connect.apiKey.required"))
@@ -832,6 +835,7 @@ function ProviderConnection(props: {
         integrationID: props.provider,
         location: location(),
         key: apiKey,
+        label: label || undefined,
       })
       await complete()
     }
@@ -875,6 +879,17 @@ function ProviderConnection(props: {
                 onInput={(event) => setFormStore("value", event.currentTarget.value)}
               />
             </label>
+            <label class="flex w-full flex-col gap-1 font-[530] leading-4 text-v2-text-text-base">
+              {language.t("provider.connect.apiKey.labelOptional")}
+              <TextInputV2
+                ref={labelInput}
+                class="!w-full"
+                name="label"
+                placeholder={language.t("provider.connect.apiKey.labelPlaceholder")}
+                value={formStore.label}
+                onInput={(event) => setFormStore("label", event.currentTarget.value)}
+              />
+            </label>
             <Show when={formStore.error}>
               {(error) => (
                 <div id={errorID} role="alert" class="-mt-4 text-xs text-v2-state-fg-danger">
@@ -924,6 +939,15 @@ function ProviderConnection(props: {
             validationState={formStore.error ? "invalid" : undefined}
             error={formStore.error}
           />
+          <TextField
+            ref={labelInput}
+            type="text"
+            label={language.t("provider.connect.apiKey.labelOptional")}
+            placeholder={language.t("provider.connect.apiKey.labelPlaceholder")}
+            name="label"
+            value={formStore.label}
+            onChange={(v) => setFormStore("label", v)}
+          />
           <Button class="w-auto" type="submit" size="large" variant="primary">
             {language.t("common.continue")}
           </Button>

packages/app/src/components/dialog-subagent-models.tsx

@@ -0,0 +1,98 @@
+import { Dialog } from "@opencode-ai/ui/dialog"
+import { List } from "@opencode-ai/ui/list"
+import { Switch } from "@opencode-ai/ui/switch"
+import { Tooltip } from "@opencode-ai/ui/tooltip"
+import { Show, type Component } from "solid-js"
+import { useLocal } from "@/context/local"
+import { useLanguage } from "@/context/language"
+import { useServerSDK } from "@/context/server-sdk"
+import { useSync } from "@/context/sync"
+import { ModelTooltip } from "./model-tooltip"
+import { effectiveModelState, toggleModelRules, type ModelRule } from "./subagent-model-rules"
+import { draftVersion, modelKey, pendingSelection, togglePending } from "./draft-subagent-models"
+
+type ModelItem = ReturnType<ReturnType<typeof useLocal>["model"]["list"]>[number]
+
+export const DialogSubagentModels: Component<{ sessionID?: string; directory: string }> = (props) => {
+  const local = useLocal()
+  const language = useLanguage()
+  const serverSDK = useServerSDK()
+  const sync = useSync()
+
+  const sessionRules = (): ModelRule[] => {
+    if (!props.sessionID) return []
+    return (sync().session.get(props.sessionID)?.permission ?? []) as ModelRule[]
+  }
+
+  const isAllowed = (providerID: string, modelID: string) => {
+    // Drafts have no session yet: truth is the pending selection.
+    // draftVersion() subscribes so plain-Set mutations re-render.
+    if (!props.sessionID) {
+      draftVersion()
+      return pendingSelection(props.directory).has(modelKey(providerID, modelID))
+    }
+    return effectiveModelState(sessionRules(), providerID, modelID) === "allow"
+  }
+
+  const setAllowed = async (providerID: string, modelID: string, allow: boolean) => {
+    if (!props.sessionID) {
+      togglePending(props.directory, providerID, modelID)
+      return
+    }
+    if ((await serverSDK().protocol) !== "v1") return
+    await serverSDK().client.session.update({
+      sessionID: props.sessionID,
+      directory: props.directory,
+      permission: toggleModelRules(sessionRules(), providerID, modelID, allow),
+    })
+  }
+
+  return (
+    <Dialog
+      title={language.t("dialog.subagentModels.title")}
+      description={language.t("dialog.subagentModels.description")}
+    >
+      <List
+        class="px-3"
+        search={{ placeholder: language.t("dialog.model.search.placeholder"), autofocus: true }}
+        emptyMessage={language.t("dialog.model.empty")}
+        key={(x) => `${x?.provider?.id}:${x?.id}`}
+        items={local.model
+          .list()
+          .filter((m) => local.model.visible({ modelID: m.id, providerID: m.provider.id }))}
+        filterKeys={["provider.name", "name", "id"]}
+        sortBy={(a, b) => a.name.localeCompare(b.name)}
+        groupBy={(x) => x.provider.name}
+        groupHeader={(group) => <span>{group.items[0]?.provider.name}</span>}
+        itemWrapper={(item, node) => (
+          <Tooltip
+            class="w-full"
+            placement="right-start"
+            gutter={12}
+            openDelay={0}
+            value={<ModelTooltip model={item} />}
+          >
+            {node}
+          </Tooltip>
+        )}
+      >
+        {(item: ModelItem) => (
+          <div class="w-full flex items-center gap-x-2 text-13-regular">
+            <span class="truncate">{item.name}</span>
+            <Switch
+              class="-mr-1 ml-auto"
+              checked={isAllowed(item.provider.id, item.id)}
+              onChange={(checked) => void setAllowed(item.provider.id, item.id, checked)}
+              hideLabel
+            >
+              {item.name}
+            </Switch>
+          </div>
+        )}
+      </List>
+      <div class="text-12-regular text-text-weak px-3 pb-1">
+        {language.t("dialog.subagentModels.hint")}
+      </div>
+    </Dialog>
+  )
+}

packages/app/src/components/draft-subagent-models.test.ts

@@ -0,0 +1,33 @@
+import { describe, expect, test } from "bun:test"
+import { clearPending, modelKey, pendingRules, pendingSelection, togglePending } from "./draft-subagent-models"
+
+const DIR = "/tmp/draft-test"
+
+describe("draft subagent models", () => {
+  test("toggle adds and removes selections", () => {
+    clearPending(DIR)
+    expect(togglePending(DIR, "openrouter", "x")).toBe(true)
+    expect(pendingSelection(DIR).has(modelKey("openrouter", "x"))).toBe(true)
+    expect(togglePending(DIR, "openrouter", "x")).toBe(false)
+    expect(pendingSelection(DIR).size).toBe(0)
+    clearPending(DIR)
+  })
+
+  test("pendingRules emits deny baseline plus allows", () => {
+    clearPending(DIR)
+    expect(pendingRules(DIR)).toEqual([])
+    togglePending(DIR, "openrouter", "x")
+    togglePending(DIR, "groq", "y")
+    expect(pendingRules(DIR)).toEqual([
+      { permission: "task", pattern: "*/*", action: "deny" },
+      { permission: "task", pattern: "openrouter/x", action: "allow" },
+      { permission: "task", pattern: "groq/y", action: "allow" },
+    ])
+    clearPending(DIR)
+    expect(pendingRules(DIR)).toEqual([])
+  })
+
+  test("modelKey joins provider and model", () => {
+    expect(modelKey("openrouter", "a/b")).toBe("openrouter/a/b")
+  })
+})

packages/app/src/components/draft-subagent-models.ts

@@ -0,0 +1,57 @@
+import type { ModelRule } from "./subagent-model-rules"
+
+import { createSignal } from "solid-js"
+
+/** Pending subagent-model selections for drafts (no session exists yet).
+    Keyed by directory; flushed into session permission rules right after
+    the session is created, before the first prompt is sent — so there is
+    no race with the first task call. Entries are tiny bounded sets; they
+    are cleared on flush. */
+const pending = new Map<string, Set<string>>()
+
+const [version, bumpVersion] = createSignal(0)
+/** Reactive clock: read inside memos/render so plain-Set mutations propagate. */
+export const draftVersion = version
+
+export const modelKey = (providerID: string, modelID: string) => `${providerID}/${modelID}`
+
+export function pendingSelection(directory: string): Set<string> {
+  let set = pending.get(directory)
+  if (!set) {
+    set = new Set()
+    pending.set(directory, set)
+  }
+  return set
+}
+
+export function togglePending(directory: string, providerID: string, modelID: string): boolean {
+  const set = pendingSelection(directory)
+  const key = modelKey(providerID, modelID)
+  let next: boolean
+  if (set.has(key)) {
+    set.delete(key)
+    next = false
+  } else {
+    set.add(key)
+    next = true
+  }
+  bumpVersion((v) => v + 1)
+  return next
+}
+
+export function clearPending(directory: string) {
+  if (pending.delete(directory)) bumpVersion((v) => v + 1)
+}
+
+/** Builds the rule batch for a fresh selection: deny-all baseline plus one
+    allow per selected model (server merges, last match wins). */
+export function pendingRules(directory: string): ModelRule[] {
+  const selected = pendingSelection(directory)
+  if (selected.size === 0) return []
+  return [
+    { permission: "task", pattern: "*/*", action: "deny" as const },
+    ...[...selected].map(
+      (key): ModelRule => ({ permission: "task", pattern: key, action: "allow" as const }),
+    ),
+  ]
+}