chore: merge main into the local-first storage epic

One conflict, in the provider hook that both sides rewrote.

Main gave saveProvider a return value so callers learn which row actually
persisted: a single-instance save keeps the earlier provider's id, and that
is the id chat target selection needs. The epic replaced the same function
with a query over the server and returned nothing.

Resolved by keeping the epic's implementation and restoring the contract.
planProviderSave already computes the row that gets written, so it returns
that. Taking either side wholesale would have been wrong: the epic's alone
silently breaks the first-run handoff, main's alone reverts the switch to
server-backed storage.

Author: DaniAkash

.github/workflows/nightly.yml

@@ -101,6 +101,7 @@ jobs:
     uses: ./.github/workflows/release-claw-server.yml
     permissions:
       contents: write
+      pull-requests: write
     with:
       mode: build
       defer_finalize: true
@@ -181,6 +182,8 @@ jobs:
     name: Build signed BrowserOS nightly
     needs: [transaction, verify-components]
     uses: ./.github/workflows/nightly-macos-product.yml
+    permissions:
+      contents: read
     with:
       product: browseros
       state_ref: ${{ needs.transaction.outputs.state_ref }}
@@ -196,6 +199,8 @@ jobs:
     name: Build signed BrowserOS neo nightly
     needs: [transaction, verify-components]
     uses: ./.github/workflows/nightly-macos-product.yml
+    permissions:
+      contents: read
     with:
       product: browserclaw
       state_ref: ${{ needs.transaction.outputs.state_ref }}
@@ -228,6 +233,7 @@ jobs:
     uses: ./.github/workflows/release-claw-server.yml
     permissions:
       contents: write
+      pull-requests: write
     with:
       mode: finalize
       state_owner: suite
@@ -273,7 +279,8 @@ jobs:
     needs: [transaction, finalize-server]
     uses: ./.github/workflows/publish-server-ota.yml
     permissions:
-      contents: read
+      contents: write
+      pull-requests: write
     with:
       product: browseros
       version: ${{ needs.transaction.outputs.server_version }}
@@ -287,7 +294,8 @@ jobs:
     needs: [transaction, finalize-claw-server]
     uses: ./.github/workflows/publish-server-ota.yml
     permissions:
-      contents: read
+      contents: write
+      pull-requests: write
     with:
       product: browserclaw
       version: ${{ needs.transaction.outputs.claw_server_version }}

packages/browseros-agent/apps/app-onboard/package.json

@@ -2,7 +2,7 @@
   "name": "@browseros/app-onboard",
   "type": "module",
   "private": true,
-  "version": "0.0.0",
+  "version": "0.0.1",
   "description": "Standalone Vite app for the BrowserOS onboarding flow (app theme, base-ui).",
   "scripts": {
     "dev": "vite",

packages/browseros-agent/apps/app/entrypoints/app/App.tsx

@@ -16,6 +16,7 @@ import { MCPSettingsPage } from '@/screens/mcp-settings/MCPSettingsPage'
 import { NewTabChat } from '@/screens/newtab/index/NewTabChat'
 import { NewTabLayout } from '@/screens/newtab/layout/NewTabLayout'
 import { Personalize } from '@/screens/newtab/personalize/Personalize'
+import { OnboardingAiPage } from '@/screens/onboarding-ai/OnboardingAiPage'
 import { ProfilePage } from '@/screens/profile/ProfilePage'
 import { ScheduledTasksPage } from '@/screens/scheduled-tasks/ScheduledTasksPage'
 import { UsagePage } from '@/screens/usage/UsagePage'
@@ -89,6 +90,13 @@ export const App: FC = () => {
 
         <Route path="features" element={<FeaturesPage />} />
 
+        {/* First-run setup, opened by the native onboarding on completion.
+            Outside every layout route on purpose: no sidebar, no chrome. */}
+        <Route path="onboarding">
+          <Route path="ai" element={<OnboardingAiPage />} />
+          <Route index element={<Navigate to="/onboarding/ai" replace />} />
+        </Route>
+
         <Route path="/" element={<Navigate to="/home" replace />} />
         <Route
           path="/personalize"

packages/browseros-agent/apps/app/modules/llm-providers/llm-providers.hooks.ts

@@ -28,7 +28,12 @@ export interface UseLlmProvidersReturn {
    * offering to set up a first provider and saying the list is unavailable.
    */
   isUnavailable: boolean
-  saveProvider: (provider: LlmProviderConfig) => Promise<void>
+  /**
+   * Resolves with the row that was actually written. A single-instance save
+   * keeps the existing provider's id, so the caller must not assume the id it
+   * passed in is the one that persisted.
+   */
+  saveProvider: (provider: LlmProviderConfig) => Promise<LlmProviderConfig>
   setDefaultProvider: (providerId: string) => Promise<void>
   deleteProvider: (providerId: string) => Promise<void>
 }
@@ -88,6 +93,10 @@ export function useLlmProviders(): UseLlmProvidersReturn {
       const { saved, removedIds } = planProviderSave(providers, provider)
       await putProvider(saved)
       for (const id of removedIds) await deleteProviderRow(id)
+      // The row that persisted, which is not always the one passed in: a
+      // single-instance save keeps the earlier provider's id, and that is the
+      // id chat target selection has to reference.
+      return saved
     },
     onSuccess: invalidate,
   })
@@ -130,9 +139,7 @@ export function useLlmProviders(): UseLlmProvidersReturn {
     selectedProvider: resolveSelectedProvider(providers, defaultProviderId),
     isLoading: providersQuery.isPending,
     isUnavailable: providersQuery.isError,
-    saveProvider: async (provider) => {
-      await saveMutation.mutateAsync(provider)
-    },
+    saveProvider: (provider) => saveMutation.mutateAsync(provider),
     setDefaultProvider,
     deleteProvider: async (providerId) => {
       await deleteMutation.mutateAsync(providerId)

packages/browseros-agent/apps/app/package.json

@@ -2,7 +2,7 @@
   "name": "@browseros/app",
   "description": "manifest.json description",
   "private": true,
-  "version": "0.0.145",
+  "version": "0.0.146",
   "type": "module",
   "scripts": {
     "dev": "test -d generated/graphql || bun run codegen; bun --env-file=../../.env.development wxt",