chore: sync the local-first storage epic with main

.github/workflows/nightly.yml

@@ -101,6 +101,7 @@ jobs:
     uses: ./.github/workflows/release-claw-server.yml
     permissions:
       contents: write
+      pull-requests: write
     with:
       mode: build
       defer_finalize: true
@@ -181,6 +182,8 @@ jobs:
     name: Build signed BrowserOS nightly
     needs: [transaction, verify-components]
     uses: ./.github/workflows/nightly-macos-product.yml
+    permissions:
+      contents: read
     with:
       product: browseros
       state_ref: ${{ needs.transaction.outputs.state_ref }}
@@ -196,6 +199,8 @@ jobs:
     name: Build signed BrowserOS neo nightly
     needs: [transaction, verify-components]
     uses: ./.github/workflows/nightly-macos-product.yml
+    permissions:
+      contents: read
     with:
       product: browserclaw
       state_ref: ${{ needs.transaction.outputs.state_ref }}
@@ -228,6 +233,7 @@ jobs:
     uses: ./.github/workflows/release-claw-server.yml
     permissions:
       contents: write
+      pull-requests: write
     with:
       mode: finalize
       state_owner: suite
@@ -273,7 +279,8 @@ jobs:
     needs: [transaction, finalize-server]
     uses: ./.github/workflows/publish-server-ota.yml
     permissions:
-      contents: read
+      contents: write
+      pull-requests: write
     with:
       product: browseros
       version: ${{ needs.transaction.outputs.server_version }}
@@ -287,7 +294,8 @@ jobs:
     needs: [transaction, finalize-claw-server]
     uses: ./.github/workflows/publish-server-ota.yml
     permissions:
-      contents: read
+      contents: write
+      pull-requests: write
     with:
       product: browserclaw
       version: ${{ needs.transaction.outputs.claw_server_version }}

packages/browseros-agent/apps/app-onboard/package.json

@@ -2,7 +2,7 @@
   "name": "@browseros/app-onboard",
   "type": "module",
   "private": true,
-  "version": "0.0.0",
+  "version": "0.0.1",
   "description": "Standalone Vite app for the BrowserOS onboarding flow (app theme, base-ui).",
   "scripts": {
     "dev": "vite",

packages/browseros-agent/apps/app/entrypoints/app/App.tsx

@@ -16,6 +16,7 @@ import { MCPSettingsPage } from '@/screens/mcp-settings/MCPSettingsPage'
 import { NewTabChat } from '@/screens/newtab/index/NewTabChat'
 import { NewTabLayout } from '@/screens/newtab/layout/NewTabLayout'
 import { Personalize } from '@/screens/newtab/personalize/Personalize'
+import { OnboardingAiPage } from '@/screens/onboarding-ai/OnboardingAiPage'
 import { ProfilePage } from '@/screens/profile/ProfilePage'
 import { ScheduledTasksPage } from '@/screens/scheduled-tasks/ScheduledTasksPage'
 import { UsagePage } from '@/screens/usage/UsagePage'
@@ -89,6 +90,13 @@ export const App: FC = () => {
 
         <Route path="features" element={<FeaturesPage />} />
 
+        {/* First-run setup, opened by the native onboarding on completion.
+            Outside every layout route on purpose: no sidebar, no chrome. */}
+        <Route path="onboarding">
+          <Route path="ai" element={<OnboardingAiPage />} />
+          <Route index element={<Navigate to="/onboarding/ai" replace />} />
+        </Route>
+
         <Route path="/" element={<Navigate to="/home" replace />} />
         <Route
           path="/personalize"

packages/browseros-agent/apps/app/modules/llm-providers/llm-providers.hooks.ts

@@ -28,7 +28,12 @@ export interface UseLlmProvidersReturn {
    * offering to set up a first provider and saying the list is unavailable.
    */
   isUnavailable: boolean
-  saveProvider: (provider: LlmProviderConfig) => Promise<void>
+  /**
+   * Resolves with the row that was actually written. A single-instance save
+   * keeps the existing provider's id, so the caller must not assume the id it
+   * passed in is the one that persisted.
+   */
+  saveProvider: (provider: LlmProviderConfig) => Promise<LlmProviderConfig>
   setDefaultProvider: (providerId: string) => Promise<void>
   deleteProvider: (providerId: string) => Promise<void>
 }
@@ -88,6 +93,10 @@ export function useLlmProviders(): UseLlmProvidersReturn {
       const { saved, removedIds } = planProviderSave(providers, provider)
       await putProvider(saved)
       for (const id of removedIds) await deleteProviderRow(id)
+      // The row that persisted, which is not always the one passed in: a
+      // single-instance save keeps the earlier provider's id, and that is the
+      // id chat target selection has to reference.
+      return saved
     },
     onSuccess: invalidate,
   })
@@ -130,9 +139,7 @@ export function useLlmProviders(): UseLlmProvidersReturn {
     selectedProvider: resolveSelectedProvider(providers, defaultProviderId),
     isLoading: providersQuery.isPending,
     isUnavailable: providersQuery.isError,
-    saveProvider: async (provider) => {
-      await saveMutation.mutateAsync(provider)
-    },
+    saveProvider: (provider) => saveMutation.mutateAsync(provider),
     setDefaultProvider,
     deleteProvider: async (providerId) => {
       await deleteMutation.mutateAsync(providerId)

packages/browseros-agent/apps/app/package.json

@@ -2,7 +2,7 @@
   "name": "@browseros/app",
   "description": "manifest.json description",
   "private": true,
-  "version": "0.0.145",
+  "version": "0.0.146",
   "type": "module",
   "scripts": {
     "dev": "test -d generated/graphql || bun run codegen; bun --env-file=../../.env.development wxt",