Merge pull request #133 from closedloop-ai/PLN-359

PLN-359: Add desktop managed security upgrade

Author: shafty023

.github/workflows/version-check.yml

@@ -18,7 +18,8 @@ jobs:
 
       - name: Check desktop version bump
         run: |
-          BASE="${{ github.event.pull_request.base.sha }}"
+          BASE_REF="${{ github.event.pull_request.base.ref }}"
+          BASE=$(git merge-base "origin/$BASE_REF" HEAD)
 
           OLD_VERSION=$(git show "$BASE":apps/desktop/package.json | jq -r .version)
           NEW_VERSION=$(jq -r .version apps/desktop/package.json)

AGENTS.md

@@ -17,6 +17,8 @@ Use `just` recipes from the repo root:
 
 - `just install`: install workspace dependencies.
 - `just desktop-dev`: build and run Electron locally.
+- `just desktop-no-auth`: start Electron with gateway auth disabled for local development only.
+- `just desktop-debug-auth`: start Electron with debug token minting enabled.
 - `just desktop-start`: run Electron from existing build output.
 - `just desktop-lint`: run ESLint for desktop sources.
 - `just desktop-typecheck`: run TypeScript `--noEmit`.
@@ -31,8 +33,23 @@ TypeScript is strict-mode (`tsconfig.base.json`) and ESM (`NodeNext`).
 - Follow existing style: 2-space indentation, semicolons, double quotes.
 - Prefer `kebab-case` file names (for example, `gateway-auth.ts`).
 - Keep boundaries clear between `main`, `server`, and `shared` modules.
+- Use `.js` extensions in ESM imports.
 - Prefix intentionally unused variables/args with `_` to satisfy lint rules.
 - Do not edit `apps/desktop/src/shared/build-info.ts` manually (auto-generated in prebuild).
+- Avoid unnecessary TypeScript casts. Prefer importing concrete shared types, narrowing with type guards, or shaping helper return types so call sites do not need `as` to satisfy the compiler.
+- Use shared constants, generated enums, or exported enum-like objects for statuses, reasons, protocol modes, channel names, storage keys, and other contract values. Do not duplicate hardcoded strings when a constant or enum exists.
+- Export and reuse shared TypeScript types for cross-module contracts or metadata patches instead of duplicating inline `Pick`/`Partial` shapes in callers.
+- When the same helper logic, object shape, or protocol type appears in multiple files, extract it into the nearest shared module owned by that surface instead of committing parallel copies.
+- Prefer schema-based object validation and narrowing at JSON, IPC, persisted-store, and HTTP boundaries instead of ad hoc `Record<string, unknown>` casts or manual `typeof value === "object"` checks. Reuse or colocate schemas when the shape is shared.
+- For expected service outcomes such as conflicts, invalid state transitions, missing records, validation failures, or unsupported operations, return typed domain results instead of throwing custom Error classes for control flow.
+- Avoid `instanceof` and `in` checks for routine error/result handling when a typed result discriminant or shared error code can express the branch more clearly. Reserve thrown errors and exception-style narrowing for unexpected failures or third-party APIs that require it.
+
+## Gateway Operations
+Gateway route handlers live under `apps/desktop/src/server/operations/`.
+
+- Before adding a helper to an operation file, check existing shared modules such as `response-utils.ts` for `json()` and `symphony-utils.ts` for `expandHome()`. If helper logic is used by more than one operation, extract it into a shared module instead of copying it.
+- Follow the route registration pattern: export `registerXxxRoutes(dispatcher, ...deps)` from the operation module and register it from `router.ts`.
+- Do not duplicate local response helpers across operation files.
 
 ## Testing Guidelines
 Tests run with `tsx --test` (Node test runner) via `just desktop-test`.
@@ -57,3 +74,6 @@ Commit format follows `.gitmessage` and recent history:
 - Footer sections: `Testing:` and `Risks:`.
 
 PRs should target `main`, explain what changed and why, link the ticket, and include screenshots/log snippets when UI or gateway behavior changes. Any PR that changes files under `apps/desktop/` must include a version bump in `apps/desktop/package.json`. If the current branch already has a version bump in `apps/desktop/package.json` (committed or uncommitted), do not bump again.
+
+## GitHub Review Replies
+When replying to existing GitHub PR review comments, use the review-comment REST reply endpoint (`POST /repos/{owner}/{repo}/pulls/{pull_number}/comments/{comment_id}/replies`) with the original review comment database ID. Do not use GraphQL `addPullRequestReviewThreadReply` unless you have verified in the GitHub UI or REST response model that it renders as a normal inline reply. After posting, verify the new comment has `in_reply_to_id` set to the original comment ID.

apps/desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "desktop",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "description": "ClosedLoop Desktop",
   "author": "ClosedLoop AI <support@closedloop.ai>",
   "private": true,