FEA-1497: Merge main + fix build (Phase 0)

Phase 0 of the in-process agent monitor replacement (PR #264): make the
integration branch current and compilable before any feature work.

- Merge origin/main (175 commits) into feat/in-process-agent-database,
  bringing in FEA-1431 genai-prices pricing, FEA-1434 billing_mode, and
  the FEA-1435/1436 cost-reconciliation subsystem.
- Resolve conflicts:
  - app.ts: keep both 264's in-process SQLite wiring (openAgentDatabase,
    desktop:db:* IPC handlers) and main's reconciliation subsystem
    imports/wiring; drop the broken HarnessImportService import, field,
    constructor, start(), and stop() — harness-parsers/ never existed on
    the branch and was the tsc build break.
  - preload.ts: union both sides — 264's db.* bridge plus main's flags /
    ingest-progress / managed-key-hint methods.
  - package.json: bump version to 0.15.105 (above main's 0.15.104); keep
    both @playwright/test (main) and @tailwindcss/* (264).
  - index.html: keep 264's clean Vite entry (drop the monolithic shell).
  - pnpm-lock.yaml: regenerated via pnpm install against the merged
    package.json (re-links vendored @closedloop-ai/design-system).
- model_pricing is now absent from the entire desktop src (main's
  FEA-1431 removed it); the new-DB read path (src/main/database) never
  referenced it. The Phase 1 relay repoint stays out of scope.

Testing:
- just desktop-typecheck passes (tsc --noEmit, exit 0, zero errors)
- git merge-base --is-ancestor origin/main HEAD holds after this commit
- grep confirms zero model_pricing references in apps/desktop/src

Risks:
- Sidecar + iframe runtime still present (cutover is Phase 1); two SQLite
  DBs coexist by design until then. No external contract changed.
- Scope limited to Phase 0; no write path, relay repoint, or feature work
  in this commit.

Author: thadeusb

.gitignore

@@ -15,3 +15,15 @@ dist-dmg/
 
 # Generated agent-monitor runtime tree
 apps/desktop/.generated/
+.gstack/
+
+# Playwright test artifacts (apps/desktop/test-e2e)
+apps/desktop/test-results/
+apps/desktop/playwright-report/
+
+# UI Numbers Audit generated reports (FEA-1415 / PLN-738)
+# These embed a timestamp; regenerate locally via `pnpm --filter desktop audit:report`
+# or `node apps/desktop/test-e2e/agent-monitor/inventory/scan-tiles.mjs`.
+apps/desktop/test-e2e/agent-monitor/inventory/REPORT-*.md
+apps/desktop/test-e2e/agent-monitor/inventory/INVENTORY-DRAFT.md
+apps/desktop/test-e2e/agent-monitor/inventory/manifest.scanned.json

AGENTS.md

@@ -56,6 +56,8 @@ Gateway route handlers live under `apps/desktop/src/server/operations/`.
 - When classifying failed spawned commands or gateway operations, inspect every captured output stream that can feed the user-facing excerpt or diagnostic payload, not only `stderr`. Add focused coverage for stdout-only and stderr-only failure markers when the classification depends on process output.
 - When adapting cloud relay command bodies before forwarding them to local gateway routes, preserve each route handler's request contract. Add focused coverage for every route whose body is transformed, especially when one route swaps credentials and another route must keep its original payload fields.
 - When a gateway request includes `localRepoPath`, never serialize or forward the raw request path into runtime context, environment, process args, or persisted metadata after sandbox policy rejects it. Only materialize the policy-approved resolved path returned by `tryAssertRepoAllowed`/`assertPathAllowed`, such as `expandedRepoPath`; optional-repo commands that ignore a rejected path must also omit it from `.closedloop-ai/context/*` files.
+- When parsing Git CLI path output, account for Git C-quoted paths and format-specific separators instead of using JSON parsing or unqualified string splits. Add focused coverage for non-ASCII filenames, quoted filenames containing separator text, and binary add/delete metadata when the route returns file status or diff shape.
+- Git diff and numstat output does not cover every status class, especially untracked files. When a gateway response exposes file stats for mixed tracked and untracked local changes, either supplement the missing untracked metadata or explicitly document zero-value semantics, and add route-level coverage for the chosen behavior.
 
 ## Testing Guidelines
 Tests run with `tsx --test` (Node test runner) via `just desktop-test`.

CLAUDE.md

@@ -34,15 +34,32 @@ This rule does NOT apply to internal contracts that ship as a single unit with t
 
 ### Code Organization
 - **[mistake]**: When adding new operation files, do not copy-paste helper functions from existing files. Check for shared modules first. The `json()` response helper was duplicated across 33 files before being extracted into `response-utils.ts`.
+- **[mistake]**: For agent-monitor harness, parser, and build code, extract shared helpers into `agent-monitor-shared`, `parser-utils`, or nearby shared modules instead of duplicating per harness. (context: agent-monitor|duplication|helpers)
 
 ### Testing
 - **[mistake]**: When writing tests, check for existing shared test helpers (conftest, test_helpers, shared fixtures) before defining local helpers. Duplicated test setup functions drift silently when the shared contract changes. (context: tests|duplication|helpers)
+- **[mistake]**: Regression tests must assert the exact reviewed invariant, not only comments or a local surrogate path. (context: tests|coverage|regression)
 
 ### Code Quality
 - **[mistake]**: When adding code comments, verify they describe the current behavior — not a prior design or planned feature. Comments referencing non-existent files, removed fields, or superseded workflows mislead future readers. (context: comments|accuracy|stale)
 - **[mistake]**: Never fabricate history in changelogs, commit messages, or comments. Do not claim code "replaces" or "fixes" a prior implementation unless that implementation verifiably exists in the codebase or git history. (context: changelog|hallucination|fabrication)
 - **[mistake]**: Before adding a fallback or recovery path, verify the triggering condition can actually occur. Dead fallbacks that read from files never written or variables never set create false confidence in error handling. (context: dead-code|fallback|unreachable)
 
+### Agent Monitor & Sidecar Security
+- **[mistake]**: Treat localhost sidecar routes and iframe messages as privileged surfaces. Mutating routes need origin/trusted-action guards, explicit target origins, and regression coverage. (context: agent-monitor|sidecar|security)
+
+### Process Spawning & Secrets
+- **[mistake]**: Keep large or sensitive data out of spawned argv/env. Use stdin or files for prompts, quote shell args, set approved cwd, and pass minimal child environments. (context: spawn|argv|env|secrets)
+
+### Boundary Validation
+- **[mistake]**: Runtime-validate gateway, IPC, and persisted payloads before path or file use. TypeScript casts and preload promise types do not protect missing or null fields. (context: validation|ipc|gateway)
+
+### Generated Agent Monitor Runtime
+- **[pattern]**: When generated sidecar overlays, snippets, or patch inputs change, update stamp/materialization inputs and verify generated output so stale assets or bypassed patches cannot ship. (context: agent-monitor|generated|build)
+
+### State & Lifecycle
+- **[mistake]**: Setting toggles must update persisted state and in-memory side effects together. Avoid one-way restart guards, stale tray state, or stale cloud presence. (context: settings|lifecycle|state)
+
 ## Commit Messages
 
 Follow the format in `.gitmessage`. The subject line must be `<TICKET>: <description>` where TICKET is extracted from the branch name (e.g. `FEAT-68: add no-auth dev mode`). Include bullet-point body, Testing, and Risks sections.

apps/desktop/ci/README.md

@@ -0,0 +1,46 @@
+# Desktop CI workflow staging
+
+## `audit-gate.yml` — UI Numbers Audit Gate (FEA-1437 Phase 6)
+
+This is the Phase 6 CI gate for the UI Numbers Audit. It lives here, **not** in
+`.github/workflows/`, only because the automation token that opened this PR
+lacks the GitHub `workflow` OAuth scope (pushing a file under
+`.github/workflows/` is rejected without it).
+
+**To activate** (one step, needs a token/UI with `workflow` scope):
+
+```bash
+git mv apps/desktop/ci/audit-gate.yml .github/workflows/audit-gate.yml
+git commit -m "ci: activate UI Numbers Audit gate"
+```
+
+Until moved, the gate does not run automatically, but every check it performs is
+runnable locally and is identical to the existing `test:audit` suite:
+
+```bash
+pnpm -C apps/desktop audit:coverage   # static coverage gate (fast, no build)
+pnpm -C apps/desktop test:audit       # full node-side audit
+pnpm -C apps/desktop test:audit:ui    # headless Playwright tile audit
+```
+
+The workflow has two jobs:
+
+- **coverage** — runs `audit:coverage`: regenerates the tile scan + coverage
+  classification, asserts every scanner detection is classified (no
+  `needs_review`), asserts every harness parser has a `*-parser.contract.test.mjs`,
+  and posts the `by_status` breakdown to the job summary. This is the merge gate
+  that fires when a new route / tile / parser lands without manifest coverage.
+- **ui-audit** — builds the agent-monitor sidecar and runs the headless
+  Playwright tile audits (rendered DOM == oracle).
+
+Real-Electron and visual-regression suites are intentionally excluded (they run
+elsewhere as non-blocking, flaky-by-nature per PLN-760).
+
+### Branch-protection guidance (read before marking required)
+
+Mark **only the `coverage` job** as a required status check. Leave `ui-audit`
+optional (it's heavier — builds the sidecar + Playwright — and shouldn't block on
+infra flake). The workflow has **no `paths:` filter** by design: a required check
+combined with a paths filter deadlocks any PR that doesn't touch `apps/desktop/**`
+(the job never triggers, so the required status sits pending forever). Triggering
+on every PR keeps the required `coverage` check from hanging; the job is fast.

apps/desktop/ci/audit-gate.yml

@@ -0,0 +1,108 @@
+name: UI Numbers Audit Gate
+
+# FEA-1437 Phase 6 — gate PRs on the UI Numbers Audit. Two jobs:
+#   coverage  — fast, static: every scanner detection is classified (no
+#               needs_review), every harness parser has a contract test. This
+#               is the merge gate that fires when a new route / tile / parser
+#               lands without manifest coverage.
+#   ui-audit  — heavier: builds the agent-monitor sidecar and runs the headless
+#               Playwright tile audits (rendered DOM == oracle).
+# Real-Electron + visual-regression suites are intentionally NOT here; they run
+# elsewhere as non-blocking (flaky-by-nature) per PLN-760.
+#
+# NO `paths:` filter on purpose. The `coverage` job is intended to be a REQUIRED
+# status check, and "required check + paths filter" is a classic deadlock: a PR
+# that doesn't touch apps/desktop/** never triggers the job, so the required
+# status sits pending forever and the PR can't merge. Triggering on every PR
+# keeps the required check from hanging. The `coverage` job is fast; only mark
+# `coverage` as required (leave `ui-audit` optional — see apps/desktop/ci/README.md).
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+  push:
+    branches: [main]
+
+concurrency:
+  group: audit-gate-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  coverage:
+    name: Coverage gate (static)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      packages: read
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Generate build info
+        run: pnpm -r prebuild
+      - name: Audit coverage gate
+        run: pnpm -C apps/desktop audit:coverage
+      - name: Coverage summary -> job summary
+        if: always()
+        # Reporting only — never let a summary glitch fail the gate job.
+        continue-on-error: true
+        run: |
+          COV=apps/desktop/test-e2e/agent-monitor/inventory/coverage.json
+          if [ -f "$COV" ]; then
+            {
+              echo "### UI Numbers Audit — coverage"
+              echo ""
+              echo "| status | count |"
+              echo "|---|---|"
+              # Resolve to an absolute path: require() treats a bare relative
+              # string as a node_modules specifier and would throw.
+              node -e '
+                const c = require(require("path").resolve(process.env.COV));
+                for (const [k, v] of Object.entries(c.by_status)) console.log(`| ${k} | ${v} |`);
+                console.log(`| **total** | **${c.total_detections}** |`);
+              '
+            } >> "$GITHUB_STEP_SUMMARY"
+          fi
+        env:
+          COV: apps/desktop/test-e2e/agent-monitor/inventory/coverage.json
+
+  ui-audit:
+    name: UI tile audit (headless Playwright)
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    permissions:
+      contents: read
+      packages: read
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Generate build info
+        run: pnpm -r prebuild
+      - name: Install Playwright Chromium
+        run: pnpm -C apps/desktop exec playwright install --with-deps chromium
+      - name: Run headless tile audit
+        run: pnpm -C apps/desktop test:audit:ui
+      - name: Upload Playwright report on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-audit-report
+          path: apps/desktop/test-results/
+          retention-days: 7
+          if-no-files-found: ignore

apps/desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "desktop",
-  "version": "0.15.57",
+  "version": "0.15.105",
   "description": "ClosedLoop Desktop",
   "author": "ClosedLoop AI <support@closedloop.ai>",
   "private": true,
@@ -20,13 +20,27 @@
     "stage:package": "node scripts/stage-packaging-app.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "lint": "eslint src/",
-    "test": "tsx --test test/*.test.ts && node --test \"scripts/agent-monitor-packs/__tests__/*.test.js\"",
+    "test": "tsx --test test/*.test.ts && node --test \"scripts/agent-monitor-packs/__tests__/*.test.js\" \"scripts/agent-monitor-pull-requests/__tests__/*.test.js\"",
+    "pretest:contract": "pnpm build:agent-monitor",
+    "test:contract": "node --test \"test-e2e/agent-monitor/specs/api-contract/*.test.mjs\"",
+    "pretest:e2e": "pnpm build:agent-monitor",
+    "test:e2e": "playwright test --config test-e2e/agent-monitor/playwright.config.ts",
+    "pretest:audit": "pnpm build:agent-monitor && pnpm audit:scan && pnpm audit:classify",
+    "audit:scan": "node test-e2e/agent-monitor/inventory/scan-tiles.mjs",
+    "audit:classify": "node test-e2e/agent-monitor/inventory/coverage-classifier.mjs",
+    "audit:coverage": "bash scripts/check-audit-coverage.sh",
+    "test:audit": "node --test \"test-e2e/agent-monitor/specs/audit/*.test.mjs\"",
+    "pretest:audit:ui": "pnpm build:agent-monitor",
+    "test:audit:ui": "playwright test --config test-e2e/agent-monitor/playwright.audit.config.ts",
+    "preaudit:report": "pnpm build:agent-monitor",
+    "audit:report": "node test-e2e/agent-monitor/inventory/run-report.mjs",
     "package": "pnpm clean:package && pnpm build && pnpm stage:package && node scripts/run-electron-builder.mjs",
     "release": "pnpm clean:package && pnpm build && pnpm stage:package && node scripts/run-electron-builder.mjs --publish always"
   },
   "dependencies": {
     "@closedloop-ai/design-system": "file:vendor/design-system",
     "@closedloop-ai/loops-api": "0.2.11",
+    "@pydantic/genai-prices": "0.0.62",
     "agent-dashboard": "github:hoangsonww/Claude-Code-Agent-Monitor#840c518d7fa69231de049e41b893938228b67e40",
     "busboy": "^1.6.0",
     "electron-log": "^5.4.3",
@@ -44,6 +58,7 @@
     "zod": "^4.0.0"
   },
   "devDependencies": {
+    "@playwright/test": "^1.60.0",
     "@tailwindcss/postcss": "^4.3.0",
     "@tailwindcss/typography": "^0.5.19",
     "@tailwindcss/vite": "^4.3.0",