ship: address review feedback

Author: arul28

apps/desktop/native/ios-sim-helpers/build.sh

@@ -83,8 +83,12 @@ if [[ ! -x "$CAPTURE" || ! -x "$INPUT" ]]; then
 fi
 
 if command -v codesign >/dev/null 2>&1; then
-  codesign --force --sign - "$CAPTURE" >/dev/null 2>&1 || true
-  codesign --force --sign - "$INPUT" >/dev/null 2>&1 || true
+  if ! codesign --force --sign - "$CAPTURE" >/dev/null 2>&1; then
+    echo "warning: failed to ad-hoc sign $CAPTURE" >&2
+  fi
+  if ! codesign --force --sign - "$INPUT" >/dev/null 2>&1; then
+    echo "warning: failed to ad-hoc sign $INPUT" >&2
+  fi
 fi
 
 if [[ "$SMOKE" == "1" ]]; then

apps/desktop/package.json

@@ -186,16 +186,6 @@
       {
         "from": "scripts/ade-cli-install-path.cmd",
         "to": "ade-cli/install-path.cmd"
-      },
-      {
-        "from": "native/ios-sim-helpers",
-        "to": "native/ios-sim-helpers",
-        "filter": [
-          "README.md",
-          "build.sh",
-          "sim-capture.swift",
-          "sim-input.m"
-        ]
       }
     ],
     "afterPack": "./scripts/after-pack-runtime-fixes.cjs",
@@ -238,7 +228,19 @@
       "entitlementsInherit": "build/entitlements.mac.inherit.plist",
       "notarize": true,
       "mergeASARs": false,
-      "x64ArchFiles": "Contents/Resources/app.asar.unpacked/{node_modules,vendor}/**/*"
+      "x64ArchFiles": "Contents/Resources/app.asar.unpacked/{node_modules,vendor}/**/*",
+      "extraResources": [
+        {
+          "from": "native/ios-sim-helpers",
+          "to": "native/ios-sim-helpers",
+          "filter": [
+            "README.md",
+            "build.sh",
+            "sim-capture.swift",
+            "sim-input.m"
+          ]
+        }
+      ]
     }
   }
 }

apps/desktop/scripts/audit-chat-model-runtime.mjs

@@ -1057,7 +1057,9 @@ async function main() {
       results = await runSmokeCases(client, cases, lane.id, options);
     }
 
-    const ok = results.every((result) => result.ok);
+    const ok = options.mode === "list"
+      ? true
+      : models.length > 0 && cases.length > 0 && results.length > 0 && results.every((result) => result.ok);
     const payload = {
       ok,
       mode: options.mode,

apps/desktop/scripts/dev.cjs

@@ -208,6 +208,9 @@ async function main() {
   if (!Number.isFinite(remoteDebugPort) || remoteDebugPort <= 0 || remoteDebugPort > 65535) {
     throw new Error(`Invalid Electron remote debugging port: ${remoteDebugPortRaw}`);
   }
+  if (!(await isPortFree(remoteDebugPort))) {
+    throw new Error(`Electron remote debugging port ${remoteDebugPort} is already in use.`);
+  }
   if (process.env.ADE_APP_CONTROL_CDP_PORT) {
     process.stdout.write(`[ade] honoring ADE App Control CDP port ${remoteDebugPort}\n`);
   }

apps/desktop/src/main/services/ai/aiIntegrationService.test.ts

@@ -479,11 +479,13 @@ describe("aiIntegrationService", () => {
       verifiedAt: "2026-03-17T19:00:00.000Z",
     });
 
-    await expect(service.verifyApiKeyConnection("cursor")).resolves.toMatchObject({
+    const result = await service.verifyApiKeyConnection("cursor");
+    expect(result).toMatchObject({
       provider: "cursor",
       ok: true,
       source: "store",
     });
+    expect(JSON.stringify(result)).not.toContain("crsr_test");
 
     const refreshedStatus = await service.getStatus();
     expect(mockState.detectAllAuth.mock.calls.length).toBeGreaterThanOrEqual(3);
@@ -521,10 +523,44 @@ describe("aiIntegrationService", () => {
       errorMessage: "Cursor model API returned HTTP 401.",
     });
 
-    await expect(service.verifyApiKeyConnection("cursor")).resolves.toMatchObject({
+    const result = await service.verifyApiKeyConnection("cursor");
+    expect(result).toMatchObject({
       provider: "cursor",
       ok: false,
       source: "store",
     });
+    expect(JSON.stringify(result)).not.toContain("crsr_test");
+  });
+
+  it("does not fail Cursor verification on non-auth model probe failures", async () => {
+    const { service } = makeService({
+      providerMode: "guest",
+      availability: { claude: false, codex: false, cursor: false, droid: false },
+    });
+
+    mockState.detectAllAuth.mockResolvedValue([
+      { type: "api-key", provider: "cursor", key: "crsr_test", source: "store" },
+    ]);
+    mockState.verifyProviderApiKey.mockResolvedValue({
+      provider: "cursor",
+      ok: true,
+      message: "Connection verified successfully.",
+      endpoint: "Cursor.me",
+      statusCode: null,
+      verifiedAt: "2026-03-17T19:00:00.000Z",
+    });
+    mockState.probeCursorSdkModelDiscovery.mockResolvedValue({
+      rows: [],
+      failureKind: "unavailable",
+      errorMessage: "Cursor model API returned HTTP 503.",
+    });
+
+    const result = await service.verifyApiKeyConnection("cursor");
+    expect(result).toMatchObject({
+      provider: "cursor",
+      ok: true,
+      source: "store",
+    });
+    expect(JSON.stringify(result)).not.toContain("crsr_test");
   });
 });

apps/desktop/src/main/services/ai/aiIntegrationService.ts

@@ -970,15 +970,21 @@ export function createAiIntegrationService(args: {
       if (providerName === "cursor" && verification.ok) {
         invalidateProviderReadinessCaches();
         invalidateInFinally = false;
-        const discovery = await probeCursorSdkModelDiscovery(apiEntry.key, { timeoutMs: 3_000 });
-        if (discovery.failureKind === "auth") {
-          return {
-            ...verification,
-            ok: false,
-            message:
-              "Cursor account verification succeeded, but Cursor rejected this API key for agent/model access. Re-enter a key from the Cursor dashboard integrations page.",
-            source: apiEntry.source,
-          };
+        try {
+          const discovery = await probeCursorSdkModelDiscovery(apiEntry.key, { timeoutMs: 3_000 });
+          if (discovery.failureKind === "auth") {
+            return {
+              ...verification,
+              ok: false,
+              message:
+                "Cursor account verification succeeded, but Cursor rejected this API key for agent/model access. Re-enter a key from the Cursor dashboard integrations page.",
+              source: apiEntry.source,
+            };
+          }
+        } catch (error) {
+          logger.warn("ai.cursor.discovery_probe_failed", {
+            error: error instanceof Error ? error.message : String(error),
+          });
         }
       }
       return {

apps/desktop/src/main/services/ai/apiKeyStore.ts

@@ -163,6 +163,9 @@ function writeMacosKeychainSecret(account: string, value: string): void {
   if (!isMacosKeychainAvailable()) {
     throw new Error("macOS Keychain is unavailable. Cannot persist API keys.");
   }
+  // `/usr/bin/security add-generic-password` does not support a non-interactive
+  // stdin password sentinel: `-w -` stores a literal dash. Keep this path
+  // synchronous and tightly scoped until we replace it with a native binding.
   const result = runSecurity([
     "add-generic-password",
     "-a",
@@ -329,13 +332,13 @@ function ensureStore(): StoredKeys {
   return cache;
 }
 
-function persistEncryptedStore(): void {
-  if (!storePath || !cache) return;
+function persistEncryptedStore(nextStore: StoredKeys = cache ?? {}): void {
+  if (!storePath) return;
   if (!isSecureStorageAvailable()) {
     throw new Error("OS secure storage is unavailable. Cannot persist API keys.");
   }
   fs.mkdirSync(path.dirname(storePath), { recursive: true });
-  const encrypted = safeStorage!.encryptString(JSON.stringify(cache));
+  const encrypted = safeStorage!.encryptString(JSON.stringify(nextStore));
   fs.writeFileSync(storePath, encrypted);
   try {
     fs.chmodSync(storePath, 0o600);
@@ -385,14 +388,16 @@ export function storeApiKey(provider: string, key: string): void {
     throw new Error("Provider and key are required.");
   }
   const store = ensureStore();
-  store[normalizedProvider] = normalizedKey;
   if (isMacosKeychainAvailable()) {
     writeMacosKeychainSecret(normalizedProvider, normalizedKey);
     const index = readMacosKeychainProviderIndex();
     writeMacosKeychainProviderIndex(new Set([...index.providers, normalizedProvider]));
+    store[normalizedProvider] = normalizedKey;
     return;
   }
-  persistEncryptedStore();
+  const nextStore = { ...store, [normalizedProvider]: normalizedKey };
+  persistEncryptedStore(nextStore);
+  cache = nextStore;
 }
 
 export function getApiKey(provider: string): string | null {
@@ -413,14 +418,17 @@ export function deleteApiKey(provider: string): void {
   const normalizedProvider = provider.trim().toLowerCase();
   if (!normalizedProvider.length) return;
   const store = ensureStore();
-  delete store[normalizedProvider];
   if (isMacosKeychainAvailable()) {
     deleteMacosKeychainSecret(normalizedProvider);
     const index = readMacosKeychainProviderIndex();
     writeMacosKeychainProviderIndex(index.providers.filter((entry) => entry !== normalizedProvider));
+    delete store[normalizedProvider];
     return;
   }
-  persistEncryptedStore();
+  const nextStore = { ...store };
+  delete nextStore[normalizedProvider];
+  persistEncryptedStore(nextStore);
+  cache = nextStore;
 }
 
 export function listStoredProviders(): string[] {

apps/desktop/src/main/services/ai/authDetector.ts

@@ -15,7 +15,10 @@ import { getLocalProviderDefaultEndpoint, type LocalProviderFamily } from "../..
 import type { AiLocalProviderConfigs } from "../../../shared/types";
 import { inspectLocalProvider, clearLocalProviderInspectionCache } from "./localModelDiscovery";
 import { resolveDroidExecutable } from "./droidExecutable";
-import { reportProviderRuntimeAuthFailure } from "./providerRuntimeHealth";
+import {
+  reportProviderRuntimeAuthFailure,
+  reportProviderRuntimeReady,
+} from "./providerRuntimeHealth";
 
 type CliName = "claude" | "codex" | "cursor" | "droid";
 
@@ -804,6 +807,7 @@ async function verifyCursorApiKey(
         );
       }),
     ]);
+    reportProviderRuntimeReady("cursor");
     return {
       provider: "cursor",
       ok: true,

apps/desktop/src/main/services/ai/providerConnectionStatus.ts

@@ -94,13 +94,15 @@ export async function buildProviderConnections(
     if (!health) return;
     if (health.state === "auth-failed" || health.state === "runtime-failed") {
       status.runtimeAvailable = false;
+      status.usageAvailable = false;
       status.blocker = health.message
         ?? (health.state === "auth-failed"
           ? `${status.provider} runtime was detected, but ADE chat reported that login is still required.`
           : `${status.provider} runtime was detected, but ADE could not launch it from this app session.`);
     } else if (health.state === "ready") {
       status.runtimeAvailable = true;
       status.authAvailable = true;
+      if (status.provider === "cursor") status.usageAvailable = true;
       status.blocker = null;
     }
   }

apps/desktop/src/main/services/chat/agentChatService.test.ts

@@ -909,11 +909,9 @@ async function waitForEvent<T extends AgentChatEventEnvelope>(
 }
 
 async function waitForSessionTitle(sessionService: ReturnType<typeof createMockSessionService>, sessionId: string, title: string): Promise<void> {
-  for (let attempt = 0; attempt < 100; attempt += 1) {
-    if (sessionService.get(sessionId)?.title === title) return;
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-  throw new Error(`Timed out waiting for session title '${title}'.`);
+  await vi.waitFor(() => {
+    expect(sessionService.get(sessionId)?.title).toBe(title);
+  }, { timeout: 1_000 });
 }
 
 // ---------------------------------------------------------------------------
@@ -3363,8 +3361,7 @@ describe("createAgentChatService", () => {
         method: "thread/name/updated",
         params: { threadId: "thread-1", name: "Should Not Win" },
       });
-      await new Promise((resolve) => setTimeout(resolve, 20));
-      expect(sessionService.get(session.id)?.title).toBe("Manual Title");
+      await waitForSessionTitle(sessionService, session.id, "Manual Title");
     });
 
     it("lets OpenCode session.updated titles beat ADE AI fallback", async () => {
@@ -3401,6 +3398,9 @@ describe("createAgentChatService", () => {
       });
 
       await service.sendMessage({ sessionId: session.id, text: "Use ACP title." }, { awaitDispatch: true });
+      await vi.waitFor(() => {
+        expect(typeof mockState.droidPooled.bridge.onSessionUpdate).toBe("function");
+      }, { timeout: 1_000 });
       mockState.droidPooled.bridge.onSessionUpdate?.({
         sessionId: "droid-acp-session-1",
         update: {
@@ -5801,7 +5801,7 @@ describe("createAgentChatService", () => {
       }
     });
 
-    it("keeps the requested Codex reasoning effort while applying effective thread policy", async () => {
+    it("persists the runtime-effective Codex reasoning effort while applying effective thread policy", async () => {
       mockState.codexResponseOverrides.set("thread/start", () => ({
         thread: { id: "thread-effective-start" },
         approvalPolicy: "onFailure",
@@ -5843,18 +5843,18 @@ describe("createAgentChatService", () => {
       } | undefined;
       expect(turnStartParams?.approvalPolicy).toBe("on-failure");
       expect(turnStartParams?.sandboxPolicy?.type).toBe("workspaceWrite");
-      expect(turnStartParams?.effort).toBe("xhigh");
+      expect(turnStartParams?.effort).toBe("high");
 
       const summary = await service.getSessionSummary(session.id);
       expect(summary?.codexApprovalPolicy).toBe("on-failure");
       expect(summary?.codexSandbox).toBe("workspace-write");
       expect(summary?.permissionMode).toBe("default");
-      expect(summary?.reasoningEffort).toBe("xhigh");
+      expect(summary?.reasoningEffort).toBe("high");
 
       const persisted = readPersistedChatState(session.id);
       expect(persisted.codexApprovalPolicy).toBe("on-failure");
       expect(persisted.codexSandbox).toBe("workspace-write");
-      expect(persisted.reasoningEffort).toBe("xhigh");
+      expect(persisted.reasoningEffort).toBe("high");
     });
 
     it("re-resumes Codex threads when permission mode changes mid-session", async () => {
@@ -6185,7 +6185,7 @@ describe("createAgentChatService", () => {
       expect(sessionService.reopen).toHaveBeenCalledWith(session.id);
     });
 
-    it("keeps requested Codex reasoning effort while applying effective policy on resume", async () => {
+    it("keeps runtime-effective Codex reasoning effort while applying effective policy on resume", async () => {
       mockState.codexResponseOverrides.set("thread/resume", () => ({
         thread: { id: "thread-effective-resume" },
         approvalPolicy: "onFailure",
@@ -6219,13 +6219,13 @@ describe("createAgentChatService", () => {
       expect(resumed.codexApprovalPolicy).toBe("on-failure");
       expect(resumed.codexSandbox).toBe("workspace-write");
       expect(resumed.permissionMode).toBe("default");
-      expect(resumed.reasoningEffort).toBe("xhigh");
+      expect(resumed.reasoningEffort).toBe("high");
 
       const persistedAfter = readPersistedChatState(session.id);
       expect(persistedAfter.threadId).toBe("thread-effective-resume");
       expect(persistedAfter.codexApprovalPolicy).toBe("on-failure");
       expect(persistedAfter.codexSandbox).toBe("workspace-write");
-      expect(persistedAfter.reasoningEffort).toBe("xhigh");
+      expect(persistedAfter.reasoningEffort).toBe("high");
     });
 
     it("throws when resuming an unknown session", async () => {