Merge pull request 'feat: config & onboarding — each teammate connects their own Gitea (productionize Phase A)' (#51) from feat/config-onboarding into main

Reviewed-on: #51

apps/desktop/e2e/live-onboarding.spec.ts

@@ -0,0 +1,56 @@
+import { dirname, join } from 'node:path'
+import { mkdtempSync, readFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { fileURLToPath } from 'node:url'
+
+import { _electron as electron, expect, test } from '@playwright/test'
+
+const here = dirname(fileURLToPath(import.meta.url))
+const MAIN = join(here, '..', 'out', 'main', 'index.js')
+
+/** Read the real token from .env.local (walking up) so the test can fill the form. */
+function readToken(): string | null {
+  let dir = here
+  for (let i = 0; i < 6; i++) {
+    try {
+      const m = /^GITEA_TOKEN\s*=\s*(.+?)\s*$/m.exec(readFileSync(join(dir, '.env.local'), 'utf8'))
+      if (m) return m[1].trim()
+    } catch {
+      /* keep walking */
+    }
+    dir = dirname(dir)
+  }
+  return null
+}
+
+// Opt-in (GITEA_LIVE=1). Forces the onboarding path (COMMITEA_NO_ENV_LOCAL) with a
+// fresh userData, fills the real connection form, and asserts it lands on real data.
+test.describe('live onboarding', () => {
+  test('connect form → real board', async () => {
+    const token = process.env.GITEA_LIVE ? readToken() : null
+    test.skip(!token, 'GITEA_LIVE + a .env.local token required')
+    test.setTimeout(90_000)
+
+    const app = await electron.launch({
+      args: [MAIN],
+      env: { ...process.env, COMMITEA_NO_ENV_LOCAL: '1', COMMITEA_USERDATA: mkdtempSync(join(tmpdir(), 'commitea-')) },
+    })
+    const win = await app.firstWindow()
+    await win.waitForLoadState('domcontentloaded')
+
+    // the connection gate, not the app
+    await expect(win.getByText(/Connect your Gitea/)).toBeVisible({ timeout: 15000 })
+    await win.getByPlaceholder('your-org').fill('christian')
+    await win.getByPlaceholder('your-repo').fill('commitea')
+    await win.getByPlaceholder(/gitea PAT/).fill(token!)
+    await win.getByRole('button', { name: 'Connect' }).click()
+
+    // it validated + saved + reconciled into the real board — real issue titles prove it
+    const rail = win.getByRole('navigation', { name: 'Primary' })
+    await rail.getByRole('button', { name: 'The pot' }).click()
+    await expect(win.getByText(/Model router|SQLite cache bootstrap|Purity\/rebuild/).first()).toBeVisible({ timeout: 30000 })
+    await win.screenshot({ path: join(here, '.artifacts', 'screens', 'live-onboarding.png'), fullPage: true, animations: 'disabled' })
+
+    await app.close()
+  })
+})

apps/desktop/e2e/smoke.spec.ts

@@ -97,7 +97,7 @@ test('Directives: consequence diff + append-only ledger', async ({ app, window }
 test('Settings: connection, schema, and appearance sync with theme', async ({ app, window }) => {
   await app.nav('Settings').click()
   await expect(window.getByRole('heading', { name: 'Settings' })).toBeVisible()
-  await expect(window.getByText('Managed repos')).toBeVisible()
+  await expect(window.getByRole('heading', { name: 'Connection' })).toBeVisible()
   await app.screenshot('settings')
   // the Evening (dark) radio drives the shared theme
   await window.getByText('Evening (dark)').click()

apps/desktop/src/main/config-store.ts

@@ -0,0 +1,101 @@
+/**
+ * Persistent app config for a shared/team build. The gitea PAT is encrypted at
+ * rest with Electron's safeStorage (OS keychain-backed) and only ever lives in
+ * the main process — the renderer receives everything *except* the token. Config
+ * lives in userData so each teammate has their own; a `.env.local` remains a dev
+ * fallback (see resolveConfig). Nothing here runs under COMMITEA_E2E.
+ */
+
+import { readFileSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+import { app, safeStorage } from 'electron'
+
+export interface AppConfig {
+  baseUrl: string
+  owner: string
+  repo: string
+  token: string
+  /** Defaults to `${repo}-pm-state` when omitted. */
+  pmStateRepo?: string
+  /** OpenAI-compatible base for Reginald; chat stays off when absent. */
+  modelUrl?: string
+}
+
+/** The renderer-safe view — everything but the token, plus whether one is set. */
+export type PublicConfig = Omit<AppConfig, 'token'> & { hasToken: boolean }
+
+interface StoredConfig {
+  baseUrl: string
+  owner: string
+  repo: string
+  tokenEnc: string | null // base64 of safeStorage-encrypted token
+  pmStateRepo?: string
+  modelUrl?: string
+}
+
+function configPath(): string {
+  return join(app.getPath('userData'), 'commitea-config.json')
+}
+
+function readStored(): StoredConfig | null {
+  try {
+    return JSON.parse(readFileSync(configPath(), 'utf8')) as StoredConfig
+  } catch {
+    return null
+  }
+}
+
+/** Full config incl. the decrypted token, or null when unset. Main-process only. */
+export function loadConfig(): AppConfig | null {
+  const s = readStored()
+  if (!s || !s.baseUrl || !s.owner || !s.repo) return null
+  let token = ''
+  if (s.tokenEnc) {
+    try {
+      token = safeStorage.decryptString(Buffer.from(s.tokenEnc, 'base64'))
+    } catch {
+      token = '' // key rotated / different machine — treat as no token
+    }
+  }
+  if (!token) return null
+  return { baseUrl: s.baseUrl, owner: s.owner, repo: s.repo, token, pmStateRepo: s.pmStateRepo, modelUrl: s.modelUrl }
+}
+
+/** The renderer-safe view of the saved config (never includes the token). */
+export function publicConfig(): PublicConfig | null {
+  const s = readStored()
+  if (!s) return null
+  return {
+    baseUrl: s.baseUrl,
+    owner: s.owner,
+    repo: s.repo,
+    pmStateRepo: s.pmStateRepo,
+    modelUrl: s.modelUrl,
+    hasToken: !!s.tokenEnc,
+  }
+}
+
+/** Encrypt the token + persist. Best-effort; throws only on a genuine write failure. */
+export function saveConfig(cfg: AppConfig): void {
+  const tokenEnc = cfg.token
+    ? Buffer.from(safeStorage.encryptString(cfg.token)).toString('base64')
+    : (readStored()?.tokenEnc ?? null) // keep the existing token if none supplied
+  const stored: StoredConfig = {
+    baseUrl: cfg.baseUrl.trim().replace(/\/+$/, ''),
+    owner: cfg.owner.trim(),
+    repo: cfg.repo.trim(),
+    tokenEnc,
+    pmStateRepo: cfg.pmStateRepo?.trim() || undefined,
+    modelUrl: cfg.modelUrl?.trim() || undefined,
+  }
+  writeFileSync(configPath(), JSON.stringify(stored, null, 2), 'utf8')
+}
+
+export function clearConfig(): void {
+  try {
+    writeFileSync(configPath(), JSON.stringify({ baseUrl: '', owner: '', repo: '', tokenEnc: null }), 'utf8')
+  } catch {
+    // ignore
+  }
+}

apps/desktop/src/main/gitea.ts

@@ -13,6 +13,7 @@ import { dirname, join } from 'node:path'
 import {
   appendDirective,
   createGiteaClient,
+  GiteaApiError,
   type DirectiveEntry,
   type GiteaClient,
   type GiteaConfig,
@@ -28,6 +29,7 @@ import {
 } from '@commitea/core'
 import { ipcMain } from 'electron'
 
+import { type AppConfig, clearConfig, loadConfig, publicConfig, saveConfig } from './config-store.js'
 import { loadSnapshot, saveSnapshot } from './snapshot-store.js'
 
 /** Walk up from cwd looking for a .env.local with a GITEA_TOKEN (dev convenience). */
@@ -48,9 +50,15 @@ function loadEnvLocalToken(): string | undefined {
   return undefined
 }
 
-function resolveConfig(): GiteaConfig | null {
+/** Saved config wins (team build); a `.env.local` is the dev fallback; e2e uses fixtures. */
+export function resolveConfig(): GiteaConfig | null {
   // E2E runs against fixtures — never hit the network from the test harness.
   if (process.env.COMMITEA_E2E === '1') return null
+  const saved = loadConfig()
+  if (saved) return { baseUrl: saved.baseUrl, token: saved.token, owner: saved.owner, repo: saved.repo }
+  // COMMITEA_NO_ENV_LOCAL forces the onboarding path (no .env.local fallback) for testing.
+  if (process.env.COMMITEA_NO_ENV_LOCAL === '1') return null
+  // dev fallback — .env.local / env vars
   const token = process.env.GITEA_TOKEN ?? loadEnvLocalToken()
   if (!token) return null
   return {
@@ -61,8 +69,23 @@ function resolveConfig(): GiteaConfig | null {
   }
 }
 
-// Memoized client so both the gitea and model bridges share one instance.
+/** The pm-state repo name: configured, else `${repo}-pm-state`, else the env override. */
+function pmStateRepoName(config: GiteaConfig): string {
+  return loadConfig()?.pmStateRepo ?? process.env.COMMITEA_PMSTATE_REPO ?? `${config.repo}-pm-state`
+}
+
+// Memoized clients; reset via resetClients() when the config changes.
 let sharedClient: GiteaClient | null | undefined
+let pmStateClient: GiteaClient | null | undefined
+
+/** Drop the cached clients + snapshot so the next call re-reads the new config. */
+export function resetClients(): void {
+  sharedClient = undefined
+  pmStateClient = undefined
+  labelCache = null
+  invalidateSnapshot()
+}
+
 export function getGiteaClient(): GiteaClient | null {
   if (sharedClient === undefined) {
     const config = resolveConfig()
@@ -73,13 +96,10 @@ export function getGiteaClient(): GiteaClient | null {
 
 // The pm-state repo holds machine-derived state (the directive ledger). Same
 // token/host as the work repo, a different repo (the purity split, decisions D4).
-let pmStateClient: GiteaClient | null | undefined
 export function getPmStateClient(): GiteaClient | null {
   if (pmStateClient === undefined) {
     const config = resolveConfig()
-    pmStateClient = config
+    pmStateClient = config ? createGiteaClient({ ...config, repo: pmStateRepoName(config) }, fetch) : null
-      ? createGiteaClient({ ...config, repo: process.env.COMMITEA_PMSTATE_REPO ?? 'commitea-pm-state' }, fetch)
-      : null
   }
   return pmStateClient
 }
@@ -192,20 +212,38 @@ export function bootSnapshot(): (Snapshot & { savedAt: string }) | null {
 /** Agent tool calls tolerate a slightly stale snapshot (seconds) to stay responsive. */
 export const AGENT_SNAPSHOT_TTL_MS = 30_000
 
-export function registerGiteaIpc(): void {
+// Label cache is reset with the clients (module-level so resetClients can clear it).
-  const client = getGiteaClient()
+let labelCache: GiteaLabel[] | null = null
-  const repo = client ? `${process.env.GITEA_OWNER ?? 'christian'}/${process.env.GITEA_REPO ?? 'commitea'}` : null
+async function resolveLabelIds(client: GiteaClient, names: string[]): Promise<number[]> {
+  const lookup = () => new Map(labelCache!.map((l) => [l.name, l.id]))
+  if (!labelCache) labelCache = await client.listLabels()
+  let byName = lookup()
+  if (names.some((n) => !byName.has(n))) {
+    labelCache = await client.listLabels() // a name we don't know — refetch once
+    byName = lookup()
+  }
+  return names.map((n) => byName.get(n)).filter((id): id is number => id != null)
+}
 
-  ipcMain.handle('gitea:status', () => ({ configured: !!client, repo }))
+export function registerGiteaIpc(): void {
+  ipcMain.handle('gitea:status', () => {
+    const cfg = resolveConfig()
+    return {
+      configured: !!cfg,
+      repo: cfg ? `${cfg.owner}/${cfg.repo}` : null,
+      demo: process.env.COMMITEA_E2E === '1',
+    }
+  })
 
   // Instant boot: the last persisted snapshot, shown before the fresh reconcile lands.
   ipcMain.handle('gitea:boot', () => {
-    if (!client) return { configured: false }
+    if (!getGiteaClient()) return { configured: false }
     const persisted = bootSnapshot()
     return persisted ? { configured: true, cached: true, ...persisted } : { configured: true, cached: false }
   })
 
   ipcMain.handle('gitea:reconcile', async () => {
+    const client = getGiteaClient()
     if (!client) return { configured: false, issues: [], milestones: [], deps: [], timelines: {} }
     try {
       // explicit UI sync — force fresh, and warm the cache for agent tool calls
@@ -220,32 +258,20 @@ export function registerGiteaIpc(): void {
   })
 
   ipcMain.handle('gitea:getIssue', async (_event, index: number) => {
+    const client = getGiteaClient()
     if (!client) return null
     return client.getIssue(index)
   })
 
-  // Cached label list for name→id resolution; refreshed on demand if a name misses.
-  let labelCache: GiteaLabel[] | null = null
-  async function resolveLabelIds(names: string[]): Promise<number[]> {
-    if (!client) return []
-    const lookup = () => new Map(labelCache!.map((l) => [l.name, l.id]))
-    if (!labelCache) labelCache = await client.listLabels()
-    let byName = lookup()
-    if (names.some((n) => !byName.has(n))) {
-      labelCache = await client.listLabels() // a name we don't know — refetch once
-      byName = lookup()
-    }
-    return names.map((n) => byName.get(n)).filter((id): id is number => id != null)
-  }
-
   // The write path (apply_changes). Additive label swaps, applied only after the
   // renderer's propose-approve. Returns the plan + the freshly-read issue.
   ipcMain.handle('gitea:applyChange', async (_event, change: IssueChange) => {
+    const client = getGiteaClient()
     if (!client) return { ok: false as const, reason: 'unconfigured' as const }
     const current = await client.getIssue(change.issue)
     const plan = planIssueChange(current.labels, change)
     if (plan.noop) return { ok: true as const, plan, issue: current }
-    const ids = await resolveLabelIds(plan.labels)
+    const ids = await resolveLabelIds(client, plan.labels)
     await client.setIssueLabels(change.issue, ids)
     const issue = await client.getIssue(change.issue)
     invalidateSnapshot() // the board + forecast must reflect the label change
@@ -257,11 +283,12 @@ export function registerGiteaIpc(): void {
   ipcMain.handle(
     'gitea:createIssues',
     async (_event, issues: { title: string; body?: string; estimate?: string; priority?: string }[]) => {
+      const client = getGiteaClient()
       if (!client) return { ok: false as const, reason: 'unconfigured' as const }
       const created: { number: number; title: string }[] = []
       for (const it of issues) {
         const names = [it.estimate, it.priority].filter((n): n is string => !!n)
-        const labelIds = await resolveLabelIds(names)
+        const labelIds = await resolveLabelIds(client, names)
         const issue = await client.createIssue({ title: it.title, body: it.body, labelIds })
         created.push({ number: issue.number, title: issue.title })
       }
@@ -291,4 +318,33 @@ export function registerGiteaIpc(): void {
       return { ok: true as const, members: [] }
     }
   })
+
+  // ---- config (team onboarding) ----
+  ipcMain.handle('config:get', () => publicConfig())
+
+  ipcMain.handle('config:set', (_event, cfg: AppConfig) => {
+    saveConfig(cfg)
+    resetClients() // new config takes effect without a restart
+    return { ok: true as const }
+  })
+
+  ipcMain.handle('config:clear', () => {
+    clearConfig()
+    resetClients()
+    return { ok: true as const }
+  })
+
+  // Validate a token + repo before saving: any authed read on the repo proves access.
+  ipcMain.handle('config:test', async (_event, cfg: AppConfig) => {
+    try {
+      const c = createGiteaClient(
+        { baseUrl: cfg.baseUrl.replace(/\/+$/, ''), owner: cfg.owner.trim(), repo: cfg.repo.trim(), token: cfg.token },
+        fetch,
+      )
+      await c.listLabels()
+      return { ok: true as const }
+    } catch (e) {
+      return { ok: false as const, error: e instanceof GiteaApiError ? `${e.status}` : e instanceof Error ? e.message : String(e) }
+    }
+  })
 }

apps/desktop/src/main/index.ts

@@ -2,6 +2,9 @@ import { join } from 'node:path'
 
 import { BrowserWindow, app, shell } from 'electron'
 
+// Test hook: isolate config/cache to a throwaway dir (must run before any getPath).
+if (process.env.COMMITEA_USERDATA) app.setPath('userData', process.env.COMMITEA_USERDATA)
+
 import { registerGiteaIpc } from './gitea.js'
 import { registerModelIpc } from './model.js'
 

apps/desktop/src/main/model.ts

@@ -24,8 +24,9 @@ import {
   runAgentTurn,
   toDirectiveInput,
 } from '@commitea/core'
-import { ipcMain } from 'electron'
+import { app, ipcMain } from 'electron'
 
+import { loadConfig } from './config-store.js'
 import {
   AGENT_SNAPSHOT_TTL_MS,
   appendDirectiveEntry,
@@ -37,7 +38,11 @@ import {
 /** Small local model for prose + the read tool; big model reserved for later decomposition. */
 function resolveModelRouter(): ModelRouter | null {
   if (process.env.COMMITEA_E2E === '1') return null // e2e uses the scripted fixture Reginald
-  const baseUrl = process.env.COMMITEA_MODEL_URL ?? 'http://localhost:1234/v1'
+  // Config wins (team build); env is the dev override; localhost is a dev convenience only.
+  const baseUrl =
+    loadConfig()?.modelUrl ??
+    process.env.COMMITEA_MODEL_URL ??
+    (app.isPackaged ? undefined : 'http://localhost:1234/v1')
   if (!baseUrl) return null
   return {
     small: { baseUrl, model: process.env.COMMITEA_MODEL_SMALL ?? '' },
@@ -45,6 +50,19 @@ function resolveModelRouter(): ModelRouter | null {
   }
 }
 
+/** Probe the endpoint for a usable model; null when unreachable (chat then stays off). */
+async function probeModel(baseUrl: string): Promise<string | null> {
+  try {
+    const model = await resolveLoadedModel(baseUrl, process.env.COMMITEA_MODEL_SMALL ?? '')
+    // resolveLoadedModel only returns a real id when the server answered; the default
+    // fallback means unreachable, so confirm with a lightweight models call.
+    const res = await fetch(`${baseUrl.replace(/\/+$/, '')}/models`)
+    return res.ok ? model : null
+  } catch {
+    return null
+  }
+}
+
 /**
  * Resolve which model to actually ask for. An explicit env override wins;
  * otherwise ask the server which model is *loaded* (LM Studio's native
@@ -78,15 +96,15 @@ async function resolveLoadedModel(baseUrl: string, override: string): Promise<st
 }
 
 export function registerModelIpc(): void {
-  const router = resolveModelRouter()
-
   ipcMain.handle('model:status', async () => {
-    if (!router) return { configured: false, model: null }
+    const r = resolveModelRouter() // resolve fresh so a saved modelUrl takes effect
-    const model = await resolveLoadedModel(router.small.baseUrl, router.small.model)
+    if (!r) return { configured: false, model: null }
-    return { configured: true, model }
+    const model = await probeModel(r.small.baseUrl) // only "configured" if a model actually answers
+    return { configured: !!model, model }
   })
 
   ipcMain.handle('model:chat', async (event, messages: ChatMessage[]) => {
+    const router = resolveModelRouter()
     if (!router) return { ok: false as const, reason: 'unconfigured' as const }
     const client = getGiteaClient()
     const model = await resolveLoadedModel(router.small.baseUrl, router.small.model)
@@ -149,6 +167,7 @@ export function registerModelIpc(): void {
   // decomposition (with one loaded local model, that's the loaded one). Returns
   // a proposal; nothing is filed until the Capture tray approves it.
   ipcMain.handle('model:capture', async (_event, braindump: string) => {
+    const router = resolveModelRouter()
     if (!router) return { ok: false as const, reason: 'unconfigured' as const }
     const model = await resolveLoadedModel(router.big.baseUrl, router.big.model)
     const chat = createChatClient({ ...router.big, model }, fetch)

apps/desktop/src/preload/index.ts

@@ -22,6 +22,16 @@ const api = {
     /** Read the capacity config from the pm-state repo. */
     capacity: () => ipcRenderer.invoke('pmstate:capacity'),
   },
+  config: {
+    /** The saved config (never the token) — null when unset. */
+    get: () => ipcRenderer.invoke('config:get'),
+    /** Validate a token + repo before saving. */
+    test: (cfg: unknown) => ipcRenderer.invoke('config:test', cfg),
+    /** Save config (token encrypted in main); takes effect without restart. */
+    set: (cfg: unknown) => ipcRenderer.invoke('config:set', cfg),
+    /** Forget the saved config. */
+    clear: () => ipcRenderer.invoke('config:clear'),
+  },
   model: {
     /** Whether a model endpoint is configured (else the UI keeps the scripted Reginald). */
     status: () => ipcRenderer.invoke('model:status'),

apps/desktop/src/renderer/src/components/screens/connect-screen.tsx

@@ -0,0 +1,117 @@
+import React from 'react'
+
+import type { PublicConfig } from '../../global.js'
+import logoIcon from '../../design/assets/logo-icon.png'
+import { Button, Card, Input } from '../ui/index.js'
+
+/**
+ * Real onboarding — each teammate connects their own Gitea with a personal access
+ * token. The token is validated (an authed read on the repo) then saved encrypted
+ * in the main process (never exposed to this renderer). Optional model URL wires
+ * Reginald; leave it blank and chat simply stays off.
+ */
+export function ConnectScreen({ onConnected, existing }: { onConnected: () => void; existing?: PublicConfig | null }) {
+  const [baseUrl, setBaseUrl] = React.useState(existing?.baseUrl ?? 'https://gitea.stephenmann.io')
+  const [owner, setOwner] = React.useState(existing?.owner ?? '')
+  const [repo, setRepo] = React.useState(existing?.repo ?? '')
+  const [token, setToken] = React.useState('')
+  const [modelUrl, setModelUrl] = React.useState(existing?.modelUrl ?? '')
+  const [state, setState] = React.useState<'idle' | 'testing' | 'saving'>('idle')
+  const [error, setError] = React.useState<string | null>(null)
+
+  const cfg = () => ({ baseUrl, owner, repo, token, modelUrl: modelUrl.trim() || undefined })
+  const ready = baseUrl.trim() && owner.trim() && repo.trim() && (token.trim() || existing?.hasToken)
+
+  const connect = async () => {
+    setError(null)
+    setState('testing')
+    // reuse the saved token when editing and the field is left blank
+    const payload = token.trim() ? cfg() : { ...cfg(), token: '' }
+    if (token.trim()) {
+      const test = await window.commitea.config.test(cfg()).catch(() => ({ ok: false, error: 'unreachable' }))
+      if (!test.ok) {
+        setState('idle')
+        setError(
+          test.error === '404'
+            ? "Couldn't find that repo — check owner/name and that the token can see it."
+            : test.error === '401' || test.error === '403'
+              ? 'The token was rejected — check it has repo + issue scopes.'
+              : `Connection failed${test.error ? ` (${test.error})` : ''}.`,
+        )
+        return
+      }
+    }
+    setState('saving')
+    await window.commitea.config.set(payload)
+    onConnected()
+  }
+
+  const field = (
+    label: string,
+    value: string,
+    set: (v: string) => void,
+    opts: { placeholder?: string; type?: string; hint?: string } = {},
+  ) => (
+    <div style={{ display: 'flex', flexDirection: 'column', gap: 5 }}>
+      <Input
+        label={label}
+        value={value}
+        type={opts.type}
+        placeholder={opts.placeholder}
+        onChange={(e) => set(e.target.value)}
+      />
+      {opts.hint ? <span style={{ font: 'var(--text-caption)', color: 'var(--ink-3)' }}>{opts.hint}</span> : null}
+    </div>
+  )
+
+  return (
+    <div
+      style={{
+        height: '100vh',
+        display: 'flex',
+        alignItems: 'center',
+        justifyContent: 'center',
+        background: 'var(--surface-app)',
+        padding: 24,
+      }}
+    >
+      <Card style={{ width: 460, maxWidth: '100%' }}>
+        <div style={{ display: 'flex', alignItems: 'center', gap: 10, marginBottom: 6 }}>
+          <img src={logoIcon} width="28" height="28" alt="" style={{ borderRadius: 7, display: 'block' }} />
+          <span style={{ font: '400 24px/1 var(--font-serif-display)', color: 'var(--ink-1)' }}>
+            Commi<span style={{ color: 'var(--accent-text)' }}>Tea</span>
+          </span>
+        </div>
+        <p style={{ font: 'var(--text-body)', color: 'var(--ink-2)', margin: '0 0 18px' }}>
+          Connect your Gitea. Your token is stored encrypted on this machine and never leaves it.
+        </p>
+
+        <div style={{ display: 'flex', flexDirection: 'column', gap: 12 }}>
+          {field('Gitea URL', baseUrl, setBaseUrl, { placeholder: 'https://gitea.example.com' })}
+          <div style={{ display: 'grid', gridTemplateColumns: '1fr 1fr', gap: 12 }}>
+            {field('Owner', owner, setOwner, { placeholder: 'your-org' })}
+            {field('Repository', repo, setRepo, { placeholder: 'your-repo' })}
+          </div>
+          {field('Access token', token, setToken, {
+            type: 'password',
+            placeholder: existing?.hasToken ? '•••••••• (saved — leave blank to keep)' : 'gitea PAT · scopes: repo + issue',
+          })}
+          {field('Model URL', modelUrl, setModelUrl, {
+            placeholder: 'http://localhost:1234/v1',
+            hint: 'Optional — an OpenAI-compatible endpoint for Reginald. Leave blank to keep chat off.',
+          })}
+        </div>
+
+        {error ? (
+          <p style={{ font: 'var(--text-agent)', color: 'var(--danger)', margin: '12px 0 0' }}>{error}</p>
+        ) : null}
+
+        <div style={{ display: 'flex', gap: 10, marginTop: 18 }}>
+          <Button onClick={() => void connect()} disabled={!ready || state !== 'idle'}>
+            {state === 'testing' ? 'Checking…' : state === 'saving' ? 'Connecting…' : existing ? 'Save' : 'Connect'}
+          </Button>
+        </div>
+      </Card>
+    </div>
+  )
+}

apps/desktop/src/renderer/src/components/screens/settings-screen.tsx

@@ -1,9 +1,22 @@
 import React from 'react'
 
+import type { PublicConfig } from '../../global.js'
 import { Badge, Button, Card, Icon, IconButton, Input, Radio, Select, Switch, Tag } from '../ui/index.js'
 
 // Settings — gitea connection, sync, model roles, labels, rituals, appearance
-export function SettingsScreen({ dark, setDark }: { dark: boolean; setDark: (v: boolean) => void }) {
+export function SettingsScreen({
+  dark,
+  setDark,
+  connection,
+  onReconnect,
+  onDisconnect,
+}: {
+  dark: boolean
+  setDark: (v: boolean) => void
+  connection?: PublicConfig | null
+  onReconnect?: () => void
+  onDisconnect?: () => void
+}) {
   const [webhooks, setWebhooks] = React.useState(true)
   const [reconcile, setReconcile] = React.useState(true)
   const [poll, setPoll] = React.useState(true)
@@ -24,25 +37,35 @@ export function SettingsScreen({ dark, setDark }: { dark: boolean; setDark: (v:
       </header>
 
       <Card overline="Gitea" title="Connection">
-        <div style={{ display: 'flex', flexDirection: 'column', gap: 14 }}>
+        <div style={{ display: 'flex', flexDirection: 'column', gap: 12 }}>
-          <Input label="Base URL" icon="link" mono defaultValue="https://gitea.stephenmann.io" />
+          {connection ? (
-          <Input label="Access token" icon="keyboard" mono type="password" defaultValue="ct_9f2e81c4a7d6" hint="Scopes: repo, issue. Nothing more." />
+            <>
-          <div style={{ display: 'flex', flexDirection: 'column', gap: 8 }}>
-            <span style={{ font: '600 13px/1.2 var(--font-sans)', color: 'var(--ink-1)' }}>Managed repos</span>
               <Row style={{ padding: '8px 12px', background: 'var(--paper-0)', border: '1px solid var(--line-1)', borderRadius: 'var(--radius-2)' }}>
                 <Icon name="git-branch" size={14} style={{ color: 'var(--ink-3)' }} />
-              <span style={{ font: 'var(--text-data)', color: 'var(--ink-1)', flex: 1 }}>stephen/commitea</span>
+                <span style={{ font: 'var(--text-data)', color: 'var(--ink-1)', flex: 1 }}>{connection.owner}/{connection.repo}</span>
-              <Badge tone="ok" dot>syncing</Badge>
+                <Badge tone="ok" dot>connected</Badge>
-              <IconButton icon="x" label="Stop managing" size="sm" />
               </Row>
-            <Row style={{ padding: '8px 12px', background: 'var(--paper-0)', border: '1px solid var(--line-1)', borderRadius: 'var(--radius-2)' }}>
+              <Row style={{ font: 'var(--text-caption)', color: 'var(--ink-3)', gap: 6 }}>
-              <Icon name="layers" size={14} style={{ color: 'var(--ink-3)' }} />
+                <Icon name="link" size={12} />{connection.baseUrl}
-              <span style={{ font: 'var(--text-data)', color: 'var(--ink-1)', flex: 1 }}>stephen/pm-state</span>
-              <Badge>sidecar</Badge>
               </Row>
-            <Note>The sidecar holds machine-derived state only. Delete it and resync — no truth is lost.</Note>
+              <Row style={{ font: 'var(--text-caption)', color: 'var(--ink-3)', gap: 6 }}>
-            <Button variant="secondary" size="sm" icon="plus" style={{ alignSelf: 'flex-start' }}>Add repo</Button>
+                <Icon name="layers" size={12} />sidecar: {connection.pmStateRepo ?? `${connection.repo}-pm-state`}
-          </div>
+              </Row>
+              <Row style={{ font: 'var(--text-caption)', color: 'var(--ink-3)', gap: 6 }}>
+                <Icon name="sparkles" size={12} />model: {connection.modelUrl ?? 'not set — chat off'}
+              </Row>
+              <Note>Your token is stored encrypted on this machine. Delete the sidecar and resync — no truth is lost.</Note>
+              <Row style={{ gap: 8, marginTop: 2 }}>
+                <Button variant="secondary" size="sm" icon="settings-2" onClick={onReconnect}>Reconfigure</Button>
+                <Button variant="ghost" size="sm" onClick={onDisconnect}>Disconnect</Button>
+              </Row>
+            </>
+          ) : (
+            <Row style={{ gap: 8 }}>
+              <Note>Not connected.</Note>
+              <Button variant="secondary" size="sm" onClick={onReconnect}>Connect</Button>
+            </Row>
+          )}
         </div>
       </Card>
 

apps/desktop/src/renderer/src/components/shell/app-shell.tsx

@@ -3,7 +3,9 @@ import React, { useEffect, useState } from 'react'
 import logoIcon from '../../design/assets/logo-icon.png'
 import type { IssueChange } from '@commitea/core'
 
+import type { PublicConfig } from '../../global.js'
 import type { IssueRef } from '../../data/fixtures.js'
+import { ConnectScreen } from '../screens/connect-screen.js'
 import {
   backlogCalibration,
   capacityWorkers,
@@ -97,6 +99,8 @@ export function AppShell() {
   const [issue, setIssue] = useState<IssueRef | null>(null)
   const [readIds, setReadIds] = useState<number[]>([])
   const [milestoneId, setMilestoneId] = useState<number | null>(null)
+  const [gate, setGate] = useState<'checking' | 'connect' | 'ready'>('checking')
+  const [pubConfig, setPubConfig] = useState<PublicConfig | null>(null)
   const [backlog, refetchBacklog] = useBacklog()
   const capacityMembers = useCapacity()
   const workers = capacityWorkers(capacityMembers)
@@ -132,6 +136,16 @@ export function AppShell() {
     document.documentElement.setAttribute('data-theme', dark ? 'dark' : 'light')
   }, [dark])
 
+  // Gate: e2e/demo → the shell (fixtures); configured → the shell (real data);
+  // otherwise → the connect screen (each teammate brings their own token).
+  useEffect(() => {
+    window.commitea.gitea
+      .status()
+      .then((s) => setGate(s.demo || s.configured ? 'ready' : 'connect'))
+      .catch(() => setGate('connect'))
+    window.commitea.config.get().then(setPubConfig).catch(() => {})
+  }, [])
+
   const openIssue = (ref: IssueRef) => {
     if (view !== 'issue') setPrevView(view)
     setIssue(ref)
@@ -250,7 +264,20 @@ export function AppShell() {
       case 'directives':
         return <DirectivesScreen />
       case 'settings':
-        return <SettingsScreen dark={dark} setDark={setDark} />
+        return (
+          <SettingsScreen
+            dark={dark}
+            setDark={setDark}
+            connection={pubConfig}
+            onReconnect={() => setGate('connect')}
+            onDisconnect={() => {
+              void window.commitea.config.clear().then(() => {
+                setPubConfig(null)
+                setGate('connect')
+              })
+            }}
+          />
+        )
       case 'issue':
         return issue ? (
           <IssueScreen
@@ -270,6 +297,23 @@ export function AppShell() {
     }
   }
 
+  // Connection gate (real onboarding) comes before everything else.
+  if (gate === 'checking') {
+    return <div style={{ height: '100vh', background: 'var(--surface-app)' }} />
+  }
+  if (gate === 'connect') {
+    return (
+      <ConnectScreen
+        existing={pubConfig}
+        onConnected={() => {
+          window.commitea.config.get().then(setPubConfig).catch(() => {})
+          setGate('ready')
+          refetchBacklog()
+        }}
+      />
+    )
+  }
+
   // First run is full-window — no rail, no chat panel
   if (view === 'firstrun') {
     return <OnboardingScreen onDone={(dest) => setView(dest)} />

apps/desktop/src/renderer/src/components/shell/chat-panel.tsx

@@ -62,7 +62,7 @@ export function ChatPanel({ onOpenDirectives, offline, onApplyChange }: ChatPane
         <Icon name="sparkles" size={16} style={{ color: offline ? 'var(--ink-3)' : 'var(--jade)' }} />
         <span style={{ font: 'var(--text-body-strong)', color: 'var(--ink-1)' }}>Reginald</span>
         <span style={{ font: '400 11px var(--font-mono)', color: 'var(--ink-3)', marginLeft: 'auto' }}>
-          {offline ? 'offline · queueing' : live ? `${modelLabel} · local` : 'demo · scripted'}
+          {offline ? 'offline · queueing' : live ? `${modelLabel} · local` : 'no model'}
         </span>
         <IconButton icon="history" label="Directive log" size="sm" onClick={onOpenDirectives} />
       </header>
@@ -161,8 +161,8 @@ export function ChatPanel({ onOpenDirectives, offline, onApplyChange }: ChatPane
                 send()
               }
             }}
-            placeholder={offline ? 'Writes wait for the connection…' : 'Tell me what to do…'}
+            placeholder={offline ? 'Writes wait for the connection…' : live ? 'Tell me what to do…' : 'Add a Model URL in Settings…'}
-            disabled={offline}
+            disabled={offline || !live}
             rows={1}
             style={{
               flex: 1,
@@ -180,15 +180,15 @@ export function ChatPanel({ onOpenDirectives, offline, onApplyChange }: ChatPane
             type="button"
             onClick={send}
             aria-label="Send"
-            disabled={offline}
+            disabled={offline || !live}
             style={{
               width: 30,
               height: 30,
               borderRadius: 'var(--radius-2)',
               border: 'none',
-              cursor: offline ? 'not-allowed' : 'pointer',
+              cursor: offline || !live ? 'not-allowed' : 'pointer',
-              background: offline ? 'var(--paper-3)' : 'var(--accent)',
+              background: offline || !live ? 'var(--paper-3)' : 'var(--accent)',
-              color: offline ? 'var(--ink-3)' : 'var(--ink-inverse)',
+              color: offline || !live ? 'var(--ink-3)' : 'var(--ink-inverse)',
               display: 'inline-flex',
               alignItems: 'center',
               justifyContent: 'center',

apps/desktop/src/renderer/src/global.d.ts

@@ -49,9 +49,37 @@ export type BootPayload =
   | { configured: true; cached: false }
   | ({ configured: true; cached: true } & Omit<SnapshotPayload, 'configured'>)
 
+/** The saved connection config (never includes the token). */
+export interface PublicConfig {
+  baseUrl: string
+  owner: string
+  repo: string
+  pmStateRepo?: string
+  modelUrl?: string
+  hasToken: boolean
+}
+
+/** What the onboarding/settings form submits. */
+export interface ConfigInput {
+  baseUrl: string
+  owner: string
+  repo: string
+  token: string
+  pmStateRepo?: string
+  modelUrl?: string
+}
+
+/** The config bridge for team onboarding. */
+export interface ConfigBridge {
+  get(): Promise<PublicConfig | null>
+  test(cfg: ConfigInput): Promise<{ ok: boolean; error?: string }>
+  set(cfg: ConfigInput): Promise<{ ok: boolean }>
+  clear(): Promise<{ ok: boolean }>
+}
+
 /** The gitea bridge exposed by the preload over IPC (main-process backed). */
 export interface GiteaBridge {
-  status(): Promise<{ configured: boolean; repo: string | null }>
+  status(): Promise<{ configured: boolean; repo: string | null; demo: boolean }>
   boot(): Promise<BootPayload>
   reconcile(): Promise<SnapshotPayload>
   getIssue(index: number): Promise<GiteaIssue | null>
@@ -96,6 +124,7 @@ declare global {
       gitea: GiteaBridge
       model: ModelBridge
       pmstate: PmStateBridge
+      config: ConfigBridge
     }
   }
 }

apps/desktop/src/renderer/src/lib/use-chat.ts

@@ -2,13 +2,18 @@ import { useCallback, useEffect, useRef, useState } from 'react'
 
 import type { ChangeProposal, ChatMessage as WireMessage, IssueChange } from '@commitea/core'
 
-import { CANNED_REPLY, CHAT, type ChatMessage } from '../data/fixtures.js'
+import { CHAT, type ChatMessage } from '../data/fixtures.js'
 
 const LIVE_GREETING: ChatMessage = {
   from: 'agent',
   text: 'Morning. Ask me anything about the project — I check the real board before I answer.',
 }
 
+const NO_MODEL: ChatMessage = {
+  from: 'agent',
+  text: "Reginald is off — I need a model. Add a Model URL in Settings and chat turns on.",
+}
+
 export interface ChatState {
   msgs: ChatMessage[]
   thinking: boolean
@@ -55,10 +60,14 @@ export function useChat(onApplyChange?: (change: IssueChange) => Promise<{ ok: b
     window.commitea.model
       .status()
       .then((s) => {
-        if (alive && s.configured) {
+        if (!alive) return
+        if (s.configured) {
           setLive(true)
           setModel(s.model)
           setSeed([LIVE_GREETING])
+        } else {
+          // no model → clean "off" state, not a scripted fixture reply
+          setSeed([NO_MODEL])
         }
       })
       .catch(() => {})
@@ -78,10 +87,8 @@ export function useChat(onApplyChange?: (change: IssueChange) => Promise<{ ok: b
       setProposals([])
 
       if (!live) {
-        window.setTimeout(() => {
+        // no model configured — nothing to send (composer is disabled anyway)
         setThinking(false)
-          setConvo((c) => [...c, { from: 'agent', text: CANNED_REPLY }])
-        }, 900)
         return
       }