Desktop client: setup reliability, onboarding, wallet, chat, and UI overhaul

[cowboycoderhq]

Summary

A consolidated set of desktop client (ui-desktop) improvements plus one proxy-router fix, focused on making a first-run install work reliably for non-technical users and completing several half-wired flows. Opened against dev per the contribution pipeline.

Setup / first-run reliability

• Restore executable permissions on extracted service binaries (a dropped exec bit left llama-server/ipfs non-runnable on a clean install).
• Recover from an interrupted install instead of short-circuiting to a false "ready".
• Give cold model/chain startup enough time before the health-check timeout (a 10s default was killing a still-loading service).
• Make IPFS and Docker genuinely optional / non-blocking, and pick a free IPFS port when the default is in use.
• Run our own proxy-router on a free port when the configured port is already held by another (e.g. containerized) router, instead of failing against one we can't authenticate with.
• Reap orphaned services after a crash.

Onboarding

• Plain-language new-wallet wizard with structural Back navigation and tap-to-verify recovery phrase.
• Content-based wallet-import routing (a mnemonic pasted into the private-key field is handled correctly).

Wallet

• Complete the send path: real transfers, fails loudly instead of rendering a false success, blocks zero-address and over-balance sends, adds a confirmation step.
• Price MOR with the MOR rate; safe reset when the router is down; self-heal the router signing wallet at login.

Chat

• Client-owned conversation history so context is preserved across turns.
• Faster marketplace load; show the serving provider and the real staked amount; sortable model picker; clearer provider-error messaging; corrected session-duration floor.

proxy-router

• Restore chat_id history on load — a JSON round-trip dropped stored history for every client that relies on it. Includes a regression test.

UI

• Refreshed design system: one theme source of truth, self-hosted fonts, and consistent treatment for money surfaces.

Deps

• styled-components 4 → 5.

Testing

Built as a signed/notarized DMG and validated end-to-end on a clean machine: fresh install → setup → all services healthy → onboarding → populated wallet, with no errors. Typecheck + build verified against dev.

Notes

• Provider registration (register / stake / post-a-bid) is present but disabled ("Coming soon") pending end-to-end verification of its on-chain path.
• This is a large change; happy to split it into smaller PRs (the proxy-router history fix and the setup-reliability fixes stand alone) if that's easier to review.

🤖 Generated with Claude Code

[nomadicrogue]

@cowboycoderhq ...Thanks for putting this together — and welcome. There’s a lot of real product value here: the first-run/setup reliability work (exec bits, interrupted installs, longer cold-start probes, free-port handling, orphan reap), the wallet send path actually failing loudly, client-owned chat history, and the proxy-router chat_id history round-trip fix are all problems we’ve felt.

I pulled the branch locally, typechecked/built ui-desktop on macOS arm64, and got through download → proxy-router healthy → local chat with the new Qwen model. Appreciate the thoroughness and the offer to split the reviews...I'll take you up on that :-)

This is a large single commit with several different risk profiles mixed together. We typically work on one component at a time. For reviewability, rollback, and a first contribution, please split into three PRs in this order:

PR 1 — proxy-router only

The AppendChatHistory JSON round-trip fix + regression test, and related router defaults.

Chat context (please include in this PR): change the proxy-router default so PROXY_FORWARD_CHAT_CONTEXT is false when unset (today config.go defaults it to true). Leaving FORWARD on by default was not the intended long-term behavior, and fixing history load while FORWARD stays on will surprise any client that already sends a full OpenAI-style transcript (duplicated context).

Intended architecture (what the desktop client already does in this branch):

• Client owns the conversation transcript — each /v1/chat/completions request sends the full messages[] the model should see.
• PROXY_STORE_CHAT_CONTEXT=true — keep storing turns for the history drawer / /v1/chats/:id.
• PROXY_FORWARD_CHAT_CONTEXT=false — router must not prepend stored history on top of the client payload.

So “chat memory works” is a client/UI responsibility: send [...priorTurns, newMessage] in the body, keep chat_id for storage/title/drawer, leave FORWARD off. CLI / other API clients should follow the same pattern; FORWARD can remain an explicit opt-in for unusual clients that send only the latest turn.

Please flip the router default to false and call out the default change in the PR description.

PR 2 — UI functional changes

Everything that makes the desktop client work better without changing look and feel: setup/orchestrator reliability, onboarding flows, wallet send path, chat behavior (client-owned transcript, marketplace/session fixes), local model swap (TinyLlama → Qwen), secret redaction, etc.

Also in this PR (not later): docs scrub for the model swap. Search tinyllama / TinyLlama across docs/, readme.md, and AGENTS.md and update in the same PR so docs and functionality don’t diverge. House rule: if you add or change user-facing functionality, doc updates land with it.

PR 3 — UI visual / design-system work (optional, separate)

On a local run the app felt like a different product: cyan/turquoise accent, monospace-heavy HUD look, glass/glow surfaces. The existing Morpheus green/dark look is intentional brand, and most UX bugs didn’t require a full “Aurora/JARVIS” reskin.

Please keep visual work out of PRs 1–2. If you want to propose a design direction, do it here with before/after screenshots — we’re open to discussing it, but it shouldn’t block the functional fixes.

Security / trust (please address in PR 2)

healRouterWallet auto-POSTs the Keychain mnemonic to /wallet/mnemonic on login. Combined with adopting any listener on the default API port that returns a readable cookie path, that’s a real local trust issue (same-machine / TOCTOU). Please only heal a router this process spawned (or require explicit user confirmation), and don’t treat “cookie path is readable” as sufficient to adopt a foreign process.

Related from our dirty-machine smoke test: ProcessFactory happily adopted a stale llama-server still pointed at a deleted model because /health returned ok. Same class of bug — port/health ≠ our current binary/config.

Builds

I only exercised macOS arm64 locally. GitHub checks haven’t run on this fork branch yet; once workflows are approved, the usual UI build jobs are enough for us (when we send from dev to test branch, the ci will build all test releases that we can work through before a main release)

Again: the reliability and wallet/chat fixes are genuinely useful. Happy to re-review as three PRs — router first, then UI function (+ docs), then visual if desired.

[cowboycoderhq]

Makes sense — splitting into three as you asked, router first.

PR 1 → #804 is proxy-router only: the AppendChatHistory JSON round-trip fix + regression test, and the PROXY_FORWARD_CHAT_CONTEXT default flipped to false (called out in the PR description, since it changes behavior for clients that send a full transcript).

PR 2 (UI functional — setup/orchestrator reliability, wallet send path, client-owned transcript, TinyLlama→Qwen swap + the docs scrub, secret redaction, and the healRouterWallet spawn-only/provenance fix) and PR 3 (visual, optional, with before/after screenshots) will follow.

I'll close this in favor of the split so it doesn't sit stale — let me know if you'd rather keep it open as a tracking umbrella.