Merge remote-tracking branch 'origin/main' into feat/e2e-linux-ci-default

# Conflicts:
#	src/openhuman/agent/loop_/context_guard.rs

Author: CodeGhost21

.claude/memory.md

@@ -39,6 +39,7 @@ Quick reference for anyone starting with Claude on this project. Updated by the
 - **OnboardingOverlay is a portal, not a route** — mounted in `App.tsx`, renders via `createPortal` at z-[9999]. There is no `/onboarding` route in `AppRoutes.tsx`. Gating is purely Redux + workspace flag.
 - **Deferred onboarding** — `onboardingDeferredByUser` in `authSlice.ts` (persisted via redux-persist) durably tracks when a user clicks "Set up later". `SetupBanner.tsx` provides the resume path.
 - **`selectHasIncompleteOnboarding` is unused** in production code — only tested. Don't use it for new features.
+- **Logout must clear onboarding state** — `_clearToken` resets `isOnboardedByUser` + `isAnalyticsEnabledByUser`. Workspace flag (`.skip_onboarding` file) is cleared via `openhumanWorkspaceOnboardingFlagSet(false)` in SettingsHome logout, clearAllAppData, and UserProvider auth recovery. All three paths must stay in sync.
 - **`formatBytes` / `formatEta` / `progressFromStatus`** — shared in `app/src/utils/localAiHelpers.ts`. Home.tsx and LocalModelPanel.tsx still have local copies (can be migrated later).
 - **Notification z-index stacking** — ErrorReportNotification: z-[10000] bottom-right. OnboardingOverlay: z-[9999]. LocalAIDownloadSnackbar: z-[9998] bottom-left.
 - **React Compiler lint** — `useCallback` deps must match the full inferred closure. Using `user?._id` as dep when the closure captures `user` triggers `preserve-manual-memoization`. Use `user` as the dep instead.

.github/workflows/release-packages.yml

@@ -678,6 +678,48 @@ jobs:
           echo "Checking staple..."
           xcrun stapler validate "$APP_PATH" || echo "WARNING: Staple validation failed"
 
+      - name: Package CLI tarball and upload to release
+        if: matrix.settings.platform != 'windows-latest'
+        shell: bash
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ needs.prepare-release.outputs.version }}
+          MATRIX_PLATFORM: ${{ matrix.settings.platform }}
+          MATRIX_TARGET: ${{ matrix.settings.target }}
+        run: |
+          set -euo pipefail
+
+          TARBALL="openhuman-core-${VERSION}-${MATRIX_TARGET}.tar.gz"
+          WORK=$(mktemp -d)
+          trap 'rm -rf "$WORK"' EXIT
+
+          if [[ "$MATRIX_PLATFORM" == "macos-latest" ]]; then
+            # Prefer the notarized+signed binary extracted from inside the .app bundle
+            APP_PATH="${{ steps.locate-app.outputs.app_path }}"
+            BIN=$(find "$APP_PATH/Contents/MacOS" -maxdepth 1 -name "openhuman-core-*" \
+              ! -name "*.sig" 2>/dev/null | head -1 || true)
+            [[ -z "$BIN" ]] && BIN=$(find "$APP_PATH/Contents/Resources" -maxdepth 1 \
+              -name "openhuman-core-*" ! -name "*.sig" 2>/dev/null | head -1 || true)
+            if [[ -z "$BIN" ]]; then
+              echo "[pkg] Falling back to target dir binary (no notarized sidecar found)"
+              BIN="${{ steps.cli-paths.outputs.cli_path }}"
+            fi
+          else
+            BIN="${{ steps.cli-paths.outputs.cli_path }}"
+          fi
+
+          cp "$BIN" "$WORK/openhuman-core"
+          chmod +x "$WORK/openhuman-core"
+          tar -czf "$TARBALL" -C "$WORK" openhuman-core
+
+          # openssl dgst works on both macOS and Linux runners
+          openssl dgst -sha256 -r "$TARBALL" | awk '{print $1}' > "${TARBALL}.sha256"
+
+          gh release upload "v${VERSION}" "$TARBALL" "${TARBALL}.sha256" \
+            --repo tinyhumansai/openhuman --clobber
+
+          echo "[pkg] Uploaded $TARBALL and ${TARBALL}.sha256"
+
       - name: Upload standalone CLI artifacts
         uses: actions/upload-artifact@v4
         with:

.github/workflows/release.yml

@@ -27,10 +27,24 @@ const OnboardingOverlay = () => {
   const isDeferred = useAppSelector(selectOnboardingDeferred);
   const [hasWorkspaceFlag, setHasWorkspaceFlag] = useState<boolean | null>(null);
   const [dismissed, setDismissed] = useState(false);
+  const [userLoadTimedOut, setUserLoadTimedOut] = useState(false);
 
-  // Check workspace flag once user is loaded
+  // Timeout: if user profile hasn't loaded after 3s but we have token + bootstrap,
+  // proceed anyway so onboarding isn't permanently invisible.
   useEffect(() => {
-    if (!token || !isAuthBootstrapComplete || !user?._id) return;
+    if (!token || !isAuthBootstrapComplete || user?._id) return;
+
+    const timer = setTimeout(() => setUserLoadTimedOut(true), 3000);
+    return () => clearTimeout(timer);
+  }, [token, isAuthBootstrapComplete, user?._id]);
+
+  // User is ready when profile loaded or timeout elapsed.
+  // Note: userLoadTimedOut is sticky across sessions but harmless — when token
+  // is null (logged out) the early-return guard prevents any visible effect,
+  // and the workspace flag check doesn't require userId.
+  const userReady = !!user?._id || userLoadTimedOut;
+  useEffect(() => {
+    if (!token || !isAuthBootstrapComplete || !userReady) return;
 
     let mounted = true;
     const check = async () => {
@@ -47,7 +61,7 @@ const OnboardingOverlay = () => {
     return () => {
       mounted = false;
     };
-  }, [token, isAuthBootstrapComplete, user?._id, isOnboarded]);
+  }, [token, isAuthBootstrapComplete, userReady, isOnboarded]);
 
   const handleComplete = useCallback(() => {
     setDismissed(true);
@@ -60,8 +74,8 @@ const OnboardingOverlay = () => {
     setDismissed(true);
   }, [dispatch, user]);
 
-  // Don't show if not logged in, bootstrap not complete, or user not loaded
-  if (!token || !isAuthBootstrapComplete || !user?._id) return null;
+  // Don't show if not logged in, bootstrap not complete, or user not ready
+  if (!token || !isAuthBootstrapComplete || !userReady) return null;
 
   // Still loading workspace flag
   if (hasWorkspaceFlag === null) return null;

app/src/components/OnboardingOverlay.tsx

@@ -4,7 +4,10 @@ import { skillManager } from '../../lib/skills/manager';
 import { persistor } from '../../store';
 import { clearToken } from '../../store/authSlice';
 import { useAppDispatch } from '../../store/hooks';
-import { logout as tauriLogout } from '../../utils/tauriCommands';
+import {
+  openhumanWorkspaceOnboardingFlagSet,
+  logout as tauriLogout,
+} from '../../utils/tauriCommands';
 import SettingsHeader from './components/SettingsHeader';
 import SettingsMenuItem from './components/SettingsMenuItem';
 import { useSettingsNavigation } from './hooks/useSettingsNavigation';
@@ -18,6 +21,11 @@ const SettingsHome = () => {
 
   const handleLogout = async () => {
     await dispatch(clearToken());
+    try {
+      await openhumanWorkspaceOnboardingFlagSet(false);
+    } catch (err) {
+      console.warn('[Settings] Failed to clear workspace onboarding flag:', err);
+    }
     try {
       await tauriLogout();
     } catch (err) {
@@ -28,6 +36,11 @@ const SettingsHome = () => {
 
   const clearAllAppData = async () => {
     await dispatch(clearToken());
+    try {
+      await openhumanWorkspaceOnboardingFlagSet(false);
+    } catch (err) {
+      console.warn('[Settings] Failed to clear workspace onboarding flag:', err);
+    }
     try {
       await tauriLogout();
     } catch (err) {

app/src/components/settings/SettingsHome.tsx

@@ -2,7 +2,12 @@ import { useEffect } from 'react';
 
 import { clearToken, setAuthBootstrapComplete, setToken } from '../store/authSlice';
 import { useAppDispatch, useAppSelector } from '../store/hooks';
-import { getAuthState, getSessionToken, isTauri } from '../utils/tauriCommands';
+import {
+  getAuthState,
+  getSessionToken,
+  isTauri,
+  openhumanWorkspaceOnboardingFlagSet,
+} from '../utils/tauriCommands';
 
 const AUTH_BOOTSTRAP_TIMEOUT_MS = 5000;
 
@@ -50,6 +55,11 @@ const UserProvider = ({ children }: { children: React.ReactNode }) => {
           }
         } else if (!authState.is_authenticated && token) {
           await dispatch(clearToken());
+          try {
+            await openhumanWorkspaceOnboardingFlagSet(false);
+          } catch (err) {
+            console.warn('[auth] Failed to clear workspace onboarding flag:', err);
+          }
         }
       } catch (err) {
         console.warn('[auth] Failed to restore session token from core RPC:', err);

app/src/providers/UserProvider.tsx

@@ -2,9 +2,13 @@ import { configureStore } from '@reduxjs/toolkit';
 import { describe, expect, it } from 'vitest';
 
 import authReducer, {
+  clearToken,
   setAnalyticsForUser,
+  setEncryptionKeyForUser,
   setOnboardedForUser,
+  setOnboardingDeferredForUser,
   setOnboardingTasksForUser,
+  setPrimaryWalletAddressForUser,
   setToken,
 } from '../authSlice';
 import teamReducer from '../teamSlice';
@@ -87,4 +91,49 @@ describe('authSlice', () => {
     );
     expect(store.getState().auth.hasIncompleteOnboardingByUser.u1).toBe(false);
   });
+
+  it('clearToken resets all per-user state', async () => {
+    const store = createStore();
+
+    // Populate all per-user fields
+    store.dispatch(setToken('jwt-abc'));
+    store.dispatch(setOnboardedForUser({ userId: 'u1', value: true }));
+    store.dispatch(setAnalyticsForUser({ userId: 'u1', enabled: true }));
+    store.dispatch(setEncryptionKeyForUser({ userId: 'u1', key: 'aes-hex' }));
+    store.dispatch(setPrimaryWalletAddressForUser({ userId: 'u1', address: '0xabc' }));
+    store.dispatch(setOnboardingDeferredForUser({ userId: 'u1', deferred: true }));
+    store.dispatch(
+      setOnboardingTasksForUser({
+        userId: 'u1',
+        tasks: {
+          accessibilityPermissionGranted: true,
+          localModelConsentGiven: true,
+          localModelDownloadStarted: true,
+          enabledTools: ['shell'],
+          connectedSources: ['telegram'],
+        },
+      })
+    );
+
+    // Verify state is populated
+    const before = store.getState().auth;
+    expect(before.token).toBe('jwt-abc');
+    expect(before.isOnboardedByUser.u1).toBe(true);
+    expect(before.isAnalyticsEnabledByUser.u1).toBe(true);
+    expect(before.encryptionKeyByUser.u1).toBe('aes-hex');
+
+    // Dispatch clearToken thunk
+    await store.dispatch(clearToken());
+
+    // Verify everything is reset
+    const after = store.getState().auth;
+    expect(after.token).toBeNull();
+    expect(after.isOnboardedByUser).toEqual({});
+    expect(after.onboardingTasksByUser).toEqual({});
+    expect(after.hasIncompleteOnboardingByUser).toEqual({});
+    expect(after.isAnalyticsEnabledByUser).toEqual({});
+    expect(after.encryptionKeyByUser).toEqual({});
+    expect(after.primaryWalletAddressByUser).toEqual({});
+    expect(after.onboardingDeferredByUser).toEqual({});
+  });
 });

app/src/store/__tests__/authSlice.test.ts

@@ -56,8 +56,10 @@ const authSlice = createSlice({
     },
     _clearToken: state => {
       state.token = null;
+      state.isOnboardedByUser = {};
       state.onboardingTasksByUser = {};
       state.hasIncompleteOnboardingByUser = {};
+      state.isAnalyticsEnabledByUser = {};
       state.encryptionKeyByUser = {};
       state.primaryWalletAddressByUser = {};
       state.onboardingDeferredByUser = {};