Merge remote-tracking branch 'origin/improvement/platform-core-chat' into test/chat-steering-e2e-final

The org view moved to use-organization-conversation and use-composer, which kept
the queue: removed there, with Retry and Dismiss in the shared thread props and the
queued-edit test gone. The acceptance suite split into checks/, so the steering
scenarios moved to checks/chat.ts; its harness stubs the socket token itself, so the
throttle allowance is gone with the file it was in.

Author: waleedlatif1

.agents/skills/add-trigger/SKILL.md

@@ -411,7 +411,7 @@ export const {service}PollingHandler: PollingProviderHandler = {
       await markWebhookSuccess(webhookId, logger)
       return 'success'
     } catch (error) {
-      logger.error(`[${requestId}] Error processing {service} webhook ${webhookId}:`, error)
+      logger.error('Error processing {service} webhook:', error)
       await markWebhookFailed(webhookId, logger)
       return 'failure'
     }

.claude/rules/sim-platform-views.md

@@ -0,0 +1,66 @@
+---
+description: One pattern per job across the organization views (Settings, People, Integrations, Links, Home)
+paths:
+  - "apps/sim/platform/embedded/app/(shell)/{settings,people,integrations,links,home}/**"
+  - "apps/sim/platform/design-system/components/{status,modal,picker,settings-section,search-field,activity-row}/**"
+  - "apps/sim/app/o/*/**"
+  - "apps/sim/app/o/*/settings/**"
+---
+
+# Organization Views
+
+The organization views live in `apps/sim/platform/embedded/app/(shell)/` and take everything shared from
+`@/platform/design-system/components`. Each job below has one pattern. A view that differs needs a
+reason written where it differs; "it was already like that" is not one.
+
+| Job | Use | Never |
+| --- | --- | --- |
+| First read of a view | `QueryBoundary` (`query`, `failure`, `loadingLabel`, optional `empty`, `loading`), which renders `LoadingRows`, then `FailureNotice`, then `empty`, then `children(data)` | Inline `isPending ? … : error ? …`, a raw `<p>Loading…</p>`, a loading `InlineNotice` |
+| Loading | `LoadingRows` by default. A placeholder shaped like its content (`WidgetSkeleton`, usage charts) only where rows would misrepresent it | A second generic skeleton |
+| Failed read | `FailureNotice`, labelled Retry. `intent='warning'` where the read partly answered | A hand-built retry button or `InlineNotice` + `Button` |
+| Failed background refresh | `FailureNotice` outside the boundary, over the content it keeps | Replacing content already on screen |
+| Empty | `EmptyState`, with no create button when the page already has one. A picker's no-match line inside a dialog stays `Muted`, since a block would take over the dialog | `Muted` or a raw `<p>` anywhere else |
+| Confirm | `ConfirmDialog` (`target`, `title`, `confirmLabel`, `pendingLabel`, `onConfirm`, `safe` when nothing is lost). Removing a person, revoking an invite and any destructive row action always ask first | `Modal variant='confirm'`, `window.confirm`, an unconfirmed destructive action |
+| Save | `SaveActions`, end-aligned in the page flow under the fields it commits: Discard while dirty, then Save. Save is visible and disabled while clean | Save in a header, Save before Discard, a Cancel beside Discard |
+| Editing a server value | `useServerDraft`. Adopts a newer value while clean; while dirty it keeps the edits and sets `conflict`. Show `DraftConflictNotice`, and block Save until the viewer chooses | Seeding `useState` from a query once |
+| Autosave vs Save | One or the other per page. A page with `SaveActions` holds every field in one draft and writes it in one request. List actions with their own dialog, such as adding or removing a member, are not field edits | A page mixing both |
+| Create | A primary compact button in `SectionToolbar`, or in the page header on a page with one | Create in both the toolbar and the empty state |
+| Search over a section's rows | `SectionSearch subject='members'` | `SearchField` with its own copy, unless the search covers more than the subject's name |
+| Row | `ActivityRow` for a row that opens something, `SettingsRow` for a row holding a control | A hand-built row |
+| List of rows | `RowList` (`dividers` for a list read as one block). `ActivityRow density='comfortable'` in settings | `calc(-1 * var(--ui-row-inset))` around a list; styling a row's height from outside |
+| Row actions | `ActionMenu` with icon `I108`, destructive item last with a separator | The same action in the row and its menu |
+| Section heading | `SettingsSection title` (h2), `DetailHeader` for a sub-view's way back | A hand-written heading |
+| Toolbar | `SectionToolbar grow={<SectionSearch />}` with its actions as children | A hand-built flex row |
+
+## Failure feedback
+
+- Form validation is inline, on the field (`error`), once a save has been attempted.
+- A dialog's own action failing stays in the dialog: `Modal` shows a rejected `onConfirm`'s message and keeps the draft.
+- Any other action failing is a toast. Nothing fails silently.
+
+## Page gates
+
+Every page under `app/o/[organizationId]` calls
+`requireOrganizationViewer(organizationId, callbackUrl)` from `@/app/o/[organizationId]/viewer`. It
+redirects a signed-out viewer to sign-in and back, 404s a viewer with no access, and returns
+`{ userId, principal, surface }`. Never write `{ kind: 'session', ... }` in a page.
+
+## Dialogs
+
+`Modal` holds itself open while `onConfirm`'s promise or its `pending` prop runs. Escape, the backdrop
+and Close do nothing until it settles, including when the browser closes the `<dialog>` itself: once
+user activation is spent, `cancel` cannot be prevented, so `OverlayDialog` reopens from `close`.
+
+## Files
+
+- A section with more than one job splits by job: `group-detail.tsx` is the shell, `group-general-tab.tsx`
+  and `group-catalog-tabs.tsx` its bodies, `use-group-draft.ts` its write.
+- Merge logic worth a test is a pure module next to the view, such as `secrets-draft.ts`.
+- `section-parts/` holds what only settings needs: `SectionStack`, `FieldStack`, `SectionToolbar`,
+  `DetailHeader`, `HeadingRow`, `Muted`, `SectionSkeleton`, `DraftConflictNotice`. `useServerDraft` is in `_components/`, since Integrations uses it too.
+
+## Legacy workspace settings
+
+`apps/sim/app/workspace/*/settings/**` keeps `SettingsPanel` from `@/components/settings/settings-panel`,
+which owns chrome through `settings/[section]/layout.tsx`. The `add-settings-page` skill describes it.
+New organization work never imports it.

.claude/rules/sim-settings-pages.md

@@ -2,7 +2,6 @@
 description: Settings page layout and SettingsPanel design-system compliance
 paths:
   - "apps/sim/app/workspace/*/settings/**"
-  - "apps/sim/app/o/*/settings/**"
   - "apps/sim/app/workspace/*/{integrations,skills,upgrade}/**"
   - "apps/sim/app/workspace/*/components/{resource-tile,credential-detail}/**"
   - "apps/sim/components/{settings,permissions}/**"

.cursor/rules/sim-platform-views.mdc

@@ -0,0 +1,64 @@
+---
+description: "One pattern per job across the organization views (Settings, People, Integrations, Links, Home)"
+globs: ["apps/sim/platform/embedded/app/(shell)/{settings,people,integrations,links,home}/**","apps/sim/platform/design-system/components/{status,modal,picker,settings-section,search-field,activity-row}/**","apps/sim/app/o/*/**","apps/sim/app/o/*/settings/**"]
+---
+
+<!-- Generated from .claude/rules/sim-platform-views.md by `bun run skills:sync`. Edit the source, not this file. -->
+
+# Organization Views
+
+The organization views live in `apps/sim/platform/embedded/app/(shell)/` and take everything shared from
+`@/platform/design-system/components`. Each job below has one pattern. A view that differs needs a
+reason written where it differs; "it was already like that" is not one.
+
+| Job | Use | Never |
+| --- | --- | --- |
+| First read of a view | `QueryBoundary` (`query`, `failure`, `loadingLabel`, optional `empty`, `loading`), which renders `LoadingRows`, then `FailureNotice`, then `empty`, then `children(data)` | Inline `isPending ? … : error ? …`, a raw `<p>Loading…</p>`, a loading `InlineNotice` |
+| Loading | `LoadingRows` by default. A placeholder shaped like its content (`WidgetSkeleton`, usage charts) only where rows would misrepresent it | A second generic skeleton |
+| Failed read | `FailureNotice`, labelled Retry. `intent='warning'` where the read partly answered | A hand-built retry button or `InlineNotice` + `Button` |
+| Failed background refresh | `FailureNotice` outside the boundary, over the content it keeps | Replacing content already on screen |
+| Empty | `EmptyState`, with no create button when the page already has one. A picker's no-match line inside a dialog stays `Muted`, since a block would take over the dialog | `Muted` or a raw `<p>` anywhere else |
+| Confirm | `ConfirmDialog` (`target`, `title`, `confirmLabel`, `pendingLabel`, `onConfirm`, `safe` when nothing is lost). Removing a person, revoking an invite and any destructive row action always ask first | `Modal variant='confirm'`, `window.confirm`, an unconfirmed destructive action |
+| Save | `SaveActions`, end-aligned in the page flow under the fields it commits: Discard while dirty, then Save. Save is visible and disabled while clean | Save in a header, Save before Discard, a Cancel beside Discard |
+| Editing a server value | `useServerDraft`. Adopts a newer value while clean; while dirty it keeps the edits and sets `conflict`. Show `DraftConflictNotice`, and block Save until the viewer chooses | Seeding `useState` from a query once |
+| Autosave vs Save | One or the other per page. A page with `SaveActions` holds every field in one draft and writes it in one request. List actions with their own dialog, such as adding or removing a member, are not field edits | A page mixing both |
+| Create | A primary compact button in `SectionToolbar`, or in the page header on a page with one | Create in both the toolbar and the empty state |
+| Search over a section's rows | `SectionSearch subject='members'` | `SearchField` with its own copy, unless the search covers more than the subject's name |
+| Row | `ActivityRow` for a row that opens something, `SettingsRow` for a row holding a control | A hand-built row |
+| List of rows | `RowList` (`dividers` for a list read as one block). `ActivityRow density='comfortable'` in settings | `calc(-1 * var(--ui-row-inset))` around a list; styling a row's height from outside |
+| Row actions | `ActionMenu` with icon `I108`, destructive item last with a separator | The same action in the row and its menu |
+| Section heading | `SettingsSection title` (h2), `DetailHeader` for a sub-view's way back | A hand-written heading |
+| Toolbar | `SectionToolbar grow={<SectionSearch />}` with its actions as children | A hand-built flex row |
+
+## Failure feedback
+
+- Form validation is inline, on the field (`error`), once a save has been attempted.
+- A dialog's own action failing stays in the dialog: `Modal` shows a rejected `onConfirm`'s message and keeps the draft.
+- Any other action failing is a toast. Nothing fails silently.
+
+## Page gates
+
+Every page under `app/o/[organizationId]` calls
+`requireOrganizationViewer(organizationId, callbackUrl)` from `@/app/o/[organizationId]/viewer`. It
+redirects a signed-out viewer to sign-in and back, 404s a viewer with no access, and returns
+`{ userId, principal, surface }`. Never write `{ kind: 'session', ... }` in a page.
+
+## Dialogs
+
+`Modal` holds itself open while `onConfirm`'s promise or its `pending` prop runs. Escape, the backdrop
+and Close do nothing until it settles, including when the browser closes the `<dialog>` itself: once
+user activation is spent, `cancel` cannot be prevented, so `OverlayDialog` reopens from `close`.
+
+## Files
+
+- A section with more than one job splits by job: `group-detail.tsx` is the shell, `group-general-tab.tsx`
+  and `group-catalog-tabs.tsx` its bodies, `use-group-draft.ts` its write.
+- Merge logic worth a test is a pure module next to the view, such as `secrets-draft.ts`.
+- `section-parts/` holds what only settings needs: `SectionStack`, `FieldStack`, `SectionToolbar`,
+  `DetailHeader`, `HeadingRow`, `Muted`, `SectionSkeleton`, `DraftConflictNotice`. `useServerDraft` is in `_components/`, since Integrations uses it too.
+
+## Legacy workspace settings
+
+`apps/sim/app/workspace/*/settings/**` keeps `SettingsPanel` from `@/components/settings/settings-panel`,
+which owns chrome through `settings/[section]/layout.tsx`. The `add-settings-page` skill describes it.
+New organization work never imports it.

.cursor/rules/sim-settings-pages.mdc

@@ -1,6 +1,6 @@
 ---
 description: "Settings page layout and SettingsPanel design-system compliance"
-globs: ["apps/sim/app/workspace/*/settings/**","apps/sim/app/o/*/settings/**","apps/sim/app/workspace/*/{integrations,skills,upgrade}/**","apps/sim/app/workspace/*/components/{resource-tile,credential-detail}/**","apps/sim/components/{settings,permissions}/**","apps/sim/ee/**/components/**"]
+globs: ["apps/sim/app/workspace/*/settings/**","apps/sim/app/workspace/*/{integrations,skills,upgrade}/**","apps/sim/app/workspace/*/components/{resource-tile,credential-detail}/**","apps/sim/components/{settings,permissions}/**","apps/sim/ee/**/components/**"]
 ---
 
 <!-- Generated from .claude/rules/sim-settings-pages.md by `bun run skills:sync`. Edit the source, not this file. -->

.github/CI.md

@@ -40,8 +40,12 @@ WebKit acceptance on Blacksmith uses the matching, digest-pinned Playwright brow
 
 HTTP and docs browser installation first asks the pinned Playwright driver to simulate its OS dependency installation. When the simulation requires no package changes, the runner avoids an apt update; missing dependencies, proposed upgrades, or an unsuccessful simulation use the normal dependency installer. Browser selection and downloads still use the pinned driver, including full native Chromium for extension acceptance.
 
+`app/o` bundles `platform/embedded` and `platform/design-system`, so both are build and `ci:shared` inputs: an edit to either changes the build hash and selects every boundary. The Platform zone (`platform/{app,lib,fixtures,checks,docs,preview,public}` and its own configs) is a separate Next app that the embedded tree may not import, reached only through the `/org` rewrite, and is excluded by name so that a new `platform/` folder stays an input until it is declared zone-only. A zone-only edit selects `platform-design.yml` and the app's unit tests, and no main-app build or acceptance job.
+
 Every HTTP and browser group consumes the same production build in an isolated job/database. Electron also uses that build and skips its development-route warm-up. Local HTTP and Electron development runs retain their dev-server behavior. Build inputs exclude test-only files so a harness edit can reuse an unchanged production build.
 
+The Platform's fixture and live suites stay in `platform-design.yml`, outside `checks / ci`. The HTTP and production matrices consume one `next-build` artifact, built without `SIM_PLATFORM_ORIGIN`, while the `zone` topology bakes that origin into its rewrite and also builds the Platform app, so it needs its own job, gate flag and plan output rather than a suite entry. A task that depends on `ci:shared` would select two 16-vCPU jobs of up to 75 minutes for nearly every app PR and hold every staging push's deployment gate on them. The cost is that a red run is advisory, and a path-filtered workflow cannot be a required check: one that never starts never reports, so the status does not block a merge until the suite joins the aggregate.
+
 Desktop inbox protocol, assistant actions UI, and organization search UI run as three parallel HTTP jobs with isolated databases, apps, and reports. Each harness owns its acceptance task, so an edit selects its own job. The inbox protocol task depends on server and realtime code; the browser tasks also depend on workspace UI. Desktop inbox needs no browser. The UI jobs and browser extension install Chromium while their app starts, waiting for both before executing assertions; browser-install failures still fail the job and preserve the install log. No acceptance assertions are removed by the split.
 
 Live Electron acceptance tracks its live-app suite, fixtures, and Playwright configuration separately from shell-only smoke tests. Changing a shell-only smoke case runs the dedicated desktop workflow without starting the app's production build and live lease checks.

.github/scripts/http-e2e.sh

@@ -170,7 +170,9 @@ start_platform() {
 # platform_live_environment: one hosted Enterprise organization, the deterministic seed its specs
 # read, and a scripted worker in place of the model. Hosted is decided by the app's hostname, which
 # the job maps to loopback. Google and Microsoft answer only to real credentials, so those clients
-# are fixtures, and what no fixture can reach is reported by the specs as a skip.
+# are fixtures, and what no fixture can reach is reported by the specs as a skip. Each group starts
+# the realtime server after its app, as org-redesign does, and holds the same tripwire and tool
+# permissions, so a route that passes one suite cannot fail on the same stack in the other.
 platform_live_environment() {
   app_server=start
   export REDIS_URL=redis://127.0.0.1:6379
@@ -186,6 +188,9 @@ platform_live_environment() {
   export NEXT_PUBLIC_ACCESS_CONTROL_ENABLED=true
   export SIM_LINKS=true PEOPLE=true
   export INTERNAL_API_SECRET=platform-live-ci-local-secret-at-least-32-characters
+  export COPILOT_TOOL_PERMISSIONS_ENABLED=true
+  export DB_TX_TRIPWIRE=throw
+  export NEXT_PUBLIC_SOCKET_URL=http://127.0.0.1:3030 SOCKET_SERVER_URL=http://127.0.0.1:3030
   export COPILOT_API_KEY=platform-live-ci-local-copilot-key MOTHERSHIP_SIM_TRANSPORT=direct
   export SIM_AGENT_API_URL=http://127.0.0.1:3029
   export GOOGLE_CLIENT_ID=platform-live-google-client GOOGLE_CLIENT_SECRET=platform-live-google-secret
@@ -491,6 +496,7 @@ JS
     export SIM_PLATFORM_ORIGIN=http://127.0.0.1:3028
     start_browser_install platform-live --only-shell chromium
     PLATFORM_ORG_UI=true start_app platform-live 3027 'Platform main' record-http-status
+    start_realtime platform-live 3030
     start_platform 3028
     bun --no-env-file platform/checks/live/support/scripted-agent.ts 3029 \
       > "$report_dir/platform-live-agent.log" 2>&1 &
@@ -510,6 +516,7 @@ JS
     export PLATFORM_ORG_UI=true
     start_browser_install platform-live --only-shell chromium
     start_app platform-live-flag-off 3027 'Main, no zone' record-http-status
+    start_realtime platform-live-flag-off 3030
     wait_for_browsers
     run_platform_live flag-off platform-live-flag-off
     ;;

.github/workflows/platform-design.yml

@@ -2,12 +2,35 @@ name: platform-design
 
 on:
   pull_request:
+    # The zone and the seam it reads through: the main app that mounts and proxies it, the contracts,
+    # hooks and enterprise domains its data layer wraps, and the chat modules it drives unchanged.
+    # A pattern's order matters: the ledger follows the docs exclusion so an edit to it still meets
+    # the report-based parity check. `*` stands for `[workspaceId]`, which a filter would read as a
+    # character class.
     paths:
       - 'apps/sim/platform/**'
       - '!apps/sim/platform/docs/**'
       - '!apps/sim/platform/README.md'
+      - 'apps/sim/platform/docs/org-parity.md'
+      - 'apps/sim/app/o/**'
+      - 'apps/sim/lib/platform/**'
+      - 'apps/sim/proxy.ts'
+      - 'apps/sim/next.config.ts'
+      - 'apps/sim/lib/api/contracts/**'
+      - 'apps/sim/hooks/queries/**'
+      - 'apps/sim/ee/**'
+      - 'apps/sim/app/workspace/*/home/hooks/**'
+      - 'apps/sim/app/workspace/*/home/types.ts'
+      - 'apps/sim/app/workspace/*/home/search-params.ts'
+      - 'apps/sim/app/workspace/*/home/components/message-content/**'
+      - 'apps/sim/app/workspace/*/home/components/knowledge-search-results/utils.ts'
+      - 'apps/sim/app/workspace/*/w/*/components/panel/components/copilot/components/user-input/hooks/**'
+      - 'apps/sim/scripts/platform-live-seed.ts'
       - 'apps/sim/package.json'
+      - 'apps/realtime/**'
       - 'scripts/check-platform-design*'
+      - 'scripts/check-platform-parity*'
+      - 'scripts/platform-search-source-catalog.ts'
       - 'scripts/platform-variant-usage.ts'
       - 'scripts/sync-platform-*.ts'
       - '.github/workflows/platform-design.yml'