kurrent-io
diff --git a/‎docs/superpowers/plans/2026-08-23-ai2194-desktop-shell-home.md‎
Lines changed: 834 additions & 0 deletions b/‎docs/superpowers/plans/2026-08-23-ai2194-desktop-shell-home.md‎
Lines changed: 834 additions & 0 deletions
diff --git a/‎src/Capacitor.App/App.axaml‎
Lines changed: 19 additions & 0 deletions b/‎src/Capacitor.App/App.axaml‎
Lines changed: 19 additions & 0 deletions
diff --git a/‎src/Capacitor.App/App.axaml.cs‎
Lines changed: 56 additions & 6 deletions b/‎src/Capacitor.App/App.axaml.cs‎
Lines changed: 56 additions & 6 deletions
diff --git a/‎src/Capacitor.App/Capacitor.App.csproj‎
Lines changed: 1 addition & 0 deletions b/‎src/Capacitor.App/Capacitor.App.csproj‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎src/Capacitor.App/Services/AppStateStore.cs‎
Lines changed: 6 additions & 1 deletion b/‎src/Capacitor.App/Services/AppStateStore.cs‎
Lines changed: 6 additions & 1 deletion
diff --git a/‎src/Capacitor.App/Services/HostedHarnessCatalog.cs‎
Lines changed: 61 additions & 0 deletions b/‎src/Capacitor.App/Services/HostedHarnessCatalog.cs‎
Lines changed: 61 additions & 0 deletions
diff --git a/‎src/Capacitor.App/Services/ILaunchClient.cs‎
Lines changed: 53 additions & 0 deletions b/‎src/Capacitor.App/Services/ILaunchClient.cs‎
Lines changed: 53 additions & 0 deletions
diff --git a/‎src/Capacitor.App/Services/LaunchHubJson.cs‎
Lines changed: 19 additions & 0 deletions b/‎src/Capacitor.App/Services/LaunchHubJson.cs‎
Lines changed: 19 additions & 0 deletions
@@ -2,6 +2,25 @@
              xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
              x:Class="Capacitor.App.App"
              RequestedThemeVariant="Default">
+    <Application.Resources>
+        <!-- The Home surface's design palette. Kcap-prefixed keys so these never
+             shadow a FluentTheme resource of the same short name — MainWindow's existing controls
+             stay on FluentTheme defaults untouched. -->
+        <ResourceDictionary>
+            <SolidColorBrush x:Key="KcapCanvasBrush" Color="#0B0D12" />
+            <SolidColorBrush x:Key="KcapSurfaceBrush" Color="#12151D" />
+            <SolidColorBrush x:Key="KcapSurfaceRaisedBrush" Color="#191D27" />
+            <SolidColorBrush x:Key="KcapBorderBrush" Color="#2A3040" />
+            <SolidColorBrush x:Key="KcapTextBrush" Color="#F1F3F7" />
+            <SolidColorBrush x:Key="KcapMutedBrush" Color="#9299AA" />
+            <SolidColorBrush x:Key="KcapAccentBrush" Color="#5BE0B3" />
+            <SolidColorBrush x:Key="KcapAccentDimBrush" Color="#173F36" />
+            <SolidColorBrush x:Key="KcapWarningBrush" Color="#F4B860" />
+            <SolidColorBrush x:Key="KcapWarningDimBrush" Color="#45351E" />
+            <SolidColorBrush x:Key="KcapPurpleBrush" Color="#A994FF" />
+            <SolidColorBrush x:Key="KcapDangerBrush" Color="#FF7272" />
+        </ResourceDictionary>
+    </Application.Resources>
     <Application.Styles>
         <FluentTheme />
     </Application.Styles>
 
@@ -65,6 +65,17 @@ public partial class App : Application {
     // frame: the prompt window factory and BuildAndShowMainWindow both close over the SAME
     // instance.
     ActivityViewModel? _activity;
+    // Constructed INSIDE BuildAndShowMainWindow, over the same `service`
+    // instance MainWindowViewModel itself uses — retrieved back off the built window's own
+    // DataContext right below, so this field (and therefore disposal) never needs a second
+    // construction path or a signature change to BuildAndShowMainWindow (AppStartupTests calls
+    // that method directly, with no Home argument).
+    HomeViewModel? _home;
+    // Home's launch transport, held here because it is the one graph object that outlives a
+    // window rebuild (MainWindowCoordinator can build a second window over the same client) and
+    // owns a live HubConnection. Disposed after _home on both teardown paths — never before, or a
+    // launch still in flight would lose its transport mid-invoke.
+    ServerLaunchClient? _launch;
     TrayViewModel? _trayVm;
     TrayIconManager? _tray;
     // No disposal needed — RefCount tears its Interval down with its last subscriber, and every
@@ -158,7 +169,8 @@ async Task StartAsync(IClassicDesktopStyleApplicationLifetime desktop) {
             if (_wizardWindow is { IsVisible: true } wizard) wizard.Close();
             Console.Error.WriteLine($"kcap app failed to start: {ex}");
             await HandleStartupFailureAsync(
-                desktop, ex, _service, _shutdown, [_tray, _trayVm, _promptCoordinator, _consent, _activity, _pause], _lifecycle, _lane);
+                desktop, ex, _service, _shutdown, [_tray, _trayVm, _promptCoordinator, _consent, _activity, _home, _pause], _lifecycle, _lane);
+            await DisposeLaunchClientAsync(); // after _home above — its only caller
             // all already disposed above — never let a later OnShutdownRequested (e.g. Cmd+Q
             // while the error window is up) dispose any of them a second time
             _service = null;
@@ -172,6 +184,7 @@ await HandleStartupFailureAsync(
             _consent = null;
             _pause = null;
             _activity = null;
+            _home = null;
             _wizardAuth = null; // its attempt, if any, already settled through the wizard's own close path
             _wizardImport = null; // same — any in-flight run already settled through the wizard's own close path
             _wizardWindow = null;
@@ -263,15 +276,24 @@ void BuildDaemonGraph(
             Notifier = notifier,
         });
 
+        // One launch client for the app, not one per window the coordinator builds — each carries
+        // its own HubConnection, and only a held instance can be disposed at teardown.
+        var launch = new ServerLaunchClient();
+        _launch = launch;
+
         _coordinator = new MainWindowCoordinator(
-            () => BuildAndShowMainWindow(service, actions, notifier, ticker, _shutdown.Token, activity, lifecycle.StartActionAsync, lifecycleStatus));
+            () => BuildAndShowMainWindow(service, actions, notifier, ticker, _shutdown.Token, activity, lifecycle.StartActionAsync, lifecycleStatus, launch));
         // A shutdown that started before this continuation resumed already ran its first
         // pass against a null coordinator, so a window built now must never be
         // close-protected (BeginShutdownPass's rule 1 is the general defense; this is the
         // by-construction one, and it is why the window below cannot even briefly intercept).
         _coordinator.QuitInProgress = _shutdownStarted;
         _coordinator.ShowMainWindow();
         desktop.MainWindow = _coordinator.Window;
+        // BuildAndShowMainWindow constructs Home itself (over the same `service`) — read back off
+        // the window's own DataContext rather than threading a new parameter through, so
+        // AppStartupTests' existing direct call to that method needs no change.
+        _home = (_coordinator.Window?.DataContext as MainWindowViewModel)?.Home;
 
         // LAST, deliberately (spec §9): anything above throwing lands in the catch with no
         // tray icon ever created, leaving the error window as the only surface.
@@ -563,12 +585,23 @@ internal static Window BuildStartupErrorWindow(Exception ex) =>
     internal static MainWindow BuildAndShowMainWindow(
             IDaemonClientService service, AgentActionService actions, IAppNotifier notifier, ITicker ticker,
             CancellationToken shutdownToken, ActivityViewModel activity, Func<CancellationToken, Task>? startAction = null,
-            IObservable<string?>? lifecycleStatus = null) {
+            IObservable<string?>? lifecycleStatus = null, ILaunchClient? launch = null) {
         // Notifier is set on the WINDOW (spec §11 toast overlay), not the ViewModel — the toast
         // is a View-level concern (WindowNotificationManager lives on MainWindow) independent of
         // the VM's WhenActivated-scoped projections.
+        //
+        // Home is built here, over the SAME `service` instance MainWindowViewModel
+        // itself uses — never a second daemon connection. AppStateStore/ServerLaunchClient are both
+        // cheap, self-contained constructions (file-path-gated I/O; a HubConnection that only opens
+        // lazily on first StartAsync), the same reasoning BuildLifecycleController's own
+        // `new AppStateStore(PathHelpers.ConfigPath("app-state.json"))` already relies on. The
+        // composition root passes its held client so teardown can dispose it; a caller that passes
+        // none (a test) gets an unheld one, which owns nothing until a launch is actually made.
+        var home = new HomeViewModel(
+            service, new AppStateStore(PathHelpers.ConfigPath("app-state.json")),
+            launch ?? new ServerLaunchClient(), shutdownToken);
         var window = new MainWindow {
-            DataContext = new MainWindowViewModel(service, actions, ticker, shutdownToken, activity, startAction, lifecycleStatus),
+            DataContext = new MainWindowViewModel(service, actions, ticker, shutdownToken, activity, startAction, lifecycleStatus, home: home),
             Notifier = notifier,
         };
         window.Show();
@@ -993,16 +1026,20 @@ async Task DisposeAndShutdownAsync() {
             // disposed one. A resolve already in flight was cancelled by _shutdown at the top of
             // OnShutdownRequested and settles on the ViewModel's silent-abort path.
             await DisposeUiThenConfirmShutdownAsync(
-                [_tray, _trayVm, _promptCoordinator, _consent, _activity, _pause],
+                [_tray, _trayVm, _promptCoordinator, _consent, _activity, _home, _pause],
                 DisposeLifecycleAndServiceAsync, () => _shutdownConfirmed = true, desktop, _exitCode);
         } else {
             await DisposeLifecycleAndServiceAsync();
             _shutdownConfirmed = true;
         }
     }
 
-    // _lifecycle goes first (guarded, so a throw never skips _service's disposal); the lane goes LAST — its substrate must outlive any caller still awaiting RunAsync.
+    // Runs after the UI disposables (DisposeUiThenConfirmShutdownAsync), so _home is already gone
+    // when its launch client is torn down here. _lifecycle then goes first (guarded, so a throw
+    // never skips _service's disposal); the lane goes LAST — its substrate must outlive any caller
+    // still awaiting RunAsync.
     async ValueTask DisposeLifecycleAndServiceAsync() {
+        await DisposeLaunchClientAsync().ConfigureAwait(false);
         if (_lifecycle is not null) {
             try {
                 await _lifecycle.DisposeAsync().ConfigureAwait(false);
@@ -1020,6 +1057,19 @@ async ValueTask DisposeLifecycleAndServiceAsync() {
         }
     }
 
+    // Idempotent (both teardown paths can reach it) and guarded for the same reason DisposeAll is:
+    // a failing hub disposal must never skip the disposals that follow.
+    async ValueTask DisposeLaunchClientAsync() {
+        if (_launch is null) return;
+
+        try {
+            await _launch.DisposeAsync().ConfigureAwait(false);
+        } catch (Exception ex) {
+            Console.Error.WriteLine($"kcap app failed to dispose the launch client during teardown: {ex}");
+        }
+        _launch = null;
+    }
+
     /// <summary>Quiesces shutdown in two phases: sign-in and import finish uncapped so an in-progress commit isn't torn down, then lifecycle/lane quiesce under the cap.</summary>
     internal static async Task QuiesceAppAsync(
             WizardAuthService? auth, ImportStepViewModel? import,
 
@@ -18,6 +18,7 @@
         <PackageReference Include="Avalonia.Themes.Fluent" />
         <PackageReference Include="ReactiveUI.Avalonia" />
         <PackageReference Include="DynamicData" />
+        <PackageReference Include="Microsoft.AspNetCore.SignalR.Client" />
     </ItemGroup>
     <ItemGroup>
         <!-- .axaml files are auto-included as AvaloniaXaml by Avalonia's build props; plain
 
@@ -10,7 +10,12 @@ public sealed record AppState(
     bool ShimOffered = false,
     bool ShimDenied = false,
     IReadOnlyList<string>? DeclinedTakeoverPairs = null,
-    bool ConsentQuarantineAcked = false);
+    bool ConsentQuarantineAcked = false,
+    // Absolute repo path -> vendor token. "" is the reserved key for the not-yet-in-a-repository
+    // target (HomeViewModel.ScratchRepoPath) — a stored preference only, since the daemon does
+    // not accept a repo-less launch. Absent key = never chosen here; the caller picks its own
+    // default rather than inheriting another repository's choice.
+    IReadOnlyDictionary<string, string>? HarnessByRepo = null);
 
 public interface IAppStateStore {
     Task<AppState> LoadAsync();
 
@@ -0,0 +1,61 @@
+using Capacitor.Cli.Core.Setup;
+
+namespace Capacitor.App.Services;
+
+public sealed record HarnessOption(string Vendor, string Label, string TransportFamily, bool Available);
+
+/// The picker's vendor list. Availability comes from what the daemon advertises
+/// (DaemonInfoDto.SupportedVendors), never from a version check — a vendor auto-update must not
+/// silently withdraw a harness. A vendor the daemon advertises but this build has never heard of
+/// is still offered, listed under its raw token: the daemon is the authority on what it can host.
+public static class HostedHarnessCatalog {
+    // Transport family for each vendor: how the daemon hosts it (pty, acp, or rpc).
+    // Vendors absent from this map default to "rpc" — which reads as "chat" in the picker, true or
+    // not, so HostedHarnessCatalogTests pins every vendor in Core's HarnessCatalog to an entry
+    // here. The fallback stays for a vendor only the DAEMON knows about; it is not a licence to
+    // skip a tenth entry when one is added to Core.
+    static readonly Dictionary<string, string> TransportFamilies = new(StringComparer.OrdinalIgnoreCase) {
+        { "claude",      "pty" },
+        { "codex",       "pty" },
+        { "cursor",      "acp" },
+        { "copilot",     "acp" },
+        { "gemini",      "acp" },
+        { "kiro",        "acp" },
+        { "opencode",    "acp" },
+        { "antigravity", "rpc" },
+        { "pi",          "rpc" },
+    };
+
+    /// The vendors with an EXPLICIT family above — what the guard test reads, since Build's
+    /// fallback makes an unmapped vendor indistinguishable from a mapped "rpc" one.
+    internal static IReadOnlyCollection<string> MappedVendors => TransportFamilies.Keys;
+
+    public static IReadOnlyList<HarnessOption> Build(string[]? supportedVendors) {
+        // null = an older daemon that never sent the field: unknown, not empty.
+        var advertised = supportedVendors is null
+            ? null
+            : new HashSet<string>(supportedVendors, StringComparer.OrdinalIgnoreCase);
+
+        var options = HarnessCatalog.All
+            .Select(k => new HarnessOption(
+                k.VendorId,
+                k.Label,
+                TransportFamilies.TryGetValue(k.VendorId, out var family) ? family : "rpc",
+                advertised?.Contains(k.VendorId) ?? true))
+            .ToList();
+
+        if (advertised is null) return options;
+
+        var known = new HashSet<string>(HarnessCatalog.All.Select(k => k.VendorId), StringComparer.OrdinalIgnoreCase);
+        foreach (var extra in supportedVendors!.Where(v => !known.Contains(v)).Distinct(StringComparer.OrdinalIgnoreCase))
+            options.Add(new HarnessOption(extra, extra, "rpc", true));
+
+        return options;
+    }
+
+    public static string DescriptionFor(HarnessOption option) => option.TransportFamily switch {
+        "pty" => "PTY · terminal + chat",
+        "acp" => "ACP · chat",
+        _     => "chat",
+    };
+}
@@ -0,0 +1,53 @@
+using System.Text.Json.Serialization;
+
+namespace Capacitor.App.Services;
+
+public sealed record LaunchRequest(string DaemonName, string RepoPath, string Vendor, string? Prompt);
+
+public sealed record LaunchOutcome(bool Started, string? AgentId, string? Error);
+
+/// Starting a session goes through the SERVER, not the local socket: the local Spawn frame
+/// resolves against the daemon's PTY launchers (claude and codex only), while the server's
+/// RequestLaunchAgentV2 reaches every vendor through the runtime factories.
+public interface ILaunchClient {
+    Task<LaunchOutcome> StartAsync(LaunchRequest request, CancellationToken ct);
+}
+
+/// The RequestLaunchAgentV2 hub argument. A concrete record, not an anonymous type: the app
+/// serializes through source-generated contexts throughout (AppStateStore, KcapCli), and a
+/// reflection dependency here would foreclose ever AOT-publishing it. Member names must match
+/// LaunchAgentRequestV2's properties — the hub binds by name.
+// Explicit snake_case on every member: the server applies PropertyNamingPolicy =
+// SnakeCaseLower to all hub payloads (kcap-server JsonDefaults.ConfigureSignalRPayload), and
+// LaunchHubJson.Configure sets the same policy here. The explicit names are what survive that
+// policy whatever it is set to, and they put the wire contract in plain sight next to the
+// server record each member must match — this file has already shipped one launch-breaking
+// key-casing defect, so the names are pinned rather than derived.
+public sealed record LaunchAgentRequestV2Payload {
+    [JsonPropertyName("daemon_name")]           public required string   DaemonName          { get; init; }
+    [JsonPropertyName("prompt")]                public          string?  Prompt              { get; init; }
+    [JsonPropertyName("model")]                 public required string   Model               { get; init; }
+    [JsonPropertyName("effort")]                public          string?  Effort              { get; init; }
+    [JsonPropertyName("repo_path")]             public required string   RepoPath            { get; init; }
+    [JsonPropertyName("tools")]                 public          string[]? Tools              { get; init; }
+    [JsonPropertyName("attachment_ids")]        public          string[]? AttachmentIds      { get; init; }
+    [JsonPropertyName("visibility")]            public          string?  Visibility          { get; init; }
+    [JsonPropertyName("grants")]                public          object[]? Grants             { get; init; }
+    [JsonPropertyName("vendor")]                public required string   Vendor              { get; init; }
+    [JsonPropertyName("codex_posture")]         public          object?  CodexPosture        { get; init; }
+    [JsonPropertyName("acp_permission_preset")] public          string?  AcpPermissionPreset { get; init; }
+}
+
+[JsonSerializable(typeof(LaunchAgentRequestV2Payload))]
+public partial class LaunchJsonContext : JsonSerializerContext;
+
+/// The RequestLaunchAgentV2 argument, split from the transport so its shape is testable.
+public static class LaunchPayload {
+    public static LaunchAgentRequestV2Payload For(LaunchRequest r) => new() {
+        DaemonName = r.DaemonName,
+        Prompt     = string.IsNullOrWhiteSpace(r.Prompt) ? null : r.Prompt,
+        Model      = "",   // vendor default; the server rejects null
+        RepoPath   = r.RepoPath,
+        Vendor     = r.Vendor,
+    };
+}
@@ -0,0 +1,19 @@
+using System.Text.Json;
+
+namespace Capacitor.App.Services;
+
+/// <summary>
+/// The EXACT SignalR JSON hub-protocol payload configuration ServerLaunchClient applies —
+/// extracted so wire-contract tests serialize with the genuine on-wire options instead of a
+/// hand-built approximation that could silently diverge from production (mirrors kcap-server's
+/// JsonDefaults.ConfigureSignalRPayload, extracted for the same reason). Matches
+/// ServerConnection.cs / WatchCommand.cs: chain-insert the generated context rather than
+/// replacing TypeInfoResolver, and set the same snake_case policy the server expects on every
+/// hub payload — belt and braces alongside the payload's own explicit [JsonPropertyName]s.
+/// </summary>
+public static class LaunchHubJson {
+    public static void Configure(JsonSerializerOptions options) {
+        options.TypeInfoResolverChain.Insert(0, LaunchJsonContext.Default);
+        options.PropertyNamingPolicy = JsonNamingPolicy.SnakeCaseLower;
+    }
+}