refactor(desktop): enforce a metadata-free renderer startup boundary

apps/desktop/src/main/__tests__/model-catalog-choices.test.ts

@@ -5,48 +5,22 @@ import { dirname, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { describe, it } from 'node:test';
 import { build } from 'esbuild';
-import type { LlmConnection } from '@maka/core';
+import type { ChatModelChoice, LlmConnection, SessionSummary } from '@maka/core';
+import { buildChatModelChoices } from '@maka/core/chat-model-choice';
+import { buildConnectionModelCatalogEntries } from '@maka/core/model-catalog';
+import {
+  normalizeActiveChatModel,
+  pickNewChatModel,
+} from '../../renderer/shell-chat-model-selection.js';
 
 const REPO_ROOT = resolve(import.meta.dirname, '../../../../..');
 
 type ModelCatalogChoicesModule = {
   buildCatalogRecommendedDefaultModel(providerType: LlmConnection['providerType']): string;
-  buildCatalogChatModelChoices(connections: readonly LlmConnection[]): Array<{
-    connectionSlug: string;
-    providerType: string;
-    model: string;
-    label: string;
-    connectionName?: string;
-  }>;
-  pickCatalogDefaultChatModel(connection: LlmConnection):
-    | { llmConnectionSlug: string; model: string }
-    | undefined;
-  pickNewChatModel(input: {
-    pending: { llmConnectionSlug: string; model: string } | null;
-    activationCandidate?: { llmConnectionSlug: string; model: string };
-    catalogDefault: { llmConnectionSlug: string; model: string } | undefined;
-    choices: Array<{
-      connectionSlug: string;
-      providerType: LlmConnection['providerType'];
-      model: string;
-      label: string;
-    }>;
-  }): { llmConnectionSlug: string; model: string } | undefined;
   buildCatalogDailyReviewModelOptions(
     connections: readonly LlmConnection[],
     currentModelKey: string,
   ): Array<readonly [string, string]>;
-  buildCatalogModelChoices(connection: LlmConnection): Array<{
-    id: string;
-    displayName?: string;
-    source: string;
-    recommendedRank?: number;
-    lifecycle: string;
-    docsUrl?: string;
-    availability: string;
-    unavailableReason: string;
-    isDefault: boolean;
-  }>;
 };
 
 let modulePromise: Promise<ModelCatalogChoicesModule> | undefined;
@@ -92,8 +66,57 @@ function choiceIdentity(choice: {
 }
 
 describe('model catalog picker helpers', () => {
-  it('uses the first offered model when no user or workspace preference exists', async () => {
-    const { pickNewChatModel } = await importModelCatalogChoices();
+  it('keeps the first offered Codex model when replacing an unsupported stored model', () => {
+    const choices: ChatModelChoice[] = [
+      {
+        connectionSlug: 'codex-account',
+        providerType: 'openai-codex',
+        providerLabel: 'OpenAI OAuth',
+        model: 'first-offered',
+        label: 'First offered',
+        isDefault: false,
+        thinkingLevels: [],
+      },
+      {
+        connectionSlug: 'codex-account',
+        providerType: 'openai-codex',
+        providerLabel: 'OpenAI OAuth',
+        model: 'later-default',
+        label: 'Later default',
+        isDefault: true,
+        thinkingLevels: [],
+      },
+    ];
+    const session: SessionSummary = {
+      id: 'session-1',
+      name: 'Legacy Codex session',
+      isFlagged: false,
+      isArchived: false,
+      labels: [],
+      hasUnread: false,
+      status: 'active',
+      backend: 'ai-sdk',
+      llmConnectionSlug: 'codex-account',
+      connectionLocked: true,
+      model: 'gpt-5-codex',
+      permissionMode: 'ask',
+    };
+
+    assert.equal(
+      normalizeActiveChatModel(
+        session,
+        connection({
+          slug: 'codex-account',
+          providerType: 'openai-codex',
+          defaultModel: 'gpt-5-codex',
+        }),
+        choices,
+      ),
+      'first-offered',
+    );
+  });
+
+  it('uses the first offered model when no user or workspace preference exists', () => {
     assert.deepEqual(
       pickNewChatModel({
         pending: null,
@@ -102,17 +125,19 @@ describe('model catalog picker helpers', () => {
           {
             connectionSlug: 'opencode-free',
             providerType: 'opencode-free',
+            providerLabel: 'OpenCode Zen',
             model: 'mimo-v2.5-free',
             label: 'MiMo V2.5 Free',
+            isDefault: true,
+            thinkingLevels: [],
           },
         ],
       }),
       { llmConnectionSlug: 'opencode-free', model: 'mimo-v2.5-free' },
     );
   });
 
-  it('uses the readiness-checked activation candidate before an unverified first choice', async () => {
-    const { pickNewChatModel } = await importModelCatalogChoices();
+  it('uses the readiness-checked activation candidate before an unverified first choice', () => {
     assert.deepEqual(
       pickNewChatModel({
         pending: null,
@@ -125,24 +150,29 @@ describe('model catalog picker helpers', () => {
           {
             connectionSlug: 'missing-key-first',
             providerType: 'anthropic',
+            providerLabel: 'Anthropic',
             model: 'unusable-model',
             label: 'Unusable',
+            isDefault: true,
+            thinkingLevels: [],
           },
           {
             connectionSlug: 'ready-second',
             providerType: 'opencode-free',
+            providerLabel: 'OpenCode Zen',
             model: 'ready-model',
             label: 'Ready',
+            isDefault: true,
+            thinkingLevels: [],
           },
         ],
       }),
       { llmConnectionSlug: 'ready-second', model: 'ready-model' },
     );
   });
 
-  it('offers the normalized fallback for legacy Codex-only inventory', async () => {
-    const { buildCatalogChatModelChoices } = await importModelCatalogChoices();
-    const choices = buildCatalogChatModelChoices([
+  it('offers the normalized fallback for legacy Codex-only inventory', () => {
+    const choices = buildChatModelChoices([
       connection({
         slug: 'codex-account',
         providerType: 'openai-codex',
@@ -157,9 +187,7 @@ describe('model catalog picker helpers', () => {
     ]);
   });
 
-  it('projects enabled models across wired providers without collapsing provider identities', async () => {
-    const { buildCatalogChatModelChoices, buildCatalogModelChoices } =
-      await importModelCatalogChoices();
+  it('projects enabled models across wired providers without collapsing provider identities', () => {
     const openrouter = connection({
       slug: 'openrouter-main',
       providerType: 'openrouter',
@@ -173,15 +201,15 @@ describe('model catalog picker helpers', () => {
       modelSource: 'fetched',
     });
     assert.deepEqual(
-      buildCatalogChatModelChoices([openrouter]).map((choice) => choice.model),
+      buildChatModelChoices([openrouter]).map((choice) => choice.model),
       ['openrouter/auto', 'anthropic/claude-sonnet-4.6'],
     );
     assert.deepEqual(
-      buildCatalogModelChoices(openrouter).map((choice) => choice.id),
+      buildConnectionModelCatalogEntries({ connection: openrouter }).map((choice) => choice.id),
       ['openrouter/auto', 'anthropic/claude-sonnet-4.6', 'openai/gpt-5.5'],
     );
 
-    const choices = buildCatalogChatModelChoices([
+    const choices = buildChatModelChoices([
       connection({
         slug: 'ollama-cloud',
         providerType: 'ollama-cloud',
@@ -231,9 +259,8 @@ describe('model catalog picker helpers', () => {
     ]);
   });
 
-  it('keeps API connection labels while redacting OAuth account identities', async () => {
-    const { buildCatalogChatModelChoices } = await importModelCatalogChoices();
-    const choices = buildCatalogChatModelChoices([
+  it('keeps API connection labels while redacting OAuth account identities', () => {
+    const choices = buildChatModelChoices([
       connection({
         slug: 'openrouter',
         name: 'Openrouter',
@@ -351,12 +378,7 @@ describe('model catalog picker helpers', () => {
   });
 
   it('derives canonical defaults, exact provider ids, and missing-default state', async () => {
-    const {
-      buildCatalogChatModelChoices,
-      buildCatalogModelChoices,
-      buildCatalogRecommendedDefaultModel,
-      pickCatalogDefaultChatModel,
-    } = await importModelCatalogChoices();
+    const { buildCatalogRecommendedDefaultModel } = await importModelCatalogChoices();
     assert.deepEqual(
       [
         'deepseek',
@@ -391,7 +413,7 @@ describe('model catalog picker helpers', () => {
       modelSource: 'fetched',
     });
     assert.deepEqual(
-      buildCatalogModelChoices(zenmux).map(({ id, source, isDefault }) => ({
+      buildConnectionModelCatalogEntries({ connection: zenmux }).map(({ id, source, isDefault }) => ({
         id,
         source,
         isDefault,
@@ -401,36 +423,19 @@ describe('model catalog picker helpers', () => {
         { id: 'moonshotai/kimi-k2.7-code', source: 'provider_api', isDefault: false },
       ],
     );
-    assert.deepEqual(buildCatalogChatModelChoices([zenmux]).map(choiceIdentity), [
+    assert.deepEqual(buildChatModelChoices([zenmux]).map(choiceIdentity), [
       'zenmux:zenmux:moonshotai/kimi-k2.5',
       'zenmux:zenmux:moonshotai/kimi-k2.7-code',
     ]);
-    assert.deepEqual(pickCatalogDefaultChatModel(zenmux), {
-      llmConnectionSlug: 'zenmux',
-      model: 'moonshotai/kimi-k2.5',
-    });
-    assert.deepEqual(
-      pickCatalogDefaultChatModel(
-        connection({
-          slug: 'openai-api',
-          providerType: 'openai',
-          defaultModel: '  gpt-4o-mini  ',
-          models: [{ id: 'gpt-4o-mini' }],
-          modelSource: 'fetched',
-        }),
-      ),
-      { llmConnectionSlug: 'openai-api', model: 'gpt-4o-mini' },
-    );
-
-    const missingDefault = buildCatalogModelChoices(
-      connection({
+    const missingDefault = buildConnectionModelCatalogEntries({
+      connection: connection({
         slug: 'openai-api',
         providerType: 'openai',
         defaultModel: 'gpt-5',
         models: [{ id: 'gpt-4o-mini' }],
         modelSource: 'fetched',
       }),
-    );
+    });
     assert.deepEqual(
       missingDefault.map(({ id, availability, unavailableReason, isDefault }) => ({
         id,
@@ -454,14 +459,14 @@ describe('model catalog picker helpers', () => {
       ],
     );
     assert.equal(
-      buildCatalogModelChoices(
-        connection({
+      buildConnectionModelCatalogEntries({
+        connection: connection({
           slug: 'deepseek-api',
           providerType: 'deepseek',
           defaultModel: 'deepseek-v4-flash',
           modelSource: 'fallback',
         }),
-      ).filter((choice) => choice.source === 'static_catalog').length,
+      }).filter((choice) => choice.source === 'static_catalog').length,
       4,
     );
   });

apps/desktop/src/main/__tests__/onboarding-service.test.ts

@@ -44,6 +44,24 @@ function realConnection(overrides: Partial<LlmConnection> = {}): LlmConnection {
   } as LlmConnection;
 }
 
+function session(overrides: Partial<SessionSummary> = {}): SessionSummary {
+  return {
+    id: 's1',
+    name: 'Session',
+    isFlagged: false,
+    isArchived: false,
+    labels: [],
+    hasUnread: false,
+    status: 'active',
+    backend: 'ai-sdk',
+    llmConnectionSlug: 'a',
+    connectionLocked: true,
+    model: 'claude-sonnet-4-5-20250929',
+    permissionMode: 'ask',
+    ...overrides,
+  };
+}
+
 function fakeDeps(overrides: Partial<OnboardingServiceDeps> = {}): OnboardingServiceDeps {
   const milestones: OnboardingMilestone[] = [];
   return {
@@ -72,6 +90,48 @@ function fakeDeps(overrides: Partial<OnboardingServiceDeps> = {}): OnboardingSer
 }
 
 describe('createOnboardingService.getSnapshot', () => {
+  it('pins the complete renderer projection for every physical session', async () => {
+    const service = createOnboardingService(fakeDeps({
+      listConnections: async () => [realConnection({ slug: 'a' })],
+      getDefaultSlug: async () => 'a',
+      listSessions: async () => [
+        session(),
+        session({ id: 's2', llmConnectionSlug: 'removed' }),
+      ],
+      getMilestones: async () => [{ id: 'initial_onboarding', completedAt: 1 }],
+      hasCredential: async () => true,
+    }));
+
+    const snapshot = await service.getSnapshot();
+    assert.deepEqual({
+      chatModelChoices: snapshot.chatModelChoices,
+      sessionSendOutcomes: snapshot.sessionSendOutcomes,
+    }, {
+      chatModelChoices: [{
+        connectionSlug: 'a',
+        providerType: 'anthropic',
+        providerLabel: 'Anthropic',
+        model: 'claude-sonnet-4-5-20250929',
+        label: 'Claude Sonnet 4.5',
+        connectionName: 'Anthropic Live',
+        isDefault: true,
+        thinkingLevels: ['off'],
+      }],
+      sessionSendOutcomes: {
+        s1: { kind: 'ready' },
+        s2: {
+          kind: 'blocked',
+          reason: 'connection_missing',
+          connectionLocked: true,
+        },
+      },
+    });
+    assert.deepEqual(
+      Object.keys(snapshot.sessionSendOutcomes).sort(),
+      snapshot.sessions.map((item) => item.id).sort(),
+    );
+  });
+
   it('returns derived OnboardingState + sanitized milestones together', async () => {
     const service = createOnboardingService(
       fakeDeps({
@@ -86,6 +146,27 @@ describe('createOnboardingService.getSnapshot', () => {
     assert.deepEqual(snapshot.milestones, [
       { id: 'first_chat_sent', completedAt: 1_700_000_000_000 },
     ]);
+    assert.equal(snapshot.chatModelChoices[0]?.providerLabel, 'Anthropic');
+    assert.equal(snapshot.chatModelChoices[0]?.isDefault, true);
+  });
+
+  it('projects session send readiness again after connection credentials change', async () => {
+    let hasCredential = true;
+    const service = createOnboardingService(fakeDeps({
+      listConnections: async () => [realConnection({ slug: 'a' })],
+      getDefaultSlug: async () => 'a',
+      listSessions: async () => [session()],
+      getMilestones: async () => [{ id: 'initial_onboarding', completedAt: 1 }],
+      hasCredential: async () => hasCredential,
+    }));
+
+    assert.deepEqual((await service.getSnapshot()).sessionSendOutcomes.s1, { kind: 'ready' });
+    hasCredential = false;
+    assert.deepEqual((await service.getSnapshot()).sessionSendOutcomes.s1, {
+      kind: 'blocked',
+      reason: 'missing_api_key',
+      connectionLocked: true,
+    });
   });
 
   it('keeps physical revision summaries in the snapshot for version navigation', async () => {