feat(web): address destinations, cards and panel views by path

[tlgimenes]

What

Navigation was thread-based: /$org/$taskId with a ?main= param selecting the main panel. Destinations were overlays on someone's thread, so opening one from a coding agent forced a hand-back to the Super Agent, minting a thread to do it.

Now every page, card and panel view has an address:

/$org/home	Overview
/$org/agents/{-$project}/{-$panel}	an agent's workspace; the view is a path segment
/$org/tasks/{-$taskKey}	the board, and /$org/tasks/DECO-01 opens that card
/$org/reports /$org/library	org-wide
/$org/$taskId	legacy, mounted forever, translated

Unconditional — #6642 removed nav_v2 and made first-class navigation the only UI.

The rule

Path = which page. Search = how that page is laid out.

main used to conflate two things: which view shows, and whether the panel is open at all (the 0 sentinel). That conflation — not the path — is why a segment couldn't express "closed". Split them: the path names the view, and ?mainpanel mirrors ?sidepanel as a boolean. The six tab ids carrying a payload (app:<conn>:<tool>, code:<path>, …) keep it in search, since they encode their own / and :.

main/sidepanel/thread are declared once on the pathless agent-shell parent.

Cards

The segment is the human key — DECO-01, or a synced card's own OS-333 — because a uuid is not a thing anyone pastes into Slack. A non-canonical spelling (deco-1, a raw id) rewrites itself to the shareable form. /$org/t/KEY stays for delivered digest email, reduced to a redirect needing no fetch.

Legacy URLs never break

/$org/$taskId translates via a pure (pathname, search) function with no thread lookup. ?main= is accepted forever: two server-side emitters put main=app:<conn>:<tool> into mail already in inboxes. Those emitters now mint the path form, so only delivered links use the old shape.

Bugs fixed, all found by running it

• Panel toggles fabricated a thread id via crypto.randomUUID() that reached the SSE subscriber — a retry loop, 24–570 stream 404s per destination visit — and reported fabricated thread_ids to PostHog.
• "New chat" on a project created the thread on the Super Agent, then wrote a stale ?virtualmcpid= that overrode the path segment.
• Org-level destinations could be scoped to a project the same way; /home, /tasks, /reports, /library are Super-Agent-only again.
• ProjectSwitcher remount-looped /chat and /tasks (two useSuspenseQuery dialogs in a portal whose target node is provider state).
• Stripe return URLs pointed at /{org}/members, which matched no route — it fell through and minted a thread row named members on every checkout return.
• /$org?sidepanel=true silently dropped the param, so the URL that opens the chat did nothing.
• choose-editor was not a reserved org slug despite being a root route.

Also

STUDIO_API_TARGET=https://studio.decocms.com bun run --cwd=apps/web dev points the dev server's /api proxy at a remote Studio, for exercising the UI against real data. It rewrites Origin because trustedOrigins derives from the server's own base URL — safe only because the proxy is unreachable off the machine.

Testing

fmt, check (14 workspaces), lint (0 errors), knip clean. bun run test → 7895 pass / 0 fail. Browser-verified against a real org: every destination, both legacy translations, the card URL round-trip, and the panel defaults.

Known gaps

• /$org/chat doesn't 404 — the legacy catch-all swallows any unknown single segment. Pre-existing, but the retired URL now fails silently.
• A pasted ?virtualmcpid= stays visible on org-level URLs. Inert; deliberately not stripped rather than add a third canonicalisation.
• use-destination-route.test.ts was deleted with the project switcher (built, then removed as premature). DESTINATION_ROUTE and useLeafRoutePath have no unit coverage.
• Cold entry to /$org shows Overview with no composer — the uniform collapse rule; starting a chat means opening the panel first.

🤖 Generated with Claude Code