Permitter Login and AI Agent Combined

.env.example

@@ -1,15 +1,74 @@
+# Copy to .env in the REPO ROOT. `npm run copy-env` propagates it to frontend/ and
+# electron/ for builds; the vite dev server reads frontend/.env, so copy it there too
+# (or run copy-env) after changing anything.
+#
+# Values below are the DEV stage — the one local development is registered for.
+
+# --- Permitteer sign-in (D8: renderer-owned, identical web/desktop) ------------------
+# VITE_* reach the renderer (the whole OIDC client).
+#
+# VITE_OAUTH_ISSUER is the ONLY var with no built-in fallback — without it the app logs
+# "VITE_OAUTH_ISSUER is not configured" and sign-in never starts.
+#
+# Keep VITE_OAUTH_CLIENT_ID as remoteit_desktop for local work. Redirect URIs are
+# registered PER CLIENT, and the deployed AI portal's client (remoteit_portal_ai, set on
+# the Amplify branch) has only https://app.ai.remote.it/authCallback registered — using it
+# locally fails authorize with a 400. remoteit_desktop carries both
+# http://localhost:3003/authCallback and remoteit://authCallback, and both clients are
+# granted the same agent/MCP authorization details, so the chat lane works either way.
+VITE_OAUTH_ISSUER="https://login.dev.remote.it"
+VITE_OAUTH_CLIENT_ID="remoteit_desktop"
+VITE_OAUTH_GRAPHQL_RESOURCE="https://cloud.dev.remote.it/api"
+VITE_OAUTH_PASSPORT_RESOURCE="https://passport.dev.remote.it/account/api"
+VITE_OAUTH_AGENT_RESOURCE="https://agent.dev.remote.it"
+VITE_OAUTH_MCP_RESOURCE="https://cloud.dev.remote.it/mcp"
+VITE_OAUTH_MCP_DETAIL="remoteit_mcp"
+
+# The GraphQL and WebSocket URLs are NOT set here. They default to the stage named by
+# VITE_OAUTH_GRAPHQL_RESOURCE above — on the unified front the resource is the TREE, so
+# cloud.dev…/api -> cloud.dev…/api/graphql and wss://cloud.dev…/api/ws — so a fresh
+# checkout works out of the box; switch stages in the running app under
+# Settings → Test Settings → API Target, which sets both together and mints the matching
+# audience. Setting VITE_GRAPHQL_API/VITE_WEBSOCKET_URL by hand still works, but a value
+# that disagrees with the OIDC resource 401s with nothing in the UI explaining why.
+
+# --- Remote.It AI chat ---------------------------------------------------------------
+# The chat is a license feature ("ai-agent") and nothing else switches it on: the account
+# you sign in with — locally too — needs the ai-agent add-on licence, granted from
+# Admin → Add-ons by a system admin. Settings → Test Settings → Features can switch it
+# back off on an account that holds it. (VITE_CHAT_ALWAYS_ON, which used to default the
+# flag on for the AI portal and dev builds, is retired and ignored.)
+# In dev, agentURL() returns the same-origin "/agent" vite proxy unless Test Settings
+# overrides it, so AGENT_PROXY_TARGET is the knob here: the deployed dev agent, or
+# http://localhost:3001 to run the ai-agent service locally. DPoP proofs are signed over
+# the canonical resource URL, so proxying does not break them.
+AGENT_PROXY_TARGET="https://agent.dev.remote.it"
+VITE_AGENT_URL="https://agent.dev.remote.it"
+
+# --- App ------------------------------------------------------------------------------
 BRAND=remoteit
-AIRBRAKE_PROJECT_KEY="..."
-VITE_PORTAL="..."
-VITE_API_URL="..."
-VITE_CLIENT_ID="..."
-VITE_GRAPHQL_API="..."
-VITE_GRAPHQL_BETA_API="..."
+VITE_PORTAL=false
+VITE_API_URL="https://api.remote.it/apv/v27"
 VITE_DEVELOPER_KEY="..."
-VITE_DEV_CALLBACK_URL="..."
-VITE_PROD_CALLBACK_URL="..."
-VITE_WEBSOCKET_URL="..."
-VITE_WEBSOCKET_BETA_URL="..."
+
+# --- Third party ----------------------------------------------------------------------
+AIRBRAKE_PROJECT_KEY="..."
+VITE_AIRBRAKE_ID="..."
+VITE_AIRBRAKE_KEY="..."
 VITE_ZENDESK_URL="..."
+VITE_ZENDESK_KEY="..."
 VITE_SEGMENT_PROJECT_PORTAL_KEY="..."
-VITE_SEGMENT_PROJECT_KEY="..."
+VITE_SEGMENT_PROJECT_KEY="..."
+VITE_GOOGLE_TAG_MANAGER_DESKTOP_KEY="..."
+VITE_GOOGLE_TAG_MANAGER_PORTAL_KEY="..."
+VITE_GOOGLE_TAG_MANAGER_ANDROID_KEY="..."
+VITE_GOOGLE_TAG_MANAGER_IOS_KEY="..."
+
+# --- Desktop build signing (release builds only) --------------------------------------
+SKIP_SIGNING=true
+APPLE_ID_PASSWORD="..."
+APPLE_TEAM_ID="..."
+WINDOWS_SIGN_USER_NAME="..."
+WINDOWS_SIGN_USER_PASSWORD="..."
+WINDOWS_SIGN_CREDENTIAL_ID="..."
+WINDOWS_SIGN_USER_TOTP="..."

.gitattributes

@@ -0,0 +1,6 @@
+# Vendored snapshot of the API's platform catalogue, written by scripts/platforms-generate.mjs.
+# It is committed on purpose — the app reads it at module load, so generating it at build time
+# would need API credentials in every build and would make builds non-reproducible. Marking it
+# generated collapses it in review, where the meaningful diff is the migration it came from.
+# JSON takes no comments, so this is the only place the marker can live.
+frontend/src/platforms/catalogue.generated.json linguist-generated=true

.github/workflows/mirror-next.yml

@@ -0,0 +1,25 @@
+# app.next.remote.it — the NEXT portal — is this branch built for PRODUCTION's AS and container
+# (Amplify branch `next`, env VITE_OAUTH_ISSUER=https://login.remote.it and cloud.remote.it for
+# the API). Amplify deploys a branch once, so `next` is a git branch that MIRRORS this one: every
+# push here is pushed through, and Amplify's webhook builds it. Nobody commits to `next`.
+#
+# Why a mirror rather than a second Amplify app: one app, one GitHub connection, one build spec
+# and one set of app-level env — `next` differs from app.dev by six branch-level variables.
+name: Mirror to next
+
+on:
+  push:
+    branches: [feat/permitteer-login]
+
+permissions:
+  contents: write
+
+jobs:
+  mirror:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Push this commit to next
+        run: git push --force origin HEAD:refs/heads/next

.github/workflows/typecheck.yml

@@ -38,3 +38,15 @@ jobs:
 
       - name: Run typecheck
         run: npm run typecheck
+
+      # Catalog COVERAGE + parity. i18n:check alone only compares the catalogs to each other, so a
+      # t() key missing from ALL of them (a new UI string shipped on its inline default) passes
+      # unnoticed and renders untranslated for ja/de/es. So first re-extract from source: any
+      # missing key changes a catalog and the clean-diff check fails until it is committed. Then
+      # i18n:check verifies parity, no dead keys, and non-empty English. After typecheck so a
+      # broken build reports first.
+      - name: Check translation catalogs
+        run: |
+          npm run i18n:extract -w=frontend
+          git diff --exit-code -- frontend/src/i18n/locales || (echo "::error::Untracked i18n keys — run 'npm run i18n:extract -w frontend' and commit." && exit 1)
+          npm run i18n:check -w=frontend

RELEASE.md

@@ -29,6 +29,29 @@ A release marked **Pre-release** is only offered to users who have opted in
 That is the whole difference between a beta and a public release — a
 pre-release that is never promoted is invisible to everyone else.
 
+## Before you bump: refresh the platform catalogue
+
+`frontend/src/platforms/catalogue.generated.json` is a committed snapshot of the API's platform
+catalogue — the names, install commands and `/add` page copy that used to be hard-coded here. It
+does not refresh itself, so a release can ship stale platform copy if the catalogue changed in the
+database and nobody propagated it.
+
+```bash
+npm run platforms:generate
+```
+
+No diff is the normal case and means the snapshot is current. A diff means the database moved
+since the last regeneration: review it as a content change, and note that English copy changes
+also need the translations in `frontend/src/i18n/locales/*/platforms.json` updated. Land it as its
+own pull request rather than folding it into the version bump.
+
+The primary control is upstream of this — whoever edits the catalogue should regenerate and open
+that pull request at the time — so this step is a backstop for when that did not happen.
+
+Until the platform catalogue is deployed to the stage the CLI points at, this reports that the
+schema has no catalogue fields. That is expected, not a failure: skip the step and leave the
+committed snapshot as it is.
+
 ## 1. Bump the version
 
 From `main`, with everything merged and CI green:

common/src/constants.ts

@@ -42,3 +42,9 @@ export const DEFAULT_SERVICE: IService = {
   license: 'UNKNOWN',
   attributes: {},
 }
+
+// Chat popout window — the boot flag and dimensions are a contract between
+// the frontend (opens the window with ?chatPopout=<id>) and electron (allows
+// the window.open and sizes the child window)
+export const CHAT_POPOUT_PARAM = 'chatPopout'
+export const CHAT_POPOUT_SIZE = { width: 520, height: 780, minWidth: 360, minHeight: 500 }