Fix broken build/release, CLI, sync, web, extension and desktop app; rewrite README

.github/workflows/ci.yml

@@ -8,35 +8,30 @@ on:
 
 jobs:
   cli-tests:
-    name: CLI Tests (PHP 8.2)
+    name: CLI Tests (PHP ${{ matrix.php }})
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        php: ["8.2", "8.3"]
     steps:
       - uses: actions/checkout@v4
 
       - uses: shivammathur/setup-php@v2
         with:
-          php-version: "8.2"
+          php-version: ${{ matrix.php }}
           extensions: pdo_sqlite, openssl, zip, mbstring, json
-          coverage: xdebug
+          coverage: none
 
       - name: Install CLI dependencies
-        working-directory: contextbridge
+        working-directory: movez
         run: composer install --no-interaction --prefer-dist --optimize-autoloader
 
       - name: Run CLI tests
-        working-directory: contextbridge
+        working-directory: movez
         run: php vendor/bin/pest
         env:
-          CB_KEY_PATH: /tmp/cb_test_key
-          CB_TOKEN_PATH: /tmp/cb_test_token
-
-      - name: Upload coverage
-        uses: codecov/codecov-action@v4
-        with:
-          files: movez/coverage.xml
-          flags: cli
-        continue-on-error: true
-        if: false
+          MOVEZ_KEY_PATH: /tmp/movez_test_key
+          MOVEZ_TOKEN_PATH: /tmp/movez_test_token
 
   web-tests:
     name: Web Tests (PHP 8.2 + Node 20)
@@ -48,7 +43,7 @@ jobs:
       - uses: shivammathur/setup-php@v2
         with:
           php-version: "8.2"
-          extensions: pdo_sqlite, mbstring, openssl, zip, bcmath
+          extensions: pdo_sqlite, mbstring, openssl, zip, bcmath, pcntl, posix
 
       - uses: actions/setup-node@v4
         with:
@@ -64,6 +59,10 @@ jobs:
         working-directory: web
         run: npm ci
 
+      - name: Type check frontend
+        working-directory: web
+        run: npm run type-check
+
       - name: Build frontend assets
         working-directory: web
         run: npm run build
@@ -99,11 +98,36 @@ jobs:
         working-directory: vscode-extension
         run: npm ci
 
-      - name: TypeScript type check
+      - name: Type check and compile
         working-directory: vscode-extension
-        run: npx tsc --noEmit
+        run: npm test
 
-      - name: Run extension tests
+      - name: Package VSIX (non-interactive)
         working-directory: vscode-extension
-        run: npm test
-        continue-on-error: true
+        run: npx vsce package --no-dependencies --out movez-vscode.vsix
+
+  desktop-typecheck:
+    name: Desktop App Type Check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: electron-app/package-lock.json
+
+      - name: Install desktop dependencies
+        working-directory: electron-app
+        run: npm ci
+        env:
+          ELECTRON_SKIP_BINARY_DOWNLOAD: "1"
+
+      - name: Type check
+        working-directory: electron-app
+        run: npm run typecheck
+
+      - name: Build
+        working-directory: electron-app
+        run: npm run build

.github/workflows/release.yml

@@ -19,29 +19,26 @@ jobs:
         with:
           php-version: "8.2"
           extensions: pdo_sqlite, openssl, zip, mbstring
+          ini-values: phar.readonly=0
 
       - name: Install CLI dependencies (no dev)
-        working-directory: contextbridge
+        working-directory: movez
         run: composer install --no-dev --optimize-autoloader --no-interaction
 
       - name: Build PHAR
-        working-directory: contextbridge
-        run: php movez app:build movez --build-version=${{ github.ref_name }} --no-interaction
+        working-directory: movez
+        run: php movez app:build movez.phar --build-version=${{ github.ref_name }} --no-interaction
 
-      - name: Upload PHAR to release
-        uses: softprops/action-gh-release@v2
-        with:
-          files: contextbridge/builds/movez
-          name: MoveZ ${{ github.ref_name }}
-          body: |
-            ## MoveZ ${{ github.ref_name }}
+      - name: Smoke test PHAR
+        working-directory: movez
+        run: |
+          php builds/movez.phar --version
+          php builds/movez.phar list --raw | grep -q '^export'
 
-            ### Installation
-            ```bash
-            chmod +x movez
-            mv movez /usr/local/bin/movez
-            movez doctor
-            ```
+      - uses: actions/upload-artifact@v4
+        with:
+          name: movez-phar
+          path: movez/builds/movez.phar
 
   build-vsix:
     name: Build VS Code Extension
@@ -52,16 +49,102 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: "20"
+          cache: npm
+          cache-dependency-path: vscode-extension/package-lock.json
 
       - name: Install extension dependencies
         working-directory: vscode-extension
         run: npm ci
 
       - name: Package extension
         working-directory: vscode-extension
-        run: npx vsce package --no-dependencies
+        run: npx vsce package --no-dependencies --out movez-vscode.vsix
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: movez-vsix
+          path: vscode-extension/movez-vscode.vsix
+
+  build-desktop:
+    name: Build Windows Desktop Installer
+    needs: build-phar
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: electron-app/package-lock.json
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: movez-phar
+          path: electron-app/resources
 
-      - name: Upload VSIX to release
-        uses: softprops/action-gh-release@v2
+      - name: Bundle PHP runtime
+        shell: pwsh
+        working-directory: electron-app/resources
+        run: |
+          Invoke-WebRequest -Uri "https://windows.php.net/downloads/releases/latest/php-8.3-nts-Win32-vs16-x64-latest.zip" -OutFile php.zip
+          Expand-Archive php.zip -DestinationPath php
+          Remove-Item php.zip
+          @(
+            'extension_dir = "ext"',
+            'extension=openssl',
+            'extension=pdo_sqlite',
+            'extension=zip',
+            'extension=mbstring',
+            'extension=fileinfo'
+          ) | Set-Content -Encoding ascii php/php.ini
+          php/php.exe -v
+          php/php.exe movez.phar --version
+
+      - name: Install desktop dependencies
+        working-directory: electron-app
+        run: npm ci
+
+      - name: Set version from tag
+        working-directory: electron-app
+        shell: pwsh
+        run: npm version "$("${{ github.ref_name }}".TrimStart('v'))" --no-git-tag-version --allow-same-version
+
+      - name: Build installer
+        working-directory: electron-app
+        run: npm run package -- --win --publish never
+
+      - uses: actions/upload-artifact@v4
         with:
-          files: vscode-extension/*.vsix
+          name: movez-desktop
+          path: electron-app/dist/*.exe
+
+  publish:
+    name: Publish GitHub Release
+    needs: [build-phar, build-vsix, build-desktop]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+          merge-multiple: true
+
+      - uses: softprops/action-gh-release@v2
+        with:
+          name: MoveZ ${{ github.ref_name }}
+          files: artifacts/*
+          body: |
+            ## MoveZ ${{ github.ref_name }}
+
+            | File | What it is |
+            |---|---|
+            | `MoveZ-Setup-*.exe` | Windows desktop app (bundles PHP and the CLI) |
+            | `movez.phar` | Cross-platform CLI (needs PHP 8.2+ with pdo_sqlite, openssl, zip, mbstring) |
+            | `movez-vscode.vsix` | VS Code / Cursor extension — install with "Extensions: Install from VSIX…" |
+
+            ### CLI quick start
+            ```bash
+            curl -L https://github.com/kv4u/MoveZ/releases/latest/download/movez.phar -o movez
+            chmod +x movez && sudo mv movez /usr/local/bin/movez
+            movez doctor
+            ```

.gitignore

@@ -5,10 +5,13 @@ vendor/
 # Build artifacts
 electron-app/dist/
 electron-app/out/
-contextbridge/contextbridge.phar
-contextbridge/box.phar
-contextbridge/builds/
+movez/movez.phar
+movez/box.phar
+movez/builds/
 vscode-extension/*.vsix
+vscode-extension/out/
+web/public/build/
+*.tsbuildinfo
 
 # Bundled runtime binaries (downloaded during setup, not source)
 electron-app/resources/php/
@@ -45,5 +48,5 @@ npm-debug.log*
 .php-cs-fixer.cache
 
 # Personal utility scripts
-contextbridge/bundle_export.php
-contextbridge/make_cbz.php
+movez/bundle_export.php
+movez/make_cbz.php

AGENTS.md

@@ -81,7 +81,7 @@ movez/         ← Laravel Zero CLI
 │   ├── Support/       BundleSchema, PlatformPaths
 │   └── Commands/      ExportCommand, ImportCommand, TransferCommand, PackageCommand,
 │                      UnpackCommand, Sync/SyncPushCommand, Sync/SyncPullCommand,
-│                      ListCommand, DoctorCommand
+│                      ListCommand, ShowCommand, DoctorCommand
 ├── config/movez.php
 └── tests/             Unit/ + Feature/ (Pest PHP 3)
 
@@ -99,6 +99,10 @@ web/                   ← Laravel 12 Dashboard + Sync Server
 │                          TurnBlock.vue, SessionCard.vue
 └── e2e/                   Playwright tests
 
+electron-app/          ← Electron + Vue 3 Windows desktop app (bundles PHP + movez.phar)
+├── electron/          main.ts, preload.ts, cli.ts, ipc/*.ts
+└── src/               pages/, components/, stores/
+
 vscode-extension/      ← TypeScript VS Code extension
 ├── src/               extension.ts, SessionTreeProvider.ts, MigrationPanel.ts
 └── package.json
@@ -143,8 +147,8 @@ Key stored at `~/.movez/key` with chmod 0600.
 ## 6. Bundle Format (.cbz)
 
 ZIP archive containing:
-- `bundle.json` — array of SessionDTO serialized via `toArray()`
-- `manifest.json` — `{ version, source_tool, machine_sha, exported_at, session_count }`
+- `bundle.json` — `{ version, source_tool, exported_at, sessions: SessionDTO::toArray()[] }` (encrypted string when `manifest.encrypted`)
+- `manifest.json` — `{ version, source_tool, machine_sha, exported_at, session_count, encrypted }`
 - `config.json` (optional) — ProjectConfigDTO
 
 Required keys validated by `BundleSchema::validate()`: `version`, `sessions`, `source_tool`, `exported_at`
@@ -155,25 +159,28 @@ Required keys validated by `BundleSchema::validate()`: `version`, `sessions`, `s
 
 | Tool | Format | Storage |
 |---|---|---|
-| cursor | SQLite state.vscdb | workspaceStorage/ |
-| windsurf | SQLite state.vscdb | workspaceStorage/ |
+| cursor | JSONL transcripts + SQLite state.vscdb | ~/.cursor/projects/ + globalStorage/workspaceStorage |
+| windsurf | Encrypted protobuf (Cascade) | not supported — parser/writer throw |
 | claude-code | JSONL | ~/.claude/projects/ |
-| codex | JSONL | ~/.codex/sessions/ |
+| codex | JSONL rollout (session_meta/response_item) | ~/.codex/sessions/YYYY/MM/DD/ |
 | copilot-cli | JSON | ~/.copilot/sessions/ |
-| cline | JSON (glob) | ~/.vscode/extensions/saoudrizwan.claude-dev-*/ |
-| continue | SQLite sessions.db | ~/.continue/ |
+| cline | JSON per task (read-only) | ~/.vscode/extensions/saoudrizwan.claude-dev-*/data/tasks/<id>/ |
+| continue | SQLite sessions.db (read-only) | ~/.continue/ |
 
 ---
 
 ## 8. API Routes (Sync Server)
 
 ```
-POST /api/sync/push    — Bearer token, body: { sessions: encrypted_json }
-GET  /api/sync/pull    — Bearer token, returns: { sessions: encrypted_json }
+POST /api/sync/push    — Bearer token, body: { sessions: encrypted_json, count?: int }
+GET  /api/sync/pull    — Bearer token, returns: { sessions: encrypted_json|null, count: int }
 ```
 
 Auth: `ApiTokenMiddleware` — Bearer token → `hash('sha256', $token)` → match `users.api_token`
 
+Payloads are stored in `sync_blobs` (one per user). Issue tokens with `php artisan movez:token <email>`.
+CLI clients read `MOVEZ_TOKEN` / `MOVEZ_SERVER_URL` so tokens never appear in process lists.
+
 ---
 
 ## 9. VS Code Extension Commands
@@ -184,5 +191,6 @@ Auth: `ApiTokenMiddleware` — Bearer token → `hash('sha256', $token)` → mat
 - `movez.syncPush`
 - `movez.syncPull`
 - `movez.refreshSessions`
+- `movez.setToken` (stores the sync token in SecretStorage)
 
-Settings: `movez.cliPath`, `movez.serverUrl`, `movez.token`
+Settings: `movez.cliPath`, `movez.phpPath`, `movez.serverUrl` (`movez.token` is deprecated)