Reagan/opencode integration

[Cheggin]

Add browsercode (opencode fork) with many edits.

Currently kimi, qwen, and minimax models are added.

runs via bcode within cli with api key auth

also normalized a few things, such as cli spawning.

and added a spinner that shouldve been in a different pr but it's fine haha

---

Summary by cubic

Adds a new browsercode engine with provider/model selection and API key management, standardizes CLI spawning across platforms, and improves reliability so sessions show the exact model used and failures are easier to diagnose.

• New Features

  • browsercode adapter wrapping bcode run --format json; providers: Moonshot Kimi, Alibaba Qwen, MiniMax; uses our Electron harness (no native browser_execute).
  • EnginePicker flyout for provider/model; Settings to save/test/delete provider keys with deep-link to a provider; sessions/DB store model and hub/logs show engine/model; engine install via IPC for claude-code, codex, browsercode; pill remembers selected engine; inline “thinking” spinner in Terminal.

• Refactors

  • Centralized CLI spawning in cliSpawn (spawnCli/runCliCapture); PATH enrichment adds ~/.bcode/bin; Windows/POSIX shim fixes; stdin-based prompt on Windows; timeouts resolve even if children ignore SIGTERM; Linux spawn smoke in CI.
  • BrowserCode correctness: only treat step_finish as done when reason=stop; dedupe done events and watch actual harness files for edits; map provider errors to friendly messages; production builds disallow BrowserCode mock API-key tests; deterministic setup/parser state (dedupe setup clicks, normalize provider ids/keys, preserve manual-zoom centering, capture Claude auth transport errors, handle terminal-only tool_use timing); cancelled/canceled tool_use now reports as unsuccessful.

^{Written for commit 53d1787. Summary will update on new commits.}

[cubic-dev-ai]

6 issues found across 44 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="app/src/renderer/hub/BrowserCodeModelPicker.tsx">

<violation number="1" location="app/src/renderer/hub/BrowserCodeModelPicker.tsx:282">
P2: Use the provider default model as a fallback in the submenu so the active model is highlighted correctly when `lastModel` is unset.</violation>
</file>

<file name="app/src/main/hl/engines/cliSpawn.ts">

<violation number="1" location="app/src/main/hl/engines/cliSpawn.ts:44">
P1: Timeout logic can hang indefinitely because it only sends `SIGTERM` and never resolves on timeout if the process does not exit.</violation>
</file>

<file name="app/src/main/hl/engines/browsercode/adapter.ts">

<violation number="1" location="app/src/main/hl/engines/browsercode/adapter.ts:93">
P1: Passing the wrapped multi-line prompt via argv can break BrowserCode on Windows `.cmd` shims. Use stdin payload mode instead of `args.push(wrappedPrompt)` for this adapter.</violation>
</file>

<file name="app/src/main/index.ts">

<violation number="1" location="app/src/main/index.ts:1252">
P2: Avoid info-level logging in the `sessions:view-resize` hot path; this handler runs every frame and can cause resize jank and log spam.</violation>
</file>

<file name="app/src/main/settings/apiKeyIpc.ts">

<violation number="1" location="app/src/main/settings/apiKeyIpc.ts:428">
P1: Development/testing backdoor left in production code. The `mockTestResult` function allows anyone to bypass real API key validation by entering `mock:ok` as their key. This should be gated behind a `NODE_ENV` / dev-mode check, or removed entirely before shipping.</violation>
</file>

<file name="app/src/main/hl/engines/installer.ts">

<violation number="1" location="app/src/main/hl/engines/installer.ts:43">
P1: Windows script construction breaks for commands containing `&&`. The browsercode installer command uses `&&` internally, but `openWindowsTerminal` joins all parts with ` & `. Since cmd.exe treats `&&` as a higher-precedence conditional operator, the `echo` line will be split and `bash` will run prematurely as a conditional. Wrap the command and echo in parentheses or use a different composition strategy.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}

[Cheggin]

@cubic review

[cubic-dev-ai]

@cubic review

@Cheggin I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

5 issues found across 48 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="app/src/renderer/hub/EnginePicker.tsx">

<violation number="1" location="app/src/renderer/hub/EnginePicker.tsx:203">
P2: Prevent repeated clicks from re-triggering install/login while that engine is already in progress.</violation>
</file>

<file name="app/src/main/identity/authStore.ts">

<violation number="1" location="app/src/main/identity/authStore.ts:252">
P3: Provider ID is validated with `.trim()` but stored untrimmed, inconsistent with `saveBrowserCodeKey` which trims before using as key. If persisted data contains whitespace in a provider key, it will survive normalization but won't match subsequent lookups.</violation>
</file>

<file name="app/src/main/sessions/BrowserPool.ts">

<violation number="1" location="app/src/main/sessions/BrowserPool.ts:445">
P2: Bounds fitting uses a computed zoom from height instead of the current webContents zoom, so resize centering can drift after window/manual zoom changes.</violation>
</file>

<file name="app/src/main/hl/engines/claude-code/adapter.ts">

<violation number="1" location="app/src/main/hl/engines/claude-code/adapter.ts:74">
P3: Propagate `r.error` here so spawn/timeout failures are not mislabeled as a normal auth failure.</violation>
</file>

<file name="app/src/main/hl/engines/browsercode/adapter.ts">

<violation number="1" location="app/src/main/hl/engines/browsercode/adapter.ts:222">
P2: Tool timing is broken: `pendingTools` is read/deleted but never populated, so `tool_result.ms` is always near zero.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}

[cubic-dev-ai]

1 issue found across 10 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="app/src/main/hl/engines/browsercode/adapter.ts">

<violation number="1" location="app/src/main/hl/engines/browsercode/adapter.ts:261">
P2: Cancelled tool executions are incorrectly marked as successful (`ok: true`).</violation>
</file>

_{Tip: Review your code locally with the cubic CLI to iterate faster.
Fix all with cubic.}