Xeo Forge v1.25.2 — The Clean First Minute

v1.25.2 — The Clean First Minute

Summary

v1.25.2 fixes what a stock Windows machine actually hits in the first ten
minutes. Every defect in this release was found by driving the full local
verification flow — clone → install → test suite → desktop:dev — on a
clean checkout, and every fix is verified at that same layer: the same
typecheck, the same suite, a fresh production build, and live HTTP checks
against the rebuilt standalone.

None of these are architecture changes. They are the difference between
"a Windows user with a space in their folder name never reaches the
product" and "the first minute just works."

The defect: desktop:dev was unbootable on any path containing a space

scripts/prepare-desktop.mjs spawned electron-rebuild.cmd through
spawnSync(..., { shell: true }) on Windows WITHOUT quoting the command
path. shell: true joins the command and args into one cmd.exe line, and
cmd.exe splits an unquoted program path at the first space — so a checkout
at C:\My Projects\xeo-forge failed with:

'C:\My Projects\xeo-forge' is not recognized as an internal or external command

…before Electron ever launched, and the message pointed at the FOLDER, not
at the tool, so nothing about it suggested a quoting bug. The fix quotes the
executable on win32. node-gyp additionally warns about spaces in the build
path on its own; that limitation is real and now documented instead of
discovered.

The failure output also stops being a bare exit code: when the rebuild
fails, the error now states the actual prerequisites (Windows: Visual
Studio Build Tools with the "Desktop development with C++" workload) and
the XEO_SKIP_NATIVE_REBUILD=1 escape hatch for UI-only local runs, with
its honest constraint — the standalone server then runs under the same Node
ABI it was built for.

The defect: a missing Go toolchain killed dev prepare

The Go runtime broker is optional at runtime: the Electron shell boots
without it, warns, and disables broker-backed local process supervision.
But prepare-desktop.mjs still hard-failed the whole prepare step when Go
was absent, for every developer, on every platform — even though only the
packaged installers actually need the broker binaries.

Go is now probed once up front. If it is missing, the broker builds are
skipped with a visible warning and prepare completes; the CI release
runners still have Go and still produce both platform binaries, so the
packaged app is unchanged. The principle the codebase already states —
optional runtime components must not block the dev path — now holds in
the prepare step too.

The defect: the intent router asked for clarification about plain work

classifyWorkIntent("Build a small script that says hello and verify it")
returned clarification_needed. The reason: script was not in
TARGET_PATTERNS, so a completely unambiguous software request had no
"target" in the router's eyes and Work stalled the user behind a visible
choice for no reason.

The pattern lists now cover the common software-work vocabulary for all
five advertised languages (en/ar/zh/ru/fr):

• Nouns (targets): script, feature, bug, test(s), suite, function,
  module, package, library, endpoint, route, service, config,
  dependency/dependencies — plus the same field in Arabic, Chinese, Russian
  and French.
• Verbs (direct actions): add, update, write, refactor, delete, remove,
  install, generate, scaffold, set up/setup — safe only in combination
  with a target hit, which is already the classifier's rule: a bare
  "add some notes" with no target stays conversational.

While pinning this, a dead French pattern surfaced: \b collapses before
an accented capital (É is not \w), so Écris un script… at sentence
start never matched \bécrit — the exact dead-pattern class the file's
own CJK comment warns about, sitting in the French list. The affected
alternatives are unanchored now, with a comment stating why.

All of it is pinned by 8 new regression tests in test/intent.test.ts
(en ×5, ar, fr, plus one "action language with no target still asks for
clarification" guard).

The defect: /tasks returned 404

The task list UI lives at /work; /tasks predates it and 404'd. A
temporary redirect /tasks → /work now keeps the natural URL working
for users and old bookmarks. /tasks/:id keeps its real page.

Verified live on the rebuilt standalone: /tasks → 307 /work,
/tasks/:id still serves its page, /chat unaffected.

Also in this release

• lib/mcp/client.ts default-imports package.json instead of
  named-importing version, clearing the Webpack deprecation warning
  ("should not import the named export … only default export is available
  soon"). MCP_CLIENT_INFO is unchanged at runtime.
• README restructured for the first minute: a five-command quick start now
  sits at the top above the fold, and a new Desktop dev prerequisites
  section states what desktop:dev actually needs on Windows and Linux —
  the MSVC C++ workload, Go, and a space-free checkout path — plus what
  happens when each is missing.

Verified

• tsc --noEmit clean.
• vitest run: 968/968 pass (57 files), including the 8 new intent
  regressions.
• next build clean; the mcp/client version warning is gone from the
  build output.
• Live check on the rebuilt standalone: /tasks → 307 /work;
  /tasks/nonexistent-id → 404 (its real page contract);
  /chat → 200.
• desktop:dev prepare step re-run locally with the quoting fix: the
  electron-rebuild invocation now reaches the toolchain check instead of
  dying at cmd.exe argument parsing.