fix(web): use themed confirmation dialogs

[StiensWout]

Summary

Rebased onto the newest upstream/main (1a003e383ac6) and addressed the review feedback. The shared themed confirmation coordinator now carries an explicit confirmation intent: destructive actions render the existing T3 destructive/red button variant, while normal confirmations keep the standard primary button.

Deletion, worktree removal, project removal, checkpoint revert, settings reset, and SIGKILL confirmations are destructive. Archive, update/install, and informational confirmations remain normal. Native macOS context menus remain unchanged.

Verification

• vp run --filter @t3tools/web typecheck
• vp run --filter @t3tools/desktop typecheck
• targeted Oxlint on all changed confirmation files
• vp fmt --check
• git diff --check
• focused Vitest invocations retried after vp i; both still fail before test execution because of the repository's runner/configuration bootstrap errors (zero test bodies run)
• CI will re-run the full test job for the new head
• before/after deletion confirmation evidence is inline below
  
  

Scope

Mobile native alerts, CLI prompts, Electron message/error boxes, and native macOS context-menu behavior remain unchanged. The renderer confirmation path fails closed when no themed host is mounted.

Model/harness: gpt-5.6-luna via Codex.

---

Note

Medium Risk
Changes how destructive actions (updates, SIGKILL, deletes via LocalApi) are confirmed; fail-closed behavior when no host is mounted could block actions in edge cases.

Overview
Replaces native browser and Electron confirmation flows with a shared in-app AlertDialog so destructive prompts match the rest of the UI on web and desktop.

A new confirmDialog coordinator queues requests, handles close transitions, and exposes ConfirmDialogHost from the root route. LocalApi.dialogs.confirm now goes through requestConfirmDialog when a host is mounted; if none is registered it returns false instead of calling window.confirm or the desktop bridge.

The Electron confirm IPC path is removed (ElectronDialog.confirm, CONFIRM_CHANNEL, preload confirm, and DesktopBridge.confirm in contracts). Call sites that used window.confirm (update install, SIGKILL in diagnostics/telemetry) now await ensureLocalApi().dialogs.confirm, with pending-state guards to avoid double submissions.

^{Reviewed by Cursor Bugbot for commit 01be733. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Replace native window.confirm with themed in-app confirmation dialogs

• Introduces a confirmDialog coordinator module (confirmDialog.ts) with a pub/sub state machine that serializes confirmation requests, supports a destructive visual variant, and resolves pending dialogs when the host unmounts.
• Adds ConfirmDialogHost.tsx, mounted in the app root, which renders an AlertDialog driven by the coordinator state and handles confirm/cancel/close lifecycle callbacks.
• Updates LocalApi.dialogs.confirm to route exclusively through the coordinator, returning false when no host is registered, and removes the previous window.confirm and desktop bridge fallback paths.
• Removes the Electron confirm IPC handler, ElectronDialog.confirm, CONFIRM_CHANNEL, and desktopBridge.confirm from the desktop layer entirely.
• All destructive actions (delete thread, remove project, SIGKILL, install update) now pass { variant: 'destructive' } to dialogs.confirm for consistent styling.
• Risk: window.desktopBridge.confirm is permanently removed; any external caller relying on it will receive no response.

^{Macroscope summarized 2e4424a.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 26c755d8-2c23-4055-b5a8-a5ca48eac708

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces a new themed confirmation dialog system with state management and queue handling, replaces the existing Electron IPC-based confirmation flow, and changes user-facing UI behavior across multiple components. The scope and architectural changes warrant human review despite good test coverage.

^{You can customize Macroscope's approvability policy. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 01be733. Configure here.}

[Bil0000]

This was much needed, but was thinking of making dangerous btns red (e.g confirm deletion, etc)

[StiensWout]

Thanks for the suggestion. I adapted the confirmation API so intent is explicit instead of inferred from message text: deletion, worktree/project removal, checkpoint revert, settings reset, and SIGKILL now render the red destructive action; update/install, archive, and informational confirmations keep the normal primary action. This is in 2e4424af1, rebased onto the latest main.