feat: first-run experience - guided wizard ending at the approval gate#216
Merged
Conversation
- firstrun_funnel app_settings blob, first-touch-wins, mirrored into the activity log (context first-run) so the trail reads in-app; mission-scoped marks gated in main so normal usage never logs - settings:mark-funnel-step / settings:get-funnel IPC - projects:createDemoWorkspace scaffolds ~/daemon-first-mission (3 files, git init, idempotent) and registers it for the mission read tools - fix set-onboarding-progress validation: required keys were still the old step list, so every save failed silently
- new step order: workspace, claude connect, project, approval gate, first mission - StepClaude back in the flow with OAuth polling (4s up to 5min) and honest disclosure copy while the browser flow runs - StepProject gains the demo-workspace route; StepAiSafety is now a frozen preview of the real WRITE approval card plus the three risk rules - StepFirstMission fires the scripted ARIA turn ending in a real remember_fact approval card; tour offer deferred until the mission turn settles so it never lands on top of the card - funnel marks at each step boundary; approval_shown/decision marks in the aria store (gated main-side); wizard testids for the e2e run
… swarms, memory - console empty state states the deal and offers starter prompt chips; the first-mission chip disappears after the first approval decision - wallet empty route leads with the devnet context and a throwaway wallet - activity true-empty introduces the flight recorder instead of a filter miss - swarm and memory empties explain what will appear and what it needs
…urface The no-wallet empty state moved to WalletWorkspace in the packs shell; the old WalletTab route is dead code, so revert its copy edit and land the devnet-context message and Create devnet wallet primary where users actually see it. Also point the onboarding smoke at the toolbox host that now owns Solana Start.
…'t leak in The scripted mission ran its reads through the configured RPC, so a re-entrant wizard run with mainnet stored in runtime config would silently read mainnet wallet state and tag the demo's write card [MAINNET]. Pin the mission turn instead: both launch surfaces send snapshot.pinnedCluster 'devnet' (restrict-only, normalized at the IPC boundary), pinned read_wallet/read_project_status answer from the local wallet inventory with zero RPC and report the cluster as devnet by construction, and pinned turns refuse sensitive (money/key) tools before the card is ever raised - which also makes the [MAINNET] label on the remaining local writes factually wrong, so it is dropped for pinned turns only. Unpinned turns are untouched: same gating, same marks. Verified live against a mainnet-configured fresh profile: readout says devnet (pinned), no [MAINNET] anywhere, card in 21s, reject narrated.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rebuilds onboarding around the product's actual wedge: a fresh install reaches a real write approval card, and rejects it, inside five minutes (measured 3:31 on a fresh profile).
Suite 1073 passing (was 1027 at branch time; +46, none skipped). Typecheck, build, lint:styles green. Fresh-profile E2E driven over CDP twice, plus an adversarial run with cluster forced to mainnet-beta: pinned readout shown, card clean, zero console errors.