feat(sidebar): refactor project sidebar into spaces with pinned sidebar and card redesign

apps/mesh/e2e/tests/connection-create.spec.ts

@@ -9,11 +9,17 @@ test.describe("Connection creation flow", () => {
     await signUp(page);
 
     // 2. Wait for the auto-redirect to the org page and extract slug from URL
-    await page.waitForURL(/\/[a-z0-9-]+\/?$/, { timeout: 15_000 });
+    await page.waitForURL(
+      (url) => {
+        const slug = url.pathname.split("/")[1];
+        return !!slug && slug !== "login" && slug !== "api";
+      },
+      { timeout: 15_000 },
+    );
     const orgSlug = new URL(page.url()).pathname.split("/")[1];
 
     // 3. Navigate directly to the connections page
-    await page.goto(`/${orgSlug}/mcps`);
+    await page.goto(`/${orgSlug}/settings/connections`);
 
     // 4. Open the create connection dialog
     await page.getByRole("button", { name: "Custom Connection" }).click();
@@ -34,7 +40,9 @@ test.describe("Connection creation flow", () => {
       .click();
 
     // 7. Should navigate to the connection detail page (slug derived from URL)
-    await page.waitForURL(/\/mcps\/examplecom-mcp/, { timeout: 10_000 });
-    await expect(page).toHaveURL(/\/mcps\/examplecom-mcp/);
+    await page.waitForURL(/\/settings\/connections\/examplecom-mcp/, {
+      timeout: 10_000,
+    });
+    await expect(page).toHaveURL(/\/settings\/connections\/examplecom-mcp/);
   });
 });

apps/mesh/migrations/052-spaces.ts

@@ -0,0 +1,73 @@
+import type { Kysely } from "kysely";
+import { sql } from "kysely";
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+  // Add pinned column
+  await db.schema
+    .alterTable("connections")
+    .addColumn("pinned", "boolean", (col) => col.notNull().defaultTo(false))
+    .execute();
+
+  // Backfill: projects become pinned, agents/null become unpinned
+  await sql`UPDATE connections SET pinned = true WHERE subtype = 'project' AND connection_type = 'VIRTUAL'`.execute(
+    db,
+  );
+
+  // Drop the old composite index on (organization_id, connection_type, subtype)
+  await db.schema
+    .dropIndex("idx_connections_org_type_subtype")
+    .ifExists()
+    .execute();
+
+  // Drop the CHECK constraint on subtype
+  await sql`ALTER TABLE connections DROP CONSTRAINT IF EXISTS chk_connections_subtype`.execute(
+    db,
+  );
+
+  // Drop the subtype column
+  await db.schema.alterTable("connections").dropColumn("subtype").execute();
+
+  // Add new composite index for pinned queries
+  await db.schema
+    .createIndex("idx_connections_org_type_pinned")
+    .on("connections")
+    .columns(["organization_id", "connection_type", "pinned"])
+    .execute();
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+  // Drop new index
+  await db.schema
+    .dropIndex("idx_connections_org_type_pinned")
+    .ifExists()
+    .execute();
+
+  // Re-add subtype column
+  await db.schema
+    .alterTable("connections")
+    .addColumn("subtype", "text")
+    .execute();
+
+  // Backfill: pinned items become projects, unpinned become agents
+  await sql`UPDATE connections SET subtype = 'project' WHERE pinned = true AND connection_type = 'VIRTUAL'`.execute(
+    db,
+  );
+  await sql`UPDATE connections SET subtype = 'agent' WHERE pinned = false AND connection_type = 'VIRTUAL'`.execute(
+    db,
+  );
+
+  // Re-add CHECK constraint
+  await sql`ALTER TABLE connections ADD CONSTRAINT chk_connections_subtype CHECK (subtype IN ('agent', 'project') OR subtype IS NULL)`.execute(
+    db,
+  );
+
+  // Re-add old index
+  await db.schema
+    .createIndex("idx_connections_org_type_subtype")
+    .on("connections")
+    .columns(["organization_id", "connection_type", "subtype"])
+    .execute();
+
+  // Drop pinned column
+  await db.schema.alterTable("connections").dropColumn("pinned").execute();
+}

apps/mesh/migrations/054-automation-project-scope.ts

@@ -0,0 +1,31 @@
+/**
+ * Automation Project Scope Migration
+ *
+ * Adds `virtual_mcp_id` column to `automations` table so automations can be
+ * scoped to a specific project or space (Virtual MCP).
+ * NULL means org-level (existing behavior).
+ */
+
+import { Kysely } from "kysely";
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+  await db.schema
+    .alterTable("automations")
+    .addColumn("virtual_mcp_id", "text")
+    .execute();
+
+  await db.schema
+    .createIndex("idx_automations_virtual_mcp")
+    .on("automations")
+    .columns(["virtual_mcp_id"])
+    .execute();
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+  await db.schema.dropIndex("idx_automations_virtual_mcp").execute();
+
+  await db.schema
+    .alterTable("automations")
+    .dropColumn("virtual_mcp_id")
+    .execute();
+}

apps/mesh/migrations/055-thread-virtual-mcp-id.ts

@@ -0,0 +1,58 @@
+/**
+ * Thread Virtual MCP ID Migration
+ *
+ * Replaces the `agent_ids` JSON text column with a simple `virtual_mcp_id`
+ * foreign key. Each thread is associated with exactly one virtual MCP
+ * (the agent it was initiated with).
+ *
+ * - Adds `virtual_mcp_id` column (NOT NULL, defaults to empty string)
+ * - Backfills from `agent_ids[0]` where available
+ * - Adds composite index for efficient querying
+ * - Drops `agent_ids` column
+ */
+
+import type { Kysely } from "kysely";
+import { sql } from "kysely";
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+  await db.schema
+    .alterTable("threads")
+    .addColumn("virtual_mcp_id", "text", (col) => col.notNull().defaultTo(""))
+    .execute();
+
+  await sql`
+    UPDATE threads
+    SET virtual_mcp_id = (agent_ids::jsonb ->> 0)
+    WHERE agent_ids IS NOT NULL
+      AND agent_ids != '[]'
+      AND agent_ids != ''
+      AND (agent_ids::jsonb ->> 0) IS NOT NULL
+  `.execute(db);
+
+  await sql`
+    CREATE INDEX idx_threads_virtual_mcp_id
+    ON threads (organization_id, virtual_mcp_id, hidden, updated_at DESC)
+  `.execute(db);
+
+  await db.schema.alterTable("threads").dropColumn("agent_ids").execute();
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+  await db.schema
+    .alterTable("threads")
+    .addColumn("agent_ids", "text", (col) => col.defaultTo("[]"))
+    .execute();
+
+  await sql`
+    UPDATE threads
+    SET agent_ids = CASE
+      WHEN virtual_mcp_id IS NOT NULL AND virtual_mcp_id != ''
+      THEN jsonb_build_array(virtual_mcp_id)::text
+      ELSE '[]'
+    END
+  `.execute(db);
+
+  await sql`DROP INDEX IF EXISTS idx_threads_virtual_mcp_id`.execute(db);
+
+  await db.schema.alterTable("threads").dropColumn("virtual_mcp_id").execute();
+}

apps/mesh/migrations/index.ts

@@ -51,8 +51,11 @@ import * as migration049removeorgadminprojects from "./049-remove-org-admin-proj
 import * as migration050durableagentruns from "./050-durable-agent-runs.ts";
 import * as migration051orgsso from "./051-org-sso.ts";
 import * as migration052threadagentids from "./052-thread-agent-ids.ts";
+import * as migration052spaces from "./052-spaces.ts";
 import * as migration053registryconfig from "./053-registry-config.ts";
+import * as migration054automationprojectscope from "./054-automation-project-scope.ts";
 import * as migration054connectionslug from "./054-connection-slug.ts";
+import * as migration055threadvirtualmcpid from "./055-thread-virtual-mcp-id.ts";
 
 /**
  * Core migrations for the Mesh application.
@@ -118,8 +121,11 @@ const migrations: Record<string, Migration> = {
   "050-durable-agent-runs": migration050durableagentruns,
   "051-org-sso": migration051orgsso,
   "052-thread-agent-ids": migration052threadagentids,
+  "052-spaces": migration052spaces,
   "053-registry-config": migration053registryconfig,
+  "054-automation-project-scope": migration054automationprojectscope,
   "054-connection-slug": migration054connectionslug,
+  "055-thread-virtual-mcp-id": migration055threadvirtualmcpid,
 };
 
 export default migrations;

apps/mesh/src/ai-providers/coding-agents/claude-code/index.ts

@@ -38,8 +38,14 @@ export function createClaudeCodeModel(
 
   switch (options?.toolApprovalLevel) {
     case "plan":
-      settings.permissionMode = "plan";
-      settings.disallowedTools = [...HEADLESS_DISALLOWED_TOOLS];
+      settings.permissionMode = "bypassPermissions";
+      settings.disallowedTools = [
+        ...HEADLESS_DISALLOWED_TOOLS,
+        "Write",
+        "Edit",
+        "Bash",
+        "NotebookEdit",
+      ];
       break;
     case "readonly":
       settings.permissionMode = "bypassPermissions";

apps/mesh/src/api/access-control.integration.test.ts

@@ -259,6 +259,7 @@ describe("Access Control Integration Tests", () => {
         metadata: null,
         bindings: null,
         status: "active",
+        pinned: false,
         created_at: new Date().toISOString(),
         updated_at: new Date().toISOString(),
       })

apps/mesh/src/api/app.ts

@@ -329,8 +329,8 @@ export async function createApp(options: CreateAppOptions = {}) {
   const runRegistry = new RunRegistry(cancelReactorDeps, POD_ID);
 
   cancelBroadcast
-    .start((threadId) => {
-      runRegistry.execute({ type: "CANCEL", threadId }).catch((err) => {
+    .start((taskId) => {
+      runRegistry.execute({ type: "CANCEL", taskId }).catch((err) => {
         console.error("[Decopilot] CancelBroadcast execute failed:", err);
       });
     })
@@ -986,7 +986,7 @@ export async function createApp(options: CreateAppOptions = {}) {
         toolApprovalLevel: config.toolApprovalLevel,
         organizationId: thread.organization_id,
         userId: thread.created_by,
-        threadId: thread.id,
+        taskId: thread.id,
         windowSize: config.windowSize,
         isResume: true,
       },

apps/mesh/src/api/routes/deco-sites.ts

@@ -136,7 +136,7 @@ app.get("/", async (c) => {
 
   const config = getSupabaseConfig();
   if (!config) {
-    return c.json({ error: "Deco integration is not configured" }, 503);
+    return c.json({ sites: [] });
   }
   const { supabaseUrl, serviceKey } = config;
 
@@ -216,28 +216,34 @@ app.post("/connection", async (c) => {
   }
 
   const config = getSupabaseConfig();
-  if (!config) {
-    return c.json({ error: "Deco integration is not configured" }, 503);
-  }
-  const { supabaseUrl, serviceKey } = config;
 
-  try {
-    const profileId = await resolveProfileId(supabaseUrl, serviceKey, email);
-    if (!profileId) {
-      return c.json({ error: "No deco.cx account found for this user" }, 404);
-    }
-
-    const apiKey = await fetchDecoApiKey(supabaseUrl, serviceKey, profileId);
+  // Local dev fallback: create a stub connection without an API key so the
+  // full import flow can be tested without Supabase credentials.
+  const apiKey = config
+    ? await (async () => {
+        const { supabaseUrl, serviceKey } = config;
+        const profileId = await resolveProfileId(
+          supabaseUrl,
+          serviceKey,
+          email,
+        );
+        if (!profileId) return null;
+        return fetchDecoApiKey(supabaseUrl, serviceKey, profileId);
+      })().catch(() => null)
+    : null;
 
+  try {
     // Fetch tools and scopes from the MCP server before storing, mirroring
     // what COLLECTION_CONNECTIONS_CREATE does so the tools list isn't empty.
-    const fetchResult = await fetchToolsFromMCP({
-      id: `pending-${connId}`,
-      title: `deco.cx — ${siteName}`,
-      connection_type: "HTTP",
-      connection_url: ADMIN_MCP,
-      connection_token: apiKey,
-    }).catch(() => null);
+    const fetchResult = apiKey
+      ? await fetchToolsFromMCP({
+          id: `pending-${connId}`,
+          title: `deco.cx — ${siteName}`,
+          connection_type: "HTTP",
+          connection_url: ADMIN_MCP,
+          connection_token: apiKey,
+        }).catch(() => null)
+      : null;
     const tools = fetchResult?.tools?.length ? fetchResult.tools : null;
     const configuration_scopes = fetchResult?.scopes?.length
       ? fetchResult.scopes

apps/mesh/src/api/routes/decopilot/cancel-broadcast.ts

@@ -7,9 +7,9 @@
 
 export interface CancelBroadcast {
   /** Start listening for cancel broadcasts. When received, call onCancel locally. */
-  start(onCancel?: (threadId: string) => void): Promise<void>;
+  start(onCancel?: (taskId: string) => void): Promise<void>;
   /** Broadcast a cancellation to all pods (including local). */
-  broadcast(threadId: string): void;
+  broadcast(taskId: string): void;
   /** Stop listening and release resources. */
   stop(): Promise<void>;
 }

apps/mesh/src/api/routes/decopilot/conversation.ts

@@ -184,7 +184,11 @@ export async function processConversation(
           .map((part) => {
             const p = part as Record<string, unknown>;
             if ("providerOptions" in p || "providerMetadata" in p) {
-              const { providerOptions, providerMetadata, ...rest } = p;
+              const {
+                providerOptions: _po,
+                providerMetadata: _pm,
+                ...rest
+              } = p;
               return rest as typeof part;
             }
             return part;

apps/mesh/src/api/routes/decopilot/helpers.ts

@@ -211,18 +211,18 @@ export async function validateThreadAccess(
     throw new HTTPException(401, { message: "Unauthorized" });
   }
   const organization = ensureOrganization(c);
-  const threadId = c.req.param("threadId");
-  if (!threadId) {
+  const taskId = c.req.param("threadId");
+  if (!taskId) {
     throw new HTTPException(400, { message: "Missing thread ID" });
   }
-  if (/[.*>\s]/.test(threadId)) {
+  if (/[.*>\s]/.test(taskId)) {
     throw new HTTPException(400, { message: "Invalid thread ID" });
   }
-  const thread = await ctx.storage.threads.get(threadId);
+  const thread = await ctx.storage.threads.get(taskId);
   if (!thread) {
     throw new HTTPException(404, { message: "Thread not found" });
   }
-  return { ctx, organization, thread, threadId, userId };
+  return { ctx, organization, thread, taskId, userId };
 }
 
 /**