Merge remote-tracking branch 'origin/main' into e2e-flow

Author: CodeGhost21

.claude/memory.md

@@ -87,6 +87,8 @@ Quick reference for anyone starting with Claude on this project. Updated by the
 - **Banner dismiss state uses localStorage** (prefix `openhuman:upsell:`), not Redux — consistent with CLAUDE.md exception for ephemeral UI state.
 - **Phased rollout** — Phase 1 = banners + limit modal + hook. Phase 2 = onboarding upsell + analytics. Phase 3 = remote config + A/B testing.
 - **"5-hour" label stragglers in Conversations.tsx** — `LimitPill` label and its hover tooltip still say "5h" / "5-hour". Commit 8c52236's "10-hour" terminology refactor missed those two spots.
+- **`getTeamUsage()` now normalizes via `normalizeTeamUsage()`** — Added in issue #482. The Rust sidecar passes backend JSON through opaquely (`src/openhuman/team/ops.rs`), so the TS client must normalize field names and types. Pattern matches existing `normalizeCreditBalance()` in the same file. Any new billing API that returns raw backend data should follow the same normalize-at-the-client pattern.
+- **Two separate `TeamUsage` types exist** — `creditsApi.ts:24` (billing: cycle budget, limits) and `types/team.ts:11` (team model: daily token limit). Different import paths, no collision, but confusing.
 
 ## Settings & Skills Reorganization (Issue #396)
 

.gitignore

@@ -59,3 +59,4 @@ src-tauri/target/
 
 workflow
 .fastembed_cache
+overlay/src-tauri/target/

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "openhuman"
-version = "0.52.0"
+version = "0.52.2"
 edition = "2021"
 description = "OpenHuman core business logic and RPC server"
 autobins = false

Cargo.toml

@@ -1,6 +1,6 @@
 {
   "name": "openhuman-app",
-  "version": "0.52.0",
+  "version": "0.52.2",
   "type": "module",
   "scripts": {
     "dev": "vite",

app/package.json

@@ -1,6 +1,6 @@
 [package]
 name = "OpenHuman"
-version = "0.52.0"
+version = "0.52.2"
 description = "OpenHuman - AI-powered Super Assistant"
 authors = ["OpenHuman"]
 edition = "2021"
@@ -40,6 +40,9 @@ semver = "1"
 log = "0.4"
 env_logger = "0.11"
 
+[target.'cfg(unix)'.dependencies]
+nix = { version = "0.29", default-features = false, features = ["signal"] }
+
 [target.'cfg(target_os = "macos")'.dependencies]
 objc2-app-kit = "0.3.2"
 objc2-core-graphics = "0.3.2"

app/src-tauri/Cargo.lock

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>NSMicrophoneUsageDescription</key>
+	<string>OpenHuman uses the microphone for voice dictation — press the hotkey to record speech and transcribe it to text.</string>
+</dict>
+</plist>

app/src-tauri/Cargo.toml

@@ -8,5 +8,16 @@
     <true/>
     <key>com.apple.security.cs.disable-library-validation</key>
     <true/>
+    <key>com.apple.security.device.audio-input</key>
+    <!-- Required for the core sidecar to make outbound HTTPS calls (registry fetch,
+         skill manifest + JS bundle downloads) under the macOS Hardened Runtime.
+         Without this, reqwest connections are silently blocked by the OS in signed
+         DMG builds, causing skills_install to appear stuck for ~30 s per request. -->
+    <key>com.apple.security.network.client</key>
+    <true/>
+    <!-- Required for the core sidecar to bind and accept connections on port 7788
+         (JSON-RPC server, Socket.IO) under the macOS Hardened Runtime. -->
+    <key>com.apple.security.network.server</key>
+    <true/>
 </dict>
 </plist>

app/src-tauri/Info.plist

@@ -108,6 +108,10 @@ impl CoreProcessHandle {
                 "[core] found existing core rpc endpoint at {}",
                 self.rpc_url()
             );
+            log::warn!(
+                "[core] reusing port {} — if channel/Telegram behavior mismatches the app, another stale `openhuman` core may be attached; check [core-update] logs for version skew.",
+                self.port
+            );
             return Ok(());
         }
 
@@ -310,26 +314,35 @@ impl CoreProcessHandle {
 
     /// Stop the core process this handle spawned (child or in-process task). Safe to call if
     /// nothing was spawned or core was already external.
+    ///
+    /// On Unix, sends SIGTERM first so the core process can run its graceful
+    /// shutdown hooks (e.g. stopping the autocomplete engine and its Swift
+    /// overlay helper). Falls back to SIGKILL after a timeout.
     pub async fn shutdown(&self) {
         let mut child_guard = self.child.lock().await;
         if let Some(mut child) = child_guard.take() {
             log::info!("[core] terminating child core process on app shutdown");
-            if let Err(e) = child.kill().await {
-                log::warn!("[core] failed to kill child core process: {e}");
+
+            let exited = self.try_graceful_terminate(&child).await;
+
+            if !exited {
+                log::info!("[core] graceful shutdown timed out, sending SIGKILL");
+                if let Err(e) = child.kill().await {
+                    log::warn!("[core] failed to kill child core process: {e}");
+                }
             }
+
             // Wait for the process to exit so the RPC listen socket is released before restart
             // checks the port (otherwise we can spuriously hit "port still in use").
             match timeout(Duration::from_secs(12), child.wait()).await {
                 Ok(Ok(status)) => {
-                    log::debug!("[core] child core process reaped after kill: {status}");
+                    log::debug!("[core] child core process reaped after shutdown: {status}");
                 }
                 Ok(Err(e)) => {
-                    log::warn!("[core] wait on child core process after kill: {e}");
+                    log::warn!("[core] wait on child core process after shutdown: {e}");
                 }
                 Err(_) => {
-                    log::warn!(
-                        "[core] timed out waiting for child core process to exit after kill (12s)"
-                    );
+                    log::warn!("[core] timed out waiting for child core process to exit (12s)");
                 }
             }
         }
@@ -338,6 +351,62 @@ impl CoreProcessHandle {
             task.abort();
         }
     }
+
+    /// Send SIGTERM to the child and wait up to 5 seconds for it to exit.
+    /// Returns `true` if the process exited gracefully, `false` if it's still
+    /// alive (caller should escalate to SIGKILL).
+    async fn try_graceful_terminate(&self, child: &Child) -> bool {
+        #[cfg(unix)]
+        {
+            use nix::sys::signal::{self, Signal};
+            use nix::unistd::Pid;
+
+            let Some(pid) = child.id() else {
+                log::debug!("[core] child has no PID (already exited?)");
+                return true;
+            };
+
+            log::info!("[core] sending SIGTERM to core process (pid={pid})");
+            if let Err(e) = signal::kill(Pid::from_raw(pid as i32), Signal::SIGTERM) {
+                log::warn!("[core] failed to send SIGTERM: {e}");
+                return false;
+            }
+
+            // Poll for exit for up to 5 seconds.
+            const GRACE_PERIOD: Duration = Duration::from_secs(5);
+            const POLL_INTERVAL: Duration = Duration::from_millis(100);
+            let start = tokio::time::Instant::now();
+
+            while start.elapsed() < GRACE_PERIOD {
+                // Check if process is still alive (signal 0 = existence check).
+                match signal::kill(Pid::from_raw(pid as i32), None) {
+                    Err(nix::errno::Errno::ESRCH) => {
+                        log::info!(
+                            "[core] core process exited gracefully after SIGTERM ({}ms)",
+                            start.elapsed().as_millis()
+                        );
+                        return true;
+                    }
+                    _ => {}
+                }
+                tokio::time::sleep(POLL_INTERVAL).await;
+            }
+
+            log::warn!(
+                "[core] core process still alive after {}s grace period",
+                GRACE_PERIOD.as_secs()
+            );
+            false
+        }
+
+        #[cfg(not(unix))]
+        {
+            // On non-Unix platforms, there is no SIGTERM equivalent; the caller
+            // will use `child.kill()` directly.
+            let _ = child;
+            false
+        }
+    }
 }
 
 fn is_current_exe_path(candidate: &std::path::Path) -> bool {