Local project setup handoff

The public distribution uses a local RS-SDK folder for friendly identities. Its Settings page is reachable from the shared top bar in both modes, the fleet heading and the empty fleet state. Existing #operations links still show local accounts; they no longer depend on an external database schema.

Source map

• server/project-settings.ts: bounded BOT_USERNAME discovery, persisted selected path, directory browsing within the home folder. Absolute pasted paths may select other volumes. No shell invocation or credential projection.
• server/friendlies.ts: shared identity projection and allegiance; incomplete scans fail unknown for outsiders.
• server/local-operations.ts: compatibility operations API with local roster and no invented assignments or KPIs.
• server/index.ts: local settings routes, existing operator-session enforcement and runtime default-path update. No account startup or pairing side effect.
• src/Settings.tsx and src/settings.css: connection preview, save/disconnect/rescan, connection status and API/CLI/MCP setup. Existing API, data tools, assistant and Command remain separate destinations.
• server/project-settings.test.ts: username isolation, persistence, root switching, disconnect, missing folders and symlink exclusions.

Persistence and boundaries

data/project-settings.json is ignored and written with mode 0600. A saved path or saved null overrides the startup RS_SDK_ROOT environment fallback. Connection status caches scans for 60 seconds; Refresh accounts explicitly rescans. Preview never saves. Disconnect does not delete observations, saved watches, manual classifications, grants or existing runtime pairings. A running harness remains bound to its original project; changing this setting only updates the suggested path for future setup.

The API/CLI/MCP tab generates configuration from the current app directory and browser origin. Do not introduce developer-specific paths, roster fixtures or credentials into committed configuration. A folder connection establishes friendly identities only, not live full-bank access, ownership or command authorization.

Design references

Inspected Mobbin references: Replit developer tools, Canny connection settings. The implementation uses existing Frosted controls and theme tokens, with connection status and developer tools in separate sections.

Private/public sync

This replaces the public connector only. The private app's external integrations and runtime state are intentionally preserved. Keep these public-specific files during reviewed source sync; never restore the removed connector from a bulk copy. The export manifest retains the previous source hashes so drift remains visible.

Validation (2026-10-27)

• Settings/identity/fleet and local adapter regression group: 29 passed, zero failed. Credential projections use synthetic canaries.
• HTTP smoke: preview does not save, saves and folder browsing reject absent operator sessions, cross-origin mutation rejects, username preview excludes credentials.
• Browser on isolated port 5198: preview/connect/disconnect, folder browsing, fleet handoff, navigation from both modes, developer setup and 390px phone layout checked with a synthetic project.
• TypeScript passed; frontend production build checked separately. Python market tests: 84 passed; sync planner: three passed.
• Historical pre-fix result: full pnpm run check did not finish green: latest run had 647 passing, three optional source skips and five failures in existing sandbox/worker timing tests. Local-adapter and swarm-service failures passed isolated reruns; code-mode tests passed one focused run but remain timing-sensitive in broader runs. Do not describe this as a clean full-suite result or a stable release.

Follow-up verification

• Latest full pnpm run check: 654 passed, three optional source-comparison tests skipped, zero failed; TypeScript and Vite build passed. Test-only startup synchronization/cleanup corrections supersede the historical failures above.
• MCP configuration tests cover different installation roots, spaces, trailing separators, localhost ports and unavailable setup.
• Actual generated stdio bridge initialized from /tmp, listed 72 tools and completed read-only world_status against a non-default port. No gameplay or agent job was dispatched.
• Settings now explains the Palantir installation versus connected RS-SDK folder and withholds copyable MCP configuration until the installation is loaded.