Simplify setup journeys with guided phone pairing and bot creation

[sambitcreate]

Setup currently makes people coordinate separate settings before they can connect a phone or start useful work. This change adds guided setup and clearer recovery across the approved UX review, with ChatGPT, LM Studio, Ollama, and Other Custom Provider shown before Other ways, and consistent Create a bot wording.

• Phone pairing uses two setup cards and one acknowledgement. A serialized main-process operation checks prerequisites, enables the chosen connection, verifies pairing, and rolls back newly introduced access on known failures. Existing routes, device identity, one-use codes, and uncertain-outcome reconciliation are preserved.
• Route and local teardown are attempted independently, so a failed Tailscale disconnect cannot leave local listeners, access state, or the guided UI active. Guided failures strip Electron's IPC wrapper before showing the underlying error.
• Regression coverage exercises both cleanup branches, including existing-access route failure. The scheduled-profile search setup uses the native input setter and bubbling input event so the deterministic Electron gate cannot retain a stale React-controlled value.
• Bot creation becomes two steps with optional appearance/capability details and minimal Custom access for fresh desktop drafts. Existing bots retain their policies.
• Telegram, voice, Computer Use, schedules, plugins, and Settings search gain clearer setup groups, access explanations, connection checks, and draft/error recovery. iOS/Android pairing directions follow the new desktop flow.

Review the Now vs proposed HTML, implementation checklist, and 39-journey audit/backlog. Two desktop actions assumes the connection method is already selected and external prerequisites are ready; phone scanning and OS/account permissions are additional steps.

Validation

• Exact-head CI is green at 04761bc8: verification, deterministic Electron E2E, Android build/UI tests, generic iOS test compilation, and production bundles. Pullfrog is green and all review threads are resolved.
• The hosted Electron matrix covers 48 cases, including real local-fixture onboarding/relaunch, guided LAN cancellation/pairing, permission cancellation, responsive Settings navigation, and advanced Remote/Telegram disclosures.
• Local validation also passed the full JavaScript/TypeScript suite, focused Settings contracts, production build, generic iOS build-for-testing, and Android unit/lint/assemble/androidTest compilation.

Remaining release acceptance

Physical iOS-device and live Tailscale/phone acceptance remain operator release checks; they do not block code review or merge readiness. The isolated Electron profile cannot establish native Bot Keychain authority, and production does not add a fallback. The broader journey audit remains Active rather than claiming every journey branch is complete.

[sambitcreate]

Readiness hardening pushed at exact head 0c8218e.

Resolved the five mainline conflicts without merge commits and preserved the current Settings hierarchy/tests. Adversarial fixes include semantic Android QR/setup-code tabs, responsive Telegram connection status, restored Telegram switch labels and settings-card treatment, and propagation of scheduled-task save failures back into the inline review error state.

Local validation at this head:

• full npm test: pass
• type-check, E2E type-check, lint, production build: pass
• focused guided setup / remote lifecycle / Settings Electron E2E: 5/5 pass after updating the disclosure-aware Settings assertion
• Android unit, lint, debug build, and Android-test Kotlin compilation: pass
• generic physical-iOS build-for-testing with signing disabled: pass

Physical-device pairing and live Tailscale/phone acceptance remain operator release checks; they are not represented as automated evidence here. Watching hosted exact-head CI before changing draft status.

[sambitcreate]

Final readiness update: exact-head CI run https://github.com/sambitcreate/aiden-agent/actions/runs/34555533957 is fully green at 26477f5bcbc5a299db8fafdf796027f80db25f98 (verify, 48-case deterministic Electron E2E matrix, Android, generic iOS compile, and production bundles). The single unchanged filesystem-watcher timing miss from the first verify attempt passed on the isolated failed-job rerun and passed 20/20 local repetitions. The branch is rebased on current main, contains no merge commits, is GitHub-mergeable/CLEAN, and has zero unresolved review threads.

[pullfrog]

Important

The new guided phone-setup coordinator has a rollback path that can leave phone access enabled when the Tailscale route cleanup fails. A minor error-display issue is inline; a now-unreachable Telegram IPC surface and three nitpicks follow.

Reviewed changes — read the complete 45-file diff at 26477f5b against main (e42b147), covering the new main-process setup coordinator and its tests, the renderer setup/onboarding/Bot/Telegram/voice/schedule flows, Settings discovery, native pairing copy, and the docs/E2E additions.

• Guided phone setup — AidenRemoteService.setupPairing checks the reviewed state, enables the selected connection, prepares and verifies the Tailscale route, and opens one pairing session in a single serialized, owner-checked operation with rollback; new remote:setupPairing IPC; two-card Settings surface plus acknowledgement dialog.
• Onboarding AI choices — primary grid is ChatGPT, LM Studio, Ollama, and Other Custom Provider; API-key, Anthropic, and Tailscale options move under Other ways; the custom provider reuses ProviderEditor with requireReady.
• Two-step Bot editor — fresh desktop drafts start Custom with no grants; model, access, and capability review share one page; failed saves keep the draft.
• Setup review and recovery — Telegram gains three groups and an enable/connect acknowledgement, Computer Use an enable review, schedules a review step with retained errors, plugins a connect-time check, voice an error beside the draft, and the composer a readiness deep link.
• Settings discovery and copy — Aiden On The Go destination with intent aliases, device labels, native iOS/Android pairing instructions, plan/implementation-review docs, and new E2E coverage.

ℹ️ Telegram's previous connect/disconnect surface is now unreachable

telegram-settings.tsx:98,110 drive enablement through telegramApi.setEnabled, so telegramApi.connect/disconnect, the telegram:connect/telegram:disconnect handlers, and the clearOffset path they were the only callers of now have no production caller, while telegram-service-core.test.ts:689-705 still pins the old disconnect() contract. Decide whether to keep them as a supported IPC surface or remove them, and confirm that retaining the polling offset on Disconnect (the old handler cleared it) is intended.

Technical details

# Dead Telegram enable/disable surface

## Affected sites
- `renderer/components/settings/telegram-settings.tsx:98,110` — the only remaining UI callers now use `setEnabled`.
- `renderer/lib/ipc.ts:452-453` — `connect`/`disconnect` wrappers have no remaining caller.
- `main/handlers/telegram.ts:80-88` — handlers unreachable from the renderer.
- `main/services/telegram/telegram-service-core.ts:396-400` — `disconnect()` and therefore `clearOffset()` are unreachable from production.

## Required outcome
- Either remove the unused surface (and update the test contract) or keep it deliberately and note that UI Disconnect no longer resets the persisted `lastUpdateId`.

## Open questions for the human
- Is retaining the offset on Disconnect intentional? It differs from the previous behavior where Disconnect cleared it.

ℹ️ Nitpicks

• renderer/components/settings/telegram-settings.tsx:98 — setEnabled(true) persists telegramEnabled before assertHealthy()/start() run, so a failed Connect leaves the Advanced switch on while step 3 shows "○ Disconnected" and its Disconnect button (disabled={!polling}) is unavailable.
• renderer/components/settings/remote-access-settings.tsx:885-892 — after a "Phone access changed" failure the review dialog keeps the stale enabled/connectionMode, so retrying from the open dialog fails identically until the user cancels and reopens it.
• renderer/components/scheduled-task-editor.tsx:258 — the review row label "Keep this Mac awake" reads like a setting; the body says Aiden must be open. Consider "Runs while Aiden is open".

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using DeepSeek Flash ｜ 𝕏}

[sambitcreate]

Addressed both late Pullfrog findings at f1326592: guided rollback now attempts Tailscale route removal and local listener/state/mode restoration independently, reports route uncertainty separately, and has a regression test proving local access is disabled even when route removal rejects. Guided setup errors now strip Electron’s remote-method and nested Error: wrappers before display. The 372-test Remote suite (371 pass, 1 intentional skip), focused regression, type-check, and lint pass locally. Fresh exact-head CI is running.

[pullfrog]

ℹ️ No critical issues — one minor test-coverage suggestion inline.

Reviewed changes — read the range-diff since the prior pullfrog review at 26477f5b and the complete 45-file diff at f1326592 against main (e42b147).

• Isolated guided-setup rollback steps — setupPairing now runs the external Tailscale route removal and the local listener/state teardown in independent try blocks, tracks each failure separately, and reports whether local access was actually restored.
• Normalized setup error display — friendlyTailscaleError strips Electron's Error invoking remote method … wrapper before matching, so typed tailscale_* remediation and raw setup messages reach the Callout without the wrapper.
• Added regression coverage — a service test drives a failing Tailscale disconnect after a fresh attempt and asserts local access is disabled and the prior mode restored; the renderer contract test pins the wrapper normalization.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using DeepSeek Flash ｜ 𝕏}

[sambitcreate]

Addressed the final Pullfrog coverage finding at exact head 7594021a: added the existing-access route-cleanup failure regression with connectionMode: both, pre-enabled listeners, failed Tailscale disconnect, the exact “Existing local access stayed on” message, retained ownership, enabled/running state, and one attempted disconnect. The complete Remote suite passes locally (372 pass, 1 intentional skip), plus TypeScript, lint, and diff check. Fresh exact-head checks are running.

[pullfrog]

✅ No new issues found.

Reviewed changes — read the range-diff since the prior pullfrog review at f1326592 and the complete 45-file diff at 7594021a against main (e42b147).

• Branch-specific rollback regression test — a new service test starts from mode: "both" with access already enabled and a failing Tailscale disconnect, asserting the "Existing local access stayed on" message while enabled, connectionMode, tailscaleOwnership, and listener state stay intact. Swapping the two message branches fails both this test and the fresh-access one, so the coverage is real.
• Papercut note — records that the two distinct cleanup outcomes each need their own regression.

  ^{｜ View workflow run ｜ Using DeepSeek Flash ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes — reviewed the range-diff since the prior pullfrog review at 7594021a and checked the delta against the 46-file PR diff at 04761bc8 (main e42b147); the new commit is test-only.

• Stabilized scheduled-search E2E cleanup — the reset after filtering now drives HTMLInputElement.prototype's value setter plus a bubbling input event, so an empty Playwright fill cannot leave the React-controlled search unchanged on hosted Electron, and the test still asserts the list restores.
• Papercut note — records the hosted-Electron controlled-input finding for future E2E work.

  ^{｜ View workflow run ｜ Using DeepSeek Flash ｜ 𝕏}

[sambitcreate]

Final readiness audit complete on exact head 04761bc8fa073cff9ecb7f339d6acc231ad12ab1. Two independent GPT-5.6 Sol review lanes covered merge/rebase compatibility and adversarial UX/error recovery. The branch is linear with no merge commits, Pullfrog is green, all review threads are resolved, and exact-head CI run 34562060803 is green across verification, deterministic Electron E2E, Android, generic iOS compilation, production bundles, and diagnostics. Marking this PR ready to merge; physical-device pairing and live Tailscale remain release acceptance checks.