[LogicLyra]

Summary

Adds the owner-requested "Everything (full setup)" import mode next to the shipped chats-only importer (PR #14): a 1:1, opt-in copy of a local OpenCode profile into an empty Classic desktop sidecar profile.

• All 19 application SQLite tables (chats, credentials, cloud accounts, permissions, shares, workspaces, context epochs, data migrations), provider auth.json, global config (JSONC-preserving), agents/skills/plugins, state, plans, tool output, workspace files and snapshot stores.
• SQLite only ever reads a private snapshot copy of the source DB+WAL (O_NOFOLLOW, fingerprinted); the source DB, WAL and SHM remain byte-identical (tested). Hot rollback journals and symlinked/special SQLite auxiliaries are refused.
• Staged profile built with compiled-schema DDL, parameterized inserts, private permissions (0600/0700), then activated before the sidecar starts via two recoverable directory renames under a durable ownership journal (uuid, inode identity, building/ready/activated phases). Crash windows between renames recover idempotently; the replaced bootstrap profile is retained (quarantined), never deleted. Unknown scratch/backup paths are never removed.
• Internal paths (workspaces, snapshot stores, permission patterns, config map keys) are remapped canonical+lexical; external project paths stay unchanged. Linked worktrees get private Git metadata and object stores; snapshot alternates are recursively materialized (verified independent after moving the original repo).
• Refuses non-empty destinations (generated plugin scaffold recognized as bootstrap), OPENCODE_DB/config/auth env overrides, future schemas, external symlinks, cyclic alternates, >50 GiB / >500k entries, and insufficient disk (DB+WAL counted).
• Native consent dialog: compiled main-owned copy (renderer cannot alter it — an earlier renderer-reachable spread was caught by i18n parity tests and removed), parented to the initiating window, Cancel default, discloses preserved execution surfaces (account refresh, plugins/deps, MCP, commands, Git hooks, permissions, pending prompts).
• CLI/README docs; version 1.18.31.

Commits

• 5252258b9f feat(desktop): stage full setup imports with offline profile activation
• 4ebef81038 fix(desktop): harden profile recovery and isolate source snapshots
• 265a442bfb fix(desktop): own scratch snapshots, retain replaced profiles, harden consent
• 966537ba62 chore: bump version to 1.18.31
• 55820a4323 fix(desktop): keep native consent copy main-owned and locale parity intact
• 4c734fa50d chore: normalize lockfile entry ordering

Base aa4e014e15 → head 4c734fa50d (tree-only diff, no merge commits).

Verification

• Focused: 37 desktop tests (real SQLite + real Git linked-worktree fixture: staged/unstaged/untracked survival, alternates materialization, crash recovery between renames, backup-symlink tamper, SHM preservation, scaffold recognition, alias remap, controller authorization) + 13 i18n parity tests — all pass; desktop+app typechecks pass; lint 0 errors (advisory warnings pre-existing).
• Full 10-stage Linux package gate: PASS at 4c734fa50d (run 20260915T192312Z-4c734fa50d-package; environment/static/dependencies/focused/typecheck/lint/broad-tests/builds/desktop-build/package-linux); evidence and package checksums verified. Two earlier attempts failed correctly (real locale-parity defect fixed in 55820a4323; a QA-wrapper-only bug).
• Real-server bootstrap smoke: isolated synthetic HOME, sidecar env, /global/config /provider /path /project exercised → fresh-profile eligibility still holds.
• Real-chromium UI smoke (component harness, mocked contexts): preview→staged with consent gating + restart, nonempty refusal, consent refusal, activated status, chats-only isolation — 5/5 PASS, no console errors.
• Packaged-worker smoke from the exact built deb (app.asar extraction, standalone Node): profile worker preview writes nothing; confirm stages DB + auth(0600) + config + worktree content, journal ready with digest; source byte-identical. Chats-only worker regression PASS.
• Reviews: independent correctness review — approved, no blockers. Independent security review (two rounds) — all blockers from round one closed and verified; residual register below.

Known limitations / residual risks

• Electron GUI runtime on the QA VM remains blocked by the standing no-AVX SIGILL limitation; compensated by the gate + component/browser smokes (as in PR sync: upstream v1.18.30 -- classic layout preserved, maintenance resumed #12-feat(desktop): import chats from OpenCode with storage protections #14).
• LOW (fast-follow): a corrupted/tampered recovery journal at startup aborts init (fail-closed, no data loss); a try/catch + log continue is a recommended follow-up.
• LOW (UX): after a worker timeout or crashed staging, importer returns busy until app restart (error copy says so).
• Full import reads opencode.db (plain name); channel-suffixed source DBs are chats-only/browse-selectable for the DB, not the full profile.
• One retained .profile-import-retained-<id> directory per successful full import persists by design.
• OAuth token rotation between two concurrent installs may require re-auth; new English strings await a localization pass (fork fallback bundle).

Statement

No direct main push, no upstream write, no tag or release created by this PR. Owner has authorized merge and the 1.18.31 draft-first release after checks.

Requesting owner review; prefer a merge commit (no squash/rebase).

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[github-actions]

This PR doesn't fully meet our contributing guidelines and PR template.

What needs to be fixed:

• PR description is missing required template sections. Please use the PR template.

Please edit this PR description to address the above within 2 hours, or it will be automatically closed.

If you believe this was flagged incorrectly, please let a maintainer know.