refactor: comprehensive project improvements - Security: Enable CSP, add prompt boundary markers - Testing: Add vitest with 83 tests, Biome linter - Architecture: Extract App.tsx into focused hooks (1423→821 lines), split useAppView.ts into 4 files, split chat.rs into 5 submodules - Rust: Replace string enums with SessionStatus/AutonomyMode/MessageRole, deduplicate approval gate, batch disk writes, reduce cloning - Performance: React.lazy code splitting, React.memo on screens, optimize terminal buffer - Accessibility: aria-labels on all interactive controls - Config: private:true, explicit tailwindcss, meta description - Docs: Update SPEC.md and AGENTS.md

AGENTS.md

@@ -3,6 +3,9 @@
 ## Commands
 - `bun run dev` starts the Vite web shell on port 5173 for local UI work.
 - `bun run build` runs `tsc && vite build` for the frontend bundle.
+- `bun run test` runs the Vitest test suite (unit and component tests).
+- `bun run lint` runs the Biome linter/formatter check against `src/`.
+- `bun run lint:fix` auto-fixes lint and format issues in `src/`.
 - `bun run tauri dev` starts the desktop shell against the local Vite server.
 - `bun run tauri build` packages the desktop app.
 - `cargo check --manifest-path .\src-tauri\Cargo.toml` validates the Rust command layer.
@@ -19,7 +22,7 @@
 - MUST keep `docs/PRD.md` and `docs/SPEC.md` aligned with shipped behavior when you change the review flow, model options, import flow, or autonomy modes.
 - MUST run `cargo check --manifest-path .\src-tauri\Cargo.toml` after changing Rust commands or shared payload types.
 - MUST run `bun run build` after changing routes, stores, document loading, or shared UI contracts. If Bun reports broken shims first, repair them with `bun install --force`.
-- MUST extract new frontend behavior out of `src/App.tsx` when possible; it is already the main orchestration shell.
+- MUST extract new frontend behavior out of `src/App.tsx` when possible; it is being refactored from a monolithic file into smaller components and route shells.
 - MUST use context7 mcp server for all documentation lookups.
 
 ## Ask First
@@ -34,12 +37,12 @@
 - NEVER commit secrets, auth tokens, or machine-local binary paths.
 
 ## Landmines
-- `src/App.tsx` is 1,071 lines and `src/styles.css` is 1,047 lines. Prefer targeted extractions over widening either file.
+- `src/App.tsx` is being refactored from a large monolithic file. Prefer targeted extractions into `src/components` and `src/lib` over widening it further. `src/styles.css` is similarly large; prefer Tailwind utilities over adding more custom CSS.
 - `src-tauri/src/lib.rs` mixes environment scanning, workspace walking, diffing, document parsing, and simulated agent execution. Small changes are safer than broad rewrites.
 - `git_get_diff()` returns a sample diff when the working tree is clean, and `FALLBACK_WORKSPACE` advertises files that may not exist yet. Keep demo behavior separate from real execution logic.
 - `scan_workspace_folder()` and `filterWorkspaceFiles()` intentionally respect `.gitignore`; preserve that behavior when changing workspace discovery.
 - `docs/SPEC.md` is partially aspirational today and references tooling that is not in `package.json` (`react-markdown`, `react-syntax-highlighter`, `tauri-plugin-store`). Update the docs when you normalize or implement those gaps.
-- There is no committed frontend formatter, linter, or automated test suite yet. MUST ask before introducing one mid-task.
+- Biome is configured as the project linter/formatter (`bun run lint`). Vitest is configured for testing (`bun run test`). A CI workflow validates typecheck, lint, and tests on push/PR.
 
 ## Patterns
 - Put reusable frontend behavior in `src/lib`, long-lived client state in `src/store`, and view composition in `src/components` or route shells.

biome.json

@@ -0,0 +1,50 @@
+{
+  "$schema": "https://biomejs.dev/schemas/2.4.11/schema.json",
+  "assist": { "actions": { "source": { "organizeImports": "on" } } },
+  "linter": {
+    "enabled": true,
+    "rules": {
+      "recommended": true,
+      "a11y": {
+        "noLabelWithoutControl": "warn"
+      },
+      "complexity": {
+        "noExcessiveCognitiveComplexity": "warn"
+      },
+      "correctness": {
+        "noUnusedImports": "warn",
+        "noUnusedVariables": "warn",
+        "noUnusedFunctionParameters": "warn",
+        "useExhaustiveDependencies": "warn"
+      },
+      "style": {
+        "noNonNullAssertion": "off",
+        "useImportType": "off"
+      },
+      "suspicious": {
+        "noExplicitAny": "warn",
+        "noArrayIndexKey": "warn"
+      }
+    }
+  },
+  "formatter": {
+    "enabled": false
+  },
+  "css": {
+    "linter": {
+      "enabled": false
+    },
+    "parser": {
+      "cssModules": false
+    }
+  },
+  "files": {
+    "includes": [
+      "**",
+      "!**/dist/**",
+      "!**/node_modules/**",
+      "!**/src-tauri/target/**",
+      "!**/*.css"
+    ]
+  }
+}

docs/SPEC.md

@@ -143,3 +143,4 @@ This prevents review from launching a second execution engine that could diverge
 * Opened workspace file tabs remain in-memory only; there is still no save-to-disk flow.
 * The desktop runtime is required for real project persistence, chat sessions, and CLI-backed turns.
 * The provider set remains limited to Codex CLI and Claude Code for this version.
+* **Planned dependencies not yet installed:** `react-markdown`, `react-syntax-highlighter`, and `tauri-plugin-store` are referenced in design documents but are not currently in `package.json` or `Cargo.toml`. Features that depend on them (rich markdown rendering, syntax-highlighted code blocks, native key-value persistence) are aspirational and should not be assumed functional until the dependencies are added.

index.html

@@ -3,6 +3,7 @@
   <head>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta name="description" content="SpecForge — a desktop coding assistant for spec-driven development with AI agents." />
     <title>SpecForge</title>
   </head>
   <body>

package.json

@@ -1,6 +1,6 @@
 {
   "name": "specforge",
-  "private": false,
+  "private": true,
   "version": "0.1.0",
   "type": "module",
   "packageManager": "bun@1.3.6",
@@ -9,6 +9,10 @@
     "tauri:dev": "tauri dev",
     "build": "tsc && vite build",
     "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "lint": "biome check src",
+    "lint:fix": "biome check --fix src",
     "preview": "vite preview",
     "tauri": "tauri"
   },
@@ -25,12 +29,18 @@
   },
   "devDependencies": {
     "@tailwindcss/vite": "^4.1.0",
+    "@testing-library/jest-dom": "^6.6.3",
+    "@testing-library/react": "^16.3.0",
     "@tauri-apps/cli": "^2.8.0",
     "@types/node": "^24.0.0",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
     "@vitejs/plugin-react": "^5.0.0",
     "typescript": "^5.9.0",
-    "vite": "^7.0.0"
+    "jsdom": "^26.1.0",
+    "tailwindcss": "^4.1.0",
+    "vite": "^7.0.0",
+    "@biomejs/biome": "^2.0.0",
+    "vitest": "^3.2.1"
   }
 }