Implement configuration workflow and desktop improvements

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: sharpninja

McpServerManager.sln

@@ -47,8 +47,6 @@ Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "McpServer.VsExtension.McpTo
 EndProject
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "tests", "tests", "{9897A8EA-E873-9B68-C2F6-10D3BFE97FAA}"
 EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "McpServer.Common.Copilot.Tests", "lib\McpServer\tests\McpServer.Common.Copilot.Tests\McpServer.Common.Copilot.Tests.csproj", "{8FD37703-A43A-452E-B1DF-C51C14EC787F}"
-EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "McpServer.Common.Copilot", "lib\McpServer\src\McpServer.Common.Copilot\McpServer.Common.Copilot.csproj", "{6F5701FC-F0DF-415C-9484-13EFD36E11CB}"
 EndProject
 Global
@@ -253,18 +251,6 @@ Global
 		{576EC5F4-1C16-4796-9CC0-3DD4EF119243}.Release|x64.Build.0 = Release|Any CPU
 		{576EC5F4-1C16-4796-9CC0-3DD4EF119243}.Release|x86.ActiveCfg = Release|Any CPU
 		{576EC5F4-1C16-4796-9CC0-3DD4EF119243}.Release|x86.Build.0 = Release|Any CPU
-		{8FD37703-A43A-452E-B1DF-C51C14EC787F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
-		{8FD37703-A43A-452E-B1DF-C51C14EC787F}.Debug|Any CPU.Build.0 = Debug|Any CPU
-		{8FD37703-A43A-452E-B1DF-C51C14EC787F}.Debug|x64.ActiveCfg = Debug|x64
-		{8FD37703-A43A-452E-B1DF-C51C14EC787F}.Debug|x64.Build.0 = Debug|x64
-		{8FD37703-A43A-452E-B1DF-C51C14EC787F}.Debug|x86.ActiveCfg = Debug|x86
-		{8FD37703-A43A-452E-B1DF-C51C14EC787F}.Debug|x86.Build.0 = Debug|x86
-		{8FD37703-A43A-452E-B1DF-C51C14EC787F}.Release|Any CPU.ActiveCfg = Release|Any CPU
-		{8FD37703-A43A-452E-B1DF-C51C14EC787F}.Release|Any CPU.Build.0 = Release|Any CPU
-		{8FD37703-A43A-452E-B1DF-C51C14EC787F}.Release|x64.ActiveCfg = Release|x64
-		{8FD37703-A43A-452E-B1DF-C51C14EC787F}.Release|x64.Build.0 = Release|x64
-		{8FD37703-A43A-452E-B1DF-C51C14EC787F}.Release|x86.ActiveCfg = Release|x86
-		{8FD37703-A43A-452E-B1DF-C51C14EC787F}.Release|x86.Build.0 = Release|x86
 		{6F5701FC-F0DF-415C-9484-13EFD36E11CB}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
 		{6F5701FC-F0DF-415C-9484-13EFD36E11CB}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{6F5701FC-F0DF-415C-9484-13EFD36E11CB}.Debug|x64.ActiveCfg = Debug|x64
@@ -301,7 +287,6 @@ Global
 		{BE32426E-CF8B-456A-9ECF-C6B0B86D9E06} = {0AB3BF05-4346-4AA6-1389-037BE0695223}
 		{576EC5F4-1C16-4796-9CC0-3DD4EF119243} = {827E0CD3-B72D-47B6-A68D-7590B98EB39B}
 		{9897A8EA-E873-9B68-C2F6-10D3BFE97FAA} = {AC2490A8-6721-B82B-8F37-115021953299}
-		{8FD37703-A43A-452E-B1DF-C51C14EC787F} = {9897A8EA-E873-9B68-C2F6-10D3BFE97FAA}
 		{6F5701FC-F0DF-415C-9484-13EFD36E11CB} = {6AF42076-EE0C-549E-06B8-456F4C7181C1}
 	EndGlobalSection
 EndGlobal

README.md

@@ -53,17 +53,22 @@ dotnet run
 
 ## Deployment automation
 
-Use NUKE from the repo root as the authoritative build/deploy entry point.
+Use NUKE from the repo root as the authoritative build/deploy entry point for local automation and CI.
 
 ```powershell
 .\build.ps1
-.\build.ps1 --target DeployAll
-.\build.ps1 --target DeployAll --deploy-selection Director,WebUi,DesktopMsix
-.\build.ps1 --target DeployAll --what-if
-.\build.ps1 --target DeployAll --configuration Debug --deploy-selection Director,WebUi
+.\build.ps1 DeployAll
+.\build.ps1 DeployAll --deploy-selection Director,WebUi,DesktopMsix
+.\build.ps1 DeployAll --what-if
+.\build.ps1 DeployAll --configuration Debug --deploy-selection Director,WebUi
 .\build.ps1 BuildAndInstallVsix --what-if
 ```
 
+```bash
+bash ./build.sh VersionInfo --json-output-path artifacts/version.json
+bash ./build.sh BuildDesktopDeb --package-version <semver>
+```
+
 Current target names:
 - `Director`
 - `WebUi`
@@ -76,13 +81,19 @@ Behavior notes:
 - `build.ps1` and `build.sh` are the primary entry points; they invoke `build\Build.csproj` with the repo root wired up for NUKE.
 - When invoked with no arguments, the root wrappers forward `--help` so you see NUKE help instead of accidentally running a default target.
 - For convenience, the wrappers treat the first bare argument as `--target`, so commands like `.\build.ps1 BuildAndInstallVsix --what-if` work without spelling out `--target`.
+- `.github\workflows\build-android.yml` is intentionally thin: the workflow restores tools and runner prerequisites, then delegates versioning, packaging, release, F-Droid, and Pages assembly to NUKE targets.
 - The build is best-effort for deploy-all: unavailable targets are skipped and reported in the final summary.
 - `--what-if` is the standard dry-run mechanism for NUKE-backed targets.
-- `DesktopMsix` deployment auto-elevates only the certificate trust/install step through `gsudo`, avoiding elevated NUKE re-entry log-file conflicts; otherwise the build fails with guidance to install `gsudo` or rerun from an elevated PowerShell session.
+- `DesktopMsix` deployment auto-elevates only the certificate trust step through `gsudo`, then installs the package back in the invoking user context to ensure the app registers for the actual desktop user.
 - `DesktopDeb` installation on Windows launches an interactive WSL `sudo` prompt so the user can enter their password when package installation is requested.
 - Legacy files under `scripts\` now act as compatibility wrappers so existing commands continue to work while NUKE owns the orchestration logic.
 - For independent target execution, import `scripts\DeployAllTargets.psm1` and call the exported compatibility functions directly, for example `Invoke-DeployDirectorTool -Configuration Debug -WhatIf`.
 
+Validation commands:
+- `dotnet build build\Build.csproj -nologo`
+- `dotnet build src\McpServerManager.Desktop\McpServerManager.Desktop.csproj -nologo`
+- `Invoke-Pester -Path scripts\DeployAllTargets.Tests.ps1 -Output Detailed -CI`
+
 ### WSL with WSLg
 
 On WSL with WSLg enabled (Windows 11), the app window should appear on the Windows desktop. If it doesn’t:

build/Build.MsixPackaging.cs

@@ -353,45 +353,44 @@ private string BuildDesktopMsixWithElevation()
         {
             if (CommandExists("gsudo"))
             {
-                Warn("[WhatIf] Elevate the MSIX certificate trust/install step through gsudo.");
+                Warn("[WhatIf] Elevate the MSIX certificate trust step through gsudo, then install the package in the invoking user context.");
             }
             else
             {
-                Warn("[WhatIf] MSIX installation would require elevation, and gsudo was not found in PATH.");
+                Warn("[WhatIf] MSIX certificate trust would require elevation, and gsudo was not found in PATH.");
             }
 
             return BuildDesktopMsixCoreNative(installAfterBuild: false);
         }
 
         if (!CommandExists("gsudo"))
         {
-            throw new InvalidOperationException("MSIX installation requires elevation, but gsudo was not found in PATH. Install gsudo or rerun this command from an elevated PowerShell session.");
+            throw new InvalidOperationException("MSIX certificate trust requires elevation, but gsudo was not found in PATH. Install gsudo or rerun this command from an elevated PowerShell session.");
         }
 
         var packagingContext = ResolveDesktopMsixPackagingContext();
         var msixPath = BuildDesktopMsixCoreNative(installAfterBuild: false);
-        InstallMsixPackageWithGsudo(packagingContext.Config.PackageName, msixPath, packagingContext.CertificatePath);
+        TrustMsixCertificateWithGsudo(packagingContext.CertificatePath);
+        InstallMsixPackage(packagingContext.Config.PackageName, msixPath);
         return msixPath;
     }
 
     [SupportedOSPlatform("windows")]
-    private void InstallMsixPackageWithGsudo(string packageName, string msixPath, string certificatePath)
+    private void TrustMsixCertificateWithGsudo(string certificatePath)
     {
         var command = string.Join(
             Environment.NewLine,
             new[]
             {
+                "$ErrorActionPreference = 'Stop'",
                 $"$certPath = '{QuotePowerShellLiteral(certificatePath)}'",
-                $"$msixPath = '{QuotePowerShellLiteral(msixPath)}'",
-                $"$packageName = '{QuotePowerShellLiteral(packageName)}'",
                 "if (-not (Test-Path -LiteralPath $certPath)) { throw \"Signing certificate not found at $certPath\" }",
-                "if (-not (Test-Path -LiteralPath $msixPath)) { throw \"MSIX package not found at $msixPath\" }",
                 "$certificate = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2 $certPath",
                 "$trustedCertificate = Get-ChildItem Cert:\\LocalMachine\\Root | Where-Object { $_.Thumbprint -eq $certificate.Thumbprint } | Select-Object -First 1",
-                "if ($null -eq $trustedCertificate) { Import-Certificate -FilePath $certPath -CertStoreLocation 'Cert:\\LocalMachine\\Root' | Out-Null }",
-                "$existingPackage = Get-AppxPackage -Name $packageName -ErrorAction SilentlyContinue",
-                "if ($null -ne $existingPackage) { Remove-AppxPackage -Package $existingPackage.PackageFullName }",
-                "Add-AppxPackage -Path $msixPath"
+                "if ($null -eq $trustedCertificate) {",
+                "    $imported = Import-Certificate -FilePath $certPath -CertStoreLocation 'Cert:\\LocalMachine\\Root'",
+                "    if ($null -eq $imported) { throw \"Certificate import did not return a result for $certPath\" }",
+                "}"
             });
 
         var result = InvokeProcess(
@@ -413,7 +412,7 @@ private void InstallMsixPackageWithGsudo(string packageName, string msixPath, st
 
         if (result.ExitCode != 0)
         {
-            throw new InvalidOperationException($"gsudo failed to elevate MSIX installation (exit code {result.ExitCode}).{Environment.NewLine}{result.GetCombinedOutput()}");
+            throw new InvalidOperationException($"gsudo failed to elevate MSIX certificate trust (exit code {result.ExitCode}).{Environment.NewLine}{result.GetCombinedOutput()}");
         }
     }
 
@@ -819,9 +818,12 @@ private void InstallMsixPackage(string packageName, string msixPath)
             Environment.NewLine,
             new[]
             {
+                "$ErrorActionPreference = 'Stop'",
                 $"$existing = Get-AppxPackage -Name '{QuotePowerShellLiteral(packageName)}' -ErrorAction SilentlyContinue",
-                "if ($null -ne $existing) { Remove-AppxPackage -Package $existing.PackageFullName }",
-                $"Add-AppxPackage -Path '{QuotePowerShellLiteral(msixPath)}'"
+                "if ($null -ne $existing) { Remove-AppxPackage -Package $existing.PackageFullName -ErrorAction Stop }",
+                $"Add-AppxPackage -Path '{QuotePowerShellLiteral(msixPath)}' -ErrorAction Stop",
+                $"$installed = Get-AppxPackage -Name '{QuotePowerShellLiteral(packageName)}' -ErrorAction Stop",
+                "if ($null -eq $installed) { throw \"Package registration was not visible after Add-AppxPackage completed.\" }"
             });
         InvokePowerShellCommand(command, true);
     }

docs/todo.yaml

@@ -854,12 +854,25 @@ mvp-mcp:
 director:
   medium-priority:
   - id: DIR-UI-001
-    title: '[NEEDS PLAN] Reorder the tabs so that global config tabse are at the end.'
+    title: Reorder the tabs so that non-workspace tabs are at the end.
+    note: Implementation and bookkeeping refreshed on 2026-03-11 after DIR-UI-001 planning and code changes.
     done: false
     description:
-    - Place global config tabs (non-Workspace specific) at the end of the tabs.
+    - Move the Director non-workspace tabs (Health, Workspaces, Policy, Logs, and Config) to the end of the tab strip.
+    - Keep workspace-scoped and workspace-aware tabs first after the existing authorization and availability filtering.
+    remaining: Implementation is complete, but targeted validation and build-tool redeploy are blocked by unrelated McpServer.Director package restore/version issues (missing package versions plus NU1602/NU1605/NU1608 restore-as-error conflicts).
     technical-details:
-    - '-'
+    - Add TabPlacementGroup metadata to TabRegistration in McpServer.UI.Core/Navigation/ITabRegistry.cs.
+    - Apply a stable GetVisibleTabRegistrations helper in MainScreen so filtering happens before placement ordering.
+    - Cover admin, agent-manager, and viewer ordering cases in focused Director tests.
     implementation-tasks:
-    - task: '[ ]'
+    - task: Add placement metadata to the shared Director tab registration model
+      done: true
+    - task: Mark the non-workspace Director tabs as trailing in MainScreen
+      done: true
+    - task: Add focused tab-ordering tests for the Director screen
+      done: true
+    - task: Resolve unrelated McpServer.Director package restore/version failures and rerun targeted validation
+      done: false
+    - task: Redeploy Director through build.ps1 UpdateDirectorTool after restore issues are fixed
       done: false

lib/McpServer

@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2012/06/nuspec.xsd">
   <metadata>
     <id>SharpNinja.McpServer.Director</id>
-    <version>0.5.1-22</version>
+    <version>0.5.1-30</version>
     <authors>SharpNinja</authors>
     <description>CLI management tool for McpServer. Provides workspace management, agent orchestration, compliance policy editing, Keycloak OIDC auth, and an interactive Terminal.Gui TUI with 7 tabbed screens. 18 CLI commands via System.CommandLine.</description>
     <packageTypes>

nupkg/SharpNinja.McpServer.Director.nuspec

@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2012/06/nuspec.xsd">
   <metadata>
     <id>SharpNinja.McpServer.Web</id>
-    <version>0.5.1-22</version>
+    <version>0.5.1-30</version>
     <authors>SharpNinja</authors>
     <description>SharpNinja.McpServer.Web</description>
     <packageTypes>

nupkg/SharpNinja.McpServer.Web.nuspec

@@ -29,6 +29,7 @@ internal sealed class DirectorAuthorizationPolicyService : IAuthorizationPolicyS
         [McpArea.Diagnostic] = McpRoles.Viewer,
         [McpArea.AuthConfig] = McpRoles.Viewer,
         [McpArea.Templates] = McpRoles.Viewer,
+        [McpArea.Configuration] = McpRoles.Admin,
     };
 
     private static readonly IReadOnlyDictionary<string, string> s_actionRoles =
@@ -125,6 +126,8 @@ internal sealed class DirectorAuthorizationPolicyService : IAuthorizationPolicyS
             [McpActionKeys.VoiceTranscript] = McpRoles.Viewer,
             [McpActionKeys.VoiceDeleteSession] = McpRoles.Viewer,
             [McpActionKeys.EventsSubscribe] = McpRoles.Viewer,
+            [McpActionKeys.ConfigurationGet] = McpRoles.Admin,
+            [McpActionKeys.ConfigurationPatch] = McpRoles.Admin,
         };
 
     /// <summary>Initializes a new instance of the policy service.</summary>