From ccf8b30b810f50cc00ec5311ecf573b0dc441d5a Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Wed, 1 Jul 2026 17:26:35 -0400
Subject: [PATCH 01/89] feat(apps): seamless container/service runnables

Two backward-compatible improvements so container-based services (e.g.
code-server) need no launcher script:

- Auto-bind the cached repo clone into the container when a runnable
  resolves working_dir to 'repo'. Previously the repo symlink dangled
  inside containers (only the work dir and param paths were bound), so the
  documented `working_dir: repo` escape hatch was unusable. Container
  bind-path computation is extracted into _container_bind_paths().

- For service-type jobs, emit a preamble that picks a free TCP port on the
  compute node and exports it as FG_SERVICE_PORT (with FG_HOSTNAME). New
  service-only `auto_url` field makes Fileglancer write
  http://$FG_HOSTNAME:$FG_SERVICE_PORT to SERVICE_URL_PATH, so a service
  that binds $FG_SERVICE_PORT needs no URL-writing code of its own.

Net effect: a container service becomes a one-liner, e.g.
  command: code-server --bind-addr 0.0.0.0:$FG_SERVICE_PORT
with auto_url: true and container: ghcr.io/coder/code-server.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 fileglancer/apps/__init__.py |   2 +
 fileglancer/apps/jobs.py     |  93 ++++++++++++++++++++++-----
 fileglancer/model.py         |  12 ++++
 frontend/src/shared.types.ts |   1 +
 tests/test_apps.py           | 121 +++++++++++++++++++++++++++++++++++
 5 files changed, 212 insertions(+), 17 deletions(-)

diff --git a/fileglancer/apps/__init__.py b/fileglancer/apps/__init__.py
index ad92584b..e8e8e48c 100644
--- a/fileglancer/apps/__init__.py
+++ b/fileglancer/apps/__init__.py
@@ -24,7 +24,9 @@
 )
 from fileglancer.apps.jobs import (  # noqa: F401
     _build_container_script,
+    _container_bind_paths,
     _container_sif_name,
+    _SERVICE_PORT_HELPER,
     cancel_job,
     start_job_monitor,
     stop_job_monitor,
diff --git a/fileglancer/apps/jobs.py b/fileglancer/apps/jobs.py
index 066d91ca..5e1d3905 100644
--- a/fileglancer/apps/jobs.py
+++ b/fileglancer/apps/jobs.py
@@ -390,6 +390,33 @@ def _container_sif_name(container_url: str) -> str:
 _DEFAULT_CONTAINER_CACHE_DIR = "$HOME/.fileglancer/apptainer_cache"
 
 
+# Runtime helper emitted for service jobs. It allocates a free TCP port on the
+# compute node (a port chosen on the submit host would be meaningless there) and
+# exports it as FG_SERVICE_PORT along with FG_HOSTNAME, so a service command can
+# bind to a known address without reimplementing port discovery. Prefers python
+# (authoritative bind-to-0), then falls back to a bash probe of ephemeral ports.
+_SERVICE_PORT_HELPER = r"""# Fileglancer service setup: pick a free port and expose the hostname
+__fg_free_port() {
+  local p py i
+  for py in python3 python; do
+    if command -v "$py" >/dev/null 2>&1; then
+      p="$("$py" -c 'import socket; s=socket.socket(); s.bind(("",0)); print(s.getsockname()[1]); s.close()' 2>/dev/null)" || true
+      [ -n "$p" ] && { printf '%s' "$p"; return 0; }
+    fi
+  done
+  for i in $(seq 1 50); do
+    p=$(( (RANDOM % 16384) + 49152 ))
+    if ! (exec 3<>"/dev/tcp/127.0.0.1/$p") 2>/dev/null; then
+      printf '%s' "$p"; return 0
+    fi
+  done
+  printf '%s' 8080
+}
+export FG_HOSTNAME="$(hostname)"
+export FG_SERVICE_PORT="$(__fg_free_port)"
+"""
+
+
 def _build_container_script(
     container_url: str,
     command: str,
@@ -428,6 +455,43 @@ def _build_container_script(
     return "\n".join(lines)
 
 
+def _container_bind_paths(entry_point, parameters: dict, username: Optional[str],
+                          cached_repo_dir) -> list[str]:
+    """Compute the host paths to bind-mount into a container runnable.
+
+    Binds are drawn from three sources, in order:
+
+    1. Each file/directory parameter's value (a file binds its parent dir).
+       Cloud-storage URIs and non-absolute values are skipped — they are not
+       bind-mountable and would otherwise produce garbage binds.
+    2. The runnable's explicit `bind_paths`.
+    3. The cached repo clone, but only when the command runs from `repo`. The
+       `repo` symlink lives inside the (already-bound) work dir yet points at
+       the clone outside it, so without this bind the symlink dangles in the
+       container and the `cd` into it fails. Container runnables default to
+       `work`, so this is only added when the author opts into `repo`.
+
+    The work dir itself is always bound by `_build_container_script`, so it is
+    not included here.
+    """
+    bind_paths: list[str] = []
+    for param in entry_point.flat_parameters():
+        if param.type in ("file", "directory") and param.key in parameters:
+            path_val = str(parameters[param.key])
+            expanded = expand_user_path(path_val, username)
+            if expanded.startswith(_URI_PREFIXES) or not expanded.startswith("/"):
+                continue
+            if param.type == "directory":
+                bind_paths.append(expanded)
+            else:
+                bind_paths.append(str(Path(expanded).parent))
+    if entry_point.bind_paths:
+        bind_paths.extend(entry_point.bind_paths)
+    if entry_point.effective_working_dir == "repo":
+        bind_paths.append(str(cached_repo_dir))
+    return bind_paths
+
+
 async def submit_job(
     username: str,
     app_url: str,
@@ -633,6 +697,15 @@ async def submit_job(
         preamble_lines.append(f"export PATH=$PATH:{path_suffix}")
     if entry_point.type == "service":
         preamble_lines.append('export SERVICE_URL_PATH="$FG_WORK_DIR/service_url"')
+        preamble_lines.append(_SERVICE_PORT_HELPER)
+        # When the author opts in with auto_url, write the service URL for them
+        # using the port we just allocated, so a service that binds to
+        # $FG_SERVICE_PORT needs no URL-writing code of its own. A service that
+        # manages its own URL simply leaves auto_url unset and overwrites this.
+        if entry_point.auto_url:
+            preamble_lines.append(
+                'printf \'http://%s:%s\' "$FG_HOSTNAME" "$FG_SERVICE_PORT" > "$SERVICE_URL_PATH"'
+            )
     # Choose the working directory. 'work' runs from the job's work dir (the
     # repo is still reachable via the `repo` symlink); 'repo' runs from the
     # cloned project (optionally the manifest's subdirectory). cd_suffix may
@@ -654,23 +727,9 @@ async def submit_job(
 
     # If container is defined, wrap command in apptainer exec
     if effective_container:
-        bind_paths = []
-        for param in entry_point.flat_parameters():
-            if param.type in ("file", "directory") and param.key in parameters:
-                path_val = str(parameters[param.key])
-                # Expand ~ against the user's home (same normalization as the
-                # command). Skip cloud-storage URIs and anything that isn't an
-                # absolute local path — those are not bind-mountable and would
-                # otherwise produce garbage binds (e.g. s3://bucket/k -> s3:/bucket).
-                expanded = expand_user_path(path_val, username)
-                if expanded.startswith(_URI_PREFIXES) or not expanded.startswith("/"):
-                    continue
-                if param.type == "directory":
-                    bind_paths.append(expanded)
-                else:
-                    bind_paths.append(str(Path(expanded).parent))
-        if entry_point.bind_paths:
-            bind_paths.extend(entry_point.bind_paths)
+        bind_paths = _container_bind_paths(
+            entry_point, parameters, username, cached_repo_dir
+        )
 
         command = _build_container_script(
             container_url=effective_container,
diff --git a/fileglancer/model.py b/fileglancer/model.py
index 5743ddc8..77e3ccbb 100644
--- a/fileglancer/model.py
+++ b/fileglancer/model.py
@@ -436,6 +436,16 @@ class AppEntryPoint(BaseModel):
         ),
         default=None,
     )
+    auto_url: bool = Field(
+        description=(
+            "For service entry points only: have Fileglancer write "
+            "http://$FG_HOSTNAME:$FG_SERVICE_PORT to SERVICE_URL_PATH before the "
+            "command runs. Set this when your service binds to the "
+            "Fileglancer-provided $FG_SERVICE_PORT so you don't have to write the "
+            "URL file yourself."
+        ),
+        default=False,
+    )
     requirements: List[str] = Field(
         description="Required tools for this entry point, e.g. ['apptainer']. Merged with manifest-level requirements.",
         default=[],
@@ -550,6 +560,8 @@ def check_conda_container_exclusive(self):
             raise ValueError("conda_env and container are mutually exclusive — use one or the other")
         if self.bind_paths and not self.container:
             raise ValueError("bind_paths requires container to be set")
+        if self.auto_url and self.type != "service":
+            raise ValueError("auto_url is only valid for service entry points (type: service)")
         return self
 
 
diff --git a/frontend/src/shared.types.ts b/frontend/src/shared.types.ts
index 05beb24b..baff9068 100644
--- a/frontend/src/shared.types.ts
+++ b/frontend/src/shared.types.ts
@@ -126,6 +126,7 @@ type AppEntryPoint = {
   bind_paths?: string[];
   container_args?: string;
   working_dir?: 'work' | 'repo';
+  auto_url?: boolean;
   requirements?: string[];
 };
 
diff --git a/tests/test_apps.py b/tests/test_apps.py
index 4ccc35a2..7452dcda 100644
--- a/tests/test_apps.py
+++ b/tests/test_apps.py
@@ -22,6 +22,8 @@
     build_requirements_check,
     _container_sif_name,
     _build_container_script,
+    _container_bind_paths,
+    _SERVICE_PORT_HELPER,
     build_command,
     collect_path_parameters,
     expand_user_path,
@@ -679,6 +681,125 @@ def test_docker_prefix_not_doubled(self):
         assert "docker://ghcr.io/org/image:1.0" in script
 
 
+class TestContainerBindPaths:
+    """_container_bind_paths decides what host paths get mounted into a container."""
+
+    def _ep(self, **kwargs):
+        defaults = dict(id="t", name="T", command="echo",
+                        container="ghcr.io/org/image:tag")
+        defaults.update(kwargs)
+        return AppEntryPoint(**defaults)
+
+    def test_directory_param_bound_directly(self):
+        ep = self._ep(parameters=[
+            AppParameter(flag="--data", name="Data", type="directory")
+        ])
+        binds = _container_bind_paths(ep, {"data": "/groups/lab/data"}, None, "/cache/repo")
+        assert "/groups/lab/data" in binds
+
+    def test_file_param_binds_parent_dir(self):
+        ep = self._ep(parameters=[
+            AppParameter(flag="--in", name="In", type="file")
+        ])
+        binds = _container_bind_paths(ep, {"in": "/groups/lab/x.tif"}, None, "/cache/repo")
+        assert "/groups/lab" in binds
+        assert "/groups/lab/x.tif" not in binds
+
+    def test_cloud_uri_and_relative_skipped(self):
+        ep = self._ep(parameters=[
+            AppParameter(flag="--a", name="A", type="directory"),
+            AppParameter(flag="--b", name="B", type="directory"),
+        ])
+        binds = _container_bind_paths(
+            ep, {"a": "s3://bucket/key", "b": "./rel"}, None, "/cache/repo"
+        )
+        assert binds == []  # neither is a bind-mountable absolute local path
+
+    def test_explicit_bind_paths_included(self):
+        ep = self._ep(bind_paths=["/shared/ref", "/scratch"])
+        binds = _container_bind_paths(ep, {}, None, "/cache/repo")
+        assert "/shared/ref" in binds and "/scratch" in binds
+
+    def test_repo_bound_only_when_working_dir_repo(self):
+        # Container default is working_dir=work → repo NOT bound.
+        work_ep = self._ep()
+        assert "work" == work_ep.effective_working_dir
+        assert "/cache/repo" not in _container_bind_paths(work_ep, {}, None, "/cache/repo")
+
+        # Opt into repo → the cached clone is bound so the repo symlink resolves.
+        repo_ep = self._ep(working_dir="repo")
+        assert "/cache/repo" in _container_bind_paths(repo_ep, {}, None, "/cache/repo")
+
+
+# --- Service port / URL tests (FG_SERVICE_PORT + auto_url) ---
+
+class TestServicePortHelper:
+    """The preamble helper Fileglancer injects for service-type jobs."""
+
+    def test_helper_exports_port_and_hostname(self):
+        assert "export FG_SERVICE_PORT=" in _SERVICE_PORT_HELPER
+        assert "export FG_HOSTNAME=" in _SERVICE_PORT_HELPER
+
+    def test_helper_is_valid_bash(self):
+        # The generated snippet must at least parse as bash.
+        result = subprocess.run(
+            ["bash", "-n", "-c", _SERVICE_PORT_HELPER],
+            capture_output=True, text=True,
+        )
+        assert result.returncode == 0, result.stderr
+
+    def test_helper_picks_a_free_port_at_runtime(self):
+        # Run the helper and confirm FG_SERVICE_PORT is a plausible TCP port.
+        script = _SERVICE_PORT_HELPER + '\necho "$FG_SERVICE_PORT"'
+        result = subprocess.run(
+            ["bash", "-c", script], capture_output=True, text=True,
+        )
+        assert result.returncode == 0, result.stderr
+        port = int(result.stdout.strip().splitlines()[-1])
+        assert 1 <= port <= 65535
+
+    def test_helper_robust_under_set_euo_pipefail(self):
+        # A deployment may prepend `set -euo pipefail` via script_prologue; the
+        # helper must still allocate a port and not abort the job.
+        script = "set -euo pipefail\n" + _SERVICE_PORT_HELPER + '\necho "$FG_SERVICE_PORT"'
+        result = subprocess.run(
+            ["bash", "-c", script], capture_output=True, text=True,
+        )
+        assert result.returncode == 0, result.stderr
+        assert int(result.stdout.strip().splitlines()[-1]) >= 1
+
+
+class TestServiceAutoUrl:
+    """auto_url is service-only and drives Fileglancer to write the URL file."""
+
+    def test_auto_url_defaults_false(self):
+        ep = AppEntryPoint(id="t", name="T", command="echo", type="service")
+        assert ep.auto_url is False
+
+    def test_auto_url_allowed_on_service(self):
+        ep = AppEntryPoint(id="t", name="T", command="echo",
+                           type="service", auto_url=True)
+        assert ep.auto_url is True
+
+    def test_auto_url_rejected_on_job(self):
+        with pytest.raises(ValidationError, match="auto_url is only valid for service"):
+            AppEntryPoint(id="t", name="T", command="echo",
+                          type="job", auto_url=True)
+
+    def test_auto_url_write_command_uses_provided_port(self):
+        # Mirror the preamble line submit_job emits when auto_url is set, and
+        # confirm it writes a valid http URL built from the helper's values.
+        write_line = (
+            'printf \'http://%s:%s\' "$FG_HOSTNAME" "$FG_SERVICE_PORT"'
+        )
+        script = _SERVICE_PORT_HELPER + "\n" + write_line
+        result = subprocess.run(
+            ["bash", "-c", script], capture_output=True, text=True,
+        )
+        assert result.returncode == 0, result.stderr
+        assert result.stdout.startswith("http://")
+
+
 # --- Path validation tests ---
 
 from fileglancer.apps import validate_path_for_shell, validate_path_in_filestore

From 69dd372fdf5f817c3418a119d0dc4e96ffaf1e9c Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Wed, 1 Jul 2026 19:43:04 -0400
Subject: [PATCH 02/89] feat(apps): choose which apps to add from a multi-app
 repo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adding a repo that contains more than one app now lets the user pick which
apps to add instead of always adding all of them.

Backend:
- New POST /api/apps/discover returns the repo's manifests (path, name,
  description, already_added) without adding anything.
- AppAddRequest gains optional manifest_paths; POST /api/apps adds only that
  subset when provided, or all discovered manifests when omitted (unchanged
  default). Shared _discover_repo_manifests keeps error handling identical
  across both endpoints.

Frontend:
- AddAppDialog is now two-step: enter the URL, then — only when the repo has
  more than one app — a checklist of apps with a Select all / Deselect all
  toggle and an "Add Selected (N)" action. Single-app repos add directly as
  before. Already-added apps are shown checked and disabled.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 fileglancer/model.py                          |  19 ++
 fileglancer/server.py                         |  61 +++-
 frontend/src/components/AppLaunch.tsx         |   2 +-
 frontend/src/components/Apps.tsx              |  13 +-
 .../components/ui/AppsPage/AddAppDialog.tsx   | 323 +++++++++++++-----
 frontend/src/queries/appsQueries.ts           |  42 ++-
 frontend/src/shared.types.ts                  |   8 +
 tests/test_apps_endpoints.py                  | 106 ++++++
 8 files changed, 480 insertions(+), 94 deletions(-)

diff --git a/fileglancer/model.py b/fileglancer/model.py
index 77e3ccbb..5ec22df8 100644
--- a/fileglancer/model.py
+++ b/fileglancer/model.py
@@ -713,6 +713,25 @@ class ManifestFetchRequest(BaseModel):
 class AppAddRequest(BaseModel):
     """Request to add an app"""
     url: str = Field(description="URL to the app manifest or GitHub repo")
+    manifest_paths: Optional[List[str]] = Field(
+        description=(
+            "Manifest paths (relative dirs within the repo) to add. When omitted "
+            "or null, every discovered manifest in the repo is added. Use this to "
+            "add a subset of a multi-app repository."
+        ),
+        default=None,
+    )
+
+
+class DiscoveredApp(BaseModel):
+    """A manifest discovered in a repo, for previewing before adding"""
+    manifest_path: str = Field(description="Relative directory path to the manifest within the repo", default="")
+    name: str = Field(description="App name from the manifest")
+    description: Optional[str] = Field(description="App description from the manifest", default=None)
+    already_added: bool = Field(
+        description="True if the user has already added this manifest from this repo",
+        default=False,
+    )
 
 
 class AppRemoveRequest(BaseModel):
diff --git a/fileglancer/server.py b/fileglancer/server.py
index 6655a058..e3096e44 100644
--- a/fileglancer/server.py
+++ b/fileglancer/server.py
@@ -1732,15 +1732,15 @@ async def get_user_apps(username: str = Depends(get_current_user)):
             user_app.description = manifest.description
         return result
 
-    @app.post("/api/apps", response_model=list[UserApp],
-              description="Add an app by URL (discovers all manifests in the repo)")
-    async def add_user_app(body: AppAddRequest,
-                           username: str = Depends(get_current_user)):
-        # Clone the repo and discover all manifests. The worker resolves the
-        # branch as the user, so a private repo's real default is used.
+    async def _discover_repo_manifests(url: str, username: str):
+        """Clone/scan a repo and return (resolved_branch, canonical_url, discovered).
+
+        Shared by the discover and add endpoints so both surface identical,
+        user-facing errors for a bad URL/revision/private-repo clone.
+        """
         try:
             resolved_branch, discovered = await apps_module.discover_app_manifests(
-                body.url, username=username)
+                url, username=username)
         except ValueError as e:
             raise HTTPException(status_code=404, detail=str(e))
         except HTTPException as e:
@@ -1764,9 +1764,50 @@ async def add_user_app(body: AppAddRequest,
             )
 
         # Bake the worker-resolved revision into the stored URL (so a repo whose
-        # default is e.g. "master" dedups against an explicit ".../tree/master"),
-        # and record the user's requested revision separately ("" = unpinned).
-        canonical_url, requested = apps_module.canonical_app_url(body.url, resolved_branch)
+        # default is e.g. "master" dedups against an explicit ".../tree/master").
+        canonical_url, _ = apps_module.canonical_app_url(url, resolved_branch)
+        return resolved_branch, canonical_url, discovered
+
+    @app.post("/api/apps/discover", response_model=list[DiscoveredApp],
+              description="Discover the apps (manifests) in a repo without adding them")
+    async def discover_user_apps(body: AppAddRequest,
+                                 username: str = Depends(get_current_user)):
+        _, canonical_url, discovered = await _discover_repo_manifests(body.url, username)
+        with db.get_db_session(settings.db_url) as session:
+            return [
+                DiscoveredApp(
+                    manifest_path=manifest_path,
+                    name=manifest.name,
+                    description=manifest.description,
+                    already_added=db.get_user_app(
+                        session, username, canonical_url, manifest_path) is not None,
+                )
+                for manifest_path, manifest in discovered
+            ]
+
+    @app.post("/api/apps", response_model=list[UserApp],
+              description="Add apps by URL (all discovered manifests, or the subset in manifest_paths)")
+    async def add_user_app(body: AppAddRequest,
+                           username: str = Depends(get_current_user)):
+        # Clone the repo and discover all manifests. The worker resolves the
+        # branch as the user, so a private repo's real default is used.
+        resolved_branch, canonical_url, discovered = await _discover_repo_manifests(
+            body.url, username)
+
+        # Restrict to the requested subset when manifest_paths is provided; an
+        # omitted/null list means "add everything" (backward compatible). Paths
+        # not present in the repo are ignored.
+        if body.manifest_paths is not None:
+            wanted = set(body.manifest_paths)
+            discovered = [(p, m) for p, m in discovered if p in wanted]
+            if not discovered:
+                raise HTTPException(
+                    status_code=400,
+                    detail="None of the requested apps were found in the repository.",
+                )
+
+        # Record the user's requested revision separately ("" = unpinned).
+        _, requested = apps_module.canonical_app_url(body.url, resolved_branch)
         new_apps: list[UserApp] = []
 
         with db.get_db_session(settings.db_url) as session:
diff --git a/frontend/src/components/AppLaunch.tsx b/frontend/src/components/AppLaunch.tsx
index 2da22e74..c66856a5 100644
--- a/frontend/src/components/AppLaunch.tsx
+++ b/frontend/src/components/AppLaunch.tsx
@@ -166,7 +166,7 @@ export default function AppLaunch() {
 
   const handleInstall = async () => {
     try {
-      const apps = await addAppMutation.mutateAsync(appUrl);
+      const apps = await addAppMutation.mutateAsync({ url: appUrl });
       const count = apps.length;
       toast.success(`${count} app${count !== 1 ? 's' : ''} added`);
     } catch (error) {
diff --git a/frontend/src/components/Apps.tsx b/frontend/src/components/Apps.tsx
index 3e1531a6..039558d2 100644
--- a/frontend/src/components/Apps.tsx
+++ b/frontend/src/components/Apps.tsx
@@ -10,6 +10,7 @@ import DeleteAppDialog from '@/components/ui/AppsPage/DeleteAppDialog';
 import {
   useAppsQuery,
   useAddAppMutation,
+  useDiscoverAppsMutation,
   useUpdateAppMutation,
   useRemoveAppMutation,
   useShareAppMutation,
@@ -26,6 +27,7 @@ export default function Apps() {
 
   const appsQuery = useAppsQuery();
   const addAppMutation = useAddAppMutation();
+  const discoverAppsMutation = useDiscoverAppsMutation();
   const updateAppMutation = useUpdateAppMutation();
   const removeAppMutation = useRemoveAppMutation();
   const shareAppMutation = useShareAppMutation();
@@ -85,8 +87,13 @@ export default function Apps() {
     toast.success('Shared to catalog');
   };
 
-  const handleAddFromUrl = async (url: string) => {
-    const apps = await addAppMutation.mutateAsync(url);
+  const handleDiscover = (url: string) => discoverAppsMutation.mutateAsync(url);
+
+  const handleAddFromUrl = async (url: string, manifestPaths?: string[]) => {
+    const apps = await addAppMutation.mutateAsync({
+      url,
+      manifest_paths: manifestPaths
+    });
     const count = apps.length;
     toast.success(`${count} app${count !== 1 ? 's' : ''} added`);
     setShowAddDialog(false);
@@ -165,8 +172,10 @@ export default function Apps() {
 
       <AddAppDialog
         adding={addAppMutation.isPending}
+        discovering={discoverAppsMutation.isPending}
         onAdd={handleAddFromUrl}
         onClose={() => setShowAddDialog(false)}
+        onDiscover={handleDiscover}
         open={showAddDialog}
       />
       <DeleteAppDialog
diff --git a/frontend/src/components/ui/AppsPage/AddAppDialog.tsx b/frontend/src/components/ui/AppsPage/AddAppDialog.tsx
index 35df07bf..7b7f59d2 100644
--- a/frontend/src/components/ui/AppsPage/AddAppDialog.tsx
+++ b/frontend/src/components/ui/AppsPage/AddAppDialog.tsx
@@ -5,24 +5,49 @@ import FgDialog from '@/components/ui/Dialogs/FgDialog';
 import FgButton from '@/components/designSystem/atoms/FgButton';
 import FgFormField from '@/components/designSystem/molecules/FgFormField';
 import FgInput from '@/components/designSystem/atoms/formElements/FgInput';
+import FgCheckbox from '@/components/designSystem/atoms/formElements/FgCheckbox';
 import { buildAppUrl, isGithubRepoUrl } from '@/utils';
+import type { DiscoveredApp } from '@/shared.types';
 
 interface AddAppDialogProps {
   readonly open: boolean;
   readonly onClose: () => void;
-  readonly onAdd: (url: string) => Promise<void>;
+  readonly onDiscover: (url: string) => Promise<DiscoveredApp[]>;
+  readonly onAdd: (url: string, manifestPaths?: string[]) => Promise<void>;
+  readonly discovering: boolean;
   readonly adding: boolean;
 }
 
 export default function AddAppDialog({
   open,
   onClose,
+  onDiscover,
   onAdd,
+  discovering,
   adding
 }: AddAppDialogProps) {
   const [repoUrl, setRepoUrl] = useState('');
   const [branch, setBranch] = useState('');
   const [urlError, setUrlError] = useState('');
+  // Once a multi-app repo is discovered we move to a selection step.
+  const [phase, setPhase] = useState<'input' | 'select'>('input');
+  const [appUrl, setAppUrl] = useState('');
+  const [discovered, setDiscovered] = useState<DiscoveredApp[]>([]);
+  const [selected, setSelected] = useState<Set<string>>(new Set());
+
+  // Apps that can still be added (not already in the user's list).
+  const addable = discovered.filter(app => !app.already_added);
+  const allSelected = addable.length > 0 && selected.size === addable.length;
+
+  const resetState = () => {
+    setRepoUrl('');
+    setBranch('');
+    setUrlError('');
+    setPhase('input');
+    setAppUrl('');
+    setDiscovered([]);
+    setSelected(new Set());
+  };
 
   const validateUrl = (url: string): boolean => {
     if (!url.trim()) {
@@ -37,25 +62,66 @@ export default function AddAppDialog({
     return true;
   };
 
-  const handleAdd = async () => {
+  // Step 1: discover the apps in the repo. A single-app repo is added straight
+  // away; a multi-app repo advances to the checkbox selection step.
+  const handleContinue = async () => {
     if (!validateUrl(repoUrl)) {
       return;
     }
-    const appUrl = buildAppUrl(repoUrl, branch);
+    const url = buildAppUrl(repoUrl, branch);
     try {
-      await onAdd(appUrl);
-      setRepoUrl('');
-      setBranch('');
+      const apps = await onDiscover(url);
+      if (apps.length <= 1) {
+        await onAdd(url);
+        resetState();
+        return;
+      }
+      setAppUrl(url);
+      setDiscovered(apps);
+      setSelected(
+        new Set(apps.filter(a => !a.already_added).map(a => a.manifest_path))
+      );
       setUrlError('');
+      setPhase('select');
     } catch (error) {
-      setUrlError(error instanceof Error ? error.message : 'Failed to add app');
+      setUrlError(
+        error instanceof Error ? error.message : 'Failed to read repository'
+      );
     }
   };
 
+  // Step 2: add only the checked apps.
+  const handleAddSelected = async () => {
+    try {
+      await onAdd(appUrl, Array.from(selected));
+      resetState();
+    } catch (error) {
+      setUrlError(
+        error instanceof Error ? error.message : 'Failed to add apps'
+      );
+    }
+  };
+
+  const toggleOne = (manifestPath: string) => {
+    setSelected(prev => {
+      const next = new Set(prev);
+      if (next.has(manifestPath)) {
+        next.delete(manifestPath);
+      } else {
+        next.add(manifestPath);
+      }
+      return next;
+    });
+  };
+
+  const toggleAll = () => {
+    setSelected(
+      allSelected ? new Set() : new Set(addable.map(a => a.manifest_path))
+    );
+  };
+
   const handleClose = () => {
-    setRepoUrl('');
-    setBranch('');
-    setUrlError('');
+    resetState();
     onClose();
   };
 
@@ -63,73 +129,176 @@ export default function AddAppDialog({
 
   return (
     <FgDialog className="max-w-lg" onClose={handleClose} open={open}>
-      <Typography className="mb-4 text-foreground font-bold" type="h6">
-        Add App
-      </Typography>
-
-      <Typography className="mb-2 text-foreground text-sm">
-        Enter a GitHub repository URL (HTTPS or SSH) containing a{' '}
-        <code>runnables.yaml</code> manifest. Private repositories are accessed
-        over SSH using your configured SSH key.
-      </Typography>
-
-      <FgFormField
-        error={urlError || undefined}
-        htmlFor="repo-url"
-        label="GitHub Repository URL"
-      >
-        <FgInput
-          autoFocus
-          onChange={e => {
-            const value = e.target.value;
-            setRepoUrl(value);
-            validateUrl(value);
-          }}
-          onKeyDown={e => {
-            if (e.key === 'Enter') {
-              handleAdd();
-            }
-          }}
-          placeholder="https://github.com/org/repo or git@github.com:org/repo.git"
-          type="text"
-          value={repoUrl}
-        />
-      </FgFormField>
-
-      <FgFormField
-        helperText="Tag or branch name"
-        htmlFor="branch"
-        label="Revision"
-        optional
-      >
-        <FgInput
-          onChange={e => {
-            setBranch(e.target.value);
-          }}
-          onKeyDown={e => {
-            if (e.key === 'Enter') {
-              handleAdd();
-            }
-          }}
-          placeholder="main"
-          type="text"
-          value={branch}
-        />
-      </FgFormField>
-
-      <div className="flex gap-3">
-        <FgButton
-          disabled={!urlIsValid || adding}
-          loading={adding}
-          loadingText="Adding..."
-          onClick={handleAdd}
-        >
-          Add App
-        </FgButton>
-        <FgButton onClick={handleClose} variant="ghost">
-          Cancel
-        </FgButton>
-      </div>
+      {phase === 'input' ? (
+        <>
+          <Typography className="mb-4 text-foreground font-bold" type="h6">
+            Add App
+          </Typography>
+
+          <Typography className="mb-2 text-foreground text-sm">
+            Enter a GitHub repository URL (HTTPS or SSH) containing one or more{' '}
+            <code>runnables.yaml</code> manifests. Private repositories are
+            accessed over SSH using your configured SSH key.
+          </Typography>
+
+          <FgFormField
+            error={urlError || undefined}
+            htmlFor="repo-url"
+            label="GitHub Repository URL"
+          >
+            <FgInput
+              autoFocus
+              onChange={e => {
+                const value = e.target.value;
+                setRepoUrl(value);
+                validateUrl(value);
+              }}
+              onKeyDown={e => {
+                if (e.key === 'Enter') {
+                  handleContinue();
+                }
+              }}
+              placeholder="https://github.com/org/repo or git@github.com:org/repo.git"
+              type="text"
+              value={repoUrl}
+            />
+          </FgFormField>
+
+          <FgFormField
+            helperText="Tag or branch name"
+            htmlFor="branch"
+            label="Revision"
+            optional
+          >
+            <FgInput
+              onChange={e => {
+                setBranch(e.target.value);
+              }}
+              onKeyDown={e => {
+                if (e.key === 'Enter') {
+                  handleContinue();
+                }
+              }}
+              placeholder="main"
+              type="text"
+              value={branch}
+            />
+          </FgFormField>
+
+          <div className="flex gap-3">
+            <FgButton
+              disabled={!urlIsValid || discovering || adding}
+              loading={discovering || adding}
+              loadingText="Reading repository..."
+              onClick={handleContinue}
+            >
+              Continue
+            </FgButton>
+            <FgButton onClick={handleClose} variant="ghost">
+              Cancel
+            </FgButton>
+          </div>
+        </>
+      ) : (
+        <>
+          <Typography className="mb-1 text-foreground font-bold" type="h6">
+            Select apps to add
+          </Typography>
+          <Typography className="mb-3 text-secondary text-sm">
+            This repository contains {discovered.length} apps. Choose which ones
+            to add.
+          </Typography>
+
+          <div className="mb-2 flex items-center justify-between">
+            <Typography className="text-foreground text-sm font-medium">
+              {selected.size} selected
+            </Typography>
+            <button
+              className="text-primary text-sm hover:underline disabled:opacity-50 disabled:no-underline"
+              disabled={addable.length === 0}
+              onClick={toggleAll}
+              type="button"
+            >
+              {allSelected ? 'Deselect all' : 'Select all'}
+            </button>
+          </div>
+
+          <div className="mb-4 max-h-80 overflow-y-auto rounded border border-surface divide-y divide-surface">
+            {discovered.map(app => {
+              const cbId = `discover-${app.manifest_path || 'root'}`;
+              return (
+                <div
+                  className="flex items-start gap-3 p-3"
+                  key={app.manifest_path}
+                >
+                  <FgCheckbox
+                    checked={
+                      app.already_added || selected.has(app.manifest_path)
+                    }
+                    className="mt-0.5"
+                    disabled={app.already_added}
+                    hideLabel
+                    id={cbId}
+                    label={app.name}
+                    onChange={() => toggleOne(app.manifest_path)}
+                  />
+                  <div className="min-w-0 flex-1">
+                    <label
+                      className={`text-foreground text-sm font-medium ${app.already_added ? 'cursor-default' : 'cursor-pointer'}`}
+                      htmlFor={cbId}
+                    >
+                      {app.name}
+                    </label>
+                    {app.already_added ? (
+                      <span className="ml-2 text-secondary text-xs">
+                        (already added)
+                      </span>
+                    ) : null}
+                    {app.description ? (
+                      <p className="text-secondary text-xs mt-0.5 break-words">
+                        {app.description}
+                      </p>
+                    ) : null}
+                    <p className="text-secondary text-xs mt-0.5 font-mono break-all">
+                      {app.manifest_path || 'repository root'}
+                    </p>
+                  </div>
+                </div>
+              );
+            })}
+          </div>
+
+          {urlError ? (
+            <Typography className="mb-3 text-error text-sm">
+              {urlError}
+            </Typography>
+          ) : null}
+
+          <div className="flex gap-3">
+            <FgButton
+              disabled={selected.size === 0 || adding}
+              loading={adding}
+              loadingText="Adding..."
+              onClick={handleAddSelected}
+            >
+              {`Add Selected (${selected.size})`}
+            </FgButton>
+            <FgButton
+              disabled={adding}
+              onClick={() => {
+                setPhase('input');
+                setUrlError('');
+              }}
+              variant="ghost"
+            >
+              Back
+            </FgButton>
+            <FgButton disabled={adding} onClick={handleClose} variant="ghost">
+              Cancel
+            </FgButton>
+          </div>
+        </>
+      )}
     </FgDialog>
   );
 }
diff --git a/frontend/src/queries/appsQueries.ts b/frontend/src/queries/appsQueries.ts
index 96d10343..eb04b118 100644
--- a/frontend/src/queries/appsQueries.ts
+++ b/frontend/src/queries/appsQueries.ts
@@ -6,7 +6,12 @@ import {
   getResponseJsonOrError,
   throwResponseNotOkError
 } from '@/queries/queryUtils';
-import type { AppListing, AppManifest, UserApp } from '@/shared.types';
+import type {
+  AppListing,
+  AppManifest,
+  DiscoveredApp,
+  UserApp
+} from '@/shared.types';
 
 // --- Query Keys ---
 
@@ -71,15 +76,44 @@ export function useManifestPreviewMutation(): UseMutationResult<
   });
 }
 
+export function useDiscoverAppsMutation(): UseMutationResult<
+  DiscoveredApp[],
+  Error,
+  string
+> {
+  return useMutation({
+    mutationFn: async (url: string) => {
+      const response = await sendFetchRequest('/api/apps/discover', 'POST', {
+        url
+      });
+      const data = await getResponseJsonOrError(response);
+      if (!response.ok) {
+        throwResponseNotOkError(response, data);
+      }
+      return data as DiscoveredApp[];
+    }
+  });
+}
+
 export function useAddAppMutation(): UseMutationResult<
   UserApp[],
   Error,
-  string
+  { url: string; manifest_paths?: string[] }
 > {
   const queryClient = useQueryClient();
   return useMutation({
-    mutationFn: async (url: string) => {
-      const response = await sendFetchRequest('/api/apps', 'POST', { url });
+    mutationFn: async ({
+      url,
+      manifest_paths
+    }: {
+      url: string;
+      manifest_paths?: string[];
+    }) => {
+      const response = await sendFetchRequest('/api/apps', 'POST', {
+        url,
+        // Only include manifest_paths when provided; omitting it adds all apps.
+        ...(manifest_paths ? { manifest_paths } : {})
+      });
       const data = await getResponseJsonOrError(response);
       if (!response.ok) {
         throwResponseNotOkError(response, data);
diff --git a/frontend/src/shared.types.ts b/frontend/src/shared.types.ts
index baff9068..5fa36d1f 100644
--- a/frontend/src/shared.types.ts
+++ b/frontend/src/shared.types.ts
@@ -150,6 +150,13 @@ type UserApp = {
   listing_id?: number;
 };
 
+type DiscoveredApp = {
+  manifest_path: string;
+  name: string;
+  description?: string;
+  already_added: boolean;
+};
+
 type AppListing = {
   id: number;
   owner_username: string;
@@ -258,6 +265,7 @@ export type {
   AppParameterItem,
   AppParameterSection,
   AppResourceDefaults,
+  DiscoveredApp,
   FetchRequestOptions,
   FileOrFolder,
   FileSharePath,
diff --git a/tests/test_apps_endpoints.py b/tests/test_apps_endpoints.py
index 9c62b1a9..567fbe1c 100644
--- a/tests/test_apps_endpoints.py
+++ b/tests/test_apps_endpoints.py
@@ -335,6 +335,112 @@ def test_add_app_pinned_revision_kept(test_client, db_session):
     assert rows[0].branch == "dev"
 
 
+def test_discover_lists_all_apps(test_client):
+    """POST /api/apps/discover returns every manifest in the repo without adding."""
+    m1 = _make_manifest(name="VS Code", description="IDE")
+    m2 = _make_manifest(name="JupyterLab", description="Notebook")
+    with patch("fileglancer.apps.discover_app_manifests",
+               new=AsyncMock(return_value=("main", [("vscode", m1), ("jupyterlab", m2)]))):
+        response = test_client.post(
+            "/api/apps/discover",
+            json={"url": "https://github.com/owner/monorepo"},
+        )
+
+    assert response.status_code == 200
+    body = response.json()
+    assert [a["manifest_path"] for a in body] == ["vscode", "jupyterlab"]
+    assert [a["name"] for a in body] == ["VS Code", "JupyterLab"]
+    assert all(a["already_added"] is False for a in body)
+    # Discovery must not create any rows.
+    assert test_client.get("/api/apps").json() == []
+
+
+def test_discover_marks_already_added(test_client, db_session):
+    """Apps the user already has are flagged already_added=True."""
+    m1 = _make_manifest(name="VS Code")
+    m2 = _make_manifest(name="JupyterLab")
+    _seed_app(db_session, url="https://github.com/owner/monorepo",
+              manifest_path="vscode", branch="",
+              manifest=m1.model_dump(mode="json"))
+    with patch("fileglancer.apps.discover_app_manifests",
+               new=AsyncMock(return_value=("main", [("vscode", m1), ("jupyterlab", m2)]))):
+        response = test_client.post(
+            "/api/apps/discover",
+            json={"url": "https://github.com/owner/monorepo"},
+        )
+
+    assert response.status_code == 200
+    by_path = {a["manifest_path"]: a for a in response.json()}
+    assert by_path["vscode"]["already_added"] is True
+    assert by_path["jupyterlab"]["already_added"] is False
+
+
+def test_discover_no_manifests_404(test_client):
+    with patch("fileglancer.apps.discover_app_manifests",
+               new=AsyncMock(return_value=("main", []))):
+        response = test_client.post(
+            "/api/apps/discover",
+            json={"url": "https://github.com/owner/empty"},
+        )
+    assert response.status_code == 404
+
+
+def test_add_subset_via_manifest_paths(test_client, db_session):
+    """manifest_paths adds only the selected apps, not the whole repo."""
+    m1 = _make_manifest(name="VS Code")
+    m2 = _make_manifest(name="JupyterLab")
+    m3 = _make_manifest(name="marimo")
+    discovered = [("vscode", m1), ("jupyterlab", m2), ("marimo", m3)]
+    with patch("fileglancer.apps.discover_app_manifests",
+               new=AsyncMock(return_value=("main", discovered))):
+        response = test_client.post(
+            "/api/apps",
+            json={
+                "url": "https://github.com/owner/monorepo",
+                "manifest_paths": ["vscode", "marimo"],
+            },
+        )
+
+    assert response.status_code == 200
+    body = response.json()
+    assert {a["manifest_path"] for a in body} == {"vscode", "marimo"}
+    rows = list_user_apps(db_session, TEST_USERNAME)
+    assert {r.manifest_path for r in rows} == {"vscode", "marimo"}
+
+
+def test_add_null_manifest_paths_adds_all(test_client, db_session):
+    """Omitting manifest_paths preserves the add-everything behavior."""
+    m1 = _make_manifest(name="VS Code")
+    m2 = _make_manifest(name="JupyterLab")
+    with patch("fileglancer.apps.discover_app_manifests",
+               new=AsyncMock(return_value=("main", [("vscode", m1), ("jupyterlab", m2)]))):
+        response = test_client.post(
+            "/api/apps",
+            json={"url": "https://github.com/owner/monorepo"},
+        )
+
+    assert response.status_code == 200
+    assert len(response.json()) == 2
+    assert len(list_user_apps(db_session, TEST_USERNAME)) == 2
+
+
+def test_add_manifest_paths_no_match_400(test_client, db_session):
+    """A manifest_paths list matching nothing in the repo is a client error."""
+    m1 = _make_manifest(name="VS Code")
+    with patch("fileglancer.apps.discover_app_manifests",
+               new=AsyncMock(return_value=("main", [("vscode", m1)]))):
+        response = test_client.post(
+            "/api/apps",
+            json={
+                "url": "https://github.com/owner/monorepo",
+                "manifest_paths": ["does-not-exist"],
+            },
+        )
+
+    assert response.status_code == 400
+    assert len(list_user_apps(db_session, TEST_USERNAME)) == 0
+
+
 def test_add_app_dedups_bare_against_resolved_default(test_client, db_session):
     """The dedup-hole fix: a bare URL for a master-default repo matches an already
     stored '/tree/master' row, so the add is a no-op (409)."""

From 6675403f7082c9ecfb22a5da702f2394080d65f4 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Wed, 1 Jul 2026 19:46:58 -0400
Subject: [PATCH 03/89] fix(apps): black text and drop manifest path in app
 picker

In the multi-app selection list, use foreground (black) text instead of the
purple secondary color for the description, the "already added" tag, and the
intro line, and remove the manifest-path line from each row.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 frontend/src/components/ui/AppsPage/AddAppDialog.tsx | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/frontend/src/components/ui/AppsPage/AddAppDialog.tsx b/frontend/src/components/ui/AppsPage/AddAppDialog.tsx
index 7b7f59d2..bb88c1a7 100644
--- a/frontend/src/components/ui/AppsPage/AddAppDialog.tsx
+++ b/frontend/src/components/ui/AppsPage/AddAppDialog.tsx
@@ -204,7 +204,7 @@ export default function AddAppDialog({
           <Typography className="mb-1 text-foreground font-bold" type="h6">
             Select apps to add
           </Typography>
-          <Typography className="mb-3 text-secondary text-sm">
+          <Typography className="mb-3 text-foreground text-sm">
             This repository contains {discovered.length} apps. Choose which ones
             to add.
           </Typography>
@@ -250,18 +250,15 @@ export default function AddAppDialog({
                       {app.name}
                     </label>
                     {app.already_added ? (
-                      <span className="ml-2 text-secondary text-xs">
+                      <span className="ml-2 text-foreground text-xs">
                         (already added)
                       </span>
                     ) : null}
                     {app.description ? (
-                      <p className="text-secondary text-xs mt-0.5 break-words">
+                      <p className="text-foreground text-xs mt-0.5 break-words">
                         {app.description}
                       </p>
                     ) : null}
-                    <p className="text-secondary text-xs mt-0.5 font-mono break-all">
-                      {app.manifest_path || 'repository root'}
-                    </p>
                   </div>
                 </div>
               );

From b581b75ff4669f81dec5fe3d3c238665b85ea39f Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Wed, 1 Jul 2026 20:15:23 -0400
Subject: [PATCH 04/89] fix(jobs): truncate Command to one line in Execution
 box

The Command row in the job page's Execution card wrapped across many lines.
Add an opt-in `truncate` mode to InfoRow (single line, ellipsis, full text on
hover) and use it for Command.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 frontend/src/components/JobDetail.tsx | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/frontend/src/components/JobDetail.tsx b/frontend/src/components/JobDetail.tsx
index 11a971ab..5b2c79e2 100644
--- a/frontend/src/components/JobDetail.tsx
+++ b/frontend/src/components/JobDetail.tsx
@@ -223,10 +223,14 @@ function InfoCard({
 /** A label/value row; renders nothing when the value is empty. */
 function InfoRow({
   label,
-  value
+  value,
+  truncate = false
 }: {
   readonly label: string;
   readonly value: ReactNode;
+  // When true, render the value as a single line clipped with an ellipsis
+  // (full text shown on hover) instead of wrapping across multiple lines.
+  readonly truncate?: boolean;
 }) {
   if (value === null || value === undefined || value === '') {
     return null;
@@ -236,7 +240,10 @@ function InfoRow({
       <Typography className="text-foreground text-sm font-semibold shrink-0">
         {label}:
       </Typography>
-      <Typography className="text-foreground whitespace-pre-wrap break-all">
+      <Typography
+        className={`text-foreground ${truncate ? 'truncate min-w-0 flex-1' : 'whitespace-pre-wrap break-all'}`}
+        title={truncate && typeof value === 'string' ? value : undefined}
+      >
         {value}
       </Typography>
     </div>
@@ -358,7 +365,7 @@ function JobOverview({
               ))}
             </div>
           ) : null}
-          <InfoRow label="Command" value={job.command} />
+          <InfoRow label="Command" truncate value={job.command} />
           <InfoRow label="Container" value={job.container} />
           <InfoRow label="Container args" value={job.container_args} />
           <InfoRow label="Conda env" value={job.conda_env} />

From bbd37aa71db1d50121228c1f7c02990f2d14a11b Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Wed, 1 Jul 2026 20:24:17 -0400
Subject: [PATCH 05/89] fix(jobs): show Recent output whenever stdout has
 content
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Overview "Recent output" panel was gated on job.started_at, so it stayed
hidden while a job was still PENDING (started_at null) even though stdout.log
already had content — while "Recent errors" showed because it gates on stderr
content. Gate stdout on content too (hasStdout), mirroring stderr, so output
appears as soon as there is any. Drops the now-unused stdoutPending prop.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 frontend/src/components/JobDetail.tsx | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/frontend/src/components/JobDetail.tsx b/frontend/src/components/JobDetail.tsx
index 5b2c79e2..25d2c5e6 100644
--- a/frontend/src/components/JobDetail.tsx
+++ b/frontend/src/components/JobDetail.tsx
@@ -275,7 +275,6 @@ function JobOverview({
   job,
   stdoutContent,
   stderrContent,
-  stdoutPending,
   isDarkMode,
   onViewStdout,
   onViewStderr
@@ -283,7 +282,6 @@ function JobOverview({
   readonly job: Job;
   readonly stdoutContent: string | null | undefined;
   readonly stderrContent: string | null | undefined;
-  readonly stdoutPending: boolean;
   readonly isDarkMode: boolean;
   readonly onViewStdout: () => void;
   readonly onViewStderr: () => void;
@@ -304,6 +302,7 @@ function JobOverview({
     stderrContent !== null && stderrContent !== undefined
       ? tailLines(stripLsfFooter(stderrContent), RECENT_OUTPUT_LINES)
       : null;
+  const hasStdout = Boolean(stdoutTail && stdoutTail.trim());
   const hasStderr = Boolean(stderrTail && stderrTail.trim());
 
   return (
@@ -373,7 +372,7 @@ function JobOverview({
         </InfoCard>
       </div>
 
-      {job.started_at ? (
+      {hasStdout ? (
         <div>
           <div className="flex items-center justify-between mb-1">
             <Typography className="text-foreground font-bold">
@@ -388,7 +387,7 @@ function JobOverview({
             </button>
           </div>
           <FilePreview
-            content={stdoutPending ? undefined : (stdoutTail ?? null)}
+            content={stdoutTail}
             isDarkMode={isDarkMode}
             language="text"
           />
@@ -739,7 +738,6 @@ export default function JobDetail() {
                 onViewStdout={() => setActiveTab('stdout')}
                 stderrContent={stderrQuery.data}
                 stdoutContent={stdoutQuery.data}
-                stdoutPending={stdoutQuery.isPending}
               />
             </Tabs.Panel>
 

From 98309765baaaccfaeb9cfadf02dfaaad929b8dc0 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Wed, 1 Jul 2026 20:36:41 -0400
Subject: [PATCH 06/89] fix(apps): don't orphan jobs submitted while the poll
 loop is stopping
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The poll loop slept a full poll_interval before clearing _poll_task and
returning when it found no active jobs. A job submitted during that window
saw _poll_task still set (not done), so submit_job's ensure_poll_loop() no-op'd
— then the loop exited, leaving no poller and the job stuck in PENDING forever
(never advancing to RUNNING, so services never surfaced their service_url).

Decide to stop *before* sleeping, clear _poll_task with no await in between,
and re-check for active jobs (catching a job submitted during the same cycle)
so the loop keeps running instead of exiting. Also wrap the locked section in
try/finally so the poll lock can't leak if the task is cancelled while held.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 fileglancer/apps/jobs.py | 56 +++++++++++++++++++++++++++++-----------
 tests/test_apps.py       | 38 +++++++++++++++++++++++++++
 2 files changed, 79 insertions(+), 15 deletions(-)

diff --git a/fileglancer/apps/jobs.py b/fileglancer/apps/jobs.py
index 5e1d3905..4698275d 100644
--- a/fileglancer/apps/jobs.py
+++ b/fileglancer/apps/jobs.py
@@ -185,24 +185,50 @@ async def _poll_loop(settings):
         lock_fd = None
         try:
             lock_fd = open(_POLL_LOCK_PATH, "w")
-            fcntl.flock(lock_fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
             try:
-                has_jobs = await _poll_jobs(settings)
-            except Exception:
-                logger.exception("Error in job poll loop")
-                has_jobs = True  # keep polling on error
-            # Hold lock through the sleep so no other worker polls
-            # until this interval is over
-            await asyncio.sleep(settings.cluster.poll_interval)
-            fcntl.flock(lock_fd, fcntl.LOCK_UN)
-            lock_fd.close()
+                fcntl.flock(lock_fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+            except OSError:
+                # Another worker holds the lock this cycle — skip and retry.
+                lock_fd.close()
+                lock_fd = None
+                await asyncio.sleep(settings.cluster.poll_interval)
+                continue
 
-            if not has_jobs:
-                logger.info("No active jobs — poll loop stopping")
-                _poll_task = None
-                return
+            # try/finally so the lock is always released, even if the task is
+            # cancelled (e.g. on shutdown) while we hold it.
+            try:
+                try:
+                    has_jobs = await _poll_jobs(settings)
+                except Exception:
+                    logger.exception("Error in job poll loop")
+                    has_jobs = True  # keep polling on error
+
+                if not has_jobs:
+                    # No active jobs — stop the loop. Clear _poll_task and
+                    # return *without* sleeping first: sleeping here (as the
+                    # old code did) left a poll_interval-long window in which
+                    # _poll_task was still set but the loop was on its way out,
+                    # so a job submitted during that window saw a live task,
+                    # ensure_poll_loop() no-op'd, and the job was then orphaned
+                    # in PENDING when the loop exited. Re-check for active jobs
+                    # first (no await in between) to catch a job that was
+                    # submitted during this very cycle.
+                    if _get_any_active_username(settings) is None:
+                        logger.info("No active jobs — poll loop stopping")
+                        _poll_task = None
+                        return
+                    # A job appeared mid-cycle; keep polling.
+                    continue
+
+                # Hold the lock through the sleep so a co-worker doesn't
+                # double-poll within the same interval.
+                await asyncio.sleep(settings.cluster.poll_interval)
+            finally:
+                fcntl.flock(lock_fd, fcntl.LOCK_UN)
+                lock_fd.close()
+                lock_fd = None
         except OSError:
-            # Another worker is polling this cycle — skip and retry
+            # Opening the lock file failed — retry next cycle.
             if lock_fd:
                 lock_fd.close()
             await asyncio.sleep(settings.cluster.poll_interval)
diff --git a/tests/test_apps.py b/tests/test_apps.py
index 7452dcda..1f6581b1 100644
--- a/tests/test_apps.py
+++ b/tests/test_apps.py
@@ -1905,3 +1905,41 @@ def test_falls_back_to_directory_name(self, tmp_path, monkeypatch):
         monkeypatch.setattr(pixi_mod, "_get_git_repo_name", lambda d: None)
         manifest = PixiAdapter().convert(tmp_path)
         assert manifest.name == tmp_path.name
+
+
+class TestPollLoopStopRace:
+    """The poll loop must not orphan a job submitted while it is stopping.
+
+    Regression: the loop used to sleep a full poll_interval before clearing
+    _poll_task, so a job submitted during that window saw a live task,
+    ensure_poll_loop() no-op'd, and the job was left in PENDING forever once the
+    loop exited. The loop now decides to stop *before* sleeping and re-checks
+    for active jobs (no await in between) so a mid-cycle submission keeps it
+    alive.
+    """
+
+    def test_keeps_polling_when_job_appears_during_stop(self, tmp_path, monkeypatch):
+        import asyncio
+        from types import SimpleNamespace
+        from unittest.mock import AsyncMock, patch
+        import fileglancer.apps.jobs as jobs_mod
+
+        monkeypatch.setattr(jobs_mod, "_POLL_LOCK_PATH", str(tmp_path / "poll.lock"))
+        monkeypatch.setattr(jobs_mod, "_poll_task", None, raising=False)
+        settings = SimpleNamespace(cluster=SimpleNamespace(poll_interval=0.01))
+
+        # _poll_jobs reports "no active jobs" every cycle. The stop re-check
+        # returns a user first (a job appeared mid-cycle -> keep going), then
+        # None (really nothing -> stop).
+        with patch.object(jobs_mod, "_poll_jobs", new=AsyncMock(return_value=False)) as poll_jobs, \
+             patch.object(jobs_mod, "_get_any_active_username",
+                          side_effect=["someuser", None]) as active_user:
+            async def run():
+                await asyncio.wait_for(jobs_mod._poll_loop(settings), timeout=5)
+            asyncio.run(run())
+
+        # Polled twice: it did NOT exit on the first no-jobs cycle because the
+        # re-check still saw an active job.
+        assert poll_jobs.await_count == 2
+        assert active_user.call_count == 2
+        assert jobs_mod._poll_task is None

From c3eefacb38c523dab61ce57fc1515d6601fe566f Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Wed, 1 Jul 2026 20:39:13 -0400
Subject: [PATCH 07/89] docs: reword comments to describe behavior, not history

Rewrite comments in the poll-loop stop path, the discover/add endpoint, and the
poll-loop regression test so they explain what the code does and why, without
referring to prior implementations.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 fileglancer/apps/jobs.py | 17 ++++++++---------
 fileglancer/server.py    |  4 ++--
 tests/test_apps.py       | 10 ++++------
 3 files changed, 14 insertions(+), 17 deletions(-)

diff --git a/fileglancer/apps/jobs.py b/fileglancer/apps/jobs.py
index 4698275d..df87f8d6 100644
--- a/fileglancer/apps/jobs.py
+++ b/fileglancer/apps/jobs.py
@@ -204,15 +204,14 @@ async def _poll_loop(settings):
                     has_jobs = True  # keep polling on error
 
                 if not has_jobs:
-                    # No active jobs — stop the loop. Clear _poll_task and
-                    # return *without* sleeping first: sleeping here (as the
-                    # old code did) left a poll_interval-long window in which
-                    # _poll_task was still set but the loop was on its way out,
-                    # so a job submitted during that window saw a live task,
-                    # ensure_poll_loop() no-op'd, and the job was then orphaned
-                    # in PENDING when the loop exited. Re-check for active jobs
-                    # first (no await in between) to catch a job that was
-                    # submitted during this very cycle.
+                    # No active jobs: stop the loop. Clear _poll_task and return
+                    # with no await in between, so a concurrent submit_job()
+                    # either sees this task still alive or starts a fresh loop —
+                    # there is no gap where _poll_task is set while the loop is
+                    # exiting. Re-check for active jobs immediately before
+                    # returning (again, no await in between) so a job submitted
+                    # during this cycle keeps the loop running rather than being
+                    # left unpolled.
                     if _get_any_active_username(settings) is None:
                         logger.info("No active jobs — poll loop stopping")
                         _poll_task = None
diff --git a/fileglancer/server.py b/fileglancer/server.py
index e3096e44..e1534d60 100644
--- a/fileglancer/server.py
+++ b/fileglancer/server.py
@@ -1795,8 +1795,8 @@ async def add_user_app(body: AppAddRequest,
             body.url, username)
 
         # Restrict to the requested subset when manifest_paths is provided; an
-        # omitted/null list means "add everything" (backward compatible). Paths
-        # not present in the repo are ignored.
+        # omitted/null list means "add every discovered manifest". Paths not
+        # present in the repo are ignored.
         if body.manifest_paths is not None:
             wanted = set(body.manifest_paths)
             discovered = [(p, m) for p, m in discovered if p in wanted]
diff --git a/tests/test_apps.py b/tests/test_apps.py
index 1f6581b1..1cfc2cb3 100644
--- a/tests/test_apps.py
+++ b/tests/test_apps.py
@@ -1910,12 +1910,10 @@ def test_falls_back_to_directory_name(self, tmp_path, monkeypatch):
 class TestPollLoopStopRace:
     """The poll loop must not orphan a job submitted while it is stopping.
 
-    Regression: the loop used to sleep a full poll_interval before clearing
-    _poll_task, so a job submitted during that window saw a live task,
-    ensure_poll_loop() no-op'd, and the job was left in PENDING forever once the
-    loop exited. The loop now decides to stop *before* sleeping and re-checks
-    for active jobs (no await in between) so a mid-cycle submission keeps it
-    alive.
+    When _poll_jobs reports no active jobs, the loop re-checks for active jobs
+    before exiting, with no await in between, and keeps polling if one appeared
+    during the cycle. So a job submitted just as the loop is about to stop is
+    still picked up rather than left unpolled in PENDING.
     """
 
     def test_keeps_polling_when_job_appears_during_stop(self, tmp_path, monkeypatch):

From 879e3be0203aade18aa8d4888f03b07131c1a302 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Wed, 1 Jul 2026 21:23:36 -0400
Subject: [PATCH 08/89] feat(apps): readiness-gated auto_url + FG_SERVICE_TOKEN
 + service_url_suffix

Make publishing a service URL a first-class part of auto_url instead of
per-app pre_run boilerplate:

- auto_url now waits until $FG_SERVICE_PORT accepts a connection before writing
  SERVICE_URL_PATH (background probe, bounded, logs to stderr on give-up), so
  the link never appears while the container image is still pulling or the
  server is still binding.
- Mint FG_SERVICE_TOKEN (URL-safe) alongside FG_SERVICE_PORT/FG_HOSTNAME, so a
  service can use it for auth and splice it into the URL.
- New service_url_suffix: a restricted template (literal URL text plus the
  ${FG_SERVICE_TOKEN}/${FG_SERVICE_PORT}/${FG_HOSTNAME} placeholders) appended
  to the published URL for one-click token auth. Validated for shell-safety and
  requires auto_url. Scheme stays http for now.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 fileglancer/apps/__init__.py |   1 +
 fileglancer/apps/jobs.py     |  43 +++++++++++--
 fileglancer/model.py         |  47 +++++++++++++--
 frontend/src/shared.types.ts |   1 +
 tests/test_apps.py           | 114 +++++++++++++++++++++++++++++++----
 5 files changed, 182 insertions(+), 24 deletions(-)

diff --git a/fileglancer/apps/__init__.py b/fileglancer/apps/__init__.py
index e8e8e48c..f29c32d4 100644
--- a/fileglancer/apps/__init__.py
+++ b/fileglancer/apps/__init__.py
@@ -24,6 +24,7 @@
 )
 from fileglancer.apps.jobs import (  # noqa: F401
     _build_container_script,
+    _build_service_url_publisher,
     _container_bind_paths,
     _container_sif_name,
     _SERVICE_PORT_HELPER,
diff --git a/fileglancer/apps/jobs.py b/fileglancer/apps/jobs.py
index df87f8d6..536593bd 100644
--- a/fileglancer/apps/jobs.py
+++ b/fileglancer/apps/jobs.py
@@ -420,7 +420,10 @@ def _container_sif_name(container_url: str) -> str:
 # exports it as FG_SERVICE_PORT along with FG_HOSTNAME, so a service command can
 # bind to a known address without reimplementing port discovery. Prefers python
 # (authoritative bind-to-0), then falls back to a bash probe of ephemeral ports.
-_SERVICE_PORT_HELPER = r"""# Fileglancer service setup: pick a free port and expose the hostname
+# It also mints FG_SERVICE_TOKEN, a URL-safe random secret the service can use
+# for auth (e.g. --token-password="$FG_SERVICE_TOKEN") and that auto_url can
+# splice into the published URL via the ${FG_SERVICE_TOKEN} placeholder.
+_SERVICE_PORT_HELPER = r"""# Fileglancer service setup: pick a free port, expose the hostname, mint a token
 __fg_free_port() {
   local p py i
   for py in python3 python; do
@@ -439,9 +442,36 @@ def _container_sif_name(container_url: str) -> str:
 }
 export FG_HOSTNAME="$(hostname)"
 export FG_SERVICE_PORT="$(__fg_free_port)"
+export FG_SERVICE_TOKEN="$(openssl rand -hex 24 2>/dev/null || python3 -c 'import secrets; print(secrets.token_hex(24))' 2>/dev/null || date +%s%N | sha256sum | cut -c1-48)"
 """
 
 
+def _build_service_url_publisher(suffix: str = "") -> str:
+    """Bash that publishes the service URL once $FG_SERVICE_PORT is live.
+
+    Runs in the background so it tolerates a slow start (the container image may
+    still be pulling); it writes SERVICE_URL_PATH only when the port accepts a
+    connection, and gives up after a bounded wait, logging to stderr. `suffix` is
+    appended to http://$FG_HOSTNAME:$FG_SERVICE_PORT and may reference the
+    ${FG_SERVICE_TOKEN}/${FG_SERVICE_PORT}/${FG_HOSTNAME} shell variables; it is
+    validated for shell-safety at manifest load (AppEntryPoint), so it is safe to
+    embed inside the double-quoted printf argument here.
+    """
+    return "\n".join([
+        "# Publish the service URL once the port is accepting connections.",
+        "(",
+        "  for _ in $(seq 1 3600); do",
+        '    if (exec 3<>"/dev/tcp/127.0.0.1/$FG_SERVICE_PORT") 2>/dev/null; then',
+        f'      printf \'http://%s:%s%s\' "$FG_HOSTNAME" "$FG_SERVICE_PORT" "{suffix}" > "$SERVICE_URL_PATH"',
+        "      exit 0",
+        "    fi",
+        "    sleep 1",
+        "  done",
+        '  echo "Fileglancer: port $FG_SERVICE_PORT never opened; service URL not published." >&2',
+        ") &",
+    ])
+
+
 def _build_container_script(
     container_url: str,
     command: str,
@@ -723,13 +753,14 @@ async def submit_job(
     if entry_point.type == "service":
         preamble_lines.append('export SERVICE_URL_PATH="$FG_WORK_DIR/service_url"')
         preamble_lines.append(_SERVICE_PORT_HELPER)
-        # When the author opts in with auto_url, write the service URL for them
-        # using the port we just allocated, so a service that binds to
-        # $FG_SERVICE_PORT needs no URL-writing code of its own. A service that
-        # manages its own URL simply leaves auto_url unset and overwrites this.
+        # With auto_url, Fileglancer publishes the URL for the author: a
+        # background probe waits for $FG_SERVICE_PORT to accept connections and
+        # then writes http://$FG_HOSTNAME:$FG_SERVICE_PORT plus the optional
+        # (validated) service_url_suffix. A service that manages its own URL
+        # leaves auto_url unset and writes SERVICE_URL_PATH itself.
         if entry_point.auto_url:
             preamble_lines.append(
-                'printf \'http://%s:%s\' "$FG_HOSTNAME" "$FG_SERVICE_PORT" > "$SERVICE_URL_PATH"'
+                _build_service_url_publisher(entry_point.service_url_suffix or "")
             )
     # Choose the working directory. 'work' runs from the job's work dir (the
     # repo is still reachable via the `repo` symlink); 'repo' runs from the
diff --git a/fileglancer/model.py b/fileglancer/model.py
index 5ec22df8..566874e1 100644
--- a/fileglancer/model.py
+++ b/fileglancer/model.py
@@ -438,14 +438,25 @@ class AppEntryPoint(BaseModel):
     )
     auto_url: bool = Field(
         description=(
-            "For service entry points only: have Fileglancer write "
-            "http://$FG_HOSTNAME:$FG_SERVICE_PORT to SERVICE_URL_PATH before the "
-            "command runs. Set this when your service binds to the "
-            "Fileglancer-provided $FG_SERVICE_PORT so you don't have to write the "
-            "URL file yourself."
+            "For service entry points only: have Fileglancer publish the service "
+            "URL for you. Once the service's port ($FG_SERVICE_PORT) is accepting "
+            "connections, Fileglancer writes http://$FG_HOSTNAME:$FG_SERVICE_PORT "
+            "(plus service_url_suffix, if set) to SERVICE_URL_PATH. Set this when "
+            "your service binds to the Fileglancer-provided $FG_SERVICE_PORT."
         ),
         default=False,
     )
+    service_url_suffix: Optional[str] = Field(
+        description=(
+            "For auto_url service entry points: text appended to "
+            "http://$FG_HOSTNAME:$FG_SERVICE_PORT when publishing the URL, e.g. a "
+            "path and/or query for one-click auth. May contain the placeholders "
+            "${FG_SERVICE_TOKEN}, ${FG_SERVICE_PORT}, ${FG_HOSTNAME} (braces "
+            "required) and literal URL text; nothing else. Example: "
+            "'/?access_token=${FG_SERVICE_TOKEN}'."
+        ),
+        default=None,
+    )
     requirements: List[str] = Field(
         description="Required tools for this entry point, e.g. ['apptainer']. Merged with manifest-level requirements.",
         default=[],
@@ -484,6 +495,23 @@ def validate_container(cls, v):
             raise ValueError(f"container URL contains forbidden characters: {v!r}")
         return v
 
+    @field_validator("service_url_suffix")
+    @classmethod
+    def validate_service_url_suffix(cls, v):
+        if v is None:
+            return v
+        # Strip the recognized ${FG_*} placeholders, then reject anything that
+        # would be unsafe or unexpanded inside the double-quoted shell string the
+        # suffix is emitted into (a stray $, quote, backtick, backslash, newline).
+        residual = _SERVICE_URL_PLACEHOLDER.sub("", v)
+        if _SERVICE_URL_UNSAFE.search(residual):
+            raise ValueError(
+                "service_url_suffix may contain only literal URL text and the "
+                "placeholders ${FG_SERVICE_TOKEN}, ${FG_SERVICE_PORT}, "
+                f"${{FG_HOSTNAME}} (braces required); got: {v!r}"
+            )
+        return v
+
     @field_validator("bind_paths")
     @classmethod
     def validate_bind_paths(cls, v):
@@ -562,6 +590,8 @@ def check_conda_container_exclusive(self):
             raise ValueError("bind_paths requires container to be set")
         if self.auto_url and self.type != "service":
             raise ValueError("auto_url is only valid for service entry points (type: service)")
+        if self.service_url_suffix is not None and not self.auto_url:
+            raise ValueError("service_url_suffix requires auto_url to be set")
         return self
 
 
@@ -575,6 +605,13 @@ def check_conda_container_exclusive(self):
 )
 
 _SHELL_METACHAR_PATTERN = re.compile(r'[;&|`$(){}!<>\n\r]')
+# Placeholders Fileglancer substitutes into service_url_suffix at runtime.
+_SERVICE_URL_PLACEHOLDER = re.compile(r'\$\{(?:FG_SERVICE_TOKEN|FG_SERVICE_PORT|FG_HOSTNAME)\}')
+# The suffix is emitted inside a double-quoted shell string, so only these are
+# dangerous once the recognized placeholders are removed: a stray $, a double
+# quote, a backtick, a backslash, or a newline. Everything else (?, &, =, /, %,
+# ...) is literal inside double quotes and valid in a URL.
+_SERVICE_URL_UNSAFE = re.compile(r'[$"`\\\n\r]')
 _CONDA_ENV_NAME_PATTERN = re.compile(r'^[a-zA-Z0-9_.-]+$')
 _CONDA_ENV_PATH_FORBIDDEN = re.compile(r'[;&|`$(){}!<>\n\r]')
 
diff --git a/frontend/src/shared.types.ts b/frontend/src/shared.types.ts
index 5fa36d1f..689c707d 100644
--- a/frontend/src/shared.types.ts
+++ b/frontend/src/shared.types.ts
@@ -127,6 +127,7 @@ type AppEntryPoint = {
   container_args?: string;
   working_dir?: 'work' | 'repo';
   auto_url?: boolean;
+  service_url_suffix?: string;
   requirements?: string[];
 };
 
diff --git a/tests/test_apps.py b/tests/test_apps.py
index 1cfc2cb3..e71308b6 100644
--- a/tests/test_apps.py
+++ b/tests/test_apps.py
@@ -24,6 +24,7 @@
     _build_container_script,
     _container_bind_paths,
     _SERVICE_PORT_HELPER,
+    _build_service_url_publisher,
     build_command,
     collect_path_parameters,
     expand_user_path,
@@ -736,9 +737,19 @@ def test_repo_bound_only_when_working_dir_repo(self):
 class TestServicePortHelper:
     """The preamble helper Fileglancer injects for service-type jobs."""
 
-    def test_helper_exports_port_and_hostname(self):
+    def test_helper_exports_port_hostname_and_token(self):
         assert "export FG_SERVICE_PORT=" in _SERVICE_PORT_HELPER
         assert "export FG_HOSTNAME=" in _SERVICE_PORT_HELPER
+        assert "export FG_SERVICE_TOKEN=" in _SERVICE_PORT_HELPER
+
+    def test_helper_mints_a_urlsafe_token(self):
+        import re
+        script = _SERVICE_PORT_HELPER + '\necho "$FG_SERVICE_TOKEN"'
+        result = subprocess.run(["bash", "-c", script], capture_output=True, text=True)
+        assert result.returncode == 0, result.stderr
+        token = result.stdout.strip().splitlines()[-1]
+        # Non-empty and URL-safe (hex), so no encoding is needed in the URL.
+        assert re.fullmatch(r"[0-9a-f]{16,}", token), token
 
     def test_helper_is_valid_bash(self):
         # The generated snippet must at least parse as bash.
@@ -770,7 +781,7 @@ def test_helper_robust_under_set_euo_pipefail(self):
 
 
 class TestServiceAutoUrl:
-    """auto_url is service-only and drives Fileglancer to write the URL file."""
+    """auto_url is service-only and drives Fileglancer to publish the URL file."""
 
     def test_auto_url_defaults_false(self):
         ep = AppEntryPoint(id="t", name="T", command="echo", type="service")
@@ -786,18 +797,95 @@ def test_auto_url_rejected_on_job(self):
             AppEntryPoint(id="t", name="T", command="echo",
                           type="job", auto_url=True)
 
-    def test_auto_url_write_command_uses_provided_port(self):
-        # Mirror the preamble line submit_job emits when auto_url is set, and
-        # confirm it writes a valid http URL built from the helper's values.
-        write_line = (
-            'printf \'http://%s:%s\' "$FG_HOSTNAME" "$FG_SERVICE_PORT"'
-        )
-        script = _SERVICE_PORT_HELPER + "\n" + write_line
-        result = subprocess.run(
-            ["bash", "-c", script], capture_output=True, text=True,
-        )
+
+class TestServiceUrlSuffix:
+    """service_url_suffix is a restricted template validated for shell-safety."""
+
+    def _ep(self, suffix, **kw):
+        kw.setdefault("type", "service")
+        kw.setdefault("auto_url", True)
+        return AppEntryPoint(id="t", name="T", command="echo",
+                             service_url_suffix=suffix, **kw)
+
+    def test_allows_literal_and_known_placeholders(self):
+        ep = self._ep("/?access_token=${FG_SERVICE_TOKEN}")
+        assert ep.service_url_suffix == "/?access_token=${FG_SERVICE_TOKEN}"
+
+    def test_allows_multiple_query_params_and_paths(self):
+        # ? & = / are literal inside the double-quoted emission; base paths ok.
+        ep = self._ep("/lab?token=${FG_SERVICE_TOKEN}&reset=1")
+        assert "reset=1" in ep.service_url_suffix
+
+    def test_rejects_unknown_placeholder(self):
+        with pytest.raises(ValidationError, match="service_url_suffix"):
+            self._ep("/?t=${SECRET}")
+
+    def test_rejects_bare_dollar(self):
+        with pytest.raises(ValidationError, match="service_url_suffix"):
+            self._ep("/?t=$FG_SERVICE_TOKEN")  # braces required
+
+    def test_rejects_shell_injection_chars(self):
+        for bad in ['/`whoami`', '/"x"', "/\\x"]:
+            with pytest.raises(ValidationError, match="service_url_suffix"):
+                self._ep(bad)
+
+    def test_requires_auto_url(self):
+        with pytest.raises(ValidationError, match="service_url_suffix requires auto_url"):
+            AppEntryPoint(id="t", name="T", command="echo", type="service",
+                          auto_url=False, service_url_suffix="/?t=x")
+
+
+class TestServiceUrlPublisher:
+    """The backgrounded readiness probe that publishes SERVICE_URL_PATH."""
+
+    def test_publisher_is_valid_bash(self):
+        snippet = _build_service_url_publisher("/?access_token=${FG_SERVICE_TOKEN}")
+        result = subprocess.run(["bash", "-n", "-c", snippet],
+                                capture_output=True, text=True)
         assert result.returncode == 0, result.stderr
-        assert result.stdout.startswith("http://")
+        assert "SERVICE_URL_PATH" in snippet and "3600" in snippet
+
+    def test_publishes_tokenized_url_only_once_port_is_up(self, tmp_path):
+        import socket
+        # Bind a real port so the probe's TCP connect succeeds.
+        srv = socket.socket()
+        srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+        srv.bind(("127.0.0.1", 0))
+        port = srv.getsockname()[1]
+        srv.listen()
+        try:
+            url_file = tmp_path / "service_url"
+            env = (
+                f'export FG_HOSTNAME=h1 FG_SERVICE_PORT={port} '
+                f'FG_SERVICE_TOKEN=deadbeef SERVICE_URL_PATH={url_file}\n'
+            )
+            # Run the publisher in the foreground (drop the trailing &) so the
+            # test can wait for it deterministically.
+            snippet = _build_service_url_publisher(
+                "/?access_token=${FG_SERVICE_TOKEN}").rstrip().removesuffix("&")
+            result = subprocess.run(["bash", "-c", env + snippet],
+                                    capture_output=True, text=True, timeout=30)
+            assert result.returncode == 0, result.stderr
+            assert url_file.read_text() == f"http://h1:{port}/?access_token=deadbeef"
+        finally:
+            srv.close()
+
+    def test_does_not_publish_when_port_never_opens(self, tmp_path):
+        import socket
+        # Grab a free port number, then close it so nothing is listening.
+        s = socket.socket(); s.bind(("127.0.0.1", 0)); port = s.getsockname()[1]; s.close()
+        url_file = tmp_path / "service_url"
+        env = (
+            f'export FG_HOSTNAME=h1 FG_SERVICE_PORT={port} '
+            f'FG_SERVICE_TOKEN=x SERVICE_URL_PATH={url_file}\n'
+        )
+        # Shrink the loop to 2 iterations so the timeout path is quick.
+        snippet = _build_service_url_publisher("").replace("$(seq 1 3600)", "$(seq 1 2)")
+        snippet = snippet.rstrip().removesuffix("&")
+        result = subprocess.run(["bash", "-c", env + snippet],
+                                capture_output=True, text=True, timeout=30)
+        assert not url_file.exists()
+        assert "never opened" in result.stderr
 
 
 # --- Path validation tests ---

From 335add476601c9d8e97ec5d3e14dec8273c17513 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Wed, 1 Jul 2026 22:01:21 -0400
Subject: [PATCH 09/89] =?UTF-8?q?feat(apps):=20surface=20"Downloading=20co?=
 =?UTF-8?q?ntainer=20image=E2=80=A6"=20during=20service=20startup?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A container service can sit for minutes pulling its image before the URL
appears, with nothing telling the user why. The generated job script now
reports its phase: it writes 'pulling_image' to $FG_PHASE_PATH (a 'phase' file
in the work dir) around the apptainer pull, then 'starting'. The worker reads
it alongside the service URL, the Job model carries a `phase` field, and the
job page shows "Downloading container image… first launch can take a few
minutes" instead of a bare "starting up".

Since Fileglancer generates the script, the phase is emitted deterministically
at the pull instruction (only when the SIF isn't cached) rather than scraped
from Apptainer's logs. The phase file rides the same work-dir read path as
service_url, so no new access-model or extra worker dispatch.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 fileglancer/apps/__init__.py          |  1 +
 fileglancer/apps/jobfiles.py          | 31 +++++++++++++++++++++
 fileglancer/apps/jobs.py              |  7 +++++
 fileglancer/model.py                  |  1 +
 fileglancer/server.py                 | 16 +++++++----
 fileglancer/user_worker.py            |  7 +++--
 frontend/src/components/JobDetail.tsx |  4 ++-
 frontend/src/shared.types.ts          |  1 +
 tests/test_apps.py                    | 39 ++++++++++++++++++++++++++-
 9 files changed, 96 insertions(+), 11 deletions(-)

diff --git a/fileglancer/apps/__init__.py b/fileglancer/apps/__init__.py
index f29c32d4..61a68f8b 100644
--- a/fileglancer/apps/__init__.py
+++ b/fileglancer/apps/__init__.py
@@ -37,4 +37,5 @@
     get_job_file_content,
     get_job_file_paths,
     get_service_url,
+    get_service_phase,
 )
diff --git a/fileglancer/apps/jobfiles.py b/fileglancer/apps/jobfiles.py
index 33ff0543..c783e6a5 100644
--- a/fileglancer/apps/jobfiles.py
+++ b/fileglancer/apps/jobfiles.py
@@ -115,6 +115,37 @@ def get_service_url(db_job: db.JobDB) -> Optional[str]:
     return url
 
 
+# Startup phases a service job writes to its 'phase' file so the UI can explain
+# a wait before the URL appears (chiefly a container image still downloading).
+_SERVICE_PHASES = ("pulling_image", "starting")
+
+
+def get_service_phase(db_job: db.JobDB) -> Optional[str]:
+    """Read the current startup phase from a service job's work directory.
+
+    The generated job script writes a short marker (see _SERVICE_PHASES) to a
+    'phase' file — e.g. 'pulling_image' while Apptainer downloads the container
+    image, then 'starting'. This lets the UI show why a service is taking a
+    while before its URL is published. Returns None unless the job is a RUNNING
+    service with a recognized phase written.
+    """
+    if getattr(db_job, 'entry_point_type', 'job') != 'service':
+        return None
+    if db_job.status != 'RUNNING':
+        return None
+
+    phase_file = _resolve_work_dir(db_job) / "phase"
+    if not phase_file.is_file():
+        return None
+
+    try:
+        phase = phase_file.read_text().strip()
+    except OSError:
+        return None
+
+    return phase if phase in _SERVICE_PHASES else None
+
+
 def get_job_file_paths(db_job: db.JobDB) -> dict[str, dict]:
     """Return file path info for a job's files (script, stdout, stderr, service_url).
 
diff --git a/fileglancer/apps/jobs.py b/fileglancer/apps/jobs.py
index 536593bd..f5a316dd 100644
--- a/fileglancer/apps/jobs.py
+++ b/fileglancer/apps/jobs.py
@@ -502,8 +502,12 @@ def _build_container_script(
         'mkdir -p "$APPTAINER_CACHE_DIR"',
         f'SIF_PATH="$APPTAINER_CACHE_DIR/{sif_name}"',
         'if [ ! -f "$SIF_PATH" ]; then',
+        # Report the (often multi-minute) image download so the UI can say so.
+        # FG_PHASE_PATH is set in the preamble; guard in case it is not.
+        '  [ -n "$FG_PHASE_PATH" ] && printf pulling_image > "$FG_PHASE_PATH" 2>/dev/null || true',
         f'  apptainer pull "$SIF_PATH" {shlex.quote(docker_url)}',
         'fi',
+        '[ -n "$FG_PHASE_PATH" ] && printf starting > "$FG_PHASE_PATH" 2>/dev/null || true',
         f'apptainer exec {bind_flags}{extra} "$SIF_PATH" \\',
         f'  {command}',
     ]
@@ -740,6 +744,9 @@ async def submit_job(
     preamble_lines = [
         "unset PIXI_PROJECT_MANIFEST",
         f"export FG_WORK_DIR={shlex.quote(str(work_dir))}",
+        # Where the script reports its startup phase (e.g. pulling a container
+        # image). The UI reads this to explain a wait before a service is ready.
+        'export FG_PHASE_PATH="$FG_WORK_DIR/phase"',
     ]
     # For local executor, trap EXIT to write the exit code to a file so
     # PID-based polling can determine the final status after the process exits.
diff --git a/fileglancer/model.py b/fileglancer/model.py
index 566874e1..4373d23a 100644
--- a/fileglancer/model.py
+++ b/fileglancer/model.py
@@ -812,6 +812,7 @@ class Job(BaseModel):
     work_dir: Optional[str] = Field(description="Working directory the job ran in", default=None)
     cluster_job_id: Optional[str] = Field(description="Cluster-assigned job ID", default=None)
     service_url: Optional[str] = Field(description="URL of the running service (for service-type jobs)", default=None)
+    phase: Optional[str] = Field(description="Startup phase of a running service before its URL is ready, e.g. 'pulling_image' or 'starting'", default=None)
     created_at: datetime = Field(description="When the job was created")
     started_at: Optional[datetime] = Field(description="When the job started running", default=None)
     finished_at: Optional[datetime] = Field(description="When the job finished", default=None)
diff --git a/fileglancer/server.py b/fileglancer/server.py
index e1534d60..84306bf2 100644
--- a/fileglancer/server.py
+++ b/fileglancer/server.py
@@ -2091,13 +2091,15 @@ async def get_jobs(status: Optional[str] = Query(None, description="Filter by st
             jobs = []
             for j in db_jobs:
                 service_url = None
+                phase = None
                 if getattr(j, 'entry_point_type', 'job') == 'service' and j.status == 'RUNNING':
                     try:
                         result = await _worker_exec(username, "get_service_url", job_id=j.id)
                         service_url = result.get("service_url")
+                        phase = result.get("phase")
                     except Exception:
                         pass
-                jobs.append(_convert_job(j, service_url=service_url))
+                jobs.append(_convert_job(j, service_url=service_url, phase=phase))
             return JobResponse(jobs=jobs)
 
     @app.get("/api/jobs/{job_id}", response_model=Job,
@@ -2113,13 +2115,15 @@ async def get_job(job_id: int,
             # rather than paying a worker roundtrip + NFS glob/stat.
             files = apps_module.get_job_file_paths(db_job)
             service_url = None
+            phase = None
             if getattr(db_job, 'entry_point_type', 'job') == 'service' and db_job.status == 'RUNNING':
                 try:
                     svc_result = await _worker_exec(username, "get_service_url", job_id=job_id)
                     service_url = svc_result.get("service_url")
+                    phase = svc_result.get("phase")
                 except Exception:
                     pass
-            return _convert_job(db_job, service_url=service_url, files=files)
+            return _convert_job(db_job, service_url=service_url, files=files, phase=phase)
 
     @app.post("/api/jobs/{job_id}/cancel",
               description="Cancel a running job")
@@ -2180,11 +2184,12 @@ def _ensure_utc(dt: Optional[datetime]) -> Optional[datetime]:
             return dt.replace(tzinfo=UTC)
         return dt
 
-    def _convert_job(db_job: db.JobDB, service_url: str = None, files: dict = None) -> Job:
+    def _convert_job(db_job: db.JobDB, service_url: str = None, files: dict = None,
+                     phase: str = None) -> Job:
         """Convert a database JobDB to a Pydantic Job model.
 
-        File-reading fields (service_url, files) must be passed in pre-computed
-        by the caller, since they require user-context file I/O.
+        File-reading fields (service_url, phase, files) must be passed in
+        pre-computed by the caller, since they require user-context file I/O.
         """
         return Job(
             id=db_job.id,
@@ -2210,6 +2215,7 @@ def _convert_job(db_job: db.JobDB, service_url: str = None, files: dict = None)
             work_dir=db_job.work_dir,
             cluster_job_id=db_job.cluster_job_id,
             service_url=service_url,
+            phase=phase,
             created_at=_ensure_utc(db_job.created_at),
             started_at=_ensure_utc(db_job.started_at),
             finished_at=_ensure_utc(db_job.finished_at),
diff --git a/fileglancer/user_worker.py b/fileglancer/user_worker.py
index 34112abe..a588aa22 100644
--- a/fileglancer/user_worker.py
+++ b/fileglancer/user_worker.py
@@ -743,15 +743,14 @@ def _action_get_job_file(request: dict, ctx: WorkerContext) -> dict:
 
 @action("get_service_url")
 def _action_get_service_url(request: dict, ctx: WorkerContext) -> dict:
-    """Read service URL from job work directory."""
-    from fileglancer.apps.jobfiles import get_service_url
+    """Read the service URL and startup phase from a job's work directory."""
+    from fileglancer.apps.jobfiles import get_service_url, get_service_phase
 
     job_id = request["job_id"]
     db_job = ctx.db.get_job(job_id, ctx.username)
     if db_job is None:
         return {"error": f"Job {job_id} not found", "status_code": 404}
-    url = get_service_url(db_job)
-    return {"service_url": url}
+    return {"service_url": get_service_url(db_job), "phase": get_service_phase(db_job)}
 
 
 # ---------------------------------------------------------------------------
diff --git a/frontend/src/components/JobDetail.tsx b/frontend/src/components/JobDetail.tsx
index 25d2c5e6..799320a6 100644
--- a/frontend/src/components/JobDetail.tsx
+++ b/frontend/src/components/JobDetail.tsx
@@ -675,7 +675,9 @@ export default function JobDetail() {
                   <span className="relative inline-flex rounded-full h-3 w-3 bg-warning" />
                 </span>
                 <Typography className="text-foreground flex-1">
-                  Service is starting up...
+                  {job.phase === 'pulling_image'
+                    ? 'Downloading container image… first launch can take a few minutes.'
+                    : 'Service is starting up…'}
                 </Typography>
                 <FgButton
                   color="error"
diff --git a/frontend/src/shared.types.ts b/frontend/src/shared.types.ts
index 689c707d..38b44d51 100644
--- a/frontend/src/shared.types.ts
+++ b/frontend/src/shared.types.ts
@@ -201,6 +201,7 @@ type Job = {
   work_dir?: string;
   cluster_job_id?: string;
   service_url?: string;
+  phase?: string;
   created_at: string;
   started_at?: string;
   finished_at?: string;
diff --git a/tests/test_apps.py b/tests/test_apps.py
index e71308b6..f97baf12 100644
--- a/tests/test_apps.py
+++ b/tests/test_apps.py
@@ -229,7 +229,7 @@ def test_robust_under_set_euo_pipefail(self):
 
 from types import SimpleNamespace
 
-from fileglancer.apps.jobfiles import get_job_file_paths, read_job_file
+from fileglancer.apps.jobfiles import get_job_file_paths, read_job_file, get_service_phase
 
 
 def _fake_job(**overrides):
@@ -888,6 +888,43 @@ def test_does_not_publish_when_port_never_opens(self, tmp_path):
         assert "never opened" in result.stderr
 
 
+class TestServicePhase:
+    """The 'phase' marker the container script writes and get_service_phase reads."""
+
+    def test_container_script_reports_pull_and_start_phases(self):
+        script = _build_container_script("docker://x/y:latest", "run", "/wd", [])
+        # 'pulling_image' is written inside the "SIF missing" branch (the pull),
+        # 'starting' unconditionally before exec.
+        assert 'printf pulling_image > "$FG_PHASE_PATH"' in script
+        assert 'printf starting > "$FG_PHASE_PATH"' in script
+        pull_i = script.index("apptainer pull")
+        assert script.index("pulling_image") < pull_i < script.index("apptainer exec")
+
+    def _svc(self, tmp_path, phase=None, **kw):
+        if phase is not None:
+            (tmp_path / "phase").write_text(phase)
+        kw.setdefault("entry_point_type", "service")
+        kw.setdefault("status", "RUNNING")
+        return _fake_job(work_dir=str(tmp_path), **kw)
+
+    def test_reads_recognized_phase_for_running_service(self, tmp_path):
+        assert get_service_phase(self._svc(tmp_path, "pulling_image")) == "pulling_image"
+        (tmp_path / "phase").write_text("starting")
+        assert get_service_phase(self._svc(tmp_path)) == "starting"
+
+    def test_none_when_not_running(self, tmp_path):
+        assert get_service_phase(self._svc(tmp_path, "pulling_image", status="PENDING")) is None
+
+    def test_none_for_non_service(self, tmp_path):
+        assert get_service_phase(self._svc(tmp_path, "starting", entry_point_type="job")) is None
+
+    def test_none_when_no_phase_file(self, tmp_path):
+        assert get_service_phase(self._svc(tmp_path)) is None
+
+    def test_rejects_unknown_phase(self, tmp_path):
+        assert get_service_phase(self._svc(tmp_path, "garbage")) is None
+
+
 # --- Path validation tests ---
 
 from fileglancer.apps import validate_path_for_shell, validate_path_in_filestore

From 1e21e121cbdd0b4d656c6eef16cd127bb2dc7ef0 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Wed, 1 Jul 2026 22:17:02 -0400
Subject: [PATCH 10/89] fix(apps): pull with --disable-cache to avoid duplicate
 SIF storage
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The generated script only pulls when its own SIF is missing, so Apptainer's
internal layer/SIF cache (~/.apptainer/cache) mostly just duplicated every
image — gigabytes that sped up a re-pull that rarely happens. Add
--disable-cache to `apptainer pull` so the .sif we keep is the only copy; a
re-pull (if that .sif is deleted) re-downloads from the registry.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 fileglancer/apps/jobs.py | 7 ++++++-
 tests/test_apps.py       | 3 +++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/fileglancer/apps/jobs.py b/fileglancer/apps/jobs.py
index f5a316dd..c988dfd1 100644
--- a/fileglancer/apps/jobs.py
+++ b/fileglancer/apps/jobs.py
@@ -505,7 +505,12 @@ def _build_container_script(
         # Report the (often multi-minute) image download so the UI can say so.
         # FG_PHASE_PATH is set in the preamble; guard in case it is not.
         '  [ -n "$FG_PHASE_PATH" ] && printf pulling_image > "$FG_PHASE_PATH" 2>/dev/null || true',
-        f'  apptainer pull "$SIF_PATH" {shlex.quote(docker_url)}',
+        # --disable-cache: the built SIF here is the only copy we keep. We pull
+        # only when it's missing, so Apptainer's own layer/SIF cache would just
+        # duplicate gigabytes to speed up a re-pull that rarely happens. Skipping
+        # it means a re-pull (if this SIF is deleted) re-downloads from the
+        # registry, which is the right trade for not double-storing every image.
+        f'  apptainer pull --disable-cache "$SIF_PATH" {shlex.quote(docker_url)}',
         'fi',
         '[ -n "$FG_PHASE_PATH" ] && printf starting > "$FG_PHASE_PATH" 2>/dev/null || true',
         f'apptainer exec {bind_flags}{extra} "$SIF_PATH" \\',
diff --git a/tests/test_apps.py b/tests/test_apps.py
index f97baf12..aa042779 100644
--- a/tests/test_apps.py
+++ b/tests/test_apps.py
@@ -624,6 +624,9 @@ def test_basic_script(self):
             bind_paths=[],
         )
         assert "apptainer pull" in script
+        # Pull without populating Apptainer's own cache, so the SIF we keep is
+        # the only copy (no multi-GB duplicate under ~/.apptainer/cache).
+        assert "apptainer pull --disable-cache" in script
         assert "apptainer exec" in script
         assert "docker://ghcr.io/org/image:1.0" in script
         assert "ghcr.io_org_image_1.0.sif" in script

From 6773a066cabc020ec1d6384d53c1a8dfd1002042 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Wed, 1 Jul 2026 22:44:40 -0400
Subject: [PATCH 11/89] fix(apps): keep the Apps tabs visible on the job detail
 page

The job detail route (apps/jobs/:jobId) was a standalone route outside
AppsLayout, so drilling into a job dropped the My Apps / App Catalog / Jobs tab
bar. Nest it as a child of the AppsLayout route so it renders in the layout's
Outlet with the tabs; the Jobs tab (NavLink to /apps/jobs, non-exact) stays
highlighted. The URL is unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 frontend/src/App.tsx | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/frontend/src/App.tsx b/frontend/src/App.tsx
index 9bd7c430..7b05f1eb 100644
--- a/frontend/src/App.tsx
+++ b/frontend/src/App.tsx
@@ -128,6 +128,9 @@ const AppComponent = () => {
               <Route element={<Apps />} index />
               <Route element={<Catalog />} path="catalog" />
               <Route element={<AppJobs />} path="jobs" />
+              {/* Render job detail inside the layout so the My Apps / App
+                  Catalog / Jobs tabs stay visible when drilling into a job. */}
+              <Route element={<JobDetail />} path="jobs/:jobId" />
             </Route>
             <Route
               element={
@@ -169,14 +172,6 @@ const AppComponent = () => {
               }
               path="apps/relaunch/:owner/:repo"
             />
-            <Route
-              element={
-                <RequireAuth>
-                  <JobDetail />
-                </RequireAuth>
-              }
-              path="apps/jobs/:jobId"
-            />
             {tasksEnabled ? (
               <Route
                 element={

From b9c70f0f09b635e3e9855ca23af21f464b2bb9a9 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Wed, 1 Jul 2026 22:48:42 -0400
Subject: [PATCH 12/89] fix(apps): drop the redundant "Back to Jobs" button on
 job detail

The job detail page now renders inside AppsLayout with the tab bar, so the
Jobs tab already provides the way back. Remove the button and its now-unused
icon import.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 frontend/src/components/JobDetail.tsx | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/frontend/src/components/JobDetail.tsx b/frontend/src/components/JobDetail.tsx
index 799320a6..185d7e10 100644
--- a/frontend/src/components/JobDetail.tsx
+++ b/frontend/src/components/JobDetail.tsx
@@ -5,7 +5,6 @@ import { Link, useNavigate, useParams } from 'react-router';
 import { Card, Tabs, Typography } from '@material-tailwind/react';
 import {
   HiExternalLink,
-  HiOutlineArrowLeft,
   HiOutlineDownload,
   HiOutlineRefresh,
   HiOutlineStop
@@ -541,15 +540,6 @@ export default function JobDetail() {
 
   return (
     <div>
-      <FgButton
-        className="mb-6"
-        icon={HiOutlineArrowLeft}
-        onClick={() => navigate('/apps/jobs')}
-        variant="outline"
-      >
-        Back to Jobs
-      </FgButton>
-
       {jobQuery.isPending ? (
         <div className="animate-pulse">
           {/* Title skeleton */}

From 2e218f4b4a299e1ecd2e431df518b90bdd54e51d Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Thu, 2 Jul 2026 08:32:21 -0400
Subject: [PATCH 13/89] feat(apps): create_if_missing directory params
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add an opt-in per-parameter boolean create_if_missing (directory params
only). When set, Fileglancer creates the resolved directory as the user,
within an allowed file share, just before the submit-time existence
check — so a home default like ~/.fileglancer/logs works on first launch
and overrides to new directories are created too.

Backend: model field + validator (directory-only), collect_creatable_dirs
mirroring collect_path_parameters, a create_dirs setuid-worker action
that enforces file-share containment before makedirs(exist_ok=True), and
a submit_job step that dispatches create_dirs before validate_paths.
Frontend type parity in shared.types.ts.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 fileglancer/apps/__init__.py |  1 +
 fileglancer/apps/command.py  | 32 +++++++++++++++
 fileglancer/apps/jobs.py     | 15 +++++++
 fileglancer/model.py         | 15 +++++++
 fileglancer/user_worker.py   | 31 +++++++++++++++
 frontend/src/shared.types.ts |  1 +
 tests/test_apps.py           | 76 ++++++++++++++++++++++++++++++++++++
 tests/test_worker.py         | 41 +++++++++++++++++++
 8 files changed, 212 insertions(+)

diff --git a/fileglancer/apps/__init__.py b/fileglancer/apps/__init__.py
index 61a68f8b..481306ba 100644
--- a/fileglancer/apps/__init__.py
+++ b/fileglancer/apps/__init__.py
@@ -16,6 +16,7 @@
     _TOOL_REGISTRY,
     build_command,
     build_requirements_check,
+    collect_creatable_dirs,
     collect_path_parameters,
     expand_user_path,
     merge_requirements,
diff --git a/fileglancer/apps/command.py b/fileglancer/apps/command.py
index d7a161eb..c3993e4a 100644
--- a/fileglancer/apps/command.py
+++ b/fileglancer/apps/command.py
@@ -517,3 +517,35 @@ def collect_path_parameters(entry_point: AppEntryPoint, parameters: dict,
                 continue
             result.append((param.key, param.name, str(value)))
     return result
+
+
+def collect_creatable_dirs(entry_point: AppEntryPoint, parameters: dict,
+                           env_parameters: dict = None) -> list[tuple[str, str]]:
+    """Collect effective directory values for params with create_if_missing set.
+
+    Mirrors collect_path_parameters' effective-value logic (user value else
+    default, across both the env and pipeline namespaces) but returns only
+    directory params carrying create_if_missing, as (param_name, raw_value)
+    tuples. Raw (un-expanded) values are returned so the setuid worker resolves
+    '~' as the target user. See submit_job.
+    """
+    env_parameters = env_parameters or {}
+    env_flat = _flatten_param_items(entry_point.env_parameters)
+    param_flat = _flatten_param_items(entry_point.parameters)
+    groups = ((env_flat, env_parameters), (param_flat, parameters))
+
+    result: list[tuple[str, str]] = []
+    for flat, values in groups:
+        for param in flat:
+            if param.type != "directory" or not param.create_if_missing:
+                continue
+            if param.key in values:
+                value = values[param.key]
+            elif param.default is not None:
+                value = param.default
+            else:
+                continue
+            if value == "":
+                continue
+            result.append((param.name, str(value)))
+    return result
diff --git a/fileglancer/apps/jobs.py b/fileglancer/apps/jobs.py
index c988dfd1..04da2627 100644
--- a/fileglancer/apps/jobs.py
+++ b/fileglancer/apps/jobs.py
@@ -28,6 +28,7 @@
 from fileglancer.apps.command import (
     build_command,
     build_requirements_check,
+    collect_creatable_dirs,
     collect_path_parameters,
     expand_user_path,
     merge_requirements,
@@ -624,6 +625,20 @@ async def submit_job(
     # as a service account that isn't in the user's groups, so a redundant
     # server-side check would wrongly reject (or, on local FS, wrongly accept)
     # paths the user can actually access.
+    # Create any directory params flagged create_if_missing first, as the user,
+    # so a home default like '~/.fileglancer/logs' exists by the time the
+    # existence check below runs. Containment (within a file share) is enforced
+    # in the worker before makedirs, so this never writes outside a share.
+    creatable_dirs = collect_creatable_dirs(entry_point, parameters, env_parameters)
+    if creatable_dirs:
+        paths_to_create = {str(i): value for i, (_, value) in enumerate(creatable_dirs)}
+        creation = await _dispatch(username, "create_dirs", paths=paths_to_create)
+        errors = (creation or {}).get("errors") or {}
+        if errors:
+            idx = min(int(i) for i in errors)
+            param_name, _ = creatable_dirs[idx]
+            raise ValueError(f"Parameter '{param_name}': {errors[str(idx)]}")
+
     path_params = collect_path_parameters(entry_point, parameters, env_parameters)
     if path_params:
         paths_to_check = {str(i): value for i, (_, _, value) in enumerate(path_params)}
diff --git a/fileglancer/model.py b/fileglancer/model.py
index 4373d23a..700cabd2 100644
--- a/fileglancer/model.py
+++ b/fileglancer/model.py
@@ -340,6 +340,12 @@ class AppParameter(BaseModel):
     pattern: Optional[str] = Field(description="Regex validation pattern for string types", default=None)
     hidden: bool = Field(description="Whether the parameter is hidden by default in the UI", default=False)
     raw: bool = Field(description="If true, value is appended to the command without shell quoting", default=False)
+    create_if_missing: bool = Field(
+        description="directory params only: create the resolved directory (as the user, "
+                    "within an allowed file share) before the existence check, so a home "
+                    "default like '~/.fileglancer/logs' works on first launch",
+        default=False,
+    )
 
     @field_validator("flag")
     @classmethod
@@ -363,6 +369,15 @@ def stringify_options(cls, v):
             return v
         return [str(item) for item in v]
 
+    @model_validator(mode='after')
+    def validate_create_if_missing(self):
+        if self.create_if_missing and self.type != "directory":
+            raise ValueError(
+                f"create_if_missing is only valid on directory parameters, "
+                f"but '{self.name}' has type '{self.type}'"
+            )
+        return self
+
 
 class AppParameterSection(BaseModel):
     """A collapsible section that groups parameters in the UI"""
diff --git a/fileglancer/user_worker.py b/fileglancer/user_worker.py
index a588aa22..9213d21b 100644
--- a/fileglancer/user_worker.py
+++ b/fileglancer/user_worker.py
@@ -655,6 +655,37 @@ def _action_validate_paths(request: dict, ctx: WorkerContext) -> dict:
     return {"errors": errors}
 
 
+@action("create_dirs")
+def _action_create_dirs(request: dict, ctx: WorkerContext) -> dict:
+    """Create directories for app params with create_if_missing set.
+
+    Runs as the target user in the setuid worker. Each path is expanded ('~'
+    resolves to this user's home), confirmed to be within an allowed file share
+    (containment only — the directory need not exist yet), and only then created
+    with exist_ok=True. Never creates anything outside a file share. Best-effort:
+    per-path failures are returned in {"errors": {index: message}} rather than
+    aborting the batch.
+    """
+    from fileglancer.apps.command import validate_path_in_filestore
+
+    paths = request["paths"]
+    fsps = ctx.db.get_file_share_paths()
+    errors = {}
+    for key, path_value in paths.items():
+        # Containment check without the exists/readable check — the directory is
+        # about to be created, so it legitimately may not exist yet.
+        error = validate_path_in_filestore(path_value, fsps, check_access=False)
+        if error:
+            errors[key] = error
+            continue
+        expanded = os.path.expanduser(path_value.replace("\\", "/"))
+        try:
+            os.makedirs(expanded, exist_ok=True)
+        except OSError as e:
+            errors[key] = str(e)
+    return {"errors": errors}
+
+
 @action("get_profile")
 def _action_get_profile(request: dict, ctx: WorkerContext) -> dict:
     """Get user profile information."""
diff --git a/frontend/src/shared.types.ts b/frontend/src/shared.types.ts
index 38b44d51..5fe47179 100644
--- a/frontend/src/shared.types.ts
+++ b/frontend/src/shared.types.ts
@@ -79,6 +79,7 @@ type AppParameter = {
   pattern?: string;
   hidden?: boolean;
   raw?: boolean;
+  create_if_missing?: boolean;
 };
 
 type AppParameterSection = {
diff --git a/tests/test_apps.py b/tests/test_apps.py
index aa042779..133ab25d 100644
--- a/tests/test_apps.py
+++ b/tests/test_apps.py
@@ -26,6 +26,7 @@
     _SERVICE_PORT_HELPER,
     _build_service_url_publisher,
     build_command,
+    collect_creatable_dirs,
     collect_path_parameters,
     expand_user_path,
 )
@@ -1178,6 +1179,81 @@ def test_omits_path_params_without_value_or_default(self):
         assert collect_path_parameters(ep, {}) == []
 
 
+class TestCreateIfMissingValidation:
+    """create_if_missing is only valid on directory params."""
+
+    def test_accepted_on_directory(self):
+        p = AppParameter(key="d", name="Dir", type="directory", create_if_missing=True)
+        assert p.create_if_missing is True
+
+    def test_defaults_false(self):
+        p = AppParameter(key="d", name="Dir", type="directory")
+        assert p.create_if_missing is False
+
+    @pytest.mark.parametrize("bad_type", ["file", "string", "integer", "enum"])
+    def test_rejected_on_non_directory(self, bad_type):
+        kwargs = {"key": "p", "name": "P", "type": bad_type, "create_if_missing": True}
+        if bad_type == "enum":
+            kwargs["options"] = ["a", "b"]
+        with pytest.raises(ValidationError):
+            AppParameter(**kwargs)
+
+
+class TestCollectCreatableDirs:
+    """collect_creatable_dirs gathers directory params flagged create_if_missing."""
+
+    def test_collects_via_default_and_user_value(self):
+        ep = AppEntryPoint(
+            id="test",
+            name="test",
+            command="test_cmd",
+            env_parameters=[{
+                "key": "envdir", "name": "Env Dir", "type": "directory",
+                "default": "~/.fileglancer/env", "create_if_missing": True,
+            }],
+            parameters=[
+                {"key": "logdir", "name": "Log Dir", "type": "directory",
+                 "flag": "--logdir", "default": "~/.fileglancer/logs",
+                 "create_if_missing": True},
+                # directory without the flag -> excluded
+                {"key": "indir", "name": "In Dir", "type": "directory",
+                 "flag": "--indir", "default": "/data/in"},
+            ],
+        )
+        result = collect_creatable_dirs(
+            ep,
+            {"logdir": "/data/mylogs"},  # user override
+            env_parameters={},
+        )
+        # Env default included; pipeline 'logdir' uses the user value; 'indir'
+        # excluded (no create_if_missing).
+        assert result == [
+            ("Env Dir", "~/.fileglancer/env"),
+            ("Log Dir", "/data/mylogs"),
+        ]
+
+    def test_omits_when_no_effective_value(self):
+        ep = AppEntryPoint(
+            id="test",
+            name="test",
+            command="test_cmd",
+            parameters=[{"key": "logdir", "name": "Log Dir", "type": "directory",
+                         "flag": "--logdir", "create_if_missing": True}],
+        )
+        assert collect_creatable_dirs(ep, {}) == []
+
+    def test_omits_empty_string_value(self):
+        ep = AppEntryPoint(
+            id="test",
+            name="test",
+            command="test_cmd",
+            parameters=[{"key": "logdir", "name": "Log Dir", "type": "directory",
+                         "flag": "--logdir", "default": "~/logs",
+                         "create_if_missing": True}],
+        )
+        assert collect_creatable_dirs(ep, {"logdir": ""}) == []
+
+
 class TestExpandUserPath:
     """expand_user_path normalizes file/dir param values consistently."""
 
diff --git a/tests/test_worker.py b/tests/test_worker.py
index e1152df9..14aa5349 100644
--- a/tests/test_worker.py
+++ b/tests/test_worker.py
@@ -28,6 +28,7 @@
     _recv,
     _ACTIONS,
     _action_validate_proxied_path,
+    _action_create_dirs,
     WorkerContext,
     _HEADER_FMT,
     _HEADER_SIZE,
@@ -637,3 +638,43 @@ def test_accepts_symlink(self, tmp_path):
         result = _action_validate_proxied_path(
             {"fsp_name": "vpp_symlink", "path": "link.txt"}, ctx)
         assert result == {"ok": True}
+
+
+class TestCreateDirsAction:
+    """create_dirs makes directories within a share, refusing anything outside."""
+
+    def _ctx(self, mount_path):
+        fsp = FileSharePath(zone="test", name="cd", mount_path=str(mount_path))
+        return WorkerContext(username="test", db=_StubDb([fsp]))
+
+    def test_creates_missing_directory(self, tmp_path):
+        ctx = self._ctx(tmp_path)
+        target = tmp_path / "logs" / "run1"
+        result = _action_create_dirs({"paths": {"0": str(target)}}, ctx)
+        assert result == {"errors": {}}
+        assert target.is_dir()
+
+    def test_existing_directory_is_noop(self, tmp_path):
+        ctx = self._ctx(tmp_path)
+        target = tmp_path / "logs"
+        target.mkdir()
+        result = _action_create_dirs({"paths": {"0": str(target)}}, ctx)
+        assert result == {"errors": {}}
+        assert target.is_dir()
+
+    def test_refuses_path_outside_any_share(self, tmp_path):
+        share = tmp_path / "share"
+        share.mkdir()
+        ctx = self._ctx(share)
+        outside = tmp_path / "outside" / "dir"
+        result = _action_create_dirs({"paths": {"0": str(outside)}}, ctx)
+        assert "0" in result["errors"]
+        assert not outside.exists()
+
+    def test_expands_tilde_as_the_user(self, tmp_path, monkeypatch):
+        # Point HOME at a share so '~' resolves inside it.
+        monkeypatch.setenv("HOME", str(tmp_path))
+        ctx = self._ctx(tmp_path)
+        result = _action_create_dirs({"paths": {"0": "~/.fileglancer/logs"}}, ctx)
+        assert result == {"errors": {}}
+        assert (tmp_path / ".fileglancer" / "logs").is_dir()

From 43a57058bb574eb7022b300944c9e282d67ba5a3 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Thu, 2 Jul 2026 08:41:21 -0400
Subject: [PATCH 14/89] feat(files): home default + toolbar for the
 folder-select dialog

Two improvements to the file/folder selector dialog (useFileSelector +
FileSelectorButton):

1. Start in the user's home directory when opened with no path yet
   (opt-in via defaultToHome, enabled on the app launch form's
   directory/file pickers), instead of the top-level zones list.

2. Add "go home", "new folder", and "show/hide dot files" buttons
   mirroring the browser toolbar. Show/hide dot files is a dialog-local
   override that follows the global preference until toggled and never
   writes it. New folder creates a directory in the current file share.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../components/ui/AppsPage/AppLaunchForm.tsx  |   1 +
 .../ui/FileSelector/FileSelectorButton.tsx    | 141 +++++++++++++++++-
 frontend/src/hooks/useFileSelector.ts         | 107 ++++++++++---
 3 files changed, 224 insertions(+), 25 deletions(-)

diff --git a/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx b/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
index 5dce41d5..9b51e055 100644
--- a/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
+++ b/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
@@ -165,6 +165,7 @@ function ParameterField({
             }
           />
           <FileSelectorButton
+            defaultToHome
             initialPath={
               typeof value === 'string' &&
               !value.startsWith('s3://') &&
diff --git a/frontend/src/components/ui/FileSelector/FileSelectorButton.tsx b/frontend/src/components/ui/FileSelector/FileSelectorButton.tsx
index 32792e2b..27a4eb64 100644
--- a/frontend/src/components/ui/FileSelector/FileSelectorButton.tsx
+++ b/frontend/src/components/ui/FileSelector/FileSelectorButton.tsx
@@ -1,15 +1,22 @@
 import { useState, useEffect } from 'react';
-import type { MouseEvent } from 'react';
-import { Input, Typography } from '@material-tailwind/react';
+import type { ChangeEvent, FormEvent, MouseEvent } from 'react';
+import { IconButton, Input, Typography } from '@material-tailwind/react';
 import { HiOutlineFolder, HiOutlineFunnel, HiXMark } from 'react-icons/hi2';
+import { HiHome, HiFolderAdd, HiEye, HiEyeOff } from 'react-icons/hi';
+import toast from 'react-hot-toast';
 
 import FgDialog from '@/components/ui/Dialogs/FgDialog';
 import FgButton from '@/components/designSystem/atoms/FgButton';
 import FgIcon from '@/components/designSystem/atoms/FgIcon';
+import FgTooltip from '@/components/ui/widgets/FgTooltip';
+import FgInput from '@/components/designSystem/atoms/formElements/FgInput';
 import FileSelectorBreadcrumbs from './FileSelectorBreadcrumbs';
 import FileSelectorTable from './FileSelectorTable';
 import { Spinner } from '@/components/ui/widgets/Loaders';
 import useFileSelector from '@/hooks/useFileSelector';
+import useFileNameValidation from '@/hooks/useFileNameValidation';
+import { useCreateFolderMutation } from '@/queries/fileQueries';
+import { joinPaths } from '@/utils';
 import type {
   FileSelectorInitialLocation,
   FileSelectorMode
@@ -33,8 +40,13 @@ type FileSelectorButtonProps = {
   readonly mode?: FileSelectorMode;
   readonly useServerPath?: boolean;
   readonly initialPath?: string;
+  readonly defaultToHome?: boolean;
 };
 
+// Icon-button styling matched to the file browser toolbar.
+const toolbarBtnClasses =
+  'inline-grid place-items-center border align-middle select-none font-sans font-medium text-center transition-all duration-300 ease-in disabled:opacity-50 disabled:shadow-none disabled:pointer-events-none data-[shape=circular]:rounded-full text-sm min-w-[38px] min-h-[38px] rounded-md shadow-sm hover:shadow-md bg-transparent border-primary text-primary hover:bg-primary hover:text-primary-foreground outline-none group';
+
 export default function FileSelectorButton({
   onSelect,
   triggerClasses = '',
@@ -42,9 +54,12 @@ export default function FileSelectorButton({
   initialLocation,
   mode = 'any',
   useServerPath,
-  initialPath
+  initialPath,
+  defaultToHome = false
 }: FileSelectorButtonProps) {
   const [showDialog, setShowDialog] = useState(false);
+  const [showNewFolder, setShowNewFolder] = useState(false);
+  const [newFolderName, setNewFolderName] = useState('');
 
   // Use initialPath if provided, otherwise fall back to last confirmed selection's parent
   const effectiveInitialPath =
@@ -56,6 +71,8 @@ export default function FileSelectorButton({
     fileQuery,
     zonesQuery,
     navigateToLocation,
+    navigateHome,
+    canGoHome,
     selectItem,
     handleItemDoubleClick,
     reset,
@@ -63,14 +80,24 @@ export default function FileSelectorButton({
     handleSearchChange,
     clearSearch,
     isFilteredByGroups,
-    userHasGroups
+    userHasGroups,
+    hideDotFiles,
+    toggleHideDotFiles
   } = useFileSelector({
     initialLocation,
     initialPath: showDialog ? effectiveInitialPath : undefined,
     mode,
-    pathPreferenceOverride: useServerPath ? ['linux_path'] : undefined
+    pathPreferenceOverride: useServerPath ? ['linux_path'] : undefined,
+    defaultToHome
   });
 
+  const createFolderMutation = useCreateFolderMutation();
+  const nameValidation = useFileNameValidation(newFolderName);
+
+  // New folders can only be made inside a file share (not at the zones/zone level).
+  const currentFilesystem =
+    state.currentLocation.type === 'filesystem' ? state.currentLocation : null;
+
   // When dialog opens, select the current folder
   useEffect(() => {
     if (showDialog) {
@@ -78,11 +105,41 @@ export default function FileSelectorButton({
     }
   }, [showDialog, selectItem]);
 
+  const resetNewFolder = () => {
+    setShowNewFolder(false);
+    setNewFolderName('');
+  };
+
   const onClose = () => {
     reset();
+    resetNewFolder();
     setShowDialog(false);
   };
 
+  const handleCreateFolder = async (e: FormEvent<HTMLFormElement>) => {
+    e.preventDefault();
+    if (
+      !currentFilesystem ||
+      !newFolderName.trim() ||
+      !nameValidation.isValid
+    ) {
+      return;
+    }
+    const base = currentFilesystem.path === '.' ? '' : currentFilesystem.path;
+    try {
+      await createFolderMutation.mutateAsync({
+        fspName: currentFilesystem.fspName,
+        folderPath: joinPaths(base, newFolderName.trim())
+      });
+      toast.success('New folder created!');
+      resetNewFolder();
+    } catch (err) {
+      toast.error(
+        `Error creating folder: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  };
+
   const handleSelect = () => {
     if (state.selectedItem) {
       lastSelectedParentPath = getParentPath(state.selectedItem.displayPath);
@@ -142,6 +199,80 @@ export default function FileSelectorButton({
             zonesData={zonesQuery.data}
           />
 
+          {/* Toolbar: go home, new folder, show/hide dot files */}
+          <div className="mt-2 flex items-center gap-1">
+            <FgTooltip
+              as={IconButton}
+              disabledCondition={!canGoHome}
+              icon={HiHome}
+              label="Go to home folder"
+              onClick={() => {
+                resetNewFolder();
+                navigateHome();
+              }}
+              triggerClasses={toolbarBtnClasses}
+            />
+            <FgTooltip
+              as={IconButton}
+              disabledCondition={!currentFilesystem}
+              icon={HiFolderAdd}
+              label="New folder"
+              onClick={() => {
+                if (currentFilesystem) {
+                  setShowNewFolder(prev => !prev);
+                }
+              }}
+              triggerClasses={toolbarBtnClasses}
+            />
+            <FgTooltip
+              as={IconButton}
+              icon={hideDotFiles ? HiEyeOff : HiEye}
+              label={hideDotFiles ? 'Show dot files' : 'Hide dot files'}
+              onClick={toggleHideDotFiles}
+              triggerClasses={toolbarBtnClasses}
+            />
+          </div>
+
+          {/* Inline new-folder form */}
+          {showNewFolder && currentFilesystem ? (
+            <form
+              className="mt-2 flex items-start gap-2"
+              onSubmit={handleCreateFolder}
+            >
+              <div className="flex-1">
+                <FgInput
+                  autoFocus
+                  onChange={(event: ChangeEvent<HTMLInputElement>) =>
+                    setNewFolderName(event.target.value)
+                  }
+                  placeholder="New folder name ..."
+                  type="text"
+                  value={newFolderName}
+                />
+                {nameValidation.errorMessage ? (
+                  <Typography className="mt-1 text-xs text-error">
+                    {nameValidation.errorMessage}
+                  </Typography>
+                ) : null}
+              </div>
+              <FgButton
+                disabled={
+                  !newFolderName.trim() ||
+                  !nameValidation.isValid ||
+                  createFolderMutation.isPending
+                }
+                loading={createFolderMutation.isPending}
+                loadingText="Creating..."
+                type="submit"
+              >
+                Create
+              </FgButton>
+              <FgButton onClick={resetNewFolder} type="button" variant="ghost">
+                Cancel
+              </FgButton>
+            </form>
+          ) : null}
+
           {/* Search input */}
           <div className="my-2 relative">
             <Input
diff --git a/frontend/src/hooks/useFileSelector.ts b/frontend/src/hooks/useFileSelector.ts
index b95a2a4e..15f3928d 100644
--- a/frontend/src/hooks/useFileSelector.ts
+++ b/frontend/src/hooks/useFileSelector.ts
@@ -40,33 +40,90 @@ type FileSelectorOptions = {
   initialPath?: string;
   mode?: FileSelectorMode;
   pathPreferenceOverride?: ['linux_path'];
+  // When neither initialLocation nor initialPath resolves to a folder, open in
+  // the user's home directory instead of the top-level zones list.
+  defaultToHome?: boolean;
 };
 
 export default function useFileSelector(options?: FileSelectorOptions) {
   const { zonesAndFspQuery } = useZoneAndFspMapContext();
-  const { pathPreference, isFilteredByGroups } = usePreferencesContext();
+  const { pathPreference, isFilteredByGroups, hideDotFiles } =
+    usePreferencesContext();
   const { profile } = useProfileContext();
 
   const initialLocation = options?.initialLocation;
   const mode = options?.mode ?? 'any';
+  const defaultToHome = options?.defaultToHome ?? false;
   const overrideKey = options?.pathPreferenceOverride?.[0];
   const effectivePathPreference = useMemo(
     () => (overrideKey ? ([overrideKey] as ['linux_path']) : pathPreference),
     [overrideKey, pathPreference]
   );
 
-  // Initialize location based on initialLocation prop
+  // The user's home directory as a filesystem location, when known.
+  const homeLocation = useMemo<FileSelectorLocation | undefined>(() => {
+    if (!profile?.homeFileSharePathName) {
+      return undefined;
+    }
+    return {
+      type: 'filesystem',
+      fspName: profile.homeFileSharePathName,
+      path: profile.homeDirectoryName || '.'
+    };
+  }, [profile]);
+
+  // Where the selector starts (and returns to on reset): an explicit
+  // initialLocation, else the home directory when defaultToHome is set, else
+  // the top-level zones list.
+  const defaultLocation = useMemo<FileSelectorLocation>(() => {
+    if (initialLocation) {
+      return {
+        type: 'filesystem',
+        fspName: initialLocation.fspName,
+        path: initialLocation.path
+      };
+    }
+    if (defaultToHome && homeLocation) {
+      return homeLocation;
+    }
+    return { type: 'zones' };
+  }, [initialLocation, defaultToHome, homeLocation]);
+
+  // Initialize location based on the resolved default location
   const [state, setState] = useState<FileSelectorState>({
-    currentLocation: initialLocation
-      ? {
-          type: 'filesystem',
-          fspName: initialLocation.fspName,
-          path: initialLocation.path
-        }
-      : { type: 'zones' },
+    currentLocation: defaultLocation,
     selectedItem: null
   });
 
+  // Local-only dot-file visibility for the dialog: null follows the global
+  // preference; once the user toggles inside the dialog it overrides locally
+  // without ever writing the global preference.
+  const [hideDotFilesOverride, setHideDotFilesOverride] = useState<
+    boolean | null
+  >(null);
+  const hideDotFilesEffective = hideDotFilesOverride ?? hideDotFiles;
+  const toggleHideDotFiles = useCallback(() => {
+    setHideDotFilesOverride(prev => !(prev ?? hideDotFiles));
+  }, [hideDotFiles]);
+
+  // If the profile (and thus home) resolves only after mount, apply the home
+  // default once, as long as the user hasn't already navigated away.
+  const appliedHomeRef = useRef(false);
+  useEffect(() => {
+    if (!defaultToHome || initialLocation || options?.initialPath) {
+      return;
+    }
+    if (appliedHomeRef.current || !homeLocation) {
+      return;
+    }
+    appliedHomeRef.current = true;
+    setState(prev =>
+      prev.currentLocation.type === 'zones'
+        ? { currentLocation: homeLocation, selectedItem: null }
+        : prev
+    );
+  }, [defaultToHome, initialLocation, options?.initialPath, homeLocation]);
+
   const [searchQuery, setSearchQuery] = useState<string>('');
   const normalizedQuery = searchQuery.trim().toLowerCase();
 
@@ -234,7 +291,10 @@ export default function useFileSelector(options?: FileSelectorOptions) {
       return items;
     } else {
       // In filesystem mode, return files from query
-      const files = fileQuery.data?.files || [];
+      let files = fileQuery.data?.files || [];
+      if (hideDotFilesEffective) {
+        files = files.filter(item => !item.name.startsWith('.'));
+      }
       if (normalizedQuery) {
         return files.filter(item =>
           item.name.toLowerCase().includes(normalizedQuery)
@@ -249,7 +309,8 @@ export default function useFileSelector(options?: FileSelectorOptions) {
     fileQuery.data,
     isFilteredByGroups,
     profile,
-    normalizedQuery
+    normalizedQuery,
+    hideDotFilesEffective
   ]);
 
   // Navigation methods
@@ -261,21 +322,23 @@ export default function useFileSelector(options?: FileSelectorOptions) {
     });
   }, []);
 
+  // Jump to the user's home directory (no-op until the profile resolves).
+  const navigateHome = useCallback(() => {
+    if (homeLocation) {
+      navigateToLocation(homeLocation);
+    }
+  }, [homeLocation, navigateToLocation]);
+
   // Reset to initial state (for when dialog is closed/cancelled)
   const reset = useCallback(() => {
     lastResolvedPath.current = undefined;
     setSearchQuery('');
+    setHideDotFilesOverride(null);
     setState({
-      currentLocation: initialLocation
-        ? {
-            type: 'filesystem',
-            fspName: initialLocation.fspName,
-            path: initialLocation.path
-          }
-        : { type: 'zones' },
+      currentLocation: defaultLocation,
       selectedItem: null
     });
-  }, [initialLocation]);
+  }, [defaultLocation]);
 
   // Select an item and generate its full filesystem path
   // If no item provided, selects the current folder/location
@@ -405,6 +468,8 @@ export default function useFileSelector(options?: FileSelectorOptions) {
     fileQuery,
     zonesQuery: zonesAndFspQuery,
     navigateToLocation,
+    navigateHome,
+    canGoHome: homeLocation !== undefined,
     selectItem,
     handleItemDoubleClick,
     reset,
@@ -412,6 +477,8 @@ export default function useFileSelector(options?: FileSelectorOptions) {
     handleSearchChange,
     clearSearch,
     isFilteredByGroups,
-    userHasGroups
+    userHasGroups,
+    hideDotFiles: hideDotFilesEffective,
+    toggleHideDotFiles
   };
 }

From 04b88b4c53b31829244b685aada941470c701837 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Thu, 2 Jul 2026 09:12:09 -0400
Subject: [PATCH 15/89] fix(apps): don't fail pre-submit validation for
 create_if_missing dirs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The launch form validates directory paths against the worker before
submitting, and that existence check rejected a create_if_missing
default like ~/.fileglancer/tensorboard with "Path does not exist" —
before submit_job's create_dirs step could create it.

Pass the create_if_missing param keys through /api/apps/validate-paths
so the worker validates those for file-share containment only (not
existence). The directory is still created at submit time, and paths
outside any share are still rejected early.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 fileglancer/model.py                          |  5 +++
 fileglancer/server.py                         |  3 +-
 fileglancer/user_worker.py                    |  8 ++++-
 .../components/ui/AppsPage/AppLaunchForm.tsx  |  9 ++++-
 frontend/src/queries/appsQueries.ts           |  6 ++--
 tests/test_worker.py                          | 35 +++++++++++++++++++
 6 files changed, 61 insertions(+), 5 deletions(-)

diff --git a/fileglancer/model.py b/fileglancer/model.py
index 700cabd2..59e0e966 100644
--- a/fileglancer/model.py
+++ b/fileglancer/model.py
@@ -883,6 +883,11 @@ def validate_container_args(cls, v):
 class PathValidationRequest(BaseModel):
     """Request to validate file/directory paths"""
     paths: Dict[str, str] = Field(description="Map of parameter key to path value")
+    create_if_missing: List[str] = Field(
+        default=[],
+        description="Keys whose directory may not exist yet (create_if_missing "
+                    "params): validated for file-share containment only, not existence",
+    )
 
 
 class PathValidationResponse(BaseModel):
diff --git a/fileglancer/server.py b/fileglancer/server.py
index 84306bf2..67d4b62c 100644
--- a/fileglancer/server.py
+++ b/fileglancer/server.py
@@ -1914,7 +1914,8 @@ async def update_user_app(body: ManifestFetchRequest,
               description="Validate file/directory paths for app parameters")
     async def validate_paths(body: PathValidationRequest,
                              username: str = Depends(get_current_user)):
-        result = await _worker_exec(username, "validate_paths", paths=body.paths)
+        result = await _worker_exec(username, "validate_paths", paths=body.paths,
+                                    create_if_missing=body.create_if_missing)
         return PathValidationResponse(errors=result.get("errors", {}))
 
     # --- Catalog (shared apps) API ---
diff --git a/fileglancer/user_worker.py b/fileglancer/user_worker.py
index 9213d21b..2be0af10 100644
--- a/fileglancer/user_worker.py
+++ b/fileglancer/user_worker.py
@@ -646,10 +646,16 @@ def _action_validate_paths(request: dict, ctx: WorkerContext) -> dict:
     from fileglancer.apps.command import validate_path_in_filestore
 
     paths = request["paths"]
+    # Keys whose directory may not exist yet (create_if_missing params) are
+    # checked for file-share containment only — Fileglancer creates them at
+    # submit time, so a missing-but-in-share path is valid here.
+    create_if_missing = set(request.get("create_if_missing") or [])
     fsps = ctx.db.get_file_share_paths()
     errors = {}
     for param_key, path_value in paths.items():
-        error = validate_path_in_filestore(path_value, fsps)
+        error = validate_path_in_filestore(
+            path_value, fsps, check_access=param_key not in create_if_missing
+        )
         if error:
             errors[param_key] = error
     return {"errors": errors}
diff --git a/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx b/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
index 9b51e055..0b473f00 100644
--- a/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
+++ b/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
@@ -972,6 +972,10 @@ export default function AppLaunchForm({
     // Filter out undefined/empty values and normalize paths to Linux format
     const params: Record<string, unknown> = {};
     const pathParams: Record<string, string> = {};
+    // Directory params flagged create_if_missing are validated for file-share
+    // containment only — Fileglancer creates them at submit time, so their
+    // absence must not fail pre-submit validation.
+    const createIfMissingKeys: string[] = [];
     for (const [key, val] of Object.entries(values)) {
       if (val !== undefined && val !== null && val !== '') {
         const paramDef = paramDefs.get(key);
@@ -991,6 +995,9 @@ export default function AppLaunchForm({
             !normalized.startsWith('https://')
           ) {
             pathParams[key] = normalized;
+            if (paramDef.type === 'directory' && paramDef.create_if_missing) {
+              createIfMissingKeys.push(key);
+            }
           }
         } else {
           params[key] = val;
@@ -1002,7 +1009,7 @@ export default function AppLaunchForm({
     if (Object.keys(pathParams).length > 0) {
       setValidating(true);
       try {
-        const pathErrors = await validatePaths(pathParams);
+        const pathErrors = await validatePaths(pathParams, createIfMissingKeys);
         if (Object.keys(pathErrors).length > 0) {
           setErrors(prev => ({ ...prev, ...pathErrors }));
           setValidating(false);
diff --git a/frontend/src/queries/appsQueries.ts b/frontend/src/queries/appsQueries.ts
index eb04b118..c3a63cb0 100644
--- a/frontend/src/queries/appsQueries.ts
+++ b/frontend/src/queries/appsQueries.ts
@@ -127,10 +127,12 @@ export function useAddAppMutation(): UseMutationResult<
 }
 
 export async function validatePaths(
-  paths: Record<string, string>
+  paths: Record<string, string>,
+  createIfMissing: string[] = []
 ): Promise<Record<string, string>> {
   const response = await sendFetchRequest('/api/apps/validate-paths', 'POST', {
-    paths
+    paths,
+    create_if_missing: createIfMissing
   });
   const data = await getResponseJsonOrError(response);
   if (!response.ok) {
diff --git a/tests/test_worker.py b/tests/test_worker.py
index 14aa5349..24931164 100644
--- a/tests/test_worker.py
+++ b/tests/test_worker.py
@@ -29,6 +29,7 @@
     _ACTIONS,
     _action_validate_proxied_path,
     _action_create_dirs,
+    _action_validate_paths,
     WorkerContext,
     _HEADER_FMT,
     _HEADER_SIZE,
@@ -678,3 +679,37 @@ def test_expands_tilde_as_the_user(self, tmp_path, monkeypatch):
         result = _action_create_dirs({"paths": {"0": "~/.fileglancer/logs"}}, ctx)
         assert result == {"errors": {}}
         assert (tmp_path / ".fileglancer" / "logs").is_dir()
+
+
+class TestValidatePathsAction:
+    """validate_paths checks existence, except for create_if_missing keys."""
+
+    def _ctx(self, mount_path):
+        fsp = FileSharePath(zone="test", name="vp", mount_path=str(mount_path))
+        return WorkerContext(username="test", db=_StubDb([fsp]))
+
+    def test_missing_dir_fails_by_default(self, tmp_path):
+        ctx = self._ctx(tmp_path)
+        missing = tmp_path / "logs"
+        result = _action_validate_paths({"paths": {"logdir": str(missing)}}, ctx)
+        assert "logdir" in result["errors"]
+
+    def test_missing_dir_ok_when_create_if_missing(self, tmp_path):
+        ctx = self._ctx(tmp_path)
+        missing = tmp_path / "logs"
+        result = _action_validate_paths(
+            {"paths": {"logdir": str(missing)}, "create_if_missing": ["logdir"]},
+            ctx,
+        )
+        assert result == {"errors": {}}
+
+    def test_create_if_missing_still_enforces_containment(self, tmp_path):
+        share = tmp_path / "share"
+        share.mkdir()
+        ctx = self._ctx(share)
+        outside = tmp_path / "outside" / "logs"
+        result = _action_validate_paths(
+            {"paths": {"logdir": str(outside)}, "create_if_missing": ["logdir"]},
+            ctx,
+        )
+        assert "logdir" in result["errors"]

From 549cb2b58681cc9504b7ca6e3fc211db5d4e11c0 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Thu, 2 Jul 2026 09:59:06 -0400
Subject: [PATCH 16/89] feat(files): tighten the folder-select dialog layout

Default to hiding dot files in the dialog regardless of the global
preference, move the filter onto the toolbar row, drop the bottom
"Selected" display, widen the dialog, and scale the file-list height
with the viewport so shorter screens shrink the scrollable list.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../ui/FileSelector/FileSelectorButton.tsx    | 72 ++++++++-----------
 .../ui/FileSelector/FileSelectorTable.tsx     | 17 ++---
 frontend/src/hooks/useFileSelector.ts         | 24 +++----
 3 files changed, 42 insertions(+), 71 deletions(-)

diff --git a/frontend/src/components/ui/FileSelector/FileSelectorButton.tsx b/frontend/src/components/ui/FileSelector/FileSelectorButton.tsx
index 27a4eb64..54c66f47 100644
--- a/frontend/src/components/ui/FileSelector/FileSelectorButton.tsx
+++ b/frontend/src/components/ui/FileSelector/FileSelectorButton.tsx
@@ -177,7 +177,7 @@ export default function FileSelectorButton({
       </FgButton>
       {showDialog ? (
         <FgDialog
-          className="w-[800px] max-w-[90vw] max-h-max"
+          className="w-[920px] max-w-[92vw] max-h-max"
           onClose={onClose}
           open={showDialog}
         >
@@ -199,7 +199,7 @@ export default function FileSelectorButton({
             zonesData={zonesQuery.data}
           />
 
-          {/* Toolbar: go home, new folder, show/hide dot files */}
+          {/* Toolbar: go home, new folder, show/hide dot files, filter */}
           <div className="mt-2 flex items-center gap-1">
             <FgTooltip
               as={IconButton}
@@ -231,6 +231,29 @@ export default function FileSelectorButton({
               onClick={toggleHideDotFiles}
               triggerClasses={toolbarBtnClasses}
             />
+            <div className="relative ml-1 flex-1">
+              <Input
+                className="bg-background text-foreground [&::-webkit-search-cancel-button]:appearance-none"
+                onChange={handleSearchChange}
+                placeholder="Type to filter"
+                type="search"
+                value={searchQuery}
+              >
+                <Input.Icon>
+                  <FgIcon className="h-full w-full" icon={HiOutlineFunnel} />
+                </Input.Icon>
+              </Input>
+              {searchQuery ? (
+                <button
+                  aria-label="Clear search"
+                  className="absolute right-2 top-1/2 transform -translate-y-1/2 text-primary hover:text-primary/80 transition-colors"
+                  onClick={clearSearch}
+                  type="button"
+                >
+                  <FgIcon className="font-bold" icon={HiXMark} />
+                </button>
+              ) : null}
+            </div>
           </div>
 
           {/* Inline new-folder form */}
@@ -273,33 +296,9 @@ export default function FileSelectorButton({
             </form>
           ) : null}
 
-          {/* Search input */}
-          <div className="my-2 relative">
-            <Input
-              className="bg-background text-foreground [&::-webkit-search-cancel-button]:appearance-none"
-              onChange={handleSearchChange}
-              placeholder="Type to filter"
-              type="search"
-              value={searchQuery}
-            >
-              <Input.Icon>
-                <FgIcon className="h-full w-full" icon={HiOutlineFunnel} />
-              </Input.Icon>
-            </Input>
-            {searchQuery ? (
-              <button
-                aria-label="Clear search"
-                className="absolute right-2 top-1/2 transform -translate-y-1/2 text-primary hover:text-primary/80 transition-colors"
-                onClick={clearSearch}
-                type="button"
-              >
-                <FgIcon className="font-bold" icon={HiXMark} />
-              </button>
-            ) : null}
-          </div>
-
-          {/* Table with loading/error states */}
-          <div className="my-4 h-96">
+          {/* Table with loading/error states. Height scales with the
+              viewport so shorter screens shrink the (scrollable) file list. */}
+          <div className="my-4 h-[50vh] max-h-96 min-h-[10rem]">
             {zonesQuery.isPending ? (
               <div className="flex items-center justify-center h-full">
                 <Spinner
@@ -351,21 +350,6 @@ export default function FileSelectorButton({
             </div>
           ) : null}
 
-          {/* Selected path display */}
-
-          <div className="mb-4 p-2 h-14 bg-surface rounded">
-            <Typography className="text-sm text-foreground/60">
-              Selected:
-            </Typography>
-            {state.selectedItem ? (
-              <Typography className="text-sm text-foreground font-mono truncate">
-                {state.selectedItem.displayPath}
-              </Typography>
-            ) : (
-              <div className="h-5" />
-            )}
-          </div>
-
           {/* Action buttons */}
           <div className="flex justify-end gap-2 mt-4">
             <FgButton onClick={handleCancel} variant="ghost">
diff --git a/frontend/src/components/ui/FileSelector/FileSelectorTable.tsx b/frontend/src/components/ui/FileSelector/FileSelectorTable.tsx
index 26e4df3e..fa500256 100644
--- a/frontend/src/components/ui/FileSelector/FileSelectorTable.tsx
+++ b/frontend/src/components/ui/FileSelector/FileSelectorTable.tsx
@@ -50,21 +50,12 @@ export default function FileSelectorTable({
   onItemClick,
   onItemDoubleClick
 }: FileSelectorTableProps) {
-  const { hideDotFiles, pathPreference } = usePreferencesContext();
+  const { pathPreference } = usePreferencesContext();
   const [sorting, setSorting] = useState<SortingState>([]);
 
-  const displayFiles = useMemo(() => {
-    let filtered = data;
-
-    // Filter out dot files if preference is set
-    if (hideDotFiles) {
-      filtered = filtered.filter(
-        (file: FileOrFolder) => !file.name.startsWith('.')
-      );
-    }
-
-    return filtered;
-  }, [data, hideDotFiles]);
+  // Dot-file visibility is handled upstream by useFileSelector (which keeps a
+  // dialog-local override), so the incoming data is already filtered.
+  const displayFiles = data;
 
   const columns = useMemo<ColumnDef<FileOrFolder>[]>(
     () => [
diff --git a/frontend/src/hooks/useFileSelector.ts b/frontend/src/hooks/useFileSelector.ts
index 15f3928d..d95393c1 100644
--- a/frontend/src/hooks/useFileSelector.ts
+++ b/frontend/src/hooks/useFileSelector.ts
@@ -47,8 +47,7 @@ type FileSelectorOptions = {
 
 export default function useFileSelector(options?: FileSelectorOptions) {
   const { zonesAndFspQuery } = useZoneAndFspMapContext();
-  const { pathPreference, isFilteredByGroups, hideDotFiles } =
-    usePreferencesContext();
+  const { pathPreference, isFilteredByGroups } = usePreferencesContext();
   const { profile } = useProfileContext();
 
   const initialLocation = options?.initialLocation;
@@ -95,16 +94,13 @@ export default function useFileSelector(options?: FileSelectorOptions) {
     selectedItem: null
   });
 
-  // Local-only dot-file visibility for the dialog: null follows the global
-  // preference; once the user toggles inside the dialog it overrides locally
+  // Local-only dot-file visibility for the dialog. Always starts hidden,
+  // ignoring the global preference; the user can toggle it within the dialog
   // without ever writing the global preference.
-  const [hideDotFilesOverride, setHideDotFilesOverride] = useState<
-    boolean | null
-  >(null);
-  const hideDotFilesEffective = hideDotFilesOverride ?? hideDotFiles;
+  const [hideDotFilesLocal, setHideDotFilesLocal] = useState<boolean>(true);
   const toggleHideDotFiles = useCallback(() => {
-    setHideDotFilesOverride(prev => !(prev ?? hideDotFiles));
-  }, [hideDotFiles]);
+    setHideDotFilesLocal(prev => !prev);
+  }, []);
 
   // If the profile (and thus home) resolves only after mount, apply the home
   // default once, as long as the user hasn't already navigated away.
@@ -292,7 +288,7 @@ export default function useFileSelector(options?: FileSelectorOptions) {
     } else {
       // In filesystem mode, return files from query
       let files = fileQuery.data?.files || [];
-      if (hideDotFilesEffective) {
+      if (hideDotFilesLocal) {
         files = files.filter(item => !item.name.startsWith('.'));
       }
       if (normalizedQuery) {
@@ -310,7 +306,7 @@ export default function useFileSelector(options?: FileSelectorOptions) {
     isFilteredByGroups,
     profile,
     normalizedQuery,
-    hideDotFilesEffective
+    hideDotFilesLocal
   ]);
 
   // Navigation methods
@@ -333,7 +329,7 @@ export default function useFileSelector(options?: FileSelectorOptions) {
   const reset = useCallback(() => {
     lastResolvedPath.current = undefined;
     setSearchQuery('');
-    setHideDotFilesOverride(null);
+    setHideDotFilesLocal(true);
     setState({
       currentLocation: defaultLocation,
       selectedItem: null
@@ -478,7 +474,7 @@ export default function useFileSelector(options?: FileSelectorOptions) {
     clearSearch,
     isFilteredByGroups,
     userHasGroups,
-    hideDotFiles: hideDotFilesEffective,
+    hideDotFiles: hideDotFilesLocal,
     toggleHideDotFiles
   };
 }

From 38f27f35dd8b8ade79b03cdca1ee90a1c3c81630 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Thu, 2 Jul 2026 10:13:53 -0400
Subject: [PATCH 17/89] feat(files): added path display/input box to path
 selection dialog

---
 .../ui/FileSelector/FileSelectorButton.tsx    | 46 ++++++++++++++++++-
 frontend/src/hooks/useFileSelector.ts         | 37 +++++++++++++++
 2 files changed, 82 insertions(+), 1 deletion(-)

diff --git a/frontend/src/components/ui/FileSelector/FileSelectorButton.tsx b/frontend/src/components/ui/FileSelector/FileSelectorButton.tsx
index 54c66f47..e3cf07c8 100644
--- a/frontend/src/components/ui/FileSelector/FileSelectorButton.tsx
+++ b/frontend/src/components/ui/FileSelector/FileSelectorButton.tsx
@@ -1,5 +1,5 @@
 import { useState, useEffect } from 'react';
-import type { ChangeEvent, FormEvent, MouseEvent } from 'react';
+import type { ChangeEvent, FormEvent, KeyboardEvent, MouseEvent } from 'react';
 import { IconButton, Input, Typography } from '@material-tailwind/react';
 import { HiOutlineFolder, HiOutlineFunnel, HiXMark } from 'react-icons/hi2';
 import { HiHome, HiFolderAdd, HiEye, HiEyeOff } from 'react-icons/hi';
@@ -60,6 +60,9 @@ export default function FileSelectorButton({
   const [showDialog, setShowDialog] = useState(false);
   const [showNewFolder, setShowNewFolder] = useState(false);
   const [newFolderName, setNewFolderName] = useState('');
+  // Editable path field: local while typing, kept in sync with the current
+  // selection/location so pasting a path can navigate the browser there.
+  const [pathInput, setPathInput] = useState('');
 
   // Use initialPath if provided, otherwise fall back to last confirmed selection's parent
   const effectiveInitialPath =
@@ -71,8 +74,10 @@ export default function FileSelectorButton({
     fileQuery,
     zonesQuery,
     navigateToLocation,
+    navigateToRawPath,
     navigateHome,
     canGoHome,
+    currentPathDisplay,
     selectItem,
     handleItemDoubleClick,
     reset,
@@ -105,6 +110,22 @@ export default function FileSelectorButton({
     }
   }, [showDialog, selectItem]);
 
+  // Reflect the current selection/location in the editable path field.
+  useEffect(() => {
+    setPathInput(currentPathDisplay);
+  }, [currentPathDisplay]);
+
+  const handlePathInputSubmit = () => {
+    const trimmed = pathInput.trim();
+    if (!trimmed || trimmed === currentPathDisplay) {
+      return;
+    }
+    if (!navigateToRawPath(trimmed)) {
+      toast.error('No file share found for that path');
+      setPathInput(currentPathDisplay);
+    }
+  };
+
   const resetNewFolder = () => {
     setShowNewFolder(false);
     setNewFolderName('');
@@ -350,6 +371,29 @@ export default function FileSelectorButton({
             </div>
           ) : null}
 
+          {/* Editable path: paste a path here to navigate the browser there */}
+          <div className="mb-4">
+            <Typography className="mb-1 text-sm text-foreground/60">
+              Path
+            </Typography>
+            <FgInput
+              className="font-mono"
+              onBlur={handlePathInputSubmit}
+              onChange={(event: ChangeEvent<HTMLInputElement>) =>
+                setPathInput(event.target.value)
+              }
+              onKeyDown={(event: KeyboardEvent<HTMLInputElement>) => {
+                if (event.key === 'Enter') {
+                  event.preventDefault();
+                  handlePathInputSubmit();
+                }
+              }}
+              placeholder="Type or paste a path to navigate ..."
+              type="text"
+              value={pathInput}
+            />
+          </div>
+
           {/* Action buttons */}
           <div className="flex justify-end gap-2 mt-4">
             <FgButton onClick={handleCancel} variant="ghost">
diff --git a/frontend/src/hooks/useFileSelector.ts b/frontend/src/hooks/useFileSelector.ts
index d95393c1..ef29dce4 100644
--- a/frontend/src/hooks/useFileSelector.ts
+++ b/frontend/src/hooks/useFileSelector.ts
@@ -193,6 +193,20 @@ export default function useFileSelector(options?: FileSelectorOptions) {
     return (zonesAndFspQuery.data?.[fspKey] as FileSharePath) || null;
   }, [state.currentLocation, zonesAndFspQuery.data]);
 
+  // Path to show in the editable path field, in the user's preferred format:
+  // the selected item when there is one, otherwise the current folder.
+  const currentPathDisplay = useMemo(() => {
+    if (state.selectedItem) {
+      return state.selectedItem.displayPath;
+    }
+    if (state.currentLocation.type === 'filesystem' && currentFsp) {
+      const subPath =
+        state.currentLocation.path === '.' ? '' : state.currentLocation.path;
+      return getPreferredPathForDisplay(pathPreference, currentFsp, subPath);
+    }
+    return '';
+  }, [state.selectedItem, state.currentLocation, currentFsp, pathPreference]);
+
   // Build the items to display based on current location
   const displayItems = useMemo((): FileOrFolder[] => {
     if (zonesAndFspQuery.isPending || !zonesAndFspQuery.data) {
@@ -318,6 +332,27 @@ export default function useFileSelector(options?: FileSelectorOptions) {
     });
   }, []);
 
+  // Resolve a raw path (in any OS format, e.g. pasted by the user) to an FSP
+  // and navigate the browser into it. Returns false if no FSP matches.
+  const navigateToRawPath = useCallback(
+    (rawPath: string): boolean => {
+      if (!rawPath.trim() || !zonesAndFspQuery.data) {
+        return false;
+      }
+      const resolved = resolvePathToFsp(rawPath, zonesAndFspQuery.data);
+      if (!resolved) {
+        return false;
+      }
+      navigateToLocation({
+        type: 'filesystem',
+        fspName: resolved.fsp.name,
+        path: resolved.subpath || '.'
+      });
+      return true;
+    },
+    [zonesAndFspQuery.data, navigateToLocation]
+  );
+
   // Jump to the user's home directory (no-op until the profile resolves).
   const navigateHome = useCallback(() => {
     if (homeLocation) {
@@ -464,7 +499,9 @@ export default function useFileSelector(options?: FileSelectorOptions) {
     fileQuery,
     zonesQuery: zonesAndFspQuery,
     navigateToLocation,
+    navigateToRawPath,
     navigateHome,
+    currentPathDisplay,
     canGoHome: homeLocation !== undefined,
     selectItem,
     handleItemDoubleClick,

From ca71ff1ca5fe7f565665584e1ed311ef85f24d28 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Thu, 2 Jul 2026 13:07:30 -0400
Subject: [PATCH 18/89] feat(apps): app detail page, card banner with actions
 menu, tabbed launch

Unify the apps UX around a drill-down hierarchy (My Apps > app detail >
entry point launch) with the apps tabs visible throughout:

- App cards get a banner: entry-point type icon (server for services,
  terminal for jobs) and Shared tag on the left, Launch button and a
  vertical-ellipsis actions menu (Launch/View/Share|Unshare/Update/
  Remove) on the right, replacing the corner icon buttons and bottom
  Launch button. The whole card is clickable and opens the detail page.
- New app detail page replaces AppInfoDialog: info table, per-entry-
  point Launch buttons, visible Share/Unshare and Update buttons, and
  Remove tucked in the ellipsis menu.
- Launch/relaunch routes move inside AppsLayout so the tabs stay
  visible; the "Back to Apps" button is replaced by a shared
  back-arrow + app-name header. Back arrows walk up one level:
  launch -> detail (when installed), detail -> My Apps.
- My Apps tab stays highlighted on detail/launch/relaunch pages.
- App action mutations + share/remove dialogs consolidated into a
  reusable useAppActions hook shared by the cards and detail page.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 frontend/src/App.tsx                          |  61 ++--
 .../src/__tests__/unitTests/appUrls.test.ts   |  13 +
 frontend/src/components/AppDetail.tsx         | 209 +++++++++++++
 frontend/src/components/AppLaunch.tsx         |  35 ++-
 frontend/src/components/Apps.tsx              | 102 +-----
 .../ui/AppsPage/AppActionDialogs.tsx          |  32 ++
 .../src/components/ui/AppsPage/AppCard.tsx    | 230 +++++---------
 .../components/ui/AppsPage/AppInfoDialog.tsx  | 290 ------------------
 .../components/ui/AppsPage/AppInfoTable.tsx   |  49 +++
 .../components/ui/AppsPage/AppPageHeader.tsx  |  61 ++++
 .../components/ui/AppsPage/ShareAppDialog.tsx | 126 ++++++++
 .../components/ui/Menus/DataLinksActions.tsx  |  10 +-
 frontend/src/hooks/useAppActions.ts           | 139 +++++++++
 frontend/src/layouts/AppsLayout.tsx           |  25 +-
 frontend/src/utils/appIcons.ts                |  18 ++
 frontend/src/utils/appUrls.ts                 |  16 +
 frontend/src/utils/index.ts                   |   4 +
 17 files changed, 821 insertions(+), 599 deletions(-)
 create mode 100644 frontend/src/components/AppDetail.tsx
 create mode 100644 frontend/src/components/ui/AppsPage/AppActionDialogs.tsx
 delete mode 100644 frontend/src/components/ui/AppsPage/AppInfoDialog.tsx
 create mode 100644 frontend/src/components/ui/AppsPage/AppInfoTable.tsx
 create mode 100644 frontend/src/components/ui/AppsPage/AppPageHeader.tsx
 create mode 100644 frontend/src/components/ui/AppsPage/ShareAppDialog.tsx
 create mode 100644 frontend/src/hooks/useAppActions.ts
 create mode 100644 frontend/src/utils/appIcons.ts

diff --git a/frontend/src/App.tsx b/frontend/src/App.tsx
index 7b05f1eb..12b66b2e 100644
--- a/frontend/src/App.tsx
+++ b/frontend/src/App.tsx
@@ -10,6 +10,7 @@ import { OtherPagesLayout } from './layouts/OtherPagesLayout';
 import AppsLayout from './layouts/AppsLayout';
 import Login from '@/components/Login';
 import Apps from '@/components/Apps';
+import AppDetail from '@/components/AppDetail';
 import Catalog from '@/components/Catalog';
 import AppJobs from '@/components/AppJobs';
 import AppLaunch from '@/components/AppLaunch';
@@ -128,50 +129,26 @@ const AppComponent = () => {
               <Route element={<Apps />} index />
               <Route element={<Catalog />} path="catalog" />
               <Route element={<AppJobs />} path="jobs" />
-              {/* Render job detail inside the layout so the My Apps / App
-                  Catalog / Jobs tabs stay visible when drilling into a job. */}
+              {/* Render job/app detail and launch inside the layout so the
+                  My Apps / App Catalog / Jobs tabs stay visible when drilling
+                  into a job or an app. */}
               <Route element={<JobDetail />} path="jobs/:jobId" />
+              <Route element={<AppDetail />} path="detail/:owner/:repo" />
+              <Route
+                element={<AppLaunch />}
+                path="launch/:owner/:repo/:branch/:entryPointId"
+              />
+              <Route
+                element={<AppLaunch />}
+                path="launch/:owner/:repo/:branch"
+              />
+              <Route element={<AppLaunch />} path="launch/:owner/:repo" />
+              <Route
+                element={<AppLaunch />}
+                path="relaunch/:owner/:repo/:branch/:entryPointId"
+              />
+              <Route element={<AppLaunch />} path="relaunch/:owner/:repo" />
             </Route>
-            <Route
-              element={
-                <RequireAuth>
-                  <AppLaunch />
-                </RequireAuth>
-              }
-              path="apps/launch/:owner/:repo/:branch/:entryPointId"
-            />
-            <Route
-              element={
-                <RequireAuth>
-                  <AppLaunch />
-                </RequireAuth>
-              }
-              path="apps/launch/:owner/:repo/:branch"
-            />
-            <Route
-              element={
-                <RequireAuth>
-                  <AppLaunch />
-                </RequireAuth>
-              }
-              path="apps/launch/:owner/:repo"
-            />
-            <Route
-              element={
-                <RequireAuth>
-                  <AppLaunch />
-                </RequireAuth>
-              }
-              path="apps/relaunch/:owner/:repo/:branch/:entryPointId"
-            />
-            <Route
-              element={
-                <RequireAuth>
-                  <AppLaunch />
-                </RequireAuth>
-              }
-              path="apps/relaunch/:owner/:repo"
-            />
             {tasksEnabled ? (
               <Route
                 element={
diff --git a/frontend/src/__tests__/unitTests/appUrls.test.ts b/frontend/src/__tests__/unitTests/appUrls.test.ts
index b86950c1..0ee8a138 100644
--- a/frontend/src/__tests__/unitTests/appUrls.test.ts
+++ b/frontend/src/__tests__/unitTests/appUrls.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, test } from 'vitest';
 
 import {
+  buildAppDetailPath,
   buildAppUrl,
   buildLaunchPath,
   buildRelaunchPath,
@@ -87,6 +88,18 @@ describe('app URL helpers', () => {
     );
   });
 
+  test('builds detail paths, omitting the default branch and empty manifest path', () => {
+    expect(buildAppDetailPath('https://github.com/org/tool', '')).toBe(
+      '/apps/detail/org/tool'
+    );
+    expect(
+      buildAppDetailPath(
+        'https://github.com/org/tool/tree/feature/my-tool',
+        'apps/demo'
+      )
+    ).toBe('/apps/detail/org/tool?branch=feature%2Fmy-tool&path=apps%2Fdemo');
+  });
+
   test('builds relaunch paths with slash branches in the query string', () => {
     expect(buildRelaunchPath('org', 'tool', 'release/2026-06', 'run')).toBe(
       '/apps/relaunch/org/tool?branch=release%2F2026-06&entryPointId=run'
diff --git a/frontend/src/components/AppDetail.tsx b/frontend/src/components/AppDetail.tsx
new file mode 100644
index 00000000..2b1f03fe
--- /dev/null
+++ b/frontend/src/components/AppDetail.tsx
@@ -0,0 +1,209 @@
+import { useNavigate, useParams, useSearchParams } from 'react-router';
+import { Card, Typography } from '@material-tailwind/react';
+import { HiOutlinePlay, HiOutlineRefresh } from 'react-icons/hi';
+import { HiOutlineEllipsisVertical } from 'react-icons/hi2';
+import { FaUsers, FaUsersSlash } from 'react-icons/fa6';
+
+import AppActionDialogs from '@/components/ui/AppsPage/AppActionDialogs';
+import AppInfoTable from '@/components/ui/AppsPage/AppInfoTable';
+import AppPageHeader from '@/components/ui/AppsPage/AppPageHeader';
+import DataLinksActionsMenu from '@/components/ui/Menus/DataLinksActions';
+import type { MenuItem } from '@/components/ui/Menus/FgMenuItems';
+import FgButton from '@/components/designSystem/atoms/FgButton';
+import FgIcon from '@/components/designSystem/atoms/FgIcon';
+import FgTooltip from '@/components/ui/widgets/FgTooltip';
+import { useAppsQuery } from '@/queries/appsQueries';
+import { useAppActions } from '@/hooks/useAppActions';
+import {
+  buildGithubUrl,
+  canonicalGithubUrl,
+  getAppIconType,
+  getEntryPointIconType
+} from '@/utils';
+import type { UserApp } from '@/shared.types';
+
+export default function AppDetail() {
+  const { owner, repo } = useParams<{ owner: string; repo: string }>();
+  const [searchParams] = useSearchParams();
+  const navigate = useNavigate();
+  const appsQuery = useAppsQuery();
+  const actions = useAppActions({ onRemoved: () => navigate('/apps') });
+
+  const manifestPath = searchParams.get('path') || '';
+  const branch = searchParams.get('branch') || 'main';
+  const appUrl = buildGithubUrl(owner!, repo!, branch);
+
+  // Match by canonical URL identity rather than exact string, since stored app
+  // URLs may carry cosmetic variations (".git" suffix, trailing slash,
+  // "/tree/main") that don't survive the round-trip through the route.
+  const app = appsQuery.data?.find(
+    a =>
+      canonicalGithubUrl(a.url) === appUrl && a.manifest_path === manifestPath
+  );
+
+  if (appsQuery.isPending) {
+    return (
+      <Typography className="text-foreground" type="small">
+        Loading app...
+      </Typography>
+    );
+  }
+
+  if (appsQuery.isError) {
+    return (
+      <div className="p-3 bg-error/10 rounded text-error text-sm">
+        Failed to load apps: {appsQuery.error?.message || 'Unknown error'}
+      </div>
+    );
+  }
+
+  if (!app) {
+    return (
+      <div>
+        <AppPageHeader title="App not found" />
+        <Typography className="text-foreground mb-4">
+          This app is not in your apps. It may have been removed.
+        </Typography>
+        <FgButton onClick={() => navigate('/apps')} variant="outline">
+          Go to My Apps
+        </FgButton>
+      </div>
+    );
+  }
+
+  const isShared = app.listing_id !== undefined && app.listing_id !== null;
+  const runnables = app.manifest?.runnables ?? [];
+
+  const menuItems: MenuItem<UserApp>[] = [
+    {
+      name: 'Remove',
+      action: a => actions.requestRemove(a),
+      color: 'text-error'
+    }
+  ];
+
+  return (
+    <div>
+      <AppPageHeader
+        actions={
+          <>
+            {isShared ? (
+              <FgTooltip label="Unshare from catalog">
+                <FgButton
+                  disabled={actions.unsharing}
+                  icon={FaUsersSlash}
+                  loading={actions.unsharing}
+                  loadingText="Unsharing..."
+                  onClick={() => void actions.unshare(app)}
+                  size="sm"
+                  variant="outline"
+                >
+                  Unshare
+                </FgButton>
+              </FgTooltip>
+            ) : (
+              <FgTooltip label="Share to catalog">
+                <FgButton
+                  icon={FaUsers}
+                  onClick={() => actions.requestShare(app)}
+                  size="sm"
+                  variant="outline"
+                >
+                  Share to Catalog
+                </FgButton>
+              </FgTooltip>
+            )}
+            <FgTooltip label="Update to the latest version">
+              <FgButton
+                disabled={actions.updating}
+                icon={HiOutlineRefresh}
+                loading={actions.updating}
+                loadingText="Updating..."
+                onClick={() => void actions.update(app)}
+                size="sm"
+                variant="outline"
+              >
+                Update
+              </FgButton>
+            </FgTooltip>
+            {runnables.length === 0 ? (
+              <FgButton
+                icon={HiOutlinePlay}
+                onClick={() => actions.launch(app)}
+                size="sm"
+              >
+                Launch
+              </FgButton>
+            ) : null}
+            <DataLinksActionsMenu<UserApp>
+              actionProps={app}
+              menuItems={menuItems}
+              triggerIcon={HiOutlineEllipsisVertical}
+            />
+          </>
+        }
+        icon={getAppIconType(app.manifest)}
+        title={app.name}
+      >
+        {isShared ? (
+          <span className="inline-block px-2 py-0.5 rounded-sm bg-success/10 text-success text-xs font-medium flex-shrink-0">
+            Shared
+          </span>
+        ) : null}
+      </AppPageHeader>
+
+      <div className="max-w-2xl">
+        <AppInfoTable app={app} />
+
+        {runnables.length > 0 ? (
+          <>
+            <Typography
+              className="text-foreground font-semibold mb-3"
+              type="h6"
+            >
+              Entry Points
+            </Typography>
+            <div className="space-y-4">
+              {runnables.map(ep => (
+                <Card
+                  className="p-4 flex flex-col gap-2 text-left w-full dark:border-surface-light"
+                  key={ep.id}
+                >
+                  <div className="flex items-center gap-2">
+                    <FgIcon
+                      className="text-foreground"
+                      icon={getEntryPointIconType(ep)}
+                    />
+                    <Typography className="text-foreground font-semibold">
+                      {ep.name}
+                    </Typography>
+                    {ep.type === 'service' ? (
+                      <span className="inline-flex items-center px-1.5 py-0.5 rounded text-[10px] font-medium bg-info/10 text-info border border-info/30">
+                        Service
+                      </span>
+                    ) : null}
+                  </div>
+                  {ep.description ? (
+                    <Typography className="text-sm md:text-base text-foreground">
+                      {ep.description}
+                    </Typography>
+                  ) : null}
+                  <FgButton
+                    className="self-start"
+                    icon={HiOutlinePlay}
+                    onClick={() => actions.launch(app, ep.id)}
+                    size="sm"
+                  >
+                    Launch
+                  </FgButton>
+                </Card>
+              ))}
+            </div>
+          </>
+        ) : null}
+      </div>
+
+      <AppActionDialogs actions={actions} />
+    </div>
+  );
+}
diff --git a/frontend/src/components/AppLaunch.tsx b/frontend/src/components/AppLaunch.tsx
index c66856a5..8e09605b 100644
--- a/frontend/src/components/AppLaunch.tsx
+++ b/frontend/src/components/AppLaunch.tsx
@@ -7,15 +7,17 @@ import {
 } from 'react-router';
 
 import { Card, Typography } from '@material-tailwind/react';
-import {
-  HiOutlineArrowLeft,
-  HiOutlineDownload,
-  HiOutlinePlay
-} from 'react-icons/hi';
+import { HiOutlineDownload, HiOutlinePlay } from 'react-icons/hi';
 import toast from 'react-hot-toast';
 
 import AppLaunchForm from '@/components/ui/AppsPage/AppLaunchForm';
-import { buildGithubUrl, canonicalGithubUrl } from '@/utils';
+import AppPageHeader from '@/components/ui/AppsPage/AppPageHeader';
+import {
+  buildAppDetailPath,
+  buildGithubUrl,
+  canonicalGithubUrl,
+  getAppIconType
+} from '@/utils';
 import {
   useAppsQuery,
   useAddAppMutation,
@@ -178,14 +180,16 @@ export default function AppLaunch() {
 
   return (
     <div>
-      <FgButton
-        className="mb-6"
-        icon={HiOutlineArrowLeft}
-        onClick={() => navigate('/apps')}
-        variant="outline"
-      >
-        Back to Apps
-      </FgButton>
+      <AppPageHeader
+        backLabel={installedApp ? 'Back to app details' : 'Back to My Apps'}
+        backTo={
+          installedApp
+            ? buildAppDetailPath(installedApp.url, installedApp.manifest_path)
+            : '/apps'
+        }
+        icon={manifest ? getAppIconType(manifest) : undefined}
+        title={displayName}
+      />
 
       {/* Not-installed banner */}
       {!appsQuery.isPending && !isInstalled ? (
@@ -257,9 +261,6 @@ export default function AppLaunch() {
         />
       ) : manifest ? (
         <div className="max-w-2xl">
-          <Typography className="font-bold mb-1" type="h5">
-            {displayName}
-          </Typography>
           {manifest.description ? (
             <Typography className="mb-6">{manifest.description}</Typography>
           ) : null}
diff --git a/frontend/src/components/Apps.tsx b/frontend/src/components/Apps.tsx
index 039558d2..cbc66f63 100644
--- a/frontend/src/components/Apps.tsx
+++ b/frontend/src/components/Apps.tsx
@@ -6,86 +6,24 @@ import toast from 'react-hot-toast';
 
 import AppCard from '@/components/ui/AppsPage/AppCard';
 import AddAppDialog from '@/components/ui/AppsPage/AddAppDialog';
-import DeleteAppDialog from '@/components/ui/AppsPage/DeleteAppDialog';
+import AppActionDialogs from '@/components/ui/AppsPage/AppActionDialogs';
 import {
   useAppsQuery,
   useAddAppMutation,
-  useDiscoverAppsMutation,
-  useUpdateAppMutation,
-  useRemoveAppMutation,
-  useShareAppMutation,
-  useUnshareListingMutation
+  useDiscoverAppsMutation
 } from '@/queries/appsQueries';
+import { useAppActions } from '@/hooks/useAppActions';
 import FgButton from './designSystem/atoms/FgButton';
 import FgExternalLink from '@/components/designSystem/atoms/FgExternalLink';
 import { DOCS_BASE_URL } from '@/constants/docs';
-import type { UserApp } from '@/shared.types';
 
 export default function Apps() {
-  const [deleteApp, setDeleteApp] = useState<UserApp | null>(null);
   const [showAddDialog, setShowAddDialog] = useState(false);
 
   const appsQuery = useAppsQuery();
   const addAppMutation = useAddAppMutation();
   const discoverAppsMutation = useDiscoverAppsMutation();
-  const updateAppMutation = useUpdateAppMutation();
-  const removeAppMutation = useRemoveAppMutation();
-  const shareAppMutation = useShareAppMutation();
-  const unshareListingMutation = useUnshareListingMutation();
-
-  const handleRequestRemove = (app: UserApp) => {
-    setDeleteApp(app);
-  };
-
-  const handleConfirmDelete = async () => {
-    if (!deleteApp) {
-      return;
-    }
-    try {
-      await removeAppMutation.mutateAsync({
-        url: deleteApp.url,
-        manifest_path: deleteApp.manifest_path
-      });
-      toast.success('App removed');
-      setDeleteApp(null);
-    } catch (error) {
-      const message =
-        error instanceof Error ? error.message : 'Failed to remove app';
-      toast.error(message);
-    }
-  };
-
-  const handleUpdateApp = async ({
-    url,
-    manifest_path
-  }: {
-    url: string;
-    manifest_path: string;
-  }) => {
-    try {
-      await updateAppMutation.mutateAsync({ url, manifest_path });
-      toast.success('App updated');
-    } catch (error) {
-      const message =
-        error instanceof Error ? error.message : 'Failed to update app';
-      toast.error(message);
-    }
-  };
-
-  const handleShare = async (params: {
-    url: string;
-    manifest_path: string;
-    name: string;
-    description: string;
-  }) => {
-    await shareAppMutation.mutateAsync({
-      url: params.url,
-      manifest_path: params.manifest_path,
-      name: params.name,
-      description: params.description
-    });
-    toast.success('Shared to catalog');
-  };
+  const actions = useAppActions();
 
   const handleDiscover = (url: string) => discoverAppsMutation.mutateAsync(url);
 
@@ -99,17 +37,6 @@ export default function Apps() {
     setShowAddDialog(false);
   };
 
-  const handleUnshare = async (listingId: number) => {
-    try {
-      await unshareListingMutation.mutateAsync({ listing_id: listingId });
-      toast.success('Removed from catalog');
-    } catch (error) {
-      const message =
-        error instanceof Error ? error.message : 'Failed to unshare';
-      toast.error(message);
-    }
-  };
-
   return (
     <div>
       <Typography className="mb-6 text-foreground">
@@ -144,20 +71,9 @@ export default function Apps() {
         <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-4 mb-8">
           {appsQuery.data.map(app => (
             <AppCard
+              actions={actions}
               app={app}
               key={`${app.url}::${app.manifest_path}`}
-              onRemove={() => handleRequestRemove(app)}
-              onShare={handleShare}
-              onUnshare={() =>
-                app.listing_id !== undefined
-                  ? handleUnshare(app.listing_id)
-                  : undefined
-              }
-              onUpdate={handleUpdateApp}
-              removing={removeAppMutation.isPending}
-              sharing={shareAppMutation.isPending}
-              unsharing={unshareListingMutation.isPending}
-              updating={updateAppMutation.isPending}
             />
           ))}
         </div>
@@ -178,13 +94,7 @@ export default function Apps() {
         onDiscover={handleDiscover}
         open={showAddDialog}
       />
-      <DeleteAppDialog
-        app={deleteApp}
-        onClose={() => setDeleteApp(null)}
-        onConfirm={handleConfirmDelete}
-        open={deleteApp !== null}
-        removing={removeAppMutation.isPending}
-      />
+      <AppActionDialogs actions={actions} />
     </div>
   );
 }
diff --git a/frontend/src/components/ui/AppsPage/AppActionDialogs.tsx b/frontend/src/components/ui/AppsPage/AppActionDialogs.tsx
new file mode 100644
index 00000000..9f2908b5
--- /dev/null
+++ b/frontend/src/components/ui/AppsPage/AppActionDialogs.tsx
@@ -0,0 +1,32 @@
+import DeleteAppDialog from '@/components/ui/AppsPage/DeleteAppDialog';
+import ShareAppDialog from '@/components/ui/AppsPage/ShareAppDialog';
+import type { AppActions } from '@/hooks/useAppActions';
+
+/**
+ * The confirmation/share dialogs backing the two-step app actions from
+ * `useAppActions`. Render once per page that uses the hook.
+ */
+export default function AppActionDialogs({
+  actions
+}: {
+  readonly actions: AppActions;
+}) {
+  return (
+    <>
+      <ShareAppDialog
+        app={actions.shareTarget}
+        onClose={actions.closeShare}
+        onShare={actions.share}
+        open={actions.shareTarget !== null}
+        sharing={actions.sharing}
+      />
+      <DeleteAppDialog
+        app={actions.removeTarget}
+        onClose={actions.closeRemove}
+        onConfirm={actions.confirmRemove}
+        open={actions.removeTarget !== null}
+        removing={actions.removing}
+      />
+    </>
+  );
+}
diff --git a/frontend/src/components/ui/AppsPage/AppCard.tsx b/frontend/src/components/ui/AppsPage/AppCard.tsx
index b214a059..4e0701a4 100644
--- a/frontend/src/components/ui/AppsPage/AppCard.tsx
+++ b/frontend/src/components/ui/AppsPage/AppCard.tsx
@@ -1,174 +1,114 @@
-import { useState } from 'react';
-import { useNavigate } from 'react-router';
+import type { KeyboardEvent } from 'react';
 
-import { Card, IconButton, Typography } from '@material-tailwind/react';
-import { buildLaunchPathFromApp } from '@/utils';
-import {
-  HiOutlineInformationCircle,
-  HiOutlinePlay,
-  HiOutlineTrash
-} from 'react-icons/hi';
-import { FaUsers, FaUsersSlash } from 'react-icons/fa6';
+import { Card, Typography } from '@material-tailwind/react';
+import { HiOutlinePlay } from 'react-icons/hi';
+import { HiOutlineEllipsisVertical } from 'react-icons/hi2';
 
-import AppInfoDialog from '@/components/ui/AppsPage/AppInfoDialog';
+import DataLinksActionsMenu from '@/components/ui/Menus/DataLinksActions';
+import type { MenuItem } from '@/components/ui/Menus/FgMenuItems';
+import FgButton from '@/components/designSystem/atoms/FgButton';
 import FgIcon from '@/components/designSystem/atoms/FgIcon';
 import FgTooltip from '@/components/ui/widgets/FgTooltip';
+import type { AppActions } from '@/hooks/useAppActions';
+import { getAppIconType } from '@/utils';
 import type { UserApp } from '@/shared.types';
-import FgButton from '@/components/designSystem/atoms/FgButton';
 
 interface AppCardProps {
   readonly app: UserApp;
-  readonly onRemove: () => void;
-  readonly onUpdate: (params: { url: string; manifest_path: string }) => void;
-  readonly onShare: (params: {
-    url: string;
-    manifest_path: string;
-    name: string;
-    description: string;
-  }) => Promise<void>;
-  readonly onUnshare: () => void;
-  readonly removing: boolean;
-  readonly updating: boolean;
-  readonly sharing: boolean;
-  readonly unsharing: boolean;
+  readonly actions: AppActions;
 }
 
-export default function AppCard({
-  app,
-  onRemove,
-  onUpdate,
-  onShare,
-  onUnshare,
-  removing,
-  updating,
-  sharing,
-  unsharing
-}: AppCardProps) {
-  const navigate = useNavigate();
-  const [infoOpen, setInfoOpen] = useState(false);
-  const [startInShareView, setStartInShareView] = useState(false);
-
+export default function AppCard({ app, actions }: AppCardProps) {
   const isShared = app.listing_id !== undefined && app.listing_id !== null;
 
-  const handleLaunch = () => {
-    navigate(buildLaunchPathFromApp(app.url, app.manifest_path));
-  };
+  const menuItems: MenuItem<UserApp>[] = [
+    { name: 'Launch', action: a => actions.launch(a) },
+    { name: 'View', action: a => actions.view(a) },
+    {
+      name: 'Share to Catalog',
+      action: a => actions.requestShare(a),
+      shouldShow: !isShared
+    },
+    {
+      name: 'Unshare',
+      action: a => void actions.unshare(a),
+      shouldShow: isShared
+    },
+    { name: 'Update', action: a => void actions.update(a) },
+    {
+      name: 'Remove',
+      action: a => actions.requestRemove(a),
+      color: 'text-error'
+    }
+  ];
 
-  const handleInfo = () => {
-    setStartInShareView(false);
-    setInfoOpen(true);
-  };
+  const handleView = () => actions.view(app);
 
-  const handleShare = () => {
-    setStartInShareView(true);
-    setInfoOpen(true);
+  const handleKeyDown = (event: KeyboardEvent<HTMLDivElement>) => {
+    if (
+      (event.key === 'Enter' || event.key === ' ') &&
+      event.target === event.currentTarget
+    ) {
+      event.preventDefault();
+      handleView();
+    }
   };
 
   return (
-    <Card className="p-4 flex flex-col gap-3 text-left w-full dark:border-surface-light">
-      <div className="flex items-center justify-between">
-        <Typography
-          className="text-foreground font-semibold truncate"
-          type="h6"
-        >
-          {app.name}
-        </Typography>
-        <div className="flex flex-shrink-0">
-          <FgTooltip label="App info">
-            <IconButton
-              className="text-foreground hover:text-primary"
-              onClick={handleInfo}
-              size="sm"
-              variant="ghost"
-            >
-              <FgIcon icon={HiOutlineInformationCircle} />
-            </IconButton>
-          </FgTooltip>
+    <Card
+      className="p-0 flex flex-col text-left w-full dark:border-surface-light cursor-pointer transition-colors hover:bg-surface dark:hover:bg-surface-light"
+      onClick={handleView}
+      onKeyDown={handleKeyDown}
+      role="link"
+      tabIndex={0}
+    >
+      <div className="px-3 py-2 rounded-t-lg bg-surface dark:bg-surface-light border-b border-surface-light dark:border-surface flex items-center justify-between gap-2">
+        <div className="flex items-center gap-2 min-w-0">
+          <FgIcon
+            className="text-foreground flex-shrink-0"
+            icon={getAppIconType(app.manifest)}
+          />
           {isShared ? (
-            <FgTooltip label="Unshare from catalog">
-              <IconButton
-                className="text-foreground hover:text-error"
-                disabled={unsharing}
-                onClick={onUnshare}
-                size="sm"
-                variant="ghost"
-              >
-                <FgIcon icon={FaUsersSlash} />
-              </IconButton>
-            </FgTooltip>
-          ) : (
-            <FgTooltip label="Share to catalog">
-              <IconButton
-                className="text-foreground hover:text-primary"
-                disabled={sharing}
-                onClick={handleShare}
-                size="sm"
-                variant="ghost"
-              >
-                <FgIcon icon={FaUsers} />
-              </IconButton>
-            </FgTooltip>
-          )}
-          <FgTooltip label="Remove app">
-            <IconButton
-              className="text-foreground hover:text-error"
-              disabled={removing}
-              onClick={onRemove}
+            <span className="inline-block px-2 py-0.5 rounded-sm bg-success/10 text-success text-xs font-medium">
+              Shared
+            </span>
+          ) : null}
+        </div>
+        <div
+          className="flex items-center gap-1"
+          onClick={e => e.stopPropagation()}
+        >
+          <FgTooltip label="Launch this app">
+            <FgButton
+              icon={HiOutlinePlay}
+              onClick={() => actions.launch(app)}
               size="sm"
-              variant="ghost"
             >
-              <FgIcon icon={HiOutlineTrash} />
-            </IconButton>
+              Launch
+            </FgButton>
           </FgTooltip>
+          <DataLinksActionsMenu<UserApp>
+            actionProps={app}
+            menuItems={menuItems}
+            triggerIcon={HiOutlineEllipsisVertical}
+          />
         </div>
       </div>
 
-      {isShared ? (
-        <div>
-          <span className="inline-block px-2 py-0.5 rounded-sm bg-success/10 text-success text-xs font-medium">
-            Shared
-          </span>
-        </div>
-      ) : null}
-
-      {app.description ? (
-        <Typography className="text-sm md:text-base text-foreground">
-          {app.description}
+      <div className="p-4 flex flex-col gap-3 flex-1">
+        <Typography
+          className="text-foreground font-semibold truncate"
+          type="h6"
+        >
+          {app.name}
         </Typography>
-      ) : null}
-
-      <FgButton
-        className="self-start mt-auto"
-        icon={HiOutlinePlay}
-        onClick={handleLaunch}
-        size="sm"
-      >
-        Launch
-      </FgButton>
 
-      <AppInfoDialog
-        app={app}
-        onClose={() => setInfoOpen(false)}
-        onLaunch={() => {
-          setInfoOpen(false);
-          handleLaunch();
-        }}
-        onRemove={() => {
-          setInfoOpen(false);
-          onRemove();
-        }}
-        onShare={onShare}
-        onUnshare={onUnshare}
-        onUpdate={() =>
-          onUpdate({ url: app.url, manifest_path: app.manifest_path })
-        }
-        open={infoOpen}
-        removing={removing}
-        sharing={sharing}
-        startInShareView={startInShareView}
-        unsharing={unsharing}
-        updating={updating}
-      />
+        {app.description ? (
+          <Typography className="text-sm md:text-base text-foreground">
+            {app.description}
+          </Typography>
+        ) : null}
+      </div>
     </Card>
   );
 }
diff --git a/frontend/src/components/ui/AppsPage/AppInfoDialog.tsx b/frontend/src/components/ui/AppsPage/AppInfoDialog.tsx
deleted file mode 100644
index 66cb0968..00000000
--- a/frontend/src/components/ui/AppsPage/AppInfoDialog.tsx
+++ /dev/null
@@ -1,290 +0,0 @@
-import { useEffect, useState } from 'react';
-import { Typography } from '@material-tailwind/react';
-import {
-  HiOutlinePlay,
-  HiOutlineRefresh,
-  HiOutlineTrash
-} from 'react-icons/hi';
-import { FaUsers, FaUsersSlash } from 'react-icons/fa6';
-
-import FgDialog from '@/components/ui/Dialogs/FgDialog';
-import type { UserApp } from '@/shared.types';
-import FgButton from '@/components/designSystem/atoms/FgButton';
-import FgExternalLink from '@/components/designSystem/atoms/FgExternalLink';
-import FgTooltip from '@/components/ui/widgets/FgTooltip';
-import { parseGithubUrl } from '@/utils/appUrls';
-
-/**
- * The revision actually cloned, parsed out of the canonical app URL (which
- * always carries it). Falls back to the requested branch, then null.
- */
-function appRevision(app: UserApp): string | null {
-  try {
-    return parseGithubUrl(app.url).branch;
-  } catch {
-    return app.branch || null;
-  }
-}
-
-interface AppInfoDialogProps {
-  readonly app: UserApp;
-  readonly open: boolean;
-  readonly onClose: () => void;
-  readonly onLaunch: () => void;
-  readonly onUpdate: () => void;
-  readonly onRemove: () => void;
-  readonly onShare: (params: {
-    url: string;
-    manifest_path: string;
-    name: string;
-    description: string;
-  }) => Promise<void>;
-  readonly onUnshare: () => void;
-  readonly updating: boolean;
-  readonly removing: boolean;
-  readonly sharing: boolean;
-  readonly unsharing: boolean;
-  readonly startInShareView?: boolean;
-}
-
-function AppInfoTable({ app }: { readonly app: UserApp }) {
-  const labelClass =
-    'text-foreground font-medium pr-4 py-1.5 align-top whitespace-nowrap';
-  const valueClass = 'text-foreground py-1.5';
-  const revision = appRevision(app);
-
-  return (
-    <table className="w-full text-sm mb-6">
-      <tbody>
-        <tr>
-          <td className={labelClass}>URL</td>
-          <td className="py-1.5">
-            <FgExternalLink className="break-all" href={app.url}>
-              {app.url}
-            </FgExternalLink>
-          </td>
-        </tr>
-        {revision ? (
-          <tr>
-            <td className={labelClass}>Revision</td>
-            <td className={valueClass}>{revision}</td>
-          </tr>
-        ) : null}
-        {app.description ? (
-          <tr>
-            <td className={labelClass}>Description</td>
-            <td className={valueClass}>{app.description}</td>
-          </tr>
-        ) : null}
-        {app.manifest?.runnables && app.manifest.runnables.length > 0 ? (
-          <tr>
-            <td className={labelClass}>Entry Points</td>
-            <td className={valueClass}>
-              {app.manifest.runnables.map(ep => ep.name).join(', ')}
-            </td>
-          </tr>
-        ) : null}
-      </tbody>
-    </table>
-  );
-}
-
-export default function AppInfoDialog({
-  app,
-  open,
-  onClose,
-  onLaunch,
-  onUpdate,
-  onRemove,
-  onShare,
-  onUnshare,
-  updating,
-  removing,
-  sharing,
-  unsharing,
-  startInShareView = false
-}: AppInfoDialogProps) {
-  const isShared = app.listing_id !== undefined && app.listing_id !== null;
-
-  // The share form is shown as an inline view within this dialog (rather than a
-  // separate stacked dialog) so the dialog stays open throughout sharing.
-  const [shareView, setShareView] = useState(false);
-  const [name, setName] = useState('');
-  const [description, setDescription] = useState('');
-  const [shareError, setShareError] = useState('');
-
-  const openShareForm = () => {
-    setName(app.name);
-    setDescription(app.description ?? '');
-    setShareError('');
-    setShareView(true);
-  };
-
-  // Open into the share form when requested (and shareable), otherwise always
-  // return to the info view when the dialog is (re)opened.
-  useEffect(() => {
-    if (open) {
-      if (startInShareView && !isShared) {
-        openShareForm();
-      } else {
-        setShareView(false);
-      }
-    }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [open]);
-
-  const handleShareSubmit = async () => {
-    if (!name.trim()) {
-      setShareError('Name is required');
-      return;
-    }
-    try {
-      await onShare({
-        url: app.url,
-        manifest_path: app.manifest_path,
-        name: name.trim(),
-        description: description.trim()
-      });
-      setShareView(false);
-    } catch (e) {
-      setShareError(e instanceof Error ? e.message : 'Failed to share');
-    }
-  };
-
-  return (
-    <FgDialog className="max-w-2xl" onClose={onClose} open={open}>
-      {shareView ? (
-        <>
-          <Typography className="text-foreground font-bold mb-4 pr-8" type="h6">
-            Share to Catalog
-          </Typography>
-          <Typography className="mb-4 text-foreground text-sm">
-            Publish this app so other users can add it to their own collection.
-            You can customize the name and description before sharing without
-            affecting your own copy.
-          </Typography>
-
-          <div className="mb-3">
-            <label className="block text-foreground text-sm font-medium mb-1">
-              Name
-            </label>
-            <input
-              autoFocus
-              className="w-full p-2 text-foreground border rounded-sm focus:outline-none bg-background border-primary-light focus:border-primary"
-              onChange={e => {
-                setName(e.target.value);
-                setShareError('');
-              }}
-              type="text"
-              value={name}
-            />
-          </div>
-
-          <div className="mb-4">
-            <label className="block text-foreground text-sm font-medium mb-1">
-              Description
-              <span className="text-foreground font-normal ml-1">
-                (optional)
-              </span>
-            </label>
-            <textarea
-              className="w-full p-2 text-foreground border rounded-sm focus:outline-none bg-background border-primary-light focus:border-primary"
-              onChange={e => setDescription(e.target.value)}
-              rows={3}
-              value={description}
-            />
-          </div>
-
-          {shareError ? (
-            <Typography className="text-error mb-3" type="small">
-              {shareError}
-            </Typography>
-          ) : null}
-
-          <div className="flex gap-3">
-            <FgButton
-              disabled={!name.trim() || sharing}
-              icon={FaUsers}
-              loading={sharing}
-              loadingText="Sharing..."
-              onClick={handleShareSubmit}
-            >
-              Share
-            </FgButton>
-            <FgButton onClick={() => setShareView(false)} variant="ghost">
-              Cancel
-            </FgButton>
-          </div>
-        </>
-      ) : (
-        <>
-          <Typography className="text-foreground font-bold mb-4 pr-8" type="h6">
-            {app.name}
-          </Typography>
-
-          <AppInfoTable app={app} />
-
-          <div className="flex justify-between">
-            <FgTooltip label="Launch this app">
-              <FgButton icon={HiOutlinePlay} onClick={onLaunch}>
-                Launch
-              </FgButton>
-            </FgTooltip>
-            <div className="flex gap-2">
-              {isShared ? (
-                <FgTooltip label="Unshare from catalog">
-                  <FgButton
-                    disabled={unsharing}
-                    icon={FaUsersSlash}
-                    loading={unsharing}
-                    loadingText="Unsharing..."
-                    onClick={onUnshare}
-                    variant="outline"
-                  >
-                    Unshare
-                  </FgButton>
-                </FgTooltip>
-              ) : (
-                <FgTooltip label="Share to catalog">
-                  <FgButton
-                    icon={FaUsers}
-                    onClick={openShareForm}
-                    variant="outline"
-                  >
-                    Share to Catalog
-                  </FgButton>
-                </FgTooltip>
-              )}
-              <FgTooltip label="Update to the latest version">
-                <FgButton
-                  disabled={updating}
-                  icon={HiOutlineRefresh}
-                  loading={updating}
-                  loadingText="Updating..."
-                  onClick={onUpdate}
-                  variant="outline"
-                >
-                  Update
-                </FgButton>
-              </FgTooltip>
-              <FgTooltip label="Remove from my apps">
-                <FgButton
-                  className="!rounded-md"
-                  color="error"
-                  disabled={removing}
-                  icon={HiOutlineTrash}
-                  loading={removing}
-                  loadingText="Removing..."
-                  onClick={onRemove}
-                  variant="outline"
-                >
-                  Remove
-                </FgButton>
-              </FgTooltip>
-            </div>
-          </div>
-        </>
-      )}
-    </FgDialog>
-  );
-}
diff --git a/frontend/src/components/ui/AppsPage/AppInfoTable.tsx b/frontend/src/components/ui/AppsPage/AppInfoTable.tsx
new file mode 100644
index 00000000..dc1752fb
--- /dev/null
+++ b/frontend/src/components/ui/AppsPage/AppInfoTable.tsx
@@ -0,0 +1,49 @@
+import FgExternalLink from '@/components/designSystem/atoms/FgExternalLink';
+import type { UserApp } from '@/shared.types';
+import { parseGithubUrl } from '@/utils/appUrls';
+
+/**
+ * The revision actually cloned, parsed out of the canonical app URL (which
+ * always carries it). Falls back to the requested branch, then null.
+ */
+function appRevision(app: UserApp): string | null {
+  try {
+    return parseGithubUrl(app.url).branch;
+  } catch {
+    return app.branch || null;
+  }
+}
+
+export default function AppInfoTable({ app }: { readonly app: UserApp }) {
+  const labelClass =
+    'text-foreground font-medium pr-4 py-1.5 align-top whitespace-nowrap';
+  const valueClass = 'text-foreground py-1.5';
+  const revision = appRevision(app);
+
+  return (
+    <table className="w-full text-sm mb-6">
+      <tbody>
+        <tr>
+          <td className={labelClass}>URL</td>
+          <td className="py-1.5">
+            <FgExternalLink className="break-all" href={app.url}>
+              {app.url}
+            </FgExternalLink>
+          </td>
+        </tr>
+        {revision ? (
+          <tr>
+            <td className={labelClass}>Revision</td>
+            <td className={valueClass}>{revision}</td>
+          </tr>
+        ) : null}
+        {app.description ? (
+          <tr>
+            <td className={labelClass}>Description</td>
+            <td className={valueClass}>{app.description}</td>
+          </tr>
+        ) : null}
+      </tbody>
+    </table>
+  );
+}
diff --git a/frontend/src/components/ui/AppsPage/AppPageHeader.tsx b/frontend/src/components/ui/AppsPage/AppPageHeader.tsx
new file mode 100644
index 00000000..f9255306
--- /dev/null
+++ b/frontend/src/components/ui/AppsPage/AppPageHeader.tsx
@@ -0,0 +1,61 @@
+import type { ReactNode } from 'react';
+import { useNavigate } from 'react-router';
+import { IconButton, Typography } from '@material-tailwind/react';
+import { HiOutlineArrowLeft } from 'react-icons/hi';
+import type { IconType } from 'react-icons';
+
+import FgIcon from '@/components/designSystem/atoms/FgIcon';
+import FgTooltip from '@/components/ui/widgets/FgTooltip';
+
+interface AppPageHeaderProps {
+  readonly title?: string;
+  readonly icon?: IconType;
+  readonly backTo?: string;
+  readonly backLabel?: string;
+  readonly actions?: ReactNode;
+  readonly children?: ReactNode;
+}
+
+/**
+ * Header for apps sub-pages (app detail, launch): a back arrow followed by the
+ * app icon and name, with an optional badge (`children`) and a right-aligned
+ * `actions` slot.
+ */
+export default function AppPageHeader({
+  title,
+  icon,
+  backTo = '/apps',
+  backLabel = 'Back to My Apps',
+  actions,
+  children
+}: AppPageHeaderProps) {
+  const navigate = useNavigate();
+
+  return (
+    <div className="mb-6 flex items-center justify-between gap-3">
+      <div className="flex items-center gap-2 min-w-0">
+        <FgTooltip label={backLabel}>
+          <IconButton
+            aria-label={backLabel}
+            className="text-foreground hover:text-primary flex-shrink-0"
+            onClick={() => navigate(backTo)}
+            size="sm"
+            variant="ghost"
+          >
+            <FgIcon icon={HiOutlineArrowLeft} />
+          </IconButton>
+        </FgTooltip>
+        {icon ? (
+          <FgIcon className="text-foreground flex-shrink-0" icon={icon} />
+        ) : null}
+        <Typography className="text-foreground font-bold truncate" type="h6">
+          {title}
+        </Typography>
+        {children}
+      </div>
+      {actions ? (
+        <div className="flex items-center gap-2 flex-shrink-0">{actions}</div>
+      ) : null}
+    </div>
+  );
+}
diff --git a/frontend/src/components/ui/AppsPage/ShareAppDialog.tsx b/frontend/src/components/ui/AppsPage/ShareAppDialog.tsx
new file mode 100644
index 00000000..656d5482
--- /dev/null
+++ b/frontend/src/components/ui/AppsPage/ShareAppDialog.tsx
@@ -0,0 +1,126 @@
+import { useEffect, useState } from 'react';
+import { Typography } from '@material-tailwind/react';
+import { FaUsers } from 'react-icons/fa6';
+
+import FgDialog from '@/components/ui/Dialogs/FgDialog';
+import FgButton from '@/components/designSystem/atoms/FgButton';
+import type { UserApp } from '@/shared.types';
+
+interface ShareAppDialogProps {
+  readonly app: UserApp | null;
+  readonly open: boolean;
+  readonly onClose: () => void;
+  readonly onShare: (params: {
+    url: string;
+    manifest_path: string;
+    name: string;
+    description: string;
+  }) => Promise<void>;
+  readonly sharing: boolean;
+}
+
+export default function ShareAppDialog({
+  app,
+  open,
+  onClose,
+  onShare,
+  sharing
+}: ShareAppDialogProps) {
+  const [name, setName] = useState('');
+  const [description, setDescription] = useState('');
+  const [shareError, setShareError] = useState('');
+
+  // Prefill from the app each time the dialog is (re)opened.
+  useEffect(() => {
+    if (open && app) {
+      setName(app.name);
+      setDescription(app.description ?? '');
+      setShareError('');
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [open]);
+
+  const handleShareSubmit = async () => {
+    if (!app) {
+      return;
+    }
+    if (!name.trim()) {
+      setShareError('Name is required');
+      return;
+    }
+    try {
+      await onShare({
+        url: app.url,
+        manifest_path: app.manifest_path,
+        name: name.trim(),
+        description: description.trim()
+      });
+      onClose();
+    } catch (e) {
+      setShareError(e instanceof Error ? e.message : 'Failed to share');
+    }
+  };
+
+  return (
+    <FgDialog className="max-w-2xl" onClose={onClose} open={open}>
+      <Typography className="text-foreground font-bold mb-4 pr-8" type="h6">
+        Share to Catalog
+      </Typography>
+      <Typography className="mb-4 text-foreground text-sm">
+        Publish this app so other users can add it to their own collection. You
+        can customize the name and description before sharing without affecting
+        your own copy.
+      </Typography>
+
+      <div className="mb-3">
+        <label className="block text-foreground text-sm font-medium mb-1">
+          Name
+        </label>
+        <input
+          autoFocus
+          className="w-full p-2 text-foreground border rounded-sm focus:outline-none bg-background border-primary-light focus:border-primary"
+          onChange={e => {
+            setName(e.target.value);
+            setShareError('');
+          }}
+          type="text"
+          value={name}
+        />
+      </div>
+
+      <div className="mb-4">
+        <label className="block text-foreground text-sm font-medium mb-1">
+          Description
+          <span className="text-foreground font-normal ml-1">(optional)</span>
+        </label>
+        <textarea
+          className="w-full p-2 text-foreground border rounded-sm focus:outline-none bg-background border-primary-light focus:border-primary"
+          onChange={e => setDescription(e.target.value)}
+          rows={3}
+          value={description}
+        />
+      </div>
+
+      {shareError ? (
+        <Typography className="text-error mb-3" type="small">
+          {shareError}
+        </Typography>
+      ) : null}
+
+      <div className="flex gap-3">
+        <FgButton
+          disabled={!name.trim() || sharing}
+          icon={FaUsers}
+          loading={sharing}
+          loadingText="Sharing..."
+          onClick={handleShareSubmit}
+        >
+          Share
+        </FgButton>
+        <FgButton onClick={onClose} variant="ghost">
+          Cancel
+        </FgButton>
+      </div>
+    </FgDialog>
+  );
+}
diff --git a/frontend/src/components/ui/Menus/DataLinksActions.tsx b/frontend/src/components/ui/Menus/DataLinksActions.tsx
index 2eebbc97..ad0a20aa 100644
--- a/frontend/src/components/ui/Menus/DataLinksActions.tsx
+++ b/frontend/src/components/ui/Menus/DataLinksActions.tsx
@@ -1,6 +1,7 @@
 import type { MouseEvent } from 'react';
 import { Menu, IconButton } from '@material-tailwind/react';
 import { HiOutlineEllipsisHorizontalCircle } from 'react-icons/hi2';
+import type { IconType } from 'react-icons';
 
 import FgIcon from '@/components/designSystem/atoms/FgIcon';
 import FgMenuItems from './FgMenuItems';
@@ -9,11 +10,13 @@ import type { MenuItem } from './FgMenuItems';
 type SharedActionsMenuProps<T = unknown> = {
   readonly menuItems: MenuItem<T>[];
   readonly actionProps: T;
+  readonly triggerIcon?: IconType;
 };
 
 export default function DataLinksActionsMenu<T>({
   menuItems,
-  actionProps
+  actionProps,
+  triggerIcon = HiOutlineEllipsisHorizontalCircle
 }: SharedActionsMenuProps<T>) {
   return (
     <Menu>
@@ -23,10 +26,7 @@ export default function DataLinksActionsMenu<T>({
         onClick={(e: MouseEvent) => e.stopPropagation()}
         variant="ghost"
       >
-        <FgIcon
-          className="text-foreground"
-          icon={HiOutlineEllipsisHorizontalCircle}
-        />
+        <FgIcon className="text-foreground" icon={triggerIcon} />
       </Menu.Trigger>
       <Menu.Content>
         <FgMenuItems<T> actionProps={actionProps} menuItems={menuItems} />
diff --git a/frontend/src/hooks/useAppActions.ts b/frontend/src/hooks/useAppActions.ts
new file mode 100644
index 00000000..bd2cac50
--- /dev/null
+++ b/frontend/src/hooks/useAppActions.ts
@@ -0,0 +1,139 @@
+import { useState } from 'react';
+import { useNavigate } from 'react-router';
+import toast from 'react-hot-toast';
+
+import {
+  useRemoveAppMutation,
+  useShareAppMutation,
+  useUnshareListingMutation,
+  useUpdateAppMutation
+} from '@/queries/appsQueries';
+import { buildAppDetailPath, buildLaunchPathFromApp } from '@/utils';
+import type { UserApp } from '@/shared.types';
+
+export interface AppActions {
+  launch: (app: UserApp, entryPointId?: string) => void;
+  view: (app: UserApp) => void;
+  update: (app: UserApp) => Promise<void>;
+  unshare: (app: UserApp) => Promise<void>;
+  share: (params: {
+    url: string;
+    manifest_path: string;
+    name: string;
+    description: string;
+  }) => Promise<void>;
+  requestShare: (app: UserApp) => void;
+  requestRemove: (app: UserApp) => void;
+  confirmRemove: () => Promise<void>;
+  shareTarget: UserApp | null;
+  removeTarget: UserApp | null;
+  closeShare: () => void;
+  closeRemove: () => void;
+  updating: boolean;
+  removing: boolean;
+  sharing: boolean;
+  unsharing: boolean;
+}
+
+/**
+ * Navigation and mutation handlers for the actions offered on a user app
+ * (launch, view details, share/unshare, update, remove), shared by the My Apps
+ * cards and the app detail page. Share and remove are two-step flows: the
+ * `request*` functions set a target app whose dialog is rendered by
+ * `AppActionDialogs`.
+ */
+export function useAppActions(opts?: { onRemoved?: () => void }): AppActions {
+  const navigate = useNavigate();
+  const [shareTarget, setShareTarget] = useState<UserApp | null>(null);
+  const [removeTarget, setRemoveTarget] = useState<UserApp | null>(null);
+
+  const updateAppMutation = useUpdateAppMutation();
+  const removeAppMutation = useRemoveAppMutation();
+  const shareAppMutation = useShareAppMutation();
+  const unshareListingMutation = useUnshareListingMutation();
+
+  const launch = (app: UserApp, entryPointId?: string) => {
+    navigate(buildLaunchPathFromApp(app.url, app.manifest_path, entryPointId));
+  };
+
+  const view = (app: UserApp) => {
+    navigate(buildAppDetailPath(app.url, app.manifest_path));
+  };
+
+  const update = async (app: UserApp) => {
+    try {
+      await updateAppMutation.mutateAsync({
+        url: app.url,
+        manifest_path: app.manifest_path
+      });
+      toast.success('App updated');
+    } catch (error) {
+      const message =
+        error instanceof Error ? error.message : 'Failed to update app';
+      toast.error(message);
+    }
+  };
+
+  const unshare = async (app: UserApp) => {
+    if (app.listing_id === undefined || app.listing_id === null) {
+      return;
+    }
+    try {
+      await unshareListingMutation.mutateAsync({ listing_id: app.listing_id });
+      toast.success('Removed from catalog');
+    } catch (error) {
+      const message =
+        error instanceof Error ? error.message : 'Failed to unshare';
+      toast.error(message);
+    }
+  };
+
+  // Errors intentionally propagate so ShareAppDialog can show them inline.
+  const share = async (params: {
+    url: string;
+    manifest_path: string;
+    name: string;
+    description: string;
+  }) => {
+    await shareAppMutation.mutateAsync(params);
+    toast.success('Shared to catalog');
+  };
+
+  const confirmRemove = async () => {
+    if (!removeTarget) {
+      return;
+    }
+    try {
+      await removeAppMutation.mutateAsync({
+        url: removeTarget.url,
+        manifest_path: removeTarget.manifest_path
+      });
+      toast.success('App removed');
+      setRemoveTarget(null);
+      opts?.onRemoved?.();
+    } catch (error) {
+      const message =
+        error instanceof Error ? error.message : 'Failed to remove app';
+      toast.error(message);
+    }
+  };
+
+  return {
+    launch,
+    view,
+    update,
+    unshare,
+    share,
+    requestShare: setShareTarget,
+    requestRemove: setRemoveTarget,
+    confirmRemove,
+    shareTarget,
+    removeTarget,
+    closeShare: () => setShareTarget(null),
+    closeRemove: () => setRemoveTarget(null),
+    updating: updateAppMutation.isPending,
+    removing: removeAppMutation.isPending,
+    sharing: shareAppMutation.isPending,
+    unsharing: unshareListingMutation.isPending
+  };
+}
diff --git a/frontend/src/layouts/AppsLayout.tsx b/frontend/src/layouts/AppsLayout.tsx
index d23e8fde..ee16673b 100644
--- a/frontend/src/layouts/AppsLayout.tsx
+++ b/frontend/src/layouts/AppsLayout.tsx
@@ -1,4 +1,4 @@
-import { NavLink, Outlet } from 'react-router';
+import { NavLink, Outlet, useLocation } from 'react-router';
 import type { ReactNode } from 'react';
 
 import FgBadge from '@/components/designSystem/atoms/FgBadge';
@@ -9,6 +9,8 @@ interface TabItem {
   label: string;
   end?: boolean;
   badge?: ReactNode;
+  /** Overrides NavLink's own active-state matching when set. */
+  isActive?: boolean;
 }
 
 function tabClass({ isActive }: { isActive: boolean }) {
@@ -33,9 +35,18 @@ function TabUnderline({ active }: { readonly active: boolean }) {
 
 export default function AppsLayout() {
   const activeJobCount = useActiveJobCount();
+  const { pathname } = useLocation();
+
+  // App detail and launch pages are drill-downs from My Apps, so keep that tab
+  // highlighted there (NavLink's own matching would mark it inactive).
+  const myAppsActive =
+    pathname === '/apps' ||
+    pathname.startsWith('/apps/detail/') ||
+    pathname.startsWith('/apps/launch/') ||
+    pathname.startsWith('/apps/relaunch/');
 
   const tabs: TabItem[] = [
-    { to: '/apps', label: 'My Apps', end: true },
+    { to: '/apps', label: 'My Apps', end: true, isActive: myAppsActive },
     { to: '/apps/catalog', label: 'App Catalog' },
     {
       to: '/apps/jobs',
@@ -58,12 +69,18 @@ export default function AppsLayout() {
         <ul className="flex gap-1 -mb-px">
           {tabs.map(tab => (
             <li key={tab.to}>
-              <NavLink className={tabClass} end={tab.end} to={tab.to}>
+              <NavLink
+                className={({ isActive }) =>
+                  tabClass({ isActive: tab.isActive ?? isActive })
+                }
+                end={tab.end}
+                to={tab.to}
+              >
                 {({ isActive }) => (
                   <>
                     <span>{tab.label}</span>
                     {tab.badge}
-                    <TabUnderline active={isActive} />
+                    <TabUnderline active={tab.isActive ?? isActive} />
                   </>
                 )}
               </NavLink>
diff --git a/frontend/src/utils/appIcons.ts b/frontend/src/utils/appIcons.ts
new file mode 100644
index 00000000..140bf030
--- /dev/null
+++ b/frontend/src/utils/appIcons.ts
@@ -0,0 +1,18 @@
+import type { IconType } from 'react-icons';
+import { FaServer } from 'react-icons/fa6';
+import { IoTerminal } from 'react-icons/io5';
+
+import type { AppEntryPoint, AppManifest } from '@/shared.types';
+
+/** Icon representing an entry point: a server for services, a terminal for batch jobs. */
+export function getEntryPointIconType(entryPoint?: AppEntryPoint): IconType {
+  return entryPoint?.type === 'service' ? FaServer : IoTerminal;
+}
+
+/**
+ * Icon representing an app, derived from its primary (first) entry point.
+ * Falls back to the job (terminal) icon when the manifest isn't loaded.
+ */
+export function getAppIconType(manifest?: AppManifest): IconType {
+  return getEntryPointIconType(manifest?.runnables?.[0]);
+}
diff --git a/frontend/src/utils/appUrls.ts b/frontend/src/utils/appUrls.ts
index 761cbe8e..50d5a52b 100644
--- a/frontend/src/utils/appUrls.ts
+++ b/frontend/src/utils/appUrls.ts
@@ -118,6 +118,22 @@ export function buildLaunchPathFromApp(
   );
 }
 
+export function buildAppDetailPath(
+  appUrl: string,
+  manifestPath: string
+): string {
+  const { owner, repo, branch } = parseGithubUrl(appUrl);
+  const params = new URLSearchParams();
+  if (branch && branch !== 'main') {
+    params.set('branch', branch);
+  }
+  if (manifestPath) {
+    params.set('path', manifestPath);
+  }
+  const query = params.toString();
+  return `/apps/detail/${owner}/${repo}${query ? `?${query}` : ''}`;
+}
+
 export function buildRelaunchPath(
   owner: string,
   repo: string,
diff --git a/frontend/src/utils/index.ts b/frontend/src/utils/index.ts
index 748ea97f..c04af819 100644
--- a/frontend/src/utils/index.ts
+++ b/frontend/src/utils/index.ts
@@ -399,9 +399,13 @@ export {
   buildGithubUrl,
   buildLaunchPath,
   buildLaunchPathFromApp,
+  buildAppDetailPath,
   buildRelaunchPath
 } from './appUrls';
 
+// Re-export app icon utilities
+export { getAppIconType, getEntryPointIconType } from './appIcons';
+
 // Re-export Neuroglancer URL utilities
 export {
   parseNeuroglancerUrl,

From 234b32fa8073b697313be7e473f530783ec09238 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Thu, 2 Jul 2026 13:27:19 -0400
Subject: [PATCH 19/89] feat(apps): catalog listing detail page and card banner
 with actions menu

Bring the App Catalog in line with the My Apps card design:

- Listing cards get the same banner treatment: type icon (from the
  installed copy's manifest when available) and an "In your apps" tag
  on the left, an Add button and vertical-ellipsis actions menu
  (Add to my apps/View/View in My Apps/Unshare) on the right. The
  whole card is clickable and opens the listing detail page.
- New listing detail page at /apps/catalog/:listingId replaces
  ListingInfoDialog: info table plus Add to my apps, with owner-only
  Unshare tucked in the ellipsis menu (navigates back to the catalog
  after unsharing). Installed listings link to the app's My Apps
  detail page.
- Listing mutations consolidated into a useListingActions hook shared
  by the catalog cards and the detail page.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 frontend/src/App.tsx                          |   2 +
 frontend/src/components/Catalog.tsx           |  63 ++----
 frontend/src/components/ListingDetail.tsx     | 130 +++++++++++++
 .../components/ui/AppsPage/ListingCard.tsx    | 183 ++++++++++--------
 .../ui/AppsPage/ListingInfoDialog.tsx         | 134 -------------
 .../ui/AppsPage/ListingInfoTable.tsx          |  62 ++++++
 frontend/src/hooks/useListingActions.ts       |  76 ++++++++
 7 files changed, 384 insertions(+), 266 deletions(-)
 create mode 100644 frontend/src/components/ListingDetail.tsx
 delete mode 100644 frontend/src/components/ui/AppsPage/ListingInfoDialog.tsx
 create mode 100644 frontend/src/components/ui/AppsPage/ListingInfoTable.tsx
 create mode 100644 frontend/src/hooks/useListingActions.ts

diff --git a/frontend/src/App.tsx b/frontend/src/App.tsx
index 12b66b2e..b7cb2fbe 100644
--- a/frontend/src/App.tsx
+++ b/frontend/src/App.tsx
@@ -12,6 +12,7 @@ import Login from '@/components/Login';
 import Apps from '@/components/Apps';
 import AppDetail from '@/components/AppDetail';
 import Catalog from '@/components/Catalog';
+import ListingDetail from '@/components/ListingDetail';
 import AppJobs from '@/components/AppJobs';
 import AppLaunch from '@/components/AppLaunch';
 import JobDetail from '@/components/JobDetail';
@@ -128,6 +129,7 @@ const AppComponent = () => {
             >
               <Route element={<Apps />} index />
               <Route element={<Catalog />} path="catalog" />
+              <Route element={<ListingDetail />} path="catalog/:listingId" />
               <Route element={<AppJobs />} path="jobs" />
               {/* Render job/app detail and launch inside the layout so the
                   My Apps / App Catalog / Jobs tabs stay visible when drilling
diff --git a/frontend/src/components/Catalog.tsx b/frontend/src/components/Catalog.tsx
index 2b475622..e4e30d9a 100644
--- a/frontend/src/components/Catalog.tsx
+++ b/frontend/src/components/Catalog.tsx
@@ -1,17 +1,12 @@
 import { useMemo, useState } from 'react';
 import { Typography } from '@material-tailwind/react';
-import toast from 'react-hot-toast';
 
 import ListingCard from '@/components/ui/AppsPage/ListingCard';
 import FgCheckbox from '@/components/designSystem/atoms/formElements/FgCheckbox';
-import {
-  useAppsQuery,
-  useAddFromListingMutation,
-  useCatalogQuery,
-  useUnshareListingMutation
-} from '@/queries/appsQueries';
+import { useAppsQuery, useCatalogQuery } from '@/queries/appsQueries';
+import { useListingActions } from '@/hooks/useListingActions';
 import { useProfileContext } from '@/contexts/ProfileContext';
-import type { AppListing } from '@/shared.types';
+import type { UserApp } from '@/shared.types';
 
 export default function Catalog() {
   const [search, setSearch] = useState('');
@@ -20,23 +15,21 @@ export default function Catalog() {
   const catalogQuery = useCatalogQuery();
   const appsQuery = useAppsQuery();
   const { profile } = useProfileContext();
+  const actions = useListingActions();
 
-  const addFromListingMutation = useAddFromListingMutation();
-  const unshareListingMutation = useUnshareListingMutation();
-
-  const myAppKeys = useMemo(() => {
-    const set = new Set<string>();
+  const myAppsByKey = useMemo(() => {
+    const map = new Map<string, UserApp>();
     (appsQuery.data ?? []).forEach(a =>
-      set.add(`${a.url}::${a.manifest_path}`)
+      map.set(`${a.url}::${a.manifest_path}`, a)
     );
-    return set;
+    return map;
   }, [appsQuery.data]);
 
   const filteredListings = useMemo(() => {
     const term = search.trim().toLowerCase();
     const listings = catalogQuery.data ?? [];
     return listings.filter(l => {
-      if (hideInstalled && myAppKeys.has(`${l.url}::${l.manifest_path}`)) {
+      if (hideInstalled && myAppsByKey.has(`${l.url}::${l.manifest_path}`)) {
         return false;
       }
       if (!term) {
@@ -48,25 +41,7 @@ export default function Catalog() {
         l.owner_username.toLowerCase().includes(term)
       );
     });
-  }, [catalogQuery.data, search, hideInstalled, myAppKeys]);
-
-  const handleAddFromListing = async (listing: AppListing) => {
-    try {
-      await addFromListingMutation.mutateAsync({ listing_id: listing.id });
-      toast.success(`Added "${listing.name}"`);
-    } catch (e) {
-      toast.error(e instanceof Error ? e.message : 'Failed to add app');
-    }
-  };
-
-  const handleUnshare = async (listing: AppListing) => {
-    try {
-      await unshareListingMutation.mutateAsync({ listing_id: listing.id });
-      toast.success('Listing removed');
-    } catch (e) {
-      toast.error(e instanceof Error ? e.message : 'Failed to unshare');
-    }
-  };
+  }, [catalogQuery.data, search, hideInstalled, myAppsByKey]);
 
   const totalListings = catalogQuery.data?.length ?? 0;
 
@@ -119,27 +94,19 @@ export default function Catalog() {
       ) : (
         <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-4 mb-8">
           {filteredListings.map(listing => {
-            const key = `${listing.url}::${listing.manifest_path}`;
-            const alreadyAdded = myAppKeys.has(key);
+            const installedApp = myAppsByKey.get(
+              `${listing.url}::${listing.manifest_path}`
+            );
             const isOwner =
               profile?.username !== undefined &&
               profile.username === listing.owner_username;
-            const isAdding =
-              addFromListingMutation.isPending &&
-              addFromListingMutation.variables?.listing_id === listing.id;
-            const isUnsharing =
-              unshareListingMutation.isPending &&
-              unshareListingMutation.variables?.listing_id === listing.id;
             return (
               <ListingCard
-                adding={isAdding}
-                canAdd={!alreadyAdded}
+                actions={actions}
                 canManage={isOwner}
+                installedApp={installedApp}
                 key={listing.id}
                 listing={listing}
-                onAdd={handleAddFromListing}
-                onUnshare={handleUnshare}
-                unsharing={isUnsharing}
               />
             );
           })}
diff --git a/frontend/src/components/ListingDetail.tsx b/frontend/src/components/ListingDetail.tsx
new file mode 100644
index 00000000..91f97add
--- /dev/null
+++ b/frontend/src/components/ListingDetail.tsx
@@ -0,0 +1,130 @@
+import { useNavigate, useParams } from 'react-router';
+import { Typography } from '@material-tailwind/react';
+import { HiOutlinePlus } from 'react-icons/hi';
+import { HiOutlineEllipsisVertical } from 'react-icons/hi2';
+
+import AppPageHeader from '@/components/ui/AppsPage/AppPageHeader';
+import ListingInfoTable from '@/components/ui/AppsPage/ListingInfoTable';
+import DataLinksActionsMenu from '@/components/ui/Menus/DataLinksActions';
+import type { MenuItem } from '@/components/ui/Menus/FgMenuItems';
+import FgButton from '@/components/designSystem/atoms/FgButton';
+import { useAppsQuery, useCatalogQuery } from '@/queries/appsQueries';
+import { useListingActions } from '@/hooks/useListingActions';
+import { useProfileContext } from '@/contexts/ProfileContext';
+import { getAppIconType } from '@/utils';
+import type { AppListing } from '@/shared.types';
+
+const BACK_PROPS = {
+  backLabel: 'Back to App Catalog',
+  backTo: '/apps/catalog'
+};
+
+export default function ListingDetail() {
+  const { listingId } = useParams<{ listingId: string }>();
+  const navigate = useNavigate();
+  const catalogQuery = useCatalogQuery();
+  const appsQuery = useAppsQuery();
+  const { profile } = useProfileContext();
+  const actions = useListingActions({
+    onUnshared: () => navigate('/apps/catalog')
+  });
+
+  const listing = catalogQuery.data?.find(l => l.id === Number(listingId));
+
+  if (catalogQuery.isPending) {
+    return (
+      <Typography className="text-foreground" type="small">
+        Loading listing...
+      </Typography>
+    );
+  }
+
+  if (catalogQuery.isError) {
+    return (
+      <div className="p-3 bg-error/10 rounded text-error text-sm">
+        Failed to load catalog: {catalogQuery.error?.message || 'Unknown error'}
+      </div>
+    );
+  }
+
+  if (!listing) {
+    return (
+      <div>
+        <AppPageHeader {...BACK_PROPS} title="Listing not found" />
+        <Typography className="text-foreground mb-4">
+          This catalog listing does not exist. It may have been unshared.
+        </Typography>
+        <FgButton onClick={() => navigate('/apps/catalog')} variant="outline">
+          Go to App Catalog
+        </FgButton>
+      </div>
+    );
+  }
+
+  const installedApp = appsQuery.data?.find(
+    a => a.url === listing.url && a.manifest_path === listing.manifest_path
+  );
+  const alreadyAdded = installedApp !== undefined;
+  const canManage =
+    profile?.username !== undefined &&
+    profile.username === listing.owner_username;
+  const adding = actions.addingId === listing.id;
+
+  const menuItems: MenuItem<AppListing>[] = [
+    {
+      name: 'View in My Apps',
+      action: () => installedApp && actions.viewInMyApps(installedApp),
+      shouldShow: alreadyAdded
+    },
+    {
+      name: 'Unshare',
+      action: l => void actions.unshare(l),
+      color: 'text-error',
+      shouldShow: canManage
+    }
+  ];
+  const hasMenuItems = menuItems.some(item => item.shouldShow !== false);
+
+  return (
+    <div>
+      <AppPageHeader
+        {...BACK_PROPS}
+        actions={
+          <>
+            {!alreadyAdded ? (
+              <FgButton
+                disabled={adding}
+                icon={HiOutlinePlus}
+                loading={adding}
+                loadingText="Adding..."
+                onClick={() => void actions.add(listing)}
+                size="sm"
+              >
+                Add to my apps
+              </FgButton>
+            ) : null}
+            {hasMenuItems ? (
+              <DataLinksActionsMenu<AppListing>
+                actionProps={listing}
+                menuItems={menuItems}
+                triggerIcon={HiOutlineEllipsisVertical}
+              />
+            ) : null}
+          </>
+        }
+        icon={getAppIconType(installedApp?.manifest)}
+        title={listing.name}
+      >
+        {alreadyAdded ? (
+          <span className="inline-block px-2 py-0.5 rounded-sm bg-success/10 text-success text-xs font-medium flex-shrink-0">
+            In your apps
+          </span>
+        ) : null}
+      </AppPageHeader>
+
+      <div className="max-w-2xl">
+        <ListingInfoTable listing={listing} />
+      </div>
+    </div>
+  );
+}
diff --git a/frontend/src/components/ui/AppsPage/ListingCard.tsx b/frontend/src/components/ui/AppsPage/ListingCard.tsx
index a6d7ad3a..db38295c 100644
--- a/frontend/src/components/ui/AppsPage/ListingCard.tsx
+++ b/frontend/src/components/ui/AppsPage/ListingCard.tsx
@@ -1,116 +1,131 @@
-import { useState } from 'react';
-import { Card, IconButton, Typography } from '@material-tailwind/react';
-import { HiOutlineInformationCircle, HiOutlinePlus } from 'react-icons/hi';
-import { FaUsersSlash } from 'react-icons/fa6';
+import type { KeyboardEvent } from 'react';
+import { Card, Typography } from '@material-tailwind/react';
+import { HiOutlinePlus } from 'react-icons/hi';
+import { HiOutlineEllipsisVertical } from 'react-icons/hi2';
 
-import FgIcon from '@/components/designSystem/atoms/FgIcon';
+import DataLinksActionsMenu from '@/components/ui/Menus/DataLinksActions';
+import type { MenuItem } from '@/components/ui/Menus/FgMenuItems';
 import FgButton from '@/components/designSystem/atoms/FgButton';
+import FgIcon from '@/components/designSystem/atoms/FgIcon';
 import FgTooltip from '@/components/ui/widgets/FgTooltip';
-import ListingInfoDialog from '@/components/ui/AppsPage/ListingInfoDialog';
-import { formatDateString } from '@/utils';
-import type { AppListing } from '@/shared.types';
+import type { ListingActions } from '@/hooks/useListingActions';
+import { formatDateString, getAppIconType } from '@/utils';
+import type { AppListing, UserApp } from '@/shared.types';
 
 interface ListingCardProps {
   readonly listing: AppListing;
-  readonly canAdd: boolean;
+  /** The user's copy of this app, when it is already in their apps. */
+  readonly installedApp?: UserApp;
   readonly canManage: boolean;
-  readonly adding: boolean;
-  readonly unsharing: boolean;
-  readonly onAdd: (listing: AppListing) => void;
-  readonly onUnshare: (listing: AppListing) => void;
+  readonly actions: ListingActions;
 }
 
 export default function ListingCard({
   listing,
-  canAdd,
+  installedApp,
   canManage,
-  adding,
-  unsharing,
-  onAdd,
-  onUnshare
+  actions
 }: ListingCardProps) {
-  const [infoOpen, setInfoOpen] = useState(false);
+  const alreadyAdded = installedApp !== undefined;
+  const adding = actions.addingId === listing.id;
   const publishedAt = formatDateString(listing.published_at);
 
+  const menuItems: MenuItem<AppListing>[] = [
+    {
+      name: 'Add to my apps',
+      action: l => void actions.add(l),
+      shouldShow: !alreadyAdded
+    },
+    { name: 'View', action: l => actions.view(l) },
+    {
+      name: 'View in My Apps',
+      action: () => installedApp && actions.viewInMyApps(installedApp),
+      shouldShow: alreadyAdded
+    },
+    {
+      name: 'Unshare',
+      action: l => void actions.unshare(l),
+      color: 'text-error',
+      shouldShow: canManage
+    }
+  ];
+
+  const handleView = () => actions.view(listing);
+
+  const handleKeyDown = (event: KeyboardEvent<HTMLDivElement>) => {
+    if (
+      (event.key === 'Enter' || event.key === ' ') &&
+      event.target === event.currentTarget
+    ) {
+      event.preventDefault();
+      handleView();
+    }
+  };
+
   return (
-    <Card className="p-4 flex flex-col gap-3 text-left w-full dark:border-surface-light">
-      <div className="flex items-start justify-between gap-2">
-        <Typography
-          className="text-foreground font-semibold truncate"
-          type="h6"
+    <Card
+      className="p-0 flex flex-col text-left w-full dark:border-surface-light cursor-pointer transition-colors hover:bg-surface dark:hover:bg-surface-light"
+      onClick={handleView}
+      onKeyDown={handleKeyDown}
+      role="link"
+      tabIndex={0}
+    >
+      <div className="px-3 py-2 rounded-t-lg bg-surface dark:bg-surface-light border-b border-surface-light dark:border-surface flex items-center justify-between gap-2">
+        <div className="flex items-center gap-2 min-w-0">
+          <FgIcon
+            className="text-foreground flex-shrink-0"
+            icon={getAppIconType(installedApp?.manifest)}
+          />
+          {alreadyAdded ? (
+            <span className="inline-block px-2 py-0.5 rounded-sm bg-success/10 text-success text-xs font-medium">
+              In your apps
+            </span>
+          ) : null}
+        </div>
+        <div
+          className="flex items-center gap-1"
+          onClick={e => e.stopPropagation()}
         >
-          {listing.name}
-        </Typography>
-        <div className="flex flex-shrink-0">
-          <FgTooltip label="App info">
-            <IconButton
-              className="text-foreground hover:text-primary"
-              onClick={() => setInfoOpen(true)}
-              size="sm"
-              variant="ghost"
-            >
-              <FgIcon icon={HiOutlineInformationCircle} />
-            </IconButton>
-          </FgTooltip>
-          {canManage ? (
-            <FgTooltip label="Unshare from catalog">
-              <IconButton
-                className="text-foreground hover:text-error"
-                disabled={unsharing}
-                onClick={() => onUnshare(listing)}
+          {!alreadyAdded ? (
+            <FgTooltip label="Add to my apps">
+              <FgButton
+                disabled={adding}
+                icon={HiOutlinePlus}
+                loading={adding}
+                loadingText="Adding..."
+                onClick={() => void actions.add(listing)}
                 size="sm"
-                variant="ghost"
               >
-                <FgIcon icon={FaUsersSlash} />
-              </IconButton>
+                Add
+              </FgButton>
             </FgTooltip>
           ) : null}
+          <DataLinksActionsMenu<AppListing>
+            actionProps={listing}
+            menuItems={menuItems}
+            triggerIcon={HiOutlineEllipsisVertical}
+          />
         </div>
       </div>
 
-      <Typography className="text-foreground text-xs" type="small">
-        Shared by {listing.owner_username} on {publishedAt}
-      </Typography>
+      <div className="p-4 flex flex-col gap-3 flex-1">
+        <Typography
+          className="text-foreground font-semibold truncate"
+          type="h6"
+        >
+          {listing.name}
+        </Typography>
 
-      {listing.description ? (
-        <Typography className="text-sm text-foreground">
-          {listing.description}
+        <Typography className="text-foreground text-xs" type="small">
+          Shared by {listing.owner_username} on {publishedAt}
         </Typography>
-      ) : null}
 
-      <div className="mt-auto">
-        {canAdd ? (
-          <FgButton
-            disabled={adding}
-            icon={HiOutlinePlus}
-            loading={adding}
-            loadingText="Adding..."
-            onClick={() => onAdd(listing)}
-            size="sm"
-          >
-            Add to my apps
-          </FgButton>
-        ) : (
-          <Typography className="text-foreground text-xs italic" type="small">
-            Already in your apps
+        {listing.description ? (
+          <Typography className="text-sm text-foreground">
+            {listing.description}
           </Typography>
-        )}
+        ) : null}
       </div>
-
-      <ListingInfoDialog
-        adding={adding}
-        canAdd={canAdd}
-        canManage={canManage}
-        listing={listing}
-        onAdd={() => {
-          setInfoOpen(false);
-          onAdd(listing);
-        }}
-        onClose={() => setInfoOpen(false)}
-        onUnshare={() => onUnshare(listing)}
-        open={infoOpen}
-        unsharing={unsharing}
-      />
     </Card>
   );
 }
diff --git a/frontend/src/components/ui/AppsPage/ListingInfoDialog.tsx b/frontend/src/components/ui/AppsPage/ListingInfoDialog.tsx
deleted file mode 100644
index bc828081..00000000
--- a/frontend/src/components/ui/AppsPage/ListingInfoDialog.tsx
+++ /dev/null
@@ -1,134 +0,0 @@
-import { Typography } from '@material-tailwind/react';
-import { HiOutlinePlus } from 'react-icons/hi';
-import { FaUsersSlash } from 'react-icons/fa6';
-
-import FgDialog from '@/components/ui/Dialogs/FgDialog';
-import type { AppListing } from '@/shared.types';
-import FgButton from '@/components/designSystem/atoms/FgButton';
-import FgExternalLink from '@/components/designSystem/atoms/FgExternalLink';
-import FgTooltip from '@/components/ui/widgets/FgTooltip';
-import { formatDateString } from '@/utils';
-import { parseGithubUrl } from '@/utils/appUrls';
-
-/**
- * The revision actually cloned, parsed out of the canonical listing URL (which
- * always carries it). Falls back to the requested branch, then null.
- */
-function listingRevision(listing: AppListing): string | null {
-  try {
-    return parseGithubUrl(listing.url).branch;
-  } catch {
-    return listing.branch || null;
-  }
-}
-
-interface ListingInfoDialogProps {
-  readonly listing: AppListing;
-  readonly open: boolean;
-  readonly canAdd: boolean;
-  readonly canManage: boolean;
-  readonly adding: boolean;
-  readonly unsharing: boolean;
-  readonly onClose: () => void;
-  readonly onAdd: () => void;
-  readonly onUnshare: () => void;
-}
-
-function ListingInfoTable({ listing }: { readonly listing: AppListing }) {
-  const labelClass =
-    'text-foreground font-medium pr-4 py-1.5 align-top whitespace-nowrap';
-  const valueClass = 'text-foreground py-1.5';
-
-  const publishedAt = formatDateString(listing.published_at);
-  const revision = listingRevision(listing);
-
-  return (
-    <table className="w-full text-sm mb-6">
-      <tbody>
-        <tr>
-          <td className={labelClass}>URL</td>
-          <td className="py-1.5">
-            <FgExternalLink className="break-all" href={listing.url}>
-              {listing.url}
-            </FgExternalLink>
-          </td>
-        </tr>
-        {revision ? (
-          <tr>
-            <td className={labelClass}>Revision</td>
-            <td className={valueClass}>{revision}</td>
-          </tr>
-        ) : null}
-        <tr>
-          <td className={labelClass}>Shared by</td>
-          <td className={valueClass}>
-            {listing.owner_username} on {publishedAt}
-          </td>
-        </tr>
-        {listing.description ? (
-          <tr>
-            <td className={labelClass}>Description</td>
-            <td className={valueClass}>{listing.description}</td>
-          </tr>
-        ) : null}
-      </tbody>
-    </table>
-  );
-}
-
-export default function ListingInfoDialog({
-  listing,
-  open,
-  canAdd,
-  canManage,
-  adding,
-  unsharing,
-  onClose,
-  onAdd,
-  onUnshare
-}: ListingInfoDialogProps) {
-  return (
-    <FgDialog className="max-w-2xl" onClose={onClose} open={open}>
-      <Typography className="text-foreground font-bold mb-4 pr-8" type="h6">
-        {listing.name}
-      </Typography>
-
-      <ListingInfoTable listing={listing} />
-
-      <div className="flex justify-between">
-        {canAdd ? (
-          <FgTooltip label="Add to my apps">
-            <FgButton icon={HiOutlinePlus} loading={adding} onClick={onAdd}>
-              Add to my apps
-            </FgButton>
-          </FgTooltip>
-        ) : (
-          <Typography
-            className="text-foreground text-sm italic self-center"
-            type="small"
-          >
-            Already in your apps
-          </Typography>
-        )}
-        <div className="flex gap-2">
-          {canManage ? (
-            <FgTooltip label="Unshare from catalog">
-              <FgButton
-                className="!rounded-md"
-                color="error"
-                disabled={unsharing}
-                icon={FaUsersSlash}
-                loading={unsharing}
-                loadingText="Unsharing..."
-                onClick={onUnshare}
-                variant="outline"
-              >
-                Unshare
-              </FgButton>
-            </FgTooltip>
-          ) : null}
-        </div>
-      </div>
-    </FgDialog>
-  );
-}
diff --git a/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx b/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx
new file mode 100644
index 00000000..b4d64165
--- /dev/null
+++ b/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx
@@ -0,0 +1,62 @@
+import FgExternalLink from '@/components/designSystem/atoms/FgExternalLink';
+import type { AppListing } from '@/shared.types';
+import { formatDateString } from '@/utils';
+import { parseGithubUrl } from '@/utils/appUrls';
+
+/**
+ * The revision actually cloned, parsed out of the canonical listing URL (which
+ * always carries it). Falls back to the requested branch, then null.
+ */
+function listingRevision(listing: AppListing): string | null {
+  try {
+    return parseGithubUrl(listing.url).branch;
+  } catch {
+    return listing.branch || null;
+  }
+}
+
+export default function ListingInfoTable({
+  listing
+}: {
+  readonly listing: AppListing;
+}) {
+  const labelClass =
+    'text-foreground font-medium pr-4 py-1.5 align-top whitespace-nowrap';
+  const valueClass = 'text-foreground py-1.5';
+
+  const publishedAt = formatDateString(listing.published_at);
+  const revision = listingRevision(listing);
+
+  return (
+    <table className="w-full text-sm mb-6">
+      <tbody>
+        <tr>
+          <td className={labelClass}>URL</td>
+          <td className="py-1.5">
+            <FgExternalLink className="break-all" href={listing.url}>
+              {listing.url}
+            </FgExternalLink>
+          </td>
+        </tr>
+        {revision ? (
+          <tr>
+            <td className={labelClass}>Revision</td>
+            <td className={valueClass}>{revision}</td>
+          </tr>
+        ) : null}
+        <tr>
+          <td className={labelClass}>Shared by</td>
+          <td className={valueClass}>
+            {listing.owner_username} on {publishedAt}
+          </td>
+        </tr>
+        {listing.description ? (
+          <tr>
+            <td className={labelClass}>Description</td>
+            <td className={valueClass}>{listing.description}</td>
+          </tr>
+        ) : null}
+      </tbody>
+    </table>
+  );
+}
diff --git a/frontend/src/hooks/useListingActions.ts b/frontend/src/hooks/useListingActions.ts
new file mode 100644
index 00000000..634f0002
--- /dev/null
+++ b/frontend/src/hooks/useListingActions.ts
@@ -0,0 +1,76 @@
+import { useNavigate } from 'react-router';
+import toast from 'react-hot-toast';
+
+import {
+  useAddFromListingMutation,
+  useUnshareListingMutation
+} from '@/queries/appsQueries';
+import { buildAppDetailPath } from '@/utils';
+import type { AppListing, UserApp } from '@/shared.types';
+
+export function buildListingDetailPath(listingId: number): string {
+  return `/apps/catalog/${listingId}`;
+}
+
+export interface ListingActions {
+  view: (listing: AppListing) => void;
+  viewInMyApps: (app: UserApp) => void;
+  add: (listing: AppListing) => Promise<void>;
+  unshare: (listing: AppListing) => Promise<void>;
+  /** Listing id the add/unshare mutation is currently running for, if any. */
+  addingId: number | null;
+  unsharingId: number | null;
+}
+
+/**
+ * Navigation and mutation handlers for the actions offered on a catalog
+ * listing (view details, add to my apps, unshare), shared by the catalog
+ * cards and the listing detail page.
+ */
+export function useListingActions(opts?: {
+  onUnshared?: () => void;
+}): ListingActions {
+  const navigate = useNavigate();
+  const addFromListingMutation = useAddFromListingMutation();
+  const unshareListingMutation = useUnshareListingMutation();
+
+  const view = (listing: AppListing) => {
+    navigate(buildListingDetailPath(listing.id));
+  };
+
+  const viewInMyApps = (app: UserApp) => {
+    navigate(buildAppDetailPath(app.url, app.manifest_path));
+  };
+
+  const add = async (listing: AppListing) => {
+    try {
+      await addFromListingMutation.mutateAsync({ listing_id: listing.id });
+      toast.success(`Added "${listing.name}"`);
+    } catch (e) {
+      toast.error(e instanceof Error ? e.message : 'Failed to add app');
+    }
+  };
+
+  const unshare = async (listing: AppListing) => {
+    try {
+      await unshareListingMutation.mutateAsync({ listing_id: listing.id });
+      toast.success('Removed from catalog');
+      opts?.onUnshared?.();
+    } catch (e) {
+      toast.error(e instanceof Error ? e.message : 'Failed to unshare');
+    }
+  };
+
+  return {
+    view,
+    viewInMyApps,
+    add,
+    unshare,
+    addingId: addFromListingMutation.isPending
+      ? (addFromListingMutation.variables?.listing_id ?? null)
+      : null,
+    unsharingId: unshareListingMutation.isPending
+      ? (unshareListingMutation.variables?.listing_id ?? null)
+      : null
+  };
+}

From 1d6a36061d629b71f6fa468108210cc1212c399e Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Thu, 2 Jul 2026 13:30:34 -0400
Subject: [PATCH 20/89] feat(apps): adopt shared page header on the job detail
 page

Replace JobDetail's hand-rolled header with AppPageHeader so all three
apps drill-downs (app detail, launch, job detail) share the same
back-arrow + icon + title idiom: back arrow to /apps/jobs, entry-point
type icon, job title with the status badge in the badge slot, and the
Export params / Cancel / Relaunch buttons in the actions slot.

Adds getEntryPointTypeIconType so the icon can be derived from a job's
entry_point_type without a manifest.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 frontend/src/components/JobDetail.tsx | 29 ++++++++++++++++-----------
 frontend/src/utils/appIcons.ts        |  7 ++++++-
 frontend/src/utils/index.ts           |  6 +++++-
 3 files changed, 28 insertions(+), 14 deletions(-)

diff --git a/frontend/src/components/JobDetail.tsx b/frontend/src/components/JobDetail.tsx
index 185d7e10..e0a9a99b 100644
--- a/frontend/src/components/JobDetail.tsx
+++ b/frontend/src/components/JobDetail.tsx
@@ -16,6 +16,7 @@ import {
 } from 'react-syntax-highlighter/dist/esm/styles/prism';
 
 import AnsiText from '@/components/ui/AppsPage/AnsiText';
+import AppPageHeader from '@/components/ui/AppsPage/AppPageHeader';
 import FgButton from '@/components/designSystem/atoms/FgButton';
 import FgIcon from '@/components/designSystem/atoms/FgIcon';
 import CancelJobDialog from '@/components/ui/Dialogs/CancelJob';
@@ -34,6 +35,7 @@ import {
   buildGithubUrl,
   downloadTextFile,
   formatDuration,
+  getEntryPointTypeIconType,
   stripLsfFooter,
   tailLines,
   exitCodeMeaning
@@ -572,19 +574,14 @@ export default function JobDetail() {
       ) : job ? (
         <div>
           {/* Job Info Header */}
-          <div className="mb-6">
-            <div className="flex items-center justify-between gap-4">
-              <div className="flex items-center gap-3 min-w-0">
-                <Typography className="font-bold truncate" type="h5">
-                  {job.app_name} &mdash; {job.entry_point_name}
-                </Typography>
-                <JobStatusBadge status={job.status} />
-              </div>
-              <div className="flex items-center gap-2">
+          <AppPageHeader
+            actions={
+              <>
                 <FgButton
                   className="!rounded-md whitespace-nowrap"
                   icon={HiOutlineDownload}
                   onClick={handleDownloadParams}
+                  size="sm"
                   variant="outline"
                 >
                   Export params
@@ -597,6 +594,7 @@ export default function JobDetail() {
                     loading={cancelMutation.isPending}
                     loadingText="Cancelling"
                     onClick={() => setShowStopConfirm(true)}
+                    size="sm"
                     variant="outline"
                   >
                     Cancel
@@ -605,14 +603,21 @@ export default function JobDetail() {
                   <FgButton
                     icon={HiOutlineRefresh}
                     onClick={handleRelaunch}
+                    size="sm"
                     variant="outline"
                   >
                     Relaunch
                   </FgButton>
                 )}
-              </div>
-            </div>
-          </div>
+              </>
+            }
+            backLabel="Back to Jobs"
+            backTo="/apps/jobs"
+            icon={getEntryPointTypeIconType(job.entry_point_type)}
+            title={`${job.app_name} — ${job.entry_point_name}`}
+          >
+            <JobStatusBadge status={job.status} />
+          </AppPageHeader>
 
           {/* Service URL banner */}
           {isService && job.status === 'RUNNING' ? (
diff --git a/frontend/src/utils/appIcons.ts b/frontend/src/utils/appIcons.ts
index 140bf030..13b1e378 100644
--- a/frontend/src/utils/appIcons.ts
+++ b/frontend/src/utils/appIcons.ts
@@ -4,9 +4,14 @@ import { IoTerminal } from 'react-icons/io5';
 
 import type { AppEntryPoint, AppManifest } from '@/shared.types';
 
+/** Icon for an entry point type: a server for services, a terminal for batch jobs. */
+export function getEntryPointTypeIconType(type?: 'job' | 'service'): IconType {
+  return type === 'service' ? FaServer : IoTerminal;
+}
+
 /** Icon representing an entry point: a server for services, a terminal for batch jobs. */
 export function getEntryPointIconType(entryPoint?: AppEntryPoint): IconType {
-  return entryPoint?.type === 'service' ? FaServer : IoTerminal;
+  return getEntryPointTypeIconType(entryPoint?.type);
 }
 
 /**
diff --git a/frontend/src/utils/index.ts b/frontend/src/utils/index.ts
index c04af819..55791485 100644
--- a/frontend/src/utils/index.ts
+++ b/frontend/src/utils/index.ts
@@ -404,7 +404,11 @@ export {
 } from './appUrls';
 
 // Re-export app icon utilities
-export { getAppIconType, getEntryPointIconType } from './appIcons';
+export {
+  getAppIconType,
+  getEntryPointIconType,
+  getEntryPointTypeIconType
+} from './appIcons';
 
 // Re-export Neuroglancer URL utilities
 export {

From f3511f45270d6202d753d6f47c4220e11aec150c Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Thu, 2 Jul 2026 13:43:22 -0400
Subject: [PATCH 21/89] feat(apps): show entry points on the catalog listing
 detail page

Listings don't carry the manifest, so the listing detail page fetches a
manifest preview (POST /api/apps/manifest) and renders the same entry
points section as the app detail page, with per-entry-point Launch
buttons and the correct type icon in the header. Installed listings
use the installed copy's manifest without the extra fetch.

Extracts the entry points section into a shared EntryPointsList
component used by both detail pages.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 frontend/src/components/AppDetail.tsx         | 61 ++--------------
 frontend/src/components/ListingDetail.tsx     | 48 ++++++++++++-
 .../ui/AppsPage/EntryPointsList.tsx           | 69 +++++++++++++++++++
 3 files changed, 121 insertions(+), 57 deletions(-)
 create mode 100644 frontend/src/components/ui/AppsPage/EntryPointsList.tsx

diff --git a/frontend/src/components/AppDetail.tsx b/frontend/src/components/AppDetail.tsx
index 2b1f03fe..142ac965 100644
--- a/frontend/src/components/AppDetail.tsx
+++ b/frontend/src/components/AppDetail.tsx
@@ -1,5 +1,5 @@
 import { useNavigate, useParams, useSearchParams } from 'react-router';
-import { Card, Typography } from '@material-tailwind/react';
+import { Typography } from '@material-tailwind/react';
 import { HiOutlinePlay, HiOutlineRefresh } from 'react-icons/hi';
 import { HiOutlineEllipsisVertical } from 'react-icons/hi2';
 import { FaUsers, FaUsersSlash } from 'react-icons/fa6';
@@ -7,19 +7,14 @@ import { FaUsers, FaUsersSlash } from 'react-icons/fa6';
 import AppActionDialogs from '@/components/ui/AppsPage/AppActionDialogs';
 import AppInfoTable from '@/components/ui/AppsPage/AppInfoTable';
 import AppPageHeader from '@/components/ui/AppsPage/AppPageHeader';
+import EntryPointsList from '@/components/ui/AppsPage/EntryPointsList';
 import DataLinksActionsMenu from '@/components/ui/Menus/DataLinksActions';
 import type { MenuItem } from '@/components/ui/Menus/FgMenuItems';
 import FgButton from '@/components/designSystem/atoms/FgButton';
-import FgIcon from '@/components/designSystem/atoms/FgIcon';
 import FgTooltip from '@/components/ui/widgets/FgTooltip';
 import { useAppsQuery } from '@/queries/appsQueries';
 import { useAppActions } from '@/hooks/useAppActions';
-import {
-  buildGithubUrl,
-  canonicalGithubUrl,
-  getAppIconType,
-  getEntryPointIconType
-} from '@/utils';
+import { buildGithubUrl, canonicalGithubUrl, getAppIconType } from '@/utils';
 import type { UserApp } from '@/shared.types';
 
 export default function AppDetail() {
@@ -155,52 +150,10 @@ export default function AppDetail() {
       <div className="max-w-2xl">
         <AppInfoTable app={app} />
 
-        {runnables.length > 0 ? (
-          <>
-            <Typography
-              className="text-foreground font-semibold mb-3"
-              type="h6"
-            >
-              Entry Points
-            </Typography>
-            <div className="space-y-4">
-              {runnables.map(ep => (
-                <Card
-                  className="p-4 flex flex-col gap-2 text-left w-full dark:border-surface-light"
-                  key={ep.id}
-                >
-                  <div className="flex items-center gap-2">
-                    <FgIcon
-                      className="text-foreground"
-                      icon={getEntryPointIconType(ep)}
-                    />
-                    <Typography className="text-foreground font-semibold">
-                      {ep.name}
-                    </Typography>
-                    {ep.type === 'service' ? (
-                      <span className="inline-flex items-center px-1.5 py-0.5 rounded text-[10px] font-medium bg-info/10 text-info border border-info/30">
-                        Service
-                      </span>
-                    ) : null}
-                  </div>
-                  {ep.description ? (
-                    <Typography className="text-sm md:text-base text-foreground">
-                      {ep.description}
-                    </Typography>
-                  ) : null}
-                  <FgButton
-                    className="self-start"
-                    icon={HiOutlinePlay}
-                    onClick={() => actions.launch(app, ep.id)}
-                    size="sm"
-                  >
-                    Launch
-                  </FgButton>
-                </Card>
-              ))}
-            </div>
-          </>
-        ) : null}
+        <EntryPointsList
+          onLaunch={ep => actions.launch(app, ep.id)}
+          runnables={runnables}
+        />
       </div>
 
       <AppActionDialogs actions={actions} />
diff --git a/frontend/src/components/ListingDetail.tsx b/frontend/src/components/ListingDetail.tsx
index 91f97add..b9b6f6e8 100644
--- a/frontend/src/components/ListingDetail.tsx
+++ b/frontend/src/components/ListingDetail.tsx
@@ -1,17 +1,23 @@
+import { useEffect } from 'react';
 import { useNavigate, useParams } from 'react-router';
 import { Typography } from '@material-tailwind/react';
 import { HiOutlinePlus } from 'react-icons/hi';
 import { HiOutlineEllipsisVertical } from 'react-icons/hi2';
 
 import AppPageHeader from '@/components/ui/AppsPage/AppPageHeader';
+import EntryPointsList from '@/components/ui/AppsPage/EntryPointsList';
 import ListingInfoTable from '@/components/ui/AppsPage/ListingInfoTable';
 import DataLinksActionsMenu from '@/components/ui/Menus/DataLinksActions';
 import type { MenuItem } from '@/components/ui/Menus/FgMenuItems';
 import FgButton from '@/components/designSystem/atoms/FgButton';
-import { useAppsQuery, useCatalogQuery } from '@/queries/appsQueries';
+import {
+  useAppsQuery,
+  useCatalogQuery,
+  useManifestPreviewMutation
+} from '@/queries/appsQueries';
 import { useListingActions } from '@/hooks/useListingActions';
 import { useProfileContext } from '@/contexts/ProfileContext';
-import { getAppIconType } from '@/utils';
+import { buildLaunchPathFromApp, getAppIconType } from '@/utils';
 import type { AppListing } from '@/shared.types';
 
 const BACK_PROPS = {
@@ -28,8 +34,24 @@ export default function ListingDetail() {
   const actions = useListingActions({
     onUnshared: () => navigate('/apps/catalog')
   });
+  const manifestMutation = useManifestPreviewMutation();
 
   const listing = catalogQuery.data?.find(l => l.id === Number(listingId));
+  const listingUrl = listing?.url;
+  const listingManifestPath = listing?.manifest_path;
+
+  // Listings don't carry the manifest, so fetch a preview to show the entry
+  // points and the correct type icon.
+  useEffect(() => {
+    if (listingUrl !== undefined) {
+      manifestMutation.mutate({
+        url: listingUrl,
+        manifest_path: listingManifestPath ?? ''
+      });
+    }
+    // Re-fetch when the listing identity (url or manifest path) changes
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [listingUrl, listingManifestPath]);
 
   if (catalogQuery.isPending) {
     return (
@@ -65,6 +87,7 @@ export default function ListingDetail() {
     a => a.url === listing.url && a.manifest_path === listing.manifest_path
   );
   const alreadyAdded = installedApp !== undefined;
+  const manifest = installedApp?.manifest ?? manifestMutation.data;
   const canManage =
     profile?.username !== undefined &&
     profile.username === listing.owner_username;
@@ -112,7 +135,7 @@ export default function ListingDetail() {
             ) : null}
           </>
         }
-        icon={getAppIconType(installedApp?.manifest)}
+        icon={getAppIconType(manifest)}
         title={listing.name}
       >
         {alreadyAdded ? (
@@ -124,6 +147,25 @@ export default function ListingDetail() {
 
       <div className="max-w-2xl">
         <ListingInfoTable listing={listing} />
+
+        {manifestMutation.isPending && !manifest ? (
+          <Typography className="text-foreground" type="small">
+            Loading entry points...
+          </Typography>
+        ) : (
+          <EntryPointsList
+            onLaunch={ep =>
+              navigate(
+                buildLaunchPathFromApp(
+                  listing.url,
+                  listing.manifest_path,
+                  ep.id
+                )
+              )
+            }
+            runnables={manifest?.runnables ?? []}
+          />
+        )}
       </div>
     </div>
   );
diff --git a/frontend/src/components/ui/AppsPage/EntryPointsList.tsx b/frontend/src/components/ui/AppsPage/EntryPointsList.tsx
new file mode 100644
index 00000000..e5f46ca5
--- /dev/null
+++ b/frontend/src/components/ui/AppsPage/EntryPointsList.tsx
@@ -0,0 +1,69 @@
+import { Card, Typography } from '@material-tailwind/react';
+import { HiOutlinePlay } from 'react-icons/hi';
+
+import FgButton from '@/components/designSystem/atoms/FgButton';
+import FgIcon from '@/components/designSystem/atoms/FgIcon';
+import { getEntryPointIconType } from '@/utils';
+import type { AppEntryPoint } from '@/shared.types';
+
+interface EntryPointsListProps {
+  readonly runnables: AppEntryPoint[];
+  readonly onLaunch: (entryPoint: AppEntryPoint) => void;
+}
+
+/**
+ * The "Entry Points" section of the app and listing detail pages: one card per
+ * runnable with its type icon, description, and a Launch button.
+ */
+export default function EntryPointsList({
+  runnables,
+  onLaunch
+}: EntryPointsListProps) {
+  if (runnables.length === 0) {
+    return null;
+  }
+
+  return (
+    <>
+      <Typography className="text-foreground font-semibold mb-3" type="h6">
+        Entry Points
+      </Typography>
+      <div className="space-y-4">
+        {runnables.map(ep => (
+          <Card
+            className="p-4 flex flex-col gap-2 text-left w-full dark:border-surface-light"
+            key={ep.id}
+          >
+            <div className="flex items-center gap-2">
+              <FgIcon
+                className="text-foreground"
+                icon={getEntryPointIconType(ep)}
+              />
+              <Typography className="text-foreground font-semibold">
+                {ep.name}
+              </Typography>
+              {ep.type === 'service' ? (
+                <span className="inline-flex items-center px-1.5 py-0.5 rounded text-[10px] font-medium bg-info/10 text-info border border-info/30">
+                  Service
+                </span>
+              ) : null}
+            </div>
+            {ep.description ? (
+              <Typography className="text-sm md:text-base text-foreground">
+                {ep.description}
+              </Typography>
+            ) : null}
+            <FgButton
+              className="self-start"
+              icon={HiOutlinePlay}
+              onClick={() => onLaunch(ep)}
+              size="sm"
+            >
+              Launch
+            </FgButton>
+          </Card>
+        ))}
+      </div>
+    </>
+  );
+}

From 2f98f7247639306a4d79054bd5623af416ef6166 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Thu, 2 Jul 2026 13:46:48 -0400
Subject: [PATCH 22/89] feat(apps): recent jobs on app detail, link job detail
 back to its app

The app detail page now lists the app's five most recent jobs (status
badge, entry point, submission time) linking to their job detail pages,
with a "View all" link when there are more. Conversely, the App row in
the job detail Execution panel links to the app's detail page (falling
back to plain text for unparseable app URLs).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 frontend/src/components/AppDetail.tsx | 60 ++++++++++++++++++++++++++-
 frontend/src/components/JobDetail.tsx | 22 +++++++++-
 2 files changed, 79 insertions(+), 3 deletions(-)

diff --git a/frontend/src/components/AppDetail.tsx b/frontend/src/components/AppDetail.tsx
index 142ac965..5574f8ca 100644
--- a/frontend/src/components/AppDetail.tsx
+++ b/frontend/src/components/AppDetail.tsx
@@ -1,4 +1,4 @@
-import { useNavigate, useParams, useSearchParams } from 'react-router';
+import { Link, useNavigate, useParams, useSearchParams } from 'react-router';
 import { Typography } from '@material-tailwind/react';
 import { HiOutlinePlay, HiOutlineRefresh } from 'react-icons/hi';
 import { HiOutlineEllipsisVertical } from 'react-icons/hi2';
@@ -11,17 +11,28 @@ import EntryPointsList from '@/components/ui/AppsPage/EntryPointsList';
 import DataLinksActionsMenu from '@/components/ui/Menus/DataLinksActions';
 import type { MenuItem } from '@/components/ui/Menus/FgMenuItems';
 import FgButton from '@/components/designSystem/atoms/FgButton';
+import FgLink from '@/components/designSystem/atoms/FgLink';
 import FgTooltip from '@/components/ui/widgets/FgTooltip';
+import JobStatusBadge from '@/components/ui/AppsPage/JobStatusBadge';
 import { useAppsQuery } from '@/queries/appsQueries';
+import { useJobsQuery } from '@/queries/jobsQueries';
 import { useAppActions } from '@/hooks/useAppActions';
-import { buildGithubUrl, canonicalGithubUrl, getAppIconType } from '@/utils';
+import {
+  buildGithubUrl,
+  canonicalGithubUrl,
+  formatDateString,
+  getAppIconType
+} from '@/utils';
 import type { UserApp } from '@/shared.types';
 
+const RECENT_JOBS_LIMIT = 5;
+
 export default function AppDetail() {
   const { owner, repo } = useParams<{ owner: string; repo: string }>();
   const [searchParams] = useSearchParams();
   const navigate = useNavigate();
   const appsQuery = useAppsQuery();
+  const jobsQuery = useJobsQuery();
   const actions = useAppActions({ onRemoved: () => navigate('/apps') });
 
   const manifestPath = searchParams.get('path') || '';
@@ -69,6 +80,15 @@ export default function AppDetail() {
   const isShared = app.listing_id !== undefined && app.listing_id !== null;
   const runnables = app.manifest?.runnables ?? [];
 
+  const appJobs = (jobsQuery.data ?? [])
+    .filter(
+      job =>
+        canonicalGithubUrl(job.app_url) === appUrl &&
+        (job.manifest_path || '') === manifestPath
+    )
+    .sort((a, b) => b.created_at.localeCompare(a.created_at));
+  const recentJobs = appJobs.slice(0, RECENT_JOBS_LIMIT);
+
   const menuItems: MenuItem<UserApp>[] = [
     {
       name: 'Remove',
@@ -154,6 +174,42 @@ export default function AppDetail() {
           onLaunch={ep => actions.launch(app, ep.id)}
           runnables={runnables}
         />
+
+        {recentJobs.length > 0 ? (
+          <div className="mt-8">
+            <Typography
+              className="text-foreground font-semibold mb-3"
+              type="h6"
+            >
+              Recent Jobs
+            </Typography>
+            <div className="flex flex-col divide-y divide-surface-light dark:divide-surface border border-surface-light dark:border-surface rounded-lg">
+              {recentJobs.map(job => (
+                <Link
+                  className="flex items-center gap-3 px-4 py-2 transition-colors hover:bg-surface dark:hover:bg-surface-light first:rounded-t-lg last:rounded-b-lg"
+                  key={job.id}
+                  to={`/apps/jobs/${job.id}`}
+                >
+                  <JobStatusBadge status={job.status} />
+                  <Typography className="text-foreground text-sm font-medium truncate">
+                    {job.entry_point_name}
+                  </Typography>
+                  <Typography
+                    className="text-foreground/70 text-xs ml-auto flex-shrink-0"
+                    type="small"
+                  >
+                    {formatDateString(job.created_at)}
+                  </Typography>
+                </Link>
+              ))}
+            </div>
+            {appJobs.length > RECENT_JOBS_LIMIT ? (
+              <Typography className="mt-2 text-sm">
+                <FgLink to="/apps/jobs">View all {appJobs.length} jobs</FgLink>
+              </Typography>
+            ) : null}
+          </div>
+        ) : null}
       </div>
 
       <AppActionDialogs actions={actions} />
diff --git a/frontend/src/components/JobDetail.tsx b/frontend/src/components/JobDetail.tsx
index e0a9a99b..17163ab5 100644
--- a/frontend/src/components/JobDetail.tsx
+++ b/frontend/src/components/JobDetail.tsx
@@ -19,6 +19,7 @@ import AnsiText from '@/components/ui/AppsPage/AnsiText';
 import AppPageHeader from '@/components/ui/AppsPage/AppPageHeader';
 import FgButton from '@/components/designSystem/atoms/FgButton';
 import FgIcon from '@/components/designSystem/atoms/FgIcon';
+import FgLink from '@/components/designSystem/atoms/FgLink';
 import CancelJobDialog from '@/components/ui/Dialogs/CancelJob';
 import FgTooltip from '@/components/ui/widgets/FgTooltip';
 import type {
@@ -30,6 +31,7 @@ import type {
 import JobStatusBadge from '@/components/ui/AppsPage/JobStatusBadge';
 import {
   formatDateString,
+  buildAppDetailPath,
   buildRelaunchPath,
   parseGithubUrl,
   buildGithubUrl,
@@ -269,6 +271,15 @@ function appRepoLink(appUrl: string): { href: string; label: string } | null {
   }
 }
 
+/** Best-effort link to the app's detail page; null if the URL isn't parseable. */
+function appDetailLink(job: Job): string | null {
+  try {
+    return buildAppDetailPath(job.app_url, job.manifest_path);
+  } catch {
+    return null;
+  }
+}
+
 const RECENT_OUTPUT_LINES = 20;
 
 /** The job Overview tab: status, execution details, recent output. */
@@ -294,6 +305,7 @@ function JobOverview({
     : null;
   const exitMeaning = exitCodeMeaning(job.exit_code);
   const repoLink = appRepoLink(job.app_url);
+  const detailPath = appDetailLink(job);
 
   const stdoutTail =
     stdoutContent !== null && stdoutContent !== undefined
@@ -334,7 +346,15 @@ function JobOverview({
         <InfoCard className="md:col-span-3" title="Execution">
           <InfoRow
             label="App"
-            value={`${job.app_name} — ${job.entry_point_name}`}
+            value={
+              detailPath ? (
+                <FgLink to={detailPath}>
+                  {`${job.app_name} — ${job.entry_point_name}`}
+                </FgLink>
+              ) : (
+                `${job.app_name} — ${job.entry_point_name}`
+              )
+            }
           />
           <InfoRow
             label="Repository"

From dd35f205778cf91561a469d42f05fda763027903 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Thu, 2 Jul 2026 13:49:41 -0400
Subject: [PATCH 23/89] refactor(apps): drop duplicate app name from the launch
 form

The launch page header already shows the app name (with the user's
custom name preferred), so the form's app-name subtitle under the entry
point title was redundant. Removing it makes the appName and manifest
props of AppLaunchForm unused, so they are removed too.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 frontend/src/components/AppLaunch.tsx         |  2 --
 .../components/ui/AppsPage/AppLaunchForm.tsx  | 19 ++++---------------
 2 files changed, 4 insertions(+), 17 deletions(-)

diff --git a/frontend/src/components/AppLaunch.tsx b/frontend/src/components/AppLaunch.tsx
index 8e09605b..d69bafc1 100644
--- a/frontend/src/components/AppLaunch.tsx
+++ b/frontend/src/components/AppLaunch.tsx
@@ -243,7 +243,6 @@ export default function AppLaunch() {
         </div>
       ) : manifest && selectedEntryPoint ? (
         <AppLaunchForm
-          appName={displayName}
           entryPoint={selectedEntryPoint}
           initialContainer={relaunchContainer}
           initialContainerArgs={relaunchContainerArgs}
@@ -254,7 +253,6 @@ export default function AppLaunch() {
           initialPreRun={relaunchPreRun}
           initialResources={relaunchResources}
           initialValues={relaunchParameters}
-          manifest={manifest}
           onSubmit={handleSubmit}
           submitError={submitJobMutation.error?.message}
           submitting={submitJobMutation.isPending}
diff --git a/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx b/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
index 0b473f00..2ffb4086 100644
--- a/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
+++ b/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
@@ -33,14 +33,12 @@ import {
 import type {
   AppEntryPoint,
   AppLaunchParamsFile,
-  AppManifest,
   AppParameter,
   AppParameterSection,
   AppResourceDefaults
 } from '@/shared.types';
 
 interface AppLaunchFormProps {
-  readonly manifest: AppManifest;
   readonly entryPoint: AppEntryPoint;
   readonly onSubmit: (
     parameters: Record<string, unknown>,
@@ -64,10 +62,6 @@ interface AppLaunchFormProps {
   readonly initialPostRun?: string;
   readonly initialContainer?: string;
   readonly initialContainerArgs?: string;
-  // Display name for the app; defaults to the manifest name when omitted. Lets
-  // callers show a user's custom app name (e.g. chosen when adding from the
-  // catalog) instead of the raw manifest name.
-  readonly appName?: string;
 }
 
 type EnvVar = { key: string; value: string };
@@ -714,7 +708,6 @@ function ClusterTabContent({
 }
 
 export default function AppLaunchForm({
-  manifest,
   entryPoint,
   onSubmit,
   submitting,
@@ -727,8 +720,7 @@ export default function AppLaunchForm({
   initialPreRun,
   initialPostRun,
   initialContainer,
-  initialContainerArgs,
-  appName
+  initialContainerArgs
 }: AppLaunchFormProps) {
   const { defaultExtraArgs } = usePreferencesContext();
   const { zonesAndFspQuery } = useZoneAndFspMapContext();
@@ -1254,12 +1246,9 @@ export default function AppLaunchForm({
         type="file"
       />
       <div className="flex items-start justify-between gap-4 mb-1">
-        <div>
-          <Typography className="font-bold mb-1" type="h5">
-            {entryPoint.name}
-          </Typography>
-          <Typography className="block">{appName ?? manifest.name}</Typography>
-        </div>
+        <Typography className="font-bold mb-1" type="h5">
+          {entryPoint.name}
+        </Typography>
         {actionButtons}
       </div>
       {/* Errors (top) */}

From 754fc7653538dfb61817d73784b31d969e2ea8eb Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Thu, 2 Jul 2026 13:51:36 -0400
Subject: [PATCH 24/89] refactor: rename DataLinksActionsMenu to
 CardActionsMenu

The menu now serves data links, NG links, jobs tables, both app card
types, and two detail-page headers, so the data-links name was
misleading. Mechanical rename of the file, component, and props type;
no behavior change.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 frontend/src/components/AppDetail.tsx                       | 4 ++--
 frontend/src/components/ListingDetail.tsx                   | 4 ++--
 frontend/src/components/ui/AppsPage/AppCard.tsx             | 4 ++--
 frontend/src/components/ui/AppsPage/ListingCard.tsx         | 4 ++--
 .../ui/Menus/{DataLinksActions.tsx => CardActionsMenu.tsx}  | 6 +++---
 frontend/src/components/ui/Table/appsJobsColumns.tsx        | 4 ++--
 frontend/src/components/ui/Table/linksColumns.tsx           | 4 ++--
 frontend/src/components/ui/Table/ngLinksColumns.tsx         | 4 ++--
 8 files changed, 17 insertions(+), 17 deletions(-)
 rename frontend/src/components/ui/Menus/{DataLinksActions.tsx => CardActionsMenu.tsx} (88%)

diff --git a/frontend/src/components/AppDetail.tsx b/frontend/src/components/AppDetail.tsx
index 5574f8ca..8ad8e204 100644
--- a/frontend/src/components/AppDetail.tsx
+++ b/frontend/src/components/AppDetail.tsx
@@ -8,7 +8,7 @@ import AppActionDialogs from '@/components/ui/AppsPage/AppActionDialogs';
 import AppInfoTable from '@/components/ui/AppsPage/AppInfoTable';
 import AppPageHeader from '@/components/ui/AppsPage/AppPageHeader';
 import EntryPointsList from '@/components/ui/AppsPage/EntryPointsList';
-import DataLinksActionsMenu from '@/components/ui/Menus/DataLinksActions';
+import CardActionsMenu from '@/components/ui/Menus/CardActionsMenu';
 import type { MenuItem } from '@/components/ui/Menus/FgMenuItems';
 import FgButton from '@/components/designSystem/atoms/FgButton';
 import FgLink from '@/components/designSystem/atoms/FgLink';
@@ -150,7 +150,7 @@ export default function AppDetail() {
                 Launch
               </FgButton>
             ) : null}
-            <DataLinksActionsMenu<UserApp>
+            <CardActionsMenu<UserApp>
               actionProps={app}
               menuItems={menuItems}
               triggerIcon={HiOutlineEllipsisVertical}
diff --git a/frontend/src/components/ListingDetail.tsx b/frontend/src/components/ListingDetail.tsx
index b9b6f6e8..126795d3 100644
--- a/frontend/src/components/ListingDetail.tsx
+++ b/frontend/src/components/ListingDetail.tsx
@@ -7,7 +7,7 @@ import { HiOutlineEllipsisVertical } from 'react-icons/hi2';
 import AppPageHeader from '@/components/ui/AppsPage/AppPageHeader';
 import EntryPointsList from '@/components/ui/AppsPage/EntryPointsList';
 import ListingInfoTable from '@/components/ui/AppsPage/ListingInfoTable';
-import DataLinksActionsMenu from '@/components/ui/Menus/DataLinksActions';
+import CardActionsMenu from '@/components/ui/Menus/CardActionsMenu';
 import type { MenuItem } from '@/components/ui/Menus/FgMenuItems';
 import FgButton from '@/components/designSystem/atoms/FgButton';
 import {
@@ -127,7 +127,7 @@ export default function ListingDetail() {
               </FgButton>
             ) : null}
             {hasMenuItems ? (
-              <DataLinksActionsMenu<AppListing>
+              <CardActionsMenu<AppListing>
                 actionProps={listing}
                 menuItems={menuItems}
                 triggerIcon={HiOutlineEllipsisVertical}
diff --git a/frontend/src/components/ui/AppsPage/AppCard.tsx b/frontend/src/components/ui/AppsPage/AppCard.tsx
index 4e0701a4..4835adab 100644
--- a/frontend/src/components/ui/AppsPage/AppCard.tsx
+++ b/frontend/src/components/ui/AppsPage/AppCard.tsx
@@ -4,7 +4,7 @@ import { Card, Typography } from '@material-tailwind/react';
 import { HiOutlinePlay } from 'react-icons/hi';
 import { HiOutlineEllipsisVertical } from 'react-icons/hi2';
 
-import DataLinksActionsMenu from '@/components/ui/Menus/DataLinksActions';
+import CardActionsMenu from '@/components/ui/Menus/CardActionsMenu';
 import type { MenuItem } from '@/components/ui/Menus/FgMenuItems';
 import FgButton from '@/components/designSystem/atoms/FgButton';
 import FgIcon from '@/components/designSystem/atoms/FgIcon';
@@ -87,7 +87,7 @@ export default function AppCard({ app, actions }: AppCardProps) {
               Launch
             </FgButton>
           </FgTooltip>
-          <DataLinksActionsMenu<UserApp>
+          <CardActionsMenu<UserApp>
             actionProps={app}
             menuItems={menuItems}
             triggerIcon={HiOutlineEllipsisVertical}
diff --git a/frontend/src/components/ui/AppsPage/ListingCard.tsx b/frontend/src/components/ui/AppsPage/ListingCard.tsx
index db38295c..a0593c90 100644
--- a/frontend/src/components/ui/AppsPage/ListingCard.tsx
+++ b/frontend/src/components/ui/AppsPage/ListingCard.tsx
@@ -3,7 +3,7 @@ import { Card, Typography } from '@material-tailwind/react';
 import { HiOutlinePlus } from 'react-icons/hi';
 import { HiOutlineEllipsisVertical } from 'react-icons/hi2';
 
-import DataLinksActionsMenu from '@/components/ui/Menus/DataLinksActions';
+import CardActionsMenu from '@/components/ui/Menus/CardActionsMenu';
 import type { MenuItem } from '@/components/ui/Menus/FgMenuItems';
 import FgButton from '@/components/designSystem/atoms/FgButton';
 import FgIcon from '@/components/designSystem/atoms/FgIcon';
@@ -100,7 +100,7 @@ export default function ListingCard({
               </FgButton>
             </FgTooltip>
           ) : null}
-          <DataLinksActionsMenu<AppListing>
+          <CardActionsMenu<AppListing>
             actionProps={listing}
             menuItems={menuItems}
             triggerIcon={HiOutlineEllipsisVertical}
diff --git a/frontend/src/components/ui/Menus/DataLinksActions.tsx b/frontend/src/components/ui/Menus/CardActionsMenu.tsx
similarity index 88%
rename from frontend/src/components/ui/Menus/DataLinksActions.tsx
rename to frontend/src/components/ui/Menus/CardActionsMenu.tsx
index ad0a20aa..f14b838d 100644
--- a/frontend/src/components/ui/Menus/DataLinksActions.tsx
+++ b/frontend/src/components/ui/Menus/CardActionsMenu.tsx
@@ -7,17 +7,17 @@ import FgIcon from '@/components/designSystem/atoms/FgIcon';
 import FgMenuItems from './FgMenuItems';
 import type { MenuItem } from './FgMenuItems';
 
-type SharedActionsMenuProps<T = unknown> = {
+type CardActionsMenuProps<T = unknown> = {
   readonly menuItems: MenuItem<T>[];
   readonly actionProps: T;
   readonly triggerIcon?: IconType;
 };
 
-export default function DataLinksActionsMenu<T>({
+export default function CardActionsMenu<T>({
   menuItems,
   actionProps,
   triggerIcon = HiOutlineEllipsisHorizontalCircle
-}: SharedActionsMenuProps<T>) {
+}: CardActionsMenuProps<T>) {
   return (
     <Menu>
       <Menu.Trigger
diff --git a/frontend/src/components/ui/Table/appsJobsColumns.tsx b/frontend/src/components/ui/Table/appsJobsColumns.tsx
index 69f3ea54..b1139fb5 100644
--- a/frontend/src/components/ui/Table/appsJobsColumns.tsx
+++ b/frontend/src/components/ui/Table/appsJobsColumns.tsx
@@ -1,7 +1,7 @@
 import type { ColumnDef } from '@tanstack/react-table';
 
 import FgLink from '@/components/designSystem/atoms/FgLink';
-import DataLinksActionsMenu from '@/components/ui/Menus/DataLinksActions';
+import CardActionsMenu from '@/components/ui/Menus/CardActionsMenu';
 import FgTooltip from '@/components/ui/widgets/FgTooltip';
 import JobStatusBadge from '@/components/ui/AppsPage/JobStatusBadge';
 import { formatDateString } from '@/utils';
@@ -178,7 +178,7 @@ export function createAppsJobsColumns(
 
         return (
           <div className="flex items-center justify-end h-full">
-            <DataLinksActionsMenu<JobRowActionProps>
+            <CardActionsMenu<JobRowActionProps>
               actionProps={actionProps}
               menuItems={menuItems}
             />
diff --git a/frontend/src/components/ui/Table/linksColumns.tsx b/frontend/src/components/ui/Table/linksColumns.tsx
index 8d66b603..2fd7c682 100644
--- a/frontend/src/components/ui/Table/linksColumns.tsx
+++ b/frontend/src/components/ui/Table/linksColumns.tsx
@@ -4,7 +4,7 @@ import { Typography } from '@material-tailwind/react';
 import type { ColumnDef } from '@tanstack/react-table';
 import DataLinkDialog from '@/components/ui/Dialogs/DataLink';
 import DataLinkUsageDialog from '@/components/ui/Dialogs/dataLinkUsage/DataLinkUsageDialog';
-import DataLinksActionsMenu from '@/components/ui/Menus/DataLinksActions';
+import CardActionsMenu from '@/components/ui/Menus/CardActionsMenu';
 import { usePreferencesContext } from '@/contexts/PreferencesContext';
 import { useZoneAndFspMapContext } from '@/contexts/ZonesAndFspMapContext';
 import { useProxiedPathContext } from '@/contexts/ProxiedPathContext';
@@ -190,7 +190,7 @@ function ActionsCell({ item }: { readonly item: ProxiedPath }) {
       key={`action-${item.sharing_key}`}
     >
       <div onClick={e => e.stopPropagation()}>
-        <DataLinksActionsMenu<ProxiedPathRowActionProps>
+        <CardActionsMenu<ProxiedPathRowActionProps>
           actionProps={actionProps}
           menuItems={menuItems}
         />
diff --git a/frontend/src/components/ui/Table/ngLinksColumns.tsx b/frontend/src/components/ui/Table/ngLinksColumns.tsx
index c85c98af..bc2f5d58 100644
--- a/frontend/src/components/ui/Table/ngLinksColumns.tsx
+++ b/frontend/src/components/ui/Table/ngLinksColumns.tsx
@@ -6,7 +6,7 @@ import type { ColumnDef } from '@tanstack/react-table';
 import type { NGLink } from '@/queries/ngLinkQueries';
 import { formatDateString } from '@/utils';
 import FgTooltip from '../widgets/FgTooltip';
-import DataLinksActionsMenu from '@/components/ui/Menus/DataLinksActions';
+import CardActionsMenu from '@/components/ui/Menus/CardActionsMenu';
 import type { MenuItem } from '@/components/ui/Menus/FgMenuItems';
 import toast from 'react-hot-toast';
 import { copyToClipboard } from '@/utils/copyText';
@@ -69,7 +69,7 @@ function ActionsCell({
   return (
     <div className="min-w-0 flex items-center">
       <div onClick={e => e.stopPropagation()}>
-        <DataLinksActionsMenu<NGLinkRowActionProps>
+        <CardActionsMenu<NGLinkRowActionProps>
           actionProps={{ item, onEdit, onDelete }}
           menuItems={menuItems}
         />

From fd85618002ccf48c4afbcbe1e816952896c6eb2d Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Thu, 2 Jul 2026 22:38:08 -0400
Subject: [PATCH 25/89] feat(apps): pin apps to commits and run jobs from
 immutable snapshots

Previously all apps from one repo shared a single mutable clone, so
updating any app silently changed the code every sibling app ran (while
their cached manifests went stale), and a pull could mutate the tree
under a running job.

Each app now pins a commit_sha at add time. Jobs run from immutable
per-SHA snapshots (hardlink clones under .snapshots/, cheap in time and
disk), so Update re-pins only the targeted app: siblings and running
jobs keep the exact tree they were pinned to. Manifests with a separate
repo_url get their code repo pinned too (code_commit_sha), and jobs
record the commit they executed for provenance on the job detail page.

Unreferenced snapshots are garbage-collected opportunistically after
update/remove/submit. The keep-set spans app pins, non-terminal jobs
(UNKNOWN counts as live), and terminal jobs younger than 14 days so
recent work-dir repo symlinks stay browsable; a one-hour mtime grace
period plus a hot-path touch protect in-flight launches and
cross-process creation. Deletion renames to .trash-* and finishes on a
daemon thread so the worker's serial loop never stalls; stale trash is
re-swept on later snapshot creation.

A new /api/apps/check-updates endpoint compares pins against remote
tips (one batched worker call, concurrent ls-remotes, 10s timeout) and
powers an "Update available" badge on app cards and the detail page;
bare legacy URLs resolve the remote HEAD rather than assuming main.
Updating now toasts "Updated to <sha>" or "Already up to date", and
legacy unpinned rows are backfilled at first launch. If a pinned
snapshot can't be rebuilt (cache wiped and commit rewritten away),
manifest reads fall back to the branch clone instead of failing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 ...e97_add_commit_pinning_to_apps_and_jobs.py |  39 ++
 fileglancer/apps/__init__.py                  |   5 +
 fileglancer/apps/jobs.py                      |  62 ++-
 fileglancer/apps/manifest.py                  | 406 +++++++++++++++++-
 fileglancer/database.py                       |  51 ++-
 fileglancer/model.py                          |  28 ++
 fileglancer/server.py                         | 204 ++++++++-
 fileglancer/user_worker.py                    |  56 ++-
 frontend/src/components/AppDetail.tsx         |   5 +-
 frontend/src/components/JobDetail.tsx         |  22 +
 .../src/components/ui/AppsPage/AppCard.tsx    |   4 +
 .../components/ui/AppsPage/AppInfoTable.tsx   |  19 +-
 .../ui/AppsPage/UpdateAvailableBadge.tsx      |  11 +
 frontend/src/hooks/useAppActions.ts           |  16 +-
 frontend/src/queries/appsQueries.ts           |  47 +-
 frontend/src/shared.types.ts                  |  13 +
 frontend/src/utils/appUrls.ts                 |  16 +
 frontend/src/utils/index.ts                   |   1 +
 tests/test_apps_endpoints.py                  | 183 ++++++--
 tests/test_catalog_endpoints.py               |  14 +-
 tests/test_snapshots.py                       | 186 ++++++++
 21 files changed, 1300 insertions(+), 88 deletions(-)
 create mode 100644 fileglancer/alembic/versions/f4a1d8c62e97_add_commit_pinning_to_apps_and_jobs.py
 create mode 100644 frontend/src/components/ui/AppsPage/UpdateAvailableBadge.tsx
 create mode 100644 tests/test_snapshots.py

diff --git a/fileglancer/alembic/versions/f4a1d8c62e97_add_commit_pinning_to_apps_and_jobs.py b/fileglancer/alembic/versions/f4a1d8c62e97_add_commit_pinning_to_apps_and_jobs.py
new file mode 100644
index 00000000..a45ae605
--- /dev/null
+++ b/fileglancer/alembic/versions/f4a1d8c62e97_add_commit_pinning_to_apps_and_jobs.py
@@ -0,0 +1,39 @@
+"""add commit pinning to user_apps and jobs
+
+Revision ID: f4a1d8c62e97
+Revises: c1f9a4e7b2d8
+Create Date: 2026-07-02 00:00:00.000000
+
+user_apps.commit_sha pins each app to the exact commit it was added or last
+updated at; jobs run from an immutable per-SHA snapshot of that commit rather
+than the mutable branch clone. code_commit_sha is the equivalent pin for a
+manifest's separate code repo (repo_url), when one is declared.
+jobs.commit_sha records the commit whose code the job actually executed, and
+jobs.code_repo_url the repo that commit belongs to when it isn't the app repo.
+
+All columns are nullable: legacy rows have no pin and are backfilled the next
+time the app is launched or updated.
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision = 'f4a1d8c62e97'
+down_revision = 'c1f9a4e7b2d8'
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column('user_apps', sa.Column('commit_sha', sa.String(), nullable=True))
+    op.add_column('user_apps', sa.Column('code_commit_sha', sa.String(), nullable=True))
+    op.add_column('jobs', sa.Column('commit_sha', sa.String(), nullable=True))
+    op.add_column('jobs', sa.Column('code_repo_url', sa.String(), nullable=True))
+
+
+def downgrade() -> None:
+    op.drop_column('jobs', 'code_repo_url')
+    op.drop_column('jobs', 'commit_sha')
+    op.drop_column('user_apps', 'code_commit_sha')
+    op.drop_column('user_apps', 'commit_sha')
diff --git a/fileglancer/apps/__init__.py b/fileglancer/apps/__init__.py
index 481306ba..45f0ce0b 100644
--- a/fileglancer/apps/__init__.py
+++ b/fileglancer/apps/__init__.py
@@ -5,12 +5,17 @@
     _ensure_repo_cache,
     clone_url_for_stored_app,
     discover_app_manifests,
+    ensure_repo_snapshot,
     fetch_app_manifest,
+    gc_repo_snapshots,
     get_app_branch,
+    get_remote_head,
+    get_remote_heads,
     canonical_app_url,
     get_or_load_manifest,
     refresh_cached_manifest,
     set_worker_exec,
+    validate_commit_sha,
 )
 from fileglancer.apps.command import (  # noqa: F401
     _TOOL_REGISTRY,
diff --git a/fileglancer/apps/jobs.py b/fileglancer/apps/jobs.py
index 04da2627..c797737e 100644
--- a/fileglancer/apps/jobs.py
+++ b/fileglancer/apps/jobs.py
@@ -21,7 +21,7 @@
 from fileglancer.apps.manifest import (
     clone_url_for_stored_app,
     _dispatch,
-    _ensure_repo_cache,
+    ensure_repo_snapshot,
     get_or_load_manifest,
     validate_manifest_path,
 )
@@ -687,6 +687,9 @@ async def submit_job(
     # Not in the user's library: clone the URL as given (a bare URL resolves the
     # current default). Overridden below with the pinned URL when installed.
     app_clone_url = app_url
+    app_installed = False
+    pinned_sha = None
+    pinned_code_sha = None
 
     with db.get_db_session(settings.db_url) as session:
         # Read user's container cache dir preference
@@ -699,9 +702,50 @@ async def submit_job(
         user_app = db.get_user_app(session, username, app_url, manifest_path)
         app_name = user_app.name if user_app is not None else manifest.name
         if user_app is not None:
+            app_installed = True
             stored_app_url = user_app.url
             app_clone_url = clone_url_for_stored_app(stored_app_url, user_app.branch)
+            pinned_sha = user_app.commit_sha
+            pinned_code_sha = user_app.code_commit_sha
+
+    # Resolve the immutable snapshot the job will run from. A pinned app finds
+    # its snapshot already on disk (no git work, no network); a legacy unpinned
+    # row resolves the branch clone's current HEAD and is pinned to it below,
+    # so it never drifts again. Pulling is never done here; updates are an
+    # explicit user action via the "Update" app endpoint.
+    executed_repo_url = None
+    if manifest.repo_url and canonical_github_url(manifest.repo_url) != stored_app_url:
+        # Manifest and tool code live in separate repos: the job runs from the
+        # code repo's snapshot root.
+        cached_repo_dir, executed_sha = await ensure_repo_snapshot(
+            manifest.repo_url, sha=pinned_code_sha, username=username)
+        cd_suffix = "repo"
+        executed_repo_url = canonical_github_url(manifest.repo_url)
+        if app_installed and (pinned_sha is None or pinned_code_sha is None):
+            app_sha = pinned_sha
+            if app_sha is None:
+                # Pin the manifest repo as well — left unpinned, this app's
+                # manifest would keep drifting with the shared branch clone
+                # and update checks would skip it forever.
+                _, app_sha = await ensure_repo_snapshot(
+                    app_clone_url, username=username)
+            with db.get_db_session(settings.db_url) as session:
+                db.set_user_app_pins(session, username, stored_app_url,
+                                     manifest_path,
+                                     commit_sha=app_sha,
+                                     code_commit_sha=executed_sha)
+    else:
+        # Manifest and tool code share one repo: run from the subdirectory
+        # that contains the manifest.
+        cached_repo_dir, executed_sha = await ensure_repo_snapshot(
+            app_clone_url, sha=pinned_sha, username=username)
+        cd_suffix = f"repo/{manifest_path}" if manifest_path else "repo"
+        if app_installed and pinned_sha is None:
+            with db.get_db_session(settings.db_url) as session:
+                db.set_user_app_pins(session, username, stored_app_url,
+                                     manifest_path, commit_sha=executed_sha)
 
+    with db.get_db_session(settings.db_url) as session:
         db_job = db.create_job(
             session=session,
             username=username,
@@ -722,6 +766,8 @@ async def submit_job(
             command=entry_point.command,
             conda_env=entry_point.conda_env,
             requirements=effective_requirements,
+            commit_sha=executed_sha,
+            code_repo_url=executed_repo_url,
         )
         job_id = db_job.id
 
@@ -732,20 +778,6 @@ async def submit_job(
         db_job.work_dir = str(work_dir)
         session.commit()
 
-    # Ensure the repo is cached in the user's cache (~username/.fileglancer/apps).
-    # Pulling is never done here; updates are an explicit user action via the
-    # "Update" app endpoint. The manifest read above already reflects the cache.
-    if manifest.repo_url and canonical_github_url(manifest.repo_url) != stored_app_url:
-        # Manifest and tool code live in separate repos: cache the code repo
-        # and run from its root.
-        cached_repo_dir = await _ensure_repo_cache(manifest.repo_url, username=username)
-        cd_suffix = "repo"
-    else:
-        # Manifest and tool code share one repo: cache it and run from the
-        # subdirectory that contains the manifest.
-        cached_repo_dir = await _ensure_repo_cache(app_clone_url, username=username)
-        cd_suffix = f"repo/{manifest_path}" if manifest_path else "repo"
-
     # Build environment variable export lines
     env_lines = ""
     if merged_env:
diff --git a/fileglancer/apps/manifest.py b/fileglancer/apps/manifest.py
index 6e4c8307..9e0668f4 100644
--- a/fileglancer/apps/manifest.py
+++ b/fileglancer/apps/manifest.py
@@ -2,7 +2,10 @@
 
 import asyncio
 import os
+import re
 import shutil
+import threading
+import time
 from contextlib import suppress
 from pathlib import Path, PurePosixPath
 
@@ -46,6 +49,21 @@ async def _dispatch(username: str, action: str, **kwargs) -> dict:
 
 _MANIFEST_FILENAME = "runnables.yaml"
 
+# Immutable per-commit checkouts live under <owner>/<repo>/.snapshots/<sha>.
+# The dirname starts with '.' so it can never collide with a branch-named
+# clone directory (git forbids ref components that begin with a dot).
+_SNAPSHOTS_DIRNAME = ".snapshots"
+_SHA_PATTERN = re.compile(r"^[0-9a-f]{40}$")
+
+
+def validate_commit_sha(sha: str) -> str:
+    """Validate a full 40-hex commit SHA. It becomes a path component and a
+    git argument, so anything else is rejected."""
+    if not sha or not _SHA_PATTERN.fullmatch(sha):
+        raise ValueError(f"Invalid commit SHA: '{sha}'")
+    return sha
+
+
 def _repo_cache_base(username: str | None = None) -> Path:
     """Return the repo cache base directory, optionally for a specific user."""
     if username:
@@ -355,6 +373,331 @@ async def _ensure_repo_cache(url: str, pull: bool = False,
     return repo_dir
 
 
+# --- Immutable per-commit snapshots -----------------------------------------
+#
+# Apps are pinned to a commit (user_apps.commit_sha) and jobs run from an
+# immutable checkout of that commit, not from the mutable branch clone. The
+# branch clone remains the fetch target; snapshots are materialized from it as
+# local hardlink clones, so they are cheap in time and disk while still being
+# fully self-contained (their .git works when bind-mounted into a container).
+# Updating an app creates a new snapshot and repoints the row — sibling apps
+# in the same repo and already-running jobs keep the tree they were pinned to.
+
+
+def _snapshots_dir(owner: str, repo: str) -> Path:
+    return _repo_cache_base() / owner / repo / _SNAPSHOTS_DIRNAME
+
+
+async def _git_head_sha(repo_dir: Path) -> str:
+    stdout, _ = await _run_git(["git", "-C", str(repo_dir), "rev-parse", "HEAD"])
+    return stdout.decode().strip()
+
+
+async def _create_snapshot(owner: str, repo: str, repo_dir: Path, sha: str,
+                           snapshot_dir: Path) -> None:
+    """Materialize an immutable checkout of sha from the branch clone.
+
+    Builds the snapshot in a sibling .tmp dir and renames it into place, so a
+    half-built snapshot is never observable at the final path. Caller holds
+    the per-snapshot lock.
+    """
+    # The pinned commit may predate the branch clone's current tip (a sibling
+    # app's update pulled past it). If the object isn't present locally, fetch
+    # it explicitly — GitHub serves reachable commits by SHA.
+    try:
+        await _run_git(["git", "-C", str(repo_dir), "cat-file", "-e",
+                        f"{sha}^{{commit}}"])
+    except ValueError:
+        try:
+            await _run_git(["git", "-C", str(repo_dir), "fetch", "origin", sha],
+                           timeout=120, extra_env=_SSH_GIT_ENV)
+        except ValueError as e:
+            raise ValueError(
+                f"Commit {sha[:7]} is no longer available in {owner}/{repo} "
+                f"(its history may have been rewritten). Update the app to "
+                f"pin it to the current revision. ({e})"
+            )
+
+    snapshot_dir.parent.mkdir(parents=True, exist_ok=True)
+    tmp_dir = snapshot_dir.parent / f".tmp-{sha}"
+    shutil.rmtree(tmp_dir, ignore_errors=True)
+    try:
+        # Local clone: objects are hardlinked. --no-checkout because the
+        # branch clone's HEAD may be detached (tag-pinned apps), which some
+        # git versions refuse to check out during clone; we check out the
+        # exact commit ourselves either way.
+        await _run_git(["git", "clone", "--no-checkout", str(repo_dir),
+                        str(tmp_dir)], timeout=300)
+        await _run_git(["git", "-C", str(tmp_dir), "checkout", "--detach", sha],
+                       timeout=300)
+        # Keep the commit reachable inside the snapshot regardless of where
+        # its branches move, so nothing can ever gc it out from under a job.
+        await _run_git(["git", "-C", str(tmp_dir), "tag", "-f",
+                        "fileglancer-pin", sha])
+        # Point origin at GitHub rather than at the local branch clone.
+        https_url, _ = _github_remote_urls(owner, repo)
+        await _run_git(["git", "-C", str(tmp_dir), "remote", "set-url",
+                        "origin", https_url])
+        try:
+            os.rename(tmp_dir, snapshot_dir)
+        except OSError:
+            # Lost a creation race — the existing snapshot is equivalent.
+            if not (snapshot_dir / ".git").exists():
+                raise
+    finally:
+        shutil.rmtree(tmp_dir, ignore_errors=True)
+
+
+async def ensure_repo_snapshot(url: str, sha: str | None = None,
+                               pull: bool = False,
+                               username: str | None = None) -> tuple[Path, str]:
+    """Return (snapshot_dir, sha) for an immutable checkout of the repo at sha.
+
+    sha=None means "the branch clone's current HEAD" (after pulling when
+    pull=True): used at add/update time to pin an app, and at launch time to
+    backfill legacy unpinned rows.
+
+    When username is provided, the work is delegated to a worker subprocess
+    running as the target user.
+    """
+    if sha is not None:
+        validate_commit_sha(sha)
+
+    if username:
+        result = await _dispatch(username, "ensure_snapshot", url=url, sha=sha,
+                                 pull=pull)
+        return Path(result["snapshot_dir"]), result["sha"]
+
+    owner, repo, _ = _parse_github_url(url)
+
+    # Hot path (job launch of a pinned app): the snapshot already exists, so
+    # no git work — and no network — happens at all. Touch the directory so
+    # the GC grace period protects a snapshot that is about to be launched
+    # from but isn't yet referenced by a committed job row.
+    if sha is not None and not pull:
+        snapshot_dir = _snapshots_dir(owner, repo) / sha
+        if (snapshot_dir / ".git").exists():
+            with suppress(OSError):
+                os.utime(snapshot_dir)
+            return snapshot_dir, sha
+
+    repo_dir = await _ensure_repo_cache(url, pull=pull)
+    if sha is None:
+        sha = await _git_head_sha(repo_dir)
+    snapshot_dir = _snapshots_dir(owner, repo) / sha
+
+    lock = _get_repo_lock(owner, repo, f"snapshot/{sha}")
+    async with lock:
+        if (snapshot_dir / ".git").exists():
+            with suppress(OSError):
+                os.utime(snapshot_dir)
+            return snapshot_dir, sha
+        # A directory without .git is debris from an interrupted delete.
+        if snapshot_dir.exists():
+            shutil.rmtree(snapshot_dir, ignore_errors=True)
+        await _create_snapshot(owner, repo, repo_dir, sha, snapshot_dir)
+
+    # Opportunistically resume deleting stale trash left by a gc whose
+    # background delete was cut short (e.g. worker eviction mid-rmtree).
+    _delete_dirs_in_background(_stale_trash_dirs(_snapshots_dir(owner, repo)))
+    return snapshot_dir, sha
+
+
+def _delete_dirs_in_background(paths: list[Path]) -> None:
+    """Delete directories on a daemon thread.
+
+    Snapshot trees can be large (pixi envs build inside them) and live on NFS;
+    deleting inline would stall the worker's serial request loop.
+    """
+    if not paths:
+        return
+
+    def _rm():
+        for p in paths:
+            shutil.rmtree(p, ignore_errors=True)
+
+    threading.Thread(target=_rm, daemon=True, name="fg-snapshot-gc").start()
+
+
+# How recently a snapshot (or .tmp/.trash dir) must have been touched to be
+# exempt from gc. Guards the windows the DB keep-set cannot see: a snapshot
+# resolved by a launch whose job row isn't committed yet, a .tmp dir another
+# process is mid-clone into (the per-repo locks are process-local), and a
+# .trash dir another process's delete thread is still working through.
+_GC_GRACE_SECONDS = 3600
+
+
+def _is_recent(path: Path) -> bool:
+    try:
+        return (time.time() - path.stat().st_mtime) < _GC_GRACE_SECONDS
+    except OSError:
+        # Vanished (e.g. another process's delete finished) — nothing to do.
+        return True
+
+
+def _stale_trash_dirs(snapshots_dir: Path) -> list[Path]:
+    """Trash dirs old enough that no delete thread can still be on them."""
+    if not snapshots_dir.is_dir():
+        return []
+    return [
+        entry for entry in snapshots_dir.iterdir()
+        if entry.name.startswith(".trash-") and not _is_recent(entry)
+    ]
+
+
+async def gc_repo_snapshots(url: str, keep_shas: list[str],
+                            username: str | None = None) -> list[str]:
+    """Remove snapshots of this repo that no app or retained job references.
+
+    keep_shas is computed by the caller from the database (every user_apps pin
+    for this owner/repo plus the SHAs of retained jobs). Anything created or
+    used within the grace period is skipped regardless — the DB can't see a
+    launch that hasn't committed its job row yet, nor another server process's
+    in-flight snapshot creation. Directories are renamed out of the way
+    immediately and deleted in the background. Returns the SHAs removed.
+    Never touches branch clones.
+    """
+    if username:
+        result = await _dispatch(username, "gc_snapshots", url=url,
+                                 keep_shas=list(keep_shas))
+        return result["removed"]
+
+    owner, repo, _ = _parse_github_url(url)
+    keep = {s for s in keep_shas if s and _SHA_PATTERN.fullmatch(s)}
+    snapshots_dir = _snapshots_dir(owner, repo)
+    if not snapshots_dir.is_dir():
+        return []
+
+    removed: list[str] = []
+    to_delete: list[Path] = []
+    for entry in list(snapshots_dir.iterdir()):
+        name = entry.name
+        if name.startswith(".trash-"):
+            # Leftover from a previous gc whose delete never finished. Recent
+            # trash may still have an active delete thread — leave it alone.
+            if not _is_recent(entry):
+                to_delete.append(entry)
+            continue
+        is_tmp = name.startswith(".tmp-")
+        sha = name[len(".tmp-"):] if is_tmp else name
+        if not _SHA_PATTERN.fullmatch(sha) or sha in keep:
+            continue
+        if _is_recent(entry):
+            continue
+        # The per-snapshot lock serializes against an in-flight creation in
+        # this process: if one was underway, it completes first (and a .tmp
+        # entry will have been renamed to its final path, making it vanish
+        # from under us).
+        async with _get_repo_lock(owner, repo, f"snapshot/{sha}"):
+            if not entry.exists() or _is_recent(entry):
+                continue
+            trash = snapshots_dir / f".trash-{sha}-{os.getpid()}-{len(to_delete)}"
+            try:
+                os.rename(entry, trash)
+            except OSError:
+                continue
+        to_delete.append(trash)
+        if not is_tmp:
+            removed.append(sha)
+
+    _delete_dirs_in_background(to_delete)
+    if removed:
+        logger.info(f"GC removed {len(removed)} snapshot(s) of {owner}/{repo}")
+    return removed
+
+
+# Timeout per ls-remote for update checks. These run while the user's serial
+# worker is occupied (blocking their file browsing etc.), so fail fast — a
+# missed badge beats a hung UI when GitHub is slow.
+_LS_REMOTE_TIMEOUT = 10
+
+
+async def get_remote_head(url: str, username: str | None = None) -> str | None:
+    """Resolve the remote tip commit of the revision baked into a stored URL.
+
+    Used by the update-available check: compares against the app's pinned
+    commit_sha. Returns None when the remote can't be reached or the revision
+    no longer exists (no badge rather than an error). A revision that is
+    itself a commit SHA resolves to itself — such an app can never drift.
+
+    A URL without a revision only reaches here for legacy branch=None rows
+    (clone_url_for_stored_app makes pinned revisions explicit) and for code
+    repos referenced by bare manifest repo_urls; both track the remote's
+    *current default*, so resolve HEAD rather than assuming "main".
+    """
+    if username:
+        result = await _dispatch(username, "remote_heads", urls=[url])
+        return (result.get("shas") or {}).get(url)
+
+    owner, repo, branch = _parse_github_url(url)
+    if branch and _SHA_PATTERN.fullmatch(branch):
+        return branch
+
+    if branch:
+        patterns = [f"refs/heads/{branch}", f"refs/tags/{branch}"]
+        # Branch tips win; for annotated tags prefer the peeled commit
+        # (refs/tags/x^{}) that ls-remote emits alongside the tag object.
+        preference = (f"refs/heads/{branch}",
+                      f"refs/tags/{branch}^{{}}",
+                      f"refs/tags/{branch}")
+    else:
+        patterns = ["HEAD"]
+        preference = ("HEAD",)
+
+    https_url, ssh_url = _github_remote_urls(owner, repo)
+    for remote, extra_env in ((https_url, None), (ssh_url, _SSH_GIT_ENV)):
+        try:
+            stdout, _ = await _run_git(
+                ["git", "ls-remote", remote, *patterns],
+                timeout=_LS_REMOTE_TIMEOUT, extra_env=extra_env,
+            )
+        except ValueError as e:
+            # Private repo over HTTPS: retry via SSH; anything else, give up.
+            if _is_git_auth_error(str(e)):
+                continue
+            return None
+        except Exception:
+            return None
+
+        shas_by_ref: dict[str, str] = {}
+        for line in stdout.decode().splitlines():
+            parts = line.split()
+            if len(parts) == 2:
+                shas_by_ref[parts[1]] = parts[0]
+        for ref in preference:
+            sha = shas_by_ref.get(ref)
+            if sha and _SHA_PATTERN.fullmatch(sha):
+                return sha
+        return None
+    return None
+
+
+async def get_remote_heads(urls: list[str],
+                           username: str | None = None) -> dict[str, str | None]:
+    """Resolve remote tips for several stored URLs in one worker round-trip.
+
+    The per-user worker handles one request at a time, so N sequential
+    dispatches would occupy it for N ls-remote timeouts; batching bounds the
+    occupancy to the slowest single lookup (they run concurrently in-process).
+    """
+    urls = list(dict.fromkeys(urls))
+    if not urls:
+        return {}
+
+    if username:
+        result = await _dispatch(username, "remote_heads", urls=urls)
+        shas = result.get("shas") or {}
+        return {url: shas.get(url) for url in urls}
+
+    results = await asyncio.gather(
+        *(get_remote_head(url) for url in urls), return_exceptions=True,
+    )
+    return {
+        url: (sha if isinstance(sha, str) else None)
+        for url, sha in zip(urls, results)
+    }
+
+
 _SKIP_DIRS = {'.git', 'node_modules', '__pycache__', '.pixi', '.venv', 'venv'}
 
 
@@ -449,14 +792,15 @@ def _find_manifests_in_repo(repo_dir: Path) -> list[tuple[str, AppManifest]]:
 async def discover_app_manifests(
     url: str,
     username: str | None = None,
-) -> tuple[str, list[tuple[str, AppManifest]]]:
+) -> tuple[str, str | None, list[tuple[str, AppManifest]]]:
     """Clone/pull a GitHub repo and discover all manifest files.
 
-    Returns (resolved_branch, [(relative_dir_path, AppManifest), ...]). The
-    resolved branch is the revision actually cloned — resolved in the same
+    Returns (resolved_branch, head_sha, [(relative_dir_path, AppManifest), ...]).
+    The resolved branch is the revision actually cloned — resolved in the same
     process that does the clone, so a private repo's real default branch is used
-    rather than a fallback. Raises ValueError if the URL is invalid or the clone
-    fails.
+    rather than a fallback. head_sha is the commit at the tip of that revision,
+    used to pin apps added from this discovery. Raises ValueError if the URL is
+    invalid or the clone fails.
 
     When username is provided, the work is delegated to a worker subprocess
     running as the target user (which holds the user's SSH credentials).
@@ -467,37 +811,69 @@ async def discover_app_manifests(
             (item["path"], AppManifest(**item["manifest"]))
             for item in result["manifests"]
         ]
-        return result["branch"], manifests
+        return result["branch"], result.get("head_sha"), manifests
 
     repo_dir = await _ensure_repo_cache(url, pull=True)
     owner, repo, _ = _parse_github_url(url)
     branch = repo_dir.relative_to(
         (_repo_cache_base() / owner / repo).resolve()
     ).as_posix()
-    return branch, _find_manifests_in_repo(repo_dir)
+    head_sha = await _git_head_sha(repo_dir)
+    return branch, head_sha, _find_manifests_in_repo(repo_dir)
 
 
 async def fetch_app_manifest(url: str, manifest_path: str = "",
-                             username: str | None = None) -> AppManifest:
+                             username: str | None = None,
+                             sha: str | None = None) -> AppManifest:
     """Fetch and validate an app manifest from a cloned repo.
 
-    Clones the repo if needed, then reads the manifest from disk.
+    With sha, the manifest is read from the immutable snapshot of that commit
+    (materializing it if needed) — a pinned app's manifest never drifts just
+    because the branch clone was pulled past its pin. Without sha, reads from
+    the mutable branch clone (preview semantics), cloning if needed.
 
     When username is provided, the work is delegated to a worker subprocess
     running as the target user.
     """
     # Reject traversal/unsafe input early, before any worker round-trip.
     validate_manifest_path(manifest_path)
+    if sha is not None:
+        validate_commit_sha(sha)
 
     if username:
-        result = await _dispatch(username, "read_manifest", url=url, manifest_path=manifest_path)
+        result = await _dispatch(username, "read_manifest", url=url,
+                                 manifest_path=manifest_path, sha=sha)
         return AppManifest(**result["manifest"])
 
-    repo_dir = await _ensure_repo_cache(url)
+    if sha is not None:
+        repo_dir, _ = await ensure_repo_snapshot(url, sha=sha)
+    else:
+        repo_dir = await _ensure_repo_cache(url)
     target_dir = _safe_repo_subdir(repo_dir, manifest_path)
     return _read_manifest_file(target_dir)
 
 
+async def _fetch_manifest_with_pin_fallback(fetch_url: str, manifest_path: str,
+                                            username: str | None,
+                                            sha: str | None) -> AppManifest:
+    """Read the manifest at the pinned commit, falling back to the branch
+    clone when the pin can't be materialized (snapshot lost and the commit
+    rewritten away upstream). A drifted manifest beats an unusable app; the
+    next successful update re-pins.
+    """
+    if sha is None:
+        return await fetch_app_manifest(fetch_url, manifest_path, username=username)
+    try:
+        return await fetch_app_manifest(fetch_url, manifest_path,
+                                        username=username, sha=sha)
+    except Exception as e:
+        logger.warning(
+            f"Pinned manifest read failed for {fetch_url}@{sha[:7]} ({e}); "
+            f"falling back to the branch clone"
+        )
+        return await fetch_app_manifest(fetch_url, manifest_path, username=username)
+
+
 async def get_or_load_manifest(username: str, url: str,
                                 manifest_path: str = "") -> AppManifest:
     """Return the manifest for an app, preferring the DB cache.
@@ -523,6 +899,7 @@ async def get_or_load_manifest(username: str, url: str,
         row_exists = row is not None
         row_url = row.url if row is not None else url
         row_branch = row.branch if row is not None else None
+        row_sha = row.commit_sha if row is not None else None
 
     if stored is not None:
         try:
@@ -531,7 +908,8 @@ async def get_or_load_manifest(username: str, url: str,
             logger.warning(f"Stored manifest schema mismatch for {url}: {e}")
 
     fetch_url = clone_url_for_stored_app(row_url, row_branch) if row_exists else url
-    manifest = await fetch_app_manifest(fetch_url, manifest_path, username=username)
+    manifest = await _fetch_manifest_with_pin_fallback(
+        fetch_url, manifest_path, username, row_sha)
 
     if row_exists:
         # branch=None: this is a cache refresh, so leave the requested revision
@@ -569,9 +947,11 @@ async def refresh_cached_manifest(username: str, url: str,
         row_exists = row is not None
         row_url = row.url if row_exists else url
         row_branch = row.branch if row_exists else None
+        row_sha = row.commit_sha if row_exists else None
 
     fetch_url = clone_url_for_stored_app(row_url, row_branch) if row_exists else url
-    manifest = await fetch_app_manifest(fetch_url, manifest_path, username=username)
+    manifest = await _fetch_manifest_with_pin_fallback(
+        fetch_url, manifest_path, username, row_sha)
 
     with db.get_db_session(settings.db_url) as session:
         if row_exists:
diff --git a/fileglancer/database.py b/fileglancer/database.py
index 4d6bb9c3..882d783d 100644
--- a/fileglancer/database.py
+++ b/fileglancer/database.py
@@ -180,6 +180,13 @@ class JobDB(Base):
     # detail endpoint build browse links without realpath'ing mounts per read.
     work_dir_fsp_name = Column(String, nullable=True)
     work_dir_subpath = Column(String, nullable=True)
+    # Commit whose code this job executed (the code repo's SHA when the
+    # manifest declares a separate repo_url, else the app repo's SHA). NULL for
+    # jobs submitted before commit pinning existed.
+    commit_sha = Column(String, nullable=True)
+    # Repo the executed commit belongs to, when it differs from app_url
+    # (manifests with a separate repo_url). NULL means commit_sha is app_url's.
+    code_repo_url = Column(String, nullable=True)
     created_at = Column(DateTime, nullable=False, default=lambda: datetime.now(UTC))
     started_at = Column(DateTime, nullable=True)
     finished_at = Column(DateTime, nullable=True)
@@ -196,6 +203,12 @@ class UserAppDB(Base):
     name = Column(String, nullable=False)
     description = Column(String, nullable=True)
     branch = Column(String, nullable=True)
+    # Commit the app is pinned to: jobs run from an immutable snapshot of this
+    # SHA, and only an explicit Update moves it. NULL for legacy rows, which
+    # get pinned on their next launch or update.
+    commit_sha = Column(String, nullable=True)
+    # Pin for the manifest's separate code repo (repo_url), when declared.
+    code_commit_sha = Column(String, nullable=True)
     manifest = Column(JSON, nullable=True)
     added_at = Column(DateTime, nullable=False, default=lambda: datetime.now(UTC))
     updated_at = Column(DateTime, nullable=True)
@@ -956,7 +969,9 @@ def create_job(session: Session, username: str, app_url: str, app_name: str,
                container_args: Optional[str] = None,
                command: Optional[str] = None,
                conda_env: Optional[str] = None,
-               requirements: Optional[List[str]] = None) -> JobDB:
+               requirements: Optional[List[str]] = None,
+               commit_sha: Optional[str] = None,
+               code_repo_url: Optional[str] = None) -> JobDB:
     """Create a new job record"""
     now = datetime.now(UTC)
     job = JobDB(
@@ -978,6 +993,8 @@ def create_job(session: Session, username: str, app_url: str, app_name: str,
         command=command,
         conda_env=conda_env,
         requirements=requirements,
+        commit_sha=commit_sha,
+        code_repo_url=code_repo_url,
         status="PENDING",
         created_at=now
     )
@@ -1087,6 +1104,8 @@ def upsert_user_app(session: Session, username: str, url: str,
                     name: str,
                     description: Optional[str] = None,
                     branch: Optional[str] = None,
+                    commit_sha: Optional[str] = None,
+                    code_commit_sha: Optional[str] = None,
                     manifest: Optional[Dict] = None,
                     bump_updated_at: bool = True) -> UserAppDB:
     """Insert or update a user app row.
@@ -1102,6 +1121,10 @@ def upsert_user_app(session: Session, username: str, url: str,
     Pass branch=None to leave an existing row's branch untouched —
     manifest-cache refreshes use this so they don't clobber the requested
     revision with a resolved one.
+
+    commit_sha / code_commit_sha are the app's pins (see UserAppDB). Like
+    branch, None means "leave the existing value untouched" — only add, update
+    and launch-time backfill move a pin.
     """
     now = datetime.now(UTC)
     url = canonical_github_url(url)
@@ -1114,6 +1137,8 @@ def upsert_user_app(session: Session, username: str, url: str,
             name=name,
             description=description,
             branch=branch,
+            commit_sha=commit_sha,
+            code_commit_sha=code_commit_sha,
             manifest=manifest,
             added_at=now,
         )
@@ -1123,6 +1148,10 @@ def upsert_user_app(session: Session, username: str, url: str,
         row.description = description
         if branch is not None:
             row.branch = branch
+        if commit_sha is not None:
+            row.commit_sha = commit_sha
+        if code_commit_sha is not None:
+            row.code_commit_sha = code_commit_sha
         row.manifest = manifest
         if bump_updated_at:
             row.updated_at = now
@@ -1130,6 +1159,26 @@ def upsert_user_app(session: Session, username: str, url: str,
     return row
 
 
+def set_user_app_pins(session: Session, username: str, url: str,
+                      manifest_path: str = "", *,
+                      commit_sha: Optional[str] = None,
+                      code_commit_sha: Optional[str] = None) -> Optional[UserAppDB]:
+    """Set an app row's commit pins without touching any other field.
+
+    Used by launch-time backfill of legacy unpinned rows. None leaves a pin
+    unchanged. Returns the row, or None if it doesn't exist.
+    """
+    row = get_user_app(session, username, url, manifest_path)
+    if row is None:
+        return None
+    if commit_sha is not None:
+        row.commit_sha = commit_sha
+    if code_commit_sha is not None:
+        row.code_commit_sha = code_commit_sha
+    session.commit()
+    return row
+
+
 def delete_user_app(session: Session, username: str, url: str,
                     manifest_path: str = "") -> bool:
     """Delete a user app row. Returns True if a row was deleted."""
diff --git a/fileglancer/model.py b/fileglancer/model.py
index 59e0e966..9683f0cc 100644
--- a/fileglancer/model.py
+++ b/fileglancer/model.py
@@ -682,6 +682,14 @@ class UserApp(BaseModel):
     url: str = Field(description="URL to the app manifest")
     manifest_path: str = Field(description="Relative directory path to the manifest within the repo", default="")
     branch: Optional[str] = Field(description="Revision the user requested; empty means no explicit revision was requested. The fixed actually-cloned revision is baked into url; a bare stored URL means main.", default=None)
+    commit_sha: Optional[str] = Field(
+        description="Commit the app is pinned to; jobs run an immutable snapshot of this SHA. None for legacy rows not yet pinned.",
+        default=None,
+    )
+    code_commit_sha: Optional[str] = Field(
+        description="Pin for the manifest's separate code repo (repo_url), when declared.",
+        default=None,
+    )
     name: str = Field(description="App name from manifest")
     description: Optional[str] = Field(description="App description from manifest", default=None)
     added_at: datetime = Field(description="When the app was added")
@@ -786,6 +794,21 @@ class DiscoveredApp(BaseModel):
     )
 
 
+class AppUpdateCheck(BaseModel):
+    """Whether a newer commit exists on an app's pinned revision"""
+    url: str = Field(description="Canonical URL of the app")
+    manifest_path: str = Field(description="Manifest path within the repo", default="")
+    commit_sha: Optional[str] = Field(description="Commit the app is currently pinned to", default=None)
+    latest_sha: Optional[str] = Field(
+        description="Tip of the pinned revision on the remote; None if it could not be resolved",
+        default=None,
+    )
+    update_available: bool = Field(
+        description="True when the remote tip differs from the pinned commit",
+        default=False,
+    )
+
+
 class AppRemoveRequest(BaseModel):
     """Request to remove an app"""
     url: str = Field(description="URL of the app to remove")
@@ -825,6 +848,11 @@ class Job(BaseModel):
     conda_env: Optional[str] = Field(description="Conda environment activated for the job", default=None)
     requirements: Optional[List[str]] = Field(description="Declared runtime requirements (e.g. ['nextflow', 'apptainer'])", default=None)
     work_dir: Optional[str] = Field(description="Working directory the job ran in", default=None)
+    commit_sha: Optional[str] = Field(description="Commit whose code the job executed", default=None)
+    code_repo_url: Optional[str] = Field(
+        description="Repo the executed commit belongs to, when it differs from app_url",
+        default=None,
+    )
     cluster_job_id: Optional[str] = Field(description="Cluster-assigned job ID", default=None)
     service_url: Optional[str] = Field(description="URL of the running service (for service-type jobs)", default=None)
     phase: Optional[str] = Field(description="Startup phase of a running service before its URL is ready, e.g. 'pulling_image' or 'starting'", default=None)
diff --git a/fileglancer/server.py b/fileglancer/server.py
index 67d4b62c..33a9de6e 100644
--- a/fileglancer/server.py
+++ b/fileglancer/server.py
@@ -1,3 +1,4 @@
+import asyncio
 import os
 import re
 import sys
@@ -1680,6 +1681,8 @@ async def get_user_apps(username: str = Depends(get_current_user)):
                     "name": row.name,
                     "description": row.description,
                     "branch": row.branch,
+                    "commit_sha": row.commit_sha,
+                    "code_commit_sha": row.code_commit_sha,
                     "manifest": row.manifest,
                     "added_at": row.added_at,
                     "updated_at": row.updated_at,
@@ -1710,6 +1713,8 @@ async def get_user_apps(username: str = Depends(get_current_user)):
                 name=snap["name"],
                 description=snap["description"],
                 branch=snap["branch"],
+                commit_sha=snap["commit_sha"],
+                code_commit_sha=snap["code_commit_sha"],
                 added_at=snap["added_at"],
                 updated_at=snap["updated_at"],
                 manifest=manifest_obj,
@@ -1732,14 +1737,73 @@ async def get_user_apps(username: str = Depends(get_current_user)):
             user_app.description = manifest.description
         return result
 
+    # How long a finished job keeps its snapshot alive. Work dirs carry a
+    # `repo` symlink into the snapshot, so collecting it immediately would
+    # break browsing a recent job's code; jobs older than this trade that
+    # for reclaiming the (potentially large) snapshot tree.
+    _JOB_SNAPSHOT_RETENTION = timedelta(days=14)
+    _TERMINAL_JOB_STATUSES = ("DONE", "FAILED", "KILLED")
+
+    def _collect_keep_shas(session, username: str) -> list[str]:
+        """Every snapshot SHA still referenced by this user: all app pins,
+        plus the commits of jobs that are not in a terminal state (UNKNOWN
+        counts as live — the poll loop writes raw executor statuses), plus
+        recently-created terminal jobs (their work dirs link into the
+        snapshot)."""
+        keep = set()
+        for row in db.list_user_apps(session, username):
+            if row.commit_sha:
+                keep.add(row.commit_sha)
+            if row.code_commit_sha:
+                keep.add(row.code_commit_sha)
+        cutoff = datetime.now(UTC).replace(tzinfo=None) - _JOB_SNAPSHOT_RETENTION
+        for j in db.get_jobs_by_username(session, username):
+            if not j.commit_sha:
+                continue
+            created = j.created_at.replace(tzinfo=None) if j.created_at else None
+            if j.status not in _TERMINAL_JOB_STATUSES or (
+                    created is not None and created >= cutoff):
+                keep.add(j.commit_sha)
+        return sorted(keep)
+
+    # Fire-and-forget tasks must be referenced until done — the event loop
+    # only holds weak references, so an unreferenced task can be gc'd
+    # mid-execution.
+    _background_tasks: set = set()
+
+    def _spawn_snapshot_gc(username: str, urls: list) -> None:
+        task = asyncio.create_task(_gc_app_snapshots(username, urls))
+        _background_tasks.add(task)
+        task.add_done_callback(_background_tasks.discard)
+
+    async def _gc_app_snapshots(username: str, urls: list):
+        """Fire-and-forget snapshot GC for the given repos.
+
+        The keep-set is over-inclusive (all of the user's pins, not just this
+        repo's) — a SHA that doesn't exist under a repo's .snapshots simply
+        matches nothing, and over-keeping is always safe.
+        """
+        try:
+            with db.get_db_session(settings.db_url) as session:
+                keep = _collect_keep_shas(session, username)
+        except Exception as e:
+            logger.warning(f"Snapshot GC skipped for {username}: {e}")
+            return
+        for url in dict.fromkeys(u for u in urls if u):
+            try:
+                await apps_module.gc_repo_snapshots(url, keep, username=username)
+            except Exception as e:
+                logger.warning(f"Snapshot GC failed for {url} ({username}): {e}")
+
     async def _discover_repo_manifests(url: str, username: str):
-        """Clone/scan a repo and return (resolved_branch, canonical_url, discovered).
+        """Clone/scan a repo and return (resolved_branch, head_sha,
+        canonical_url, discovered).
 
         Shared by the discover and add endpoints so both surface identical,
         user-facing errors for a bad URL/revision/private-repo clone.
         """
         try:
-            resolved_branch, discovered = await apps_module.discover_app_manifests(
+            resolved_branch, head_sha, discovered = await apps_module.discover_app_manifests(
                 url, username=username)
         except ValueError as e:
             raise HTTPException(status_code=404, detail=str(e))
@@ -1766,13 +1830,13 @@ async def _discover_repo_manifests(url: str, username: str):
         # Bake the worker-resolved revision into the stored URL (so a repo whose
         # default is e.g. "master" dedups against an explicit ".../tree/master").
         canonical_url, _ = apps_module.canonical_app_url(url, resolved_branch)
-        return resolved_branch, canonical_url, discovered
+        return resolved_branch, head_sha, canonical_url, discovered
 
     @app.post("/api/apps/discover", response_model=list[DiscoveredApp],
               description="Discover the apps (manifests) in a repo without adding them")
     async def discover_user_apps(body: AppAddRequest,
                                  username: str = Depends(get_current_user)):
-        _, canonical_url, discovered = await _discover_repo_manifests(body.url, username)
+        _, _, canonical_url, discovered = await _discover_repo_manifests(body.url, username)
         with db.get_db_session(settings.db_url) as session:
             return [
                 DiscoveredApp(
@@ -1791,7 +1855,7 @@ async def add_user_app(body: AppAddRequest,
                            username: str = Depends(get_current_user)):
         # Clone the repo and discover all manifests. The worker resolves the
         # branch as the user, so a private repo's real default is used.
-        resolved_branch, canonical_url, discovered = await _discover_repo_manifests(
+        resolved_branch, head_sha, canonical_url, discovered = await _discover_repo_manifests(
             body.url, username)
 
         # Restrict to the requested subset when manifest_paths is provided; an
@@ -1819,12 +1883,15 @@ async def add_user_app(body: AppAddRequest,
                     url=canonical_url, manifest_path=manifest_path,
                     name=manifest.name, description=manifest.description,
                     branch=requested,
+                    commit_sha=head_sha,
                     manifest=manifest.model_dump(mode="json"),
                 )
                 new_apps.append(UserApp(
                     url=row.url,
                     manifest_path=row.manifest_path,
                     branch=row.branch,
+                    commit_sha=row.commit_sha,
+                    code_commit_sha=row.code_commit_sha,
                     name=row.name,
                     description=row.description,
                     added_at=row.added_at,
@@ -1838,6 +1905,16 @@ async def add_user_app(body: AppAddRequest,
                 detail="All apps in this repository have already been added.",
             )
 
+        # Materialize the pinned snapshot now so the first launch doesn't pay
+        # for it. Non-fatal: launch re-ensures the snapshot if this failed.
+        if head_sha:
+            try:
+                clone_url = apps_module.clone_url_for_stored_app(canonical_url, requested)
+                await apps_module.ensure_repo_snapshot(
+                    clone_url, sha=head_sha, username=username)
+            except Exception as e:
+                logger.warning(f"Eager snapshot of {canonical_url}@{head_sha[:7]} failed: {e}")
+
         return new_apps
 
     @app.delete("/api/apps",
@@ -1846,41 +1923,55 @@ async def remove_user_app(url: str = Query(..., description="URL of the app to r
                               manifest_path: str = Query("", description="Manifest path within the repo"),
                               username: str = Depends(get_current_user)):
         with db.get_db_session(settings.db_url) as session:
-            if not db.delete_user_app(session, username, url, manifest_path):
+            row = db.get_user_app(session, username, url, manifest_path)
+            if row is None:
                 raise HTTPException(status_code=404, detail="App not found")
+            # Repos whose snapshots may have just become unreferenced: the
+            # app's own repo, plus its separate code repo if one was declared.
+            gc_urls = [row.url, (row.manifest or {}).get("repo_url")]
+            db.delete_user_app(session, username, url, manifest_path)
+        _spawn_snapshot_gc(username, gc_urls)
         return {"message": "App removed"}
 
     @app.post("/api/apps/update", response_model=UserApp,
-              description="Pull latest code and re-read the manifest for an app")
+              description="Pull latest code and re-pin this app to the new tip commit")
     async def update_user_app(body: ManifestFetchRequest,
                               username: str = Depends(get_current_user)):
         # The revision is fixed at add time and baked into body.url, so update
-        # just pulls that revision again and re-reads the manifest — it never
-        # re-resolves the default branch or moves the app to a new URL.
+        # just pulls that revision again — it never re-resolves the default
+        # branch or moves the app to a new URL. Only THIS app's pin moves:
+        # sibling apps in the same repo keep their snapshots, and running jobs
+        # keep the tree they started with.
         with db.get_db_session(settings.db_url) as session:
             existing = db.get_user_app(session, username, body.url, body.manifest_path)
             if existing is None:
                 raise HTTPException(status_code=404, detail="App not found")
             stored_url = existing.url
             stored_branch = existing.branch
+            # If the update changes the manifest's repo_url, the old code
+            # repo's snapshots lose their last reference here — remember it
+            # so the GC below can target it.
+            old_repo_url = (existing.manifest or {}).get("repo_url")
 
         clone_url = apps_module.clone_url_for_stored_app(stored_url, stored_branch)
         try:
-            await apps_module._ensure_repo_cache(clone_url, pull=True, username=username)
+            _, new_sha = await apps_module.ensure_repo_snapshot(
+                clone_url, pull=True, username=username)
         except Exception as e:
             raise HTTPException(status_code=400, detail=f"Failed to pull latest code: {str(e)}")
 
         try:
             manifest = await apps_module.fetch_app_manifest(clone_url, body.manifest_path,
-                                                            username=username)
+                                                            username=username, sha=new_sha)
         except ValueError as e:
             raise HTTPException(status_code=404, detail=str(e))
         except Exception as e:
             raise HTTPException(status_code=400, detail=f"Failed to read manifest after update: {str(e)}")
 
+        code_sha = None
         if manifest.repo_url and canonical_github_url(manifest.repo_url) != stored_url:
             try:
-                await apps_module._ensure_repo_cache(
+                _, code_sha = await apps_module.ensure_repo_snapshot(
                     manifest.repo_url,
                     pull=True,
                     username=username,
@@ -1897,18 +1988,83 @@ async def update_user_app(body: ManifestFetchRequest,
                 session, username,
                 url=stored_url, manifest_path=body.manifest_path,
                 name=manifest.name, description=manifest.description,
+                commit_sha=new_sha, code_commit_sha=code_sha,
                 manifest=manifest.model_dump(mode="json"),
             )
-            return UserApp(
+            result = UserApp(
                 url=row.url,
                 manifest_path=row.manifest_path,
                 branch=row.branch,
+                commit_sha=row.commit_sha,
+                code_commit_sha=row.code_commit_sha,
                 name=row.name,
                 description=row.description,
                 added_at=row.added_at,
                 updated_at=row.updated_at,
                 manifest=manifest,
             )
+        _spawn_snapshot_gc(username, [stored_url, manifest.repo_url, old_repo_url])
+        return result
+
+    @app.get("/api/apps/check-updates", response_model=list[AppUpdateCheck],
+             description="Compare each app's pinned commits against their remote revision tips")
+    async def check_app_updates(username: str = Depends(get_current_user)):
+        with db.get_db_session(settings.db_url) as session:
+            rows = [
+                {
+                    "url": r.url,
+                    "manifest_path": r.manifest_path,
+                    "branch": r.branch,
+                    "commit_sha": r.commit_sha,
+                    "code_commit_sha": r.code_commit_sha,
+                    "repo_url": (r.manifest or {}).get("repo_url"),
+                }
+                for r in db.list_user_apps(session, username)
+            ]
+
+        # One batched worker round-trip resolves every distinct repo+revision
+        # (sibling apps share a lookup, and the ls-remotes run concurrently in
+        # the worker, so a slow remote costs one short timeout — not one per
+        # app queued on the user's serial worker).
+        lookup_urls: list[str] = []
+        for row in rows:
+            if not row["commit_sha"]:
+                continue
+            row["clone_url"] = apps_module.clone_url_for_stored_app(
+                row["url"], row["branch"])
+            lookup_urls.append(row["clone_url"])
+            if row["code_commit_sha"] and row["repo_url"]:
+                lookup_urls.append(row["repo_url"])
+        tips: dict[str, Optional[str]] = {}
+        if lookup_urls:
+            try:
+                tips = await apps_module.get_remote_heads(
+                    lookup_urls, username=username)
+            except Exception as e:
+                logger.warning(f"Update check failed for {username}: {e}")
+
+        results: list[AppUpdateCheck] = []
+        for row in rows:
+            if not row["commit_sha"]:
+                # Unpinned legacy row — nothing to compare against.
+                results.append(AppUpdateCheck(
+                    url=row["url"], manifest_path=row["manifest_path"]))
+                continue
+            latest = tips.get(row["clone_url"])
+            drifted = bool(latest) and latest != row["commit_sha"]
+            # An app whose code lives in a separate repo can also drift there.
+            if row["code_commit_sha"] and row["repo_url"]:
+                code_latest = tips.get(row["repo_url"])
+                drifted = drifted or (
+                    bool(code_latest) and code_latest != row["code_commit_sha"])
+            results.append(AppUpdateCheck(
+                url=row["url"],
+                manifest_path=row["manifest_path"],
+                commit_sha=row["commit_sha"],
+                latest_sha=latest,
+                update_available=drifted,
+            ))
+        return results
 
     @app.post("/api/apps/validate-paths", response_model=PathValidationResponse,
               description="Validate file/directory paths for app parameters")
@@ -2015,8 +2171,19 @@ async def add_from_catalog(listing_id: int,
 
         clone_url = apps_module.clone_url_for_stored_app(listing_url, listing_branch)
         try:
+            # Pin the install to the revision's current tip and read the
+            # manifest from that immutable snapshot.
+            try:
+                _, pinned_sha = await apps_module.ensure_repo_snapshot(
+                    clone_url, pull=True, username=username)
+            except Exception:
+                # The pull needs the network; a warm cached clone doesn't.
+                # Fall back so installing a previously-cloned app still works
+                # offline (pinned to the cache's tip instead of the remote's).
+                _, pinned_sha = await apps_module.ensure_repo_snapshot(
+                    clone_url, username=username)
             manifest = await apps_module.fetch_app_manifest(
-                clone_url, listing_manifest_path, username=username,
+                clone_url, listing_manifest_path, username=username, sha=pinned_sha,
             )
         except ValueError as e:
             raise HTTPException(status_code=404, detail=str(e))
@@ -2031,12 +2198,15 @@ async def add_from_catalog(listing_id: int,
                 url=listing_url, manifest_path=listing_manifest_path,
                 name=listing_name, description=listing_description,
                 branch=listing_branch,
+                commit_sha=pinned_sha,
                 manifest=manifest.model_dump(mode="json"),
             )
             return UserApp(
                 url=row.url,
                 manifest_path=row.manifest_path,
                 branch=row.branch,
+                commit_sha=row.commit_sha,
+                code_commit_sha=row.code_commit_sha,
                 name=row.name,
                 description=row.description,
                 added_at=row.added_at,
@@ -2075,6 +2245,10 @@ async def submit_job(body: JobSubmitRequest,
                 container=body.container,
                 container_args=body.container_args,
             )
+            # Launches of apps not in the user's library create snapshots that
+            # no delete/update endpoint ever GCs; sweep here (the new job's
+            # row is committed, so its own snapshot is in the keep-set).
+            _spawn_snapshot_gc(username, [body.app_url])
             return _convert_job(db_job)
         except ValueError as e:
             raise HTTPException(status_code=400, detail=str(e))
@@ -2214,6 +2388,8 @@ def _convert_job(db_job: db.JobDB, service_url: str = None, files: dict = None,
             conda_env=db_job.conda_env,
             requirements=db_job.requirements,
             work_dir=db_job.work_dir,
+            commit_sha=db_job.commit_sha,
+            code_repo_url=db_job.code_repo_url,
             cluster_job_id=db_job.cluster_job_id,
             service_url=service_url,
             phase=phase,
diff --git a/fileglancer/user_worker.py b/fileglancer/user_worker.py
index 2be0af10..38349391 100644
--- a/fileglancer/user_worker.py
+++ b/fileglancer/user_worker.py
@@ -1075,11 +1075,13 @@ def _action_discover_manifests(request: dict, ctx: WorkerContext) -> dict:
 
     Resolves the default branch here, in the user's worker, so a private repo's
     real default (reachable via the user's SSH key) is used rather than the
-    server process's "main" fallback.
+    server process's "main" fallback. Also reports the tip commit so apps added
+    from this discovery can be pinned to it.
     """
     from fileglancer.apps.manifest import (
         _ensure_repo_cache,
         _find_manifests_in_repo,
+        _git_head_sha,
         _parse_github_url,
         _repo_cache_base,
     )
@@ -1091,9 +1093,11 @@ def _action_discover_manifests(request: dict, ctx: WorkerContext) -> dict:
     branch = repo_dir.relative_to(
         (_repo_cache_base() / owner / repo).resolve()
     ).as_posix()
+    head_sha = _run_async(_git_head_sha(repo_dir))
     results = _find_manifests_in_repo(repo_dir)
     return {
         "branch": branch,
+        "head_sha": head_sha,
         "manifests": [
             {"path": path, "manifest": manifest.model_dump(mode="json")}
             for path, manifest in results
@@ -1103,22 +1107,62 @@ def _action_discover_manifests(request: dict, ctx: WorkerContext) -> dict:
 
 @action("read_manifest")
 def _action_read_manifest(request: dict, ctx: WorkerContext) -> dict:
-    """Fetch and read a single manifest from a cached repo."""
+    """Fetch and read a single manifest from a cached repo.
+
+    With "sha", reads from the immutable snapshot of that commit (materializing
+    it if needed) instead of the mutable branch clone.
+    """
     from fileglancer.apps.manifest import (
         _ensure_repo_cache,
         _read_manifest_file,
         _safe_repo_subdir,
+        ensure_repo_snapshot,
     )
-    repo_dir = _run_async(_ensure_repo_cache(
-        url=request["url"],
-        pull=request.get("pull", False),
-    ))
+    sha = request.get("sha")
+    if sha:
+        repo_dir, _ = _run_async(ensure_repo_snapshot(url=request["url"], sha=sha))
+    else:
+        repo_dir = _run_async(_ensure_repo_cache(
+            url=request["url"],
+            pull=request.get("pull", False),
+        ))
     manifest_path = request.get("manifest_path", "")
     target_dir = _safe_repo_subdir(repo_dir, manifest_path)
     manifest = _read_manifest_file(target_dir)
     return {"manifest": manifest.model_dump(mode="json")}
 
 
+@action("ensure_snapshot")
+def _action_ensure_snapshot(request: dict, ctx: WorkerContext) -> dict:
+    """Materialize (or find) the immutable snapshot of a repo at a commit."""
+    from fileglancer.apps.manifest import ensure_repo_snapshot
+    snapshot_dir, sha = _run_async(ensure_repo_snapshot(
+        url=request["url"],
+        sha=request.get("sha"),
+        pull=request.get("pull", False),
+    ))
+    return {"snapshot_dir": str(snapshot_dir), "sha": sha}
+
+
+@action("gc_snapshots")
+def _action_gc_snapshots(request: dict, ctx: WorkerContext) -> dict:
+    """Remove snapshots of a repo that no app or active job references."""
+    from fileglancer.apps.manifest import gc_repo_snapshots
+    removed = _run_async(gc_repo_snapshots(
+        url=request["url"],
+        keep_shas=request.get("keep_shas") or [],
+    ))
+    return {"removed": removed}
+
+
+@action("remote_heads")
+def _action_remote_heads(request: dict, ctx: WorkerContext) -> dict:
+    """Resolve remote tip commits for stored app URLs (batched: the lookups
+    run concurrently so one slow remote doesn't multiply worker occupancy)."""
+    from fileglancer.apps.manifest import get_remote_heads
+    return {"shas": _run_async(get_remote_heads(request.get("urls") or []))}
+
+
 # ---------------------------------------------------------------------------
 # Worker context and main loop
 # ---------------------------------------------------------------------------
diff --git a/frontend/src/components/AppDetail.tsx b/frontend/src/components/AppDetail.tsx
index 8ad8e204..903c7073 100644
--- a/frontend/src/components/AppDetail.tsx
+++ b/frontend/src/components/AppDetail.tsx
@@ -14,7 +14,8 @@ import FgButton from '@/components/designSystem/atoms/FgButton';
 import FgLink from '@/components/designSystem/atoms/FgLink';
 import FgTooltip from '@/components/ui/widgets/FgTooltip';
 import JobStatusBadge from '@/components/ui/AppsPage/JobStatusBadge';
-import { useAppsQuery } from '@/queries/appsQueries';
+import UpdateAvailableBadge from '@/components/ui/AppsPage/UpdateAvailableBadge';
+import { useAppsQuery, useAppUpdateAvailable } from '@/queries/appsQueries';
 import { useJobsQuery } from '@/queries/jobsQueries';
 import { useAppActions } from '@/hooks/useAppActions';
 import {
@@ -46,6 +47,7 @@ export default function AppDetail() {
     a =>
       canonicalGithubUrl(a.url) === appUrl && a.manifest_path === manifestPath
   );
+  const updateAvailable = useAppUpdateAvailable(app);
 
   if (appsQuery.isPending) {
     return (
@@ -165,6 +167,7 @@ export default function AppDetail() {
             Shared
           </span>
         ) : null}
+        {updateAvailable ? <UpdateAvailableBadge /> : null}
       </AppPageHeader>
 
       <div className="max-w-2xl">
diff --git a/frontend/src/components/JobDetail.tsx b/frontend/src/components/JobDetail.tsx
index 17163ab5..b3ed4ac0 100644
--- a/frontend/src/components/JobDetail.tsx
+++ b/frontend/src/components/JobDetail.tsx
@@ -32,6 +32,7 @@ import JobStatusBadge from '@/components/ui/AppsPage/JobStatusBadge';
 import {
   formatDateString,
   buildAppDetailPath,
+  buildGithubCommitUrl,
   buildRelaunchPath,
   parseGithubUrl,
   buildGithubUrl,
@@ -305,6 +306,11 @@ function JobOverview({
     : null;
   const exitMeaning = exitCodeMeaning(job.exit_code);
   const repoLink = appRepoLink(job.app_url);
+  // The executed commit may belong to a separate code repo (manifests with
+  // repo_url); link the commit against whichever repo it came from.
+  const commitLink = job.commit_sha
+    ? buildGithubCommitUrl(job.code_repo_url || job.app_url, job.commit_sha)
+    : null;
   const detailPath = appDetailLink(job);
 
   const stdoutTail =
@@ -366,6 +372,22 @@ function JobOverview({
               ) : null
             }
           />
+          <InfoRow
+            label="Version"
+            value={
+              job.commit_sha ? (
+                commitLink ? (
+                  <FgExternalLink className="font-mono" href={commitLink}>
+                    {job.commit_sha.slice(0, 7)}
+                  </FgExternalLink>
+                ) : (
+                  <span className="font-mono">
+                    {job.commit_sha.slice(0, 7)}
+                  </span>
+                )
+              ) : null
+            }
+          />
           <InfoRow
             label="Type"
             value={job.entry_point_type === 'service' ? 'Service' : 'Batch job'}
diff --git a/frontend/src/components/ui/AppsPage/AppCard.tsx b/frontend/src/components/ui/AppsPage/AppCard.tsx
index 4835adab..b605352b 100644
--- a/frontend/src/components/ui/AppsPage/AppCard.tsx
+++ b/frontend/src/components/ui/AppsPage/AppCard.tsx
@@ -9,7 +9,9 @@ import type { MenuItem } from '@/components/ui/Menus/FgMenuItems';
 import FgButton from '@/components/designSystem/atoms/FgButton';
 import FgIcon from '@/components/designSystem/atoms/FgIcon';
 import FgTooltip from '@/components/ui/widgets/FgTooltip';
+import UpdateAvailableBadge from '@/components/ui/AppsPage/UpdateAvailableBadge';
 import type { AppActions } from '@/hooks/useAppActions';
+import { useAppUpdateAvailable } from '@/queries/appsQueries';
 import { getAppIconType } from '@/utils';
 import type { UserApp } from '@/shared.types';
 
@@ -20,6 +22,7 @@ interface AppCardProps {
 
 export default function AppCard({ app, actions }: AppCardProps) {
   const isShared = app.listing_id !== undefined && app.listing_id !== null;
+  const updateAvailable = useAppUpdateAvailable(app);
 
   const menuItems: MenuItem<UserApp>[] = [
     { name: 'Launch', action: a => actions.launch(a) },
@@ -73,6 +76,7 @@ export default function AppCard({ app, actions }: AppCardProps) {
               Shared
             </span>
           ) : null}
+          {updateAvailable ? <UpdateAvailableBadge /> : null}
         </div>
         <div
           className="flex items-center gap-1"
diff --git a/frontend/src/components/ui/AppsPage/AppInfoTable.tsx b/frontend/src/components/ui/AppsPage/AppInfoTable.tsx
index dc1752fb..8a44bc3e 100644
--- a/frontend/src/components/ui/AppsPage/AppInfoTable.tsx
+++ b/frontend/src/components/ui/AppsPage/AppInfoTable.tsx
@@ -1,6 +1,6 @@
 import FgExternalLink from '@/components/designSystem/atoms/FgExternalLink';
 import type { UserApp } from '@/shared.types';
-import { parseGithubUrl } from '@/utils/appUrls';
+import { buildGithubCommitUrl, parseGithubUrl } from '@/utils/appUrls';
 
 /**
  * The revision actually cloned, parsed out of the canonical app URL (which
@@ -19,6 +19,9 @@ export default function AppInfoTable({ app }: { readonly app: UserApp }) {
     'text-foreground font-medium pr-4 py-1.5 align-top whitespace-nowrap';
   const valueClass = 'text-foreground py-1.5';
   const revision = appRevision(app);
+  const commitUrl = app.commit_sha
+    ? buildGithubCommitUrl(app.url, app.commit_sha)
+    : null;
 
   return (
     <table className="w-full text-sm mb-6">
@@ -37,6 +40,20 @@ export default function AppInfoTable({ app }: { readonly app: UserApp }) {
             <td className={valueClass}>{revision}</td>
           </tr>
         ) : null}
+        {app.commit_sha ? (
+          <tr>
+            <td className={labelClass}>Version</td>
+            <td className={valueClass}>
+              {commitUrl ? (
+                <FgExternalLink className="font-mono" href={commitUrl}>
+                  {app.commit_sha.slice(0, 7)}
+                </FgExternalLink>
+              ) : (
+                <span className="font-mono">{app.commit_sha.slice(0, 7)}</span>
+              )}
+            </td>
+          </tr>
+        ) : null}
         {app.description ? (
           <tr>
             <td className={labelClass}>Description</td>
diff --git a/frontend/src/components/ui/AppsPage/UpdateAvailableBadge.tsx b/frontend/src/components/ui/AppsPage/UpdateAvailableBadge.tsx
new file mode 100644
index 00000000..22950f37
--- /dev/null
+++ b/frontend/src/components/ui/AppsPage/UpdateAvailableBadge.tsx
@@ -0,0 +1,11 @@
+/**
+ * Amber chip shown on app cards and the app detail page when the remote has a
+ * newer commit than the version the app is pinned to.
+ */
+export default function UpdateAvailableBadge() {
+  return (
+    <span className="inline-block px-2 py-0.5 rounded-sm bg-warning/10 text-warning text-xs font-medium flex-shrink-0">
+      Update available
+    </span>
+  );
+}
diff --git a/frontend/src/hooks/useAppActions.ts b/frontend/src/hooks/useAppActions.ts
index bd2cac50..e507a834 100644
--- a/frontend/src/hooks/useAppActions.ts
+++ b/frontend/src/hooks/useAppActions.ts
@@ -62,11 +62,23 @@ export function useAppActions(opts?: { onRemoved?: () => void }): AppActions {
 
   const update = async (app: UserApp) => {
     try {
-      await updateAppMutation.mutateAsync({
+      const updated = await updateAppMutation.mutateAsync({
         url: app.url,
         manifest_path: app.manifest_path
       });
-      toast.success('App updated');
+      // Either repo may move: the app repo pin or (for manifests with a
+      // separate repo_url) the code repo pin. A legacy app with no prior pin
+      // can't be compared, so report a neutral success.
+      const moved =
+        updated.commit_sha !== app.commit_sha ||
+        updated.code_commit_sha !== app.code_commit_sha;
+      if (!app.commit_sha || !updated.commit_sha) {
+        toast.success('App updated');
+      } else if (!moved) {
+        toast.success('Already up to date');
+      } else {
+        toast.success(`Updated to ${updated.commit_sha.slice(0, 7)}`);
+      }
     } catch (error) {
       const message =
         error instanceof Error ? error.message : 'Failed to update app';
diff --git a/frontend/src/queries/appsQueries.ts b/frontend/src/queries/appsQueries.ts
index c3a63cb0..8b520240 100644
--- a/frontend/src/queries/appsQueries.ts
+++ b/frontend/src/queries/appsQueries.ts
@@ -9,6 +9,7 @@ import {
 import type {
   AppListing,
   AppManifest,
+  AppUpdateCheck,
   DiscoveredApp,
   UserApp
 } from '@/shared.types';
@@ -17,7 +18,8 @@ import type {
 
 export const appsQueryKeys = {
   all: ['apps'] as const,
-  list: () => ['apps', 'list'] as const
+  list: () => ['apps', 'list'] as const,
+  updates: () => ['apps', 'updates'] as const
 };
 
 export const catalogQueryKeys = {
@@ -48,6 +50,49 @@ export function useAppsQuery(): UseQueryResult<UserApp[], Error> {
   });
 }
 
+/**
+ * Compare each installed app's pinned commit against its remote revision tip.
+ * The backend does one git ls-remote per distinct repo, so this is kept on a
+ * long stale time and only refetched after an app update (via invalidation of
+ * the parent 'apps' key).
+ */
+export function useAppUpdatesQuery(): UseQueryResult<AppUpdateCheck[], Error> {
+  return useQuery({
+    queryKey: appsQueryKeys.updates(),
+    queryFn: async ({ signal }) => {
+      const response = await sendFetchRequest(
+        '/api/apps/check-updates',
+        'GET',
+        undefined,
+        { signal }
+      );
+      const data = await getResponseJsonOrError(response);
+      if (!response.ok) {
+        throwResponseNotOkError(response, data);
+      }
+      return data as AppUpdateCheck[];
+    },
+    staleTime: 10 * 60 * 1000,
+    retry: false
+  });
+}
+
+/** True when the remote has a newer commit than the app's pinned version. */
+export function useAppUpdateAvailable(app: UserApp | undefined): boolean {
+  const updatesQuery = useAppUpdatesQuery();
+  if (!app) {
+    return false;
+  }
+  return (
+    updatesQuery.data?.some(
+      u =>
+        u.update_available &&
+        u.url === app.url &&
+        u.manifest_path === app.manifest_path
+    ) ?? false
+  );
+}
+
 // --- Mutation Hooks ---
 
 export function useManifestPreviewMutation(): UseMutationResult<
diff --git a/frontend/src/shared.types.ts b/frontend/src/shared.types.ts
index 5fe47179..7f332d3b 100644
--- a/frontend/src/shared.types.ts
+++ b/frontend/src/shared.types.ts
@@ -144,6 +144,8 @@ type UserApp = {
   url: string;
   manifest_path: string;
   branch?: string;
+  commit_sha?: string;
+  code_commit_sha?: string;
   name: string;
   description?: string;
   added_at: string;
@@ -152,6 +154,14 @@ type UserApp = {
   listing_id?: number;
 };
 
+type AppUpdateCheck = {
+  url: string;
+  manifest_path: string;
+  commit_sha?: string;
+  latest_sha?: string;
+  update_available: boolean;
+};
+
 type DiscoveredApp = {
   manifest_path: string;
   name: string;
@@ -186,6 +196,8 @@ type Job = {
   entry_point_id: string;
   entry_point_name: string;
   entry_point_type?: 'job' | 'service';
+  commit_sha?: string;
+  code_repo_url?: string;
   parameters: Record<string, unknown>;
   env_parameters?: Record<string, unknown>;
   status: 'PENDING' | 'RUNNING' | 'DONE' | 'FAILED' | 'KILLED';
@@ -268,6 +280,7 @@ export type {
   AppParameterItem,
   AppParameterSection,
   AppResourceDefaults,
+  AppUpdateCheck,
   DiscoveredApp,
   FetchRequestOptions,
   FileOrFolder,
diff --git a/frontend/src/utils/appUrls.ts b/frontend/src/utils/appUrls.ts
index 50d5a52b..b16475ea 100644
--- a/frontend/src/utils/appUrls.ts
+++ b/frontend/src/utils/appUrls.ts
@@ -82,6 +82,22 @@ export function buildGithubUrl(
   return `https://github.com/${owner}/${repo}/tree/${branch}`;
 }
 
+/**
+ * GitHub link for a specific commit of an app; null if the app URL isn't
+ * parseable.
+ */
+export function buildGithubCommitUrl(
+  appUrl: string,
+  sha: string
+): string | null {
+  try {
+    const { owner, repo } = parseGithubUrl(appUrl);
+    return `https://github.com/${owner}/${repo}/commit/${sha}`;
+  } catch {
+    return null;
+  }
+}
+
 export function buildLaunchPath(
   owner: string,
   repo: string,
diff --git a/frontend/src/utils/index.ts b/frontend/src/utils/index.ts
index 55791485..f42c8b18 100644
--- a/frontend/src/utils/index.ts
+++ b/frontend/src/utils/index.ts
@@ -396,6 +396,7 @@ export {
   isGithubRepoUrl,
   canonicalGithubUrl,
   buildAppUrl,
+  buildGithubCommitUrl,
   buildGithubUrl,
   buildLaunchPath,
   buildLaunchPathFromApp,
diff --git a/tests/test_apps_endpoints.py b/tests/test_apps_endpoints.py
index 567fbe1c..8bb9cbab 100644
--- a/tests/test_apps_endpoints.py
+++ b/tests/test_apps_endpoints.py
@@ -30,6 +30,8 @@
 
 
 TEST_USERNAME = "testuser"
+TEST_SHA = "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0"
+TEST_SHA_2 = "b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1"
 
 
 def _make_manifest(name="Demo App", description="Demo"):
@@ -40,6 +42,15 @@ def _make_manifest(name="Demo App", description="Demo"):
     )
 
 
+def _patch_snapshot(sha=TEST_SHA):
+    """Patch ensure_repo_snapshot as the server sees it, so add/update tests
+    never touch git or the worker."""
+    return patch(
+        "fileglancer.apps.ensure_repo_snapshot",
+        new=AsyncMock(return_value=(f"/tmp/snapshots/{sha}", sha)),
+    )
+
+
 @pytest.fixture
 def temp_dir():
     d = tempfile.mkdtemp()
@@ -101,7 +112,7 @@ def db_session(test_app):
 
 def _seed_app(db_session, *, url="https://github.com/owner/repo",
               manifest_path="", manifest=None, name="Demo App",
-              description="Demo", branch="main",
+              description="Demo", branch="main", commit_sha=None,
               added_at=None, updated_at=None):
     row = UserAppDB(
         username=TEST_USERNAME,
@@ -110,6 +121,7 @@ def _seed_app(db_session, *, url="https://github.com/owner/repo",
         name=name,
         description=description,
         branch=branch,
+        commit_sha=commit_sha,
         manifest=manifest,
         added_at=added_at or datetime.now(UTC),
         updated_at=updated_at,
@@ -254,7 +266,8 @@ def test_add_app_persists_manifest_and_branch(test_client, db_session):
     to the bare canonical URL."""
     manifest = _make_manifest(name="From Add")
     with patch("fileglancer.apps.discover_app_manifests",
-               new=AsyncMock(return_value=("main", [("", manifest)]))):
+               new=AsyncMock(return_value=("main", TEST_SHA, [("", manifest)]))), \
+         _patch_snapshot() as mock_snapshot:
         response = test_client.post(
             "/api/apps",
             json={"url": "https://github.com/owner/repo"},
@@ -266,12 +279,22 @@ def test_add_app_persists_manifest_and_branch(test_client, db_session):
     assert body[0]["name"] == "From Add"
     assert body[0]["branch"] == ""
     assert body[0]["url"] == "https://github.com/owner/repo"
+    assert body[0]["commit_sha"] == TEST_SHA
     assert body[0]["manifest"]["name"] == "From Add"
 
+    # The pinned snapshot is materialized eagerly, at the discovered tip.
+    assert mock_snapshot.await_count == 1
+    assert mock_snapshot.await_args.args == ("https://github.com/owner/repo/tree/main",)
+    assert mock_snapshot.await_args.kwargs == {
+        "sha": TEST_SHA,
+        "username": TEST_USERNAME,
+    }
+
     rows = list_user_apps(db_session, TEST_USERNAME)
     assert len(rows) == 1
     assert rows[0].manifest["name"] == "From Add"
     assert rows[0].branch == ""
+    assert rows[0].commit_sha == TEST_SHA
 
 
 def test_add_app_bakes_resolved_default_into_url(test_client, db_session):
@@ -279,7 +302,8 @@ def test_add_app_bakes_resolved_default_into_url(test_client, db_session):
     it dedups against an explicit '/tree/master' add. branch stays "" (unpinned)."""
     manifest = _make_manifest(name="Master Default")
     with patch("fileglancer.apps.discover_app_manifests",
-               new=AsyncMock(return_value=("master", [("", manifest)]))):
+               new=AsyncMock(return_value=("master", TEST_SHA, [("", manifest)]))), \
+         _patch_snapshot():
         response = test_client.post(
             "/api/apps",
             json={"url": "https://github.com/owner/repo"},
@@ -302,9 +326,10 @@ def test_add_uses_worker_resolved_branch_not_server(test_client, db_session):
     repo's non-main default would be lost to the server's 'main' fallback."""
     manifest = _make_manifest(name="Private")
     with patch("fileglancer.apps.discover_app_manifests",
-               new=AsyncMock(return_value=("develop", [("", manifest)]))), \
+               new=AsyncMock(return_value=("develop", TEST_SHA, [("", manifest)]))), \
          patch("fileglancer.apps.manifest._resolve_default_branch",
-               new=AsyncMock(side_effect=AssertionError("server must not resolve"))):
+               new=AsyncMock(side_effect=AssertionError("server must not resolve"))), \
+         _patch_snapshot():
         response = test_client.post(
             "/api/apps",
             json={"url": "https://github.com/owner/private-repo"},
@@ -322,7 +347,8 @@ def test_add_app_pinned_revision_kept(test_client, db_session):
     """An explicit '/tree/dev' URL is pinned: branch records 'dev'."""
     manifest = _make_manifest(name="Pinned")
     with patch("fileglancer.apps.discover_app_manifests",
-               new=AsyncMock(return_value=("dev", [("", manifest)]))):
+               new=AsyncMock(return_value=("dev", TEST_SHA, [("", manifest)]))), \
+         _patch_snapshot():
         response = test_client.post(
             "/api/apps",
             json={"url": "https://github.com/owner/repo/tree/dev"},
@@ -340,7 +366,7 @@ def test_discover_lists_all_apps(test_client):
     m1 = _make_manifest(name="VS Code", description="IDE")
     m2 = _make_manifest(name="JupyterLab", description="Notebook")
     with patch("fileglancer.apps.discover_app_manifests",
-               new=AsyncMock(return_value=("main", [("vscode", m1), ("jupyterlab", m2)]))):
+               new=AsyncMock(return_value=("main", TEST_SHA, [("vscode", m1), ("jupyterlab", m2)]))):
         response = test_client.post(
             "/api/apps/discover",
             json={"url": "https://github.com/owner/monorepo"},
@@ -363,7 +389,7 @@ def test_discover_marks_already_added(test_client, db_session):
               manifest_path="vscode", branch="",
               manifest=m1.model_dump(mode="json"))
     with patch("fileglancer.apps.discover_app_manifests",
-               new=AsyncMock(return_value=("main", [("vscode", m1), ("jupyterlab", m2)]))):
+               new=AsyncMock(return_value=("main", TEST_SHA, [("vscode", m1), ("jupyterlab", m2)]))):
         response = test_client.post(
             "/api/apps/discover",
             json={"url": "https://github.com/owner/monorepo"},
@@ -377,7 +403,7 @@ def test_discover_marks_already_added(test_client, db_session):
 
 def test_discover_no_manifests_404(test_client):
     with patch("fileglancer.apps.discover_app_manifests",
-               new=AsyncMock(return_value=("main", []))):
+               new=AsyncMock(return_value=("main", TEST_SHA, []))):
         response = test_client.post(
             "/api/apps/discover",
             json={"url": "https://github.com/owner/empty"},
@@ -392,7 +418,8 @@ def test_add_subset_via_manifest_paths(test_client, db_session):
     m3 = _make_manifest(name="marimo")
     discovered = [("vscode", m1), ("jupyterlab", m2), ("marimo", m3)]
     with patch("fileglancer.apps.discover_app_manifests",
-               new=AsyncMock(return_value=("main", discovered))):
+               new=AsyncMock(return_value=("main", TEST_SHA, discovered))), \
+         _patch_snapshot():
         response = test_client.post(
             "/api/apps",
             json={
@@ -413,7 +440,8 @@ def test_add_null_manifest_paths_adds_all(test_client, db_session):
     m1 = _make_manifest(name="VS Code")
     m2 = _make_manifest(name="JupyterLab")
     with patch("fileglancer.apps.discover_app_manifests",
-               new=AsyncMock(return_value=("main", [("vscode", m1), ("jupyterlab", m2)]))):
+               new=AsyncMock(return_value=("main", TEST_SHA, [("vscode", m1), ("jupyterlab", m2)]))), \
+         _patch_snapshot():
         response = test_client.post(
             "/api/apps",
             json={"url": "https://github.com/owner/monorepo"},
@@ -428,7 +456,7 @@ def test_add_manifest_paths_no_match_400(test_client, db_session):
     """A manifest_paths list matching nothing in the repo is a client error."""
     m1 = _make_manifest(name="VS Code")
     with patch("fileglancer.apps.discover_app_manifests",
-               new=AsyncMock(return_value=("main", [("vscode", m1)]))):
+               new=AsyncMock(return_value=("main", TEST_SHA, [("vscode", m1)]))):
         response = test_client.post(
             "/api/apps",
             json={
@@ -449,7 +477,7 @@ def test_add_app_dedups_bare_against_resolved_default(test_client, db_session):
               branch="", manifest=manifest.model_dump(mode="json"))
 
     with patch("fileglancer.apps.discover_app_manifests",
-               new=AsyncMock(return_value=("master", [("", manifest)]))):
+               new=AsyncMock(return_value=("master", TEST_SHA, [("", manifest)]))):
         response = test_client.post(
             "/api/apps",
             json={"url": "https://github.com/owner/repo"},
@@ -466,7 +494,7 @@ def test_add_app_dedups(test_client, db_session):
               manifest=manifest.model_dump(mode="json"))
 
     with patch("fileglancer.apps.discover_app_manifests",
-               new=AsyncMock(return_value=("main", [("", manifest)]))):
+               new=AsyncMock(return_value=("main", TEST_SHA, [("", manifest)]))):
         response = test_client.post(
             "/api/apps",
             json={"url": "https://github.com/owner/repo"},
@@ -483,27 +511,29 @@ def test_update_app_persists_manifest(test_client, db_session):
     fresh = _make_manifest(name="New", description="New")
 
     with patch("fileglancer.apps.fetch_app_manifest",
-               new=AsyncMock(return_value=fresh)), \
+               new=AsyncMock(return_value=fresh)) as mock_fetch, \
          patch("fileglancer.apps.manifest._resolve_default_branch",
                new=AsyncMock(side_effect=AssertionError("must not re-resolve"))), \
-         patch("fileglancer.apps._ensure_repo_cache",
-               new=AsyncMock(return_value="/tmp/x")) as mock_ensure:
+         _patch_snapshot() as mock_snapshot:
         response = test_client.post(
             "/api/apps/update",
             json={"url": "https://github.com/owner/repo", "manifest_path": ""},
         )
 
     assert response.status_code == 200
-    assert mock_ensure.await_count == 1
-    assert mock_ensure.await_args.kwargs == {
+    assert mock_snapshot.await_count == 1
+    assert mock_snapshot.await_args.kwargs == {
         "pull": True,
         "username": TEST_USERNAME,
     }
     # A stored bare URL means the fixed "main" revision, not current default.
-    assert mock_ensure.await_args.args == ("https://github.com/owner/repo/tree/main",)
+    assert mock_snapshot.await_args.args == ("https://github.com/owner/repo/tree/main",)
+    # The manifest is read from the freshly pinned snapshot, not the branch clone.
+    assert mock_fetch.await_args.kwargs["sha"] == TEST_SHA
     body = response.json()
     assert body["url"] == "https://github.com/owner/repo"
     assert body["name"] == "New"
+    assert body["commit_sha"] == TEST_SHA
     assert body["updated_at"] is not None
 
     rows = list_user_apps(db_session, TEST_USERNAME)
@@ -511,6 +541,7 @@ def test_update_app_persists_manifest(test_client, db_session):
     assert rows[0].url == "https://github.com/owner/repo"
     assert rows[0].name == "New"
     assert rows[0].manifest["name"] == "New"
+    assert rows[0].commit_sha == TEST_SHA
     assert rows[0].updated_at is not None
     # added_at preserved across update.
     assert rows[0].added_at.replace(tzinfo=None) == older.replace(tzinfo=None)
@@ -531,16 +562,15 @@ def test_update_app_pulls_separate_code_repo(test_client, db_session):
                new=AsyncMock(return_value=fresh)), \
          patch("fileglancer.apps.manifest._resolve_default_branch",
                new=AsyncMock(side_effect=AssertionError("must not re-resolve"))), \
-         patch("fileglancer.apps._ensure_repo_cache",
-               new=AsyncMock(return_value="/tmp/x")) as mock_ensure:
+         _patch_snapshot() as mock_snapshot:
         response = test_client.post(
             "/api/apps/update",
             json={"url": "https://github.com/owner/repo", "manifest_path": ""},
         )
 
     assert response.status_code == 200
-    assert mock_ensure.await_count == 2
-    first_call, second_call = mock_ensure.await_args_list
+    assert mock_snapshot.await_count == 2
+    first_call, second_call = mock_snapshot.await_args_list
     assert first_call.args == ("https://github.com/owner/repo/tree/main",)
     assert first_call.kwargs == {"pull": True, "username": TEST_USERNAME}
     assert second_call.args == ("https://github.com/tools/code",)
@@ -548,6 +578,9 @@ def test_update_app_pulls_separate_code_repo(test_client, db_session):
 
     rows = list_user_apps(db_session, TEST_USERNAME)
     assert rows[0].manifest["repo_url"] == "https://github.com/tools/code"
+    # Both repos are pinned: the app repo and the separate code repo.
+    assert rows[0].commit_sha == TEST_SHA
+    assert rows[0].code_commit_sha == TEST_SHA
 
 
 def test_update_app_does_not_pull_same_repo_with_cosmetic_url(test_client, db_session):
@@ -567,16 +600,15 @@ def test_update_app_does_not_pull_same_repo_with_cosmetic_url(test_client, db_se
                new=AsyncMock(return_value=fresh)), \
          patch("fileglancer.apps.manifest._resolve_default_branch",
                new=AsyncMock(side_effect=AssertionError("must not re-resolve"))), \
-         patch("fileglancer.apps._ensure_repo_cache",
-               new=AsyncMock(return_value="/tmp/x")) as mock_ensure:
+         _patch_snapshot() as mock_snapshot:
         response = test_client.post(
             "/api/apps/update",
             json={"url": "https://github.com/owner/repo", "manifest_path": ""},
         )
 
     assert response.status_code == 200
-    assert mock_ensure.await_count == 1
-    assert mock_ensure.await_args.args == (
+    assert mock_snapshot.await_count == 1
+    assert mock_snapshot.await_args.args == (
         "https://github.com/owner/repo/tree/main",
     )
 
@@ -606,15 +638,14 @@ def test_update_pulls_stored_revision_and_never_re_resolves(
                new=AsyncMock(return_value=fresh)), \
          patch("fileglancer.apps.manifest._resolve_default_branch",
                new=AsyncMock(side_effect=AssertionError("must not re-resolve"))), \
-         patch("fileglancer.apps._ensure_repo_cache",
-               new=AsyncMock(return_value="/tmp/x")) as mock_ensure:
+         _patch_snapshot() as mock_snapshot:
         response = test_client.post(
             "/api/apps/update",
             json={"url": stored_url, "manifest_path": ""},
         )
 
     assert response.status_code == 200
-    assert mock_ensure.await_args_list[0].args == (clone_url,)
+    assert mock_snapshot.await_args_list[0].args == (clone_url,)
     body = response.json()
     assert body["url"] == stored_url
     assert body["branch"] == stored_branch
@@ -627,6 +658,91 @@ def test_update_pulls_stored_revision_and_never_re_resolves(
     assert rows[0].branch == stored_branch
 
 
+def test_update_repins_only_target_app(test_client, db_session):
+    """The core pinning invariant: updating one app in a multi-app repo moves
+    only that app's pin. Sibling apps keep their commit (and their snapshot)."""
+    m1 = _make_manifest(name="VS Code")
+    m2 = _make_manifest(name="JupyterLab")
+    _seed_app(db_session, url="https://github.com/owner/monorepo",
+              manifest_path="vscode", branch="", commit_sha=TEST_SHA,
+              manifest=m1.model_dump(mode="json"), name="VS Code")
+    _seed_app(db_session, url="https://github.com/owner/monorepo",
+              manifest_path="jupyterlab", branch="", commit_sha=TEST_SHA,
+              manifest=m2.model_dump(mode="json"), name="JupyterLab")
+
+    with patch("fileglancer.apps.fetch_app_manifest",
+               new=AsyncMock(return_value=m1)), \
+         _patch_snapshot(sha=TEST_SHA_2):
+        response = test_client.post(
+            "/api/apps/update",
+            json={"url": "https://github.com/owner/monorepo",
+                  "manifest_path": "vscode"},
+        )
+
+    assert response.status_code == 200
+    assert response.json()["commit_sha"] == TEST_SHA_2
+
+    rows = {r.manifest_path: r for r in list_user_apps(db_session, TEST_USERNAME)}
+    assert rows["vscode"].commit_sha == TEST_SHA_2
+    assert rows["jupyterlab"].commit_sha == TEST_SHA
+
+
+def test_check_updates_reports_newer_remote_tip(test_client, db_session):
+    """An app pinned behind the remote tip is flagged; one at the tip is not.
+    Apps from the same repo+revision share a single remote lookup."""
+    m = _make_manifest()
+    _seed_app(db_session, url="https://github.com/owner/monorepo",
+              manifest_path="vscode", branch="", commit_sha=TEST_SHA,
+              manifest=m.model_dump(mode="json"))
+    _seed_app(db_session, url="https://github.com/owner/monorepo",
+              manifest_path="jupyterlab", branch="", commit_sha=TEST_SHA_2,
+              manifest=m.model_dump(mode="json"))
+
+    with patch("fileglancer.apps.get_remote_heads",
+               new=AsyncMock(return_value={
+                   "https://github.com/owner/monorepo/tree/main": TEST_SHA_2,
+               })) as mock_heads:
+        response = test_client.get("/api/apps/check-updates")
+
+    assert response.status_code == 200
+    assert mock_heads.await_count == 1  # one batched lookup for both apps
+    by_path = {r["manifest_path"]: r for r in response.json()}
+    assert by_path["vscode"]["update_available"] is True
+    assert by_path["vscode"]["latest_sha"] == TEST_SHA_2
+    assert by_path["jupyterlab"]["update_available"] is False
+
+
+def test_check_updates_skips_unpinned_rows(test_client, db_session):
+    """Legacy rows without a pin can't be compared — no badge, no remote call."""
+    _seed_app(db_session, manifest=_make_manifest().model_dump(mode="json"),
+              branch="", commit_sha=None)
+
+    with patch("fileglancer.apps.get_remote_heads",
+               new=AsyncMock()) as mock_heads:
+        response = test_client.get("/api/apps/check-updates")
+
+    assert response.status_code == 200
+    assert mock_heads.await_count == 0
+    body = response.json()
+    assert len(body) == 1
+    assert body[0]["update_available"] is False
+
+
+def test_check_updates_remote_failure_is_not_an_error(test_client, db_session):
+    """An unreachable remote yields update_available=False, not a 5xx."""
+    _seed_app(db_session, manifest=_make_manifest().model_dump(mode="json"),
+              branch="", commit_sha=TEST_SHA)
+
+    with patch("fileglancer.apps.get_remote_heads",
+               new=AsyncMock(side_effect=RuntimeError("network down"))):
+        response = test_client.get("/api/apps/check-updates")
+
+    assert response.status_code == 200
+    body = response.json()
+    assert body[0]["update_available"] is False
+    assert body[0]["latest_sha"] is None
+
+
 def test_delete_app_removes_row(test_client, db_session):
     _seed_app(db_session, manifest=_make_manifest().model_dump(mode="json"))
     assert len(list_user_apps(db_session, TEST_USERNAME)) == 1
@@ -903,8 +1019,9 @@ def test_alembic_migration_moves_legacy_apps(temp_dir, monkeypatch):
     s.commit()
     s.close()
 
-    # 3) Run our migration.
-    command.upgrade(cfg, "c4e8a7d92b15")
+    # 3) Run our migration (and everything after it, so the schema matches
+    # the current models used to query below).
+    command.upgrade(cfg, "head")
 
     # 4) Verify rows moved and preference is gone.
     s = Session()
diff --git a/tests/test_catalog_endpoints.py b/tests/test_catalog_endpoints.py
index ac1d0cc3..cdaf3185 100644
--- a/tests/test_catalog_endpoints.py
+++ b/tests/test_catalog_endpoints.py
@@ -34,6 +34,7 @@
 
 OWNER = "alice"
 ADOPTER = "bob"
+TEST_SHA = "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0"
 
 
 def _make_manifest(name="Demo App", description="Demo"):
@@ -350,14 +351,24 @@ def test_add_from_listing_creates_independent_user_app(
     with patch(
         "fileglancer.apps.fetch_app_manifest",
         new=AsyncMock(return_value=fresh),
-    ) as mock_fetch:
+    ) as mock_fetch, patch(
+        "fileglancer.apps.ensure_repo_snapshot",
+        new=AsyncMock(return_value=(f"/tmp/snapshots/{TEST_SHA}", TEST_SHA)),
+    ) as mock_snapshot:
         response = client.post(f"/api/catalog/{listing.id}/add")
 
     assert response.status_code == 200
+    # The install is pinned to the revision's current tip and the manifest is
+    # read from that snapshot.
+    assert mock_snapshot.await_args.args == (
+        "https://github.com/owner/repo/tree/main",
+    )
+    assert mock_snapshot.await_args.kwargs == {"pull": True, "username": ADOPTER}
     assert mock_fetch.await_args.args == (
         "https://github.com/owner/repo/tree/main",
         "",
     )
+    assert mock_fetch.await_args.kwargs["sha"] == TEST_SHA
     body = response.json()
     assert body["name"] == "Custom Name"
     assert body["description"] == "Custom description"
@@ -369,6 +380,7 @@ def test_add_from_listing_creates_independent_user_app(
     assert rows[0].url == "https://github.com/owner/repo"
     assert rows[0].name == "Custom Name"
     assert rows[0].description == "Custom description"
+    assert rows[0].commit_sha == TEST_SHA
 
 
 def test_add_from_listing_rejects_when_already_added(
diff --git a/tests/test_snapshots.py b/tests/test_snapshots.py
new file mode 100644
index 00000000..2bbe2797
--- /dev/null
+++ b/tests/test_snapshots.py
@@ -0,0 +1,186 @@
+"""Tests for the immutable per-commit snapshot store (apps/manifest.py).
+
+Uses real git repos in a temp directory: the branch clone is faked via
+_ensure_repo_cache/_repo_cache_base monkeypatches, everything below that
+(clone, checkout, cat-file, gc) runs the real git code paths.
+"""
+
+import asyncio
+import shutil
+import subprocess
+
+import pytest
+
+import fileglancer.apps.manifest as m
+
+
+MANIFEST_V1 = """\
+name: Demo
+runnables:
+  - id: run
+    name: Run
+    command: echo hi
+"""
+
+MANIFEST_V2 = MANIFEST_V1.replace("name: Demo", "name: Demo v2")
+
+REPO_URL = "https://github.com/owner/repo"
+
+
+def _git(*args, cwd=None):
+    subprocess.run(
+        ["git", "-c", "user.email=test@test", "-c", "user.name=test",
+         "-c", "protocol.file.allow=always", *args],
+        cwd=cwd, check=True, capture_output=True,
+    )
+
+
+def _commit_all(clone, message):
+    _git("add", ".", cwd=clone)
+    _git("commit", "-m", message, cwd=clone)
+
+
+def _head_sha(clone) -> str:
+    return asyncio.run(m._git_head_sha(clone))
+
+
+@pytest.fixture
+def repo_setup(tmp_path, monkeypatch):
+    """A fake per-user cache with a real git 'branch clone' at owner/repo/main."""
+    cache_base = tmp_path / "cache"
+    clone = cache_base / "owner" / "repo" / "main"
+    clone.mkdir(parents=True)
+    _git("init", "-b", "main", cwd=clone)
+    (clone / "runnables.yaml").write_text(MANIFEST_V1)
+    _commit_all(clone, "one")
+
+    monkeypatch.setattr(m, "_repo_cache_base", lambda username=None: cache_base)
+
+    async def fake_ensure_repo_cache(url, pull=False, username=None):
+        return clone
+
+    monkeypatch.setattr(m, "_ensure_repo_cache", fake_ensure_repo_cache)
+    # Locks may be left over from other tests' event loops.
+    monkeypatch.setattr(m, "_repo_locks", {})
+    # Make gc deletion synchronous so tests (and tmp_path cleanup) are
+    # deterministic.
+    monkeypatch.setattr(
+        m, "_delete_dirs_in_background",
+        lambda paths: [shutil.rmtree(p, ignore_errors=True) for p in paths],
+    )
+    return cache_base, clone
+
+
+def test_snapshot_of_current_head(repo_setup):
+    cache_base, clone = repo_setup
+    snap_dir, sha = asyncio.run(m.ensure_repo_snapshot(REPO_URL))
+
+    assert sha == _head_sha(clone)
+    assert snap_dir == cache_base / "owner" / "repo" / ".snapshots" / sha
+    assert (snap_dir / "runnables.yaml").read_text() == MANIFEST_V1
+    # Self-contained .git (a real directory from the hardlink clone, not a
+    # worktree pointer file) so it works when bind-mounted into containers.
+    assert (snap_dir / ".git").is_dir()
+
+    # Idempotent: asking for the same sha finds the existing snapshot.
+    snap_dir2, sha2 = asyncio.run(m.ensure_repo_snapshot(REPO_URL, sha=sha))
+    assert (snap_dir2, sha2) == (snap_dir, sha)
+
+
+def test_snapshot_immutable_when_branch_moves(repo_setup):
+    """Pulling the branch clone past a pin never changes the pinned tree."""
+    _, clone = repo_setup
+    snap_v1, sha_v1 = asyncio.run(m.ensure_repo_snapshot(REPO_URL))
+
+    (clone / "runnables.yaml").write_text(MANIFEST_V2)
+    _commit_all(clone, "two")
+    snap_v2, sha_v2 = asyncio.run(m.ensure_repo_snapshot(REPO_URL))
+
+    assert sha_v2 != sha_v1
+    assert snap_v2 != snap_v1
+    assert (snap_v2 / "runnables.yaml").read_text() == MANIFEST_V2
+    # The old snapshot still serves the old tree.
+    assert (snap_v1 / "runnables.yaml").read_text() == MANIFEST_V1
+
+
+def test_snapshot_of_older_commit_materialized_on_demand(repo_setup):
+    """A pinned commit that predates the branch clone's tip (e.g. its snapshot
+    was gc'd on another machine) is rebuilt from the clone's history."""
+    _, clone = repo_setup
+    sha_v1 = _head_sha(clone)
+    (clone / "runnables.yaml").write_text(MANIFEST_V2)
+    _commit_all(clone, "two")
+
+    snap_dir, sha = asyncio.run(m.ensure_repo_snapshot(REPO_URL, sha=sha_v1))
+    assert sha == sha_v1
+    assert (snap_dir / "runnables.yaml").read_text() == MANIFEST_V1
+
+
+def test_fetch_manifest_reads_pinned_snapshot(repo_setup):
+    """fetch_app_manifest(sha=...) serves the manifest as of the pin, not the
+    branch clone's current tip."""
+    _, clone = repo_setup
+    sha_v1 = _head_sha(clone)
+    (clone / "runnables.yaml").write_text(MANIFEST_V2)
+    _commit_all(clone, "two")
+
+    pinned = asyncio.run(m.fetch_app_manifest(REPO_URL, "", sha=sha_v1))
+    assert pinned.name == "Demo"
+    tip = asyncio.run(m.fetch_app_manifest(REPO_URL, ""))
+    assert tip.name == "Demo v2"
+
+
+def test_gc_removes_only_unreferenced_snapshots(repo_setup, monkeypatch):
+    _, clone = repo_setup
+    # Disable the recency guard so freshly-created snapshots are eligible.
+    monkeypatch.setattr(m, "_GC_GRACE_SECONDS", 0)
+    snap_v1, sha_v1 = asyncio.run(m.ensure_repo_snapshot(REPO_URL))
+    (clone / "runnables.yaml").write_text(MANIFEST_V2)
+    _commit_all(clone, "two")
+    snap_v2, sha_v2 = asyncio.run(m.ensure_repo_snapshot(REPO_URL))
+
+    removed = asyncio.run(m.gc_repo_snapshots(REPO_URL, [sha_v2]))
+
+    assert removed == [sha_v1]
+    assert not snap_v1.exists()
+    assert snap_v2.exists()
+    # The branch clone is never gc'd.
+    assert clone.exists()
+
+
+def test_gc_grace_period_protects_recent_snapshots(repo_setup):
+    """A just-created snapshot is exempt from gc even when unreferenced: the
+    DB keep-set can't see a launch whose job row hasn't committed yet."""
+    _, _ = repo_setup
+    snap_dir, sha = asyncio.run(m.ensure_repo_snapshot(REPO_URL))
+
+    removed = asyncio.run(m.gc_repo_snapshots(REPO_URL, []))
+    assert removed == []
+    assert snap_dir.exists()
+
+
+def test_gc_ignores_foreign_directories(repo_setup, monkeypatch):
+    """Only 40-hex snapshot dirs are eligible; anything else is left alone."""
+    cache_base, _ = repo_setup
+    monkeypatch.setattr(m, "_GC_GRACE_SECONDS", 0)
+    snapshots = cache_base / "owner" / "repo" / m._SNAPSHOTS_DIRNAME
+    snapshots.mkdir(parents=True)
+    stray = snapshots / "not-a-sha"
+    stray.mkdir()
+
+    removed = asyncio.run(m.gc_repo_snapshots(REPO_URL, []))
+    assert removed == []
+    assert stray.exists()
+
+
+def test_get_remote_head_sha_revision_is_itself():
+    """A URL pinned to a commit SHA resolves without any network call."""
+    sha = "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0"
+    result = asyncio.run(m.get_remote_head(f"https://github.com/owner/repo/tree/{sha}"))
+    assert result == sha
+
+
+@pytest.mark.parametrize("bad", ["", "abc", "HEAD", "../escape", "a" * 39, "g" * 40])
+def test_validate_commit_sha_rejects_non_shas(bad):
+    with pytest.raises(ValueError):
+        m.validate_commit_sha(bad)

From c2e0b982afffad48d5e2b7ee8ebb56e60294f4fc Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Thu, 2 Jul 2026 22:46:23 -0400
Subject: [PATCH 26/89] fix(alembic): make commit-pinning migration idempotent

The f4a1d8c62e97 migration briefly existed without jobs.code_repo_url,
so a dev database migrated during that window is stamped at this head
while missing the column, and the server fails on any jobs query. Guard
each add/drop with a column-existence check so re-running the revision
(after `alembic stamp c1f9a4e7b2d8`) converges any such state.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 ...e97_add_commit_pinning_to_apps_and_jobs.py | 33 ++++++++++++++-----
 1 file changed, 25 insertions(+), 8 deletions(-)

diff --git a/fileglancer/alembic/versions/f4a1d8c62e97_add_commit_pinning_to_apps_and_jobs.py b/fileglancer/alembic/versions/f4a1d8c62e97_add_commit_pinning_to_apps_and_jobs.py
index a45ae605..8ec73b4a 100644
--- a/fileglancer/alembic/versions/f4a1d8c62e97_add_commit_pinning_to_apps_and_jobs.py
+++ b/fileglancer/alembic/versions/f4a1d8c62e97_add_commit_pinning_to_apps_and_jobs.py
@@ -25,15 +25,32 @@
 depends_on = None
 
 
+def _missing(table: str, column: str) -> bool:
+    inspector = sa.inspect(op.get_bind())
+    return column not in {c["name"] for c in inspector.get_columns(table)}
+
+
 def upgrade() -> None:
-    op.add_column('user_apps', sa.Column('commit_sha', sa.String(), nullable=True))
-    op.add_column('user_apps', sa.Column('code_commit_sha', sa.String(), nullable=True))
-    op.add_column('jobs', sa.Column('commit_sha', sa.String(), nullable=True))
-    op.add_column('jobs', sa.Column('code_repo_url', sa.String(), nullable=True))
+    # Guarded adds: this revision briefly existed without jobs.code_repo_url,
+    # so a dev database migrated during that window is stamped at this head
+    # while missing the column. Re-running after `alembic stamp c1f9a4e7b2d8`
+    # converges any such state without erroring on the columns that do exist.
+    if _missing('user_apps', 'commit_sha'):
+        op.add_column('user_apps', sa.Column('commit_sha', sa.String(), nullable=True))
+    if _missing('user_apps', 'code_commit_sha'):
+        op.add_column('user_apps', sa.Column('code_commit_sha', sa.String(), nullable=True))
+    if _missing('jobs', 'commit_sha'):
+        op.add_column('jobs', sa.Column('commit_sha', sa.String(), nullable=True))
+    if _missing('jobs', 'code_repo_url'):
+        op.add_column('jobs', sa.Column('code_repo_url', sa.String(), nullable=True))
 
 
 def downgrade() -> None:
-    op.drop_column('jobs', 'code_repo_url')
-    op.drop_column('jobs', 'commit_sha')
-    op.drop_column('user_apps', 'code_commit_sha')
-    op.drop_column('user_apps', 'commit_sha')
+    if not _missing('jobs', 'code_repo_url'):
+        op.drop_column('jobs', 'code_repo_url')
+    if not _missing('jobs', 'commit_sha'):
+        op.drop_column('jobs', 'commit_sha')
+    if not _missing('user_apps', 'code_commit_sha'):
+        op.drop_column('user_apps', 'code_commit_sha')
+    if not _missing('user_apps', 'commit_sha'):
+        op.drop_column('user_apps', 'commit_sha')

From f342d1a79d88b80a660c0322d21acc5a13a13200 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Thu, 2 Jul 2026 23:03:31 -0400
Subject: [PATCH 27/89] fix(apps): shrink version commit-sha font to match
 surrounding text

The monospace commit sha rendered noticeably larger than adjacent
text at the same declared size, throwing off row spacing on the
app detail and job detail pages.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 frontend/src/components/JobDetail.tsx                | 7 +++++--
 frontend/src/components/ui/AppsPage/AppInfoTable.tsx | 6 ++++--
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/frontend/src/components/JobDetail.tsx b/frontend/src/components/JobDetail.tsx
index b3ed4ac0..ef2c394a 100644
--- a/frontend/src/components/JobDetail.tsx
+++ b/frontend/src/components/JobDetail.tsx
@@ -377,11 +377,14 @@ function JobOverview({
             value={
               job.commit_sha ? (
                 commitLink ? (
-                  <FgExternalLink className="font-mono" href={commitLink}>
+                  <FgExternalLink
+                    className="text-xs font-mono"
+                    href={commitLink}
+                  >
                     {job.commit_sha.slice(0, 7)}
                   </FgExternalLink>
                 ) : (
-                  <span className="font-mono">
+                  <span className="text-xs font-mono">
                     {job.commit_sha.slice(0, 7)}
                   </span>
                 )
diff --git a/frontend/src/components/ui/AppsPage/AppInfoTable.tsx b/frontend/src/components/ui/AppsPage/AppInfoTable.tsx
index 8a44bc3e..5a9bb788 100644
--- a/frontend/src/components/ui/AppsPage/AppInfoTable.tsx
+++ b/frontend/src/components/ui/AppsPage/AppInfoTable.tsx
@@ -45,11 +45,13 @@ export default function AppInfoTable({ app }: { readonly app: UserApp }) {
             <td className={labelClass}>Version</td>
             <td className={valueClass}>
               {commitUrl ? (
-                <FgExternalLink className="font-mono" href={commitUrl}>
+                <FgExternalLink className="text-xs font-mono" href={commitUrl}>
                   {app.commit_sha.slice(0, 7)}
                 </FgExternalLink>
               ) : (
-                <span className="font-mono">{app.commit_sha.slice(0, 7)}</span>
+                <span className="text-xs font-mono">
+                  {app.commit_sha.slice(0, 7)}
+                </span>
               )}
             </td>
           </tr>

From 75e725bd8ddbbe4576a392fd42b3c1f2ea928f10 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Fri, 3 Jul 2026 08:51:27 -0400
Subject: [PATCH 28/89] feat(apps): add card/table view toggle to My Apps

My Apps can now be viewed as a sortable, filterable table (same
TableCard used by the Jobs views) in addition to the existing card
grid. The toggle sits on the Add from URL row and the chosen mode
persists in localStorage.

Table columns: repository (org/repo linking to GitHub), revision, name
(links to app detail, with update-available badge), truncated
description, shared badge, and the same actions menu as the cards.

Menu items, the shared badge, and appRevision() are extracted into
shared helpers so card and table modes stay in sync.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 frontend/src/components/Apps.tsx              |  80 +++++++-
 .../src/components/ui/AppsPage/AppCard.tsx    |  35 +---
 .../components/ui/AppsPage/AppInfoTable.tsx   |  16 +-
 .../components/ui/AppsPage/SharedBadge.tsx    |  11 ++
 .../components/ui/AppsPage/appMenuItems.ts    |  39 ++++
 .../src/components/ui/Table/TableCard.tsx     |   2 +-
 .../src/components/ui/Table/myAppsColumns.tsx | 183 ++++++++++++++++++
 frontend/src/utils/appUrls.ts                 |  15 ++
 frontend/src/utils/index.ts                   |   1 +
 9 files changed, 335 insertions(+), 47 deletions(-)
 create mode 100644 frontend/src/components/ui/AppsPage/SharedBadge.tsx
 create mode 100644 frontend/src/components/ui/AppsPage/appMenuItems.ts
 create mode 100644 frontend/src/components/ui/Table/myAppsColumns.tsx

diff --git a/frontend/src/components/Apps.tsx b/frontend/src/components/Apps.tsx
index cbc66f63..abd62228 100644
--- a/frontend/src/components/Apps.tsx
+++ b/frontend/src/components/Apps.tsx
@@ -1,12 +1,19 @@
-import { useState } from 'react';
+import { useMemo, useState } from 'react';
 
-import { Typography } from '@material-tailwind/react';
-import { HiOutlineLink } from 'react-icons/hi2';
+import { ButtonGroup, IconButton, Typography } from '@material-tailwind/react';
+import {
+  HiOutlineLink,
+  HiOutlineSquares2X2,
+  HiOutlineTableCells
+} from 'react-icons/hi2';
 import toast from 'react-hot-toast';
 
 import AppCard from '@/components/ui/AppsPage/AppCard';
 import AddAppDialog from '@/components/ui/AppsPage/AddAppDialog';
 import AppActionDialogs from '@/components/ui/AppsPage/AppActionDialogs';
+import { TableCard } from '@/components/ui/Table/TableCard';
+import { createMyAppsColumns } from '@/components/ui/Table/myAppsColumns';
+import FgTooltip from '@/components/ui/widgets/FgTooltip';
 import {
   useAppsQuery,
   useAddAppMutation,
@@ -17,14 +24,65 @@ import FgButton from './designSystem/atoms/FgButton';
 import FgExternalLink from '@/components/designSystem/atoms/FgExternalLink';
 import { DOCS_BASE_URL } from '@/constants/docs';
 
+type AppsViewMode = 'cards' | 'table';
+
+const VIEW_MODE_STORAGE_KEY = 'appsViewMode';
+
+function ViewModeToggle({
+  viewMode,
+  onChange
+}: {
+  readonly viewMode: AppsViewMode;
+  readonly onChange: (mode: AppsViewMode) => void;
+}) {
+  const triggerClasses = (active: boolean) =>
+    active
+      ? 'text-primary bg-primary/10'
+      : 'text-foreground/60 hover:text-foreground';
+  return (
+    <ButtonGroup className="gap-1">
+      <FgTooltip
+        as={IconButton}
+        icon={HiOutlineSquares2X2}
+        label="Card view"
+        onClick={() => onChange('cards')}
+        triggerClasses={triggerClasses(viewMode === 'cards')}
+        variant="ghost"
+      />
+      <FgTooltip
+        as={IconButton}
+        icon={HiOutlineTableCells}
+        label="Table view"
+        onClick={() => onChange('table')}
+        triggerClasses={triggerClasses(viewMode === 'table')}
+        variant="ghost"
+      />
+    </ButtonGroup>
+  );
+}
+
 export default function Apps() {
   const [showAddDialog, setShowAddDialog] = useState(false);
+  const [viewMode, setViewMode] = useState<AppsViewMode>(() =>
+    localStorage.getItem(VIEW_MODE_STORAGE_KEY) === 'table' ? 'table' : 'cards'
+  );
 
   const appsQuery = useAppsQuery();
   const addAppMutation = useAddAppMutation();
   const discoverAppsMutation = useDiscoverAppsMutation();
   const actions = useAppActions();
 
+  const appsColumns = useMemo(
+    () => createMyAppsColumns(actions),
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    []
+  );
+
+  const changeViewMode = (mode: AppsViewMode) => {
+    setViewMode(mode);
+    localStorage.setItem(VIEW_MODE_STORAGE_KEY, mode);
+  };
+
   const handleDiscover = (url: string) => discoverAppsMutation.mutateAsync(url);
 
   const handleAddFromUrl = async (url: string, manifestPaths?: string[]) => {
@@ -49,7 +107,7 @@ export default function Apps() {
         .
       </Typography>
 
-      <div className="mb-6">
+      <div className="mb-6 flex items-center justify-between gap-2">
         <FgButton
           icon={HiOutlineLink}
           onClick={() => setShowAddDialog(true)}
@@ -57,9 +115,21 @@ export default function Apps() {
         >
           Add from URL
         </FgButton>
+        <ViewModeToggle onChange={changeViewMode} viewMode={viewMode} />
       </div>
 
-      {appsQuery.isPending ? (
+      {viewMode === 'table' ? (
+        <div className="mb-8">
+          <TableCard
+            columns={appsColumns}
+            data={appsQuery.data || []}
+            dataType="apps"
+            errorState={appsQuery.error}
+            gridColsClass="grid-cols-[2fr_1fr_2fr_3fr_1fr_1fr]"
+            loadingState={appsQuery.isPending}
+          />
+        </div>
+      ) : appsQuery.isPending ? (
         <Typography className="text-foreground mb-6" type="small">
           Loading apps...
         </Typography>
diff --git a/frontend/src/components/ui/AppsPage/AppCard.tsx b/frontend/src/components/ui/AppsPage/AppCard.tsx
index b605352b..293ebd67 100644
--- a/frontend/src/components/ui/AppsPage/AppCard.tsx
+++ b/frontend/src/components/ui/AppsPage/AppCard.tsx
@@ -5,11 +5,15 @@ import { HiOutlinePlay } from 'react-icons/hi';
 import { HiOutlineEllipsisVertical } from 'react-icons/hi2';
 
 import CardActionsMenu from '@/components/ui/Menus/CardActionsMenu';
-import type { MenuItem } from '@/components/ui/Menus/FgMenuItems';
 import FgButton from '@/components/designSystem/atoms/FgButton';
 import FgIcon from '@/components/designSystem/atoms/FgIcon';
 import FgTooltip from '@/components/ui/widgets/FgTooltip';
+import SharedBadge from '@/components/ui/AppsPage/SharedBadge';
 import UpdateAvailableBadge from '@/components/ui/AppsPage/UpdateAvailableBadge';
+import {
+  buildAppMenuItems,
+  isAppShared
+} from '@/components/ui/AppsPage/appMenuItems';
 import type { AppActions } from '@/hooks/useAppActions';
 import { useAppUpdateAvailable } from '@/queries/appsQueries';
 import { getAppIconType } from '@/utils';
@@ -21,29 +25,10 @@ interface AppCardProps {
 }
 
 export default function AppCard({ app, actions }: AppCardProps) {
-  const isShared = app.listing_id !== undefined && app.listing_id !== null;
+  const isShared = isAppShared(app);
   const updateAvailable = useAppUpdateAvailable(app);
 
-  const menuItems: MenuItem<UserApp>[] = [
-    { name: 'Launch', action: a => actions.launch(a) },
-    { name: 'View', action: a => actions.view(a) },
-    {
-      name: 'Share to Catalog',
-      action: a => actions.requestShare(a),
-      shouldShow: !isShared
-    },
-    {
-      name: 'Unshare',
-      action: a => void actions.unshare(a),
-      shouldShow: isShared
-    },
-    { name: 'Update', action: a => void actions.update(a) },
-    {
-      name: 'Remove',
-      action: a => actions.requestRemove(a),
-      color: 'text-error'
-    }
-  ];
+  const menuItems = buildAppMenuItems(app, actions);
 
   const handleView = () => actions.view(app);
 
@@ -71,11 +56,7 @@ export default function AppCard({ app, actions }: AppCardProps) {
             className="text-foreground flex-shrink-0"
             icon={getAppIconType(app.manifest)}
           />
-          {isShared ? (
-            <span className="inline-block px-2 py-0.5 rounded-sm bg-success/10 text-success text-xs font-medium">
-              Shared
-            </span>
-          ) : null}
+          {isShared ? <SharedBadge /> : null}
           {updateAvailable ? <UpdateAvailableBadge /> : null}
         </div>
         <div
diff --git a/frontend/src/components/ui/AppsPage/AppInfoTable.tsx b/frontend/src/components/ui/AppsPage/AppInfoTable.tsx
index 5a9bb788..4dc3bbe7 100644
--- a/frontend/src/components/ui/AppsPage/AppInfoTable.tsx
+++ b/frontend/src/components/ui/AppsPage/AppInfoTable.tsx
@@ -1,24 +1,12 @@
 import FgExternalLink from '@/components/designSystem/atoms/FgExternalLink';
 import type { UserApp } from '@/shared.types';
-import { buildGithubCommitUrl, parseGithubUrl } from '@/utils/appUrls';
-
-/**
- * The revision actually cloned, parsed out of the canonical app URL (which
- * always carries it). Falls back to the requested branch, then null.
- */
-function appRevision(app: UserApp): string | null {
-  try {
-    return parseGithubUrl(app.url).branch;
-  } catch {
-    return app.branch || null;
-  }
-}
+import { appRevision, buildGithubCommitUrl } from '@/utils/appUrls';
 
 export default function AppInfoTable({ app }: { readonly app: UserApp }) {
   const labelClass =
     'text-foreground font-medium pr-4 py-1.5 align-top whitespace-nowrap';
   const valueClass = 'text-foreground py-1.5';
-  const revision = appRevision(app);
+  const revision = appRevision(app.url, app.branch);
   const commitUrl = app.commit_sha
     ? buildGithubCommitUrl(app.url, app.commit_sha)
     : null;
diff --git a/frontend/src/components/ui/AppsPage/SharedBadge.tsx b/frontend/src/components/ui/AppsPage/SharedBadge.tsx
new file mode 100644
index 00000000..6019a742
--- /dev/null
+++ b/frontend/src/components/ui/AppsPage/SharedBadge.tsx
@@ -0,0 +1,11 @@
+/**
+ * Green chip shown on app cards and table rows when the app has been shared
+ * to the catalog.
+ */
+export default function SharedBadge() {
+  return (
+    <span className="inline-block px-2 py-0.5 rounded-sm bg-success/10 text-success text-xs font-medium flex-shrink-0">
+      Shared
+    </span>
+  );
+}
diff --git a/frontend/src/components/ui/AppsPage/appMenuItems.ts b/frontend/src/components/ui/AppsPage/appMenuItems.ts
new file mode 100644
index 00000000..67dcd34e
--- /dev/null
+++ b/frontend/src/components/ui/AppsPage/appMenuItems.ts
@@ -0,0 +1,39 @@
+import type { MenuItem } from '@/components/ui/Menus/FgMenuItems';
+import type { AppActions } from '@/hooks/useAppActions';
+import type { UserApp } from '@/shared.types';
+
+/** True when the app has been shared to the catalog. */
+export function isAppShared(app: UserApp): boolean {
+  return app.listing_id !== undefined && app.listing_id !== null;
+}
+
+/**
+ * Actions menu items for a user app, shared by the My Apps card and table
+ * views.
+ */
+export function buildAppMenuItems(
+  app: UserApp,
+  actions: AppActions
+): MenuItem<UserApp>[] {
+  const isShared = isAppShared(app);
+  return [
+    { name: 'Launch', action: a => actions.launch(a) },
+    { name: 'View', action: a => actions.view(a) },
+    {
+      name: 'Share to Catalog',
+      action: a => actions.requestShare(a),
+      shouldShow: !isShared
+    },
+    {
+      name: 'Unshare',
+      action: a => void actions.unshare(a),
+      shouldShow: isShared
+    },
+    { name: 'Update', action: a => void actions.update(a) },
+    {
+      name: 'Remove',
+      action: a => actions.requestRemove(a),
+      color: 'text-error'
+    }
+  ];
+}
diff --git a/frontend/src/components/ui/Table/TableCard.tsx b/frontend/src/components/ui/Table/TableCard.tsx
index b100a12f..baea89e4 100644
--- a/frontend/src/components/ui/Table/TableCard.tsx
+++ b/frontend/src/components/ui/Table/TableCard.tsx
@@ -71,7 +71,7 @@ declare module '@tanstack/react-table' {
   }
 }
 
-type DataType = 'data links' | 'tasks' | 'NG links' | 'jobs';
+type DataType = 'data links' | 'tasks' | 'NG links' | 'jobs' | 'apps';
 
 type TableProps<TData> = {
   readonly columns: ColumnDef<TData>[];
diff --git a/frontend/src/components/ui/Table/myAppsColumns.tsx b/frontend/src/components/ui/Table/myAppsColumns.tsx
new file mode 100644
index 00000000..c17c46b2
--- /dev/null
+++ b/frontend/src/components/ui/Table/myAppsColumns.tsx
@@ -0,0 +1,183 @@
+import type { MouseEvent } from 'react';
+import type { ColumnDef } from '@tanstack/react-table';
+
+import FgExternalLink from '@/components/designSystem/atoms/FgExternalLink';
+import FgLink from '@/components/designSystem/atoms/FgLink';
+import CardActionsMenu from '@/components/ui/Menus/CardActionsMenu';
+import FgTooltip from '@/components/ui/widgets/FgTooltip';
+import SharedBadge from '@/components/ui/AppsPage/SharedBadge';
+import UpdateAvailableBadge from '@/components/ui/AppsPage/UpdateAvailableBadge';
+import {
+  buildAppMenuItems,
+  isAppShared
+} from '@/components/ui/AppsPage/appMenuItems';
+import { useAppUpdateAvailable } from '@/queries/appsQueries';
+import { appRevision, buildAppDetailPath, parseGithubUrl } from '@/utils';
+import type { AppActions } from '@/hooks/useAppActions';
+import type { UserApp } from '@/shared.types';
+
+/** "org/repo" label for an app's GitHub URL; falls back to the raw URL. */
+function repoLabel(app: UserApp): string {
+  try {
+    const { owner, repo } = parseGithubUrl(app.url);
+    return `${owner}/${repo}`;
+  } catch {
+    return app.url;
+  }
+}
+
+type OnCellContextMenu = (
+  e: MouseEvent<HTMLElement>,
+  data: { value: string }
+) => void;
+
+function NameCell({
+  app,
+  onContextMenu
+}: {
+  readonly app: UserApp;
+  readonly onContextMenu?: OnCellContextMenu;
+}) {
+  const updateAvailable = useAppUpdateAvailable(app);
+  let detailPath: string | null = null;
+  try {
+    detailPath = buildAppDetailPath(app.url, app.manifest_path);
+  } catch {
+    detailPath = null;
+  }
+  return (
+    <div
+      className="flex items-center gap-2 truncate w-full h-full"
+      onContextMenu={e => {
+        e.preventDefault();
+        onContextMenu?.(e, { value: app.name });
+      }}
+    >
+      {detailPath ? (
+        <FgLink className="truncate" to={detailPath}>
+          {app.name}
+        </FgLink>
+      ) : (
+        <span className="truncate">{app.name}</span>
+      )}
+      {updateAvailable ? <UpdateAvailableBadge /> : null}
+    </div>
+  );
+}
+
+export function createMyAppsColumns(actions: AppActions): ColumnDef<UserApp>[] {
+  return [
+    {
+      id: 'repository',
+      accessorFn: repoLabel,
+      header: 'Repository',
+      cell: ({ getValue, row, table }) => {
+        const value = getValue() as string;
+        const onContextMenu = table.options.meta?.onCellContextMenu;
+        return (
+          <div
+            className="flex items-center truncate w-full h-full"
+            onContextMenu={e => {
+              e.preventDefault();
+              onContextMenu?.(e, { value });
+            }}
+          >
+            {/* No icon: the inline-flex icon layout defeats text truncation */}
+            <FgExternalLink
+              className="truncate min-w-0"
+              href={row.original.url}
+              showIcon={false}
+              size="sm"
+            >
+              {value}
+            </FgExternalLink>
+          </div>
+        );
+      },
+      enableSorting: true
+    },
+    {
+      id: 'revision',
+      accessorFn: row => appRevision(row.url, row.branch) ?? '',
+      header: 'Revision',
+      cell: ({ getValue, table }) => {
+        const value = getValue() as string;
+        const onContextMenu = table.options.meta?.onCellContextMenu;
+        return (
+          <div
+            className="flex items-center truncate w-full h-full"
+            onContextMenu={e => {
+              e.preventDefault();
+              onContextMenu?.(e, { value });
+            }}
+          >
+            <span className="truncate text-sm">{value}</span>
+          </div>
+        );
+      },
+      enableSorting: true
+    },
+    {
+      accessorKey: 'name',
+      header: 'Name',
+      cell: ({ row, table }) => (
+        <NameCell
+          app={row.original}
+          onContextMenu={table.options.meta?.onCellContextMenu}
+        />
+      ),
+      enableSorting: true
+    },
+    {
+      accessorKey: 'description',
+      header: 'Description',
+      cell: ({ getValue, table }) => {
+        const value = (getValue() as string | undefined) ?? '';
+        const onContextMenu = table.options.meta?.onCellContextMenu;
+        return (
+          <div
+            className="flex items-center truncate w-full h-full"
+            onContextMenu={e => {
+              e.preventDefault();
+              onContextMenu?.(e, { value });
+            }}
+          >
+            {value ? (
+              <FgTooltip label={value} triggerClasses="max-w-full truncate">
+                <span className="truncate text-sm">{value}</span>
+              </FgTooltip>
+            ) : null}
+          </div>
+        );
+      },
+      enableSorting: true
+    },
+    {
+      id: 'shared',
+      accessorFn: row => (isAppShared(row) ? 'Shared' : ''),
+      header: 'Shared',
+      cell: ({ row }) => (
+        <div className="flex items-center h-full">
+          {isAppShared(row.original) ? <SharedBadge /> : null}
+        </div>
+      ),
+      enableSorting: true
+    },
+    {
+      id: 'actions',
+      header: 'Actions',
+      cell: ({ row }) => {
+        const app = row.original;
+        return (
+          <div className="flex items-center justify-end h-full">
+            <CardActionsMenu<UserApp>
+              actionProps={app}
+              menuItems={buildAppMenuItems(app, actions)}
+            />
+          </div>
+        );
+      },
+      enableSorting: false
+    }
+  ];
+}
diff --git a/frontend/src/utils/appUrls.ts b/frontend/src/utils/appUrls.ts
index b16475ea..1c1a1252 100644
--- a/frontend/src/utils/appUrls.ts
+++ b/frontend/src/utils/appUrls.ts
@@ -82,6 +82,21 @@ export function buildGithubUrl(
   return `https://github.com/${owner}/${repo}/tree/${branch}`;
 }
 
+/**
+ * The revision actually cloned, parsed out of the canonical app URL (which
+ * always carries it). Falls back to the requested branch, then null.
+ */
+export function appRevision(
+  appUrl: string,
+  fallbackBranch?: string
+): string | null {
+  try {
+    return parseGithubUrl(appUrl).branch;
+  } catch {
+    return fallbackBranch || null;
+  }
+}
+
 /**
  * GitHub link for a specific commit of an app; null if the app URL isn't
  * parseable.
diff --git a/frontend/src/utils/index.ts b/frontend/src/utils/index.ts
index f42c8b18..23bb613d 100644
--- a/frontend/src/utils/index.ts
+++ b/frontend/src/utils/index.ts
@@ -392,6 +392,7 @@ export type {
 
 // Re-export app URL utilities
 export {
+  appRevision,
   parseGithubUrl,
   isGithubRepoUrl,
   canonicalGithubUrl,

From b3a2d7bd0eb013db3419a3b47f1273b73c1798b9 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Fri, 3 Jul 2026 09:03:18 -0400
Subject: [PATCH 29/89] fix(apps): drop update-available badge from My Apps
 table mode

Keep the pill on cards and the detail page only; the table's name cell
no longer mounts the check-updates query.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 frontend/src/components/ui/Table/myAppsColumns.tsx | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/frontend/src/components/ui/Table/myAppsColumns.tsx b/frontend/src/components/ui/Table/myAppsColumns.tsx
index c17c46b2..9de0f3de 100644
--- a/frontend/src/components/ui/Table/myAppsColumns.tsx
+++ b/frontend/src/components/ui/Table/myAppsColumns.tsx
@@ -6,12 +6,10 @@ import FgLink from '@/components/designSystem/atoms/FgLink';
 import CardActionsMenu from '@/components/ui/Menus/CardActionsMenu';
 import FgTooltip from '@/components/ui/widgets/FgTooltip';
 import SharedBadge from '@/components/ui/AppsPage/SharedBadge';
-import UpdateAvailableBadge from '@/components/ui/AppsPage/UpdateAvailableBadge';
 import {
   buildAppMenuItems,
   isAppShared
 } from '@/components/ui/AppsPage/appMenuItems';
-import { useAppUpdateAvailable } from '@/queries/appsQueries';
 import { appRevision, buildAppDetailPath, parseGithubUrl } from '@/utils';
 import type { AppActions } from '@/hooks/useAppActions';
 import type { UserApp } from '@/shared.types';
@@ -38,7 +36,6 @@ function NameCell({
   readonly app: UserApp;
   readonly onContextMenu?: OnCellContextMenu;
 }) {
-  const updateAvailable = useAppUpdateAvailable(app);
   let detailPath: string | null = null;
   try {
     detailPath = buildAppDetailPath(app.url, app.manifest_path);
@@ -60,7 +57,6 @@ function NameCell({
       ) : (
         <span className="truncate">{app.name}</span>
       )}
-      {updateAvailable ? <UpdateAvailableBadge /> : null}
     </div>
   );
 }

From c7d8b8ca7c46cad674063bf9a9eea66502536257 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Fri, 3 Jul 2026 09:09:16 -0400
Subject: [PATCH 30/89] fix(apps): name Nextflow pipelines by repo only, not
 org/repo

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 fileglancer/apps/nextflow.py | 9 +++++----
 tests/test_apps.py           | 4 ++--
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/fileglancer/apps/nextflow.py b/fileglancer/apps/nextflow.py
index d64b5f03..326d5f5e 100644
--- a/fileglancer/apps/nextflow.py
+++ b/fileglancer/apps/nextflow.py
@@ -99,15 +99,16 @@ def convert(self, directory: Path) -> AppManifest:
         schema_path = directory / _NEXTFLOW_SCHEMA_FILENAME
         schema = json.loads(schema_path.read_text())
 
-        # Determine app metadata — use owner/repo from the cache path
-        # (directory is {cache_base}/{owner}/{repo}/{branch})
+        # Determine app metadata — use the repo name from the cache path
+        # (directory is {cache_base}/{owner}/{repo}/{branch}, where branch may
+        # span multiple path segments)
         try:
             from fileglancer.apps.manifest import _repo_cache_base
             cache_base = _repo_cache_base().resolve()
             relative = directory.resolve().relative_to(cache_base)
-            name = f"{relative.parts[0]}/{relative.parts[1]}"
+            name = relative.parts[1]
         except Exception:
-            name = f"{directory.parent.parent.name}/{directory.parent.name}"
+            name = directory.parent.name
         description = schema.get("description")
 
         # Build parameters from definitions, ordered by allOf
diff --git a/tests/test_apps.py b/tests/test_apps.py
index 133ab25d..c2a36752 100644
--- a/tests/test_apps.py
+++ b/tests/test_apps.py
@@ -2006,7 +2006,7 @@ def test_standard_naming(self, tmp_path):
 
         with patch("fileglancer.apps.manifest._repo_cache_base", return_value=cache_base):
             manifest = NextflowAdapter().convert(repo_dir)
-            assert manifest.name == "nf-core/rnaseq"
+            assert manifest.name == "rnaseq"
 
     def test_slashed_branch_naming(self, tmp_path):
         from unittest.mock import patch
@@ -2017,7 +2017,7 @@ def test_slashed_branch_naming(self, tmp_path):
 
         with patch("fileglancer.apps.manifest._repo_cache_base", return_value=cache_base):
             manifest = NextflowAdapter().convert(repo_dir)
-            assert manifest.name == "nf-core/rnaseq"
+            assert manifest.name == "rnaseq"
 
 
 class TestEffectiveWorkingDir:

From 8b0fbbd06d72005255af5fae78fe3bb1c363783a Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Fri, 3 Jul 2026 11:53:15 -0400
Subject: [PATCH 31/89] feat(apps): add card/table view toggle to App Catalog

Extract the view-mode toggle and localStorage persistence from My Apps
into shared useViewMode/ViewModeToggle, and the listing menu items and
"In your apps" badge from ListingCard for reuse in the new catalog
table. The catalog table includes the sharer, and the header now groups
search and the hide-installed checkbox on the left with the toggle on
the right. Rename the My Apps "Shared" column to "Status" to match.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 frontend/src/components/Apps.tsx              |  57 +------
 frontend/src/components/Catalog.tsx           |  57 +++++--
 .../ui/AppsPage/InYourAppsBadge.tsx           |  11 ++
 .../components/ui/AppsPage/ListingCard.tsx    |  34 ++---
 .../ui/AppsPage/listingMenuItems.ts           |  35 +++++
 .../src/components/ui/Table/TableCard.tsx     |   8 +-
 .../components/ui/Table/catalogColumns.tsx    | 144 ++++++++++++++++++
 .../src/components/ui/Table/myAppsColumns.tsx |   4 +-
 .../components/ui/widgets/ViewModeToggle.tsx  |  41 +++++
 frontend/src/hooks/useViewMode.ts             |  22 +++
 10 files changed, 320 insertions(+), 93 deletions(-)
 create mode 100644 frontend/src/components/ui/AppsPage/InYourAppsBadge.tsx
 create mode 100644 frontend/src/components/ui/AppsPage/listingMenuItems.ts
 create mode 100644 frontend/src/components/ui/Table/catalogColumns.tsx
 create mode 100644 frontend/src/components/ui/widgets/ViewModeToggle.tsx
 create mode 100644 frontend/src/hooks/useViewMode.ts

diff --git a/frontend/src/components/Apps.tsx b/frontend/src/components/Apps.tsx
index abd62228..56c98ff8 100644
--- a/frontend/src/components/Apps.tsx
+++ b/frontend/src/components/Apps.tsx
@@ -1,11 +1,7 @@
 import { useMemo, useState } from 'react';
 
-import { ButtonGroup, IconButton, Typography } from '@material-tailwind/react';
-import {
-  HiOutlineLink,
-  HiOutlineSquares2X2,
-  HiOutlineTableCells
-} from 'react-icons/hi2';
+import { Typography } from '@material-tailwind/react';
+import { HiOutlineLink } from 'react-icons/hi2';
 import toast from 'react-hot-toast';
 
 import AppCard from '@/components/ui/AppsPage/AppCard';
@@ -13,59 +9,21 @@ import AddAppDialog from '@/components/ui/AppsPage/AddAppDialog';
 import AppActionDialogs from '@/components/ui/AppsPage/AppActionDialogs';
 import { TableCard } from '@/components/ui/Table/TableCard';
 import { createMyAppsColumns } from '@/components/ui/Table/myAppsColumns';
-import FgTooltip from '@/components/ui/widgets/FgTooltip';
+import ViewModeToggle from '@/components/ui/widgets/ViewModeToggle';
 import {
   useAppsQuery,
   useAddAppMutation,
   useDiscoverAppsMutation
 } from '@/queries/appsQueries';
 import { useAppActions } from '@/hooks/useAppActions';
+import { useViewMode } from '@/hooks/useViewMode';
 import FgButton from './designSystem/atoms/FgButton';
 import FgExternalLink from '@/components/designSystem/atoms/FgExternalLink';
 import { DOCS_BASE_URL } from '@/constants/docs';
 
-type AppsViewMode = 'cards' | 'table';
-
-const VIEW_MODE_STORAGE_KEY = 'appsViewMode';
-
-function ViewModeToggle({
-  viewMode,
-  onChange
-}: {
-  readonly viewMode: AppsViewMode;
-  readonly onChange: (mode: AppsViewMode) => void;
-}) {
-  const triggerClasses = (active: boolean) =>
-    active
-      ? 'text-primary bg-primary/10'
-      : 'text-foreground/60 hover:text-foreground';
-  return (
-    <ButtonGroup className="gap-1">
-      <FgTooltip
-        as={IconButton}
-        icon={HiOutlineSquares2X2}
-        label="Card view"
-        onClick={() => onChange('cards')}
-        triggerClasses={triggerClasses(viewMode === 'cards')}
-        variant="ghost"
-      />
-      <FgTooltip
-        as={IconButton}
-        icon={HiOutlineTableCells}
-        label="Table view"
-        onClick={() => onChange('table')}
-        triggerClasses={triggerClasses(viewMode === 'table')}
-        variant="ghost"
-      />
-    </ButtonGroup>
-  );
-}
-
 export default function Apps() {
   const [showAddDialog, setShowAddDialog] = useState(false);
-  const [viewMode, setViewMode] = useState<AppsViewMode>(() =>
-    localStorage.getItem(VIEW_MODE_STORAGE_KEY) === 'table' ? 'table' : 'cards'
-  );
+  const [viewMode, changeViewMode] = useViewMode('appsViewMode');
 
   const appsQuery = useAppsQuery();
   const addAppMutation = useAddAppMutation();
@@ -78,11 +36,6 @@ export default function Apps() {
     []
   );
 
-  const changeViewMode = (mode: AppsViewMode) => {
-    setViewMode(mode);
-    localStorage.setItem(VIEW_MODE_STORAGE_KEY, mode);
-  };
-
   const handleDiscover = (url: string) => discoverAppsMutation.mutateAsync(url);
 
   const handleAddFromUrl = async (url: string, manifestPaths?: string[]) => {
diff --git a/frontend/src/components/Catalog.tsx b/frontend/src/components/Catalog.tsx
index e4e30d9a..b4eb78b1 100644
--- a/frontend/src/components/Catalog.tsx
+++ b/frontend/src/components/Catalog.tsx
@@ -3,14 +3,19 @@ import { Typography } from '@material-tailwind/react';
 
 import ListingCard from '@/components/ui/AppsPage/ListingCard';
 import FgCheckbox from '@/components/designSystem/atoms/formElements/FgCheckbox';
+import { TableCard } from '@/components/ui/Table/TableCard';
+import { createCatalogColumns } from '@/components/ui/Table/catalogColumns';
+import ViewModeToggle from '@/components/ui/widgets/ViewModeToggle';
 import { useAppsQuery, useCatalogQuery } from '@/queries/appsQueries';
 import { useListingActions } from '@/hooks/useListingActions';
+import { useViewMode } from '@/hooks/useViewMode';
 import { useProfileContext } from '@/contexts/ProfileContext';
-import type { UserApp } from '@/shared.types';
+import type { AppListing, UserApp } from '@/shared.types';
 
 export default function Catalog() {
   const [search, setSearch] = useState('');
   const [hideInstalled, setHideInstalled] = useState(false);
+  const [viewMode, changeViewMode] = useViewMode('catalogViewMode');
 
   const catalogQuery = useCatalogQuery();
   const appsQuery = useAppsQuery();
@@ -25,6 +30,18 @@ export default function Catalog() {
     return map;
   }, [appsQuery.data]);
 
+  const catalogColumns = useMemo(
+    () =>
+      createCatalogColumns(
+        actions,
+        (listing: AppListing) =>
+          myAppsByKey.get(`${listing.url}::${listing.manifest_path}`),
+        profile?.username
+      ),
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    [myAppsByKey, profile?.username]
+  );
+
   const filteredListings = useMemo(() => {
     const term = search.trim().toLowerCase();
     const listings = catalogQuery.data ?? [];
@@ -53,18 +70,21 @@ export default function Catalog() {
       </Typography>
 
       <div className="mb-6 flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
-        <input
-          className="w-full sm:max-w-sm p-2 text-foreground border rounded-sm focus:outline-none bg-background border-primary-light focus:border-primary"
-          onChange={e => setSearch(e.target.value)}
-          placeholder="Search by name, description, or sharer"
-          type="text"
-          value={search}
-        />
-        <FgCheckbox
-          checked={hideInstalled}
-          label="Hide already installed apps"
-          onChange={e => setHideInstalled(e.target.checked)}
-        />
+        <div className="flex w-full flex-col gap-3 sm:flex-row sm:items-center">
+          <input
+            className="w-full sm:max-w-sm p-2 text-foreground border rounded-sm focus:outline-none bg-background border-primary-light focus:border-primary"
+            onChange={e => setSearch(e.target.value)}
+            placeholder="Search by name, description, or sharer"
+            type="text"
+            value={search}
+          />
+          <FgCheckbox
+            checked={hideInstalled}
+            label="Hide already installed apps"
+            onChange={e => setHideInstalled(e.target.checked)}
+          />
+        </div>
+        <ViewModeToggle onChange={changeViewMode} viewMode={viewMode} />
       </div>
 
       {catalogQuery.isPending ? (
@@ -91,6 +111,17 @@ export default function Catalog() {
               : 'All shared apps are already in your apps.'}
           </Typography>
         </div>
+      ) : viewMode === 'table' ? (
+        <div className="mb-8">
+          <TableCard
+            columns={catalogColumns}
+            data={filteredListings}
+            dataType="shared apps"
+            errorState={catalogQuery.error}
+            gridColsClass="grid-cols-[2fr_3fr_1fr_1fr_1fr_1fr]"
+            loadingState={catalogQuery.isPending}
+          />
+        </div>
       ) : (
         <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-4 mb-8">
           {filteredListings.map(listing => {
diff --git a/frontend/src/components/ui/AppsPage/InYourAppsBadge.tsx b/frontend/src/components/ui/AppsPage/InYourAppsBadge.tsx
new file mode 100644
index 00000000..d9a80f00
--- /dev/null
+++ b/frontend/src/components/ui/AppsPage/InYourAppsBadge.tsx
@@ -0,0 +1,11 @@
+/**
+ * Green chip shown on catalog cards and table rows when the listing is
+ * already in the user's apps.
+ */
+export default function InYourAppsBadge() {
+  return (
+    <span className="inline-block px-2 py-0.5 rounded-sm bg-success/10 text-success text-xs font-medium flex-shrink-0">
+      In your apps
+    </span>
+  );
+}
diff --git a/frontend/src/components/ui/AppsPage/ListingCard.tsx b/frontend/src/components/ui/AppsPage/ListingCard.tsx
index a0593c90..71bcfe7e 100644
--- a/frontend/src/components/ui/AppsPage/ListingCard.tsx
+++ b/frontend/src/components/ui/AppsPage/ListingCard.tsx
@@ -4,7 +4,8 @@ import { HiOutlinePlus } from 'react-icons/hi';
 import { HiOutlineEllipsisVertical } from 'react-icons/hi2';
 
 import CardActionsMenu from '@/components/ui/Menus/CardActionsMenu';
-import type { MenuItem } from '@/components/ui/Menus/FgMenuItems';
+import InYourAppsBadge from '@/components/ui/AppsPage/InYourAppsBadge';
+import { buildListingMenuItems } from '@/components/ui/AppsPage/listingMenuItems';
 import FgButton from '@/components/designSystem/atoms/FgButton';
 import FgIcon from '@/components/designSystem/atoms/FgIcon';
 import FgTooltip from '@/components/ui/widgets/FgTooltip';
@@ -30,25 +31,12 @@ export default function ListingCard({
   const adding = actions.addingId === listing.id;
   const publishedAt = formatDateString(listing.published_at);
 
-  const menuItems: MenuItem<AppListing>[] = [
-    {
-      name: 'Add to my apps',
-      action: l => void actions.add(l),
-      shouldShow: !alreadyAdded
-    },
-    { name: 'View', action: l => actions.view(l) },
-    {
-      name: 'View in My Apps',
-      action: () => installedApp && actions.viewInMyApps(installedApp),
-      shouldShow: alreadyAdded
-    },
-    {
-      name: 'Unshare',
-      action: l => void actions.unshare(l),
-      color: 'text-error',
-      shouldShow: canManage
-    }
-  ];
+  const menuItems = buildListingMenuItems(
+    listing,
+    installedApp,
+    canManage,
+    actions
+  );
 
   const handleView = () => actions.view(listing);
 
@@ -76,11 +64,7 @@ export default function ListingCard({
             className="text-foreground flex-shrink-0"
             icon={getAppIconType(installedApp?.manifest)}
           />
-          {alreadyAdded ? (
-            <span className="inline-block px-2 py-0.5 rounded-sm bg-success/10 text-success text-xs font-medium">
-              In your apps
-            </span>
-          ) : null}
+          {alreadyAdded ? <InYourAppsBadge /> : null}
         </div>
         <div
           className="flex items-center gap-1"
diff --git a/frontend/src/components/ui/AppsPage/listingMenuItems.ts b/frontend/src/components/ui/AppsPage/listingMenuItems.ts
new file mode 100644
index 00000000..41a3dcaf
--- /dev/null
+++ b/frontend/src/components/ui/AppsPage/listingMenuItems.ts
@@ -0,0 +1,35 @@
+import type { MenuItem } from '@/components/ui/Menus/FgMenuItems';
+import type { ListingActions } from '@/hooks/useListingActions';
+import type { AppListing, UserApp } from '@/shared.types';
+
+/**
+ * Actions menu items for a catalog listing, shared by the catalog card and
+ * table views.
+ */
+export function buildListingMenuItems(
+  listing: AppListing,
+  installedApp: UserApp | undefined,
+  canManage: boolean,
+  actions: ListingActions
+): MenuItem<AppListing>[] {
+  const alreadyAdded = installedApp !== undefined;
+  return [
+    {
+      name: 'Add to my apps',
+      action: l => void actions.add(l),
+      shouldShow: !alreadyAdded
+    },
+    { name: 'View', action: l => actions.view(l) },
+    {
+      name: 'View in My Apps',
+      action: () => installedApp && actions.viewInMyApps(installedApp),
+      shouldShow: alreadyAdded
+    },
+    {
+      name: 'Unshare',
+      action: l => void actions.unshare(l),
+      color: 'text-error',
+      shouldShow: canManage
+    }
+  ];
+}
diff --git a/frontend/src/components/ui/Table/TableCard.tsx b/frontend/src/components/ui/Table/TableCard.tsx
index baea89e4..04f2110e 100644
--- a/frontend/src/components/ui/Table/TableCard.tsx
+++ b/frontend/src/components/ui/Table/TableCard.tsx
@@ -71,7 +71,13 @@ declare module '@tanstack/react-table' {
   }
 }
 
-type DataType = 'data links' | 'tasks' | 'NG links' | 'jobs' | 'apps';
+type DataType =
+  | 'data links'
+  | 'tasks'
+  | 'NG links'
+  | 'jobs'
+  | 'apps'
+  | 'shared apps';
 
 type TableProps<TData> = {
   readonly columns: ColumnDef<TData>[];
diff --git a/frontend/src/components/ui/Table/catalogColumns.tsx b/frontend/src/components/ui/Table/catalogColumns.tsx
new file mode 100644
index 00000000..68ee2b47
--- /dev/null
+++ b/frontend/src/components/ui/Table/catalogColumns.tsx
@@ -0,0 +1,144 @@
+import type { ColumnDef } from '@tanstack/react-table';
+
+import FgLink from '@/components/designSystem/atoms/FgLink';
+import CardActionsMenu from '@/components/ui/Menus/CardActionsMenu';
+import FgTooltip from '@/components/ui/widgets/FgTooltip';
+import InYourAppsBadge from '@/components/ui/AppsPage/InYourAppsBadge';
+import { buildListingMenuItems } from '@/components/ui/AppsPage/listingMenuItems';
+import { buildListingDetailPath } from '@/hooks/useListingActions';
+import type { ListingActions } from '@/hooks/useListingActions';
+import { formatDateString } from '@/utils';
+import type { AppListing, UserApp } from '@/shared.types';
+
+export function createCatalogColumns(
+  actions: ListingActions,
+  getInstalledApp: (listing: AppListing) => UserApp | undefined,
+  currentUsername: string | undefined
+): ColumnDef<AppListing>[] {
+  return [
+    {
+      accessorKey: 'name',
+      header: 'Name',
+      cell: ({ getValue, row, table }) => {
+        const value = getValue() as string;
+        const onContextMenu = table.options.meta?.onCellContextMenu;
+        return (
+          <div
+            className="flex items-center gap-2 truncate w-full h-full"
+            onContextMenu={e => {
+              e.preventDefault();
+              onContextMenu?.(e, { value });
+            }}
+          >
+            <FgLink
+              className="truncate"
+              to={buildListingDetailPath(row.original.id)}
+            >
+              {value}
+            </FgLink>
+          </div>
+        );
+      },
+      enableSorting: true
+    },
+    {
+      accessorKey: 'description',
+      header: 'Description',
+      cell: ({ getValue, table }) => {
+        const value = (getValue() as string | undefined) ?? '';
+        const onContextMenu = table.options.meta?.onCellContextMenu;
+        return (
+          <div
+            className="flex items-center truncate w-full h-full"
+            onContextMenu={e => {
+              e.preventDefault();
+              onContextMenu?.(e, { value });
+            }}
+          >
+            {value ? (
+              <FgTooltip label={value} triggerClasses="max-w-full truncate">
+                <span className="truncate text-sm">{value}</span>
+              </FgTooltip>
+            ) : null}
+          </div>
+        );
+      },
+      enableSorting: true
+    },
+    {
+      accessorKey: 'owner_username',
+      header: 'Sharer',
+      cell: ({ getValue, table }) => {
+        const value = getValue() as string;
+        const onContextMenu = table.options.meta?.onCellContextMenu;
+        return (
+          <div
+            className="flex items-center truncate w-full h-full"
+            onContextMenu={e => {
+              e.preventDefault();
+              onContextMenu?.(e, { value });
+            }}
+          >
+            <span className="truncate text-sm">{value}</span>
+          </div>
+        );
+      },
+      enableSorting: true
+    },
+    {
+      accessorKey: 'published_at',
+      header: 'Shared on',
+      cell: ({ getValue, table }) => {
+        const formattedDate = formatDateString(getValue() as string);
+        const onContextMenu = table.options.meta?.onCellContextMenu;
+        return (
+          <div
+            className="flex items-center truncate w-full h-full"
+            onContextMenu={e => {
+              e.preventDefault();
+              onContextMenu?.(e, { value: formattedDate });
+            }}
+          >
+            <span className="truncate text-sm">{formattedDate}</span>
+          </div>
+        );
+      },
+      enableSorting: true
+    },
+    {
+      id: 'status',
+      accessorFn: row => (getInstalledApp(row) ? 'In your apps' : ''),
+      header: 'Status',
+      cell: ({ row }) => (
+        <div className="flex items-center h-full">
+          {getInstalledApp(row.original) ? <InYourAppsBadge /> : null}
+        </div>
+      ),
+      enableSorting: true
+    },
+    {
+      id: 'actions',
+      header: 'Actions',
+      cell: ({ row }) => {
+        const listing = row.original;
+        const canManage =
+          currentUsername !== undefined &&
+          currentUsername === listing.owner_username;
+        return (
+          <div className="flex items-center justify-end h-full">
+            <CardActionsMenu<AppListing>
+              actionProps={listing}
+              menuItems={buildListingMenuItems(
+                listing,
+                getInstalledApp(listing),
+                canManage,
+                actions
+              )}
+            />
+          </div>
+        );
+      },
+      enableSorting: false
+    }
+  ];
+}
diff --git a/frontend/src/components/ui/Table/myAppsColumns.tsx b/frontend/src/components/ui/Table/myAppsColumns.tsx
index 9de0f3de..f408e33a 100644
--- a/frontend/src/components/ui/Table/myAppsColumns.tsx
+++ b/frontend/src/components/ui/Table/myAppsColumns.tsx
@@ -149,9 +149,9 @@ export function createMyAppsColumns(actions: AppActions): ColumnDef<UserApp>[] {
       enableSorting: true
     },
     {
-      id: 'shared',
+      id: 'status',
       accessorFn: row => (isAppShared(row) ? 'Shared' : ''),
-      header: 'Shared',
+      header: 'Status',
       cell: ({ row }) => (
         <div className="flex items-center h-full">
           {isAppShared(row.original) ? <SharedBadge /> : null}
diff --git a/frontend/src/components/ui/widgets/ViewModeToggle.tsx b/frontend/src/components/ui/widgets/ViewModeToggle.tsx
new file mode 100644
index 00000000..cabb87d6
--- /dev/null
+++ b/frontend/src/components/ui/widgets/ViewModeToggle.tsx
@@ -0,0 +1,41 @@
+import { ButtonGroup, IconButton } from '@material-tailwind/react';
+import { HiOutlineSquares2X2, HiOutlineTableCells } from 'react-icons/hi2';
+
+import FgTooltip from '@/components/ui/widgets/FgTooltip';
+import type { ViewMode } from '@/hooks/useViewMode';
+
+interface ViewModeToggleProps {
+  readonly viewMode: ViewMode;
+  readonly onChange: (mode: ViewMode) => void;
+}
+
+/** Card/table view switcher shared by the My Apps and App Catalog pages. */
+export default function ViewModeToggle({
+  viewMode,
+  onChange
+}: ViewModeToggleProps) {
+  const triggerClasses = (active: boolean) =>
+    active
+      ? 'text-primary bg-primary/10'
+      : 'text-foreground/60 hover:text-foreground';
+  return (
+    <ButtonGroup className="gap-1">
+      <FgTooltip
+        as={IconButton}
+        icon={HiOutlineSquares2X2}
+        label="Card view"
+        onClick={() => onChange('cards')}
+        triggerClasses={triggerClasses(viewMode === 'cards')}
+        variant="ghost"
+      />
+      <FgTooltip
+        as={IconButton}
+        icon={HiOutlineTableCells}
+        label="Table view"
+        onClick={() => onChange('table')}
+        triggerClasses={triggerClasses(viewMode === 'table')}
+        variant="ghost"
+      />
+    </ButtonGroup>
+  );
+}
diff --git a/frontend/src/hooks/useViewMode.ts b/frontend/src/hooks/useViewMode.ts
new file mode 100644
index 00000000..6a0a2962
--- /dev/null
+++ b/frontend/src/hooks/useViewMode.ts
@@ -0,0 +1,22 @@
+import { useState } from 'react';
+
+export type ViewMode = 'cards' | 'table';
+
+/**
+ * Card/table view mode persisted to localStorage under the given key, shared
+ * by the My Apps and App Catalog pages.
+ */
+export function useViewMode(
+  storageKey: string
+): [ViewMode, (mode: ViewMode) => void] {
+  const [viewMode, setViewMode] = useState<ViewMode>(() =>
+    localStorage.getItem(storageKey) === 'table' ? 'table' : 'cards'
+  );
+
+  const changeViewMode = (mode: ViewMode) => {
+    setViewMode(mode);
+    localStorage.setItem(storageKey, mode);
+  };
+
+  return [viewMode, changeViewMode];
+}

From 5a5b273def9e7348238af061ad3a4203bf0c594f Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Fri, 3 Jul 2026 14:09:19 -0400
Subject: [PATCH 32/89] feat(apps): replace create_if_missing with exists on
 path params

Path parameters now carry an exists flag (default true) matching
nf-schema vocabulary: exists=false marks outputs the job may create,
skipping the pre-launch existence check (containment is still enforced)
while directories are still auto-created at submit time. The Nextflow
adapter maps this straight from nextflow_schema.json, so pipeline paths
like outdir no longer need to exist before launch unless the schema
sets "exists": true. The validate-paths protocol field is renamed to
may_be_missing accordingly.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 fileglancer/apps/command.py                   |  20 +--
 fileglancer/apps/jobs.py                      |  20 +--
 fileglancer/apps/nextflow.py                  |   6 +
 fileglancer/model.py                          |  26 ++--
 fileglancer/server.py                         |   2 +-
 fileglancer/user_worker.py                    |  13 +-
 .../components/ui/AppsPage/AppLaunchForm.tsx  |  15 +--
 frontend/src/queries/appsQueries.ts           |   4 +-
 frontend/src/shared.types.ts                  |   4 +-
 tests/test_apps.py                            | 115 +++++++++++++++---
 tests/test_worker.py                          |  10 +-
 11 files changed, 168 insertions(+), 67 deletions(-)

diff --git a/fileglancer/apps/command.py b/fileglancer/apps/command.py
index c3993e4a..9ce4c616 100644
--- a/fileglancer/apps/command.py
+++ b/fileglancer/apps/command.py
@@ -488,12 +488,14 @@ def build_command(entry_point: AppEntryPoint, parameters: dict,
 
 
 def collect_path_parameters(entry_point: AppEntryPoint, parameters: dict,
-                            env_parameters: dict = None) -> list[tuple[str, str, str]]:
+                            env_parameters: dict = None) -> list[tuple[str, str, str, bool]]:
     """Collect effective file/directory parameter values needing path validation.
 
     Mirrors build_command's effective-value computation (user-provided merged
     with defaults, across both the env and pipeline namespaces) but returns only
-    file/directory parameters as (param_key, param_name, raw_value) tuples.
+    file/directory parameters as (param_key, param_name, raw_value, exists)
+    tuples. exists=False params are outputs the job may create, so they are
+    validated for file-share containment only, not existence.
 
     Raw (un-expanded) values are returned so that authoritative validation can
     run in the setuid worker, where '~' and access checks resolve as the target
@@ -504,7 +506,7 @@ def collect_path_parameters(entry_point: AppEntryPoint, parameters: dict,
     param_flat = _flatten_param_items(entry_point.parameters)
     groups = ((env_flat, env_parameters), (param_flat, parameters))
 
-    result: list[tuple[str, str, str]] = []
+    result: list[tuple[str, str, str, bool]] = []
     for flat, values in groups:
         for param in flat:
             if param.type not in ("file", "directory"):
@@ -515,19 +517,19 @@ def collect_path_parameters(entry_point: AppEntryPoint, parameters: dict,
                 value = param.default
             else:
                 continue
-            result.append((param.key, param.name, str(value)))
+            result.append((param.key, param.name, str(value), param.exists))
     return result
 
 
 def collect_creatable_dirs(entry_point: AppEntryPoint, parameters: dict,
                            env_parameters: dict = None) -> list[tuple[str, str]]:
-    """Collect effective directory values for params with create_if_missing set.
+    """Collect effective directory values for params with exists=false.
 
     Mirrors collect_path_parameters' effective-value logic (user value else
     default, across both the env and pipeline namespaces) but returns only
-    directory params carrying create_if_missing, as (param_name, raw_value)
-    tuples. Raw (un-expanded) values are returned so the setuid worker resolves
-    '~' as the target user. See submit_job.
+    directory params whose path need not exist yet (exists=false), as
+    (param_name, raw_value) tuples. Raw (un-expanded) values are returned so
+    the setuid worker resolves '~' as the target user. See submit_job.
     """
     env_parameters = env_parameters or {}
     env_flat = _flatten_param_items(entry_point.env_parameters)
@@ -537,7 +539,7 @@ def collect_creatable_dirs(entry_point: AppEntryPoint, parameters: dict,
     result: list[tuple[str, str]] = []
     for flat, values in groups:
         for param in flat:
-            if param.type != "directory" or not param.create_if_missing:
+            if param.type != "directory" or param.exists:
                 continue
             if param.key in values:
                 value = values[param.key]
diff --git a/fileglancer/apps/jobs.py b/fileglancer/apps/jobs.py
index c797737e..65e0c3b0 100644
--- a/fileglancer/apps/jobs.py
+++ b/fileglancer/apps/jobs.py
@@ -625,10 +625,10 @@ async def submit_job(
     # as a service account that isn't in the user's groups, so a redundant
     # server-side check would wrongly reject (or, on local FS, wrongly accept)
     # paths the user can actually access.
-    # Create any directory params flagged create_if_missing first, as the user,
-    # so a home default like '~/.fileglancer/logs' exists by the time the
-    # existence check below runs. Containment (within a file share) is enforced
-    # in the worker before makedirs, so this never writes outside a share.
+    # Create any directory params with exists=false first, as the user, so a
+    # home default like '~/.fileglancer/logs' exists by the time the job runs.
+    # Containment (within a file share) is enforced in the worker before
+    # makedirs, so this never writes outside a share.
     creatable_dirs = collect_creatable_dirs(entry_point, parameters, env_parameters)
     if creatable_dirs:
         paths_to_create = {str(i): value for i, (_, value) in enumerate(creatable_dirs)}
@@ -641,14 +641,20 @@ async def submit_job(
 
     path_params = collect_path_parameters(entry_point, parameters, env_parameters)
     if path_params:
-        paths_to_check = {str(i): value for i, (_, _, value) in enumerate(path_params)}
-        validation = await _dispatch(username, "validate_paths", paths=paths_to_check)
+        paths_to_check = {str(i): value for i, (_, _, value, _) in enumerate(path_params)}
+        # exists=false params are outputs the job may create: containment check
+        # only. Directory params among them were just created above, but file
+        # params (e.g. a Nextflow output file) never exist pre-launch.
+        may_be_missing = [str(i) for i, (_, _, _, exists) in enumerate(path_params)
+                          if not exists]
+        validation = await _dispatch(username, "validate_paths", paths=paths_to_check,
+                                     may_be_missing=may_be_missing)
         errors = (validation or {}).get("errors") or {}
         if errors:
             # Report the first failure, keyed back to its parameter name, to
             # match the single-message format build_command would have raised.
             idx = min(int(i) for i in errors)
-            _, param_name, _ = path_params[idx]
+            _, param_name, _, _ = path_params[idx]
             raise ValueError(f"Parameter '{param_name}': {errors[str(idx)]}")
 
     # Build resource spec (extra_args passed separately, not from manifest)
diff --git a/fileglancer/apps/nextflow.py b/fileglancer/apps/nextflow.py
index 326d5f5e..48609288 100644
--- a/fileglancer/apps/nextflow.py
+++ b/fileglancer/apps/nextflow.py
@@ -53,6 +53,12 @@ def _convert_property(name: str, prop: dict, is_required: bool) -> AppParameter:
     if is_required:
         kwargs["required"] = True
 
+    # Nextflow schemas only require a path to exist when "exists": true is set;
+    # anything else (outdir, report paths, ...) is an output the pipeline
+    # creates, so don't demand it exists before launch.
+    if param_type in ("file", "directory"):
+        kwargs["exists"] = prop.get("exists") is True
+
     if "default" in prop:
         default = prop["default"]
         if isinstance(default, str):
diff --git a/fileglancer/model.py b/fileglancer/model.py
index 9683f0cc..3769f9d4 100644
--- a/fileglancer/model.py
+++ b/fileglancer/model.py
@@ -340,11 +340,15 @@ class AppParameter(BaseModel):
     pattern: Optional[str] = Field(description="Regex validation pattern for string types", default=None)
     hidden: bool = Field(description="Whether the parameter is hidden by default in the UI", default=False)
     raw: bool = Field(description="If true, value is appended to the command without shell quoting", default=False)
-    create_if_missing: bool = Field(
-        description="directory params only: create the resolved directory (as the user, "
-                    "within an allowed file share) before the existence check, so a home "
-                    "default like '~/.fileglancer/logs' works on first launch",
-        default=False,
+    exists: bool = Field(
+        description="file/directory params only: when true (the default), the path "
+                    "must exist and be readable before launch. Set false for outputs "
+                    "the job creates — the pre-launch existence check is skipped "
+                    "(file-share containment is still enforced), and directory params "
+                    "are created (as the user, within an allowed file share) before "
+                    "launch, so a home default like '~/.fileglancer/logs' works on "
+                    "first launch",
+        default=True,
     )
 
     @field_validator("flag")
@@ -370,10 +374,10 @@ def stringify_options(cls, v):
         return [str(item) for item in v]
 
     @model_validator(mode='after')
-    def validate_create_if_missing(self):
-        if self.create_if_missing and self.type != "directory":
+    def validate_exists(self):
+        if "exists" in self.model_fields_set and self.type not in ("file", "directory"):
             raise ValueError(
-                f"create_if_missing is only valid on directory parameters, "
+                f"exists is only valid on file and directory parameters, "
                 f"but '{self.name}' has type '{self.type}'"
             )
         return self
@@ -911,10 +915,10 @@ def validate_container_args(cls, v):
 class PathValidationRequest(BaseModel):
     """Request to validate file/directory paths"""
     paths: Dict[str, str] = Field(description="Map of parameter key to path value")
-    create_if_missing: List[str] = Field(
+    may_be_missing: List[str] = Field(
         default=[],
-        description="Keys whose directory may not exist yet (create_if_missing "
-                    "params): validated for file-share containment only, not existence",
+        description="Keys whose path may not exist yet (exists=false params): "
+                    "validated for file-share containment only, not existence",
     )
 
 
diff --git a/fileglancer/server.py b/fileglancer/server.py
index 33a9de6e..0efcfb24 100644
--- a/fileglancer/server.py
+++ b/fileglancer/server.py
@@ -2071,7 +2071,7 @@ async def check_app_updates(username: str = Depends(get_current_user)):
     async def validate_paths(body: PathValidationRequest,
                              username: str = Depends(get_current_user)):
         result = await _worker_exec(username, "validate_paths", paths=body.paths,
-                                    create_if_missing=body.create_if_missing)
+                                    may_be_missing=body.may_be_missing)
         return PathValidationResponse(errors=result.get("errors", {}))
 
     # --- Catalog (shared apps) API ---
diff --git a/fileglancer/user_worker.py b/fileglancer/user_worker.py
index 38349391..c7c38205 100644
--- a/fileglancer/user_worker.py
+++ b/fileglancer/user_worker.py
@@ -646,15 +646,16 @@ def _action_validate_paths(request: dict, ctx: WorkerContext) -> dict:
     from fileglancer.apps.command import validate_path_in_filestore
 
     paths = request["paths"]
-    # Keys whose directory may not exist yet (create_if_missing params) are
-    # checked for file-share containment only — Fileglancer creates them at
-    # submit time, so a missing-but-in-share path is valid here.
-    create_if_missing = set(request.get("create_if_missing") or [])
+    # Keys whose path may not exist yet (exists=false params) are checked for
+    # file-share containment only — these are outputs the job creates
+    # (directories are created by Fileglancer at submit time), so a
+    # missing-but-in-share path is valid here.
+    may_be_missing = set(request.get("may_be_missing") or [])
     fsps = ctx.db.get_file_share_paths()
     errors = {}
     for param_key, path_value in paths.items():
         error = validate_path_in_filestore(
-            path_value, fsps, check_access=param_key not in create_if_missing
+            path_value, fsps, check_access=param_key not in may_be_missing
         )
         if error:
             errors[param_key] = error
@@ -663,7 +664,7 @@ def _action_validate_paths(request: dict, ctx: WorkerContext) -> dict:
 
 @action("create_dirs")
 def _action_create_dirs(request: dict, ctx: WorkerContext) -> dict:
-    """Create directories for app params with create_if_missing set.
+    """Create directories for app params with exists=false.
 
     Runs as the target user in the setuid worker. Each path is expanded ('~'
     resolves to this user's home), confirmed to be within an allowed file share
diff --git a/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx b/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
index 2ffb4086..92c7e5a3 100644
--- a/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
+++ b/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
@@ -964,10 +964,11 @@ export default function AppLaunchForm({
     // Filter out undefined/empty values and normalize paths to Linux format
     const params: Record<string, unknown> = {};
     const pathParams: Record<string, string> = {};
-    // Directory params flagged create_if_missing are validated for file-share
-    // containment only — Fileglancer creates them at submit time, so their
-    // absence must not fail pre-submit validation.
-    const createIfMissingKeys: string[] = [];
+    // Path params with exists=false are outputs the job may create, so they
+    // are validated for file-share containment only — their absence must not
+    // fail pre-submit validation. (Directory params among them are created by
+    // Fileglancer at submit time.)
+    const mayBeMissingKeys: string[] = [];
     for (const [key, val] of Object.entries(values)) {
       if (val !== undefined && val !== null && val !== '') {
         const paramDef = paramDefs.get(key);
@@ -987,8 +988,8 @@ export default function AppLaunchForm({
             !normalized.startsWith('https://')
           ) {
             pathParams[key] = normalized;
-            if (paramDef.type === 'directory' && paramDef.create_if_missing) {
-              createIfMissingKeys.push(key);
+            if (paramDef.exists === false) {
+              mayBeMissingKeys.push(key);
             }
           }
         } else {
@@ -1001,7 +1002,7 @@ export default function AppLaunchForm({
     if (Object.keys(pathParams).length > 0) {
       setValidating(true);
       try {
-        const pathErrors = await validatePaths(pathParams, createIfMissingKeys);
+        const pathErrors = await validatePaths(pathParams, mayBeMissingKeys);
         if (Object.keys(pathErrors).length > 0) {
           setErrors(prev => ({ ...prev, ...pathErrors }));
           setValidating(false);
diff --git a/frontend/src/queries/appsQueries.ts b/frontend/src/queries/appsQueries.ts
index 8b520240..8a1af488 100644
--- a/frontend/src/queries/appsQueries.ts
+++ b/frontend/src/queries/appsQueries.ts
@@ -173,11 +173,11 @@ export function useAddAppMutation(): UseMutationResult<
 
 export async function validatePaths(
   paths: Record<string, string>,
-  createIfMissing: string[] = []
+  mayBeMissing: string[] = []
 ): Promise<Record<string, string>> {
   const response = await sendFetchRequest('/api/apps/validate-paths', 'POST', {
     paths,
-    create_if_missing: createIfMissing
+    may_be_missing: mayBeMissing
   });
   const data = await getResponseJsonOrError(response);
   if (!response.ok) {
diff --git a/frontend/src/shared.types.ts b/frontend/src/shared.types.ts
index 7f332d3b..7487d74c 100644
--- a/frontend/src/shared.types.ts
+++ b/frontend/src/shared.types.ts
@@ -79,7 +79,9 @@ type AppParameter = {
   pattern?: string;
   hidden?: boolean;
   raw?: boolean;
-  create_if_missing?: boolean;
+  /** file/directory params: when false, the path is an output the job may
+   * create, so it need not exist before launch. Defaults to true. */
+  exists?: boolean;
 };
 
 type AppParameterSection = {
diff --git a/tests/test_apps.py b/tests/test_apps.py
index c2a36752..ad04c89f 100644
--- a/tests/test_apps.py
+++ b/tests/test_apps.py
@@ -1164,9 +1164,28 @@ def test_collects_user_and_default_values_across_namespaces(self):
         # Only file/directory params; non-path 'count' excluded. Env namespace
         # default included; pipeline 'outdir' falls back to its default.
         assert result == [
-            ("envdir", "Env Dir", "/data/envdefault"),
-            ("input", "Input Path", "/data/in.txt"),
-            ("outdir", "Out Dir", "/data/outdefault"),
+            ("envdir", "Env Dir", "/data/envdefault", True),
+            ("input", "Input Path", "/data/in.txt", True),
+            ("outdir", "Out Dir", "/data/outdefault", True),
+        ]
+
+    def test_carries_exists_flag(self):
+        ep = AppEntryPoint(
+            id="test",
+            name="test",
+            command="test_cmd",
+            parameters=[
+                {"key": "report", "name": "Report", "type": "file",
+                 "flag": "--report", "exists": False},
+                {"key": "input", "name": "Input Path", "type": "file", "flag": "--input"},
+            ],
+        )
+        result = collect_path_parameters(
+            ep, {"report": "/data/report.html", "input": "/data/in.txt"}
+        )
+        assert result == [
+            ("report", "Report", "/data/report.html", False),
+            ("input", "Input Path", "/data/in.txt", True),
         ]
 
     def test_omits_path_params_without_value_or_default(self):
@@ -1179,20 +1198,25 @@ def test_omits_path_params_without_value_or_default(self):
         assert collect_path_parameters(ep, {}) == []
 
 
-class TestCreateIfMissingValidation:
-    """create_if_missing is only valid on directory params."""
+class TestExistsValidation:
+    """exists is only valid on file and directory params."""
 
     def test_accepted_on_directory(self):
-        p = AppParameter(key="d", name="Dir", type="directory", create_if_missing=True)
-        assert p.create_if_missing is True
+        p = AppParameter(key="d", name="Dir", type="directory", exists=False)
+        assert p.exists is False
+
+    def test_accepted_on_file(self):
+        p = AppParameter(key="f", name="File", type="file", exists=False)
+        assert p.exists is False
 
-    def test_defaults_false(self):
+    def test_defaults_true(self):
         p = AppParameter(key="d", name="Dir", type="directory")
-        assert p.create_if_missing is False
+        assert p.exists is True
 
-    @pytest.mark.parametrize("bad_type", ["file", "string", "integer", "enum"])
-    def test_rejected_on_non_directory(self, bad_type):
-        kwargs = {"key": "p", "name": "P", "type": bad_type, "create_if_missing": True}
+    @pytest.mark.parametrize("bad_type", ["string", "integer", "enum"])
+    @pytest.mark.parametrize("value", [True, False])
+    def test_rejected_on_non_path_type(self, bad_type, value):
+        kwargs = {"key": "p", "name": "P", "type": bad_type, "exists": value}
         if bad_type == "enum":
             kwargs["options"] = ["a", "b"]
         with pytest.raises(ValidationError):
@@ -1200,7 +1224,7 @@ def test_rejected_on_non_directory(self, bad_type):
 
 
 class TestCollectCreatableDirs:
-    """collect_creatable_dirs gathers directory params flagged create_if_missing."""
+    """collect_creatable_dirs gathers directory params with exists=false."""
 
     def test_collects_via_default_and_user_value(self):
         ep = AppEntryPoint(
@@ -1209,12 +1233,12 @@ def test_collects_via_default_and_user_value(self):
             command="test_cmd",
             env_parameters=[{
                 "key": "envdir", "name": "Env Dir", "type": "directory",
-                "default": "~/.fileglancer/env", "create_if_missing": True,
+                "default": "~/.fileglancer/env", "exists": False,
             }],
             parameters=[
                 {"key": "logdir", "name": "Log Dir", "type": "directory",
                  "flag": "--logdir", "default": "~/.fileglancer/logs",
-                 "create_if_missing": True},
+                 "exists": False},
                 # directory without the flag -> excluded
                 {"key": "indir", "name": "In Dir", "type": "directory",
                  "flag": "--indir", "default": "/data/in"},
@@ -1226,19 +1250,32 @@ def test_collects_via_default_and_user_value(self):
             env_parameters={},
         )
         # Env default included; pipeline 'logdir' uses the user value; 'indir'
-        # excluded (no create_if_missing).
+        # excluded (must exist, so it is never created).
         assert result == [
             ("Env Dir", "~/.fileglancer/env"),
             ("Log Dir", "/data/mylogs"),
         ]
 
+    def test_omits_file_params(self):
+        # exists=false file params skip the existence check but are never
+        # created (there is nothing sensible to create for a file output).
+        ep = AppEntryPoint(
+            id="test",
+            name="test",
+            command="test_cmd",
+            parameters=[{"key": "report", "name": "Report", "type": "file",
+                         "flag": "--report", "default": "~/report.html",
+                         "exists": False}],
+        )
+        assert collect_creatable_dirs(ep, {}) == []
+
     def test_omits_when_no_effective_value(self):
         ep = AppEntryPoint(
             id="test",
             name="test",
             command="test_cmd",
             parameters=[{"key": "logdir", "name": "Log Dir", "type": "directory",
-                         "flag": "--logdir", "create_if_missing": True}],
+                         "flag": "--logdir", "exists": False}],
         )
         assert collect_creatable_dirs(ep, {}) == []
 
@@ -1249,7 +1286,7 @@ def test_omits_empty_string_value(self):
             command="test_cmd",
             parameters=[{"key": "logdir", "name": "Log Dir", "type": "directory",
                          "flag": "--logdir", "default": "~/logs",
-                         "create_if_missing": True}],
+                         "exists": False}],
         )
         assert collect_creatable_dirs(ep, {"logdir": ""}) == []
 
@@ -1989,6 +2026,48 @@ def test_braced_projectdir_default_rewritten_to_repo(self, tmp_path):
         assert param.default == "./repo/assets/rrna-db-defaults.txt"
 
 
+class TestNextflowPathExists:
+    """Nextflow path params only require existence when the schema sets
+    "exists": true — anything else (outdir, report paths, ...) is an output
+    the pipeline creates."""
+
+    def _convert(self, tmp_path, properties):
+        (tmp_path / "nextflow_schema.json").write_text(json.dumps({
+            "$defs": {"opts": {"title": "Options", "properties": properties}},
+            "allOf": [{"$ref": "#/$defs/opts"}],
+        }))
+        ep = NextflowAdapter().convert(tmp_path).runnables[0]
+        return {p.key: p for p in ep.flat_parameters()}
+
+    def test_exists_true_requires_existence(self, tmp_path):
+        params = self._convert(tmp_path, {
+            "input": {"type": "string", "format": "file-path", "exists": True},
+        })
+        assert params["input"].exists is True
+
+    def test_path_without_exists_may_be_missing(self, tmp_path):
+        params = self._convert(tmp_path, {
+            "outdir": {"type": "string", "format": "directory-path"},
+            "report": {"type": "string", "format": "file-path"},
+        })
+        assert params["outdir"].exists is False
+        assert params["report"].exists is False
+
+    def test_exists_false_may_be_missing(self, tmp_path):
+        # nf-schema uses "exists": false to assert non-existence; either way
+        # the path is not required to exist before launch.
+        params = self._convert(tmp_path, {
+            "outdir": {"type": "string", "format": "directory-path", "exists": False},
+        })
+        assert params["outdir"].exists is False
+
+    def test_non_path_params_unaffected(self, tmp_path):
+        params = self._convert(tmp_path, {
+            "title": {"type": "string"},
+        })
+        assert params["title"].exists is True  # model default, not path-validated
+
+
 class TestNextflowAdapterNaming:
     def _make_schema(self, tmp_path):
         (tmp_path / "nextflow_schema.json").write_text(json.dumps({
diff --git a/tests/test_worker.py b/tests/test_worker.py
index 24931164..48c75231 100644
--- a/tests/test_worker.py
+++ b/tests/test_worker.py
@@ -682,7 +682,7 @@ def test_expands_tilde_as_the_user(self, tmp_path, monkeypatch):
 
 
 class TestValidatePathsAction:
-    """validate_paths checks existence, except for create_if_missing keys."""
+    """validate_paths checks existence, except for may_be_missing keys."""
 
     def _ctx(self, mount_path):
         fsp = FileSharePath(zone="test", name="vp", mount_path=str(mount_path))
@@ -694,22 +694,22 @@ def test_missing_dir_fails_by_default(self, tmp_path):
         result = _action_validate_paths({"paths": {"logdir": str(missing)}}, ctx)
         assert "logdir" in result["errors"]
 
-    def test_missing_dir_ok_when_create_if_missing(self, tmp_path):
+    def test_missing_dir_ok_when_may_be_missing(self, tmp_path):
         ctx = self._ctx(tmp_path)
         missing = tmp_path / "logs"
         result = _action_validate_paths(
-            {"paths": {"logdir": str(missing)}, "create_if_missing": ["logdir"]},
+            {"paths": {"logdir": str(missing)}, "may_be_missing": ["logdir"]},
             ctx,
         )
         assert result == {"errors": {}}
 
-    def test_create_if_missing_still_enforces_containment(self, tmp_path):
+    def test_may_be_missing_still_enforces_containment(self, tmp_path):
         share = tmp_path / "share"
         share.mkdir()
         ctx = self._ctx(share)
         outside = tmp_path / "outside" / "logs"
         result = _action_validate_paths(
-            {"paths": {"logdir": str(outside)}, "create_if_missing": ["logdir"]},
+            {"paths": {"logdir": str(outside)}, "may_be_missing": ["logdir"]},
             ctx,
         )
         assert "logdir" in result["errors"]

From 29011c907dbeeff10893c39de0d845940fe9a191 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Fri, 3 Jul 2026 14:33:26 -0400
Subject: [PATCH 33/89] fix(apps): open Browse dialog in the right folder for
 file params
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Confirming a folder selection (e.g. picking a home dir as outdir)
remembered its parent as the shared start location, so the next
file-type Browse with an empty value opened one level too high. Now the
remembered location is the selected folder itself (parent only for file
selections), and the file-mode parent-strip applies only to the field's
own value — which names a file — never to the remembered folder
fallback.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../ui/FileSelector/FileSelectorButton.tsx    | 19 ++++++++++++++-----
 frontend/src/hooks/useFileSelector.ts         |  9 ++++++---
 2 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/frontend/src/components/ui/FileSelector/FileSelectorButton.tsx b/frontend/src/components/ui/FileSelector/FileSelectorButton.tsx
index e3cf07c8..04eeca1b 100644
--- a/frontend/src/components/ui/FileSelector/FileSelectorButton.tsx
+++ b/frontend/src/components/ui/FileSelector/FileSelectorButton.tsx
@@ -22,8 +22,9 @@ import type {
   FileSelectorMode
 } from '@/hooks/useFileSelector';
 
-// Remember the last confirmed selection's parent folder across all instances
-let lastSelectedParentPath: string | null = null;
+// Remember the folder of the last confirmed selection across all instances:
+// the selection itself when it was a folder, its parent when it was a file.
+let lastSelectedFolderPath: string | null = null;
 
 function getParentPath(fullPath: string): string {
   // Strip trailing slash, then take everything up to the last separator
@@ -64,9 +65,14 @@ export default function FileSelectorButton({
   // selection/location so pasting a path can navigate the browser there.
   const [pathInput, setPathInput] = useState('');
 
-  // Use initialPath if provided, otherwise fall back to last confirmed selection's parent
+  // Use initialPath if provided, otherwise fall back to the last confirmed
+  // selection's folder
   const effectiveInitialPath =
-    initialPath || lastSelectedParentPath || undefined;
+    initialPath || lastSelectedFolderPath || undefined;
+  // The field's own value in file mode names a file, so the browser should
+  // open its parent folder. The remembered fallback is already a folder and
+  // must be opened as-is.
+  const initialPathIsFile = Boolean(initialPath) && mode !== 'directory';
 
   const {
     state,
@@ -91,6 +97,7 @@ export default function FileSelectorButton({
   } = useFileSelector({
     initialLocation,
     initialPath: showDialog ? effectiveInitialPath : undefined,
+    initialPathIsFile,
     mode,
     pathPreferenceOverride: useServerPath ? ['linux_path'] : undefined,
     defaultToHome
@@ -163,7 +170,9 @@ export default function FileSelectorButton({
 
   const handleSelect = () => {
     if (state.selectedItem) {
-      lastSelectedParentPath = getParentPath(state.selectedItem.displayPath);
+      lastSelectedFolderPath = state.selectedItem.isDir
+        ? state.selectedItem.displayPath
+        : getParentPath(state.selectedItem.displayPath);
       onSelect(state.selectedItem.fullPath, state.selectedItem.displayPath);
       onClose();
     }
diff --git a/frontend/src/hooks/useFileSelector.ts b/frontend/src/hooks/useFileSelector.ts
index ef29dce4..addef31c 100644
--- a/frontend/src/hooks/useFileSelector.ts
+++ b/frontend/src/hooks/useFileSelector.ts
@@ -38,6 +38,9 @@ export type FileSelectorMode = 'file' | 'directory' | 'any';
 type FileSelectorOptions = {
   initialLocation?: FileSelectorInitialLocation;
   initialPath?: string;
+  // When true, initialPath points at a file, so the browser opens its parent
+  // folder. Leave unset when initialPath is already a folder to open as-is.
+  initialPathIsFile?: boolean;
   mode?: FileSelectorMode;
   pathPreferenceOverride?: ['linux_path'];
   // When neither initialLocation nor initialPath resolves to a folder, open in
@@ -153,8 +156,8 @@ export default function useFileSelector(options?: FileSelectorOptions) {
 
     if (resolved) {
       let subPath = resolved.subpath;
-      // For file mode, navigate to the parent directory
-      if (subPath && mode !== 'directory') {
+      // When initialPath is a file, navigate to its parent directory
+      if (subPath && options?.initialPathIsFile) {
         const lastSlash = subPath.lastIndexOf('/');
         if (lastSlash >= 0) {
           subPath = subPath.slice(0, lastSlash);
@@ -172,7 +175,7 @@ export default function useFileSelector(options?: FileSelectorOptions) {
         selectedItem: null
       });
     }
-  }, [options?.initialPath, zonesAndFspQuery.data, mode]);
+  }, [options?.initialPath, options?.initialPathIsFile, zonesAndFspQuery.data]);
 
   // Fetch file data only when in filesystem mode
   const fileQuery = useFileQuery(

From f5e0c759fef47682edbf528d85a81c1a86ecbb7e Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Fri, 3 Jul 2026 14:44:42 -0400
Subject: [PATCH 34/89] fix(apps): preselect the current file value when
 reopening Browse
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When a file param already has a value, the Browse dialog now opens in
the file's parent folder with the file itself selected — shown in the
Path box and highlighted in the listing — instead of auto-selecting the
folder. The open-time folder auto-select is now a functional update
that keeps an existing selection and no longer reads a stale location
when opening and navigation land in the same commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 frontend/src/hooks/useFileSelector.ts | 169 ++++++++++++++++----------
 1 file changed, 104 insertions(+), 65 deletions(-)

diff --git a/frontend/src/hooks/useFileSelector.ts b/frontend/src/hooks/useFileSelector.ts
index addef31c..38eb66e2 100644
--- a/frontend/src/hooks/useFileSelector.ts
+++ b/frontend/src/hooks/useFileSelector.ts
@@ -156,14 +156,27 @@ export default function useFileSelector(options?: FileSelectorOptions) {
 
     if (resolved) {
       let subPath = resolved.subpath;
-      // When initialPath is a file, navigate to its parent directory
+      let selectedItem: FileSelectorState['selectedItem'] = null;
+      // When initialPath is a file, navigate to its parent directory and keep
+      // the file itself selected, so reopening the dialog shows the current
+      // value ready to be confirmed or replaced.
       if (subPath && options?.initialPathIsFile) {
         const lastSlash = subPath.lastIndexOf('/');
-        if (lastSlash >= 0) {
-          subPath = subPath.slice(0, lastSlash);
-        } else {
-          subPath = '';
-        }
+        selectedItem = {
+          name: subPath.slice(lastSlash + 1),
+          isDir: false,
+          fullPath: getPreferredPathForDisplay(
+            effectivePathPreference,
+            resolved.fsp,
+            subPath
+          ),
+          displayPath: getPreferredPathForDisplay(
+            pathPreference,
+            resolved.fsp,
+            subPath
+          )
+        };
+        subPath = lastSlash >= 0 ? subPath.slice(0, lastSlash) : '';
       }
 
       setState({
@@ -172,10 +185,16 @@ export default function useFileSelector(options?: FileSelectorOptions) {
           fspName: resolved.fsp.name,
           path: subPath || '.'
         },
-        selectedItem: null
+        selectedItem
       });
     }
-  }, [options?.initialPath, options?.initialPathIsFile, zonesAndFspQuery.data]);
+  }, [
+    options?.initialPath,
+    options?.initialPathIsFile,
+    zonesAndFspQuery.data,
+    effectivePathPreference,
+    pathPreference
+  ]);
 
   // Fetch file data only when in filesystem mode
   const fileQuery = useFileQuery(
@@ -378,73 +397,93 @@ export default function useFileSelector(options?: FileSelectorOptions) {
   // If no item provided, selects the current folder/location
   const selectItem = useCallback(
     (item?: FileOrFolder) => {
+      // Case 1: No item provided - select the current folder. Runs as a
+      // functional update so it composes with a navigation landing in the
+      // same commit (e.g. the initialPath resolution on dialog open), and it
+      // keeps an existing selection (e.g. the file preselected from
+      // initialPath) rather than replacing it with the folder.
+      if (!item) {
+        setState(prev => {
+          if (prev.selectedItem || prev.currentLocation.type !== 'filesystem') {
+            return prev;
+          }
+          const fspKey = makeMapKey('fsp', prev.currentLocation.fspName);
+          const fsp = zonesAndFspQuery.data?.[fspKey] as
+            | FileSharePath
+            | undefined;
+          if (!fsp) {
+            return prev;
+          }
+
+          const subPath =
+            prev.currentLocation.path === '.' ? '' : prev.currentLocation.path;
+          const fullPath = getPreferredPathForDisplay(
+            effectivePathPreference,
+            fsp,
+            subPath
+          );
+          if (!fullPath) {
+            return prev;
+          }
+
+          // Get the folder name from the path
+          const pathParts = prev.currentLocation.path
+            .split('/')
+            .filter(Boolean);
+          return {
+            ...prev,
+            selectedItem: {
+              name:
+                pathParts.length > 0
+                  ? pathParts[pathParts.length - 1]
+                  : fsp.name,
+              isDir: true,
+              fullPath,
+              displayPath: getPreferredPathForDisplay(
+                pathPreference,
+                fsp,
+                subPath
+              )
+            }
+          };
+        });
+        return;
+      }
+
+      // Case 2: Item provided - select that item
+      // Only reject files in directory mode
+      if (!item.is_dir && mode === 'directory') {
+        return;
+      }
+
+      // Don't allow selecting zones - user must select an FSP or folder within FSP
+      if (state.currentLocation.type === 'zones') {
+        return;
+      }
+
       let fullPath = '';
       let displayPath = '';
-      let name = '';
-      let isDir = true;
 
-      // Case 1: No item provided - select current folder
-      if (!item) {
-        if (state.currentLocation.type !== 'filesystem' || !currentFsp) {
-          // Can't select current location at zones or zone level
-          return;
+      if (state.currentLocation.type === 'zone') {
+        // Selecting an FSP
+        const fspKey = makeMapKey('fsp', item.name);
+        const fsp = zonesAndFspQuery.data?.[fspKey] as FileSharePath;
+        if (fsp) {
+          fullPath = getPreferredPathForDisplay(effectivePathPreference, fsp);
+          displayPath = getPreferredPathForDisplay(pathPreference, fsp);
         }
-
-        const subPath =
-          state.currentLocation.path === '.' ? '' : state.currentLocation.path;
+      } else if (currentFsp) {
+        // In filesystem mode, generate path from current FSP + item path
         fullPath = getPreferredPathForDisplay(
           effectivePathPreference,
           currentFsp,
-          subPath
+          item.path
         );
         displayPath = getPreferredPathForDisplay(
           pathPreference,
           currentFsp,
-          subPath
+          item.path
         );
-
-        // Get the folder name from the path
-        const pathParts = state.currentLocation.path.split('/').filter(Boolean);
-        name =
-          pathParts.length > 0
-            ? pathParts[pathParts.length - 1]
-            : currentFsp.name;
-      } else {
-        // Case 2: Item provided - select that item
-        // Only reject files in directory mode
-        if (!item.is_dir && mode === 'directory') {
-          return;
-        }
-
-        // Don't allow selecting zones - user must select an FSP or folder within FSP
-        if (state.currentLocation.type === 'zones') {
-          return;
-        }
-
-        if (state.currentLocation.type === 'zone') {
-          // Selecting an FSP
-          const fspKey = makeMapKey('fsp', item.name);
-          const fsp = zonesAndFspQuery.data?.[fspKey] as FileSharePath;
-          if (fsp) {
-            fullPath = getPreferredPathForDisplay(effectivePathPreference, fsp);
-            displayPath = getPreferredPathForDisplay(pathPreference, fsp);
-          }
-        } else if (currentFsp) {
-          // In filesystem mode, generate path from current FSP + item path
-          fullPath = getPreferredPathForDisplay(
-            effectivePathPreference,
-            currentFsp,
-            item.path
-          );
-          displayPath = getPreferredPathForDisplay(
-            pathPreference,
-            currentFsp,
-            item.path
-          );
-        }
-
-        name = item.name;
-        isDir = item.is_dir;
       }
 
       // Only set state if we have a valid path
@@ -452,8 +491,8 @@ export default function useFileSelector(options?: FileSelectorOptions) {
         setState(prev => ({
           ...prev,
           selectedItem: {
-            name,
-            isDir,
+            name: item.name,
+            isDir: item.is_dir,
             fullPath,
             displayPath
           }

From 59ebdb4f6c8db99202f67085cef76b7f13585d65 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Fri, 3 Jul 2026 15:05:11 -0400
Subject: [PATCH 35/89] feat(apps): validate file/folder type of path params
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Browse dialog now allows selecting a file where a folder is
required (and vice versa) instead of silently ignoring the click, and
the launch form flags the mismatch immediately under the field. The
same type check is enforced server-side: path validation takes an
expected type per key, runs as the user in the setuid worker, and
rejects an existing path of the wrong kind both at pre-submit
validation and at job submission — so a pasted folder in a file param
fails with a clear message instead of erroring at pipeline runtime.
Missing exists=false outputs are still exempt.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 fileglancer/apps/command.py                   | 56 ++++++++++++-------
 fileglancer/apps/jobs.py                      | 13 +++--
 fileglancer/model.py                          |  5 ++
 fileglancer/server.py                         |  3 +-
 fileglancer/user_worker.py                    |  6 +-
 .../components/ui/AppsPage/AppLaunchForm.tsx  | 53 ++++++++++++++++--
 .../ui/FileSelector/FileSelectorButton.tsx    | 13 ++++-
 frontend/src/hooks/useFileSelector.ts         | 12 ++--
 frontend/src/queries/appsQueries.ts           |  6 +-
 tests/test_apps.py                            | 49 +++++++++++++---
 tests/test_worker.py                          | 44 +++++++++++++++
 11 files changed, 207 insertions(+), 53 deletions(-)

diff --git a/fileglancer/apps/command.py b/fileglancer/apps/command.py
index 9ce4c616..061f4aa7 100644
--- a/fileglancer/apps/command.py
+++ b/fileglancer/apps/command.py
@@ -268,19 +268,26 @@ def validate_path_for_shell(path_value: str) -> str | None:
     return None
 
 
-def validate_path_in_filestore(path_value: str, fsps: list, check_access: bool = True) -> str | None:
+def validate_path_in_filestore(path_value: str, fsps: list, check_access: bool = True,
+                               expected_type: str | None = None) -> str | None:
     """Validate a path within an allowed file share.
 
     Always performs syntax checks and confirms the path resolves within an
     allowed file share; both checks are euid-independent. When check_access is
     True, additionally verifies the path exists and is readable.
 
-    The exists/readable check reflects the *calling process's* identity, so it
-    is only meaningful when this runs as the target user (i.e. in the setuid
-    worker). Callers running on the root server must pass check_access=False —
-    otherwise validation reflects root's access, not the user's (false-pass on
-    local FS where root bypasses perms, false-reject on root-squash NFS) — and
-    defer the access check to the worker (see submit_job).
+    When expected_type is 'file' or 'directory' and the path exists, its type
+    must match — a folder pasted into a file parameter (or vice versa) is
+    rejected here rather than failing at job runtime. A missing path is not
+    type-checked (an exists=false output has no type yet).
+
+    The exists/readable/type checks reflect the *calling process's* identity,
+    so they are only meaningful when this runs as the target user (i.e. in the
+    setuid worker). Callers running on the root server must pass
+    check_access=False — otherwise validation reflects root's access, not the
+    user's (false-pass on local FS where root bypasses perms, false-reject on
+    root-squash NFS) — and defer the access check to the worker (see
+    submit_job).
 
     Returns an error message string if invalid, or None if valid.
     """
@@ -304,14 +311,23 @@ def validate_path_in_filestore(path_value: str, fsps: list, check_access: bool =
     if result is None:
         return "Path is not within an allowed file share"
 
-    if not check_access:
-        return None
-
     fsp, subpath = result
 
-    from fileglancer.filestore import Filestore
-    filestore = Filestore(fsp)
-    return filestore.validate_path(subpath)
+    if check_access:
+        from fileglancer.filestore import Filestore
+        filestore = Filestore(fsp)
+        error = filestore.validate_path(subpath)
+        if error:
+            return error
+
+    if expected_type in ("file", "directory") and os.path.exists(expanded):
+        is_dir = os.path.isdir(expanded)
+        if expected_type == "file" and is_dir:
+            return "Path is a folder, but a file is required"
+        if expected_type == "directory" and not is_dir:
+            return "Path is a file, but a folder is required"
+
+    return None
 
 
 # --- Command Building ---
@@ -375,7 +391,8 @@ def _validate_parameter_value(param: AppParameter, value, session=None, username
         str_val = expand_user_path(str_val, username)
         if session is not None:
             fsps = db.get_file_share_paths(session)
-            error = validate_path_in_filestore(str_val, fsps, check_access=check_access)
+            error = validate_path_in_filestore(str_val, fsps, check_access=check_access,
+                                               expected_type=param.type)
         else:
             error = validate_path_for_shell(str_val)
         if error:
@@ -488,14 +505,13 @@ def build_command(entry_point: AppEntryPoint, parameters: dict,
 
 
 def collect_path_parameters(entry_point: AppEntryPoint, parameters: dict,
-                            env_parameters: dict = None) -> list[tuple[str, str, str, bool]]:
+                            env_parameters: dict = None) -> list[tuple[AppParameter, str]]:
     """Collect effective file/directory parameter values needing path validation.
 
     Mirrors build_command's effective-value computation (user-provided merged
     with defaults, across both the env and pipeline namespaces) but returns only
-    file/directory parameters as (param_key, param_name, raw_value, exists)
-    tuples. exists=False params are outputs the job may create, so they are
-    validated for file-share containment only, not existence.
+    file/directory parameters as (param, raw_value) tuples, so callers can key
+    validation off the parameter's type and exists flag.
 
     Raw (un-expanded) values are returned so that authoritative validation can
     run in the setuid worker, where '~' and access checks resolve as the target
@@ -506,7 +522,7 @@ def collect_path_parameters(entry_point: AppEntryPoint, parameters: dict,
     param_flat = _flatten_param_items(entry_point.parameters)
     groups = ((env_flat, env_parameters), (param_flat, parameters))
 
-    result: list[tuple[str, str, str, bool]] = []
+    result: list[tuple[AppParameter, str]] = []
     for flat, values in groups:
         for param in flat:
             if param.type not in ("file", "directory"):
@@ -517,7 +533,7 @@ def collect_path_parameters(entry_point: AppEntryPoint, parameters: dict,
                 value = param.default
             else:
                 continue
-            result.append((param.key, param.name, str(value), param.exists))
+            result.append((param, str(value)))
     return result
 
 
diff --git a/fileglancer/apps/jobs.py b/fileglancer/apps/jobs.py
index 65e0c3b0..01cd65cd 100644
--- a/fileglancer/apps/jobs.py
+++ b/fileglancer/apps/jobs.py
@@ -641,20 +641,23 @@ async def submit_job(
 
     path_params = collect_path_parameters(entry_point, parameters, env_parameters)
     if path_params:
-        paths_to_check = {str(i): value for i, (_, _, value, _) in enumerate(path_params)}
+        paths_to_check = {str(i): value for i, (_, value) in enumerate(path_params)}
         # exists=false params are outputs the job may create: containment check
         # only. Directory params among them were just created above, but file
         # params (e.g. a Nextflow output file) never exist pre-launch.
-        may_be_missing = [str(i) for i, (_, _, _, exists) in enumerate(path_params)
-                          if not exists]
+        may_be_missing = [str(i) for i, (param, _) in enumerate(path_params)
+                          if not param.exists]
+        # Expected type per key, so a folder pasted into a file param (or vice
+        # versa) is rejected here rather than failing at job runtime.
+        types = {str(i): param.type for i, (param, _) in enumerate(path_params)}
         validation = await _dispatch(username, "validate_paths", paths=paths_to_check,
-                                     may_be_missing=may_be_missing)
+                                     may_be_missing=may_be_missing, types=types)
         errors = (validation or {}).get("errors") or {}
         if errors:
             # Report the first failure, keyed back to its parameter name, to
             # match the single-message format build_command would have raised.
             idx = min(int(i) for i in errors)
-            _, param_name, _, _ = path_params[idx]
+            param_name = path_params[idx][0].name
             raise ValueError(f"Parameter '{param_name}': {errors[str(idx)]}")
 
     # Build resource spec (extra_args passed separately, not from manifest)
diff --git a/fileglancer/model.py b/fileglancer/model.py
index 3769f9d4..3fa993ad 100644
--- a/fileglancer/model.py
+++ b/fileglancer/model.py
@@ -920,6 +920,11 @@ class PathValidationRequest(BaseModel):
         description="Keys whose path may not exist yet (exists=false params): "
                     "validated for file-share containment only, not existence",
     )
+    types: Dict[str, str] = Field(
+        default={},
+        description="Expected type per key ('file' or 'directory'): when the "
+                    "path exists, its type must match",
+    )
 
 
 class PathValidationResponse(BaseModel):
diff --git a/fileglancer/server.py b/fileglancer/server.py
index 0efcfb24..508e5aad 100644
--- a/fileglancer/server.py
+++ b/fileglancer/server.py
@@ -2071,7 +2071,8 @@ async def check_app_updates(username: str = Depends(get_current_user)):
     async def validate_paths(body: PathValidationRequest,
                              username: str = Depends(get_current_user)):
         result = await _worker_exec(username, "validate_paths", paths=body.paths,
-                                    may_be_missing=body.may_be_missing)
+                                    may_be_missing=body.may_be_missing,
+                                    types=body.types)
         return PathValidationResponse(errors=result.get("errors", {}))
 
     # --- Catalog (shared apps) API ---
diff --git a/fileglancer/user_worker.py b/fileglancer/user_worker.py
index c7c38205..e76baa1b 100644
--- a/fileglancer/user_worker.py
+++ b/fileglancer/user_worker.py
@@ -651,11 +651,15 @@ def _action_validate_paths(request: dict, ctx: WorkerContext) -> dict:
     # (directories are created by Fileglancer at submit time), so a
     # missing-but-in-share path is valid here.
     may_be_missing = set(request.get("may_be_missing") or [])
+    # Expected type per key ('file' or 'directory'): when the path exists, its
+    # type must match.
+    types = request.get("types") or {}
     fsps = ctx.db.get_file_share_paths()
     errors = {}
     for param_key, path_value in paths.items():
         error = validate_path_in_filestore(
-            path_value, fsps, check_access=param_key not in may_be_missing
+            path_value, fsps, check_access=param_key not in may_be_missing,
+            expected_type=types.get(param_key)
         )
         if error:
             errors[param_key] = error
diff --git a/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx b/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
index 92c7e5a3..749a122a 100644
--- a/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
+++ b/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
@@ -69,11 +69,13 @@ type EnvVar = { key: string; value: string };
 function ParameterField({
   param,
   value,
-  onChange
+  onChange,
+  onError
 }: {
   readonly param: AppParameter;
   readonly value: unknown;
   readonly onChange: (value: unknown) => void;
+  readonly onError?: (message: string) => void;
 }) {
   // For file/directory fields, track a display-formatted path separately from
   // the server-formatted value used for submission. When the user selects a
@@ -170,9 +172,20 @@ function ParameterField({
             }
             label="Browse..."
             mode={param.type === 'file' ? 'file' : 'directory'}
-            onSelect={(serverPath, displayPath) => {
+            onSelect={(serverPath, displayPath, isDir) => {
+              // onChange clears any previous error for this param; flag a
+              // type mismatch right away rather than at submit time.
               onChange(serverPath);
               setFileDisplayPath(displayPath);
+              if (param.type === 'file' && isDir) {
+                onError?.(
+                  `${param.name} must be a file, but a folder was selected`
+                );
+              } else if (param.type === 'directory' && !isDir) {
+                onError?.(
+                  `${param.name} must be a folder, but a file was selected`
+                );
+              }
             }}
             useServerPath
           />
@@ -196,12 +209,14 @@ function ParameterFieldRow({
   param,
   value,
   error,
-  onChange
+  onChange,
+  onError
 }: {
   readonly param: AppParameter;
   readonly value: unknown;
   readonly error?: string;
   readonly onChange: (value: unknown) => void;
+  readonly onError?: (message: string) => void;
 }) {
   return (
     <div>
@@ -219,7 +234,12 @@ function ParameterFieldRow({
           {param.description}
         </Typography>
       ) : null}
-      <ParameterField onChange={onChange} param={param} value={value} />
+      <ParameterField
+        onChange={onChange}
+        onError={onError}
+        param={param}
+        value={value}
+      />
       {param.description && param.type === 'boolean' ? (
         <Typography className="text-foreground mt-1" type="small">
           {param.description}
@@ -272,12 +292,14 @@ function SectionContent({
   section,
   values,
   errors,
-  onParamChange
+  onParamChange,
+  onParamError
 }: {
   readonly section: AppParameterSection;
   readonly values: Record<string, unknown>;
   readonly errors: Record<string, string>;
   readonly onParamChange: (paramId: string, value: unknown) => void;
+  readonly onParamError?: (paramId: string, message: string) => void;
 }) {
   return (
     <div className="space-y-4">
@@ -286,6 +308,7 @@ function SectionContent({
           error={errors[param.key]}
           key={param.key}
           onChange={val => onParamChange(param.key, val)}
+          onError={message => onParamError?.(param.key, message)}
           param={param}
           value={values[param.key]}
         />
@@ -855,6 +878,13 @@ export default function AppLaunchForm({
     }
   };
 
+  // Immediate per-field validation errors (e.g. a folder picked from the
+  // Browse dialog where a file is required), raised without waiting for
+  // submit. handleChange clears them on the next value change.
+  const handleParamError = (paramId: string, message: string) => {
+    setErrors(prev => ({ ...prev, [paramId]: message }));
+  };
+
   // Env-tab params have their own value dict so their keys can't collide with
   // pipeline param keys.
   const handleEnvChange = (paramId: string, value: unknown) => {
@@ -969,6 +999,9 @@ export default function AppLaunchForm({
     // fail pre-submit validation. (Directory params among them are created by
     // Fileglancer at submit time.)
     const mayBeMissingKeys: string[] = [];
+    // Expected type per key, so a folder pasted into a file param (or vice
+    // versa) is rejected by server-side validation.
+    const pathParamTypes: Record<string, string> = {};
     for (const [key, val] of Object.entries(values)) {
       if (val !== undefined && val !== null && val !== '') {
         const paramDef = paramDefs.get(key);
@@ -988,6 +1021,7 @@ export default function AppLaunchForm({
             !normalized.startsWith('https://')
           ) {
             pathParams[key] = normalized;
+            pathParamTypes[key] = paramDef.type;
             if (paramDef.exists === false) {
               mayBeMissingKeys.push(key);
             }
@@ -1002,7 +1036,11 @@ export default function AppLaunchForm({
     if (Object.keys(pathParams).length > 0) {
       setValidating(true);
       try {
-        const pathErrors = await validatePaths(pathParams, mayBeMissingKeys);
+        const pathErrors = await validatePaths(
+          pathParams,
+          mayBeMissingKeys,
+          pathParamTypes
+        );
         if (Object.keys(pathErrors).length > 0) {
           setErrors(prev => ({ ...prev, ...pathErrors }));
           setValidating(false);
@@ -1306,6 +1344,7 @@ export default function AppLaunchForm({
                           <SectionContent
                             errors={errors}
                             onParamChange={handleChange}
+                            onParamError={handleParamError}
                             section={item}
                             values={values}
                           />
@@ -1316,6 +1355,7 @@ export default function AppLaunchForm({
                         error={errors[item.key]}
                         key={item.key}
                         onChange={val => handleChange(item.key, val)}
+                        onError={message => handleParamError(item.key, message)}
                         param={item}
                         value={values[item.key]}
                       />
@@ -1329,6 +1369,7 @@ export default function AppLaunchForm({
                       error={errors[item.key]}
                       key={item.key}
                       onChange={val => handleChange(item.key, val)}
+                      onError={message => handleParamError(item.key, message)}
                       param={item}
                       value={values[item.key]}
                     />
diff --git a/frontend/src/components/ui/FileSelector/FileSelectorButton.tsx b/frontend/src/components/ui/FileSelector/FileSelectorButton.tsx
index 04eeca1b..4a246cd6 100644
--- a/frontend/src/components/ui/FileSelector/FileSelectorButton.tsx
+++ b/frontend/src/components/ui/FileSelector/FileSelectorButton.tsx
@@ -34,7 +34,11 @@ function getParentPath(fullPath: string): string {
 }
 
 type FileSelectorButtonProps = {
-  readonly onSelect: (path: string, displayPath: string) => void;
+  readonly onSelect: (
+    path: string,
+    displayPath: string,
+    isDir: boolean
+  ) => void;
   readonly triggerClasses?: string;
   readonly label?: string;
   readonly initialLocation?: FileSelectorInitialLocation;
@@ -98,7 +102,6 @@ export default function FileSelectorButton({
     initialLocation,
     initialPath: showDialog ? effectiveInitialPath : undefined,
     initialPathIsFile,
-    mode,
     pathPreferenceOverride: useServerPath ? ['linux_path'] : undefined,
     defaultToHome
   });
@@ -173,7 +176,11 @@ export default function FileSelectorButton({
       lastSelectedFolderPath = state.selectedItem.isDir
         ? state.selectedItem.displayPath
         : getParentPath(state.selectedItem.displayPath);
-      onSelect(state.selectedItem.fullPath, state.selectedItem.displayPath);
+      onSelect(
+        state.selectedItem.fullPath,
+        state.selectedItem.displayPath,
+        state.selectedItem.isDir
+      );
       onClose();
     }
   };
diff --git a/frontend/src/hooks/useFileSelector.ts b/frontend/src/hooks/useFileSelector.ts
index 38eb66e2..2ced4185 100644
--- a/frontend/src/hooks/useFileSelector.ts
+++ b/frontend/src/hooks/useFileSelector.ts
@@ -41,7 +41,6 @@ type FileSelectorOptions = {
   // When true, initialPath points at a file, so the browser opens its parent
   // folder. Leave unset when initialPath is already a folder to open as-is.
   initialPathIsFile?: boolean;
-  mode?: FileSelectorMode;
   pathPreferenceOverride?: ['linux_path'];
   // When neither initialLocation nor initialPath resolves to a folder, open in
   // the user's home directory instead of the top-level zones list.
@@ -54,7 +53,6 @@ export default function useFileSelector(options?: FileSelectorOptions) {
   const { profile } = useProfileContext();
 
   const initialLocation = options?.initialLocation;
-  const mode = options?.mode ?? 'any';
   const defaultToHome = options?.defaultToHome ?? false;
   const overrideKey = options?.pathPreferenceOverride?.[0];
   const effectivePathPreference = useMemo(
@@ -450,11 +448,10 @@ export default function useFileSelector(options?: FileSelectorOptions) {
         return;
       }
 
-      // Case 2: Item provided - select that item
-      // Only reject files in directory mode
-      if (!item.is_dir && mode === 'directory') {
-        return;
-      }
+      // Case 2: Item provided - select that item. Files are selectable even
+      // in directory mode (and vice versa) — the consumer surfaces a
+      // validation error for type mismatches instead of the dialog silently
+      // ignoring the click.
 
       // Don't allow selecting zones - user must select an FSP or folder within FSP
       if (state.currentLocation.type === 'zones') {
@@ -504,7 +501,6 @@ export default function useFileSelector(options?: FileSelectorOptions) {
       currentFsp,
       effectivePathPreference,
       pathPreference,
-      mode,
       zonesAndFspQuery.data
     ]
   );
diff --git a/frontend/src/queries/appsQueries.ts b/frontend/src/queries/appsQueries.ts
index 8a1af488..33768cbd 100644
--- a/frontend/src/queries/appsQueries.ts
+++ b/frontend/src/queries/appsQueries.ts
@@ -173,11 +173,13 @@ export function useAddAppMutation(): UseMutationResult<
 
 export async function validatePaths(
   paths: Record<string, string>,
-  mayBeMissing: string[] = []
+  mayBeMissing: string[] = [],
+  types: Record<string, string> = {}
 ): Promise<Record<string, string>> {
   const response = await sendFetchRequest('/api/apps/validate-paths', 'POST', {
     paths,
-    may_be_missing: mayBeMissing
+    may_be_missing: mayBeMissing,
+    types
   });
   const data = await getResponseJsonOrError(response);
   if (!response.ok) {
diff --git a/tests/test_apps.py b/tests/test_apps.py
index ad04c89f..867e9510 100644
--- a/tests/test_apps.py
+++ b/tests/test_apps.py
@@ -1018,6 +1018,41 @@ def test_check_access_false_still_enforces_containment(self):
         assert error is not None
         assert "not within an allowed file share" in error
 
+    def test_folder_rejected_when_file_expected(self, tmp_path):
+        from fileglancer.model import FileSharePath
+        subdir = tmp_path / "results"
+        subdir.mkdir()
+        fsp = FileSharePath(zone="test", name="test", mount_path=str(tmp_path))
+        error = validate_path_in_filestore(str(subdir), [fsp], expected_type="file")
+        assert error == "Path is a folder, but a file is required"
+
+    def test_file_rejected_when_directory_expected(self, tmp_path):
+        from fileglancer.model import FileSharePath
+        test_file = tmp_path / "data.txt"
+        test_file.write_text("hello")
+        fsp = FileSharePath(zone="test", name="test", mount_path=str(tmp_path))
+        error = validate_path_in_filestore(str(test_file), [fsp],
+                                           expected_type="directory")
+        assert error == "Path is a file, but a folder is required"
+
+    def test_matching_type_passes(self, tmp_path):
+        from fileglancer.model import FileSharePath
+        test_file = tmp_path / "data.txt"
+        test_file.write_text("hello")
+        fsp = FileSharePath(zone="test", name="test", mount_path=str(tmp_path))
+        assert validate_path_in_filestore(str(test_file), [fsp],
+                                          expected_type="file") is None
+        assert validate_path_in_filestore(str(tmp_path), [fsp],
+                                          expected_type="directory") is None
+
+    def test_missing_path_not_type_checked(self, tmp_path):
+        """An exists=false output has no type yet, so only containment applies."""
+        from fileglancer.model import FileSharePath
+        fsp = FileSharePath(zone="test", name="test", mount_path=str(tmp_path))
+        missing = str(tmp_path / "report.html")
+        assert validate_path_in_filestore(missing, [fsp], check_access=False,
+                                          expected_type="file") is None
+
 
 
 class TestBuildCommandTildeExpansion:
@@ -1163,10 +1198,10 @@ def test_collects_user_and_default_values_across_namespaces(self):
         )
         # Only file/directory params; non-path 'count' excluded. Env namespace
         # default included; pipeline 'outdir' falls back to its default.
-        assert result == [
-            ("envdir", "Env Dir", "/data/envdefault", True),
-            ("input", "Input Path", "/data/in.txt", True),
-            ("outdir", "Out Dir", "/data/outdefault", True),
+        assert [(p.key, p.type, v) for p, v in result] == [
+            ("envdir", "directory", "/data/envdefault"),
+            ("input", "file", "/data/in.txt"),
+            ("outdir", "directory", "/data/outdefault"),
         ]
 
     def test_carries_exists_flag(self):
@@ -1183,9 +1218,9 @@ def test_carries_exists_flag(self):
         result = collect_path_parameters(
             ep, {"report": "/data/report.html", "input": "/data/in.txt"}
         )
-        assert result == [
-            ("report", "Report", "/data/report.html", False),
-            ("input", "Input Path", "/data/in.txt", True),
+        assert [(p.key, p.exists, v) for p, v in result] == [
+            ("report", False, "/data/report.html"),
+            ("input", True, "/data/in.txt"),
         ]
 
     def test_omits_path_params_without_value_or_default(self):
diff --git a/tests/test_worker.py b/tests/test_worker.py
index 48c75231..f301dd21 100644
--- a/tests/test_worker.py
+++ b/tests/test_worker.py
@@ -713,3 +713,47 @@ def test_may_be_missing_still_enforces_containment(self, tmp_path):
             ctx,
         )
         assert "logdir" in result["errors"]
+
+    def test_folder_rejected_when_file_expected(self, tmp_path):
+        ctx = self._ctx(tmp_path)
+        subdir = tmp_path / "results"
+        subdir.mkdir()
+        result = _action_validate_paths(
+            {"paths": {"input": str(subdir)}, "types": {"input": "file"}},
+            ctx,
+        )
+        assert result["errors"]["input"] == "Path is a folder, but a file is required"
+
+    def test_file_rejected_when_directory_expected(self, tmp_path):
+        ctx = self._ctx(tmp_path)
+        csv = tmp_path / "samples.csv"
+        csv.write_text("sample\n")
+        result = _action_validate_paths(
+            {"paths": {"outdir": str(csv)}, "types": {"outdir": "directory"}},
+            ctx,
+        )
+        assert result["errors"]["outdir"] == "Path is a file, but a folder is required"
+
+    def test_existing_wrong_type_rejected_even_when_may_be_missing(self, tmp_path):
+        # An exists=false param skips the existence check, but a path that DOES
+        # exist with the wrong type is still an error.
+        ctx = self._ctx(tmp_path)
+        csv = tmp_path / "samples.csv"
+        csv.write_text("sample\n")
+        result = _action_validate_paths(
+            {"paths": {"outdir": str(csv)}, "may_be_missing": ["outdir"],
+             "types": {"outdir": "directory"}},
+            ctx,
+        )
+        assert result["errors"]["outdir"] == "Path is a file, but a folder is required"
+
+    def test_matching_type_passes(self, tmp_path):
+        ctx = self._ctx(tmp_path)
+        csv = tmp_path / "samples.csv"
+        csv.write_text("sample\n")
+        result = _action_validate_paths(
+            {"paths": {"input": str(csv), "outdir": str(tmp_path)},
+             "types": {"input": "file", "outdir": "directory"}},
+            ctx,
+        )
+        assert result == {"errors": {}}

From dcfa5f58a9dde1e809209a0978e912527737f4f6 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Fri, 3 Jul 2026 15:14:29 -0400
Subject: [PATCH 36/89] Use standard app icon

Co-authored-by: Codex <codex@openai.com>
---
 .../src/__tests__/unitTests/appIcons.test.ts  | 30 +++++++++++++++++++
 frontend/src/components/AppDetail.tsx         |  2 +-
 frontend/src/components/AppLaunch.tsx         |  2 +-
 frontend/src/components/ListingDetail.tsx     |  5 ++--
 .../src/components/ui/AppsPage/AppCard.tsx    |  2 +-
 .../components/ui/AppsPage/ListingCard.tsx    |  2 +-
 .../src/components/ui/Table/myAppsColumns.tsx | 16 ++++++++--
 frontend/src/utils/appIcons.ts                | 16 +++++-----
 8 files changed, 56 insertions(+), 19 deletions(-)
 create mode 100644 frontend/src/__tests__/unitTests/appIcons.test.ts

diff --git a/frontend/src/__tests__/unitTests/appIcons.test.ts b/frontend/src/__tests__/unitTests/appIcons.test.ts
new file mode 100644
index 00000000..b82b88a1
--- /dev/null
+++ b/frontend/src/__tests__/unitTests/appIcons.test.ts
@@ -0,0 +1,30 @@
+import { describe, expect, test } from 'vitest';
+import { FaServer } from 'react-icons/fa6';
+import { GoPackage } from 'react-icons/go';
+import { IoTerminal } from 'react-icons/io5';
+
+import {
+  getAppIconType,
+  getEntryPointIconType,
+  getEntryPointTypeIconType
+} from '@/utils/appIcons';
+
+describe('app icon helpers', () => {
+  test('uses a package icon for apps', () => {
+    expect(getAppIconType()).toBe(GoPackage);
+  });
+
+  test('keeps entry point icons based on entry point type', () => {
+    expect(getEntryPointTypeIconType('service')).toBe(FaServer);
+    expect(getEntryPointTypeIconType('job')).toBe(IoTerminal);
+    expect(
+      getEntryPointIconType({
+        id: 'serve',
+        name: 'Serve',
+        type: 'service',
+        command: 'serve',
+        parameters: []
+      })
+    ).toBe(FaServer);
+  });
+});
diff --git a/frontend/src/components/AppDetail.tsx b/frontend/src/components/AppDetail.tsx
index 903c7073..84be2f97 100644
--- a/frontend/src/components/AppDetail.tsx
+++ b/frontend/src/components/AppDetail.tsx
@@ -159,7 +159,7 @@ export default function AppDetail() {
             />
           </>
         }
-        icon={getAppIconType(app.manifest)}
+        icon={getAppIconType()}
         title={app.name}
       >
         {isShared ? (
diff --git a/frontend/src/components/AppLaunch.tsx b/frontend/src/components/AppLaunch.tsx
index d69bafc1..2e5e45eb 100644
--- a/frontend/src/components/AppLaunch.tsx
+++ b/frontend/src/components/AppLaunch.tsx
@@ -187,7 +187,7 @@ export default function AppLaunch() {
             ? buildAppDetailPath(installedApp.url, installedApp.manifest_path)
             : '/apps'
         }
-        icon={manifest ? getAppIconType(manifest) : undefined}
+        icon={getAppIconType()}
         title={displayName}
       />
 
diff --git a/frontend/src/components/ListingDetail.tsx b/frontend/src/components/ListingDetail.tsx
index 126795d3..58b2cdbd 100644
--- a/frontend/src/components/ListingDetail.tsx
+++ b/frontend/src/components/ListingDetail.tsx
@@ -40,8 +40,7 @@ export default function ListingDetail() {
   const listingUrl = listing?.url;
   const listingManifestPath = listing?.manifest_path;
 
-  // Listings don't carry the manifest, so fetch a preview to show the entry
-  // points and the correct type icon.
+  // Listings don't carry the manifest, so fetch a preview to show entry points.
   useEffect(() => {
     if (listingUrl !== undefined) {
       manifestMutation.mutate({
@@ -135,7 +134,7 @@ export default function ListingDetail() {
             ) : null}
           </>
         }
-        icon={getAppIconType(manifest)}
+        icon={getAppIconType()}
         title={listing.name}
       >
         {alreadyAdded ? (
diff --git a/frontend/src/components/ui/AppsPage/AppCard.tsx b/frontend/src/components/ui/AppsPage/AppCard.tsx
index 293ebd67..20570a9a 100644
--- a/frontend/src/components/ui/AppsPage/AppCard.tsx
+++ b/frontend/src/components/ui/AppsPage/AppCard.tsx
@@ -54,7 +54,7 @@ export default function AppCard({ app, actions }: AppCardProps) {
         <div className="flex items-center gap-2 min-w-0">
           <FgIcon
             className="text-foreground flex-shrink-0"
-            icon={getAppIconType(app.manifest)}
+            icon={getAppIconType()}
           />
           {isShared ? <SharedBadge /> : null}
           {updateAvailable ? <UpdateAvailableBadge /> : null}
diff --git a/frontend/src/components/ui/AppsPage/ListingCard.tsx b/frontend/src/components/ui/AppsPage/ListingCard.tsx
index 71bcfe7e..218c570b 100644
--- a/frontend/src/components/ui/AppsPage/ListingCard.tsx
+++ b/frontend/src/components/ui/AppsPage/ListingCard.tsx
@@ -62,7 +62,7 @@ export default function ListingCard({
         <div className="flex items-center gap-2 min-w-0">
           <FgIcon
             className="text-foreground flex-shrink-0"
-            icon={getAppIconType(installedApp?.manifest)}
+            icon={getAppIconType()}
           />
           {alreadyAdded ? <InYourAppsBadge /> : null}
         </div>
diff --git a/frontend/src/components/ui/Table/myAppsColumns.tsx b/frontend/src/components/ui/Table/myAppsColumns.tsx
index f408e33a..2ccc98d5 100644
--- a/frontend/src/components/ui/Table/myAppsColumns.tsx
+++ b/frontend/src/components/ui/Table/myAppsColumns.tsx
@@ -2,6 +2,7 @@ import type { MouseEvent } from 'react';
 import type { ColumnDef } from '@tanstack/react-table';
 
 import FgExternalLink from '@/components/designSystem/atoms/FgExternalLink';
+import FgIcon from '@/components/designSystem/atoms/FgIcon';
 import FgLink from '@/components/designSystem/atoms/FgLink';
 import CardActionsMenu from '@/components/ui/Menus/CardActionsMenu';
 import FgTooltip from '@/components/ui/widgets/FgTooltip';
@@ -10,7 +11,12 @@ import {
   buildAppMenuItems,
   isAppShared
 } from '@/components/ui/AppsPage/appMenuItems';
-import { appRevision, buildAppDetailPath, parseGithubUrl } from '@/utils';
+import {
+  appRevision,
+  buildAppDetailPath,
+  getAppIconType,
+  parseGithubUrl
+} from '@/utils';
 import type { AppActions } from '@/hooks/useAppActions';
 import type { UserApp } from '@/shared.types';
 
@@ -44,14 +50,18 @@ function NameCell({
   }
   return (
     <div
-      className="flex items-center gap-2 truncate w-full h-full"
+      className="flex items-center gap-2 min-w-0 truncate w-full h-full"
       onContextMenu={e => {
         e.preventDefault();
         onContextMenu?.(e, { value: app.name });
       }}
     >
+      <FgIcon
+        className="text-foreground flex-shrink-0"
+        icon={getAppIconType()}
+      />
       {detailPath ? (
-        <FgLink className="truncate" to={detailPath}>
+        <FgLink className="truncate min-w-0" to={detailPath}>
           {app.name}
         </FgLink>
       ) : (
diff --git a/frontend/src/utils/appIcons.ts b/frontend/src/utils/appIcons.ts
index 13b1e378..6d97bb0e 100644
--- a/frontend/src/utils/appIcons.ts
+++ b/frontend/src/utils/appIcons.ts
@@ -1,8 +1,14 @@
 import type { IconType } from 'react-icons';
 import { FaServer } from 'react-icons/fa6';
+import { GoPackage } from 'react-icons/go';
 import { IoTerminal } from 'react-icons/io5';
 
-import type { AppEntryPoint, AppManifest } from '@/shared.types';
+import type { AppEntryPoint } from '@/shared.types';
+
+/** Standard icon representing an app. */
+export function getAppIconType(): IconType {
+  return GoPackage;
+}
 
 /** Icon for an entry point type: a server for services, a terminal for batch jobs. */
 export function getEntryPointTypeIconType(type?: 'job' | 'service'): IconType {
@@ -13,11 +19,3 @@ export function getEntryPointTypeIconType(type?: 'job' | 'service'): IconType {
 export function getEntryPointIconType(entryPoint?: AppEntryPoint): IconType {
   return getEntryPointTypeIconType(entryPoint?.type);
 }
-
-/**
- * Icon representing an app, derived from its primary (first) entry point.
- * Falls back to the job (terminal) icon when the manifest isn't loaded.
- */
-export function getAppIconType(manifest?: AppManifest): IconType {
-  return getEntryPointIconType(manifest?.runnables?.[0]);
-}

From ffb56f1cb937a85272d909119a16cf8db8e4e5b1 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Fri, 3 Jul 2026 15:18:48 -0400
Subject: [PATCH 37/89] feat(apps): align My Apps and App Catalog table columns

Drop the Revision column from My Apps, rename Name to App Name in both
tables, and add a Repository column and the app icon in front of the
name to the catalog table, matching My Apps. The org/repo label helper
moves to utils as repoLabel for shared use.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 frontend/src/components/Apps.tsx              |  2 +-
 frontend/src/components/Catalog.tsx           |  2 +-
 .../components/ui/Table/catalogColumns.tsx    | 43 +++++++++++++++++--
 .../src/components/ui/Table/myAppsColumns.tsx | 42 ++----------------
 frontend/src/utils/appUrls.ts                 | 10 +++++
 frontend/src/utils/index.ts                   |  1 +
 6 files changed, 55 insertions(+), 45 deletions(-)

diff --git a/frontend/src/components/Apps.tsx b/frontend/src/components/Apps.tsx
index 56c98ff8..11b3efe0 100644
--- a/frontend/src/components/Apps.tsx
+++ b/frontend/src/components/Apps.tsx
@@ -78,7 +78,7 @@ export default function Apps() {
             data={appsQuery.data || []}
             dataType="apps"
             errorState={appsQuery.error}
-            gridColsClass="grid-cols-[2fr_1fr_2fr_3fr_1fr_1fr]"
+            gridColsClass="grid-cols-[2fr_2fr_3fr_1fr_1fr]"
             loadingState={appsQuery.isPending}
           />
         </div>
diff --git a/frontend/src/components/Catalog.tsx b/frontend/src/components/Catalog.tsx
index b4eb78b1..2a88e2ee 100644
--- a/frontend/src/components/Catalog.tsx
+++ b/frontend/src/components/Catalog.tsx
@@ -118,7 +118,7 @@ export default function Catalog() {
             data={filteredListings}
             dataType="shared apps"
             errorState={catalogQuery.error}
-            gridColsClass="grid-cols-[2fr_3fr_1fr_1fr_1fr_1fr]"
+            gridColsClass="grid-cols-[2fr_2fr_3fr_1fr_1fr_1fr_1fr]"
             loadingState={catalogQuery.isPending}
           />
         </div>
diff --git a/frontend/src/components/ui/Table/catalogColumns.tsx b/frontend/src/components/ui/Table/catalogColumns.tsx
index 68ee2b47..b41eeb55 100644
--- a/frontend/src/components/ui/Table/catalogColumns.tsx
+++ b/frontend/src/components/ui/Table/catalogColumns.tsx
@@ -1,5 +1,7 @@
 import type { ColumnDef } from '@tanstack/react-table';
 
+import FgExternalLink from '@/components/designSystem/atoms/FgExternalLink';
+import FgIcon from '@/components/designSystem/atoms/FgIcon';
 import FgLink from '@/components/designSystem/atoms/FgLink';
 import CardActionsMenu from '@/components/ui/Menus/CardActionsMenu';
 import FgTooltip from '@/components/ui/widgets/FgTooltip';
@@ -7,7 +9,7 @@ import InYourAppsBadge from '@/components/ui/AppsPage/InYourAppsBadge';
 import { buildListingMenuItems } from '@/components/ui/AppsPage/listingMenuItems';
 import { buildListingDetailPath } from '@/hooks/useListingActions';
 import type { ListingActions } from '@/hooks/useListingActions';
-import { formatDateString } from '@/utils';
+import { formatDateString, getAppIconType, repoLabel } from '@/utils';
 import type { AppListing, UserApp } from '@/shared.types';
 
 export function createCatalogColumns(
@@ -16,22 +18,55 @@ export function createCatalogColumns(
   currentUsername: string | undefined
 ): ColumnDef<AppListing>[] {
   return [
+    {
+      id: 'repository',
+      accessorFn: row => repoLabel(row.url),
+      header: 'Repository',
+      cell: ({ getValue, row, table }) => {
+        const value = getValue() as string;
+        const onContextMenu = table.options.meta?.onCellContextMenu;
+        return (
+          <div
+            className="flex items-center truncate w-full h-full"
+            onContextMenu={e => {
+              e.preventDefault();
+              onContextMenu?.(e, { value });
+            }}
+          >
+            {/* No icon: the inline-flex icon layout defeats text truncation */}
+            <FgExternalLink
+              className="truncate min-w-0"
+              href={row.original.url}
+              showIcon={false}
+              size="sm"
+            >
+              {value}
+            </FgExternalLink>
+          </div>
+        );
+      },
+      enableSorting: true
+    },
     {
       accessorKey: 'name',
-      header: 'Name',
+      header: 'App Name',
       cell: ({ getValue, row, table }) => {
         const value = getValue() as string;
         const onContextMenu = table.options.meta?.onCellContextMenu;
         return (
           <div
-            className="flex items-center gap-2 truncate w-full h-full"
+            className="flex items-center gap-2 min-w-0 truncate w-full h-full"
             onContextMenu={e => {
               e.preventDefault();
               onContextMenu?.(e, { value });
             }}
           >
+            <FgIcon
+              className="text-foreground flex-shrink-0"
+              icon={getAppIconType()}
+            />
             <FgLink
-              className="truncate"
+              className="truncate min-w-0"
               to={buildListingDetailPath(row.original.id)}
             >
               {value}
diff --git a/frontend/src/components/ui/Table/myAppsColumns.tsx b/frontend/src/components/ui/Table/myAppsColumns.tsx
index 2ccc98d5..62891038 100644
--- a/frontend/src/components/ui/Table/myAppsColumns.tsx
+++ b/frontend/src/components/ui/Table/myAppsColumns.tsx
@@ -11,25 +11,10 @@ import {
   buildAppMenuItems,
   isAppShared
 } from '@/components/ui/AppsPage/appMenuItems';
-import {
-  appRevision,
-  buildAppDetailPath,
-  getAppIconType,
-  parseGithubUrl
-} from '@/utils';
+import { buildAppDetailPath, getAppIconType, repoLabel } from '@/utils';
 import type { AppActions } from '@/hooks/useAppActions';
 import type { UserApp } from '@/shared.types';
 
-/** "org/repo" label for an app's GitHub URL; falls back to the raw URL. */
-function repoLabel(app: UserApp): string {
-  try {
-    const { owner, repo } = parseGithubUrl(app.url);
-    return `${owner}/${repo}`;
-  } catch {
-    return app.url;
-  }
-}
-
 type OnCellContextMenu = (
   e: MouseEvent<HTMLElement>,
   data: { value: string }
@@ -75,7 +60,7 @@ export function createMyAppsColumns(actions: AppActions): ColumnDef<UserApp>[] {
   return [
     {
       id: 'repository',
-      accessorFn: repoLabel,
+      accessorFn: row => repoLabel(row.url),
       header: 'Repository',
       cell: ({ getValue, row, table }) => {
         const value = getValue() as string;
@@ -102,30 +87,9 @@ export function createMyAppsColumns(actions: AppActions): ColumnDef<UserApp>[] {
       },
       enableSorting: true
     },
-    {
-      id: 'revision',
-      accessorFn: row => appRevision(row.url, row.branch) ?? '',
-      header: 'Revision',
-      cell: ({ getValue, table }) => {
-        const value = getValue() as string;
-        const onContextMenu = table.options.meta?.onCellContextMenu;
-        return (
-          <div
-            className="flex items-center truncate w-full h-full"
-            onContextMenu={e => {
-              e.preventDefault();
-              onContextMenu?.(e, { value });
-            }}
-          >
-            <span className="truncate text-sm">{value}</span>
-          </div>
-        );
-      },
-      enableSorting: true
-    },
     {
       accessorKey: 'name',
-      header: 'Name',
+      header: 'App Name',
       cell: ({ row, table }) => (
         <NameCell
           app={row.original}
diff --git a/frontend/src/utils/appUrls.ts b/frontend/src/utils/appUrls.ts
index 1c1a1252..3bf16d19 100644
--- a/frontend/src/utils/appUrls.ts
+++ b/frontend/src/utils/appUrls.ts
@@ -35,6 +35,16 @@ export function parseGithubUrl(url: string): {
   throw new Error(`Invalid GitHub URL: ${url}`);
 }
 
+/** "org/repo" label for an app's GitHub URL; falls back to the raw URL. */
+export function repoLabel(url: string): string {
+  try {
+    const { owner, repo } = parseGithubUrl(url);
+    return `${owner}/${repo}`;
+  } catch {
+    return url;
+  }
+}
+
 /**
  * Normalize a GitHub URL to its canonical https form (no ".git" suffix, no
  * trailing slash, no redundant "/tree/main"). Returns the input unchanged if it
diff --git a/frontend/src/utils/index.ts b/frontend/src/utils/index.ts
index 23bb613d..14b3c8d1 100644
--- a/frontend/src/utils/index.ts
+++ b/frontend/src/utils/index.ts
@@ -394,6 +394,7 @@ export type {
 export {
   appRevision,
   parseGithubUrl,
+  repoLabel,
   isGithubRepoUrl,
   canonicalGithubUrl,
   buildAppUrl,

From dbb83aea93209d42e4e09be0e51241b18783d75e Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Fri, 3 Jul 2026 15:30:23 -0400
Subject: [PATCH 38/89] Add app metadata to detail pages

Show additional installed-app and catalog-listing metadata on the My Apps and App Catalog detail pages, including manifest path, commit information, timestamps, and cross-links.

Co-authored-by: Codex <codex@openai.com>
---
 frontend/src/components/ListingDetail.tsx     |   2 +-
 .../components/ui/AppsPage/AppInfoTable.tsx   | 131 +++++++++++++-----
 .../ui/AppsPage/ListingInfoTable.tsx          | 131 ++++++++++++++----
 3 files changed, 207 insertions(+), 57 deletions(-)

diff --git a/frontend/src/components/ListingDetail.tsx b/frontend/src/components/ListingDetail.tsx
index 58b2cdbd..c9797040 100644
--- a/frontend/src/components/ListingDetail.tsx
+++ b/frontend/src/components/ListingDetail.tsx
@@ -145,7 +145,7 @@ export default function ListingDetail() {
       </AppPageHeader>
 
       <div className="max-w-2xl">
-        <ListingInfoTable listing={listing} />
+        <ListingInfoTable installedApp={installedApp} listing={listing} />
 
         {manifestMutation.isPending && !manifest ? (
           <Typography className="text-foreground" type="small">
diff --git a/frontend/src/components/ui/AppsPage/AppInfoTable.tsx b/frontend/src/components/ui/AppsPage/AppInfoTable.tsx
index 4dc3bbe7..a8f2b7ea 100644
--- a/frontend/src/components/ui/AppsPage/AppInfoTable.tsx
+++ b/frontend/src/components/ui/AppsPage/AppInfoTable.tsx
@@ -1,54 +1,123 @@
+import type { ReactNode } from 'react';
+
 import FgExternalLink from '@/components/designSystem/atoms/FgExternalLink';
+import FgLink from '@/components/designSystem/atoms/FgLink';
 import type { UserApp } from '@/shared.types';
-import { appRevision, buildGithubCommitUrl } from '@/utils/appUrls';
+import { formatDateString } from '@/utils';
+import {
+  appRevision,
+  buildGithubCommitUrl,
+  canonicalGithubUrl
+} from '@/utils/appUrls';
+
+const labelClass =
+  'text-foreground font-medium pr-4 py-1.5 align-top whitespace-nowrap';
+const valueClass = 'text-foreground py-1.5';
+
+function manifestPathLabel(path: string): string {
+  return path || 'Repository root';
+}
+
+function InfoRow({
+  label,
+  children
+}: {
+  readonly label: string;
+  readonly children: ReactNode;
+}) {
+  return (
+    <tr>
+      <td className={labelClass}>{label}</td>
+      <td className={valueClass}>{children}</td>
+    </tr>
+  );
+}
+
+function CommitValue({
+  sha,
+  href
+}: {
+  readonly sha: string;
+  readonly href: string | null;
+}) {
+  if (href) {
+    return (
+      <FgExternalLink className="break-all text-xs font-mono" href={href}>
+        {sha}
+      </FgExternalLink>
+    );
+  }
+
+  return <span className="break-all text-xs font-mono">{sha}</span>;
+}
 
 export default function AppInfoTable({ app }: { readonly app: UserApp }) {
-  const labelClass =
-    'text-foreground font-medium pr-4 py-1.5 align-top whitespace-nowrap';
-  const valueClass = 'text-foreground py-1.5';
   const revision = appRevision(app.url, app.branch);
   const commitUrl = app.commit_sha
     ? buildGithubCommitUrl(app.url, app.commit_sha)
     : null;
+  const codeRepoUrl = app.manifest?.repo_url;
+  const separateCodeRepoUrl =
+    codeRepoUrl &&
+    canonicalGithubUrl(codeRepoUrl) !== canonicalGithubUrl(app.url)
+      ? codeRepoUrl
+      : null;
+  const codeCommitUrl =
+    app.code_commit_sha && separateCodeRepoUrl
+      ? buildGithubCommitUrl(separateCodeRepoUrl, app.code_commit_sha)
+      : null;
+  const updatedAt = app.updated_at
+    ? formatDateString(app.updated_at)
+    : 'Not updated since added';
 
   return (
     <table className="w-full text-sm mb-6">
       <tbody>
-        <tr>
-          <td className={labelClass}>URL</td>
-          <td className="py-1.5">
+        <InfoRow label="URL">
+          <span className="py-1.5">
             <FgExternalLink className="break-all" href={app.url}>
               {app.url}
             </FgExternalLink>
-          </td>
-        </tr>
+          </span>
+        </InfoRow>
         {revision ? (
-          <tr>
-            <td className={labelClass}>Revision</td>
-            <td className={valueClass}>{revision}</td>
-          </tr>
+          <InfoRow label="Revision">
+            <span className="break-all">{revision}</span>
+          </InfoRow>
         ) : null}
+        <InfoRow label="Manifest path">
+          {manifestPathLabel(app.manifest_path)}
+        </InfoRow>
         {app.commit_sha ? (
-          <tr>
-            <td className={labelClass}>Version</td>
-            <td className={valueClass}>
-              {commitUrl ? (
-                <FgExternalLink className="text-xs font-mono" href={commitUrl}>
-                  {app.commit_sha.slice(0, 7)}
-                </FgExternalLink>
-              ) : (
-                <span className="text-xs font-mono">
-                  {app.commit_sha.slice(0, 7)}
-                </span>
-              )}
-            </td>
-          </tr>
+          <InfoRow label="App commit">
+            <CommitValue href={commitUrl} sha={app.commit_sha} />
+          </InfoRow>
+        ) : null}
+        {separateCodeRepoUrl ? (
+          <InfoRow label="Code repo">
+            <FgExternalLink className="break-all" href={separateCodeRepoUrl}>
+              {separateCodeRepoUrl}
+            </FgExternalLink>
+          </InfoRow>
+        ) : null}
+        {app.code_commit_sha ? (
+          <InfoRow label="Code commit">
+            <CommitValue href={codeCommitUrl} sha={app.code_commit_sha} />
+          </InfoRow>
+        ) : null}
+        <InfoRow label="Added to My Apps">
+          {formatDateString(app.added_at)}
+        </InfoRow>
+        <InfoRow label="Last updated">{updatedAt}</InfoRow>
+        {app.listing_id ? (
+          <InfoRow label="Catalog listing">
+            <FgLink size="sm" to={`/apps/catalog/${app.listing_id}`}>
+              #{app.listing_id}
+            </FgLink>
+          </InfoRow>
         ) : null}
         {app.description ? (
-          <tr>
-            <td className={labelClass}>Description</td>
-            <td className={valueClass}>{app.description}</td>
-          </tr>
+          <InfoRow label="Description">{app.description}</InfoRow>
         ) : null}
       </tbody>
     </table>
diff --git a/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx b/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx
index b4d64165..3a11203f 100644
--- a/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx
+++ b/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx
@@ -1,7 +1,55 @@
+import type { ReactNode } from 'react';
+
 import FgExternalLink from '@/components/designSystem/atoms/FgExternalLink';
-import type { AppListing } from '@/shared.types';
+import FgLink from '@/components/designSystem/atoms/FgLink';
+import type { AppListing, UserApp } from '@/shared.types';
 import { formatDateString } from '@/utils';
-import { parseGithubUrl } from '@/utils/appUrls';
+import {
+  buildAppDetailPath,
+  buildGithubCommitUrl,
+  parseGithubUrl
+} from '@/utils/appUrls';
+
+const labelClass =
+  'text-foreground font-medium pr-4 py-1.5 align-top whitespace-nowrap';
+const valueClass = 'text-foreground py-1.5';
+
+function manifestPathLabel(path: string): string {
+  return path || 'Repository root';
+}
+
+function InfoRow({
+  label,
+  children
+}: {
+  readonly label: string;
+  readonly children: ReactNode;
+}) {
+  return (
+    <tr>
+      <td className={labelClass}>{label}</td>
+      <td className={valueClass}>{children}</td>
+    </tr>
+  );
+}
+
+function CommitValue({
+  sha,
+  href
+}: {
+  readonly sha: string;
+  readonly href: string | null;
+}) {
+  if (href) {
+    return (
+      <FgExternalLink className="break-all text-xs font-mono" href={href}>
+        {sha}
+      </FgExternalLink>
+    );
+  }
+
+  return <span className="break-all text-xs font-mono">{sha}</span>;
+}
 
 /**
  * The revision actually cloned, parsed out of the canonical listing URL (which
@@ -16,45 +64,78 @@ function listingRevision(listing: AppListing): string | null {
 }
 
 export default function ListingInfoTable({
+  installedApp,
   listing
 }: {
+  readonly installedApp?: UserApp;
   readonly listing: AppListing;
 }) {
-  const labelClass =
-    'text-foreground font-medium pr-4 py-1.5 align-top whitespace-nowrap';
-  const valueClass = 'text-foreground py-1.5';
-
   const publishedAt = formatDateString(listing.published_at);
+  const editedAt = listing.updated_at
+    ? formatDateString(listing.updated_at)
+    : 'Not edited since publish';
   const revision = listingRevision(listing);
+  const installedCommitUrl = installedApp?.commit_sha
+    ? buildGithubCommitUrl(installedApp.url, installedApp.commit_sha)
+    : null;
 
   return (
     <table className="w-full text-sm mb-6">
       <tbody>
-        <tr>
-          <td className={labelClass}>URL</td>
-          <td className="py-1.5">
+        <InfoRow label="URL">
+          <span className="py-1.5">
             <FgExternalLink className="break-all" href={listing.url}>
               {listing.url}
             </FgExternalLink>
-          </td>
-        </tr>
+          </span>
+        </InfoRow>
         {revision ? (
-          <tr>
-            <td className={labelClass}>Revision</td>
-            <td className={valueClass}>{revision}</td>
-          </tr>
+          <InfoRow label="Revision">
+            <span className="break-all">{revision}</span>
+          </InfoRow>
+        ) : null}
+        <InfoRow label="Manifest path">
+          {manifestPathLabel(listing.manifest_path)}
+        </InfoRow>
+        <InfoRow label="Listing ID">#{listing.id}</InfoRow>
+        <InfoRow label="Shared by">{listing.owner_username}</InfoRow>
+        <InfoRow label="Published">{publishedAt}</InfoRow>
+        <InfoRow label="Last edited">{editedAt}</InfoRow>
+        {installedApp ? (
+          <InfoRow label="In My Apps">
+            <FgLink
+              size="sm"
+              to={buildAppDetailPath(
+                installedApp.url,
+                installedApp.manifest_path
+              )}
+            >
+              View installed app
+            </FgLink>
+          </InfoRow>
+        ) : null}
+        {installedApp?.commit_sha ? (
+          <InfoRow label="Installed commit">
+            <CommitValue
+              href={installedCommitUrl}
+              sha={installedApp.commit_sha}
+            />
+          </InfoRow>
+        ) : null}
+        {installedApp ? (
+          <InfoRow label="Added to My Apps">
+            {formatDateString(installedApp.added_at)}
+          </InfoRow>
+        ) : null}
+        {installedApp ? (
+          <InfoRow label="My Apps updated">
+            {installedApp.updated_at
+              ? formatDateString(installedApp.updated_at)
+              : 'Not updated since added'}
+          </InfoRow>
         ) : null}
-        <tr>
-          <td className={labelClass}>Shared by</td>
-          <td className={valueClass}>
-            {listing.owner_username} on {publishedAt}
-          </td>
-        </tr>
         {listing.description ? (
-          <tr>
-            <td className={labelClass}>Description</td>
-            <td className={valueClass}>{listing.description}</td>
-          </tr>
+          <InfoRow label="Description">{listing.description}</InfoRow>
         ) : null}
       </tbody>
     </table>

From f68c20d918f9806ca9bd117dfe05d6366f6d434b Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Fri, 3 Jul 2026 15:34:06 -0400
Subject: [PATCH 39/89] fix(apps): tolerate serialized exists default on
 non-path params

Manifests round-trip through model_dump (worker to server, DB cache),
which writes the exists=True default onto every parameter, so the
model_fields_set check rejected re-validated manifests with one error
per string param. Validate the value instead: only exists=false on a
non-path parameter is an error.

Long error toasts (like those multi-page validation messages) are now
truncated to 300 chars via a shared showErrorToast helper, with the
full text logged to the browser console.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 fileglancer/model.py                    |  5 ++++-
 frontend/src/components/AppJobs.tsx     |  9 +++------
 frontend/src/components/AppLaunch.tsx   |  5 ++---
 frontend/src/hooks/useAppActions.ts     | 13 ++++---------
 frontend/src/hooks/useListingActions.ts |  5 +++--
 frontend/src/utils/errorToast.ts        | 26 +++++++++++++++++++++++++
 tests/test_apps.py                      | 18 ++++++++++++++---
 7 files changed, 57 insertions(+), 24 deletions(-)
 create mode 100644 frontend/src/utils/errorToast.ts

diff --git a/fileglancer/model.py b/fileglancer/model.py
index 3fa993ad..d39c718d 100644
--- a/fileglancer/model.py
+++ b/fileglancer/model.py
@@ -375,7 +375,10 @@ def stringify_options(cls, v):
 
     @model_validator(mode='after')
     def validate_exists(self):
-        if "exists" in self.model_fields_set and self.type not in ("file", "directory"):
+        # Check the value, not model_fields_set: manifests round-trip through
+        # model_dump (worker -> server, DB cache), which serializes the True
+        # default onto every param, so presence of the field is meaningless.
+        if not self.exists and self.type not in ("file", "directory"):
             raise ValueError(
                 f"exists is only valid on file and directory parameters, "
                 f"but '{self.name}' has type '{self.type}'"
diff --git a/frontend/src/components/AppJobs.tsx b/frontend/src/components/AppJobs.tsx
index e48c8c05..0e5d0dc5 100644
--- a/frontend/src/components/AppJobs.tsx
+++ b/frontend/src/components/AppJobs.tsx
@@ -9,6 +9,7 @@ import CancelJobDialog from '@/components/ui/Dialogs/CancelJob';
 import { TableCard } from '@/components/ui/Table/TableCard';
 import { createAppsJobsColumns } from '@/components/ui/Table/appsJobsColumns';
 import { buildRelaunchPath, parseGithubUrl } from '@/utils';
+import { showErrorToast } from '@/utils/errorToast';
 import type { Job } from '@/shared.types';
 import {
   useJobsQuery,
@@ -61,9 +62,7 @@ export default function AppJobs() {
         job.entry_point_type === 'service' ? 'Service stopped' : 'Job cancelled'
       );
     } catch (error) {
-      const message =
-        error instanceof Error ? error.message : 'Failed to cancel job';
-      toast.error(message);
+      showErrorToast(error, 'Failed to cancel job');
     }
   };
 
@@ -72,9 +71,7 @@ export default function AppJobs() {
       await deleteJobMutation.mutateAsync(jobId);
       toast.success('Job deleted');
     } catch (error) {
-      const message =
-        error instanceof Error ? error.message : 'Failed to delete job';
-      toast.error(message);
+      showErrorToast(error, 'Failed to delete job');
     }
   };
 
diff --git a/frontend/src/components/AppLaunch.tsx b/frontend/src/components/AppLaunch.tsx
index 2e5e45eb..60c0083b 100644
--- a/frontend/src/components/AppLaunch.tsx
+++ b/frontend/src/components/AppLaunch.tsx
@@ -18,6 +18,7 @@ import {
   canonicalGithubUrl,
   getAppIconType
 } from '@/utils';
+import { showErrorToast } from '@/utils/errorToast';
 import {
   useAppsQuery,
   useAddAppMutation,
@@ -172,9 +173,7 @@ export default function AppLaunch() {
       const count = apps.length;
       toast.success(`${count} app${count !== 1 ? 's' : ''} added`);
     } catch (error) {
-      const message =
-        error instanceof Error ? error.message : 'Failed to install app';
-      toast.error(message);
+      showErrorToast(error, 'Failed to install app');
     }
   };
 
diff --git a/frontend/src/hooks/useAppActions.ts b/frontend/src/hooks/useAppActions.ts
index e507a834..2146ef58 100644
--- a/frontend/src/hooks/useAppActions.ts
+++ b/frontend/src/hooks/useAppActions.ts
@@ -9,6 +9,7 @@ import {
   useUpdateAppMutation
 } from '@/queries/appsQueries';
 import { buildAppDetailPath, buildLaunchPathFromApp } from '@/utils';
+import { showErrorToast } from '@/utils/errorToast';
 import type { UserApp } from '@/shared.types';
 
 export interface AppActions {
@@ -80,9 +81,7 @@ export function useAppActions(opts?: { onRemoved?: () => void }): AppActions {
         toast.success(`Updated to ${updated.commit_sha.slice(0, 7)}`);
       }
     } catch (error) {
-      const message =
-        error instanceof Error ? error.message : 'Failed to update app';
-      toast.error(message);
+      showErrorToast(error, 'Failed to update app');
     }
   };
 
@@ -94,9 +93,7 @@ export function useAppActions(opts?: { onRemoved?: () => void }): AppActions {
       await unshareListingMutation.mutateAsync({ listing_id: app.listing_id });
       toast.success('Removed from catalog');
     } catch (error) {
-      const message =
-        error instanceof Error ? error.message : 'Failed to unshare';
-      toast.error(message);
+      showErrorToast(error, 'Failed to unshare');
     }
   };
 
@@ -124,9 +121,7 @@ export function useAppActions(opts?: { onRemoved?: () => void }): AppActions {
       setRemoveTarget(null);
       opts?.onRemoved?.();
     } catch (error) {
-      const message =
-        error instanceof Error ? error.message : 'Failed to remove app';
-      toast.error(message);
+      showErrorToast(error, 'Failed to remove app');
     }
   };
 
diff --git a/frontend/src/hooks/useListingActions.ts b/frontend/src/hooks/useListingActions.ts
index 634f0002..a5cb8201 100644
--- a/frontend/src/hooks/useListingActions.ts
+++ b/frontend/src/hooks/useListingActions.ts
@@ -6,6 +6,7 @@ import {
   useUnshareListingMutation
 } from '@/queries/appsQueries';
 import { buildAppDetailPath } from '@/utils';
+import { showErrorToast } from '@/utils/errorToast';
 import type { AppListing, UserApp } from '@/shared.types';
 
 export function buildListingDetailPath(listingId: number): string {
@@ -47,7 +48,7 @@ export function useListingActions(opts?: {
       await addFromListingMutation.mutateAsync({ listing_id: listing.id });
       toast.success(`Added "${listing.name}"`);
     } catch (e) {
-      toast.error(e instanceof Error ? e.message : 'Failed to add app');
+      showErrorToast(e, 'Failed to add app');
     }
   };
 
@@ -57,7 +58,7 @@ export function useListingActions(opts?: {
       toast.success('Removed from catalog');
       opts?.onUnshared?.();
     } catch (e) {
-      toast.error(e instanceof Error ? e.message : 'Failed to unshare');
+      showErrorToast(e, 'Failed to unshare');
     }
   };
 
diff --git a/frontend/src/utils/errorToast.ts b/frontend/src/utils/errorToast.ts
new file mode 100644
index 00000000..7564524c
--- /dev/null
+++ b/frontend/src/utils/errorToast.ts
@@ -0,0 +1,26 @@
+import toast from 'react-hot-toast';
+
+import logger from '@/logger';
+
+// Longest message shown in a toast. Anything bigger (e.g. a multi-line
+// manifest validation error) would overflow the screen and vanish before it
+// can be read, so it is cut here and logged in full instead.
+const MAX_TOAST_MESSAGE_LENGTH = 300;
+
+/**
+ * Show an error toast for an unknown error value (typically a caught fetch
+ * error). Long messages are truncated to stay readable in the growler, with
+ * the full text logged to the browser console.
+ */
+export function showErrorToast(error: unknown, fallback: string) {
+  const message =
+    error instanceof Error ? error.message : fallback || String(error);
+  if (message.length > MAX_TOAST_MESSAGE_LENGTH) {
+    logger.error(message);
+    toast.error(
+      `${message.slice(0, MAX_TOAST_MESSAGE_LENGTH)}… (full error logged to browser console)`
+    );
+  } else {
+    toast.error(message);
+  }
+}
diff --git a/tests/test_apps.py b/tests/test_apps.py
index 867e9510..83ce1807 100644
--- a/tests/test_apps.py
+++ b/tests/test_apps.py
@@ -1249,14 +1249,26 @@ def test_defaults_true(self):
         assert p.exists is True
 
     @pytest.mark.parametrize("bad_type", ["string", "integer", "enum"])
-    @pytest.mark.parametrize("value", [True, False])
-    def test_rejected_on_non_path_type(self, bad_type, value):
-        kwargs = {"key": "p", "name": "P", "type": bad_type, "exists": value}
+    def test_exists_false_rejected_on_non_path_type(self, bad_type):
+        kwargs = {"key": "p", "name": "P", "type": bad_type, "exists": False}
         if bad_type == "enum":
             kwargs["options"] = ["a", "b"]
         with pytest.raises(ValidationError):
             AppParameter(**kwargs)
 
+    def test_exists_true_tolerated_on_non_path_type(self):
+        # model_dump serializes the True default onto every param, so a
+        # round-tripped manifest carries exists=True on strings; that must
+        # revalidate cleanly.
+        p = AppParameter(key="s", name="S", type="string", exists=True)
+        assert p.exists is True
+
+    def test_round_trip_through_model_dump(self):
+        # Worker -> server and DB-cache paths reconstruct the model from its
+        # own model_dump; the validator must accept its own serialized output.
+        p = AppParameter(key="s", name="S", type="string", flag="--s")
+        assert AppParameter(**p.model_dump()) == p
+
 
 class TestCollectCreatableDirs:
     """collect_creatable_dirs gathers directory params with exists=false."""

From b944dbad215dc8245b54413a23cd59737bf2de25 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Fri, 3 Jul 2026 15:34:55 -0400
Subject: [PATCH 40/89] Polish app detail metadata labels

Shorten the My Apps added-date label and replace Material Tailwind ButtonGroup usage in app/table controls to avoid leaking isFullWidth onto DOM buttons.

Co-authored-by: Codex <codex@openai.com>
---
 frontend/src/components/ui/AppsPage/AppInfoTable.tsx     | 4 +---
 frontend/src/components/ui/AppsPage/ListingInfoTable.tsx | 2 +-
 frontend/src/components/ui/Table/TableCard.tsx           | 9 ++++++---
 frontend/src/components/ui/widgets/ViewModeToggle.tsx    | 6 +++---
 4 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/frontend/src/components/ui/AppsPage/AppInfoTable.tsx b/frontend/src/components/ui/AppsPage/AppInfoTable.tsx
index a8f2b7ea..514e7d3d 100644
--- a/frontend/src/components/ui/AppsPage/AppInfoTable.tsx
+++ b/frontend/src/components/ui/AppsPage/AppInfoTable.tsx
@@ -105,9 +105,7 @@ export default function AppInfoTable({ app }: { readonly app: UserApp }) {
             <CommitValue href={codeCommitUrl} sha={app.code_commit_sha} />
           </InfoRow>
         ) : null}
-        <InfoRow label="Added to My Apps">
-          {formatDateString(app.added_at)}
-        </InfoRow>
+        <InfoRow label="Added">{formatDateString(app.added_at)}</InfoRow>
         <InfoRow label="Last updated">{updatedAt}</InfoRow>
         {app.listing_id ? (
           <InfoRow label="Catalog listing">
diff --git a/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx b/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx
index 3a11203f..7096e09c 100644
--- a/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx
+++ b/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx
@@ -123,7 +123,7 @@ export default function ListingInfoTable({
           </InfoRow>
         ) : null}
         {installedApp ? (
-          <InfoRow label="Added to My Apps">
+          <InfoRow label="Added">
             {formatDateString(installedApp.added_at)}
           </InfoRow>
         ) : null}
diff --git a/frontend/src/components/ui/Table/TableCard.tsx b/frontend/src/components/ui/Table/TableCard.tsx
index 04f2110e..6b969158 100644
--- a/frontend/src/components/ui/Table/TableCard.tsx
+++ b/frontend/src/components/ui/Table/TableCard.tsx
@@ -20,7 +20,6 @@ import {
   type SortingState
 } from '@tanstack/react-table';
 import {
-  ButtonGroup,
   Card,
   IconButton,
   Input,
@@ -227,32 +226,36 @@ function TableHeader({
               of {table.getPageCount().toLocaleString()}
             </Typography>
           </div>
-          <ButtonGroup variant="ghost">
+          <div className="flex items-center gap-1">
             <IconButton
               disabled={!table.getCanPreviousPage()}
               onClick={() => table.firstPage()}
+              variant="ghost"
             >
               <FgIcon icon={HiChevronDoubleLeft} />
             </IconButton>
             <IconButton
               disabled={!table.getCanPreviousPage()}
               onClick={() => table.previousPage()}
+              variant="ghost"
             >
               <FgIcon icon={HiChevronLeft} />
             </IconButton>
             <IconButton
               disabled={!table.getCanNextPage()}
               onClick={() => table.nextPage()}
+              variant="ghost"
             >
               <FgIcon icon={HiChevronRight} />
             </IconButton>
             <IconButton
               disabled={!table.getCanNextPage()}
               onClick={() => table.lastPage()}
+              variant="ghost"
             >
               <FgIcon icon={HiChevronDoubleRight} />
             </IconButton>
-          </ButtonGroup>
+          </div>
         </div>
         <div>
           <Select
diff --git a/frontend/src/components/ui/widgets/ViewModeToggle.tsx b/frontend/src/components/ui/widgets/ViewModeToggle.tsx
index cabb87d6..9faf3e56 100644
--- a/frontend/src/components/ui/widgets/ViewModeToggle.tsx
+++ b/frontend/src/components/ui/widgets/ViewModeToggle.tsx
@@ -1,4 +1,4 @@
-import { ButtonGroup, IconButton } from '@material-tailwind/react';
+import { IconButton } from '@material-tailwind/react';
 import { HiOutlineSquares2X2, HiOutlineTableCells } from 'react-icons/hi2';
 
 import FgTooltip from '@/components/ui/widgets/FgTooltip';
@@ -19,7 +19,7 @@ export default function ViewModeToggle({
       ? 'text-primary bg-primary/10'
       : 'text-foreground/60 hover:text-foreground';
   return (
-    <ButtonGroup className="gap-1">
+    <div className="flex items-center gap-1">
       <FgTooltip
         as={IconButton}
         icon={HiOutlineSquares2X2}
@@ -36,6 +36,6 @@ export default function ViewModeToggle({
         triggerClasses={triggerClasses(viewMode === 'table')}
         variant="ghost"
       />
-    </ButtonGroup>
+    </div>
   );
 }

From 86b288453ea510fd556b9c933668e20d1e018a5f Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Fri, 3 Jul 2026 15:37:18 -0400
Subject: [PATCH 41/89] Simplify catalog app detail metadata

Remove listing ID and installed-app timestamps from the App Catalog detail metadata table.

Co-authored-by: Codex <codex@openai.com>
---
 .../src/components/ui/AppsPage/ListingInfoTable.tsx | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx b/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx
index 7096e09c..ebf6e804 100644
--- a/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx
+++ b/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx
@@ -97,7 +97,6 @@ export default function ListingInfoTable({
         <InfoRow label="Manifest path">
           {manifestPathLabel(listing.manifest_path)}
         </InfoRow>
-        <InfoRow label="Listing ID">#{listing.id}</InfoRow>
         <InfoRow label="Shared by">{listing.owner_username}</InfoRow>
         <InfoRow label="Published">{publishedAt}</InfoRow>
         <InfoRow label="Last edited">{editedAt}</InfoRow>
@@ -122,18 +121,6 @@ export default function ListingInfoTable({
             />
           </InfoRow>
         ) : null}
-        {installedApp ? (
-          <InfoRow label="Added">
-            {formatDateString(installedApp.added_at)}
-          </InfoRow>
-        ) : null}
-        {installedApp ? (
-          <InfoRow label="My Apps updated">
-            {installedApp.updated_at
-              ? formatDateString(installedApp.updated_at)
-              : 'Not updated since added'}
-          </InfoRow>
-        ) : null}
         {listing.description ? (
           <InfoRow label="Description">{listing.description}</InfoRow>
         ) : null}

From 86e4e4cb6cfe6a9e4642dadcff8a153cbe1caa3e Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Fri, 3 Jul 2026 15:42:29 -0400
Subject: [PATCH 42/89] fix(apps): keep Shared on header on one line, show date
 without time

Adds a formatDateOnly util alongside formatDateString for the catalog
table's Shared on column.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../components/ui/Table/catalogColumns.tsx    | 19 +++++--------------
 frontend/src/utils/index.ts                   | 15 +++++++++++++++
 2 files changed, 20 insertions(+), 14 deletions(-)

diff --git a/frontend/src/components/ui/Table/catalogColumns.tsx b/frontend/src/components/ui/Table/catalogColumns.tsx
index b41eeb55..c6080516 100644
--- a/frontend/src/components/ui/Table/catalogColumns.tsx
+++ b/frontend/src/components/ui/Table/catalogColumns.tsx
@@ -1,6 +1,5 @@
 import type { ColumnDef } from '@tanstack/react-table';
 
-import FgExternalLink from '@/components/designSystem/atoms/FgExternalLink';
 import FgIcon from '@/components/designSystem/atoms/FgIcon';
 import FgLink from '@/components/designSystem/atoms/FgLink';
 import CardActionsMenu from '@/components/ui/Menus/CardActionsMenu';
@@ -9,7 +8,7 @@ import InYourAppsBadge from '@/components/ui/AppsPage/InYourAppsBadge';
 import { buildListingMenuItems } from '@/components/ui/AppsPage/listingMenuItems';
 import { buildListingDetailPath } from '@/hooks/useListingActions';
 import type { ListingActions } from '@/hooks/useListingActions';
-import { formatDateString, getAppIconType, repoLabel } from '@/utils';
+import { formatDateOnly, getAppIconType, repoLabel } from '@/utils';
 import type { AppListing, UserApp } from '@/shared.types';
 
 export function createCatalogColumns(
@@ -22,7 +21,7 @@ export function createCatalogColumns(
       id: 'repository',
       accessorFn: row => repoLabel(row.url),
       header: 'Repository',
-      cell: ({ getValue, row, table }) => {
+      cell: ({ getValue, table }) => {
         const value = getValue() as string;
         const onContextMenu = table.options.meta?.onCellContextMenu;
         return (
@@ -33,15 +32,7 @@ export function createCatalogColumns(
               onContextMenu?.(e, { value });
             }}
           >
-            {/* No icon: the inline-flex icon layout defeats text truncation */}
-            <FgExternalLink
-              className="truncate min-w-0"
-              href={row.original.url}
-              showIcon={false}
-              size="sm"
-            >
-              {value}
-            </FgExternalLink>
+            <span className="truncate min-w-0 text-sm">{value}</span>
           </div>
         );
       },
@@ -122,9 +113,9 @@ export function createCatalogColumns(
     },
     {
       accessorKey: 'published_at',
-      header: 'Shared on',
+      header: () => <span className="whitespace-nowrap">Shared on</span>,
       cell: ({ getValue, table }) => {
-        const formattedDate = formatDateString(getValue() as string);
+        const formattedDate = formatDateOnly(getValue() as string);
         const onContextMenu = table.options.meta?.onCellContextMenu;
         return (
           <div
diff --git a/frontend/src/utils/index.ts b/frontend/src/utils/index.ts
index 14b3c8d1..760a57e5 100644
--- a/frontend/src/utils/index.ts
+++ b/frontend/src/utils/index.ts
@@ -105,6 +105,20 @@ const formatDateString = (dateStr: string) => {
   });
 };
 
+/** Like formatDateString, but date only — no time component. */
+const formatDateOnly = (dateStr: string) => {
+  let normalized = dateStr;
+  if (!/Z$|[+-]\d{2}:\d{2}$/.test(dateStr)) {
+    normalized = dateStr + 'Z';
+  }
+  const date = new Date(normalized);
+  return date.toLocaleDateString('en-US', {
+    month: 'numeric',
+    day: 'numeric',
+    year: 'numeric'
+  });
+};
+
 class HTTPError extends Error {
   responseCode: number;
 
@@ -366,6 +380,7 @@ export {
   checkSessionValidity,
   downloadTextFile,
   escapePathForUrl,
+  formatDateOnly,
   formatDateString,
   formatUnixTimestamp,
   formatFileSize,

From e6b39d9891591c8532873e0943c7671a94c70a7b Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Fri, 3 Jul 2026 15:44:59 -0400
Subject: [PATCH 43/89] Show repository names as text with tooltips

Render Repository column values as non-link text in app table views and show tooltips for truncated repository names.

Co-authored-by: Codex <codex@openai.com>
---
 .../src/components/ui/Table/catalogColumns.tsx    |  4 +++-
 .../src/components/ui/Table/myAppsColumns.tsx     | 15 ++++-----------
 2 files changed, 7 insertions(+), 12 deletions(-)

diff --git a/frontend/src/components/ui/Table/catalogColumns.tsx b/frontend/src/components/ui/Table/catalogColumns.tsx
index c6080516..b171cef1 100644
--- a/frontend/src/components/ui/Table/catalogColumns.tsx
+++ b/frontend/src/components/ui/Table/catalogColumns.tsx
@@ -32,7 +32,9 @@ export function createCatalogColumns(
               onContextMenu?.(e, { value });
             }}
           >
-            <span className="truncate min-w-0 text-sm">{value}</span>
+            <FgTooltip label={value} triggerClasses="max-w-full truncate">
+              <span className="truncate text-sm">{value}</span>
+            </FgTooltip>
           </div>
         );
       },
diff --git a/frontend/src/components/ui/Table/myAppsColumns.tsx b/frontend/src/components/ui/Table/myAppsColumns.tsx
index 62891038..47543ac0 100644
--- a/frontend/src/components/ui/Table/myAppsColumns.tsx
+++ b/frontend/src/components/ui/Table/myAppsColumns.tsx
@@ -1,7 +1,6 @@
 import type { MouseEvent } from 'react';
 import type { ColumnDef } from '@tanstack/react-table';
 
-import FgExternalLink from '@/components/designSystem/atoms/FgExternalLink';
 import FgIcon from '@/components/designSystem/atoms/FgIcon';
 import FgLink from '@/components/designSystem/atoms/FgLink';
 import CardActionsMenu from '@/components/ui/Menus/CardActionsMenu';
@@ -62,7 +61,7 @@ export function createMyAppsColumns(actions: AppActions): ColumnDef<UserApp>[] {
       id: 'repository',
       accessorFn: row => repoLabel(row.url),
       header: 'Repository',
-      cell: ({ getValue, row, table }) => {
+      cell: ({ getValue, table }) => {
         const value = getValue() as string;
         const onContextMenu = table.options.meta?.onCellContextMenu;
         return (
@@ -73,15 +72,9 @@ export function createMyAppsColumns(actions: AppActions): ColumnDef<UserApp>[] {
               onContextMenu?.(e, { value });
             }}
           >
-            {/* No icon: the inline-flex icon layout defeats text truncation */}
-            <FgExternalLink
-              className="truncate min-w-0"
-              href={row.original.url}
-              showIcon={false}
-              size="sm"
-            >
-              {value}
-            </FgExternalLink>
+            <FgTooltip label={value} triggerClasses="max-w-full truncate">
+              <span className="truncate text-sm">{value}</span>
+            </FgTooltip>
           </div>
         );
       },

From b4d93081bc85d89e7077f1328a44e03b6e7f0789 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Fri, 3 Jul 2026 16:00:29 -0400
Subject: [PATCH 44/89] Link app manifest paths to GitHub files

Show full runnables.yaml manifest paths in app detail metadata, link them to the corresponding GitHub file at the correct revision, and keep metadata links at the same text size as surrounding rows.

Co-authored-by: Codex <codex@openai.com>
---
 .../src/__tests__/unitTests/appUrls.test.ts   | 20 ++++++
 .../components/ui/AppsPage/AppInfoTable.tsx   | 47 +++++++++++---
 .../ui/AppsPage/ListingInfoTable.tsx          | 65 +++++++++----------
 frontend/src/utils/appUrls.ts                 | 29 +++++++++
 frontend/src/utils/index.ts                   |  1 +
 5 files changed, 120 insertions(+), 42 deletions(-)

diff --git a/frontend/src/__tests__/unitTests/appUrls.test.ts b/frontend/src/__tests__/unitTests/appUrls.test.ts
index 0ee8a138..f270f479 100644
--- a/frontend/src/__tests__/unitTests/appUrls.test.ts
+++ b/frontend/src/__tests__/unitTests/appUrls.test.ts
@@ -4,6 +4,7 @@ import {
   buildAppDetailPath,
   buildAppUrl,
   buildLaunchPath,
+  buildGithubFileUrl,
   buildRelaunchPath,
   canonicalGithubUrl,
   isGithubRepoUrl,
@@ -88,6 +89,25 @@ describe('app URL helpers', () => {
     );
   });
 
+  test('builds GitHub file URLs using explicit or URL revisions', () => {
+    expect(
+      buildGithubFileUrl(
+        'https://github.com/org/tool/tree/feature/my-tool',
+        undefined,
+        './apps/demo/runnables.yaml'
+      )
+    ).toBe(
+      'https://github.com/org/tool/blob/feature/my-tool/apps/demo/runnables.yaml'
+    );
+    expect(
+      buildGithubFileUrl(
+        'https://github.com/org/tool',
+        'abc123',
+        'runnables.yaml'
+      )
+    ).toBe('https://github.com/org/tool/blob/abc123/runnables.yaml');
+  });
+
   test('builds detail paths, omitting the default branch and empty manifest path', () => {
     expect(buildAppDetailPath('https://github.com/org/tool', '')).toBe(
       '/apps/detail/org/tool'
diff --git a/frontend/src/components/ui/AppsPage/AppInfoTable.tsx b/frontend/src/components/ui/AppsPage/AppInfoTable.tsx
index 514e7d3d..4d219677 100644
--- a/frontend/src/components/ui/AppsPage/AppInfoTable.tsx
+++ b/frontend/src/components/ui/AppsPage/AppInfoTable.tsx
@@ -7,15 +7,30 @@ import { formatDateString } from '@/utils';
 import {
   appRevision,
   buildGithubCommitUrl,
+  buildGithubFileUrl,
   canonicalGithubUrl
 } from '@/utils/appUrls';
 
 const labelClass =
   'text-foreground font-medium pr-4 py-1.5 align-top whitespace-nowrap';
 const valueClass = 'text-foreground py-1.5';
+const MANIFEST_FILENAME = 'runnables.yaml';
 
-function manifestPathLabel(path: string): string {
-  return path || 'Repository root';
+function manifestPathInfo(path: string): { filePath: string; label: string } {
+  const normalized = path
+    .trim()
+    .replace(/^\.?\//, '')
+    .replace(/\/+$/, '');
+
+  const filePath =
+    !normalized || normalized === '.'
+      ? MANIFEST_FILENAME
+      : normalized === MANIFEST_FILENAME ||
+          normalized.endsWith(`/${MANIFEST_FILENAME}`)
+        ? normalized
+        : `${normalized}/${MANIFEST_FILENAME}`;
+
+  return { filePath, label: `./${filePath}` };
 }
 
 function InfoRow({
@@ -42,20 +57,26 @@ function CommitValue({
 }) {
   if (href) {
     return (
-      <FgExternalLink className="break-all text-xs font-mono" href={href}>
+      <FgExternalLink className="break-all font-mono" href={href} size="sm">
         {sha}
       </FgExternalLink>
     );
   }
 
-  return <span className="break-all text-xs font-mono">{sha}</span>;
+  return <span className="break-all text-sm font-mono">{sha}</span>;
 }
 
 export default function AppInfoTable({ app }: { readonly app: UserApp }) {
   const revision = appRevision(app.url, app.branch);
+  const manifestPath = manifestPathInfo(app.manifest_path);
   const commitUrl = app.commit_sha
     ? buildGithubCommitUrl(app.url, app.commit_sha)
     : null;
+  const manifestUrl = buildGithubFileUrl(
+    app.url,
+    app.commit_sha ?? revision,
+    manifestPath.filePath
+  );
   const codeRepoUrl = app.manifest?.repo_url;
   const separateCodeRepoUrl =
     codeRepoUrl &&
@@ -75,7 +96,7 @@ export default function AppInfoTable({ app }: { readonly app: UserApp }) {
       <tbody>
         <InfoRow label="URL">
           <span className="py-1.5">
-            <FgExternalLink className="break-all" href={app.url}>
+            <FgExternalLink className="break-all" href={app.url} size="sm">
               {app.url}
             </FgExternalLink>
           </span>
@@ -86,7 +107,13 @@ export default function AppInfoTable({ app }: { readonly app: UserApp }) {
           </InfoRow>
         ) : null}
         <InfoRow label="Manifest path">
-          {manifestPathLabel(app.manifest_path)}
+          {manifestUrl ? (
+            <FgExternalLink className="break-all" href={manifestUrl} size="sm">
+              {manifestPath.label}
+            </FgExternalLink>
+          ) : (
+            manifestPath.label
+          )}
         </InfoRow>
         {app.commit_sha ? (
           <InfoRow label="App commit">
@@ -95,7 +122,11 @@ export default function AppInfoTable({ app }: { readonly app: UserApp }) {
         ) : null}
         {separateCodeRepoUrl ? (
           <InfoRow label="Code repo">
-            <FgExternalLink className="break-all" href={separateCodeRepoUrl}>
+            <FgExternalLink
+              className="break-all"
+              href={separateCodeRepoUrl}
+              size="sm"
+            >
               {separateCodeRepoUrl}
             </FgExternalLink>
           </InfoRow>
@@ -110,7 +141,7 @@ export default function AppInfoTable({ app }: { readonly app: UserApp }) {
         {app.listing_id ? (
           <InfoRow label="Catalog listing">
             <FgLink size="sm" to={`/apps/catalog/${app.listing_id}`}>
-              #{app.listing_id}
+              View catalog listing
             </FgLink>
           </InfoRow>
         ) : null}
diff --git a/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx b/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx
index ebf6e804..7420f0d4 100644
--- a/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx
+++ b/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx
@@ -6,16 +6,30 @@ import type { AppListing, UserApp } from '@/shared.types';
 import { formatDateString } from '@/utils';
 import {
   buildAppDetailPath,
-  buildGithubCommitUrl,
+  buildGithubFileUrl,
   parseGithubUrl
 } from '@/utils/appUrls';
 
 const labelClass =
   'text-foreground font-medium pr-4 py-1.5 align-top whitespace-nowrap';
 const valueClass = 'text-foreground py-1.5';
+const MANIFEST_FILENAME = 'runnables.yaml';
 
-function manifestPathLabel(path: string): string {
-  return path || 'Repository root';
+function manifestPathInfo(path: string): { filePath: string; label: string } {
+  const normalized = path
+    .trim()
+    .replace(/^\.?\//, '')
+    .replace(/\/+$/, '');
+
+  const filePath =
+    !normalized || normalized === '.'
+      ? MANIFEST_FILENAME
+      : normalized === MANIFEST_FILENAME ||
+          normalized.endsWith(`/${MANIFEST_FILENAME}`)
+        ? normalized
+        : `${normalized}/${MANIFEST_FILENAME}`;
+
+  return { filePath, label: `./${filePath}` };
 }
 
 function InfoRow({
@@ -33,24 +47,6 @@ function InfoRow({
   );
 }
 
-function CommitValue({
-  sha,
-  href
-}: {
-  readonly sha: string;
-  readonly href: string | null;
-}) {
-  if (href) {
-    return (
-      <FgExternalLink className="break-all text-xs font-mono" href={href}>
-        {sha}
-      </FgExternalLink>
-    );
-  }
-
-  return <span className="break-all text-xs font-mono">{sha}</span>;
-}
-
 /**
  * The revision actually cloned, parsed out of the canonical listing URL (which
  * always carries it). Falls back to the requested branch, then null.
@@ -75,16 +71,19 @@ export default function ListingInfoTable({
     ? formatDateString(listing.updated_at)
     : 'Not edited since publish';
   const revision = listingRevision(listing);
-  const installedCommitUrl = installedApp?.commit_sha
-    ? buildGithubCommitUrl(installedApp.url, installedApp.commit_sha)
-    : null;
+  const manifestPath = manifestPathInfo(listing.manifest_path);
+  const manifestUrl = buildGithubFileUrl(
+    listing.url,
+    revision,
+    manifestPath.filePath
+  );
 
   return (
     <table className="w-full text-sm mb-6">
       <tbody>
         <InfoRow label="URL">
           <span className="py-1.5">
-            <FgExternalLink className="break-all" href={listing.url}>
+            <FgExternalLink className="break-all" href={listing.url} size="sm">
               {listing.url}
             </FgExternalLink>
           </span>
@@ -95,7 +94,13 @@ export default function ListingInfoTable({
           </InfoRow>
         ) : null}
         <InfoRow label="Manifest path">
-          {manifestPathLabel(listing.manifest_path)}
+          {manifestUrl ? (
+            <FgExternalLink className="break-all" href={manifestUrl} size="sm">
+              {manifestPath.label}
+            </FgExternalLink>
+          ) : (
+            manifestPath.label
+          )}
         </InfoRow>
         <InfoRow label="Shared by">{listing.owner_username}</InfoRow>
         <InfoRow label="Published">{publishedAt}</InfoRow>
@@ -113,14 +118,6 @@ export default function ListingInfoTable({
             </FgLink>
           </InfoRow>
         ) : null}
-        {installedApp?.commit_sha ? (
-          <InfoRow label="Installed commit">
-            <CommitValue
-              href={installedCommitUrl}
-              sha={installedApp.commit_sha}
-            />
-          </InfoRow>
-        ) : null}
         {listing.description ? (
           <InfoRow label="Description">{listing.description}</InfoRow>
         ) : null}
diff --git a/frontend/src/utils/appUrls.ts b/frontend/src/utils/appUrls.ts
index 3bf16d19..584f2e19 100644
--- a/frontend/src/utils/appUrls.ts
+++ b/frontend/src/utils/appUrls.ts
@@ -123,6 +123,35 @@ export function buildGithubCommitUrl(
   }
 }
 
+/**
+ * GitHub link for a file in an app repo at a specific revision. Falls back to
+ * the revision encoded in the app URL when revision is not provided.
+ */
+export function buildGithubFileUrl(
+  appUrl: string,
+  revision: string | null | undefined,
+  filePath: string
+): string | null {
+  try {
+    const { owner, repo, branch } = parseGithubUrl(appUrl);
+    const ref = revision?.trim() || branch;
+    const normalizedPath = filePath
+      .trim()
+      .replace(/^\.?\//, '')
+      .replace(/^\/+/, '');
+    if (!ref || !normalizedPath) {
+      return null;
+    }
+    const encodedPath = normalizedPath
+      .split('/')
+      .map(segment => encodeURIComponent(segment))
+      .join('/');
+    return `https://github.com/${owner}/${repo}/blob/${ref}/${encodedPath}`;
+  } catch {
+    return null;
+  }
+}
+
 export function buildLaunchPath(
   owner: string,
   repo: string,
diff --git a/frontend/src/utils/index.ts b/frontend/src/utils/index.ts
index 760a57e5..32b7a637 100644
--- a/frontend/src/utils/index.ts
+++ b/frontend/src/utils/index.ts
@@ -414,6 +414,7 @@ export {
   canonicalGithubUrl,
   buildAppUrl,
   buildGithubCommitUrl,
+  buildGithubFileUrl,
   buildGithubUrl,
   buildLaunchPath,
   buildLaunchPathFromApp,

From 8eec21a86cb794f03fbf03fdeb3a52bc2fa5679f Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Fri, 3 Jul 2026 16:06:18 -0400
Subject: [PATCH 45/89] Align launch page header with app detail

Propagate the Shared badge to launch pages, move launch form actions into the app header, and show the GitHub URL beneath the selected entry point name.

Co-authored-by: Codex <codex@openai.com>
---
 frontend/src/components/AppLaunch.tsx         | 16 ++++++++-
 .../components/ui/AppsPage/AppLaunchForm.tsx  | 35 ++++++++++++++-----
 2 files changed, 42 insertions(+), 9 deletions(-)

diff --git a/frontend/src/components/AppLaunch.tsx b/frontend/src/components/AppLaunch.tsx
index 60c0083b..776b9a4b 100644
--- a/frontend/src/components/AppLaunch.tsx
+++ b/frontend/src/components/AppLaunch.tsx
@@ -12,6 +12,7 @@ import toast from 'react-hot-toast';
 
 import AppLaunchForm from '@/components/ui/AppsPage/AppLaunchForm';
 import AppPageHeader from '@/components/ui/AppsPage/AppPageHeader';
+import SharedBadge from '@/components/ui/AppsPage/SharedBadge';
 import {
   buildAppDetailPath,
   buildGithubUrl,
@@ -49,6 +50,8 @@ export default function AppLaunch() {
   const addAppMutation = useAddAppMutation();
   const [selectedEntryPoint, setSelectedEntryPoint] =
     useState<AppEntryPoint | null>(null);
+  const [launchActionsTarget, setLaunchActionsTarget] =
+    useState<HTMLDivElement | null>(null);
 
   const manifestPath = searchParams.get('path') || '';
   const branch = searchParams.get('branch') || routeBranch || 'main';
@@ -109,6 +112,8 @@ export default function AppLaunch() {
   // Prefer the user's saved app name (which may be a custom name chosen when
   // adding the app from the catalog) over the raw manifest name.
   const displayName = installedApp?.name ?? manifest?.name;
+  const isShared =
+    installedApp?.listing_id !== undefined && installedApp.listing_id !== null;
 
   // Auto-select entry point from URL param, or if there's only one
   useEffect(() => {
@@ -180,6 +185,11 @@ export default function AppLaunch() {
   return (
     <div>
       <AppPageHeader
+        actions={
+          manifest && selectedEntryPoint ? (
+            <div ref={setLaunchActionsTarget} />
+          ) : null
+        }
         backLabel={installedApp ? 'Back to app details' : 'Back to My Apps'}
         backTo={
           installedApp
@@ -188,7 +198,9 @@ export default function AppLaunch() {
         }
         icon={getAppIconType()}
         title={displayName}
-      />
+      >
+        {isShared ? <SharedBadge /> : null}
+      </AppPageHeader>
 
       {/* Not-installed banner */}
       {!appsQuery.isPending && !isInstalled ? (
@@ -243,6 +255,8 @@ export default function AppLaunch() {
       ) : manifest && selectedEntryPoint ? (
         <AppLaunchForm
           entryPoint={selectedEntryPoint}
+          githubUrl={appUrl}
+          headerActionsTarget={launchActionsTarget}
           initialContainer={relaunchContainer}
           initialContainerArgs={relaunchContainerArgs}
           initialEnv={relaunchEnv}
diff --git a/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx b/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
index 749a122a..82c1be3c 100644
--- a/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
+++ b/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
@@ -1,5 +1,6 @@
 import { useEffect, useRef, useState } from 'react';
 import type { Dispatch, SetStateAction } from 'react';
+import { createPortal } from 'react-dom';
 
 import { Accordion, Tabs, Typography } from '@material-tailwind/react';
 import toast from 'react-hot-toast';
@@ -11,8 +12,10 @@ import {
   HiOutlineTrash,
   HiOutlineUpload
 } from 'react-icons/hi';
+import { TbBrandGithub } from 'react-icons/tb';
 
 import FgButton from '@/components/designSystem/atoms/FgButton';
+import FgExternalLink from '@/components/designSystem/atoms/FgExternalLink';
 import FgIcon from '@/components/designSystem/atoms/FgIcon';
 import FileSelectorButton from '@/components/ui/FileSelector/FileSelectorButton';
 import FgSwitch from '@/components/ui/widgets/FgSwitch';
@@ -40,6 +43,8 @@ import type {
 
 interface AppLaunchFormProps {
   readonly entryPoint: AppEntryPoint;
+  readonly githubUrl: string;
+  readonly headerActionsTarget?: HTMLElement | null;
   readonly onSubmit: (
     parameters: Record<string, unknown>,
     envParameters: Record<string, unknown>,
@@ -732,6 +737,8 @@ function ClusterTabContent({
 
 export default function AppLaunchForm({
   entryPoint,
+  githubUrl,
+  headerActionsTarget,
   onSubmit,
   submitting,
   submitError,
@@ -1228,6 +1235,7 @@ export default function AppLaunchForm({
         className="!rounded-md whitespace-nowrap"
         icon={HiOutlineDownload}
         onClick={handleExport}
+        size="sm"
         variant="outline"
       >
         Export params
@@ -1236,6 +1244,7 @@ export default function AppLaunchForm({
         className="!rounded-md whitespace-nowrap"
         icon={HiOutlineUpload}
         onClick={() => fileInputRef.current?.click()}
+        size="sm"
         variant="outline"
       >
         Upload params file
@@ -1247,15 +1256,15 @@ export default function AppLaunchForm({
         loading={validating || submitting}
         loadingText={validating ? 'Validating...' : 'Submitting...'}
         onClick={handleSubmit}
+        size="sm"
       >
         {entryPoint.type === 'service' ? 'Start Service' : 'Submit Job'}
       </FgButton>
     </div>
   );
 
-  // Shown next to both the top and bottom submit buttons, so the user sees the
-  // error regardless of which button they used. Wording is direction-neutral
-  // since the same banner appears above and below the fields.
+  // Shown above the fields so errors stay near the header actions that submit
+  // the form.
   const submitErrorBanner = submitError ? (
     <div className="mt-2 mb-4 p-3 bg-error/10 rounded text-error text-sm">
       {submitError}
@@ -1270,6 +1279,9 @@ export default function AppLaunchForm({
 
   return (
     <div>
+      {headerActionsTarget
+        ? createPortal(actionButtons, headerActionsTarget)
+        : null}
       <input
         accept="application/json,.json"
         className="hidden"
@@ -1284,11 +1296,21 @@ export default function AppLaunchForm({
         ref={fileInputRef}
         type="file"
       />
-      <div className="flex items-start justify-between gap-4 mb-1">
+      <div className="mb-6">
         <Typography className="font-bold mb-1" type="h5">
           {entryPoint.name}
         </Typography>
-        {actionButtons}
+        <div className="flex items-center gap-1.5 text-foreground">
+          <FgIcon className="shrink-0" icon={TbBrandGithub} size="sm" />
+          <FgExternalLink
+            className="break-all"
+            href={githubUrl}
+            showIcon={false}
+            size="sm"
+          >
+            {githubUrl}
+          </FgExternalLink>
+        </div>
       </div>
       {/* Errors (top) */}
       {validationErrorBanner}
@@ -1489,9 +1511,6 @@ export default function AppLaunchForm({
       {/* Errors (bottom) */}
       {validationErrorBanner}
       {submitErrorBanner}
-
-      {/* Submit (bottom) */}
-      <div className="flex justify-end mt-6">{actionButtons}</div>
     </div>
   );
 }

From 2bd04d08a3d8ac1b0ebd44f213d70d2e4d584517 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Fri, 3 Jul 2026 16:07:54 -0400
Subject: [PATCH 46/89] Soften app card hover highlights

Use half-opacity hover backgrounds on My Apps and App Catalog cards so the hover state contrasts with the card header.

Co-authored-by: Codex <codex@openai.com>
---
 frontend/src/components/ui/AppsPage/AppCard.tsx     | 2 +-
 frontend/src/components/ui/AppsPage/ListingCard.tsx | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/frontend/src/components/ui/AppsPage/AppCard.tsx b/frontend/src/components/ui/AppsPage/AppCard.tsx
index 20570a9a..8b68d9ac 100644
--- a/frontend/src/components/ui/AppsPage/AppCard.tsx
+++ b/frontend/src/components/ui/AppsPage/AppCard.tsx
@@ -44,7 +44,7 @@ export default function AppCard({ app, actions }: AppCardProps) {
 
   return (
     <Card
-      className="p-0 flex flex-col text-left w-full dark:border-surface-light cursor-pointer transition-colors hover:bg-surface dark:hover:bg-surface-light"
+      className="p-0 flex flex-col text-left w-full dark:border-surface-light cursor-pointer transition-colors hover:bg-surface/50 dark:hover:bg-surface-light/20"
       onClick={handleView}
       onKeyDown={handleKeyDown}
       role="link"
diff --git a/frontend/src/components/ui/AppsPage/ListingCard.tsx b/frontend/src/components/ui/AppsPage/ListingCard.tsx
index 218c570b..5ae86c7a 100644
--- a/frontend/src/components/ui/AppsPage/ListingCard.tsx
+++ b/frontend/src/components/ui/AppsPage/ListingCard.tsx
@@ -52,7 +52,7 @@ export default function ListingCard({
 
   return (
     <Card
-      className="p-0 flex flex-col text-left w-full dark:border-surface-light cursor-pointer transition-colors hover:bg-surface dark:hover:bg-surface-light"
+      className="p-0 flex flex-col text-left w-full dark:border-surface-light cursor-pointer transition-colors hover:bg-surface/50 dark:hover:bg-surface-light/20"
       onClick={handleView}
       onKeyDown={handleKeyDown}
       role="link"

From a5666df8832b2d260750dd16d9dd3913d80f60c0 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Fri, 3 Jul 2026 16:11:43 -0400
Subject: [PATCH 47/89] Add unshare button to listing detail

Show a header-level Unshare button on owned App Catalog listing details, matching the app detail page, and remove the duplicate overflow-menu action there.

Co-authored-by: Codex <codex@openai.com>
---
 frontend/src/components/ListingDetail.tsx | 24 +++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/frontend/src/components/ListingDetail.tsx b/frontend/src/components/ListingDetail.tsx
index c9797040..790ff3be 100644
--- a/frontend/src/components/ListingDetail.tsx
+++ b/frontend/src/components/ListingDetail.tsx
@@ -3,6 +3,7 @@ import { useNavigate, useParams } from 'react-router';
 import { Typography } from '@material-tailwind/react';
 import { HiOutlinePlus } from 'react-icons/hi';
 import { HiOutlineEllipsisVertical } from 'react-icons/hi2';
+import { FaUsersSlash } from 'react-icons/fa6';
 
 import AppPageHeader from '@/components/ui/AppsPage/AppPageHeader';
 import EntryPointsList from '@/components/ui/AppsPage/EntryPointsList';
@@ -10,6 +11,7 @@ import ListingInfoTable from '@/components/ui/AppsPage/ListingInfoTable';
 import CardActionsMenu from '@/components/ui/Menus/CardActionsMenu';
 import type { MenuItem } from '@/components/ui/Menus/FgMenuItems';
 import FgButton from '@/components/designSystem/atoms/FgButton';
+import FgTooltip from '@/components/ui/widgets/FgTooltip';
 import {
   useAppsQuery,
   useCatalogQuery,
@@ -91,18 +93,13 @@ export default function ListingDetail() {
     profile?.username !== undefined &&
     profile.username === listing.owner_username;
   const adding = actions.addingId === listing.id;
+  const unsharing = actions.unsharingId === listing.id;
 
   const menuItems: MenuItem<AppListing>[] = [
     {
       name: 'View in My Apps',
       action: () => installedApp && actions.viewInMyApps(installedApp),
       shouldShow: alreadyAdded
-    },
-    {
-      name: 'Unshare',
-      action: l => void actions.unshare(l),
-      color: 'text-error',
-      shouldShow: canManage
     }
   ];
   const hasMenuItems = menuItems.some(item => item.shouldShow !== false);
@@ -125,6 +122,21 @@ export default function ListingDetail() {
                 Add to my apps
               </FgButton>
             ) : null}
+            {canManage ? (
+              <FgTooltip label="Unshare from catalog">
+                <FgButton
+                  disabled={unsharing}
+                  icon={FaUsersSlash}
+                  loading={unsharing}
+                  loadingText="Unsharing..."
+                  onClick={() => void actions.unshare(listing)}
+                  size="sm"
+                  variant="outline"
+                >
+                  Unshare
+                </FgButton>
+              </FgTooltip>
+            ) : null}
             {hasMenuItems ? (
               <CardActionsMenu<AppListing>
                 actionProps={listing}

From 97d50ae37d56987a66d1aa2d7c2c3c06be5218f0 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Fri, 3 Jul 2026 16:45:36 -0400
Subject: [PATCH 48/89] Allow editing catalog listings after sharing

Listing owners can now change a listing's repository URL, revision,
name, and description via an Edit dialog, reachable from the listing
... menus (cards and table) and an Edit button on the detail page.

PATCH /api/catalog/{id} accepts a new url (revision baked in as
/tree/<rev>, like the add flow). When it differs from the stored URL,
the repo is cloned/scanned as the user and the edit is rejected unless
the listing's manifest path still exists there, so the catalog never
advertises an app that can't be added. Repointing onto a repo the owner
already lists returns a 409; metadata-only edits skip git entirely.

The duplicated manifestPathInfo helper moved from the two info tables
into utils/appUrls so the dialog can show the full runnables.yaml path.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 fileglancer/database.py                       |  24 +-
 fileglancer/model.py                          |   9 +
 fileglancer/server.py                         |  41 +++-
 frontend/src/components/Catalog.tsx           |   3 +
 frontend/src/components/ListingDetail.tsx     |  46 ++--
 .../components/ui/AppsPage/AppInfoTable.tsx   |  21 +-
 .../ui/AppsPage/EditListingDialog.tsx         | 219 ++++++++++++++++++
 .../ui/AppsPage/ListingActionDialogs.tsx      |  22 ++
 .../ui/AppsPage/ListingInfoTable.tsx          |  19 +-
 .../ui/AppsPage/listingMenuItems.ts           |   5 +
 frontend/src/hooks/useListingActions.ts       |  38 ++-
 frontend/src/queries/appsQueries.ts           |   9 +-
 frontend/src/utils/appUrls.ts                 |  27 +++
 frontend/src/utils/index.ts                   |   3 +-
 tests/test_catalog_endpoints.py               | 123 ++++++++++
 15 files changed, 545 insertions(+), 64 deletions(-)
 create mode 100644 frontend/src/components/ui/AppsPage/EditListingDialog.tsx
 create mode 100644 frontend/src/components/ui/AppsPage/ListingActionDialogs.tsx

diff --git a/fileglancer/database.py b/fileglancer/database.py
index 882d783d..ccb26571 100644
--- a/fileglancer/database.py
+++ b/fileglancer/database.py
@@ -1247,15 +1247,35 @@ def create_app_listing(session: Session, owner_username: str, url: str,
 
 def update_app_listing(session: Session, listing_id: int, owner_username: str, *,
                        name: Optional[str] = None,
-                       description: Optional[str] = None) -> Optional[AppListingDB]:
+                       description: Optional[str] = None,
+                       url: Optional[str] = None,
+                       branch: Optional[str] = None) -> Optional[AppListingDB]:
     """Update an existing listing's editable metadata. Returns the listing, or
-    None if it doesn't exist or isn't owned by owner_username."""
+    None if it doesn't exist or isn't owned by owner_username.
+
+    url repoints the listing (the caller has already validated that the new
+    repo/revision still contains the listing's manifest path); branch is the
+    requested revision that goes with it and is only applied alongside url.
+    Raises ValueError if the new url collides with another listing by the
+    same owner (unique on owner/url/manifest_path)."""
     listing = session.query(AppListingDB).filter_by(
         id=listing_id,
         owner_username=owner_username,
     ).first()
     if listing is None:
         return None
+    if url is not None:
+        url = canonical_github_url(url)
+        duplicate = session.query(AppListingDB).filter(
+            AppListingDB.owner_username == owner_username,
+            AppListingDB.url == url,
+            AppListingDB.manifest_path == listing.manifest_path,
+            AppListingDB.id != listing_id,
+        ).first()
+        if duplicate is not None:
+            raise ValueError("You already have another listing for this app")
+        listing.url = url
+        listing.branch = branch
     if name is not None:
         listing.name = name
     if description is not None:
diff --git a/fileglancer/model.py b/fileglancer/model.py
index d39c718d..7dfb0872 100644
--- a/fileglancer/model.py
+++ b/fileglancer/model.py
@@ -762,6 +762,15 @@ def validate_name(cls, v):
 
 class UpdateAppListingRequest(BaseModel):
     """Request to update a listing's editable metadata"""
+    url: Optional[str] = Field(
+        description=(
+            "New GitHub URL for the listing, optionally carrying a revision "
+            "as /tree/<rev> (same form the add flow uses). When it differs "
+            "from the stored URL, the repo is cloned and the listing's "
+            "manifest path must still exist there."
+        ),
+        default=None,
+    )
     name: Optional[str] = Field(description="New display name", default=None)
     description: Optional[str] = Field(description="New description", default=None)
 
diff --git a/fileglancer/server.py b/fileglancer/server.py
index 508e5aad..4e79ecd0 100644
--- a/fileglancer/server.py
+++ b/fileglancer/server.py
@@ -2133,10 +2133,43 @@ async def update_catalog_listing(listing_id: int,
                                      body: UpdateAppListingRequest,
                                      username: str = Depends(get_current_user)):
         with db.get_db_session(settings.db_url) as session:
-            listing = db.update_app_listing(
-                session, listing_id, username,
-                name=body.name, description=body.description,
-            )
+            existing = db.get_app_listing(session, listing_id)
+            if existing is None or existing.owner_username != username:
+                raise HTTPException(status_code=404, detail="Listing not found")
+            current_url = existing.url
+            manifest_path = existing.manifest_path
+
+        # Repointing the listing at a different repo/revision: clone/scan it
+        # as the user (outside any DB session — this can take a while) and
+        # require the listing's manifest path to still exist there, so the
+        # catalog never advertises an app that can't be added.
+        new_url = None
+        new_branch = None
+        if body.url is not None and canonical_github_url(body.url) != current_url:
+            resolved_branch, _, canonical_url, discovered = await _discover_repo_manifests(
+                body.url, username)
+            found_paths = [p for p, _ in discovered]
+            if manifest_path not in found_paths:
+                locations = ", ".join(f"'{p}'" if p else "the repository root"
+                                      for p in found_paths)
+                raise HTTPException(
+                    status_code=400,
+                    detail=f"No app manifest found at '{manifest_path or '(root)'}' "
+                           f"in that repository/revision. Manifests were found at: "
+                           f"{locations}.",
+                )
+            new_url = canonical_url
+            _, new_branch = apps_module.canonical_app_url(body.url, resolved_branch)
+
+        with db.get_db_session(settings.db_url) as session:
+            try:
+                listing = db.update_app_listing(
+                    session, listing_id, username,
+                    name=body.name, description=body.description,
+                    url=new_url, branch=new_branch,
+                )
+            except ValueError as e:
+                raise HTTPException(status_code=409, detail=str(e))
             if listing is None:
                 raise HTTPException(status_code=404, detail="Listing not found")
             return _listing_to_model(listing)
diff --git a/frontend/src/components/Catalog.tsx b/frontend/src/components/Catalog.tsx
index 2a88e2ee..2d58c340 100644
--- a/frontend/src/components/Catalog.tsx
+++ b/frontend/src/components/Catalog.tsx
@@ -1,6 +1,7 @@
 import { useMemo, useState } from 'react';
 import { Typography } from '@material-tailwind/react';
 
+import ListingActionDialogs from '@/components/ui/AppsPage/ListingActionDialogs';
 import ListingCard from '@/components/ui/AppsPage/ListingCard';
 import FgCheckbox from '@/components/designSystem/atoms/formElements/FgCheckbox';
 import { TableCard } from '@/components/ui/Table/TableCard';
@@ -143,6 +144,8 @@ export default function Catalog() {
           })}
         </div>
       )}
+
+      <ListingActionDialogs actions={actions} />
     </div>
   );
 }
diff --git a/frontend/src/components/ListingDetail.tsx b/frontend/src/components/ListingDetail.tsx
index 790ff3be..2a9c4ba2 100644
--- a/frontend/src/components/ListingDetail.tsx
+++ b/frontend/src/components/ListingDetail.tsx
@@ -2,11 +2,15 @@ import { useEffect } from 'react';
 import { useNavigate, useParams } from 'react-router';
 import { Typography } from '@material-tailwind/react';
 import { HiOutlinePlus } from 'react-icons/hi';
-import { HiOutlineEllipsisVertical } from 'react-icons/hi2';
+import {
+  HiOutlineEllipsisVertical,
+  HiOutlinePencilSquare
+} from 'react-icons/hi2';
 import { FaUsersSlash } from 'react-icons/fa6';
 
 import AppPageHeader from '@/components/ui/AppsPage/AppPageHeader';
 import EntryPointsList from '@/components/ui/AppsPage/EntryPointsList';
+import ListingActionDialogs from '@/components/ui/AppsPage/ListingActionDialogs';
 import ListingInfoTable from '@/components/ui/AppsPage/ListingInfoTable';
 import CardActionsMenu from '@/components/ui/Menus/CardActionsMenu';
 import type { MenuItem } from '@/components/ui/Menus/FgMenuItems';
@@ -123,19 +127,31 @@ export default function ListingDetail() {
               </FgButton>
             ) : null}
             {canManage ? (
-              <FgTooltip label="Unshare from catalog">
-                <FgButton
-                  disabled={unsharing}
-                  icon={FaUsersSlash}
-                  loading={unsharing}
-                  loadingText="Unsharing..."
-                  onClick={() => void actions.unshare(listing)}
-                  size="sm"
-                  variant="outline"
-                >
-                  Unshare
-                </FgButton>
-              </FgTooltip>
+              <>
+                <FgTooltip label="Edit this listing">
+                  <FgButton
+                    icon={HiOutlinePencilSquare}
+                    onClick={() => actions.requestEdit(listing)}
+                    size="sm"
+                    variant="outline"
+                  >
+                    Edit
+                  </FgButton>
+                </FgTooltip>
+                <FgTooltip label="Unshare from catalog">
+                  <FgButton
+                    disabled={unsharing}
+                    icon={FaUsersSlash}
+                    loading={unsharing}
+                    loadingText="Unsharing..."
+                    onClick={() => void actions.unshare(listing)}
+                    size="sm"
+                    variant="outline"
+                  >
+                    Unshare
+                  </FgButton>
+                </FgTooltip>
+              </>
             ) : null}
             {hasMenuItems ? (
               <CardActionsMenu<AppListing>
@@ -178,6 +194,8 @@ export default function ListingDetail() {
           />
         )}
       </div>
+
+      <ListingActionDialogs actions={actions} />
     </div>
   );
 }
diff --git a/frontend/src/components/ui/AppsPage/AppInfoTable.tsx b/frontend/src/components/ui/AppsPage/AppInfoTable.tsx
index 4d219677..315dbcf2 100644
--- a/frontend/src/components/ui/AppsPage/AppInfoTable.tsx
+++ b/frontend/src/components/ui/AppsPage/AppInfoTable.tsx
@@ -8,30 +8,13 @@ import {
   appRevision,
   buildGithubCommitUrl,
   buildGithubFileUrl,
-  canonicalGithubUrl
+  canonicalGithubUrl,
+  manifestPathInfo
 } from '@/utils/appUrls';
 
 const labelClass =
   'text-foreground font-medium pr-4 py-1.5 align-top whitespace-nowrap';
 const valueClass = 'text-foreground py-1.5';
-const MANIFEST_FILENAME = 'runnables.yaml';
-
-function manifestPathInfo(path: string): { filePath: string; label: string } {
-  const normalized = path
-    .trim()
-    .replace(/^\.?\//, '')
-    .replace(/\/+$/, '');
-
-  const filePath =
-    !normalized || normalized === '.'
-      ? MANIFEST_FILENAME
-      : normalized === MANIFEST_FILENAME ||
-          normalized.endsWith(`/${MANIFEST_FILENAME}`)
-        ? normalized
-        : `${normalized}/${MANIFEST_FILENAME}`;
-
-  return { filePath, label: `./${filePath}` };
-}
 
 function InfoRow({
   label,
diff --git a/frontend/src/components/ui/AppsPage/EditListingDialog.tsx b/frontend/src/components/ui/AppsPage/EditListingDialog.tsx
new file mode 100644
index 00000000..ecaf4b0e
--- /dev/null
+++ b/frontend/src/components/ui/AppsPage/EditListingDialog.tsx
@@ -0,0 +1,219 @@
+import { useEffect, useState } from 'react';
+import { Typography } from '@material-tailwind/react';
+import { HiOutlinePencilSquare } from 'react-icons/hi2';
+
+import FgDialog from '@/components/ui/Dialogs/FgDialog';
+import FgButton from '@/components/designSystem/atoms/FgButton';
+import FgFormField from '@/components/designSystem/molecules/FgFormField';
+import FgInput from '@/components/designSystem/atoms/formElements/FgInput';
+import FgTextarea from '@/components/designSystem/atoms/formElements/FgTextarea';
+import {
+  appRevision,
+  buildAppUrl,
+  buildGithubUrl,
+  isGithubRepoUrl,
+  manifestPathInfo,
+  parseGithubUrl
+} from '@/utils';
+import type { AppListing } from '@/shared.types';
+
+interface EditListingDialogProps {
+  readonly listing: AppListing | null;
+  readonly open: boolean;
+  readonly onClose: () => void;
+  readonly onSave: (params: {
+    listing_id: number;
+    url: string;
+    name: string;
+    description: string;
+  }) => Promise<void>;
+  readonly saving: boolean;
+}
+
+/** The listing URL split into a bare repo URL and its revision, for editing. */
+function splitListingUrl(listing: AppListing): {
+  repoUrl: string;
+  revision: string;
+} {
+  try {
+    const { owner, repo } = parseGithubUrl(listing.url);
+    return {
+      repoUrl: buildGithubUrl(owner, repo, 'main'),
+      revision: appRevision(listing.url, listing.branch) ?? ''
+    };
+  } catch {
+    return { repoUrl: listing.url, revision: listing.branch ?? '' };
+  }
+}
+
+export default function EditListingDialog({
+  listing,
+  open,
+  onClose,
+  onSave,
+  saving
+}: EditListingDialogProps) {
+  const [repoUrl, setRepoUrl] = useState('');
+  const [revision, setRevision] = useState('');
+  const [name, setName] = useState('');
+  const [description, setDescription] = useState('');
+  const [urlError, setUrlError] = useState('');
+  const [saveError, setSaveError] = useState('');
+
+  // Prefill from the listing each time the dialog is (re)opened.
+  useEffect(() => {
+    if (open && listing) {
+      const { repoUrl: url, revision: rev } = splitListingUrl(listing);
+      setRepoUrl(url);
+      setRevision(rev);
+      setName(listing.name);
+      setDescription(listing.description ?? '');
+      setUrlError('');
+      setSaveError('');
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [open]);
+
+  const urlIsValid = repoUrl.trim() !== '' && isGithubRepoUrl(repoUrl);
+
+  // Whether the edit repoints the listing (as opposed to a metadata-only
+  // change), so the user knows a slower validation step is coming.
+  let newUrl: string | null = null;
+  try {
+    newUrl = buildAppUrl(repoUrl, revision);
+  } catch {
+    newUrl = null;
+  }
+  const urlChanged =
+    listing !== null && newUrl !== null && newUrl !== listing.url;
+
+  const handleSave = async () => {
+    if (!listing) {
+      return;
+    }
+    if (!urlIsValid || newUrl === null) {
+      setUrlError('Please enter a valid GitHub repository URL (HTTPS or SSH)');
+      return;
+    }
+    if (!name.trim()) {
+      setSaveError('Name is required');
+      return;
+    }
+    try {
+      await onSave({
+        listing_id: listing.id,
+        url: newUrl,
+        name: name.trim(),
+        description: description.trim()
+      });
+      onClose();
+    } catch (e) {
+      setSaveError(e instanceof Error ? e.message : 'Failed to update listing');
+    }
+  };
+
+  // Not linked to GitHub like on the detail page: the revision (and thus the
+  // link target) may be about to change.
+  const manifestLabel = listing
+    ? manifestPathInfo(listing.manifest_path).label
+    : '';
+
+  return (
+    <FgDialog className="max-w-2xl" onClose={onClose} open={open}>
+      <Typography className="text-foreground font-bold mb-4 pr-8" type="h6">
+        Edit Listing
+      </Typography>
+      <Typography className="mb-4 text-foreground text-sm">
+        Changing the repository or revision re-validates that the app manifest{' '}
+        <code>{manifestLabel}</code> still exists there.
+      </Typography>
+
+      <FgFormField
+        error={urlError || undefined}
+        htmlFor="edit-listing-url"
+        label="GitHub Repository URL"
+      >
+        <FgInput
+          onChange={e => {
+            setRepoUrl(e.target.value);
+            setUrlError('');
+            setSaveError('');
+          }}
+          placeholder="https://github.com/org/repo or git@github.com:org/repo.git"
+          type="text"
+          value={repoUrl}
+        />
+      </FgFormField>
+
+      <FgFormField
+        helperText="Tag or branch name"
+        htmlFor="edit-listing-revision"
+        label="Revision"
+        optional
+      >
+        <FgInput
+          onChange={e => {
+            setRevision(e.target.value);
+            setSaveError('');
+          }}
+          placeholder="main"
+          type="text"
+          value={revision}
+        />
+      </FgFormField>
+
+      <FgFormField htmlFor="edit-listing-name" label="Name">
+        <FgInput
+          onChange={e => {
+            setName(e.target.value);
+            setSaveError('');
+          }}
+          type="text"
+          value={name}
+        />
+      </FgFormField>
+
+      <FgFormField
+        className="mb-2"
+        htmlFor="edit-listing-description"
+        label="Description"
+        optional
+      >
+        <FgTextarea
+          onChange={e => setDescription(e.target.value)}
+          rows={3}
+          value={description}
+        />
+      </FgFormField>
+
+      {urlChanged ? (
+        <Typography className="mb-3 text-foreground text-sm">
+          The new repository and revision will be checked before saving. Users
+          who have already added this app will keep their current copies; only
+          users who add it from now on will get it from the new location.
+        </Typography>
+      ) : null}
+
+      {saveError ? (
+        <Typography className="text-error mb-3" type="small">
+          {saveError}
+        </Typography>
+      ) : null}
+
+      <div className="flex gap-3">
+        <FgButton
+          disabled={!urlIsValid || !name.trim() || saving}
+          icon={HiOutlinePencilSquare}
+          loading={saving}
+          loadingText={urlChanged ? 'Validating repository...' : 'Saving...'}
+          onClick={handleSave}
+        >
+          Save
+        </FgButton>
+        <FgButton onClick={onClose} variant="ghost">
+          Cancel
+        </FgButton>
+      </div>
+    </FgDialog>
+  );
+}
diff --git a/frontend/src/components/ui/AppsPage/ListingActionDialogs.tsx b/frontend/src/components/ui/AppsPage/ListingActionDialogs.tsx
new file mode 100644
index 00000000..16109038
--- /dev/null
+++ b/frontend/src/components/ui/AppsPage/ListingActionDialogs.tsx
@@ -0,0 +1,22 @@
+import EditListingDialog from '@/components/ui/AppsPage/EditListingDialog';
+import type { ListingActions } from '@/hooks/useListingActions';
+
+/**
+ * The dialogs backing the two-step listing actions from `useListingActions`.
+ * Render once per page that uses the hook.
+ */
+export default function ListingActionDialogs({
+  actions
+}: {
+  readonly actions: ListingActions;
+}) {
+  return (
+    <EditListingDialog
+      listing={actions.editTarget}
+      onClose={actions.closeEdit}
+      onSave={actions.saveEdit}
+      open={actions.editTarget !== null}
+      saving={actions.saving}
+    />
+  );
+}
diff --git a/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx b/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx
index 7420f0d4..1551969c 100644
--- a/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx
+++ b/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx
@@ -7,30 +7,13 @@ import { formatDateString } from '@/utils';
 import {
   buildAppDetailPath,
   buildGithubFileUrl,
+  manifestPathInfo,
   parseGithubUrl
 } from '@/utils/appUrls';
 
 const labelClass =
   'text-foreground font-medium pr-4 py-1.5 align-top whitespace-nowrap';
 const valueClass = 'text-foreground py-1.5';
-const MANIFEST_FILENAME = 'runnables.yaml';
-
-function manifestPathInfo(path: string): { filePath: string; label: string } {
-  const normalized = path
-    .trim()
-    .replace(/^\.?\//, '')
-    .replace(/\/+$/, '');
-
-  const filePath =
-    !normalized || normalized === '.'
-      ? MANIFEST_FILENAME
-      : normalized === MANIFEST_FILENAME ||
-          normalized.endsWith(`/${MANIFEST_FILENAME}`)
-        ? normalized
-        : `${normalized}/${MANIFEST_FILENAME}`;
-
-  return { filePath, label: `./${filePath}` };
-}
 
 function InfoRow({
   label,
diff --git a/frontend/src/components/ui/AppsPage/listingMenuItems.ts b/frontend/src/components/ui/AppsPage/listingMenuItems.ts
index 41a3dcaf..7c4ec749 100644
--- a/frontend/src/components/ui/AppsPage/listingMenuItems.ts
+++ b/frontend/src/components/ui/AppsPage/listingMenuItems.ts
@@ -25,6 +25,11 @@ export function buildListingMenuItems(
       action: () => installedApp && actions.viewInMyApps(installedApp),
       shouldShow: alreadyAdded
     },
+    {
+      name: 'Edit',
+      action: l => actions.requestEdit(l),
+      shouldShow: canManage
+    },
     {
       name: 'Unshare',
       action: l => void actions.unshare(l),
diff --git a/frontend/src/hooks/useListingActions.ts b/frontend/src/hooks/useListingActions.ts
index a5cb8201..f6a714c4 100644
--- a/frontend/src/hooks/useListingActions.ts
+++ b/frontend/src/hooks/useListingActions.ts
@@ -1,9 +1,11 @@
+import { useState } from 'react';
 import { useNavigate } from 'react-router';
 import toast from 'react-hot-toast';
 
 import {
   useAddFromListingMutation,
-  useUnshareListingMutation
+  useUnshareListingMutation,
+  useUpdateListingMutation
 } from '@/queries/appsQueries';
 import { buildAppDetailPath } from '@/utils';
 import { showErrorToast } from '@/utils/errorToast';
@@ -18,6 +20,16 @@ export interface ListingActions {
   viewInMyApps: (app: UserApp) => void;
   add: (listing: AppListing) => Promise<void>;
   unshare: (listing: AppListing) => Promise<void>;
+  saveEdit: (params: {
+    listing_id: number;
+    url: string;
+    name: string;
+    description: string;
+  }) => Promise<void>;
+  requestEdit: (listing: AppListing) => void;
+  editTarget: AppListing | null;
+  closeEdit: () => void;
+  saving: boolean;
   /** Listing id the add/unshare mutation is currently running for, if any. */
   addingId: number | null;
   unsharingId: number | null;
@@ -25,15 +37,19 @@ export interface ListingActions {
 
 /**
  * Navigation and mutation handlers for the actions offered on a catalog
- * listing (view details, add to my apps, unshare), shared by the catalog
- * cards and the listing detail page.
+ * listing (view details, add to my apps, edit, unshare), shared by the
+ * catalog cards and the listing detail page. Edit is a two-step flow:
+ * `requestEdit` sets a target listing whose dialog is rendered by
+ * `ListingActionDialogs`.
  */
 export function useListingActions(opts?: {
   onUnshared?: () => void;
 }): ListingActions {
   const navigate = useNavigate();
+  const [editTarget, setEditTarget] = useState<AppListing | null>(null);
   const addFromListingMutation = useAddFromListingMutation();
   const unshareListingMutation = useUnshareListingMutation();
+  const updateListingMutation = useUpdateListingMutation();
 
   const view = (listing: AppListing) => {
     navigate(buildListingDetailPath(listing.id));
@@ -62,11 +78,27 @@ export function useListingActions(opts?: {
     }
   };
 
+  // Errors intentionally propagate so EditListingDialog can show them inline.
+  const saveEdit = async (params: {
+    listing_id: number;
+    url: string;
+    name: string;
+    description: string;
+  }) => {
+    await updateListingMutation.mutateAsync(params);
+    toast.success('Listing updated');
+  };
+
   return {
     view,
     viewInMyApps,
     add,
     unshare,
+    saveEdit,
+    requestEdit: setEditTarget,
+    editTarget,
+    closeEdit: () => setEditTarget(null),
+    saving: updateListingMutation.isPending,
     addingId: addFromListingMutation.isPending
       ? (addFromListingMutation.variables?.listing_id ?? null)
       : null,
diff --git a/frontend/src/queries/appsQueries.ts b/frontend/src/queries/appsQueries.ts
index 33768cbd..96ff9f24 100644
--- a/frontend/src/queries/appsQueries.ts
+++ b/frontend/src/queries/appsQueries.ts
@@ -302,15 +302,15 @@ export function useShareAppMutation(): UseMutationResult<
 export function useUpdateListingMutation(): UseMutationResult<
   AppListing,
   Error,
-  { listing_id: number; name?: string; description?: string }
+  { listing_id: number; url?: string; name?: string; description?: string }
 > {
   const queryClient = useQueryClient();
   return useMutation({
-    mutationFn: async ({ listing_id, name, description }) => {
+    mutationFn: async ({ listing_id, url, name, description }) => {
       const response = await sendFetchRequest(
         `/api/catalog/${listing_id}`,
         'PATCH',
-        { name, description }
+        { url, name, description }
       );
       const data = await getResponseJsonOrError(response);
       if (!response.ok) {
@@ -320,6 +320,9 @@ export function useUpdateListingMutation(): UseMutationResult<
     },
     onSuccess: () => {
       queryClient.invalidateQueries({ queryKey: catalogQueryKeys.all });
+      // A url change can (un)link the listing from the owner's installed
+      // copy, which is surfaced via listing_id on /api/apps.
+      queryClient.invalidateQueries({ queryKey: appsQueryKeys.all });
     }
   });
 }
diff --git a/frontend/src/utils/appUrls.ts b/frontend/src/utils/appUrls.ts
index 584f2e19..7b3d0e11 100644
--- a/frontend/src/utils/appUrls.ts
+++ b/frontend/src/utils/appUrls.ts
@@ -123,6 +123,33 @@ export function buildGithubCommitUrl(
   }
 }
 
+const MANIFEST_FILENAME = 'runnables.yaml';
+
+/**
+ * The repo-relative file path and "./"-prefixed display label of an app's
+ * runnables.yaml, given the manifest path stored on an app or listing (a
+ * directory path, "" for the repo root).
+ */
+export function manifestPathInfo(path: string): {
+  filePath: string;
+  label: string;
+} {
+  const normalized = path
+    .trim()
+    .replace(/^\.?\//, '')
+    .replace(/\/+$/, '');
+
+  const filePath =
+    !normalized || normalized === '.'
+      ? MANIFEST_FILENAME
+      : normalized === MANIFEST_FILENAME ||
+          normalized.endsWith(`/${MANIFEST_FILENAME}`)
+        ? normalized
+        : `${normalized}/${MANIFEST_FILENAME}`;
+
+  return { filePath, label: `./${filePath}` };
+}
+
 /**
  * GitHub link for a file in an app repo at a specific revision. Falls back to
  * the revision encoded in the app URL when revision is not provided.
diff --git a/frontend/src/utils/index.ts b/frontend/src/utils/index.ts
index 32b7a637..9ee0f82d 100644
--- a/frontend/src/utils/index.ts
+++ b/frontend/src/utils/index.ts
@@ -419,7 +419,8 @@ export {
   buildLaunchPath,
   buildLaunchPathFromApp,
   buildAppDetailPath,
-  buildRelaunchPath
+  buildRelaunchPath,
+  manifestPathInfo
 } from './appUrls';
 
 // Re-export app icon utilities
diff --git a/tests/test_catalog_endpoints.py b/tests/test_catalog_endpoints.py
index cdaf3185..ca00d85a 100644
--- a/tests/test_catalog_endpoints.py
+++ b/tests/test_catalog_endpoints.py
@@ -309,6 +309,129 @@ def test_update_listing(client_factory, db_session):
     assert body["description"] == "New desc"
 
 
+def test_update_listing_metadata_only_skips_git(client_factory, db_session):
+    """A name/description edit (no url in the request) must not touch git."""
+    listing = _seed_listing(db_session, owner_username=OWNER)
+    client = client_factory(OWNER)
+    with patch(
+        "fileglancer.apps.discover_app_manifests",
+        new=AsyncMock(),
+    ) as mock_discover:
+        response = client.patch(
+            f"/api/catalog/{listing.id}",
+            json={"name": "Renamed"},
+        )
+    assert response.status_code == 200
+    mock_discover.assert_not_awaited()
+
+
+def test_update_listing_same_url_skips_validation(client_factory, db_session):
+    """Sending the listing's current URL back unchanged is a metadata edit."""
+    listing = _seed_listing(db_session, owner_username=OWNER)
+    client = client_factory(OWNER)
+    with patch(
+        "fileglancer.apps.discover_app_manifests",
+        new=AsyncMock(),
+    ) as mock_discover:
+        response = client.patch(
+            f"/api/catalog/{listing.id}",
+            json={"url": "https://github.com/owner/repo", "name": "Renamed"},
+        )
+    assert response.status_code == 200
+    assert response.json()["name"] == "Renamed"
+    mock_discover.assert_not_awaited()
+
+
+def test_update_listing_url_revalidates_manifest(client_factory, db_session):
+    """Changing the URL/revision clones the new repo as the user, checks the
+    manifest path, and stores the canonical URL + requested revision."""
+    listing = _seed_listing(db_session, owner_username=OWNER, branch="main")
+    client = client_factory(OWNER)
+    with patch(
+        "fileglancer.apps.discover_app_manifests",
+        new=AsyncMock(return_value=("v2", TEST_SHA, [("", _make_manifest())])),
+    ) as mock_discover:
+        response = client.patch(
+            f"/api/catalog/{listing.id}",
+            json={"url": "https://github.com/owner/repo/tree/v2"},
+        )
+    assert response.status_code == 200
+    mock_discover.assert_awaited_once_with(
+        "https://github.com/owner/repo/tree/v2", username=OWNER)
+    body = response.json()
+    assert body["url"] == "https://github.com/owner/repo/tree/v2"
+    assert body["branch"] == "v2"
+    db_session.expire_all()
+    row = db_session.query(AppListingDB).filter_by(id=listing.id).one()
+    assert row.url == "https://github.com/owner/repo/tree/v2"
+    assert row.branch == "v2"
+
+
+def test_update_listing_url_rejects_missing_manifest_path(
+    client_factory, db_session
+):
+    """The new repo/revision must still contain the listing's manifest path."""
+    listing = _seed_listing(
+        db_session, owner_username=OWNER, manifest_path="apps/foo")
+    client = client_factory(OWNER)
+    with patch(
+        "fileglancer.apps.discover_app_manifests",
+        new=AsyncMock(
+            return_value=("main", TEST_SHA, [("apps/bar", _make_manifest())])
+        ),
+    ):
+        response = client.patch(
+            f"/api/catalog/{listing.id}",
+            json={"url": "https://github.com/owner/other-repo"},
+        )
+    assert response.status_code == 400
+    assert "apps/foo" in response.json()["error"]
+    assert "apps/bar" in response.json()["error"]
+    db_session.expire_all()
+    row = db_session.query(AppListingDB).filter_by(id=listing.id).one()
+    assert row.url == "https://github.com/owner/repo"
+
+
+def test_update_listing_url_rejects_duplicate(client_factory, db_session):
+    """Repointing a listing onto a repo the owner already lists is a 409."""
+    _seed_listing(db_session, owner_username=OWNER,
+                  url="https://github.com/owner/target")
+    listing = _seed_listing(db_session, owner_username=OWNER,
+                            url="https://github.com/owner/source")
+    client = client_factory(OWNER)
+    with patch(
+        "fileglancer.apps.discover_app_manifests",
+        new=AsyncMock(return_value=("main", TEST_SHA, [("", _make_manifest())])),
+    ):
+        response = client.patch(
+            f"/api/catalog/{listing.id}",
+            json={"url": "https://github.com/owner/target"},
+        )
+    assert response.status_code == 409
+    db_session.expire_all()
+    row = db_session.query(AppListingDB).filter_by(id=listing.id).one()
+    assert row.url == "https://github.com/owner/source"
+
+
+def test_update_listing_url_surfaces_clone_failure(client_factory, db_session):
+    """A repo that can't be cloned (bad URL, missing revision) fails the edit."""
+    listing = _seed_listing(db_session, owner_username=OWNER)
+    client = client_factory(OWNER)
+    with patch(
+        "fileglancer.apps.discover_app_manifests",
+        new=AsyncMock(side_effect=ValueError("Revision 'v9' was not found")),
+    ):
+        response = client.patch(
+            f"/api/catalog/{listing.id}",
+            json={"url": "https://github.com/owner/repo/tree/v9"},
+        )
+    assert response.status_code == 404
+    assert "not found" in response.json()["error"]
+    db_session.expire_all()
+    row = db_session.query(AppListingDB).filter_by(id=listing.id).one()
+    assert row.url == "https://github.com/owner/repo"
+
+
 def test_update_listing_rejects_non_owner(client_factory, db_session):
     listing = _seed_listing(db_session, owner_username=OWNER)
     client = client_factory(ADOPTER)

From d4c84b3fd5b9cde9f63237a47ac4ee19c170b7b8 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Fri, 3 Jul 2026 16:46:53 -0400
Subject: [PATCH 49/89] Normalize app detail metadata typography

Use regular text for commit values, add GitHub icons to detail URL rows, and keep My Apps and App Catalog metadata value fonts consistent.

Co-authored-by: Codex <codex@openai.com>
---
 .../components/ui/AppsPage/AppInfoTable.tsx   | 28 ++++++++++++++-----
 .../ui/AppsPage/ListingInfoTable.tsx          | 24 ++++++++++++----
 2 files changed, 40 insertions(+), 12 deletions(-)

diff --git a/frontend/src/components/ui/AppsPage/AppInfoTable.tsx b/frontend/src/components/ui/AppsPage/AppInfoTable.tsx
index 315dbcf2..3aae1709 100644
--- a/frontend/src/components/ui/AppsPage/AppInfoTable.tsx
+++ b/frontend/src/components/ui/AppsPage/AppInfoTable.tsx
@@ -1,6 +1,8 @@
 import type { ReactNode } from 'react';
+import { TbBrandGithub } from 'react-icons/tb';
 
 import FgExternalLink from '@/components/designSystem/atoms/FgExternalLink';
+import FgIcon from '@/components/designSystem/atoms/FgIcon';
 import FgLink from '@/components/designSystem/atoms/FgLink';
 import type { UserApp } from '@/shared.types';
 import { formatDateString } from '@/utils';
@@ -40,13 +42,29 @@ function CommitValue({
 }) {
   if (href) {
     return (
-      <FgExternalLink className="break-all font-mono" href={href} size="sm">
+      <FgExternalLink className="break-all" href={href} size="sm">
         {sha}
       </FgExternalLink>
     );
   }
 
-  return <span className="break-all text-sm font-mono">{sha}</span>;
+  return <span className="break-all text-sm">{sha}</span>;
+}
+
+function GithubUrlValue({ url }: { readonly url: string }) {
+  return (
+    <div className="flex items-center gap-1.5 text-foreground">
+      <FgIcon className="shrink-0" icon={TbBrandGithub} size="sm" />
+      <FgExternalLink
+        className="break-all"
+        href={url}
+        showIcon={false}
+        size="sm"
+      >
+        {url}
+      </FgExternalLink>
+    </div>
+  );
 }
 
 export default function AppInfoTable({ app }: { readonly app: UserApp }) {
@@ -78,11 +96,7 @@ export default function AppInfoTable({ app }: { readonly app: UserApp }) {
     <table className="w-full text-sm mb-6">
       <tbody>
         <InfoRow label="URL">
-          <span className="py-1.5">
-            <FgExternalLink className="break-all" href={app.url} size="sm">
-              {app.url}
-            </FgExternalLink>
-          </span>
+          <GithubUrlValue url={app.url} />
         </InfoRow>
         {revision ? (
           <InfoRow label="Revision">
diff --git a/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx b/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx
index 1551969c..5d1a0583 100644
--- a/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx
+++ b/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx
@@ -1,6 +1,8 @@
 import type { ReactNode } from 'react';
+import { TbBrandGithub } from 'react-icons/tb';
 
 import FgExternalLink from '@/components/designSystem/atoms/FgExternalLink';
+import FgIcon from '@/components/designSystem/atoms/FgIcon';
 import FgLink from '@/components/designSystem/atoms/FgLink';
 import type { AppListing, UserApp } from '@/shared.types';
 import { formatDateString } from '@/utils';
@@ -30,6 +32,22 @@ function InfoRow({
   );
 }
 
+function GithubUrlValue({ url }: { readonly url: string }) {
+  return (
+    <div className="flex items-center gap-1.5 text-foreground">
+      <FgIcon className="shrink-0" icon={TbBrandGithub} size="sm" />
+      <FgExternalLink
+        className="break-all"
+        href={url}
+        showIcon={false}
+        size="sm"
+      >
+        {url}
+      </FgExternalLink>
+    </div>
+  );
+}
+
 /**
  * The revision actually cloned, parsed out of the canonical listing URL (which
  * always carries it). Falls back to the requested branch, then null.
@@ -65,11 +83,7 @@ export default function ListingInfoTable({
     <table className="w-full text-sm mb-6">
       <tbody>
         <InfoRow label="URL">
-          <span className="py-1.5">
-            <FgExternalLink className="break-all" href={listing.url} size="sm">
-              {listing.url}
-            </FgExternalLink>
-          </span>
+          <GithubUrlValue url={listing.url} />
         </InfoRow>
         {revision ? (
           <InfoRow label="Revision">

From 5ef94869bfad6e73302ae136a826d01e064872a0 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Fri, 3 Jul 2026 17:33:46 -0400
Subject: [PATCH 50/89] Align app launch and job headers

Co-authored-by: Codex <codex@openai.com>
---
 frontend/src/components/AppLaunch.tsx         | 16 ++++-
 frontend/src/components/JobDetail.tsx         | 20 +++++-
 .../components/ui/AppsPage/AppLaunchForm.tsx  | 23 -------
 .../components/ui/AppsPage/AppPageHeader.tsx  | 68 +++++++++++++------
 4 files changed, 79 insertions(+), 48 deletions(-)

diff --git a/frontend/src/components/AppLaunch.tsx b/frontend/src/components/AppLaunch.tsx
index 776b9a4b..60aabfd0 100644
--- a/frontend/src/components/AppLaunch.tsx
+++ b/frontend/src/components/AppLaunch.tsx
@@ -17,6 +17,7 @@ import {
   buildAppDetailPath,
   buildGithubUrl,
   canonicalGithubUrl,
+  getEntryPointTypeIconType,
   getAppIconType
 } from '@/utils';
 import { showErrorToast } from '@/utils/errorToast';
@@ -112,6 +113,10 @@ export default function AppLaunch() {
   // Prefer the user's saved app name (which may be a custom name chosen when
   // adding the app from the catalog) over the raw manifest name.
   const displayName = installedApp?.name ?? manifest?.name;
+  const headerTitle =
+    displayName && selectedEntryPoint
+      ? `${displayName} - ${selectedEntryPoint.name}`
+      : displayName;
   const isShared =
     installedApp?.listing_id !== undefined && installedApp.listing_id !== null;
 
@@ -196,8 +201,14 @@ export default function AppLaunch() {
             ? buildAppDetailPath(installedApp.url, installedApp.manifest_path)
             : '/apps'
         }
-        icon={getAppIconType()}
-        title={displayName}
+        description={selectedEntryPoint?.description ?? null}
+        githubUrl={selectedEntryPoint ? appUrl : null}
+        icon={
+          selectedEntryPoint
+            ? getEntryPointTypeIconType(selectedEntryPoint.type)
+            : getAppIconType()
+        }
+        title={headerTitle}
       >
         {isShared ? <SharedBadge /> : null}
       </AppPageHeader>
@@ -255,7 +266,6 @@ export default function AppLaunch() {
       ) : manifest && selectedEntryPoint ? (
         <AppLaunchForm
           entryPoint={selectedEntryPoint}
-          githubUrl={appUrl}
           headerActionsTarget={launchActionsTarget}
           initialContainer={relaunchContainer}
           initialContainerArgs={relaunchContainerArgs}
diff --git a/frontend/src/components/JobDetail.tsx b/frontend/src/components/JobDetail.tsx
index ef2c394a..1948aaa8 100644
--- a/frontend/src/components/JobDetail.tsx
+++ b/frontend/src/components/JobDetail.tsx
@@ -55,6 +55,7 @@ import {
   useJobFileQuery,
   useCancelJobMutation
 } from '@/queries/jobsQueries';
+import { useManifestPreviewMutation } from '@/queries/appsQueries';
 import FgExternalLink from './designSystem/atoms/FgExternalLink';
 
 /** Drop null/undefined values so they aren't shown or persisted as parameters. */
@@ -501,6 +502,7 @@ export default function JobDetail() {
     activeTab === 'stderr' || activeTab === 'overview'
   );
   const cancelMutation = useCancelJobMutation();
+  const jobManifestMutation = useManifestPreviewMutation();
 
   const isService = jobQuery.data?.entry_point_type === 'service';
   const isActive = jobStatus === 'PENDING' || jobStatus === 'RUNNING';
@@ -519,6 +521,20 @@ export default function JobDetail() {
   }, []);
 
   const job = jobQuery.data;
+  const jobEntryPoint = jobManifestMutation.data?.runnables.find(
+    ep => ep.id === job?.entry_point_id
+  );
+
+  useEffect(() => {
+    if (job?.app_url) {
+      jobManifestMutation.mutate({
+        url: job.app_url,
+        manifest_path: job.manifest_path || ''
+      });
+    }
+    // Re-fetch when the job's app identity changes.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [job?.app_url, job?.manifest_path]);
 
   // Download the full set of parameters used for this job (all three tabs of
   // the launch form) as a JSON file that can be re-uploaded to relaunch.
@@ -658,8 +674,10 @@ export default function JobDetail() {
             }
             backLabel="Back to Jobs"
             backTo="/apps/jobs"
+            description={jobEntryPoint?.description ?? null}
+            githubUrl={job.app_url}
             icon={getEntryPointTypeIconType(job.entry_point_type)}
-            title={`${job.app_name} — ${job.entry_point_name}`}
+            title={`${job.app_name} - ${job.entry_point_name}`}
           >
             <JobStatusBadge status={job.status} />
           </AppPageHeader>
diff --git a/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx b/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
index 82c1be3c..db932b50 100644
--- a/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
+++ b/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
@@ -12,10 +12,8 @@ import {
   HiOutlineTrash,
   HiOutlineUpload
 } from 'react-icons/hi';
-import { TbBrandGithub } from 'react-icons/tb';
 
 import FgButton from '@/components/designSystem/atoms/FgButton';
-import FgExternalLink from '@/components/designSystem/atoms/FgExternalLink';
 import FgIcon from '@/components/designSystem/atoms/FgIcon';
 import FileSelectorButton from '@/components/ui/FileSelector/FileSelectorButton';
 import FgSwitch from '@/components/ui/widgets/FgSwitch';
@@ -43,7 +41,6 @@ import type {
 
 interface AppLaunchFormProps {
   readonly entryPoint: AppEntryPoint;
-  readonly githubUrl: string;
   readonly headerActionsTarget?: HTMLElement | null;
   readonly onSubmit: (
     parameters: Record<string, unknown>,
@@ -737,7 +734,6 @@ function ClusterTabContent({
 
 export default function AppLaunchForm({
   entryPoint,
-  githubUrl,
   headerActionsTarget,
   onSubmit,
   submitting,
@@ -1296,28 +1292,9 @@ export default function AppLaunchForm({
         ref={fileInputRef}
         type="file"
       />
-      <div className="mb-6">
-        <Typography className="font-bold mb-1" type="h5">
-          {entryPoint.name}
-        </Typography>
-        <div className="flex items-center gap-1.5 text-foreground">
-          <FgIcon className="shrink-0" icon={TbBrandGithub} size="sm" />
-          <FgExternalLink
-            className="break-all"
-            href={githubUrl}
-            showIcon={false}
-            size="sm"
-          >
-            {githubUrl}
-          </FgExternalLink>
-        </div>
-      </div>
       {/* Errors (top) */}
       {validationErrorBanner}
       {submitErrorBanner}
-      {entryPoint.description ? (
-        <Typography className="block mb-6">{entryPoint.description}</Typography>
-      ) : null}
 
       {/* Tabs */}
       <Tabs onValueChange={setActiveTab} value={activeTab}>
diff --git a/frontend/src/components/ui/AppsPage/AppPageHeader.tsx b/frontend/src/components/ui/AppsPage/AppPageHeader.tsx
index f9255306..00717816 100644
--- a/frontend/src/components/ui/AppsPage/AppPageHeader.tsx
+++ b/frontend/src/components/ui/AppsPage/AppPageHeader.tsx
@@ -2,14 +2,18 @@ import type { ReactNode } from 'react';
 import { useNavigate } from 'react-router';
 import { IconButton, Typography } from '@material-tailwind/react';
 import { HiOutlineArrowLeft } from 'react-icons/hi';
+import { TbBrandGithub } from 'react-icons/tb';
 import type { IconType } from 'react-icons';
 
+import FgExternalLink from '@/components/designSystem/atoms/FgExternalLink';
 import FgIcon from '@/components/designSystem/atoms/FgIcon';
 import FgTooltip from '@/components/ui/widgets/FgTooltip';
 
 interface AppPageHeaderProps {
   readonly title?: string;
   readonly icon?: IconType;
+  readonly description?: string | null;
+  readonly githubUrl?: string | null;
   readonly backTo?: string;
   readonly backLabel?: string;
   readonly actions?: ReactNode;
@@ -24,6 +28,8 @@ interface AppPageHeaderProps {
 export default function AppPageHeader({
   title,
   icon,
+  description,
+  githubUrl,
   backTo = '/apps',
   backLabel = 'Back to My Apps',
   actions,
@@ -32,29 +38,49 @@ export default function AppPageHeader({
   const navigate = useNavigate();
 
   return (
-    <div className="mb-6 flex items-center justify-between gap-3">
-      <div className="flex items-center gap-2 min-w-0">
-        <FgTooltip label={backLabel}>
-          <IconButton
-            aria-label={backLabel}
-            className="text-foreground hover:text-primary flex-shrink-0"
-            onClick={() => navigate(backTo)}
-            size="sm"
-            variant="ghost"
-          >
-            <FgIcon icon={HiOutlineArrowLeft} />
-          </IconButton>
-        </FgTooltip>
-        {icon ? (
-          <FgIcon className="text-foreground flex-shrink-0" icon={icon} />
+    <div className="mb-6">
+      <div className="flex items-center justify-between gap-3 pb-5">
+        <div className="flex items-center gap-2 min-w-0">
+          <FgTooltip label={backLabel}>
+            <IconButton
+              aria-label={backLabel}
+              className="text-foreground hover:text-primary flex-shrink-0"
+              onClick={() => navigate(backTo)}
+              size="sm"
+              variant="ghost"
+            >
+              <FgIcon icon={HiOutlineArrowLeft} />
+            </IconButton>
+          </FgTooltip>
+          {icon ? (
+            <FgIcon className="text-foreground flex-shrink-0" icon={icon} />
+          ) : null}
+          <Typography className="text-foreground font-bold truncate" type="h6">
+            {title}
+          </Typography>
+          {children}
+        </div>
+        {actions ? (
+          <div className="flex items-center gap-2 flex-shrink-0">{actions}</div>
         ) : null}
-        <Typography className="text-foreground font-bold truncate" type="h6">
-          {title}
-        </Typography>
-        {children}
       </div>
-      {actions ? (
-        <div className="flex items-center gap-2 flex-shrink-0">{actions}</div>
+      {description ? (
+        <Typography className="text-foreground" type="small">
+          {description}
+        </Typography>
+      ) : null}
+      {githubUrl ? (
+        <div className="mt-3 flex items-center gap-1.5 text-foreground">
+          <FgIcon className="shrink-0" icon={TbBrandGithub} size="sm" />
+          <FgExternalLink
+            className="break-all"
+            href={githubUrl}
+            showIcon={false}
+            size="sm"
+          >
+            {githubUrl}
+          </FgExternalLink>
+        </div>
       ) : null}
     </div>
   );

From 97548a82a3d97cf40e6671b51e31f5546ee89022 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 08:43:43 -0400
Subject: [PATCH 51/89] Strip Fileglancer secrets from per-user worker
 environment

Worker subprocesses run as the (untrusted) target user, so anything in
their environment is readable via /proc/<pid>/environ. The spawn code only
dropped FGC_DB_URL, leaving every other fgc_-prefixed secret (session
secret key, Okta client secret, Atlassian token, ...) exposed to any user
who can launch an app. Strip all FGC_* variables while preserving PATH,
HOME, locale, SSH, and scheduler vars so git and cluster tools still work.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 fileglancer/worker_pool.py | 42 +++++++++++++++++++++++++----------
 tests/test_worker.py       | 45 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 76 insertions(+), 11 deletions(-)

diff --git a/fileglancer/worker_pool.py b/fileglancer/worker_pool.py
index abb5117f..0f166fcc 100644
--- a/fileglancer/worker_pool.py
+++ b/fileglancer/worker_pool.py
@@ -49,6 +49,30 @@
 _MAX_MESSAGE_SIZE = 64 * 1024 * 1024  # 64 MB safety limit
 
 
+def _build_worker_env(base_env: dict, home_dir: str, log_level: str,
+                      child_fd: int) -> dict:
+    """Build the environment for a worker subprocess.
+
+    Workers run as the (untrusted) target user, so anything in their
+    environment is readable by that user via /proc/<pid>/environ. Every
+    Fileglancer setting is exposed through the ``fgc_`` env prefix (see
+    Settings), so we strip *all* ``FGC_*`` variables — the session secret key,
+    Okta client secret, Atlassian token, DB URL, etc. — rather than an
+    ad-hoc denylist that would miss newly-added secrets. The worker receives
+    its config over the IPC socket instead (DB access via RpcDbProxy), plus the
+    two operational vars set below.
+
+    Non-``FGC_`` variables (PATH, HOME, locale, SSH, and scheduler vars such as
+    LSF_*) are preserved so git, ssh, and the cluster tools still function; an
+    allowlist would risk silently dropping scheduler env the submit host needs.
+    """
+    env = {k: v for k, v in base_env.items() if not k.upper().startswith("FGC_")}
+    env["HOME"] = home_dir
+    env["FGC_LOG_LEVEL"] = log_level
+    env["FGC_WORKER_FD"] = str(child_fd)
+    return env
+
+
 class WorkerError(Exception):
     """Raised when a worker returns an error response."""
     def __init__(self, message: str, status_code: int = 500):
@@ -351,17 +375,13 @@ async def _spawn_worker(self, username: str) -> UserWorker:
         # Create Unix socketpair for IPC
         parent_sock, child_sock = socket.socketpair()
 
-        # Worker subprocess deliberately does NOT receive the DB URL — it
-        # runs as the (untrusted) target user, so credentials would be
-        # readable via /proc/<pid>/environ. All DB queries reverse-RPC back
-        # to the parent over the IPC socket instead.
-        env = {
-            **os.environ,
-            "HOME": home_dir,
-            "FGC_LOG_LEVEL": self.settings.log_level,
-            "FGC_WORKER_FD": str(child_sock.fileno()),
-        }
-        env.pop("FGC_DB_URL", None)
+        # Worker subprocess deliberately does NOT receive any Fileglancer
+        # secrets (DB URL, session secret key, Okta client secret, Atlassian
+        # token, ...) — it runs as the (untrusted) target user, so they would
+        # be readable via /proc/<pid>/environ. See _build_worker_env.
+        env = _build_worker_env(
+            os.environ, home_dir, self.settings.log_level, child_sock.fileno()
+        )
 
         logger.info(
             f"Spawning persistent worker for {username} "
diff --git a/tests/test_worker.py b/tests/test_worker.py
index f301dd21..90fc0a7f 100644
--- a/tests/test_worker.py
+++ b/tests/test_worker.py
@@ -41,6 +41,7 @@
     WorkerPool,
     WorkerError,
     WorkerDead,
+    _build_worker_env,
 )
 
 
@@ -48,6 +49,50 @@
 # IPC protocol tests (user_worker.py _send/_recv/_send_with_fd)
 # ---------------------------------------------------------------------------
 
+class TestBuildWorkerEnv:
+    """Worker environment must not carry Fileglancer secrets to the user."""
+
+    def test_strips_all_fgc_variables(self):
+        base = {
+            "PATH": "/usr/bin",
+            "FGC_DB_URL": "postgresql://admin:pw@db/fg",
+            "FGC_SESSION_SECRET_KEY": "super-secret",
+            "FGC_OKTA_CLIENT_SECRET": "okta-secret",
+            "FGC_ATLASSIAN_TOKEN": "atlassian-secret",
+            "fgc_test_api_key": "lowercase-secret",
+        }
+        env = _build_worker_env(base, "/home/user", "INFO", 7)
+        for key in list(env):
+            assert not key.upper().startswith("FGC_") or key in (
+                "FGC_LOG_LEVEL",
+                "FGC_WORKER_FD",
+            ), f"secret leaked: {key}"
+        # The specific secrets are gone regardless of case.
+        assert "FGC_DB_URL" not in env
+        assert "FGC_SESSION_SECRET_KEY" not in env
+        assert "FGC_OKTA_CLIENT_SECRET" not in env
+        assert "FGC_ATLASSIAN_TOKEN" not in env
+        assert "fgc_test_api_key" not in env
+
+    def test_preserves_non_fgc_and_sets_operational_vars(self):
+        base = {
+            "PATH": "/usr/bin:/bin",
+            "LSF_ENVDIR": "/opt/lsf/conf",
+            "LANG": "en_US.UTF-8",
+            "SSH_AUTH_SOCK": "/tmp/ssh-agent.sock",
+        }
+        env = _build_worker_env(base, "/home/alice", "DEBUG", 9)
+        # Scheduler / git / locale vars survive so cluster tools keep working.
+        assert env["PATH"] == "/usr/bin:/bin"
+        assert env["LSF_ENVDIR"] == "/opt/lsf/conf"
+        assert env["LANG"] == "en_US.UTF-8"
+        assert env["SSH_AUTH_SOCK"] == "/tmp/ssh-agent.sock"
+        # Operational vars the worker needs are set explicitly.
+        assert env["HOME"] == "/home/alice"
+        assert env["FGC_LOG_LEVEL"] == "DEBUG"
+        assert env["FGC_WORKER_FD"] == "9"
+
+
 class TestIPCProtocol:
     """Test the length-prefixed JSON wire protocol."""
 

From 257ef53a7d9afb1fd77cff086c0e1f5b0d970164 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 08:46:57 -0400
Subject: [PATCH 52/89] Pin separate code repos at app add time, not first
 launch
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Apps whose manifest declares a separate repo_url only had their code repo
pinned lazily on first launch, so a user could add/review an app and later
launch code that moved upstream in between — and update-checks couldn't see
code drift until after the first launch. Resolve and store code_commit_sha
(materializing the snapshot) at both add and add-from-catalog time.

Best-effort: submit_job still backfills the pin at launch if the eager pin
fails, so a transient code-remote error never blocks adding the app.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 fileglancer/server.py        | 39 ++++++++++++++++++++++++++++++++++++
 tests/test_apps_endpoints.py | 39 ++++++++++++++++++++++++++++++++++++
 2 files changed, 78 insertions(+)

diff --git a/fileglancer/server.py b/fileglancer/server.py
index 4e79ecd0..265d60bf 100644
--- a/fileglancer/server.py
+++ b/fileglancer/server.py
@@ -1915,6 +1915,30 @@ async def add_user_app(body: AppAddRequest,
             except Exception as e:
                 logger.warning(f"Eager snapshot of {canonical_url}@{head_sha[:7]} failed: {e}")
 
+        # Pin each app's separate code repo (manifest repo_url) now, at add
+        # time, so a later launch can't silently run code that moved after the
+        # app was added/reviewed — and so update-checks can see code drift
+        # before the first launch. Best-effort: submit_job still backfills the
+        # code pin at launch if this fails (e.g. a transient network error),
+        # so a flaky code remote never blocks adding the app.
+        for app in new_apps:
+            repo_url = app.manifest.repo_url if app.manifest else None
+            if not repo_url or canonical_github_url(repo_url) == canonical_url:
+                continue
+            try:
+                _, code_sha = await apps_module.ensure_repo_snapshot(
+                    repo_url, pull=True, username=username)
+            except Exception as e:
+                logger.warning(
+                    f"Eager code-repo pin of {repo_url} for {canonical_url} "
+                    f"({app.manifest_path}) failed: {e}")
+                continue
+            with db.get_db_session(settings.db_url) as session:
+                db.set_user_app_pins(
+                    session, username, canonical_url, app.manifest_path,
+                    code_commit_sha=code_sha)
+            app.code_commit_sha = code_sha
+
         return new_apps
 
     @app.delete("/api/apps",
@@ -2224,6 +2248,20 @@ async def add_from_catalog(listing_id: int,
         except Exception as e:
             raise HTTPException(status_code=400, detail=f"Failed to fetch manifest: {str(e)}")
 
+        # Pin the manifest's separate code repo (repo_url) now, at add time, so
+        # a later launch can't silently run code that moved after the app was
+        # added. Best-effort: submit_job backfills this pin at launch if it
+        # fails here, so a flaky code remote never blocks adding the app.
+        code_sha = None
+        if manifest.repo_url and canonical_github_url(manifest.repo_url) != listing_url:
+            try:
+                _, code_sha = await apps_module.ensure_repo_snapshot(
+                    manifest.repo_url, pull=True, username=username)
+            except Exception as e:
+                logger.warning(
+                    f"Eager code-repo pin of {manifest.repo_url} for "
+                    f"{listing_url} ({listing_manifest_path}) failed: {e}")
+
         # The listing already carries the canonical URL (resolved revision baked
         # in) and the requested revision, so copy them straight over.
         with db.get_db_session(settings.db_url) as session:
@@ -2233,6 +2271,7 @@ async def add_from_catalog(listing_id: int,
                 name=listing_name, description=listing_description,
                 branch=listing_branch,
                 commit_sha=pinned_sha,
+                code_commit_sha=code_sha,
                 manifest=manifest.model_dump(mode="json"),
             )
             return UserApp(
diff --git a/tests/test_apps_endpoints.py b/tests/test_apps_endpoints.py
index 8bb9cbab..e15f1042 100644
--- a/tests/test_apps_endpoints.py
+++ b/tests/test_apps_endpoints.py
@@ -297,6 +297,45 @@ def test_add_app_persists_manifest_and_branch(test_client, db_session):
     assert rows[0].commit_sha == TEST_SHA
 
 
+def test_add_app_pins_separate_code_repo(test_client, db_session):
+    """A manifest with a separate repo_url gets its code repo pinned at add
+    time, so a later launch can't run code that moved after the app was added."""
+    manifest = AppManifest(
+        name="With Code Repo",
+        description="Demo",
+        repo_url="https://github.com/tools/code",
+        runnables=[AppEntryPoint(id="run", name="Run", command="echo hi")],
+    )
+
+    def _snapshot(url, *args, **kwargs):
+        if "tools/code" in url:
+            return (f"/tmp/snapshots/{TEST_SHA_2}", TEST_SHA_2)
+        return (f"/tmp/snapshots/{TEST_SHA}", TEST_SHA)
+
+    with patch("fileglancer.apps.discover_app_manifests",
+               new=AsyncMock(return_value=("main", TEST_SHA, [("", manifest)]))), \
+         patch("fileglancer.apps.ensure_repo_snapshot",
+               new=AsyncMock(side_effect=_snapshot)) as mock_snapshot:
+        response = test_client.post(
+            "/api/apps",
+            json={"url": "https://github.com/owner/repo"},
+        )
+
+    assert response.status_code == 200
+    body = response.json()
+    assert body[0]["code_commit_sha"] == TEST_SHA_2
+
+    # Two snapshots: the app repo (pinned tip) and the separate code repo.
+    assert mock_snapshot.await_count == 2
+    code_call = mock_snapshot.await_args_list[1]
+    assert code_call.args == ("https://github.com/tools/code",)
+    assert code_call.kwargs == {"pull": True, "username": TEST_USERNAME}
+
+    rows = list_user_apps(db_session, TEST_USERNAME)
+    assert rows[0].commit_sha == TEST_SHA
+    assert rows[0].code_commit_sha == TEST_SHA_2
+
+
 def test_add_app_bakes_resolved_default_into_url(test_client, db_session):
     """A bare URL for a repo whose default is 'master' stores '/tree/master', so
     it dedups against an explicit '/tree/master' add. branch stays "" (unpinned)."""

From 0e30bcaa48ce10ce6450a9b934a03e4d99509a00 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 08:50:56 -0400
Subject: [PATCH 53/89] Tokenize scheduler extra_args and allow LSF resource
 strings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

extra_args were broken two ways for real cluster use:

- _build_resource_spec wrapped the whole string as a single argv element,
  so "-P proj -W 60" reached the scheduler as one malformed argument.
  Submitting the launch form (which pre-fills from cluster.extra_args) could
  silently break a working config default.
- validate_extra_args rejected the shell metacharacters '<' and '>', which
  LSF -R resource strings require ("select[mem>8000]") — the exact form the
  UI placeholder suggests.

cluster_api runs bsub via exec (argv, no shell), so metacharacters in a
token can't inject. shlex.split the string into tokens, drop the denylist
(keeping balanced-quote and NUL checks), and store via shlex.join so the
value round-trips through relaunch.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 fileglancer/apps/jobs.py |  9 ++++--
 fileglancer/model.py     | 16 ++++++++--
 tests/test_apps.py       | 65 ++++++++++++++++++++++++++++++----------
 3 files changed, 71 insertions(+), 19 deletions(-)

diff --git a/fileglancer/apps/jobs.py b/fileglancer/apps/jobs.py
index 01cd65cd..94703846 100644
--- a/fileglancer/apps/jobs.py
+++ b/fileglancer/apps/jobs.py
@@ -687,7 +687,7 @@ async def submit_job(
                 "memory": resource_spec.memory,
                 "walltime": resource_spec.walltime,
                 "queue": resource_spec.queue,
-                "extra_args": " ".join(resource_spec.extra_args) if resource_spec.extra_args else None,
+                "extra_args": shlex.join(resource_spec.extra_args) if resource_spec.extra_args else None,
             }.items()
             if v is not None
         }
@@ -973,7 +973,12 @@ def _build_resource_spec(entry_point: AppEntryPoint, overrides: Optional[dict],
         if overrides.get("queue") is not None:
             queue = overrides["queue"]
         if overrides.get("extra_args") is not None:
-            extra_args = [overrides["extra_args"]]
+            # The UI/preferences deliver extra_args as one string (e.g.
+            # '-P proj -R "select[mem>8000]"'); split into individual argv
+            # tokens so the scheduler receives distinct options rather than a
+            # single malformed argument. Quotes group tokens that contain
+            # spaces.
+            extra_args = shlex.split(overrides["extra_args"])
 
     return ResourceSpec(
         cpus=cpus,
diff --git a/fileglancer/model.py b/fileglancer/model.py
index 7dfb0872..11663de0 100644
--- a/fileglancer/model.py
+++ b/fileglancer/model.py
@@ -1,4 +1,5 @@
 import re
+import shlex
 from datetime import datetime
 from typing import Annotated, Any, List, Literal, Optional, Dict, Union
 
@@ -905,8 +906,19 @@ class JobSubmitRequest(BaseModel):
     @field_validator("extra_args")
     @classmethod
     def validate_extra_args(cls, v):
-        if v is not None and _SHELL_METACHAR_PATTERN.search(v):
-            raise ValueError(f"extra_args contains forbidden characters: {v!r}")
+        # extra_args are shlex-split into argv tokens and passed to the
+        # scheduler via exec (no shell — see cluster_api's bsub), so shell
+        # metacharacters are safe and in fact required: LSF resource strings
+        # like -R "select[mem>8000]" contain '>', '[' and ']'. Only require
+        # that the string parses into balanced tokens and carries no NUL.
+        if v is None:
+            return v
+        if "\x00" in v:
+            raise ValueError("extra_args must not contain NUL bytes")
+        try:
+            shlex.split(v)
+        except ValueError as e:
+            raise ValueError(f"extra_args could not be parsed into arguments: {e}")
         return v
 
     @field_validator("container")
diff --git a/tests/test_apps.py b/tests/test_apps.py
index 83ce1807..12cbe995 100644
--- a/tests/test_apps.py
+++ b/tests/test_apps.py
@@ -567,7 +567,9 @@ def test_bind_paths_rejects_metacharacters(self):
 
 
 class TestJobSubmitExtraArgsValidation:
-    """Validate that extra_args rejects shell metacharacters."""
+    """extra_args are shlex-split into argv tokens and exec'd (no shell) by the
+    scheduler, so shell metacharacters are safe; only unparseable strings and
+    NUL bytes are rejected."""
 
     _BASE = dict(
         app_url="https://github.com/org/repo",
@@ -583,21 +585,54 @@ def test_none_is_allowed(self):
         req = JobSubmitRequest(**self._BASE, extra_args=None)
         assert req.extra_args is None
 
-    def test_rejects_semicolon(self):
-        with pytest.raises(ValidationError, match="forbidden characters"):
-            JobSubmitRequest(**self._BASE, extra_args="--gres=gpu:1; rm -rf /")
-
-    def test_rejects_backtick(self):
-        with pytest.raises(ValidationError, match="forbidden characters"):
-            JobSubmitRequest(**self._BASE, extra_args="--gres=`whoami`")
-
-    def test_rejects_dollar(self):
-        with pytest.raises(ValidationError, match="forbidden characters"):
-            JobSubmitRequest(**self._BASE, extra_args="--queue=$USER")
+    def test_lsf_resource_string_allowed(self):
+        # The regression this fixes: LSF -R strings use '>', '[' and ']', which
+        # the old shell-metachar denylist wrongly rejected (and which the UI
+        # placeholder actually suggests).
+        req = JobSubmitRequest(
+            **self._BASE, extra_args='-P proj -R "select[mem>8000]"')
+        assert req.extra_args == '-P proj -R "select[mem>8000]"'
+
+    @pytest.mark.parametrize("value", [
+        "--gres=gpu:1; rm -rf /",
+        "--gres=`whoami`",
+        "--queue=$USER",
+        "--flag | cat /etc/passwd",
+    ])
+    def test_shell_metacharacters_allowed_as_literal_argv(self, value):
+        # These are safe now: shlex.split turns them into literal argv tokens
+        # passed to the scheduler via exec, so no shell interprets them.
+        req = JobSubmitRequest(**self._BASE, extra_args=value)
+        assert req.extra_args == value
+
+    def test_rejects_unbalanced_quotes(self):
+        with pytest.raises(ValidationError, match="could not be parsed"):
+            JobSubmitRequest(**self._BASE, extra_args='-R "unterminated')
+
+    def test_rejects_nul(self):
+        with pytest.raises(ValidationError, match="NUL"):
+            JobSubmitRequest(**self._BASE, extra_args="--flag\x00")
+
+
+class TestBuildResourceSpecExtraArgs:
+    """extra_args strings are tokenized (not wrapped as one argv element)."""
+
+    def _settings(self):
+        from fileglancer.settings import Settings
+        return Settings(db_url="sqlite://", file_share_mounts=[], cli_mode=True)
+
+    def test_string_is_split_into_tokens(self):
+        from fileglancer.apps.jobs import _build_resource_spec
+        ep = AppEntryPoint(id="t", name="T", command="echo")
+        spec = _build_resource_spec(
+            ep, {"extra_args": '-P proj -R "select[mem>8000]"'}, self._settings())
+        assert spec.extra_args == ["-P", "proj", "-R", "select[mem>8000]"]
 
-    def test_rejects_pipe(self):
-        with pytest.raises(ValidationError, match="forbidden characters"):
-            JobSubmitRequest(**self._BASE, extra_args="--flag | cat /etc/passwd")
+    def test_empty_string_yields_no_args(self):
+        from fileglancer.apps.jobs import _build_resource_spec
+        ep = AppEntryPoint(id="t", name="T", command="echo")
+        spec = _build_resource_spec(ep, {"extra_args": ""}, self._settings())
+        assert spec.extra_args == []
 
 
 class TestContainerSifName:

From b2874c4e35dc8818610124df6c140eaa2ef3fd53 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 08:53:47 -0400
Subject: [PATCH 54/89] Bind container paths from defaults and env-tab file
 params too
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

_container_bind_paths only mounted file/directory parameters present in the
submitted pipeline `parameters` dict, so it missed values coming from a
manifest default and every file/directory parameter declared in the env tab
(whose values live in env_parameters). The generated command still
references those paths, so a containerized app with a file default or an
env-tab file param would fail at runtime with the path not mounted.

Compute binds from collect_path_parameters — the same effective set (user
values merged with defaults, across both namespaces) the command is built
from.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 fileglancer/apps/jobs.py | 34 +++++++++++++++++++---------------
 tests/test_apps.py       | 33 +++++++++++++++++++++++++++------
 2 files changed, 46 insertions(+), 21 deletions(-)

diff --git a/fileglancer/apps/jobs.py b/fileglancer/apps/jobs.py
index 94703846..fae37cc3 100644
--- a/fileglancer/apps/jobs.py
+++ b/fileglancer/apps/jobs.py
@@ -520,15 +520,20 @@ def _build_container_script(
     return "\n".join(lines)
 
 
-def _container_bind_paths(entry_point, parameters: dict, username: Optional[str],
+def _container_bind_paths(entry_point, parameters: dict,
+                          env_parameters: Optional[dict], username: Optional[str],
                           cached_repo_dir) -> list[str]:
     """Compute the host paths to bind-mount into a container runnable.
 
     Binds are drawn from three sources, in order:
 
-    1. Each file/directory parameter's value (a file binds its parent dir).
-       Cloud-storage URIs and non-absolute values are skipped — they are not
-       bind-mountable and would otherwise produce garbage binds.
+    1. Each effective file/directory parameter's value (a file binds its parent
+       dir). "Effective" means the same set the command is built from — user
+       values merged with manifest defaults, across BOTH the pipeline
+       (`parameters`) and env-tab (`env_parameters`) namespaces — so a file
+       default or an env-tab file parameter is mounted rather than left
+       dangling. Cloud-storage URIs and non-absolute values are skipped — they
+       are not bind-mountable and would otherwise produce garbage binds.
     2. The runnable's explicit `bind_paths`.
     3. The cached repo clone, but only when the command runs from `repo`. The
        `repo` symlink lives inside the (already-bound) work dir yet points at
@@ -540,16 +545,15 @@ def _container_bind_paths(entry_point, parameters: dict, username: Optional[str]
     not included here.
     """
     bind_paths: list[str] = []
-    for param in entry_point.flat_parameters():
-        if param.type in ("file", "directory") and param.key in parameters:
-            path_val = str(parameters[param.key])
-            expanded = expand_user_path(path_val, username)
-            if expanded.startswith(_URI_PREFIXES) or not expanded.startswith("/"):
-                continue
-            if param.type == "directory":
-                bind_paths.append(expanded)
-            else:
-                bind_paths.append(str(Path(expanded).parent))
+    for param, raw_value in collect_path_parameters(
+            entry_point, parameters, env_parameters):
+        expanded = expand_user_path(str(raw_value), username)
+        if expanded.startswith(_URI_PREFIXES) or not expanded.startswith("/"):
+            continue
+        if param.type == "directory":
+            bind_paths.append(expanded)
+        else:
+            bind_paths.append(str(Path(expanded).parent))
     if entry_point.bind_paths:
         bind_paths.extend(entry_point.bind_paths)
     if entry_point.effective_working_dir == "repo":
@@ -852,7 +856,7 @@ async def submit_job(
     # If container is defined, wrap command in apptainer exec
     if effective_container:
         bind_paths = _container_bind_paths(
-            entry_point, parameters, username, cached_repo_dir
+            entry_point, parameters, env_parameters, username, cached_repo_dir
         )
 
         command = _build_container_script(
diff --git a/tests/test_apps.py b/tests/test_apps.py
index 12cbe995..c9267bcd 100644
--- a/tests/test_apps.py
+++ b/tests/test_apps.py
@@ -734,14 +734,14 @@ def test_directory_param_bound_directly(self):
         ep = self._ep(parameters=[
             AppParameter(flag="--data", name="Data", type="directory")
         ])
-        binds = _container_bind_paths(ep, {"data": "/groups/lab/data"}, None, "/cache/repo")
+        binds = _container_bind_paths(ep, {"data": "/groups/lab/data"}, None, None, "/cache/repo")
         assert "/groups/lab/data" in binds
 
     def test_file_param_binds_parent_dir(self):
         ep = self._ep(parameters=[
             AppParameter(flag="--in", name="In", type="file")
         ])
-        binds = _container_bind_paths(ep, {"in": "/groups/lab/x.tif"}, None, "/cache/repo")
+        binds = _container_bind_paths(ep, {"in": "/groups/lab/x.tif"}, None, None, "/cache/repo")
         assert "/groups/lab" in binds
         assert "/groups/lab/x.tif" not in binds
 
@@ -751,24 +751,45 @@ def test_cloud_uri_and_relative_skipped(self):
             AppParameter(flag="--b", name="B", type="directory"),
         ])
         binds = _container_bind_paths(
-            ep, {"a": "s3://bucket/key", "b": "./rel"}, None, "/cache/repo"
+            ep, {"a": "s3://bucket/key", "b": "./rel"}, None, None, "/cache/repo"
         )
         assert binds == []  # neither is a bind-mountable absolute local path
 
     def test_explicit_bind_paths_included(self):
         ep = self._ep(bind_paths=["/shared/ref", "/scratch"])
-        binds = _container_bind_paths(ep, {}, None, "/cache/repo")
+        binds = _container_bind_paths(ep, {}, None, None, "/cache/repo")
         assert "/shared/ref" in binds and "/scratch" in binds
 
     def test_repo_bound_only_when_working_dir_repo(self):
         # Container default is working_dir=work → repo NOT bound.
         work_ep = self._ep()
         assert "work" == work_ep.effective_working_dir
-        assert "/cache/repo" not in _container_bind_paths(work_ep, {}, None, "/cache/repo")
+        assert "/cache/repo" not in _container_bind_paths(work_ep, {}, None, None, "/cache/repo")
 
         # Opt into repo → the cached clone is bound so the repo symlink resolves.
         repo_ep = self._ep(working_dir="repo")
-        assert "/cache/repo" in _container_bind_paths(repo_ep, {}, None, "/cache/repo")
+        assert "/cache/repo" in _container_bind_paths(repo_ep, {}, None, None, "/cache/repo")
+
+    def test_file_directory_default_is_bound(self):
+        # A file/directory param the user did not override still contributes its
+        # default path to the binds (the command references it, so it must be
+        # mounted).
+        ep = self._ep(parameters=[
+            AppParameter(flag="--ref", name="Ref", type="directory",
+                         default="/groups/lab/reference"),
+        ])
+        binds = _container_bind_paths(ep, {}, None, None, "/cache/repo")
+        assert "/groups/lab/reference" in binds
+
+    def test_env_tab_file_param_is_bound(self):
+        # A file/directory parameter declared in the env tab has its value in
+        # env_parameters, not parameters; it must still be bound.
+        ep = self._ep(env_parameters=[
+            AppParameter(flag="--cfg", name="Cfg", type="file"),
+        ])
+        binds = _container_bind_paths(
+            ep, {}, {"cfg": "/groups/lab/config/app.yaml"}, None, "/cache/repo")
+        assert "/groups/lab/config" in binds
 
 
 # --- Service port / URL tests (FG_SERVICE_PORT + auto_url) ---

From 711522c2f3884084aec8df44df5b7d7437aa4bec Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 08:56:19 -0400
Subject: [PATCH 55/89] Give git-heavy worker actions a longer IPC timeout

The parent socket timeout was a fixed 120s applied to every worker request,
but clone/discover/snapshot/submit actions legitimately run longer (git
clone is bounded at 120s, snapshot creation clones and checks out with 300s
ceilings each). A slow-but-valid add/update/launch could therefore trip the
120s receive timeout and be misreported as a dead worker. Set the receive
timeout per action (safe: requests are serialized under the per-worker
lock), with a generous ceiling for the git-heavy actions.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 fileglancer/worker_pool.py | 34 ++++++++++++++++++++++++++++++++--
 tests/test_worker.py       | 22 ++++++++++++++++++++++
 2 files changed, 54 insertions(+), 2 deletions(-)

diff --git a/fileglancer/worker_pool.py b/fileglancer/worker_pool.py
index 0f166fcc..5d3c2b0c 100644
--- a/fileglancer/worker_pool.py
+++ b/fileglancer/worker_pool.py
@@ -48,6 +48,30 @@
 _HEADER_SIZE = struct.calcsize(_HEADER_FMT)
 _MAX_MESSAGE_SIZE = 64 * 1024 * 1024  # 64 MB safety limit
 
+# Per-request receive timeout (seconds). The default covers ordinary IPC
+# round-trips. Git-heavy actions get a far larger ceiling because they
+# legitimately run much longer than a normal request: git clone is bounded at
+# 120s (manifest.py), snapshot creation clones and checks out with 300s ceilings
+# each, and discovery walks/converts the repo on top of a clone. A fixed 120s
+# timeout would make the parent treat the worker as dead mid-clone; keeping the
+# ceiling comfortably above the underlying operation timeouts lets a
+# slow-but-valid clone/snapshot return its result instead.
+_DEFAULT_REQUEST_TIMEOUT = 120
+_GIT_ACTION_TIMEOUT = 900
+_LONG_ACTIONS = frozenset({
+    "ensure_repo",
+    "discover_manifests",
+    "read_manifest",
+    "ensure_snapshot",
+    "gc_snapshots",
+    "submit",
+})
+
+
+def _timeout_for_action(action: str) -> float:
+    """Return the receive timeout (seconds) for a worker action."""
+    return _GIT_ACTION_TIMEOUT if action in _LONG_ACTIONS else _DEFAULT_REQUEST_TIMEOUT
+
 
 def _build_worker_env(base_env: dict, home_dir: str, log_level: str,
                       child_fd: int) -> dict:
@@ -136,8 +160,9 @@ async def execute(self, action: str, **kwargs) -> Any:
             try:
                 request = {"action": action, **kwargs}
                 loop = asyncio.get_event_loop()
+                timeout = _timeout_for_action(action)
                 response = await loop.run_in_executor(
-                    None, self._send_and_recv, request)
+                    None, self._send_and_recv, request, timeout)
 
                 if response.get("error"):
                     # Close any fd that arrived with an error response
@@ -156,14 +181,19 @@ async def execute(self, action: str, **kwargs) -> Any:
                 self._busy = False
                 self.last_activity = time.monotonic()
 
-    def _send_and_recv(self, request: dict) -> dict:
+    def _send_and_recv(self, request: dict, timeout: float = _DEFAULT_REQUEST_TIMEOUT) -> dict:
         """Send a request and receive the action response (blocking, runs in thread).
 
+        ``timeout`` bounds each blocking receive on the socket; it is set per
+        request (requests are serialized under the per-worker lock, so this is
+        safe) so that a long git clone/snapshot isn't misread as a dead worker.
+
         Loops on receive: any inbound ``_kind == "db_request"`` message is a
         reverse-RPC from the worker (which has no DB credentials) asking the
         parent to run a DB query on its behalf. We dispatch it, send back a
         ``db_response``, and keep reading. Anything else is the action result.
         """
+        self.sock.settimeout(timeout)
         self._send_msg(request)
 
         while True:
diff --git a/tests/test_worker.py b/tests/test_worker.py
index 90fc0a7f..1f511296 100644
--- a/tests/test_worker.py
+++ b/tests/test_worker.py
@@ -42,6 +42,9 @@
     WorkerError,
     WorkerDead,
     _build_worker_env,
+    _timeout_for_action,
+    _DEFAULT_REQUEST_TIMEOUT,
+    _GIT_ACTION_TIMEOUT,
 )
 
 
@@ -93,6 +96,25 @@ def test_preserves_non_fgc_and_sets_operational_vars(self):
         assert env["FGC_WORKER_FD"] == "9"
 
 
+class TestActionTimeout:
+    """Git-heavy actions get a longer receive timeout than the default."""
+
+    def test_default_for_ordinary_action(self):
+        assert _timeout_for_action("validate_paths") == _DEFAULT_REQUEST_TIMEOUT
+
+    def test_git_actions_get_longer_ceiling(self):
+        assert _GIT_ACTION_TIMEOUT > _DEFAULT_REQUEST_TIMEOUT
+        for action in ("ensure_repo", "discover_manifests", "read_manifest",
+                       "ensure_snapshot", "gc_snapshots", "submit"):
+            assert _timeout_for_action(action) == _GIT_ACTION_TIMEOUT
+
+    def test_ceiling_exceeds_snapshot_operation_timeout(self):
+        # snapshot creation runs a 300s clone then a 300s checkout; the IPC
+        # ceiling must sit above that so a valid snapshot isn't read as a
+        # dead worker.
+        assert _GIT_ACTION_TIMEOUT >= 600
+
+
 class TestIPCProtocol:
     """Test the length-prefixed JSON wire protocol."""
 

From 195f4f6d32a30e0f2574882443af2f833dca312d Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 08:59:19 -0400
Subject: [PATCH 56/89] Actually stop local-executor jobs on cancel
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The local executor runs a job as a bash subprocess whose PID a freshly
constructed executor (in a later cancel dispatch) has no handle to, so
cancel() was a no-op while the DB was marked KILLED — the process kept
running. Add a cancel_local worker action that SIGTERMs the PID persisted at
submit time ({work_dir}/job.pid), as the user, and route local-executor
cancels to it. Signals the single PID, not the process group, since the
local executor shares the worker's group.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 fileglancer/apps/jobs.py   | 10 ++++++++--
 fileglancer/user_worker.py | 34 +++++++++++++++++++++++++++++++++
 tests/test_worker.py       | 39 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 81 insertions(+), 2 deletions(-)

diff --git a/fileglancer/apps/jobs.py b/fileglancer/apps/jobs.py
index fae37cc3..6296d5eb 100644
--- a/fileglancer/apps/jobs.py
+++ b/fileglancer/apps/jobs.py
@@ -1004,8 +1004,14 @@ async def cancel_job(job_id: int, username: str) -> db.JobDB:
         if db_job.status not in ("PENDING", "RUNNING"):
             raise ValueError(f"Job {job_id} is not cancellable (status: {db_job.status})")
 
-        # Cancel on cluster as the target user
-        if db_job.cluster_job_id:
+        # Actually stop the running job as the target user. The local executor
+        # spawns a bash subprocess whose PID a fresh executor can't reach, so
+        # cancel it by the PID persisted in its work dir; other executors
+        # (LSF, ...) cancel by cluster job id via py-cluster-api.
+        if settings.cluster.executor == "local":
+            if db_job.work_dir:
+                await _dispatch(username, "cancel_local", work_dir=db_job.work_dir)
+        elif db_job.cluster_job_id:
             cluster_config = settings.cluster.model_dump(exclude_none=True)
             await _dispatch(
                 username, "cancel",
diff --git a/fileglancer/user_worker.py b/fileglancer/user_worker.py
index e76baa1b..4f1f0992 100644
--- a/fileglancer/user_worker.py
+++ b/fileglancer/user_worker.py
@@ -783,6 +783,40 @@ def _action_get_job_file(request: dict, ctx: WorkerContext) -> dict:
     return {"content": content}
 
 
+@action("cancel_local")
+def _action_cancel_local(request: dict, ctx: WorkerContext) -> dict:
+    """Terminate a local-executor job by its recorded PID, as the user.
+
+    The local executor spawns `bash <script>` in the worker's own process
+    group (no new session), and a fresh executor in a later `cancel` dispatch
+    has no handle to it, so cancellation must target the PID persisted at
+    submit time ({work_dir}/job.pid). We signal that single PID — never the
+    process group, which would also hit the worker/server — with SIGTERM so
+    the job's EXIT trap still runs and writes its exit code for the poller.
+    Returns {"killed": bool}; a missing/stale pid file or an already-exited
+    process is a no-op (killed=False), not an error.
+    """
+    import signal
+
+    work_dir = request.get("work_dir")
+    if not work_dir:
+        return {"killed": False}
+    pid_file = Path(work_dir) / "job.pid"
+    if not pid_file.is_file():
+        return {"killed": False}
+    try:
+        pid = int(pid_file.read_text().strip())
+    except (ValueError, OSError):
+        return {"killed": False}
+    try:
+        os.kill(pid, signal.SIGTERM)
+    except ProcessLookupError:
+        return {"killed": False}  # already gone
+    except OSError as e:
+        return {"error": str(e), "status_code": 500}
+    return {"killed": True}
+
+
 @action("get_service_url")
 def _action_get_service_url(request: dict, ctx: WorkerContext) -> dict:
     """Read the service URL and startup phase from a job's work directory."""
diff --git a/tests/test_worker.py b/tests/test_worker.py
index 1f511296..83d8a555 100644
--- a/tests/test_worker.py
+++ b/tests/test_worker.py
@@ -30,6 +30,7 @@
     _action_validate_proxied_path,
     _action_create_dirs,
     _action_validate_paths,
+    _action_cancel_local,
     WorkerContext,
     _HEADER_FMT,
     _HEADER_SIZE,
@@ -115,6 +116,44 @@ def test_ceiling_exceeds_snapshot_operation_timeout(self):
         assert _GIT_ACTION_TIMEOUT >= 600
 
 
+@pytest.mark.skipif(sys.platform == "win32",
+                    reason="POSIX signals / sleep command required")
+class TestCancelLocalAction:
+    """cancel_local terminates a local-executor job by its recorded PID."""
+
+    def _ctx(self):
+        return WorkerContext(username="test", db=None)
+
+    def test_kills_recorded_pid(self, tmp_path):
+        import subprocess as sp
+        proc = sp.Popen(["sleep", "60"])
+        try:
+            (tmp_path / "job.pid").write_text(str(proc.pid))
+            result = _action_cancel_local({"work_dir": str(tmp_path)}, self._ctx())
+            assert result == {"killed": True}
+            proc.wait(timeout=5)
+            assert proc.returncode != 0  # terminated by SIGTERM, not a clean exit
+        finally:
+            if proc.poll() is None:
+                proc.kill()
+                proc.wait(timeout=5)
+
+    def test_missing_pid_file_is_noop(self, tmp_path):
+        assert _action_cancel_local(
+            {"work_dir": str(tmp_path)}, self._ctx()) == {"killed": False}
+
+    def test_missing_work_dir_is_noop(self):
+        assert _action_cancel_local({}, self._ctx()) == {"killed": False}
+
+    def test_already_dead_pid_is_noop(self, tmp_path):
+        import subprocess as sp
+        proc = sp.Popen(["sleep", "0.01"])
+        proc.wait()  # reap so the PID is no longer a live process
+        (tmp_path / "job.pid").write_text(str(proc.pid))
+        assert _action_cancel_local(
+            {"work_dir": str(tmp_path)}, self._ctx()) == {"killed": False}
+
+
 class TestIPCProtocol:
     """Test the length-prefixed JSON wire protocol."""
 

From c21ee38b96cb298245cfaf6a54b21712269af863 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 09:01:29 -0400
Subject: [PATCH 57/89] Cap inline job-file reads to avoid OOM on large logs

read_job_file used Path.read_text() and the endpoint returned the whole file
in one response. HPC stdout/stderr logs can reach gigabytes, which could
exhaust worker/server memory and exceed the 64 MB IPC message limit. Return
the trailing 5 MB of oversized files (the most useful part of a log) with a
marker noting how much was omitted; the file's work-dir browse link still
gives full access. Decode with errors='replace' so non-UTF-8 log bytes never
raise.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 fileglancer/apps/jobfiles.py | 43 +++++++++++++++++++++++++++++++++---
 tests/test_apps.py           | 19 ++++++++++++++++
 2 files changed, 59 insertions(+), 3 deletions(-)

diff --git a/fileglancer/apps/jobfiles.py b/fileglancer/apps/jobfiles.py
index c783e6a5..f609c79c 100644
--- a/fileglancer/apps/jobfiles.py
+++ b/fileglancer/apps/jobfiles.py
@@ -195,6 +195,42 @@ def get_job_file_paths(db_job: db.JobDB) -> dict[str, dict]:
     return files
 
 
+# Cap for inline job-file reads. HPC stdout/stderr logs can grow to gigabytes;
+# reading one whole would exhaust worker/server memory and blow the 64 MB IPC
+# message limit. We return the tail of anything larger (the most useful part of
+# a log), with a marker; the file's work-dir browse link gives full access.
+_MAX_JOB_FILE_BYTES = 5 * 1024 * 1024
+
+
+def _read_text_capped(path: Path) -> str:
+    """Read a text file, capping oversized files to their trailing bytes.
+
+    Files up to _MAX_JOB_FILE_BYTES are returned in full. Larger files return
+    only their last _MAX_JOB_FILE_BYTES bytes, prefixed with a marker noting how
+    much was omitted, so a runaway log can't OOM the process or exceed the IPC
+    limit. Decoding uses errors='replace' so non-UTF-8 log bytes never raise.
+    """
+    size = path.stat().st_size
+    if size <= _MAX_JOB_FILE_BYTES:
+        return path.read_text(errors="replace")
+    with path.open("rb") as f:
+        f.seek(size - _MAX_JOB_FILE_BYTES)
+        tail = f.read()
+    text = tail.decode("utf-8", errors="replace")
+    # Drop a leading partial line so the tail starts on a clean boundary.
+    newline = text.find("\n")
+    if newline != -1:
+        text = text[newline + 1:]
+    omitted = size - _MAX_JOB_FILE_BYTES
+    shown_mb = _MAX_JOB_FILE_BYTES // (1024 * 1024)
+    header = (
+        f"[Fileglancer: this file is {size} bytes; showing only the last "
+        f"{shown_mb} MB ({omitted} earlier bytes omitted). Open it from the "
+        f"job's work directory to view the full contents.]\n\n"
+    )
+    return header + text
+
+
 def read_job_file(db_job, file_type: str) -> Optional[str]:
     """Read the content of a job file given a loaded job record.
 
@@ -203,6 +239,7 @@ def read_job_file(db_job, file_type: str) -> Optional[str]:
       - stdout.log  — captured standard output
       - stderr.log  — captured standard error
 
+    Oversized files are truncated to their tail (see _read_text_capped).
     Returns the file content as a string, or None if the file doesn't exist.
     """
     work_dir = _resolve_work_dir(db_job)
@@ -213,10 +250,10 @@ def read_job_file(db_job, file_type: str) -> Optional[str]:
         script_path = getattr(db_job, 'script_path', None)
         if script_path:
             path = Path(script_path)
-            return path.read_text() if path.is_file() else None
+            return _read_text_capped(path) if path.is_file() else None
         scripts = sorted(work_dir.glob("*.sh"))
         if scripts:
-            return scripts[0].read_text()
+            return _read_text_capped(scripts[0])
         return None
     elif file_type == "stdout":
         path = work_dir / "stdout.log"
@@ -226,7 +263,7 @@ def read_job_file(db_job, file_type: str) -> Optional[str]:
         raise ValueError(f"Unknown file type: {file_type}")
 
     if path.is_file():
-        return path.read_text()
+        return _read_text_capped(path)
     return None
 
 
diff --git a/tests/test_apps.py b/tests/test_apps.py
index c9267bcd..07cdc030 100644
--- a/tests/test_apps.py
+++ b/tests/test_apps.py
@@ -328,6 +328,25 @@ def test_missing_stored_script_returns_none(self, tmp_path):
         )
         assert read_job_file(job, "script") is None
 
+    def test_small_log_returned_in_full(self, tmp_path):
+        (tmp_path / "stdout.log").write_text("line 1\nline 2\n")
+        job = _fake_job(work_dir=str(tmp_path))
+        assert read_job_file(job, "stdout") == "line 1\nline 2\n"
+
+    def test_oversized_log_is_tail_truncated(self, tmp_path):
+        from fileglancer.apps.jobfiles import _MAX_JOB_FILE_BYTES
+        # One byte per line so line boundaries are easy to reason about.
+        big = ("A\n" * (_MAX_JOB_FILE_BYTES // 2)) + ("TAIL_MARKER\n" * 5)
+        (tmp_path / "stderr.log").write_text(big)
+        job = _fake_job(work_dir=str(tmp_path))
+        content = read_job_file(job, "stderr")
+        # Truncation marker present, size bounded, and the trailing content kept.
+        assert "earlier bytes omitted" in content
+        assert "TAIL_MARKER" in content
+        # Marker header plus at most the cap of tail bytes — nowhere near the
+        # full file, and safely under the 64 MB IPC limit.
+        assert len(content.encode()) <= _MAX_JOB_FILE_BYTES + 1024
+
 
 # --- merge_requirements tests ---
 

From 18af4ef27d5d9585a98caf63d70bc1db883daa42 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 09:04:14 -0400
Subject: [PATCH 58/89] Preserve env_parameters when relaunching from the Jobs
 table

The Jobs-table relaunch action omitted env_parameters from the navigation
state, so relaunching a job with env-tab parameters (e.g. Nextflow
-profile) silently reset them to manifest defaults. Job detail's relaunch
already carried them; match it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 frontend/src/components/AppJobs.tsx | 1 +
 1 file changed, 1 insertion(+)

diff --git a/frontend/src/components/AppJobs.tsx b/frontend/src/components/AppJobs.tsx
index 0e5d0dc5..4a6bf6b1 100644
--- a/frontend/src/components/AppJobs.tsx
+++ b/frontend/src/components/AppJobs.tsx
@@ -40,6 +40,7 @@ export default function AppJobs() {
     navigate(path, {
       state: {
         parameters: job.parameters,
+        env_parameters: job.env_parameters,
         resources: job.resources,
         env: job.env,
         pre_run: job.pre_run,

From 340eaf0b50574c6b2a5a5f8002ec4003085bce20 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 09:04:22 -0400
Subject: [PATCH 59/89] Install only the current app from the launch page

The launch-page "Install App" button called the add mutation with no
manifest_paths, which the backend treats as "add every manifest in the
repo". Opening a launch link for one app of a multi-app monorepo and
clicking Install therefore added all of them. Scope the add to the page's
manifest_path.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 frontend/src/components/AppLaunch.tsx | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/frontend/src/components/AppLaunch.tsx b/frontend/src/components/AppLaunch.tsx
index 60aabfd0..fbd918db 100644
--- a/frontend/src/components/AppLaunch.tsx
+++ b/frontend/src/components/AppLaunch.tsx
@@ -179,7 +179,12 @@ export default function AppLaunch() {
 
   const handleInstall = async () => {
     try {
-      const apps = await addAppMutation.mutateAsync({ url: appUrl });
+      // Install only the app on this page, not every manifest in the repo:
+      // scope the add to this manifest_path ('' is the repo-root manifest).
+      const apps = await addAppMutation.mutateAsync({
+        url: appUrl,
+        manifest_paths: [manifestPath]
+      });
       const count = apps.length;
       toast.success(`${count} app${count !== 1 ? 's' : ''} added`);
     } catch (error) {

From ac591538c946be486ab46a55787ca2ba87ca19df Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 09:04:34 -0400
Subject: [PATCH 60/89] Report cancel/stop failures on the job detail page

The cancel/stop confirmation fired the mutation and closed the dialog with
no success or error feedback (JobDetail imported no toast). A failed stop of
a running service looked identical to success while the service kept
consuming cluster resources. Await the mutation, toast success, surface
errors via showErrorToast, and keep the dialog open on failure so the user
can retry.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 frontend/src/components/JobDetail.tsx | 27 +++++++++++++++++++++++----
 1 file changed, 23 insertions(+), 4 deletions(-)

diff --git a/frontend/src/components/JobDetail.tsx b/frontend/src/components/JobDetail.tsx
index 1948aaa8..029e164e 100644
--- a/frontend/src/components/JobDetail.tsx
+++ b/frontend/src/components/JobDetail.tsx
@@ -14,6 +14,7 @@ import {
   materialDark,
   coy
 } from 'react-syntax-highlighter/dist/esm/styles/prism';
+import toast from 'react-hot-toast';
 
 import AnsiText from '@/components/ui/AppsPage/AnsiText';
 import AppPageHeader from '@/components/ui/AppsPage/AppPageHeader';
@@ -22,6 +23,7 @@ import FgIcon from '@/components/designSystem/atoms/FgIcon';
 import FgLink from '@/components/designSystem/atoms/FgLink';
 import CancelJobDialog from '@/components/ui/Dialogs/CancelJob';
 import FgTooltip from '@/components/ui/widgets/FgTooltip';
+import { showErrorToast } from '@/utils/errorToast';
 import type {
   JobFileInfo,
   FileSharePath,
@@ -601,6 +603,26 @@ export default function JobDetail() {
     });
   };
 
+  // Cancel/stop the job, reporting success and — critically — failure, so a
+  // failed stop of a running service isn't silently swallowed (the service
+  // would keep consuming cluster resources). Keep the dialog open on error so
+  // the user can retry.
+  const handleStopConfirm = async () => {
+    if (!job) {
+      return;
+    }
+    try {
+      await cancelMutation.mutateAsync(job.id);
+      toast.success(isService ? 'Service stopped' : 'Job cancelled');
+      setShowStopConfirm(false);
+    } catch (error) {
+      showErrorToast(
+        error,
+        isService ? 'Failed to stop service' : 'Failed to cancel job'
+      );
+    }
+  };
+
   return (
     <div>
       {jobQuery.isPending ? (
@@ -756,10 +778,7 @@ export default function JobDetail() {
             isPending={cancelMutation.isPending}
             isService={isService}
             onClose={() => setShowStopConfirm(false)}
-            onConfirm={() => {
-              cancelMutation.mutate(job.id);
-              setShowStopConfirm(false);
-            }}
+            onConfirm={handleStopConfirm}
             open={showStopConfirm}
           />
 

From f8297071ce46df64e6dd0df6499f20a991e2bcfd Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 09:07:02 -0400
Subject: [PATCH 61/89] Warn that apps execute code as the user at add time
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adding an app (from a URL or the shared catalog) runs code from its
repository on the cluster as the current user, but the UI never said so —
a real trust gap for catalog apps published by other users. Add a concise
trust notice (new AppTrustNotice component) to the add-from-URL dialog and
the catalog listing detail page. Source repo/revision/commit are already
shown in the app and listing info tables.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 frontend/src/components/ListingDetail.tsx     |  3 ++
 .../components/ui/AppsPage/AddAppDialog.tsx   |  3 ++
 .../components/ui/AppsPage/AppTrustNotice.tsx | 32 +++++++++++++++++++
 3 files changed, 38 insertions(+)
 create mode 100644 frontend/src/components/ui/AppsPage/AppTrustNotice.tsx

diff --git a/frontend/src/components/ListingDetail.tsx b/frontend/src/components/ListingDetail.tsx
index 2a9c4ba2..e1bafaa3 100644
--- a/frontend/src/components/ListingDetail.tsx
+++ b/frontend/src/components/ListingDetail.tsx
@@ -9,6 +9,7 @@ import {
 import { FaUsersSlash } from 'react-icons/fa6';
 
 import AppPageHeader from '@/components/ui/AppsPage/AppPageHeader';
+import AppTrustNotice from '@/components/ui/AppsPage/AppTrustNotice';
 import EntryPointsList from '@/components/ui/AppsPage/EntryPointsList';
 import ListingActionDialogs from '@/components/ui/AppsPage/ListingActionDialogs';
 import ListingInfoTable from '@/components/ui/AppsPage/ListingInfoTable';
@@ -175,6 +176,8 @@ export default function ListingDetail() {
       <div className="max-w-2xl">
         <ListingInfoTable installedApp={installedApp} listing={listing} />
 
+        {!alreadyAdded ? <AppTrustNotice className="mt-4" /> : null}
+
         {manifestMutation.isPending && !manifest ? (
           <Typography className="text-foreground" type="small">
             Loading entry points...
diff --git a/frontend/src/components/ui/AppsPage/AddAppDialog.tsx b/frontend/src/components/ui/AppsPage/AddAppDialog.tsx
index bb88c1a7..e6ba0f32 100644
--- a/frontend/src/components/ui/AppsPage/AddAppDialog.tsx
+++ b/frontend/src/components/ui/AppsPage/AddAppDialog.tsx
@@ -6,6 +6,7 @@ import FgButton from '@/components/designSystem/atoms/FgButton';
 import FgFormField from '@/components/designSystem/molecules/FgFormField';
 import FgInput from '@/components/designSystem/atoms/formElements/FgInput';
 import FgCheckbox from '@/components/designSystem/atoms/formElements/FgCheckbox';
+import AppTrustNotice from '@/components/ui/AppsPage/AppTrustNotice';
 import { buildAppUrl, isGithubRepoUrl } from '@/utils';
 import type { DiscoveredApp } from '@/shared.types';
 
@@ -141,6 +142,8 @@ export default function AddAppDialog({
             accessed over SSH using your configured SSH key.
           </Typography>
 
+          <AppTrustNotice className="mb-4" />
+
           <FgFormField
             error={urlError || undefined}
             htmlFor="repo-url"
diff --git a/frontend/src/components/ui/AppsPage/AppTrustNotice.tsx b/frontend/src/components/ui/AppsPage/AppTrustNotice.tsx
new file mode 100644
index 00000000..71efeea7
--- /dev/null
+++ b/frontend/src/components/ui/AppsPage/AppTrustNotice.tsx
@@ -0,0 +1,32 @@
+import { Typography } from '@material-tailwind/react';
+import { HiOutlineExclamationTriangle } from 'react-icons/hi2';
+
+import FgIcon from '@/components/designSystem/atoms/FgIcon';
+
+/**
+ * Warns that adding/launching an app executes code from its repository on the
+ * cluster as the current user. Shown at the add entry points (add-from-URL and
+ * add-from-catalog) so users understand the trust implication before installing
+ * something another user shared.
+ */
+export default function AppTrustNotice({
+  className = ''
+}: {
+  readonly className?: string;
+}) {
+  return (
+    <div
+      className={`flex items-start gap-2 rounded-lg border border-warning/40 bg-warning/10 p-3 ${className}`}
+    >
+      <FgIcon
+        className="text-warning shrink-0 mt-0.5"
+        icon={HiOutlineExclamationTriangle}
+        size="sm"
+      />
+      <Typography className="text-foreground text-sm">
+        Apps run code from their repository on the compute cluster as you, with
+        access to your files. Only add apps from sources you trust.
+      </Typography>
+    </div>
+  );
+}

From 58177429372f736f54748bd20518699c1f13a11a Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 11:36:27 -0400
Subject: [PATCH 62/89] Validate manifest repo_url and require at least one
 runnable

Two manifest-load hardening checks that turn confusing downstream failures
into clear author-facing errors:

- repo_url now must parse as a GitHub URL (same parser as app URLs) instead
  of any string that later fails cryptically in ensure_repo_snapshot at
  launch/update.
- runnables requires min_length=1, so a manifest with no entry points is
  rejected at parse time rather than producing an app with a Launch button
  and nothing to launch.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 fileglancer/model.py | 20 +++++++++++++++++++-
 tests/test_apps.py   | 37 ++++++++++++++++++++++++++++++++++++-
 2 files changed, 55 insertions(+), 2 deletions(-)

diff --git a/fileglancer/model.py b/fileglancer/model.py
index 11663de0..e6f7c698 100644
--- a/fileglancer/model.py
+++ b/fileglancer/model.py
@@ -5,6 +5,8 @@
 
 from pydantic import BaseModel, Discriminator, Field, HttpUrl, Tag, field_validator, model_validator
 
+from fileglancer.giturls import _parse_github_url
+
 
 class FileSharePath(BaseModel):
     """A file share path from the database"""
@@ -677,13 +679,29 @@ class AppManifest(BaseModel):
         description="Required tools, e.g. ['pixi>=0.40', 'npm']",
         default=[],
     )
-    runnables: List[AppEntryPoint] = Field(description="Available entry points for this app")
+    runnables: List[AppEntryPoint] = Field(
+        description="Available entry points for this app", min_length=1)
 
     @field_validator("requirements")
     @classmethod
     def validate_requirements(cls, v):
         return _validate_requirements(v)
 
+    @field_validator("repo_url")
+    @classmethod
+    def validate_repo_url(cls, v):
+        # A separate code repo must be a GitHub URL the same way app URLs are —
+        # reject anything else at manifest load so authors get a clear error
+        # instead of a cryptic failure later at launch/update when
+        # ensure_repo_snapshot tries to parse it.
+        if v is None:
+            return v
+        try:
+            _parse_github_url(v)
+        except ValueError as e:
+            raise ValueError(f"repo_url must be a GitHub repository URL: {e}")
+        return v
+
 
 class UserApp(BaseModel):
     """A user's saved app reference"""
diff --git a/tests/test_apps.py b/tests/test_apps.py
index 07cdc030..c1dd4243 100644
--- a/tests/test_apps.py
+++ b/tests/test_apps.py
@@ -441,6 +441,38 @@ def test_rejects_chained_version_spec(self):
             )
 
 
+class TestManifestRepoUrlValidation:
+    _RUN = [AppEntryPoint(id="t", name="T", command="echo")]
+
+    def test_valid_github_repo_url(self):
+        m = AppManifest(name="T", repo_url="https://github.com/org/code",
+                        runnables=self._RUN)
+        assert m.repo_url == "https://github.com/org/code"
+
+    def test_none_is_allowed(self):
+        assert AppManifest(name="T", runnables=self._RUN).repo_url is None
+
+    def test_rejects_non_github_url(self):
+        with pytest.raises(ValidationError, match="GitHub repository URL"):
+            AppManifest(name="T", repo_url="https://gitlab.com/org/code",
+                        runnables=self._RUN)
+
+    def test_rejects_garbage(self):
+        with pytest.raises(ValidationError, match="GitHub repository URL"):
+            AppManifest(name="T", repo_url="not a url", runnables=self._RUN)
+
+
+class TestManifestRunnablesRequired:
+    def test_rejects_empty_runnables(self):
+        with pytest.raises(ValidationError):
+            AppManifest(name="T", runnables=[])
+
+    def test_accepts_one_runnable(self):
+        m = AppManifest(name="T",
+                        runnables=[AppEntryPoint(id="t", name="T", command="echo")])
+        assert len(m.runnables) == 1
+
+
 # --- Script generation tests ---
 
 class TestCondaActivationInScript:
@@ -1482,7 +1514,10 @@ class TestFindManifestsAdapterFallback:
     empty tmp_path exercises it directly."""
 
     def test_other_adapter_handles_when_one_fails(self, tmp_path, monkeypatch):
-        manifest = AppManifest(name="From Pixi", runnables=[])
+        manifest = AppManifest(
+            name="From Pixi",
+            runnables=[AppEntryPoint(id="run", name="Run", command="echo")],
+        )
         monkeypatch.setattr(
             adapters_module,
             "MANIFEST_ADAPTERS",

From a5ae4a386f9522d4b92c240299563e0b6e294de5 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 11:45:40 -0400
Subject: [PATCH 63/89] Show unknown job status neutrally instead of "Failed"

JobStatusBadge fell back to the FAILED style for any unmapped status. The
cluster API's UNKNOWN status (which the server treats as live) would render
as "Failed", misrepresenting a running/unknown job. Fall back to a neutral
"Unknown" badge instead.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 frontend/src/components/ui/AppsPage/JobStatusBadge.tsx | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/frontend/src/components/ui/AppsPage/JobStatusBadge.tsx b/frontend/src/components/ui/AppsPage/JobStatusBadge.tsx
index 6e12244c..3ab93f22 100644
--- a/frontend/src/components/ui/AppsPage/JobStatusBadge.tsx
+++ b/frontend/src/components/ui/AppsPage/JobStatusBadge.tsx
@@ -21,7 +21,12 @@ export default function JobStatusBadge({
 }: {
   readonly status: Job['status'];
 }) {
-  const { color, label, dot } = STATUS_MAP[status] ?? STATUS_MAP.FAILED;
+  // An unrecognized status (e.g. the cluster API's UNKNOWN, which the server
+  // treats as live) is shown neutrally rather than mislabeled as a failure.
+  const { color, label, dot } = STATUS_MAP[status] ?? {
+    color: 'neutral' as const,
+    label: 'Unknown'
+  };
   return (
     <FgBadge color={color} dot={dot} variant="pill">
       {label}

From d3ccadf24f51fd060281d2021ecf3c3e1912cd2e Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 11:45:41 -0400
Subject: [PATCH 64/89] Refetch job logs once when the job goes terminal

useJobFileQuery stopped polling the moment a job became terminal, but the
last output and the scheduler epilogue are written right around then, so the
viewed log/Overview tail was left stale until remount. Do one final refetch
on the active->terminal edge (only for the tab currently being viewed).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 frontend/src/queries/jobsQueries.ts | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/frontend/src/queries/jobsQueries.ts b/frontend/src/queries/jobsQueries.ts
index 7c9920bd..e45f57af 100644
--- a/frontend/src/queries/jobsQueries.ts
+++ b/frontend/src/queries/jobsQueries.ts
@@ -1,3 +1,4 @@
+import { useEffect, useRef } from 'react';
 import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';
 import type { UseQueryResult, UseMutationResult } from '@tanstack/react-query';
 
@@ -145,17 +146,31 @@ export function useJobFileQuery(
   enabled: boolean = true
 ): UseQueryResult<string | null, Error> {
   const isActive = jobStatus === 'PENDING' || jobStatus === 'RUNNING';
-  return useQuery({
+  const query = useQuery({
     queryKey: [...jobsQueryKeys.detail(jobId), 'file', fileType],
     queryFn: ({ signal }) => fetchJobFile(jobId, fileType, signal),
     // Defer fetching the file content until its tab is viewed, so opening a
     // job doesn't load all three log files up front.
     enabled,
     refetchInterval: () => {
-      // Auto-refresh while job is active, or if file doesn't exist yet
+      // Auto-refresh while the job is active; polling stops once it's terminal.
       return isActive ? 5000 : false;
     }
   });
+
+  // Polling stops the moment the job goes terminal, but the last ~5s of output
+  // (and the scheduler epilogue) is written right around then. Do one final
+  // refetch on the active -> terminal edge so the viewed log isn't left stale.
+  const { refetch } = query;
+  const wasActive = useRef(isActive);
+  useEffect(() => {
+    if (wasActive.current && !isActive && enabled) {
+      void refetch();
+    }
+    wasActive.current = isActive;
+  }, [isActive, enabled, refetch]);
+
+  return query;
 }
 
 // --- Mutation Hooks ---

From 14f63daef28dab57dfe5bf28b0172bc6279a1c99 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 11:45:49 -0400
Subject: [PATCH 65/89] Confirm before deleting a job

Job deletion (irreversible record + log removal) fired on a single row-menu
click. Add a DeleteJobDialog confirmation, matching the cancel/stop flow,
that reports success/failure and keeps open on error.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 frontend/src/components/AppJobs.tsx           | 19 ++++++--
 .../src/components/ui/Dialogs/DeleteJob.tsx   | 46 +++++++++++++++++++
 2 files changed, 62 insertions(+), 3 deletions(-)
 create mode 100644 frontend/src/components/ui/Dialogs/DeleteJob.tsx

diff --git a/frontend/src/components/AppJobs.tsx b/frontend/src/components/AppJobs.tsx
index 4a6bf6b1..b7edc9e1 100644
--- a/frontend/src/components/AppJobs.tsx
+++ b/frontend/src/components/AppJobs.tsx
@@ -6,6 +6,7 @@ import toast from 'react-hot-toast';
 
 import FgLink from '@/components/designSystem/atoms/FgLink';
 import CancelJobDialog from '@/components/ui/Dialogs/CancelJob';
+import DeleteJobDialog from '@/components/ui/Dialogs/DeleteJob';
 import { TableCard } from '@/components/ui/Table/TableCard';
 import { createAppsJobsColumns } from '@/components/ui/Table/appsJobsColumns';
 import { buildRelaunchPath, parseGithubUrl } from '@/utils';
@@ -23,6 +24,7 @@ export default function AppJobs() {
   const cancelJobMutation = useCancelJobMutation();
   const deleteJobMutation = useDeleteJobMutation();
   const [jobToCancel, setJobToCancel] = useState<Job | null>(null);
+  const [jobToDelete, setJobToDelete] = useState<number | null>(null);
 
   const handleViewJobDetail = (jobId: number) => {
     navigate(`/apps/jobs/${jobId}`);
@@ -67,10 +69,14 @@ export default function AppJobs() {
     }
   };
 
-  const handleDeleteJob = async (jobId: number) => {
+  const handleConfirmDeleteJob = async () => {
+    if (jobToDelete === null) {
+      return;
+    }
     try {
-      await deleteJobMutation.mutateAsync(jobId);
+      await deleteJobMutation.mutateAsync(jobToDelete);
       toast.success('Job deleted');
+      setJobToDelete(null);
     } catch (error) {
       showErrorToast(error, 'Failed to delete job');
     }
@@ -82,7 +88,7 @@ export default function AppJobs() {
         onViewDetail: handleViewJobDetail,
         onRelaunch: handleRelaunch,
         onCancel: setJobToCancel,
-        onDelete: handleDeleteJob
+        onDelete: setJobToDelete
       }),
     // eslint-disable-next-line react-hooks/exhaustive-deps
     []
@@ -111,6 +117,13 @@ export default function AppJobs() {
         onConfirm={handleConfirmCancelJob}
         open={jobToCancel !== null}
       />
+
+      <DeleteJobDialog
+        isPending={deleteJobMutation.isPending}
+        onClose={() => setJobToDelete(null)}
+        onConfirm={handleConfirmDeleteJob}
+        open={jobToDelete !== null}
+      />
     </div>
   );
 }
diff --git a/frontend/src/components/ui/Dialogs/DeleteJob.tsx b/frontend/src/components/ui/Dialogs/DeleteJob.tsx
new file mode 100644
index 00000000..849ce5e7
--- /dev/null
+++ b/frontend/src/components/ui/Dialogs/DeleteJob.tsx
@@ -0,0 +1,46 @@
+import { Typography } from '@material-tailwind/react';
+import { HiOutlineTrash } from 'react-icons/hi';
+
+import FgButton from '@/components/designSystem/atoms/FgButton';
+import FgDialog from '@/components/ui/Dialogs/FgDialog';
+
+type DeleteJobDialogProps = {
+  readonly open: boolean;
+  readonly isPending: boolean;
+  readonly onClose: () => void;
+  readonly onConfirm: () => void;
+};
+
+export default function DeleteJobDialog({
+  open,
+  isPending,
+  onClose,
+  onConfirm
+}: DeleteJobDialogProps) {
+  return (
+    <FgDialog onClose={onClose} open={open}>
+      <Typography className="text-foreground font-bold mb-2" type="h6">
+        Delete Job
+      </Typography>
+      <Typography className="text-foreground mb-4">
+        Are you sure you want to delete this job? Its record, parameters, and
+        logs will be removed. This cannot be undone.
+      </Typography>
+      <div className="flex justify-end gap-2">
+        <FgButton onClick={onClose} variant="ghost">
+          Keep job
+        </FgButton>
+        <FgButton
+          color="error"
+          disabled={isPending}
+          icon={HiOutlineTrash}
+          loading={isPending}
+          loadingText="Deleting..."
+          onClick={onConfirm}
+        >
+          Delete Job
+        </FgButton>
+      </div>
+    </FgDialog>
+  );
+}

From acdd5ab21c47f7a2e6dc5baa58dd2b24bbda9f41 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 11:45:59 -0400
Subject: [PATCH 66/89] Confirm before unsharing a catalog listing

Unshare deleted a listing on a single click, including from an overflow menu
next to Edit. Unsharing affects other users (they can no longer see or add
the app) and discards the listing's curated name/description, so gate it
behind a confirmation. Add a two-step requestUnshare/confirmUnshare flow to
both useAppActions and useListingActions (mirroring the existing
remove/edit flows) with a shared UnshareDialog, and route the app/listing
buttons and menu items through it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 frontend/src/components/AppDetail.tsx         |  2 +-
 frontend/src/components/ListingDetail.tsx     |  2 +-
 .../ui/AppsPage/AppActionDialogs.tsx          |  8 +++
 .../ui/AppsPage/ListingActionDialogs.tsx      | 24 +++++---
 .../components/ui/AppsPage/UnshareDialog.tsx  | 55 +++++++++++++++++++
 .../components/ui/AppsPage/appMenuItems.ts    |  2 +-
 .../ui/AppsPage/listingMenuItems.ts           |  2 +-
 frontend/src/hooks/useAppActions.ts           | 18 ++++--
 frontend/src/hooks/useListingActions.ts       | 18 +++++-
 9 files changed, 113 insertions(+), 18 deletions(-)
 create mode 100644 frontend/src/components/ui/AppsPage/UnshareDialog.tsx

diff --git a/frontend/src/components/AppDetail.tsx b/frontend/src/components/AppDetail.tsx
index 84be2f97..8ec6c76e 100644
--- a/frontend/src/components/AppDetail.tsx
+++ b/frontend/src/components/AppDetail.tsx
@@ -111,7 +111,7 @@ export default function AppDetail() {
                   icon={FaUsersSlash}
                   loading={actions.unsharing}
                   loadingText="Unsharing..."
-                  onClick={() => void actions.unshare(app)}
+                  onClick={() => actions.requestUnshare(app)}
                   size="sm"
                   variant="outline"
                 >
diff --git a/frontend/src/components/ListingDetail.tsx b/frontend/src/components/ListingDetail.tsx
index e1bafaa3..b3f0571a 100644
--- a/frontend/src/components/ListingDetail.tsx
+++ b/frontend/src/components/ListingDetail.tsx
@@ -145,7 +145,7 @@ export default function ListingDetail() {
                     icon={FaUsersSlash}
                     loading={unsharing}
                     loadingText="Unsharing..."
-                    onClick={() => void actions.unshare(listing)}
+                    onClick={() => actions.requestUnshare(listing)}
                     size="sm"
                     variant="outline"
                   >
diff --git a/frontend/src/components/ui/AppsPage/AppActionDialogs.tsx b/frontend/src/components/ui/AppsPage/AppActionDialogs.tsx
index 9f2908b5..39e57f90 100644
--- a/frontend/src/components/ui/AppsPage/AppActionDialogs.tsx
+++ b/frontend/src/components/ui/AppsPage/AppActionDialogs.tsx
@@ -1,5 +1,6 @@
 import DeleteAppDialog from '@/components/ui/AppsPage/DeleteAppDialog';
 import ShareAppDialog from '@/components/ui/AppsPage/ShareAppDialog';
+import UnshareDialog from '@/components/ui/AppsPage/UnshareDialog';
 import type { AppActions } from '@/hooks/useAppActions';
 
 /**
@@ -27,6 +28,13 @@ export default function AppActionDialogs({
         open={actions.removeTarget !== null}
         removing={actions.removing}
       />
+      <UnshareDialog
+        name={actions.unshareTarget?.name}
+        onClose={actions.closeUnshare}
+        onConfirm={actions.confirmUnshare}
+        open={actions.unshareTarget !== null}
+        unsharing={actions.unsharing}
+      />
     </>
   );
 }
diff --git a/frontend/src/components/ui/AppsPage/ListingActionDialogs.tsx b/frontend/src/components/ui/AppsPage/ListingActionDialogs.tsx
index 16109038..49747d5e 100644
--- a/frontend/src/components/ui/AppsPage/ListingActionDialogs.tsx
+++ b/frontend/src/components/ui/AppsPage/ListingActionDialogs.tsx
@@ -1,4 +1,5 @@
 import EditListingDialog from '@/components/ui/AppsPage/EditListingDialog';
+import UnshareDialog from '@/components/ui/AppsPage/UnshareDialog';
 import type { ListingActions } from '@/hooks/useListingActions';
 
 /**
@@ -11,12 +12,21 @@ export default function ListingActionDialogs({
   readonly actions: ListingActions;
 }) {
   return (
-    <EditListingDialog
-      listing={actions.editTarget}
-      onClose={actions.closeEdit}
-      onSave={actions.saveEdit}
-      open={actions.editTarget !== null}
-      saving={actions.saving}
-    />
+    <>
+      <EditListingDialog
+        listing={actions.editTarget}
+        onClose={actions.closeEdit}
+        onSave={actions.saveEdit}
+        open={actions.editTarget !== null}
+        saving={actions.saving}
+      />
+      <UnshareDialog
+        name={actions.unshareTarget?.name}
+        onClose={actions.closeUnshare}
+        onConfirm={actions.confirmUnshare}
+        open={actions.unshareTarget !== null}
+        unsharing={actions.unsharingId !== null}
+      />
+    </>
   );
 }
diff --git a/frontend/src/components/ui/AppsPage/UnshareDialog.tsx b/frontend/src/components/ui/AppsPage/UnshareDialog.tsx
new file mode 100644
index 00000000..92fcd25d
--- /dev/null
+++ b/frontend/src/components/ui/AppsPage/UnshareDialog.tsx
@@ -0,0 +1,55 @@
+import { Typography } from '@material-tailwind/react';
+import { FaUsersSlash } from 'react-icons/fa6';
+
+import FgDialog from '@/components/ui/Dialogs/FgDialog';
+import FgButton from '@/components/designSystem/atoms/FgButton';
+
+interface UnshareDialogProps {
+  readonly name?: string;
+  readonly open: boolean;
+  readonly onClose: () => void;
+  readonly onConfirm: () => void;
+  readonly unsharing: boolean;
+}
+
+/**
+ * Confirmation for removing a catalog listing. Unsharing affects other users
+ * (they can no longer see or add the app) and discards the listing's curated
+ * name/description, so it warrants a confirm rather than a one-click action.
+ */
+export default function UnshareDialog({
+  name,
+  open,
+  onClose,
+  onConfirm,
+  unsharing
+}: UnshareDialogProps) {
+  return (
+    <FgDialog onClose={onClose} open={open}>
+      <Typography className="text-foreground font-bold mb-2" type="h6">
+        Unshare from Catalog
+      </Typography>
+      <Typography className="text-foreground mb-4">
+        Remove <span className="font-semibold">{name ?? 'this app'}</span> from
+        the shared catalog? Other users will no longer see or be able to add it,
+        and its catalog name and description will be discarded. Your own copy is
+        unaffected.
+      </Typography>
+      <div className="flex justify-end gap-2">
+        <FgButton onClick={onClose} variant="ghost">
+          Keep shared
+        </FgButton>
+        <FgButton
+          color="error"
+          disabled={unsharing}
+          icon={FaUsersSlash}
+          loading={unsharing}
+          loadingText="Unsharing..."
+          onClick={onConfirm}
+        >
+          Unshare
+        </FgButton>
+      </div>
+    </FgDialog>
+  );
+}
diff --git a/frontend/src/components/ui/AppsPage/appMenuItems.ts b/frontend/src/components/ui/AppsPage/appMenuItems.ts
index 67dcd34e..cf8b464b 100644
--- a/frontend/src/components/ui/AppsPage/appMenuItems.ts
+++ b/frontend/src/components/ui/AppsPage/appMenuItems.ts
@@ -26,7 +26,7 @@ export function buildAppMenuItems(
     },
     {
       name: 'Unshare',
-      action: a => void actions.unshare(a),
+      action: a => actions.requestUnshare(a),
       shouldShow: isShared
     },
     { name: 'Update', action: a => void actions.update(a) },
diff --git a/frontend/src/components/ui/AppsPage/listingMenuItems.ts b/frontend/src/components/ui/AppsPage/listingMenuItems.ts
index 7c4ec749..5fd5426a 100644
--- a/frontend/src/components/ui/AppsPage/listingMenuItems.ts
+++ b/frontend/src/components/ui/AppsPage/listingMenuItems.ts
@@ -32,7 +32,7 @@ export function buildListingMenuItems(
     },
     {
       name: 'Unshare',
-      action: l => void actions.unshare(l),
+      action: l => actions.requestUnshare(l),
       color: 'text-error',
       shouldShow: canManage
     }
diff --git a/frontend/src/hooks/useAppActions.ts b/frontend/src/hooks/useAppActions.ts
index 2146ef58..724197f3 100644
--- a/frontend/src/hooks/useAppActions.ts
+++ b/frontend/src/hooks/useAppActions.ts
@@ -16,7 +16,10 @@ export interface AppActions {
   launch: (app: UserApp, entryPointId?: string) => void;
   view: (app: UserApp) => void;
   update: (app: UserApp) => Promise<void>;
-  unshare: (app: UserApp) => Promise<void>;
+  requestUnshare: (app: UserApp) => void;
+  confirmUnshare: () => Promise<void>;
+  unshareTarget: UserApp | null;
+  closeUnshare: () => void;
   share: (params: {
     url: string;
     manifest_path: string;
@@ -47,6 +50,7 @@ export function useAppActions(opts?: { onRemoved?: () => void }): AppActions {
   const navigate = useNavigate();
   const [shareTarget, setShareTarget] = useState<UserApp | null>(null);
   const [removeTarget, setRemoveTarget] = useState<UserApp | null>(null);
+  const [unshareTarget, setUnshareTarget] = useState<UserApp | null>(null);
 
   const updateAppMutation = useUpdateAppMutation();
   const removeAppMutation = useRemoveAppMutation();
@@ -85,13 +89,16 @@ export function useAppActions(opts?: { onRemoved?: () => void }): AppActions {
     }
   };
 
-  const unshare = async (app: UserApp) => {
-    if (app.listing_id === undefined || app.listing_id === null) {
+  const confirmUnshare = async () => {
+    const app = unshareTarget;
+    if (!app || app.listing_id === undefined || app.listing_id === null) {
+      setUnshareTarget(null);
       return;
     }
     try {
       await unshareListingMutation.mutateAsync({ listing_id: app.listing_id });
       toast.success('Removed from catalog');
+      setUnshareTarget(null);
     } catch (error) {
       showErrorToast(error, 'Failed to unshare');
     }
@@ -129,7 +136,10 @@ export function useAppActions(opts?: { onRemoved?: () => void }): AppActions {
     launch,
     view,
     update,
-    unshare,
+    requestUnshare: setUnshareTarget,
+    confirmUnshare,
+    unshareTarget,
+    closeUnshare: () => setUnshareTarget(null),
     share,
     requestShare: setShareTarget,
     requestRemove: setRemoveTarget,
diff --git a/frontend/src/hooks/useListingActions.ts b/frontend/src/hooks/useListingActions.ts
index f6a714c4..cb3fb8e9 100644
--- a/frontend/src/hooks/useListingActions.ts
+++ b/frontend/src/hooks/useListingActions.ts
@@ -19,7 +19,10 @@ export interface ListingActions {
   view: (listing: AppListing) => void;
   viewInMyApps: (app: UserApp) => void;
   add: (listing: AppListing) => Promise<void>;
-  unshare: (listing: AppListing) => Promise<void>;
+  requestUnshare: (listing: AppListing) => void;
+  confirmUnshare: () => Promise<void>;
+  unshareTarget: AppListing | null;
+  closeUnshare: () => void;
   saveEdit: (params: {
     listing_id: number;
     url: string;
@@ -47,6 +50,7 @@ export function useListingActions(opts?: {
 }): ListingActions {
   const navigate = useNavigate();
   const [editTarget, setEditTarget] = useState<AppListing | null>(null);
+  const [unshareTarget, setUnshareTarget] = useState<AppListing | null>(null);
   const addFromListingMutation = useAddFromListingMutation();
   const unshareListingMutation = useUnshareListingMutation();
   const updateListingMutation = useUpdateListingMutation();
@@ -68,10 +72,15 @@ export function useListingActions(opts?: {
     }
   };
 
-  const unshare = async (listing: AppListing) => {
+  const confirmUnshare = async () => {
+    const listing = unshareTarget;
+    if (!listing) {
+      return;
+    }
     try {
       await unshareListingMutation.mutateAsync({ listing_id: listing.id });
       toast.success('Removed from catalog');
+      setUnshareTarget(null);
       opts?.onUnshared?.();
     } catch (e) {
       showErrorToast(e, 'Failed to unshare');
@@ -93,7 +102,10 @@ export function useListingActions(opts?: {
     view,
     viewInMyApps,
     add,
-    unshare,
+    requestUnshare: setUnshareTarget,
+    confirmUnshare,
+    unshareTarget,
+    closeUnshare: () => setUnshareTarget(null),
     saveEdit,
     requestEdit: setEditTarget,
     editTarget,

From e6c2a65d2c3edc8567083eb72adc947daccf0259 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 11:46:11 -0400
Subject: [PATCH 67/89] Associate parameter labels with inputs; label catalog
 search
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Parameter field labels used htmlFor="param-<key>" but the inputs set no
matching id, so clicking a label didn't focus its field and screen readers
got no association — add the id to each input type. Also give the catalog
search box an aria-label.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 frontend/src/components/Catalog.tsx                   | 1 +
 frontend/src/components/ui/AppsPage/AppLaunchForm.tsx | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/frontend/src/components/Catalog.tsx b/frontend/src/components/Catalog.tsx
index 2d58c340..2aeca481 100644
--- a/frontend/src/components/Catalog.tsx
+++ b/frontend/src/components/Catalog.tsx
@@ -73,6 +73,7 @@ export default function Catalog() {
       <div className="mb-6 flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
         <div className="flex w-full flex-col gap-3 sm:flex-row sm:items-center">
           <input
+            aria-label="Search shared apps"
             className="w-full sm:max-w-sm p-2 text-foreground border rounded-sm focus:outline-none bg-background border-primary-light focus:border-primary"
             onChange={e => setSearch(e.target.value)}
             placeholder="Search by name, description, or sharer"
diff --git a/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx b/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
index db932b50..b1d1618e 100644
--- a/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
+++ b/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
@@ -110,6 +110,7 @@ function ParameterField({
       return (
         <input
           className={baseInputClass}
+          id={`param-${param.key}`}
           max={param.max}
           min={param.min}
           onChange={e => {
@@ -133,6 +134,7 @@ function ParameterField({
       return (
         <select
           className={baseInputClass}
+          id={`param-${param.key}`}
           onChange={e => onChange(e.target.value)}
           value={value !== undefined && value !== null ? String(value) : ''}
         >
@@ -151,6 +153,7 @@ function ParameterField({
         <div className="flex gap-2">
           <input
             className={`flex-1 ${baseInputClass}`}
+            id={`param-${param.key}`}
             onChange={e => {
               setFileDisplayPath(null);
               onChange(e.target.value);
@@ -198,6 +201,7 @@ function ParameterField({
       return (
         <input
           className={baseInputClass}
+          id={`param-${param.key}`}
           onChange={e => onChange(e.target.value)}
           placeholder={param.name}
           type="text"

From e167c4b9f4422388838ed01c7cca1bc9a52b2847 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 11:46:12 -0400
Subject: [PATCH 68/89] Small launch/add UX guards

- Show the "not in your library" banner only once /api/apps has loaded, so a
  failed apps query doesn't flag every app (installed ones included).
- Suppress a misleading "0 apps added" success toast.
- Guard the AddAppDialog Enter handlers with the same disabled condition as
  the Continue button to avoid a double discover/add.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 frontend/src/components/AppLaunch.tsx              |  6 ++++--
 frontend/src/components/Apps.tsx                   |  5 ++++-
 .../src/components/ui/AppsPage/AddAppDialog.tsx    | 14 ++++++++++++--
 3 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/frontend/src/components/AppLaunch.tsx b/frontend/src/components/AppLaunch.tsx
index fbd918db..8c49b372 100644
--- a/frontend/src/components/AppLaunch.tsx
+++ b/frontend/src/components/AppLaunch.tsx
@@ -218,8 +218,10 @@ export default function AppLaunch() {
         {isShared ? <SharedBadge /> : null}
       </AppPageHeader>
 
-      {/* Not-installed banner */}
-      {!appsQuery.isPending && !isInstalled ? (
+      {/* Not-installed banner — only once the apps list has actually loaded, so
+          a failed /api/apps query doesn't wrongly flag every app (including
+          installed ones) as missing. */}
+      {appsQuery.isSuccess && !isInstalled ? (
         <div className="mb-4 p-3 flex items-center gap-3 border border-primary-light rounded-lg bg-surface/30">
           <Typography className="text-foreground flex-1" type="small">
             This app is not in your library. Install it for quick access from
diff --git a/frontend/src/components/Apps.tsx b/frontend/src/components/Apps.tsx
index 11b3efe0..aba7a5ab 100644
--- a/frontend/src/components/Apps.tsx
+++ b/frontend/src/components/Apps.tsx
@@ -44,7 +44,10 @@ export default function Apps() {
       manifest_paths: manifestPaths
     });
     const count = apps.length;
-    toast.success(`${count} app${count !== 1 ? 's' : ''} added`);
+    // Guard against a misleading "0 apps added" success (nothing new to add).
+    if (count > 0) {
+      toast.success(`${count} app${count !== 1 ? 's' : ''} added`);
+    }
     setShowAddDialog(false);
   };
 
diff --git a/frontend/src/components/ui/AppsPage/AddAppDialog.tsx b/frontend/src/components/ui/AppsPage/AddAppDialog.tsx
index e6ba0f32..4958fa7b 100644
--- a/frontend/src/components/ui/AppsPage/AddAppDialog.tsx
+++ b/frontend/src/components/ui/AppsPage/AddAppDialog.tsx
@@ -157,7 +157,12 @@ export default function AddAppDialog({
                 validateUrl(value);
               }}
               onKeyDown={e => {
-                if (e.key === 'Enter') {
+                if (
+                  e.key === 'Enter' &&
+                  urlIsValid &&
+                  !discovering &&
+                  !adding
+                ) {
                   handleContinue();
                 }
               }}
@@ -178,7 +183,12 @@ export default function AddAppDialog({
                 setBranch(e.target.value);
               }}
               onKeyDown={e => {
-                if (e.key === 'Enter') {
+                if (
+                  e.key === 'Enter' &&
+                  urlIsValid &&
+                  !discovering &&
+                  !adding
+                ) {
                   handleContinue();
                 }
               }}

From c93d828a1efac03e5cfe767b964431e77c908421 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 12:04:51 -0400
Subject: [PATCH 69/89] Kill the whole local-job process tree on cancel, and
 confirm it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous local-cancel fix signalled only the recorded launcher bash PID.
bash does not forward SIGTERM to its foreground child, so the real workload
was orphaned and kept running while the DB was marked KILLED unconditionally
— Fileglancer reported success for a job that was still alive.

cancel_local now snapshots the launcher's full descendant tree before
signalling (children reparent to init once the launcher dies and can no
longer be traced), SIGTERMs the tree, then SIGKILLs any survivors after a
grace period, and reports whether the workload is actually gone (liveness is
/proc-based so a not-yet-reaped zombie counts as dead). cancel_job only
records KILLED when termination is confirmed; otherwise it raises, and the
UI surfaces the failure instead of a false success.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 fileglancer/apps/jobs.py   |  17 +++--
 fileglancer/user_worker.py | 132 ++++++++++++++++++++++++++++++-------
 tests/test_worker.py       |  59 ++++++++++++-----
 3 files changed, 167 insertions(+), 41 deletions(-)

diff --git a/fileglancer/apps/jobs.py b/fileglancer/apps/jobs.py
index 6296d5eb..beb616c4 100644
--- a/fileglancer/apps/jobs.py
+++ b/fileglancer/apps/jobs.py
@@ -1005,12 +1005,21 @@ async def cancel_job(job_id: int, username: str) -> db.JobDB:
             raise ValueError(f"Job {job_id} is not cancellable (status: {db_job.status})")
 
         # Actually stop the running job as the target user. The local executor
-        # spawns a bash subprocess whose PID a fresh executor can't reach, so
-        # cancel it by the PID persisted in its work dir; other executors
-        # (LSF, ...) cancel by cluster job id via py-cluster-api.
+        # spawns a bash subprocess (plus its child workload) whose PID a fresh
+        # executor can't reach, so kill it and its whole process tree by the
+        # PID persisted in its work dir; other executors (LSF, ...) cancel by
+        # cluster job id via py-cluster-api.
         if settings.cluster.executor == "local":
             if db_job.work_dir:
-                await _dispatch(username, "cancel_local", work_dir=db_job.work_dir)
+                result = await _dispatch(
+                    username, "cancel_local", work_dir=db_job.work_dir)
+                # Only record KILLED once the workload is confirmed gone —
+                # otherwise we'd report success while the job keeps running.
+                if not (result or {}).get("terminated", False):
+                    raise ValueError(
+                        f"Could not confirm job {job_id} was stopped; it may "
+                        f"still be running. Try again."
+                    )
         elif db_job.cluster_job_id:
             cluster_config = settings.cluster.model_dump(exclude_none=True)
             await _dispatch(
diff --git a/fileglancer/user_worker.py b/fileglancer/user_worker.py
index 4f1f0992..00f2711c 100644
--- a/fileglancer/user_worker.py
+++ b/fileglancer/user_worker.py
@@ -36,6 +36,7 @@
 import socket
 import struct
 import sys
+import time
 from pathlib import Path
 from typing import Any, Optional
 
@@ -783,38 +784,125 @@ def _action_get_job_file(request: dict, ctx: WorkerContext) -> dict:
     return {"content": content}
 
 
-@action("cancel_local")
-def _action_cancel_local(request: dict, ctx: WorkerContext) -> dict:
-    """Terminate a local-executor job by its recorded PID, as the user.
-
-    The local executor spawns `bash <script>` in the worker's own process
-    group (no new session), and a fresh executor in a later `cancel` dispatch
-    has no handle to it, so cancellation must target the PID persisted at
-    submit time ({work_dir}/job.pid). We signal that single PID — never the
-    process group, which would also hit the worker/server — with SIGTERM so
-    the job's EXIT trap still runs and writes its exit code for the poller.
-    Returns {"killed": bool}; a missing/stale pid file or an already-exited
-    process is a no-op (killed=False), not an error.
+def _proc_alive(pid: int) -> bool:
+    """True if pid is a live (non-zombie) process.
+
+    Uses /proc so a killed-but-not-yet-reaped process (state 'Z') counts as
+    dead — os.kill(pid, 0) alone would report a zombie as alive.
+    """
+    try:
+        with open(f"/proc/{pid}/stat", "rb") as f:
+            data = f.read()
+        # "pid (comm) state ...": comm may contain spaces/parens, so read the
+        # state character from just after the final ')'.
+        state = data[data.rindex(b")") + 2:data.rindex(b")") + 3]
+        return state not in (b"Z", b"X", b"x")
+    except (FileNotFoundError, ProcessLookupError):
+        return False
+    except OSError:
+        # /proc unavailable — fall back to a signal-0 probe.
+        try:
+            os.kill(pid, 0)
+            return True
+        except ProcessLookupError:
+            return False
+        except PermissionError:
+            return True
+
+
+def _descendant_pids(root_pid: int) -> list[int]:
+    """Return all descendant PIDs of root_pid (children, grandchildren, ...).
+
+    Reads PPID from /proc/<pid>/stat. Must be called before the root is killed:
+    once a parent dies its children reparent to init and can no longer be
+    traced back to root_pid.
+    """
+    children: dict[int, list[int]] = {}
+    for entry in os.listdir("/proc"):
+        if not entry.isdigit():
+            continue
+        try:
+            with open(f"/proc/{entry}/stat", "rb") as f:
+                data = f.read()
+            fields = data[data.rindex(b")") + 2:].split()
+            ppid = int(fields[1])  # state, ppid, ...
+        except (OSError, ValueError, IndexError):
+            continue
+        children.setdefault(ppid, []).append(int(entry))
+
+    result: list[int] = []
+    stack = [root_pid]
+    while stack:
+        for child in children.get(stack.pop(), []):
+            result.append(child)
+            stack.append(child)
+    return result
+
+
+def _terminate_process_tree(pid: int, grace_seconds: float = 3.0) -> bool:
+    """Terminate pid and all its descendants; return True once none survive.
+
+    The launcher bash does not forward SIGTERM to its foreground child, so
+    signalling the launcher alone leaves the real workload running (orphaned).
+    Snapshot the whole tree first (before anything dies and children reparent),
+    SIGTERM it, then SIGKILL any that outlast the grace period.
     """
     import signal
 
+    # Snapshot children before signalling; include the launcher itself.
+    targets = _descendant_pids(pid) + [pid]
+
+    def _signal_all(sig: int) -> None:
+        for target in targets:
+            try:
+                os.kill(target, sig)
+            except (ProcessLookupError, PermissionError):
+                pass
+
+    def _any_alive() -> bool:
+        return any(_proc_alive(target) for target in targets)
+
+    _signal_all(signal.SIGTERM)
+    deadline = time.monotonic() + grace_seconds
+    while _any_alive() and time.monotonic() < deadline:
+        time.sleep(0.1)
+
+    if _any_alive():
+        _signal_all(signal.SIGKILL)
+        # SIGKILL is immediate but reaping isn't; give the kernel a moment.
+        time.sleep(0.2)
+
+    return not _any_alive()
+
+
+@action("cancel_local")
+def _action_cancel_local(request: dict, ctx: WorkerContext) -> dict:
+    """Terminate a local-executor job and its whole process tree, as the user.
+
+    The local executor spawns `bash <script>` (in the worker's process group,
+    so we can't safely kill the group), and a fresh executor in a later
+    `cancel` dispatch has no handle to it — so cancellation targets the PID
+    persisted at submit time ({work_dir}/job.pid). Killing only that bash would
+    leave the actual workload (its child) running, so terminate the entire
+    descendant tree and confirm it is gone.
+
+    Returns {"terminated": bool}: True when nothing from the job is left
+    running (already-exited or successfully killed), False when a process
+    survived even SIGKILL — the caller must not then report the job as killed.
+    """
     work_dir = request.get("work_dir")
     if not work_dir:
-        return {"killed": False}
+        return {"terminated": True}
     pid_file = Path(work_dir) / "job.pid"
     if not pid_file.is_file():
-        return {"killed": False}
+        return {"terminated": True}
     try:
         pid = int(pid_file.read_text().strip())
     except (ValueError, OSError):
-        return {"killed": False}
-    try:
-        os.kill(pid, signal.SIGTERM)
-    except ProcessLookupError:
-        return {"killed": False}  # already gone
-    except OSError as e:
-        return {"error": str(e), "status_code": 500}
-    return {"killed": True}
+        return {"terminated": True}
+    if not _proc_alive(pid):
+        return {"terminated": True}  # already gone
+    return {"terminated": _terminate_process_tree(pid)}
 
 
 @action("get_service_url")
diff --git a/tests/test_worker.py b/tests/test_worker.py
index 83d8a555..051cfc5b 100644
--- a/tests/test_worker.py
+++ b/tests/test_worker.py
@@ -31,6 +31,8 @@
     _action_create_dirs,
     _action_validate_paths,
     _action_cancel_local,
+    _descendant_pids,
+    _proc_alive,
     WorkerContext,
     _HEADER_FMT,
     _HEADER_SIZE,
@@ -116,42 +118,69 @@ def test_ceiling_exceeds_snapshot_operation_timeout(self):
         assert _GIT_ACTION_TIMEOUT >= 600
 
 
-@pytest.mark.skipif(sys.platform == "win32",
-                    reason="POSIX signals / sleep command required")
+@pytest.mark.skipif(not os.path.isdir("/proc"),
+                    reason="/proc-based process-tree kill requires Linux")
 class TestCancelLocalAction:
-    """cancel_local terminates a local-executor job by its recorded PID."""
+    """cancel_local terminates a local-executor job's whole process tree."""
 
     def _ctx(self):
         return WorkerContext(username="test", db=None)
 
-    def test_kills_recorded_pid(self, tmp_path):
+    def _wait_gone(self, pid, timeout=5.0):
+        deadline = time.monotonic() + timeout
+        while _proc_alive(pid) and time.monotonic() < deadline:
+            time.sleep(0.05)
+        return not _proc_alive(pid)
+
+    def test_kills_launcher_and_child_workload(self, tmp_path):
+        """The reported bug: signalling only the launcher bash left its child
+        workload running. The whole tree must be terminated."""
         import subprocess as sp
-        proc = sp.Popen(["sleep", "60"])
+        # `; :` prevents bash from exec-optimizing into sleep, so bash stays the
+        # parent of a real child `sleep` — mirroring a job script's workload.
+        proc = sp.Popen(["bash", "-c", "sleep 300; :"])
         try:
+            # Wait for bash to fork its child.
+            deadline = time.monotonic() + 5
+            children = []
+            while time.monotonic() < deadline:
+                children = _descendant_pids(proc.pid)
+                if children:
+                    break
+                time.sleep(0.05)
+            assert children, "expected bash to spawn a child workload"
+
             (tmp_path / "job.pid").write_text(str(proc.pid))
             result = _action_cancel_local({"work_dir": str(tmp_path)}, self._ctx())
-            assert result == {"killed": True}
-            proc.wait(timeout=5)
-            assert proc.returncode != 0  # terminated by SIGTERM, not a clean exit
+
+            assert result == {"terminated": True}
+            proc.wait(timeout=5)  # reap the launcher
+            assert self._wait_gone(proc.pid), "launcher bash survived"
+            for child in children:
+                assert self._wait_gone(child), f"child {child} survived cancel"
         finally:
+            for p in [*_descendant_pids(proc.pid), proc.pid]:
+                try:
+                    os.kill(p, 9)
+                except OSError:
+                    pass
             if proc.poll() is None:
-                proc.kill()
                 proc.wait(timeout=5)
 
-    def test_missing_pid_file_is_noop(self, tmp_path):
+    def test_missing_pid_file_is_terminated(self, tmp_path):
         assert _action_cancel_local(
-            {"work_dir": str(tmp_path)}, self._ctx()) == {"killed": False}
+            {"work_dir": str(tmp_path)}, self._ctx()) == {"terminated": True}
 
-    def test_missing_work_dir_is_noop(self):
-        assert _action_cancel_local({}, self._ctx()) == {"killed": False}
+    def test_missing_work_dir_is_terminated(self):
+        assert _action_cancel_local({}, self._ctx()) == {"terminated": True}
 
-    def test_already_dead_pid_is_noop(self, tmp_path):
+    def test_already_dead_pid_is_terminated(self, tmp_path):
         import subprocess as sp
         proc = sp.Popen(["sleep", "0.01"])
         proc.wait()  # reap so the PID is no longer a live process
         (tmp_path / "job.pid").write_text(str(proc.pid))
         assert _action_cancel_local(
-            {"work_dir": str(tmp_path)}, self._ctx()) == {"killed": False}
+            {"work_dir": str(tmp_path)}, self._ctx()) == {"terminated": True}
 
 
 class TestIPCProtocol:

From b8247c75ea131a2a7c88c832f087b38c70009459 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 12:11:50 -0400
Subject: [PATCH 70/89] Allowlist the worker environment instead of only
 stripping FGC_*

Stripping FGC_* protected Fileglancer's own settings but left generic
deployment secrets in the server environment (AWS_SECRET_ACCESS_KEY,
GITHUB_TOKEN, DATABASE_URL, ...) readable by any user via the worker's
/proc/<pid>/environ. Switch to an allowlist: only pass variables the worker
legitimately needs (PATH/HOME/locale/tmp/proxy/SSH, scheduler LSF_/SLURM_/
SGE_/PBS_, environment modules, conda/pixi, containers, PYTHONPATH). FGC_* is
dropped unconditionally, even if listed in passthrough.

Site-specific vars go through the new settings.apps.worker_env_passthrough
(exact names or '_'-suffixed prefixes) rather than widening the allowlist in
code.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 docs/config.yaml.template  |  6 +++
 fileglancer/settings.py    |  7 ++++
 fileglancer/worker_pool.py | 81 ++++++++++++++++++++++++++++----------
 tests/test_worker.py       | 64 ++++++++++++++++++++++++++----
 4 files changed, 129 insertions(+), 29 deletions(-)

diff --git a/docs/config.yaml.template b/docs/config.yaml.template
index 6b005cf1..47b863d7 100644
--- a/docs/config.yaml.template
+++ b/docs/config.yaml.template
@@ -137,6 +137,12 @@ session_cookie_secure: true
 #   extra_paths:                # Paths appended to $PATH in every job script
 #     - /opt/nextflow/bin       # and used when verifying tool requirements
 #     - /opt/pixi/bin
+#   worker_env_passthrough:     # Extra env var names (exact) or prefixes
+#     - MYSITE_LICENSE_SERVER   # (ending in '_') to pass to per-user workers,
+#     - MYSITE_                 # on top of the built-in allowlist. The worker
+#                               # env is an allowlist so no server secret leaks
+#                               # to the user; add only non-secret vars your
+#                               # scheduler or tools need. FGC_* is never passed.
 
 # Cluster configuration
 # Mirrors py-cluster-api ClusterConfig - all fields are optional
diff --git a/fileglancer/settings.py b/fileglancer/settings.py
index 9563cba8..053a0796 100644
--- a/fileglancer/settings.py
+++ b/fileglancer/settings.py
@@ -38,6 +38,13 @@ class ClusterSettings(BaseModel):
 class AppsSettings(BaseModel):
     """Apps-specific configuration (not passed to py-cluster-api)."""
     extra_paths: List[str] = []
+    # Extra environment variable names (exact) or prefixes (ending in '_') to
+    # pass through to per-user workers, on top of the built-in allowlist. The
+    # worker env is an allowlist so no server secret leaks to the user via
+    # /proc/<pid>/environ; add site-specific vars your scheduler or tools need
+    # here rather than widening the allowlist in code. FGC_* is never passed
+    # through regardless of this list.
+    worker_env_passthrough: List[str] = []
 
 
 class Settings(BaseSettings):
diff --git a/fileglancer/worker_pool.py b/fileglancer/worker_pool.py
index 5d3c2b0c..32659b91 100644
--- a/fileglancer/worker_pool.py
+++ b/fileglancer/worker_pool.py
@@ -73,24 +73,62 @@ def _timeout_for_action(action: str) -> float:
     return _GIT_ACTION_TIMEOUT if action in _LONG_ACTIONS else _DEFAULT_REQUEST_TIMEOUT
 
 
+# Worker env is an allowlist, not a denylist: workers run as the (untrusted)
+# target user, so anything in their environment is readable by that user via
+# /proc/<pid>/environ. Only pass variables the worker legitimately needs (git,
+# ssh, locale, tmp, the scheduler, environment modules, conda/pixi, containers)
+# so no server secret leaks — not Fileglancer's own FGC_* vars, and not generic
+# deployment secrets like AWS_SECRET_ACCESS_KEY or GITHUB_TOKEN. Site-specific
+# additions go through settings.apps.worker_env_passthrough, not code.
+_WORKER_ENV_ALLOW_NAMES = frozenset({
+    "PATH", "HOME", "USER", "LOGNAME", "SHELL", "PWD",
+    "LANG", "LANGUAGE", "TZ", "TERM",
+    "TMPDIR", "TMP", "TEMP",
+    "HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY",
+    "http_proxy", "https_proxy", "no_proxy",
+    "SSH_AUTH_SOCK",
+    # Needed for the worker's own imports under path-based installs (not a
+    # secret); harmless when unused (site-packages installs don't rely on it).
+    "PYTHONPATH", "VIRTUAL_ENV",
+})
+_WORKER_ENV_ALLOW_PREFIXES = (
+    "LC_",                          # locale
+    "LSF_", "LSB_", "EGO_",         # IBM Spectrum LSF
+    "SLURM_",                       # Slurm
+    "SGE_", "PBS_",                 # SGE / PBS / Torque
+    "MODULE", "MODULES_", "LMOD_",  # environment modules
+    "CONDA_", "MAMBA_", "PIXI_",    # conda / pixi
+    "APPTAINER_", "SINGULARITY_",   # containers
+    "GIT_",                         # git config via env (not secrets by convention)
+)
+
+
 def _build_worker_env(base_env: dict, home_dir: str, log_level: str,
-                      child_fd: int) -> dict:
-    """Build the environment for a worker subprocess.
-
-    Workers run as the (untrusted) target user, so anything in their
-    environment is readable by that user via /proc/<pid>/environ. Every
-    Fileglancer setting is exposed through the ``fgc_`` env prefix (see
-    Settings), so we strip *all* ``FGC_*`` variables — the session secret key,
-    Okta client secret, Atlassian token, DB URL, etc. — rather than an
-    ad-hoc denylist that would miss newly-added secrets. The worker receives
-    its config over the IPC socket instead (DB access via RpcDbProxy), plus the
-    two operational vars set below.
-
-    Non-``FGC_`` variables (PATH, HOME, locale, SSH, and scheduler vars such as
-    LSF_*) are preserved so git, ssh, and the cluster tools still function; an
-    allowlist would risk silently dropping scheduler env the submit host needs.
+                      child_fd: int, passthrough: Optional[list] = None) -> dict:
+    """Build the environment for a worker subprocess (allowlist).
+
+    Keeps only allowlisted variables (see the module constants) plus any
+    operator-configured ``passthrough`` names/prefixes, then always sets the
+    two operational vars the worker itself needs. FGC_* is dropped
+    unconditionally — even if an operator lists it in passthrough — so
+    Fileglancer secrets (session key, Okta/Atlassian secrets, DB URL) can never
+    reach the user. The worker gets its config over the IPC socket instead (DB
+    access via RpcDbProxy).
+
+    A passthrough entry ending in ``_`` is treated as a prefix; otherwise it is
+    an exact variable name.
     """
-    env = {k: v for k, v in base_env.items() if not k.upper().startswith("FGC_")}
+    extra_names = {p for p in (passthrough or []) if not p.endswith("_")}
+    extra_prefixes = tuple(p for p in (passthrough or []) if p.endswith("_"))
+    allow_names = _WORKER_ENV_ALLOW_NAMES | extra_names
+    allow_prefixes = _WORKER_ENV_ALLOW_PREFIXES + extra_prefixes
+
+    def _allowed(key: str) -> bool:
+        if key.upper().startswith("FGC_"):
+            return False  # never leak Fileglancer secrets
+        return key in allow_names or key.startswith(allow_prefixes)
+
+    env = {k: v for k, v in base_env.items() if _allowed(k)}
     env["HOME"] = home_dir
     env["FGC_LOG_LEVEL"] = log_level
     env["FGC_WORKER_FD"] = str(child_fd)
@@ -405,12 +443,13 @@ async def _spawn_worker(self, username: str) -> UserWorker:
         # Create Unix socketpair for IPC
         parent_sock, child_sock = socket.socketpair()
 
-        # Worker subprocess deliberately does NOT receive any Fileglancer
-        # secrets (DB URL, session secret key, Okta client secret, Atlassian
-        # token, ...) — it runs as the (untrusted) target user, so they would
-        # be readable via /proc/<pid>/environ. See _build_worker_env.
+        # The worker runs as the (untrusted) target user, so its environment is
+        # readable via /proc/<pid>/environ. Build it from an allowlist so no
+        # server secret leaks — neither Fileglancer's FGC_* vars nor generic
+        # deployment secrets. See _build_worker_env.
         env = _build_worker_env(
-            os.environ, home_dir, self.settings.log_level, child_sock.fileno()
+            os.environ, home_dir, self.settings.log_level, child_sock.fileno(),
+            passthrough=self.settings.apps.worker_env_passthrough,
         )
 
         logger.info(
diff --git a/tests/test_worker.py b/tests/test_worker.py
index 051cfc5b..bad3ebcb 100644
--- a/tests/test_worker.py
+++ b/tests/test_worker.py
@@ -56,7 +56,7 @@
 # ---------------------------------------------------------------------------
 
 class TestBuildWorkerEnv:
-    """Worker environment must not carry Fileglancer secrets to the user."""
+    """Worker environment is an allowlist: no server secret reaches the user."""
 
     def test_strips_all_fgc_variables(self):
         base = {
@@ -80,24 +80,72 @@ def test_strips_all_fgc_variables(self):
         assert "FGC_ATLASSIAN_TOKEN" not in env
         assert "fgc_test_api_key" not in env
 
-    def test_preserves_non_fgc_and_sets_operational_vars(self):
+    def test_drops_generic_deployment_secrets(self):
+        # Non-FGC secrets that may sit in a server's environment must not reach
+        # the user's worker either.
         base = {
             "PATH": "/usr/bin:/bin",
-            "LSF_ENVDIR": "/opt/lsf/conf",
+            "AWS_SECRET_ACCESS_KEY": "aws-secret",
+            "AWS_SESSION_TOKEN": "aws-token",
+            "GITHUB_TOKEN": "gh-secret",
+            "DATABASE_URL": "postgres://u:pw@h/db",
+            "MY_APP_CREDENTIALS": "creds",
+        }
+        env = _build_worker_env(base, "/home/user", "INFO", 7)
+        assert env["PATH"] == "/usr/bin:/bin"  # allowlisted, kept
+        assert "AWS_SECRET_ACCESS_KEY" not in env
+        assert "AWS_SESSION_TOKEN" not in env
+        assert "GITHUB_TOKEN" not in env
+        assert "DATABASE_URL" not in env
+        assert "MY_APP_CREDENTIALS" not in env
+
+    def test_preserves_allowlisted_and_sets_operational_vars(self):
+        base = {
+            "PATH": "/usr/bin:/bin",
+            "LSF_ENVDIR": "/opt/lsf/conf",       # LSF_ prefix
+            "LSB_JOBID": "42",                    # LSB_ prefix
+            "SLURM_CONF": "/etc/slurm.conf",      # SLURM_ prefix
+            "MODULEPATH": "/opt/modules",         # MODULE prefix
+            "CONDA_EXE": "/opt/conda/bin/conda",  # CONDA_ prefix
+            "APPTAINER_CACHEDIR": "/scratch/ac",  # APPTAINER_ prefix
             "LANG": "en_US.UTF-8",
+            "LC_ALL": "en_US.UTF-8",              # LC_ prefix
             "SSH_AUTH_SOCK": "/tmp/ssh-agent.sock",
+            "HTTPS_PROXY": "http://proxy:8080",
         }
         env = _build_worker_env(base, "/home/alice", "DEBUG", 9)
-        # Scheduler / git / locale vars survive so cluster tools keep working.
-        assert env["PATH"] == "/usr/bin:/bin"
-        assert env["LSF_ENVDIR"] == "/opt/lsf/conf"
-        assert env["LANG"] == "en_US.UTF-8"
-        assert env["SSH_AUTH_SOCK"] == "/tmp/ssh-agent.sock"
+        for key in base:
+            assert key in env, f"{key} should be allowlisted"
         # Operational vars the worker needs are set explicitly.
         assert env["HOME"] == "/home/alice"
         assert env["FGC_LOG_LEVEL"] == "DEBUG"
         assert env["FGC_WORKER_FD"] == "9"
 
+    def test_passthrough_allows_site_specific_names_and_prefixes(self):
+        base = {
+            "PATH": "/usr/bin",
+            "SITE_LICENSE_SERVER": "27000@lic",  # exact name
+            "ACME_FOO": "a",                       # ACME_ prefix
+            "ACME_BAR": "b",
+            "OTHER_VAR": "dropped",
+        }
+        env = _build_worker_env(
+            base, "/home/user", "INFO", 7,
+            passthrough=["SITE_LICENSE_SERVER", "ACME_"],
+        )
+        assert env["SITE_LICENSE_SERVER"] == "27000@lic"
+        assert env["ACME_FOO"] == "a"
+        assert env["ACME_BAR"] == "b"
+        assert "OTHER_VAR" not in env  # not allowlisted, not in passthrough
+
+    def test_passthrough_cannot_reintroduce_fgc_secrets(self):
+        base = {"FGC_SESSION_SECRET_KEY": "super-secret"}
+        env = _build_worker_env(
+            base, "/home/user", "INFO", 7,
+            passthrough=["FGC_SESSION_SECRET_KEY", "FGC_"],
+        )
+        assert "FGC_SESSION_SECRET_KEY" not in env
+
 
 class TestActionTimeout:
     """Git-heavy actions get a longer receive timeout than the default."""

From 3a317cd2af9a876067961304cdbea9149b9491a9 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 12:27:32 -0400
Subject: [PATCH 71/89] Preserve cluster extra args quoting

Use shlex.join when exposing cluster default extra_args so values with spaces or scheduler metacharacters round-trip through the launch form and backend shlex.split handling. Add endpoint coverage for quoted args.

Co-authored-by: Codex <codex@openai.com>
---
 fileglancer/server.py        |  3 ++-
 tests/test_apps_endpoints.py | 21 +++++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/fileglancer/server.py b/fileglancer/server.py
index 265d60bf..1ed68f95 100644
--- a/fileglancer/server.py
+++ b/fileglancer/server.py
@@ -1,6 +1,7 @@
 import asyncio
 import os
 import re
+import shlex
 import sys
 try:
     import pwd
@@ -2291,7 +2292,7 @@ async def add_from_catalog(listing_id: int,
              description="Get cluster configuration defaults")
     async def get_cluster_defaults():
         return {
-            "extra_args": " ".join(settings.cluster.extra_args),
+            "extra_args": shlex.join(settings.cluster.extra_args),
         }
 
     @app.post("/api/jobs", response_model=Job,
diff --git a/tests/test_apps_endpoints.py b/tests/test_apps_endpoints.py
index e15f1042..2e27c648 100644
--- a/tests/test_apps_endpoints.py
+++ b/tests/test_apps_endpoints.py
@@ -1,6 +1,7 @@
 """Tests for /api/apps endpoints backed by the user_apps table."""
 
 import os
+import shlex
 import shutil
 import tempfile
 from datetime import datetime, UTC, timedelta
@@ -825,6 +826,26 @@ def test_delete_finished_job_removes_row(test_client, db_session):
     assert get_job(db_session, job_id, TEST_USERNAME) is None
 
 
+def test_cluster_defaults_preserves_extra_args_tokens(temp_dir):
+    """Cluster default extra_args are shell-quoted so the launch form can submit
+    them back through shlex.split without losing spaces or scheduler syntax."""
+    args = ["-P", "project with spaces", "-R", "select[mem>8000] rusage[mem=8000]"]
+    settings = Settings(
+        db_url=f"sqlite:///{os.path.join(temp_dir, 'defaults.db')}",
+        file_share_mounts=[],
+        cli_mode=True,
+        cluster={"extra_args": args},
+    )
+    client = TestClient(create_app(settings))
+
+    response = client.get("/api/cluster-defaults")
+
+    assert response.status_code == 200
+    value = response.json()["extra_args"]
+    assert value == shlex.join(args)
+    assert shlex.split(value) == args
+
+
 def test_fetch_manifest_uses_cache_for_installed_app(test_client, db_session):
     """POST /api/apps/manifest returns cached manifest without disk read."""
     cached = _make_manifest(name="Cached App")

From 03945176c30d5b02ced9c95ba7d16c5ddfab0eaa Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 12:28:55 -0400
Subject: [PATCH 72/89] Show the trust notice on direct catalog "Add" too
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The code-execution trust notice only appeared in the add-from-URL dialog and
(inline) on the listing detail page. The catalog card "Add" button and the
row/card overflow menu called useListingActions.add() directly, installing an
app — which runs its repo's code as the user on launch — with no warning.

Route all catalog adds (card button, menu, listing detail) through a
requestAdd/confirmAdd flow backed by a new AddFromCatalogDialog that shows
the source repo/revision and the trust notice at the point of adding. The
now-redundant inline notice on the listing detail page is dropped in favor of
the dialog, so every add path surfaces the warning consistently.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 frontend/src/components/ListingDetail.tsx     |  5 +-
 .../ui/AppsPage/AddFromCatalogDialog.tsx      | 68 +++++++++++++++++++
 .../ui/AppsPage/ListingActionDialogs.tsx      |  8 +++
 .../components/ui/AppsPage/ListingCard.tsx    |  2 +-
 .../ui/AppsPage/listingMenuItems.ts           |  2 +-
 frontend/src/hooks/useListingActions.ts       | 18 ++++-
 6 files changed, 94 insertions(+), 9 deletions(-)
 create mode 100644 frontend/src/components/ui/AppsPage/AddFromCatalogDialog.tsx

diff --git a/frontend/src/components/ListingDetail.tsx b/frontend/src/components/ListingDetail.tsx
index b3f0571a..e73c6924 100644
--- a/frontend/src/components/ListingDetail.tsx
+++ b/frontend/src/components/ListingDetail.tsx
@@ -9,7 +9,6 @@ import {
 import { FaUsersSlash } from 'react-icons/fa6';
 
 import AppPageHeader from '@/components/ui/AppsPage/AppPageHeader';
-import AppTrustNotice from '@/components/ui/AppsPage/AppTrustNotice';
 import EntryPointsList from '@/components/ui/AppsPage/EntryPointsList';
 import ListingActionDialogs from '@/components/ui/AppsPage/ListingActionDialogs';
 import ListingInfoTable from '@/components/ui/AppsPage/ListingInfoTable';
@@ -121,7 +120,7 @@ export default function ListingDetail() {
                 icon={HiOutlinePlus}
                 loading={adding}
                 loadingText="Adding..."
-                onClick={() => void actions.add(listing)}
+                onClick={() => actions.requestAdd(listing)}
                 size="sm"
               >
                 Add to my apps
@@ -176,8 +175,6 @@ export default function ListingDetail() {
       <div className="max-w-2xl">
         <ListingInfoTable installedApp={installedApp} listing={listing} />
 
-        {!alreadyAdded ? <AppTrustNotice className="mt-4" /> : null}
-
         {manifestMutation.isPending && !manifest ? (
           <Typography className="text-foreground" type="small">
             Loading entry points...
diff --git a/frontend/src/components/ui/AppsPage/AddFromCatalogDialog.tsx b/frontend/src/components/ui/AppsPage/AddFromCatalogDialog.tsx
new file mode 100644
index 00000000..3d03b53a
--- /dev/null
+++ b/frontend/src/components/ui/AppsPage/AddFromCatalogDialog.tsx
@@ -0,0 +1,68 @@
+import { Typography } from '@material-tailwind/react';
+import { HiOutlinePlus } from 'react-icons/hi';
+
+import FgDialog from '@/components/ui/Dialogs/FgDialog';
+import FgButton from '@/components/designSystem/atoms/FgButton';
+import AppTrustNotice from '@/components/ui/AppsPage/AppTrustNotice';
+import { repoLabel } from '@/utils';
+import type { AppListing } from '@/shared.types';
+
+interface AddFromCatalogDialogProps {
+  readonly listing: AppListing | null;
+  readonly open: boolean;
+  readonly onClose: () => void;
+  readonly onConfirm: () => void;
+  readonly adding: boolean;
+}
+
+/**
+ * Confirmation for adding a catalog listing to the user's apps. Adding pins and
+ * (on launch) runs code from the listing's repository as the user, so this
+ * surfaces the source repo and the trust notice at the point of adding — the
+ * catalog card/menu "Add" buttons would otherwise install with no warning.
+ */
+export default function AddFromCatalogDialog({
+  listing,
+  open,
+  onClose,
+  onConfirm,
+  adding
+}: AddFromCatalogDialogProps) {
+  return (
+    <FgDialog onClose={onClose} open={open}>
+      <Typography className="text-foreground font-bold mb-2" type="h6">
+        Add to My Apps
+      </Typography>
+      <Typography className="text-foreground mb-3">
+        Add <span className="font-semibold">{listing?.name ?? 'this app'}</span>{' '}
+        to your apps?
+      </Typography>
+      {listing ? (
+        <Typography className="text-foreground text-sm mb-3">
+          Source: <span className="font-mono">{repoLabel(listing.url)}</span>
+          {listing.branch ? (
+            <>
+              {' '}
+              (revision <span className="font-mono">{listing.branch}</span>)
+            </>
+          ) : null}
+        </Typography>
+      ) : null}
+      <AppTrustNotice className="mb-4" />
+      <div className="flex justify-end gap-2">
+        <FgButton onClick={onClose} variant="ghost">
+          Cancel
+        </FgButton>
+        <FgButton
+          disabled={adding}
+          icon={HiOutlinePlus}
+          loading={adding}
+          loadingText="Adding..."
+          onClick={onConfirm}
+        >
+          Add to My Apps
+        </FgButton>
+      </div>
+    </FgDialog>
+  );
+}
diff --git a/frontend/src/components/ui/AppsPage/ListingActionDialogs.tsx b/frontend/src/components/ui/AppsPage/ListingActionDialogs.tsx
index 49747d5e..cc6d9a56 100644
--- a/frontend/src/components/ui/AppsPage/ListingActionDialogs.tsx
+++ b/frontend/src/components/ui/AppsPage/ListingActionDialogs.tsx
@@ -1,3 +1,4 @@
+import AddFromCatalogDialog from '@/components/ui/AppsPage/AddFromCatalogDialog';
 import EditListingDialog from '@/components/ui/AppsPage/EditListingDialog';
 import UnshareDialog from '@/components/ui/AppsPage/UnshareDialog';
 import type { ListingActions } from '@/hooks/useListingActions';
@@ -13,6 +14,13 @@ export default function ListingActionDialogs({
 }) {
   return (
     <>
+      <AddFromCatalogDialog
+        adding={actions.addingId !== null}
+        listing={actions.addTarget}
+        onClose={actions.closeAdd}
+        onConfirm={actions.confirmAdd}
+        open={actions.addTarget !== null}
+      />
       <EditListingDialog
         listing={actions.editTarget}
         onClose={actions.closeEdit}
diff --git a/frontend/src/components/ui/AppsPage/ListingCard.tsx b/frontend/src/components/ui/AppsPage/ListingCard.tsx
index 5ae86c7a..7a1efa25 100644
--- a/frontend/src/components/ui/AppsPage/ListingCard.tsx
+++ b/frontend/src/components/ui/AppsPage/ListingCard.tsx
@@ -77,7 +77,7 @@ export default function ListingCard({
                 icon={HiOutlinePlus}
                 loading={adding}
                 loadingText="Adding..."
-                onClick={() => void actions.add(listing)}
+                onClick={() => actions.requestAdd(listing)}
                 size="sm"
               >
                 Add
diff --git a/frontend/src/components/ui/AppsPage/listingMenuItems.ts b/frontend/src/components/ui/AppsPage/listingMenuItems.ts
index 5fd5426a..c87e6fc4 100644
--- a/frontend/src/components/ui/AppsPage/listingMenuItems.ts
+++ b/frontend/src/components/ui/AppsPage/listingMenuItems.ts
@@ -16,7 +16,7 @@ export function buildListingMenuItems(
   return [
     {
       name: 'Add to my apps',
-      action: l => void actions.add(l),
+      action: l => actions.requestAdd(l),
       shouldShow: !alreadyAdded
     },
     { name: 'View', action: l => actions.view(l) },
diff --git a/frontend/src/hooks/useListingActions.ts b/frontend/src/hooks/useListingActions.ts
index cb3fb8e9..e93a0a05 100644
--- a/frontend/src/hooks/useListingActions.ts
+++ b/frontend/src/hooks/useListingActions.ts
@@ -18,7 +18,10 @@ export function buildListingDetailPath(listingId: number): string {
 export interface ListingActions {
   view: (listing: AppListing) => void;
   viewInMyApps: (app: UserApp) => void;
-  add: (listing: AppListing) => Promise<void>;
+  requestAdd: (listing: AppListing) => void;
+  confirmAdd: () => Promise<void>;
+  addTarget: AppListing | null;
+  closeAdd: () => void;
   requestUnshare: (listing: AppListing) => void;
   confirmUnshare: () => Promise<void>;
   unshareTarget: AppListing | null;
@@ -50,6 +53,7 @@ export function useListingActions(opts?: {
 }): ListingActions {
   const navigate = useNavigate();
   const [editTarget, setEditTarget] = useState<AppListing | null>(null);
+  const [addTarget, setAddTarget] = useState<AppListing | null>(null);
   const [unshareTarget, setUnshareTarget] = useState<AppListing | null>(null);
   const addFromListingMutation = useAddFromListingMutation();
   const unshareListingMutation = useUnshareListingMutation();
@@ -63,10 +67,15 @@ export function useListingActions(opts?: {
     navigate(buildAppDetailPath(app.url, app.manifest_path));
   };
 
-  const add = async (listing: AppListing) => {
+  const confirmAdd = async () => {
+    const listing = addTarget;
+    if (!listing) {
+      return;
+    }
     try {
       await addFromListingMutation.mutateAsync({ listing_id: listing.id });
       toast.success(`Added "${listing.name}"`);
+      setAddTarget(null);
     } catch (e) {
       showErrorToast(e, 'Failed to add app');
     }
@@ -101,7 +110,10 @@ export function useListingActions(opts?: {
   return {
     view,
     viewInMyApps,
-    add,
+    requestAdd: setAddTarget,
+    confirmAdd,
+    addTarget,
+    closeAdd: () => setAddTarget(null),
     requestUnshare: setUnshareTarget,
     confirmUnshare,
     unshareTarget,

From d494c21eecdd092bcae005b82ee2c7b2835028ff Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 12:33:24 -0400
Subject: [PATCH 73/89] Show sharer, date, and a linked GitHub source in the
 add dialog

The catalog add confirmation now shows who shared the app and when, and
renders the source as a GitHub link with the brand icon (the same
presentation used in the listing info table) instead of a plain "owner/repo"
label. Extract that GitHub-URL-with-icon presentation into a shared
GithubUrlValue component and reuse it in both places.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../ui/AppsPage/AddFromCatalogDialog.tsx      | 28 ++++++++++++-------
 .../components/ui/AppsPage/GithubUrlValue.tsx | 21 ++++++++++++++
 .../ui/AppsPage/ListingInfoTable.tsx          | 19 +------------
 3 files changed, 40 insertions(+), 28 deletions(-)
 create mode 100644 frontend/src/components/ui/AppsPage/GithubUrlValue.tsx

diff --git a/frontend/src/components/ui/AppsPage/AddFromCatalogDialog.tsx b/frontend/src/components/ui/AppsPage/AddFromCatalogDialog.tsx
index 3d03b53a..33c470bc 100644
--- a/frontend/src/components/ui/AppsPage/AddFromCatalogDialog.tsx
+++ b/frontend/src/components/ui/AppsPage/AddFromCatalogDialog.tsx
@@ -4,7 +4,8 @@ import { HiOutlinePlus } from 'react-icons/hi';
 import FgDialog from '@/components/ui/Dialogs/FgDialog';
 import FgButton from '@/components/designSystem/atoms/FgButton';
 import AppTrustNotice from '@/components/ui/AppsPage/AppTrustNotice';
-import { repoLabel } from '@/utils';
+import GithubUrlValue from '@/components/ui/AppsPage/GithubUrlValue';
+import { formatDateString } from '@/utils';
 import type { AppListing } from '@/shared.types';
 
 interface AddFromCatalogDialogProps {
@@ -38,15 +39,22 @@ export default function AddFromCatalogDialog({
         to your apps?
       </Typography>
       {listing ? (
-        <Typography className="text-foreground text-sm mb-3">
-          Source: <span className="font-mono">{repoLabel(listing.url)}</span>
-          {listing.branch ? (
-            <>
-              {' '}
-              (revision <span className="font-mono">{listing.branch}</span>)
-            </>
-          ) : null}
-        </Typography>
+        <div className="mb-4 space-y-1.5 text-sm">
+          <div className="flex items-center gap-2">
+            <span className="text-foreground font-medium shrink-0">
+              Source:
+            </span>
+            <GithubUrlValue url={listing.url} />
+          </div>
+          <div className="text-foreground">
+            <span className="font-medium">Shared by:</span>{' '}
+            {listing.owner_username}
+          </div>
+          <div className="text-foreground">
+            <span className="font-medium">Shared on:</span>{' '}
+            {formatDateString(listing.published_at)}
+          </div>
+        </div>
       ) : null}
       <AppTrustNotice className="mb-4" />
       <div className="flex justify-end gap-2">
diff --git a/frontend/src/components/ui/AppsPage/GithubUrlValue.tsx b/frontend/src/components/ui/AppsPage/GithubUrlValue.tsx
new file mode 100644
index 00000000..2f3a485d
--- /dev/null
+++ b/frontend/src/components/ui/AppsPage/GithubUrlValue.tsx
@@ -0,0 +1,21 @@
+import { TbBrandGithub } from 'react-icons/tb';
+
+import FgExternalLink from '@/components/designSystem/atoms/FgExternalLink';
+import FgIcon from '@/components/designSystem/atoms/FgIcon';
+
+/** A GitHub repo URL rendered with the GitHub icon and an external link. */
+export default function GithubUrlValue({ url }: { readonly url: string }) {
+  return (
+    <div className="flex items-center gap-1.5 text-foreground">
+      <FgIcon className="shrink-0" icon={TbBrandGithub} size="sm" />
+      <FgExternalLink
+        className="break-all"
+        href={url}
+        showIcon={false}
+        size="sm"
+      >
+        {url}
+      </FgExternalLink>
+    </div>
+  );
+}
diff --git a/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx b/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx
index 5d1a0583..4e094aee 100644
--- a/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx
+++ b/frontend/src/components/ui/AppsPage/ListingInfoTable.tsx
@@ -1,9 +1,8 @@
 import type { ReactNode } from 'react';
-import { TbBrandGithub } from 'react-icons/tb';
 
 import FgExternalLink from '@/components/designSystem/atoms/FgExternalLink';
-import FgIcon from '@/components/designSystem/atoms/FgIcon';
 import FgLink from '@/components/designSystem/atoms/FgLink';
+import GithubUrlValue from '@/components/ui/AppsPage/GithubUrlValue';
 import type { AppListing, UserApp } from '@/shared.types';
 import { formatDateString } from '@/utils';
 import {
@@ -32,22 +31,6 @@ function InfoRow({
   );
 }
 
-function GithubUrlValue({ url }: { readonly url: string }) {
-  return (
-    <div className="flex items-center gap-1.5 text-foreground">
-      <FgIcon className="shrink-0" icon={TbBrandGithub} size="sm" />
-      <FgExternalLink
-        className="break-all"
-        href={url}
-        showIcon={false}
-        size="sm"
-      >
-        {url}
-      </FgExternalLink>
-    </div>
-  );
-}
-
 /**
  * The revision actually cloned, parsed out of the canonical listing URL (which
  * always carries it). Falls back to the requested branch, then null.

From 8fd2f50d0d166cb82a7b0642d0409760a4a4067b Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 12:38:08 -0400
Subject: [PATCH 74/89] Namespace parameter input IDs to avoid cross-namespace
 collisions

The a11y fix used id="param-<key>" / htmlFor="param-<key>", but the same
parameter key is allowed in both the pipeline and env-tab namespaces (e.g. a
pipeline --profile alongside Nextflow's -profile). That produced duplicate
DOM ids and labels that could focus the wrong input. Thread a namespace
prefix (param-main vs param-env) through ParameterFieldRow/SectionContent so
each input id is unique.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../components/ui/AppsPage/AppLaunchForm.tsx  | 28 +++++++++++++++----
 1 file changed, 23 insertions(+), 5 deletions(-)

diff --git a/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx b/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
index b1d1618e..81b63799 100644
--- a/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
+++ b/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
@@ -70,11 +70,13 @@ type EnvVar = { key: string; value: string };
 
 function ParameterField({
   param,
+  inputId,
   value,
   onChange,
   onError
 }: {
   readonly param: AppParameter;
+  readonly inputId: string;
   readonly value: unknown;
   readonly onChange: (value: unknown) => void;
   readonly onError?: (message: string) => void;
@@ -110,7 +112,7 @@ function ParameterField({
       return (
         <input
           className={baseInputClass}
-          id={`param-${param.key}`}
+          id={inputId}
           max={param.max}
           min={param.min}
           onChange={e => {
@@ -134,7 +136,7 @@ function ParameterField({
       return (
         <select
           className={baseInputClass}
-          id={`param-${param.key}`}
+          id={inputId}
           onChange={e => onChange(e.target.value)}
           value={value !== undefined && value !== null ? String(value) : ''}
         >
@@ -153,7 +155,7 @@ function ParameterField({
         <div className="flex gap-2">
           <input
             className={`flex-1 ${baseInputClass}`}
-            id={`param-${param.key}`}
+            id={inputId}
             onChange={e => {
               setFileDisplayPath(null);
               onChange(e.target.value);
@@ -201,7 +203,7 @@ function ParameterField({
       return (
         <input
           className={baseInputClass}
-          id={`param-${param.key}`}
+          id={inputId}
           onChange={e => onChange(e.target.value)}
           placeholder={param.name}
           type="text"
@@ -213,23 +215,30 @@ function ParameterField({
 
 function ParameterFieldRow({
   param,
+  idPrefix,
   value,
   error,
   onChange,
   onError
 }: {
   readonly param: AppParameter;
+  // Namespace-specific id prefix ('param-main' / 'param-env'). The same param
+  // key can legitimately appear in both the pipeline and env-tab namespaces
+  // (e.g. a pipeline --profile alongside Nextflow's -profile), so the DOM id
+  // must be namespaced to avoid duplicate ids / labels focusing the wrong input.
+  readonly idPrefix: string;
   readonly value: unknown;
   readonly error?: string;
   readonly onChange: (value: unknown) => void;
   readonly onError?: (message: string) => void;
 }) {
+  const inputId = `${idPrefix}-${param.key}`;
   return (
     <div>
       {param.type !== 'boolean' ? (
         <label
           className="block text-foreground text-sm font-semibold mb-1"
-          htmlFor={`param-${param.key}`}
+          htmlFor={inputId}
         >
           {param.name}
           {param.required ? <span className="text-error ml-1">*</span> : null}
@@ -241,6 +250,7 @@ function ParameterFieldRow({
         </Typography>
       ) : null}
       <ParameterField
+        inputId={inputId}
         onChange={onChange}
         onError={onError}
         param={param}
@@ -296,12 +306,14 @@ function SectionTrigger({
 
 function SectionContent({
   section,
+  idPrefix,
   values,
   errors,
   onParamChange,
   onParamError
 }: {
   readonly section: AppParameterSection;
+  readonly idPrefix: string;
   readonly values: Record<string, unknown>;
   readonly errors: Record<string, string>;
   readonly onParamChange: (paramId: string, value: unknown) => void;
@@ -312,6 +324,7 @@ function SectionContent({
       {section.parameters.map(param => (
         <ParameterFieldRow
           error={errors[param.key]}
+          idPrefix={idPrefix}
           key={param.key}
           onChange={val => onParamChange(param.key, val)}
           onError={message => onParamError?.(param.key, message)}
@@ -1346,6 +1359,7 @@ export default function AppLaunchForm({
                         <Accordion.Content className="pt-2 pb-4 pl-4">
                           <SectionContent
                             errors={errors}
+                            idPrefix="param-main"
                             onParamChange={handleChange}
                             onParamError={handleParamError}
                             section={item}
@@ -1356,6 +1370,7 @@ export default function AppLaunchForm({
                     ) : (
                       <ParameterFieldRow
                         error={errors[item.key]}
+                        idPrefix="param-main"
                         key={item.key}
                         onChange={val => handleChange(item.key, val)}
                         onError={message => handleParamError(item.key, message)}
@@ -1370,6 +1385,7 @@ export default function AppLaunchForm({
                   isParameterSection(item) ? null : (
                     <ParameterFieldRow
                       error={errors[item.key]}
+                      idPrefix="param-main"
                       key={item.key}
                       onChange={val => handleChange(item.key, val)}
                       onError={message => handleParamError(item.key, message)}
@@ -1435,6 +1451,7 @@ export default function AppLaunchForm({
                         <Accordion.Content className="pt-2 pb-4 pl-4">
                           <SectionContent
                             errors={{}}
+                            idPrefix="param-env"
                             onParamChange={handleEnvChange}
                             section={item}
                             values={envValues}
@@ -1444,6 +1461,7 @@ export default function AppLaunchForm({
                     ) : (
                       <ParameterFieldRow
                         error={undefined}
+                        idPrefix="param-env"
                         key={item.key}
                         onChange={val => handleEnvChange(item.key, val)}
                         param={item}

From f40dafe9cbe636ae67a9e0061c0c75c973af4569 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 12:41:54 -0400
Subject: [PATCH 75/89] Treat unknown job statuses as active

Centralize job terminal-status handling around DONE, FAILED, and KILLED so UNKNOWN and scheduler-specific statuses keep polling, remain cancellable, and cannot be deleted as if terminal. Add backend and frontend coverage.

Co-authored-by: Codex <codex@openai.com>
---
 fileglancer/apps/jobs.py                      | 10 +++---
 fileglancer/database.py                       | 24 +++++++++++--
 fileglancer/model.py                          |  2 +-
 fileglancer/server.py                         |  5 ++-
 .../src/__tests__/unitTests/jobStatus.test.ts | 24 +++++++++++++
 frontend/src/components/JobDetail.tsx         |  5 +--
 .../components/ui/AppsPage/JobStatusBadge.tsx | 26 +++++++-------
 .../components/ui/Table/appsJobsColumns.tsx   |  3 +-
 frontend/src/hooks/useActiveJobCount.ts       |  4 +--
 frontend/src/queries/jobsQueries.ts           | 11 +++---
 frontend/src/shared.types.ts                  | 31 +++++++++++++++--
 tests/test_apps_endpoints.py                  |  2 +-
 tests/test_database.py                        | 34 ++++++++++++++++++-
 13 files changed, 140 insertions(+), 41 deletions(-)
 create mode 100644 frontend/src/__tests__/unitTests/jobStatus.test.ts

diff --git a/fileglancer/apps/jobs.py b/fileglancer/apps/jobs.py
index beb616c4..68362218 100644
--- a/fileglancer/apps/jobs.py
+++ b/fileglancer/apps/jobs.py
@@ -117,7 +117,7 @@ async def stop_job_monitor():
 
 
 def _get_any_active_username(settings) -> str | None:
-    """Return any username that has active (PENDING/RUNNING) jobs, or None."""
+    """Return any username that has non-terminal jobs, or None."""
     with db.get_db_session(settings.db_url) as session:
         active_jobs = db.get_active_jobs(session)
         for job in active_jobs:
@@ -158,7 +158,7 @@ async def _reconnect_as_any_user(settings):
                 continue
             new_status = info["status"].upper()
             if new_status != db_job.status:
-                is_terminal = new_status in ("DONE", "FAILED", "KILLED")
+                is_terminal = db.is_terminal_job_status(new_status)
                 finished_at = _parse_iso_dt(info.get("finish_time")) if is_terminal else None
                 db.update_job_status(
                     session, db_job.id, new_status,
@@ -304,7 +304,7 @@ async def _poll_jobs(settings):
             old_status = db_job.status
             if new_status == old_status:
                 continue
-            is_terminal = new_status in ("DONE", "FAILED", "KILLED")
+            is_terminal = db.is_terminal_job_status(new_status)
             finished_at = _parse_iso_dt(info.get("finish_time")) if is_terminal else None
             db.update_job_status(
                 session, db_job.id, new_status,
@@ -994,14 +994,14 @@ def _build_resource_spec(entry_point: AppEntryPoint, overrides: Optional[dict],
 
 
 async def cancel_job(job_id: int, username: str) -> db.JobDB:
-    """Cancel a running or pending job."""
+    """Cancel a non-terminal job."""
     settings = get_settings()
 
     with db.get_db_session(settings.db_url) as session:
         db_job = db.get_job(session, job_id, username)
         if db_job is None:
             raise ValueError(f"Job {job_id} not found")
-        if db_job.status not in ("PENDING", "RUNNING"):
+        if db.is_terminal_job_status(db_job.status):
             raise ValueError(f"Job {job_id} is not cancellable (status: {db_job.status})")
 
         # Actually stop the running job as the target user. The local executor
diff --git a/fileglancer/database.py b/fileglancer/database.py
index ccb26571..9d60d5a0 100644
--- a/fileglancer/database.py
+++ b/fileglancer/database.py
@@ -958,6 +958,19 @@ def delete_expired_sessions(session: Session):
 
 # --- Job database functions ---
 
+TERMINAL_JOB_STATUSES = ("DONE", "FAILED", "KILLED")
+
+
+def is_terminal_job_status(status: str | None) -> bool:
+    """Return True when a job status means no scheduler work should remain.
+
+    Any status outside this explicit terminal set (including UNKNOWN or a
+    scheduler-specific transient state) is treated as active so polling,
+    cancellation, and delete guards do not drop a potentially live job.
+    """
+    return status in TERMINAL_JOB_STATUSES
+
+
 def create_job(session: Session, username: str, app_url: str, app_name: str,
                entry_point_id: str, entry_point_name: str, parameters: Dict,
                env_parameters: Optional[Dict] = None,
@@ -1017,9 +1030,14 @@ def get_job(session: Session, job_id: int, username: str) -> Optional[JobDB]:
 
 
 def get_active_jobs(session: Session) -> List[JobDB]:
-    """Get all jobs with PENDING or RUNNING status"""
+    """Get all jobs that are not known-terminal.
+
+    UNKNOWN and future scheduler-specific statuses are considered active:
+    until a job reaches DONE/FAILED/KILLED, Fileglancer should keep polling and
+    must not allow the record to be deleted as if the cluster job were gone.
+    """
     return session.query(JobDB).filter(
-        JobDB.status.in_(["PENDING", "RUNNING"])
+        ~JobDB.status.in_(TERMINAL_JOB_STATUSES)
     ).all()
 
 
@@ -1070,7 +1088,7 @@ def delete_old_jobs(session: Session, days: int = 30) -> int:
     """Delete completed/failed jobs older than the specified number of days"""
     cutoff = datetime.now(UTC) - timedelta(days=days)
     deleted = session.query(JobDB).filter(
-        JobDB.status.in_(["DONE", "FAILED", "KILLED"]),
+        JobDB.status.in_(TERMINAL_JOB_STATUSES),
         JobDB.created_at < cutoff
     ).delete(synchronize_session='fetch')
     session.commit()
diff --git a/fileglancer/model.py b/fileglancer/model.py
index e6f7c698..1e471ab7 100644
--- a/fileglancer/model.py
+++ b/fileglancer/model.py
@@ -871,7 +871,7 @@ class Job(BaseModel):
         description="Environment-tab parameter values (separate namespace from parameters)",
         default=None,
     )
-    status: str = Field(description="Job status (PENDING, RUNNING, DONE, FAILED, KILLED)")
+    status: str = Field(description="Job status (PENDING, RUNNING, UNKNOWN, DONE, FAILED, KILLED)")
     exit_code: Optional[int] = Field(description="Exit code of the job", default=None)
     resources: Optional[Dict] = Field(description="Requested resources", default=None)
     env: Optional[Dict[str, str]] = Field(description="Environment variables used for the job", default=None)
diff --git a/fileglancer/server.py b/fileglancer/server.py
index 1ed68f95..55ee4ba8 100644
--- a/fileglancer/server.py
+++ b/fileglancer/server.py
@@ -1743,7 +1743,6 @@ async def get_user_apps(username: str = Depends(get_current_user)):
     # break browsing a recent job's code; jobs older than this trade that
     # for reclaiming the (potentially large) snapshot tree.
     _JOB_SNAPSHOT_RETENTION = timedelta(days=14)
-    _TERMINAL_JOB_STATUSES = ("DONE", "FAILED", "KILLED")
 
     def _collect_keep_shas(session, username: str) -> list[str]:
         """Every snapshot SHA still referenced by this user: all app pins,
@@ -1762,7 +1761,7 @@ def _collect_keep_shas(session, username: str) -> list[str]:
             if not j.commit_sha:
                 continue
             created = j.created_at.replace(tzinfo=None) if j.created_at else None
-            if j.status not in _TERMINAL_JOB_STATUSES or (
+            if not db.is_terminal_job_status(j.status) or (
                     created is not None and created >= cutoff):
                 keep.add(j.commit_sha)
         return sorted(keep)
@@ -2392,7 +2391,7 @@ async def delete_job(job_id: int,
             db_job = db.get_job(session, job_id, username)
             if db_job is None:
                 raise HTTPException(status_code=404, detail="Job not found")
-            if db_job.status in ("PENDING", "RUNNING"):
+            if not db.is_terminal_job_status(db_job.status):
                 raise HTTPException(
                     status_code=409,
                     detail="Job is active; cancel or stop it before deleting.",
diff --git a/frontend/src/__tests__/unitTests/jobStatus.test.ts b/frontend/src/__tests__/unitTests/jobStatus.test.ts
new file mode 100644
index 00000000..328a529e
--- /dev/null
+++ b/frontend/src/__tests__/unitTests/jobStatus.test.ts
@@ -0,0 +1,24 @@
+import { describe, expect, it } from 'vitest';
+
+import { isActiveJobStatus, isTerminalJobStatus } from '@/shared.types';
+
+describe('job status helpers', () => {
+  it('only treats DONE, FAILED, and KILLED as terminal', () => {
+    for (const status of ['DONE', 'FAILED', 'KILLED']) {
+      expect(isTerminalJobStatus(status)).toBe(true);
+      expect(isActiveJobStatus(status)).toBe(false);
+    }
+  });
+
+  it('treats UNKNOWN and scheduler-specific statuses as active', () => {
+    for (const status of ['PENDING', 'RUNNING', 'UNKNOWN', 'SUSPENDED']) {
+      expect(isTerminalJobStatus(status)).toBe(false);
+      expect(isActiveJobStatus(status)).toBe(true);
+    }
+  });
+
+  it('does not poll before a status is known', () => {
+    expect(isActiveJobStatus(undefined)).toBe(false);
+    expect(isActiveJobStatus(null)).toBe(false);
+  });
+});
diff --git a/frontend/src/components/JobDetail.tsx b/frontend/src/components/JobDetail.tsx
index 029e164e..4e8bf4c0 100644
--- a/frontend/src/components/JobDetail.tsx
+++ b/frontend/src/components/JobDetail.tsx
@@ -30,6 +30,7 @@ import type {
   AppLaunchParamsFile,
   AppResourceDefaults
 } from '@/shared.types';
+import { isActiveJobStatus } from '@/shared.types';
 import JobStatusBadge from '@/components/ui/AppsPage/JobStatusBadge';
 import {
   formatDateString,
@@ -302,7 +303,7 @@ function JobOverview({
   readonly onViewStdout: () => void;
   readonly onViewStderr: () => void;
 }) {
-  const isActive = job.status === 'PENDING' || job.status === 'RUNNING';
+  const isActive = isActiveJobStatus(job.status);
   const runtime = formatDuration(job.started_at, job.finished_at);
   const queueWait = job.started_at
     ? formatDuration(job.created_at, job.started_at)
@@ -507,7 +508,7 @@ export default function JobDetail() {
   const jobManifestMutation = useManifestPreviewMutation();
 
   const isService = jobQuery.data?.entry_point_type === 'service';
-  const isActive = jobStatus === 'PENDING' || jobStatus === 'RUNNING';
+  const isActive = isActiveJobStatus(jobStatus);
 
   useEffect(() => {
     const checkDarkMode = () => {
diff --git a/frontend/src/components/ui/AppsPage/JobStatusBadge.tsx b/frontend/src/components/ui/AppsPage/JobStatusBadge.tsx
index 3ab93f22..8be45c3a 100644
--- a/frontend/src/components/ui/AppsPage/JobStatusBadge.tsx
+++ b/frontend/src/components/ui/AppsPage/JobStatusBadge.tsx
@@ -1,28 +1,28 @@
 import FgBadge from '@/components/designSystem/atoms/FgBadge';
-import type { Job } from '@/shared.types';
+import type { JobStatus } from '@/shared.types';
 
-const STATUS_MAP: Record<
-  Job['status'],
-  {
-    color: 'neutral' | 'info' | 'success' | 'error' | 'warning';
-    label: string;
-    dot?: boolean;
-  }
-> = {
+type StatusDisplay = {
+  color: 'neutral' | 'info' | 'success' | 'error' | 'warning';
+  label: string;
+  dot?: boolean;
+};
+
+const STATUS_MAP: Record<string, StatusDisplay> = {
   PENDING: { color: 'neutral', label: 'Pending' },
   RUNNING: { color: 'info', label: 'Running', dot: true },
   DONE: { color: 'success', label: 'Done' },
   FAILED: { color: 'error', label: 'Failed' },
-  KILLED: { color: 'warning', label: 'Killed' }
+  KILLED: { color: 'warning', label: 'Killed' },
+  UNKNOWN: { color: 'neutral', label: 'Unknown' }
 };
 
 export default function JobStatusBadge({
   status
 }: {
-  readonly status: Job['status'];
+  readonly status: JobStatus;
 }) {
-  // An unrecognized status (e.g. the cluster API's UNKNOWN, which the server
-  // treats as live) is shown neutrally rather than mislabeled as a failure.
+  // Future scheduler-specific statuses are shown neutrally rather than
+  // mislabeled as failures.
   const { color, label, dot } = STATUS_MAP[status] ?? {
     color: 'neutral' as const,
     label: 'Unknown'
diff --git a/frontend/src/components/ui/Table/appsJobsColumns.tsx b/frontend/src/components/ui/Table/appsJobsColumns.tsx
index b1139fb5..bcd30aad 100644
--- a/frontend/src/components/ui/Table/appsJobsColumns.tsx
+++ b/frontend/src/components/ui/Table/appsJobsColumns.tsx
@@ -6,6 +6,7 @@ import FgTooltip from '@/components/ui/widgets/FgTooltip';
 import JobStatusBadge from '@/components/ui/AppsPage/JobStatusBadge';
 import { formatDateString } from '@/utils';
 import type { MenuItem } from '@/components/ui/Menus/FgMenuItems';
+import { isActiveJobStatus } from '@/shared.types';
 import type { Job } from '@/shared.types';
 
 function formatDuration(job: Job): string {
@@ -146,7 +147,7 @@ export function createAppsJobsColumns(
       header: 'Actions',
       cell: ({ row }) => {
         const job = row.original;
-        const canCancel = job.status === 'PENDING' || job.status === 'RUNNING';
+        const canCancel = isActiveJobStatus(job.status);
 
         const isService = job.entry_point_type === 'service';
         const menuItems: MenuItem<JobRowActionProps>[] = [
diff --git a/frontend/src/hooks/useActiveJobCount.ts b/frontend/src/hooks/useActiveJobCount.ts
index 08a3748a..42c22840 100644
--- a/frontend/src/hooks/useActiveJobCount.ts
+++ b/frontend/src/hooks/useActiveJobCount.ts
@@ -1,10 +1,10 @@
 import { useJobsQuery } from '@/queries/jobsQueries';
+import { isActiveJobStatus } from '@/shared.types';
 
 export function useActiveJobCount(): number {
   const { data: jobs } = useJobsQuery();
   if (!jobs) {
     return 0;
   }
-  return jobs.filter(j => j.status === 'PENDING' || j.status === 'RUNNING')
-    .length;
+  return jobs.filter(j => isActiveJobStatus(j.status)).length;
 }
diff --git a/frontend/src/queries/jobsQueries.ts b/frontend/src/queries/jobsQueries.ts
index e45f57af..a979395f 100644
--- a/frontend/src/queries/jobsQueries.ts
+++ b/frontend/src/queries/jobsQueries.ts
@@ -7,6 +7,7 @@ import {
   getResponseJsonOrError,
   throwResponseNotOkError
 } from '@/queries/queryUtils';
+import { isActiveJobStatus } from '@/shared.types';
 import type { Job, JobSubmitRequest } from '@/shared.types';
 
 // --- Types ---
@@ -115,9 +116,7 @@ export function useJobsQuery(): UseQueryResult<Job[], Error> {
       if (!jobs) {
         return false;
       }
-      const hasActive = jobs.some(
-        j => j.status === 'PENDING' || j.status === 'RUNNING'
-      );
+      const hasActive = jobs.some(j => isActiveJobStatus(j.status));
       return hasActive ? 5000 : false;
     }
   });
@@ -132,9 +131,7 @@ export function useJobQuery(jobId: number): UseQueryResult<Job, Error> {
       if (!job) {
         return false;
       }
-      return job.status === 'PENDING' || job.status === 'RUNNING'
-        ? 5000
-        : false;
+      return isActiveJobStatus(job.status) ? 5000 : false;
     }
   });
 }
@@ -145,7 +142,7 @@ export function useJobFileQuery(
   jobStatus?: string,
   enabled: boolean = true
 ): UseQueryResult<string | null, Error> {
-  const isActive = jobStatus === 'PENDING' || jobStatus === 'RUNNING';
+  const isActive = isActiveJobStatus(jobStatus);
   const query = useQuery({
     queryKey: [...jobsQueryKeys.detail(jobId), 'file', fileType],
     queryFn: ({ signal }) => fetchJobFile(jobId, fileType, signal),
diff --git a/frontend/src/shared.types.ts b/frontend/src/shared.types.ts
index 7487d74c..c7b48059 100644
--- a/frontend/src/shared.types.ts
+++ b/frontend/src/shared.types.ts
@@ -190,6 +190,26 @@ type JobFileInfo = {
   subpath?: string;
 };
 
+type KnownJobStatus =
+  | 'PENDING'
+  | 'RUNNING'
+  | 'DONE'
+  | 'FAILED'
+  | 'KILLED'
+  | 'UNKNOWN';
+
+type JobStatus = KnownJobStatus | (string & {});
+
+const TERMINAL_JOB_STATUSES = new Set<string>(['DONE', 'FAILED', 'KILLED']);
+
+function isTerminalJobStatus(status?: string | null): boolean {
+  return typeof status === 'string' && TERMINAL_JOB_STATUSES.has(status);
+}
+
+function isActiveJobStatus(status?: string | null): boolean {
+  return typeof status === 'string' && !isTerminalJobStatus(status);
+}
+
 type Job = {
   id: number;
   app_url: string;
@@ -202,7 +222,7 @@ type Job = {
   code_repo_url?: string;
   parameters: Record<string, unknown>;
   env_parameters?: Record<string, unknown>;
-  status: 'PENDING' | 'RUNNING' | 'DONE' | 'FAILED' | 'KILLED';
+  status: JobStatus;
   exit_code?: number;
   resources?: Record<string, unknown>;
   env?: Record<string, string>;
@@ -290,6 +310,7 @@ export type {
   Failure,
   Job,
   JobFileInfo,
+  JobStatus,
   JobSubmitRequest,
   Profile,
   Result,
@@ -299,4 +320,10 @@ export type {
   ZonesAndFileSharePathsMap
 };
 
-export { flattenParameters, isParameterSection, parseAppLaunchParamsFile };
+export {
+  flattenParameters,
+  isActiveJobStatus,
+  isParameterSection,
+  isTerminalJobStatus,
+  parseAppLaunchParamsFile
+};
diff --git a/tests/test_apps_endpoints.py b/tests/test_apps_endpoints.py
index 2e27c648..257c6f95 100644
--- a/tests/test_apps_endpoints.py
+++ b/tests/test_apps_endpoints.py
@@ -802,7 +802,7 @@ def test_delete_app_removes_row(test_client, db_session):
     assert response.status_code == 404
 
 
-@pytest.mark.parametrize("status", ["PENDING", "RUNNING"])
+@pytest.mark.parametrize("status", ["PENDING", "RUNNING", "UNKNOWN", "SUSPENDED"])
 def test_delete_active_job_is_rejected(test_client, db_session, status):
     job = _seed_job(db_session, status=status)
     job_id = job.id
diff --git a/tests/test_database.py b/tests/test_database.py
index 652b6a3d..a23c0997 100644
--- a/tests/test_database.py
+++ b/tests/test_database.py
@@ -123,6 +123,39 @@ def test_user_preferences(db_session):
     assert pref is None
 
 
+def test_get_active_jobs_treats_non_terminal_statuses_as_active(db_session):
+    job_ids_by_status = {}
+    for status in [
+        "PENDING",
+        "RUNNING",
+        "UNKNOWN",
+        "SUSPENDED",
+        "DONE",
+        "FAILED",
+        "KILLED",
+    ]:
+        job = create_job(
+            db_session,
+            "testuser",
+            "https://github.com/owner/repo",
+            "App",
+            "run",
+            "Run",
+            {},
+        )
+        update_job_status(db_session, job.id, status)
+        job_ids_by_status[status] = job.id
+
+    active = get_active_jobs(db_session)
+
+    assert {job.id for job in active} == {
+        job_ids_by_status["PENDING"],
+        job_ids_by_status["RUNNING"],
+        job_ids_by_status["UNKNOWN"],
+        job_ids_by_status["SUSPENDED"],
+    }
+
+
 def test_create_proxied_path(db_session, fsp):
     # Test creating a new proxied path
     username = "testuser"
@@ -586,4 +619,3 @@ def test_no_matching_candidate_returns_none(self):
         )
         assert result is None
 
-

From e0b17fe14cfbbcd28b2a200ac610511565cd1f6c Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 12:51:05 -0400
Subject: [PATCH 76/89] Delete job work dirs with job records

Remove a terminal job's stored work directory through the user worker before deleting its database record, with safety checks around the expected Fileglancer jobs path. Update the delete dialog to warn that the entire working directory, including logs, is removed and cover the behavior in endpoint tests.

Co-authored-by: Codex <codex@openai.com>
---
 fileglancer/apps/jobfiles.py                  | 63 +++++++++++++++++++
 fileglancer/server.py                         |  8 ++-
 fileglancer/user_worker.py                    | 29 ++++++++-
 fileglancer/worker_pool.py                    |  1 +
 .../src/components/ui/Dialogs/DeleteJob.tsx   |  3 +-
 tests/test_apps_endpoints.py                  | 24 +++++++
 6 files changed, 124 insertions(+), 4 deletions(-)

diff --git a/fileglancer/apps/jobfiles.py b/fileglancer/apps/jobfiles.py
index f609c79c..0f6b7af5 100644
--- a/fileglancer/apps/jobfiles.py
+++ b/fileglancer/apps/jobfiles.py
@@ -4,6 +4,7 @@
 import os
 import posixpath
 import re
+import shutil
 from pathlib import Path
 from typing import Optional
 
@@ -40,6 +41,68 @@ def _resolve_work_dir(db_job: db.JobDB) -> Path:
     return _build_work_dir(db_job.id, db_job.app_name, db_job.entry_point_id)
 
 
+def _safe_work_dir_delete_target(db_job: db.JobDB) -> Path:
+    """Return the normalized work-dir path if it is safe to delete.
+
+    Job work directories are created under ``.fileglancer/jobs`` and include
+    the job id in their leaf name. Keep deletion constrained to that shape so a
+    stale or corrupted DB row cannot turn "delete this job" into arbitrary
+    filesystem removal.
+    """
+    raw_target = Path(os.path.expanduser(os.fspath(db_job.work_dir)))
+    if not raw_target.is_absolute():
+        raise PermissionError(
+            f"Refusing to delete relative job work directory: {raw_target}"
+        )
+    target = Path(os.path.abspath(os.fspath(raw_target)))
+    parts = target.parts
+    under_jobs_root = any(
+        part == ".fileglancer"
+        and idx + 2 < len(parts)
+        and parts[idx + 1] == "jobs"
+        for idx, part in enumerate(parts)
+    )
+    if not under_jobs_root:
+        raise PermissionError(
+            f"Refusing to delete unexpected job work directory: {target}"
+        )
+
+    job_id = re.escape(str(db_job.id))
+    if not re.search(rf"(^|-){job_id}-", target.name):
+        raise PermissionError(
+            f"Refusing to delete job work directory without job id {db_job.id}: {target}"
+        )
+
+    return target
+
+
+def delete_job_work_dir(db_job: db.JobDB) -> bool:
+    """Delete a job's work directory, returning True when something was removed.
+
+    Missing stored paths or already-removed work directories are treated as
+    already deleted so the DB record can still be cleaned up. Directory symlinks
+    are unlinked rather than followed.
+    """
+    if not getattr(db_job, "work_dir", None):
+        return False
+
+    target = _safe_work_dir_delete_target(db_job)
+    try:
+        if target.is_symlink():
+            target.unlink()
+            return True
+        if not target.exists():
+            return False
+        if not target.is_dir():
+            raise NotADirectoryError(
+                f"Job work directory is not a directory: {target}"
+            )
+        shutil.rmtree(target)
+        return True
+    except FileNotFoundError:
+        return False
+
+
 def _stored_work_dir_path(db_job: db.JobDB) -> str:
     """Return the job's work_dir as a stored path string.
 
diff --git a/fileglancer/server.py b/fileglancer/server.py
index 55ee4ba8..7c9d6934 100644
--- a/fileglancer/server.py
+++ b/fileglancer/server.py
@@ -2384,7 +2384,7 @@ async def cancel_job(job_id: int,
             raise HTTPException(status_code=400, detail=str(e))
 
     @app.delete("/api/jobs/{job_id}",
-                description="Delete a job record")
+                description="Delete a job record and its work directory")
     async def delete_job(job_id: int,
                          username: str = Depends(get_current_user)):
         with db.get_db_session(settings.db_url) as session:
@@ -2396,6 +2396,12 @@ async def delete_job(job_id: int,
                     status_code=409,
                     detail="Job is active; cancel or stop it before deleting.",
                 )
+            result = await _worker_exec(username, "delete_job_work_dir", job_id=job_id)
+            if result.get("error"):
+                raise HTTPException(
+                    status_code=result.get("status_code", 500),
+                    detail=result["error"],
+                )
             db.delete_job(session, job_id, username)
         return {"message": "Job deleted"}
 
diff --git a/fileglancer/user_worker.py b/fileglancer/user_worker.py
index 00f2711c..8aaa9851 100644
--- a/fileglancer/user_worker.py
+++ b/fileglancer/user_worker.py
@@ -168,8 +168,8 @@ def _job_db_to_dict(j) -> dict:
     """Serialize a JobDB row to a JSON-safe dict for transport to the worker.
 
     Only includes fields used by worker-side handlers (read_job_file,
-    get_service_url) — keep this list minimal so the worker sees as little of
-    the DB row as possible.
+    get_service_url, delete_job_work_dir) — keep this list minimal so the
+    worker sees as little of the DB row as possible.
     """
     return {
         "id": j.id,
@@ -784,6 +784,31 @@ def _action_get_job_file(request: dict, ctx: WorkerContext) -> dict:
     return {"content": content}
 
 
+@action("delete_job_work_dir")
+def _action_delete_job_work_dir(request: dict, ctx: WorkerContext) -> dict:
+    """Delete a terminal job's work directory as the target user."""
+    from fileglancer import database as db
+    from fileglancer.apps.jobfiles import delete_job_work_dir
+
+    job_id = request["job_id"]
+    db_job = ctx.db.get_job(job_id, ctx.username)
+    if db_job is None:
+        return {"error": f"Job {job_id} not found", "status_code": 404}
+    if not db.is_terminal_job_status(db_job.status):
+        return {
+            "error": "Job is active; cancel or stop it before deleting.",
+            "status_code": 409,
+        }
+
+    try:
+        deleted = delete_job_work_dir(db_job)
+        return {"ok": True, "work_dir_deleted": deleted}
+    except PermissionError as e:
+        return {"error": str(e), "status_code": 403}
+    except OSError as e:
+        return {"error": str(e), "status_code": 500}
+
+
 def _proc_alive(pid: int) -> bool:
     """True if pid is a live (non-zombie) process.
 
diff --git a/fileglancer/worker_pool.py b/fileglancer/worker_pool.py
index 32659b91..acc41151 100644
--- a/fileglancer/worker_pool.py
+++ b/fileglancer/worker_pool.py
@@ -65,6 +65,7 @@
     "ensure_snapshot",
     "gc_snapshots",
     "submit",
+    "delete_job_work_dir",
 })
 
 
diff --git a/frontend/src/components/ui/Dialogs/DeleteJob.tsx b/frontend/src/components/ui/Dialogs/DeleteJob.tsx
index 849ce5e7..6ea12f30 100644
--- a/frontend/src/components/ui/Dialogs/DeleteJob.tsx
+++ b/frontend/src/components/ui/Dialogs/DeleteJob.tsx
@@ -24,7 +24,8 @@ export default function DeleteJobDialog({
       </Typography>
       <Typography className="text-foreground mb-4">
         Are you sure you want to delete this job? Its record, parameters, and
-        logs will be removed. This cannot be undone.
+        entire working directory, including logs, will be removed. This cannot
+        be undone.
       </Typography>
       <div className="flex justify-end gap-2">
         <FgButton onClick={onClose} variant="ghost">
diff --git a/tests/test_apps_endpoints.py b/tests/test_apps_endpoints.py
index 257c6f95..0287cb8e 100644
--- a/tests/test_apps_endpoints.py
+++ b/tests/test_apps_endpoints.py
@@ -826,6 +826,30 @@ def test_delete_finished_job_removes_row(test_client, db_session):
     assert get_job(db_session, job_id, TEST_USERNAME) is None
 
 
+def test_delete_finished_job_removes_work_dir(test_client, db_session, temp_dir):
+    job = _seed_job(db_session, status="DONE")
+    job_id = job.id
+    work_dir = os.path.join(
+        temp_dir,
+        ".fileglancer",
+        "jobs",
+        f"{job_id}-Demo_App-run",
+    )
+    os.makedirs(work_dir)
+    with open(os.path.join(work_dir, "stdout.log"), "w", encoding="utf-8") as f:
+        f.write("job output")
+
+    job.work_dir = work_dir
+    db_session.commit()
+
+    response = test_client.delete(f"/api/jobs/{job_id}")
+
+    assert response.status_code == 200
+    assert not os.path.exists(work_dir)
+    db_session.expire_all()
+    assert get_job(db_session, job_id, TEST_USERNAME) is None
+
+
 def test_cluster_defaults_preserves_extra_args_tokens(temp_dir):
     """Cluster default extra_args are shell-quoted so the launch form can submit
     them back through shlex.split without losing spaces or scheduler syntax."""

From b8cef9222976802424e72c75f3ca87f7af95238d Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 13:07:52 -0400
Subject: [PATCH 77/89] Give up polling jobs stuck in UNKNOWN after a 24h
 cutoff
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since UNKNOWN jobs are now treated as active, a job the scheduler can no
longer report (aged out of the queue/history) would be polled forever. Add a
configurable cutoff (apps.unknown_timeout_hours, default 24) in the poll
loop: a job that has sat in UNKNOWN longer than the cutoff is marked FAILED
and dropped from polling, alongside the existing zombie-timeout handling.

To measure time-in-UNKNOWN accurately (not since creation), add a
status_updated_at column set on every status change, with an alembic
migration; the cutoff falls back to created_at for pre-migration rows. Users
can still clear a stuck job sooner by cancelling it.

The complementary upstream fix — resolving aged-out jobs from scheduler
history so they rarely become UNKNOWN — is planned in py-cluster-api.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 docs/config.yaml.template                     |  3 +
 ...2f9d31c04_add_status_updated_at_to_jobs.py | 24 ++++++
 fileglancer/apps/jobs.py                      | 23 ++++-
 fileglancer/database.py                       | 12 ++-
 fileglancer/settings.py                       |  6 ++
 tests/test_database.py                        | 22 +++++
 tests/test_poll.py                            | 84 ++++++++++++++++++-
 7 files changed, 169 insertions(+), 5 deletions(-)
 create mode 100644 fileglancer/alembic/versions/a7e2f9d31c04_add_status_updated_at_to_jobs.py

diff --git a/docs/config.yaml.template b/docs/config.yaml.template
index 47b863d7..24b0fa73 100644
--- a/docs/config.yaml.template
+++ b/docs/config.yaml.template
@@ -143,6 +143,9 @@ session_cookie_secure: true
 #                               # env is an allowlist so no server secret leaks
 #                               # to the user; add only non-secret vars your
 #                               # scheduler or tools need. FGC_* is never passed.
+#   unknown_timeout_hours: 24    # Give up polling a job stuck in UNKNOWN after
+#                               # this many hours and mark it FAILED (the
+#                               # scheduler can no longer report it). 0 disables.
 
 # Cluster configuration
 # Mirrors py-cluster-api ClusterConfig - all fields are optional
diff --git a/fileglancer/alembic/versions/a7e2f9d31c04_add_status_updated_at_to_jobs.py b/fileglancer/alembic/versions/a7e2f9d31c04_add_status_updated_at_to_jobs.py
new file mode 100644
index 00000000..3a2680e8
--- /dev/null
+++ b/fileglancer/alembic/versions/a7e2f9d31c04_add_status_updated_at_to_jobs.py
@@ -0,0 +1,24 @@
+"""add status_updated_at column to jobs
+
+Revision ID: a7e2f9d31c04
+Revises: f4a1d8c62e97
+Create Date: 2026-07-04 00:00:00.000000
+
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision = 'a7e2f9d31c04'
+down_revision = 'f4a1d8c62e97'
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column('jobs', sa.Column('status_updated_at', sa.DateTime(), nullable=True))
+
+
+def downgrade() -> None:
+    op.drop_column('jobs', 'status_updated_at')
diff --git a/fileglancer/apps/jobs.py b/fileglancer/apps/jobs.py
index 68362218..ffe3a2ca 100644
--- a/fileglancer/apps/jobs.py
+++ b/fileglancer/apps/jobs.py
@@ -246,12 +246,15 @@ async def _poll_jobs(settings):
         if not active_jobs:
             return False
 
+        now_naive = datetime.now(UTC).replace(tzinfo=None)
+        unknown_timeout_hours = settings.apps.unknown_timeout_hours
+
         # Handle zombie jobs (no cluster_job_id after timeout)
         jobs_to_poll = []
         for db_job in active_jobs:
             if not db_job.cluster_job_id:
                 created = db_job.created_at.replace(tzinfo=None) if db_job.created_at.tzinfo else db_job.created_at
-                age_minutes = (datetime.now(UTC).replace(tzinfo=None) - created).total_seconds() / 60
+                age_minutes = (now_naive - created).total_seconds() / 60
                 if age_minutes > settings.cluster.zombie_timeout_minutes:
                     db.update_job_status(session, db_job.id, "FAILED", finished_at=datetime.now(UTC))
                     logger.warning(
@@ -259,6 +262,24 @@ async def _poll_jobs(settings):
                         f"{age_minutes:.0f} minutes, marked FAILED"
                     )
                 continue
+            # Give up on jobs stuck in UNKNOWN past the cutoff: the scheduler can
+            # no longer report them (aged out of the queue/history), so continued
+            # polling would never resolve them. Measure from status_updated_at
+            # (when it entered UNKNOWN), falling back to created_at for rows
+            # predating that column.
+            if unknown_timeout_hours and db_job.status == "UNKNOWN":
+                ref = db_job.status_updated_at or db_job.created_at
+                if ref is not None:
+                    ref_naive = ref.replace(tzinfo=None) if ref.tzinfo else ref
+                    age_hours = (now_naive - ref_naive).total_seconds() / 3600
+                    if age_hours > unknown_timeout_hours:
+                        db.update_job_status(session, db_job.id, "FAILED",
+                                             finished_at=datetime.now(UTC))
+                        logger.warning(
+                            f"Job {db_job.id} stuck in UNKNOWN for {age_hours:.0f}h "
+                            f"(cutoff {unknown_timeout_hours}h), marked FAILED"
+                        )
+                        continue
             jobs_to_poll.append(db_job)
 
         if not jobs_to_poll:
diff --git a/fileglancer/database.py b/fileglancer/database.py
index 9d60d5a0..acba25cb 100644
--- a/fileglancer/database.py
+++ b/fileglancer/database.py
@@ -188,6 +188,10 @@ class JobDB(Base):
     # (manifests with a separate repo_url). NULL means commit_sha is app_url's.
     code_repo_url = Column(String, nullable=True)
     created_at = Column(DateTime, nullable=False, default=lambda: datetime.now(UTC))
+    # When the status column last changed value. Lets the poll loop measure how
+    # long a job has sat in a non-progressing state (e.g. UNKNOWN) without
+    # conflating it with created_at. NULL for rows created before this column.
+    status_updated_at = Column(DateTime, nullable=True)
     started_at = Column(DateTime, nullable=True)
     finished_at = Column(DateTime, nullable=True)
 
@@ -1009,7 +1013,8 @@ def create_job(session: Session, username: str, app_url: str, app_name: str,
         commit_sha=commit_sha,
         code_repo_url=code_repo_url,
         status="PENDING",
-        created_at=now
+        created_at=now,
+        status_updated_at=now,
     )
     session.add(job)
     session.commit()
@@ -1058,6 +1063,11 @@ def update_job_status(session: Session, job_id: int, status: str,
     job = session.query(JobDB).filter_by(id=job_id).first()
     if not job:
         return None
+    # Record when the status actually changes so the poll loop can tell how long
+    # a job has been in a stuck state (e.g. UNKNOWN). A no-op update (same
+    # status) leaves the timestamp untouched, so it marks entry into the state.
+    if job.status != status:
+        job.status_updated_at = datetime.now(UTC)
     job.status = status
     if exit_code is not None:
         job.exit_code = exit_code
diff --git a/fileglancer/settings.py b/fileglancer/settings.py
index 053a0796..68c8ba4f 100644
--- a/fileglancer/settings.py
+++ b/fileglancer/settings.py
@@ -45,6 +45,12 @@ class AppsSettings(BaseModel):
     # here rather than widening the allowlist in code. FGC_* is never passed
     # through regardless of this list.
     worker_env_passthrough: List[str] = []
+    # How long a job may sit in UNKNOWN before the poll loop gives up and marks
+    # it FAILED. UNKNOWN means the scheduler can no longer report the job (it
+    # aged out of the queue/history), so continued polling would never resolve
+    # it. This is Fileglancer poll policy, not py-cluster-api config, so it
+    # lives here rather than under `cluster`. Set to 0 to disable the cutoff.
+    unknown_timeout_hours: float = 24.0
 
 
 class Settings(BaseSettings):
diff --git a/tests/test_database.py b/tests/test_database.py
index a23c0997..e4e851d4 100644
--- a/tests/test_database.py
+++ b/tests/test_database.py
@@ -156,6 +156,28 @@ def test_get_active_jobs_treats_non_terminal_statuses_as_active(db_session):
     }
 
 
+def test_status_updated_at_tracks_status_changes(db_session):
+    job = create_job(
+        db_session, "testuser", "https://github.com/owner/repo",
+        "App", "run", "Run", {},
+    )
+    # Set on create.
+    assert job.status_updated_at is not None
+    created_stamp = job.status_updated_at
+
+    # A real status change advances the timestamp.
+    update_job_status(db_session, job.id, "RUNNING")
+    db_session.refresh(job)
+    running_stamp = job.status_updated_at
+    assert running_stamp >= created_stamp
+
+    # A no-op update (same status) leaves it untouched, so it marks entry into
+    # the current state rather than the most recent poll.
+    update_job_status(db_session, job.id, "RUNNING")
+    db_session.refresh(job)
+    assert job.status_updated_at == running_stamp
+
+
 def test_create_proxied_path(db_session, fsp):
     # Test creating a new proxied path
     username = "testuser"
diff --git a/tests/test_poll.py b/tests/test_poll.py
index 7bf64f22..039fa72d 100644
--- a/tests/test_poll.py
+++ b/tests/test_poll.py
@@ -6,7 +6,7 @@
 import multiprocessing
 import subprocess
 import time
-from datetime import datetime, UTC
+from datetime import datetime, timedelta, UTC
 from pathlib import Path
 from types import SimpleNamespace
 from unittest.mock import patch, MagicMock, AsyncMock, call
@@ -18,7 +18,7 @@
 # Helpers
 # ---------------------------------------------------------------------------
 
-def _make_settings(executor="lsf", **overrides):
+def _make_settings(executor="lsf", unknown_timeout_hours=24.0, **overrides):
     """Return a minimal Settings-like object for poll tests."""
     cluster = SimpleNamespace(
         poll_interval=0.05,
@@ -26,15 +26,17 @@ def _make_settings(executor="lsf", **overrides):
         executor=executor,
     )
     cluster.model_dump = lambda exclude_none=False: {"executor": executor}
+    apps = SimpleNamespace(unknown_timeout_hours=unknown_timeout_hours)
     settings = SimpleNamespace(
         cluster=cluster,
+        apps=apps,
         db_url="sqlite:///unused",
     )
     return settings
 
 
 def _make_db_job(job_id, cluster_job_id, status, username="alice",
-                 created_at=None, work_dir=None):
+                 created_at=None, work_dir=None, status_updated_at=None):
     """Return a mock DB job row."""
     job = SimpleNamespace(
         id=job_id,
@@ -42,6 +44,7 @@ def _make_db_job(job_id, cluster_job_id, status, username="alice",
         status=status,
         username=username,
         created_at=created_at or datetime.now(UTC),
+        status_updated_at=status_updated_at,
         work_dir=work_dir,
     )
     return job
@@ -139,6 +142,81 @@ def test_job_statuses_passed_to_worker(self, mock_db, mock_dispatch):
         assert kwargs["job_statuses"] == {"1001": "RUNNING", "1002": "PENDING"}
 
 
+class TestPollUnknownCutoff:
+    """A job stuck in UNKNOWN past the cutoff is marked FAILED and dropped from
+    polling; a recently-UNKNOWN job is still polled."""
+
+    def _mock_session(self, mock_db, jobs):
+        session = MagicMock()
+        mock_db.get_db_session.return_value.__enter__ = lambda _: session
+        mock_db.get_db_session.return_value.__exit__ = MagicMock(return_value=False)
+        mock_db.get_active_jobs.return_value = jobs
+        return session
+
+    @patch("fileglancer.apps.jobs._dispatch", new_callable=AsyncMock)
+    @patch("fileglancer.apps.jobs.db")
+    def test_stale_unknown_marked_failed_and_not_polled(self, mock_db, mock_dispatch):
+        settings = _make_settings(unknown_timeout_hours=24.0)
+        stale = datetime.now(UTC) - timedelta(hours=48)
+        job = _make_db_job(1, "1001", "UNKNOWN", status_updated_at=stale)
+        session = self._mock_session(mock_db, [job])
+
+        result = asyncio.run(_poll_jobs(settings))
+
+        mock_db.update_job_status.assert_called_once()
+        args, _ = mock_db.update_job_status.call_args
+        assert args[1] == 1 and args[2] == "FAILED"
+        # Nothing left to poll → worker not dispatched, but the cycle had jobs.
+        mock_dispatch.assert_not_awaited()
+        assert result is True
+
+    @patch("fileglancer.apps.jobs._dispatch", new_callable=AsyncMock)
+    @patch("fileglancer.apps.jobs.db")
+    def test_recent_unknown_is_still_polled(self, mock_db, mock_dispatch):
+        settings = _make_settings(unknown_timeout_hours=24.0)
+        recent = datetime.now(UTC) - timedelta(hours=1)
+        job = _make_db_job(1, "1001", "UNKNOWN", status_updated_at=recent)
+        self._mock_session(mock_db, [job])
+        mock_dispatch.return_value = {"jobs": {}}
+
+        asyncio.run(_poll_jobs(settings))
+
+        # Not reaped; polled instead (worker dispatched, no status change).
+        mock_db.update_job_status.assert_not_called()
+        mock_dispatch.assert_awaited_once()
+
+    @patch("fileglancer.apps.jobs._dispatch", new_callable=AsyncMock)
+    @patch("fileglancer.apps.jobs.db")
+    def test_cutoff_zero_disables_reaping(self, mock_db, mock_dispatch):
+        settings = _make_settings(unknown_timeout_hours=0)
+        ancient = datetime.now(UTC) - timedelta(days=30)
+        job = _make_db_job(1, "1001", "UNKNOWN", status_updated_at=ancient)
+        self._mock_session(mock_db, [job])
+        mock_dispatch.return_value = {"jobs": {}}
+
+        asyncio.run(_poll_jobs(settings))
+
+        mock_db.update_job_status.assert_not_called()
+        mock_dispatch.assert_awaited_once()
+
+    @patch("fileglancer.apps.jobs._dispatch", new_callable=AsyncMock)
+    @patch("fileglancer.apps.jobs.db")
+    def test_stale_unknown_falls_back_to_created_at(self, mock_db, mock_dispatch):
+        # Legacy row with no status_updated_at: age is measured from created_at.
+        settings = _make_settings(unknown_timeout_hours=24.0)
+        old = datetime.now(UTC) - timedelta(hours=48)
+        job = _make_db_job(1, "1001", "UNKNOWN", created_at=old,
+                           status_updated_at=None)
+        self._mock_session(mock_db, [job])
+
+        asyncio.run(_poll_jobs(settings))
+
+        mock_db.update_job_status.assert_called_once()
+        args, _ = mock_db.update_job_status.call_args
+        assert args[2] == "FAILED"
+        mock_dispatch.assert_not_awaited()
+
+
 # ---------------------------------------------------------------------------
 # Helpers for multiprocessing lock test (must be module-level for pickling)
 # ---------------------------------------------------------------------------

From 65fdedef58780004894bef8f07ba2eb1285f855e Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 13:09:54 -0400
Subject: [PATCH 78/89] Expand Apptainer cache tilde paths

Resolve user-preferred Apptainer cache paths like ~/... to the target user's home before shell-quoting them, so the generated job script does not create a literal ~ directory. Add container script tests for tilde expansion and paths with spaces.

Co-authored-by: Codex <codex@openai.com>
---
 fileglancer/apps/jobs.py | 37 +++++++++++++++++++++++++++++++++++--
 tests/test_apps.py       | 31 +++++++++++++++++++++++++++++++
 2 files changed, 66 insertions(+), 2 deletions(-)

diff --git a/fileglancer/apps/jobs.py b/fileglancer/apps/jobs.py
index ffe3a2ca..204dfc8f 100644
--- a/fileglancer/apps/jobs.py
+++ b/fileglancer/apps/jobs.py
@@ -437,6 +437,34 @@ def _container_sif_name(container_url: str) -> str:
 _DEFAULT_CONTAINER_CACHE_DIR = "$HOME/.fileglancer/apptainer_cache"
 
 
+def _quote_container_cache_dir(cache_dir: Optional[str],
+                               username: Optional[str] = None) -> str:
+    """Return a shell-safe APPTAINER_CACHE_DIR assignment value.
+
+    Preferences may use the familiar ``~/...`` spelling shown in the UI.
+    ``shlex.quote("~/...")`` would make that a literal directory named ``~``,
+    so expand current-user tildes to the target user's home before quoting.
+    If the home cannot be resolved (e.g. in a test/dev environment), fall back
+    to a shell ``$HOME`` prefix so expansion still happens in the user worker.
+    """
+    raw = (cache_dir or "").strip()
+    if not raw:
+        return _DEFAULT_CONTAINER_CACHE_DIR
+
+    if raw == "~" or raw.startswith("~/"):
+        suffix = raw[2:] if raw.startswith("~/") else ""
+        home = (
+            os.path.expanduser(f"~{username}")
+            if username else os.path.expanduser("~")
+        )
+        if home.startswith("~"):
+            return "$HOME" if not suffix else f"$HOME/{shlex.quote(suffix)}"
+        expanded = str(Path(home) / suffix) if suffix else home
+        return shlex.quote(expanded)
+
+    return shlex.quote(os.path.expanduser(raw))
+
+
 # Runtime helper emitted for service jobs. It allocates a free TCP port on the
 # compute node (a port chosen on the submit host would be meaningless there) and
 # exports it as FG_SERVICE_PORT along with FG_HOSTNAME, so a service command can
@@ -501,10 +529,14 @@ def _build_container_script(
     bind_paths: list[str],
     container_args: Optional[str] = None,
     cache_dir: Optional[str] = None,
+    username: Optional[str] = None,
 ) -> str:
     """Build shell script for running a command inside an Apptainer container."""
     sif_name = _container_sif_name(container_url)
-    docker_url = container_url if container_url.startswith("docker://") else f"docker://{container_url}"
+    docker_url = (
+        container_url
+        if container_url.startswith("docker://") else f"docker://{container_url}"
+    )
 
     # Deduplicate and sort bind paths
     all_binds = sorted(set([work_dir] + bind_paths))
@@ -516,7 +548,7 @@ def _build_container_script(
         split_args = shlex.split(container_args)
         extra = " " + " ".join(shlex.quote(arg) for arg in split_args)
 
-    resolved_dir = shlex.quote(cache_dir) if cache_dir else _DEFAULT_CONTAINER_CACHE_DIR
+    resolved_dir = _quote_container_cache_dir(cache_dir, username=username)
 
     lines = [
         "# Apptainer container setup",
@@ -887,6 +919,7 @@ async def submit_job(
             bind_paths=bind_paths,
             container_args=effective_container_args,
             cache_dir=container_cache_dir,
+            username=username,
         )
 
     if env_lines:
diff --git a/tests/test_apps.py b/tests/test_apps.py
index c1dd4243..85db1c24 100644
--- a/tests/test_apps.py
+++ b/tests/test_apps.py
@@ -1,6 +1,7 @@
 """Tests for apps module: miniforge/apptainer requirements, conda_env, and container support."""
 
 import os
+import shlex
 import subprocess
 import sys
 import time
@@ -751,6 +752,36 @@ def test_extra_args(self):
         )
         assert "--nv --bind 'my dir' \"$SIF_PATH\"" in script
 
+    def test_cache_dir_expands_tilde_before_quoting(self):
+        cache_dir = "~/apptainer cache"
+        script = _build_container_script(
+            container_url="ghcr.io/org/image:1.0",
+            command="python run.py",
+            work_dir="/work",
+            bind_paths=[],
+            cache_dir=cache_dir,
+        )
+
+        expected = shlex.quote(os.path.expanduser(cache_dir))
+        assert f"APPTAINER_CACHE_DIR={expected}" in script
+        assert "APPTAINER_CACHE_DIR='~/" not in script
+
+    def test_cache_dir_uses_target_user_home(self, monkeypatch):
+        def fake_expanduser(path):
+            return "/home/alice" if path == "~alice" else path
+
+        monkeypatch.setattr(os.path, "expanduser", fake_expanduser)
+        script = _build_container_script(
+            container_url="ghcr.io/org/image:1.0",
+            command="python run.py",
+            work_dir="/work",
+            bind_paths=[],
+            cache_dir="~/apptainer cache",
+            username="alice",
+        )
+
+        assert "APPTAINER_CACHE_DIR='/home/alice/apptainer cache'" in script
+
     def test_pull_conditional(self):
         script = _build_container_script(
             container_url="ghcr.io/org/image:1.0",

From 74d49f0ad31724fbde33185f77e355d872c1dfdd Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 13:15:11 -0400
Subject: [PATCH 79/89] Show fetch failures for app and job files

Render explicit error states when catalog listing entry-point previews or job file loads fail, instead of treating failed fetches as missing data/files.

Co-authored-by: Codex <codex@openai.com>
---
 frontend/src/components/JobDetail.tsx     | 13 +++++++++++++
 frontend/src/components/ListingDetail.tsx |  5 +++++
 2 files changed, 18 insertions(+)

diff --git a/frontend/src/components/JobDetail.tsx b/frontend/src/components/JobDetail.tsx
index 4e8bf4c0..50d1942d 100644
--- a/frontend/src/components/JobDetail.tsx
+++ b/frontend/src/components/JobDetail.tsx
@@ -74,13 +74,23 @@ function omitNullValues(
 
 function FilePreview({
   content,
+  error,
   language,
   isDarkMode
 }: {
   readonly content: string | null | undefined;
+  readonly error?: Error | null;
   readonly language: string;
   readonly isDarkMode: boolean;
 }) {
+  if (error) {
+    return (
+      <div className="p-3 bg-error/10 rounded text-error text-sm">
+        Failed to load file: {error.message || 'Unknown error'}
+      </div>
+    );
+  }
+
   if (content === undefined) {
     return <Typography className="text-foreground p-4">Loading...</Typography>;
   }
@@ -926,6 +936,7 @@ export default function JobDetail() {
                 content={
                   scriptQuery.isPending ? undefined : (scriptQuery.data ?? null)
                 }
+                error={scriptQuery.isError ? scriptQuery.error : null}
                 isDarkMode={isDarkMode}
                 language="bash"
               />
@@ -952,6 +963,7 @@ export default function JobDetail() {
                 content={
                   stdoutQuery.isPending ? undefined : (stdoutQuery.data ?? null)
                 }
+                error={stdoutQuery.isError ? stdoutQuery.error : null}
                 isDarkMode={isDarkMode}
                 language="text"
               />
@@ -978,6 +990,7 @@ export default function JobDetail() {
                 content={
                   stderrQuery.isPending ? undefined : (stderrQuery.data ?? null)
                 }
+                error={stderrQuery.isError ? stderrQuery.error : null}
                 isDarkMode={isDarkMode}
                 language="text"
               />
diff --git a/frontend/src/components/ListingDetail.tsx b/frontend/src/components/ListingDetail.tsx
index e73c6924..db7301b2 100644
--- a/frontend/src/components/ListingDetail.tsx
+++ b/frontend/src/components/ListingDetail.tsx
@@ -179,6 +179,11 @@ export default function ListingDetail() {
           <Typography className="text-foreground" type="small">
             Loading entry points...
           </Typography>
+        ) : manifestMutation.isError && !manifest ? (
+          <div className="p-3 bg-error/10 rounded text-error text-sm">
+            Failed to load entry points:{' '}
+            {manifestMutation.error?.message || 'Unknown error'}
+          </div>
         ) : (
           <EntryPointsList
             onLaunch={ep =>

From 1b451cb6223ebfc3fc36d611a5d8aca1078f58df Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 13:20:28 -0400
Subject: [PATCH 80/89] Export job extra args at top level

Normalize exported job launch params so scheduler extra args are written as top-level extra_args, matching the import path used by AppLaunchForm, instead of being nested under resources.

Co-authored-by: Codex <codex@openai.com>
---
 frontend/src/components/JobDetail.tsx | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/frontend/src/components/JobDetail.tsx b/frontend/src/components/JobDetail.tsx
index 50d1942d..aef677b1 100644
--- a/frontend/src/components/JobDetail.tsx
+++ b/frontend/src/components/JobDetail.tsx
@@ -567,8 +567,12 @@ export default function JobDetail() {
       params.env_parameters = envParameters;
     }
     const resources = job.resources ? omitNullValues(job.resources) : {};
-    if (Object.keys(resources).length > 0) {
-      params.resources = resources as AppResourceDefaults;
+    const { extra_args: extraArgs, ...resourceValues } = resources;
+    if (Object.keys(resourceValues).length > 0) {
+      params.resources = resourceValues as AppResourceDefaults;
+    }
+    if (typeof extraArgs === 'string' && extraArgs.trim()) {
+      params.extra_args = extraArgs;
     }
     if (job.env && Object.keys(job.env).length > 0) {
       params.env = job.env;

From 7c7c5781b88f72c43d89128ccc5174bb6240b75b Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 13:23:36 -0400
Subject: [PATCH 81/89] Clean up jobs after submit-time failures

Delete the newly created job row if validation, script assembly, or worker submission fails after the row has been inserted, preventing orphan PENDING jobs from lingering in the jobs list.

Co-authored-by: Codex <codex@openai.com>
---
 fileglancer/apps/jobs.py | 204 ++++++++++++++++++++-------------------
 tests/test_apps.py       |  70 ++++++++++++++
 2 files changed, 173 insertions(+), 101 deletions(-)

diff --git a/fileglancer/apps/jobs.py b/fileglancer/apps/jobs.py
index 204dfc8f..048b0f71 100644
--- a/fileglancer/apps/jobs.py
+++ b/fileglancer/apps/jobs.py
@@ -844,110 +844,114 @@ async def submit_job(
         db_job.work_dir = str(work_dir)
         session.commit()
 
-    # Build environment variable export lines
-    env_lines = ""
-    if merged_env:
-        parts = []
-        for var_name, var_value in merged_env.items():
-            if not _ENV_VAR_NAME_PATTERN.match(var_name):
-                raise ValueError(f"Invalid environment variable name: '{var_name}'")
-            parts.append(f"export {var_name}={shlex.quote(var_value)}")
-        env_lines = "\n".join(parts) + "\n"
-
-    # Set up the script preamble:
-    # - FG_WORK_DIR: the job's working directory (used by subsequent variables)
-    # - Unset PIXI_PROJECT_MANIFEST so pixi uses the repo's own manifest
-    # - SERVICE_URL_PATH: for service-type jobs, where to write the service URL
-    # - cd into the repo so commands can find project files (pixi.toml, scripts, etc.)
-    preamble_lines = [
-        "unset PIXI_PROJECT_MANIFEST",
-        f"export FG_WORK_DIR={shlex.quote(str(work_dir))}",
-        # Where the script reports its startup phase (e.g. pulling a container
-        # image). The UI reads this to explain a wait before a service is ready.
-        'export FG_PHASE_PATH="$FG_WORK_DIR/phase"',
-    ]
-    # For local executor, trap EXIT to write the exit code to a file so
-    # PID-based polling can determine the final status after the process exits.
-    if settings.cluster.executor == "local":
-        preamble_lines.append(
-            'trap \'echo $? > "$FG_WORK_DIR/exit_code"\' EXIT'
-        )
-    if settings.apps.extra_paths:
-        path_suffix = os.pathsep.join(shlex.quote(p) for p in settings.apps.extra_paths)
-        preamble_lines.append(f"export PATH=$PATH:{path_suffix}")
-    if entry_point.type == "service":
-        preamble_lines.append('export SERVICE_URL_PATH="$FG_WORK_DIR/service_url"')
-        preamble_lines.append(_SERVICE_PORT_HELPER)
-        # With auto_url, Fileglancer publishes the URL for the author: a
-        # background probe waits for $FG_SERVICE_PORT to accept connections and
-        # then writes http://$FG_HOSTNAME:$FG_SERVICE_PORT plus the optional
-        # (validated) service_url_suffix. A service that manages its own URL
-        # leaves auto_url unset and writes SERVICE_URL_PATH itself.
-        if entry_point.auto_url:
+    # The job row exists but the cluster knows nothing about it yet: any
+    # failure between here and a successful worker submit (env-var
+    # validation, script assembly, the submit dispatch) must remove the
+    # row, or it lingers as a phantom PENDING job that never runs.
+    try:
+        # Build environment variable export lines
+        env_lines = ""
+        if merged_env:
+            parts = []
+            for var_name, var_value in merged_env.items():
+                if not _ENV_VAR_NAME_PATTERN.match(var_name):
+                    raise ValueError(f"Invalid environment variable name: '{var_name}'")
+                parts.append(f"export {var_name}={shlex.quote(var_value)}")
+            env_lines = "\n".join(parts) + "\n"
+
+        # Set up the script preamble:
+        # - FG_WORK_DIR: the job's working directory (used by subsequent variables)
+        # - Unset PIXI_PROJECT_MANIFEST so pixi uses the repo's own manifest
+        # - SERVICE_URL_PATH: for service-type jobs, where to write the service URL
+        # - cd into the repo so commands can find project files (pixi.toml, scripts, etc.)
+        preamble_lines = [
+            "unset PIXI_PROJECT_MANIFEST",
+            f"export FG_WORK_DIR={shlex.quote(str(work_dir))}",
+            # Where the script reports its startup phase (e.g. pulling a container
+            # image). The UI reads this to explain a wait before a service is ready.
+            'export FG_PHASE_PATH="$FG_WORK_DIR/phase"',
+        ]
+        # For local executor, trap EXIT to write the exit code to a file so
+        # PID-based polling can determine the final status after the process exits.
+        if settings.cluster.executor == "local":
             preamble_lines.append(
-                _build_service_url_publisher(entry_point.service_url_suffix or "")
+                'trap \'echo $? > "$FG_WORK_DIR/exit_code"\' EXIT'
             )
-    # Choose the working directory. 'work' runs from the job's work dir (the
-    # repo is still reachable via the `repo` symlink); 'repo' runs from the
-    # cloned project (optionally the manifest's subdirectory). cd_suffix may
-    # include a Git-derived directory name, so shell-escape it — FG_WORK_DIR
-    # stays in its own double-quoted segment so it still expands.
-    if entry_point.effective_working_dir == "work":
-        preamble_lines.append('cd "$FG_WORK_DIR"')
-    else:
-        preamble_lines.append(f'cd "$FG_WORK_DIR"/{shlex.quote(cd_suffix)}')
-    script_parts = ["\n".join(preamble_lines)]
-
-    # Conda environment activation
-    if entry_point.conda_env:
-        conda_activation = (
-            'eval "$(conda shell.bash hook)"\n'
-            f'conda activate {shlex.quote(entry_point.conda_env)}'
-        )
-        script_parts.append(conda_activation)
+        if settings.apps.extra_paths:
+            path_suffix = os.pathsep.join(shlex.quote(p) for p in settings.apps.extra_paths)
+            preamble_lines.append(f"export PATH=$PATH:{path_suffix}")
+        if entry_point.type == "service":
+            preamble_lines.append('export SERVICE_URL_PATH="$FG_WORK_DIR/service_url"')
+            preamble_lines.append(_SERVICE_PORT_HELPER)
+            # With auto_url, Fileglancer publishes the URL for the author: a
+            # background probe waits for $FG_SERVICE_PORT to accept connections and
+            # then writes http://$FG_HOSTNAME:$FG_SERVICE_PORT plus the optional
+            # (validated) service_url_suffix. A service that manages its own URL
+            # leaves auto_url unset and writes SERVICE_URL_PATH itself.
+            if entry_point.auto_url:
+                preamble_lines.append(
+                    _build_service_url_publisher(entry_point.service_url_suffix or "")
+                )
+        # Choose the working directory. 'work' runs from the job's work dir (the
+        # repo is still reachable via the `repo` symlink); 'repo' runs from the
+        # cloned project (optionally the manifest's subdirectory). cd_suffix may
+        # include a Git-derived directory name, so shell-escape it — FG_WORK_DIR
+        # stays in its own double-quoted segment so it still expands.
+        if entry_point.effective_working_dir == "work":
+            preamble_lines.append('cd "$FG_WORK_DIR"')
+        else:
+            preamble_lines.append(f'cd "$FG_WORK_DIR"/{shlex.quote(cd_suffix)}')
+        script_parts = ["\n".join(preamble_lines)]
+
+        # Conda environment activation
+        if entry_point.conda_env:
+            conda_activation = (
+                'eval "$(conda shell.bash hook)"\n'
+                f'conda activate {shlex.quote(entry_point.conda_env)}'
+            )
+            script_parts.append(conda_activation)
 
-    # If container is defined, wrap command in apptainer exec
-    if effective_container:
-        bind_paths = _container_bind_paths(
-            entry_point, parameters, env_parameters, username, cached_repo_dir
-        )
+        # If container is defined, wrap command in apptainer exec
+        if effective_container:
+            bind_paths = _container_bind_paths(
+                entry_point, parameters, env_parameters, username, cached_repo_dir
+            )
 
-        command = _build_container_script(
-            container_url=effective_container,
-            command=command,
-            work_dir=str(work_dir),
-            bind_paths=bind_paths,
-            container_args=effective_container_args,
-            cache_dir=container_cache_dir,
-            username=username,
-        )
+            command = _build_container_script(
+                container_url=effective_container,
+                command=command,
+                work_dir=str(work_dir),
+                bind_paths=bind_paths,
+                container_args=effective_container_args,
+                cache_dir=container_cache_dir,
+                username=username,
+            )
 
-    if env_lines:
-        script_parts.append(env_lines.rstrip())
-    # Verify required tools now that PATH, conda, and env vars are set up, but
-    # before pre_run/command do any real work. Fails the job with a readable
-    # message in stderr if a requirement is unmet.
-    req_check = build_requirements_check(effective_requirements)
-    if req_check:
-        script_parts.append(req_check)
-    if effective_pre_run:
-        script_parts.append(effective_pre_run.rstrip())
-    script_parts.append(command)
-    if effective_post_run:
-        script_parts.append(effective_post_run.rstrip())
-    full_command = "\n\n".join(script_parts)
-
-    # Set work_dir and log paths on resource spec
-    resource_spec.work_dir = str(work_dir)
-    resource_spec.stdout_path = str(work_dir / "stdout.log")
-    resource_spec.stderr_path = str(work_dir / "stderr.log")
-
-    # Submit to the cluster as the target user via the persistent worker:
-    # it creates the work directory, symlinks the repo, and calls
-    # executor.submit() — all with the user's identity.
-    job_name = f"{manifest.name}-{entry_point.id}"
-    cluster_config = settings.cluster.model_dump(exclude_none=True)
-    try:
+        if env_lines:
+            script_parts.append(env_lines.rstrip())
+        # Verify required tools now that PATH, conda, and env vars are set up, but
+        # before pre_run/command do any real work. Fails the job with a readable
+        # message in stderr if a requirement is unmet.
+        req_check = build_requirements_check(effective_requirements)
+        if req_check:
+            script_parts.append(req_check)
+        if effective_pre_run:
+            script_parts.append(effective_pre_run.rstrip())
+        script_parts.append(command)
+        if effective_post_run:
+            script_parts.append(effective_post_run.rstrip())
+        full_command = "\n\n".join(script_parts)
+
+        # Set work_dir and log paths on resource spec
+        resource_spec.work_dir = str(work_dir)
+        resource_spec.stdout_path = str(work_dir / "stdout.log")
+        resource_spec.stderr_path = str(work_dir / "stderr.log")
+
+        # Submit to the cluster as the target user via the persistent worker:
+        # it creates the work directory, symlinks the repo, and calls
+        # executor.submit() — all with the user's identity.
+        job_name = f"{manifest.name}-{entry_point.id}"
+        cluster_config = settings.cluster.model_dump(exclude_none=True)
         worker_result = await _dispatch(
             username, "submit",
             cluster_config=cluster_config,
@@ -969,8 +973,6 @@ async def submit_job(
             cached_repo_dir=str(cached_repo_dir),
         )
     except Exception:
-        # Cluster submission failed — remove the PENDING DB record so
-        # the job does not appear in the user's jobs list.
         with db.get_db_session(settings.db_url) as session:
             db.delete_job(session, job_id, username)
         raise
diff --git a/tests/test_apps.py b/tests/test_apps.py
index 85db1c24..4dc84e96 100644
--- a/tests/test_apps.py
+++ b/tests/test_apps.py
@@ -2412,3 +2412,73 @@ async def run():
         assert poll_jobs.await_count == 2
         assert active_user.call_count == 2
         assert jobs_mod._poll_task is None
+
+
+class TestSubmitJobOrphanCleanup:
+    """A submit-time failure after the job row is created must delete the row.
+
+    Env-var validation, script assembly, and the worker submit all run after
+    create_job; if any of them fails without cleanup, the user is left with a
+    phantom PENDING job that never runs and never resolves.
+    """
+
+    def _submit(self, tmp_path, monkeypatch, entry_point=None, dispatch=None,
+                **submit_kwargs):
+        import asyncio
+        from unittest.mock import AsyncMock
+        import fileglancer.apps.jobs as jobs_mod
+        from fileglancer import database as db
+        from fileglancer.model import AppEntryPoint, AppManifest
+        from fileglancer.settings import Settings
+
+        db_url = f"sqlite:///{tmp_path / 'jobs.db'}"
+        db.Base.metadata.create_all(db._get_engine(db_url))
+        settings = Settings(db_url=db_url, file_share_mounts=[], cli_mode=True)
+        monkeypatch.setattr(jobs_mod, "get_settings", lambda: settings)
+
+        manifest = AppManifest(
+            name="demo",
+            runnables=[AppEntryPoint(id="run", name="Run", command="echo hi",
+                                     **(entry_point or {}))],
+        )
+        monkeypatch.setattr(jobs_mod, "get_or_load_manifest",
+                            AsyncMock(return_value=manifest))
+        monkeypatch.setattr(jobs_mod, "ensure_repo_snapshot",
+                            AsyncMock(return_value=(tmp_path / "repo", "abc123")))
+        monkeypatch.setattr(jobs_mod, "_dispatch",
+                            dispatch or AsyncMock(return_value={}))
+
+        async def run():
+            return await jobs_mod.submit_job(
+                username="alice",
+                app_url="https://github.com/org/demo",
+                entry_point_id="run",
+                parameters={},
+                **submit_kwargs,
+            )
+        return asyncio.run(run())
+
+    def _job_count(self, tmp_path):
+        from fileglancer import database as db
+        with db.get_db_session(f"sqlite:///{tmp_path / 'jobs.db'}") as session:
+            return session.query(db.JobDB).count()
+
+    def test_invalid_env_var_name_deletes_row(self, tmp_path, monkeypatch):
+        with pytest.raises(ValueError, match="Invalid environment variable name"):
+            self._submit(tmp_path, monkeypatch, env={"BAD NAME": "x"})
+        assert self._job_count(tmp_path) == 0
+
+    def test_malformed_container_args_deletes_row(self, tmp_path, monkeypatch):
+        # shlex.split raises "No closing quotation" during script assembly
+        with pytest.raises(ValueError):
+            self._submit(tmp_path, monkeypatch,
+                         container="docker://busybox",
+                         container_args="'unterminated")
+        assert self._job_count(tmp_path) == 0
+
+    def test_worker_submit_failure_deletes_row(self, tmp_path, monkeypatch):
+        from unittest.mock import AsyncMock
+        dispatch = AsyncMock(side_effect=RuntimeError("worker down"))
+        with pytest.raises(RuntimeError, match="worker down"):
+            self._submit(tmp_path, monkeypatch, dispatch=dispatch)
+        assert self._job_count(tmp_path) == 0

From 79c3025f1de808fe58e04e12501b7c16325d2a91 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 13:44:15 -0400
Subject: [PATCH 82/89] Add happy-path coverage for job submission and the jobs
 API
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

submit_job's assembly — the script text and resource spec dispatched to
the worker, which is what actually runs as the user — previously had
only failure-path tests. TestSubmitJobAssembly covers the script layout
(preamble, conda activation, env exports, pre/post_run ordering,
parameter shell-quoting, local-executor exit-code trap), service
preambles, container wrapping with default-path binds, resource
overrides with extra_args tokenization, and worker path-validation
errors mapped back to parameter names.

At the HTTP level, POST/GET /api/jobs, GET /api/jobs/{id} (including
derived file paths), POST .../cancel, GET .../files/{type}, and
POST /api/apps/validate-paths were untested; each now has endpoint
tests, with the service-URL/phase and job-file reads exercising the
real in-process worker actions.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 tests/test_apps.py           | 197 +++++++++++++++++++++++++++
 tests/test_apps_endpoints.py | 256 ++++++++++++++++++++++++++++++++++-
 2 files changed, 450 insertions(+), 3 deletions(-)

diff --git a/tests/test_apps.py b/tests/test_apps.py
index 4dc84e96..8541f5f6 100644
--- a/tests/test_apps.py
+++ b/tests/test_apps.py
@@ -2482,3 +2482,200 @@ def test_worker_submit_failure_deletes_row(self, tmp_path, monkeypatch):
         with pytest.raises(RuntimeError, match="worker down"):
             self._submit(tmp_path, monkeypatch, dispatch=dispatch)
         assert self._job_count(tmp_path) == 0
+
+
+class TestSubmitJobAssembly:
+    """Happy-path coverage for submit_job's assembly.
+
+    The building blocks (build_command, _build_container_script, preamble
+    helpers) have their own unit tests; these cover how submit_job composes
+    them — the exact script text and resource spec dispatched to the worker,
+    which is what actually runs as the user — and the job row it creates.
+    """
+
+    WORKER_RESULT = {
+        "job_id": "cluster-42",
+        "script_path": "/home/alice/.fileglancer/jobs/1-demo-run/script.sh",
+        "work_dir_fsp_name": "home",
+        "work_dir_subpath": ".fileglancer/jobs/1-demo-run",
+    }
+
+    def _submit(self, tmp_path, monkeypatch, entry_point=None, cluster=None,
+                file_share_mounts=None, validate_errors=None, **submit_kwargs):
+        """Run submit_job with worker seams mocked; return (job, dispatch calls)."""
+        import asyncio
+        from unittest.mock import AsyncMock
+        import fileglancer.apps.jobs as jobs_mod
+        from fileglancer import database as db
+        from fileglancer.settings import Settings
+
+        db_url = f"sqlite:///{tmp_path / 'jobs.db'}"
+        db.Base.metadata.create_all(db._get_engine(db_url))
+        settings = Settings(db_url=db_url,
+                            file_share_mounts=file_share_mounts or [],
+                            cli_mode=True,
+                            cluster=cluster or {})
+        monkeypatch.setattr(jobs_mod, "get_settings", lambda: settings)
+        # build_command validates path params against the file shares, which
+        # get_file_share_paths reads from settings.
+        monkeypatch.setattr(db, "get_settings", lambda: settings)
+
+        manifest = AppManifest(
+            name="demo",
+            runnables=[AppEntryPoint(id="run", name="Run", command="echo hi",
+                                     **(entry_point or {}))],
+        )
+        monkeypatch.setattr(jobs_mod, "get_or_load_manifest",
+                            AsyncMock(return_value=manifest))
+        monkeypatch.setattr(jobs_mod, "ensure_repo_snapshot",
+                            AsyncMock(return_value=(tmp_path / "repo", "a" * 40)))
+        monkeypatch.setattr(jobs_mod, "ensure_poll_loop", lambda: None)
+
+        calls = []
+
+        async def fake_dispatch(username, action, **kwargs):
+            calls.append((action, kwargs))
+            if action == "validate_paths":
+                return {"errors": validate_errors or {}}
+            if action == "create_dirs":
+                return {"errors": {}}
+            if action == "submit":
+                return dict(self.WORKER_RESULT)
+            return {}
+
+        monkeypatch.setattr(jobs_mod, "_dispatch", fake_dispatch)
+
+        async def run():
+            return await jobs_mod.submit_job(
+                username="alice",
+                app_url="https://github.com/org/demo",
+                entry_point_id="run",
+                parameters=submit_kwargs.pop("parameters", {}),
+                **submit_kwargs,
+            )
+        return asyncio.run(run()), calls
+
+    def _submitted(self, calls):
+        """Return the kwargs of the single worker 'submit' dispatch."""
+        submits = [kwargs for action, kwargs in calls if action == "submit"]
+        assert len(submits) == 1
+        return submits[0]
+
+    def test_creates_pending_job_with_cluster_metadata(self, tmp_path, monkeypatch):
+        job, calls = self._submit(tmp_path, monkeypatch)
+
+        assert job.status == "PENDING"
+        assert job.cluster_job_id == "cluster-42"
+        assert job.script_path == self.WORKER_RESULT["script_path"]
+        assert job.work_dir_fsp_name == "home"
+        assert job.work_dir_subpath == ".fileglancer/jobs/1-demo-run"
+        assert job.commit_sha == "a" * 40
+        assert job.app_name == "demo"
+        assert f"{job.id}-demo-run" in job.work_dir
+
+        submitted = self._submitted(calls)
+        assert submitted["work_dir"] == job.work_dir
+        assert submitted["job_name"] == "demo-run"
+        assert submitted["resources"]["stdout_path"] == f"{job.work_dir}/stdout.log"
+        assert submitted["resources"]["stderr_path"] == f"{job.work_dir}/stderr.log"
+
+    def test_script_layout_and_parameter_quoting(self, tmp_path, monkeypatch):
+        job, calls = self._submit(
+            tmp_path, monkeypatch,
+            # A developer config.yaml deep-merges into Settings, so pin the
+            # executor rather than relying on the 'local' default.
+            cluster={"executor": "local"},
+            entry_point={
+                "conda_env": "tools",
+                "env": {"GREETING": "hello world"},
+                "pre_run": "echo before",
+                "post_run": "echo after",
+                "parameters": [{"flag": "--name", "name": "Name", "type": "string"}],
+            },
+            parameters={"name": "Ada Lovelace"},
+        )
+        script = self._submitted(calls)["command"]
+
+        assert script.startswith("unset PIXI_PROJECT_MANIFEST")
+        assert f"export FG_WORK_DIR={shlex.quote(job.work_dir)}" in script
+        # Default working dir is the repo snapshot (no manifest subdir here).
+        assert 'cd "$FG_WORK_DIR"/repo' in script
+        assert "conda activate tools" in script
+        # User-facing values reach the script shell-quoted.
+        assert "export GREETING='hello world'" in script
+        assert "echo hi" in script
+        assert "--name 'Ada Lovelace'" in script
+        # pre_run -> command -> post_run ordering.
+        assert (script.index("echo before")
+                < script.index("echo hi")
+                < script.index("echo after"))
+        # The local executor records the exit code for PID polling.
+        assert 'trap \'echo $? > "$FG_WORK_DIR/exit_code"\' EXIT' in script
+
+    def test_non_local_executor_omits_exit_code_trap(self, tmp_path, monkeypatch):
+        _, calls = self._submit(tmp_path, monkeypatch, cluster={"executor": "lsf"})
+        assert "exit_code" not in self._submitted(calls)["command"]
+
+    def test_service_entry_point_preamble(self, tmp_path, monkeypatch):
+        _, calls = self._submit(
+            tmp_path, monkeypatch,
+            entry_point={"type": "service", "auto_url": True},
+        )
+        script = self._submitted(calls)["command"]
+        assert 'export SERVICE_URL_PATH="$FG_WORK_DIR/service_url"' in script
+        assert "FG_SERVICE_PORT" in script
+
+    def test_container_wraps_command_and_binds_default_paths(self, tmp_path, monkeypatch):
+        input_file = tmp_path / "input.txt"
+        input_file.write_text("data")
+        job, calls = self._submit(
+            tmp_path, monkeypatch,
+            entry_point={
+                "container": "docker://busybox",
+                "parameters": [{"flag": "--input", "name": "Input", "type": "file",
+                                "default": str(input_file)}],
+            },
+            file_share_mounts=[str(tmp_path)],
+        )
+        script = self._submitted(calls)["command"]
+
+        assert "apptainer" in script
+        # The file param came from its manifest default (not the submitted
+        # parameters), and its parent dir must still be bind-mounted.
+        assert f"--bind {shlex.quote(str(tmp_path))}" in script
+        # Container runnables default to running from the work dir.
+        assert 'cd "$FG_WORK_DIR"\n' in script or script.endswith('cd "$FG_WORK_DIR"')
+        assert 'cd "$FG_WORK_DIR"/repo' not in script
+
+    def test_resource_overrides_and_extra_args_tokens(self, tmp_path, monkeypatch):
+        job, calls = self._submit(
+            tmp_path, monkeypatch,
+            resources={"cpus": 4, "memory": "8G", "queue": "gpu"},
+            extra_args='-P proj -R "select[mem>8000]"',
+        )
+        resources = self._submitted(calls)["resources"]
+        assert resources["cpus"] == 4
+        assert resources["memory"] == "8G"
+        assert resources["queue"] == "gpu"
+        # The user's string arrives at the scheduler as distinct argv tokens.
+        assert resources["extra_args"] == ["-P", "proj", "-R", "select[mem>8000]"]
+        # The job row stores the same tokens, shell-joined for lossless
+        # round-tripping into the relaunch form.
+        assert job.resources["extra_args"] == "-P proj -R 'select[mem>8000]'"
+        assert job.resources["cpus"] == 4
+
+    def test_worker_path_validation_failure_names_parameter(self, tmp_path, monkeypatch):
+        from fileglancer import database as db
+        with pytest.raises(ValueError, match="Parameter 'Input': not readable"):
+            self._submit(
+                tmp_path, monkeypatch,
+                entry_point={
+                    "parameters": [{"flag": "--input", "name": "Input", "type": "file"}],
+                },
+                parameters={"input": str(tmp_path / "missing.txt")},
+                file_share_mounts=[str(tmp_path)],
+                validate_errors={"0": "not readable"},
+            )
+        # Validation runs before the job row is created — nothing to clean up.
+        with db.get_db_session(f"sqlite:///{tmp_path / 'jobs.db'}") as session:
+            assert session.query(db.JobDB).count() == 0
diff --git a/tests/test_apps_endpoints.py b/tests/test_apps_endpoints.py
index 0287cb8e..374e6ba1 100644
--- a/tests/test_apps_endpoints.py
+++ b/tests/test_apps_endpoints.py
@@ -14,6 +14,7 @@
 from fileglancer.server import create_app, get_current_user
 from fileglancer.database import (
     Base,
+    FileSharePathDB,
     UserAppDB,
     UserPreferenceDB,
     create_engine,
@@ -132,7 +133,9 @@ def _seed_app(db_session, *, url="https://github.com/owner/repo",
     return row
 
 
-def _seed_job(db_session, *, status="DONE"):
+def _seed_job(db_session, *, status="DONE", entry_point_type="job",
+              work_dir=None, cluster_job_id=None, script_path=None,
+              started_at=None, work_dir_fsp_name=None, work_dir_subpath=None):
     job = create_job(
         session=db_session,
         username=TEST_USERNAME,
@@ -140,10 +143,20 @@ def _seed_job(db_session, *, status="DONE"):
         app_name="Demo App",
         entry_point_id="run",
         entry_point_name="Run",
+        entry_point_type=entry_point_type,
         parameters={},
     )
-    if status != "PENDING":
-        update_job_status(db_session, job.id, status)
+    if work_dir:
+        job.work_dir = work_dir
+        db_session.commit()
+    update_job_status(
+        db_session, job.id, status,
+        cluster_job_id=cluster_job_id,
+        script_path=script_path,
+        started_at=started_at,
+        work_dir_fsp_name=work_dir_fsp_name,
+        work_dir_subpath=work_dir_subpath,
+    )
     db_session.refresh(job)
     return job
 
@@ -870,6 +883,243 @@ def test_cluster_defaults_preserves_extra_args_tokens(temp_dir):
     assert shlex.split(value) == args
 
 
+# --- Job endpoints (submit, list, get, cancel, files, validate-paths) ---
+
+
+def _install_app_with_manifest(db_session, name="My Custom Name"):
+    """Seed an installed, pinned app whose manifest is cached in the DB, so
+    submit_job's manifest load never touches git or the worker."""
+    manifest = _make_manifest(name="Manifest Name")
+    return _seed_app(db_session, manifest=manifest.model_dump(mode="json"),
+                     name=name, commit_sha=TEST_SHA)
+
+
+def test_submit_job_creates_pending_job(test_client, db_session):
+    _install_app_with_manifest(db_session)
+    dispatch = AsyncMock(return_value={
+        "job_id": "lsf-123",
+        "script_path": "/home/u/.fileglancer/jobs/1-demo-run/script.sh",
+        "work_dir_fsp_name": "home",
+        "work_dir_subpath": ".fileglancer/jobs/1-demo-run",
+    })
+
+    with patch("fileglancer.apps.jobs._dispatch", new=dispatch), \
+         patch("fileglancer.apps.jobs.ensure_repo_snapshot",
+               new=AsyncMock(return_value=("/tmp/snapshots/x", TEST_SHA))), \
+         patch("fileglancer.apps.jobs.ensure_poll_loop", new=lambda: None):
+        response = test_client.post("/api/jobs", json={
+            "app_url": "https://github.com/owner/repo",
+            "entry_point_id": "run",
+            "parameters": {},
+            "resources": {"cpus": 2},
+            "extra_args": "-P proj -W 60",
+        })
+
+    assert response.status_code == 200
+    body = response.json()
+    assert body["status"] == "PENDING"
+    assert body["cluster_job_id"] == "lsf-123"
+    # The job is labeled with the name the user saved for the app, not the
+    # raw manifest name.
+    assert body["app_name"] == "My Custom Name"
+    assert body["commit_sha"] == TEST_SHA
+
+    # The worker received the resource overrides, with the extra_args string
+    # split into distinct argv tokens for the scheduler.
+    submit_calls = [c for c in dispatch.await_args_list if c.args[1] == "submit"]
+    assert len(submit_calls) == 1
+    resources = submit_calls[0].kwargs["resources"]
+    assert resources["cpus"] == 2
+    assert resources["extra_args"] == ["-P", "proj", "-W", "60"]
+
+    db_session.expire_all()
+    assert get_job(db_session, body["id"], TEST_USERNAME).status == "PENDING"
+
+
+def test_submit_job_unknown_entry_point_400(test_client, db_session):
+    _install_app_with_manifest(db_session)
+
+    response = test_client.post("/api/jobs", json={
+        "app_url": "https://github.com/owner/repo",
+        "entry_point_id": "nope",
+        "parameters": {},
+    })
+
+    assert response.status_code == 400
+    assert "Entry point" in response.json()["error"]
+
+
+def test_get_jobs_lists_and_filters_by_status(test_client, db_session):
+    done = _seed_job(db_session, status="DONE")
+    running = _seed_job(db_session, status="RUNNING")
+
+    response = test_client.get("/api/jobs")
+    assert response.status_code == 200
+    assert {j["id"] for j in response.json()["jobs"]} == {done.id, running.id}
+
+    response = test_client.get("/api/jobs", params={"status": "DONE"})
+    jobs = response.json()["jobs"]
+    assert [j["id"] for j in jobs] == [done.id]
+    assert jobs[0]["status"] == "DONE"
+
+
+def test_get_jobs_running_service_includes_url_and_phase(test_client, db_session, temp_dir):
+    """A running service's URL and startup phase are read from its work dir
+    (through the worker layer) and included in the listing."""
+    work_dir = os.path.join(temp_dir, "svc")
+    os.makedirs(work_dir)
+    with open(os.path.join(work_dir, "service_url"), "w", encoding="utf-8") as f:
+        f.write("http://node1:8888\n")
+    with open(os.path.join(work_dir, "phase"), "w", encoding="utf-8") as f:
+        f.write("starting\n")
+    _seed_job(db_session, status="RUNNING", entry_point_type="service",
+              work_dir=work_dir)
+
+    response = test_client.get("/api/jobs")
+
+    assert response.status_code == 200
+    (entry,) = response.json()["jobs"]
+    assert entry["service_url"] == "http://node1:8888"
+    assert entry["phase"] == "starting"
+
+
+def test_get_job_includes_file_paths(test_client, db_session):
+    work_dir = "/home/u/.fileglancer/jobs/9-Demo_App-run"
+    job = _seed_job(
+        db_session, status="RUNNING",
+        work_dir=work_dir,
+        script_path=f"{work_dir}/job.sh",
+        started_at=datetime.now(UTC),
+        work_dir_fsp_name="home",
+        work_dir_subpath=".fileglancer/jobs/9-Demo_App-run",
+    )
+
+    response = test_client.get(f"/api/jobs/{job.id}")
+
+    assert response.status_code == 200
+    files = response.json()["files"]
+    assert files["script"]["path"] == f"{work_dir}/job.sh"
+    assert files["script"]["exists"] is True
+    assert files["stdout"]["path"] == f"{work_dir}/stdout.log"
+    assert files["stdout"]["exists"] is True
+    assert files["stdout"]["fsp_name"] == "home"
+    assert files["stdout"]["subpath"] == ".fileglancer/jobs/9-Demo_App-run/stdout.log"
+    assert files["work_dir"]["subpath"] == ".fileglancer/jobs/9-Demo_App-run"
+
+
+def test_get_job_missing_404(test_client):
+    response = test_client.get("/api/jobs/9999")
+    assert response.status_code == 404
+
+
+def test_cancel_running_job(test_client, db_session):
+    job = _seed_job(db_session, status="RUNNING",
+                    work_dir="/home/u/.fileglancer/jobs/1-Demo_App-run",
+                    cluster_job_id="lsf-1")
+    # The worker action differs by executor (cancel_local vs cancel); the mock
+    # result satisfies both, so this test is independent of any developer
+    # config.yaml that deep-merges an executor into Settings.
+    dispatch = AsyncMock(return_value={"terminated": True})
+
+    with patch("fileglancer.apps.jobs._dispatch", new=dispatch):
+        response = test_client.post(f"/api/jobs/{job.id}/cancel")
+
+    assert response.status_code == 200
+    assert response.json()["status"] == "KILLED"
+    assert response.json()["finished_at"] is not None
+    assert dispatch.await_args.args[1] in ("cancel_local", "cancel")
+    db_session.expire_all()
+    assert get_job(db_session, job.id, TEST_USERNAME).status == "KILLED"
+
+
+@pytest.mark.parametrize("status", ["DONE", "FAILED", "KILLED"])
+def test_cancel_terminal_job_400(test_client, db_session, status):
+    job = _seed_job(db_session, status=status)
+
+    response = test_client.post(f"/api/jobs/{job.id}/cancel")
+
+    assert response.status_code == 400
+    assert "not cancellable" in response.json()["error"]
+    db_session.expire_all()
+    assert get_job(db_session, job.id, TEST_USERNAME).status == status
+
+
+def test_get_job_file_returns_content(test_client, db_session, temp_dir):
+    work_dir = os.path.join(temp_dir, "job1")
+    os.makedirs(work_dir)
+    with open(os.path.join(work_dir, "stdout.log"), "w", encoding="utf-8") as f:
+        f.write("hello from the job\n")
+    script_path = os.path.join(work_dir, "job.sh")
+    with open(script_path, "w", encoding="utf-8") as f:
+        f.write("#!/bin/bash\necho hi\n")
+    job = _seed_job(db_session, status="DONE", work_dir=work_dir,
+                    script_path=script_path)
+
+    response = test_client.get(f"/api/jobs/{job.id}/files/stdout")
+    assert response.status_code == 200
+    assert response.text == "hello from the job\n"
+
+    response = test_client.get(f"/api/jobs/{job.id}/files/script")
+    assert response.status_code == 200
+    assert response.text == "#!/bin/bash\necho hi\n"
+
+
+def test_get_job_file_missing_file_404(test_client, db_session, temp_dir):
+    work_dir = os.path.join(temp_dir, "job2")
+    os.makedirs(work_dir)
+    job = _seed_job(db_session, status="DONE", work_dir=work_dir)
+
+    response = test_client.get(f"/api/jobs/{job.id}/files/stderr")
+
+    assert response.status_code == 404
+    assert "File not found" in response.json()["error"]
+
+
+def test_get_job_file_invalid_type_400(test_client, db_session):
+    job = _seed_job(db_session, status="DONE")
+
+    response = test_client.get(f"/api/jobs/{job.id}/files/env")
+
+    assert response.status_code == 400
+
+
+def test_get_job_file_unknown_job_404(test_client):
+    response = test_client.get("/api/jobs/9999/files/stdout")
+    assert response.status_code == 404
+
+
+def test_validate_paths_endpoint(test_client, db_session, temp_dir):
+    # With settings.file_share_mounts empty, file shares come from the DB.
+    db_session.add(FileSharePathDB(
+        name="scratch", zone="Local", group="local", storage="local",
+        mount_path=temp_dir, mac_path=temp_dir, windows_path=temp_dir,
+        linux_path=temp_dir,
+    ))
+    db_session.commit()
+    inside = os.path.join(temp_dir, "data.txt")
+    with open(inside, "w", encoding="utf-8") as f:
+        f.write("x")
+
+    response = test_client.post("/api/apps/validate-paths", json={
+        "paths": {
+            "input": inside,
+            "outside": "/definitely/not/shared/file.txt",
+            "output": os.path.join(temp_dir, "results"),
+            "wrongtype": temp_dir,
+        },
+        "may_be_missing": ["output"],
+        "types": {"input": "file", "wrongtype": "file"},
+    })
+
+    assert response.status_code == 200
+    errors = response.json()["errors"]
+    assert "input" not in errors
+    # exists=false outputs are containment-checked only.
+    assert "output" not in errors
+    assert "not within an allowed file share" in errors["outside"]
+    assert "a file is required" in errors["wrongtype"]
+
+
 def test_fetch_manifest_uses_cache_for_installed_app(test_client, db_session):
     """POST /api/apps/manifest returns cached manifest without disk read."""
     cached = _make_manifest(name="Cached App")

From 0d525387fd99fecb24578a69dafff9a436502db7 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 13:46:29 -0400
Subject: [PATCH 83/89] Show non-field errors in the launch form error banner

When server-side path validation could not run, the failure was stored
under the `_general` error key, which matches no parameter field: the
banner claimed there were highlighted errors while nothing was
highlighted and the real message was never shown. The banner now prints
the message of any error key that has no corresponding field, and only
claims highlighted errors when a field-keyed error actually exists.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../components/ui/AppsPage/AppLaunchForm.tsx    | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx b/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
index 81b63799..69f2f36c 100644
--- a/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
+++ b/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
@@ -1283,10 +1283,25 @@ export default function AppLaunchForm({
       {submitError}
     </div>
   ) : null;
+  // Errors keyed by a parameter render inline next to their field; any other
+  // key (e.g. `_general`, set when server-side path validation cannot run) has
+  // no field to highlight, so its message must appear in the banner itself.
+  const fieldErrorKeys = new Set(
+    [...allParams, ...envParamsFlat].map(p => p.key)
+  );
+  const nonFieldErrors = Object.entries(errors).filter(
+    ([key]) => !fieldErrorKeys.has(key)
+  );
+  const hasFieldErrors = Object.keys(errors).length > nonFieldErrors.length;
   const validationErrorBanner =
     Object.keys(errors).length > 0 ? (
       <div className="mt-2 mb-4 p-3 bg-error/10 rounded text-error text-sm">
-        Please fix the highlighted errors before submitting.
+        {hasFieldErrors ? (
+          <p>Please fix the highlighted errors before submitting.</p>
+        ) : null}
+        {nonFieldErrors.map(([key, message]) => (
+          <p key={key}>{message}</p>
+        ))}
       </div>
     ) : null;
 

From 58af14d8610faa368df9ac2001f7ea49d52be8eb Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 13:50:56 -0400
Subject: [PATCH 84/89] Batch service-URL reads in the jobs listing into one
 worker action

GET /api/jobs dispatched one get_service_url worker action per running
service job. The endpoint is polled every few seconds and the worker
executes one action at a time, so each running service added a serial
IPC round-trip that also stalled the user's file browsing.

The listing now sends all running service jobs to a single
get_service_urls action. The server passes each job's stored work dir
(rows already username-scoped by the DB query); the legacy fallback for
rows predating stored work dirs is resolved in the worker so '~'
expands to the target user's home. The single-job action used by
GET /api/jobs/{id} is unchanged, and both now share the same
url/phase file readers.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 fileglancer/apps/jobfiles.py | 55 +++++++++++++++++++++---------------
 fileglancer/server.py        | 39 +++++++++++++++++--------
 fileglancer/user_worker.py   | 34 ++++++++++++++++++++++
 tests/test_apps_endpoints.py | 30 ++++++++++++--------
 tests/test_worker.py         | 36 +++++++++++++++++++++++
 5 files changed, 148 insertions(+), 46 deletions(-)

diff --git a/fileglancer/apps/jobfiles.py b/fileglancer/apps/jobfiles.py
index 0f6b7af5..b2fb9613 100644
--- a/fileglancer/apps/jobfiles.py
+++ b/fileglancer/apps/jobfiles.py
@@ -149,19 +149,8 @@ def _make_file_info(file_path: str, exists: bool,
     }
 
 
-def get_service_url(db_job: db.JobDB) -> Optional[str]:
-    """Read the service URL from a job's work directory.
-
-    Only returns a URL when the job is a service type and is currently RUNNING.
-    The service writes its URL to a plain text file named 'service_url' in the
-    job's work directory.
-    """
-    if getattr(db_job, 'entry_point_type', 'job') != 'service':
-        return None
-    if db_job.status != 'RUNNING':
-        return None
-
-    work_dir = _resolve_work_dir(db_job)
+def read_service_url_file(work_dir: Path) -> Optional[str]:
+    """Read and validate the 'service_url' file in a job work directory."""
     url_file = work_dir / "service_url"
 
     if not url_file.is_file():
@@ -178,11 +167,40 @@ def get_service_url(db_job: db.JobDB) -> Optional[str]:
     return url
 
 
+def get_service_url(db_job: db.JobDB) -> Optional[str]:
+    """Read the service URL from a job's work directory.
+
+    Only returns a URL when the job is a service type and is currently RUNNING.
+    The service writes its URL to a plain text file named 'service_url' in the
+    job's work directory.
+    """
+    if getattr(db_job, 'entry_point_type', 'job') != 'service':
+        return None
+    if db_job.status != 'RUNNING':
+        return None
+
+    return read_service_url_file(_resolve_work_dir(db_job))
+
+
 # Startup phases a service job writes to its 'phase' file so the UI can explain
 # a wait before the URL appears (chiefly a container image still downloading).
 _SERVICE_PHASES = ("pulling_image", "starting")
 
 
+def read_service_phase_file(work_dir: Path) -> Optional[str]:
+    """Read and validate the 'phase' file in a job work directory."""
+    phase_file = work_dir / "phase"
+    if not phase_file.is_file():
+        return None
+
+    try:
+        phase = phase_file.read_text().strip()
+    except OSError:
+        return None
+
+    return phase if phase in _SERVICE_PHASES else None
+
+
 def get_service_phase(db_job: db.JobDB) -> Optional[str]:
     """Read the current startup phase from a service job's work directory.
 
@@ -197,16 +215,7 @@ def get_service_phase(db_job: db.JobDB) -> Optional[str]:
     if db_job.status != 'RUNNING':
         return None
 
-    phase_file = _resolve_work_dir(db_job) / "phase"
-    if not phase_file.is_file():
-        return None
-
-    try:
-        phase = phase_file.read_text().strip()
-    except OSError:
-        return None
-
-    return phase if phase in _SERVICE_PHASES else None
+    return read_service_phase_file(_resolve_work_dir(db_job))
 
 
 def get_job_file_paths(db_job: db.JobDB) -> dict[str, dict]:
diff --git a/fileglancer/server.py b/fileglancer/server.py
index 7c9d6934..13cc8600 100644
--- a/fileglancer/server.py
+++ b/fileglancer/server.py
@@ -2335,19 +2335,36 @@ async def get_jobs(status: Optional[str] = Query(None, description="Filter by st
                        username: str = Depends(get_current_user)):
         with db.get_db_session(settings.db_url) as session:
             db_jobs = db.get_jobs_by_username(session, username, status)
-            # For listing, read service_url for running service jobs via worker
+            # Read service_url/phase for all running service jobs in a single
+            # worker round-trip. This endpoint is polled every few seconds and
+            # the worker executes one action at a time, so dispatching per job
+            # would serially block the worker (and the user's file browsing)
+            # once several services are running.
+            running_services = [
+                j for j in db_jobs
+                if getattr(j, 'entry_point_type', 'job') == 'service'
+                and j.status == 'RUNNING'
+            ]
+            services = {}
+            if running_services:
+                try:
+                    result = await _worker_exec(
+                        username, "get_service_urls",
+                        jobs=[{
+                            "id": j.id,
+                            "app_name": j.app_name,
+                            "entry_point_id": j.entry_point_id,
+                            "work_dir": j.work_dir,
+                        } for j in running_services],
+                    )
+                    services = result.get("services") or {}
+                except Exception:
+                    pass
             jobs = []
             for j in db_jobs:
-                service_url = None
-                phase = None
-                if getattr(j, 'entry_point_type', 'job') == 'service' and j.status == 'RUNNING':
-                    try:
-                        result = await _worker_exec(username, "get_service_url", job_id=j.id)
-                        service_url = result.get("service_url")
-                        phase = result.get("phase")
-                    except Exception:
-                        pass
-                jobs.append(_convert_job(j, service_url=service_url, phase=phase))
+                info = services.get(str(j.id)) or {}
+                jobs.append(_convert_job(j, service_url=info.get("service_url"),
+                                         phase=info.get("phase")))
             return JobResponse(jobs=jobs)
 
     @app.get("/api/jobs/{job_id}", response_model=Job,
diff --git a/fileglancer/user_worker.py b/fileglancer/user_worker.py
index 8aaa9851..9cd8fe89 100644
--- a/fileglancer/user_worker.py
+++ b/fileglancer/user_worker.py
@@ -942,6 +942,40 @@ def _action_get_service_url(request: dict, ctx: WorkerContext) -> dict:
     return {"service_url": get_service_url(db_job), "phase": get_service_phase(db_job)}
 
 
+@action("get_service_urls")
+def _action_get_service_urls(request: dict, ctx: WorkerContext) -> dict:
+    """Read service URLs and startup phases for several jobs in one round-trip.
+
+    The jobs listing refetches every few seconds and the worker executes one
+    action at a time, so per-job dispatches would serially occupy the worker
+    (stalling the user's file browsing) once a few services are running. The
+    caller passes each job's stored work dir along with the fields needed to
+    reconstruct it for legacy rows that predate stored work dirs — that
+    fallback must be resolved here, as this user, so '~' expands to the target
+    user's home rather than the server's.
+    """
+    from pathlib import Path
+
+    from fileglancer.apps.jobfiles import (
+        _build_work_dir,
+        read_service_phase_file,
+        read_service_url_file,
+    )
+
+    services = {}
+    for job in request["jobs"]:
+        if job.get("work_dir"):
+            work_dir = Path(job["work_dir"])
+        else:
+            work_dir = _build_work_dir(
+                job["id"], job["app_name"], job["entry_point_id"])
+        services[str(job["id"])] = {
+            "service_url": read_service_url_file(work_dir),
+            "phase": read_service_phase_file(work_dir),
+        }
+    return {"services": services}
+
+
 # ---------------------------------------------------------------------------
 # Action handlers — S3 proxy
 # ---------------------------------------------------------------------------
diff --git a/tests/test_apps_endpoints.py b/tests/test_apps_endpoints.py
index 374e6ba1..3ca58202 100644
--- a/tests/test_apps_endpoints.py
+++ b/tests/test_apps_endpoints.py
@@ -963,24 +963,30 @@ def test_get_jobs_lists_and_filters_by_status(test_client, db_session):
     assert jobs[0]["status"] == "DONE"
 
 
-def test_get_jobs_running_service_includes_url_and_phase(test_client, db_session, temp_dir):
-    """A running service's URL and startup phase are read from its work dir
-    (through the worker layer) and included in the listing."""
-    work_dir = os.path.join(temp_dir, "svc")
-    os.makedirs(work_dir)
-    with open(os.path.join(work_dir, "service_url"), "w", encoding="utf-8") as f:
+def test_get_jobs_running_services_include_url_and_phase(test_client, db_session, temp_dir):
+    """Running services' URLs and startup phases are read from their work dirs
+    (through the batched worker action) and included in the listing."""
+    ready_dir = os.path.join(temp_dir, "svc-ready")
+    os.makedirs(ready_dir)
+    with open(os.path.join(ready_dir, "service_url"), "w", encoding="utf-8") as f:
         f.write("http://node1:8888\n")
-    with open(os.path.join(work_dir, "phase"), "w", encoding="utf-8") as f:
+    starting_dir = os.path.join(temp_dir, "svc-starting")
+    os.makedirs(starting_dir)
+    with open(os.path.join(starting_dir, "phase"), "w", encoding="utf-8") as f:
         f.write("starting\n")
-    _seed_job(db_session, status="RUNNING", entry_point_type="service",
-              work_dir=work_dir)
+    ready = _seed_job(db_session, status="RUNNING", entry_point_type="service",
+                      work_dir=ready_dir)
+    starting = _seed_job(db_session, status="RUNNING", entry_point_type="service",
+                         work_dir=starting_dir)
 
     response = test_client.get("/api/jobs")
 
     assert response.status_code == 200
-    (entry,) = response.json()["jobs"]
-    assert entry["service_url"] == "http://node1:8888"
-    assert entry["phase"] == "starting"
+    by_id = {j["id"]: j for j in response.json()["jobs"]}
+    assert by_id[ready.id]["service_url"] == "http://node1:8888"
+    assert by_id[ready.id]["phase"] is None
+    assert by_id[starting.id]["service_url"] is None
+    assert by_id[starting.id]["phase"] == "starting"
 
 
 def test_get_job_includes_file_paths(test_client, db_session):
diff --git a/tests/test_worker.py b/tests/test_worker.py
index bad3ebcb..93098432 100644
--- a/tests/test_worker.py
+++ b/tests/test_worker.py
@@ -31,6 +31,7 @@
     _action_create_dirs,
     _action_validate_paths,
     _action_cancel_local,
+    _action_get_service_urls,
     _descendant_pids,
     _proc_alive,
     WorkerContext,
@@ -231,6 +232,41 @@ def test_already_dead_pid_is_terminated(self, tmp_path):
             {"work_dir": str(tmp_path)}, self._ctx()) == {"terminated": True}
 
 
+class TestGetServiceUrlsAction:
+    """The batched action reads url + phase for many jobs in one dispatch, so
+    the jobs listing costs one worker round-trip regardless of how many
+    services are running."""
+
+    def _ctx(self):
+        return WorkerContext(username="test", db=None)
+
+    def test_reads_urls_and_phases_for_all_jobs(self, tmp_path):
+        ready = tmp_path / "ready"
+        ready.mkdir()
+        (ready / "service_url").write_text("http://node1:8888\n")
+        (ready / "phase").write_text("starting\n")
+        empty = tmp_path / "empty"
+        empty.mkdir()
+        bad_scheme = tmp_path / "bad"
+        bad_scheme.mkdir()
+        (bad_scheme / "service_url").write_text("javascript:alert(1)")
+
+        result = _action_get_service_urls({"jobs": [
+            {"id": 1, "app_name": "a", "entry_point_id": "run",
+             "work_dir": str(ready)},
+            {"id": 2, "app_name": "a", "entry_point_id": "run",
+             "work_dir": str(empty)},
+            {"id": 3, "app_name": "a", "entry_point_id": "run",
+             "work_dir": str(bad_scheme)},
+        ]}, self._ctx())
+
+        assert result["services"]["1"] == {
+            "service_url": "http://node1:8888", "phase": "starting"}
+        assert result["services"]["2"] == {"service_url": None, "phase": None}
+        # Non-http(s) URLs are rejected, same as the single-job action.
+        assert result["services"]["3"]["service_url"] is None
+
+
 class TestIPCProtocol:
     """Test the length-prefixed JSON wire protocol."""
 

From db57272b6d4d9ac592c72a3d1df730860196bbb9 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 14:05:34 -0400
Subject: [PATCH 85/89] Clean up small apps-review items

Batch of remaining small items from the apps feature review:

- Preserve custom app names on manifest cache refresh: refreshes now
  sync only the manifest column (new update_user_app_manifest_cache)
  instead of upserting name/description, so a catalog app added under
  a custom name no longer reverts to the raw manifest name when its
  cache is refilled after schema drift or a NULL backfill.
- Restrict AppParameter.flag to a conservative CLI-flag pattern; flags
  are emitted into the job script unquoted and the Nextflow adapter
  derives them from schema property names.
- Validate env-tab parameters client-side: the same rules as pipeline
  params (required/number/path), inline field errors in the Environment
  tab, section auto-expand, tab focus on error, and inclusion of env
  file/directory params in pre-submit path validation and path
  normalization (keys prefixed to avoid cross-namespace collisions).
- Stop late-arriving cluster defaults from refilling an Extra Arguments
  field the user deliberately cleared: track edits (typing or params
  import) instead of inferring from the empty string.
- Consolidate the jobs table on the shared formatDuration, which
  treats zone-less backend timestamps as UTC; the duplicate in
  appsJobsColumns silently depended on the API always emitting offsets.
- Match installed apps by canonical GitHub URL in Catalog and
  ListingDetail, aligning with AppDetail/AppLaunch so the comparison
  styles can't drift.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 fileglancer/apps/manifest.py                  |  15 +-
 fileglancer/database.py                       |  22 ++
 fileglancer/model.py                          |  15 ++
 fileglancer/server.py                         |   7 +-
 frontend/src/components/Catalog.tsx           |  17 +-
 frontend/src/components/ListingDetail.tsx     |  12 +-
 .../components/ui/AppsPage/AppLaunchForm.tsx  | 251 ++++++++++++------
 .../components/ui/Table/appsJobsColumns.tsx   |  31 +--
 tests/test_apps.py                            |  22 ++
 tests/test_apps_endpoints.py                  |  17 +-
 10 files changed, 276 insertions(+), 133 deletions(-)

diff --git a/fileglancer/apps/manifest.py b/fileglancer/apps/manifest.py
index 9e0668f4..7a61ccd6 100644
--- a/fileglancer/apps/manifest.py
+++ b/fileglancer/apps/manifest.py
@@ -912,15 +912,14 @@ async def get_or_load_manifest(username: str, url: str,
         fetch_url, manifest_path, username, row_sha)
 
     if row_exists:
-        # branch=None: this is a cache refresh, so leave the requested revision
-        # (the branch column) untouched.
+        # Cache refresh: sync only the manifest column. Name/description stay
+        # untouched — they may be user-chosen (e.g. a custom catalog name) —
+        # as do the requested revision and pins.
         with db.get_db_session(settings.db_url) as session:
-            db.upsert_user_app(
+            db.update_user_app_manifest_cache(
                 session, username,
                 url=row_url, manifest_path=manifest_path,
-                name=manifest.name, description=manifest.description,
                 manifest=manifest.model_dump(mode="json"),
-                bump_updated_at=False,
             )
 
     return manifest
@@ -955,10 +954,12 @@ async def refresh_cached_manifest(username: str, url: str,
 
     with db.get_db_session(settings.db_url) as session:
         if row_exists:
-            db.upsert_user_app(
+            # Sync only the manifest column: name/description may be
+            # user-chosen (e.g. a custom catalog name) and must survive
+            # cache refreshes.
+            db.update_user_app_manifest_cache(
                 session, username,
                 url=row_url, manifest_path=manifest_path,
-                name=manifest.name, description=manifest.description,
                 manifest=manifest.model_dump(mode="json"),
                 bump_updated_at=bump_updated_at,
             )
diff --git a/fileglancer/database.py b/fileglancer/database.py
index acba25cb..5bc72b04 100644
--- a/fileglancer/database.py
+++ b/fileglancer/database.py
@@ -1187,6 +1187,28 @@ def upsert_user_app(session: Session, username: str, url: str,
     return row
 
 
+def update_user_app_manifest_cache(session: Session, username: str, url: str,
+                                   manifest_path: str = "", *,
+                                   manifest: Dict,
+                                   bump_updated_at: bool = False
+                                   ) -> Optional[UserAppDB]:
+    """Sync only the cached manifest column on an existing row.
+
+    Cache refreshes must not touch user-facing metadata: a catalog app added
+    under a custom name would otherwise revert to the raw manifest name
+    whenever its cache is refilled (e.g. after schema drift invalidates the
+    stored copy). No-op returning None when the row doesn't exist.
+    """
+    row = get_user_app(session, username, url, manifest_path)
+    if row is None:
+        return None
+    row.manifest = manifest
+    if bump_updated_at:
+        row.updated_at = datetime.now(UTC)
+    session.commit()
+    return row
+
+
 def set_user_app_pins(session: Session, username: str, url: str,
                       manifest_path: str = "", *,
                       commit_sha: Optional[str] = None,
diff --git a/fileglancer/model.py b/fileglancer/model.py
index 1e471ab7..1b2aa787 100644
--- a/fileglancer/model.py
+++ b/fileglancer/model.py
@@ -320,6 +320,12 @@ class NeuroglancerShortLinkResponse(BaseModel):
 
 # --- App Manifest Models ---
 
+# Conservative CLI-flag shape: one or two leading dashes, then an alphanumeric
+# followed by word characters, dots, or dashes. Flags are emitted into the
+# generated job script unquoted, so anything shell-significant is rejected.
+_FLAG_PATTERN = re.compile(r'^-{1,2}[A-Za-z0-9][A-Za-z0-9_.-]*$')
+
+
 class AppParameter(BaseModel):
     """A parameter definition for an app entry point"""
     flag: Optional[str] = Field(
@@ -363,6 +369,15 @@ def validate_flag(cls, v):
             stripped = v.lstrip("-")
             if not stripped:
                 raise ValueError("Flag must have content after dashes")
+            # Flags are appended to the generated shell command unquoted, and
+            # the Nextflow adapter derives them from schema property names, so
+            # constrain them to a conservative CLI-flag shape rather than
+            # allowing shell-significant characters through.
+            if not _FLAG_PATTERN.fullmatch(v):
+                raise ValueError(
+                    f"Flag must look like '-n' or '--long-name' "
+                    f"(letters, digits, '_', '.', '-'), got '{v}'"
+                )
         return v
 
     @field_validator("options", mode="before")
diff --git a/fileglancer/server.py b/fileglancer/server.py
index 13cc8600..16058f56 100644
--- a/fileglancer/server.py
+++ b/fileglancer/server.py
@@ -1732,10 +1732,9 @@ async def get_user_apps(username: str = Depends(get_current_user)):
                 logger.warning(f"Failed to fetch manifest for {snap['url']}: {e}")
                 continue
 
-            user_app = result[idx]
-            user_app.manifest = manifest
-            user_app.name = manifest.name
-            user_app.description = manifest.description
+            # Only the manifest is refreshed; name/description keep the row's
+            # values, which may be user-chosen (e.g. a custom catalog name).
+            result[idx].manifest = manifest
         return result
 
     # How long a finished job keeps its snapshot alive. Work dirs carry a
diff --git a/frontend/src/components/Catalog.tsx b/frontend/src/components/Catalog.tsx
index 2aeca481..f10bf89d 100644
--- a/frontend/src/components/Catalog.tsx
+++ b/frontend/src/components/Catalog.tsx
@@ -11,8 +11,14 @@ import { useAppsQuery, useCatalogQuery } from '@/queries/appsQueries';
 import { useListingActions } from '@/hooks/useListingActions';
 import { useViewMode } from '@/hooks/useViewMode';
 import { useProfileContext } from '@/contexts/ProfileContext';
+import { canonicalGithubUrl } from '@/utils';
 import type { AppListing, UserApp } from '@/shared.types';
 
+// Installed-app lookup key. Canonicalize the URL so a match can't be missed
+// over URL formatting differences (same convention as AppDetail/AppLaunch).
+const listingKey = (url: string, manifestPath: string) =>
+  `${canonicalGithubUrl(url)}::${manifestPath}`;
+
 export default function Catalog() {
   const [search, setSearch] = useState('');
   const [hideInstalled, setHideInstalled] = useState(false);
@@ -26,7 +32,7 @@ export default function Catalog() {
   const myAppsByKey = useMemo(() => {
     const map = new Map<string, UserApp>();
     (appsQuery.data ?? []).forEach(a =>
-      map.set(`${a.url}::${a.manifest_path}`, a)
+      map.set(listingKey(a.url, a.manifest_path), a)
     );
     return map;
   }, [appsQuery.data]);
@@ -36,7 +42,7 @@ export default function Catalog() {
       createCatalogColumns(
         actions,
         (listing: AppListing) =>
-          myAppsByKey.get(`${listing.url}::${listing.manifest_path}`),
+          myAppsByKey.get(listingKey(listing.url, listing.manifest_path)),
         profile?.username
       ),
     // eslint-disable-next-line react-hooks/exhaustive-deps
@@ -47,7 +53,10 @@ export default function Catalog() {
     const term = search.trim().toLowerCase();
     const listings = catalogQuery.data ?? [];
     return listings.filter(l => {
-      if (hideInstalled && myAppsByKey.has(`${l.url}::${l.manifest_path}`)) {
+      if (
+        hideInstalled &&
+        myAppsByKey.has(listingKey(l.url, l.manifest_path))
+      ) {
         return false;
       }
       if (!term) {
@@ -128,7 +137,7 @@ export default function Catalog() {
         <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-4 mb-8">
           {filteredListings.map(listing => {
             const installedApp = myAppsByKey.get(
-              `${listing.url}::${listing.manifest_path}`
+              listingKey(listing.url, listing.manifest_path)
             );
             const isOwner =
               profile?.username !== undefined &&
diff --git a/frontend/src/components/ListingDetail.tsx b/frontend/src/components/ListingDetail.tsx
index db7301b2..eb8660a8 100644
--- a/frontend/src/components/ListingDetail.tsx
+++ b/frontend/src/components/ListingDetail.tsx
@@ -23,7 +23,11 @@ import {
 } from '@/queries/appsQueries';
 import { useListingActions } from '@/hooks/useListingActions';
 import { useProfileContext } from '@/contexts/ProfileContext';
-import { buildLaunchPathFromApp, getAppIconType } from '@/utils';
+import {
+  buildLaunchPathFromApp,
+  canonicalGithubUrl,
+  getAppIconType
+} from '@/utils';
 import type { AppListing } from '@/shared.types';
 
 const BACK_PROPS = {
@@ -88,8 +92,12 @@ export default function ListingDetail() {
     );
   }
 
+  // Canonicalize both URLs so a match can't be missed over formatting
+  // differences (same convention as AppDetail/AppLaunch).
   const installedApp = appsQuery.data?.find(
-    a => a.url === listing.url && a.manifest_path === listing.manifest_path
+    a =>
+      canonicalGithubUrl(a.url) === canonicalGithubUrl(listing.url) &&
+      a.manifest_path === listing.manifest_path
   );
   const alreadyAdded = installedApp !== undefined;
   const manifest = installedApp?.manifest ?? manifestMutation.data;
diff --git a/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx b/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
index 69f2f36c..3c7ef377 100644
--- a/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
+++ b/frontend/src/components/ui/AppsPage/AppLaunchForm.tsx
@@ -810,6 +810,9 @@ export default function AppLaunchForm({
   const [envValues, setEnvValues] =
     useState<Record<string, unknown>>(startingEnvValues);
   const [errors, setErrors] = useState<Record<string, string>>({});
+  // Env-tab params are a separate namespace whose keys may collide with
+  // pipeline param keys, so their errors live in their own dict.
+  const [envErrors, setEnvErrors] = useState<Record<string, string>>({});
   const [activeTab, setActiveTab] = useState('parameters');
   const [openSections, setOpenSections] =
     useState<string[]>(initialOpenSections);
@@ -822,6 +825,14 @@ export default function AppLaunchForm({
     }
   );
   const [extraArgs, setExtraArgs] = useState<string>(resolvedExtraArgs);
+  // Whether the user has touched the Extra Arguments field (typing or a
+  // params-file import). An empty string alone can't distinguish "not loaded
+  // yet" from "deliberately cleared", so late-arriving defaults key off this.
+  const extraArgsEditedRef = useRef(false);
+  const setExtraArgsEdited: Dispatch<SetStateAction<string>> = action => {
+    extraArgsEditedRef.current = true;
+    setExtraArgs(action);
+  };
 
   // Update extraArgs when async data (preferences or cluster defaults) arrives,
   // but only if not a relaunch and the user hasn't modified the field yet
@@ -829,6 +840,9 @@ export default function AppLaunchForm({
     if (externalExtraArgs !== undefined) {
       return; // relaunch value takes priority, don't overwrite
     }
+    if (extraArgsEditedRef.current) {
+      return; // user edits (including clearing the field) always win
+    }
     const resolved = defaultExtraArgs || configExtraArgs;
     if (resolved) {
       setExtraArgs(prev => (prev === '' ? resolved : prev));
@@ -909,72 +923,88 @@ export default function AppLaunchForm({
   // pipeline param keys.
   const handleEnvChange = (paramId: string, value: unknown) => {
     setEnvValues(prev => ({ ...prev, [paramId]: value }));
+    if (envErrors[paramId]) {
+      setEnvErrors(prev => {
+        const next = { ...prev };
+        delete next[paramId];
+        return next;
+      });
+    }
   };
 
-  const validate = (): boolean => {
-    const newErrors: Record<string, string> = {};
-    for (const param of allParams) {
-      const val = values[param.key];
-      if (param.required && (val === undefined || val === null || val === '')) {
-        newErrors[param.key] = `${param.name} is required`;
+  const handleEnvParamError = (paramId: string, message: string) => {
+    setEnvErrors(prev => ({ ...prev, [paramId]: message }));
+  };
+
+  // Shared per-param rules, applied to both the pipeline and env-tab
+  // namespaces. Returns the first violation, or undefined when valid.
+  const validateParamValue = (
+    param: AppParameter,
+    val: unknown
+  ): string | undefined => {
+    if (param.required && (val === undefined || val === null || val === '')) {
+      return `${param.name} is required`;
+    }
+    if (val === undefined || val === null || val === '') {
+      return undefined;
+    }
+    if (param.type === 'integer' || param.type === 'number') {
+      const numVal = Number(val);
+      if (isNaN(numVal)) {
+        return `${param.name} must be a valid number`;
       }
-      if (
-        val !== undefined &&
-        val !== null &&
-        val !== '' &&
-        (param.type === 'integer' || param.type === 'number')
-      ) {
-        const numVal = Number(val);
-        if (isNaN(numVal)) {
-          newErrors[param.key] = `${param.name} must be a valid number`;
-        } else {
-          if (
-            param.min !== null &&
-            param.min !== undefined &&
-            numVal < param.min
-          ) {
-            newErrors[param.key] =
-              `${param.name} must be at least ${param.min}`;
-          }
-          if (
-            param.max !== null &&
-            param.max !== undefined &&
-            numVal > param.max
-          ) {
-            newErrors[param.key] = `${param.name} must be at most ${param.max}`;
-          }
-        }
+      if (param.min !== null && param.min !== undefined && numVal < param.min) {
+        return `${param.name} must be at least ${param.min}`;
       }
-      // Validate file/directory paths (skip URI schemes like s3://)
+      if (param.max !== null && param.max !== undefined && numVal > param.max) {
+        return `${param.name} must be at most ${param.max}`;
+      }
+    }
+    // Validate file/directory paths (skip URI schemes like s3://)
+    if (
+      (param.type === 'file' || param.type === 'directory') &&
+      typeof val === 'string'
+    ) {
+      // Resolve Mac/Windows/alternate-Linux paths to server mount_path
+      const resolved = resolveToServerPath(val);
+      const normalized = convertBackToForwardSlash(resolved);
       if (
-        val !== undefined &&
-        val !== null &&
-        val !== '' &&
-        (param.type === 'file' || param.type === 'directory') &&
-        typeof val === 'string'
+        !normalized.startsWith('s3://') &&
+        !normalized.startsWith('gs://') &&
+        !normalized.startsWith('https://')
       ) {
-        // Resolve Mac/Windows/alternate-Linux paths to server mount_path
-        const resolved = resolveToServerPath(val);
-        const normalized = convertBackToForwardSlash(resolved);
+        if (normalized.includes('..')) {
+          return `${param.name} must not contain '..'`;
+        }
         if (
-          !normalized.startsWith('s3://') &&
-          !normalized.startsWith('gs://') &&
-          !normalized.startsWith('https://')
+          !normalized.startsWith('/') &&
+          !normalized.startsWith('~') &&
+          !normalized.startsWith('./')
         ) {
-          if (normalized.includes('..')) {
-            newErrors[param.key] = `${param.name} must not contain '..'`;
-          } else if (
-            !normalized.startsWith('/') &&
-            !normalized.startsWith('~') &&
-            !normalized.startsWith('./')
-          ) {
-            newErrors[param.key] =
-              `${param.name} must be an absolute or relative path (starting with /, ~, or ./)`;
-          }
+          return `${param.name} must be an absolute or relative path (starting with /, ~, or ./)`;
         }
       }
     }
+    return undefined;
+  };
+
+  const validate = (): boolean => {
+    const newErrors: Record<string, string> = {};
+    for (const param of allParams) {
+      const error = validateParamValue(param, values[param.key]);
+      if (error) {
+        newErrors[param.key] = error;
+      }
+    }
+    const newEnvErrors: Record<string, string> = {};
+    for (const param of envParamsFlat) {
+      const error = validateParamValue(param, envValues[param.key]);
+      if (error) {
+        newEnvErrors[param.key] = error;
+      }
+    }
     setErrors(newErrors);
+    setEnvErrors(newEnvErrors);
 
     // Auto-expand sections that contain errors and reveal hidden params if needed
     if (Object.keys(newErrors).length > 0) {
@@ -997,8 +1027,29 @@ export default function AppLaunchForm({
         setShowHidden(true);
       }
     }
+    if (Object.keys(newEnvErrors).length > 0) {
+      const envSectionsToOpen = new Set(openEnvParamSections);
+      for (const item of entryPoint.env_parameters ?? []) {
+        if (
+          isParameterSection(item) &&
+          item.parameters.some(p => newEnvErrors[p.key])
+        ) {
+          envSectionsToOpen.add(item.section);
+        }
+      }
+      setOpenEnvParamSections([...envSectionsToOpen]);
+    }
+    // Put the user on the tab that contains the (first) errors.
+    if (Object.keys(newErrors).length > 0) {
+      setActiveTab('parameters');
+    } else if (Object.keys(newEnvErrors).length > 0) {
+      setActiveTab('environment');
+    }
 
-    return Object.keys(newErrors).length === 0;
+    return (
+      Object.keys(newErrors).length === 0 &&
+      Object.keys(newEnvErrors).length === 0
+    );
   };
 
   const [validating, setValidating] = useState(false);
@@ -1008,11 +1059,17 @@ export default function AppLaunchForm({
       return;
     }
 
-    // Build a lookup of parameter definitions
+    // Build lookups of parameter definitions per namespace
     const paramDefs = new Map(allParams.map(p => [p.key, p]));
+    const envParamDefs = new Map(envParamsFlat.map(p => [p.key, p]));
+    // Env-tab keys may collide with pipeline keys, so they are prefixed in
+    // the shared validate-paths request and their errors routed back to the
+    // env error dict.
+    const ENV_KEY_PREFIX = 'env::';
 
     // Filter out undefined/empty values and normalize paths to Linux format
     const params: Record<string, unknown> = {};
+    const envParams: Record<string, unknown> = {};
     const pathParams: Record<string, string> = {};
     // Path params with exists=false are outputs the job may create, so they
     // are validated for file-share containment only — their absence must not
@@ -1022,9 +1079,17 @@ export default function AppLaunchForm({
     // Expected type per key, so a folder pasted into a file param (or vice
     // versa) is rejected by server-side validation.
     const pathParamTypes: Record<string, string> = {};
-    for (const [key, val] of Object.entries(values)) {
-      if (val !== undefined && val !== null && val !== '') {
-        const paramDef = paramDefs.get(key);
+    const collectGroup = (
+      source: Record<string, unknown>,
+      defs: Map<string, AppParameter>,
+      target: Record<string, unknown>,
+      validationKey: (key: string) => string
+    ) => {
+      for (const [key, val] of Object.entries(source)) {
+        if (val === undefined || val === null || val === '') {
+          continue;
+        }
+        const paramDef = defs.get(key);
         if (
           paramDef &&
           (paramDef.type === 'file' || paramDef.type === 'directory') &&
@@ -1033,24 +1098,32 @@ export default function AppLaunchForm({
           // Resolve Mac/Windows/alternate-Linux paths to server mount_path
           const resolved = resolveToServerPath(val);
           const normalized = convertBackToForwardSlash(resolved);
-          params[key] = normalized;
+          target[key] = normalized;
           // Skip server-side path validation for URI schemes (e.g. s3://)
           if (
             !normalized.startsWith('s3://') &&
             !normalized.startsWith('gs://') &&
             !normalized.startsWith('https://')
           ) {
-            pathParams[key] = normalized;
-            pathParamTypes[key] = paramDef.type;
+            const vKey = validationKey(key);
+            pathParams[vKey] = normalized;
+            pathParamTypes[vKey] = paramDef.type;
             if (paramDef.exists === false) {
-              mayBeMissingKeys.push(key);
+              mayBeMissingKeys.push(vKey);
             }
           }
         } else {
-          params[key] = val;
+          target[key] = val;
         }
       }
-    }
+    };
+    collectGroup(values, paramDefs, params, key => key);
+    collectGroup(
+      envValues,
+      envParamDefs,
+      envParams,
+      key => `${ENV_KEY_PREFIX}${key}`
+    );
 
     // Validate paths on the server before submitting
     if (Object.keys(pathParams).length > 0) {
@@ -1062,7 +1135,22 @@ export default function AppLaunchForm({
           pathParamTypes
         );
         if (Object.keys(pathErrors).length > 0) {
-          setErrors(prev => ({ ...prev, ...pathErrors }));
+          const mainPathErrors: Record<string, string> = {};
+          const envPathErrors: Record<string, string> = {};
+          for (const [key, message] of Object.entries(pathErrors)) {
+            if (key.startsWith(ENV_KEY_PREFIX)) {
+              envPathErrors[key.slice(ENV_KEY_PREFIX.length)] = message;
+            } else {
+              mainPathErrors[key] = message;
+            }
+          }
+          setErrors(prev => ({ ...prev, ...mainPathErrors }));
+          setEnvErrors(prev => ({ ...prev, ...envPathErrors }));
+          if (Object.keys(mainPathErrors).length > 0) {
+            setActiveTab('parameters');
+          } else {
+            setActiveTab('environment');
+          }
           setValidating(false);
           return;
         }
@@ -1093,14 +1181,6 @@ export default function AppLaunchForm({
     }
     const hasEnv = Object.keys(envRecord).length > 0;
 
-    // Env-tab parameter values (separate namespace), dropping empties.
-    const envParams: Record<string, unknown> = {};
-    for (const [key, val] of Object.entries(envValues)) {
-      if (val !== undefined && val !== null && val !== '') {
-        envParams[key] = val;
-      }
-    }
-
     onSubmit(
       params,
       envParams,
@@ -1218,7 +1298,7 @@ export default function AppLaunchForm({
       setResources(prev => ({ ...prev, ...parsed.resources }));
     }
     if (parsed.extra_args !== undefined) {
-      setExtraArgs(parsed.extra_args);
+      setExtraArgsEdited(parsed.extra_args);
     }
     if (parsed.env) {
       setEnvVars(
@@ -1239,6 +1319,7 @@ export default function AppLaunchForm({
     }
 
     setErrors({});
+    setEnvErrors({});
     toast.success('Parameters loaded');
   };
 
@@ -1286,15 +1367,15 @@ export default function AppLaunchForm({
   // Errors keyed by a parameter render inline next to their field; any other
   // key (e.g. `_general`, set when server-side path validation cannot run) has
   // no field to highlight, so its message must appear in the banner itself.
-  const fieldErrorKeys = new Set(
-    [...allParams, ...envParamsFlat].map(p => p.key)
-  );
+  const fieldErrorKeys = new Set(allParams.map(p => p.key));
   const nonFieldErrors = Object.entries(errors).filter(
     ([key]) => !fieldErrorKeys.has(key)
   );
-  const hasFieldErrors = Object.keys(errors).length > nonFieldErrors.length;
+  const hasFieldErrors =
+    Object.keys(errors).length > nonFieldErrors.length ||
+    Object.keys(envErrors).length > 0;
   const validationErrorBanner =
-    Object.keys(errors).length > 0 ? (
+    Object.keys(errors).length > 0 || Object.keys(envErrors).length > 0 ? (
       <div className="mt-2 mb-4 p-3 bg-error/10 rounded text-error text-sm">
         {hasFieldErrors ? (
           <p>Please fix the highlighted errors before submitting.</p>
@@ -1465,9 +1546,10 @@ export default function AppLaunchForm({
                         />
                         <Accordion.Content className="pt-2 pb-4 pl-4">
                           <SectionContent
-                            errors={{}}
+                            errors={envErrors}
                             idPrefix="param-env"
                             onParamChange={handleEnvChange}
+                            onParamError={handleEnvParamError}
                             section={item}
                             values={envValues}
                           />
@@ -1475,10 +1557,13 @@ export default function AppLaunchForm({
                       </Accordion.Item>
                     ) : (
                       <ParameterFieldRow
-                        error={undefined}
+                        error={envErrors[item.key]}
                         idPrefix="param-env"
                         key={item.key}
                         onChange={val => handleEnvChange(item.key, val)}
+                        onError={message =>
+                          handleEnvParamError(item.key, message)
+                        }
                         param={item}
                         value={envValues[item.key]}
                       />
@@ -1513,7 +1598,7 @@ export default function AppLaunchForm({
                 extraArgs={extraArgs}
                 openClusterSections={openClusterSections}
                 resources={resources}
-                setExtraArgs={setExtraArgs}
+                setExtraArgs={setExtraArgsEdited}
                 setOpenClusterSections={setOpenClusterSections}
                 setResources={setResources}
               />
diff --git a/frontend/src/components/ui/Table/appsJobsColumns.tsx b/frontend/src/components/ui/Table/appsJobsColumns.tsx
index bcd30aad..16a30e08 100644
--- a/frontend/src/components/ui/Table/appsJobsColumns.tsx
+++ b/frontend/src/components/ui/Table/appsJobsColumns.tsx
@@ -5,36 +5,11 @@ import CardActionsMenu from '@/components/ui/Menus/CardActionsMenu';
 import FgTooltip from '@/components/ui/widgets/FgTooltip';
 import JobStatusBadge from '@/components/ui/AppsPage/JobStatusBadge';
 import { formatDateString } from '@/utils';
+import { formatDuration } from '@/utils/jobDisplay';
 import type { MenuItem } from '@/components/ui/Menus/FgMenuItems';
 import { isActiveJobStatus } from '@/shared.types';
 import type { Job } from '@/shared.types';
 
-function formatDuration(job: Job): string {
-  if (!job.started_at) {
-    return '-';
-  }
-  const startMs = new Date(job.started_at).getTime();
-  const endMs = job.finished_at
-    ? new Date(job.finished_at).getTime()
-    : new Date().getTime();
-  const diffMs = endMs - startMs;
-
-  if (diffMs < 0) {
-    return '-';
-  }
-
-  const seconds = Math.floor(diffMs / 1000);
-  if (seconds < 60) {
-    return `${seconds}s`;
-  }
-  const minutes = Math.floor(seconds / 60);
-  if (minutes < 60) {
-    return `${minutes}m ${seconds % 60}s`;
-  }
-  const hours = Math.floor(minutes / 60);
-  return `${hours}h ${minutes % 60}m`;
-}
-
 type JobActionCallbacks = {
   onViewDetail: (jobId: number) => void;
   onRelaunch: (job: Job) => void;
@@ -133,7 +108,9 @@ export function createAppsJobsColumns(
       id: 'duration',
       header: 'Duration',
       cell: ({ row }) => {
-        const duration = formatDuration(row.original);
+        const duration =
+          formatDuration(row.original.started_at, row.original.finished_at) ??
+          '-';
         return (
           <div className="flex items-center h-full">
             <span className="text-sm">{duration}</span>
diff --git a/tests/test_apps.py b/tests/test_apps.py
index 8541f5f6..b4268c4c 100644
--- a/tests/test_apps.py
+++ b/tests/test_apps.py
@@ -474,6 +474,28 @@ def test_accepts_one_runnable(self):
         assert len(m.runnables) == 1
 
 
+class TestParameterFlagValidation:
+    """Flags are emitted into the job script unquoted (and the Nextflow
+    adapter derives them from schema property names), so they must be
+    constrained to a conservative CLI-flag shape."""
+
+    @pytest.mark.parametrize("flag", [
+        "-n", "-1", "--outdir", "-profile", "--long-name",
+        "--dotted.name", "--under_score",
+    ])
+    def test_accepts_conventional_flags(self, flag):
+        p = AppParameter(flag=flag, name="P", type="string")
+        assert p.flag == flag
+
+    @pytest.mark.parametrize("flag", [
+        "--out;rm -rf /", "--a b", "--$(whoami)", "--x'y", '--x"y',
+        "---triple", "--", "-", "notaflag", "--=x", "--a|b",
+    ])
+    def test_rejects_shell_significant_or_malformed_flags(self, flag):
+        with pytest.raises(ValidationError):
+            AppParameter(flag=flag, name="P", type="string")
+
+
 # --- Script generation tests ---
 
 class TestCondaActivationInScript:
diff --git a/tests/test_apps_endpoints.py b/tests/test_apps_endpoints.py
index 3ca58202..8fb998cf 100644
--- a/tests/test_apps_endpoints.py
+++ b/tests/test_apps_endpoints.py
@@ -211,7 +211,7 @@ def test_get_apps_uses_db_cache(test_client, db_session):
 
 def test_get_apps_backfills_null_manifest(test_client, db_session):
     _seed_app(db_session, url="https://github.com/owner/repo/tree/dev",
-              manifest=None, branch="dev", name="Stale Name")
+              manifest=None, branch="dev", name="Custom Name")
     manifest = _make_manifest(name="Fresh Name", description="Fresh")
 
     # refresh_cached_manifest calls fetch_app_manifest directly inside
@@ -224,8 +224,9 @@ def test_get_apps_backfills_null_manifest(test_client, db_session):
     assert mock_fetch.await_count == 1
 
     body = response.json()
-    assert body[0]["name"] == "Fresh Name"
-    # The backfill only fills the manifest; the requested revision is preserved.
+    # The backfill only fills the manifest; the (possibly user-chosen) name
+    # and the requested revision are preserved.
+    assert body[0]["name"] == "Custom Name"
     assert body[0]["branch"] == "dev"
     assert body[0]["manifest"]["name"] == "Fresh Name"
 
@@ -234,6 +235,7 @@ def test_get_apps_backfills_null_manifest(test_client, db_session):
     assert len(rows) == 1
     assert rows[0].manifest is not None
     assert rows[0].manifest["name"] == "Fresh Name"
+    assert rows[0].name == "Custom Name"
     assert rows[0].branch == "dev"
     # Backfill should NOT bump updated_at (invisible refresh).
     assert rows[0].updated_at is None
@@ -254,7 +256,8 @@ def test_get_apps_handles_schema_drift(test_client, db_session):
     assert mock_fetch.await_count == 1
 
     body = response.json()
-    assert body[0]["name"] == "Recovered"
+    # The saved name survives the cache repair; only the manifest is replaced.
+    assert body[0]["name"] == "Demo App"
     assert body[0]["manifest"]["name"] == "Recovered"
 
 
@@ -1248,7 +1251,7 @@ async def test_refresh_cached_manifest_syncs_existing_row(test_app, db_session):
     from fileglancer.apps import refresh_cached_manifest
 
     _seed_app(db_session, url="https://github.com/owner/repo/tree/dev",
-              manifest=None, name="Stale", branch="dev")
+              manifest=None, name="Custom Name", branch="dev")
     fresh = _make_manifest(name="Synced")
 
     with patch("fileglancer.apps.manifest.fetch_app_manifest",
@@ -1267,7 +1270,9 @@ async def test_refresh_cached_manifest_syncs_existing_row(test_app, db_session):
 
     rows = list_user_apps(db_session, TEST_USERNAME)
     assert rows[0].manifest["name"] == "Synced"
-    # A cache refresh leaves the requested revision (branch) untouched.
+    # A cache refresh leaves the (possibly user-chosen) name and the requested
+    # revision (branch) untouched.
+    assert rows[0].name == "Custom Name"
     assert rows[0].branch == "dev"
     # Silent refresh by default — updated_at stays NULL.
     assert rows[0].updated_at is None

From cbece1000d34a14866d2747d7907c28f8f671b56 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 14:21:47 -0400
Subject: [PATCH 86/89] Remove historical and outdated code comments in Apps
 code

Comments should document current state, not change history. Drop references to removed code (apps/worker.py, the old shell-metachar denylist, --env: flags), a past-commit citation, and "previously/now/anymore" phrasing; reword regression-test docstrings as present-tense invariants. Also correct the AnsiText palette comment, which claimed background-code support the parser doesn't implement.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 fileglancer/apps/jobs.py                         |  5 ++---
 fileglancer/apps/pixi.py                         |  2 --
 fileglancer/server.py                            |  3 +--
 fileglancer/user_worker.py                       |  4 ++--
 frontend/src/components/ui/AppsPage/AnsiText.tsx |  2 +-
 tests/test_apps.py                               | 14 +++++++-------
 tests/test_poll.py                               |  4 ++--
 tests/test_worker.py                             |  4 ++--
 8 files changed, 17 insertions(+), 21 deletions(-)

diff --git a/fileglancer/apps/jobs.py b/fileglancer/apps/jobs.py
index 048b0f71..750f3467 100644
--- a/fileglancer/apps/jobs.py
+++ b/fileglancer/apps/jobs.py
@@ -677,9 +677,8 @@ async def submit_job(
                                 session=session, username=username, check_access=False)
 
     # Authoritative per-user path validation: check that file/directory params
-    # exist and are readable, run in the setuid worker as the target user. This
-    # is the same fix applied to data links in commit f9858f48 — the server runs
-    # as a service account that isn't in the user's groups, so a redundant
+    # exist and are readable, run in the setuid worker as the target user. The
+    # server runs as a service account that isn't in the user's groups, so a
     # server-side check would wrongly reject (or, on local FS, wrongly accept)
     # paths the user can actually access.
     # Create any directory params with exists=false first, as the user, so a
diff --git a/fileglancer/apps/pixi.py b/fileglancer/apps/pixi.py
index 14246ff9..6d5ecb3a 100644
--- a/fileglancer/apps/pixi.py
+++ b/fileglancer/apps/pixi.py
@@ -153,8 +153,6 @@ def _task_to_entry_point(name: str, task: dict) -> AppEntryPoint | None:
     # Surface task env vars as entry-point env defaults. Pixi already applies
     # task env natively when running the task; exporting them in the generated
     # job script keeps the values visible and overridable via the job's env.
-    # (Previously these were emitted as `--env:VAR` CLI flags, which `pixi run`
-    # does not understand and which broke the generated command.)
     task_env = task.get("env")
     env = {k: str(v) for k, v in task_env.items()} if task_env else None
 
diff --git a/fileglancer/server.py b/fileglancer/server.py
index 16058f56..c9c9c4ab 100644
--- a/fileglancer/server.py
+++ b/fileglancer/server.py
@@ -529,8 +529,7 @@ def mask_password(url: str) -> str:
             logger.info("Worker pool started")
 
         # Wire the apps module to dispatch through the persistent worker
-        # pool (or in-process in dev mode) instead of spawning ephemeral
-        # subprocesses.
+        # pool (or in-process in dev mode).
         apps_module.set_worker_exec(_worker_exec)
 
         # Start cluster job monitor
diff --git a/fileglancer/user_worker.py b/fileglancer/user_worker.py
index 9cd8fe89..95f42a34 100644
--- a/fileglancer/user_worker.py
+++ b/fileglancer/user_worker.py
@@ -1103,7 +1103,7 @@ def _action_validate_proxied_path(request: dict, ctx: WorkerContext, filestore,
 
 
 # ---------------------------------------------------------------------------
-# Action handlers — cluster operations (absorbed from apps/worker.py)
+# Action handlers — cluster operations
 # ---------------------------------------------------------------------------
 
 def _get_executor(request: dict):
@@ -1241,7 +1241,7 @@ def _action_reconnect(request: dict, ctx: WorkerContext) -> dict:
 
 
 # ---------------------------------------------------------------------------
-# Action handlers — git/manifest operations (absorbed from apps/worker.py)
+# Action handlers — git/manifest operations
 # ---------------------------------------------------------------------------
 
 @action("ensure_repo")
diff --git a/frontend/src/components/ui/AppsPage/AnsiText.tsx b/frontend/src/components/ui/AppsPage/AnsiText.tsx
index 4e1c2c55..b90ef6cd 100644
--- a/frontend/src/components/ui/AppsPage/AnsiText.tsx
+++ b/frontend/src/components/ui/AppsPage/AnsiText.tsx
@@ -6,7 +6,7 @@ import {
   coy
 } from 'react-syntax-highlighter/dist/esm/styles/prism';
 
-// Standard ANSI 8-color palette (codes 30-37 foreground, 40-47 background)
+// Standard ANSI 8-color palette (foreground codes 30-37)
 const ANSI_COLORS = [
   '#000000', // 0 black
   '#cc0000', // 1 red
diff --git a/tests/test_apps.py b/tests/test_apps.py
index b4268c4c..fa9304da 100644
--- a/tests/test_apps.py
+++ b/tests/test_apps.py
@@ -660,9 +660,8 @@ def test_none_is_allowed(self):
         assert req.extra_args is None
 
     def test_lsf_resource_string_allowed(self):
-        # The regression this fixes: LSF -R strings use '>', '[' and ']', which
-        # the old shell-metachar denylist wrongly rejected (and which the UI
-        # placeholder actually suggests).
+        # LSF -R strings use '>', '[' and ']' — exactly what the UI placeholder
+        # suggests — so they must be accepted.
         req = JobSubmitRequest(
             **self._BASE, extra_args='-P proj -R "select[mem>8000]"')
         assert req.extra_args == '-P proj -R "select[mem>8000]"'
@@ -674,7 +673,7 @@ def test_lsf_resource_string_allowed(self):
         "--flag | cat /etc/passwd",
     ])
     def test_shell_metacharacters_allowed_as_literal_argv(self, value):
-        # These are safe now: shlex.split turns them into literal argv tokens
+        # These are safe: shlex.split turns them into literal argv tokens
         # passed to the scheduler via exec, so no shell interprets them.
         req = JobSubmitRequest(**self._BASE, extra_args=value)
         assert req.extra_args == value
@@ -2349,7 +2348,7 @@ def test_env_not_emitted_as_flags(self):
         ep = _task_to_entry_point(
             "build", {"cmd": "make", "env": {"FOO": "bar"}}
         )
-        # No parameter should carry an --env: flag anymore.
+        # No parameter should carry an --env: flag.
         assert all(
             p.flag is None or not p.flag.startswith("--env:")
             for p in ep.flat_parameters()
@@ -2362,8 +2361,9 @@ def test_no_env_leaves_env_none(self):
 
 
 class TestPixiAdapterName:
-    """The generated app name should come from the pixi project's name, not a
-    repo/branch combination (which produced ugly names like 'repo/HEAD')."""
+    """The generated app name should come from the pixi project's name, falling
+    back to the git repo name, then the directory name — never a repo/branch
+    combination like 'repo/HEAD'."""
 
     def _write_pixi(self, tmp_path, body: str):
         (tmp_path / "pixi.toml").write_text(body)
diff --git a/tests/test_poll.py b/tests/test_poll.py
index 039fa72d..efe84710 100644
--- a/tests/test_poll.py
+++ b/tests/test_poll.py
@@ -56,8 +56,8 @@ def _make_db_job(job_id, cluster_job_id, status, username="alice",
 
 class TestPollSkipsSameStatus:
     """When the worker returns the same status already in the DB,
-    _poll_jobs must NOT call update_job_status.  This was the bug that
-    caused 'RUNNING -> RUNNING' log spam with multiple workers."""
+    _poll_jobs must NOT call update_job_status — otherwise multiple workers
+    produce 'RUNNING -> RUNNING' log spam."""
 
     @patch("fileglancer.apps.jobs._dispatch", new_callable=AsyncMock)
     @patch("fileglancer.apps.jobs.db")
diff --git a/tests/test_worker.py b/tests/test_worker.py
index 93098432..5527bb72 100644
--- a/tests/test_worker.py
+++ b/tests/test_worker.py
@@ -182,8 +182,8 @@ def _wait_gone(self, pid, timeout=5.0):
         return not _proc_alive(pid)
 
     def test_kills_launcher_and_child_workload(self, tmp_path):
-        """The reported bug: signalling only the launcher bash left its child
-        workload running. The whole tree must be terminated."""
+        """Signalling only the launcher bash would leave its child workload
+        running. The whole tree must be terminated."""
         import subprocess as sp
         # `; :` prevents bash from exec-optimizing into sleep, so bash stays the
         # parent of a real child `sleep` — mirroring a job script's workload.

From 14c1ed3791524082e363c7c3e26a95553ed3ee23 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 14:45:11 -0400
Subject: [PATCH 87/89] Fix Windows CI test failures

Bash-script path composition must stay POSIX regardless of the host OS: join the Apptainer cache dir with '/' instead of pathlib (which rewrites to backslashes on Windows), compute bind-path parents with PurePosixPath, and count Windows drive paths as absolute in bind computation so a dev/test server on Windows composes the same script that path validation already accepts.

Skip the service-helper/publisher tests on Windows (bash there is the WSL stub, and the snippets only ever run on Linux compute nodes) and the poll-loop stop-race test (fcntl is POSIX-only), matching the existing requirements-check skip. Make the submit-assembly assertions OS-neutral: os.path.join for the OS-native work-dir log paths, as_posix() for the '/'-normalized bind path.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 fileglancer/apps/jobs.py | 18 ++++++++++++++----
 tests/test_apps.py       | 28 ++++++++++++++++++++++++----
 2 files changed, 38 insertions(+), 8 deletions(-)

diff --git a/fileglancer/apps/jobs.py b/fileglancer/apps/jobs.py
index 750f3467..4d84a70f 100644
--- a/fileglancer/apps/jobs.py
+++ b/fileglancer/apps/jobs.py
@@ -9,7 +9,7 @@
 import re
 import shlex
 import tempfile
-from pathlib import Path
+from pathlib import Path, PurePosixPath
 from datetime import datetime, UTC
 from typing import Optional
 
@@ -34,6 +34,7 @@
     merge_requirements,
     _ENV_VAR_NAME_PATTERN,
     _URI_PREFIXES,
+    _WINDOWS_DRIVE_PATTERN,
 )
 from fileglancer.apps.jobfiles import _build_work_dir
 from fileglancer.giturls import canonical_github_url
@@ -459,7 +460,9 @@ def _quote_container_cache_dir(cache_dir: Optional[str],
         )
         if home.startswith("~"):
             return "$HOME" if not suffix else f"$HOME/{shlex.quote(suffix)}"
-        expanded = str(Path(home) / suffix) if suffix else home
+        # Join with '/' rather than pathlib: the value lands in a bash script,
+        # so Windows-style separators must never be introduced here.
+        expanded = f"{home}/{suffix}" if suffix else home
         return shlex.quote(expanded)
 
     return shlex.quote(os.path.expanduser(raw))
@@ -601,12 +604,19 @@ def _container_bind_paths(entry_point, parameters: dict,
     for param, raw_value in collect_path_parameters(
             entry_point, parameters, env_parameters):
         expanded = expand_user_path(str(raw_value), username)
-        if expanded.startswith(_URI_PREFIXES) or not expanded.startswith("/"):
+        # Windows drive paths count as absolute so a dev/test server on Windows
+        # composes the same script; path validation accepts them the same way.
+        is_absolute = (expanded.startswith("/")
+                       or _WINDOWS_DRIVE_PATTERN.match(expanded))
+        if expanded.startswith(_URI_PREFIXES) or not is_absolute:
             continue
         if param.type == "directory":
             bind_paths.append(expanded)
         else:
-            bind_paths.append(str(Path(expanded).parent))
+            # PurePosixPath: the bind flag lands in a bash script, and the value
+            # is already '/'-normalized, so the parent must stay POSIX-style
+            # even when the server process runs on Windows (dev/test).
+            bind_paths.append(str(PurePosixPath(expanded).parent))
     if entry_point.bind_paths:
         bind_paths.extend(entry_point.bind_paths)
     if entry_point.effective_working_dir == "repo":
diff --git a/tests/test_apps.py b/tests/test_apps.py
index fa9304da..f3a79091 100644
--- a/tests/test_apps.py
+++ b/tests/test_apps.py
@@ -38,6 +38,13 @@
     sys.platform == "win32", reason="pwd module is not available on Windows"
 )
 
+# The generated script snippets are POSIX bash and only ever run on Linux
+# compute nodes; on Windows CI runners `bash` resolves to the WSL stub, which
+# can't execute them.
+requires_bash = pytest.mark.skipif(
+    sys.platform == "win32", reason="requires a working bash; snippets only run on Linux compute nodes"
+)
+
 
 # --- Model tests ---
 
@@ -905,6 +912,7 @@ def test_helper_exports_port_hostname_and_token(self):
         assert "export FG_HOSTNAME=" in _SERVICE_PORT_HELPER
         assert "export FG_SERVICE_TOKEN=" in _SERVICE_PORT_HELPER
 
+    @requires_bash
     def test_helper_mints_a_urlsafe_token(self):
         import re
         script = _SERVICE_PORT_HELPER + '\necho "$FG_SERVICE_TOKEN"'
@@ -914,6 +922,7 @@ def test_helper_mints_a_urlsafe_token(self):
         # Non-empty and URL-safe (hex), so no encoding is needed in the URL.
         assert re.fullmatch(r"[0-9a-f]{16,}", token), token
 
+    @requires_bash
     def test_helper_is_valid_bash(self):
         # The generated snippet must at least parse as bash.
         result = subprocess.run(
@@ -922,6 +931,7 @@ def test_helper_is_valid_bash(self):
         )
         assert result.returncode == 0, result.stderr
 
+    @requires_bash
     def test_helper_picks_a_free_port_at_runtime(self):
         # Run the helper and confirm FG_SERVICE_PORT is a plausible TCP port.
         script = _SERVICE_PORT_HELPER + '\necho "$FG_SERVICE_PORT"'
@@ -932,6 +942,7 @@ def test_helper_picks_a_free_port_at_runtime(self):
         port = int(result.stdout.strip().splitlines()[-1])
         assert 1 <= port <= 65535
 
+    @requires_bash
     def test_helper_robust_under_set_euo_pipefail(self):
         # A deployment may prepend `set -euo pipefail` via script_prologue; the
         # helper must still allocate a port and not abort the job.
@@ -1001,6 +1012,7 @@ def test_requires_auto_url(self):
 class TestServiceUrlPublisher:
     """The backgrounded readiness probe that publishes SERVICE_URL_PATH."""
 
+    @requires_bash
     def test_publisher_is_valid_bash(self):
         snippet = _build_service_url_publisher("/?access_token=${FG_SERVICE_TOKEN}")
         result = subprocess.run(["bash", "-n", "-c", snippet],
@@ -1008,6 +1020,7 @@ def test_publisher_is_valid_bash(self):
         assert result.returncode == 0, result.stderr
         assert "SERVICE_URL_PATH" in snippet and "3600" in snippet
 
+    @requires_bash
     def test_publishes_tokenized_url_only_once_port_is_up(self, tmp_path):
         import socket
         # Bind a real port so the probe's TCP connect succeeds.
@@ -1033,6 +1046,7 @@ def test_publishes_tokenized_url_only_once_port_is_up(self, tmp_path):
         finally:
             srv.close()
 
+    @requires_bash
     def test_does_not_publish_when_port_never_opens(self, tmp_path):
         import socket
         # Grab a free port number, then close it so nothing is listening.
@@ -2400,6 +2414,10 @@ def test_falls_back_to_directory_name(self, tmp_path, monkeypatch):
         assert manifest.name == tmp_path.name
 
 
+@pytest.mark.skipif(
+    sys.platform == "win32",
+    reason="the poll loop uses fcntl file locking; the server only runs on POSIX",
+)
 class TestPollLoopStopRace:
     """The poll loop must not orphan a job submitted while it is stopping.
 
@@ -2598,8 +2616,9 @@ def test_creates_pending_job_with_cluster_metadata(self, tmp_path, monkeypatch):
         submitted = self._submitted(calls)
         assert submitted["work_dir"] == job.work_dir
         assert submitted["job_name"] == "demo-run"
-        assert submitted["resources"]["stdout_path"] == f"{job.work_dir}/stdout.log"
-        assert submitted["resources"]["stderr_path"] == f"{job.work_dir}/stderr.log"
+        # work_dir is an OS-native path, so join the same way submit_job does.
+        assert submitted["resources"]["stdout_path"] == os.path.join(job.work_dir, "stdout.log")
+        assert submitted["resources"]["stderr_path"] == os.path.join(job.work_dir, "stderr.log")
 
     def test_script_layout_and_parameter_quoting(self, tmp_path, monkeypatch):
         job, calls = self._submit(
@@ -2663,8 +2682,9 @@ def test_container_wraps_command_and_binds_default_paths(self, tmp_path, monkeyp
 
         assert "apptainer" in script
         # The file param came from its manifest default (not the submitted
-        # parameters), and its parent dir must still be bind-mounted.
-        assert f"--bind {shlex.quote(str(tmp_path))}" in script
+        # parameters), and its parent dir must still be bind-mounted. Bind
+        # paths are '/'-normalized for the bash script, hence as_posix().
+        assert f"--bind {shlex.quote(tmp_path.as_posix())}" in script
         # Container runnables default to running from the work dir.
         assert 'cd "$FG_WORK_DIR"\n' in script or script.endswith('cd "$FG_WORK_DIR"')
         assert 'cd "$FG_WORK_DIR"/repo' not in script

From 3d010fb36a4ef739681e99234c2e38588c985361 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 14:46:40 -0400
Subject: [PATCH 88/89] Fix Nextflow leading-dash parameter values

Use an equals separator for Nextflow schema-derived parameters so values that begin with '-' stay attached to their intended flag while still preserving shell quoting for spaces. Keep the default space separator for other app parameters.\n\nCo-authored-by: Codex <codex@openai.com>
---
 fileglancer/apps/command.py  |  6 +++-
 fileglancer/apps/nextflow.py |  6 ++++
 fileglancer/model.py         |  8 +++++
 frontend/src/shared.types.ts |  1 +
 tests/test_apps.py           | 65 ++++++++++++++++++++++++++++++++++++
 5 files changed, 85 insertions(+), 1 deletion(-)

diff --git a/fileglancer/apps/command.py b/fileglancer/apps/command.py
index 061f4aa7..12d2d69e 100644
--- a/fileglancer/apps/command.py
+++ b/fileglancer/apps/command.py
@@ -484,7 +484,11 @@ def build_command(entry_point: AppEntryPoint, parameters: dict,
             if value is True:
                 parts.append(p.flag)
         else:
-            parts.append(f"{p.flag} {shlex.quote(validated)}")
+            quoted = shlex.quote(validated)
+            if p.value_separator == "equals":
+                parts.append(f"{p.flag}={quoted}")
+            else:
+                parts.append(f"{p.flag} {quoted}")
 
     # Pass 2: Positional args in declaration order
     for p, value in effective:
diff --git a/fileglancer/apps/nextflow.py b/fileglancer/apps/nextflow.py
index 48609288..ee026ca3 100644
--- a/fileglancer/apps/nextflow.py
+++ b/fileglancer/apps/nextflow.py
@@ -44,6 +44,12 @@ def _convert_property(name: str, prop: dict, is_required: bool) -> AppParameter:
         "flag": f"--{name}",
         "name": name.replace("_", " ").title(),
         "type": param_type,
+        # Nextflow treats a separate value that starts with '-' as another
+        # Nextflow/pipeline option (`--runtime_opts --nv` becomes
+        # params.runtime_opts=true and params.nv=true). Join generated
+        # pipeline params with '=' so leading-dash values stay attached to the
+        # intended parameter (`--runtime_opts=--nv`).
+        "value_separator": "equals",
     }
 
     desc = prop.get("description")
diff --git a/fileglancer/model.py b/fileglancer/model.py
index 1b2aa787..74a5e240 100644
--- a/fileglancer/model.py
+++ b/fileglancer/model.py
@@ -349,6 +349,14 @@ class AppParameter(BaseModel):
     pattern: Optional[str] = Field(description="Regex validation pattern for string types", default=None)
     hidden: bool = Field(description="Whether the parameter is hidden by default in the UI", default=False)
     raw: bool = Field(description="If true, value is appended to the command without shell quoting", default=False)
+    value_separator: Literal["space", "equals"] = Field(
+        description=(
+            "How non-boolean flagged parameters are joined to their value in "
+            "the generated command: 'space' emits '--flag value', while "
+            "'equals' emits '--flag=value'."
+        ),
+        default="space",
+    )
     exists: bool = Field(
         description="file/directory params only: when true (the default), the path "
                     "must exist and be readable before launch. Set false for outputs "
diff --git a/frontend/src/shared.types.ts b/frontend/src/shared.types.ts
index c7b48059..8a93c472 100644
--- a/frontend/src/shared.types.ts
+++ b/frontend/src/shared.types.ts
@@ -79,6 +79,7 @@ type AppParameter = {
   pattern?: string;
   hidden?: boolean;
   raw?: boolean;
+  value_separator?: 'space' | 'equals';
   /** file/directory params: when false, the path is an output the job may
    * create, so it need not exist before launch. Defaults to true. */
   exists?: boolean;
diff --git a/tests/test_apps.py b/tests/test_apps.py
index f3a79091..27f992d1 100644
--- a/tests/test_apps.py
+++ b/tests/test_apps.py
@@ -2091,6 +2091,53 @@ def test_empty_positional_value_preserved(self):
         assert cmd.endswith("''")
 
 
+class TestBuildCommandValueSeparator:
+    def test_flagged_params_default_to_space_separator(self):
+        ep = AppEntryPoint(
+            id="run",
+            name="run",
+            command="tool",
+            parameters=[AppParameter(flag="--opt", name="Opt", type="string")],
+        )
+        cmd = build_command(ep, {"opt": "value"})
+        assert "--opt value" in cmd
+
+    def test_equals_separator_attaches_leading_dash_value(self):
+        ep = AppEntryPoint(
+            id="run",
+            name="run",
+            command="tool",
+            parameters=[
+                AppParameter(
+                    flag="--runtime_opts",
+                    name="Runtime opts",
+                    type="string",
+                    value_separator="equals",
+                ),
+            ],
+        )
+        cmd = build_command(ep, {"runtime_opts": "--nv"})
+        assert "--runtime_opts=--nv" in cmd
+        assert "--runtime_opts --nv" not in cmd
+
+    def test_equals_separator_still_shell_quotes_spaces(self):
+        ep = AppEntryPoint(
+            id="run",
+            name="run",
+            command="tool",
+            parameters=[
+                AppParameter(
+                    flag="--runtime_opts",
+                    name="Runtime opts",
+                    type="string",
+                    value_separator="equals",
+                ),
+            ],
+        )
+        cmd = build_command(ep, {"runtime_opts": "--bind /data in"})
+        assert "--runtime_opts='--bind /data in'" in cmd
+
+
 class TestParameterKeyGeneration:
     """AppEntryPoint auto-generates parameter keys from the flag or a positional
     index, but honors an explicitly-authored key."""
@@ -2204,6 +2251,24 @@ def test_full_command_keeps_profile_before_pipeline_params(self, tmp_path):
         )
         assert cmd.startswith("nextflow run repo -ansi-log false")
         assert cmd.index("-profile") < cmd.index("--input_dir")
+        assert "-profile janeliaLSF" in cmd
+
+    def test_pipeline_params_use_equals_separator_for_leading_dash_values(self, tmp_path):
+        (tmp_path / "nextflow_schema.json").write_text(json.dumps({
+            "$defs": {
+                "opts": {
+                    "title": "Options",
+                    "properties": {
+                        "runtime_opts": {"type": "string"},
+                    },
+                }
+            },
+            "allOf": [{"$ref": "#/$defs/opts"}],
+        }))
+        ep = NextflowAdapter().convert(tmp_path).runnables[0]
+        cmd = build_command(ep, {"runtime_opts": "--nv"})
+        assert "--runtime_opts=--nv" in cmd
+        assert "--runtime_opts --nv" not in cmd
 
     def test_projectdir_default_rewritten_to_repo(self, tmp_path):
         # Running from the work dir, projectDir assets live under ./repo/, so a

From db381d60585501611d17a2b694cbe4fde7cc5227 Mon Sep 17 00:00:00 2001
From: Konrad Rokicki <rokickik@janelia.hhmi.org>
Date: Sat, 4 Jul 2026 14:54:44 -0400
Subject: [PATCH 89/89] Fix Nextflow boolean parameter emission

Emit explicit boolean values for Nextflow pipeline parameters so false overrides true defaults. Apply the Nextflow-safe form during command generation for older cached manifests while preserving generic switch behavior for other apps.\n\nCo-authored-by: Codex <codex@openai.com>
---
 fileglancer/apps/command.py  |  29 +++++++++-
 fileglancer/apps/nextflow.py |   6 ++
 fileglancer/model.py         |  20 ++++++-
 frontend/src/shared.types.ts |   1 +
 tests/test_apps.py           | 107 +++++++++++++++++++++++++++++++++++
 5 files changed, 158 insertions(+), 5 deletions(-)

diff --git a/fileglancer/apps/command.py b/fileglancer/apps/command.py
index 12d2d69e..86bd4294 100644
--- a/fileglancer/apps/command.py
+++ b/fileglancer/apps/command.py
@@ -416,6 +416,15 @@ def _flatten_param_items(items) -> list:
     return result
 
 
+def _is_nextflow_run_command(command: str) -> bool:
+    """Return true when the base command appears to be ``nextflow run``."""
+    try:
+        argv = shlex.split(command)
+    except ValueError:
+        argv = command.strip().split()
+    return len(argv) >= 2 and argv[0] == "nextflow" and argv[1] == "run"
+
+
 def build_command(entry_point: AppEntryPoint, parameters: dict,
                   env_parameters: dict = None, session=None, username=None,
                   check_access: bool = True) -> str:
@@ -473,6 +482,7 @@ def build_command(entry_point: AppEntryPoint, parameters: dict,
 
     # Start with the base command
     parts = [entry_point.command]
+    nextflow_run = _is_nextflow_run_command(entry_point.command)
 
     # Pass 1: Flagged args in declaration order
     for p, value in effective:
@@ -480,12 +490,27 @@ def build_command(entry_point: AppEntryPoint, parameters: dict,
             continue
         validated = _validate_parameter_value(p, value, session=session, username=username,
                                               check_access=check_access)
+        # Nextflow pipeline params (`--foo`) are parsed differently from normal
+        # CLI switches: a separate leading-dash value becomes another param, and
+        # omitting a false boolean leaves any pipeline default in effect. Apply
+        # the Nextflow-safe forms at command-build time too, so cached
+        # auto-generated manifests from older Fileglancer versions are fixed
+        # without requiring users to update/re-add the app.
+        is_nextflow_pipeline_param = nextflow_run and p.flag.startswith("--")
+        value_separator = "equals" if is_nextflow_pipeline_param else p.value_separator
+        boolean_style = "value" if is_nextflow_pipeline_param else p.boolean_style
         if p.type == "boolean":
-            if value is True:
+            if boolean_style == "value":
+                bool_value = "true" if value is True else "false"
+                if value_separator == "equals":
+                    parts.append(f"{p.flag}={bool_value}")
+                else:
+                    parts.append(f"{p.flag} {bool_value}")
+            elif value is True:
                 parts.append(p.flag)
         else:
             quoted = shlex.quote(validated)
-            if p.value_separator == "equals":
+            if value_separator == "equals":
                 parts.append(f"{p.flag}={quoted}")
             else:
                 parts.append(f"{p.flag} {quoted}")
diff --git a/fileglancer/apps/nextflow.py b/fileglancer/apps/nextflow.py
index ee026ca3..4f9d234e 100644
--- a/fileglancer/apps/nextflow.py
+++ b/fileglancer/apps/nextflow.py
@@ -59,6 +59,12 @@ def _convert_property(name: str, prop: dict, is_required: bool) -> AppParameter:
     if is_required:
         kwargs["required"] = True
 
+    # Nextflow boolean params are not generic CLI switches: omitting a false
+    # value leaves any pipeline default in effect (e.g. a default true stays
+    # true). Emit explicit true/false values for schema-derived booleans.
+    if param_type == "boolean":
+        kwargs["boolean_style"] = "value"
+
     # Nextflow schemas only require a path to exist when "exists": true is set;
     # anything else (outdir, report paths, ...) is an output the pipeline
     # creates, so don't demand it exists before launch.
diff --git a/fileglancer/model.py b/fileglancer/model.py
index 74a5e240..dc51dcc0 100644
--- a/fileglancer/model.py
+++ b/fileglancer/model.py
@@ -351,12 +351,21 @@ class AppParameter(BaseModel):
     raw: bool = Field(description="If true, value is appended to the command without shell quoting", default=False)
     value_separator: Literal["space", "equals"] = Field(
         description=(
-            "How non-boolean flagged parameters are joined to their value in "
-            "the generated command: 'space' emits '--flag value', while "
-            "'equals' emits '--flag=value'."
+            "How flagged parameters are joined to their value in the generated "
+            "command: 'space' emits '--flag value', while 'equals' emits "
+            "'--flag=value'."
         ),
         default="space",
     )
+    boolean_style: Literal["flag", "value"] = Field(
+        description=(
+            "How flagged boolean parameters are emitted: 'flag' emits '--flag' "
+            "for true and omits false, while 'value' emits '--flag true' or "
+            "'--flag false' (or '--flag=true/false' when value_separator is "
+            "'equals')."
+        ),
+        default="flag",
+    )
     exists: bool = Field(
         description="file/directory params only: when true (the default), the path "
                     "must exist and be readable before launch. Set false for outputs "
@@ -409,6 +418,11 @@ def validate_exists(self):
                 f"exists is only valid on file and directory parameters, "
                 f"but '{self.name}' has type '{self.type}'"
             )
+        if self.boolean_style != "flag" and self.type != "boolean":
+            raise ValueError(
+                f"boolean_style is only valid on boolean parameters, "
+                f"but '{self.name}' has type '{self.type}'"
+            )
         return self
 
 
diff --git a/frontend/src/shared.types.ts b/frontend/src/shared.types.ts
index 8a93c472..96cee59e 100644
--- a/frontend/src/shared.types.ts
+++ b/frontend/src/shared.types.ts
@@ -80,6 +80,7 @@ type AppParameter = {
   hidden?: boolean;
   raw?: boolean;
   value_separator?: 'space' | 'equals';
+  boolean_style?: 'flag' | 'value';
   /** file/directory params: when false, the path is an output the job may
    * create, so it need not exist before launch. Defaults to true. */
   exists?: boolean;
diff --git a/tests/test_apps.py b/tests/test_apps.py
index 27f992d1..b45feabe 100644
--- a/tests/test_apps.py
+++ b/tests/test_apps.py
@@ -2138,6 +2138,53 @@ def test_equals_separator_still_shell_quotes_spaces(self):
         assert "--runtime_opts='--bind /data in'" in cmd
 
 
+class TestBuildCommandBooleanStyle:
+    def test_flag_style_preserves_generic_switch_behavior(self):
+        ep = AppEntryPoint(
+            id="run",
+            name="run",
+            command="tool",
+            parameters=[AppParameter(flag="--verbose", name="Verbose", type="boolean")],
+        )
+        assert build_command(ep, {"verbose": True}) == "tool \\\n  --verbose"
+        assert build_command(ep, {"verbose": False}) == "tool"
+
+    def test_value_style_emits_explicit_boolean_values(self):
+        ep = AppEntryPoint(
+            id="run",
+            name="run",
+            command="tool",
+            parameters=[
+                AppParameter(
+                    flag="--skip_qc",
+                    name="Skip QC",
+                    type="boolean",
+                    boolean_style="value",
+                ),
+            ],
+        )
+        assert "--skip_qc true" in build_command(ep, {"skip_qc": True})
+        assert "--skip_qc false" in build_command(ep, {"skip_qc": False})
+
+    def test_value_style_can_use_equals_separator(self):
+        ep = AppEntryPoint(
+            id="run",
+            name="run",
+            command="tool",
+            parameters=[
+                AppParameter(
+                    flag="--skip_qc",
+                    name="Skip QC",
+                    type="boolean",
+                    boolean_style="value",
+                    value_separator="equals",
+                ),
+            ],
+        )
+        assert "--skip_qc=true" in build_command(ep, {"skip_qc": True})
+        assert "--skip_qc=false" in build_command(ep, {"skip_qc": False})
+
+
 class TestParameterKeyGeneration:
     """AppEntryPoint auto-generates parameter keys from the flag or a positional
     index, but honors an explicitly-authored key."""
@@ -2270,6 +2317,66 @@ def test_pipeline_params_use_equals_separator_for_leading_dash_values(self, tmp_
         assert "--runtime_opts=--nv" in cmd
         assert "--runtime_opts --nv" not in cmd
 
+    def test_boolean_params_are_emitted_explicitly(self, tmp_path):
+        (tmp_path / "nextflow_schema.json").write_text(json.dumps({
+            "$defs": {
+                "opts": {
+                    "title": "Options",
+                    "properties": {
+                        "skip_qc": {"type": "boolean", "default": True},
+                    },
+                }
+            },
+            "allOf": [{"$ref": "#/$defs/opts"}],
+        }))
+        ep = NextflowAdapter().convert(tmp_path).runnables[0]
+        param = next(p for p in ep.flat_parameters() if p.key == "skip_qc")
+        assert param.boolean_style == "value"
+
+        assert "--skip_qc=true" in build_command(ep, {})
+        assert "--skip_qc=false" in build_command(ep, {"skip_qc": False})
+        assert "--skip_qc false" not in build_command(ep, {"skip_qc": False})
+
+    def test_legacy_cached_nextflow_params_use_safe_forms(self):
+        # Cached manifests created before Fileglancer knew about
+        # value_separator/boolean_style still validate with those fields at
+        # their generic defaults. Command generation must recognize Nextflow
+        # pipeline params and use the safe forms anyway, otherwise existing
+        # installed apps keep the old bugs until manually updated/re-added.
+        ep = AppEntryPoint(
+            id="run",
+            name="Run pipeline",
+            command="nextflow run repo -ansi-log false",
+            working_dir="work",
+            env_parameters=[
+                AppParameter(flag="-profile", name="Profiles", type="string"),
+            ],
+            parameters=[
+                AppParameter(
+                    flag="--runtime_opts",
+                    name="Runtime opts",
+                    type="string",
+                ),
+                AppParameter(
+                    flag="--skip_qc",
+                    name="Skip QC",
+                    type="boolean",
+                    default=True,
+                ),
+            ],
+        )
+
+        cmd = build_command(
+            ep,
+            {"runtime_opts": "--nv", "skip_qc": False},
+            env_parameters={"profile": "janeliaLSF"},
+        )
+        assert "-profile janeliaLSF" in cmd
+        assert "--runtime_opts=--nv" in cmd
+        assert "--skip_qc=false" in cmd
+        assert "--runtime_opts --nv" not in cmd
+        assert "--skip_qc false" not in cmd
+
     def test_projectdir_default_rewritten_to_repo(self, tmp_path):
         # Running from the work dir, projectDir assets live under ./repo/, so a
         # $projectDir-relative schema default must rewrite to ./repo/... The