fix(emcn): restore embedded surfaces, drag regions and Docs keyboard focus

- Pass embedded from the host Surface, so organization views keep their
  focus outline and stay transparent without canvas.
- Restore the Electron drag region for headers marked data-desktop-drag
  in the Platform bootstrap.
- Give Docs a keyboard focus outline outside text fields, and keep
  NeutralBadge at its intrinsic width in column layouts.
- Keep EMCN out of the packaged desktop dependencies: the renderer
  bundles it.
- Trigger the Platform and Auth workflows on the legacy package and the
  hairline plugin; name the legacy package in the CI notes.
- Wait for the reopened workspace picker before pressing Escape in the
  Auth browser check.

Author: emir-karabeg

.claude/rules/sim-imports.md

@@ -13,7 +13,7 @@ paths:
 
 ```typescript
 // ✓ Good
-import { Chip } from '@sim/emcn-legacy'
+import { Chip } from '@sim/emcn/button'
 import { useWorkflowStore } from '@/stores/workflows/workflow/store'
 
 // ✗ Bad

.cursor/rules/sim-imports.mdc

@@ -13,7 +13,7 @@ globs: ["apps/sim/**/*.ts","apps/sim/**/*.tsx"]
 
 ```typescript
 // ✓ Good
-import { Chip } from '@sim/emcn-legacy'
+import { Chip } from '@sim/emcn/button'
 import { useWorkflowStore } from '@/stores/workflows/workflow/store'
 
 // ✗ Bad

.github/CI.md

@@ -40,7 +40,7 @@ WebKit acceptance on Blacksmith uses the matching, digest-pinned Playwright brow
 
 HTTP and docs browser installation first asks the pinned Playwright driver to simulate its OS dependency installation. When the simulation requires no package changes, the runner avoids an apt update; missing dependencies, proposed upgrades, or an unsuccessful simulation use the normal dependency installer. Browser selection and downloads still use the pinned driver, including full native Chromium for extension acceptance.
 
-`app/o` bundles `platform/embedded` and the EMCN packages (`packages/emcn`, `packages/emcn-platform`), so both are build and `ci:shared` inputs: an edit to either changes the build hash and selects every boundary. The Platform zone (`platform/{app,lib,fixtures,checks,docs,preview,public}` and its own configs) is a separate Next app that the embedded tree may not import, reached only through the `/org` rewrite, and is excluded by name so that a new `platform/` folder stays an input until it is declared zone-only. A zone-only edit selects `platform-design.yml` and the app's unit tests, and no main-app build or acceptance job.
+`app/o` bundles `platform/embedded` and the EMCN packages (`packages/emcn`, `packages/emcn-platform`, `packages/emcn-legacy`), so both are build and `ci:shared` inputs: an edit to either changes the build hash and selects every boundary. The Platform zone (`platform/{app,lib,fixtures,checks,docs,preview,public}` and its own configs) is a separate Next app that the embedded tree may not import, reached only through the `/org` rewrite, and is excluded by name so that a new `platform/` folder stays an input until it is declared zone-only. A zone-only edit selects `platform-design.yml` and the app's unit tests, and no main-app build or acceptance job.
 
 Every HTTP and browser group consumes the same production build in an isolated job/database. Electron also uses that build and skips its development-route warm-up. Local HTTP and Electron development runs retain their dev-server behavior. Build inputs exclude test-only files so a harness edit can reuse an unchanged production build.
 

.github/workflows/auth-ui.yml

@@ -10,6 +10,7 @@ on:
       - 'apps/sim/scripts/test-auth-ui-e2e.ts'
       - 'apps/sim/package.json'
       - 'apps/sim/postcss.config.mjs'
+      - 'apps/sim/lib/postcss/hairline-border-width.cjs'
       - 'packages/emcn/**'
       - 'packages/emcn-auth/**'
       - 'bun.lock'

.github/workflows/platform-design.yml

@@ -30,6 +30,7 @@ on:
       - 'apps/realtime/**'
       - 'packages/emcn/**'
       - 'packages/emcn-platform/**'
+      - 'packages/emcn-legacy/**'
       - 'scripts/emcn-packages.ts'
       - 'apps/sim/lib/postcss/platform-embed.cjs'
       - 'scripts/check-platform-design*'

apps/desktop/package.json

@@ -45,13 +45,13 @@
     "micromatch": "4.0.8",
     "safe-regex2": "5.1.2",
     "tldts": "7.4.18",
-    "pdf-lib": "1.17.1",
-    "@sim/emcn-auth": "workspace:*",
-    "@sim/emcn": "workspace:*"
+    "pdf-lib": "1.17.1"
   },
   "devDependencies": {
     "@electron/fuses": "1.8.0",
     "@playwright/test": "1.64.1",
+    "@sim/emcn": "workspace:*",
+    "@sim/emcn-auth": "workspace:*",
     "@sim/emcn-legacy": "workspace:*",
     "@sim/tsconfig": "workspace:*",
     "@types/micromatch": "4.0.10",

apps/sim/platform/styles/bootstrap.css

@@ -6,3 +6,11 @@
 
 @source "../../../../packages/emcn/src/components";
 @source "../../../../packages/emcn-platform/src/components";
+
+/* Electron moves the window from these headers; their controls stay clickable. */
+[data-sim-desktop-title-bar] [data-desktop-drag] {
+  -webkit-app-region: drag;
+}
+[data-sim-desktop-title-bar] [data-desktop-drag] :is(button, a, input, textarea, [role="tab"]) {
+  -webkit-app-region: no-drag;
+}

apps/sim/scripts/test-auth-ui-e2e.ts

@@ -231,6 +231,7 @@ async function run() {
       await page.keyboard.press('Enter')
       await expect(workspace).toContainText('Design')
       await workspace.click()
+      await expect(page.getByRole('listbox')).toBeVisible()
       await page.keyboard.press('Escape')
       await expect(workspace).toBeFocused()
       await expect(page.getByRole('listbox')).toBeHidden()

bun.lock

@@ -40,7 +40,7 @@ interface NeutralBadgeProps {
 
 export function NeutralBadge({ children }: NeutralBadgeProps) {
   return (
-    <span className='inline-flex items-center rounded-md bg-[var(--docs-surface)] px-2 py-0.5 font-mono text-[var(--docs-muted)] text-docs-caption'>
+    <span className='inline-flex w-fit items-center rounded-md bg-[var(--docs-surface)] px-2 py-0.5 font-mono text-[var(--docs-muted)] text-docs-caption'>
       {children}
     </span>
   )