mirror of
https://github.com/nexu-io/open-design.git
synced 2026-09-20 06:15:06 +08:00
chore/plugin-previews
16 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 open-design-crew[bot]
|
365313443d |
fix(e2e): make packaged Home readiness timeout deterministic (#7952)
Use a fake clock to verify the existing 10ms deadline and the final readiness snapshot after multiple inspections. Cover a first inspection that consumes the whole budget, where a single observation is valid. Keep the readiness helper and application behavior unchanged. Co-authored-by: lefarcen <935902669@qq.com> |
||
|
open-design-crew[bot]
|
35fa33b3c7 |
fix(e2e): align packaged Home smoke inputs and evidence (#7918)
* fix(e2e): use daemon-owned request input in Codex plans * fix(e2e): scope Codex smoke receipts to app-server processes --------- Co-authored-by: zhouzheng <zhouzheng@refly.ai> |
||
|
open-design-crew[bot]
|
d232620c16 |
fix(e2e): align packaged Home smoke with Codex app-server (#7914)
Co-authored-by: zhouzheng <zhouzheng@refly.ai> |
||
|
lefarcen
|
25475defab |
fix(e2e): stop the packaged mac first-run gate failing on budget alone (#7899)
The `[P0] cold first Home run` packaged mac case has been red on almost
every beta build for eleven days (1 pass in 12 attempts) and nobody saw
it, because release-beta's smoke step is `continue-on-error: true`.
Four changes, in the order they matter:
1. Capture evidence before cleanup. A failing case uninstalled the app
and the next case deleted the runtime namespace, so the only surviving
trace was `logs: {skipped: true}`. The failure path now writes the
desktop log, a raw `/api/runs` diagnostics snapshot, and the error into
the release report before anything is torn down.
2. Give the wait a budget that matches the chain, split in two. 15s had to
cover cold project creation through rendered output; it is now 60s for
"the daemon owns a finished run" plus 30s for "the output surfaced", so
a timeout says which half broke instead of leaving three observations
that cannot falsify each other. Polling moved inside the page: every
sample used to cost a `tools-pack mac inspect` process, which ate about
a third of the old budget on its own.
3. Drop the injected 503. `POST /api/runs` does not answer
WORKSPACE_AUTHORITY_UNAVAILABLE — local run creation is deliberately
independent of Workspace membership availability — so the case spent
an extra create round trip plus a 500ms backoff on a branch production
cannot reach. Run-create retry semantics stay covered by
apps/web/tests/providers/sse.test.ts.
4. Make the exempted red audible. The exemption stays (at a 1/12 pass rate
a blocking gate would stall the daily beta), but `tools-release
write-report` now turns a failed smoke into a run annotation and a
caution banner at the top of the step summary.
|
||
|
Caprika
|
05a01a0048 |
fix packaged mac Home readiness race (#7688)
* fix e2e packaged Home readiness race * fix e2e poll Home readiness outside inspect * fix e2e wait for Lexical attachment * fix e2e publish setup after prompt insertion |
||
|
PerishFire
|
ab77eafeb1 |
refactor(release): retire dedicated betas and preview lanes (#7058)
* refactor(release): retire dedicated betas and preview lanes * fix(updater): consume dynamic release channels * fix(e2e): narrow counted release versions structurally |
||
|
Joey-nexu
|
f1a0b60c6c |
chore: unify product name display to OpenDesign repo-wide (#6998)
* chore: unify product name display to OpenDesign repo-wide Rename the user-facing product name from "Open Design" to "OpenDesign" across documentation, web/desktop UI strings, i18n locales, prompts, plugin/skill/design-system content, changelogs, and specs, matching the landing-page rename already in flight. Deliberately excluded so installed-app identity stays untouched: - packages/release PRODUCT_NAME and everything derived from it (app bundle names, installer/registry identity, updater feeds) - tools/pack, tools/release, apps/packaged, landing page (PR #6983) - mocks/ recorded traces and LICENSE - test fixtures and comments that encode real on-disk install paths (Open Design.app, Program Files\Open Design, AppData paths) Validated with pnpm guard, pnpm typecheck, and targeted web/desktop/host test runs over the renamed strings. * fix(web): keep two-letter author monogram for CamelCase brand names authorInitials split words on whitespace only, so the renamed single-token author name "OpenDesign" produced a one-letter monogram. Treat lower-to-upper CamelCase boundaries as word breaks so the avatar fallback stays "OD". * fix(release): restore spaced Windows source artifact names in win.ps1 tools/pack still derives builder outputs from the unchanged PRODUCT_NAME ("Open Design"), so the asset script must look for the spaced filenames. Matches the mac/mac-intel/linux asset scripts, which were already kept on the original names. --------- Co-authored-by: Joey <236967869+joeylee12629-star@users.noreply.github.com> |
||
|
Ray Xi
|
f7a3fe3662 | fix(release): repair Windows prerelease auth smoke (#6682) | ||
|
Amy
|
5580736c1a |
fix(e2e): align packaged onboarding smoke selector (#6538)
* fix(e2e): align packaged onboarding smoke selector * test(e2e): guard packaged onboarding selector drift * fix(e2e): align platform onboarding probes Generated-By: looper 0.11.8 (runner=fixer, agent=codex) * fix(e2e): align packaged smoke with identity gate Generated-By: looper 0.11.8 (runner=fixer, agent=codex) |
||
|
lefarcen
|
1aad2f5ef6 |
fix(release): treat an empty windows smoke mode as core (#6524)
* test(e2e): pin that an empty windows smoke mode means core Two independent holes let an empty value read as a different profile: The workflow-level one — a workflow_call `default:` applies only when an input is OMITTED, so forwarding '' defeats the declared `core` default. The spec-level one — `??` falls back only on null/undefined, so an empty environment variable survives it and `smokeProfile === 'core'` is false. Together they made release/v0.18.1's first prerelease take the `full` path, demand the updater fixture only a genuine `full` request configures, and die before the smoke started — on the branch-cut commit, before anything else had landed there. release/v0.18.0 never showed it because its branch name matched a special case that produced `skip`, so its smoke never ran at all. Red on both layers: the resolver mirrors main's `?? 'core'` verbatim. * fix(release): treat an empty windows smoke mode as core Close both layers that let an empty value read as a different profile. notify-release-feishu now names `core` as its final arm instead of ''. A workflow_call `default:` applies only when an input is omitted, so forwarding an empty string defeated the callee's declared default. win.spec.ts resolves the profile through `resolvePackagedSmokeProfile`, which treats empty, whitespace and unset alike as `core` and rejects anything it does not recognise — a typo must not select the updater path the way '' did. Either fix alone would unblock release/v0.18.1, but they guard different holes: one stops an empty value being produced, the other stops one being misread. |
||
|
lefarcen
|
72b1db761b |
fix(e2e): let the Windows packaged smoke settle on the cloud sign-in landing (#6481)
* test(e2e): pin the Windows packaged app-shell rule (red)
Extract the Windows packaged smoke's app-shell DOM probe and the rule that
reads it into a pure module, and cover both from a platform that can actually
run them. The probe reaches the packaged renderer as a plain string through
`tools-pack inspect --expr`, and `specs/win.spec.ts` only executes on a Windows
runner with a packaged build installed, so today neither is checked anywhere.
Behavior is unchanged: the rule still accepts only `homeVisible === true`, the
same test main's inline `ensureMainAppShell` applies. The two new cases that
describe a first run resting on the cloud sign-in landing therefore fail, which
is the bug — a packaged first run nobody signs in to can never reach home
unattended, so the wait can only time out.
× settles on the cloud sign-in landing when the profile only needs a rendered surface
× still requires home when the profile has to drive the entry rail
AssertionError: expected null to be 'onboarding-landing' // Object.is equality
- Expected: "onboarding-landing"
+ Received: null
Test Files 1 failed (1)
Tests 2 failed | 10 passed (12)
* fix(e2e): accept the packaged Windows onboarding landing as a settled shell
A packaged first run that nobody signs in to comes to rest on the cloud
sign-in landing, and `connectStepRuntimeReady` in EntryShell.tsx will not
advance without a signed-in cloud account, an installed local CLI, or a
verified BYOK key — none of which a release runner has. The core Windows smoke
only screenshots from this point, so the landing is a legitimate terminal
state there; demanding home made the wait time out on a healthy app.
The landing is recognised positively, from the same three affordances the [P0]
onboarding smoke asserts (sign-in CTA plus both runtime links), so a blank
window, a crashed renderer, a boot still on the loader, or an onboarding shell
that mounted and then died all still fail — with a named cause rather than an
opaque timeout.
The full profile goes on to click `entry-nav-updater`, which
`clickUpdaterRailExpression` refuses while onboarding is up, so it keeps
demanding home and now fails here with that stated reason instead of later
with a bare `onboarding-visible`.
Test Files 1 passed (1)
Tests 12 passed (12)
* test(e2e): pin the seeded-onboarding postcondition (red)
PerishCode's review on #6481: the core run seeds onboarding as completed and
then accepts onboarding anyway, so a broken completed-onboarding boot path
passes silently.
Name the decision — `packagedAppShellPolicy` — and cover it. The
implementation still keys off the smoke profile, exactly as the previous commit
left it, so the cases that say a run whose daemon confirms completion must
still require home fail.
× requires home once the daemon confirms onboarding is completed
× keeps a seeded run failing when the app ignores completed onboarding
AssertionError: expected { acceptOnboardingLanding: true } to deeply equal { acceptOnboardingLanding: false }
Test Files 1 failed (1)
Tests 2 failed | 16 passed (18)
* fix(e2e): derive the accepted app shell from the daemon's onboarding config
Setup and expectation now come from one fact instead of two. The smoke reads
`GET /api/app-config` — which serves `readAppConfig(RUNTIME_DATA_DIR)`, the
running daemon's own resolved data root — and the accepted terminal state
follows from it:
- daemon confirms onboarding is completed -> home is the only outcome, so a
renderer that ignores a completed-onboarding config still fails the core
release lane;
- daemon reports a genuine first run -> the cloud sign-in landing is the
correct place to stop, and is accepted only when it actually rendered its
sign-in CTA and both runtime links.
The seed's postcondition is also asserted directly, right after the seeded
`tools-pack win start` where it must hold: that launch rewrites the packaged
config's `namespaceBaseRoot` to the tools-pack runtime root
(tools/pack/src/win/lifecycle.ts) and the runtime derives
`join(namespaceBaseRoot, namespace, 'data')` from it
(apps/packaged/src/paths.ts), which is byte-identical to the path
`seedPackagedOnboardingComplete` writes. A daemon that does not see the seed
there is a real data-root regression and now says so, instead of surfacing
later as an unexplained onboarding screen.
The app-shell read is deliberately taken again rather than reused: the core
profile stops the app and relaunches it through the OS protocol handler, and
that cold start inherits none of this process's environment.
Test Files 1 passed (1)
Tests 18 passed (18)
* test(e2e): pin the daemon onboarding-config probe (red)
PerishCode's second review on #6481: the probe converts an HTTP failure into
`onboardingCompleted: false`, which is the exact branch that permits the
onboarding landing. `status` is returned and never read, and the caller's guard
only rejects a malformed shape — so a 500, a 404, or a daemon that is not
serving yet resolves to "genuine first run" and the core smoke passes without
ever establishing the fact its shell policy depends on.
Move the probe text and its reading into the pure module verbatim, then drive
the shipped text against a fake fetch. Behavior is unchanged, so every failure
mode reads as a valid `false`.
× refuses to answer when the daemon returns a server error
× refuses to answer when the route is missing
× refuses to answer when the daemon is not reachable at all
× refuses to answer when the response carries no config
× names the status so a failure says what could not be established
× never lets a failed probe become permission to accept the landing
AssertionError: expected function to throw an error, but it didn't
Test Files 1 failed (1)
Tests 6 failed | 21 passed (27)
* fix(e2e): fail closed when the daemon onboarding config cannot be read
The probe now reports failure structurally instead of flattening it into a
reading: a transport error, a non-2xx, or a body without `config` each come
back as `{ ok: false, status, error }`, and `packagedOnboardingCompletedFromProbe`
raises `PackagedOnboardingConfigError` for all of them. `status` is load-bearing
— only a 200 that actually carried a config object may produce a reading.
There is deliberately no default and no retry. `waitForHealthyDesktop` has
already proven the same renderer gets 200 from `/api/health`, so a failure here
is a real fault; and the only fallback value available is `false`, which is
exactly the branch that permits the onboarding landing. An unestablished fact
must be an error, never a permission.
Test Files 1 passed (1)
Tests 27 passed (27)
* test(e2e): pin malformed-but-successful onboarding config payloads (red)
PerishCode's third review on #6481, same defect class as rounds 1 and 2:
coercion manufacturing a value that hides the absence of one.
`config.onboardingCompleted === true` turns anything into a valid boolean, so a
200 carrying `{ config: {} }` or `{ config: { onboardingCompleted: "false" } }`
returns `{ ok: true, onboardingCompleted: false, status: 200 }`. The reader's
`typeof ... !== 'boolean'` check then passes, because `=== true` already
synthesized the boolean it was meant to require — the round-3 guarantee that a
reading must "be present" was vacuous as written.
× refuses to answer when a 200 carries no onboardingCompleted field
× refuses to answer when onboardingCompleted is the wrong type
× refuses to answer when config is an array rather than an object
AssertionError: expected { ok: true, …(2) } to match object { ok: false }
Test Files 1 failed (1)
Tests 3 failed | 27 passed (30)
* fix(e2e): require the onboarding reading's type instead of coercing it
The probe now returns `{ ok: false, error, status }` when a 200 carries no
boolean `onboardingCompleted`, so a missing key, a null, or the string "false"
can no longer arrive as a real `false` reading — which was the one value that
permits the onboarding landing. `Array.isArray` also rejects an array `config`,
which `typeof === 'object'` let through.
This makes the round-3 guarantee real rather than vacuous: the reader's
`typeof ... !== 'boolean'` check now runs against a value the probe declined to
synthesize.
Swept the rest of the diff for the same defect class and tightened the two
remaining truthiness reads on the policy path, so the closed direction is
structural rather than dependent on a caller staying honest:
- `packagedAppShellPolicy` requires an explicit `false` before granting
permission; anything else requires home.
- `packagedAppShellSettled` requires `acceptOnboardingLanding === true`.
Everything else on the path already failed closed: the app-shell probe's
`instanceof` flags must all be positively true to settle, `asPackagedAppShellSnapshot`
type-checks every field before use and returns null otherwise, and the reader's
`status`/`ok` guards can only reject.
Test Files 1 passed (1)
Tests 32 passed (32)
* test(e2e): pin that a lost seed is not a genuine first run (red)
PerishCode's fifth review on #6481 — the same family, now at the level of the
scenario rather than a single expression.
The run seeds `onboardingCompleted: true` and asserts the seeded daemon reads
it back. The core profile then stops the app and relaunches it through the OS
protocol handler, which inherits none of the test process's environment. If
that cold launch resolves a different data root the seeded config is gone, the
fresh reading is `false`, and the policy calls it a genuine first run: the
landing is accepted and the smoke passes while blind to the regression it
exists to catch. Recording both readings diagnoses it; it does not fail.
Give the policy the seeded observation and leave the implementation ignoring
it, so the two cases that describe a lost seed fail.
× never downgrades a lost seed to a genuine first run
× keeps a lost seed failing at the shell check
AssertionError: expected { acceptOnboardingLanding: true } to deeply equal { acceptOnboardingLanding: false }
Test Files 1 failed (1)
Tests 2 failed | 32 passed (34)
* fix(e2e): make the seeded onboarding state authoritative across the relaunch
Chose the seed-authoritative shape over making the core scenario unseeded: an
unseeded core run would discard the completed-onboarding boot path, which is
exactly what the first review in this chain said not to lose, and every release
workflow defaults `win_x64_smoke_mode` to `core`, so that path would stop being
exercised anywhere routine.
Once this run has seeded completion and observed the daemon confirm it, a later
`false` is a regression, never new information about the user:
- `assertSeededOnboardingRetained` raises `PackagedOnboardingSeedError` naming
the cold launch and the data root to check;
- `packagedAppShellPolicy` additionally refuses permission for any run whose
seeded observation is not an explicit `false`, so the loss cannot buy the
landing even if the assertion were bypassed.
The spec asserts the seeded observation exists rather than coercing `'skipped'`,
which would have read as "never seeded" and handed the permissive branch the one
input it must not get.
This may surface a real packaged-runtime bug on the next Windows release run:
the protocol cold launch inherits none of the test process's environment, so if
it resolves a different data root the seed is genuinely gone. Failing there is
the correct outcome, not a reason to loosen the check.
Test Files 1 passed (1)
Tests 36 passed (36)
* test(e2e): pin both packaged launch scenarios as transitions (red)
PerishCode's sixth review on #6481: the run seeds unconditionally, requires the
first reading to be true, and round 5 requires that seed to survive — so
`seededObserved` is always true at the only policy call site. The policy can
only return `acceptOnboardingLanding: false`, and the unseeded unit cases
exercise a state the release smoke can never enter. This head produces a better
error and still fails, still needing `win_x64_smoke_mode: skip`.
Extract the settle loop and the phase around it so the smoke's own transition —
read the daemon fact, hold the seeded state across it, derive the policy, settle
— can be driven with only the I/O faked, then cover both scenarios the packaged
app legitimately has. `runPackagedAppShellPhase` still hardcodes the seeded
assumption, mirroring the unconditional seed, so a genuine first run fails with
the wrong error entirely:
× settles a genuine first run on the cloud sign-in landing
× fails a first run whose renderer never painted either surface
PackagedOnboardingSeedError: the relaunched daemon lost the seeded
onboarding state — check that the protocol cold launch still resolves the
tools-pack runtime data root
Test Files 1 failed (1)
Tests 2 failed | 39 passed (41)
* feat(e2e): cover both packaged launch scenarios in the core Windows smoke
Adds the explicitly unseeded first-run phase the smoke never had, so the
landing-accepting path is exercised by a scenario the release lane can actually
enter rather than only by unit fixtures.
Both behaviours are real product behaviour, not a contradiction:
`shouldRouteToFirstRunOnboarding` (apps/web/src/App.tsx) keys purely on
`onboardingCompleted`, and `connectStepRuntimeReady` (EntryShell.tsx) lets
onboarding complete through cloud sign-in *or* a local CLI *or* a verified BYOK
key. So a user who finished setup and is merely signed out belongs on home,
while a run that never completed onboarding belongs on the cloud sign-in
landing.
Chose separately asserted phases over a second `test(...)`: it reuses the single
install rather than adding a second install/uninstall cycle to the release
critical path, and it keeps the two scenarios adjacent so the contrast is
legible. Phase 1 resets the daemon data root and the Electron user-data
partition, asserts the daemon reports `onboardingCompleted: false`, and requires
the landing; it then clears both again so phase 2's seed lands clean. Phase 1 is
core-only because the full profile needs its controlled updater environment from
first launch.
The settle loop and the phase around it moved into the pure module, so the
transition — read the daemon fact, hold the seeded state across it, derive the
policy, settle — is now driven by tests with only the I/O faked, for both
scenarios and their failure modes.
Test Files 1 passed (1)
Tests 41 passed (41)
* test(e2e): pin the real fresh-install app-config response (red)
PerishCode's seventh review on #6481: round 4 made a missing
`onboardingCompleted` fail closed, round 6 added a scenario that produces
exactly that, and they collide.
`resetPackagedRuntimeDataRoot()` deletes `app-config.json`; `readAppConfig`
returns `{}` on ENOENT (app-config.ts:769) and adds only telemetry defaults, so
a fresh install's `/api/app-config` OMITS the key rather than reporting `false`.
The probe classifies that as malformed, the reader throws, and the first-run
phase never reaches the landing it was added to assert. win.spec.ts already
documented the daemon behaviour and the probe treated it as corruption anyway.
Move interpretation off the reader and onto the scenario (the reader now returns
the raw probe outcome), then add a fixture whose body matches the daemon's
actual fresh reply — `config` with telemetry defaults and no
`onboardingCompleted`. Interpretation is still round 4's, so absent stays
collapsed into malformed:
× settles a first run whose daemon never wrote the key
× still fails a completed user whose key went missing
PackagedOnboardingConfigError: packaged windows daemon onboarding config
could not be established: daemon config carried no boolean
onboardingCompleted (got undefined) (status=200)
Test Files 1 failed (1)
Tests 2 failed | 43 passed (45)
* fix(e2e): separate an absent onboarding key from a corrupt one
Chose representing absence as its own outcome over having the first-run phase
write an explicit `onboardingCompleted: false`. Writing one would make the
phase assert against a state a real fresh install never has — the same
"exercises a state the release smoke can never enter" flaw the previous review
just corrected — and would leave the probe unable to tell a fresh install from
a corrupt config anyway.
The probe now returns a discriminated outcome, and interpretation moved off the
reader and onto the declared scenario:
| outcome | first-run | completed-user |
|-------------------|-----------|----------------|
| transport-failure | reject | reject |
| http-error | reject | reject |
| no-config | reject | reject |
| absent | ACCEPT | reject (seed) |
| malformed | reject | reject |
| reading | accept | accept if true |
`absent` is the only asymmetric row, and deliberately so: a key that was never
written is the honest state of a fresh install, while in a seeded run its
disappearance means the seed vanished — which now raises
`PackagedOnboardingSeedError` naming the cold launch rather than a generic
config fault.
The table lives in the module docblock. Seven review rounds each found a defect
of one family — a fault and an absence sharing a representation — so this is
written down as the fix for the family, not for the instance.
Test Files 1 passed (1)
Tests 45 passed (45)
|
||
|
open-design-crew[bot]
|
809d45f27c |
feat(integrations): add the local Open Design Cloud flow for Codex (#6055)
* feat(daemon): expose Vela login through CLI and MCP * feat(mcp): add interactive local brief card * feat(packaged): bootstrap local MCP headlessly * feat(daemon): secure local BYOK credential profiles * feat(cli): manage secure BYOK profiles * feat(web): store BYOK keys in secure profiles * fix(runs): deduplicate cloud generation requests * feat(daemon): add end-to-end plugin observability * fix(pack): include native PTY runtime in desktop packages Lazy-load node-pty in the daemon so missing native binaries only disable Terminal and interactive Keychain operations instead of crashing startup. Ship and validate target prebuilds in macOS and Windows packages. Repair the macOS spawn helper before signing, and invalidate stale Windows packaging caches. Cover the packaged PTY path in macOS and Windows smoke tests. Require Vela CLI for every beta desktop build target. * fix(mcp): localize and stabilize plugin briefs Keep collect and confirm on one MCP Apps card, report intrinsic size changes, and remove the fragile widget-state fallback. Localize brief forms, summaries, status, and public errors from the current request or Host locale while preserving stable protocol ids and selections. Keep internal runtime identifiers out of user-facing MCP guidance. * fix(packaged): register live Studio URLs with daemon Register the packaged web sidecar loopback origin over namespace-scoped daemon IPC after dynamic binding. Invalidate install-info by the live web port and remove the second MCP URL cache so run and project responses use the current Studio address. Validate loopback origins and cover registration, rebind, and cache refresh. * fix(mcp): stabilize brief confirmation lifecycle Keep confirmed briefs locked after Host publication failures and retry only the cached follow-up message instead of confirming twice. Replace blank initialization with a compact loading state, accept immediate and delayed tool results, and bump the MCP Apps resource to v3 so Codex does not reuse the stale card. Add an executable JSDOM Host bridge harness covering double-submit, publication retry, delayed results, and repeated draft notifications. Validated with the full daemon suite, workspace typecheck, and guard. * fix(mcp): prevent brief app resize feedback loops Replace the self-observed intrinsic-height loop with deduplicated body measurements so Codex MCP app iframes do not repeatedly resize themselves and fail sandbox startup. Bump the brief resource URI to v4 to avoid cached v3 cards and cover the regression with the focused brief-app spec. Validated with daemon tests/build, workspace guard/typecheck, a verified beta DMG, and a direct packaged MCP resource smoke. * fix(mcp): use the final Open Design plugin identity Make open-design the only accepted external plugin ID across MCP tools, run attribution, artifact version origins, and telemetry. Rename the Brief MCP App resource to v5 and reject the unpublished old ID instead of aliasing it. Validated with 171 daemon tests, 5 web tests, daemon/web typechecks, and guard. * chore(pack): bump Vela CLI to 0.0.27 * chore(nix): refresh pnpm dependency hashes * fix(mcp): honor host and plugin request contracts Respect independently advertised MCP Apps capabilities and prefer the Codex-native follow-up bridge so confirmed briefs render as readable user turns instead of context-only messages. Bump the brief resource to v6 to invalidate stale cards.\n\nMark Vela login and account probes as open-world interactions, and require stable request IDs for attributed generation so lost responses cannot create a second logical run. * fix(cli): support keyless BYOK profiles Add an explicit --no-api-key save mode for local and self-hosted providers while keeping credential-bearing profiles stdin-only. Reject missing or conflicting credential modes and cover both paths in the CLI tests. * fix(pack): replace headless owner when desktop opens Advertise headless packaged runtimes as having no visible window, then shut them down before a normal desktop launch continues instead of treating SHOW as a successful focus. Validated with the focused packaged headless and launcher lifecycle tests (20 passed). * fix(pack): clean up failed headless startup Acquire the headless identity, sidecars, and IPC server through one failure-atomic lifecycle so later bootstrap errors close every previously acquired owner in reverse order. Cover MCP-install and web-identity publication failures; validated with 22 focused tests and the packaged typecheck. * fix(byok): remove raw provider request contract Expose only daemon-owned BYOK profile references from shared run types and the web transport, while retaining the daemon's fail-closed rejection for legacy or untyped raw credential payloads. Validated with 76 web provider tests plus web and contracts typechecks. * fix(daemon): preserve interrupted run idempotency Hydrate queued or running durable requests as DAEMON_RESTARTED failures before idempotency reuse, preserving the original request and workflow mappings instead of creating a second cloud operation. Share the restart transition with boot reconciliation and expose synthetic terminal events to reattaching clients. Validated with 48 focused tests and the daemon typecheck. * fix(byok): roll back failed credential metadata writes Snapshot secure-store values before mutation and compensate create, update, and delete operations when profile metadata cannot be persisted, preventing orphaned or lost credentials. Validated with nine focused credential-service tests and the daemon typecheck. * fix(web): reconcile selected BYOK profile metadata Treat the daemon's selected secure profile as authoritative for protocol, endpoint, model, and API version so CLI profile edits cannot leave the browser showing stale execution settings. Validated with 66 config tests and the web typecheck. * fix(byok): migrate legacy credentials before cleanup Import each supported legacy browser credential into a stable daemon-owned secure profile before removing plaintext copies. Keep the original browser record on secure-store or unsupported-provider failures and surface a Settings recovery path. Cover successful migration, duplicate projections, and injected secure-backend failure while preserving existing Bedrock downgrade behavior in memory. * fix(byok): secure Windows profiles with DPAPI Dispatch native Windows BYOK profiles to a CurrentUser DPAPI backend rooted under the resolved daemon data directory. Secrets enter PowerShell only through stdin, encrypted blobs stay separate from non-secret profile metadata, and API responses remain secret-free. Add platform dispatch coverage, a Windows-only real DPAPI round-trip test, and the packaged Windows smoke path for create, resolve, response-redaction, and delete behavior. * fix(web): preserve config writes during hydration * fix(byok): persist secure credentials across entry flows * test(byok): cover secure onboarding persistence --------- Co-authored-by: Cheems <94773058+itscheems@users.noreply.github.com> Co-authored-by: lefarcen <935902669@qq.com> |
||
|
Amy
|
3162da5f23 |
test: cover runtime automation gaps (#5976)
* test: cover runtime automation gaps * fix: remove duplicate runtime startup declarations Generated-By: looper 0.11.0 (runner=fixer, agent=codex) |
||
|
PerishFire
|
0bf1b6d6b8 |
[codex] converge release workflows and stable dry-runs (#4390)
* fix(tools-pack): use junctions for Windows standalone peer deps * fix(desktop): expose IPC during startup * fix(tools-pack): preserve Windows inspect diagnostics * fix(tools-pack): report Windows inspect status errors * fix(packaged): use Electron net fetch for app protocol * fix(packaged): load Windows renderer from web sidecar * fix(desktop): show Windows packaged window during startup * fix(packaged): disable Windows GPU startup * fix(tools-pack): keep Windows core smoke observable * fix(packaged): remove Windows startup probes * fix(tools-pack): trace Windows desktop IPC status * fix(tools-pack): add Windows IPC diagnose loop * fix(release): default beta-s Windows updater feed * chore: clean merged test eof * refactor(release): unify prerelease channel model * chore(release): close prerelease doc escape hatches * refactor(release): converge release channel workflows * fix(release): install toolchain in metadata jobs * fix(release): build release package before contracts * chore(release): bump development version to 0.10.1 * fix(e2e): seed windows packaged smoke runtime config * fix(release): install toolchain for metadata publish * fix(release): materialize betas metadata checkout * chore(release): bump development version to 0.10.2 * fix(release): allow betas metadata cold start from s3 * fix(e2e): support betas packaged update scenarios * fix(release): pass betas channel into packaged smoke * fix(release): set betas channel during self-hosted builds * fix(release): verify counted channel reservations * fix(release): use pnpm cmd for betas windows publish * fix(release): add betas manifest artifact fallback * fix(release): skip beta-s public metadata fetch * fix(release): read beta-s manifests from storage * fix(release): cache beta windows tools-pack builds * fix(release): inline beta mac tools-pack builds * fix(pack): deep sign unsigned mac bundles * docs(pack): document payload-first beta updater validation * fix(release): align preview tools-pack cache flow * fix(release): align prerelease tools-pack cache flow * fix(release): pass github token to prerelease metadata * fix(release): setup pnpm before feishu notify * fix(release): add stable dry-run prepublish flow * fix(release): accept completed prerelease metadata gate * fix(release): require stable release branches * fix(release): converge r2 access checks * fix(updater): use release channel parser for defaults * fix(updater): harden windows payload relaunch * fix(release): converge updater smoke fixture contract * test(e2e): require silent updater fixture output * fix(release): align stable windows smoke build path * fix(ci): include release workspace in validation * fix(ci): repair release validation lanes Generated-By: looper 0.9.10+codex.autoclean (runner=fixer, agent=codex) * fix(ci): restore zero-install Feishu notification Generated-By: looper 0.9.10+codex.autoclean (runner=fixer, agent=codex) --------- Co-authored-by: Looper <looper@noreply.github.com> |
||
|
PerishFire
|
7a1ad1a438 |
feat(packaged): add launcher payload updates (#3812)
* feat(packaged): add launcher payload runtime * ci: focus launcher payload windows smoke * ci: publish beta mac x64 launcher payload * test(e2e): harden payload updater smoke * fix(pack): inject launch config for installed windows smoke * fix(daemon): allow packaged payload resource roots * fix(updater): relaunch after payload update * test(e2e): refresh windows updater UI status * test(e2e): ensure windows smoke reaches main shell * test(e2e): skip onboarding before windows updater smoke * fix(updater): detach windows payload relaunch helper * test(e2e): run payload smoke without updater dry run * fix(desktop): relaunch windows payload updates on quit * fix(updater): preserve installed payload relaunch target * fix(updater): require launcher target for payload updates Generated-By: looper 0.9.5 (runner=fixer, agent=codex) * test(e2e): align mac x64 artifact mode assertion * test(e2e): canonicalize launcher relaunch root * fix(updater): validate launcher payload config before activation Generated-By: looper 0.9.5 (runner=fixer, agent=codex) * fix(updater): require live launcher target for payload updates Generated-By: looper 0.9.5 (runner=fixer, agent=codex) --------- Co-authored-by: Looper <looper@noreply.github.com> |
||
|
PerishFire
|
526c7f7c26 |
Fix packaged auto-update release validation (#2565)
* fix: tighten packaged updater flow * test: prune noisy extended ui coverage * fix: hide unpublished release artifacts * test: validate release updater channels * fix: align prerelease release namespaces |