3 Commits

Author	SHA1	Message	Date
open-design-crew[bot]	809d45f27c	feat(integrations): add the local Open Design Cloud flow for Codex (#6055) ... * feat(daemon): expose Vela login through CLI and MCP * feat(mcp): add interactive local brief card * feat(packaged): bootstrap local MCP headlessly * feat(daemon): secure local BYOK credential profiles * feat(cli): manage secure BYOK profiles * feat(web): store BYOK keys in secure profiles * fix(runs): deduplicate cloud generation requests * feat(daemon): add end-to-end plugin observability * fix(pack): include native PTY runtime in desktop packages Lazy-load node-pty in the daemon so missing native binaries only disable Terminal and interactive Keychain operations instead of crashing startup. Ship and validate target prebuilds in macOS and Windows packages. Repair the macOS spawn helper before signing, and invalidate stale Windows packaging caches. Cover the packaged PTY path in macOS and Windows smoke tests. Require Vela CLI for every beta desktop build target. * fix(mcp): localize and stabilize plugin briefs Keep collect and confirm on one MCP Apps card, report intrinsic size changes, and remove the fragile widget-state fallback. Localize brief forms, summaries, status, and public errors from the current request or Host locale while preserving stable protocol ids and selections. Keep internal runtime identifiers out of user-facing MCP guidance. * fix(packaged): register live Studio URLs with daemon Register the packaged web sidecar loopback origin over namespace-scoped daemon IPC after dynamic binding. Invalidate install-info by the live web port and remove the second MCP URL cache so run and project responses use the current Studio address. Validate loopback origins and cover registration, rebind, and cache refresh. * fix(mcp): stabilize brief confirmation lifecycle Keep confirmed briefs locked after Host publication failures and retry only the cached follow-up message instead of confirming twice. Replace blank initialization with a compact loading state, accept immediate and delayed tool results, and bump the MCP Apps resource to v3 so Codex does not reuse the stale card. Add an executable JSDOM Host bridge harness covering double-submit, publication retry, delayed results, and repeated draft notifications. Validated with the full daemon suite, workspace typecheck, and guard. * fix(mcp): prevent brief app resize feedback loops Replace the self-observed intrinsic-height loop with deduplicated body measurements so Codex MCP app iframes do not repeatedly resize themselves and fail sandbox startup. Bump the brief resource URI to v4 to avoid cached v3 cards and cover the regression with the focused brief-app spec. Validated with daemon tests/build, workspace guard/typecheck, a verified beta DMG, and a direct packaged MCP resource smoke. * fix(mcp): use the final Open Design plugin identity Make open-design the only accepted external plugin ID across MCP tools, run attribution, artifact version origins, and telemetry. Rename the Brief MCP App resource to v5 and reject the unpublished old ID instead of aliasing it. Validated with 171 daemon tests, 5 web tests, daemon/web typechecks, and guard. * chore(pack): bump Vela CLI to 0.0.27 * chore(nix): refresh pnpm dependency hashes * fix(mcp): honor host and plugin request contracts Respect independently advertised MCP Apps capabilities and prefer the Codex-native follow-up bridge so confirmed briefs render as readable user turns instead of context-only messages. Bump the brief resource to v6 to invalidate stale cards.\n\nMark Vela login and account probes as open-world interactions, and require stable request IDs for attributed generation so lost responses cannot create a second logical run. * fix(cli): support keyless BYOK profiles Add an explicit --no-api-key save mode for local and self-hosted providers while keeping credential-bearing profiles stdin-only. Reject missing or conflicting credential modes and cover both paths in the CLI tests. * fix(pack): replace headless owner when desktop opens Advertise headless packaged runtimes as having no visible window, then shut them down before a normal desktop launch continues instead of treating SHOW as a successful focus. Validated with the focused packaged headless and launcher lifecycle tests (20 passed). * fix(pack): clean up failed headless startup Acquire the headless identity, sidecars, and IPC server through one failure-atomic lifecycle so later bootstrap errors close every previously acquired owner in reverse order. Cover MCP-install and web-identity publication failures; validated with 22 focused tests and the packaged typecheck. * fix(byok): remove raw provider request contract Expose only daemon-owned BYOK profile references from shared run types and the web transport, while retaining the daemon's fail-closed rejection for legacy or untyped raw credential payloads. Validated with 76 web provider tests plus web and contracts typechecks. * fix(daemon): preserve interrupted run idempotency Hydrate queued or running durable requests as DAEMON_RESTARTED failures before idempotency reuse, preserving the original request and workflow mappings instead of creating a second cloud operation. Share the restart transition with boot reconciliation and expose synthetic terminal events to reattaching clients. Validated with 48 focused tests and the daemon typecheck. * fix(byok): roll back failed credential metadata writes Snapshot secure-store values before mutation and compensate create, update, and delete operations when profile metadata cannot be persisted, preventing orphaned or lost credentials. Validated with nine focused credential-service tests and the daemon typecheck. * fix(web): reconcile selected BYOK profile metadata Treat the daemon's selected secure profile as authoritative for protocol, endpoint, model, and API version so CLI profile edits cannot leave the browser showing stale execution settings. Validated with 66 config tests and the web typecheck. * fix(byok): migrate legacy credentials before cleanup Import each supported legacy browser credential into a stable daemon-owned secure profile before removing plaintext copies. Keep the original browser record on secure-store or unsupported-provider failures and surface a Settings recovery path. Cover successful migration, duplicate projections, and injected secure-backend failure while preserving existing Bedrock downgrade behavior in memory. * fix(byok): secure Windows profiles with DPAPI Dispatch native Windows BYOK profiles to a CurrentUser DPAPI backend rooted under the resolved daemon data directory. Secrets enter PowerShell only through stdin, encrypted blobs stay separate from non-secret profile metadata, and API responses remain secret-free. Add platform dispatch coverage, a Windows-only real DPAPI round-trip test, and the packaged Windows smoke path for create, resolve, response-redaction, and delete behavior. * fix(web): preserve config writes during hydration * fix(byok): persist secure credentials across entry flows * test(byok): cover secure onboarding persistence --------- Co-authored-by: Cheems <94773058+itscheems@users.noreply.github.com> Co-authored-by: lefarcen <935902669@qq.com>	2026-07-30 02:00:56 +00:00
PerishFire	a2ba3ee2ad	feat(updater): manual cache clear, installer-reinstall floor, and crash-recovery lifecycle (#6032) ... * feat(updater): manual cache clear + installer-reinstall floor on the installed outer version Two disaster-recovery capabilities for the packaged updater: - Reuse control.launcher.version.min properly: the gate now compares the physically installed outer package version (read at check time from the outer bundle's open-design-config.json via the launcher launch path; OD_UPDATE_INSTALLED_VERSION overrides for tests), not the running payload version. When the floor trips - or min is set but the outer version is unreadable (conservative) - the updater selects the installer artifact and offers a same-version installer reinstall when no newer release exists (clamped to min <= candidate so the offer always converges). The status snapshot carries a reinstall block {reason, installedVersion, minVersion, url}; UpdateDialog/UpdaterPopup render reinstall copy with an optional operator jump link. tools-release publish-metadata publishes the block from RELEASE_LAUNCHER_VERSION_MIN(_URL) (per-channel repo vars with a _STABLE fallback wired in all release workflows) and hard-fails when min exceeds the release version; verify-metadata re-checks the published block and summary-metadata surfaces the floor. - Manual clear-cache action (od:update:clear-cache IPC, sidecar clear-cache action, Settings > About row with a two-stage inline confirm): resets one-shot update state (downloaded release, install freeze) back to idle, purges releases/staging/downloads/.back, removes a stale launcher attempt.json plus any non-confirmed desktop-handoff journal, and deletes non-retained payload versions. Runtime active/lastSuccessful versions, retained cleanup entries, install.json, and a confirmed handoff journal are never touched; locked files defer through the existing cleanup.json retry machinery. Also: tools-pack --update-action now validates through sidecar-proto's exported isDesktopUpdateAction so clear-cache reaches the ops surface; tools-serve updater fixture gains control min/url knobs and CLI flags; 9 new i18n keys across all 19 locales; tools/pack/AGENTS.md documents the gate semantics and clear-cache boundaries. Validated locally per the updater matrix (desktop/web/tools-serve/tools-pack suites, guard, typechecks) plus a mac release-beta closed loop: platform full spec, same-version reinstall against a real outer/payload version split, clear-cache recovery, and a real-feed payload update to 0.15.1-beta.4. * test(updater): close Windows recovery acceptance * test(updater): mirror Windows same-version reinstall recovery on the mac lane Port the Windows runSameVersionUpdaterRecoveryAcceptance shape into the mac full profile: after the payload cold-start acceptance, restart the packaged app against a fixture publishing an installed-outer floor at the running payload version and assert the same-version installer reinstall snapshot (reason/installedVersion/minVersion/url), the popup reinstall learn-more link, clear-cache back to idle with launcher pointers untouched, explicit re-check recovery, and the installer open in dry-run mode — macOS has no silent DMG install to execute, unlike the Windows NSIS transaction lane. Extends the popup eval expression/validator with reinstallLinkVisible and records an updaterRecovery block in the smoke summary. Full-profile test timeout raised 240s -> 360s for the extra app restart. Validated locally: release-smoke full profile green in 80s with the recovery summary populated (reinstall block exact, cleared idle, recovered dmg, dryRun install). * refactor(release): centralize launcher version floor channel policy in one resolver Channel policy for control.launcher.version.{min,url} is now managed as one repo-vars pair per channel (RELEASE_LAUNCHER_VERSION_MIN[_URL]_<CHANNEL>). Workflows pass the channel pair plus the STABLE pair through verbatim — the || fallback expressions are gone from YAML — and the shared resolver in tools/release/src/storage/launcher-version-floor.ts owns resolution and validation: pair-level stable fallback for non-stable channels (never mixing one channel's min with another's url), version format, http(s) url, orphan url rejection, and the floor <= releaseVersion guard. publish-metadata and verify-metadata consume the same resolver, so verify re-derives the expected block from the same channel policy instead of trusting a pre-resolved env. release-workflows.test.ts pins the verbatim passthrough keys in all five release lanes and rejects any reintroduced YAML fallback. * feat(updater): let clear-cache rebuild a provably-owned corrupt update store A corrupt store is one of the blocking scenarios the manual clear exists to recover from, yet the action previously bailed on the very store errors it should heal. clear-cache now rebuilds the update root when — and only when — ownership is provable: the current-generation sentinel is the proof, and everything else inside an owned root is updater cache by definition. Roots without a sentinel, with a foreign-generation marker, or failing IO are never touched; the original store error surfaces unchanged. Four specs pin the boundary (corrupt metadata rebuilt, stray entries rebuilt, unowned root refused with files intact, foreign-generation marker refused). * fix(launcher): pre-arm delegated payload launches so pre-bookkeeping crashes roll back A payload that spawned successfully but died before reaching its own launcher bookkeeping left no attempt.json behind, so every later cold start re-selected the same broken active pointer and re-delegated to the dead payload — a permanent dead loop the installer fallback could never surface (found while designing the crash-rollback acceptance). The delegating parent now arms attempt.json BEFORE spawning the payload and passes the pointer as --od-launcher-delegated-* argv. Selection gains an active-delegated reason: an attempt matching active AND the delegated pointer is the launch in progress, not a previous failure; only an exact active match qualifies, so a stale pointer cannot defeat the rollback. Rollback (last-successful) delegations deliberately carry no marker and never re-arm — the attempt on disk IS the rollback evidence the child must re-derive. Covered end to end: packaged outer delegation pre-arms (and skips pre-arm on rollback), the updater's payload activation pre-arms and threads the pointer through the deferred relaunch, and confirm clears the attempt for delegated launches. launcher-proto 18, packaged 237, desktop 264 all green. * fix(updater): scrub a stale payload install freeze after a rollback A payload install freezes the updater with installResult.activeVersion awaiting the relaunch. When that payload crashed and the launcher rolled back, the app restarts on the OLD version with the freeze still persisted — every later check became a frozen no-op, so a rolled-back install never saw another update offer (the crash-rollback acceptance exposed this in its self-heal phase). Cold-start restore now detects the broken promise — installResult.activeVersion newer than the running version on a live process — and drops the freeze and stale install result while keeping the verified downloaded release actionable. The installer-artifact freeze (no activeVersion) keeps its existing restore semantics. Red spec: 'clears a stale payload install freeze when the promised relaunch never became the running version'. * test(updater): full-lifecycle acceptance — silent startup, crash rollback, coverage map Two new packaged acceptance tests on both platform lanes (mac validated locally; win symmetric for the Windows box): - 'applies a downloaded payload silently on the next cold start': enables the daemon-owned allowSilentUpdates through the production GET+PUT /api/app-config path, restarts, and asserts the first scheduler tick installs, quits, and relaunches with converged pointers — no updater action issued. - 'rolls back a crashing payload and self-heals on the next good update': repacks the real payload archive with a crash-before-bookkeeping stub (mac: shebang script via ditto; win: a real executable — System32 where.exe — via the installed app's bundled 7z, since a script cannot stand in for an exe), drives the update through the popup, asserts the pre-armed attempt survives the crash as rollback evidence, cold-starts into the rolled-back base version (degraded steady state pinned: broken pointer stays active with its attempt), then self-heals via a version-bumped healthy payload — real recovery releases ship as version+1. Spec hygiene: resetPackagedRuntimeState wipes launcher/runtime/daemon state before each lifecycle test (uninstall keeps runtime data by design, and leftover pointers silently delegate fresh installs onto stale payloads); mac waitForHealthyDesktopVersion gains win's requireSettledLauncher opt-out for rollback waits. docs/testing/updater-lifecycle.md is the new lifecycle-to-test coverage map (incl. deliberate manual-only nodes), linked from tools/pack/AGENTS.md and the e2e coverage status doc. * fix(updater): harden Windows full-lifecycle acceptance * test(release): make channel-prepare hermetic against local git tags prepare-preview derives its latest-stable floor from the clone's real open-design-v* tags, so the channel-prepare tests were green on tagless CI checkouts but permanently red on any developer clone once shipped stable tags advanced past main's package version (0.15.1 vs v0.15.1/v0.16.0 today). The spawned scripts now run with GIT_DIR pointing at a throwaway repo holding exactly the tags each test declares, and a new negative case pins the floor rejection itself (packaged version below a v99.0.0 stable tag). * test(e2e): model delegated payload launch Pass the updater's pre-armed payload pointer into the cross-runtime launcher simulation so it represents the spawned payload process instead of a later crash-recovery launch. Generated-By: looper 0.11.0 (runner=fixer, agent=codex) * test(web): wait for question form readiness Wait for the asynchronously derived submit-disabled state before asserting it, removing the suite-order race observed by the Web workspace tests check. Generated-By: looper 0.11.0 (runner=fixer, agent=codex) * fix(updater): preserve recovery state across locks and restarts Generated-By: looper 0.11.0 (runner=fixer, agent=codex) --------- Co-authored-by: Looper <looper@noreply.github.com>	2026-07-24 05:18:48 +00:00
PerishFire	0bf1b6d6b8	[codex] converge release workflows and stable dry-runs (#4390) ... * fix(tools-pack): use junctions for Windows standalone peer deps * fix(desktop): expose IPC during startup * fix(tools-pack): preserve Windows inspect diagnostics * fix(tools-pack): report Windows inspect status errors * fix(packaged): use Electron net fetch for app protocol * fix(packaged): load Windows renderer from web sidecar * fix(desktop): show Windows packaged window during startup * fix(packaged): disable Windows GPU startup * fix(tools-pack): keep Windows core smoke observable * fix(packaged): remove Windows startup probes * fix(tools-pack): trace Windows desktop IPC status * fix(tools-pack): add Windows IPC diagnose loop * fix(release): default beta-s Windows updater feed * chore: clean merged test eof * refactor(release): unify prerelease channel model * chore(release): close prerelease doc escape hatches * refactor(release): converge release channel workflows * fix(release): install toolchain in metadata jobs * fix(release): build release package before contracts * chore(release): bump development version to 0.10.1 * fix(e2e): seed windows packaged smoke runtime config * fix(release): install toolchain for metadata publish * fix(release): materialize betas metadata checkout * chore(release): bump development version to 0.10.2 * fix(release): allow betas metadata cold start from s3 * fix(e2e): support betas packaged update scenarios * fix(release): pass betas channel into packaged smoke * fix(release): set betas channel during self-hosted builds * fix(release): verify counted channel reservations * fix(release): use pnpm cmd for betas windows publish * fix(release): add betas manifest artifact fallback * fix(release): skip beta-s public metadata fetch * fix(release): read beta-s manifests from storage * fix(release): cache beta windows tools-pack builds * fix(release): inline beta mac tools-pack builds * fix(pack): deep sign unsigned mac bundles * docs(pack): document payload-first beta updater validation * fix(release): align preview tools-pack cache flow * fix(release): align prerelease tools-pack cache flow * fix(release): pass github token to prerelease metadata * fix(release): setup pnpm before feishu notify * fix(release): add stable dry-run prepublish flow * fix(release): accept completed prerelease metadata gate * fix(release): require stable release branches * fix(release): converge r2 access checks * fix(updater): use release channel parser for defaults * fix(updater): harden windows payload relaunch * fix(release): converge updater smoke fixture contract * test(e2e): require silent updater fixture output * fix(release): align stable windows smoke build path * fix(ci): include release workspace in validation * fix(ci): repair release validation lanes Generated-By: looper 0.9.10+codex.autoclean (runner=fixer, agent=codex) * fix(ci): restore zero-install Feishu notification Generated-By: looper 0.9.10+codex.autoclean (runner=fixer, agent=codex) --------- Co-authored-by: Looper <looper@noreply.github.com>	2026-06-23 06:13:21 +00:00