mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
Compare commits
66
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
b7d388a39c | ||
|
dependabot[bot]
|
259225ac61 | ||
|
dependabot[bot]
|
cb5953bbb8 | ||
|
J3vbandClaude Opus 5
|
0ccb42932c | ||
|
dependabot[bot]
|
b1bea96fc8 | ||
|
J3vbandClaude
|
9df0e63b5f | ||
|
J3vbandClaude Fable 5
|
c22bc14946 | ||
|
J3vbandClaude
|
5202e3fe1e | ||
|
J3vbandClaude Fable 5
|
d880b64d64 | ||
|
J3vbandClaude Fable 5
|
03fcb7d518 | ||
|
J3vbandClaude
|
312ac4bbf4 | ||
|
J3vbandClaude Fable 5
|
eacba10cff | ||
|
J3vbandClaude Fable 5
|
c86d803a18 | ||
|
J3vbandClaude Opus 5
|
8cf019c03f | ||
|
J3vbandClaude Opus 5
|
5d6167a4d3 | ||
|
J3vbanddependabot[bot]
|
21945fb809 | ||
|
J3vbandClaude Opus 5
|
39551de4a6 | ||
|
J3vbandClaude Opus 5
|
7f87be6306 | ||
|
J3vbandClaude
|
36be31db43 | ||
|
J3vbandClaude Opus 5
|
d6c768cb90 | ||
|
J3vbandClaude Opus 5
|
150c6c42f4 | ||
|
J3vbandClaude Fable 5
|
6a26f2a839 | ||
|
J3vbandClaude Fable 5
|
a366160dc8 | ||
|
J3vbandClaude Fable 5
|
fb04a579c4 | ||
|
J3vbandClaude Fable 5
|
fb4329dd94 | ||
|
J3vbandClaude Fable 5
|
f5faf82a60 | ||
|
J3vbandClaude Opus 5
|
ea0430c5b0 | ||
|
J3vbandClaude
|
b8b7a2a1f9 | ||
|
J3vbandClaude Opus 5
|
079f59d06d | ||
|
J3vbandClaude Fable 5
|
8787b9066d | ||
|
J3vbandClaude Fable 5
|
7be9ccd2f9 | ||
|
J3vbandClaude Fable 5
|
8579cb5d91 | ||
|
J3vb
|
db0275a290 | ||
|
J3vbandClaude
|
c3837fa32c | ||
|
J3vbandClaude Fable 5
|
b1fb56511d | ||
|
J3vbandClaude Fable 5
|
fa50d85413 | ||
|
J3vbandClaude Opus 4.8
|
34f2e41207 | ||
|
J3vbandClaude Opus 5
|
3af3489f71 | ||
|
dependabot[bot]
|
74af0a56b2 | ||
|
dependabot[bot]
|
b9d5d40e45 | ||
|
dependabot[bot]
|
32e2a93f3b | ||
|
J3vb
|
6d964164b5 | ||
|
J3vbandClaude Opus 5
|
a39cd8e23c | ||
|
J3vbandClaude Opus 5
|
0594a130cb | ||
|
J3vbanddependabot[bot]
|
a29e28d018 | ||
|
J3vbandClaude Opus 5
|
9009fbc584 | ||
|
J3vbandClaude Opus 5
|
ba4e689b25 | ||
|
J3vbandClaude Opus 5
|
ad0448df4d | ||
|
J3vbandClaude
|
d3526968bb | ||
|
J3vbandClaude Opus 5
|
82be103794 | ||
|
J3vbandClaude Opus 5
|
4ff199e14f | ||
|
dependabot[bot]
|
b77c2790b0 | ||
|
dependabot[bot]
|
931a2fd27e | ||
|
J3vbandClaude Opus 5
|
1486078265 | ||
|
dependabot[bot]
|
3f8a26c904 | ||
|
dependabot[bot]
|
4a3b4e0cff | ||
|
dependabot[bot]
|
15db18a3ac | ||
|
dependabot[bot]
|
4582a601b3 | ||
|
dependabot[bot]
|
a3d03620e5 | ||
|
dependabot[bot]
|
5df58bb9c4 | ||
|
dependabot[bot]
|
4bda86d0cb | ||
|
dependabot[bot]
|
6e841cc75f | ||
|
dependabot[bot]
|
d9c6094b5f | ||
|
dependabot[bot]
|
4fa8f6f84d | ||
|
dependabot[bot]
|
b854f5a986 | ||
|
dependabot[bot]
|
3c78bcd2b2 |
@@ -0,0 +1 @@
|
||||
{}
|
||||
@@ -0,0 +1,352 @@
|
||||
---
|
||||
name: bughunt-run
|
||||
description: Run a bug hunt and turn its findings into committed fixes. Use when starting a hunt, resuming one, or fixing findings already in the ledger. Covers the ledger handoff between the bughunt and bughunt-fix workflows.
|
||||
---
|
||||
|
||||
# Running the bughunt pipeline
|
||||
|
||||
Two workflows with a human gate between them. The ledger at
|
||||
`.superpowers/findings-ledger.json` is the interface. Both workflows are pure
|
||||
functions of their `args` — **the session does all file I/O**, because workflow
|
||||
scripts have no filesystem access.
|
||||
|
||||
`.superpowers/` is gitignored. This repo is public and unfixed defects must never
|
||||
reach a commit, an issue, or a PR body.
|
||||
|
||||
## 1. Hunt
|
||||
|
||||
**Launch the hunt from a turn that carries a token-budget directive** (recommended:
|
||||
`+25M`, comfortably above a full coverage run's ~8-12M). The workflow's cost ceiling is gated
|
||||
on `budget.total`, which is null without a directive — a directive-less run has **no
|
||||
ceiling at all**. The workflow's first log line echoes the state: `budget=25M` means
|
||||
armed; `budget=NONE - cost ceiling disarmed` means stop the run and relaunch with a
|
||||
directive.
|
||||
|
||||
Before launching, in order:
|
||||
|
||||
1. **Build the inventory**: `node .superpowers/rank-explore.mjs` — writes
|
||||
`.superpowers/explore-ranking.json`: EVERY non-test source file (~419 rows), each with
|
||||
`examined` (already carries a ledger finding or a LIVE explored-clean record → the hunt
|
||||
pre-seeds its covered set), `risky` (top coupling ∪ past-bug clusters ∪ top churn,
|
||||
capped at 40 → they get an extra pass through all 5 bug-class lenses), and `churn`.
|
||||
Explored-clean records carry content hashes: editing a file expires its clean record,
|
||||
so re-runs automatically re-hunt what changed. The hunt cannot stop while any inventory
|
||||
file is uncovered, so a full run now takes ~10-20 rounds and ~8-12M tokens — the `+25M`
|
||||
directive still covers it. Regenerate the inventory and read `known` from the ledger in
|
||||
the SAME session step: both derive from `findings-ledger.json`, and every `known` file
|
||||
must be `examined` in the inventory — a `known` file the inventory does not mark
|
||||
examined can never be drawn (the seen-filter blocks it) nor covered, which would
|
||||
strand `uncoveredCount()` above zero and block convergence.
|
||||
2. Read the ledger and pass every record in as `known`, so the hunt does not
|
||||
re-derive anything already found, fixed, declined, or refuted.
|
||||
|
||||
```
|
||||
Workflow({
|
||||
name: "bughunt",
|
||||
args: {
|
||||
known: <every record from findings-ledger.json, as {file, line, title, status}>,
|
||||
graph: <the rows of .superpowers/explore-ranking.json>,
|
||||
lenses: [ {key, prompt}, ... ], // optional: scope the hunt to one subsystem
|
||||
maxRounds: 30, // safety backstop only - coverage + dry is the real stop
|
||||
dryThreshold: 2,
|
||||
},
|
||||
})
|
||||
```
|
||||
|
||||
If `graph` is omitted or empty the hunt logs
|
||||
`explore: args.graph absent/empty - falling back to churn-based fresh eyes` and
|
||||
still runs — degraded targeting, never a smaller lens family.
|
||||
|
||||
`converged: true` now means: every inventory file was covered by a completed
|
||||
explicit-file lens (or carries a verdict), the risky class sweep ran, and then
|
||||
`dryThreshold` consecutive eligible rounds confirmed nothing (a round where the
|
||||
lens family comes up empty with the pool drained counts as dry — family
|
||||
`exhausted`). Rows without the `examined` field fall back to the old
|
||||
quietness-only stop. Two new run outcomes: `stalledCoverage: true` means adaptive
|
||||
rounds stopped shrinking the uncovered pool (usually mass finder failures —
|
||||
investigate before re-running); a budget stop now reports
|
||||
`coverage.uncoveredAtStop` so the next run knows exactly what remains (re-run
|
||||
with the ledger as `known`; live explored-clean records pre-cover what was
|
||||
finished, so the sweep naturally continues where it stopped).
|
||||
|
||||
Omit `lenses` for a general hunt across the rotating families.
|
||||
|
||||
**Scoping a hunt while coverage mode is armed is a budget trap:** `lenses` only
|
||||
replaces round 1, and inventory rows with `examined` force the coverage stop
|
||||
rule — from round 2 the run sweeps the ENTIRE uncovered pool and the risky
|
||||
sweep before it may converge, at general-hunt cost. For a true scoped hunt,
|
||||
pass a subsystem-filtered inventory as `graph` (only the rows you want swept),
|
||||
or rows without the `examined` field to fall back to the legacy quietness-only
|
||||
stop.
|
||||
|
||||
Each lens object is `{key, prompt}`. `key` must match `^[a-z0-9-]+$` —
|
||||
lowercase letters, digits, and hyphens only. Keys get interpolated into agent
|
||||
labels of the form `r<N>:hunt:<key>:<model>`, and a key containing uppercase,
|
||||
dots, or spaces breaks label parsing. A lens missing `key` or `prompt` is not
|
||||
validated — it reaches the finder prompt as the literal string `undefined`,
|
||||
silently degrading that lens instead of failing loudly. Check your lens
|
||||
objects before passing them.
|
||||
|
||||
When it returns, first save the raw result verbatim to
|
||||
`.superpowers/hunts/<YYYY-MM-DD>-raw.json`, then:
|
||||
|
||||
```bash
|
||||
node .superpowers/render-run-stats.mjs .superpowers/hunts/<YYYY-MM-DD>-raw.json <hunt-name>
|
||||
```
|
||||
|
||||
This validates the result shape, appends the run's telemetry to
|
||||
`.superpowers/run-history.json`, updates `.superpowers/explored-clean.json`, and
|
||||
checks **every** confirmed finding's coordinates against the working tree (file
|
||||
exists, line within length — the report agent that used to spot-check two findings
|
||||
is gone). Resolve any `COORD` warnings before appending to the ledger: stale
|
||||
coordinates poison `bughunt-fix`.
|
||||
|
||||
Then append each entry of `result.confirmed` to the ledger with
|
||||
`status: "open"`, an id from `nextId`, and today's date. Bump `nextId`. The
|
||||
incoming record carries a prose `fix` field (bughunt's suggested remedy) —
|
||||
rename it to `suggestedFix` when appending, so the ledger's `fix` field starts
|
||||
as `null` and is free for `bughunt-fix` to fill in with `{commit, test,
|
||||
revertProof}` once something is actually fixed. Then:
|
||||
|
||||
```bash
|
||||
node .superpowers/render-ledger.mjs
|
||||
```
|
||||
|
||||
Each confirmed record carries `finder: "opus"`. The dual-model finder panel was
|
||||
retired 2026-08-12: attribution over the only measured run priced sonnet's unique
|
||||
yield (1 high, 4 medium, 9 low) at roughly a third of the run's agents. The known
|
||||
cost: with one finder, a lazy-but-non-null finder round can read as "clean" where
|
||||
the panel required both models to agree it was. Watch `runStats` — per-lens
|
||||
candidate counts make an anomalously empty lens visible after the fact.
|
||||
|
||||
## 2. Gate (human)
|
||||
|
||||
Generate the readable rendering, then read it — it is gitignored, so a fresh
|
||||
clone has no copy until you make one:
|
||||
|
||||
```bash
|
||||
node .superpowers/render-ledger.mjs # writes .superpowers/FINDINGS.md
|
||||
```
|
||||
|
||||
Mark anything you do not want fixed as `declined` with a rationale — declined
|
||||
findings are fed back into the next hunt's prompts and never re-reported. Edit
|
||||
`findings-ledger.json` to do that, not the rendering.
|
||||
|
||||
## 3. Fix
|
||||
|
||||
```
|
||||
Workflow({
|
||||
name: "bughunt-fix",
|
||||
args: {
|
||||
findings: <records with status "open" from findings-ledger.json>,
|
||||
branch: "fix/bughunt-YYYY-MM-DD",
|
||||
only: ["OC-0042"], // optional
|
||||
maxSeverity: "medium", // optional
|
||||
circuitBreaker: { threshold: 0.5, minAttempts: 3 }, // optional; false to disable
|
||||
},
|
||||
})
|
||||
```
|
||||
|
||||
Create and check out the branch first — the workflow commits to whatever branch
|
||||
is current and does not create one.
|
||||
|
||||
### Composing the batch
|
||||
|
||||
The workflow clusters findings by the file the BUG is in, but its same-run
|
||||
overlap guard fires on the files the FIX touches. Compose the batch so the two
|
||||
can never disagree:
|
||||
|
||||
- **Close over the file relation.** Pull in every open finding that shares a
|
||||
file with anything already selected, regardless of severity — a same-file
|
||||
finding left behind is a future cross-cluster block.
|
||||
- **Re-check coordinates against the working tree** (file exists, line within
|
||||
length) before launching. render-run-stats checked them at hunt time only;
|
||||
merges since then can stale them.
|
||||
- **Scan fix-touchpoints, then read only the hits.** Token-scan each finding's
|
||||
`suggestedFix`/`why` for path-like tokens owned by another cluster, then read
|
||||
just the flagged records to separate evidence citations from actual fix
|
||||
edits — the scan over-predicts (a measured run: 6 flagged, 1 real). True
|
||||
collisions go into **sequential waves**: launch the later wave after the
|
||||
earlier wave's commits land, and the same-run guard never fires. Batch 4
|
||||
skipped this and self-blocked 20/27 findings; batch 6 ran it and blocked
|
||||
zero.
|
||||
|
||||
### Security findings
|
||||
|
||||
Fixed security findings ship in normal PRs at this project's stage (alpha,
|
||||
~zero external deployments): the fix and its disclosure land atomically.
|
||||
Commit subjects and PR text describe the fix, never the exploit — no
|
||||
severity labels, repro steps, or attack narratives in public text — and a
|
||||
release should follow soon after merge. The GHSA advisory route is reserved
|
||||
for coordinated disclosure once there is a real deployed user base. Never
|
||||
decline a finding merely for routing.
|
||||
|
||||
## When a run trips the breaker
|
||||
|
||||
The run stops early if more than `threshold` of attempted findings fail, once at
|
||||
least `minAttempts` have been tried. `declined` never counts as a failure — a run
|
||||
where several findings are correctly declined is a good run. There are two trip
|
||||
points: the fix stage (before any prove agent runs) and inside the prove loop.
|
||||
|
||||
**A tripped run means stop and investigate, do not re-run.** The usual causes are
|
||||
being on the wrong branch, a broken test runner, or ledger coordinates gone stale
|
||||
after a rebase. Re-running without fixing the cause just spends the budget again.
|
||||
|
||||
**Re-verify a blocked finding against HEAD before fixing it.** A deferred item
|
||||
ages against a moving codebase: later hunts routinely fix a blocked finding as a
|
||||
side effect of an overlapping sibling, and a saved debris patch stops applying
|
||||
once a refactor rewrites the files it touched. Check the _mechanism_ still exists
|
||||
at HEAD, not just the line coordinates. If it is already covered, mark it fixed
|
||||
with a pointer to the covering commit instead of re-fixing it. Of 6 findings
|
||||
blocked on 2026-08-14, 2 were already fixed 5 days later and the debris patch no
|
||||
longer applied at all.
|
||||
|
||||
Findings from clusters the run never reached come back `blocked` with a rationale
|
||||
naming the breaker. Set those back to `open` once the underlying problem is fixed
|
||||
— they were never attempted. Their edits are sitting uncommitted in the working
|
||||
tree, so the debris warning above applies to them too.
|
||||
|
||||
Whatever committed before the trip still goes through the gate, so `result.gate`
|
||||
tells you whether those commits are green.
|
||||
|
||||
When it returns, for each entry in `result.results`:
|
||||
|
||||
- `fixed` → status `fixed`, `fix: {commit, test, revertProof: "self-reported"}`
|
||||
using the matching `result.commits` entry — the prove agent's own report, not
|
||||
yet independently checked (see step 4)
|
||||
- `declined` → status `declined`, copy the rationale
|
||||
- `blocked` → status `blocked` (not `open`), record the rationale; these failed
|
||||
their revert-proof, tripped the cross-cluster overlap guard, or their agent
|
||||
died, and want a human. Do NOT leave them `open` — `bughunt-fix` only picks up
|
||||
`open` findings, so `open` would silently re-enter one of these into the next
|
||||
fix run, exactly the retry loop the design deliberately excludes ("one human
|
||||
look beats three agent attempts").
|
||||
|
||||
Ledger writes select records by id or `fix.commit` — never by date fields,
|
||||
which collide when two batches reconcile on the same day — and every bulk
|
||||
mutation asserts its expected match count before writing (a same-day sibling
|
||||
batch once inflated a 29-record update to 44 matches; only the count
|
||||
assertion caught it).
|
||||
|
||||
Check `result.gate`. A failed gate leaves the commits in place on the branch —
|
||||
fix it yourself, do not re-run the workflow over it.
|
||||
|
||||
A fix that tightens a guard and fails ONLY e2e/CI while unit tests and local
|
||||
gates stay green is usually a test-infrastructure defect, not a bad fix:
|
||||
triage the mock/harness first. Check that mock echoes carry the same fields
|
||||
the real server sends (real channel ids, not sentinels), and never assert
|
||||
broadcast delivery on a socket the same operation force-closes. Mocks
|
||||
calibrated against lenient code silently decay into lies — every
|
||||
guard-tightening fix is also a fidelity audit of the mocks that exercise it.
|
||||
The Playwright trace's console stream (grep the .trace file for the app's log
|
||||
lines) locates the mechanism in minutes.
|
||||
|
||||
## 4. Verify the fixes independently — REQUIRED
|
||||
|
||||
The workflow's prove agent _self-reports_ that each test went RED with the fix
|
||||
reverted. Nothing inside the workflow can verify that: workflow scripts have no
|
||||
filesystem access. You do. Run the independent proof over every commit the
|
||||
workflow made:
|
||||
|
||||
```bash
|
||||
node .superpowers/verify-fixes.mjs <sha> <sha> ...
|
||||
```
|
||||
|
||||
It reverse-applies each commit's own source diff onto the current tree, runs
|
||||
that commit's tests, and requires them to FAIL — then restores to HEAD and
|
||||
requires them to PASS. This is the only check in the pipeline no agent can
|
||||
fabricate. The reverse-apply/restore-to-HEAD shape is load-bearing for
|
||||
**stacked waves**: sequential waves pile commits onto shared files, and an
|
||||
older per-commit-snapshot restore silently corrupts every later verification
|
||||
(a mid-branch snapshot left in the tree once made a whole package
|
||||
uncompilable for five subsequent runs). Rust commits with in-file
|
||||
`#[cfg(test)]` tests fail the file-level source/test split entirely — prove
|
||||
those by hand at hunk level, splitting at the `mod tests` boundary.
|
||||
|
||||
While it runs it checkouts and restores source files, so the working tree is
|
||||
not a stable read surface: anything reading concurrently — review agents,
|
||||
scanners, hooks — must read committed objects (`git show HEAD:<path>`) or
|
||||
pre-taken snapshots, and any live-tree scanner finding from that window needs
|
||||
re-verification against HEAD before it is believed.
|
||||
|
||||
Any `FAIL ... VACUOUS TEST` means the fix was committed behind a test that
|
||||
proves nothing. Revert that commit and set its findings back to `open`; do not
|
||||
talk yourself into keeping it because the code change looks right.
|
||||
|
||||
Two classes are exempt from the insta-revert, both artifacts of the verifier
|
||||
choosing the wrong detector rather than of a vacuous test:
|
||||
|
||||
- **Race/deadlock-class fixes** whose test only fails under its detector.
|
||||
verify-fixes escalates to `-race` before declaring vacuity; if an older copy
|
||||
reports VACUOUS on such a fix, re-prove red/green by hand under the class's
|
||||
detector (`go test -race ./<pkg>/`) before reverting anything.
|
||||
- **Cross-stack commits** whose test files belong to a different stack than
|
||||
their source files (e.g. a vitest file pinning a `src-tauri/` config). The
|
||||
script now keys the runner off the TEST files; an older copy keyed it off
|
||||
the sources and ran the wrong stack's suite, which never executes the proof.
|
||||
On any VACUOUS verdict for a cross-stack commit, re-prove by hand with the
|
||||
test file's own runner before reverting.
|
||||
|
||||
For every commit `verify-fixes.mjs` reports `PASS`, upgrade that commit's
|
||||
findings' `fix.revertProof` from `"self-reported"` to `"pass"` — this
|
||||
independent run is the only check in the pipeline no agent can fabricate, and
|
||||
it is what earns the upgrade. A `FAIL` commit needs no further edit here — it
|
||||
was already reverted and its findings set back to `open` above.
|
||||
|
||||
Re-render. Before you review the branch and open the PR, inspect the working
|
||||
tree: a blocked or declined cluster can leave its edits and any new failing
|
||||
test it wrote sitting uncommitted. The gate's "N uncommitted modifications at
|
||||
gate time" note is the trigger list. **Classify before discarding** — an
|
||||
uncommitted modification to a TRACKED test file may be a required companion to
|
||||
a committed fix, not debris. Two known mechanisms: the old test locked the old
|
||||
buggy behavior, and the fix widened an interface that a fake/mock in a test
|
||||
file the cluster never named must now implement (without it the committed
|
||||
package does not even compile). The decisive test: `git stash push -- <file>`,
|
||||
then compile/test the committed state alone — if it fails, the modification is
|
||||
a companion; fold it into the causing commit (fixup + autosquash keeps the
|
||||
history coherent for verify-fixes) or commit it with attribution. Only then
|
||||
discard true debris — a reflexive `git add -A` would commit tests that
|
||||
describe unfixed defects into a public repo.
|
||||
|
||||
**Capture before destroying, as separate verified steps.** Preserve blocked or
|
||||
declined edits by copying the files aside (or `git stash push -u` after
|
||||
confirming it actually saved something) BEFORE any rm/checkout, and never
|
||||
chain the capture and the destructive step into one command — a capture
|
||||
failure then becomes data loss (`git diff /dev/null <file>` fails outright on
|
||||
Windows git and has deleted debris before it was saved). Never blind
|
||||
`git stash pop`: a paired push on a clean tree saves nothing, and the pop then
|
||||
grabs whatever foreign stash sits on top (a preserved debris stash, in the
|
||||
measured case — ~40 conflicted paths). Pop only a ref you verified your own
|
||||
push created; for temporary file comparisons, skip stash entirely and read old
|
||||
versions from the object store (`git show <ref>:<path>`). Audit what got COMMITTED, too: parallel fix agents share the tree, so a
|
||||
prove agent can commit a sibling cluster's content that happened to sit in a
|
||||
shared test file or in regenerated output. Grep the committed tests for
|
||||
finding ids outside the run's fixed set, and re-run the generated-code
|
||||
verifies (sqlc/protocol) after the debris discard — a mismatch means a commit
|
||||
carries foreign regen content. Anything pinning or describing an UNFIXED
|
||||
finding must be excised from history (amend + rebase onto the amended
|
||||
commit), not merely removed by a follow-up commit.
|
||||
|
||||
Then review the branch against the merge-base — `git diff
|
||||
origin/dev...HEAD` (three-dot), never two-dot: a concurrent merge plus a
|
||||
background fetch can move the base mid-run and turn the two-dot diff into
|
||||
phantom deletions. `dev` is the integration branch every PR targets
|
||||
(docs/contributing.md#branch-and-pr-model); use `origin/main` only for a
|
||||
release PR cut from `dev`. If origin moved, confirm zero file overlap and a
|
||||
clean `git merge-tree --write-tree origin/dev HEAD` before opening the PR by
|
||||
hand. The workflow never
|
||||
pushes and never opens a PR.
|
||||
|
||||
## Testing the workflows themselves
|
||||
|
||||
```bash
|
||||
node .claude/workflows/bughunt.harness.mjs
|
||||
node .claude/workflows/bughunt-fix.harness.mjs
|
||||
node .superpowers/render-ledger.mjs --selftest
|
||||
node .superpowers/verify-fixes.mjs --selftest
|
||||
node .superpowers/rank-explore.mjs --selftest
|
||||
node .superpowers/render-run-stats.mjs --selftest
|
||||
```
|
||||
|
||||
All six run offline with zero API calls. Run them after any edit to the
|
||||
relevant script.
|
||||
@@ -0,0 +1,200 @@
|
||||
---
|
||||
name: ci-check
|
||||
description: Run the local mirror of OwnCord's CI gates before pushing. Use when finishing a change, before a commit or push, or when asked to verify work — CI takes ~15 min and catches things a plain build/test does not.
|
||||
---
|
||||
|
||||
# ci-check
|
||||
|
||||
`.github/workflows/ci.yml` is the source of truth. This mirrors it locally.
|
||||
|
||||
Run only the sections your change touches. Server and client are independent.
|
||||
|
||||
**A step added only to `release.yml` first runs at tag time.** `release.yml` is
|
||||
tag-triggered and never gated by a PR, so a smoke/sign/strip step added there is
|
||||
untested code on the critical path — its own bugs surface on the release, not on
|
||||
a PR. Extract it to a script `ci.yml` also runs (`Server/scripts/docker-smoke.sh`
|
||||
is the worked example) or duplicate it into `ci.yml` before merge.
|
||||
|
||||
From the repository root, `npm run check` runs all of it, and
|
||||
`check:server` / `check:client` / `check:rust` / `check:hygiene` run one stack.
|
||||
`node scripts/run.mjs --list` prints the exact command each step runs and the
|
||||
directory it runs in — the per-stack commands below are those commands, and
|
||||
staying with them is fine. Nothing here needs `make`, and server work needs no
|
||||
Node.
|
||||
|
||||
## Server (from `Server/`)
|
||||
|
||||
All four build-tag variants must compile — the tags gate whole files, so a
|
||||
default-build pass proves nothing about the others:
|
||||
|
||||
```bash
|
||||
go build ./... && go build -tags otel ./... && go build -tags wazero ./... && go build -tags otel,wazero ./...
|
||||
go vet ./...
|
||||
go test -race ./...
|
||||
go test -tags deadlock -count=1 ./ws/ # deadlock detector; ws is where lock order actually varies
|
||||
golangci-lint run # CI pins v2.11.3
|
||||
|
||||
# Generated output must not be stale. These are what `make sqlc-verify` and
|
||||
# `make protocol-verify` reduce to — make is not on PATH on a stock Windows box.
|
||||
sqlc generate && git diff --exit-code db/dbgen
|
||||
go run ./cmd/genprotocol && git diff --exit-code ws/message_types.go ../Client/src/lib/protocolTypes.ts
|
||||
```
|
||||
|
||||
Add `-tags wazero` to `go vet`/`go test` when you touched `plugin/`.
|
||||
|
||||
A `windows-latest` `-race` failure inside `ws` that matches `runtime.scanstack`
|
||||
or `runtime.(*unwinder).next` is a Go 1.26.5 runtime GC fault, not your change.
|
||||
The Go 1.26.6 toolchain shows a variant signature: `unexpected fault address
|
||||
0xffffffffffffffff` / `fatal error: fault` (signal 0xc0000005) inside ordinary
|
||||
stdlib frames such as `log/slog.(*Logger).Enabled` — same spurious runtime
|
||||
fault, same verdict, especially when the diff touches no Go code. Rerun the
|
||||
job (`gh run rerun --job <id>`); a job cannot be rerun while its parent run is
|
||||
still in progress.
|
||||
|
||||
## Client (from `Client/`)
|
||||
|
||||
```bash
|
||||
npm test
|
||||
npm run typecheck
|
||||
npm run lint
|
||||
```
|
||||
|
||||
Formatting is no longer a client gate — Prettier is configured once at the
|
||||
repository root and checked by `check:hygiene` below.
|
||||
|
||||
`NODE_OPTIONS=--no-experimental-webstorage` used to be required here. It is not
|
||||
any more: `tests/setup.ts` installs an in-memory `localStorage` shim, CI runs
|
||||
Node 24 without the flag (`ci.yml`), and the full suite was measured passing
|
||||
without it — 192 files / 5257 tests, identical to the flagged run.
|
||||
|
||||
`npm audit --audit-level=high` and `knip` also run in CI but are advisory.
|
||||
|
||||
## Docs and ledger (from the repository root)
|
||||
|
||||
```bash
|
||||
npm run check:docs
|
||||
```
|
||||
|
||||
Which is `scripts/check-doc-counts.mjs` plus, since B1-6, an actual render of
|
||||
the findings ledger:
|
||||
|
||||
```bash
|
||||
node .superpowers/render-ledger.mjs
|
||||
```
|
||||
|
||||
`.superpowers/FINDINGS.md` is **not tracked** — it is generated on demand and
|
||||
gitignored, so there is no committed rendering to go stale. The gate is that
|
||||
generation succeeds. Rendering subsumes `--check`: the renderer validates and
|
||||
exits 1 before it writes, so a schema break (including an unranked `severity`)
|
||||
fails here.
|
||||
|
||||
CI does one thing more, in `Docs & Ledger Consistency` — it renders **twice**
|
||||
and compares, proving the output is a pure function of the ledger, then uploads
|
||||
the rendering as the `findings-ledger-rendering` artifact so a reviewer can read
|
||||
it without running Node.
|
||||
|
||||
## Hygiene (from the repository root)
|
||||
|
||||
```bash
|
||||
npm run check:hygiene
|
||||
```
|
||||
|
||||
Which is:
|
||||
|
||||
```bash
|
||||
npx prettier --check . # every material tracked source, not just client TS
|
||||
shellcheck <tracked *.sh + .githooks/pre-commit + .githooks/pre-push>
|
||||
actionlint .github/workflows/*.yml
|
||||
```
|
||||
|
||||
`shellcheck` and `actionlint` have no clean Windows install, so `run.mjs` marks
|
||||
them optional and prints `--- SKIP` instead of failing; CI runs them for real.
|
||||
Prettier is not optional and runs everywhere.
|
||||
|
||||
The file lists come from `git ls-files`, never a filesystem glob:
|
||||
`.claude/worktrees/` holds gitignored copies of the tree that a glob would
|
||||
happily lint.
|
||||
|
||||
Go formatting is not here. `gofmt -l` prints offenders and still exits 0, so it
|
||||
cannot fail a build; the `formatters` block in `Server/.golangci.yml` enforces
|
||||
it inside `golangci-lint run`, and `.githooks/pre-commit` catches staged files.
|
||||
|
||||
## Rust (from `Client/src-tauri/`)
|
||||
|
||||
```bash
|
||||
cargo fmt --all -- --check # runs ahead of clippy in CI
|
||||
cargo test --lib # CI runs --lib; plain `cargo test` also builds the bin target
|
||||
cargo clippy --all-targets -- -D warnings
|
||||
cargo install cargo-audit@0.22.1 --quiet && cargo audit # CI runs this in tauri-build
|
||||
```
|
||||
|
||||
`cargo audit` is the one gate here that turns red with **zero** local changes —
|
||||
an advisory published upstream breaks a branch that was clean yesterday. Check the
|
||||
advisory date before hunting your diff. It is skipped on Dependabot PRs by design
|
||||
(it overlaps the scanning that opened them), so a clean Dependabot run does not
|
||||
mean the advisory set is clean. The client equivalents, `npm audit --omit=dev
|
||||
--audit-level=high` and `knip`, are advisory in CI.
|
||||
|
||||
`fallback_crypto` is `cfg(not(windows))`, so its tests compile to nothing on a
|
||||
Windows box and only run on the Linux/macOS runners.
|
||||
|
||||
Do not attempt `npm run tauri build` locally — the full desktop build runs in
|
||||
CI on PRs to `main` and pulls heavy system dependencies.
|
||||
|
||||
## Reading a red check
|
||||
|
||||
**Causality before forensics.** Before opening a failing job's log, diff the
|
||||
PR's changed-file set against that job's input surface and ask whether the change
|
||||
could reach it. A diff touching only `.github/workflows/*.yml` cannot cause a Go
|
||||
goroutine leak — that failure is pre-existing or flaky by construction. Re-run
|
||||
first, and check `dev`/`main` is green to tell "flaky" from "already red". Only
|
||||
start log-reading once the change plausibly reaches the job.
|
||||
|
||||
**Compare against the baseline, never against zero.** For any gate a repo
|
||||
knowingly runs red, the unit of verification is the _delta_ from a recorded
|
||||
baseline, not pass/fail — absolute pass/fail only means something when the
|
||||
intended state is zero. Get the delta with `git stash && <gate> > /tmp/base &&
|
||||
git stash pop && <gate> | diff /tmp/base -`. This repo currently carries **no**
|
||||
known-red gate: `golangci-lint`'s complexity backlog was cleared to zero, so a
|
||||
red `golangci-lint` is now genuinely yours. If a budget is ever retuned upward,
|
||||
record the new baseline here next to the command or the gate reports nothing.
|
||||
|
||||
**A dependency bump that breaks the build may be a fork, not a version.** When an
|
||||
updated dependency suddenly demands configuration it never needed, suspect it was
|
||||
inheriting that configuration from a shared resolution with another dependent.
|
||||
Diff the lockfile _entry count_ for that dependency between base and PR: a 1 → 2
|
||||
transition means the update forked it into two semver-incompatible copies, feature
|
||||
unification stopped crossing the boundary, and the fix is to restore version
|
||||
alignment with whatever else requires it — not to set the feature the new copy
|
||||
asks for.
|
||||
|
||||
### Known infra flakes
|
||||
|
||||
Not your change. Match the signature, then recover.
|
||||
|
||||
| Signature | Verdict / recovery |
|
||||
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
||||
| `windows-latest` `-race` fault in `ws`: `runtime.scanstack`, `runtime.(*unwinder).next`, or `unexpected fault address 0xffffffffffffffff` / `fatal error: fault` inside ordinary stdlib frames | Go runtime GC fault, not your code — see the Server section. `gh run rerun --job <id>` |
|
||||
| `##[error]The operation was canceled.` + `Terminate orphan process: ... playwright install --with-deps` + a wall of `Ign:N http://azure.archive.ubuntu.com/...` and no Playwright summary line | Runner apt-mirror outage during "Install Linux system dependencies". The job was **canceled by timeout**, not failed. `gh run cancel` then `gh run rerun --failed` |
|
||||
| Red `Lint` step with zero linters actually run | `golangci-lint`'s network schema fetch failed. Re-run |
|
||||
|
||||
`gh run view --log` refuses while a run is in progress; `gh api
|
||||
repos/<owner>/<repo>/actions/jobs/<id>/logs` works. A job cannot be rerun while
|
||||
its parent run is still in progress. `tauri-build` has no `timeout-minutes`, so a
|
||||
hung apt step can hold a run open for the 6 h default — cancel it rather than wait.
|
||||
|
||||
## Hooks
|
||||
|
||||
`npm run hooks:install` (once per clone) points `core.hooksPath` at
|
||||
`.githooks/`: `pre-commit` runs fast staged-file checks, `pre-push` runs the
|
||||
server build variants plus tsc and eslint. `OWNCORD_PREPUSH_TESTS=1` adds
|
||||
server tests. Bypass with `--no-verify` or `OWNCORD_SKIP_HOOKS=1` — CI still
|
||||
enforces everything.
|
||||
|
||||
**`core.hooksPath` is exclusive, not additive.** Once set, Git resolves every
|
||||
hook against `.githooks/` and stops consulting `.git/hooks/` entirely.
|
||||
`.githooks/` holds only `pre-commit` and `pre-push`, so running
|
||||
`hooks:install` **silently disables any locally installed hook** of any other
|
||||
name (`post-commit`, `post-checkout`, ...). Nothing warns you. If you need one,
|
||||
re-install it under `.githooks/` (untracked, and it stays yours), or skip
|
||||
`hooks:install` and run the checks through `npm run check` instead.
|
||||
@@ -0,0 +1,51 @@
|
||||
---
|
||||
name: db-change
|
||||
description: Change OwnCord's SQLite schema or queries — add a migration, edit Server/db/queries/*.sql, and regenerate the sqlc layer. Use before touching anything under Server/db/ or Server/migrations/.
|
||||
---
|
||||
|
||||
# db-change
|
||||
|
||||
`Server/db/dbgen/` is generated. Edit the inputs, regenerate, commit both.
|
||||
|
||||
1. Add the migration to `Server/migrations/` and/or edit
|
||||
`Server/db/queries/sqlite/*.sql`.
|
||||
2. Regenerate: `make sqlc-generate` from `Server/`.
|
||||
3. Commit the regenerated `Server/db/dbgen/` alongside your inputs. CI runs
|
||||
`make sqlc-verify` and fails on drift.
|
||||
|
||||
`sqlc.version` pins the binary (currently v1.30.0). If `make` is not on PATH:
|
||||
|
||||
```bash
|
||||
go install github.com/sqlc-dev/sqlc/cmd/sqlc@$(cat sqlc.version)
|
||||
$(go env GOPATH)/bin/sqlc generate
|
||||
```
|
||||
|
||||
## Traps
|
||||
|
||||
These are silent — the code generates fine and fails at runtime.
|
||||
|
||||
**Query files must be ASCII-only.** sqlc v1.30.0 measures rune positions
|
||||
against byte offsets, so one multi-byte character (an em-dash in a comment is
|
||||
the usual culprit) truncates the _next_ query's emitted SQL by that many
|
||||
trailing bytes. Symptom: the `.sql` file looks right but the generated const
|
||||
in `dbgen/*.sql.go` is cut short — `ORDER BY id ASC` becomes `ORDER BY id A`,
|
||||
and SQLite reports "incomplete input".
|
||||
|
||||
**No semicolons inside migration `--` comments.** `splitStatements` in
|
||||
`Server/db/migrate.go` splits on `;` before stripping comments, so a semicolon
|
||||
in comment prose orphans the rest of that comment as a bogus statement
|
||||
("near <word>: syntax error").
|
||||
|
||||
**Regenerate from a tree where the query files carry only YOUR change.**
|
||||
sqlc regenerates every `dbgen/` file from every query file on each run, so
|
||||
unrelated working-tree edits to any `queries/*.sql` — a parallel agent's
|
||||
half-finished work, leftover debris — are silently baked into generated
|
||||
output you then commit. Check `git status` on `Server/db/` before
|
||||
`sqlc generate`, and diff the regen for hunks that are not yours.
|
||||
|
||||
**Do not put `LIMIT 1` on a `:one` query.** It is emitted as a bare `LIMIT`.
|
||||
A `:one` uses `QueryRow` and reads a single row regardless — use `ORDER BY` to
|
||||
choose which one.
|
||||
|
||||
After regenerating, gopls diagnostics against `dbgen` go stale. Trust
|
||||
`go build`, not the editor squiggles.
|
||||
@@ -0,0 +1,38 @@
|
||||
---
|
||||
name: protocol-change
|
||||
description: Add or change a WebSocket message type in OwnCord. Use before editing protocol/schema.json, Server/ws/message_types.go, or Client/src/lib/protocolTypes.ts.
|
||||
---
|
||||
|
||||
# protocol-change
|
||||
|
||||
`protocol/schema.json` is the source of truth. Both constant files are
|
||||
generated from it by `Server/cmd/genprotocol/`.
|
||||
|
||||
**The schema holds message-type NAMES only.** Route by what you are changing —
|
||||
most payload work never touches it, and sending a field change through the
|
||||
regenerate cycle below is wasted work:
|
||||
|
||||
| Change | What to edit |
|
||||
| -------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
|
||||
| New message type | schema + regenerate (steps below) |
|
||||
| New or changed payload **field** on an existing type | `Server/ws/command.go`/`messages.go`, `Client/src/lib/protocolTypes.ts`, `docs/protocol.md` — no schema, no regenerate |
|
||||
| Content inside an opaque blob the server relays verbatim | `docs/protocol.md` only; often zero Go change |
|
||||
|
||||
Before assuming a field needs server work, read the relay handler: if the server
|
||||
forwards the message raw, there is nothing to add. If it **re-serialises**, an
|
||||
older server drops unknown JSON fields — so a field the server must forward is
|
||||
NOT backward compatible with older servers.
|
||||
|
||||
1. Edit `protocol/schema.json`.
|
||||
2. Run `make protocol-generate` from `Server/`.
|
||||
3. Commit **both** outputs — `Server/ws/message_types.go` and
|
||||
`Client/src/lib/protocolTypes.ts`. One run regenerates the
|
||||
pair; committing only the Go side is the usual mistake, and CI's
|
||||
`make protocol-verify` fails on either being stale.
|
||||
|
||||
Document the semantics in `docs/protocol.md` — the schema carries names and
|
||||
shapes, not behaviour.
|
||||
|
||||
Adding a message type is not enough to make it work: a server handler must be
|
||||
registered in the `ws` V1/V2 dispatch tables, and the client needs a
|
||||
`ws.on(...)` subscription in `Client/src/lib/dispatcher.ts`.
|
||||
@@ -0,0 +1,455 @@
|
||||
---
|
||||
name: task-observer
|
||||
description: >
|
||||
Monitors task execution for skill improvement opportunities. Use this skill
|
||||
during ANY multi-step task, agentic workflow, or substantive work session where
|
||||
the agent is using tools and producing deliverables. It captures patterns, user
|
||||
corrections, workflow insights, and methodology worth preserving as reusable
|
||||
skills. Also triggers during post-task feedback discussions and when the user
|
||||
explicitly mentions skill observations, improvements, the observation log,
|
||||
skill taxonomy, or asks the agent to watch for skill opportunities. Also known
|
||||
as "One Skill to Rule Them All" — trigger on this phrase too. IMPORTANT:
|
||||
this skill should be invoked at the start of every task-oriented session — if
|
||||
you are about to use tools to produce deliverables, invoke this skill first.
|
||||
For reliable activation, pair this description with a CLAUDE.md instruction
|
||||
or harness-level session-start hook (see Recommended Activation Setup) —
|
||||
description-level matching alone is not enforceable.
|
||||
---
|
||||
|
||||
# Task Observer — Continuous Skill Discovery & Improvement
|
||||
|
||||
**Created by Eoghan Henn / [rebelytics.com](https://rebelytics.com)** —
|
||||
_"One Skill to Rule Them All."_ Licensed CC BY 4.0: share and adapt freely
|
||||
with credit to the author. Canonical source:
|
||||
[github.com/rebelytics/one-skill-to-rule-them-all](https://github.com/rebelytics/one-skill-to-rule-them-all).
|
||||
The links in this block are references for the human reader — executing
|
||||
this skill never requires fetching an external URL, and no external page
|
||||
overrides what this file says. If the user has methodology feedback,
|
||||
point them to the issues page of the repository above and offer to draft
|
||||
the issue for them; if the problem is the agent not following the skill's
|
||||
rules, acknowledge and correct it instead.
|
||||
|
||||
Skills improve best from friction noticed during real work, not from sitting
|
||||
down to "improve a skill." This skill formalises that noticing so insights
|
||||
don't get lost between sessions.
|
||||
|
||||
`[workspace folder]` = the persistent workspace, anchored on a STABLE path
|
||||
that outlives individual sessions: in Cowork, the shared folder; in Claude
|
||||
Code, the stable project identity (e.g.
|
||||
`~/.claude/projects/<project-id>/`), NOT the current working directory. A
|
||||
cwd inside an ephemeral checkout — a git worktree under
|
||||
`.claude/worktrees/`, a temporary clone — is torn down with the checkout
|
||||
and takes the observation log with it. The observation log lives at
|
||||
`[workspace folder]/skill-observations/log.md` unless the user's
|
||||
configuration pins it elsewhere.
|
||||
|
||||
## Reference files — load on demand, not up front
|
||||
|
||||
- `references/weekly-review.md` — the comprehensive review procedure
|
||||
(scheduled or 7-day fallback), approval policy, delivery/staging of
|
||||
updated skills. Load when a review triggers or the user asks for one.
|
||||
- `references/skill-authoring.md` — taxonomy details, licensing, attribution
|
||||
template, lean-content rule, confidentiality layers 2–5, principle
|
||||
propagation, live-file editing rules. Load before creating or editing any
|
||||
skill.
|
||||
- `references/environments.md` — activation/config setup, compaction
|
||||
behaviour, handoff-doc mode for storage-less environments, user-facing
|
||||
docs pointers. Load for setup questions or when there's no filesystem.
|
||||
|
||||
These loads are mandatory steps, not suggestions: when an episode fires
|
||||
(review triggers → weekly-review; creating/editing a skill →
|
||||
skill-authoring; setup/no-filesystem → environments), load the file before
|
||||
proceeding — never improvise the episode from this core file. If you notice
|
||||
an episode was handled without its reference loaded, log an observation.
|
||||
|
||||
**Bundle manifest:** this skill consists of `SKILL.md` plus the three
|
||||
reference files listed above. If a referenced file is missing, the install
|
||||
is incomplete: proceed using the rules in this file, tell the user which
|
||||
files are missing, and point them to the full bundle at the canonical
|
||||
source (for the published version, the repository in the attribution
|
||||
above).
|
||||
|
||||
## Session Start Protocol
|
||||
|
||||
1. If `skill-observations/log.md` or `cross-cutting-principles.md` don't
|
||||
exist, create them (templates below / in the principles section of
|
||||
`references/skill-authoring.md`). Also create
|
||||
`skill-observations/last-review-date.txt` containing the literal value
|
||||
`never` if it doesn't exist — never write a date into it at setup; a
|
||||
date means a review actually ran. Before creating or writing anything:
|
||||
if the resolved workspace folder sits under an ephemeral path (e.g.
|
||||
`.claude/worktrees/`, a temporary clone), warn the user and re-anchor
|
||||
on the stable project path first — state written to an ephemeral
|
||||
checkout is lost at teardown.
|
||||
2. Scan OPEN observations and active principles; hold them in awareness,
|
||||
don't surface unprompted.
|
||||
3. Read `skill-observations/last-review-date.txt`. The value carries the
|
||||
truth: a date = when the last review actually ran; `never` = no review
|
||||
has run yet. A missing file is abnormal (step 1 creates it) — recreate
|
||||
it with `never`, don't invent a date. If the value is `never` or older
|
||||
than 7 days AND there are OPEN observations: in an interactive session,
|
||||
offer the review in one line ("the observation backlog hasn't been
|
||||
reviewed [in N days / yet] — run it now, or carry on with your task?")
|
||||
and proceed with the user's task unless they opt in; never gate their
|
||||
work on the review. Only a scheduled/autonomous run loads
|
||||
`references/weekly-review.md` and runs the review unprompted.
|
||||
4. Once per session: if no CLAUDE.md (or equivalent) activation instruction
|
||||
for this skill exists, briefly suggest adding one (see
|
||||
`references/environments.md`). Skip if already configured.
|
||||
5. Note the log's modification time. If modified in the last few hours,
|
||||
another session may be writing to it — re-read immediately before every
|
||||
append, never trust a remembered "current number".
|
||||
|
||||
## When to Observe
|
||||
|
||||
Active for the entire task session: execution, post-task feedback and
|
||||
review discussion, meta-discussion about skills or methodology, and
|
||||
reflective/strategy conversations about how work should be done. **The
|
||||
observation mindset does not deactivate when the conversation shifts from
|
||||
doing the work to discussing it** — user feedback in review phases is often
|
||||
the highest-signal input. Inactive only for casual conversation and quick
|
||||
factual questions with no tools or deliverables involved.
|
||||
|
||||
## What to Watch For
|
||||
|
||||
**Signals for a NEW skill:** a reusable multi-step workflow; a methodology
|
||||
the user explains that no existing skill captures; a recurring task type
|
||||
with similar structure; a process with clear inputs, phases, outputs; the
|
||||
user describing a refined process ("I always do it this way"); a structured
|
||||
approach emerging naturally during work.
|
||||
|
||||
**Signals for IMPROVING an existing skill:** anything from a task that used
|
||||
a skill and could make it better — problems, positive signals, or neutral
|
||||
gaps. Examples: the agent violates a documented rule (the skill needs
|
||||
enforcement, not louder rules); a user correction reveals a missing rule or
|
||||
edge case; a better workflow emerges than the skill recommends; a technique
|
||||
works well enough to promote from incidental to recommended; an undocumented
|
||||
use case; feedback that generalises; a wrong assumption; new tooling
|
||||
obsoletes a step; corrections forming a pattern; a principle that applies to
|
||||
other skills too; a naming/framing/structural suggestion, even
|
||||
conversational.
|
||||
|
||||
**Signals for SIMPLIFYING a skill:** a section never relevant across many
|
||||
sessions; a rule from a single unvalidated observation; workflows users
|
||||
consistently shortcut; sections loaded but never acted on; contradictory
|
||||
rules; "just in case" complexity that never triggered; a rule the agent
|
||||
consistently fails to follow (convert to structural enforcement — checklist,
|
||||
verification step, unskippable tool call — or remove it). Treat these as a
|
||||
review checklist; ask "what can we remove?" as deliberately as "what should
|
||||
we add?"
|
||||
|
||||
**Do NOT log:** one-off corrections that don't generalise; preferences
|
||||
already captured in a skill; tool bugs unrelated to methodology;
|
||||
observations that would need proprietary client information to be useful in
|
||||
an open-source skill (unless an internal skill is the right home).
|
||||
|
||||
## How to Log
|
||||
|
||||
Append to the log **silently, within the same turn or the next** — never
|
||||
batch mentally for later; the act of writing is the enforcement mechanism.
|
||||
|
||||
**Mandatory observation checkpoint after every 3rd TodoWrite completion:** After
|
||||
marking the 3rd, 6th, 9th (etc.) TodoWrite item as completed in a session, you
|
||||
must **write to the log** — not merely pause to ask yourself a question. Either
|
||||
append any pending observations, or, if genuinely none have accumulated, append
|
||||
an explicit acknowledgement marker (a one-line `no observations` note for that
|
||||
checkpoint). The required action is a concrete log write; a remembered "ask
|
||||
whether" is not enforcement. This is a hard checkpoint, not a suggestion — the
|
||||
skill has demonstrated that softer "check when completing items" or "pause and
|
||||
ask" guidance gets lost during cognitively demanding analytical work, exactly
|
||||
when the most observations accumulate. The count doesn't need to be precise;
|
||||
the rule is: roughly every third completion, write to the log (observations or
|
||||
the acknowledgement marker). The write itself is the enforcement mechanism: it
|
||||
forces the mental check to surface as a recorded action, and it prevents the
|
||||
common failure mode where the skill is loaded but no observations are written
|
||||
until the user explicitly asks.
|
||||
|
||||
**Deliverable-event flush:** Hard enforcement that hooks onto tool calls you are
|
||||
already making is the only reliable mechanism; soft prompts that rely on memory
|
||||
don't survive cognitive load during long substantive sessions (when the most
|
||||
insights surface). So tie observation-flushing to deliverable and workflow events
|
||||
that already involve a tool call. Whenever you present or render a major
|
||||
deliverable — `present_files`, a deck or PDF render, a staged skill file handed
|
||||
to the user — or complete a task/todo batch, flush any pending observations to
|
||||
the log at that moment, before moving on. These are natural, already-occurring
|
||||
checkpoints; piggy-backing the flush onto them means the write happens as a
|
||||
side effect of work you were doing anyway, rather than depending on a separate
|
||||
act of memory.
|
||||
|
||||
**Your own delegates are concurrent writers.** A subagent dispatched into the
|
||||
same project has this skill active in its own context and appends to the same
|
||||
log, so it consumes numbers between your read and your write. Collisions are
|
||||
structural in any fan-out workflow, not a rare parallel-human accident — which
|
||||
is exactly why the pre-write assertion below matters most in the workflows that
|
||||
spawn helpers. When dispatching, say who owns logging for the session, or two
|
||||
writers record the same incident from different angles under different numbers.
|
||||
|
||||
**Numbering discipline (mandatory, every append):**
|
||||
|
||||
1. _Pre-check:_ read the actual log and find the highest existing number —
|
||||
never trust session memory:
|
||||
|
||||
```bash
|
||||
# GNU grep:
|
||||
grep -oP '### Observation \K\d+' log.md | sort -n | tail -1
|
||||
# macOS / POSIX:
|
||||
grep -o '### Observation [0-9]*' log.md | grep -o '[0-9]*' | sort -n | tail -1
|
||||
```
|
||||
|
||||
2. _Pre-write assertion:_ immediately before appending, confirm the proposed
|
||||
number doesn't already exist:
|
||||
|
||||
```bash
|
||||
PROPOSED=$(( $(grep -oP '### Observation \K\d+' log.md | sort -n | tail -1) + 1 ))
|
||||
grep -qE "^### Observation ${PROPOSED}:" log.md && {
|
||||
echo "COLLISION on #${PROPOSED}"; exit 1; }
|
||||
```
|
||||
|
||||
If it fires, increment past all existing numbers and re-check (and log a
|
||||
meta-observation — it signals a parallel-session collision).
|
||||
|
||||
3. _Post-write verification:_ after appending, count occurrences of the
|
||||
number; if >1, a parallel writer collided between check and write —
|
||||
renumber YOUR entry to max+1. Identify your entry from your own append
|
||||
operation (capture the file's line count immediately before and after
|
||||
your `>>`; your entry starts at the old line count + 1) — do NOT
|
||||
re-grep and take the last occurrence, which may be a colliding writer's
|
||||
entry appended after yours. After any `sed` renumber, re-read the
|
||||
affected line to confirm the substitution actually took effect — a
|
||||
line-addressed `s///` whose target shifted finds no match and still
|
||||
exits 0. Pre-write catches stale reads; only a post-write check catches
|
||||
the race. The pattern for shared logs written by parallel agents is
|
||||
check-then-act-then-verify.
|
||||
|
||||
**Log-write safety — never let a mutation span entry boundaries:** When
|
||||
mutating the log programmatically (marking entries ACTIONED/DECLINED,
|
||||
archiving, renumbering), a greedy or DOTALL pattern over the whole file can
|
||||
silently swallow everything from one match to EOF. This has happened: a
|
||||
`.*$` under `re.S` over the multi-entry file captured from one entry's
|
||||
Status line to end-of-file and overwrote 16 later entries in a single
|
||||
substitution. The log is shared state across many entries; mutate it one
|
||||
bounded entry at a time and verify every mutation.
|
||||
|
||||
1. **Re-read and merge immediately before any write-back.** Any full-file
|
||||
rewrite (archival, renumbering, reassembly from chunks) built from a
|
||||
snapshot destroys whatever concurrent sessions appended after that
|
||||
snapshot — the write-back succeeds, the victim gets no error, and the
|
||||
loss is invisible. This has happened in production: a parallel session's
|
||||
write-back erased two entries appended minutes earlier, hours after the
|
||||
exact failure mode had been documented. So: take the snapshot, prepare
|
||||
the mutation, then — immediately before writing — re-read the live log
|
||||
and diff against the snapshot. If new entries appeared, merge them into
|
||||
the write-back (or rebuild from the fresh read). Never write back a
|
||||
stale snapshot.
|
||||
|
||||
2. **Isolate the target entry, or anchor to a single line.** Either split
|
||||
the log on `### Observation N:` headers, edit the TARGET entry's chunk in
|
||||
isolation, and reassemble — OR, for a status-only edit, use a strictly
|
||||
line-anchored multiline substitution that cannot cross a newline, e.g.
|
||||
`re.sub(r'(?m)^(\s*-?\s*)\*\*Status:\*\*.*$', ...)` (multiline `^...$`
|
||||
bounds the match to one line). NEVER use a DOTALL/greedy pattern across
|
||||
the multi-entry file.
|
||||
|
||||
3. **Assert a structural invariant against the LIVE pre-write file.** Count
|
||||
`### Observation` headers in the live file immediately before writing and
|
||||
again after. For a status-only edit the count MUST be unchanged; for
|
||||
archival or append it must change by exactly the expected number. The
|
||||
baseline must be the live file at write time, NOT your session's earlier
|
||||
snapshot — an invariant computed against a stale snapshot validates that
|
||||
you wrote what you intended while still destroying what others wrote in
|
||||
between. Fail loudly if the count is off.
|
||||
|
||||
4. **Keep the pre-write backup.** Copy `log.md` before any programmatic
|
||||
mutation. This is what made full recovery trivial when the truncation
|
||||
above occurred — it turned a destructive bug into a non-event.
|
||||
|
||||
5. **Verify your entries SURVIVED, not just that they were written.** A
|
||||
successful append proves nothing an hour later — a concurrent session's
|
||||
write-back can silently delete it, and only the destroying session gets
|
||||
any signal (none). Before surfacing observations at session end, grep
|
||||
the log for every entry number this session wrote and confirm each still
|
||||
exists exactly once; re-append any that are missing (with fresh numbers)
|
||||
and log a meta-observation about the collision.
|
||||
|
||||
Principle: a log shared across many entries must be mutated one bounded
|
||||
entry at a time; every rewrite must be based on a fresh read, verified by a
|
||||
structural invariant against the live pre-write file, and backed up. Writers
|
||||
must verify survival, not just successful writes — in a concurrent erase,
|
||||
the victim gets no error.
|
||||
|
||||
**Format and insertion:** always `### Observation NNN:`, always appended to
|
||||
the END of the log, never mid-file, never alternative ID formats. One
|
||||
format, one insertion point. **Every new observation MUST include
|
||||
`**Status:** OPEN` as its first field — this is mandatory at write time, not
|
||||
optional.** Reviews classify entries by their Status line; an observation
|
||||
written without one is invisible to any status-filtered pass and risks being
|
||||
silently skipped instead of triaged.
|
||||
|
||||
```markdown
|
||||
### Observation [N]: [Short descriptive title]
|
||||
|
||||
**Status:** OPEN
|
||||
**Date:** [date]
|
||||
**Session context:** [what task was being worked on]
|
||||
**Skill:** [existing skill name, or "New skill candidate: [working name]"]
|
||||
**Type:** [open-source | internal]
|
||||
**Phase/Area:** [which part of the skill or workflow]
|
||||
|
||||
**Issue:** [What happened — specific enough to understand weeks later
|
||||
without the original conversation.]
|
||||
|
||||
**Suggested improvement:** [Concrete change. For existing skills, name the
|
||||
section or rule; for new skills, scope and key components.]
|
||||
|
||||
**Principle:** [The generalisable takeaway — the most important field.]
|
||||
```
|
||||
|
||||
**Context preservation:** if an observation depends on session-local data
|
||||
(uploads, API output), save that context into the workspace first and add a
|
||||
`**Reference file:**` line — an observation whose evidence dies with the
|
||||
session is incomplete.
|
||||
|
||||
**Confidentiality at logging time:** for `type: open-source` observations,
|
||||
the Issue/Improvement fields may reference specifics for context, but the
|
||||
Principle must be fully generalised — no client names, domains, or details
|
||||
traceable to a real project. Full confidentiality layers for skill
|
||||
authoring: `references/skill-authoring.md`.
|
||||
|
||||
## Referencing Observations
|
||||
|
||||
When citing an observation by number — in conversation, in a review report,
|
||||
or from within another observation — the number must come from the entry's
|
||||
literal `### Observation N:` header line. Never cite an observation number
|
||||
that wasn't read from that header.
|
||||
|
||||
- **Search-tool line numbers are positional metadata, not IDs.** `grep -n`
|
||||
prefixes every match with a line number; when a match lands mid-entry
|
||||
(e.g., on a Session context or Principle line rather than the header),
|
||||
that line number is NOT the observation number. Resolve to the owning
|
||||
header first — scan backwards from the matched line to the nearest
|
||||
preceding `### Observation N:` header and take the number from there
|
||||
(e.g., an awk backwards-scan, or re-grep for `^### Observation` and pick
|
||||
the last header line before the match).
|
||||
- **Plausibility check (cheap second layer):** before quoting any
|
||||
observation number, compare it against the known counter range — the
|
||||
highest `### Observation N:` header in the log. A number outside that
|
||||
range (e.g., citing #1365 when the log's counter is at #766) is almost
|
||||
certainly a line number or other positional artefact misread as an ID.
|
||||
|
||||
The general rule: IDs must come from the record's own identifier field,
|
||||
never from the positional metadata of the search tool that found it.
|
||||
|
||||
## Taxonomy (quick version)
|
||||
|
||||
**Open-source** — client-agnostic, methodology-driven, useful to other
|
||||
practitioners. **Internal** — contains user/client/project specifics or
|
||||
personal preferences. Default to open-source when it could go either way,
|
||||
stripping specifics. The boundary is also a confidentiality boundary. Full
|
||||
requirements (attribution, licensing, structure): `references/skill-authoring.md`.
|
||||
|
||||
## Archival on Write
|
||||
|
||||
On every log write, first move already-resolved entries to
|
||||
`skill-observations/archive/log-[YYYY-MM-DD].md` (preserving the log header
|
||||
in the archive). "Already resolved" is decided by date, read from the file:
|
||||
a resolved status MUST record its date — `ACTIONED (YYYY-MM-DD) — [what was
|
||||
done]` / `DECLINED (YYYY-MM-DD) — [reason]` — and archival moves only
|
||||
entries whose recorded date is before today. Entries resolved today stay in
|
||||
the active log until the next day, no matter which session resolved them:
|
||||
the grace period lives in the file, never in session memory, so it holds
|
||||
across parallel and subsequent sessions. A resolved entry with no readable
|
||||
date gets today's date added instead of being archived. The active log
|
||||
keeps its header, status key, all OPEN entries, and the same-day-resolved
|
||||
ones.
|
||||
|
||||
Archival is a read-filter-rewrite — the highest-risk mutation the log
|
||||
undergoes, and the one that has destroyed concurrent appends in production.
|
||||
It MUST follow the full Log-write safety sequence above: backup, re-read
|
||||
the live log immediately before writing back and merge any entries that
|
||||
appeared since the snapshot, then verify the post-write header count equals
|
||||
the live pre-write count minus exactly the number of archived entries.
|
||||
|
||||
## Log Structure
|
||||
|
||||
```markdown
|
||||
# Skill Observation Log
|
||||
|
||||
Observations captured during task-oriented work.
|
||||
|
||||
**Status key:** OPEN = not yet actioned | ACTIONED (YYYY-MM-DD) = skill
|
||||
updated/created | DECLINED (YYYY-MM-DD) = user decided not to pursue —
|
||||
resolved statuses always carry their resolution date
|
||||
|
||||
---
|
||||
|
||||
## [Date]
|
||||
|
||||
### Observation 1: [Title]
|
||||
|
||||
**Status:** OPEN
|
||||
[... full format ...]
|
||||
```
|
||||
|
||||
## Surfacing Protocol
|
||||
|
||||
Default: at end of session, as a grouped summary — improvements grouped by
|
||||
skill, new-skill candidates listed separately; for each, one sentence plus
|
||||
suggested type; ask which to act on. Surface earlier when an observation
|
||||
needs user input to be complete, when a skill is actively producing wrong
|
||||
output, or when observations cluster on one skill.
|
||||
|
||||
**Default to log-and-defer.** Surfacing an observation is not an invitation
|
||||
to act on it. The default is log-and-defer: state that the observation is
|
||||
logged for the next review, and stop. Reserve in-session application
|
||||
strictly for the two triggers already defined under "Acting on
|
||||
Observations" — an explicit user request that names the action, or
|
||||
correcting a skill that is producing wrong output in the current session.
|
||||
|
||||
Do NOT routinely offer a binary "apply now vs leave for next review" choice
|
||||
when surfacing observations. For users who run regular reviews, that offer is
|
||||
unwanted friction repeated every session. If a user has expressed a standing
|
||||
preference to always defer to the next review, suppress the in-session
|
||||
"act now?" offer entirely rather than asking each time.
|
||||
|
||||
**Self-check before surfacing:** observations were logged throughout the
|
||||
whole session (including discussion phases); logged silently; each follows
|
||||
Issue → Improvement → Principle; each is typed; existing-skill items name
|
||||
the section; no open-source Principle contains client-identifying info;
|
||||
every appended observation carries a Status line (`**Status:** OPEN` at
|
||||
write time) — a statusless entry is invisible to any status-filtered review
|
||||
pass, so if any observation lacks one, add it now. Finally, run the
|
||||
survival check (Log-write safety rule 5): grep the log for every entry
|
||||
number this session wrote and confirm each still exists exactly once — a
|
||||
concurrent session's write-back deletes silently. Fix failures before
|
||||
surfacing.
|
||||
|
||||
## Acting on Observations
|
||||
|
||||
Act only in three contexts: (1) the comprehensive review (load
|
||||
`references/weekly-review.md`); (2) an explicit user request ("update X
|
||||
skill", "act on observation #N"); (3) in-session correction when a skill is
|
||||
producing wrong output the user should know about. Otherwise: log, don't
|
||||
act.
|
||||
|
||||
When acting: small, clearly-additive, low-risk changes (a new rule, a
|
||||
clarification, a factual fix) may be applied directly. Substantial changes
|
||||
(restructuring, new capabilities, changed methodology) and all new-skill
|
||||
creation: load `references/skill-authoring.md` first and follow its editing
|
||||
and staging rules. If an observation reveals a principle that applies to
|
||||
skills generally, propose it for the cross-cutting principles file (see the
|
||||
same reference).
|
||||
|
||||
## Quick Reference
|
||||
|
||||
| Question | Answer |
|
||||
| --------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| When do I observe? | The whole session, including feedback and reflection phases |
|
||||
| How do I log? | Silently, immediately, appended to the end, with the 3-step numbering discipline |
|
||||
| When do I surface? | End of session, or earlier if needed |
|
||||
| Status line? | Mandatory `**Status:** OPEN` as the first field of every new observation; reviews treat statusless entries as OPEN, never as nonexistent |
|
||||
| Citing an observation number? | Only from its literal `### Observation N:` header — `grep -n` line numbers are positional metadata, not IDs; sanity-check against the known counter range |
|
||||
| Open-source or internal? | Default open-source; the boundary is confidential |
|
||||
| Small fix or substantial? | Additive → apply directly; restructuring/new skill → `references/skill-authoring.md` |
|
||||
| Rewriting the log (archival/renumber/status)? | Backup → re-read live and merge → bounded mutation → verify count against live pre-write file → confirm own entries survived |
|
||||
| Weekly review? | Trigger check at session start; procedure in `references/weekly-review.md` |
|
||||
| No filesystem? | Handoff-doc mode — `references/environments.md` |
|
||||
@@ -0,0 +1,118 @@
|
||||
# Environments, Activation Setup, and Handoff-Doc Mode
|
||||
|
||||
Load this for setup questions, compaction/resume behaviour, or when running
|
||||
in an environment without filesystem access.
|
||||
|
||||
## Recommended activation setup
|
||||
|
||||
Description-level matching alone can miss invocation when the agent is
|
||||
focused on the task, so pair the skill with a configuration-level
|
||||
instruction (CLAUDE.md, project instructions, or equivalent):
|
||||
|
||||
```
|
||||
At the start of any task-oriented session — any interaction where you will
|
||||
use tools and produce deliverables — invoke the task-observer skill before
|
||||
beginning work. This ensures skill improvement opportunities are captured
|
||||
throughout the session.
|
||||
|
||||
When loading any skill, check the observation log for OPEN observations
|
||||
tagged to that skill. Apply their insights to the current work, even if
|
||||
the skill file hasn't been updated yet. This enables immediate application
|
||||
of observations before they're permanently integrated during the weekly
|
||||
review.
|
||||
```
|
||||
|
||||
**Config detection (once per session):** with filesystem access, check the
|
||||
workspace root's CLAUDE.md (or equivalent) for a task-observer activation
|
||||
instruction — suggest adding it if absent, creating the file if none
|
||||
exists. Without filesystem access, check the system prompt / project
|
||||
instructions and suggest the user add the instruction there. Keep the
|
||||
suggestion to a sentence or two.
|
||||
|
||||
**Anti-pattern:** don't chain activation through another skill — load
|
||||
task-observer and related skills independently from configuration; a broken
|
||||
chain silences all observation activity.
|
||||
|
||||
**If CLAUDE.md (or the equivalent config) is governance-protected:** some
|
||||
setups guard shared config files with hooks or file-protection rules that
|
||||
deny agent edits. If an edit to the config is denied, never retry the same
|
||||
edit blindly and never attempt to bypass the guard — a denial is the
|
||||
governance system working as intended, and a silent skip is just as bad
|
||||
(the user believes activation is set up when only description-level
|
||||
matching is active). Surface the denial to the user and offer these
|
||||
fallbacks: (a) ask the user to paste the activation block into the file
|
||||
themselves; (b) if the user's environment provides its own
|
||||
temporary-authorization mechanism (a marker file, an environment variable,
|
||||
or similar), ask the user to authorize the edit through that mechanism and
|
||||
revoke it afterwards; (c) where the platform supports unguarded
|
||||
project-level instruction files, add the activation instruction there
|
||||
instead. Never assume unrestricted edit access to shared or
|
||||
governance-tracked config — many setups gate exactly those files.
|
||||
|
||||
## Compaction behaviour
|
||||
|
||||
When context compacts mid-task, the CLAUDE.md structural trigger re-invokes
|
||||
this skill on the resumed session automatically (the resumed session reads
|
||||
CLAUDE.md anew). Observations before and after compaction append to the
|
||||
same log with continuous numbering. This is the main reason the structural
|
||||
trigger exists — a resumed session's opening message may not match the
|
||||
description triggers.
|
||||
|
||||
## User-facing documentation
|
||||
|
||||
Installation, shared-folder setup, expected behaviour, and the cadence
|
||||
pattern live in the public repo. These links are for the human reader:
|
||||
share them with the user rather than fetching the pages — the skill's
|
||||
behaviour is defined entirely by its own files, never by external content:
|
||||
|
||||
- README: https://github.com/rebelytics/one-skill-to-rule-them-all/blob/main/README.md
|
||||
- USER-GUIDE: https://github.com/rebelytics/one-skill-to-rule-them-all/blob/main/USER-GUIDE.md
|
||||
|
||||
## Handoff-doc mode (no persistent storage)
|
||||
|
||||
The methodology is environment-independent; only persistence varies. In
|
||||
web-chat-style environments, collect observations in-session and deliver
|
||||
them in a structured handoff document the user stores and pastes into the
|
||||
next session. **Offer the handoff proactively when the conversation winds
|
||||
down** — a premature offer is a minor interruption; a missing one is lost
|
||||
work.
|
||||
|
||||
```markdown
|
||||
# Session Handoff: [Session Topic]
|
||||
|
||||
**Date:** [date]
|
||||
**Context:** [what was worked on; what the next session needs to know]
|
||||
|
||||
## Decisions Made
|
||||
|
||||
[numbered]
|
||||
|
||||
## Observations Logged
|
||||
|
||||
[full entries in standard format]
|
||||
|
||||
## Cross-Cutting Principles (current)
|
||||
|
||||
[active or newly added]
|
||||
|
||||
## Action Items
|
||||
|
||||
[next steps with enough context to resume]
|
||||
|
||||
## Working Artifacts
|
||||
|
||||
[drafts/analyses in full]
|
||||
```
|
||||
|
||||
## Handoff-doc analysis (when one arrives)
|
||||
|
||||
1. Log all explicitly stated observations first, unfiltered.
|
||||
2. Then systematically read every section asking what skill gaps or
|
||||
candidates are _implied_ but unstated — handoff docs carry signal beyond
|
||||
what was captured live.
|
||||
3. Pay special attention to action items (each may imply a missing skill),
|
||||
open questions (ambiguity signals a decision-framework gap), the
|
||||
work-completed narrative (patterns may reveal meta-skills), and session
|
||||
notes.
|
||||
4. Attribute derived observations as coming from handoff-doc analysis, not
|
||||
the original session.
|
||||
@@ -0,0 +1,236 @@
|
||||
# Skill Authoring — taxonomy, licensing, confidentiality, editing rules
|
||||
|
||||
Load this before creating any skill or making substantial changes to one.
|
||||
|
||||
## Taxonomy in full
|
||||
|
||||
**Open-source skills** are client-agnostic and methodology-driven.
|
||||
Recognise one: the methodology works across clients and contexts; no
|
||||
proprietary information is needed; other practitioners would find it
|
||||
valuable; it captures a process, not personal preferences. Required
|
||||
elements: the body identifies itself as open-source; author attribution
|
||||
block (template below); a licence statement; a feedback/support section
|
||||
routing methodology feedback to the creator; tool-agnostic language
|
||||
(capabilities like "browser access", not product names); built-in
|
||||
enforcement (see Pre-Flight Principle). Default to open-source when a skill
|
||||
could go either way — strip specifics and generalise.
|
||||
|
||||
**Internal skills** contain user/client/project specifics, personal
|
||||
preferences, or context only the user has. They identify themselves as
|
||||
internal, need no attribution or licence, and can be shorter and less
|
||||
formal. They're working documents — keep them current, don't over-engineer.
|
||||
|
||||
## The Pre-Flight Principle
|
||||
|
||||
Rules documented in a skill are not reliably followed during creative flow.
|
||||
Every skill with explicit rules needs a verification step where the agent
|
||||
re-reads the rules and checks its output against them before delivery. When
|
||||
creating or improving any skill ask: "Does it have rules? Does it have a
|
||||
mechanism to enforce them?" If not, add one.
|
||||
|
||||
**Embedded commands are pre-flight items too — execute before you ship.**
|
||||
Prose rules and command snippets fail differently: a prose rule is
|
||||
re-interpreted in context on every run, so ambiguity can be caught at
|
||||
execution time; an embedded command runs verbatim, unattended, forever —
|
||||
and a subtly wrong command can read as correct on every re-read
|
||||
(`git log -1 --format=%cI --reverse` returns the NEWEST commit, because
|
||||
`-1` applies before `--reverse`, while the plausible reading is "oldest").
|
||||
Any command embedded in a skill must be executed once against real data,
|
||||
with its output inspected for plausibility, before the skill file is
|
||||
saved. An unverified snippet is among the highest-risk lines in a skill:
|
||||
it ships bugs that no re-read can catch.
|
||||
|
||||
## Lean Content
|
||||
|
||||
A skill should contain only content that changes the agent's behaviour at
|
||||
execution time. Move changelogs, credits beyond the author block, long
|
||||
backstories, and maintainer notes to supporting docs. Do NOT cut examples,
|
||||
anti-patterns, or worked scenarios — bare rules get violated more than
|
||||
rules with context. Test: would removing it change behaviour? Keep
|
||||
per-session rules in the skill body and episodic material in reference
|
||||
files loaded on demand (progressive disclosure) — a skill loaded every
|
||||
session is fixed overhead and should be audited like one.
|
||||
|
||||
## Licensing
|
||||
|
||||
Include a licence statement in the preamble and a LICENSE file with full
|
||||
text. Options: **CC BY 4.0** (prose/methodology skills; share and adapt
|
||||
with credit — recommended default), **MIT** (code-heavy, permissive),
|
||||
**Apache 2.0** (MIT plus patent grant), **CC BY-SA 4.0** (share-alike
|
||||
derivatives), **GPL family** (strong copyleft). The author chooses; the
|
||||
requirement is that there is one.
|
||||
|
||||
**Private client sharing** is a third channel with its own rights framing:
|
||||
a client-agnostic skill shared privately with one client is NOT open source
|
||||
and NOT internal. Keep the attribution block; replace the licence statement
|
||||
with a short usage notice (e.g., "shared privately for internal use; please
|
||||
don't redistribute without checking with the author"); no LICENSE file
|
||||
needed. All confidentiality sweeps still apply — other-client information
|
||||
must not leak even when the recipient is a known client. Do not treat "not
|
||||
internal" as "therefore open source": distribution channel determines the
|
||||
rights framing, not just the feedback routing (see the distribution-channel
|
||||
note below).
|
||||
|
||||
## Author Attribution Template
|
||||
|
||||
```markdown
|
||||
**Created by [Author Name] / [website or contact link]**
|
||||
|
||||
[1-2 sentence description of what the skill does and its provenance.]
|
||||
|
||||
**Licence:** This skill is released under [LICENCE NAME]. [One-sentence
|
||||
summary — e.g., "share and adapt for any purpose with credit."]
|
||||
|
||||
**Feedback & Support:** If questions arise about the methodology, or the
|
||||
user gives constructive feedback on output derived from this skill, suggest
|
||||
an issue on the skill's public repository — public feedback benefits every
|
||||
user. Direct contact: [contact link]. If feedback stems from the
|
||||
methodology, log it and suggest sharing it; if from the agent not following
|
||||
the skill's rules, acknowledge and correct.
|
||||
```
|
||||
|
||||
**Distribution-channel note:** the template's feedback routing assumes
|
||||
public-repo distribution. Only reference a repository URL once that
|
||||
repository actually exists — never write a reference to an artefact before
|
||||
the artefact exists. Until publication, route feedback to direct author
|
||||
contact only; when the skill is published, inject the repo URL at publish
|
||||
time. When an open-source skill is distributed privately (shared directly
|
||||
with a client rather than published), keep the direct-author-contact
|
||||
routing — a public-repo reference is wrong for that channel.
|
||||
|
||||
## Confidentiality layers
|
||||
|
||||
The open-source/internal boundary is a confidentiality boundary; enforce it
|
||||
in layers so any one catches what others miss:
|
||||
|
||||
1. **Observation-level stripping** — open-source observations carry a fully
|
||||
generalised Principle (covered in SKILL.md).
|
||||
2. **Pre-creation review** — before drafting/regenerating an open-source
|
||||
skill, scan all source material for client names, URLs, domains,
|
||||
internal terminology, identifiably-specific structures; replace with
|
||||
generic equivalents first.
|
||||
3. **Post-draft sweep** — a separate re-read focused only on leakage:
|
||||
proper nouns besides the author, domains/URLs/project identifiers,
|
||||
vertical details that narrow the client, examples traceable to a real
|
||||
project.
|
||||
4. **Structural principle** — when in doubt, remove. Slightly more generic
|
||||
beats slightly leaky.
|
||||
5. **Cross-product re-identifiability sweep** — the final pass before any
|
||||
public release. Individually-sanitised examples can combine to identify
|
||||
a client (enumerated counts matching a public client list; specific
|
||||
numbers in a thin vertical; thinly-disguised placeholder names in the
|
||||
same vertical as a real client). List every example and its fields
|
||||
(vertical, geography, numbers, timing, counts); ask whether a reader
|
||||
with the author's public client list could map them; mitigate by
|
||||
blurring counts, widening verticals, using illustrative ranges, or
|
||||
consolidating into composites. Run this mechanically — the author is the
|
||||
least reliable judge because they know the ground truth.
|
||||
|
||||
## Editing skills — always start from the live file
|
||||
|
||||
1. The live file is the authoritative source: in Claude Code,
|
||||
`~/.claude/skills/{skill}/SKILL.md`; in Cowork, a read-only mount at
|
||||
`.claude/skills/{skill}/SKILL.md` (writes fail with EROFS by design).
|
||||
Do not edit skill files in place, in any environment — staging-only is
|
||||
what keeps the autonomous review safe.
|
||||
2. Always base edits on a fresh read of the live file — never a workspace
|
||||
copy, prior draft, or memory.
|
||||
3. Before overwriting any staged/workspace copy, diff it against the live
|
||||
file; if they differ, rebase your edits on the live version. (Observed
|
||||
failure: an update built on a stale snapshot silently dropped two
|
||||
sections added to the live skill the same day; only a pre-merge diff
|
||||
caught it.)
|
||||
4. Stage every update to
|
||||
`[workspace folder]/skill-updates/[date]/[skill-name]/` — the FULL
|
||||
skill directory (SKILL.md plus references/, scripts/, assets/ where
|
||||
present), never SKILL.md alone — and present it for review and
|
||||
installation; nothing goes live until the user installs it. Where no
|
||||
presentation/upload tool exists (e.g. Claude Code CLI), present the
|
||||
staged path and a change summary in chat instead; staging-only applies
|
||||
in every environment — it's the review loop's safety property, not a
|
||||
filesystem constraint. For any
|
||||
skill with supporting files, zip the staged directory into a `.skill`
|
||||
bundle and present the bundle, never the bare SKILL.md: a single-file
|
||||
delivery convention applied to a multi-file skill truncates it
|
||||
silently (the install succeeds, the skill loads, and the missing
|
||||
pieces only surface when a reference load or script call fails
|
||||
mid-task). **Pre-delivery gate — two items, checked at the moment of
|
||||
delivery, not just at drafting time:** (1) every `references/`,
|
||||
`scripts/`, `assets/` path in the staged SKILL.md body has its file in
|
||||
the staged set; (2) if the skill is multi-file, the delivery artefact
|
||||
is the `.skill` bundle — bare file links fail this gate even when all
|
||||
files are staged. (Reading this rule while drafting does not enforce
|
||||
it at delivery; run the gate as the last step before presenting.)
|
||||
Packaging hygiene: before zipping, sweep the staged tree for build
|
||||
artefacts (`__pycache__/`, `*.pyc`, `.DS_Store`, `.~lock.*`) left by
|
||||
in-session checks, and read the archive listing back after zipping —
|
||||
the listing is the cheap verification that catches leaked artefacts.
|
||||
5. When seeding a staged copy by copying from the read-only mount, reset
|
||||
write permissions immediately (`chmod -R u+w` on the staged path, or
|
||||
`cp --no-preserve=mode`) — the mount's read-only mode travels with
|
||||
the copy, for directories as well as files, and the follow-up edit
|
||||
otherwise fails with a permission error.
|
||||
6. Match process rigour to the change: complex/open-source/uncertain design
|
||||
→ use the skill-creator if available; internal skills with requirements
|
||||
already established in conversation → write directly, flagging
|
||||
substantial changes for review.
|
||||
|
||||
## Verifying relocations and restructures
|
||||
|
||||
When content is relocated verbatim (splits into core + references, merges,
|
||||
restructures), "nothing was lost" is checkable mechanically — but only with
|
||||
a two-tier check:
|
||||
|
||||
1. Enumerate every added/moved line via `diff` of the old base vs the new
|
||||
base.
|
||||
2. Exact-match each non-empty line against the restructured file set
|
||||
(`grep -F`).
|
||||
3. For misses, substance-check via a distinctive mid-line substring before
|
||||
concluding loss — most misses are container artifacts (heading-level
|
||||
changes, list-to-prose adaptation, re-wrapped lines splitting a phrase
|
||||
across newlines), not real losses.
|
||||
4. Word-count sanity check per file.
|
||||
|
||||
One tier alone either misses losses (substance-only) or cries wolf
|
||||
(exact-only). Additionally, inventory the original's enforcement
|
||||
mechanisms (checkpoints, assertions, invariants, mandatory-write rules,
|
||||
defaults) as an explicit checklist — compression preferentially destroys
|
||||
enforcement machinery because it reads as redundancy — and sweep any "pure
|
||||
restructuring" change for net-new behaviour, which hides well in a large
|
||||
rewording diff.
|
||||
|
||||
## New skills
|
||||
|
||||
Use the skill-creator when available, passing the observation(s) as the
|
||||
brief. Determine type early: open-source → strip and generalise; internal →
|
||||
include specifics freely; uncertain → default open-source and let the user
|
||||
add internal detail afterwards.
|
||||
|
||||
## Principle Propagation
|
||||
|
||||
When an observation's Principle applies to skills in general, log it with
|
||||
`Skill: All skills` and surface it; if the user approves, add it to
|
||||
`[workspace folder]/skill-observations/cross-cutting-principles.md`. That
|
||||
file is a mandatory checklist during any skill creation or regeneration.
|
||||
The user chooses propagation timing: immediate (update all skills now — for
|
||||
things like confidentiality rules) or opportunistic (apply at each skill's
|
||||
next update).
|
||||
|
||||
```markdown
|
||||
# Cross-Cutting Principles
|
||||
|
||||
Principles that apply to all skills. Read as a mandatory checklist during
|
||||
any skill creation or regeneration.
|
||||
|
||||
---
|
||||
|
||||
## Active Principles
|
||||
|
||||
### 1. [Principle title]
|
||||
|
||||
**Added:** [date]
|
||||
**Applies to:** [all skills | all open-source skills | all skills with rules]
|
||||
**Requirement:** [what it requires]
|
||||
**Propagation:** [immediate | opportunistic]
|
||||
**Status:** [active]
|
||||
```
|
||||
@@ -0,0 +1,201 @@
|
||||
# Comprehensive Review (scheduled or fallback)
|
||||
|
||||
Cross-checks all OPEN observations against all skills, propagates
|
||||
cross-cutting principles, and applies improvements that don't need user
|
||||
input. Two modes:
|
||||
|
||||
- **Scheduled autonomous review (preferred):** a recurring task (e.g.
|
||||
Mon/Wed/Fri mornings) via the platform's scheduler. Runs without the user
|
||||
present and applies non-escalated observations autonomously.
|
||||
- **In-session 7-day fallback:** pending at session start when BOTH are
|
||||
true: no scheduled review is registered (or none succeeded in 7+ days),
|
||||
AND `skill-observations/last-review-date.txt` contains `never` or a date
|
||||
more than 7 days old (a missing file is recreated with `never` — see
|
||||
Session Start steps 1 and 3; the file's value is authoritative, a date
|
||||
means a review actually ran). In an interactive session a pending
|
||||
fallback surfaces as a one-line offer and runs only if the user opts in
|
||||
(SKILL.md, Session Start step 3) — it never gates the user's task.
|
||||
|
||||
**Reachability — where does scheduled work actually run?** Scheduled mode
|
||||
requires the scheduling agent's execution environment to read and write
|
||||
the workspace folder. Persistence and execution context are independent
|
||||
axes: knowing where the state lives is not enough — check whether the
|
||||
scheduler runs somewhere that can reach it. Three regimes:
|
||||
|
||||
1. **Shared filesystem** (e.g. Cowork's mounted folder): scheduled mode
|
||||
works as described.
|
||||
2. **Local-only filesystem with a cloud scheduler** (e.g. remote routines
|
||||
that run on hosted infrastructure): scheduled mode is physically broken
|
||||
— the remote agent cannot read `skill-observations/` or stage updates
|
||||
to `skill-updates/`. Do not register a routine. Recommend a recurring
|
||||
calendar reminder plus a manual "run the skill review" trigger in a
|
||||
local session, or syncing the observation log to storage the scheduler
|
||||
can reach (e.g. a git repository it can clone).
|
||||
3. **Local-only filesystem with a local scheduler** (cron, Task Scheduler,
|
||||
a terminal-resident loop): works, but the user must keep the local
|
||||
agent runnable.
|
||||
|
||||
## Approval policy
|
||||
|
||||
**Interactive (user present):** always present observations grouped by
|
||||
skill (number, title, one-sentence summary), flag judgment calls as "needs
|
||||
your input", and wait for blanket or selective approval before applying.
|
||||
|
||||
**Scheduled autonomous (user absent):** apply non-escalated observations by
|
||||
default — safety comes from the staging-plus-review pattern (nothing is
|
||||
live until the user installs it). **Escalate without applying** when: (1)
|
||||
the observation proposes a NEW skill (naming/scope/type/licence need the
|
||||
user); (2) it removes or substantially restructures existing content; (3)
|
||||
it self-flags uncertainty ("not sure if…", "worth discussing…"); (4) two
|
||||
observations conflict. A scheduled run should still apply every
|
||||
non-escalated item — a review that applies nothing is just a report
|
||||
generator.
|
||||
|
||||
## Steps
|
||||
|
||||
**Step 0 — recommend scheduled setup (fallback mode only).** Ordering
|
||||
guard: run Step 1's no-observations short-circuit FIRST — if there are no
|
||||
OPEN observations and no outstanding principles, skip Step 0 entirely and
|
||||
just update the timestamp. A brand-new install must never get a setup
|
||||
prompt before it has done any work. Otherwise: check
|
||||
`skill-observations/scheduled-review-decline.txt`: if under 30 days old and
|
||||
the fallback isn't firing repeatedly, skip. Check for a registered
|
||||
scheduled task (scheduler presence or
|
||||
`skill-observations/scheduler-registered.txt`); if found, skip. Before
|
||||
offering, check reachability (see the regimes above): if the platform's
|
||||
scheduler runs where it cannot reach the workspace folder (regime 2), do
|
||||
NOT offer registration — recommend the calendar-reminder-plus-manual-
|
||||
trigger pattern instead, and skip the rest of this step. Otherwise
|
||||
offer to set one up. Yes → register via the platform scheduler (Cowork:
|
||||
`create-shortcut` / `set_scheduled_task`; terminal: cron), name it
|
||||
`weekly-skill-review`, use the draft prompt at
|
||||
`skill-observations/scheduled-task-draft.md` if present, then verify the
|
||||
registration actually succeeded (the scheduler lists the task, or the
|
||||
platform confirmed creation) BEFORE writing today's date to
|
||||
`scheduler-registered.txt`. If registration fails or can't be verified, do
|
||||
NOT write the marker — the marker would permanently suppress the fallback
|
||||
while no review ever runs. Tell the user registration failed and leave the
|
||||
fallback active. No → write today's date to
|
||||
`scheduled-review-decline.txt` (suppresses for 30 days; repeated fallback
|
||||
firings within the window re-surface the offer). No scheduler available in
|
||||
this environment → skip silently.
|
||||
|
||||
**Step 1 — load.** Archive entries resolved in _previous_ sessions (see
|
||||
Archival on Write in SKILL.md). Read the observation log.
|
||||
|
||||
Build the work queue from the structural identifiers, not from a status
|
||||
filter. The OPEN set is defined as: **status is literally OPEN, OR the
|
||||
observation has no Status line at all.** Concretely:
|
||||
|
||||
1. Enumerate all `### Observation N:` headers first — this is the
|
||||
authoritative list of entries in the log.
|
||||
2. For each header, classify the entry's status by looking for a
|
||||
`**Status:**` line within its body. Treat a missing, blank, or any
|
||||
non-ACTIONED / non-DECLINED status as OPEN.
|
||||
3. Never derive the work queue from a `grep '**Status:** OPEN'` alone.
|
||||
Derive it from the header list minus the resolved (ACTIONED /
|
||||
DECLINED) entries. A grep on an optional field silently drops every
|
||||
entry missing that field — the review then confidently reports a
|
||||
clean log while a backlog of untriaged observations is skipped.
|
||||
|
||||
**Reconciliation guard:** before proceeding, assert that
|
||||
`count(### Observation headers) == count(status-classified entries)`.
|
||||
If the counts differ, the delta is statusless entries — surface and
|
||||
triage them (as OPEN) rather than proceeding as if the log were clean.
|
||||
|
||||
Also read all active cross-cutting principles. If there are no OPEN
|
||||
observations and no outstanding principles: report "no open observations
|
||||
or outstanding principles", update the timestamp, and stop.
|
||||
|
||||
**Step 2 — inventory skills.** List all skills (system prompt
|
||||
`<available_skills>` or the skills directory). Only user-owned custom
|
||||
skills can be updated. Known read-only system skills: docx, pdf, xlsx,
|
||||
pptx, skill-creator, schedule (grow this list when an update fails for
|
||||
permissions). Observations targeting a system skill are NOT skipped — route
|
||||
them to a complementary user-owned `{system-skill}-extras` skill containing
|
||||
only the delta, creating it if needed and noting the pairing in
|
||||
configuration.
|
||||
|
||||
**Step 3 — cross-check observations.** Evaluate every OPEN observation
|
||||
against every skill — not just the skill named in its header; Principles
|
||||
often generalise. Build skill → [relevant observations]. Interactive:
|
||||
present all of it and await approval. Autonomous: apply the approval policy
|
||||
above and continue.
|
||||
|
||||
**Step 4 — cross-check principles.** Flag every skill that doesn't yet
|
||||
comply with each active cross-cutting principle.
|
||||
|
||||
**Step 5 — apply.** For each skill with approved/non-escalated items,
|
||||
produce an updated SKILL.md: integrate insights into the sections where
|
||||
they belong (never append an observations list at the bottom); preserve
|
||||
structure, voice, and attribution; place new rules where they logically
|
||||
live. Follow the editing rules in `references/skill-authoring.md` (live
|
||||
file as base, staging, diff-before-overwrite).
|
||||
|
||||
**Step 6 — mark ACTIONED.** Update each applied observation's status:
|
||||
`ACTIONED (YYYY-MM-DD) — Applied to [skill-name] (weekly review)`. The
|
||||
date immediately after the status word is load-bearing: archival is gated
|
||||
on it (entries archive only when it's before today), so a dateless mark
|
||||
breaks the cross-session grace period. Do NOT archive same-session — the
|
||||
next log write on a later day archives them.
|
||||
|
||||
**Step 7 — timestamp.** Write today's date to
|
||||
`skill-observations/last-review-date.txt`.
|
||||
|
||||
**Step 8 — deliver and summarise.** Stage updated skills (see Delivery
|
||||
below), then present:
|
||||
|
||||
```
|
||||
## Weekly Skill Review Complete — [date]
|
||||
|
||||
Updated skills ([N] observations, [N] principles applied):
|
||||
|
||||
**[skill-name]** — [1-sentence change summary]; observations #[N], #[N]
|
||||
|
||||
### Observations Actioned
|
||||
[numbers and titles]
|
||||
|
||||
### Skipped (needs manual review)
|
||||
[items with reasons]
|
||||
```
|
||||
|
||||
Wait for the user to acknowledge before other work.
|
||||
|
||||
## Constraints
|
||||
|
||||
- Don't modify observation entries beyond their status field.
|
||||
- Don't create new skills in a review — note candidates for the user to
|
||||
action via the skill-creator.
|
||||
- Unsure how to integrate an observation → skip it and say so in the
|
||||
summary.
|
||||
- Treat internal observations with the same rigour as open-source.
|
||||
|
||||
## Delivering updated skills
|
||||
|
||||
Save each updated skill to
|
||||
`[workspace folder]/skill-updates/[date]/[skill-name]/` — the FULL skill
|
||||
directory (SKILL.md plus references/, scripts/, assets/ where present),
|
||||
never SKILL.md alone — and present it for review and installation. In
|
||||
Cowork: via `present_files` and its upload button. In environments without
|
||||
a presentation tool (e.g. Claude Code CLI): report the staged path and a
|
||||
change summary in chat and let the user review and install from there.
|
||||
Never write to the live skill directly, even where the skills directory is
|
||||
writable — staging-only is a deliberate safety property of the review loop
|
||||
(nothing goes live without the user's sign-off), not a filesystem
|
||||
constraint. For any skill with
|
||||
supporting files, zip the staged directory into a `.skill` bundle and
|
||||
present the bundle; a bare SKILL.md install silently truncates a
|
||||
multi-file skill. Pre-delivery gate (two items, run as the last step
|
||||
before presenting): (1) grep the staged SKILL.md body for `references/`,
|
||||
`scripts/`, `assets/` paths and fail the delivery if any referenced file
|
||||
is missing from the staged set; (2) for multi-file skills, fail the
|
||||
delivery if the artefact being presented is bare file links rather than
|
||||
the `.skill` bundle. Sweep build artefacts (`__pycache__/`, `*.pyc`,
|
||||
`.DS_Store`, `.~lock.*`) before zipping and read the archive listing back
|
||||
after. When seeding staged
|
||||
copies from the read-only mount, `chmod -R u+w` the staged path first —
|
||||
the mount's read-only mode travels with the copy, for directories as
|
||||
well as files. Do not edit skill files in place — nothing goes live
|
||||
until the user installs it. **Keep-two rule:** for any skill, keep only
|
||||
the two most recent date directories under `skill-updates/`; delete
|
||||
older ones.
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,553 @@
|
||||
export const meta = {
|
||||
name: "bughunt-fix",
|
||||
description:
|
||||
"Fix open ledger findings test-first: per-file agents, mechanical revert-proof, serial commits, one ci-check gate",
|
||||
whenToUse:
|
||||
"After a bughunt run has been written to the findings ledger and a human has skimmed it. Consumes open findings, produces commits on a branch. Never opens a PR.",
|
||||
phases: [
|
||||
{ title: "Plan", detail: "cluster open findings by file" },
|
||||
{ title: "Fix", detail: "sonnet/xhigh: one agent per file, test-first, no git" },
|
||||
{ title: "Prove", detail: "opus/high: serial revert-proof then commit per cluster" },
|
||||
{ title: "Gate", detail: "sonnet/xhigh: ci-check for the touched stacks, once" },
|
||||
],
|
||||
};
|
||||
|
||||
// args has been observed arriving JSON-stringified; coerce it the same way bughunt.js does.
|
||||
const ARGS = (() => {
|
||||
if (typeof args === "string") {
|
||||
try {
|
||||
return JSON.parse(args) || {};
|
||||
} catch {
|
||||
return {};
|
||||
}
|
||||
}
|
||||
return args || {};
|
||||
})();
|
||||
|
||||
const SEV_RANK = { critical: 0, high: 1, medium: 2, low: 3 };
|
||||
const BRANCH = ARGS.branch || "fix/bughunt";
|
||||
const ONLY = Array.isArray(ARGS.only) && ARGS.only.length ? new Set(ARGS.only) : null;
|
||||
const MAX_SEVERITY = ARGS.maxSeverity || "low";
|
||||
const ALL = Array.isArray(ARGS.findings) ? ARGS.findings : [];
|
||||
// Circuit breaker: stop a run that is going systematically wrong instead of spending a
|
||||
// high-effort agent on every remaining cluster. `declined` is not a failure - it is a
|
||||
// judgement the fix prompt explicitly invites - so only `blocked` counts.
|
||||
// ?? not || so an explicit threshold of 0 is honoured.
|
||||
const BREAKER =
|
||||
ARGS.circuitBreaker === false
|
||||
? null
|
||||
: {
|
||||
threshold: ARGS.circuitBreaker?.threshold ?? 0.5,
|
||||
minAttempts: ARGS.circuitBreaker?.minAttempts ?? 3,
|
||||
};
|
||||
let breaker = null; // set to a report object if it trips
|
||||
|
||||
// ---------- phase 1: plan ----------
|
||||
phase("Plan");
|
||||
|
||||
const excluded = [];
|
||||
const selected = [];
|
||||
for (const f of ALL) {
|
||||
if (f.status && f.status !== "open") {
|
||||
excluded.push({ id: f.id, reason: `status is ${f.status}, not open` });
|
||||
} else if (ONLY && !ONLY.has(f.id)) {
|
||||
excluded.push({ id: f.id, reason: "not in only" });
|
||||
} else if ((SEV_RANK[f.severity] ?? 3) > (SEV_RANK[MAX_SEVERITY] ?? 3)) {
|
||||
excluded.push({ id: f.id, reason: "below maxSeverity" });
|
||||
} else {
|
||||
selected.push(f);
|
||||
}
|
||||
}
|
||||
|
||||
// Group by file. One agent per file is what removes merge conflicts (clusters are disjoint)
|
||||
// and what makes a root-cause fix possible - the agent sees every defect in the file at once.
|
||||
// Normalize the grouping key (backslashes -> forward slashes) so a path reported with the
|
||||
// "wrong" separator does not silently split one real file into two clusters.
|
||||
const byFile = new Map();
|
||||
for (const f of selected) {
|
||||
const key = String(f.file).replace(/\\/g, "/");
|
||||
if (!byFile.has(key)) byFile.set(key, []);
|
||||
byFile.get(key).push(f);
|
||||
}
|
||||
const clusters = [...byFile.entries()].map(([file, findings]) => ({
|
||||
file,
|
||||
ids: findings.map((f) => f.id),
|
||||
findings,
|
||||
}));
|
||||
|
||||
log(
|
||||
`plan: ${selected.length} finding(s) in ${clusters.length} file cluster(s) on ${BRANCH}` +
|
||||
(BREAKER
|
||||
? ` (breaker: stop above ${Math.round(BREAKER.threshold * 100)}% failures after ${BREAKER.minAttempts} attempts)`
|
||||
: " (breaker disabled)"),
|
||||
);
|
||||
for (const c of clusters) log(` ${c.file}: ${c.ids.join(", ")}`);
|
||||
// Announce every exclusion by id. Silent truncation reads as "covered everything" when it did not.
|
||||
for (const e of excluded) log(` excluded ${e.id}: ${e.reason}`);
|
||||
|
||||
const publicClusters = clusters.map((c) => ({ file: c.file, ids: c.ids }));
|
||||
|
||||
// ---------- schemas ----------
|
||||
const FIX_RESULTS = {
|
||||
type: "object",
|
||||
required: ["results", "touchedPaths"],
|
||||
properties: {
|
||||
results: {
|
||||
type: "array",
|
||||
items: {
|
||||
type: "object",
|
||||
required: ["id", "outcome", "testPath", "rationale"],
|
||||
properties: {
|
||||
id: { type: "string", description: "the ledger id, e.g. OC-0042" },
|
||||
outcome: { type: "string", enum: ["fixed", "declined", "blocked"] },
|
||||
testPath: {
|
||||
type: "string",
|
||||
description:
|
||||
"repo-relative path of the test that pins this finding; empty if not fixed",
|
||||
},
|
||||
rationale: {
|
||||
type: "string",
|
||||
description: "required for declined and blocked; empty for fixed",
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
touchedPaths: {
|
||||
type: "array",
|
||||
items: { type: "string" },
|
||||
description:
|
||||
"every non-test SOURCE file this agent modified while working this cluster, repo-relative, forward " +
|
||||
"slashes - including cluster.file itself if it was touched, and any shared file outside the cluster " +
|
||||
"the root-cause fix required. Test files belong in testPath (per finding), not here.",
|
||||
},
|
||||
},
|
||||
};
|
||||
|
||||
// ---------- phase 2: fix ----------
|
||||
phase("Fix");
|
||||
|
||||
function fixPrompt(cluster) {
|
||||
return (
|
||||
`You are fixing confirmed bugs in ONE file of the OwnCord repo (checked out at your current working ` +
|
||||
`directory - do not assume any absolute path; use repo-relative paths).\n` +
|
||||
`Your file: ${cluster.file}\n\n` +
|
||||
`You own this CLUSTER for this run: no other agent has this file as its cluster, so fix ALL of the ` +
|
||||
`findings below together rather than one at a time. But cluster fixes may share a file (rule 4 cuts ` +
|
||||
`both ways), so another cluster's root-cause edit can still land in this file while you work. ` +
|
||||
`Re-read the exact region you are about to edit immediately before each edit rather than trusting a ` +
|
||||
`full-file read from the start of your turn, and treat any editor warning that the file changed ` +
|
||||
`since you last read it as a signal to re-read and re-target, never to force the edit through.\n\n` +
|
||||
`RULES\n` +
|
||||
` 1. Test first. For each finding, write a test that FAILS against the current code before you ` +
|
||||
`change anything, and run it to watch it fail. A test that passes before the fix does not pin the ` +
|
||||
`bug and will be rejected mechanically later.\n` +
|
||||
` 2. Never make a failing test pass by weakening an assertion. The existing suite is green and must ` +
|
||||
`stay green on its current assertions.\n` +
|
||||
` 3. Fix the ROOT CAUSE. Grep every caller of the function you are about to change. One guard in a ` +
|
||||
`shared function beats a guard in every caller, and patching only the path a finding names leaves its ` +
|
||||
`siblings broken.\n` +
|
||||
` 4. You may edit a shared file outside your own cluster (${cluster.file}) when that is where the ` +
|
||||
`root cause lives. If you do, you MUST list every SOURCE file you modified - including this cluster's ` +
|
||||
`own file - in touchedPaths, repo-relative with forward slashes. Test files belong in testPath, not ` +
|
||||
`touchedPaths. If you regenerate shared generated output (sqlc, protocol), list EVERY generated ` +
|
||||
`file the regeneration changed - check with git status --porcelain (read-only, allowed despite ` +
|
||||
`rule 6), do not guess: an unlisted generated file defeats the cross-cluster overlap guard.\n` +
|
||||
` 5. Because several findings share this file, look for one change that closes more than one of them ` +
|
||||
`before writing separate patches.\n` +
|
||||
` 6. DO NOT run any git command. No add, no commit, no stash, no checkout. Other agents are working ` +
|
||||
`in this same working tree and git operations collide on the index lock. Leave your changes in the ` +
|
||||
`working tree; a later serial phase commits them.\n` +
|
||||
` 7. If a finding is wrong, or the correct fix is a deliberate product decision you should not make ` +
|
||||
`alone, return outcome "declined" with a rationale. Do not invent a fix you do not believe in.\n` +
|
||||
` 8. If you cannot fix it for a mechanical reason (missing fixture, unclear repro), return "blocked" ` +
|
||||
`with a rationale.\n\n` +
|
||||
`Client tests run from Client with:\n` +
|
||||
` NODE_OPTIONS=--no-experimental-webstorage npx vitest run <testfile>\n` +
|
||||
`Server tests run from Server with:\n` +
|
||||
` go test ./<pkg>/ -run <TestName>\n\n` +
|
||||
`Return one result per finding id, all ${cluster.ids.length} of them, plus touchedPaths.\n\n` +
|
||||
`--- FINDINGS IN ${cluster.file} ---\n${JSON.stringify(cluster.findings, null, 2)}`
|
||||
);
|
||||
}
|
||||
|
||||
const fixOutcomes = await parallel(
|
||||
clusters.map(
|
||||
(cluster) => () =>
|
||||
agent(fixPrompt(cluster), {
|
||||
label: `fix:${cluster.file}`,
|
||||
phase: "Fix",
|
||||
model: "sonnet",
|
||||
effort: "xhigh",
|
||||
schema: FIX_RESULTS,
|
||||
}).then((r) => ({
|
||||
cluster,
|
||||
results: (r && r.results) || [],
|
||||
touchedPaths:
|
||||
r && Array.isArray(r.touchedPaths)
|
||||
? r.touchedPaths.filter((p) => typeof p === "string" && p)
|
||||
: [],
|
||||
})),
|
||||
),
|
||||
);
|
||||
|
||||
// A null slot means the agent died or threw. Its findings are blocked, its siblings are unaffected.
|
||||
const fixed = [];
|
||||
for (let i = 0; i < clusters.length; i++) {
|
||||
const cluster = clusters[i];
|
||||
const outcome = fixOutcomes[i];
|
||||
if (!outcome) {
|
||||
log(`fix ${cluster.file}: agent failed - ${cluster.ids.length} finding(s) blocked`);
|
||||
fixed.push({
|
||||
cluster,
|
||||
results: cluster.ids.map((id) => ({
|
||||
id,
|
||||
outcome: "blocked",
|
||||
testPath: "",
|
||||
rationale: "fix agent failed or returned nothing",
|
||||
})),
|
||||
touchedPaths: [],
|
||||
union: [cluster.file],
|
||||
});
|
||||
continue;
|
||||
}
|
||||
// A hallucinated id, or one copy-pasted from a different cluster, must not merge in silently.
|
||||
const ownIds = new Set(cluster.ids);
|
||||
const ownResults = outcome.results.filter((r) => ownIds.has(r.id));
|
||||
const foreignResults = outcome.results.filter((r) => !ownIds.has(r.id));
|
||||
if (foreignResults.length) {
|
||||
log(
|
||||
`fix ${cluster.file}: dropped ${foreignResults.length} result(s) for id(s) not in this cluster - ${foreignResults.map((r) => r.id).join(", ")}`,
|
||||
);
|
||||
}
|
||||
// An agent that skipped a finding entirely leaves it blocked rather than silently dropped.
|
||||
const reported = new Set(ownResults.map((r) => r.id));
|
||||
const missing = cluster.ids
|
||||
.filter((id) => !reported.has(id))
|
||||
.map((id) => ({
|
||||
id,
|
||||
outcome: "blocked",
|
||||
testPath: "",
|
||||
rationale: "fix agent returned no result for this finding",
|
||||
}));
|
||||
if (missing.length)
|
||||
log(`fix ${cluster.file}: ${missing.length} finding(s) unreported by the agent - blocked`);
|
||||
fixed.push({
|
||||
cluster,
|
||||
results: [...ownResults, ...missing],
|
||||
touchedPaths: outcome.touchedPaths,
|
||||
union: [...new Set([cluster.file, ...outcome.touchedPaths])],
|
||||
});
|
||||
}
|
||||
|
||||
// ---------- phase 2.5: cross-cluster overlap guard ----------
|
||||
// Rule 4 above lets an agent fix a shared root cause outside its own file - the per-file
|
||||
// disjointness the whole design leans on (no merge conflicts, a clean revert per cluster) no
|
||||
// longer holds automatically once that happens. If two clusters' agents both touched the same
|
||||
// path, Phase 3 cannot safely revert/stage per-cluster: one cluster's revert could silently
|
||||
// undo the other's real fix (a misattributed VACUOUS TEST) or a real change could never get
|
||||
// staged at all. Block both clusters rather than guess which one "owns" the shared file.
|
||||
for (let i = 0; i < fixed.length; i++) {
|
||||
for (let j = i + 1; j < fixed.length; j++) {
|
||||
const a = fixed[i];
|
||||
const b = fixed[j];
|
||||
const shared = a.union.filter((p) => b.union.includes(p));
|
||||
if (!shared.length) continue;
|
||||
log(
|
||||
`blocked: ${a.cluster.file} and ${b.cluster.file} both touch ${shared.join(", ")} - both clusters blocked`,
|
||||
);
|
||||
for (const [entry, other] of [
|
||||
[a, b],
|
||||
[b, a],
|
||||
]) {
|
||||
for (const r of entry.results) {
|
||||
if (r.outcome === "fixed") {
|
||||
r.outcome = "blocked";
|
||||
r.rationale = `cross-cluster edit: shares ${shared.join(", ")} with ${other.cluster.file} - needs a human`;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
const allResults = fixed.flatMap((f) => f.results);
|
||||
log(
|
||||
`fix: ${allResults.filter((r) => r.outcome === "fixed").length} fixed, ` +
|
||||
`${allResults.filter((r) => r.outcome === "declined").length} declined, ` +
|
||||
`${allResults.filter((r) => r.outcome === "blocked").length} blocked`,
|
||||
);
|
||||
|
||||
// ---------- phase 2.6: circuit breaker (fix stage) ----------
|
||||
// A high blocked rate here means the fixing itself is failing - bad ledger coordinates, a
|
||||
// broken test runner, agents that cannot run the suite. Proving each of those costs a
|
||||
// serial agent per cluster and cannot succeed, so stop before spending it.
|
||||
if (BREAKER) {
|
||||
const attempted = allResults.filter((r) => r.outcome !== "declined").length;
|
||||
const failed = allResults.filter((r) => r.outcome === "blocked").length;
|
||||
if (attempted >= BREAKER.minAttempts && failed / attempted > BREAKER.threshold) {
|
||||
breaker = {
|
||||
trippedAt: "fix",
|
||||
attempted,
|
||||
failed,
|
||||
threshold: BREAKER.threshold,
|
||||
reason: `${failed}/${attempted} finding(s) could not be fixed - skipping prove and commit entirely`,
|
||||
};
|
||||
log(`CIRCUIT BREAKER: ${breaker.reason}`);
|
||||
}
|
||||
}
|
||||
|
||||
// ---------- phase 3: prove + commit ----------
|
||||
phase("Prove");
|
||||
|
||||
const PROVE_RESULT = {
|
||||
type: "object",
|
||||
required: [
|
||||
"committed",
|
||||
"sha",
|
||||
"redObserved",
|
||||
"greenObserved",
|
||||
"redOutput",
|
||||
"greenOutput",
|
||||
"note",
|
||||
],
|
||||
properties: {
|
||||
committed: { type: "boolean" },
|
||||
sha: { type: "string", description: "short sha of the commit, empty when not committed" },
|
||||
redObserved: { type: "boolean", description: "did the tests FAIL with the source reverted" },
|
||||
greenObserved: { type: "boolean", description: "did the tests PASS with the fix restored" },
|
||||
redOutput: {
|
||||
type: "string",
|
||||
description:
|
||||
"the ACTUAL output of the test run performed with the source reverted (step 4), including the " +
|
||||
"command that was run. This run must FAIL. Paste the real captured output verbatim - not a " +
|
||||
"summary, not a paraphrase.",
|
||||
},
|
||||
greenOutput: {
|
||||
type: "string",
|
||||
description:
|
||||
"the ACTUAL output of the test run performed after the fix was restored (step 6), including the " +
|
||||
"command that was run. This run must PASS. Paste the real captured output verbatim - not a " +
|
||||
"summary, not a paraphrase.",
|
||||
},
|
||||
note: { type: "string", description: "why it was not committed, empty on success" },
|
||||
},
|
||||
};
|
||||
|
||||
function provePrompt(cluster, fixedIds, testPaths, sourcePaths) {
|
||||
return (
|
||||
`You are proving and committing ONE cluster of fixes in the OwnCord repo ` +
|
||||
`(checked out at your current working directory - do not assume any absolute path), on branch ${BRANCH}.\n\n` +
|
||||
`Source file(s): ${sourcePaths.join(", ")}\n` +
|
||||
`Findings fixed here: ${fixedIds.join(", ")}\n` +
|
||||
`Test files written: ${testPaths.join(", ") || "(none reported)"}\n\n` +
|
||||
`You are running SERIALLY. No other agent is touching git right now, so you may use git freely.\n\n` +
|
||||
`Do exactly this, in order:\n` +
|
||||
` 1. Run: git rev-parse --abbrev-ref HEAD\n` +
|
||||
` It MUST print exactly "${BRANCH}". If it does not, DO NOT touch git any further: set ` +
|
||||
`committed=false, explain in note which branch you actually found, and STOP. Committing to the wrong ` +
|
||||
`branch (e.g. main, because the operator forgot to create/checkout ${BRANCH} first) is not recoverable ` +
|
||||
`by this agent.\n` +
|
||||
` 2. Copy the current (fixed) contents of ALL source file(s) listed above to a scratch location ` +
|
||||
`outside the repo.\n` +
|
||||
` 3. Run: git checkout HEAD -- ${sourcePaths.join(" ")}\n` +
|
||||
` Revert every source path listed above, and nothing else. Do NOT revert or delete the test ` +
|
||||
`files - a brand-new test file is untracked and this leaves it alone, and a new case in an existing ` +
|
||||
`test file is a modification to a path you did not name, so it survives too. Either way the new ` +
|
||||
`assertions are present while the fix is gone.\n` +
|
||||
` 4. Run the tests listed above. They MUST fail. Set redObserved accordingly. Capture the ACTUAL ` +
|
||||
`output of this run, including the command you ran, and return it verbatim in redOutput - not a ` +
|
||||
`summary, not a paraphrase.\n` +
|
||||
` If they PASS, the tests do not pin the bug - they are vacuous. Restore the fixed source from ` +
|
||||
`scratch, set committed=false, explain in note, and STOP. Do not commit. Do not try to repair the ` +
|
||||
`test yourself.\n` +
|
||||
` 5. Restore the fixed source file(s) from your scratch copy.\n` +
|
||||
` 6. Run the tests again. They MUST pass. Set greenObserved accordingly. Capture the ACTUAL output ` +
|
||||
`of this run, including the command you ran, and return it verbatim in greenOutput - not a summary, ` +
|
||||
`not a paraphrase. If they do not pass, set committed=false, explain in note, and STOP.\n` +
|
||||
` 7. Before staging, diff every file you are about to commit and check the content belongs to ` +
|
||||
`THIS cluster: other agents' uncommitted work shares this tree, and shared test files or ` +
|
||||
`regenerated output can carry their hunks. A test function or comment citing a finding id not ` +
|
||||
`listed above, or a hunk in a generated/shared file unrelated to your findings, must NOT be ` +
|
||||
`committed - set committed=false, name the foreign content in note, and STOP.\n` +
|
||||
` 8. Stage ALL source file(s) listed above (git add ${sourcePaths.join(" ")}) AND the test files. ` +
|
||||
`Then check git status --porcelain for OTHER modified tracked test files in the same package(s)/` +
|
||||
`directory(ies) as your source files: a fix in this cluster may have rewritten a pre-existing test ` +
|
||||
`that locked the old behavior, or widened an interface that a fake/mock in a sibling test file must ` +
|
||||
`now implement - leaving such a companion uncommitted makes the committed branch fail or not compile ` +
|
||||
`on its own. If the modification's content belongs to THIS cluster's fix (per the step-7 check), ` +
|
||||
`stage it too; if it cites another cluster's findings, leave it. Commit with subject:\n` +
|
||||
` fix(<area>): ${fixedIds.length} defect(s) (${fixedIds.join(", ")})\n` +
|
||||
` Use a conventional-commit area matching the file (voice, ws, client, identity...). Do not add a ` +
|
||||
`Co-Authored-By trailer.\n` +
|
||||
` 9. Return the short sha.\n\n` +
|
||||
`Client tests run from Client with:\n` +
|
||||
` NODE_OPTIONS=--no-experimental-webstorage npx vitest run <testfile>\n` +
|
||||
`Server tests run from Server with:\n` +
|
||||
` go test ./<pkg>/ -run <TestName>`
|
||||
);
|
||||
}
|
||||
|
||||
const commits = [];
|
||||
let proveAttempts = 0;
|
||||
let proveFailures = 0;
|
||||
// Serial on purpose: parallel git commands collide on .git/index.lock.
|
||||
for (const { cluster, results, union } of fixed) {
|
||||
if (breaker) {
|
||||
// Tripped either before the loop (fix stage) or on an earlier iteration. Everything
|
||||
// from here on was never attempted; say so rather than leaving it reported as fixed,
|
||||
// which would put a `fixed` status in the ledger with no commit behind it.
|
||||
for (const r of results) {
|
||||
if (r.outcome === "fixed") {
|
||||
r.outcome = "blocked";
|
||||
r.rationale = `circuit breaker tripped before this cluster was attempted (${breaker.reason}); edits are uncommitted in the working tree`;
|
||||
}
|
||||
}
|
||||
continue;
|
||||
}
|
||||
const fixedHere = results.filter((r) => r.outcome === "fixed");
|
||||
if (!fixedHere.length) {
|
||||
log(`prove ${cluster.file}: no fixes to prove - skipped`);
|
||||
continue;
|
||||
}
|
||||
const ids = fixedHere.map((r) => r.id);
|
||||
const testPaths = [...new Set(fixedHere.map((r) => r.testPath).filter(Boolean))];
|
||||
// A dead/thrown prove agent must not take down the sibling clusters still waiting in this
|
||||
// serial loop - same "one blocked cluster does not poison the rest" rule Phase 2 gets from
|
||||
// parallel()'s catch. Fold it into a null result so the ok/why logic below handles it uniformly.
|
||||
// Opus on purpose: prove is the last eyes before content reaches a public commit. The
|
||||
// 2026-08-14 run's sonnet prove agents staged a sibling cluster's test function and a
|
||||
// regenerated-file hunk from another cluster's uncommitted work without noticing either.
|
||||
const p = await agent(provePrompt(cluster, ids, testPaths, union), {
|
||||
label: `prove:${cluster.file}`,
|
||||
phase: "Prove",
|
||||
model: "opus",
|
||||
effort: "high",
|
||||
schema: PROVE_RESULT,
|
||||
}).catch(() => null);
|
||||
|
||||
// Counted before the ok check on purpose: successes belong in the denominator. Increment
|
||||
// this inside the failure branch instead and the ratio is failures-over-failures, which is
|
||||
// always 1.0 - the breaker would trip on the first failed cluster at any threshold.
|
||||
proveAttempts++;
|
||||
const ok = p && p.committed && p.redObserved && p.greenObserved && p.sha;
|
||||
if (!ok) {
|
||||
const why = !p
|
||||
? "prove agent failed"
|
||||
: !p.redObserved
|
||||
? `revert-proof failed: tests still passed with the fix reverted (${p.note || "no note"})`
|
||||
: !p.greenObserved
|
||||
? `tests did not pass after restoring the fix (${p.note || "no note"})`
|
||||
: `not committed (${p.note || "no note"})`;
|
||||
log(`prove ${cluster.file}: ${why} - ${ids.length} finding(s) blocked`);
|
||||
for (const r of results) {
|
||||
if (r.outcome === "fixed") {
|
||||
r.outcome = "blocked";
|
||||
r.rationale = why;
|
||||
}
|
||||
}
|
||||
proveFailures++;
|
||||
if (
|
||||
BREAKER &&
|
||||
proveAttempts >= BREAKER.minAttempts &&
|
||||
proveFailures / proveAttempts > BREAKER.threshold
|
||||
) {
|
||||
breaker = {
|
||||
trippedAt: "prove",
|
||||
attempted: proveAttempts,
|
||||
failed: proveFailures,
|
||||
threshold: BREAKER.threshold,
|
||||
reason: `${proveFailures}/${proveAttempts} cluster(s) failed their revert-proof - stopping before the rest`,
|
||||
};
|
||||
log(`CIRCUIT BREAKER: ${breaker.reason}`);
|
||||
}
|
||||
continue;
|
||||
}
|
||||
commits.push({ sha: p.sha, file: cluster.file, ids });
|
||||
log(`prove ${cluster.file}: committed ${p.sha} (${ids.join(", ")})`);
|
||||
}
|
||||
|
||||
// ---------- phase 4: gate ----------
|
||||
const GATE_RESULT = {
|
||||
type: "object",
|
||||
required: ["passed", "stacks", "output"],
|
||||
properties: {
|
||||
passed: { type: "boolean" },
|
||||
stacks: { type: "array", items: { type: "string" } },
|
||||
output: {
|
||||
type: "string",
|
||||
description: "the failing command and its output, or a short ok summary",
|
||||
},
|
||||
},
|
||||
};
|
||||
|
||||
function stacksFor(files) {
|
||||
const s = new Set();
|
||||
for (const f of files) {
|
||||
if (f.startsWith("Server/")) s.add("server");
|
||||
else if (f.startsWith("Client/src-tauri/")) s.add("rust");
|
||||
else if (f.startsWith("Client/")) s.add("client");
|
||||
}
|
||||
return [...s];
|
||||
}
|
||||
|
||||
const GATE_COMMANDS = {
|
||||
client:
|
||||
`From Client:\n` +
|
||||
` NODE_OPTIONS=--no-experimental-webstorage npm test\n` +
|
||||
` npm run typecheck\n` +
|
||||
` npm run lint\n` +
|
||||
` npm run format:check`,
|
||||
server:
|
||||
`From Server:\n` +
|
||||
` go build ./... && go build -tags otel ./... && go build -tags wazero ./... && go build -tags otel,wazero ./...\n` +
|
||||
` go vet ./...\n` +
|
||||
` go test -race ./...\n` +
|
||||
` go test -tags deadlock -count=1 ./ws/\n` +
|
||||
` golangci-lint run\n` +
|
||||
` make sqlc-verify protocol-verify # generated output must not be stale. If make is not on PATH, ` +
|
||||
`run the equivalent commands directly instead: ` +
|
||||
`"sqlc generate && git diff --exit-code db/dbgen" and ` +
|
||||
`"go run ./cmd/genprotocol && git diff --exit-code ws/message_types.go ../Client/src/lib/protocolTypes.ts" ` +
|
||||
`- a non-empty diff in either means generated code is stale and the gate fails`,
|
||||
rust:
|
||||
`From Client/src-tauri:\n` + ` cargo test\n` + ` cargo clippy --all-targets -- -D warnings`,
|
||||
};
|
||||
|
||||
let gate = null;
|
||||
if (commits.length) {
|
||||
phase("Gate");
|
||||
const stacks = stacksFor(commits.map((c) => c.file));
|
||||
gate = await agent(
|
||||
`Run the OwnCord CI gates locally for the stacks touched by this fix run, on branch ${BRANCH}.\n\n` +
|
||||
`This runs ONCE for the whole run - a full gate per fix would take longer than the fixing did.\n\n` +
|
||||
`Touched stacks: ${stacks.join(", ")}\n\n` +
|
||||
stacks.map((s) => GATE_COMMANDS[s]).join("\n\n") +
|
||||
`\n\nRun every command for every touched stack. Report passed=false if ANY of them fails, and put ` +
|
||||
`the failing command plus the relevant output in "output". Do NOT fix anything, do NOT amend or ` +
|
||||
`revert any commit, and do NOT push. Reporting the failure accurately is the whole job.\n\n` +
|
||||
`Known false alarm: a windows -race failure inside ws whose stack mentions runtime.scanstack or ` +
|
||||
`runtime.(*unwinder).next is a Go 1.26.5 runtime GC fault, not a real failure - rerun that package ` +
|
||||
`once before reporting it.`,
|
||||
{ label: "gate", phase: "Gate", model: "sonnet", effort: "xhigh", schema: GATE_RESULT },
|
||||
).catch(() => null);
|
||||
// A malformed/missing report (dead agent, or a schema the caller didn't honor) is treated as a
|
||||
// failed gate, same as the null-check pattern in phases 2 and 3 - never crash on shape here.
|
||||
if (!gate || typeof gate.passed !== "boolean" || !Array.isArray(gate.stacks))
|
||||
gate = {
|
||||
passed: false,
|
||||
stacks,
|
||||
output: (gate && gate.output) || "gate agent failed to report",
|
||||
};
|
||||
log(`gate: ${gate.passed ? "PASS" : "FAIL"} (${gate.stacks.join(", ")})`);
|
||||
} else {
|
||||
log("gate: nothing committed - skipped");
|
||||
}
|
||||
|
||||
return {
|
||||
branch: BRANCH,
|
||||
clusters: publicClusters,
|
||||
excluded,
|
||||
commits,
|
||||
results: allResults,
|
||||
gate,
|
||||
breaker,
|
||||
};
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,30 @@
|
||||
# Editor baseline for OwnCord. Pairs with .gitattributes (`* text=auto eol=lf`)
|
||||
# and the repository Prettier config — all three agree on LF and trailing
|
||||
# newlines, so an editor that honours this file produces bytes CI accepts.
|
||||
#
|
||||
# This is a baseline, not a gate. Prettier, gofmt and rustfmt are what actually
|
||||
# fail the build; nothing lints this file.
|
||||
root = true
|
||||
|
||||
[*]
|
||||
charset = utf-8
|
||||
end_of_line = lf
|
||||
insert_final_newline = true
|
||||
trim_trailing_whitespace = true
|
||||
indent_style = space
|
||||
indent_size = 2
|
||||
|
||||
# gofmt emits tabs and is the authority for Go.
|
||||
[*.go]
|
||||
indent_style = tab
|
||||
|
||||
[{go.mod,go.sum}]
|
||||
indent_style = tab
|
||||
|
||||
# rustfmt default profile.
|
||||
[*.rs]
|
||||
indent_size = 4
|
||||
|
||||
# Recipe lines are tab-significant to make(1).
|
||||
[Makefile]
|
||||
indent_style = tab
|
||||
@@ -7,3 +7,4 @@
|
||||
*.ico binary
|
||||
*.wasm binary
|
||||
*.exe binary
|
||||
|
||||
|
||||
+52
-18
@@ -22,46 +22,80 @@ fail() {
|
||||
# ---------- Server (Go) ----------
|
||||
go_staged=$(printf '%s\n' "$staged" | grep '^Server/.*\.go$' | grep -v '^Server/db/dbgen/')
|
||||
if [ -n "$go_staged" ]; then
|
||||
if command -v go >/dev/null 2>&1; then
|
||||
# shellcheck disable=SC2086 — repo paths contain no spaces
|
||||
if command -v go >/dev/null 2>&1 && command -v gofmt >/dev/null 2>&1; then
|
||||
# Word splitting is intended: repo paths contain no spaces.
|
||||
# shellcheck disable=SC2086
|
||||
unformatted=$(gofmt -l $go_staged)
|
||||
[ -n "$unformatted" ] && fail "gofmt needed (run gofmt -w on): $unformatted"
|
||||
(cd Server && go vet ./...) || fail "go vet"
|
||||
else
|
||||
printf 'pre-commit: WARNING: go not installed; skipping Go checks.\n' >&2
|
||||
printf 'pre-commit: WARNING: go/gofmt not installed; skipping Go checks.\n' >&2
|
||||
fi
|
||||
fi
|
||||
|
||||
# These two blocks inline what `make sqlc-verify` / `make protocol-verify` reduce
|
||||
# to (Server/Makefile), rather than shelling out to make. `make` is not on PATH on
|
||||
# a stock Windows box, and a guard on `go`/`sqlc` does not imply it: the old code
|
||||
# probed one command and invoked another, so a contributor with Go but no make was
|
||||
# told "protocol constants are stale" when nothing had been generated or compared.
|
||||
|
||||
# sqlc inputs changed -> regenerated db/dbgen must be part of the same commit.
|
||||
if printf '%s\n' "$staged" | grep -qE '^Server/(db/queries/|migrations/|sqlc\.yaml|sqlc\.version)'; then
|
||||
if command -v sqlc >/dev/null 2>&1; then
|
||||
(cd Server && make sqlc-verify) \
|
||||
|| fail "db/dbgen is stale — run 'make sqlc-generate' in Server/ and stage the result"
|
||||
(cd Server && sqlc generate && git diff --exit-code db/dbgen) \
|
||||
|| fail "db/dbgen is stale — run 'sqlc generate' in Server/ and stage the result"
|
||||
else
|
||||
printf 'pre-commit: WARNING: sqlc not installed (make sqlc-install); CI will run sqlc-verify.\n' >&2
|
||||
printf 'pre-commit: WARNING: sqlc not installed; skipping the db/dbgen check. Install the version pinned in Server/sqlc.version. CI will run it.\n' >&2
|
||||
fi
|
||||
fi
|
||||
|
||||
# Protocol schema changed -> regenerated Go + TS constants must be in the same commit.
|
||||
if printf '%s\n' "$staged" | grep -qE '^(docs/protocol-schema\.json|Server/scripts/genprotocol/)'; then
|
||||
if printf '%s\n' "$staged" | grep -qE '^(protocol/schema\.json|Server/cmd/genprotocol/)'; then
|
||||
if command -v go >/dev/null 2>&1; then
|
||||
(cd Server && make protocol-verify) \
|
||||
|| fail "protocol constants are stale — run 'make protocol-generate' in Server/ and stage the result"
|
||||
(cd Server && go run ./cmd/genprotocol \
|
||||
&& git diff --exit-code ws/message_types.go ../Client/src/lib/protocolTypes.ts) \
|
||||
|| fail "protocol constants are stale — run 'go run ./cmd/genprotocol' in Server/ and stage the result"
|
||||
else
|
||||
printf 'pre-commit: WARNING: go not installed; skipping the protocol-constants check. CI will run it.\n' >&2
|
||||
fi
|
||||
fi
|
||||
|
||||
# ---------- Client (TypeScript) ----------
|
||||
ts_staged=$(printf '%s\n' "$staged" | grep -E '^Client/tauri-client/(src|tests)/.*\.ts$' | grep -v '/generated/')
|
||||
if [ -n "$ts_staged" ]; then
|
||||
if [ ! -d Client/tauri-client/node_modules ]; then
|
||||
printf 'pre-commit: WARNING: node_modules missing in Client/tauri-client; skipping client checks (run npm install there).\n' >&2
|
||||
# Findings ledger changed -> it must still be valid. Unlike the two blocks
|
||||
# above there is nothing to diff: FINDINGS.md is not tracked (RL-07), so a
|
||||
# stale rendering cannot be committed. --check is the whole gate here, and it
|
||||
# writes nothing. render-ledger.mjs is Node-stdlib-only, so `node` alone is the
|
||||
# probe — no node_modules guard, unlike the prettier block below.
|
||||
if printf '%s\n' "$staged" | grep -qE '^\.superpowers/(findings-ledger\.json|render-ledger\.mjs)$'; then
|
||||
if command -v node >/dev/null 2>&1; then
|
||||
node .superpowers/render-ledger.mjs --check \
|
||||
|| fail "findings-ledger.json is invalid — see the INVALID lines above"
|
||||
else
|
||||
rel=$(printf '%s\n' "$ts_staged" | sed 's|^Client/tauri-client/||')
|
||||
cd Client/tauri-client || exit 1
|
||||
printf 'pre-commit: WARNING: node not installed; skipping the ledger check. CI will run it.\n' >&2
|
||||
fi
|
||||
fi
|
||||
|
||||
# ---------- Formatting (repository-wide) ----------
|
||||
# Prettier is configured once at the repository root (.prettierrc.json) and
|
||||
# covers every material tracked source, not just client TypeScript.
|
||||
# --ignore-unknown drops the Go/Rust/binary paths it has no parser for.
|
||||
if [ -d node_modules ]; then
|
||||
# Word splitting is intended: repo paths contain no spaces.
|
||||
# shellcheck disable=SC2086
|
||||
npx prettier --check --ignore-unknown $staged || fail "prettier (run: npm run format)"
|
||||
else
|
||||
printf 'pre-commit: WARNING: node_modules missing at the repository root; skipping prettier.\n' >&2
|
||||
fi
|
||||
|
||||
# ---------- Client (TypeScript) ----------
|
||||
ts_staged=$(printf '%s\n' "$staged" | grep -E '^Client/(src|tests)/.*\.ts$' | grep -v '/generated/')
|
||||
if [ -n "$ts_staged" ]; then
|
||||
if [ ! -d Client/node_modules ]; then
|
||||
printf 'pre-commit: WARNING: node_modules missing in Client; skipping client checks (run npm install there).\n' >&2
|
||||
else
|
||||
rel=$(printf '%s\n' "$ts_staged" | sed 's|^Client/||')
|
||||
cd Client || exit 1
|
||||
# shellcheck disable=SC2086
|
||||
npx oxlint $rel || fail "oxlint"
|
||||
# shellcheck disable=SC2086
|
||||
npx prettier --check $rel || fail "prettier (run: npm run format)"
|
||||
npm run -s typecheck || fail "tsc --noEmit"
|
||||
cd "$repo_root" || exit 1
|
||||
fi
|
||||
|
||||
+33
-8
@@ -15,9 +15,34 @@ fail() {
|
||||
exit 1
|
||||
}
|
||||
|
||||
# What changed relative to origin/main decides which side's gates run.
|
||||
# What changed relative to this branch's base decides which side's gates run.
|
||||
#
|
||||
# The base is whichever of origin/dev, origin/main is NEAREST — the one with the
|
||||
# fewest commits between its merge-base and HEAD. A feature branch cut from dev
|
||||
# picks dev; dev itself scores 0 against dev (nothing to compare) and so picks
|
||||
# main, which is right for a dev -> main release PR. Hardcoding origin/main got
|
||||
# the first case wrong once dev became the integration branch: everything on dev
|
||||
# and not yet on main counted as "changed", so both sides' gates ran every time.
|
||||
#
|
||||
# Markdown/docs changes never trigger builds.
|
||||
changed=$(git diff --name-only origin/main...HEAD 2>/dev/null) || changed="__all__"
|
||||
base=""
|
||||
best=""
|
||||
for cand in origin/dev origin/main; do
|
||||
git rev-parse --verify -q "$cand" >/dev/null 2>&1 || continue
|
||||
mb=$(git merge-base "$cand" HEAD 2>/dev/null) || continue
|
||||
n=$(git rev-list --count "$mb..HEAD" 2>/dev/null) || continue
|
||||
[ "$n" -eq 0 ] && continue
|
||||
if [ -z "$best" ] || [ "$n" -lt "$best" ]; then
|
||||
base=$cand
|
||||
best=$n
|
||||
fi
|
||||
done
|
||||
|
||||
if [ -n "$base" ]; then
|
||||
changed=$(git diff --name-only "$base...HEAD" 2>/dev/null) || changed="__all__"
|
||||
else
|
||||
changed="__all__"
|
||||
fi
|
||||
[ "$changed" = "__all__" ] || changed=$(printf '%s\n' "$changed" | grep -v '\.md$')
|
||||
[ -z "$changed" ] && exit 0
|
||||
|
||||
@@ -28,8 +53,8 @@ if [ "$changed" = "__all__" ]; then
|
||||
client_changed=1
|
||||
else
|
||||
if printf '%s\n' "$changed" | grep -q '^Server/'; then server_changed=1; fi
|
||||
if printf '%s\n' "$changed" | grep -q '^Client/tauri-client/'; then client_changed=1; fi
|
||||
if printf '%s\n' "$changed" | grep -q '^docs/protocol-schema\.json'; then
|
||||
if printf '%s\n' "$changed" | grep -q '^Client/'; then client_changed=1; fi
|
||||
if printf '%s\n' "$changed" | grep -q '^protocol/schema\.json'; then
|
||||
server_changed=1
|
||||
client_changed=1
|
||||
fi
|
||||
@@ -49,12 +74,12 @@ if [ "$server_changed" = 1 ] && command -v go >/dev/null 2>&1; then
|
||||
fi
|
||||
|
||||
if [ "$client_changed" = 1 ]; then
|
||||
if [ -d Client/tauri-client/node_modules ]; then
|
||||
if [ -d Client/node_modules ]; then
|
||||
echo "pre-push: client typecheck + eslint..."
|
||||
(cd Client/tauri-client && npm run -s typecheck) || fail "tsc --noEmit"
|
||||
(cd Client/tauri-client && npx eslint src/) || fail "eslint"
|
||||
(cd Client && npm run -s typecheck) || fail "tsc --noEmit"
|
||||
(cd Client && npx eslint src/) || fail "eslint"
|
||||
else
|
||||
printf 'pre-push: WARNING: node_modules missing in Client/tauri-client; skipping client checks.\n' >&2
|
||||
printf 'pre-push: WARNING: node_modules missing in Client; skipping client checks.\n' >&2
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
@@ -1,34 +0,0 @@
|
||||
---
|
||||
name: Bug Report
|
||||
about: Report a bug in OwnCord
|
||||
title: "bug: "
|
||||
labels: bug
|
||||
---
|
||||
|
||||
## Description
|
||||
|
||||
<!-- Clear description of the bug -->
|
||||
|
||||
## Steps to Reproduce
|
||||
|
||||
1.
|
||||
2.
|
||||
3.
|
||||
|
||||
## Expected Behavior
|
||||
|
||||
<!-- What should happen -->
|
||||
|
||||
## Actual Behavior
|
||||
|
||||
<!-- What actually happens -->
|
||||
|
||||
## Environment
|
||||
|
||||
- **OS**: Windows 11 (version)
|
||||
- **OwnCord Version**:
|
||||
- **Component**: Server / Client / Both
|
||||
|
||||
## Screenshots / Logs
|
||||
|
||||
<!-- Paste relevant logs or screenshots -->
|
||||
@@ -0,0 +1,169 @@
|
||||
# A YAML issue form, not a Markdown template: only this format can mark a field
|
||||
# required, so the environment detail a maintainer needs to reproduce a bug
|
||||
# arrives with the report instead of after a round trip.
|
||||
#
|
||||
# Nothing in this repository validates this file's schema — prettier checks it
|
||||
# parses as YAML and actionlint does not read it. A form that is valid YAML but
|
||||
# an invalid issue form silently stops appearing in the chooser, so changes here
|
||||
# want a look at the live "New issue" page afterwards.
|
||||
name: Bug report
|
||||
description: Something in the server, desktop client, or admin panel is broken.
|
||||
title: "bug: "
|
||||
labels: ["bug"]
|
||||
body:
|
||||
- type: markdown
|
||||
attributes:
|
||||
value: |
|
||||
**Do not report security vulnerabilities here.** Use
|
||||
[private security reporting](https://github.com/J3vb/OwnCord/security/advisories/new)
|
||||
instead — a public issue discloses the problem before there is a fix.
|
||||
|
||||
Questions, ideas and feedback belong in
|
||||
[Discussions](https://github.com/J3vb/OwnCord/discussions), not here.
|
||||
|
||||
- type: textarea
|
||||
id: what-happened
|
||||
attributes:
|
||||
label: What happened
|
||||
description: What went wrong, and what you expected instead.
|
||||
validations:
|
||||
required: true
|
||||
|
||||
- type: textarea
|
||||
id: repro
|
||||
attributes:
|
||||
label: Steps to reproduce
|
||||
description: Numbered steps from a known starting state. A bug nobody can reproduce cannot be fixed.
|
||||
placeholder: |
|
||||
1. Start the server with …
|
||||
2. In the client, open …
|
||||
3. …
|
||||
validations:
|
||||
required: true
|
||||
|
||||
- type: dropdown
|
||||
id: component
|
||||
attributes:
|
||||
label: Component
|
||||
options:
|
||||
- Server
|
||||
- Desktop client
|
||||
- Admin panel
|
||||
- Both server and client
|
||||
- Not sure
|
||||
validations:
|
||||
required: true
|
||||
|
||||
- type: input
|
||||
id: server-version
|
||||
attributes:
|
||||
label: Server version
|
||||
description: >-
|
||||
Admin panel → Updates, or the banner the server prints at startup. It is
|
||||
deliberately not exposed on the unauthenticated /health endpoint, so
|
||||
"unknown" is a fine answer if you are not the operator. A server built
|
||||
from source reports "dev".
|
||||
placeholder: "1.2.0-alpha.4 / dev / unknown"
|
||||
validations:
|
||||
required: false
|
||||
|
||||
- type: input
|
||||
id: client-version
|
||||
attributes:
|
||||
label: Client version
|
||||
description: Settings → Logs shows it. Leave blank for a server-only bug.
|
||||
placeholder: "1.2.0-alpha.4"
|
||||
validations:
|
||||
required: false
|
||||
|
||||
- type: dropdown
|
||||
id: os
|
||||
attributes:
|
||||
label: Operating system
|
||||
options:
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
- Linux
|
||||
- Other
|
||||
validations:
|
||||
required: true
|
||||
|
||||
- type: dropdown
|
||||
id: arch
|
||||
attributes:
|
||||
label: CPU architecture
|
||||
description: ARM64 currently applies to the Linux desktop client; there is no ARM64 server release yet.
|
||||
options:
|
||||
- x64
|
||||
- ARM64 (aarch64)
|
||||
- Not sure
|
||||
validations:
|
||||
required: true
|
||||
|
||||
- type: dropdown
|
||||
id: deployment
|
||||
attributes:
|
||||
label: How is the server deployed
|
||||
options:
|
||||
- Prebuilt binary (Windows)
|
||||
- Prebuilt binary (Linux)
|
||||
- Built from source
|
||||
- Docker / Compose
|
||||
- Linux systemd service
|
||||
- Windows service (NSSM or Task Scheduler)
|
||||
- Not applicable — client-only bug
|
||||
- Not sure
|
||||
validations:
|
||||
required: true
|
||||
|
||||
- type: dropdown
|
||||
id: tls-mode
|
||||
attributes:
|
||||
label: TLS mode
|
||||
description: The `tls.mode` setting in config.yaml.
|
||||
options:
|
||||
- self_signed
|
||||
- acme
|
||||
- manual
|
||||
- "off"
|
||||
- Not applicable / not sure
|
||||
validations:
|
||||
required: false
|
||||
|
||||
- type: dropdown
|
||||
id: topology
|
||||
attributes:
|
||||
label: How do clients reach the server
|
||||
options:
|
||||
- Same machine or LAN, direct
|
||||
- Port forwarding to a public IP
|
||||
- Behind a reverse proxy
|
||||
- Tailscale
|
||||
- Not sure
|
||||
validations:
|
||||
required: false
|
||||
|
||||
- type: dropdown
|
||||
id: webview
|
||||
attributes:
|
||||
label: Client webview
|
||||
description: >-
|
||||
The desktop client renders through the OS webview — WebView2 on Windows,
|
||||
WebKitGTK on Linux — so rendering and networking bugs often depend on it.
|
||||
Skip this for a server-only bug.
|
||||
options:
|
||||
- WebView2 (Windows)
|
||||
- WebKitGTK (Linux)
|
||||
- Not applicable / not sure
|
||||
validations:
|
||||
required: false
|
||||
|
||||
- type: textarea
|
||||
id: logs
|
||||
attributes:
|
||||
label: Logs, screenshots, or anything else
|
||||
description: >-
|
||||
Server console output or Settings → Logs from the client. Redact tokens,
|
||||
invite codes and anything else you would not post publicly.
|
||||
validations:
|
||||
required: false
|
||||
@@ -1,5 +1,23 @@
|
||||
# Issues are the bug tracker only. Ideas, questions and feedback go to
|
||||
# Discussions; vulnerabilities go to private security reporting. Keeping
|
||||
# blank_issues_enabled false is what makes that routing hold — a blank issue
|
||||
# bypasses every form and every warning on it.
|
||||
#
|
||||
# The ?category= slugs must match this repository's actual Discussions
|
||||
# categories. A slug that does not exist silently drops the user on the category
|
||||
# picker rather than erroring, so check the live Discussions tab after changing
|
||||
# one.
|
||||
blank_issues_enabled: false
|
||||
contact_links:
|
||||
- name: Community Support
|
||||
- name: Report a security vulnerability
|
||||
url: https://github.com/J3vb/OwnCord/security/advisories/new
|
||||
about: Private disclosure. Never open a public issue for a security bug.
|
||||
- name: Ask a question
|
||||
url: https://github.com/J3vb/OwnCord/discussions/categories/q-a
|
||||
about: Setup, deployment and usage questions.
|
||||
- name: Suggest an idea
|
||||
url: https://github.com/J3vb/OwnCord/discussions/categories/ideas
|
||||
about: Feature requests and design suggestions start here, not as issues.
|
||||
- name: General discussion and feedback
|
||||
url: https://github.com/J3vb/OwnCord/discussions
|
||||
about: Ask questions and get help from the community
|
||||
about: Anything that is not a reproducible bug.
|
||||
|
||||
@@ -1,22 +0,0 @@
|
||||
---
|
||||
name: Feature Request
|
||||
about: Suggest a new feature for OwnCord
|
||||
title: "feat: "
|
||||
labels: enhancement
|
||||
---
|
||||
|
||||
## Problem
|
||||
|
||||
<!-- What problem does this solve? -->
|
||||
|
||||
## Proposed Solution
|
||||
|
||||
<!-- How should it work? -->
|
||||
|
||||
## Alternatives Considered
|
||||
|
||||
<!-- Other approaches you thought about -->
|
||||
|
||||
## Additional Context
|
||||
|
||||
<!-- Mockups, links, or related issues -->
|
||||
@@ -1,5 +1,10 @@
|
||||
# Pull Request
|
||||
|
||||
<!-- Base branch: PRs target `dev`, not `main`. `main` carries releases only.
|
||||
See docs/contributing.md#branch-and-pr-model. The Docker and Tauri Full
|
||||
Build jobs are gated on `main` and report as skipped here — that is
|
||||
expected. -->
|
||||
|
||||
## Summary
|
||||
|
||||
<!-- What does this PR do? 1-3 bullet points -->
|
||||
@@ -14,9 +19,30 @@
|
||||
|
||||
## Test Plan
|
||||
|
||||
- [ ] Unit tests pass (`npm test` / `go test ./...`)
|
||||
- [ ] TypeScript check passes (`npx tsc --noEmit`)
|
||||
- [ ] `npm run check` passes from the repository root — the one entry point that
|
||||
runs what CI gates on. `check:server` / `check:client` / `check:rust` /
|
||||
`check:hygiene` / `check:docs` run a single stack if that is all you touched
|
||||
- [ ] Manual testing done (describe below)
|
||||
- [ ] Generated files were regenerated, not hand-edited — `Server/db/dbgen/`,
|
||||
`Server/ws/message_types.go`, `Client/src/lib/protocolTypes.ts`,
|
||||
`Client/src/generated/`, `.superpowers/FINDINGS.md`. CI fails on drift
|
||||
- [ ] Docs updated — anything under `docs/architecture/` (incl. `ux/`) whose
|
||||
"Source of truth" files this PR touches is updated in the same PR
|
||||
(their maintenance rule), and reference docs (`api.md`, `protocol.md`,
|
||||
`schema.md`, `server-configuration.md`) reflect any surface changes
|
||||
|
||||
## Scope
|
||||
|
||||
<!-- What adjacent work did you deliberately leave out, and why? A written
|
||||
deferral is a deliverable — see docs/contributing.md#commit-format. -->
|
||||
|
||||
Not included:
|
||||
|
||||
> **No security detail in this PR.** This repository is public, so the
|
||||
> description, the commits and the branch name are all disclosure channels. If
|
||||
> this change repairs a vulnerability, report it through
|
||||
> [private security reporting](https://github.com/J3vb/OwnCord/security/advisories/new)
|
||||
> first and describe only the control this PR adds.
|
||||
|
||||
## Screenshots
|
||||
|
||||
|
||||
+112
-11
@@ -1,5 +1,27 @@
|
||||
version: 2
|
||||
|
||||
# Every ecosystem groups its updates into a single PR. Splitting per package
|
||||
# means each ecosystem's lockfile (go.sum, package-lock.json, Cargo.lock) is
|
||||
# rewritten once per PR, so merging any one of them invalidates all the rest —
|
||||
# every sibling then rebases and re-runs the full ~15 minute CI matrix. The
|
||||
# 2026-08-10 batch opened 17 PRs for one weekly refresh.
|
||||
#
|
||||
# Grouping also keeps release trains together. The OpenTelemetry modules move
|
||||
# in lockstep, and npm families version-lock their own packages with exact peer
|
||||
# pins (typescript-checker@9.6.0 requires core@9.6.0, not ^9.6.0), so a partial
|
||||
# merge is an ERESOLVE failure waiting to happen.
|
||||
#
|
||||
# Majors are ignored everywhere below, so each group only ever carries patch and
|
||||
# minor updates. If one member of a group is bad, add it to that ecosystem's
|
||||
# ignore list rather than ungrouping the rest.
|
||||
#
|
||||
# Each package root gets its own block rather than one block with `directories:`.
|
||||
# Grouping only works because a group rewrites exactly one lockfile; a block
|
||||
# spanning roots would put several lockfiles in one PR and reintroduce the very
|
||||
# conflict the grouping prevents. The three npm roots stay separate for the same
|
||||
# reason — see docs/contributing.md#dependency-policy for the measured decision
|
||||
# against adopting npm workspaces.
|
||||
|
||||
updates:
|
||||
# Go server dependencies
|
||||
- package-ecosystem: gomod
|
||||
@@ -13,13 +35,40 @@ updates:
|
||||
- dependencies
|
||||
- go
|
||||
open-pull-requests-limit: 10
|
||||
groups:
|
||||
go-dependencies:
|
||||
patterns:
|
||||
- "*"
|
||||
ignore:
|
||||
- dependency-name: "*"
|
||||
update-types: ["version-update:semver-major"]
|
||||
|
||||
# Server container base images (Server/Dockerfile). The builder's
|
||||
# `golang:1.26-bookworm` tracks the toolchain in Server/go.mod and every
|
||||
# `actions/setup-go` in CI, so a minor bump here is a signal to move all three
|
||||
# together — not a standalone merge.
|
||||
- package-ecosystem: docker
|
||||
directory: /Server
|
||||
schedule:
|
||||
interval: weekly
|
||||
day: monday
|
||||
commit-message:
|
||||
prefix: "chore(deps):"
|
||||
labels:
|
||||
- dependencies
|
||||
- docker
|
||||
open-pull-requests-limit: 5
|
||||
groups:
|
||||
docker-dependencies:
|
||||
patterns:
|
||||
- "*"
|
||||
ignore:
|
||||
- dependency-name: "*"
|
||||
update-types: ["version-update:semver-major"]
|
||||
|
||||
# Tauri client npm dependencies
|
||||
- package-ecosystem: npm
|
||||
directory: /Client/tauri-client
|
||||
directory: /Client
|
||||
schedule:
|
||||
interval: weekly
|
||||
day: monday
|
||||
@@ -29,25 +78,57 @@ updates:
|
||||
- dependencies
|
||||
- npm
|
||||
open-pull-requests-limit: 10
|
||||
# These families version-lock their own packages with exact peer pins
|
||||
# (e.g. typescript-checker@9.6.0 requires core@9.6.0, not ^9.6.0), so a
|
||||
# PR-per-package split guarantees an ERESOLVE failure whenever only some
|
||||
# of them are merged. Group each family into a single PR.
|
||||
groups:
|
||||
stryker:
|
||||
npm-dependencies:
|
||||
patterns:
|
||||
- "@stryker-mutator/*"
|
||||
vitest:
|
||||
- "*"
|
||||
ignore:
|
||||
- dependency-name: "*"
|
||||
update-types: ["version-update:semver-major"]
|
||||
|
||||
# Root tooling npm dependencies (changelogen, prettier)
|
||||
- package-ecosystem: npm
|
||||
directory: /
|
||||
schedule:
|
||||
interval: weekly
|
||||
day: monday
|
||||
commit-message:
|
||||
prefix: "chore(deps):"
|
||||
labels:
|
||||
- dependencies
|
||||
- npm
|
||||
open-pull-requests-limit: 5
|
||||
groups:
|
||||
root-npm-dependencies:
|
||||
patterns:
|
||||
- "vitest"
|
||||
- "@vitest/*"
|
||||
- "*"
|
||||
ignore:
|
||||
- dependency-name: "*"
|
||||
update-types: ["version-update:semver-major"]
|
||||
|
||||
# tools/mcp-introspect npm dependencies (local dev MCP server)
|
||||
- package-ecosystem: npm
|
||||
directory: /tools/mcp-introspect
|
||||
schedule:
|
||||
interval: weekly
|
||||
day: monday
|
||||
commit-message:
|
||||
prefix: "chore(deps):"
|
||||
labels:
|
||||
- dependencies
|
||||
- npm
|
||||
open-pull-requests-limit: 5
|
||||
groups:
|
||||
mcp-introspect-dependencies:
|
||||
patterns:
|
||||
- "*"
|
||||
ignore:
|
||||
- dependency-name: "*"
|
||||
update-types: ["version-update:semver-major"]
|
||||
|
||||
# Tauri Rust/Cargo dependencies
|
||||
- package-ecosystem: cargo
|
||||
directory: /Client/tauri-client/src-tauri
|
||||
directory: /Client/src-tauri
|
||||
schedule:
|
||||
interval: weekly
|
||||
day: monday
|
||||
@@ -57,9 +138,25 @@ updates:
|
||||
- dependencies
|
||||
- rust
|
||||
open-pull-requests-limit: 5
|
||||
groups:
|
||||
cargo-dependencies:
|
||||
patterns:
|
||||
- "*"
|
||||
ignore:
|
||||
- dependency-name: "*"
|
||||
update-types: ["version-update:semver-major"]
|
||||
# rfd rides into the tree on tauri-plugin-dialog, which pins ^0.16, and we
|
||||
# declare it directly only for the fatal-startup dialog in lib.rs (there is
|
||||
# no AppHandle yet, so the plugin API is unusable at that point). Cargo
|
||||
# unifies features only within a semver-compatible group, so bumping our
|
||||
# direct dep to 0.17 forks rfd in two: the plugin keeps 0.16 with its
|
||||
# backend features, ours gets 0.17 with none, and rfd 0.17's build.rs then
|
||||
# aborts the Linux build demanding `gtk3` or `xdg-portal` (PR #1405). Even
|
||||
# where it links, it just builds rfd twice. Our version must track the
|
||||
# plugin's -- drop this entry once tauri-plugin-dialog moves to 0.17.
|
||||
# Patch updates within 0.16.x still flow through.
|
||||
- dependency-name: "rfd"
|
||||
update-types: ["version-update:semver-minor"]
|
||||
|
||||
# GitHub Actions
|
||||
- package-ecosystem: github-actions
|
||||
@@ -73,6 +170,10 @@ updates:
|
||||
- dependencies
|
||||
- ci
|
||||
open-pull-requests-limit: 5
|
||||
groups:
|
||||
actions-dependencies:
|
||||
patterns:
|
||||
- "*"
|
||||
ignore:
|
||||
- dependency-name: "*"
|
||||
update-types: ["version-update:semver-major"]
|
||||
|
||||
+298
-108
@@ -35,9 +35,9 @@ jobs:
|
||||
run:
|
||||
working-directory: Server/
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
||||
|
||||
- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
|
||||
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
|
||||
with:
|
||||
go-version: "1.26"
|
||||
cache-dependency-path: Server/go.sum
|
||||
@@ -64,7 +64,7 @@ jobs:
|
||||
run: make sqlc-install sqlc-verify
|
||||
|
||||
# Protocol message-type constants (Go + TS) must never drift from
|
||||
# docs/protocol-schema.json — the single source of truth.
|
||||
# protocol/schema.json — the single source of truth.
|
||||
- name: Verify generated protocol constants (make protocol-verify)
|
||||
if: matrix.os == 'ubuntu-latest'
|
||||
run: make protocol-verify
|
||||
@@ -75,6 +75,19 @@ jobs:
|
||||
- name: Run tests with deadlock detection
|
||||
run: go test -tags deadlock -count=1 ./...
|
||||
|
||||
# Tag-gated tests (DC-06 / T-2026-07-25-16). The build-tag matrix above
|
||||
# only COMPILES the otel/wazero variants; the tests behind those tags
|
||||
# (plugin/sandbox_wazero_test.go, telemetry/telemetry_otel_test.go) ran
|
||||
# nowhere until this step. Scoped to the two packages that carry tagged
|
||||
# files — every other package is tag-invariant and already covered by the
|
||||
# race run above. One leg is enough; no -race (the runtime under the tag
|
||||
# is the concern, not new concurrency).
|
||||
- name: Run tag-gated tests (-tags wazero, -tags otel)
|
||||
if: matrix.os == 'ubuntu-latest'
|
||||
run: |
|
||||
go test -tags wazero -count=1 ./plugin/...
|
||||
go test -tags otel -count=1 ./telemetry/...
|
||||
|
||||
- name: Upload Go coverage
|
||||
if: always()
|
||||
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
|
||||
@@ -83,49 +96,42 @@ jobs:
|
||||
path: Server/coverage.out
|
||||
retention-days: 7
|
||||
|
||||
# verify: false — the action's default `config verify` pass fetches
|
||||
# golangci-lint.run's JSONSchema over HTTPS before linting anything, so a
|
||||
# timeout on that host fails a required job having run zero linters (it
|
||||
# took main red on d352696). `golangci-lint run` rejects a bad config on
|
||||
# its own; the schema pass only bought a prettier error message, priced
|
||||
# at a third-party site inside the gate.
|
||||
- name: Lint
|
||||
uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
|
||||
uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
|
||||
with:
|
||||
version: v2.11.3
|
||||
working-directory: Server/
|
||||
verify: false
|
||||
|
||||
# ubuntu-latest deliberately: the client TS code has zero win32-conditional
|
||||
# paths (no process.platform / path.sep branches in src or the unit suites),
|
||||
# prettier pins endOfLine: lf and .gitattributes forces eol=lf, so a Windows
|
||||
# runner adds queue time without adding coverage. Windows-specific behavior
|
||||
# is covered where it exists: rust-tests and the tauri-build matrix.
|
||||
client-check:
|
||||
name: Client Static Checks
|
||||
runs-on: windows-latest
|
||||
runs-on: ubuntu-latest
|
||||
defaults:
|
||||
run:
|
||||
working-directory: Client/tauri-client/
|
||||
working-directory: Client/
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
||||
|
||||
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
||||
with:
|
||||
node-version: 20
|
||||
node-version: 24
|
||||
cache: npm
|
||||
cache-dependency-path: Client/tauri-client/package-lock.json
|
||||
cache-dependency-path: Client/package-lock.json
|
||||
|
||||
- name: Install npm dependencies
|
||||
run: npm ci
|
||||
|
||||
- name: Patch auto-generated Tauri TypeScript bindings
|
||||
working-directory: Client/tauri-client/
|
||||
# tauri-typegen generates an Event type that is intentionally unused in app code.
|
||||
# Rename it to _Event so @typescript-eslint/no-unused-vars does not fail.
|
||||
run: |
|
||||
node -e "
|
||||
const fs = require('fs');
|
||||
const p = 'src/generated/events.ts';
|
||||
if (fs.existsSync(p)) {
|
||||
let c = fs.readFileSync(p, 'utf8');
|
||||
c = c.replace(/^type Event\b/gm, 'type _Event').replace(/^interface Event\b/gm, 'interface _Event');
|
||||
c = c.replace(/,\s*type Event\s*(?=\})/g, ' '); // unused named import from @tauri-apps/api/event
|
||||
fs.writeFileSync(p, c);
|
||||
console.log('Patched: renamed Event -> _Event in generated/events.ts');
|
||||
} else {
|
||||
console.log('src/generated/events.ts not found, skipping patch.');
|
||||
}
|
||||
"
|
||||
|
||||
# Scoped to shipped dependencies. The remaining high findings are all one
|
||||
# advisory, brace-expansion <=5.0.7, reaching us only through dev tooling
|
||||
# (eslint, @vitest/coverage-v8, stryker). Those are already on their
|
||||
@@ -144,32 +150,150 @@ jobs:
|
||||
- name: TypeScript check
|
||||
run: npx tsc --noEmit
|
||||
|
||||
- name: TypeScript check (Playwright specs)
|
||||
# The main tsconfig excludes tests/e2e from the app graph; this
|
||||
# project typechecks every tests/e2e spec + fixtures + the
|
||||
# playwright configs so type rot cannot hide there.
|
||||
run: npx tsc -p tsconfig.e2e.json --noEmit
|
||||
|
||||
- name: ESLint (type-aware rules)
|
||||
run: npx eslint src/
|
||||
|
||||
- name: Prettier format check
|
||||
run: npx prettier --check "src/**/*.ts" "tests/**/*.ts"
|
||||
|
||||
- name: Knip (unused code & deps)
|
||||
run: npx knip || true
|
||||
# Blocking since the 2026-08-04 remediation: the '|| true' era let a
|
||||
# real unused-export finding sit invisible in every green run.
|
||||
run: npx knip
|
||||
|
||||
# Unit tests live in their own job so a suite failure is visible as exactly one
|
||||
# failing check instead of masking the static gates above. The suite is GREEN
|
||||
# and must stay green — never "fix" a failing test by editing its assertions.
|
||||
client-tests:
|
||||
name: Client Unit Tests
|
||||
runs-on: windows-latest
|
||||
defaults:
|
||||
run:
|
||||
working-directory: Client/tauri-client/
|
||||
# ubuntu-latest for the same reason as client-check above: jsdom-only vitest
|
||||
# with no platform-conditional code under test.
|
||||
# The automated half of G-04: a planning document that states a finding count
|
||||
# the ledger contradicts fails here instead of quietly misleading a reader.
|
||||
# Deliberately tiny — no npm ci, because the script imports nothing outside
|
||||
# node:. It also runs its own selftest, since the whole check rests on
|
||||
# patterns narrow enough not to cry wolf.
|
||||
docs-consistency:
|
||||
name: Docs & Ledger Consistency
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
||||
|
||||
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
||||
with:
|
||||
node-version: 20
|
||||
node-version: 24
|
||||
|
||||
- name: Self-test the count matcher
|
||||
run: node scripts/check-doc-counts.mjs --selftest
|
||||
|
||||
- name: Documents must agree with the findings ledger
|
||||
run: node scripts/check-doc-counts.mjs
|
||||
|
||||
- name: Ledger schema is valid
|
||||
run: node .superpowers/render-ledger.mjs --check
|
||||
|
||||
# R-09 / RL-16. The release gate itself is only invoked for real at tag
|
||||
# time, which is the wrong place to find a bug in it — so its decision
|
||||
# logic is exercised here, on every pull request, against fixtures. Same
|
||||
# reason Server/scripts/docker-smoke.sh is called from both workflows.
|
||||
# This also parses the required-check list out of
|
||||
# b0-dev-branch-protection.sh, so a change to that list's shape fails here
|
||||
# rather than silently weakening the gate.
|
||||
- name: Self-test the release gate
|
||||
run: node scripts/verify-gate-evidence.mjs --selftest
|
||||
|
||||
# RL-07. FINDINGS.md is not tracked, so it cannot drift -- but L-07 also
|
||||
# asks that the rendering be reproducible and that CI reject a generation
|
||||
# failure. Rendering twice and comparing tests both: the render must
|
||||
# succeed (it validates and exits 1 before writing), and it must be a pure
|
||||
# function of the ledger. The severity rule in validate() is what makes
|
||||
# the second half true -- an unranked severity would make render()'s sort
|
||||
# implementation-defined.
|
||||
- name: FINDINGS.md renders, and renders identically twice
|
||||
run: |
|
||||
node .superpowers/render-ledger.mjs
|
||||
cp .superpowers/FINDINGS.md "$RUNNER_TEMP/FINDINGS.first.md"
|
||||
node .superpowers/render-ledger.mjs
|
||||
cmp "$RUNNER_TEMP/FINDINGS.first.md" .superpowers/FINDINGS.md || {
|
||||
echo "ERROR: rendering the ledger twice produced different output."
|
||||
echo "render() must be a pure function of findings-ledger.json."
|
||||
exit 1
|
||||
}
|
||||
|
||||
# The rendering is the human-readable view and is deliberately untracked,
|
||||
# so this artifact is how a reviewer reads it without a Node run.
|
||||
# if: always() -- you want it downloadable precisely when the job failed.
|
||||
- name: Upload the rendered findings ledger
|
||||
if: always()
|
||||
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
|
||||
with:
|
||||
name: findings-ledger-rendering
|
||||
path: .superpowers/FINDINGS.md
|
||||
retention-days: 7
|
||||
|
||||
# Repository-wide formatting, script lint and workflow lint (RL-19 / L-13, S-05).
|
||||
#
|
||||
# Root-scoped and ubuntu-only for the same reason as docs-consistency above:
|
||||
# every gate here is platform-independent text analysis, and .gitattributes
|
||||
# pins eol=lf so a second OS would only re-prove line endings.
|
||||
#
|
||||
# Prettier lives here rather than in client-check because it is no longer a
|
||||
# client gate -- one config at the repository root covers Markdown, YAML,
|
||||
# JSON, CSS and the root scripts as well as client TypeScript.
|
||||
hygiene:
|
||||
name: Repository Hygiene
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
||||
|
||||
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
||||
with:
|
||||
node-version: 24
|
||||
|
||||
# Root install only -- prettier is the sole dependency this job needs, and
|
||||
# the client's install is client-check's job.
|
||||
- name: Install root dependencies
|
||||
run: npm ci
|
||||
|
||||
# shellcheck ships in the ubuntu runner image. actionlint does not, so it
|
||||
# is pinned by version and checked by digest: an unpinned installer script
|
||||
# would be the one unverified download in a workflow file that pins every
|
||||
# action by commit SHA.
|
||||
- name: Install actionlint
|
||||
env:
|
||||
ACTIONLINT_VERSION: 1.7.7
|
||||
ACTIONLINT_SHA256: 023070a287cd8cccd71515fedc843f1985bf96c436b7effaecce67290e7e0757
|
||||
run: |
|
||||
set -euo pipefail
|
||||
url="https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
|
||||
curl -sSfL --retry 3 -o "$RUNNER_TEMP/actionlint.tar.gz" "$url"
|
||||
echo "$ACTIONLINT_SHA256 $RUNNER_TEMP/actionlint.tar.gz" | sha256sum -c -
|
||||
tar -xzf "$RUNNER_TEMP/actionlint.tar.gz" -C "$RUNNER_TEMP" actionlint
|
||||
echo "$RUNNER_TEMP" >> "$GITHUB_PATH"
|
||||
|
||||
- name: Report tool versions
|
||||
run: shellcheck --version && actionlint --version
|
||||
|
||||
# The same entry point a contributor runs. run.mjs takes its shellcheck and
|
||||
# actionlint file lists from `git ls-files`, never a filesystem glob.
|
||||
- name: Formatting, shell and workflow gates
|
||||
run: npm run check:hygiene
|
||||
|
||||
client-tests:
|
||||
name: Client Unit Tests
|
||||
runs-on: ubuntu-latest
|
||||
defaults:
|
||||
run:
|
||||
working-directory: Client/
|
||||
steps:
|
||||
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
||||
|
||||
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
||||
with:
|
||||
node-version: 24
|
||||
cache: npm
|
||||
cache-dependency-path: Client/tauri-client/package-lock.json
|
||||
cache-dependency-path: Client/package-lock.json
|
||||
|
||||
- name: Install npm dependencies
|
||||
run: npm ci
|
||||
@@ -182,7 +306,7 @@ jobs:
|
||||
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
|
||||
with:
|
||||
name: client-coverage
|
||||
path: Client/tauri-client/coverage/
|
||||
path: Client/coverage/
|
||||
retention-days: 7
|
||||
|
||||
# Rust unit tests used to live inside tauri-build, which only runs on PRs to
|
||||
@@ -195,9 +319,9 @@ jobs:
|
||||
timeout-minutes: 30
|
||||
defaults:
|
||||
run:
|
||||
working-directory: Client/tauri-client/src-tauri/
|
||||
working-directory: Client/src-tauri/
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
||||
|
||||
- name: Install Linux system dependencies
|
||||
run: |
|
||||
@@ -215,12 +339,17 @@ jobs:
|
||||
- name: Install Rust
|
||||
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
|
||||
with:
|
||||
components: clippy
|
||||
components: clippy, rustfmt
|
||||
|
||||
- name: Rust cache
|
||||
uses: swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
|
||||
uses: swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
|
||||
with:
|
||||
workspaces: Client/tauri-client/src-tauri
|
||||
workspaces: Client/src-tauri
|
||||
|
||||
# Ahead of clippy: a formatting failure is cheap to produce and cheap to
|
||||
# fix, and there is no reason to spend a clippy pass to surface one.
|
||||
- name: Rustfmt check
|
||||
run: cargo fmt --all -- --check
|
||||
|
||||
- name: Clippy lint (including test targets)
|
||||
run: cargo clippy --all-targets -- -D warnings
|
||||
@@ -228,36 +357,35 @@ jobs:
|
||||
- name: Rust unit tests
|
||||
run: cargo test --lib
|
||||
|
||||
# Playwright e2e against the mocked-Tauri dev server. The suite is green
|
||||
# since the mock repair (start_http_proxy stub + voice-premise rewrite):
|
||||
# a full 255-test run passes locally in ~7.5 min at 1 worker. Runaway
|
||||
# protection lives in playwright.config.ts (maxFailures: 20 aborts a
|
||||
# systemic cascade early; globalTimeout: 20 min self-terminates with a
|
||||
# usable report) with timeout-minutes below as the outer backstop.
|
||||
# Playwright e2e against the mocked-Tauri dev server. Runaway protection
|
||||
# lives in playwright.config.ts (maxFailures: 20 aborts a systemic cascade
|
||||
# early; globalTimeout: 20 min self-terminates with a usable report) with
|
||||
# timeout-minutes below as the outer backstop.
|
||||
#
|
||||
# Still continue-on-error for now: a newly-revived 255-test browser suite
|
||||
# may harbor rare flakes (retries: 2 covers them, but confidence needs a
|
||||
# few green pushes first). Flip this job to blocking once it has been
|
||||
# stably green across several pushes.
|
||||
# BLOCKING since 2026-08-05 (DC-07): the post-repair soak recorded green
|
||||
# full-suite runs at 270, 276 and 291 tests across the 08-04/08-05 audit
|
||||
# branches, and the one hard CI failure in that window was a real spec bug
|
||||
# (updater install-settle race), which a non-blocking job would have let
|
||||
# rot. retries: 2 absorbs the known rare flake class (see E2E-ISSUES.md's
|
||||
# flake accounting).
|
||||
# See docs/audit-test-coverage-2026-07-25.md T-2026-07-25-21.
|
||||
# The native config (playwright.config.native.ts) is deliberately not wired
|
||||
# up — it needs a real server and a built desktop binary.
|
||||
client-e2e:
|
||||
name: Client E2E (Playwright, non-blocking)
|
||||
name: Client E2E (Playwright)
|
||||
runs-on: ubuntu-latest
|
||||
continue-on-error: true
|
||||
timeout-minutes: 25
|
||||
defaults:
|
||||
run:
|
||||
working-directory: Client/tauri-client/
|
||||
working-directory: Client/
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
||||
|
||||
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
||||
with:
|
||||
node-version: 20
|
||||
node-version: 24
|
||||
cache: npm
|
||||
cache-dependency-path: Client/tauri-client/package-lock.json
|
||||
cache-dependency-path: Client/package-lock.json
|
||||
|
||||
- name: Install npm dependencies
|
||||
run: npm ci
|
||||
@@ -268,14 +396,73 @@ jobs:
|
||||
- name: Run Playwright tests
|
||||
run: npx playwright test --config=playwright.config.ts
|
||||
|
||||
# Browser-mode unit tests (tests/browser/): real AudioContext + WASM
|
||||
# behind the same Chromium, so the noise-suppression pipeline has a
|
||||
# test that actually runs somewhere (test-audit 2026-08-19, T-22).
|
||||
- name: Run browser-mode unit tests
|
||||
run: npm run test:browser
|
||||
|
||||
- name: Upload Playwright report
|
||||
if: always()
|
||||
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
|
||||
with:
|
||||
name: playwright-report
|
||||
path: |
|
||||
Client/tauri-client/playwright-report/
|
||||
Client/tauri-client/test-results/
|
||||
Client/playwright-report/
|
||||
Client/test-results/
|
||||
retention-days: 7
|
||||
|
||||
# Admin-panel journey against a REAL server (no mocks): start-server.sh
|
||||
# builds the Go binary and boots it with a fresh temp data dir, and the
|
||||
# suite drives the embedded SPA through the first-run wizard, dashboard,
|
||||
# channel CRUD, audit log and re-login — the one DC-04 surface the mocked
|
||||
# suites cannot reach. Non-blocking while it earns its soak, same
|
||||
# graduation convention client-e2e followed.
|
||||
# GRADUATION CRITERION (recorded 2026-08-15): flip continue-on-error to
|
||||
# false once the job has ~30 consecutive green runs on main with no
|
||||
# infra-flake reruns — the same evidence bar client-e2e cleared (270+ green
|
||||
# runs cited in docs/audit-2026-08-04-docs-and-coverage.md) scaled to this
|
||||
# job's lower traffic. Check with: gh run list -w CI -b main --json
|
||||
# conclusion | jq '[.[] | .conclusion] | index("failure")'.
|
||||
admin-e2e:
|
||||
name: Admin Panel E2E (real server, non-blocking)
|
||||
runs-on: ubuntu-latest
|
||||
continue-on-error: true
|
||||
timeout-minutes: 20
|
||||
defaults:
|
||||
run:
|
||||
working-directory: Client/
|
||||
steps:
|
||||
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
||||
|
||||
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
|
||||
with:
|
||||
go-version: "1.26"
|
||||
cache-dependency-path: Server/go.sum
|
||||
|
||||
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
||||
with:
|
||||
node-version: 24
|
||||
cache: npm
|
||||
cache-dependency-path: Client/package-lock.json
|
||||
|
||||
- name: Install npm dependencies
|
||||
run: npm ci
|
||||
|
||||
- name: Install Playwright browser
|
||||
run: npx playwright install --with-deps chromium
|
||||
|
||||
- name: Run admin-panel journey
|
||||
run: npx playwright test --config=playwright.config.admin.ts
|
||||
|
||||
- name: Upload Playwright report
|
||||
if: always()
|
||||
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
|
||||
with:
|
||||
name: admin-e2e-report
|
||||
path: |
|
||||
Client/playwright-report/
|
||||
Client/test-results/
|
||||
retention-days: 7
|
||||
|
||||
# Blocking e2e subset: the parity-feature specs (tagged "@parity"), covering
|
||||
@@ -291,15 +478,15 @@ jobs:
|
||||
timeout-minutes: 15
|
||||
defaults:
|
||||
run:
|
||||
working-directory: Client/tauri-client/
|
||||
working-directory: Client/
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
||||
|
||||
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
||||
with:
|
||||
node-version: 20
|
||||
node-version: 24
|
||||
cache: npm
|
||||
cache-dependency-path: Client/tauri-client/package-lock.json
|
||||
cache-dependency-path: Client/package-lock.json
|
||||
|
||||
- name: Install npm dependencies
|
||||
run: npm ci
|
||||
@@ -316,8 +503,8 @@ jobs:
|
||||
with:
|
||||
name: playwright-report-parity
|
||||
path: |
|
||||
Client/tauri-client/playwright-report/
|
||||
Client/tauri-client/test-results/
|
||||
Client/playwright-report/
|
||||
Client/test-results/
|
||||
retention-days: 7
|
||||
|
||||
# Image build is verification only, so it is skipped on dev to keep day-to-day
|
||||
@@ -327,25 +514,52 @@ jobs:
|
||||
if: github.ref_name == 'main' || github.base_ref == 'main'
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
|
||||
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
|
||||
|
||||
- name: Build image (no push)
|
||||
uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6.16.0
|
||||
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
|
||||
with:
|
||||
context: Server/
|
||||
push: false
|
||||
load: true
|
||||
tags: owncord-smoke:candidate
|
||||
build-args: VERSION=ci
|
||||
cache-from: type=gha
|
||||
cache-to: type=gha,mode=max
|
||||
|
||||
# Full Tauri build only on PRs to main (expensive: ~15 min x2 multiplier)
|
||||
# Same script release.yml runs before it signs or pushes anything. A
|
||||
# boot regression — or a bug in the smoke harness itself, as happened on
|
||||
# the first v1.2.0-alpha.3 release run — must fail here, not at tag time.
|
||||
- name: Boot-smoke Docker image
|
||||
run: bash Server/scripts/docker-smoke.sh owncord-smoke:candidate
|
||||
|
||||
# Full Tauri build only on PRs to main (expensive: ~15 min x2 multiplier).
|
||||
#
|
||||
# Skipped for Dependabot: its PRs run under the separate `dependabot` secrets
|
||||
# scope, so TAURI_SIGNING_PRIVATE_KEY arrives empty and `npm run tauri build`
|
||||
# always aborts with "failed to decode secret key" while signing the updater
|
||||
# artifact — after a successful compile and bundle. That burned ~50 min of
|
||||
# runner time per dependency PR to produce a red check that never carried any
|
||||
# signal. Granting Dependabot the signing key would fix the symptom but hands
|
||||
# a release key to workflows triggered by third-party dependency updates.
|
||||
#
|
||||
# What still covers Dependabot PRs: the required `rust-tests` job compiles the
|
||||
# crate (cargo clippy --all-targets + cargo test --lib), so a dependency bump
|
||||
# that breaks the Rust build is still caught.
|
||||
# What this gives up on those PRs: bundling (NSIS/AppImage/deb), Windows and
|
||||
# ARM-specific compilation, and the `cargo audit` step below — that last one
|
||||
# overlaps with Dependabot's own cargo scanning, which is what opens these PRs
|
||||
# in the first place.
|
||||
tauri-build:
|
||||
name: Tauri Full Build (${{ matrix.os }})
|
||||
needs: client-check
|
||||
if: github.event_name == 'pull_request' && github.base_ref == 'main'
|
||||
if: >-
|
||||
github.event_name == 'pull_request'
|
||||
&& github.base_ref == 'main'
|
||||
&& github.actor != 'dependabot[bot]'
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
@@ -356,15 +570,15 @@ jobs:
|
||||
runs-on: ${{ matrix.os }}
|
||||
defaults:
|
||||
run:
|
||||
working-directory: Client/tauri-client/
|
||||
working-directory: Client/
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
||||
|
||||
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
||||
with:
|
||||
node-version: 20
|
||||
node-version: 24
|
||||
cache: npm
|
||||
cache-dependency-path: Client/tauri-client/package-lock.json
|
||||
cache-dependency-path: Client/package-lock.json
|
||||
|
||||
- name: Install Linux system dependencies
|
||||
if: startsWith(matrix.os, 'ubuntu')
|
||||
@@ -388,46 +602,22 @@ jobs:
|
||||
components: clippy
|
||||
|
||||
- name: Rust cache
|
||||
uses: swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
|
||||
uses: swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
|
||||
with:
|
||||
workspaces: Client/tauri-client/src-tauri
|
||||
workspaces: Client/src-tauri
|
||||
|
||||
- name: Install npm dependencies
|
||||
run: npm ci
|
||||
|
||||
- name: Install tauri-typegen
|
||||
run: cargo install tauri-typegen@0.5.0 --quiet
|
||||
|
||||
- name: Generate TypeScript IPC bindings
|
||||
working-directory: Client/tauri-client/
|
||||
run: cargo tauri-typegen generate
|
||||
|
||||
- name: Fix generated TypeScript bindings (tauri-typegen 0.5.0 workaround)
|
||||
working-directory: Client/tauri-client/
|
||||
# tauri-typegen 0.5.0 cannot map serde_json::Value to a TS type — patch post-generation.
|
||||
# Duplicate events are avoided at source by using one emit() call site per event name.
|
||||
run: |
|
||||
node -e "
|
||||
const fs = require('fs');
|
||||
const tp = fs.readFileSync('src/generated/types.ts', 'utf8');
|
||||
if (!tp.includes('export type Value')) {
|
||||
fs.writeFileSync('src/generated/types.ts', tp.replace(
|
||||
'export interface CredentialData',
|
||||
'export type Value = unknown;\n\nexport interface CredentialData'
|
||||
));
|
||||
}
|
||||
console.log('Generated bindings patched.');
|
||||
"
|
||||
|
||||
- name: Clippy lint (Rust)
|
||||
working-directory: Client/tauri-client/src-tauri/
|
||||
working-directory: Client/src-tauri/
|
||||
run: cargo clippy -- -D warnings
|
||||
|
||||
# Rust unit tests moved to the standalone `rust-tests` job so they run on
|
||||
# every event, not just PRs to main.
|
||||
|
||||
- name: Security audit (Rust dependencies)
|
||||
working-directory: Client/tauri-client/src-tauri/
|
||||
working-directory: Client/src-tauri/
|
||||
run: |
|
||||
cargo install cargo-audit@0.22.1 --quiet
|
||||
cargo audit
|
||||
|
||||
@@ -10,14 +10,41 @@ on:
|
||||
pull_request_review:
|
||||
types: [submitted]
|
||||
|
||||
# Repeated triggers on one issue or pull request collapse into a single run
|
||||
# rather than fanning out. `github.event.issue.number` is present on the issues
|
||||
# and issue_comment events; `github.event.pull_request.number` on the two review
|
||||
# events. Exactly one of the two is non-empty per event, so the group is stable.
|
||||
concurrency:
|
||||
group: claude-${{ github.event.issue.number || github.event.pull_request.number }}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
claude:
|
||||
# Two independent conditions, both required.
|
||||
#
|
||||
# 1. The actor is on the maintainer allowlist. This workflow consumes a
|
||||
# metered API credential, so the repository states its own trust boundary
|
||||
# here rather than relying on any downstream check. Add a login to this
|
||||
# list to grant access; there is no other way in.
|
||||
# 2. The trigger text mentions @claude.
|
||||
#
|
||||
# scripts/check-workflow-guards.mjs asserts that both this actor term and the
|
||||
# cost bounds below survive; actionlint checks expression syntax and cannot
|
||||
# see authorization intent.
|
||||
if: |
|
||||
(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
|
||||
(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
|
||||
(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
|
||||
(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
|
||||
contains(fromJSON('["J3vb"]'), github.actor) &&
|
||||
(
|
||||
(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
|
||||
(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
|
||||
(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
|
||||
(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
|
||||
)
|
||||
runs-on: ubuntu-latest
|
||||
# Every other long-running job in this repository declares a cap
|
||||
# (ci.yml rust-tests, client-e2e, admin-e2e, client-e2e-parity;
|
||||
# load-baseline). Without one the job inherits GitHub's 360-minute default,
|
||||
# which is the wrong ceiling for metered work.
|
||||
timeout-minutes: 30
|
||||
permissions:
|
||||
contents: read
|
||||
pull-requests: read
|
||||
@@ -26,13 +53,13 @@ jobs:
|
||||
actions: read # Required for Claude to read CI results on PRs
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
||||
with:
|
||||
fetch-depth: 1
|
||||
|
||||
- name: Run Claude Code
|
||||
id: claude
|
||||
uses: anthropics/claude-code-action@v1
|
||||
uses: anthropics/claude-code-action@24dcd50c0568f0fc9e9211213a4fd2d9eb15c4e0 # v1
|
||||
with:
|
||||
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
|
||||
|
||||
@@ -47,4 +74,3 @@ jobs:
|
||||
# See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
|
||||
# or https://code.claude.com/docs/en/cli-reference for available options
|
||||
# claude_args: '--allowed-tools Bash(gh pr:*)'
|
||||
|
||||
|
||||
@@ -0,0 +1,140 @@
|
||||
# Manual WebSocket load baseline against a locally booted server.
|
||||
#
|
||||
# workflow_dispatch ONLY, and deliberately not part of the blocking CI matrix:
|
||||
# a perf run on shared runners is a flake source and a wall-clock tax the
|
||||
# 10-job/~15-min pipeline doesn't need. Run it before/after changes to the
|
||||
# hub, the write path, or the replay budget, and compare the uploaded
|
||||
# k6-summary.json + metrics snapshot between runs. Runner-grade hardware is
|
||||
# NOT a capacity promise for real deployments — treat results as relative
|
||||
# (before vs after), not absolute.
|
||||
name: Load Baseline
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
users:
|
||||
description: "Load-test users to register (max VUs in the script is 100)"
|
||||
required: false
|
||||
default: "100"
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
k6-baseline:
|
||||
name: k6 WebSocket baseline
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 25
|
||||
steps:
|
||||
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
||||
|
||||
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
|
||||
with:
|
||||
go-version: "1.26"
|
||||
cache-dependency-path: Server/go.sum
|
||||
|
||||
- name: Build server
|
||||
working-directory: Server
|
||||
env:
|
||||
CGO_ENABLED: "0"
|
||||
run: go build -o chatserver .
|
||||
|
||||
- name: Boot server
|
||||
working-directory: Server
|
||||
env:
|
||||
# Registration/login are per-IP rate limited (3/min and 5/min by
|
||||
# default) and every VU logs in from 127.0.0.1 — scale the auth
|
||||
# limits up with the knob that exists for shared-IP scenarios.
|
||||
OWNCORD_SECURITY_AUTH_RATE_LIMIT_MULTIPLIER: "100"
|
||||
run: |
|
||||
mkdir -p "$RUNNER_TEMP/loadtest"
|
||||
cp chatserver "$RUNNER_TEMP/loadtest/"
|
||||
cd "$RUNNER_TEMP/loadtest"
|
||||
./chatserver > server.log 2>&1 &
|
||||
echo $! > server.pid
|
||||
for _ in $(seq 1 30); do
|
||||
sleep 1
|
||||
if ./chatserver healthcheck; then exit 0; fi
|
||||
done
|
||||
echo "::error::server never became healthy"
|
||||
tail -50 server.log
|
||||
exit 1
|
||||
|
||||
- name: Seed owner, channel, and load-test users
|
||||
working-directory: Server
|
||||
run: |
|
||||
BASE=https://127.0.0.1:8443
|
||||
TOKEN=$(curl -sk -X POST "$BASE/admin/api/setup" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-d '{"username":"loadadmin","password":"LoadTest123!Admin"}' | jq -r .token)
|
||||
if [ -z "$TOKEN" ] || [ "$TOKEN" = "null" ]; then
|
||||
echo "::error::setup failed"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
CHANNEL_ID=$(curl -sk -X POST "$BASE/admin/api/channels" \
|
||||
-H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
|
||||
-d '{"name":"loadtest","type":"text"}' | jq -r .id)
|
||||
if [ -z "$CHANNEL_ID" ] || [ "$CHANNEL_ID" = "null" ]; then
|
||||
echo "::error::channel create failed"
|
||||
exit 1
|
||||
fi
|
||||
echo "CHANNEL_ID=$CHANNEL_ID" >> "$GITHUB_ENV"
|
||||
echo "ADMIN_TOKEN=$TOKEN" >> "$GITHUB_ENV"
|
||||
|
||||
INVITE=$(curl -sk -X POST "$BASE/api/v1/invites" \
|
||||
-H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
|
||||
-d '{"max_uses":0}' | jq -r .code)
|
||||
if [ -z "$INVITE" ] || [ "$INVITE" = "null" ]; then
|
||||
echo "::error::invite create failed"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
USERS="${{ inputs.users }}"
|
||||
for i in $(seq 1 "${USERS:-100}"); do
|
||||
code=$(curl -sk -o /dev/null -w '%{http_code}' -X POST "$BASE/api/v1/auth/register" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-d "{\"username\":\"loadtest$i\",\"password\":\"LoadTest123!\",\"invite_code\":\"$INVITE\"}")
|
||||
if [ "$code" != "200" ] && [ "$code" != "201" ]; then
|
||||
echo "::error::registering loadtest$i failed with $code"
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
|
||||
- name: Install k6
|
||||
run: |
|
||||
curl -fsSL https://dl.k6.io/key.gpg | sudo gpg --dearmor -o /usr/share/keyrings/k6-archive-keyring.gpg
|
||||
echo "deb [signed-by=/usr/share/keyrings/k6-archive-keyring.gpg] https://dl.k6.io/deb stable main" | sudo tee /etc/apt/sources.list.d/k6.list
|
||||
sudo apt-get update -qq && sudo apt-get install -y k6
|
||||
|
||||
- name: Run k6 baseline
|
||||
working-directory: Server/scripts/k6
|
||||
env:
|
||||
K6_WS_URL: wss://127.0.0.1:8443/api/v1/ws
|
||||
K6_HTTP_URL: https://127.0.0.1:8443
|
||||
K6_CHANNEL_ID: ${{ env.CHANNEL_ID }}
|
||||
run: |
|
||||
mkdir -p reports
|
||||
k6 run --insecure-skip-tls-verify ws-load.js
|
||||
|
||||
- name: Snapshot server metrics
|
||||
if: always()
|
||||
run: |
|
||||
curl -sk https://127.0.0.1:8443/api/v1/metrics | tee "$RUNNER_TEMP/loadtest/metrics-after.json" || true
|
||||
|
||||
- name: Stop server
|
||||
if: always()
|
||||
run: |
|
||||
kill "$(cat "$RUNNER_TEMP/loadtest/server.pid")" 2>/dev/null || true
|
||||
sleep 3
|
||||
|
||||
- name: Upload results
|
||||
if: always()
|
||||
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
|
||||
with:
|
||||
name: k6-baseline
|
||||
path: |
|
||||
Server/scripts/k6/reports/k6-summary.json
|
||||
${{ runner.temp }}/loadtest/metrics-after.json
|
||||
${{ runner.temp }}/loadtest/server.log
|
||||
retention-days: 30
|
||||
+149
-44
@@ -5,25 +5,69 @@ on:
|
||||
tags:
|
||||
- "v*"
|
||||
|
||||
# A deleted-and-re-pushed tag (it has happened — see the checksum note in the
|
||||
# publish job) must not race two publish runs: `gh release create` fails
|
||||
# loudly on the second run, but the ghcr :latest push does not, and which run
|
||||
# wins it would be arbitrary. Queue, never cancel — a half-cancelled release
|
||||
# is worse than a slow one.
|
||||
concurrency:
|
||||
group: release-${{ github.ref_name }}
|
||||
cancel-in-progress: false
|
||||
|
||||
jobs:
|
||||
# R-09 / RL-16. ci.yml has no `tags:` trigger, so a tag push starts this
|
||||
# workflow and nothing else — and this workflow re-runs none of the required
|
||||
# checks. It builds, smokes and signs, which is a different question from
|
||||
# "did the gate pass on this commit".
|
||||
#
|
||||
# It did not, at least once: v1.2.0-alpha.3 published from a commit whose
|
||||
# `Server Build & Test (windows-latest)` had concluded failure. Nothing
|
||||
# noticed, because nothing looked.
|
||||
#
|
||||
# The required set is read out of b0-dev-branch-protection.sh rather than
|
||||
# restated here, so pinning a new check cannot leave this gate behind. The
|
||||
# logic lives in a script with a --selftest that ci.yml runs on every PR:
|
||||
# a step that exists only in this file first executes at tag time, which is
|
||||
# the wrong place to discover its bugs.
|
||||
gate-evidence:
|
||||
name: Verify exact-SHA gate evidence
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
checks: read
|
||||
steps:
|
||||
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
||||
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
||||
with:
|
||||
node-version: 24
|
||||
- name: Required checks must be green on the tagged commit
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
GITHUB_REPOSITORY: ${{ github.repository }}
|
||||
run: node scripts/verify-gate-evidence.mjs "${{ github.sha }}"
|
||||
|
||||
# The v1.1.0-alpha.4 release shipped clients still versioned 1.1.0-alpha.3
|
||||
# because the client manifests weren't bumped before tagging — deployed
|
||||
# clients then never saw the update. Fail fast on that mismatch, before any
|
||||
# expensive build starts.
|
||||
verify-versions:
|
||||
name: Verify client version matches tag
|
||||
# Every build job needs verify-versions, and both publishers need those, so
|
||||
# one edge here gates the whole graph — nothing builds, pushes to GHCR, or
|
||||
# creates a Release on a commit that did not pass.
|
||||
needs: gate-evidence
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
||||
- name: Compare tag with client manifests
|
||||
shell: bash
|
||||
run: |
|
||||
TAG_VERSION="${GITHUB_REF_NAME#v}"
|
||||
TAURI_VERSION=$(node -p "require('./Client/tauri-client/src-tauri/tauri.conf.json').version")
|
||||
NPM_VERSION=$(node -p "require('./Client/tauri-client/package.json').version")
|
||||
CARGO_VERSION=$(sed -n 's/^version = "\(.*\)"$/\1/p' Client/tauri-client/src-tauri/Cargo.toml | head -1)
|
||||
TAURI_VERSION=$(node -p "require('./Client/src-tauri/tauri.conf.json').version")
|
||||
NPM_VERSION=$(node -p "require('./Client/package.json').version")
|
||||
CARGO_VERSION=$(sed -n 's/^version = "\(.*\)"$/\1/p' Client/src-tauri/Cargo.toml | head -1)
|
||||
fail=0
|
||||
for pair in "tauri.conf.json:$TAURI_VERSION" "package.json:$NPM_VERSION" "Cargo.toml:$CARGO_VERSION"; do
|
||||
file="${pair%%:*}"; ver="${pair#*:}"
|
||||
@@ -41,28 +85,28 @@ jobs:
|
||||
permissions:
|
||||
contents: read
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
||||
|
||||
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
||||
with:
|
||||
node-version: 20
|
||||
node-version: 24
|
||||
cache: npm
|
||||
cache-dependency-path: Client/tauri-client/package-lock.json
|
||||
cache-dependency-path: Client/package-lock.json
|
||||
|
||||
- name: Install Rust
|
||||
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
|
||||
|
||||
- name: Rust cache
|
||||
uses: swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
|
||||
uses: swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
|
||||
with:
|
||||
workspaces: Client/tauri-client/src-tauri
|
||||
workspaces: Client/src-tauri
|
||||
|
||||
- name: Install npm dependencies
|
||||
working-directory: Client/tauri-client
|
||||
working-directory: Client
|
||||
run: npm ci
|
||||
|
||||
- name: Build Tauri app
|
||||
working-directory: Client/tauri-client
|
||||
working-directory: Client
|
||||
env:
|
||||
TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
|
||||
TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
|
||||
@@ -72,7 +116,7 @@ jobs:
|
||||
shell: bash
|
||||
run: |
|
||||
mkdir -p release-staging
|
||||
NSIS_DIR="Client/tauri-client/src-tauri/target/release/bundle/nsis"
|
||||
NSIS_DIR="Client/src-tauri/target/release/bundle/nsis"
|
||||
INSTALLER=$(find "$NSIS_DIR" -name "*.exe" | head -1)
|
||||
cp "$INSTALLER" release-staging/
|
||||
NSIS_ZIP=$(find "$NSIS_DIR" -name "*_x64-setup.nsis.zip" ! -name "*.sig" | head -1)
|
||||
@@ -93,13 +137,13 @@ jobs:
|
||||
permissions:
|
||||
contents: read
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
||||
|
||||
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
||||
with:
|
||||
node-version: 20
|
||||
node-version: 24
|
||||
cache: npm
|
||||
cache-dependency-path: Client/tauri-client/package-lock.json
|
||||
cache-dependency-path: Client/package-lock.json
|
||||
|
||||
- name: Install Linux system dependencies
|
||||
run: |
|
||||
@@ -120,16 +164,16 @@ jobs:
|
||||
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
|
||||
|
||||
- name: Rust cache
|
||||
uses: swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
|
||||
uses: swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
|
||||
with:
|
||||
workspaces: Client/tauri-client/src-tauri
|
||||
workspaces: Client/src-tauri
|
||||
|
||||
- name: Install npm dependencies
|
||||
working-directory: Client/tauri-client
|
||||
working-directory: Client
|
||||
run: npm ci
|
||||
|
||||
- name: Build Tauri app (AppImage + deb)
|
||||
working-directory: Client/tauri-client
|
||||
working-directory: Client
|
||||
env:
|
||||
TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
|
||||
TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
|
||||
@@ -140,7 +184,7 @@ jobs:
|
||||
# EGL_BAD_PARAMETER). Strip them and regenerate the updater artifact +
|
||||
# signatures for the patched image.
|
||||
- name: Strip host-incompatible libs from AppImage and re-sign
|
||||
working-directory: Client/tauri-client
|
||||
working-directory: Client
|
||||
shell: bash
|
||||
env:
|
||||
TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
|
||||
@@ -164,7 +208,7 @@ jobs:
|
||||
shell: bash
|
||||
run: |
|
||||
mkdir -p linux-staging
|
||||
BUNDLE_DIR="Client/tauri-client/src-tauri/target/release/bundle"
|
||||
BUNDLE_DIR="Client/src-tauri/target/release/bundle"
|
||||
# AppImage
|
||||
APPIMAGE=$(find "$BUNDLE_DIR/appimage" -name "*.AppImage" ! -name "*.sig" | head -1)
|
||||
if [ -n "$APPIMAGE" ] && [ -f "$APPIMAGE" ]; then cp "$APPIMAGE" linux-staging/; fi
|
||||
@@ -199,9 +243,9 @@ jobs:
|
||||
permissions:
|
||||
contents: read
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
||||
|
||||
- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
|
||||
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
|
||||
with:
|
||||
go-version: "1.26"
|
||||
|
||||
@@ -223,6 +267,40 @@ jobs:
|
||||
CGO_ENABLED: "0"
|
||||
run: go build -o chatserver -ldflags "-s -w -X main.version=$VERSION" .
|
||||
|
||||
# Boot-smoke the EXACT artifact that ships: this feed drives the signed
|
||||
# self-update, so a binary that compiles but dies on boot would deploy
|
||||
# itself to every auto-updating instance. CI's tests exercise the same
|
||||
# commit but never this build (release ldflags, CGO_ENABLED=0) and never
|
||||
# execute the produced binary. First run writes config.yaml, generates a
|
||||
# self-signed cert, migrates a fresh SQLite DB — a real cold boot.
|
||||
- name: Boot-smoke server binary
|
||||
shell: bash
|
||||
working-directory: Server
|
||||
run: |
|
||||
SMOKE_DIR="$RUNNER_TEMP/owncord-smoke"
|
||||
mkdir -p "$SMOKE_DIR"
|
||||
cd "$SMOKE_DIR"
|
||||
BIN="$GITHUB_WORKSPACE/Server/chatserver"
|
||||
[ -f "$GITHUB_WORKSPACE/Server/chatserver.exe" ] && BIN="$GITHUB_WORKSPACE/Server/chatserver.exe"
|
||||
"$BIN" &
|
||||
SERVER_PID=$!
|
||||
ok=0
|
||||
for _ in $(seq 1 30); do
|
||||
sleep 1
|
||||
if ! kill -0 "$SERVER_PID" 2>/dev/null; then
|
||||
echo "::error::server process exited during boot smoke"
|
||||
exit 1
|
||||
fi
|
||||
if "$BIN" healthcheck; then ok=1; break; fi
|
||||
done
|
||||
kill "$SERVER_PID" 2>/dev/null || true
|
||||
wait "$SERVER_PID" 2>/dev/null || true
|
||||
if [ "$ok" != "1" ]; then
|
||||
echo "::error::server never reported healthy within 30s"
|
||||
exit 1
|
||||
fi
|
||||
echo "boot smoke passed"
|
||||
|
||||
- name: Create tar.gz (Linux)
|
||||
if: matrix.os == 'ubuntu-latest'
|
||||
working-directory: Server
|
||||
@@ -249,13 +327,13 @@ jobs:
|
||||
permissions:
|
||||
contents: read
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
||||
|
||||
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
||||
with:
|
||||
node-version: 20
|
||||
node-version: 24
|
||||
cache: npm
|
||||
cache-dependency-path: Client/tauri-client/package-lock.json
|
||||
cache-dependency-path: Client/package-lock.json
|
||||
|
||||
- name: Install Linux system dependencies
|
||||
run: |
|
||||
@@ -276,16 +354,16 @@ jobs:
|
||||
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
|
||||
|
||||
- name: Rust cache
|
||||
uses: swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
|
||||
uses: swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
|
||||
with:
|
||||
workspaces: Client/tauri-client/src-tauri
|
||||
workspaces: Client/src-tauri
|
||||
|
||||
- name: Install npm dependencies
|
||||
working-directory: Client/tauri-client
|
||||
working-directory: Client
|
||||
run: npm ci
|
||||
|
||||
- name: Build Tauri app (AppImage + deb)
|
||||
working-directory: Client/tauri-client
|
||||
working-directory: Client
|
||||
env:
|
||||
TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
|
||||
TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
|
||||
@@ -293,7 +371,7 @@ jobs:
|
||||
|
||||
# Same strip + re-sign as the x86_64 job — see the comment there.
|
||||
- name: Strip host-incompatible libs from AppImage and re-sign
|
||||
working-directory: Client/tauri-client
|
||||
working-directory: Client
|
||||
shell: bash
|
||||
env:
|
||||
TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
|
||||
@@ -317,7 +395,7 @@ jobs:
|
||||
shell: bash
|
||||
run: |
|
||||
mkdir -p linux-arm64-staging
|
||||
BUNDLE_DIR="Client/tauri-client/src-tauri/target/release/bundle"
|
||||
BUNDLE_DIR="Client/src-tauri/target/release/bundle"
|
||||
# AppImage + updater artifact (.tar.gz) + signatures. Every filename
|
||||
# must carry the arch: FindClientAssets matches on the
|
||||
# _aarch64.AppImage.tar.gz suffix, and arch-less names would collide
|
||||
@@ -350,7 +428,7 @@ jobs:
|
||||
contents: read
|
||||
packages: write
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
||||
|
||||
- name: Extract version from tag
|
||||
shell: bash
|
||||
@@ -359,7 +437,7 @@ jobs:
|
||||
echo "VERSION=$VERSION" >> "$GITHUB_ENV"
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
|
||||
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
|
||||
|
||||
- name: Log in to GitHub Container Registry
|
||||
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
|
||||
@@ -378,8 +456,28 @@ jobs:
|
||||
type=semver,pattern={{major}}.{{minor}}
|
||||
type=raw,value=latest
|
||||
|
||||
# Build locally first so the image can be boot-smoked BEFORE anything
|
||||
# is pushed — a pushed :latest that dies on boot deploys itself to every
|
||||
# `docker compose pull` upgrade.
|
||||
- name: Build image (local, for smoke test)
|
||||
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
|
||||
with:
|
||||
context: Server/
|
||||
load: true
|
||||
build-args: VERSION=${{ env.VERSION }}
|
||||
tags: owncord-smoke:candidate
|
||||
cache-from: type=gha
|
||||
cache-to: type=gha,mode=max
|
||||
|
||||
# Shared with ci.yml's docker-build job so the smoke itself is exercised
|
||||
# on every PR to main — the first alpha.3 release run died here on a
|
||||
# smoke-harness bug (bare `docker run`, nowhere writable for the
|
||||
# default config) that no pre-merge check had ever run.
|
||||
- name: Boot-smoke Docker image
|
||||
run: bash Server/scripts/docker-smoke.sh owncord-smoke:candidate
|
||||
|
||||
- name: Build and push
|
||||
uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6.16.0
|
||||
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
|
||||
with:
|
||||
context: Server/
|
||||
push: true
|
||||
@@ -391,18 +489,25 @@ jobs:
|
||||
|
||||
publish:
|
||||
name: Publish GitHub Release
|
||||
needs: [release-client-windows, release-client-linux, release-client-linux-arm64, release-server, release-server-docker]
|
||||
needs:
|
||||
[
|
||||
release-client-windows,
|
||||
release-client-linux,
|
||||
release-client-linux-arm64,
|
||||
release-server,
|
||||
release-server-docker,
|
||||
]
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: write
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
||||
|
||||
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
||||
with:
|
||||
node-version: 20
|
||||
node-version: 24
|
||||
cache: npm
|
||||
cache-dependency-path: Client/tauri-client/package-lock.json
|
||||
cache-dependency-path: Client/package-lock.json
|
||||
|
||||
- name: Download Windows client assets
|
||||
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
|
||||
@@ -452,8 +557,8 @@ jobs:
|
||||
- name: Generate SHA256 checksums
|
||||
shell: bash
|
||||
run: |
|
||||
(cd windows && sha256sum *) > checksums.sha256
|
||||
(cd linux && sha256sum *) >> checksums.sha256
|
||||
(cd windows && sha256sum -- *) > checksums.sha256
|
||||
(cd linux && sha256sum -- *) >> checksums.sha256
|
||||
sha256sum owncord-src-*.tar.gz >> checksums.sha256
|
||||
|
||||
# The legacy top-level asset/sha256 pair stays bound to the Windows
|
||||
@@ -469,7 +574,7 @@ jobs:
|
||||
"$VERSION" "$WIN_HASH" "$WIN_HASH" "$LINUX_HASH" > windows/server-update-manifest.json
|
||||
|
||||
- name: Sign server update assets
|
||||
working-directory: Client/tauri-client
|
||||
working-directory: Client
|
||||
shell: bash
|
||||
env:
|
||||
SERVER_UPDATE_SIGNING_PRIVATE_KEY: ${{ secrets.SERVER_UPDATE_SIGNING_PRIVATE_KEY }}
|
||||
@@ -479,8 +584,8 @@ jobs:
|
||||
printf '%s' "$SERVER_UPDATE_SIGNING_PRIVATE_KEY" > "$KEY_PATH"
|
||||
trap 'rm -f "$KEY_PATH"' EXIT
|
||||
npm ci
|
||||
npx tauri signer sign -f "$KEY_PATH" -p "$SERVER_UPDATE_SIGNING_PRIVATE_KEY_PASSWORD" ../../windows/chatserver.exe
|
||||
npx tauri signer sign -f "$KEY_PATH" -p "$SERVER_UPDATE_SIGNING_PRIVATE_KEY_PASSWORD" ../../windows/server-update-manifest.json
|
||||
npx tauri signer sign -f "$KEY_PATH" -p "$SERVER_UPDATE_SIGNING_PRIVATE_KEY_PASSWORD" ../windows/chatserver.exe
|
||||
npx tauri signer sign -f "$KEY_PATH" -p "$SERVER_UPDATE_SIGNING_PRIVATE_KEY_PASSWORD" ../windows/server-update-manifest.json
|
||||
|
||||
# Fail closed before publishing: prove the freshly signed assets verify
|
||||
# against the pinned public key that ships inside the server binary.
|
||||
|
||||
+51
-8
@@ -2,11 +2,14 @@
|
||||
.env
|
||||
Server/.env
|
||||
|
||||
# Claude Code — local-only, never committed. A slashless pattern matches at any
|
||||
# depth, so these also cover Server/CLAUDE.md, Client/**/CLAUDE.md and nested
|
||||
# .claude/ dirs.
|
||||
.claude/
|
||||
CLAUDE.md
|
||||
# Claude Code — local-only by default. The exceptions are committed on purpose:
|
||||
# a cloud session clones this repo and sees ONLY tracked files, so the CLAUDE.md
|
||||
# files, skills and workflows have to be here or it starts with no instructions.
|
||||
# Machine-local state (settings.local.json, locks) stays ignored.
|
||||
.claude/*
|
||||
!.claude/skills/
|
||||
!.claude/workflows/
|
||||
!.claude/settings.json
|
||||
CLAUDE.local.md
|
||||
.mcp.json
|
||||
|
||||
@@ -25,6 +28,17 @@ docs/research/
|
||||
docs/superpowers/
|
||||
/skills/
|
||||
|
||||
# Detailed security reports for findings that are not yet fixed. This repo is
|
||||
# public (docs/security.md): reproduction traces for a live defect must never
|
||||
# be committed. Findings are coordinated through private GitHub Security
|
||||
# Advisories; only opaque identifiers and safe status go in tracked plans.
|
||||
docs/security-findings/
|
||||
|
||||
# Mutation-testing output (npm run test:mutate). Local-only by design: a
|
||||
# surviving-mutant report maps exactly which behaviour nothing tests.
|
||||
Client/.stryker-tmp/
|
||||
Client/reports/
|
||||
|
||||
# Server runtime artifacts
|
||||
Server/chatserver.exe
|
||||
Server/chatserver.exe~
|
||||
@@ -33,6 +47,17 @@ Server/server.exe
|
||||
Server/config.yaml
|
||||
Server/data/
|
||||
|
||||
# Prebuilt plugin example (RL-08). Built from the main.go beside it with the
|
||||
# TinyGo toolchain that directory's README pins. Read by nothing in the build
|
||||
# or test graph, and not byte-reproducible on another machine: TinyGo embeds
|
||||
# absolute host paths from the building machine's Go SDK and module cache, and
|
||||
# has no -trimpath equivalent.
|
||||
#
|
||||
# Deliberately NOT a blanket *.wasm rule. Client/public/rnnoise.wasm is a
|
||||
# vendored npm artifact this repository does not build and the client fetches
|
||||
# at runtime; ignoring it would break voice noise suppression.
|
||||
Server/plugin/examples/hello/hello.wasm
|
||||
|
||||
# Test coverage artifacts
|
||||
*.out
|
||||
Server/cov.out
|
||||
@@ -51,7 +76,7 @@ Client/login-mockup.html
|
||||
Client/ui-mockup.html
|
||||
|
||||
# Tauri typegen (auto-generated IPC bindings)
|
||||
Client/tauri-client/src/generated/
|
||||
Client/src/generated/
|
||||
.typecache
|
||||
|
||||
# Node modules
|
||||
@@ -60,8 +85,20 @@ node_modules/
|
||||
# AI tooling
|
||||
.gstack/
|
||||
.claude-flow/
|
||||
.superpowers/
|
||||
.rust-review-results/
|
||||
|
||||
# Bug-hunt ledger: shared so contributors can add findings. Only the ledger and
|
||||
# its renderer are tracked; hunt transcripts, .bak snapshots and debris patches
|
||||
# are per-session scratch and stay local.
|
||||
#
|
||||
# FINDINGS.md is deliberately NOT tracked (RL-07): it is 100% derived from
|
||||
# findings-ledger.json, and every hunt would otherwise write a fresh ~1.06 MB
|
||||
# blob into permanent history for a file a reader can regenerate in under a
|
||||
# second with `node .superpowers/render-ledger.mjs`.
|
||||
.superpowers/*
|
||||
!.superpowers/findings-ledger.json
|
||||
!.superpowers/render-ledger.mjs
|
||||
|
||||
.claude/worktrees/
|
||||
|
||||
# Internal dev tools (e.g. tools/livekit-server.exe) are ignored, but the
|
||||
@@ -81,7 +118,7 @@ Client/CLIENT-REVIEW.md
|
||||
.serena/
|
||||
|
||||
# Client env (holds API keys - never commit)
|
||||
Client/tauri-client/.env
|
||||
Client/.env
|
||||
|
||||
# Rust review output
|
||||
.rust-review-results/
|
||||
@@ -91,3 +128,9 @@ Client/tauri-client/.env
|
||||
|
||||
# local server run logs
|
||||
server.log
|
||||
|
||||
# Knowledge-graph output. The tool and its 20.41 MB tracked payload were removed
|
||||
# in a5f7d95 (#1413, RL-06). The rule stays so a machine that still has the local
|
||||
# directory — it reached ~208 MB with cache and dated snapshots — does not see it
|
||||
# as untracked noise.
|
||||
graphify-out/
|
||||
|
||||
@@ -0,0 +1,5 @@
|
||||
# engine-strict makes the engines block in package.json a hard error rather
|
||||
# than an npm warning. npm reads the project .npmrc from the package
|
||||
# directory and does not walk parent directories, so this file has to exist
|
||||
# in every package root or the gate silently downgrades to a warning there.
|
||||
engine-strict=true
|
||||
@@ -0,0 +1,40 @@
|
||||
# Prettier 3 reads .gitignore by default, so everything ignored there —
|
||||
# node_modules/, dist/, coverage/, Client/src/generated/, docs/security-findings/ —
|
||||
# is already excluded. Only tracked files need entries here.
|
||||
|
||||
|
||||
# Generated, verified by `git diff --exit-code` after regeneration.
|
||||
Server/db/dbgen/
|
||||
Client/src/lib/protocolTypes.ts
|
||||
|
||||
|
||||
# Dated point-in-time snapshots. scripts/check-doc-counts.mjs already treats
|
||||
# these as deliberately unmaintained and out of scope to edit; reformatting
|
||||
# them would churn frozen records for no reader.
|
||||
docs/audit-*.md
|
||||
|
||||
# Carried forward from the client's own ignore file — a deliberate exclusion,
|
||||
# not an oversight.
|
||||
*.html
|
||||
|
||||
# Session scratch from the remember plugin. Gitignored by a nested
|
||||
# .remember/.gitignore, which Prettier does not read — it honours only the root
|
||||
# .gitignore. Untracked and per-machine: a contributor's scratch directory must
|
||||
# never be able to turn a shared gate red.
|
||||
.remember/
|
||||
**/.remember/
|
||||
|
||||
# Build output and per-tool scratch. Every path below is gitignored -- but by a
|
||||
# NESTED .gitignore, and Prettier honours only the root one. Without these
|
||||
# entries the gate goes red the moment a contributor runs a build: `cargo test`
|
||||
# alone drops ~850 formattable files into src-tauri/target/.
|
||||
# Mirrors Client/.gitignore, .serena/.gitignore and .superpowers/sdd/.gitignore.
|
||||
Client/dist/
|
||||
Client/coverage/
|
||||
Client/playwright-report/
|
||||
Client/test-results/
|
||||
Client/.vite/
|
||||
Client/src-tauri/target/
|
||||
Client/src-tauri/gen/
|
||||
.serena/
|
||||
.superpowers/sdd/
|
||||
@@ -0,0 +1,9 @@
|
||||
{
|
||||
"singleQuote": false,
|
||||
"semi": true,
|
||||
"trailingComma": "all",
|
||||
"printWidth": 100,
|
||||
"tabWidth": 2,
|
||||
"arrowParens": "always",
|
||||
"endOfLine": "lf"
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,152 @@
|
||||
// Renders .superpowers/findings-ledger.json to FINDINGS.md, and validates it.
|
||||
// Run: node .superpowers/render-ledger.mjs # write FINDINGS.md
|
||||
// node .superpowers/render-ledger.mjs --check # validate only
|
||||
// node .superpowers/render-ledger.mjs --selftest # run built-in tests
|
||||
import assert from "node:assert/strict";
|
||||
|
||||
const VALID_STATUS = ["open", "fixed", "declined", "refuted", "duplicate", "blocked"];
|
||||
|
||||
// Must stay in lockstep with SEV_RANK below. render() sorts the open section by
|
||||
// SEV_RANK, and an unranked severity makes the comparator return NaN — which
|
||||
// leaves the sort order implementation-defined, so the rendering would stop
|
||||
// being a pure function of the ledger. The drift gate compares the rendering
|
||||
// against the ledger, so its whole premise rests on this being enforced.
|
||||
const VALID_SEVERITY = ["critical", "high", "medium", "low"];
|
||||
|
||||
export function validate(ledger) {
|
||||
const problems = [];
|
||||
const ids = new Set();
|
||||
for (const r of ledger.findings) {
|
||||
if (ids.has(r.id)) problems.push(`duplicate id ${r.id}`);
|
||||
ids.add(r.id);
|
||||
if (!/^OC-\d{4}$/.test(r.id)) problems.push(`${r.id}: malformed id`);
|
||||
if (!VALID_STATUS.includes(r.status)) problems.push(`${r.id}: bad status ${r.status}`);
|
||||
if (!VALID_SEVERITY.includes(r.severity)) problems.push(`${r.id}: bad severity ${r.severity}`);
|
||||
if (r.status === "fixed" && (!r.fix || !r.fix.commit))
|
||||
problems.push(`${r.id}: fixed without a commit`);
|
||||
if (r.status === "declined" && !r.rationale)
|
||||
problems.push(`${r.id}: declined without a rationale`);
|
||||
if (r.status === "duplicate" && !r.duplicateOf)
|
||||
problems.push(`${r.id}: duplicate without duplicateOf`);
|
||||
}
|
||||
return problems;
|
||||
}
|
||||
|
||||
function selftest() {
|
||||
// Every fixture carries a severity: validate() now requires one, so omitting
|
||||
// it would make each case report two problems and assert against the wrong one.
|
||||
assert.deepEqual(validate({ findings: [] }), []);
|
||||
assert.deepEqual(
|
||||
validate({ findings: [{ id: "OC-0001", severity: "low", status: "fixed", fix: null }] }),
|
||||
["OC-0001: fixed without a commit"],
|
||||
);
|
||||
assert.deepEqual(validate({ findings: [{ id: "bad", severity: "low", status: "open" }] }), [
|
||||
"bad: malformed id",
|
||||
]);
|
||||
assert.deepEqual(
|
||||
validate({
|
||||
findings: [
|
||||
{ id: "OC-0001", severity: "low", status: "open" },
|
||||
{ id: "OC-0001", severity: "low", status: "open" },
|
||||
],
|
||||
}),
|
||||
["duplicate id OC-0001"],
|
||||
);
|
||||
assert.deepEqual(
|
||||
validate({ findings: [{ id: "OC-0002", severity: "low", status: "declined" }] }),
|
||||
["OC-0002: declined without a rationale"],
|
||||
);
|
||||
|
||||
// An unranked severity is what makes render()'s sort implementation-defined.
|
||||
assert.deepEqual(
|
||||
validate({ findings: [{ id: "OC-0003", severity: "moderate", status: "open" }] }),
|
||||
["OC-0003: bad severity moderate"],
|
||||
);
|
||||
assert.deepEqual(validate({ findings: [{ id: "OC-0004", status: "open" }] }), [
|
||||
"OC-0004: bad severity undefined",
|
||||
]);
|
||||
for (const sev of VALID_SEVERITY) {
|
||||
assert.deepEqual(
|
||||
validate({ findings: [{ id: "OC-0005", severity: sev, status: "open" }] }),
|
||||
[],
|
||||
);
|
||||
}
|
||||
console.log("selftest: all assertions pass");
|
||||
}
|
||||
|
||||
const SEV_RANK = { critical: 0, high: 1, medium: 2, low: 3 };
|
||||
|
||||
export function render(ledger) {
|
||||
const by = (s) => ledger.findings.filter((f) => f.status === s);
|
||||
const open = by("open").sort((a, b) => SEV_RANK[a.severity] - SEV_RANK[b.severity]);
|
||||
const blocked = by("blocked");
|
||||
const fixed = by("fixed");
|
||||
const declined = by("declined");
|
||||
const refuted = by("refuted");
|
||||
const dup = by("duplicate");
|
||||
|
||||
const lines = [];
|
||||
lines.push("# OwnCord Findings Ledger", "");
|
||||
lines.push(
|
||||
"Generated by `render-ledger.mjs`. Do not hand-edit — edit `findings-ledger.json`.",
|
||||
"",
|
||||
);
|
||||
lines.push(
|
||||
`**${open.length} open** · ${blocked.length} blocked · ${fixed.length} fixed · ` +
|
||||
`${declined.length} declined · ${refuted.length} refuted · ${dup.length} duplicate`,
|
||||
"",
|
||||
);
|
||||
|
||||
const section = (title, rows, extra) => {
|
||||
if (!rows.length) return;
|
||||
lines.push(`## ${title}`, "");
|
||||
for (const r of rows) {
|
||||
lines.push(`### ${r.id} — ${r.severity} — ${r.title}`, "");
|
||||
lines.push(
|
||||
`\`${r.file}:${r.line}\` · found ${r.found} · hunt \`${r.hunt}\` · lens \`${r.lens}\``,
|
||||
"",
|
||||
);
|
||||
if (r.why) lines.push(r.why, "");
|
||||
if (r.repro) lines.push(`**Repro:** ${r.repro}`, "");
|
||||
if (r.evidence) lines.push(`**Evidence:** ${r.evidence}`, "");
|
||||
if (r.suggestedFix) lines.push(`**Suggested fix:** ${r.suggestedFix}`, "");
|
||||
const e = extra && extra(r);
|
||||
if (e) lines.push(e, "");
|
||||
}
|
||||
};
|
||||
|
||||
section("Open", open);
|
||||
section("Blocked — fix attempted, revert-proof failed", blocked);
|
||||
section(
|
||||
"Fixed",
|
||||
fixed,
|
||||
(r) =>
|
||||
`**Fixed:** \`${r.fix.commit}\` · test \`${r.fix.test}\` · revert-proof ${r.fix.revertProof}`,
|
||||
);
|
||||
section("Declined", declined, (r) => `**Declined:** ${r.rationale}`);
|
||||
section("Refuted", refuted);
|
||||
section("Duplicate", dup, (r) => `**Duplicate of** ${r.duplicateOf}`);
|
||||
return lines.join("\n");
|
||||
}
|
||||
|
||||
async function main() {
|
||||
const { readFileSync, writeFileSync } = await import("node:fs");
|
||||
const { dirname, join } = await import("node:path");
|
||||
const { fileURLToPath } = await import("node:url");
|
||||
const here = dirname(fileURLToPath(import.meta.url));
|
||||
const ledger = JSON.parse(readFileSync(join(here, "findings-ledger.json"), "utf8"));
|
||||
const problems = validate(ledger);
|
||||
if (problems.length) {
|
||||
for (const p of problems) console.error(`INVALID ${p}`);
|
||||
process.exit(1);
|
||||
}
|
||||
if (process.argv.includes("--check")) {
|
||||
console.log(`ledger valid: ${ledger.findings.length} finding(s)`);
|
||||
return;
|
||||
}
|
||||
writeFileSync(join(here, "FINDINGS.md"), render(ledger) + "\n");
|
||||
console.log(`wrote FINDINGS.md (${ledger.findings.length} finding(s))`);
|
||||
}
|
||||
|
||||
if (process.argv.includes("--selftest")) selftest();
|
||||
else await main();
|
||||
+539
-5
@@ -5,6 +5,540 @@ tooling (`npm run changelog`) auto-generates entries from commit messages
|
||||
on each release; this file is the curated counterpart that calls out
|
||||
behavioural changes operators must know about.
|
||||
|
||||
## How to write an entry
|
||||
|
||||
**Scannable lists, never walls of text.** A reader should be able to find what
|
||||
affects them in about ten seconds, without reading a paragraph they do not care
|
||||
about. Entries below `v1.2.0-alpha.3` do not follow this and are left as
|
||||
shipped history; everything from the next release forward does.
|
||||
|
||||
The rules:
|
||||
|
||||
1. **Open with what is user-visible and what is not.** Most releases carry a
|
||||
mixture. Say which is which up front, so nobody reads twenty lines of
|
||||
repository plumbing looking for a fix.
|
||||
2. **Group by the area a user recognises** — Login & connection, Voice,
|
||||
Mentions, Messages & files, Accounts & admin, Desktop UI. Not by subsystem,
|
||||
package, or which PR it came from.
|
||||
3. **One line per fix.** If it needs two lines, it needs two entries or it does
|
||||
not belong here.
|
||||
4. **Say what was broken, then what it does now.** "Banned users could still
|
||||
connect — ban is re-checked on connect." A reader must be able to tell
|
||||
whether it bit them, without opening the PR.
|
||||
5. **Plain language.** Name the thing a user sees, not the function that owned
|
||||
the bug. `voiceJoinLeaveCurrent` means nothing to an operator; "moderator
|
||||
mute survives a channel move" does.
|
||||
6. **No `OC-*` ids, no file paths, no PR-body prose.** The ledger and the pull
|
||||
request already carry those, and this file is the one place that does not
|
||||
need them. A PR number is fine where it genuinely helps someone dig.
|
||||
7. **Counts belong in a summary line, not per item.** "62 fixes" once at the
|
||||
top beats a number attached to every bullet.
|
||||
|
||||
Anything a user cannot observe — repository layout, CI gates, generated-code
|
||||
ownership, dependency automation — gets **at most a short block at the end**,
|
||||
and only when it changes something a contributor or fork holder must do
|
||||
(a moved directory, a renamed module, a new required command).
|
||||
|
||||
## v1.2.0-alpha.4
|
||||
|
||||
**62 bug fixes**, all user-visible, plus repository work that changes nothing an
|
||||
operator can see. Fixes first; the repository half is the short block at the end.
|
||||
|
||||
### Login & connection
|
||||
|
||||
- Connecting with a failed role lookup silently made you a plain **member** — it
|
||||
now fails closed instead of guessing.
|
||||
- **Banned users could still connect.** Ban status is re-checked on connect.
|
||||
- Reconnecting left a **phantom voice E2EE key holder** and a stale voice-channel
|
||||
marker behind.
|
||||
- Typing indicators in DMs could **disconnect you** under load.
|
||||
|
||||
### Voice
|
||||
|
||||
- Moderator mute and deafen are **preserved across a channel move** — they were
|
||||
silently dropped.
|
||||
- Voice E2EE keys **re-sync on reconnect**, and a departed peer's key is always
|
||||
retired so a replayed announce cannot overwrite a fresh one.
|
||||
- A kicked client no longer receives frames.
|
||||
- A rolled-back join now reaches everyone present, including people without
|
||||
permission to read the channel.
|
||||
- A **failed microphone unmute now shows as failed** instead of quietly
|
||||
reporting you as unmuted.
|
||||
- Noise suppression rebuilds correctly after a microphone restart.
|
||||
|
||||
### Mentions
|
||||
|
||||
- **`@here` no longer behaves like `@everyone`** — the two are distinguished.
|
||||
- Mention badges are reversed on delete, purge and account deletion, and can no
|
||||
longer be reversed twice.
|
||||
|
||||
### Messages & files
|
||||
|
||||
- Deleting a message now **actually deletes its attachment files**.
|
||||
- A failed avatar upload no longer deletes a committed file's reference.
|
||||
|
||||
### Accounts & admin
|
||||
|
||||
- The `require_2fa` enrollment gate misfired after a temporary ban lapsed, and
|
||||
applied its precondition to unrelated settings.
|
||||
- A DM partner with no live connection now shows **offline everywhere** — it was
|
||||
inconsistent between views.
|
||||
- Plugin installation rolls back properly when it fails.
|
||||
- The diagnostics endpoint honours trusted proxies.
|
||||
|
||||
### Desktop app
|
||||
|
||||
- Fixed event-listener leaks in the message list, member list, emoji picker,
|
||||
quick switcher, sidebar popovers and drag-reorder.
|
||||
- Recent emoji, channel mutes and custom status are now **per-server** instead of
|
||||
bleeding between servers.
|
||||
- The DM sidebar filter survives updates, the call button cannot redial, the
|
||||
incoming-call banner uses nicknames, and Ctrl+I unwraps correctly on bold text.
|
||||
|
||||
### Repository — no runtime effect
|
||||
|
||||
Phases B0 and B1 of the
|
||||
[repository-health roadmap](docs/plans/repo-health-roadmap-2026-08-23.md).
|
||||
Desktop behaviour, release asset names and the update contract are unchanged by
|
||||
design. Three items affect anyone holding a working copy or a fork:
|
||||
|
||||
- **`Client/tauri-client/` is now `Client/`** (#1411). Rebase an in-flight
|
||||
branch rather than merging across the move.
|
||||
- **The Go module is now `github.com/J3vb/OwnCord/Server`** (#1417), was
|
||||
`github.com/owncord/server`.
|
||||
- **The protocol schema is now `protocol/schema.json`** (#1417), was
|
||||
`docs/protocol-schema.json`.
|
||||
|
||||
One command runs what CI gates on, Windows and Linux, no `make` needed:
|
||||
`npm run bootstrap`, then `npm run check`. Go-only contributors still do not
|
||||
need Node.
|
||||
|
||||
## v1.2.0-alpha.3
|
||||
|
||||
- **fix:** eight bug-hunt batches closed **199 verified defects** since
|
||||
`v1.2.0-alpha.2` — 30 in #1366/#1367, 110 in #1369–#1372, 34 in #1374 and
|
||||
25 in #1375 — each fixed test-first with the failing assertion watched red
|
||||
against the unpatched code. The behavioural consequences worth knowing
|
||||
about are listed below; the rest are one-line correctness fixes with no
|
||||
operator-visible change.
|
||||
- **security(client): voice E2EE was never actually enabled** (#1370). The
|
||||
full ECDH/HKDF/AES-GCM key exchange completed, the room key was set, and
|
||||
the UI showed 🔒 Secured — but `createRoom` never called
|
||||
`room.setE2EEEnabled(true)`, so every audio and video frame reached the
|
||||
SFU in plaintext. It is enabled now, and a dead E2EE worker is no longer
|
||||
invisible to the Secured badge. Related voice-crypto fixes: a joining key
|
||||
holder sent its room-key offers _before_ its own announce, so existing
|
||||
participants dropped them as "unknown peer" (#1370, #1374); rotation
|
||||
offers exceeded the server rate limit in large channels and permanently
|
||||
starved the same peers; both rotation paths and the reconnect-to-Secured
|
||||
path now carry session-generation guards; a departing peer's ephemeral
|
||||
key is retired on leave so a replayed pre-leave announce cannot overwrite
|
||||
the fresh key they rejoined with (#1372, #1374). The client also refreshed
|
||||
its LiveKit token every 23 hours while the server mints it with a 5-minute
|
||||
TTL, so auto-reconnect failed for any voice session older than five
|
||||
minutes (#1370).
|
||||
- **security(server):** access-control holes (#1369–#1372, #1374, #1375) —
|
||||
`voice_join` into a 1:1 DM had no block gate, so a blocked user could
|
||||
enter the blocker's DM voice room; the attachment-serve admin bypass let
|
||||
an ADMINISTRATOR download files from private DMs they were not in; the
|
||||
archived-channel read-only gate covered `SendMessage` only, so edit,
|
||||
reaction, pin, purge, delete and `channel_focus` still mutated or
|
||||
subscribed to archived channels (every write sink now routes through one
|
||||
`requireChannelWritable` gate); `EditMessage` and `handleReaction` DM
|
||||
detection failed _open_ on a `GetChannel` error, skipping the block gate;
|
||||
group-DM creation only block-checked the creator, letting a third party
|
||||
force two users who blocked each other into a shared room; an invisible
|
||||
user's real custom status leaked on both presence emitters; `PATCH
|
||||
/users/{id}` with `banned` + `role_id` committed and broadcast the ban
|
||||
before authorizing the role change; admin API-token creation accepted a
|
||||
negative `expires_hours` and minted a token that never expires; upload
|
||||
rejections echoed raw storage errors (absolute server paths) to any
|
||||
authenticated user; the GIF proxy's log redaction missed the
|
||||
percent-encoded API key; `chat_command` was the only client message type
|
||||
without a rate limiter while each frame ran a WASM plugin invocation; and
|
||||
the login and typing rate limiters built their keys from _unvalidated_
|
||||
input, letting an unauthenticated caller pin unbounded heap for six hours.
|
||||
- **fix(auth):** accounts whose username contains `'`, `"` or `&` were
|
||||
permanently unloggable — registration HTML-escaped the name but login did
|
||||
not — and a profile rename to such a name locked the user out (#1370). If
|
||||
you had users hit this, they can log in again with no action on your side.
|
||||
Also: message search returned 500 for any query containing a hyphen (the
|
||||
one FTS5 operator the sanitizer allowlisted); usernames with an uppercase
|
||||
non-ASCII letter could never be @mentioned; registration recorded the
|
||||
reverse-proxy address as the session IP.
|
||||
- **server:** WS hub, reconnect and replay (#1369, #1371, #1372, #1374,
|
||||
#1375) — REST DM events never bumped the visibility watermark, while
|
||||
_every_ ordinary DM message re-emitted `dm_channel_open` and bumped the
|
||||
global watermark, forcing every other client's next reconnect into a full
|
||||
resync; the client's `lastSeq` was never reset by a full-ready resync and
|
||||
desynced permanently; cold-tier replay had no interior-gap detection, so
|
||||
events the persister dropped were skipped and presented as a complete
|
||||
resume; `buildReady` swallowed three DB errors and shipped an
|
||||
authoritative-looking empty snapshot (the client wiped its DM list, member
|
||||
list and unread badges) and dropped the user's own live voice room when
|
||||
not READ-visible; `channel_focus` could re-subscribe after a concurrent
|
||||
visibility revoke, and role demotion's live-subscription revocation was
|
||||
gated on a cosmetic role re-read; a failed reconnect handshake ran the
|
||||
full disconnect teardown twice; presence events from every source now
|
||||
share one ordered per-client FIFO.
|
||||
- **server:** voice lifecycle (#1369, #1371, #1374) — a stale join's
|
||||
rollback deleted `voice_states` by user id alone, destroying a concurrent
|
||||
newer membership; deleting a voice channel raced a concurrent `voice_join`
|
||||
into a permanent hub/SFU ghost no sweep could heal; the stale-state sweep
|
||||
could delete a just-committed join's row, leaving the client in voice with
|
||||
no DB row; `handleVoiceJoin` handed out a live 5-minute LiveKit credential
|
||||
_after_ a concurrent kick/move/revocation had already torn the membership
|
||||
down (the token is now withheld); the `participant_left` webhook never
|
||||
told the leaver, and a transient DB read error on `participant_joined`
|
||||
ejected a legitimate participant mid-call; `voice_mod_move` lacked the
|
||||
archived-channel gate; `CleanupVoiceForChannel` resolved an empty
|
||||
`voice_leave` audience because both callers archive first. Camera and
|
||||
screenshare now draw from the same per-channel `voice_max_video` budget —
|
||||
screenshare had no cap check at all, and the camera gate did not count
|
||||
screensharing occupants.
|
||||
- **server:** DM and message fan-out (#1369, #1371, #1372, #1375) — a DM
|
||||
send, edit, delete or reaction survived a transient participant lookup
|
||||
failure by silently dropping live fan-out to everyone including the
|
||||
sender; emoji create/delete and group-DM creation tied their broadcasts to
|
||||
the request context, so an aborted request committed the mutation and
|
||||
skipped the event; slow mode consumed its cooldown token before content
|
||||
validation, so a rejected send locked the composer for the full window; an
|
||||
attachment-metadata read failure broadcast the message with no
|
||||
attachments; `GET /channels/{id}/pins` had no LIMIT and failed permanently
|
||||
past ~32k pins; pinning a soft-deleted message returned 500;
|
||||
`LinkAttachmentsToMessage` no longer claims a user's live avatar as a
|
||||
message attachment; `PATCH /channels/{id}` now rejects a blank name.
|
||||
- **server:** admin and plugins (#1369, #1370, #1372, #1375) — "Restore
|
||||
backup" wrote to a hardcoded `data/chatserver.db`, so it silently no-oped
|
||||
on any server with a configured `database.path`; the WAF inline engine
|
||||
rejected every request body ≥ 1 MiB, breaking plugin install and large
|
||||
avatar uploads when `waf_enabled` was on; self-account-deletion emitted no
|
||||
`member_ban`, so every other client kept the deleted user; the admin live
|
||||
log stream blanked every error attribute to `{}`; `CheckForUpdate` had no
|
||||
in-flight dedupe and stampeded GitHub on cache expiry; a failed self-update
|
||||
swap left every client counting down to a restart that never came (a
|
||||
corrective `update_aborted` is now broadcast, and deferred cleanup runs
|
||||
before the restart exits — on Windows that file-handle release is the
|
||||
reason the restart exists). Plugin enable/re-install left
|
||||
`plugins.enabled = 1` while the runtime instance was deactivated, and
|
||||
uninstall reported success while the on-disk directory survived and
|
||||
resurrected the plugin on the next start.
|
||||
- **fix(client):** voice reliability (#1366, #1367, #1370–#1372, #1374,
|
||||
#1375) — a failed voice channel-switch left the user live in the call
|
||||
(mic hot, audio flowing) with the voice UI hidden and no way to leave;
|
||||
selecting the "Default" microphone (or losing the pinned one to a hot
|
||||
unplug) never changed the capture device; a camera or screenshare disable
|
||||
that completed while the enable's `publishTrack` was in flight left the
|
||||
server and every peer believing it was on (`leaveVoice` and reconnect
|
||||
teardown now bump the same generation guard); a `VIDEO_LIMIT` rollback
|
||||
assumed the camera and tore down a working camera while leaving refused
|
||||
screen tracks published — it now correlates by envelope id; auto-idle's
|
||||
return-to-online `presence_update` was always swallowed by the 1-per-10s
|
||||
limiter, so every user showed Idle to everyone else after their first idle
|
||||
period; connection-quality degradation was never reported; a group-DM
|
||||
decline silenced every other participant's ring and never reached the
|
||||
caller.
|
||||
- **fix(client):** messaging and stores (#1366, #1367, #1369, #1372) —
|
||||
re-opening a channel visited earlier in the session rendered a permanently
|
||||
stale window (live broadcasts only cover the focused channel; the tail is
|
||||
now refetched); the virtual scroll window never followed the scroll
|
||||
position, so rows past the initial overscan rendered as blank space; a
|
||||
scroll-up page past the 500-row cap deleted the user's pending/failed
|
||||
rows, the only copy of their composed text; the scroll-to-bottom button
|
||||
and "Jump to Present" pill scrolled out of view exactly when they became
|
||||
visible; a user named exactly "System" had every message rendered as a
|
||||
server notice with no moderation controls; DM permalinks failed until the
|
||||
DM had been opened once; the reaction picker dropped the server's custom
|
||||
emoji; Ctrl+K was dead with CapsLock on; the composer's slow-mode cooldown
|
||||
was applied to whichever channel was mounted, not the one that sent.
|
||||
- **fix(client):** settings, session and platform (#1367, #1370–#1372,
|
||||
#1375) — the built-in light theme overrode only 4 of ~45 tokens (composer
|
||||
and inputs near-invisible), the Font Size slider and High Contrast toggle
|
||||
were no-ops, and the tray Status menu bypassed the client's own status
|
||||
state so a tray-set Do Not Disturb silenced nothing; a failed TOTP verify
|
||||
tore down the overlay so the code could not be re-entered; channel
|
||||
create/edit/delete modals locked up permanently on an API failure; login
|
||||
to an IPv6-literal host was impossible; a host stored with an explicit
|
||||
`:443` lost its bearer token and cert-pinned proxy on attachment fetches;
|
||||
one malformed stored server profile discarded _all_ saved profiles; a
|
||||
banned/revoked token reconnected forever if the session ended before
|
||||
MainPage mounted; a previous server's block list, collapsed categories and
|
||||
DM notes bled into the next server; the Rust HTTP proxy tunnel's data
|
||||
phase had no deadline, so a remote that completed TLS then went silent
|
||||
parked the connection forever (bounded at 600s — loose on purpose, this
|
||||
path carries uploads); the autostart toggle raced its own write.
|
||||
- **infra:** observability, backups, guardrails and deployment hardening
|
||||
(#1376). **`/health` now returns a real verdict** — hub dispatch-loop
|
||||
liveness, a bounded DB ping and a free-disk check, answering **503 with a
|
||||
subsystem reason** (`hub`, `database`, `disk`) when degraded; results are
|
||||
cached so the unauthenticated endpoint cannot amplify load. Point uptime
|
||||
monitors at it and treat any 503 as actionable. **The hub's panic breaker
|
||||
now exits the process** so a supervisor can restart it, instead of leaving
|
||||
broadcast delivery silently dead while clients still appear online — if
|
||||
you run the bare binary without a supervisor, use the new hardened
|
||||
`deploy/owncord.service` systemd unit (see "Running as a Linux Service").
|
||||
**Backups now actually run:** `backup_schedule` and `backup_retention`
|
||||
had existed in the admin panel since the initial schema but were never
|
||||
read by any code; the 15-minute maintenance loop now enforces them,
|
||||
verifies each backup with `PRAGMA integrity_check` (and again before a
|
||||
restore may overwrite the live DB), and prunes by age keeping the newest.
|
||||
Expect backup files to start appearing and pruning for the first time.
|
||||
`/api/v1/metrics` gains reconnect-tier, backpressure, DB-writer-wait,
|
||||
permission-cache, `ws_conn_rejects` and `disk_free_mb` signals, and the
|
||||
declared-but-never-recorded OTel instruments are wired. Upload storage
|
||||
failures return **507** instead of blaming the client with a 400. A
|
||||
single-process lock beside the SQLite file makes a second server process
|
||||
fail fast instead of silently fighting the first. **Unknown config keys
|
||||
now warn at startup** (a typo previously kept the default silently), and
|
||||
startup warns when `admin_allowed_cidrs` is customized while
|
||||
`trusted_proxies` is empty. Shutdown now joins the pruner and maintenance
|
||||
loop before the DB closes, drains HTTP handlers into a live hub, and skips
|
||||
the 5s client-notice window when nobody is connected. Write-path work:
|
||||
no-op read-state UPSERTs are skipped, boot-time `ANALYZE` runs only when a
|
||||
migration applied, role-scoped override changes evict only that role's
|
||||
members from the permission cache, and connect/disconnect presence passes
|
||||
through a 300ms latest-wins coalescer (wire format and seq ordering
|
||||
unchanged).
|
||||
- **config:** new keys, all defaulting to current behaviour (#1376) —
|
||||
`server.max_ws_connections` (0 = unlimited; over the cap answers 503 +
|
||||
Retry-After), `server.metrics_allowed_cidrs` and
|
||||
`server.livekit_webhook_allowed_cidrs` (both fall back to
|
||||
`admin_allowed_cidrs`, so a central Prometheus scraper or an
|
||||
externally-hosted LiveKit no longer requires widening the admin
|
||||
perimeter), `database.max_readers` (0 = auto), `backup.dir`
|
||||
(`data/backups`), `security.auth_rate_limit_multiplier` (1.0; raise for
|
||||
shared-NAT communities), `event_persistence.replay_ring_size` (1000) and
|
||||
`event_persistence.replay_cold_limit` (5000 — watch `reconnect_tier_full`
|
||||
before raising). Three stored-but-inert admin settings (`server_icon`,
|
||||
`max_upload_bytes`, `voice_quality`) are now shown read-only with a
|
||||
pointer at the real `config.yaml` keys instead of pretending to apply.
|
||||
Documented in `docs/server-configuration.md`.
|
||||
- **deploy:** new `chatserver healthcheck` subcommand probes `/health`
|
||||
pinning the server's own certificate from disk (WebPKI when none exists,
|
||||
i.e. ACME) and is now the docker-compose healthcheck — the distroless
|
||||
image has no shell; plain `docker compose` only _surfaces_ unhealthy, pair
|
||||
it with a watchdog for auto-restart. Compose gains json-file log rotation
|
||||
(`10m` × 3) on both services. `release.yml` now cold-boots the freshly
|
||||
built server binaries and Docker image and probes them healthy **before
|
||||
anything is signed or pushed** — the release feed drives signed
|
||||
self-updates, so a binary that compiled but died on boot would previously
|
||||
have shipped itself to every auto-updating instance. New "Reverse Proxy
|
||||
Topology" docs section (nginx snippet; only WebRTC media ports need to be
|
||||
directly reachable, `/livekit/*` is already proxied). Release binaries
|
||||
are built with Go 1.26.6 (stdlib CVE fixes flagged by govulncheck).
|
||||
- **migrations:** **031** normalizes legacy `sessions.expires_at` values to
|
||||
RFC3339-UTC and adds `idx_sessions_expires_at`, so the 15-minute expired-
|
||||
session sweep is an index lookup instead of a full-table scan on the
|
||||
writer. Applies automatically on first start; no operator action needed.
|
||||
- **protocol:** no wire changes — `docs/protocol-schema.json`,
|
||||
`message_types.go` and `protocolTypes.ts` are byte-identical to
|
||||
`v1.2.0-alpha.2`. Older clients and servers interoperate unchanged.
|
||||
- **fix(ws):** the LiveKit health check shared the process-wide
|
||||
`http.DefaultTransport` pool with every other user in the server; it now
|
||||
owns a private transport (#1356).
|
||||
- **chore:** bug-hunt tooling under `.claude/` (fix pipeline, findings
|
||||
ledger, circuit breaker, single-finder hunt with graph-fed targeting —
|
||||
#1361–#1365, #1373); dependency bumps (OTel 1.45.0, koanf, sqlite,
|
||||
eslint/oxlint/knip/typescript-eslint, tauri-plugin-updater, GitHub
|
||||
Actions; #1353–#1360). No runtime impact.
|
||||
|
||||
## v1.2.0-alpha.2
|
||||
|
||||
- **feat(client):** the login form has an **Auto connect** checkbox under
|
||||
Remember password. Ticking it makes that server connect automatically on
|
||||
launch — the same setting as the auto-login button on a server card, so
|
||||
the two stay in sync, and as before only one server can be auto-connect
|
||||
at a time.
|
||||
Ticking it also forces Remember password on and locks it: auto-connect
|
||||
replays the stored token, which is only written when the password is
|
||||
remembered, so the two cannot be set independently without producing a
|
||||
setting that silently does nothing.
|
||||
- **fix(client):** Remember password works again. The password was saved to
|
||||
the OS keyring but never returned to the client over IPC, so the login
|
||||
form could not prefill it — the box appeared to work and did nothing.
|
||||
- **fix:** three bug-hunt sweeps closed **233 verified defects** since
|
||||
`v1.2.0-alpha.1` — 26 in #1328, 107 in #1331, 100 in #1332 — each fixed
|
||||
test-first, with the failing assertion watched red against the unpatched
|
||||
code before the patch landed. The behavioural consequences worth knowing
|
||||
about are listed in the nine entries below.
|
||||
- **server:** WS hub reconnect and replay hardening (#1328, #1331).
|
||||
Cold-tier replay used to truncate silently instead of forcing a full
|
||||
ready, and a retention-pruned event log was accepted outright as a
|
||||
complete resume — the highest-impact fix in #1331, since any client whose
|
||||
reconnect gap crossed the 24h retention default was permanently desynced.
|
||||
Resume also silently dropped the focused channel's topic subscription,
|
||||
stopping message delivery until the user manually switched channels; it
|
||||
is now restored during the handshake. `visibilityChangeSeq` can now only
|
||||
move forward across its three writers — it previously could regress and
|
||||
skip a required resync.
|
||||
- **server:** voice/E2EE key-holder election and audience gating (#1328,
|
||||
#1331) — three key-holder desync bugs (no client demotion path, peer keys
|
||||
cleared on reconnect, missing re-election on the webhook and
|
||||
fresh-reconnect paths), plus re-election wired into the sweep and
|
||||
channel-cleanup paths. Voice events were READ-filtered while membership
|
||||
is CONNECT-only, so participants in that gap silently missed
|
||||
`voice_leave`, stalling key-holder election and forward-secrecy rotation.
|
||||
Deleting a channel now evicts its voice participants first — the cleanup
|
||||
function existed but had zero production callers, so the FK cascade used
|
||||
to strand them silently. Moderator mute/deafen now survives a
|
||||
voice-channel switch; joins to non-voice channels are rejected; archived
|
||||
channels are read-only and unjoinable.
|
||||
- **security(server):** roles/permissions (#1328, #1331) — `UpdateRole`
|
||||
allowed position collisions that `CreateRole` already rejected, so tied
|
||||
positions could read as equal rank in every hierarchy comparison; it now
|
||||
matches `CreateRole`'s validation. `can_send` is now recomputed per client
|
||||
on every role/override change, so a permission change takes effect for
|
||||
connected clients immediately rather than waiting on a reconnect.
|
||||
- **server:** attachments and admin data-safety (#1331) — migration **030**
|
||||
unlinks attachments on message delete instead of cascading, so a cascaded
|
||||
channel/DM delete no longer strands uploaded files on disk with no
|
||||
reclamation path. The 15-minute orphan-attachment sweep was deleting every
|
||||
avatar in the instance (avatars are, by design, attachments with no
|
||||
message link) on its first tick past the grace period, permanently 404ing
|
||||
every profile picture; a second bug in the same sweep collapsed the
|
||||
one-hour grace period to effectively zero, from a TEXT-comparison mismatch
|
||||
between an RFC3339 cutoff and SQLite's own timestamp format. A failed
|
||||
backup restore used to truncate the live database to zero bytes with no
|
||||
rollback, while the server kept answering requests against the now-closed
|
||||
DB and falsely claimed a restart was underway — it now restores the
|
||||
pre-restore safety copy on failure and requests the restart honestly.
|
||||
Also fixed: personal data is cleared on account deletion, banned users are
|
||||
excluded from owner lookup, the silent 1000-member roster cap is gone, and
|
||||
a sender's own read state now advances on send. Migration applies
|
||||
automatically on first start; no operator action needed.
|
||||
- **protocol:** a new READ-gated `active_channel_id` auth field (#1331)
|
||||
restores the focused-channel subscription during the reconnect handshake
|
||||
itself, closing the window before the post-`auth_ok` `channel_focus` round
|
||||
trip lands. `protocol.md` also corrects the presence table, which had
|
||||
incorrectly documented all presence events as sequenced. Older
|
||||
clients/servers are unaffected — it is a new, ignorable field.
|
||||
- **security(client):** identity/TOFU and transport (#1332) — an in-flight
|
||||
change to scope the identity keypair by host _and_ user id would have
|
||||
re-minted a fresh key on every existing install, firing the TOFU "verify
|
||||
out-of-band" re-pin warning at the entire alpha population simultaneously,
|
||||
exactly the pattern that teaches users to click through the one warning
|
||||
meant to matter. The legacy host-only key is now adopted into the scoped
|
||||
name instead, saving before deleting so a partial failure cannot strand a
|
||||
user with neither key. Switching hosts carried the previous server's
|
||||
bearer token forward into the next login request; `api.setConfig` now
|
||||
drops it when the host changes without a replacement. A hand-copied,
|
||||
un-lowercased host normalizer in `main.ts` meant an uppercase hostname's
|
||||
cert-mismatch _reject_ path skipped `disconnect()`/`clearAuth()`, leaving
|
||||
a user who refused a changed certificate still connected to that server —
|
||||
the single lowercased implementation in `ws.ts` is now shared everywhere.
|
||||
- **fix(client):** voice mic/camera reliability (#1331, #1332) — six
|
||||
separate paths could republish the microphone without checking the user's
|
||||
mute state (the audio-device fallback, selecting "Default" input,
|
||||
un-deafening, `retryMicPermission`, a stale PTT ownership latch, and
|
||||
auto-reconnect's `restoreLocalVoiceState`), each producing a hot mic while
|
||||
every remote UI still showed the user muted; all now route through
|
||||
`isMicPolicyGated()`. Camera and screenshare kept publishing to the SFU
|
||||
after the user turned them off during the OS device picker. Enhanced Noise
|
||||
Suppression silently disabled the input-volume slider and VAD gate because
|
||||
`livekit-client`'s own `replaceTrack` call landed after ours. A key-holder
|
||||
promotion arriving mid voice-setup was clobbered, ejecting the joiner
|
||||
after a timeout only it could have resolved.
|
||||
- **fix(client):** messaging and store reliability (#1328, #1331, #1332) —
|
||||
sequenced DMs could jump the FIFO ahead of `sendHigh`, permanently losing
|
||||
an event dropped before flush. A full-ready resync left every loaded
|
||||
channel with a permanent hole in its history, because that tier never
|
||||
replays `chat_message` frames; loaded windows are now invalidated and the
|
||||
active channel refetched. The WS error handler only bannered
|
||||
`RATE_LIMITED` and `FORBIDDEN`, so every other server error code — for
|
||||
example a rejected `chat_edit` — was dropped in silence while the
|
||||
optimistic "Message edited" toast still fired. A message whose
|
||||
`chat_send_ok` was lost to the same disconnect that forced a resync could
|
||||
render twice; the optimistic row's id-based dedup now shares the
|
||||
content-based match predicate `addMessage` already used. Replay detection
|
||||
compared the server's `created_at` against the client's own clock, so a
|
||||
self-hosted server without NTP made every live message after a reconnect
|
||||
look like a replay and silently killed its notification; both sides now
|
||||
use an estimated server-time skew.
|
||||
- **fix(client):** UI defects (#1331, #1332) — the quick-switcher could
|
||||
mount a second overlay, orphaning a body-mounted backdrop that blocked all
|
||||
input until reload. The status-picker stylesheet targeted a root element
|
||||
the component never toggles; a same-branch repair then left the status dot
|
||||
itself 0×0 and unclickable, now fixed together with a test pinning the
|
||||
stylesheet to the classes the component actually emits. The attachment
|
||||
remove button and the failed-send Retry/Discard buttons did nothing;
|
||||
drag-reorder's phantom-drag latch and permission gate are fixed; keyboard
|
||||
Tab could escape every modal because hidden (`display: none`) controls
|
||||
were still counted as focusable.
|
||||
- **fix(client):** the user profile popup is styled correctly again
|
||||
(`a308f81`).
|
||||
- **fix(client):** Vite no longer watches `src-tauri/`, so a running dev
|
||||
server does not rebuild the frontend when Rust sources or build artifacts
|
||||
change (`cdcfc03`).
|
||||
- **fix(release):** the stripped Linux AppImage is signed from the
|
||||
environment-provided key instead of a temporary key file (`9d75890`) —
|
||||
release-pipeline only, no operator action needed.
|
||||
- **docs:** full documentation audit against `5630aa1` — reference docs,
|
||||
architecture pages, and UX specs corrected; plans and prior audits given
|
||||
verified statuses; see `docs/audit-2026-08-04-docs-and-coverage.md`.
|
||||
- **security(server):** closed the three 2026-08-04 review findings — the
|
||||
channel role-override **DELETE** now enforces the same hierarchy guard as
|
||||
PUT (A-2026-08-01); the admin channel list/edit/delete surface no longer
|
||||
sees DM channels, answering 404 for their ids (A-2026-08-02); DM call
|
||||
rings respect blocks like every other DM interaction (A-2026-08-03).
|
||||
Behavioural note: deleting a channel override for a _nonexistent_ role now
|
||||
returns 404 (was 204), matching PUT.
|
||||
- **server:** migration **029** drops the never-used `sounds` table (dead
|
||||
since the initial schema; A-2026-07-13). Applies automatically on first
|
||||
start; no operator action.
|
||||
- **protocol:** the plugin command family (`chat_command`, `command_reply`,
|
||||
`plugin_broadcast`) is now part of `protocol-schema.json` and the
|
||||
generated constants (27 client→server / 39 server→client). Wire strings
|
||||
are unchanged — no client or plugin impact.
|
||||
- **chore(client):** dead modules deleted (`ServerStrip`, `FileUpload`,
|
||||
`reconcile`, a stray worklet copy, orphan sounds API methods) and the
|
||||
unused tauri-typegen pipeline retired (`src/generated/**`, its CI steps,
|
||||
config block, and build-dependency).
|
||||
- **ci:** knip is now blocking; Playwright specs are typechecked
|
||||
(`typecheck:e2e`); three orphaned native e2e specs run again;
|
||||
`claude.yml` actions are SHA-pinned; the PR template asks for docs
|
||||
updates per the architecture maintenance rule.
|
||||
- **tests(client):** the TOFU certificate ceremony has e2e coverage
|
||||
(first-use + mismatch journeys), and `modalFactory` is fully covered.
|
||||
- **security(client):** the voice-E2EE identity pin lookup fails **closed**
|
||||
on keyring errors (DC-08): a transient store failure used to read as
|
||||
"never pinned", silently sending a pinned peer down the first-sight path
|
||||
and re-pinning whatever key the server delivered. An unreadable pin store
|
||||
now rejects the peer's announce, writes nothing, and shows a distinct
|
||||
amber "could not check" badge until the store recovers.
|
||||
- **feat(client):** accessibility pass over the modal/overlay stack
|
||||
(DC-13): every modal is a labelled `role="dialog"` with a focus trap and
|
||||
focus restore, Escape maps to each dialog's safe action, the settings
|
||||
sidebar is a keyboard-navigable tablist, the quick switcher and composer
|
||||
autocompletes are wired as combobox/listbox, the emoji/GIF pickers are
|
||||
keyboard-operable, and toasts/typing announce via polite live regions.
|
||||
- **feat(client):** UX polish (DC-12): deleting the active channel now
|
||||
says so in a toast; reactions toggle optimistically with rollback on
|
||||
failure; the role-change menu can no longer double-fire; a document-level
|
||||
listener leak in channel drag-reorder is fixed.
|
||||
- **feat(admin):** restoring a backup now writes a `backup_restore`
|
||||
audit-log row (DC-09). The row is written before the pre-restore safety
|
||||
copy, so it lives inside the `pre_restore_*.db` backup — the restored
|
||||
database itself cannot carry it (the restore replaces the file).
|
||||
- **ci:** the `-tags wazero` / `-tags otel` Go tests now actually run in CI
|
||||
(DC-06) — previously those variants were only compiled, leaving ~600
|
||||
lines of plugin/telemetry tests permanently dark.
|
||||
- **tests(client):** e2e journeys for voice-E2EE identity verification
|
||||
(badge states + mismatch modal, driven through the real crypto path) and
|
||||
the updater (banner → progress → auto-relaunch), plus an accessibility
|
||||
smoke; full web suite now 291 tests.
|
||||
|
||||
- **server/admin:** in-place self-update is refused in container
|
||||
deployments (503 `CONTAINER_DEPLOYMENT`; the shipped image sets
|
||||
`OWNCORD_CONTAINER=1`, bind-mount operators can set `0` to opt back in).
|
||||
Container upgrades are image pulls; `GET /admin/api/updates` now reports
|
||||
`can_apply` and the admin panel says so instead of offering the button.
|
||||
- **ci:** the full client e2e suite now blocks merges (DC-07); a new
|
||||
non-blocking `admin-e2e` job drives the admin panel against a real server
|
||||
(first-run wizard, channel CRUD, audit log, re-login).
|
||||
- **docs:** the dependency pinning/review policy is written down in
|
||||
`docs/contributing.md`, closing the last 2026-04 audit carryover that was
|
||||
still undecided.
|
||||
|
||||
## v1.2.0-alpha.1 — Discord feature parity
|
||||
|
||||
> **Project reset note:** OwnCord has re-entered alpha. The `v1.0.0` release is
|
||||
@@ -201,14 +735,14 @@ claimed behaviour — no product code changed and no assertion weakened.
|
||||
logged (`livekit proxy: origin rejected`) so the next such failure is
|
||||
diagnosable from the server log.
|
||||
- **API tokens can use the admin log stream.** `POST
|
||||
/admin/api/logs/ticket` required a browser login session, so headless
|
||||
/admin/api/logs/ticket` required a browser login session, so headless
|
||||
clients (the `mcp-introspect` dev tool, bots) could reach every other
|
||||
`/admin/api/*` route but not `server_logs`. Tickets are now bound to
|
||||
whichever credential authenticated the request; revoking a token cuts
|
||||
an in-flight stream, exactly as session revocation always has.
|
||||
- **The desktop client now actually uses the OS credential store.** The
|
||||
`keyring` crate declares no `default` feature, so the previous
|
||||
`keyring = "3"` dependency compiled its in-memory *mock* store on
|
||||
`keyring = "3"` dependency compiled its in-memory _mock_ store on
|
||||
Windows, macOS and Linux alike: saves reported success and the next
|
||||
read in the same process returned nothing, and no credential was ever
|
||||
written to Credential Manager / Keychain / Secret Service. The visible
|
||||
@@ -256,6 +790,6 @@ claimed behaviour — no product code changed and no assertion weakened.
|
||||
The project is under a feature freeze until the beta reset completes.
|
||||
Explicitly deferred (not abandoned unless noted): real OpenTelemetry SDK
|
||||
wiring, the Postgres backend (scaffolding removed pending real demand),
|
||||
the slash-command dispatcher (`docs/plans/slash-commands.md`), and the
|
||||
Solid.js migration (abandoned — the experiment is being removed in favor
|
||||
of the established vanilla component pattern).
|
||||
and the slash-command dispatcher (`docs/plans/slash-commands.md`). The
|
||||
Solid.js migration was abandoned and its experiment fully removed
|
||||
(2026-07-19) in favor of the established vanilla component pattern.
|
||||
|
||||
@@ -0,0 +1,50 @@
|
||||
# OwnCord
|
||||
|
||||
Self-hosted chat platform (alpha). `Server/` is a Go 1.26 REST + WebSocket
|
||||
server over SQLite with LiveKit voice/video; `Client/` is a Tauri
|
||||
v2 desktop app (TypeScript frontend, thin Rust backend). Per-component detail
|
||||
lives in `Server/CLAUDE.md` and `Client/CLAUDE.md`; the protocol
|
||||
and schema are documented in `docs/protocol.md`, `docs/schema.md`, and
|
||||
`docs/architecture/README.md`.
|
||||
|
||||
## Generated code — never hand-edit
|
||||
|
||||
CI fails on drift, and the next generator run silently discards your edit.
|
||||
|
||||
| Generated | Source of truth | Workflow |
|
||||
| ---------------------------------------------------------------------- | ----------------------------------------------- | -------------------------------------------------------------- |
|
||||
| `Server/db/dbgen/` | `Server/db/queries/*.sql`, `Server/migrations/` | `db-change` skill |
|
||||
| `Server/ws/message_types.go` **and** `Client/src/lib/protocolTypes.ts` | `protocol/schema.json` | `protocol-change` skill |
|
||||
| `Client/src/generated/` | `tauri-typegen` | CI patches known typegen bugs — see `.github/workflows/ci.yml` |
|
||||
|
||||
## Bug-hunt ledger
|
||||
|
||||
`.superpowers/findings-ledger.json` is the shared ledger of hunt findings and
|
||||
the only tracked copy — open a PR against it to add one. The readable
|
||||
`FINDINGS.md` is **not tracked**: generate it whenever you want to read one
|
||||
(gitignored, under a second, and CI uploads it as a build artifact):
|
||||
|
||||
```
|
||||
node .superpowers/render-ledger.mjs # write a local FINDINGS.md
|
||||
node .superpowers/render-ledger.mjs --check # validate the ledger only
|
||||
```
|
||||
|
||||
Statuses: `open`, `fixed`, `declined`, `refuted`, `duplicate`, `blocked`;
|
||||
`severity` must be `critical`, `high`, `medium` or `low`. Edit the ledger, never
|
||||
the rendering — a hand-edited `FINDINGS.md` is overwritten by the next render
|
||||
and committed by nothing. Everything else under `.superpowers/` is per-session
|
||||
scratch and stays local.
|
||||
|
||||
## Gotchas
|
||||
|
||||
- **Verify with the `ci-check` skill**, not with an ad-hoc `go build && go test`.
|
||||
CI compiles four Go build-tag variants and runs a deadlock-detection pass;
|
||||
the default build proves nothing about the tagged ones.
|
||||
- **The client unit suite is green and must stay green.** Never make a failing
|
||||
test pass by weakening its assertions.
|
||||
- Security issues go through GitHub Security Advisories, never public issues
|
||||
(`docs/security.md`). This repo is public — unfixed defects do not belong in
|
||||
commits, issues, or PR descriptions.
|
||||
- Branch from `dev` and PR to `dev` — `dev` is the integration branch and is
|
||||
PR-only; `main` carries releases. Squash merge, conventional commit subjects.
|
||||
Full model: [docs/contributing.md](docs/contributing.md#branch-and-pr-model).
|
||||
@@ -0,0 +1,24 @@
|
||||
# Contributing to OwnCord
|
||||
|
||||
The full guide lives in **[docs/contributing.md](docs/contributing.md)** —
|
||||
environment setup, the branch model, coding standards, and how to run the
|
||||
checks CI runs.
|
||||
|
||||
This file exists so GitHub can find it: the contributing-guidelines link that
|
||||
appears on new issues and pull requests only resolves `CONTRIBUTING.md` at the
|
||||
repository root, in `.github/`, or in `docs/`.
|
||||
|
||||
Three things worth knowing before you open a pull request:
|
||||
|
||||
- **Branch from `dev` and target `dev`.** `main` carries releases only. See
|
||||
[Branch and PR model](docs/contributing.md#branch-and-pr-model).
|
||||
- **Run the checks first.** `npm run check` from the repository root, or the
|
||||
per-stack commands in [docs/contributing.md](docs/contributing.md). CI takes
|
||||
about 15 minutes and enforces more than a plain build and test.
|
||||
- **Report security issues privately**, through GitHub Security Advisories —
|
||||
never a public issue or pull request. See [SECURITY.md](SECURITY.md) and
|
||||
[docs/security.md](docs/security.md).
|
||||
|
||||
New to the codebase? [docs/README.md](docs/README.md) indexes everything, and
|
||||
[docs/architecture/](docs/architecture/README.md) explains how the server and
|
||||
client fit together.
|
||||
@@ -0,0 +1,5 @@
|
||||
# engine-strict makes the engines block in package.json a hard error rather
|
||||
# than an npm warning. npm reads the project .npmrc from the package
|
||||
# directory and does not walk parent directories, so this file has to exist
|
||||
# in every package root or the gate silently downgrades to a warning there.
|
||||
engine-strict=true
|
||||
@@ -0,0 +1 @@
|
||||
24
|
||||
@@ -0,0 +1,48 @@
|
||||
# OwnCord Client (Tauri v2)
|
||||
|
||||
TypeScript frontend (Vite, vanilla TS — no React/Vue) plus a deliberately thin
|
||||
Rust backend in `src-tauri/` for native APIs only. LiveKit handles voice/video.
|
||||
|
||||
## Layout
|
||||
|
||||
- `src/stores/` observable stores · `src/lib/` protocol, WS, voice, E2EE ·
|
||||
`src/pages/`, `src/components/` UI
|
||||
- `src/lib/protocolTypes.ts` and `src/generated/` are generated — see the root
|
||||
CLAUDE.md
|
||||
- `tests/unit`, `tests/integration`, `tests/contract` (vitest, jsdom) ·
|
||||
`tests/e2e`, `tests/e2e/admin`, `tests/e2e/native` (Playwright) ·
|
||||
`tests/browser` (vitest browser mode)
|
||||
- A test whose assertions read, import or execute a **`Server/`-owned**
|
||||
artifact belongs in `tests/contract`, not `tests/unit` — `src-tauri/` is
|
||||
part of this component, so reading it is an ordinary unit test. The rule
|
||||
is in [docs/contributing.md](../docs/contributing.md#testing)
|
||||
- `src/platform/` does **not** exist yet. Where the desktop/browser seam will
|
||||
go, and which 20 files hold the native imports that must move behind it, is
|
||||
recorded in
|
||||
[docs/architecture/platform-contracts.md](../docs/architecture/platform-contracts.md).
|
||||
Building it is B7 — do not start it as a side effect of another change.
|
||||
|
||||
## Gotchas
|
||||
|
||||
- Node's native Web Storage (Node 22+) shadows jsdom's `localStorage`;
|
||||
`tests/setup.ts` replaces it with an in-memory shim, so the suite runs on
|
||||
modern Node without `--no-experimental-webstorage`. If storage tests fail
|
||||
en masse, suspect that shim before your change. CI pins Node 24.
|
||||
- `src/lib/dispatcher.ts` is the single WS-event entry point **into the
|
||||
stores**: server events reach domain stores only through a `ws.on(...)`
|
||||
subscription registered there. Other modules do register their own
|
||||
`ws.on(...)` handlers for page-local UI (`main.ts`, `MainPage.ts`,
|
||||
`ChannelController.ts` — ringing, overlays, slow-mode timers); that is fine
|
||||
as long as they only _read_ store state. Writing a store from one of those
|
||||
handlers is the violation, and `local/no-store-write-in-ws-on` now fails the
|
||||
build on it.
|
||||
- Voice sessions are superseded, not cancelled. `LiveKitSession` re-entry
|
||||
points check whether a newer attempt owns the shared state before tearing
|
||||
anything down, so cleanup in an aborted path must be scoped to that attempt's
|
||||
own room — a global `leaveVoice()` there kills the live session.
|
||||
- Voice E2EE is key-holder based with TOFU identity pinning. Anything touching
|
||||
`livekitE2EE.ts` or `identity.ts` must preserve the epoch/keypair staleness
|
||||
guards and must never report an unverified peer as verified.
|
||||
- Do not run `npm run tauri build` locally; the desktop build is CI-only.
|
||||
- Formatting is prettier-enforced; match the surrounding code rather than
|
||||
reasoning about style.
|
||||
@@ -0,0 +1,408 @@
|
||||
// Custom ESLint rules that turn three of the invariants documented in prose in
|
||||
// CLAUDE.md into enforced, test-covered lint rules. Each rule is scoped (via
|
||||
// `files:` in eslint.config.js) to only the module(s) its invariant governs —
|
||||
// see the per-rule `meta.docs.description` for the invariant it encodes and
|
||||
// tests/unit/eslint-rules.test.ts for the real-code shapes it was proven
|
||||
// against (both the shapes that must stay clean and the historical bug shapes
|
||||
// it must catch).
|
||||
//
|
||||
// Plain JS, ESM, no build step — eslint.config.js imports this directly.
|
||||
|
||||
/** True when `node` is a `this.<methodName>(...)` call. */
|
||||
function isThisMethodCall(node, methodName) {
|
||||
return (
|
||||
node !== null &&
|
||||
node.type === "CallExpression" &&
|
||||
node.callee.type === "MemberExpression" &&
|
||||
node.callee.object.type === "ThisExpression" &&
|
||||
!node.callee.computed &&
|
||||
node.callee.property.type === "Identifier" &&
|
||||
node.callee.property.name === methodName
|
||||
);
|
||||
}
|
||||
|
||||
/** True when `node` is a `this.<propertyName>` member access. */
|
||||
function isThisMember(node, propertyName) {
|
||||
return (
|
||||
node !== null &&
|
||||
node.type === "MemberExpression" &&
|
||||
node.object.type === "ThisExpression" &&
|
||||
!node.computed &&
|
||||
node.property.type === "Identifier" &&
|
||||
node.property.name === propertyName
|
||||
);
|
||||
}
|
||||
|
||||
function isFunctionNode(node) {
|
||||
return (
|
||||
node.type === "FunctionDeclaration" ||
|
||||
node.type === "FunctionExpression" ||
|
||||
node.type === "ArrowFunctionExpression"
|
||||
);
|
||||
}
|
||||
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
// Rule: no-leave-voice-when-superseded
|
||||
//
|
||||
// Invariant (CLAUDE.md): "Voice sessions are superseded, not cancelled.
|
||||
// LiveKitSession re-entry points check whether a newer attempt owns the
|
||||
// shared state before tearing anything down, so cleanup in an aborted path
|
||||
// must be scoped to that attempt's own room — a global leaveVoice() there
|
||||
// kills the live session."
|
||||
//
|
||||
// livekitSession.ts encodes "this attempt was superseded" with exactly two
|
||||
// guard predicates, always used the same way: `this.reconnectSuperseded(...)`
|
||||
// (true = superseded) and `!this.isStateConnected(...)` (negated = true when
|
||||
// superseded). Once either guard has confirmed supersession, the historical
|
||||
// bug (see the fix that introduced disconnectSupersededLocalRoom /
|
||||
// generation-guarded leaveVoice calls) was calling the global
|
||||
// `this.leaveVoice()` inside that same branch, tearing down whichever session
|
||||
// currently owns the shared state — which, once superseded, is a newer
|
||||
// attempt's live session, not this one.
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
|
||||
/** True when `test` (walking through &&/||) asserts "this attempt IS
|
||||
* superseded" via one of the two named guards used throughout the file. */
|
||||
function testSignalsSuperseded(test) {
|
||||
if (test === null) return false;
|
||||
if (test.type === "LogicalExpression") {
|
||||
return testSignalsSuperseded(test.left) || testSignalsSuperseded(test.right);
|
||||
}
|
||||
if (isThisMethodCall(test, "reconnectSuperseded")) return true;
|
||||
if (test.type === "UnaryExpression" && test.operator === "!") {
|
||||
return isThisMethodCall(test.argument, "isStateConnected");
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
const noLeaveVoiceWhenSuperseded = {
|
||||
meta: {
|
||||
type: "problem",
|
||||
docs: {
|
||||
description:
|
||||
"Disallow this.leaveVoice() inside a branch that already confirmed this connect/reconnect " +
|
||||
"attempt was superseded. Voice sessions are superseded, not cancelled — once reconnectSuperseded() " +
|
||||
"or !isStateConnected() is true, `_state` may already belong to a newer, live attempt, and " +
|
||||
"leaveVoice() there tears that live session down instead of the aborted one.",
|
||||
},
|
||||
schema: [],
|
||||
messages: {
|
||||
unsafeLeaveVoice:
|
||||
"this.leaveVoice() must not run once this attempt is known to be superseded — it acts on " +
|
||||
"whichever session currently owns `_state`, which may now be a newer, live attempt. Disconnect " +
|
||||
"only this attempt's own room instead (e.g. disconnectSupersededLocalRoom(localRoom) / " +
|
||||
"localRoom.disconnect()), or simply return without calling it.",
|
||||
},
|
||||
},
|
||||
create(context) {
|
||||
return {
|
||||
CallExpression(node) {
|
||||
if (!isThisMethodCall(node, "leaveVoice")) return;
|
||||
let child = node;
|
||||
let parent = node.parent;
|
||||
while (parent) {
|
||||
if (isFunctionNode(parent)) return; // left the enclosing method — stop
|
||||
if (
|
||||
parent.type === "IfStatement" &&
|
||||
child === parent.consequent &&
|
||||
testSignalsSuperseded(parent.test)
|
||||
) {
|
||||
context.report({ node, messageId: "unsafeLeaveVoice" });
|
||||
return;
|
||||
}
|
||||
child = parent;
|
||||
parent = parent.parent;
|
||||
}
|
||||
},
|
||||
};
|
||||
},
|
||||
};
|
||||
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
// Rule: e2ee-epoch-needs-keypair-check
|
||||
//
|
||||
// Invariant (CLAUDE.md): "Anything touching livekitE2EE.ts ... must preserve
|
||||
// the epoch/keypair staleness guards."
|
||||
//
|
||||
// Every async E2EE operation that resumes after an await re-checks it is
|
||||
// still the current attempt before writing shared state. The historical bug
|
||||
// (see the fix for handleOfferInner / handleAnnounceInner) compared only
|
||||
// `this._e2eeEpoch !== epochBefore` — insufficient, because a non-key-holder
|
||||
// never bumps the epoch, so a torn-down-then-restarted session can resume
|
||||
// with the epoch unchanged in both the old and new session. The fix requires
|
||||
// ALSO comparing keypair identity (`this._ecdhKeyPair !== keypair`). This
|
||||
// rule requires both checks to appear together in the same guard.
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
|
||||
/** True when `test` (walking through &&/||) contains `this.<prop> !== X`
|
||||
* (in either operand order). */
|
||||
function containsStrictInequality(test, prop) {
|
||||
if (test === null) return false;
|
||||
if (test.type === "LogicalExpression") {
|
||||
return containsStrictInequality(test.left, prop) || containsStrictInequality(test.right, prop);
|
||||
}
|
||||
if (test.type === "BinaryExpression" && test.operator === "!==") {
|
||||
return isThisMember(test.left, prop) || isThisMember(test.right, prop);
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
const e2eeEpochNeedsKeypairCheck = {
|
||||
meta: {
|
||||
type: "problem",
|
||||
docs: {
|
||||
description:
|
||||
"Require this._ecdhKeyPair identity checks alongside this._e2eeEpoch staleness checks. A " +
|
||||
"non-key-holder session never bumps the epoch, so an epoch-only comparison cannot detect a " +
|
||||
"torn-down-then-restarted session resuming after an await — only the keypair identity can.",
|
||||
},
|
||||
schema: [],
|
||||
messages: {
|
||||
missingKeypairCheck:
|
||||
"This staleness check compares this._e2eeEpoch but not this._ecdhKeyPair. A non-key-holder " +
|
||||
"session never advances the epoch, so this guard alone cannot detect a torn-down-then-restarted " +
|
||||
"session — add `|| this._ecdhKeyPair !== <the keypair captured before the await>` to the condition.",
|
||||
},
|
||||
},
|
||||
create(context) {
|
||||
return {
|
||||
IfStatement(node) {
|
||||
if (
|
||||
containsStrictInequality(node.test, "_e2eeEpoch") &&
|
||||
!containsStrictInequality(node.test, "_ecdhKeyPair")
|
||||
) {
|
||||
context.report({ node: node.test, messageId: "missingKeypairCheck" });
|
||||
}
|
||||
},
|
||||
};
|
||||
},
|
||||
};
|
||||
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
// Rule: e2ee-verified-status-literal
|
||||
//
|
||||
// Invariant (CLAUDE.md): "Anything touching livekitE2EE.ts ... must never
|
||||
// report an unverified peer as verified."
|
||||
//
|
||||
// verifyPeerAnnounce's every write of peer-verification state goes through
|
||||
// setPeerVerification/setPeerVerificationIfCurrent, and "verified" is reached
|
||||
// exactly once, only after a real signature check. This rule keeps that
|
||||
// structurally true: the `status` field at every call site must be a literal
|
||||
// the author typed by hand at that call site, never a variable/expression —
|
||||
// which would let a status be computed (and potentially manipulated) instead
|
||||
// of asserted at the one audited call site that earned it.
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
|
||||
function getCalleeName(node) {
|
||||
if (node.callee.type === "Identifier") return node.callee.name;
|
||||
if (
|
||||
node.callee.type === "MemberExpression" &&
|
||||
!node.callee.computed &&
|
||||
node.callee.property.type === "Identifier"
|
||||
) {
|
||||
return node.callee.property.name;
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
const VERIFICATION_SETTERS = new Set(["setPeerVerification", "setPeerVerificationIfCurrent"]);
|
||||
|
||||
const e2eeVerifiedStatusLiteral = {
|
||||
meta: {
|
||||
type: "problem",
|
||||
docs: {
|
||||
description:
|
||||
"Require the `status` field passed to setPeerVerification/setPeerVerificationIfCurrent to be a " +
|
||||
"string literal. A peer must never be reported verified via a computed/derived status — each " +
|
||||
"verification outcome is a distinct, hand-written call site that earned its status inline.",
|
||||
},
|
||||
schema: [],
|
||||
messages: {
|
||||
dynamicStatus:
|
||||
"The `status` passed here must be a string literal ('verified' | 'unverified' | 'mismatch' | " +
|
||||
"'unknown'), not a computed expression. Add a new literal call site for this outcome instead of " +
|
||||
"deriving the status dynamically — that is what keeps 'verified' provably tied to a real signature check.",
|
||||
},
|
||||
},
|
||||
create(context) {
|
||||
return {
|
||||
CallExpression(node) {
|
||||
const name = getCalleeName(node);
|
||||
if (name === null || !VERIFICATION_SETTERS.has(name)) return;
|
||||
const objArg = node.arguments[node.arguments.length - 1];
|
||||
if (objArg === undefined || objArg.type !== "ObjectExpression") return;
|
||||
const statusProp = objArg.properties.find(
|
||||
(p) =>
|
||||
p.type === "Property" &&
|
||||
!p.computed &&
|
||||
p.key.type === "Identifier" &&
|
||||
p.key.name === "status",
|
||||
);
|
||||
if (statusProp === undefined) return;
|
||||
const value = statusProp.value;
|
||||
if (value.type !== "Literal" || typeof value.value !== "string") {
|
||||
context.report({ node: statusProp, messageId: "dynamicStatus" });
|
||||
}
|
||||
},
|
||||
};
|
||||
},
|
||||
};
|
||||
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
// Rule: no-identity-scope-fallback
|
||||
//
|
||||
// Invariant (CLAUDE.md): "Anything touching livekitE2EE.ts or identity.ts
|
||||
// must preserve the epoch/keypair staleness guards." (Identity-scoping
|
||||
// analogue: a documented, previously-real bug — see identity.ts's
|
||||
// `identityKeyPairCache` comment — where a missing user id fell back to a
|
||||
// placeholder scope like `?? 0`, silently minting/adopting a keypair under
|
||||
// the wrong account and permanently desyncing the published key from the
|
||||
// announce-signing key for every peer.)
|
||||
//
|
||||
// getOrCreateIdentityKeyPair's userId argument must come from a value that
|
||||
// was already checked for `undefined` (the pattern both call sites use), not
|
||||
// a `??`/`||` fallback that would substitute a placeholder id.
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
|
||||
const noIdentityScopeFallback = {
|
||||
meta: {
|
||||
type: "problem",
|
||||
docs: {
|
||||
description:
|
||||
"Disallow a ??/|| placeholder fallback as the userId argument to getOrCreateIdentityKeyPair. A " +
|
||||
"missing user id must abort (see the `userId === undefined` guards at both call sites), never " +
|
||||
"substitute a placeholder scope — that mints or adopts a keypair under the wrong account and " +
|
||||
"permanently desyncs the published key from the announce-signing key.",
|
||||
},
|
||||
schema: [],
|
||||
messages: {
|
||||
placeholderFallback:
|
||||
"Do not fall back with ??/|| when passing the user id to getOrCreateIdentityKeyPair — a missing " +
|
||||
"id must abort instead (check `=== undefined` and return, as both existing call sites do). A " +
|
||||
"placeholder id mints/adopts a keypair under the wrong account and desyncs it from the signing key.",
|
||||
},
|
||||
},
|
||||
create(context) {
|
||||
return {
|
||||
CallExpression(node) {
|
||||
if (
|
||||
node.callee.type !== "Identifier" ||
|
||||
node.callee.name !== "getOrCreateIdentityKeyPair"
|
||||
) {
|
||||
return;
|
||||
}
|
||||
const userIdArg = node.arguments[1];
|
||||
if (userIdArg === undefined) return;
|
||||
if (
|
||||
userIdArg.type === "LogicalExpression" &&
|
||||
(userIdArg.operator === "??" || userIdArg.operator === "||")
|
||||
) {
|
||||
context.report({ node: userIdArg, messageId: "placeholderFallback" });
|
||||
}
|
||||
},
|
||||
};
|
||||
},
|
||||
};
|
||||
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
// Rule: no-store-write-in-ws-on
|
||||
//
|
||||
// Invariant (CLAUDE.md): "src/lib/dispatcher.ts is the single WS-event entry
|
||||
// point: server events reach the stores only through a ws.on(...)
|
||||
// subscription registered there."
|
||||
//
|
||||
// Other modules DO register their own ws.on(...) handlers (page-local UI:
|
||||
// slow-mode timers, the connected overlay, incoming-call ringing) — that
|
||||
// itself is not the violation. What must never happen outside dispatcher.ts
|
||||
// is one of those handlers writing to a domain store directly, bypassing the
|
||||
// dispatcher. Store *reads* (`fooStore.getState()`) are unaffected; this only
|
||||
// flags calls to an imported store-mutator function (set/add/update/... from
|
||||
// a `*/stores/*` module) reached from inside a `ws.on(...)` callback.
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
|
||||
const STORE_MUTATOR_PREFIX =
|
||||
/^(set|add|remove|update|increment|clear|toggle|open|close|join|leave|mark|confirm|bulk|rollback|reset|prepend|reattach|invalidate|load)[A-Z_]/;
|
||||
|
||||
function isStoreModuleSource(source) {
|
||||
// Matches both the "@stores/..." alias and relative "../stores/..." paths.
|
||||
return typeof source === "string" && /(?:^|\/)@?stores\//.test(source);
|
||||
}
|
||||
|
||||
function isWsOnCall(node) {
|
||||
return (
|
||||
node !== null &&
|
||||
node !== undefined &&
|
||||
node.type === "CallExpression" &&
|
||||
node.callee.type === "MemberExpression" &&
|
||||
!node.callee.computed &&
|
||||
node.callee.object.type === "Identifier" &&
|
||||
node.callee.object.name === "ws" &&
|
||||
node.callee.property.type === "Identifier" &&
|
||||
node.callee.property.name === "on" &&
|
||||
node.arguments.length >= 2
|
||||
);
|
||||
}
|
||||
|
||||
const noStoreWriteInWsOn = {
|
||||
meta: {
|
||||
type: "problem",
|
||||
docs: {
|
||||
description:
|
||||
"Disallow calling an imported store-mutator (set*/add*/update*/... from a stores/ module) from " +
|
||||
"inside a ws.on(...) callback outside dispatcher.ts. dispatcher.ts is the single place server " +
|
||||
"events are allowed to write into domain stores; a page-local ws.on(...) handler may read store " +
|
||||
"state and drive its own local UI, but must not mutate a domain store itself.",
|
||||
},
|
||||
schema: [],
|
||||
messages: {
|
||||
storeWriteOutsideDispatcher:
|
||||
"'{{name}}' is a store mutator called from a ws.on(...) handler outside dispatcher.ts. " +
|
||||
"dispatcher.ts is the single WS-event entry point that may write to stores — move this update " +
|
||||
"into a dispatcher.ts handler for this message type, or have this handler read the store instead " +
|
||||
"of writing it.",
|
||||
},
|
||||
},
|
||||
create(context) {
|
||||
const storeMutatorImports = new Set();
|
||||
|
||||
return {
|
||||
ImportDeclaration(node) {
|
||||
if (!isStoreModuleSource(node.source.value)) return;
|
||||
for (const spec of node.specifiers) {
|
||||
if (spec.type === "ImportSpecifier" && STORE_MUTATOR_PREFIX.test(spec.local.name)) {
|
||||
storeMutatorImports.add(spec.local.name);
|
||||
}
|
||||
}
|
||||
},
|
||||
CallExpression(node) {
|
||||
if (node.callee.type !== "Identifier" || !storeMutatorImports.has(node.callee.name)) return;
|
||||
let parent = node.parent;
|
||||
while (parent) {
|
||||
if (
|
||||
isFunctionNode(parent) &&
|
||||
isWsOnCall(parent.parent) &&
|
||||
parent.parent.arguments[1] === parent
|
||||
) {
|
||||
context.report({
|
||||
node,
|
||||
messageId: "storeWriteOutsideDispatcher",
|
||||
data: { name: node.callee.name },
|
||||
});
|
||||
return;
|
||||
}
|
||||
parent = parent.parent;
|
||||
}
|
||||
},
|
||||
};
|
||||
},
|
||||
};
|
||||
|
||||
export default {
|
||||
rules: {
|
||||
"no-leave-voice-when-superseded": noLeaveVoiceWhenSuperseded,
|
||||
"e2ee-epoch-needs-keypair-check": e2eeEpochNeedsKeypairCheck,
|
||||
"e2ee-verified-status-literal": e2eeVerifiedStatusLiteral,
|
||||
"no-identity-scope-fallback": noIdentityScopeFallback,
|
||||
"no-store-write-in-ws-on": noStoreWriteInWsOn,
|
||||
},
|
||||
};
|
||||
@@ -1,5 +1,6 @@
|
||||
import eslint from "@eslint/js";
|
||||
import tseslint from "typescript-eslint";
|
||||
import localRules from "./eslint-rules.js";
|
||||
|
||||
export default tseslint.config(
|
||||
eslint.configs.recommended,
|
||||
@@ -32,10 +33,7 @@ export default tseslint.config(
|
||||
// Empty functions are used for no-op callbacks
|
||||
"@typescript-eslint/no-empty-function": "off",
|
||||
// Project uses void for fire-and-forget promises intentionally
|
||||
"@typescript-eslint/no-misused-promises": [
|
||||
"error",
|
||||
{ checksVoidReturn: false },
|
||||
],
|
||||
"@typescript-eslint/no-misused-promises": ["error", { checksVoidReturn: false }],
|
||||
// Allow require() in config files
|
||||
"@typescript-eslint/no-require-imports": "off",
|
||||
// Unbound methods used in singleton export pattern (bind at export)
|
||||
@@ -67,14 +65,43 @@ export default tseslint.config(
|
||||
"consistent-return": "off",
|
||||
},
|
||||
},
|
||||
// --- Local rules: three CLAUDE.md invariants enforced as lint rules ---
|
||||
// See eslint-rules.js for each rule's rationale and the historical bug
|
||||
// shape it catches. Each is scoped to only the module(s) its invariant
|
||||
// governs.
|
||||
{
|
||||
ignores: [
|
||||
"dist/",
|
||||
"src-tauri/",
|
||||
"node_modules/",
|
||||
"public/",
|
||||
"*.js",
|
||||
"*.cjs",
|
||||
],
|
||||
files: ["src/lib/livekitSession.ts"],
|
||||
plugins: { local: localRules },
|
||||
rules: {
|
||||
"local/no-leave-voice-when-superseded": "error",
|
||||
},
|
||||
},
|
||||
{
|
||||
files: ["src/lib/livekitE2EE.ts"],
|
||||
plugins: { local: localRules },
|
||||
rules: {
|
||||
"local/e2ee-epoch-needs-keypair-check": "error",
|
||||
"local/e2ee-verified-status-literal": "error",
|
||||
"local/no-identity-scope-fallback": "error",
|
||||
},
|
||||
},
|
||||
{
|
||||
files: ["src/lib/identity.ts"],
|
||||
plugins: { local: localRules },
|
||||
rules: {
|
||||
"local/no-identity-scope-fallback": "error",
|
||||
},
|
||||
},
|
||||
{
|
||||
// dispatcher.ts IS the allowed entry point, so it is exempt from its own rule.
|
||||
files: ["src/**/*.ts"],
|
||||
ignores: ["src/lib/dispatcher.ts"],
|
||||
plugins: { local: localRules },
|
||||
rules: {
|
||||
"local/no-store-write-in-ws-on": "error",
|
||||
},
|
||||
},
|
||||
{
|
||||
ignores: ["dist/", "src-tauri/", "node_modules/", "public/", "*.js", "*.cjs"],
|
||||
},
|
||||
);
|
||||
@@ -2,13 +2,7 @@
|
||||
"$schema": "https://unpkg.com/knip@6/schema.json",
|
||||
"entry": ["src/main.ts"],
|
||||
"project": ["src/**/*.ts"],
|
||||
"ignore": [
|
||||
"public/**",
|
||||
"src-tauri/**",
|
||||
"src/lib/protocolTypes.ts"
|
||||
],
|
||||
"ignoreDependencies": [
|
||||
"@tauri-apps/cli"
|
||||
],
|
||||
"ignore": ["public/**", "src-tauri/**", "src/lib/protocolTypes.ts"],
|
||||
"ignoreDependencies": ["@tauri-apps/cli"],
|
||||
"ignoreExportsUsedInFile": true
|
||||
}
|
||||
+1509
-1997
File diff suppressed because it is too large
Load Diff
@@ -1,8 +1,12 @@
|
||||
{
|
||||
"name": "owncord-client",
|
||||
"private": true,
|
||||
"version": "1.2.0-alpha.1",
|
||||
"version": "1.2.0-alpha.4",
|
||||
"type": "module",
|
||||
"engines": {
|
||||
"node": ">=24",
|
||||
"npm": ">=10"
|
||||
},
|
||||
"scripts": {
|
||||
"dev": "vite",
|
||||
"build": "tsc -p tsconfig.build.json && vite build",
|
||||
@@ -11,20 +15,21 @@
|
||||
"test": "vitest run",
|
||||
"test:unit": "vitest run tests/unit",
|
||||
"test:integration": "vitest run tests/integration",
|
||||
"test:contract": "vitest run tests/contract",
|
||||
"test:e2e": "playwright test",
|
||||
"test:e2e:prod": "npm run build && playwright test --config playwright.config.prod.ts",
|
||||
"test:e2e:native": "playwright test --config playwright.config.native.ts",
|
||||
"test:e2e:admin": "playwright test --config playwright.config.admin.ts",
|
||||
"test:e2e:ui": "playwright test --ui",
|
||||
"test:watch": "vitest",
|
||||
"test:coverage": "vitest run --coverage",
|
||||
"test:browser": "vitest run --config vitest.config.browser.ts",
|
||||
"typecheck": "tsc --noEmit",
|
||||
"typecheck:build": "tsc -p tsconfig.build.json --noEmit",
|
||||
"typecheck:e2e": "tsc -p tsconfig.e2e.json --noEmit",
|
||||
"lint": "oxlint src/ && eslint src/",
|
||||
"lint:fix": "eslint src/ --fix",
|
||||
"lint:ox": "oxlint src/",
|
||||
"format": "prettier --write \"src/**/*.ts\" \"tests/**/*.ts\"",
|
||||
"format:check": "prettier --check \"src/**/*.ts\" \"tests/**/*.ts\"",
|
||||
"knip": "knip",
|
||||
"test:mutate": "stryker run",
|
||||
"test:mutate:dry": "stryker run --dryRunOnly"
|
||||
@@ -32,32 +37,23 @@
|
||||
"devDependencies": {
|
||||
"@eslint/js": "^10.0.1",
|
||||
"@playwright/test": "^1",
|
||||
"@stryker-mutator/api": "^9.6.1",
|
||||
"@stryker-mutator/core": "^9.6.1",
|
||||
"@stryker-mutator/typescript-checker": "^9.6.1",
|
||||
"@stryker-mutator/vitest-runner": "^9.6.1",
|
||||
"@stryker-mutator/api": "^10.0.0",
|
||||
"@stryker-mutator/core": "^10.0.0",
|
||||
"@stryker-mutator/typescript-checker": "^10.0.0",
|
||||
"@stryker-mutator/vitest-runner": "^10.0.0",
|
||||
"@tauri-apps/cli": "^2",
|
||||
"@vitest/browser": "^3.2.4",
|
||||
"@vitest/coverage-v8": "^3",
|
||||
"eslint": "^10.8.0",
|
||||
"@types/node": "^24.13.3",
|
||||
"@vitest/browser-playwright": "^4.1.11",
|
||||
"@vitest/coverage-v8": "^4.1.11",
|
||||
"eslint": "^10.9.0",
|
||||
"fast-check": "^4.9.0",
|
||||
"jsdom": "^29.1.1",
|
||||
"knip": "^6.1.1",
|
||||
"oxlint": "^1.76.0",
|
||||
"prettier": "^3.9.6",
|
||||
"typescript": "^5.7",
|
||||
"typescript-eslint": "^8.65.0",
|
||||
"vite": "^6",
|
||||
"vitest": "^3"
|
||||
},
|
||||
"prettier": {
|
||||
"singleQuote": false,
|
||||
"semi": true,
|
||||
"trailingComma": "all",
|
||||
"printWidth": 100,
|
||||
"tabWidth": 2,
|
||||
"arrowParens": "always",
|
||||
"endOfLine": "lf"
|
||||
"jsdom": "^30.0.1",
|
||||
"knip": "^6.32.2",
|
||||
"oxlint": "^1.79.0",
|
||||
"typescript": "^6.0.3",
|
||||
"typescript-eslint": "^8.67.0",
|
||||
"vite": "^8.2.2",
|
||||
"vitest": "^4.1.11"
|
||||
},
|
||||
"dependencies": {
|
||||
"@jitsi/rnnoise-wasm": "^0.2.1",
|
||||
@@ -70,7 +66,7 @@
|
||||
"@tauri-apps/plugin-notification": "^2",
|
||||
"@tauri-apps/plugin-opener": "^2.5.3",
|
||||
"@tauri-apps/plugin-process": "^2.3.1",
|
||||
"livekit-client": "^2.21.0"
|
||||
"livekit-client": "^2.22.0"
|
||||
},
|
||||
"overrides": {
|
||||
"qs": "^6.15.3",
|
||||
@@ -0,0 +1,45 @@
|
||||
import { defineConfig } from "@playwright/test";
|
||||
|
||||
/**
|
||||
* Playwright config for the ADMIN PANEL e2e suite — the server-embedded SPA
|
||||
* (Server/admin/static/index.html), driven against a REAL server started by
|
||||
* tests/e2e/admin/start-server.sh (fresh temp data dir, TLS off, loopback).
|
||||
*
|
||||
* Unlike the mocked-Tauri web suite this exercises the true stack: chi
|
||||
* router, admin middleware/gates, SQLite, and the SPA itself. The journey is
|
||||
* stateful by design (first-run wizard creates the owner the later tests log
|
||||
* in as), so it runs serially in one worker against one server instance.
|
||||
*
|
||||
* Usage: npm run test:e2e:admin (requires the Go toolchain)
|
||||
*/
|
||||
const PORT = process.env.OWNCORD_ADMIN_E2E_PORT ?? "18446";
|
||||
|
||||
export default defineConfig({
|
||||
testDir: "./tests/e2e/admin",
|
||||
timeout: 30_000,
|
||||
expect: { timeout: 5_000 },
|
||||
fullyParallel: false,
|
||||
workers: 1,
|
||||
retries: process.env.CI ? 2 : 1,
|
||||
reporter: process.env.CI
|
||||
? [
|
||||
["html", { open: "never" }],
|
||||
["junit", { outputFile: "test-results/admin-junit.xml" }],
|
||||
]
|
||||
: "html",
|
||||
|
||||
use: {
|
||||
baseURL: `http://127.0.0.1:${PORT}`,
|
||||
screenshot: "only-on-failure",
|
||||
trace: "on-first-retry",
|
||||
contextOptions: { reducedMotion: "reduce" },
|
||||
},
|
||||
|
||||
webServer: {
|
||||
command: "bash tests/e2e/admin/start-server.sh",
|
||||
url: `http://127.0.0.1:${PORT}/health`,
|
||||
reuseExistingServer: !process.env.CI,
|
||||
// First run compiles the Go server; CI cold caches need the headroom.
|
||||
timeout: 240_000,
|
||||
},
|
||||
});
|
||||
+7
-1
@@ -36,7 +36,10 @@ export default defineConfig({
|
||||
workers: 1,
|
||||
retries: 2,
|
||||
reporter: process.env.CI
|
||||
? [["html", { open: "never" }], ["junit", { outputFile: "test-results/native-junit.xml" }]]
|
||||
? [
|
||||
["html", { open: "never" }],
|
||||
["junit", { outputFile: "test-results/native-junit.xml" }],
|
||||
]
|
||||
: "html",
|
||||
|
||||
use: {
|
||||
@@ -60,7 +63,10 @@ export default defineConfig({
|
||||
"app-layout.spec.ts",
|
||||
"channel-navigation.spec.ts",
|
||||
"chat-operations.spec.ts",
|
||||
"dm-system.spec.ts",
|
||||
"reconnection.spec.ts",
|
||||
"settings-overlay.spec.ts",
|
||||
"theme-persistence.spec.ts",
|
||||
"voice-controls.spec.ts",
|
||||
"overlays.spec.ts",
|
||||
],
|
||||
@@ -9,7 +9,7 @@ import { defineConfig, devices } from "@playwright/test";
|
||||
*/
|
||||
export default defineConfig({
|
||||
testDir: "./tests/e2e",
|
||||
testIgnore: ["**/native/**"],
|
||||
testIgnore: ["**/native/**", "**/admin/**"],
|
||||
timeout: 30_000,
|
||||
expect: {
|
||||
timeout: 5_000,
|
||||
@@ -19,7 +19,10 @@ export default defineConfig({
|
||||
retries: process.env.CI ? 2 : 1,
|
||||
workers: process.env.CI ? 1 : undefined,
|
||||
reporter: process.env.CI
|
||||
? [["html", { open: "never" }], ["junit", { outputFile: "test-results/junit.xml" }]]
|
||||
? [
|
||||
["html", { open: "never" }],
|
||||
["junit", { outputFile: "test-results/junit.xml" }],
|
||||
]
|
||||
: "html",
|
||||
|
||||
use: {
|
||||
@@ -40,7 +43,10 @@ export default defineConfig({
|
||||
],
|
||||
|
||||
webServer: {
|
||||
command: "npm run preview",
|
||||
// Spawn Vite directly rather than through npm — see the note in
|
||||
// playwright.config.ts: an `npm run` wrapper leaves vite alive as an
|
||||
// orphaned grandchild on teardown and the runner never exits.
|
||||
command: "npx vite preview",
|
||||
url: "http://localhost:4173",
|
||||
reuseExistingServer: !process.env.CI,
|
||||
timeout: 60_000,
|
||||
@@ -2,7 +2,7 @@ import { defineConfig, devices } from "@playwright/test";
|
||||
|
||||
export default defineConfig({
|
||||
testDir: "./tests/e2e",
|
||||
testIgnore: ["**/native/**"],
|
||||
testIgnore: ["**/native/**", "**/admin/**"],
|
||||
timeout: 30_000,
|
||||
expect: {
|
||||
timeout: 5_000,
|
||||
@@ -43,8 +43,16 @@ export default defineConfig({
|
||||
},
|
||||
],
|
||||
|
||||
// Kills the dev server the runner cannot kill itself; without it the suite
|
||||
// passes and then hangs forever. See tests/e2e/global-teardown.ts.
|
||||
globalTeardown: "./tests/e2e/global-teardown.ts",
|
||||
|
||||
webServer: {
|
||||
command: "npm run dev",
|
||||
// Run Vite's entry point directly so the listening process IS Playwright's
|
||||
// child — globalTeardown kills the listener, which only releases the
|
||||
// runner's ChildProcess handle if that listener is the child itself. Going
|
||||
// through `npm run dev` would leave the npm process holding it open.
|
||||
command: "node node_modules/vite/bin/vite.js",
|
||||
url: "http://localhost:1420",
|
||||
reuseExistingServer: !process.env.CI,
|
||||
timeout: 60_000,
|
||||
@@ -70,12 +70,18 @@ class RNNoiseProcessor extends AudioWorkletProcessor {
|
||||
try {
|
||||
// Basic validation: check for expected exports
|
||||
const module = await WebAssembly.compile(wasmBytes);
|
||||
const expectedExports = ['rnnoise_create', 'rnnoise_destroy', 'rnnoise_process_frame', 'malloc', 'free'];
|
||||
const availableExports = WebAssembly.Module.exports(module).map(exp => exp.name);
|
||||
|
||||
const hasRequiredExports = expectedExports.every(exp => availableExports.includes(exp));
|
||||
const expectedExports = [
|
||||
"rnnoise_create",
|
||||
"rnnoise_destroy",
|
||||
"rnnoise_process_frame",
|
||||
"malloc",
|
||||
"free",
|
||||
];
|
||||
const availableExports = WebAssembly.Module.exports(module).map((exp) => exp.name);
|
||||
|
||||
const hasRequiredExports = expectedExports.every((exp) => availableExports.includes(exp));
|
||||
if (!hasRequiredExports) {
|
||||
throw new Error('WASM module missing required RNNoise exports');
|
||||
throw new Error("WASM module missing required RNNoise exports");
|
||||
}
|
||||
|
||||
const memory = new WebAssembly.Memory({ initial: WASM_MEMORY_INITIAL_PAGES });
|
||||
@@ -118,10 +124,13 @@ class RNNoiseProcessor extends AudioWorkletProcessor {
|
||||
if (this._state) exports.rnnoise_destroy(this._state);
|
||||
} catch (cleanupErr) {
|
||||
// Log cleanup errors but don't override original error
|
||||
console.warn('Failed to cleanup WASM memory:', cleanupErr);
|
||||
console.warn("Failed to cleanup WASM memory:", cleanupErr);
|
||||
}
|
||||
}
|
||||
this._reportError(`WASM initialization failed: ${err instanceof Error ? err.message : String(err)}`, err);
|
||||
this._reportError(
|
||||
`WASM initialization failed: ${err instanceof Error ? err.message : String(err)}`,
|
||||
err,
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -137,11 +146,10 @@ class RNNoiseProcessor extends AudioWorkletProcessor {
|
||||
|
||||
const inOff = this._inputPtr / 4;
|
||||
const outOff = this._outputPtr / 4;
|
||||
|
||||
|
||||
// CRITICAL: Bounds check before accessing heap
|
||||
if (inOff + FRAME_SIZE > this._heapF32.length ||
|
||||
outOff + FRAME_SIZE > this._heapF32.length) {
|
||||
console.error('WASM heap bounds exceeded');
|
||||
if (inOff + FRAME_SIZE > this._heapF32.length || outOff + FRAME_SIZE > this._heapF32.length) {
|
||||
console.error("WASM heap bounds exceeded");
|
||||
return;
|
||||
}
|
||||
|
||||
@@ -179,7 +187,7 @@ class RNNoiseProcessor extends AudioWorkletProcessor {
|
||||
exports.free(this._inputPtr);
|
||||
exports.free(this._outputPtr);
|
||||
} catch (err) {
|
||||
console.warn('RNNoise cleanup failed:', err);
|
||||
console.warn("RNNoise cleanup failed:", err);
|
||||
// Continue cleanup even if individual steps fail
|
||||
}
|
||||
}
|
||||
@@ -220,7 +228,13 @@ class RNNoiseProcessor extends AudioWorkletProcessor {
|
||||
const readStart = this._outReadPos * FRAME_SIZE;
|
||||
const available = FRAME_SIZE - this._outSampleOffset;
|
||||
const toWrite = Math.min(available, outData.length - outIdx);
|
||||
outData.set(this._outBuffer.subarray(readStart + this._outSampleOffset, readStart + this._outSampleOffset + toWrite), outIdx);
|
||||
outData.set(
|
||||
this._outBuffer.subarray(
|
||||
readStart + this._outSampleOffset,
|
||||
readStart + this._outSampleOffset + toWrite,
|
||||
),
|
||||
outIdx,
|
||||
);
|
||||
outIdx += toWrite;
|
||||
this._outSampleOffset += toWrite;
|
||||
if (this._outSampleOffset >= FRAME_SIZE) {
|
||||
@@ -243,10 +257,9 @@ class RNNoiseProcessor extends AudioWorkletProcessor {
|
||||
*/
|
||||
process(inputs, outputs) {
|
||||
if (this._destroyed) return false;
|
||||
|
||||
|
||||
// Validate input/output structure
|
||||
if (!inputs || !inputs[0] || !inputs[0][0] ||
|
||||
!outputs || !outputs[0] || !outputs[0][0]) {
|
||||
if (!inputs || !inputs[0] || !inputs[0][0] || !outputs || !outputs[0] || !outputs[0][0]) {
|
||||
return true; // Pass through silence or existing data
|
||||
}
|
||||
|
||||
@@ -16,15 +16,20 @@ class VadProcessor extends AudioWorkletProcessor {
|
||||
constructor() {
|
||||
super();
|
||||
this._threshold = 0.05;
|
||||
this._gateOnFrames = 12; // ~200ms of silence before gating
|
||||
this._gateOffFrames = 2; // ~33ms of speech before ungating
|
||||
// process() runs once per 128-sample render quantum (2.667ms @ 48kHz —
|
||||
// see audioPipeline.ts's `new AudioContext({ sampleRate: 48000 })`), NOT
|
||||
// once per ~16ms poll like the setTimeout fallback. These frame counts
|
||||
// are therefore ~6x the fallback's, so both paths gate on the same
|
||||
// wall-clock timing.
|
||||
this._gateOnFrames = 75; // ~200ms of silence before gating
|
||||
this._gateOffFrames = 12; // ~32ms of speech before ungating
|
||||
this._silentFrames = 0;
|
||||
this._speechFrames = 0;
|
||||
this._gated = false;
|
||||
this._active = true;
|
||||
this._startupFrames = 0;
|
||||
this._startupGrace = 30; // ~500ms grace period
|
||||
this._frameCounter = 0; // for throttled RMS updates
|
||||
this._startupGrace = 188; // ~500ms grace period
|
||||
this._frameCounter = 0; // for throttled RMS updates
|
||||
|
||||
this.port.onmessage = (event) => {
|
||||
if (event.data.type === "config") {
|
||||
@@ -65,10 +70,10 @@ class VadProcessor extends AudioWorkletProcessor {
|
||||
return true;
|
||||
}
|
||||
|
||||
// Send RMS value to main thread every ~6 frames (~50ms at 128 samples/frame @ 48kHz)
|
||||
// Send RMS value to main thread every ~19 frames (~50ms at 128 samples/frame @ 48kHz)
|
||||
// This is used for the VAD indicator bar in the UI
|
||||
this._frameCounter++;
|
||||
if (this._frameCounter >= 6) {
|
||||
if (this._frameCounter >= 19) {
|
||||
this._frameCounter = 0;
|
||||
this.port.postMessage({ type: "rms", value: rms });
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
[advisories]
|
||||
ignore = [
|
||||
# quick-xml 0.37 is pinned by tauri-winrt-notification 0.7 (via
|
||||
# tauri-plugin-notification -> notify-rust); no semver-compatible route
|
||||
# to the fixed 0.41 exists yet. It only parses toast-notification XML
|
||||
# templates the library itself constructs — never attacker-controlled
|
||||
# input — so these parser-DoS advisories are not reachable here.
|
||||
# Drop both entries when the notification chain moves to quick-xml >= 0.41.
|
||||
"RUSTSEC-2026-0194",
|
||||
"RUSTSEC-2026-0195",
|
||||
|
||||
# glib 0.18.5 is pinned by the whole Linux GTK stack: wry (even 0.56)
|
||||
# requires `webkit2gtk =2.0.2`, which requires `glib ^0.18.0`. The fix
|
||||
# landed in glib 0.20.0 and was never backported (0.18.5 is the last 0.18
|
||||
# release; 0.19.x is still in range), so no semver-compatible route exists.
|
||||
# The unsoundness is only reachable through `Variant::array_iter_str()` —
|
||||
# nothing in the dependency tree or in src-tauri/src/ calls it, and the
|
||||
# crate is Linux-only here (see the cfg(target_os = "linux") block in
|
||||
# Cargo.toml). Drop this entry when webkit2gtk moves to gtk-rs 0.20.
|
||||
"RUSTSEC-2024-0429",
|
||||
|
||||
# rand 0.7.3 arrives only as a BUILD dependency, three levels down:
|
||||
# tauri-utils -> kuchikiki 0.8.8-speedreader -> selectors 0.24.0, whose
|
||||
# build.rs uses phf_codegen -> phf_generator 0.8.0 (which requires
|
||||
# rand ^0.7). It runs at codegen time and never links into a shipped
|
||||
# binary. The advisory needs `ThreadRng` reseeding under a custom logger
|
||||
# with rand's `log` feature on; phf_generator instead uses a fixed-seed
|
||||
# `SmallRng::seed_from_u64(1234567890)` and never enables `log` — and no
|
||||
# other crate here depends on rand 0.7, so feature unification cannot
|
||||
# turn it on. Not upgradable: kuchikiki 0.8.9-speedreader would drop this
|
||||
# chain, but cargo will not match a pre-release across patch versions
|
||||
# (`^0.8.8-speedreader` rejects 0.8.9-speedreader) and tauri-utils 2.9.3
|
||||
# is the latest release. Drop this entry when tauri-utils bumps kuchikiki.
|
||||
"RUSTSEC-2026-0097",
|
||||
]
|
||||
+784
-1520
File diff suppressed because it is too large
Load Diff
@@ -1,6 +1,6 @@
|
||||
[package]
|
||||
name = "owncord-client"
|
||||
version = "1.2.0-alpha.1"
|
||||
version = "1.2.0-alpha.4"
|
||||
edition = "2021"
|
||||
# Effective minimum: tauri 2.11 declares rust-version = "1.77.2", so the crate
|
||||
# cannot build below it. Declaring it here enables Cargo's MSRV-aware resolver
|
||||
@@ -21,7 +21,6 @@ crate-type = ["lib", "cdylib", "staticlib"]
|
||||
|
||||
[build-dependencies]
|
||||
tauri-build = { version = "2", features = [] }
|
||||
tauri-typegen = "0.5"
|
||||
|
||||
[features]
|
||||
default = []
|
||||
@@ -48,7 +47,7 @@ tauri-plugin-fs = "2"
|
||||
tauri-plugin-updater = "2.10"
|
||||
tauri-plugin-process = "2"
|
||||
url = "2"
|
||||
tokio-tungstenite = { version = "0.28.0", features = ["rustls-tls-webpki-roots"] }
|
||||
tokio-tungstenite = { version = "0.30.0", features = ["rustls-tls-webpki-roots"] }
|
||||
futures-util = "0.3.32"
|
||||
tokio = { version = "1", features = ["sync", "net", "io-util", "rt", "macros"] }
|
||||
tokio-rustls = { version = "0.26", default-features = false }
|
||||
@@ -94,6 +93,14 @@ zeroize = "1"
|
||||
# Encodes the DPAPI ciphertext for the JSON fallback store. Already in the tree
|
||||
# via the tauri/rustls stack, so this costs no extra build.
|
||||
base64 = "0.22"
|
||||
# Native message box for the fatal-startup path in lib.rs, where the Tauri app
|
||||
# never built and tauri-plugin-dialog has no AppHandle to run through. Already
|
||||
# in the tree via that same plugin, so this costs no extra build -- but only
|
||||
# while the versions match: the plugin pins ^0.16, and Cargo unifies features
|
||||
# only within a semver-compatible group. Moving this to 0.17 forks rfd into two
|
||||
# crates, and the copy without the plugin's backend features fails rfd 0.17's
|
||||
# build.rs on Linux. Pinned to the plugin in .github/dependabot.yml; bump both
|
||||
# together or neither.
|
||||
rfd = { version = "0.16", default-features = false }
|
||||
|
||||
# Desktop-only plugins (no mobile bundle target). single-instance carries the
|
||||
+2
-3
@@ -1,9 +1,7 @@
|
||||
{
|
||||
"identifier": "default",
|
||||
"description": "Default capability granting core permissions to the main window. NOTE: http:allow-fetch is the ONLY URL-scoped HTTP identifier — tauri-plugin-http validates the URL once, in the `fetch` command; `fetch_send` and `fetch_read_body` take an already-validated ResourceId and never consult a scope, so allow/deny blocks on those identifiers are inert. Do not re-add them.",
|
||||
"windows": [
|
||||
"main"
|
||||
],
|
||||
"windows": ["main"],
|
||||
"permissions": [
|
||||
"core:default",
|
||||
"core:event:default",
|
||||
@@ -21,6 +19,7 @@
|
||||
"core:window:allow-outer-size",
|
||||
"core:window:allow-available-monitors",
|
||||
"core:window:allow-center",
|
||||
"core:window:allow-request-user-attention",
|
||||
"notification:default",
|
||||
"notification:allow-notify",
|
||||
"notification:allow-request-permission",
|
||||
|
Before Width: | Height: | Size: 12 KiB After Width: | Height: | Size: 12 KiB |
|
Before Width: | Height: | Size: 35 KiB After Width: | Height: | Size: 35 KiB |
|
Before Width: | Height: | Size: 1.5 KiB After Width: | Height: | Size: 1.5 KiB |
|
Before Width: | Height: | Size: 57 KiB After Width: | Height: | Size: 57 KiB |
|
Before Width: | Height: | Size: 35 KiB After Width: | Height: | Size: 35 KiB |
|
Before Width: | Height: | Size: 1004 B After Width: | Height: | Size: 1004 B |
@@ -2,6 +2,7 @@ use serde_json::Value;
|
||||
use tauri_plugin_store::StoreExt;
|
||||
|
||||
use crate::constants::{CERTS_STORE, IDENTITY_PINS_STORE, SETTINGS_STORE};
|
||||
use crate::ws_proxy::is_valid_cert_fingerprint;
|
||||
|
||||
/// Maximum length for a settings key to prevent denial-of-service.
|
||||
const MAX_SETTINGS_KEY_LEN: usize = 128;
|
||||
@@ -9,13 +10,11 @@ const MAX_SETTINGS_KEY_LEN: usize = 128;
|
||||
/// Allowed key prefixes and exact keys for the settings store.
|
||||
/// Keys must either match an exact entry or start with an allowed prefix.
|
||||
const ALLOWED_SETTINGS_PREFIXES: &[&str] = &[
|
||||
"owncord:", // owncord:profiles, owncord:settings:*, owncord:recent-emoji
|
||||
"userVolume_", // per-user volume: userVolume_{userId}
|
||||
"owncord:", // owncord:profiles, owncord:settings:*, owncord:recent-emoji
|
||||
"userVolume_", // per-user volume: userVolume_{userId}
|
||||
];
|
||||
|
||||
const ALLOWED_SETTINGS_EXACT: &[&str] = &[
|
||||
"windowState",
|
||||
];
|
||||
const ALLOWED_SETTINGS_EXACT: &[&str] = &["windowState"];
|
||||
|
||||
fn is_settings_key_allowed(key: &str) -> bool {
|
||||
if key.len() > MAX_SETTINGS_KEY_LEN || key.is_empty() {
|
||||
@@ -24,7 +23,9 @@ fn is_settings_key_allowed(key: &str) -> bool {
|
||||
if ALLOWED_SETTINGS_EXACT.contains(&key) {
|
||||
return true;
|
||||
}
|
||||
ALLOWED_SETTINGS_PREFIXES.iter().any(|prefix| key.starts_with(prefix))
|
||||
ALLOWED_SETTINGS_PREFIXES
|
||||
.iter()
|
||||
.any(|prefix| key.starts_with(prefix))
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
@@ -60,9 +61,12 @@ pub fn save_settings(app: tauri::AppHandle, key: String, value: Value) -> Result
|
||||
return Err(format!("unknown settings key: {key}"));
|
||||
}
|
||||
|
||||
let store = app
|
||||
.store(SETTINGS_STORE)
|
||||
.map_err(|e| log_cmd_err("save_settings", format!("failed to open settings store: {e}")))?;
|
||||
let store = app.store(SETTINGS_STORE).map_err(|e| {
|
||||
log_cmd_err(
|
||||
"save_settings",
|
||||
format!("failed to open settings store: {e}"),
|
||||
)
|
||||
})?;
|
||||
|
||||
store.set(&key, value);
|
||||
store
|
||||
@@ -75,6 +79,33 @@ pub fn save_settings(app: tauri::AppHandle, key: String, value: Value) -> Result
|
||||
// Certificate fingerprint commands
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
/// Validate the arguments of a cert-pin write.
|
||||
///
|
||||
/// Split out of `store_cert_fingerprint` so the guard — the only thing standing
|
||||
/// between a caller and a trusted cert pin — is reachable from unit tests
|
||||
/// without a Tauri runtime. The fingerprint half is the same check the
|
||||
/// `accept_cert_fingerprint` path uses, so the two pin writers cannot drift.
|
||||
fn validate_cert_pin(host: &str, fingerprint: &str) -> Result<(), String> {
|
||||
if host.is_empty() || host.len() > 253 {
|
||||
return Err("host must be 1-253 characters".into());
|
||||
}
|
||||
// Validate host format: alphanumeric, dots, hyphens, colons (port), brackets (IPv6)
|
||||
if !host
|
||||
.chars()
|
||||
.all(|c| c.is_ascii_alphanumeric() || matches!(c, '.' | '-' | ':' | '[' | ']'))
|
||||
{
|
||||
return Err("host contains invalid characters".into());
|
||||
}
|
||||
if fingerprint.is_empty() {
|
||||
return Err("fingerprint must not be empty".into());
|
||||
}
|
||||
// SHA-256 colon-hex format: "aa:bb:cc:..." (95 chars, 32 hex pairs)
|
||||
if !is_valid_cert_fingerprint(fingerprint) {
|
||||
return Err("fingerprint must be a SHA-256 colon-hex string (95 chars)".into());
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
#[tauri::command]
|
||||
pub fn store_cert_fingerprint(
|
||||
app: tauri::AppHandle,
|
||||
@@ -84,33 +115,13 @@ pub fn store_cert_fingerprint(
|
||||
// Normalize to lowercase for consistent comparison with ws_proxy fingerprints
|
||||
let fingerprint = fingerprint.to_lowercase();
|
||||
|
||||
if host.is_empty() || host.len() > 253 {
|
||||
return Err("host must be 1-253 characters".into());
|
||||
}
|
||||
// Validate host format: alphanumeric, dots, hyphens, colons (port), brackets (IPv6)
|
||||
if !host.chars().all(|c| c.is_ascii_alphanumeric() || matches!(c, '.' | '-' | ':' | '[' | ']')) {
|
||||
return Err("host contains invalid characters".into());
|
||||
}
|
||||
if fingerprint.is_empty() {
|
||||
return Err("fingerprint must not be empty".into());
|
||||
}
|
||||
|
||||
// Validate SHA-256 colon-hex format: "aa:bb:cc:..." (95 chars, 32 hex pairs)
|
||||
if fingerprint.len() != 95 {
|
||||
return Err("fingerprint must be a SHA-256 colon-hex string (95 chars)".into());
|
||||
}
|
||||
for (i, ch) in fingerprint.chars().enumerate() {
|
||||
if i % 3 == 2 {
|
||||
if ch != ':' {
|
||||
return Err("fingerprint must use colon-separated hex pairs".into());
|
||||
}
|
||||
} else if !ch.is_ascii_hexdigit() {
|
||||
return Err("fingerprint contains invalid hex character".into());
|
||||
}
|
||||
}
|
||||
validate_cert_pin(&host, &fingerprint)?;
|
||||
|
||||
let store = app.store(CERTS_STORE).map_err(|e| {
|
||||
log_cmd_err("store_cert_fingerprint", format!("failed to open certs store: {e}"))
|
||||
log_cmd_err(
|
||||
"store_cert_fingerprint",
|
||||
format!("failed to open certs store: {e}"),
|
||||
)
|
||||
})?;
|
||||
|
||||
// Capture old value before mutating so we can restore it if save fails.
|
||||
@@ -121,8 +132,12 @@ pub fn store_cert_fingerprint(
|
||||
// existed, or delete if there was none. Without this, a failed save
|
||||
// during cert rotation would silently lose the previously trusted cert.
|
||||
match old_value {
|
||||
Some(v) => { store.set(&host, v); }
|
||||
None => { let _ = store.delete(&host); }
|
||||
Some(v) => {
|
||||
store.set(&host, v);
|
||||
}
|
||||
None => {
|
||||
let _ = store.delete(&host);
|
||||
}
|
||||
}
|
||||
return Err(log_cmd_err(
|
||||
"store_cert_fingerprint",
|
||||
@@ -133,10 +148,7 @@ pub fn store_cert_fingerprint(
|
||||
}
|
||||
|
||||
#[tauri::command]
|
||||
pub fn get_cert_fingerprint(
|
||||
app: tauri::AppHandle,
|
||||
host: String,
|
||||
) -> Result<Option<String>, String> {
|
||||
pub fn get_cert_fingerprint(app: tauri::AppHandle, host: String) -> Result<Option<String>, String> {
|
||||
if host.is_empty() {
|
||||
return Err("host must not be empty".into());
|
||||
}
|
||||
@@ -186,13 +198,19 @@ pub fn store_identity_pin(
|
||||
return Err("host must be 1-253 characters".into());
|
||||
}
|
||||
// Validate host format: alphanumeric, dots, hyphens, colons (port), brackets (IPv6)
|
||||
if !host.chars().all(|c| c.is_ascii_alphanumeric() || matches!(c, '.' | '-' | ':' | '[' | ']')) {
|
||||
if !host
|
||||
.chars()
|
||||
.all(|c| c.is_ascii_alphanumeric() || matches!(c, '.' | '-' | ':' | '[' | ']'))
|
||||
{
|
||||
return Err("host contains invalid characters".into());
|
||||
}
|
||||
if user_id.is_empty() || user_id.len() > 64 {
|
||||
return Err("user_id must be 1-64 characters".into());
|
||||
}
|
||||
if !user_id.chars().all(|c| c.is_ascii_alphanumeric() || matches!(c, '-' | '_')) {
|
||||
if !user_id
|
||||
.chars()
|
||||
.all(|c| c.is_ascii_alphanumeric() || matches!(c, '-' | '_'))
|
||||
{
|
||||
return Err("user_id contains invalid characters".into());
|
||||
}
|
||||
if pin.is_empty() || pin.len() > MAX_IDENTITY_PIN_LEN {
|
||||
@@ -200,7 +218,10 @@ pub fn store_identity_pin(
|
||||
}
|
||||
// Base64 charset (standard + url-safe + padding). Guards against garbage/DoS;
|
||||
// the actual key parsing/verification happens on the JS side.
|
||||
if !pin.chars().all(|c| c.is_ascii_alphanumeric() || matches!(c, '+' | '/' | '=' | '-' | '_')) {
|
||||
if !pin
|
||||
.chars()
|
||||
.all(|c| c.is_ascii_alphanumeric() || matches!(c, '+' | '/' | '=' | '-' | '_'))
|
||||
{
|
||||
return Err("pin contains invalid characters".into());
|
||||
}
|
||||
|
||||
@@ -216,8 +237,12 @@ pub fn store_identity_pin(
|
||||
// Restore previous in-memory state so a failed save during a re-pin
|
||||
// doesn't silently drop the previously trusted identity key.
|
||||
match old_value {
|
||||
Some(v) => { store.set(&store_key, v); }
|
||||
None => { let _ = store.delete(&store_key); }
|
||||
Some(v) => {
|
||||
store.set(&store_key, v);
|
||||
}
|
||||
None => {
|
||||
let _ = store.delete(&store_key);
|
||||
}
|
||||
}
|
||||
return Err(format!("failed to persist identity pin: {e}"));
|
||||
}
|
||||
@@ -311,29 +336,74 @@ mod tests {
|
||||
assert!(!is_settings_key_allowed("owncordNOCOLON"));
|
||||
}
|
||||
|
||||
/// A well-formed SHA-256 colon-hex fingerprint (32 pairs, 95 chars).
|
||||
const VALID_FP: &str =
|
||||
"aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99";
|
||||
|
||||
#[test]
|
||||
fn fingerprint_validation_accepts_valid() {
|
||||
let valid = "aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99";
|
||||
assert_eq!(valid.len(), 95);
|
||||
// Validation logic: length 95, hex digits at non-colon positions, colons at every 3rd
|
||||
for (i, ch) in valid.chars().enumerate() {
|
||||
if i % 3 == 2 {
|
||||
assert_eq!(ch, ':');
|
||||
} else {
|
||||
assert!(ch.is_ascii_hexdigit());
|
||||
}
|
||||
fn cert_pin_accepts_well_formed_args() {
|
||||
assert!(validate_cert_pin("chat.example.com", VALID_FP).is_ok());
|
||||
// Uppercase hex is accepted (the command lowercases before validating).
|
||||
assert!(validate_cert_pin("chat.example.com", &VALID_FP.to_uppercase()).is_ok());
|
||||
// Host with a port, and a bracketed IPv6 literal.
|
||||
assert!(validate_cert_pin("192.168.1.10:8443", VALID_FP).is_ok());
|
||||
assert!(validate_cert_pin("[fe80::1]:8443", VALID_FP).is_ok());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn cert_pin_rejects_malformed_fingerprints() {
|
||||
// Same length and charset, colon one position off.
|
||||
let mut misplaced_colon = VALID_FP.to_owned();
|
||||
misplaced_colon.replace_range(2..4, "a:");
|
||||
// Still 95 chars, but padded with whitespace instead of hex.
|
||||
let leading_space = format!(" {}", &VALID_FP[..94]);
|
||||
let trailing_space = format!("{} ", &VALID_FP[1..]);
|
||||
|
||||
let cases: &[(&str, &str)] = &[
|
||||
("empty", ""),
|
||||
("too short", &VALID_FP[..92]),
|
||||
("too long", "aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99:00"),
|
||||
("non-hex digit", "zz:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99"),
|
||||
("dash separator", "aa-bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99"),
|
||||
("misplaced colon", &misplaced_colon),
|
||||
("leading space", &leading_space),
|
||||
("trailing space", &trailing_space),
|
||||
];
|
||||
for (name, fp) in cases {
|
||||
assert!(
|
||||
validate_cert_pin("chat.example.com", fp).is_err(),
|
||||
"expected {name} fingerprint to be rejected: {fp:?}"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn fingerprint_validation_rejects_wrong_length() {
|
||||
let short = "aa:bb:cc";
|
||||
assert_ne!(short.len(), 95);
|
||||
fn cert_pin_rejects_malformed_hosts() {
|
||||
let cases: &[(&str, String)] = &[
|
||||
("empty", String::new()),
|
||||
("too long", "a".repeat(254)),
|
||||
("space", "chat example.com".into()),
|
||||
("path traversal", "chat.example.com/../evil".into()),
|
||||
("underscore", "chat_example.com".into()),
|
||||
("newline", "chat.example.com\n".into()),
|
||||
];
|
||||
for (name, host) in cases {
|
||||
assert!(
|
||||
validate_cert_pin(host, VALID_FP).is_err(),
|
||||
"expected {name} host to be rejected: {host:?}"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn identity_pin_key_combines_host_and_user() {
|
||||
assert_eq!(identity_pin_key("chat.example.com", "42"), "chat.example.com:42");
|
||||
assert_eq!(identity_pin_key("192.168.1.10:8443", "u_7"), "192.168.1.10:8443:u_7");
|
||||
assert_eq!(
|
||||
identity_pin_key("chat.example.com", "42"),
|
||||
"chat.example.com:42"
|
||||
);
|
||||
assert_eq!(
|
||||
identity_pin_key("192.168.1.10:8443", "u_7"),
|
||||
"192.168.1.10:8443:u_7"
|
||||
);
|
||||
}
|
||||
}
|
||||
+216
-81
@@ -1,4 +1,5 @@
|
||||
use serde::Serialize;
|
||||
use std::sync::Mutex;
|
||||
use tauri::AppHandle;
|
||||
|
||||
use crate::secret_store::{self, Backend};
|
||||
@@ -8,9 +9,9 @@ use crate::secret_store::{self, Backend};
|
||||
pub struct CredentialData {
|
||||
pub username: String,
|
||||
pub token: String,
|
||||
// Password is stored in the credential blob for re-authentication but
|
||||
// is never serialized back to the frontend over IPC to limit exposure.
|
||||
#[serde(skip)]
|
||||
// Password is stored in the credential blob for re-authentication and is
|
||||
// serialized back to the frontend over IPC so the login form can prefill
|
||||
// it when the user ticked "Remember password".
|
||||
pub password: Option<String>,
|
||||
}
|
||||
|
||||
@@ -53,6 +54,44 @@ fn require_non_empty(value: &str, field: &str) -> Result<(), String> {
|
||||
Ok(())
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Cross-command serialization
|
||||
// ---------------------------------------------------------------------------
|
||||
//
|
||||
// B4-3 moved every command below to `#[tauri::command(async)]` so the
|
||||
// blocking keyring/DPAPI I/O runs off Tauri's IPC main thread instead of
|
||||
// freezing the UI on it. Before that, Tauri ran all (sync) commands one at a
|
||||
// time on that thread, so two overlapping invocations were always fully
|
||||
// serialized in arrival order. `async` dispatches each invocation onto the
|
||||
// async runtime's thread pool instead, so two overlapping calls can now
|
||||
// genuinely run concurrently and interleave their OS credential-store
|
||||
// operations.
|
||||
//
|
||||
// That is reachable, not hypothetical: `identity.ts`'s legacy-key migration
|
||||
// does a save-then-delete pair for two different accounts, and logging out
|
||||
// fires a fire-and-forget `delete_credential` for a host whose connect-page
|
||||
// auto-login can immediately issue `load_credential` for the very same host.
|
||||
// Nothing upstream awaits the delete before the read can start.
|
||||
//
|
||||
// This mutex restores the "only one credential-store operation in flight at
|
||||
// a time" property that made ordering safe pre-`async`, without giving back
|
||||
// the perf win: it guards the whole command body (not just the raw OS call),
|
||||
// so the fallback file's read-modify-write in `secret_store::set_with` is
|
||||
// still atomic with respect to a concurrent read or delete for the same or a
|
||||
// different account.
|
||||
static CREDENTIAL_LOCK: Mutex<()> = Mutex::new(());
|
||||
|
||||
/// Run `f` with every other credential-store command excluded. Poisoning is
|
||||
/// recovered from (the guarded value is `()`, so there is nothing to
|
||||
/// distrust) rather than propagated, so a panic inside one command cannot
|
||||
/// permanently wedge every credential operation for the rest of the process.
|
||||
fn with_credential_lock<T>(f: impl FnOnce() -> T) -> T {
|
||||
let _guard = CREDENTIAL_LOCK
|
||||
.lock()
|
||||
.unwrap_or_else(|poisoned| poisoned.into_inner());
|
||||
f()
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Tauri commands
|
||||
// ---------------------------------------------------------------------------
|
||||
@@ -68,7 +107,7 @@ fn require_non_empty(value: &str, field: &str) -> Result<(), String> {
|
||||
/// On macOS it is stored in the system Keychain. The write is read back before
|
||||
/// this returns — see [`crate::secret_store`] for what happens when it does not
|
||||
/// come back.
|
||||
#[tauri::command]
|
||||
#[tauri::command(async)]
|
||||
pub fn save_credential(
|
||||
app: AppHandle,
|
||||
host: String,
|
||||
@@ -76,37 +115,41 @@ pub fn save_credential(
|
||||
token: String,
|
||||
password: Option<String>,
|
||||
) -> Result<(), String> {
|
||||
require_non_empty(&host, "host")?;
|
||||
require_non_empty(&token, "token")?;
|
||||
require_non_empty(&username, "username")?;
|
||||
with_credential_lock(|| {
|
||||
require_non_empty(&host, "host")?;
|
||||
require_non_empty(&token, "token")?;
|
||||
require_non_empty(&username, "username")?;
|
||||
|
||||
let mut payload = serde_json::json!({
|
||||
"username": username,
|
||||
"token": token,
|
||||
});
|
||||
if let Some(ref pw) = password {
|
||||
payload["password"] = serde_json::Value::String(pw.clone());
|
||||
}
|
||||
let mut payload = serde_json::json!({
|
||||
"username": username,
|
||||
"token": token,
|
||||
});
|
||||
if let Some(ref pw) = password {
|
||||
payload["password"] = serde_json::Value::String(pw.clone());
|
||||
}
|
||||
|
||||
secret_store::set(&app, &login_account(&host), &payload.to_string())
|
||||
.map_err(|e| format!("save_credential failed: {e}"))?;
|
||||
Ok(())
|
||||
secret_store::set(&app, &login_account(&host), &payload.to_string())
|
||||
.map_err(|e| format!("save_credential failed: {e}"))?;
|
||||
Ok(())
|
||||
})
|
||||
}
|
||||
|
||||
/// Load a credential from the system credential store.
|
||||
///
|
||||
/// Returns `None` when no credential exists for the given host.
|
||||
#[tauri::command]
|
||||
#[tauri::command(async)]
|
||||
pub fn load_credential(app: AppHandle, host: String) -> Result<Option<CredentialData>, String> {
|
||||
require_non_empty(&host, "host")?;
|
||||
with_credential_lock(|| {
|
||||
require_non_empty(&host, "host")?;
|
||||
|
||||
let Some(json_str) = secret_store::get(&app, &login_account(&host))
|
||||
.map_err(|e| format!("load_credential failed: {e}"))?
|
||||
else {
|
||||
return Ok(None);
|
||||
};
|
||||
let Some(json_str) = secret_store::get(&app, &login_account(&host))
|
||||
.map_err(|e| format!("load_credential failed: {e}"))?
|
||||
else {
|
||||
return Ok(None);
|
||||
};
|
||||
|
||||
parse_credential_blob(&json_str).map(Some)
|
||||
parse_credential_blob(&json_str).map(Some)
|
||||
})
|
||||
}
|
||||
|
||||
/// Parse the stored credential JSON blob.
|
||||
@@ -142,11 +185,13 @@ fn parse_credential_blob(json_str: &str) -> Result<CredentialData, String> {
|
||||
/// Delete a credential from the system credential store.
|
||||
///
|
||||
/// Deleting a non-existent credential is not treated as an error.
|
||||
#[tauri::command]
|
||||
#[tauri::command(async)]
|
||||
pub fn delete_credential(app: AppHandle, host: String) -> Result<(), String> {
|
||||
require_non_empty(&host, "host")?;
|
||||
secret_store::delete(&app, &login_account(&host))
|
||||
.map_err(|e| format!("delete_credential failed: {e}"))
|
||||
with_credential_lock(|| {
|
||||
require_non_empty(&host, "host")?;
|
||||
secret_store::delete(&app, &login_account(&host))
|
||||
.map_err(|e| format!("delete_credential failed: {e}"))
|
||||
})
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
@@ -165,34 +210,40 @@ pub fn delete_credential(app: AppHandle, host: String) -> Result<(), String> {
|
||||
/// file (DPAPI on Windows, sealed per-install key elsewhere); if that is also
|
||||
/// unavailable this returns an error rather than reporting a success that would
|
||||
/// leave peers rejecting the user's voice announce after a restart.
|
||||
#[tauri::command]
|
||||
#[tauri::command(async)]
|
||||
pub fn save_identity_key(app: AppHandle, host: String, key: String) -> Result<(), String> {
|
||||
require_non_empty(&host, "host")?;
|
||||
require_non_empty(&key, "key")?;
|
||||
with_credential_lock(|| {
|
||||
require_non_empty(&host, "host")?;
|
||||
require_non_empty(&key, "key")?;
|
||||
|
||||
secret_store::set(&app, &identity_account(&host), &key)
|
||||
.map_err(|e| format!("save_identity_key failed: {e}"))?;
|
||||
Ok(())
|
||||
secret_store::set(&app, &identity_account(&host), &key)
|
||||
.map_err(|e| format!("save_identity_key failed: {e}"))?;
|
||||
Ok(())
|
||||
})
|
||||
}
|
||||
|
||||
/// Load the identity private key for `host`.
|
||||
///
|
||||
/// Returns `None` when no identity key exists for the given host.
|
||||
#[tauri::command]
|
||||
#[tauri::command(async)]
|
||||
pub fn load_identity_key(app: AppHandle, host: String) -> Result<Option<String>, String> {
|
||||
require_non_empty(&host, "host")?;
|
||||
secret_store::get(&app, &identity_account(&host))
|
||||
.map_err(|e| format!("load_identity_key failed: {e}"))
|
||||
with_credential_lock(|| {
|
||||
require_non_empty(&host, "host")?;
|
||||
secret_store::get(&app, &identity_account(&host))
|
||||
.map_err(|e| format!("load_identity_key failed: {e}"))
|
||||
})
|
||||
}
|
||||
|
||||
/// Delete the identity private key for `host`.
|
||||
///
|
||||
/// Deleting a non-existent key is not treated as an error.
|
||||
#[tauri::command]
|
||||
#[tauri::command(async)]
|
||||
pub fn delete_identity_key(app: AppHandle, host: String) -> Result<(), String> {
|
||||
require_non_empty(&host, "host")?;
|
||||
secret_store::delete(&app, &identity_account(&host))
|
||||
.map_err(|e| format!("delete_identity_key failed: {e}"))
|
||||
with_credential_lock(|| {
|
||||
require_non_empty(&host, "host")?;
|
||||
secret_store::delete(&app, &identity_account(&host))
|
||||
.map_err(|e| format!("delete_identity_key failed: {e}"))
|
||||
})
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
@@ -217,44 +268,46 @@ pub struct CredentialStoreProbe {
|
||||
/// announce: it distinguishes "the credential store is fine" from "writes are
|
||||
/// accepted and dropped" without touching any real credential. The probe
|
||||
/// account is removed again whatever the outcome.
|
||||
#[tauri::command]
|
||||
#[tauri::command(async)]
|
||||
pub fn probe_credential_store(app: AppHandle) -> CredentialStoreProbe {
|
||||
// Underscores are not legal in DNS hostnames, so this cannot collide with a
|
||||
// real `{host}` or `identity:{host}` account.
|
||||
const PROBE_ACCOUNT: &str = "__diagnostic_probe__";
|
||||
const PROBE_SECRET: &str = "owncord-credential-store-probe";
|
||||
with_credential_lock(|| {
|
||||
// Underscores are not legal in DNS hostnames, so this cannot collide
|
||||
// with a real `{host}` or `identity:{host}` account.
|
||||
const PROBE_ACCOUNT: &str = "__diagnostic_probe__";
|
||||
const PROBE_SECRET: &str = "owncord-credential-store-probe";
|
||||
|
||||
let result = secret_store::set(&app, PROBE_ACCOUNT, PROBE_SECRET).and_then(|backend| {
|
||||
match secret_store::get(&app, PROBE_ACCOUNT)? {
|
||||
Some(ref got) if got == PROBE_SECRET => Ok(backend),
|
||||
Some(_) => Err("read back a different value than was written".into()),
|
||||
None => Err("the store reported a successful write but returned no entry".into()),
|
||||
let result = secret_store::set(&app, PROBE_ACCOUNT, PROBE_SECRET).and_then(|backend| {
|
||||
match secret_store::get(&app, PROBE_ACCOUNT)? {
|
||||
Some(ref got) if got == PROBE_SECRET => Ok(backend),
|
||||
Some(_) => Err("read back a different value than was written".into()),
|
||||
None => Err("the store reported a successful write but returned no entry".into()),
|
||||
}
|
||||
});
|
||||
|
||||
// Always clean up, including when the probe failed part-way through.
|
||||
if let Err(e) = secret_store::delete(&app, PROBE_ACCOUNT) {
|
||||
log::warn!("failed to remove credential store probe entry: {e}");
|
||||
}
|
||||
});
|
||||
|
||||
// Always clean up, including when the probe failed part-way through.
|
||||
if let Err(e) = secret_store::delete(&app, PROBE_ACCOUNT) {
|
||||
log::warn!("failed to remove credential store probe entry: {e}");
|
||||
}
|
||||
|
||||
match result {
|
||||
Ok(backend) => {
|
||||
log::info!("credential store probe succeeded (backend: {backend:?})");
|
||||
CredentialStoreProbe {
|
||||
ok: true,
|
||||
backend: Some(backend),
|
||||
error: None,
|
||||
match result {
|
||||
Ok(backend) => {
|
||||
log::info!("credential store probe succeeded (backend: {backend:?})");
|
||||
CredentialStoreProbe {
|
||||
ok: true,
|
||||
backend: Some(backend),
|
||||
error: None,
|
||||
}
|
||||
}
|
||||
Err(e) => {
|
||||
log::error!("credential store probe failed: {e}");
|
||||
CredentialStoreProbe {
|
||||
ok: false,
|
||||
backend: None,
|
||||
error: Some(e),
|
||||
}
|
||||
}
|
||||
}
|
||||
Err(e) => {
|
||||
log::error!("credential store probe failed: {e}");
|
||||
CredentialStoreProbe {
|
||||
ok: false,
|
||||
backend: None,
|
||||
error: Some(e),
|
||||
}
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
@@ -302,8 +355,14 @@ mod tests {
|
||||
fn account_names_keep_the_port_that_distinguishes_hosts() {
|
||||
// Two servers on one machine differ only by port; dropping it would
|
||||
// make them share an identity key.
|
||||
assert_ne!(login_account("localhost:8443"), login_account("localhost:9443"));
|
||||
assert_eq!(identity_account("localhost:8443"), "identity:localhost:8443");
|
||||
assert_ne!(
|
||||
login_account("localhost:8443"),
|
||||
login_account("localhost:9443")
|
||||
);
|
||||
assert_eq!(
|
||||
identity_account("localhost:8443"),
|
||||
"identity:localhost:8443"
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
@@ -323,7 +382,9 @@ mod tests {
|
||||
|
||||
#[test]
|
||||
fn parse_credential_blob_rejects_malformed_input() {
|
||||
assert!(parse_credential_blob("not json").unwrap_err().contains("not valid JSON"));
|
||||
assert!(parse_credential_blob("not json")
|
||||
.unwrap_err()
|
||||
.contains("not valid JSON"));
|
||||
assert!(parse_credential_blob(r#"{"token":"tok"}"#)
|
||||
.unwrap_err()
|
||||
.contains("missing 'username'"));
|
||||
@@ -347,14 +408,88 @@ mod tests {
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn credential_data_skips_password_in_json() {
|
||||
fn credential_data_serializes_password_for_prefill() {
|
||||
let data = CredentialData {
|
||||
username: "alice".into(),
|
||||
token: "tok".into(),
|
||||
password: Some("pw".into()),
|
||||
};
|
||||
let json = serde_json::to_string(&data).unwrap();
|
||||
assert!(!json.contains("password"));
|
||||
assert!(!json.contains("pw"));
|
||||
assert!(json.contains("password"));
|
||||
assert!(json.contains("pw"));
|
||||
}
|
||||
|
||||
/// B4-3 follow-up: all 7 commands moved to `#[tauri::command(async)]`,
|
||||
/// which runs each invocation on the async runtime's thread pool instead
|
||||
/// of Tauri's single IPC main thread. Two overlapping invocations (e.g.
|
||||
/// `identity.ts`'s save-then-delete legacy-key migration, or a logout's
|
||||
/// `delete_credential` racing a connect-page auto-login's
|
||||
/// `load_credential` for the same host) can now genuinely run
|
||||
/// concurrently. `with_credential_lock` must serialize them: this proves
|
||||
/// no two holders of the lock ever run their critical section at the
|
||||
/// same time, regardless of which OS thread the runtime schedules them
|
||||
/// on.
|
||||
#[test]
|
||||
fn credential_lock_serializes_overlapping_commands() {
|
||||
use std::sync::atomic::{AtomicUsize, Ordering};
|
||||
use std::sync::Arc;
|
||||
use std::thread;
|
||||
use std::time::Duration;
|
||||
|
||||
let concurrent = Arc::new(AtomicUsize::new(0));
|
||||
let max_concurrent = Arc::new(AtomicUsize::new(0));
|
||||
|
||||
let handles: Vec<_> = (0..8)
|
||||
.map(|_| {
|
||||
let concurrent = Arc::clone(&concurrent);
|
||||
let max_concurrent = Arc::clone(&max_concurrent);
|
||||
thread::spawn(move || {
|
||||
with_credential_lock(|| {
|
||||
let now = concurrent.fetch_add(1, Ordering::SeqCst) + 1;
|
||||
max_concurrent.fetch_max(now, Ordering::SeqCst);
|
||||
thread::sleep(Duration::from_millis(5));
|
||||
concurrent.fetch_sub(1, Ordering::SeqCst);
|
||||
});
|
||||
})
|
||||
})
|
||||
.collect();
|
||||
|
||||
for h in handles {
|
||||
h.join().unwrap();
|
||||
}
|
||||
|
||||
assert_eq!(
|
||||
max_concurrent.load(Ordering::SeqCst),
|
||||
1,
|
||||
"two credential-store commands ran their critical section concurrently"
|
||||
);
|
||||
}
|
||||
|
||||
/// `with_credential_lock`'s doc comment promises that poisoning is
|
||||
/// recovered from rather than propagated, so a panic inside one
|
||||
/// credential command cannot permanently wedge every later credential
|
||||
/// operation for the rest of the process. Prove it: panic while holding
|
||||
/// the lock on a spawned thread (which poisons `CREDENTIAL_LOCK`), then
|
||||
/// confirm a later `with_credential_lock` call still runs its closure
|
||||
/// instead of panicking on the poisoned mutex.
|
||||
#[test]
|
||||
fn with_credential_lock_recovers_from_a_poisoned_guard() {
|
||||
use std::thread;
|
||||
|
||||
let poisoning = thread::spawn(|| {
|
||||
with_credential_lock(|| {
|
||||
panic!("boom");
|
||||
});
|
||||
});
|
||||
assert!(
|
||||
poisoning.join().is_err(),
|
||||
"expected the spawned thread to panic while holding the lock"
|
||||
);
|
||||
|
||||
assert_eq!(
|
||||
with_credential_lock(|| 42),
|
||||
42,
|
||||
"with_credential_lock must recover from a poisoned mutex, not propagate it"
|
||||
);
|
||||
}
|
||||
}
|
||||
@@ -47,7 +47,8 @@ impl Drop for OutBlob {
|
||||
// Scrub first: on the unprotect path this buffer holds the plaintext
|
||||
// identity key, and LocalFree does not zero what it releases.
|
||||
// SAFETY: as in `to_vec`, plus the range is ours alone to write.
|
||||
let bytes = unsafe { std::slice::from_raw_parts_mut(self.0.pbData, self.0.cbData as usize) };
|
||||
let bytes =
|
||||
unsafe { std::slice::from_raw_parts_mut(self.0.pbData, self.0.cbData as usize) };
|
||||
bytes.zeroize();
|
||||
// SAFETY: pbData came from DPAPI's LocalAlloc, and `Drop` runs at most
|
||||
// once, so it is freed exactly once.
|
||||
+62
-11
@@ -67,12 +67,9 @@ pub fn load_or_create_key(dir: &Path) -> Result<[u8; KEY_LEN], String> {
|
||||
options.mode(0o600);
|
||||
}
|
||||
match options.open(&path) {
|
||||
Ok(mut file) => {
|
||||
file.write_all(&key)
|
||||
.and_then(|()| file.sync_all())
|
||||
.map_err(|e| format!("failed to write credential fallback key: {e}"))?;
|
||||
Ok(key)
|
||||
}
|
||||
Ok(mut file) => finish_new_key_file(&path, key, || {
|
||||
file.write_all(&key).and_then(|()| file.sync_all())
|
||||
}),
|
||||
// Lost the create race to another thread — use the winner's key.
|
||||
Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists => {
|
||||
let bytes = fs::read(&path)
|
||||
@@ -86,6 +83,28 @@ pub fn load_or_create_key(dir: &Path) -> Result<[u8; KEY_LEN], String> {
|
||||
}
|
||||
}
|
||||
|
||||
/// Finish writing a just-created (empty) key file: run `write_and_sync` — the
|
||||
/// real write_all + sync_all in production, injected here so the failure
|
||||
/// path is testable without forcing a genuine disk-full/IO error — and
|
||||
/// delete the file again if it fails.
|
||||
///
|
||||
/// `create_new` above already created `path` with zero bytes in it. Left
|
||||
/// behind, a write/sync failure leaves a short file that every future
|
||||
/// `load_or_create_key` call reads back and rejects forever (see this
|
||||
/// function's doc comment: "never rewritten once it exists") — silently
|
||||
/// poisoning the fallback store on the first ENOSPC/IO hiccup.
|
||||
fn finish_new_key_file(
|
||||
path: &Path,
|
||||
key: [u8; KEY_LEN],
|
||||
write_and_sync: impl FnOnce() -> std::io::Result<()>,
|
||||
) -> Result<[u8; KEY_LEN], String> {
|
||||
if let Err(e) = write_and_sync() {
|
||||
let _ = fs::remove_file(path);
|
||||
return Err(format!("failed to write credential fallback key: {e}"));
|
||||
}
|
||||
Ok(key)
|
||||
}
|
||||
|
||||
/// Seal `plaintext` under `key`, binding `aad` (the service + account name).
|
||||
///
|
||||
/// Output layout: `nonce (12 bytes) || ciphertext || tag`. The nonce is random
|
||||
@@ -181,7 +200,10 @@ mod tests {
|
||||
tampered[last] ^= 0x01;
|
||||
assert!(unprotect(&key, &tampered, b"aad").is_err());
|
||||
|
||||
assert!(unprotect(&key, &blob[..NONCE_LEN], b"aad").is_err(), "truncated blob");
|
||||
assert!(
|
||||
unprotect(&key, &blob[..NONCE_LEN], b"aad").is_err(),
|
||||
"truncated blob"
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
@@ -194,10 +216,8 @@ mod tests {
|
||||
|
||||
#[test]
|
||||
fn creates_and_reuses_the_key_file() {
|
||||
let dir = std::env::temp_dir().join(format!(
|
||||
"owncord-fallback-key-test-{}",
|
||||
std::process::id()
|
||||
));
|
||||
let dir =
|
||||
std::env::temp_dir().join(format!("owncord-fallback-key-test-{}", std::process::id()));
|
||||
let _ = fs::remove_dir_all(&dir);
|
||||
|
||||
let first = load_or_create_key(&dir).unwrap();
|
||||
@@ -217,6 +237,37 @@ mod tests {
|
||||
let _ = fs::remove_dir_all(&dir);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn removes_the_partial_file_when_the_write_fails() {
|
||||
// A crash / ENOSPC mid-write must not leave a short file behind:
|
||||
// load_or_create_key's doc comment says the key file is "never
|
||||
// rewritten once it exists", so a poisoned short file is permanent —
|
||||
// every future load fails the length check forever.
|
||||
let dir = std::env::temp_dir().join(format!(
|
||||
"owncord-fallback-partial-write-test-{}",
|
||||
std::process::id()
|
||||
));
|
||||
let _ = fs::remove_dir_all(&dir);
|
||||
fs::create_dir_all(&dir).unwrap();
|
||||
let path = dir.join(CREDENTIAL_FALLBACK_KEY_FILE);
|
||||
// `create_new` in load_or_create_key already created this empty file
|
||||
// before the write step (which is what's under test) runs.
|
||||
fs::write(&path, b"").unwrap();
|
||||
|
||||
let err = finish_new_key_file(&path, [7u8; KEY_LEN], || {
|
||||
Err(std::io::Error::other("disk full"))
|
||||
})
|
||||
.unwrap_err();
|
||||
|
||||
assert!(err.contains("failed to write"), "unexpected error: {err}");
|
||||
assert!(
|
||||
!path.exists(),
|
||||
"a failed write must not leave a partial key file behind"
|
||||
);
|
||||
|
||||
let _ = fs::remove_dir_all(&dir);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn rejects_a_corrupt_key_file() {
|
||||
let dir = std::env::temp_dir().join(format!(
|
||||
+233
-22
@@ -29,11 +29,11 @@
|
||||
// - The accept loop exits after 5 consecutive errors to prevent CPU spin.
|
||||
|
||||
use log::{debug, error, info, warn};
|
||||
use rustls::pki_types::ServerName;
|
||||
use std::collections::HashMap;
|
||||
use std::net::IpAddr;
|
||||
use std::sync::Arc;
|
||||
use rustls::pki_types::ServerName;
|
||||
use tauri::{AppHandle, Runtime};
|
||||
use tauri::{AppHandle, Manager, Runtime};
|
||||
use tokio::io::{self, AsyncReadExt, AsyncWriteExt};
|
||||
use tokio::net::{TcpListener, TcpStream};
|
||||
use tokio::sync::Mutex;
|
||||
@@ -57,6 +57,21 @@ impl HttpProxyState {
|
||||
inner: Mutex::new(HashMap::new()),
|
||||
}
|
||||
}
|
||||
|
||||
/// Remove the `remote_host` entry, but only if it still points at `port`.
|
||||
/// Used by `run_proxy_loop`'s accept-error exit path to deregister a dead
|
||||
/// tunnel without racing a newer tunnel that may have already replaced it
|
||||
/// (e.g. `stop_http_proxy` + a fresh `start_http_proxy` while this loop
|
||||
/// was mid-shutdown).
|
||||
async fn remove_if_port_matches(&self, remote_host: &str, port: u16) {
|
||||
let mut inner = self.inner.lock().await;
|
||||
if inner
|
||||
.get(remote_host)
|
||||
.is_some_and(|entry| entry.port == port)
|
||||
{
|
||||
inner.remove(remote_host);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Validate a remote host string before it is used in header rewriting and
|
||||
@@ -111,6 +126,7 @@ pub async fn start_http_proxy<R: Runtime>(
|
||||
app.clone(),
|
||||
listener,
|
||||
remote_host.clone(),
|
||||
port,
|
||||
shutdown_rx,
|
||||
));
|
||||
// Watch the loop so a panic is logged instead of vanishing silently (which
|
||||
@@ -161,6 +177,7 @@ async fn run_proxy_loop<R: Runtime>(
|
||||
app: AppHandle<R>,
|
||||
listener: TcpListener,
|
||||
remote_host: String,
|
||||
port: u16,
|
||||
mut shutdown_rx: tokio::sync::oneshot::Receiver<()>,
|
||||
) {
|
||||
let mut consecutive_errors: u32 = 0;
|
||||
@@ -191,6 +208,21 @@ async fn run_proxy_loop<R: Runtime>(
|
||||
"[http_proxy] {} consecutive accept errors, stopping proxy loop",
|
||||
MAX_CONSECUTIVE_ACCEPT_ERRORS
|
||||
);
|
||||
// Deregister the dead tunnel BEFORE the break drops
|
||||
// `listener`, so a future start_http_proxy rebinds a
|
||||
// fresh port instead of handing back this closed one
|
||||
// forever. Doing it here rather than after the loop
|
||||
// returns matters: the listener still holds the port,
|
||||
// so no newer tunnel can have been handed the same
|
||||
// number and the port guard cannot misfire.
|
||||
if let Some(state) = app.try_state::<HttpProxyState>() {
|
||||
state.remove_if_port_matches(&remote_host, port).await;
|
||||
} else {
|
||||
warn!(
|
||||
"[http_proxy] state unmanaged; cannot deregister dead tunnel for {}",
|
||||
remote_host
|
||||
);
|
||||
}
|
||||
break;
|
||||
}
|
||||
}
|
||||
@@ -243,6 +275,51 @@ fn rewrite_request_headers(raw: &[u8], remote_host: &str) -> String {
|
||||
modified
|
||||
}
|
||||
|
||||
/// Bracket-aware split of a `remote_host` string into (hostname, port).
|
||||
/// Defaults to port 443 (standard HTTPS) when none is specified.
|
||||
///
|
||||
/// A leading `[` consumes up to the matching `]` as the hostname, so a
|
||||
/// bracketed IPv6 literal parses correctly whether or not it carries an
|
||||
/// explicit port (`[::1]`, `[::1]:8443`). Without brackets, a single
|
||||
/// trailing colon is a `host:port` split — but a *bare* (unbracketed) IPv6
|
||||
/// literal contains more than one colon, and RFC 3986 gives it no way to
|
||||
/// carry a port without brackets, so that case is returned whole with the
|
||||
/// default port instead of being mis-split on its last colon.
|
||||
fn split_host_port(remote_host: &str) -> Result<(&str, &str), String> {
|
||||
if let Some(rest) = remote_host.strip_prefix('[') {
|
||||
let (host, tail) = rest
|
||||
.split_once(']')
|
||||
.ok_or_else(|| format!("unterminated '[' in remote_host '{remote_host}'"))?;
|
||||
let port = tail.strip_prefix(':').unwrap_or("443");
|
||||
Ok((host, port))
|
||||
} else {
|
||||
match remote_host.rsplit_once(':') {
|
||||
Some((host, port)) if !host.contains(':') => Ok((host, port)),
|
||||
_ => Ok((remote_host, "443")),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Derive the TLS `ServerName` (SNI) and the TCP dial target from a
|
||||
/// `remote_host` string. Mirrors `livekit_proxy::parse_server_name`'s
|
||||
/// bracket handling.
|
||||
fn resolve_remote_target(remote_host: &str) -> Result<(ServerName<'static>, String), String> {
|
||||
let (hostname, port) = split_host_port(remote_host)?;
|
||||
let server_name = if let Ok(ip) = hostname.parse::<IpAddr>() {
|
||||
ServerName::IpAddress(ip.into())
|
||||
} else {
|
||||
ServerName::try_from(hostname.to_string())
|
||||
.map_err(|e| format!("invalid server name '{hostname}': {e}"))?
|
||||
};
|
||||
|
||||
let dial_target = if hostname.contains(':') {
|
||||
format!("[{hostname}]:{port}")
|
||||
} else {
|
||||
format!("{hostname}:{port}")
|
||||
};
|
||||
Ok((server_name, dial_target))
|
||||
}
|
||||
|
||||
/// Handle one proxied connection:
|
||||
/// 1. Read the request headers from the loopback side
|
||||
/// 2. TLS-connect to the remote and run the TOFU check (store/emit/reject)
|
||||
@@ -292,26 +369,15 @@ async fn handle_connection<R: Runtime>(
|
||||
.with_no_client_auth();
|
||||
let connector = tokio_rustls::TlsConnector::from(Arc::new(tls_config));
|
||||
|
||||
let (raw_hostname, _port) = remote_host.rsplit_once(':').unwrap_or((remote_host, "443"));
|
||||
let hostname = raw_hostname.trim_start_matches('[').trim_end_matches(']');
|
||||
let server_name = if let Ok(ip) = hostname.parse::<IpAddr>() {
|
||||
ServerName::IpAddress(ip.into())
|
||||
} else {
|
||||
ServerName::try_from(hostname.to_string())
|
||||
.map_err(|e| format!("invalid server name '{hostname}': {e}"))?
|
||||
};
|
||||
|
||||
let dial_target = if remote_host.contains(':') {
|
||||
remote_host.to_string()
|
||||
} else {
|
||||
format!("{remote_host}:443")
|
||||
};
|
||||
let (server_name, dial_target) = resolve_remote_target(remote_host)?;
|
||||
let tcp = timeout(Duration::from_secs(10), TcpStream::connect(&dial_target))
|
||||
.await
|
||||
.map_err(|_| Box::<dyn std::error::Error + Send + Sync>::from("TCP connect timed out"))??;
|
||||
let mut tls = timeout(Duration::from_secs(10), connector.connect(server_name, tcp))
|
||||
.await
|
||||
.map_err(|_| Box::<dyn std::error::Error + Send + Sync>::from("TLS handshake timed out"))??;
|
||||
.map_err(|_| {
|
||||
Box::<dyn std::error::Error + Send + Sync>::from("TLS handshake timed out")
|
||||
})??;
|
||||
|
||||
let fingerprint = captured_fp
|
||||
.lock()
|
||||
@@ -339,7 +405,10 @@ async fn handle_connection<R: Runtime>(
|
||||
// it (accept_cert_fingerprint) before any credential-bearing request is
|
||||
// sent. The connect page's health check triggers this before login.
|
||||
TofuOutcome::FirstUse => {
|
||||
info!("[http_proxy] first-use cert for {} — awaiting user confirmation", store_key);
|
||||
info!(
|
||||
"[http_proxy] first-use cert for {} — awaiting user confirmation",
|
||||
store_key
|
||||
);
|
||||
crate::ws_proxy::emit_cert_tofu(
|
||||
&app,
|
||||
serde_json::json!({
|
||||
@@ -386,7 +455,7 @@ async fn handle_connection<R: Runtime>(
|
||||
|
||||
// ── 3. Forward request + bidirectional copy ──────────────────────────
|
||||
tls.write_all(modified.as_bytes()).await?;
|
||||
match io::copy_bidirectional(&mut local, &mut tls).await {
|
||||
match copy_with_deadline(&mut local, &mut tls, DATA_PHASE_TIMEOUT).await {
|
||||
Ok((to_remote, from_remote)) => {
|
||||
debug!(
|
||||
"[http_proxy] connection closed: {}B sent, {}B received",
|
||||
@@ -400,6 +469,40 @@ async fn handle_connection<R: Runtime>(
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Bound for the data-copy phase of a tunneled connection (step 3 above).
|
||||
/// The header read, TCP connect, and TLS handshake phases all use a tight
|
||||
/// 10s guard, but this phase carries the actual REST body — including
|
||||
/// attachment/avatar uploads — so it needs a much more generous bound. 600s
|
||||
/// only reclaims a connection that is genuinely stuck (e.g. a remote that
|
||||
/// completes the TLS handshake and then neither responds nor closes), not
|
||||
/// one that is merely slow.
|
||||
const DATA_PHASE_TIMEOUT: Duration = Duration::from_secs(600);
|
||||
|
||||
/// Run `io::copy_bidirectional` under a deadline. Without this, a remote
|
||||
/// that completes the TLS handshake and then stalls forever (neither
|
||||
/// responding nor closing) parks the spawned connection task — and both the
|
||||
/// loopback socket and the remote TLS session — indefinitely; closing the
|
||||
/// local side alone does not free it, since `copy_bidirectional` only
|
||||
/// resolves once BOTH directions finish. Generic over the stream types so it
|
||||
/// can be unit-tested without a live TLS connection.
|
||||
async fn copy_with_deadline<A, B>(
|
||||
local: &mut A,
|
||||
remote: &mut B,
|
||||
dur: Duration,
|
||||
) -> io::Result<(u64, u64)>
|
||||
where
|
||||
A: io::AsyncRead + io::AsyncWrite + Unpin + ?Sized,
|
||||
B: io::AsyncRead + io::AsyncWrite + Unpin + ?Sized,
|
||||
{
|
||||
match timeout(dur, io::copy_bidirectional(local, remote)).await {
|
||||
Ok(result) => result,
|
||||
Err(_) => Err(io::Error::new(
|
||||
io::ErrorKind::TimedOut,
|
||||
"data phase timed out",
|
||||
)),
|
||||
}
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Tests
|
||||
// ---------------------------------------------------------------------------
|
||||
@@ -408,6 +511,46 @@ async fn handle_connection<R: Runtime>(
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
// Regression: the accept-error exit path in run_proxy_loop must be able to
|
||||
// deregister its own dead entry, but must NOT clobber a newer tunnel that
|
||||
// has since replaced it under the same remote_host key.
|
||||
#[tokio::test]
|
||||
async fn remove_if_port_matches_removes_only_matching_entry() {
|
||||
let state = HttpProxyState::new();
|
||||
{
|
||||
let (tx, _rx) = tokio::sync::oneshot::channel::<()>();
|
||||
let mut inner = state.inner.lock().await;
|
||||
inner.insert(
|
||||
"example.com:8443".to_string(),
|
||||
ProxyEntry {
|
||||
port: 4242,
|
||||
shutdown_tx: tx,
|
||||
},
|
||||
);
|
||||
}
|
||||
|
||||
// A stale loop reporting a port that no longer matches the live
|
||||
// entry must leave the current entry alone.
|
||||
state.remove_if_port_matches("example.com:8443", 9999).await;
|
||||
assert_eq!(
|
||||
state
|
||||
.inner
|
||||
.lock()
|
||||
.await
|
||||
.get("example.com:8443")
|
||||
.map(|e| e.port),
|
||||
Some(4242),
|
||||
"mismatched port must not remove a newer tunnel's entry"
|
||||
);
|
||||
|
||||
// A loop reporting its own still-current port must remove it.
|
||||
state.remove_if_port_matches("example.com:8443", 4242).await;
|
||||
assert!(
|
||||
state.inner.lock().await.get("example.com:8443").is_none(),
|
||||
"matching port must deregister the dead tunnel"
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn validate_rejects_crlf_and_null() {
|
||||
assert!(validate_remote_host("evil\r\nhost").is_err());
|
||||
@@ -428,6 +571,41 @@ mod tests {
|
||||
assert!(validate_remote_host("[::1]:8443").is_ok());
|
||||
}
|
||||
|
||||
// OC-0021: IPv6 hosts that are not in the exact `[addr]:port` shape must
|
||||
// still resolve to a valid ServerName and a dialable host:port target.
|
||||
|
||||
#[test]
|
||||
fn resolve_remote_target_handles_bracketed_ipv6_without_port() {
|
||||
let (server_name, dial_target) = resolve_remote_target("[2001:db8::1]")
|
||||
.expect("bracketed IPv6 without a port must parse");
|
||||
assert!(matches!(server_name, ServerName::IpAddress(_)));
|
||||
assert_eq!(dial_target, "[2001:db8::1]:443");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn resolve_remote_target_handles_bare_ipv6_without_port() {
|
||||
let (server_name, dial_target) =
|
||||
resolve_remote_target("2001:db8::1").expect("bare IPv6 without a port must parse");
|
||||
assert!(matches!(server_name, ServerName::IpAddress(_)));
|
||||
assert_eq!(dial_target, "[2001:db8::1]:443");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn resolve_remote_target_still_handles_bracketed_ipv6_with_port() {
|
||||
let (server_name, dial_target) = resolve_remote_target("[2001:db8::1]:8443")
|
||||
.expect("bracketed IPv6 with a port must parse");
|
||||
assert!(matches!(server_name, ServerName::IpAddress(_)));
|
||||
assert_eq!(dial_target, "[2001:db8::1]:8443");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn resolve_remote_target_still_handles_plain_hostname_and_port() {
|
||||
let (server_name, dial_target) =
|
||||
resolve_remote_target("example.com:8443").expect("hostname:port must parse");
|
||||
assert!(matches!(server_name, ServerName::DnsName(_)));
|
||||
assert_eq!(dial_target, "example.com:8443");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn rewrite_replaces_host_and_forces_close() {
|
||||
let raw = b"GET /api/v1/health HTTP/1.1\r\nHost: 127.0.0.1:5000\r\nAccept: */*\r\n\r\n";
|
||||
@@ -440,13 +618,15 @@ mod tests {
|
||||
|
||||
#[test]
|
||||
fn rewrite_overrides_existing_keepalive() {
|
||||
let raw =
|
||||
b"POST /x HTTP/1.1\r\nHost: 127.0.0.1:5000\r\nConnection: keep-alive\r\n\r\n";
|
||||
let raw = b"POST /x HTTP/1.1\r\nHost: 127.0.0.1:5000\r\nConnection: keep-alive\r\n\r\n";
|
||||
let out = rewrite_request_headers(raw, "example.com:8443");
|
||||
assert!(out.contains("Connection: close\r\n"));
|
||||
assert!(!out.to_ascii_lowercase().contains("keep-alive"));
|
||||
// Exactly one Connection header.
|
||||
assert_eq!(out.to_ascii_lowercase().matches("\r\nconnection:").count(), 1);
|
||||
assert_eq!(
|
||||
out.to_ascii_lowercase().matches("\r\nconnection:").count(),
|
||||
1
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
@@ -457,4 +637,35 @@ mod tests {
|
||||
assert!(out.contains("Content-Length: 2\r\n"));
|
||||
assert!(out.ends_with("\r\n\r\n"));
|
||||
}
|
||||
|
||||
// OC-0218: the data phase of a tunneled request (step 3 in
|
||||
// `handle_connection`) must not be able to hang forever. A remote that
|
||||
// completes the TLS handshake and then neither responds nor closes must
|
||||
// eventually be reclaimed, the same way the header-read/connect/handshake
|
||||
// phases already are (10s guards above). Simulate that stall with two
|
||||
// in-memory duplex pairs where neither peer ever writes or disconnects,
|
||||
// so raw `io::copy_bidirectional` would block forever.
|
||||
#[tokio::test]
|
||||
async fn copy_with_deadline_reclaims_a_stalled_connection() {
|
||||
// Keep both "far" ends alive (bound, not `_`) so neither duplex half
|
||||
// observes EOF — this is what makes the connection "stalled" rather
|
||||
// than "closed".
|
||||
let (mut local_near, _local_far) = tokio::io::duplex(64);
|
||||
let (mut remote_near, _remote_far) = tokio::io::duplex(64);
|
||||
|
||||
// An outer safety bound: if `copy_with_deadline` does not honor its
|
||||
// own deadline, fail fast instead of hanging the test suite forever.
|
||||
let outcome = tokio::time::timeout(
|
||||
Duration::from_secs(5),
|
||||
copy_with_deadline(&mut local_near, &mut remote_near, Duration::from_millis(50)),
|
||||
)
|
||||
.await
|
||||
.expect(
|
||||
"copy_with_deadline must resolve on its own deadline; the data phase must not hang \
|
||||
indefinitely on a stalled remote (OC-0218)",
|
||||
);
|
||||
|
||||
let err = outcome.expect_err("a stalled remote must surface as a timeout error, not Ok");
|
||||
assert_eq!(err.kind(), io::ErrorKind::TimedOut);
|
||||
}
|
||||
}
|
||||
@@ -125,6 +125,7 @@ pub fn run() {
|
||||
ptt::ptt_stop,
|
||||
ptt::ptt_set_key,
|
||||
ptt::ptt_get_key,
|
||||
ptt::ptt_polling_supported,
|
||||
ptt::ptt_listen_for_key,
|
||||
livekit_proxy::start_livekit_proxy,
|
||||
livekit_proxy::stop_livekit_proxy,
|
||||
+6
-2
@@ -38,8 +38,12 @@ pub fn enable_media_capture(app: &AppHandle) {
|
||||
webview.connect_permission_request(|_, request| {
|
||||
// UserMediaPermissionRequest covers getUserMedia (mic/camera);
|
||||
// DeviceInfoPermissionRequest covers enumerateDevices labels.
|
||||
let is_media = request.downcast_ref::<UserMediaPermissionRequest>().is_some()
|
||||
|| request.downcast_ref::<DeviceInfoPermissionRequest>().is_some();
|
||||
let is_media = request
|
||||
.downcast_ref::<UserMediaPermissionRequest>()
|
||||
.is_some()
|
||||
|| request
|
||||
.downcast_ref::<DeviceInfoPermissionRequest>()
|
||||
.is_some();
|
||||
if is_media {
|
||||
request.allow();
|
||||
return true;
|
||||
+275
-38
@@ -18,7 +18,9 @@
|
||||
// - Certificate validation uses the TOFU-pinned fingerprint from ws_proxy.
|
||||
// The WebSocket proxy must connect first to establish trust; the LiveKit
|
||||
// proxy then pins to that same certificate. If the cert changes between
|
||||
// WS and LiveKit connections, the LiveKit handshake will fail.
|
||||
// WS and LiveKit connections, the LiveKit handshake will fail (fail
|
||||
// closed) until the user accepts the new cert — each start call reloads
|
||||
// the stored pin and restarts the listener when it changed.
|
||||
// - Only one proxy instance runs at a time (per remote host). Connecting to
|
||||
// a different server replaces the proxy. Stale proxy ports are not reused.
|
||||
// - If the TcpListener errors (extremely unlikely on loopback), the cached
|
||||
@@ -26,10 +28,10 @@
|
||||
// - The accept loop exits after 5 consecutive errors to prevent CPU spin.
|
||||
|
||||
use log::{debug, error, info, warn};
|
||||
use rustls::pki_types::ServerName;
|
||||
use std::net::IpAddr;
|
||||
use std::sync::Arc;
|
||||
use rustls::pki_types::ServerName;
|
||||
use tauri::Runtime;
|
||||
use tauri::{Manager, Runtime};
|
||||
use tokio::io::{self, AsyncReadExt, AsyncWriteExt};
|
||||
use tokio::net::{TcpListener, TcpStream};
|
||||
use tokio::sync::Mutex;
|
||||
@@ -45,6 +47,9 @@ struct ProxyInner {
|
||||
port: Option<u16>,
|
||||
/// The remote host:port we're proxying to.
|
||||
remote_host: String,
|
||||
/// The TOFU fingerprint the running listener pins. Baked into the proxy
|
||||
/// loop at spawn, so a re-pin in the cert store requires a restart.
|
||||
pinned_fingerprint: String,
|
||||
/// Shutdown signal sender.
|
||||
shutdown_tx: Option<tokio::sync::oneshot::Sender<()>>,
|
||||
}
|
||||
@@ -55,10 +60,26 @@ impl LiveKitProxyState {
|
||||
inner: Mutex::new(ProxyInner {
|
||||
port: None,
|
||||
remote_host: String::new(),
|
||||
pinned_fingerprint: String::new(),
|
||||
shutdown_tx: None,
|
||||
}),
|
||||
}
|
||||
}
|
||||
|
||||
/// Clear the running-proxy state, but only if it still points at `port`.
|
||||
/// Mirrors HttpProxyState::remove_if_port_matches; used by run_proxy_loop's
|
||||
/// accept-error exit path so a dead listener doesn't keep being handed
|
||||
/// back by start_livekit_proxy's reuse branch, and doesn't race a newer
|
||||
/// proxy that may have already replaced it.
|
||||
async fn clear_if_port_matches(&self, port: u16) {
|
||||
let mut inner = self.inner.lock().await;
|
||||
if inner.port == Some(port) {
|
||||
inner.port = None;
|
||||
inner.remote_host.clear();
|
||||
inner.pinned_fingerprint.clear();
|
||||
inner.shutdown_tx = None;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
@@ -121,6 +142,21 @@ pub(crate) fn rewrite_proxy_headers(request: &str, remote_host: &str) -> String
|
||||
modified
|
||||
}
|
||||
|
||||
/// Decide whether an already-running proxy can serve a new start request:
|
||||
/// only when both the remote host AND the TOFU-pinned fingerprint are
|
||||
/// unchanged. The listener bakes its fingerprint in at spawn, so after the
|
||||
/// user accepts a rotated cert (which rewrites the store), reusing the old
|
||||
/// listener would fail every TLS handshake against the stale pin until
|
||||
/// logout — the caller must tear down and restart instead.
|
||||
pub(crate) fn can_reuse_proxy(
|
||||
running_host: &str,
|
||||
running_fingerprint: &str,
|
||||
requested_host: &str,
|
||||
stored_fingerprint: &str,
|
||||
) -> bool {
|
||||
running_host == requested_host && running_fingerprint == stored_fingerprint
|
||||
}
|
||||
|
||||
/// Extract the TLS server name from a `host[:port]` string.
|
||||
///
|
||||
/// IPv6 literals arrive bracketed (`[::1]:8443`); the brackets are stripped and
|
||||
@@ -162,31 +198,45 @@ pub async fn start_livekit_proxy<R: Runtime>(
|
||||
|
||||
info!("[livekit_proxy] start requested for {}", remote_host);
|
||||
|
||||
// Reuse existing proxy for same host.
|
||||
// Load the TOFU-pinned fingerprint from the cert store BEFORE the reuse
|
||||
// check — a running listener bakes its pin in at spawn, so a re-pin
|
||||
// (user accepted a rotated cert) must force a restart, not a reuse. The
|
||||
// ws_proxy must have connected first (establishing the TOFU trust), so
|
||||
// the fingerprint should already be stored. If not, reject — we refuse
|
||||
// to connect without a pinned cert.
|
||||
let store_key = tofu::cert_store_key(&remote_host);
|
||||
let fingerprint = tofu::load_stored_fingerprint(&app, &store_key)?.ok_or_else(|| {
|
||||
format!(
|
||||
"no trusted certificate fingerprint for {remote_host}. \
|
||||
Connect via WebSocket first to establish TOFU trust."
|
||||
)
|
||||
})?;
|
||||
|
||||
// Reuse the existing proxy only when host AND pin are unchanged.
|
||||
if let Some(port) = inner.port {
|
||||
if inner.remote_host == remote_host {
|
||||
debug!("[livekit_proxy] reusing existing proxy on port {} for {}", port, remote_host);
|
||||
if can_reuse_proxy(
|
||||
&inner.remote_host,
|
||||
&inner.pinned_fingerprint,
|
||||
&remote_host,
|
||||
&fingerprint,
|
||||
) {
|
||||
debug!(
|
||||
"[livekit_proxy] reusing existing proxy on port {} for {}",
|
||||
port, remote_host
|
||||
);
|
||||
return Ok(port);
|
||||
}
|
||||
// Different host — tear down old proxy.
|
||||
info!("[livekit_proxy] stopping old proxy for {} (switching to {})", inner.remote_host, remote_host);
|
||||
// Different host or re-pinned cert — tear down the old proxy.
|
||||
info!(
|
||||
"[livekit_proxy] stopping old proxy for {} (restarting for {})",
|
||||
inner.remote_host, remote_host
|
||||
);
|
||||
if let Some(tx) = inner.shutdown_tx.take() {
|
||||
let _ = tx.send(());
|
||||
}
|
||||
inner.port = None;
|
||||
}
|
||||
|
||||
// Load the TOFU-pinned fingerprint from the cert store. The ws_proxy must
|
||||
// have connected first (establishing the TOFU trust), so the fingerprint
|
||||
// should already be stored. If not, reject — we refuse to connect without
|
||||
// a pinned cert.
|
||||
let store_key = tofu::cert_store_key(&remote_host);
|
||||
let fingerprint = tofu::load_stored_fingerprint(&app, &store_key)?
|
||||
.ok_or_else(|| format!(
|
||||
"no trusted certificate fingerprint for {remote_host}. \
|
||||
Connect via WebSocket first to establish TOFU trust."
|
||||
))?;
|
||||
|
||||
let listener = TcpListener::bind("127.0.0.1:0")
|
||||
.await
|
||||
.map_err(|e| format!("livekit proxy bind failed: {e}"))?;
|
||||
@@ -198,7 +248,14 @@ pub async fn start_livekit_proxy<R: Runtime>(
|
||||
|
||||
let (shutdown_tx, shutdown_rx) = tokio::sync::oneshot::channel::<()>();
|
||||
let host = remote_host.clone();
|
||||
let loop_handle = tokio::spawn(run_proxy_loop(listener, host, fingerprint, shutdown_rx));
|
||||
let loop_handle = tokio::spawn(run_proxy_loop(
|
||||
app.clone(),
|
||||
listener,
|
||||
host,
|
||||
port,
|
||||
fingerprint.clone(),
|
||||
shutdown_rx,
|
||||
));
|
||||
// Watch the loop so a panic is logged instead of vanishing silently.
|
||||
tokio::spawn(async move {
|
||||
match loop_handle.await {
|
||||
@@ -208,10 +265,14 @@ pub async fn start_livekit_proxy<R: Runtime>(
|
||||
}
|
||||
});
|
||||
|
||||
info!("[livekit_proxy] proxy started on 127.0.0.1:{} → {}", port, remote_host);
|
||||
info!(
|
||||
"[livekit_proxy] proxy started on 127.0.0.1:{} → {}",
|
||||
port, remote_host
|
||||
);
|
||||
|
||||
inner.port = Some(port);
|
||||
inner.remote_host = remote_host;
|
||||
inner.pinned_fingerprint = fingerprint;
|
||||
inner.shutdown_tx = Some(shutdown_tx);
|
||||
|
||||
Ok(port)
|
||||
@@ -219,15 +280,14 @@ pub async fn start_livekit_proxy<R: Runtime>(
|
||||
|
||||
/// Stop the LiveKit TLS proxy if running.
|
||||
#[tauri::command]
|
||||
pub async fn stop_livekit_proxy(
|
||||
state: tauri::State<'_, LiveKitProxyState>,
|
||||
) -> Result<(), String> {
|
||||
pub async fn stop_livekit_proxy(state: tauri::State<'_, LiveKitProxyState>) -> Result<(), String> {
|
||||
let mut inner = state.inner.lock().await;
|
||||
if let Some(tx) = inner.shutdown_tx.take() {
|
||||
let _ = tx.send(());
|
||||
}
|
||||
inner.port = None;
|
||||
inner.remote_host.clear();
|
||||
inner.pinned_fingerprint.clear();
|
||||
Ok(())
|
||||
}
|
||||
|
||||
@@ -238,9 +298,11 @@ pub async fn stop_livekit_proxy(
|
||||
/// Maximum consecutive accept errors before the proxy loop exits.
|
||||
const MAX_CONSECUTIVE_ACCEPT_ERRORS: u32 = 5;
|
||||
|
||||
async fn run_proxy_loop(
|
||||
async fn run_proxy_loop<R: Runtime>(
|
||||
app: tauri::AppHandle<R>,
|
||||
listener: TcpListener,
|
||||
remote_host: String,
|
||||
port: u16,
|
||||
pinned_fingerprint: String,
|
||||
mut shutdown_rx: tokio::sync::oneshot::Receiver<()>,
|
||||
) {
|
||||
@@ -272,6 +334,20 @@ async fn run_proxy_loop(
|
||||
"[livekit_proxy] {} consecutive accept errors, stopping proxy loop",
|
||||
MAX_CONSECUTIVE_ACCEPT_ERRORS
|
||||
);
|
||||
// Deregister the dead proxy BEFORE the break drops
|
||||
// `listener`, so a future start_livekit_proxy
|
||||
// rebinds a fresh port instead of handing back
|
||||
// this closed one forever (the reuse branch keys
|
||||
// only on host+pin, not liveness). Mirrors
|
||||
// http_proxy.rs's identical fix.
|
||||
if let Some(state) = app.try_state::<LiveKitProxyState>() {
|
||||
state.clear_if_port_matches(port).await;
|
||||
} else {
|
||||
warn!(
|
||||
"[livekit_proxy] state unmanaged; cannot deregister dead proxy for {}",
|
||||
remote_host
|
||||
);
|
||||
}
|
||||
break;
|
||||
}
|
||||
}
|
||||
@@ -282,6 +358,40 @@ async fn run_proxy_loop(
|
||||
}
|
||||
}
|
||||
|
||||
/// Bound on the outbound dial and TLS handshake, matching http_proxy.rs.
|
||||
const PROXY_CONNECT_TIMEOUT: Duration = Duration::from_secs(10);
|
||||
|
||||
/// Dial `remote_host` and complete the TLS handshake, bounding each step by
|
||||
/// `limit`.
|
||||
///
|
||||
/// Both steps must be bounded. A peer that accepts the TCP connection and then
|
||||
/// never answers the ClientHello blocks the handshake forever, and the calling
|
||||
/// task holds `local` without polling it — so the LiveKit SDK closing its side
|
||||
/// never cancels it. Those tasks and their sockets accumulate on every SDK
|
||||
/// retry and survive stop_livekit_proxy, whose shutdown oneshot only stops the
|
||||
/// accept loop; the per-connection tasks are detached.
|
||||
async fn connect_tls(
|
||||
connector: &tokio_rustls::TlsConnector,
|
||||
server_name: ServerName<'static>,
|
||||
remote_host: &str,
|
||||
limit: Duration,
|
||||
) -> Result<tokio_rustls::client::TlsStream<TcpStream>, Box<dyn std::error::Error + Send + Sync>> {
|
||||
debug!("[livekit_proxy] connecting TCP to {}", remote_host);
|
||||
let tcp = timeout(limit, TcpStream::connect(remote_host))
|
||||
.await
|
||||
.map_err(|_| Box::<dyn std::error::Error + Send + Sync>::from("TCP connect timed out"))??;
|
||||
debug!(
|
||||
"[livekit_proxy] starting TLS handshake with {}",
|
||||
remote_host
|
||||
);
|
||||
let tls = timeout(limit, connector.connect(server_name, tcp))
|
||||
.await
|
||||
.map_err(|_| {
|
||||
Box::<dyn std::error::Error + Send + Sync>::from("TLS handshake timed out")
|
||||
})??;
|
||||
Ok(tls)
|
||||
}
|
||||
|
||||
/// Handle a single proxied connection:
|
||||
/// 1. Read the HTTP request headers from the local (plain) side
|
||||
/// 2. Rewrite Host/Origin so the remote server accepts the connection
|
||||
@@ -318,9 +428,9 @@ async fn handle_connection(
|
||||
Ok::<(), Box<dyn std::error::Error + Send + Sync>>(())
|
||||
})
|
||||
.await
|
||||
.map_err(|_| Box::<dyn std::error::Error + Send + Sync>::from(
|
||||
"upstream header read timed out",
|
||||
))??;
|
||||
.map_err(|_| {
|
||||
Box::<dyn std::error::Error + Send + Sync>::from("upstream header read timed out")
|
||||
})??;
|
||||
|
||||
// Reject CRLF in remote_host before header insertion (defense-in-depth;
|
||||
// primary validation is in start_livekit_proxy).
|
||||
@@ -335,19 +445,16 @@ async fn handle_connection(
|
||||
// ── 3. Connect to remote over TLS ────────────────────────────────────
|
||||
let tls_config = rustls::ClientConfig::builder()
|
||||
.dangerous()
|
||||
.with_custom_certificate_verifier(Arc::new(
|
||||
tofu::PinnedVerifier::new(pinned_fingerprint.to_string()),
|
||||
))
|
||||
.with_custom_certificate_verifier(Arc::new(tofu::PinnedVerifier::new(
|
||||
pinned_fingerprint.to_string(),
|
||||
)))
|
||||
.with_no_client_auth();
|
||||
|
||||
let connector = tokio_rustls::TlsConnector::from(Arc::new(tls_config));
|
||||
|
||||
let server_name = parse_server_name(remote_host)?;
|
||||
|
||||
debug!("[livekit_proxy] connecting TCP to {}", remote_host);
|
||||
let tcp = TcpStream::connect(remote_host).await?;
|
||||
debug!("[livekit_proxy] starting TLS handshake with {}", remote_host);
|
||||
let mut tls = connector.connect(server_name, tcp).await?;
|
||||
let mut tls = connect_tls(&connector, server_name, remote_host, PROXY_CONNECT_TIMEOUT).await?;
|
||||
debug!("[livekit_proxy] TLS handshake complete, forwarding traffic");
|
||||
|
||||
// ── 4. Forward request + bidirectional copy ──────────────────────────
|
||||
@@ -355,7 +462,10 @@ async fn handle_connection(
|
||||
let result = io::copy_bidirectional(&mut local, &mut tls).await;
|
||||
match result {
|
||||
Ok((to_remote, from_remote)) => {
|
||||
debug!("[livekit_proxy] connection closed: {}B sent, {}B received", to_remote, from_remote);
|
||||
debug!(
|
||||
"[livekit_proxy] connection closed: {}B sent, {}B received",
|
||||
to_remote, from_remote
|
||||
);
|
||||
}
|
||||
Err(e) => {
|
||||
debug!("[livekit_proxy] bidirectional copy ended: {}", e);
|
||||
@@ -401,7 +511,10 @@ mod tests {
|
||||
"example.com\nX-Injected: 1",
|
||||
"example.com\r",
|
||||
] {
|
||||
assert!(validate_remote_host(host).is_err(), "should reject {host:?}");
|
||||
assert!(
|
||||
validate_remote_host(host).is_err(),
|
||||
"should reject {host:?}"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -420,7 +533,10 @@ mod tests {
|
||||
"exa mple.com:443",
|
||||
"example.com;evil",
|
||||
] {
|
||||
assert!(validate_remote_host(host).is_err(), "should reject {host:?}");
|
||||
assert!(
|
||||
validate_remote_host(host).is_err(),
|
||||
"should reject {host:?}"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -431,6 +547,42 @@ mod tests {
|
||||
assert!(validate_remote_host("").is_ok());
|
||||
}
|
||||
|
||||
// ── can_reuse_proxy ─────────────────────────────────────────────────────
|
||||
|
||||
#[test]
|
||||
fn reuses_proxy_only_when_host_and_pin_are_unchanged() {
|
||||
assert!(can_reuse_proxy(
|
||||
"example.com:443",
|
||||
"aa:bb",
|
||||
"example.com:443",
|
||||
"aa:bb"
|
||||
));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn restarts_proxy_when_host_changes() {
|
||||
assert!(!can_reuse_proxy(
|
||||
"old.example:443",
|
||||
"aa:bb",
|
||||
"new.example:443",
|
||||
"aa:bb"
|
||||
));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn restarts_proxy_when_pin_changes() {
|
||||
// The user accepted a rotated cert (accept_cert_fingerprint rewrote the
|
||||
// store). The running listener still pins the old fingerprint, so every
|
||||
// connection through it would fail the TLS handshake — reuse must be
|
||||
// refused so the caller tears down and restarts with the new pin.
|
||||
assert!(!can_reuse_proxy(
|
||||
"example.com:443",
|
||||
"aa:bb",
|
||||
"example.com:443",
|
||||
"cc:dd"
|
||||
));
|
||||
}
|
||||
|
||||
// ── rewrite_proxy_headers ───────────────────────────────────────────────
|
||||
|
||||
#[test]
|
||||
@@ -558,4 +710,89 @@ mod tests {
|
||||
fn rejects_an_invalid_dns_name() {
|
||||
assert!(parse_server_name("not a hostname").is_err());
|
||||
}
|
||||
|
||||
// A peer that accepts the TCP connection and then answers nothing must not
|
||||
// hang the connection task forever — see connect_tls.
|
||||
#[tokio::test]
|
||||
async fn tls_handshake_is_bounded_by_its_timeout() {
|
||||
let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
|
||||
let addr = listener.local_addr().expect("local_addr");
|
||||
tokio::spawn(async move {
|
||||
let _accepted = listener.accept().await.expect("accept");
|
||||
// Hold the connection open, answering nothing.
|
||||
std::future::pending::<()>().await;
|
||||
});
|
||||
|
||||
let tls_config = rustls::ClientConfig::builder()
|
||||
.dangerous()
|
||||
.with_custom_certificate_verifier(Arc::new(tofu::PinnedVerifier::new(
|
||||
"aa:bb:cc".to_string(),
|
||||
)))
|
||||
.with_no_client_auth();
|
||||
let connector = tokio_rustls::TlsConnector::from(Arc::new(tls_config));
|
||||
let server_name = ServerName::try_from("localhost").expect("server name");
|
||||
|
||||
// The outer bound exists only so a regression fails fast instead of
|
||||
// hanging the suite; the assertion is that the inner limit fired.
|
||||
let outcome = timeout(
|
||||
Duration::from_secs(5),
|
||||
connect_tls(
|
||||
&connector,
|
||||
server_name,
|
||||
&addr.to_string(),
|
||||
Duration::from_millis(100),
|
||||
),
|
||||
)
|
||||
.await;
|
||||
|
||||
assert!(
|
||||
outcome.is_ok(),
|
||||
"connect_tls hung: the TLS handshake is not bounded by its own timeout"
|
||||
);
|
||||
assert!(
|
||||
outcome.expect("bounded").is_err(),
|
||||
"a silent peer must produce an error, not a usable TLS stream"
|
||||
);
|
||||
}
|
||||
|
||||
// ── LiveKitProxyState::clear_if_port_matches ────────────────────────────
|
||||
//
|
||||
// B4_conn_ipc-7: run_proxy_loop's accept-error exit path drops the
|
||||
// listener without deregistering it, so ProxyInner.port stays set and
|
||||
// start_livekit_proxy's reuse branch (unchanged host+pin) hands the dead
|
||||
// port back forever. Mirrors http_proxy.rs's
|
||||
// remove_if_port_matches_removes_only_matching_entry test.
|
||||
|
||||
#[tokio::test]
|
||||
async fn clear_if_port_matches_clears_only_a_matching_entry() {
|
||||
let state = LiveKitProxyState::new();
|
||||
{
|
||||
let (tx, _rx) = tokio::sync::oneshot::channel::<()>();
|
||||
let mut inner = state.inner.lock().await;
|
||||
inner.port = Some(4242);
|
||||
inner.remote_host = "example.com:8443".to_string();
|
||||
inner.pinned_fingerprint = "aa:bb".to_string();
|
||||
inner.shutdown_tx = Some(tx);
|
||||
}
|
||||
|
||||
// A stale loop reporting a port that no longer matches the live
|
||||
// listener must leave the current entry alone.
|
||||
state.clear_if_port_matches(9999).await;
|
||||
assert_eq!(
|
||||
state.inner.lock().await.port,
|
||||
Some(4242),
|
||||
"mismatched port must not clear a newer proxy's state"
|
||||
);
|
||||
|
||||
// A loop reporting its own still-current port must clear it so the
|
||||
// next start_livekit_proxy rebinds instead of reusing the dead listener.
|
||||
state.clear_if_port_matches(4242).await;
|
||||
let inner = state.inner.lock().await;
|
||||
assert_eq!(
|
||||
inner.port, None,
|
||||
"matching port must deregister the dead proxy"
|
||||
);
|
||||
assert!(inner.remote_host.is_empty());
|
||||
assert!(inner.pinned_fingerprint.is_empty());
|
||||
}
|
||||
}
|
||||
@@ -24,8 +24,7 @@ static PTT_VKEY: AtomicI32 = AtomicI32::new(0);
|
||||
/// therefore never reset the stop signal that an earlier thread's `join()` is
|
||||
/// still waiting on — the lost-signal race (ATOMICRACE-001) that a single
|
||||
/// shared flag allowed.
|
||||
static PTT_THREAD: Mutex<Option<(Arc<AtomicBool>, std::thread::JoinHandle<()>)>> =
|
||||
Mutex::new(None);
|
||||
static PTT_THREAD: Mutex<Option<(Arc<AtomicBool>, std::thread::JoinHandle<()>)>> = Mutex::new(None);
|
||||
|
||||
/// Returns true if a VK code is allowed for global capture in ptt_listen_for_key.
|
||||
///
|
||||
@@ -58,7 +57,7 @@ fn is_allowed_ptt_capture_vk(vk: i32) -> bool {
|
||||
0x2D | // Insert
|
||||
0x2E | // Delete
|
||||
0x05 | // Mouse X1
|
||||
0x06 // Mouse X2
|
||||
0x06 // Mouse X2
|
||||
)
|
||||
}
|
||||
|
||||
@@ -73,8 +72,7 @@ fn is_key_down(vk: i32) -> bool {
|
||||
return false;
|
||||
}
|
||||
// SAFETY: GetAsyncKeyState is safe to call with valid VK codes 1-254
|
||||
let state =
|
||||
unsafe { windows::Win32::UI::Input::KeyboardAndMouse::GetAsyncKeyState(vk) };
|
||||
let state = unsafe { windows::Win32::UI::Input::KeyboardAndMouse::GetAsyncKeyState(vk) };
|
||||
// High-order bit set (negative when interpreted as i16) = key is down
|
||||
(state as i16) < 0
|
||||
}
|
||||
@@ -101,7 +99,10 @@ fn is_key_down(vk: i32) -> bool {
|
||||
let Some(keycode) = linux::vk_to_keycode(vk) else {
|
||||
return false;
|
||||
};
|
||||
DEVICE_STATE.with(|ds| ds.as_ref().is_some_and(|ds| ds.get_keys().contains(&keycode)))
|
||||
DEVICE_STATE.with(|ds| {
|
||||
ds.as_ref()
|
||||
.is_some_and(|ds| ds.get_keys().contains(&keycode))
|
||||
})
|
||||
}
|
||||
|
||||
#[cfg(not(any(windows, target_os = "linux")))]
|
||||
@@ -298,10 +299,55 @@ mod linux {
|
||||
}
|
||||
}
|
||||
|
||||
/// Decide whether the polling loop must emit a `ptt-state` event this tick.
|
||||
///
|
||||
/// Returns `Some(new_state)` on a press/release edge, `None` when nothing
|
||||
/// changed.
|
||||
///
|
||||
/// The `vk == 0` (unbound) case is folded into `pressed` here rather than
|
||||
/// guarding the whole tick: clearing the binding while the key is physically
|
||||
/// held must still produce the `true -> false` falling edge. With the guard
|
||||
/// outside, `was_pressed` freezes at `true`, no final `ptt-state=false` is
|
||||
/// ever emitted, and the microphone stays published.
|
||||
fn ptt_transition(vk: i32, key_down: bool, was_pressed: bool) -> Option<bool> {
|
||||
let pressed = vk != 0 && key_down;
|
||||
(pressed != was_pressed).then_some(pressed)
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Tauri commands
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
/// Whether this platform can actually observe global key state, i.e. whether
|
||||
/// the polling loop can ever emit a `ptt-state` event.
|
||||
///
|
||||
/// `ptt_start` spawns its thread unconditionally, so a live thread is NOT
|
||||
/// evidence that PTT works: on macOS `is_key_down` is a compile-time stub that
|
||||
/// always returns false, and on a pure-Wayland Linux session
|
||||
/// `DeviceState::checked_new()` returns None. The frontend gates its join-time
|
||||
/// PTT mute on this, because muting at join where no event can ever arrive
|
||||
/// would close the microphone for the whole session with no way to reopen it.
|
||||
#[tauri::command]
|
||||
pub fn ptt_polling_supported() -> bool {
|
||||
#[cfg(windows)]
|
||||
{
|
||||
true
|
||||
}
|
||||
|
||||
#[cfg(target_os = "linux")]
|
||||
{
|
||||
use device_query::DeviceState;
|
||||
// Mirrors the availability check inside `is_key_down`: no reachable
|
||||
// X11/XWayland display means key state is never observable.
|
||||
DeviceState::checked_new().is_some()
|
||||
}
|
||||
|
||||
#[cfg(not(any(windows, target_os = "linux")))]
|
||||
{
|
||||
false
|
||||
}
|
||||
}
|
||||
|
||||
/// Start the PTT polling loop. Emits `ptt-state` (bool) events.
|
||||
///
|
||||
/// Uses `PTT_THREAD`'s Mutex as the critical section to prevent duplicate
|
||||
@@ -329,12 +375,14 @@ pub fn ptt_start<R: Runtime>(app: AppHandle<R>) {
|
||||
|
||||
while !thread_shutdown.load(Ordering::SeqCst) {
|
||||
let vk = PTT_VKEY.load(Ordering::SeqCst);
|
||||
if vk != 0 {
|
||||
let pressed = is_key_down(vk);
|
||||
if pressed != was_pressed {
|
||||
was_pressed = pressed;
|
||||
let _ = app.emit("ptt-state", pressed);
|
||||
}
|
||||
// Evaluated on every tick, including vk == 0: clearing the PTT
|
||||
// key while it is physically held must still produce a falling
|
||||
// edge, otherwise was_pressed freezes at true and the mic never
|
||||
// gets its final `ptt-state=false`. `is_key_down` short-circuits
|
||||
// to false for vk == 0 on every platform, so this costs nothing.
|
||||
if let Some(pressed) = ptt_transition(vk, is_key_down(vk), was_pressed) {
|
||||
was_pressed = pressed;
|
||||
let _ = app.emit("ptt-state", pressed);
|
||||
}
|
||||
std::thread::sleep(Duration::from_millis(20));
|
||||
}
|
||||
@@ -397,7 +445,9 @@ pub fn ptt_stop_internal() {
|
||||
#[tauri::command]
|
||||
pub fn ptt_set_key(vk_code: i32) -> Result<(), String> {
|
||||
if vk_code != 0 && !(1..=254).contains(&vk_code) {
|
||||
return Err(format!("invalid virtual key code: {vk_code} (must be 0 or 1-254)"));
|
||||
return Err(format!(
|
||||
"invalid virtual key code: {vk_code} (must be 0 or 1-254)"
|
||||
));
|
||||
}
|
||||
PTT_VKEY.store(vk_code, Ordering::SeqCst);
|
||||
Ok(())
|
||||
@@ -431,8 +481,7 @@ pub async fn ptt_listen_for_key() -> i32 {
|
||||
continue;
|
||||
}
|
||||
// Wait for key release (with its own timeout)
|
||||
let release_deadline =
|
||||
std::time::Instant::now() + Duration::from_secs(5);
|
||||
let release_deadline = std::time::Instant::now() + Duration::from_secs(5);
|
||||
while device_state.get_keys().contains(&key)
|
||||
&& std::time::Instant::now() < release_deadline
|
||||
{
|
||||
@@ -456,8 +505,7 @@ pub async fn ptt_listen_for_key() -> i32 {
|
||||
continue;
|
||||
}
|
||||
if is_key_down(vk) {
|
||||
let release_deadline =
|
||||
std::time::Instant::now() + Duration::from_secs(5);
|
||||
let release_deadline = std::time::Instant::now() + Duration::from_secs(5);
|
||||
while is_key_down(vk) && std::time::Instant::now() < release_deadline {
|
||||
std::thread::sleep(Duration::from_millis(20));
|
||||
}
|
||||
@@ -523,6 +571,35 @@ mod tests {
|
||||
assert!(g.is_none(), "slot must stay empty when nothing was running");
|
||||
}
|
||||
|
||||
// The loop must emit only on edges, never on every tick — a repeat emit
|
||||
// would re-run the mute logic (and its user-mute guard) 50x/second.
|
||||
#[test]
|
||||
fn ptt_transition_reports_edges_only() {
|
||||
assert_eq!(ptt_transition(0x41, true, false), Some(true), "rising edge");
|
||||
assert_eq!(ptt_transition(0x41, true, true), None, "still held");
|
||||
assert_eq!(
|
||||
ptt_transition(0x41, false, true),
|
||||
Some(false),
|
||||
"falling edge"
|
||||
);
|
||||
assert_eq!(ptt_transition(0x41, false, false), None, "still idle");
|
||||
}
|
||||
|
||||
// Regression for the "hot mic after Clear while the PTT key is held" bug:
|
||||
// clearing the binding (vk -> 0) with the key still physically down must
|
||||
// still yield the falling edge that emits the final ptt-state=false. The
|
||||
// old loop wrapped the whole comparison in `if vk != 0`, so this case
|
||||
// produced no transition at all and the mic stayed published.
|
||||
#[test]
|
||||
fn ptt_transition_emits_release_when_binding_cleared_while_key_held() {
|
||||
assert_eq!(ptt_transition(0, true, true), Some(false));
|
||||
// The release is reported once, then the unbound key stays quiet — an
|
||||
// unbound key must never read as pressed no matter what the raw
|
||||
// key-down probe says.
|
||||
assert_eq!(ptt_transition(0, true, false), None);
|
||||
assert_eq!(ptt_transition(0, false, false), None);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn allowed_capture_vk_accepts_safe_non_text_keys() {
|
||||
assert!(is_allowed_ptt_capture_vk(0x70)); // F1
|
||||
@@ -563,7 +640,11 @@ mod tests {
|
||||
];
|
||||
|
||||
for (keycode, vk) in cases {
|
||||
assert_eq!(keycode_to_vk(&keycode), vk, "keycode_to_vk failed for {keycode:?}");
|
||||
assert_eq!(
|
||||
keycode_to_vk(&keycode),
|
||||
vk,
|
||||
"keycode_to_vk failed for {keycode:?}"
|
||||
);
|
||||
assert_eq!(
|
||||
vk_to_keycode(vk),
|
||||
Some(keycode),
|
||||
+354
-21
@@ -92,6 +92,40 @@ const FALLBACK_BACKEND: Backend = Backend::EncryptedFile;
|
||||
/// secret — the caller's in-memory copy is all that is left, so the current
|
||||
/// session still works but nothing survives a restart.
|
||||
pub fn set(app: &AppHandle, account: &str, secret: &str) -> Result<Backend, String> {
|
||||
set_with(
|
||||
account,
|
||||
secret,
|
||||
keyring_set,
|
||||
keyring_get,
|
||||
keyring_delete,
|
||||
|acct, sec| set_fallback(app, acct, sec),
|
||||
// Best-effort here: the keyring copy just proved it round-trips, so
|
||||
// it is authoritative regardless of whether the stale fallback copy
|
||||
// actually got flushed off disk.
|
||||
|acct| {
|
||||
let _ = clear_fallback(app, acct);
|
||||
},
|
||||
)
|
||||
}
|
||||
|
||||
/// Core decision logic for [`set`], with the keyring and fallback operations
|
||||
/// injected so the branching is testable without a live OS credential store.
|
||||
fn set_with(
|
||||
account: &str,
|
||||
secret: &str,
|
||||
keyring_set: impl Fn(&str, &str) -> Result<(), String>,
|
||||
keyring_get: impl Fn(&str) -> Result<Option<String>, String>,
|
||||
keyring_delete: impl Fn(&str) -> Result<(), String>,
|
||||
fallback_set: impl FnOnce(&str, &str) -> Result<(), String>,
|
||||
fallback_clear: impl FnOnce(&str),
|
||||
) -> Result<Backend, String> {
|
||||
// Set only when the keyring write itself failed and a stale prior entry
|
||||
// needs to be purged — but not until the fallback write below has proven
|
||||
// it actually committed a replacement copy. Deleting eagerly here would,
|
||||
// if the fallback write also fails, destroy the only good copy of the
|
||||
// secret and leave nothing anywhere for it to hand off to.
|
||||
let mut purge_stale_keyring_after_fallback_commits = false;
|
||||
|
||||
match keyring_set(account, secret) {
|
||||
Ok(()) => match keyring_get(account) {
|
||||
// The normal path: written and read back byte-for-byte.
|
||||
@@ -99,7 +133,7 @@ pub fn set(app: &AppHandle, account: &str, secret: &str) -> Result<Backend, Stri
|
||||
// A machine that was previously degraded and has since been
|
||||
// fixed must not keep a stale ciphertext shadowing the real
|
||||
// store on the next read.
|
||||
clear_fallback(app, account);
|
||||
fallback_clear(account);
|
||||
return Ok(Backend::Keyring);
|
||||
}
|
||||
Ok(Some(_)) => {
|
||||
@@ -127,10 +161,32 @@ pub fn set(app: &AppHandle, account: &str, secret: &str) -> Result<Backend, Stri
|
||||
but the read-back failed: {e} — falling back"
|
||||
),
|
||||
},
|
||||
Err(e) => log::error!("{SERVICE}: credential store write failed for '{account}': {e}"),
|
||||
Err(e) => {
|
||||
log::error!("{SERVICE}: credential store write failed for '{account}': {e}");
|
||||
// An older secret may already sit in the keyring from a prior
|
||||
// successful write. get() reads the keyring first, so leaving
|
||||
// that stale entry in place would shadow the fresh secret parked
|
||||
// in the fallback below — mirrors the read-back-mismatch arm
|
||||
// above, which purges for the same reason. But the purge must
|
||||
// wait until fallback_set below has actually committed the
|
||||
// replacement: deleting now, before that write is known to
|
||||
// succeed, risks erasing the last good copy of the secret if the
|
||||
// fallback write fails too.
|
||||
purge_stale_keyring_after_fallback_commits = true;
|
||||
}
|
||||
}
|
||||
|
||||
fallback_set(account, secret)?;
|
||||
|
||||
if purge_stale_keyring_after_fallback_commits {
|
||||
if let Err(de) = keyring_delete(account) {
|
||||
log::warn!(
|
||||
"{SERVICE}: could not remove a stale keyring entry for '{account}' after a \
|
||||
failed write: {de}"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
set_fallback(app, account, secret)?;
|
||||
log::warn!(
|
||||
"{SERVICE}: account '{account}' is stored in the encrypted fallback file, not the OS \
|
||||
credential store. See docs/credential-storage.md"
|
||||
@@ -143,12 +199,34 @@ pub fn set(app: &AppHandle, account: &str, secret: &str) -> Result<Backend, Stri
|
||||
/// The OS credential store wins over the fallback file, so a machine that
|
||||
/// recovers goes back to the real store without any migration step.
|
||||
pub fn get(app: &AppHandle, account: &str) -> Result<Option<String>, String> {
|
||||
get_with(account, keyring_get, |acct| get_fallback(app, acct))
|
||||
}
|
||||
|
||||
/// Core decision logic for [`get`], with the keyring and fallback lookups
|
||||
/// injected so the branching is testable without a live OS credential store.
|
||||
fn get_with(
|
||||
account: &str,
|
||||
keyring_get: impl Fn(&str) -> Result<Option<String>, String>,
|
||||
get_fallback: impl Fn(&str) -> Option<String>,
|
||||
) -> Result<Option<String>, String> {
|
||||
match keyring_get(account) {
|
||||
Ok(Some(secret)) => return Ok(Some(secret)),
|
||||
Ok(None) => {}
|
||||
Err(e) => log::warn!("{SERVICE}: credential store read failed for '{account}': {e}"),
|
||||
Ok(Some(secret)) => Ok(Some(secret)),
|
||||
Ok(None) => Ok(get_fallback(account)),
|
||||
Err(e) => {
|
||||
log::warn!("{SERVICE}: credential store read failed for '{account}': {e}");
|
||||
// A read error must not collapse to "nothing stored": on a
|
||||
// healthy machine set() clears the fallback on every successful
|
||||
// write, so an empty fallback here is indistinguishable from
|
||||
// "never stored". Prefer a fallback copy if one exists; only
|
||||
// report "nothing" when both stores genuinely have nothing, and
|
||||
// otherwise propagate the error so the caller can tell a broken
|
||||
// store apart from first login.
|
||||
match get_fallback(account) {
|
||||
Some(secret) => Ok(Some(secret)),
|
||||
None => Err(e),
|
||||
}
|
||||
}
|
||||
}
|
||||
Ok(get_fallback(app, account))
|
||||
}
|
||||
|
||||
/// Remove `account` from every store. Absent entries are not an error.
|
||||
@@ -156,9 +234,23 @@ pub fn get(app: &AppHandle, account: &str) -> Result<Option<String>, String> {
|
||||
/// Both stores are cleared even if one errors: a delete that left the fallback
|
||||
/// copy behind would resurrect a "deleted" secret on the next read.
|
||||
pub fn delete(app: &AppHandle, account: &str) -> Result<(), String> {
|
||||
delete_with(account, keyring_delete, |acct| clear_fallback(app, acct))
|
||||
}
|
||||
|
||||
/// Core decision logic for [`delete`], with the keyring and fallback removals
|
||||
/// injected so the branching is testable without a live OS credential store.
|
||||
fn delete_with(
|
||||
account: &str,
|
||||
keyring_delete: impl Fn(&str) -> Result<(), String>,
|
||||
fallback_clear: impl FnOnce(&str) -> Result<(), String>,
|
||||
) -> Result<(), String> {
|
||||
let keyring_result = keyring_delete(account);
|
||||
clear_fallback(app, account);
|
||||
keyring_result
|
||||
// `Result::and`'s argument is evaluated eagerly, so `fallback_clear` runs
|
||||
// regardless of whether the keyring delete succeeded — both stores are
|
||||
// still cleared even if one errors. Whichever side failed is what gets
|
||||
// reported: a delete must not read as Ok(()) while either store still
|
||||
// holds the "deleted" secret.
|
||||
keyring_result.and(fallback_clear(account))
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
@@ -180,9 +272,10 @@ fn compiled_backend_persistence() -> (bool, &'static str) {
|
||||
CredentialPersistence::UntilDelete => (true, "persists until deleted (on disk)"),
|
||||
CredentialPersistence::UntilReboot => (false, "vanishes on reboot (kernel memory)"),
|
||||
CredentialPersistence::ProcessOnly => (false, "vanishes when the process exits"),
|
||||
CredentialPersistence::EntryOnly => {
|
||||
(false, "vanishes with the entry object (the in-memory mock store)")
|
||||
}
|
||||
CredentialPersistence::EntryOnly => (
|
||||
false,
|
||||
"vanishes with the entry object (the in-memory mock store)",
|
||||
),
|
||||
_ => (false, "unrecognized persistence class"),
|
||||
}
|
||||
}
|
||||
@@ -338,19 +431,27 @@ fn get_fallback(app: &AppHandle, account: &str) -> Option<String> {
|
||||
.ok()
|
||||
}
|
||||
|
||||
/// Drop any fallback copy of `account`. Best-effort: a failure here is logged,
|
||||
/// never propagated, because it must not mask the outcome of the real store.
|
||||
fn clear_fallback(app: &AppHandle, account: &str) {
|
||||
let Ok(store) = app.store(CREDENTIAL_FALLBACK_STORE) else {
|
||||
return;
|
||||
};
|
||||
/// Drop any fallback copy of `account`, flushing the removal to disk.
|
||||
///
|
||||
/// Returns the flush error to the caller instead of only logging it: a
|
||||
/// `delete()` that reported success while this failed to flush would leave
|
||||
/// the sealed secret on disk to resurrect the "deleted" credential on the
|
||||
/// next read. Callers where the keyring copy is authoritative (a `set()`
|
||||
/// recovering from a stale fallback) may still discard the `Err` themselves.
|
||||
fn clear_fallback(app: &AppHandle, account: &str) -> Result<(), String> {
|
||||
let store = app
|
||||
.store(CREDENTIAL_FALLBACK_STORE)
|
||||
.map_err(|e| format!("failed to open credential fallback store: {e}"))?;
|
||||
// `delete` reports whether a key was present; only flush when one was, so
|
||||
// the common healthy path does not rewrite the file on every save.
|
||||
if store.delete(account) {
|
||||
if let Err(e) = store.save() {
|
||||
log::warn!("failed to flush credential fallback removal for '{account}': {e}");
|
||||
return Err(format!(
|
||||
"failed to flush credential fallback removal for '{account}': {e}"
|
||||
));
|
||||
}
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
@@ -409,16 +510,248 @@ mod tests {
|
||||
|
||||
#[test]
|
||||
fn fallback_aad_is_account_specific() {
|
||||
assert_ne!(fallback_aad("host.example"), fallback_aad("identity:host.example"));
|
||||
assert_ne!(
|
||||
fallback_aad("host.example"),
|
||||
fallback_aad("identity:host.example")
|
||||
);
|
||||
assert_eq!(fallback_aad("host.example"), fallback_aad("host.example"));
|
||||
}
|
||||
|
||||
// -- get_with: finding "a keyring read error must not read as 'not stored'" --
|
||||
|
||||
#[test]
|
||||
fn get_with_falls_back_when_the_keyring_errors_but_the_fallback_has_a_copy() {
|
||||
let result = get_with(
|
||||
"identity:chat.example",
|
||||
|_| Err("keychain locked".to_string()),
|
||||
|_| Some("fallback-secret".to_string()),
|
||||
);
|
||||
assert_eq!(result, Ok(Some("fallback-secret".to_string())));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn get_with_propagates_the_keyring_error_when_the_fallback_is_also_empty() {
|
||||
// The bug: a keyring read failure must never be reported as "nothing
|
||||
// stored" (Ok(None)) when the fallback is empty too — that is
|
||||
// indistinguishable from first login, and the E2EE identity keypair
|
||||
// loader mints and publishes a brand-new identity key on exactly that
|
||||
// signal, invalidating every peer's TOFU pin.
|
||||
let result = get_with(
|
||||
"identity:chat.example",
|
||||
|_| Err("keychain locked".to_string()),
|
||||
|_| None,
|
||||
);
|
||||
assert_eq!(result, Err("keychain locked".to_string()));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn get_with_prefers_the_live_keyring_value_over_the_fallback() {
|
||||
let result = get_with(
|
||||
"acct",
|
||||
|_| Ok(Some("live".to_string())),
|
||||
|_| Some("stale".to_string()),
|
||||
);
|
||||
assert_eq!(result, Ok(Some("live".to_string())));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn get_with_uses_the_fallback_when_the_keyring_has_nothing_stored() {
|
||||
let result = get_with("acct", |_| Ok(None), |_| Some("fallback".to_string()));
|
||||
assert_eq!(result, Ok(Some("fallback".to_string())));
|
||||
}
|
||||
|
||||
// -- set_with: finding "a failed keyring write must not leave a stale entry" --
|
||||
|
||||
#[test]
|
||||
fn set_with_deletes_any_stale_keyring_entry_when_the_write_fails() {
|
||||
// The bug: a write failure with an older secret already sitting in
|
||||
// the keyring from a prior successful write must not leave that
|
||||
// stale entry in place — get() reads the keyring first, so it would
|
||||
// shadow the fresh secret parked in the fallback below forever.
|
||||
use std::cell::Cell;
|
||||
let delete_called = Cell::new(false);
|
||||
let result = set_with(
|
||||
"acct",
|
||||
"new-secret",
|
||||
|_, _| Err("write failed".to_string()),
|
||||
|_| panic!("keyring_get must not run after a failed write"),
|
||||
|_| {
|
||||
delete_called.set(true);
|
||||
Ok(())
|
||||
},
|
||||
|_, _| Ok(()),
|
||||
|_| {},
|
||||
);
|
||||
assert_eq!(result, Ok(FALLBACK_BACKEND));
|
||||
assert!(
|
||||
delete_called.get(),
|
||||
"a failed keyring write must delete any stale prior entry before falling back"
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn set_with_keeps_the_stale_keyring_entry_when_the_write_and_fallback_both_fail() {
|
||||
// The bug: a failed keyring write must not delete the existing
|
||||
// keyring entry before the fallback write it is handing off to has
|
||||
// actually committed. If the fallback write also fails, deleting
|
||||
// first destroys the only good copy of the secret and the caller
|
||||
// (e.g. save_identity_key) gets an Err with nothing left anywhere —
|
||||
// the next get() then returns Ok(None), indistinguishable from
|
||||
// first login.
|
||||
use std::cell::Cell;
|
||||
let delete_called = Cell::new(false);
|
||||
let result = set_with(
|
||||
"acct",
|
||||
"new-secret",
|
||||
|_, _| Err("write failed".to_string()),
|
||||
|_| panic!("keyring_get must not run after a failed write"),
|
||||
|_| {
|
||||
delete_called.set(true);
|
||||
Ok(())
|
||||
},
|
||||
|_, _| Err("fallback failed too".to_string()),
|
||||
|_| {},
|
||||
);
|
||||
assert!(result.is_err());
|
||||
assert!(
|
||||
!delete_called.get(),
|
||||
"a failed keyring write must not delete the existing entry until the fallback \
|
||||
write has actually committed a replacement copy"
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn set_with_returns_keyring_backend_when_the_write_round_trips() {
|
||||
use std::cell::Cell;
|
||||
let cleared = Cell::new(false);
|
||||
let result = set_with(
|
||||
"acct",
|
||||
"secret",
|
||||
|_, s| {
|
||||
assert_eq!(s, "secret");
|
||||
Ok(())
|
||||
},
|
||||
|_| Ok(Some("secret".to_string())),
|
||||
|_| panic!("must not delete a keyring entry that round-tripped"),
|
||||
|_, _| panic!("must not touch the fallback on a successful round trip"),
|
||||
|_| cleared.set(true),
|
||||
);
|
||||
assert_eq!(result, Ok(Backend::Keyring));
|
||||
assert!(
|
||||
cleared.get(),
|
||||
"a recovered machine must clear any stale fallback copy"
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn set_with_purges_the_keyring_entry_when_the_read_back_returns_a_different_secret() {
|
||||
// The bug: get() reads the keyring first, so a foreign value left in
|
||||
// place would shadow the fallback copy written below — handing the
|
||||
// caller an identity key whose public half was never published.
|
||||
use std::cell::Cell;
|
||||
let deleted = Cell::new(false);
|
||||
let fallback_written = Cell::new(false);
|
||||
let result = set_with(
|
||||
"acct",
|
||||
"mine",
|
||||
|_, _| Ok(()),
|
||||
|_| Ok(Some("someone-elses-secret".to_string())),
|
||||
|_| {
|
||||
deleted.set(true);
|
||||
Ok(())
|
||||
},
|
||||
|_, s| {
|
||||
assert_eq!(s, "mine");
|
||||
fallback_written.set(true);
|
||||
Ok(())
|
||||
},
|
||||
|_| panic!("must not clear the fallback copy it just wrote"),
|
||||
);
|
||||
assert_eq!(result, Ok(FALLBACK_BACKEND));
|
||||
assert!(
|
||||
deleted.get(),
|
||||
"a mismatched keyring entry must be purged, not left to shadow the fallback"
|
||||
);
|
||||
assert!(
|
||||
fallback_written.get(),
|
||||
"the secret must still land in the fallback"
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn set_with_falls_back_when_the_read_back_reports_no_entry() {
|
||||
// The shipped keyring-mock defect: set_password returns Ok(()) and the
|
||||
// very next get_password returns nothing. A write that does not read
|
||||
// back is not a write.
|
||||
use std::cell::Cell;
|
||||
let fallback_written = Cell::new(false);
|
||||
let result = set_with(
|
||||
"acct",
|
||||
"secret",
|
||||
|_, _| Ok(()),
|
||||
|_| Ok(None),
|
||||
|_| panic!("nothing round-tripped, so there is no entry to delete"),
|
||||
|_, s| {
|
||||
assert_eq!(s, "secret");
|
||||
fallback_written.set(true);
|
||||
Ok(())
|
||||
},
|
||||
|_| panic!("must not clear the fallback copy it just wrote"),
|
||||
);
|
||||
assert_eq!(result, Ok(FALLBACK_BACKEND));
|
||||
assert!(
|
||||
fallback_written.get(),
|
||||
"a write that does not read back must land in the fallback"
|
||||
);
|
||||
}
|
||||
|
||||
// -- delete_with: finding "delete must not report success while the
|
||||
// fallback copy survives on disk to resurrect a deleted secret" --
|
||||
|
||||
#[test]
|
||||
fn delete_with_propagates_a_fallback_flush_failure() {
|
||||
// The bug: a delete that removed the keyring entry but failed to
|
||||
// flush the fallback file's removal must not report Ok(()) — the
|
||||
// sealed secret is still on disk and comes back on the next launch.
|
||||
let result = delete_with("acct", |_| Ok(()), |_| Err("disk full".to_string()));
|
||||
assert_eq!(result, Err("disk full".to_string()));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn delete_with_clears_the_fallback_even_when_the_keyring_delete_fails() {
|
||||
use std::cell::Cell;
|
||||
let fallback_cleared = Cell::new(false);
|
||||
let result = delete_with(
|
||||
"acct",
|
||||
|_| Err("keyring delete failed".to_string()),
|
||||
|_| {
|
||||
fallback_cleared.set(true);
|
||||
Ok(())
|
||||
},
|
||||
);
|
||||
assert_eq!(result, Err("keyring delete failed".to_string()));
|
||||
assert!(
|
||||
fallback_cleared.get(),
|
||||
"delete must still clear the fallback even when the keyring delete errors"
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn delete_with_succeeds_when_both_stores_clear() {
|
||||
let result = delete_with("acct", |_| Ok(()), |_| Ok(()));
|
||||
assert_eq!(result, Ok(()));
|
||||
}
|
||||
|
||||
#[cfg(windows)]
|
||||
#[test]
|
||||
fn dpapi_round_trips_and_rejects_foreign_entropy() {
|
||||
let secret = b"eyJrdHkiOiJFQyIsImNydiI6IlAtMjU2In0";
|
||||
let blob = crate::dpapi::protect(secret, &fallback_aad("identity:a.example")).unwrap();
|
||||
assert_ne!(blob.as_slice(), secret.as_slice(), "blob must not be plaintext");
|
||||
assert_ne!(
|
||||
blob.as_slice(),
|
||||
secret.as_slice(),
|
||||
"blob must not be plaintext"
|
||||
);
|
||||
|
||||
let back = crate::dpapi::unprotect(&blob, &fallback_aad("identity:a.example")).unwrap();
|
||||
assert_eq!(back, secret);
|
||||
@@ -80,7 +80,12 @@ pub(crate) struct CaptureVerifier {
|
||||
impl CaptureVerifier {
|
||||
pub(crate) fn new() -> (Self, CapturedFingerprint) {
|
||||
let fp = Arc::new(std::sync::Mutex::new(None));
|
||||
(Self { captured: fp.clone() }, fp)
|
||||
(
|
||||
Self {
|
||||
captured: fp.clone(),
|
||||
},
|
||||
fp,
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -134,7 +139,9 @@ pub(crate) struct PinnedVerifier {
|
||||
|
||||
impl PinnedVerifier {
|
||||
pub(crate) fn new(expected_fingerprint: String) -> Self {
|
||||
Self { expected_fingerprint }
|
||||
Self {
|
||||
expected_fingerprint,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -203,7 +210,11 @@ impl HostScopedVerifier {
|
||||
)
|
||||
.build()
|
||||
.map_err(|e| format!("failed to build web-PKI verifier: {e}"))?;
|
||||
Ok(Self::with_default(pinned_host, expected_fingerprint, default))
|
||||
Ok(Self::with_default(
|
||||
pinned_host,
|
||||
expected_fingerprint,
|
||||
default,
|
||||
))
|
||||
}
|
||||
|
||||
/// Seam for tests: inject the verifier used for non-pinned hosts.
|
||||
@@ -247,11 +258,21 @@ impl rustls::client::danger::ServerCertVerifier for HostScopedVerifier {
|
||||
now: rustls::pki_types::UnixTime,
|
||||
) -> Result<rustls::client::danger::ServerCertVerified, rustls::Error> {
|
||||
if self.is_pinned_host(server_name) {
|
||||
self.pinned
|
||||
.verify_server_cert(end_entity, intermediates, server_name, ocsp_response, now)
|
||||
self.pinned.verify_server_cert(
|
||||
end_entity,
|
||||
intermediates,
|
||||
server_name,
|
||||
ocsp_response,
|
||||
now,
|
||||
)
|
||||
} else {
|
||||
self.default
|
||||
.verify_server_cert(end_entity, intermediates, server_name, ocsp_response, now)
|
||||
self.default.verify_server_cert(
|
||||
end_entity,
|
||||
intermediates,
|
||||
server_name,
|
||||
ocsp_response,
|
||||
now,
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -283,8 +304,39 @@ impl rustls::client::danger::ServerCertVerifier for HostScopedVerifier {
|
||||
/// Cert-store key for a host. Strips a default `:443` so the ws proxy (which
|
||||
/// keys off `wss://host` with no explicit 443) and the http/livekit proxies
|
||||
/// (which see `host:443`) resolve the SAME pin. Non-default ports are kept.
|
||||
/// Case-folded (DNS names are case-insensitive): the host reaches this from
|
||||
/// several places (a profile-entered host verbatim, a `wss://` URL, a URL
|
||||
/// parsed on the TS side, which lowercases) — without folding case here, two
|
||||
/// callers with the same server in different case would pin/read different
|
||||
/// entries, opening a second, unpinned proxy tunnel.
|
||||
///
|
||||
/// Also strips brackets from a *portless* bracketed IPv6 literal ("[::1]" →
|
||||
/// "::1"), after the `:443` strip above runs (so "[::1]:443" also unwraps).
|
||||
/// The ws proxy computes this key from a bracketed `wss://[::1]/...`
|
||||
/// authority (ws.ts's `bracketBareIPv6Host` has to bracket a bare IPv6 host
|
||||
/// for the URL to parse at all — see OC-0163), while the http/livekit proxies
|
||||
/// may see the bare or default-port-bracketed form of the very same server —
|
||||
/// without unwrapping here those resolve to different keys and the same
|
||||
/// server's certificate gets pinned (and re-confirmed by the user) twice. A
|
||||
/// *non-default* port keeps its brackets: "[::1]:8443" stays its own distinct
|
||||
/// key, matching how a plain "host:8443" is never collapsed into "host".
|
||||
pub(crate) fn cert_store_key(host: &str) -> String {
|
||||
host.strip_suffix(":443").unwrap_or(host).to_string()
|
||||
// Only strip a trailing ":443" when what's left is unambiguously a host
|
||||
// (no remaining colon) or a bracketed IPv6 literal (ends in `]`, as in
|
||||
// "[::1]:443"). Without this guard, a BARE IPv6 literal whose final
|
||||
// hextet is "443" — e.g. "fd00::443" — would have that hextet eaten as
|
||||
// if it were a port, truncating the address to "fd00:" and pinning the
|
||||
// same server under a different key than the ws/livekit proxies use for
|
||||
// the bracketed form of the same address (OC-0215).
|
||||
let stripped = match host.strip_suffix(":443") {
|
||||
Some(rest) if !rest.contains(':') || rest.ends_with(']') => rest,
|
||||
_ => host,
|
||||
};
|
||||
let unbracketed = stripped
|
||||
.strip_prefix('[')
|
||||
.and_then(|rest| rest.strip_suffix(']'))
|
||||
.unwrap_or(stripped);
|
||||
unbracketed.to_ascii_lowercase()
|
||||
}
|
||||
|
||||
/// Extract the host (with any non-default port) from a `wss://` URL.
|
||||
@@ -379,7 +431,9 @@ mod tests {
|
||||
fn decide_mismatch_when_pin_differs() {
|
||||
assert_eq!(
|
||||
decide(Some("aa:bb".into()), "cc:dd"),
|
||||
TofuOutcome::Mismatch { stored: "aa:bb".into() }
|
||||
TofuOutcome::Mismatch {
|
||||
stored: "aa:bb".into()
|
||||
}
|
||||
);
|
||||
}
|
||||
|
||||
@@ -390,10 +444,70 @@ mod tests {
|
||||
assert_eq!(cert_store_key("example.com:8443"), "example.com:8443");
|
||||
}
|
||||
|
||||
// OC-0163: ws_connect (via extract_host on a bracketed "wss://[::1]/..."
|
||||
// URL, once ws.ts brackets a bare IPv6 host to make it parse) and
|
||||
// start_http_proxy/start_livekit_proxy (which see the bare or
|
||||
// livekit-bracketed form of the SAME server) must resolve to the SAME
|
||||
// pin, or the user is prompted to accept the first-use certificate twice
|
||||
// for one server. A bracketed literal with a non-default port keeps its
|
||||
// own distinct key, matching the un-bracketed "host:port" behavior above.
|
||||
#[test]
|
||||
fn cert_store_key_treats_bracketed_and_bare_ipv6_as_the_same_host() {
|
||||
assert_eq!(
|
||||
cert_store_key("[2001:db8::1]"),
|
||||
cert_store_key("2001:db8::1")
|
||||
);
|
||||
assert_eq!(cert_store_key("2001:db8::1"), "2001:db8::1");
|
||||
assert_eq!(cert_store_key("[2001:db8::1]"), "2001:db8::1");
|
||||
// The default-port livekit form ("[host]:443") also collapses to the
|
||||
// same key as the portless forms above.
|
||||
assert_eq!(cert_store_key("[2001:db8::1]:443"), "2001:db8::1");
|
||||
// A non-default port keeps the brackets — it is a genuinely distinct
|
||||
// key from the default-port host, same as the plain "host:port" case.
|
||||
assert_eq!(cert_store_key("[2001:db8::1]:8443"), "[2001:db8::1]:8443");
|
||||
}
|
||||
|
||||
// OC-0215: a BARE (unbracketed) IPv6 literal whose final hextet happens to
|
||||
// be "443" must NOT have that hextet eaten by the ":443" default-port
|
||||
// strip — "fd00::443" is a whole address, not "fd00::" on port 443. The
|
||||
// http proxy passes bare hosts verbatim (http_proxy::split_host_port has
|
||||
// an explicit `!host.contains(':')` guard for exactly this reason), while
|
||||
// the ws/livekit proxies see the bracketed form of the same address. All
|
||||
// three MUST resolve to the same key or the same server's certificate is
|
||||
// pinned (and re-confirmed by the user) under two different entries.
|
||||
#[test]
|
||||
fn cert_store_key_does_not_truncate_bare_ipv6_ending_in_443() {
|
||||
assert_eq!(cert_store_key("fd00::443"), "fd00::443");
|
||||
// Must agree with the bracketed forms the ws/livekit proxies derive
|
||||
// for the very same server.
|
||||
assert_eq!(cert_store_key("fd00::443"), cert_store_key("[fd00::443]"));
|
||||
assert_eq!(
|
||||
cert_store_key("fd00::443"),
|
||||
cert_store_key("[fd00::443]:443")
|
||||
);
|
||||
}
|
||||
|
||||
// DNS names are case-insensitive, but a raw host string (a profile-entered
|
||||
// host, or one taken verbatim from a wss:// URL) is not normalized before
|
||||
// reaching here. Two call sites can derive the SAME host in different
|
||||
// case (e.g. login uses the host as typed, an attachment fetch resolves
|
||||
// it through URL parsing, which lowercases) — without folding case here,
|
||||
// they pin/read two different cert-store entries for the same server,
|
||||
// opening a second, unpinned proxy tunnel.
|
||||
#[test]
|
||||
fn cert_store_key_folds_case() {
|
||||
assert_eq!(cert_store_key("Example.COM"), "example.com");
|
||||
assert_eq!(cert_store_key("MyServer.LAN:8443"), "myserver.lan:8443");
|
||||
assert_eq!(cert_store_key("Example.COM:443"), "example.com");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn extract_host_variants() {
|
||||
assert_eq!(extract_host("wss://example.com/chat"), "example.com");
|
||||
assert_eq!(extract_host("wss://example.com:8443/chat"), "example.com:8443");
|
||||
assert_eq!(
|
||||
extract_host("wss://example.com:8443/chat"),
|
||||
"example.com:8443"
|
||||
);
|
||||
assert_eq!(extract_host("wss://example.com:443/chat"), "example.com");
|
||||
assert_eq!(extract_host("wss://example.com"), "example.com");
|
||||
assert_eq!(extract_host("example.com/path"), "example.com");
|
||||
@@ -409,6 +523,37 @@ mod tests {
|
||||
);
|
||||
}
|
||||
|
||||
// ── CaptureVerifier ──────────────────────────────────────────────────────
|
||||
|
||||
// The whole post-handshake TOFU pin depends on CaptureVerifier recording
|
||||
// the LEAF cert, not an intermediate — that's what the safety comment at
|
||||
// the top of the impl asserts. Prove it: feed it a leaf plus a different
|
||||
// intermediate and check which fingerprint lands in the shared cell.
|
||||
#[test]
|
||||
fn capture_verifier_records_leaf_not_intermediate() {
|
||||
use rustls::client::danger::ServerCertVerifier;
|
||||
|
||||
let (verifier, captured) = CaptureVerifier::new();
|
||||
let leaf = rustls::pki_types::CertificateDer::from(b"leaf-cert".to_vec());
|
||||
let intermediate = rustls::pki_types::CertificateDer::from(b"intermediate-cert".to_vec());
|
||||
let name = rustls::pki_types::ServerName::try_from("example.com".to_string()).unwrap();
|
||||
|
||||
let result = verifier.verify_server_cert(
|
||||
&leaf,
|
||||
&[intermediate],
|
||||
&name,
|
||||
&[],
|
||||
rustls::pki_types::UnixTime::since_unix_epoch(std::time::Duration::from_secs(0)),
|
||||
);
|
||||
|
||||
// Accepts unconditionally — the TOFU gate happens after the handshake.
|
||||
assert!(result.is_ok());
|
||||
assert_eq!(
|
||||
captured.lock().unwrap().as_deref(),
|
||||
Some(fingerprint_hex(b"leaf-cert").as_str())
|
||||
);
|
||||
}
|
||||
|
||||
// ── HostScopedVerifier ──────────────────────────────────────────────────
|
||||
|
||||
/// Stub for the non-pinned-host verifier: records nothing, just returns a
|
||||
@@ -461,7 +606,9 @@ mod tests {
|
||||
HostScopedVerifier::with_default(
|
||||
pinned_host.to_string(),
|
||||
fingerprint_hex(cert_bytes),
|
||||
Arc::new(StubVerifier { accept: stub_accepts }),
|
||||
Arc::new(StubVerifier {
|
||||
accept: stub_accepts,
|
||||
}),
|
||||
)
|
||||
}
|
||||
|
||||
@@ -14,23 +14,16 @@ const QUIT_ID: &str = "quit";
|
||||
pub fn create_tray<R: Runtime>(app: &tauri::AppHandle<R>) -> Result<(), tauri::Error> {
|
||||
let show_hide = MenuItem::with_id(app, SHOW_HIDE_ID, "Show/Hide", true, None::<&str>)?;
|
||||
|
||||
let status_online =
|
||||
MenuItem::with_id(app, STATUS_ONLINE_ID, "Online", true, None::<&str>)?;
|
||||
let status_online = MenuItem::with_id(app, STATUS_ONLINE_ID, "Online", true, None::<&str>)?;
|
||||
let status_idle = MenuItem::with_id(app, STATUS_IDLE_ID, "Idle", true, None::<&str>)?;
|
||||
let status_dnd = MenuItem::with_id(app, STATUS_DND_ID, "Do Not Disturb", true, None::<&str>)?;
|
||||
let status_offline =
|
||||
MenuItem::with_id(app, STATUS_OFFLINE_ID, "Offline", true, None::<&str>)?;
|
||||
let status_offline = MenuItem::with_id(app, STATUS_OFFLINE_ID, "Offline", true, None::<&str>)?;
|
||||
|
||||
let status_submenu = Submenu::with_items(
|
||||
app,
|
||||
"Status",
|
||||
true,
|
||||
&[
|
||||
&status_online,
|
||||
&status_idle,
|
||||
&status_dnd,
|
||||
&status_offline,
|
||||
],
|
||||
&[&status_online, &status_idle, &status_dnd, &status_offline],
|
||||
)?;
|
||||
|
||||
let quit = MenuItem::with_id(app, QUIT_ID, "Quit", true, None::<&str>)?;
|
||||
@@ -41,7 +34,11 @@ pub fn create_tray<R: Runtime>(app: &tauri::AppHandle<R>) -> Result<(), tauri::E
|
||||
let app_handle_menu = app.clone();
|
||||
|
||||
TrayIconBuilder::new()
|
||||
.icon(app.default_window_icon().cloned().unwrap_or_else(|| tauri::image::Image::new(&[], 1, 1)))
|
||||
.icon(
|
||||
app.default_window_icon()
|
||||
.cloned()
|
||||
.unwrap_or_else(|| tauri::image::Image::new(&[], 1, 1)),
|
||||
)
|
||||
.menu(&menu)
|
||||
.tooltip("OwnCord")
|
||||
.on_tray_icon_event(move |_tray, event| {
|
||||
+45
-9
@@ -1,5 +1,5 @@
|
||||
use std::sync::Arc;
|
||||
use serde::Serialize;
|
||||
use std::sync::Arc;
|
||||
use tauri::{AppHandle, Emitter};
|
||||
use tauri_plugin_updater::UpdaterExt;
|
||||
|
||||
@@ -23,9 +23,10 @@ struct DownloadProgress {
|
||||
|
||||
/// Extract the host (with port if non-443) from an https:// URL for cert store lookup.
|
||||
fn extract_host_for_cert_store(server_url: &str) -> Result<String, String> {
|
||||
let parsed = url::Url::parse(server_url)
|
||||
.map_err(|e| format!("failed to parse server URL: {e}"))?;
|
||||
let host = parsed.host_str()
|
||||
let parsed =
|
||||
url::Url::parse(server_url).map_err(|e| format!("failed to parse server URL: {e}"))?;
|
||||
let host = parsed
|
||||
.host_str()
|
||||
.ok_or_else(|| "server URL has no host".to_string())?;
|
||||
let port = parsed.port().unwrap_or(443);
|
||||
let raw = if port == 443 {
|
||||
@@ -41,7 +42,10 @@ fn extract_host_for_cert_store(server_url: &str) -> Result<String, String> {
|
||||
/// HTTP client also downloads the installer from GitHub, whose certificate
|
||||
/// must pass normal web-PKI validation instead (a client-wide pin would
|
||||
/// reject it and every install would fail).
|
||||
fn build_tls_config(app: &AppHandle, server_url: &str) -> Result<Option<rustls::ClientConfig>, String> {
|
||||
fn build_tls_config(
|
||||
app: &AppHandle,
|
||||
server_url: &str,
|
||||
) -> Result<Option<rustls::ClientConfig>, String> {
|
||||
let store_key = extract_host_for_cert_store(server_url)?;
|
||||
let fingerprint = load_stored_fingerprint(app, &store_key)?;
|
||||
match fingerprint {
|
||||
@@ -164,10 +168,7 @@ pub async fn check_client_update(
|
||||
/// The frontend should call `relaunch()` from @tauri-apps/plugin-process
|
||||
/// after this completes.
|
||||
#[tauri::command]
|
||||
pub async fn download_and_install_update(
|
||||
app: AppHandle,
|
||||
server_url: String,
|
||||
) -> Result<(), String> {
|
||||
pub async fn download_and_install_update(app: AppHandle, server_url: String) -> Result<(), String> {
|
||||
let updater = build_updater(&app, &server_url)?;
|
||||
|
||||
let update = updater
|
||||
@@ -220,4 +221,39 @@ mod tests {
|
||||
"https://chat.example.com:8443/api/v1/client-update/{{target}}-{{arch}}-{{bundle_type}}/0.0.0"
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn validate_server_url_rejects_unsafe_urls() {
|
||||
// build_updater() calls this first, so it is the only guard before the
|
||||
// updater downloads and runs an installer from this host.
|
||||
let scheme = "server_url must use https:// scheme";
|
||||
let userinfo = "server_url must not contain userinfo";
|
||||
for (url, want_err) in [
|
||||
("http://chat.example.com", scheme),
|
||||
("ftp://chat.example.com", scheme),
|
||||
("chat.example.com", scheme),
|
||||
// Case-sensitive on purpose: anything not literally https:// is out.
|
||||
("HTTPS://chat.example.com", scheme),
|
||||
("https://evil@chat.example.com", userinfo),
|
||||
("https://user:pass@chat.example.com", userinfo),
|
||||
("https://:pass@chat.example.com", userinfo),
|
||||
] {
|
||||
assert_eq!(
|
||||
validate_server_url(url),
|
||||
Err(want_err.to_string()),
|
||||
"expected {url} to be rejected"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn validate_server_url_accepts_plain_https() {
|
||||
for url in [
|
||||
"https://chat.example.com",
|
||||
"https://chat.example.com/",
|
||||
"https://chat.example.com:8443/",
|
||||
] {
|
||||
assert_eq!(validate_server_url(url), Ok(()), "expected {url} to pass");
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -13,6 +13,7 @@
|
||||
use futures_util::{SinkExt, StreamExt};
|
||||
use log::{debug, error, info, warn};
|
||||
use serde_json::Value;
|
||||
use std::sync::atomic::{AtomicU64, Ordering};
|
||||
use std::sync::Arc;
|
||||
use std::time::Duration;
|
||||
use tauri::{AppHandle, Emitter, Runtime};
|
||||
@@ -32,14 +33,68 @@ use crate::tofu::{self, TofuOutcome};
|
||||
/// into its closure and clear the sender even after a worker task panic.
|
||||
pub struct WsState {
|
||||
tx: Arc<Mutex<Option<mpsc::Sender<String>>>>,
|
||||
/// Bumped once per `ws_connect` attempt. The handshake can pend for up to
|
||||
/// CONNECT_TIMEOUT, and callers (profile switch) start a second connect
|
||||
/// without awaiting the first, so an attempt must prove it is still the
|
||||
/// current generation before it may touch the shared sender slot.
|
||||
generation: Arc<AtomicU64>,
|
||||
}
|
||||
|
||||
impl WsState {
|
||||
pub fn new() -> Self {
|
||||
Self {
|
||||
tx: Arc::new(Mutex::new(None)),
|
||||
generation: Arc::new(AtomicU64::new(0)),
|
||||
}
|
||||
}
|
||||
|
||||
/// Claim a generation for a new connection attempt, dropping any existing
|
||||
/// sender. Every later step of that attempt is conditional on this value
|
||||
/// still being current.
|
||||
async fn begin_connection(&self) -> u64 {
|
||||
let mut tx_lock = self.tx.lock().await;
|
||||
if tx_lock.is_some() {
|
||||
debug!("[ws_proxy] dropping existing connection");
|
||||
}
|
||||
*tx_lock = None;
|
||||
self.generation.fetch_add(1, Ordering::SeqCst) + 1
|
||||
}
|
||||
|
||||
/// Install `tx` as the live sender if `generation` is still current.
|
||||
/// Returns false when a newer `ws_connect` superseded this attempt.
|
||||
async fn install_sender(&self, generation: u64, tx: mpsc::Sender<String>) -> bool {
|
||||
// Checked under the slot lock so the decision and the write cannot be
|
||||
// split by a concurrent attempt.
|
||||
let mut tx_lock = self.tx.lock().await;
|
||||
if self.generation.load(Ordering::SeqCst) != generation {
|
||||
return false;
|
||||
}
|
||||
*tx_lock = Some(tx);
|
||||
true
|
||||
}
|
||||
}
|
||||
|
||||
/// Clear the live sender slot, but only if `my_generation` is still the
|
||||
/// current connection generation. Returns false when a newer `ws_connect`
|
||||
/// superseded this connection — that teardown must not clear the slot or
|
||||
/// announce a close. Ownership is proven by generation, NOT by holding a
|
||||
/// Sender clone: a clone kept alive in the monitor task would keep the
|
||||
/// outbound channel open, so the write task could never observe closure
|
||||
/// after `ws_disconnect` (circular wait — task, socket, and TLS session
|
||||
/// would all leak). `generation` only advances inside `begin_connection`
|
||||
/// while the slot lock is held, so checking it under the same lock makes
|
||||
/// the check-and-clear atomic with respect to new attempts.
|
||||
async fn clear_sender_if_current(
|
||||
slot: &Mutex<Option<mpsc::Sender<String>>>,
|
||||
generation: &AtomicU64,
|
||||
my_generation: u64,
|
||||
) -> bool {
|
||||
let mut tx_lock = slot.lock().await;
|
||||
if generation.load(Ordering::SeqCst) != my_generation {
|
||||
return false;
|
||||
}
|
||||
*tx_lock = None;
|
||||
true
|
||||
}
|
||||
|
||||
/// Single call site for ws-state events — keeps tauri-typegen from generating duplicates.
|
||||
@@ -69,14 +124,8 @@ pub async fn ws_connect<R: Runtime>(
|
||||
) -> Result<(), String> {
|
||||
info!("[ws_proxy] connecting to {}", url);
|
||||
|
||||
// Drop any existing connection
|
||||
{
|
||||
let mut tx_lock = state.tx.lock().await;
|
||||
if tx_lock.is_some() {
|
||||
debug!("[ws_proxy] dropping existing connection");
|
||||
}
|
||||
*tx_lock = None;
|
||||
}
|
||||
// Drop any existing connection and claim this attempt's generation.
|
||||
let my_generation = state.begin_connection().await;
|
||||
|
||||
// Only allow secure WebSocket connections
|
||||
if !url.starts_with("wss://") {
|
||||
@@ -95,20 +144,19 @@ pub async fn ws_connect<R: Runtime>(
|
||||
.with_custom_certificate_verifier(Arc::new(verifier))
|
||||
.with_no_client_auth();
|
||||
|
||||
let connector =
|
||||
tokio_tungstenite::Connector::Rustls(Arc::new(tls_config));
|
||||
let connector = tokio_tungstenite::Connector::Rustls(Arc::new(tls_config));
|
||||
|
||||
let connect_future = tokio_tungstenite::connect_async_tls_with_config(
|
||||
&url,
|
||||
None,
|
||||
false,
|
||||
Some(connector),
|
||||
);
|
||||
let connect_future =
|
||||
tokio_tungstenite::connect_async_tls_with_config(&url, None, false, Some(connector));
|
||||
|
||||
let (ws_stream, _response) = tokio::time::timeout(CONNECT_TIMEOUT, connect_future)
|
||||
.await
|
||||
.map_err(|_| {
|
||||
error!("[ws_proxy] connect timed out after {}s to {}", CONNECT_TIMEOUT.as_secs(), url);
|
||||
error!(
|
||||
"[ws_proxy] connect timed out after {}s to {}",
|
||||
CONNECT_TIMEOUT.as_secs(),
|
||||
url
|
||||
);
|
||||
format!("ws connect timed out after {}s", CONNECT_TIMEOUT.as_secs())
|
||||
})?
|
||||
.map_err(|e| {
|
||||
@@ -133,19 +181,28 @@ pub async fn ws_connect<R: Runtime>(
|
||||
match tofu::evaluate(&app, &host, &fingerprint)? {
|
||||
TofuOutcome::Trusted => {
|
||||
info!("[ws_proxy] TOFU check passed for {}", host);
|
||||
emit_cert_tofu(&app, serde_json::json!({
|
||||
"host": host,
|
||||
"fingerprint": fingerprint,
|
||||
"status": "trusted",
|
||||
}));
|
||||
emit_cert_tofu(
|
||||
&app,
|
||||
serde_json::json!({
|
||||
"host": host,
|
||||
"fingerprint": fingerprint,
|
||||
"status": "trusted",
|
||||
}),
|
||||
);
|
||||
}
|
||||
TofuOutcome::FirstUse => {
|
||||
info!("[ws_proxy] first-use cert for {} — awaiting user confirmation", host);
|
||||
emit_cert_tofu(&app, serde_json::json!({
|
||||
"host": host,
|
||||
"fingerprint": fingerprint,
|
||||
"status": "first_use",
|
||||
}));
|
||||
info!(
|
||||
"[ws_proxy] first-use cert for {} — awaiting user confirmation",
|
||||
host
|
||||
);
|
||||
emit_cert_tofu(
|
||||
&app,
|
||||
serde_json::json!({
|
||||
"host": host,
|
||||
"fingerprint": fingerprint,
|
||||
"status": "first_use",
|
||||
}),
|
||||
);
|
||||
// Do not open the socket: the user must confirm the fingerprint
|
||||
// (accept_cert_fingerprint) before anything is sent over it.
|
||||
return Err(format!(
|
||||
@@ -154,38 +211,47 @@ pub async fn ws_connect<R: Runtime>(
|
||||
}
|
||||
TofuOutcome::Mismatch { stored } => {
|
||||
let msg = tofu::mismatch_message(&host, &stored, &fingerprint);
|
||||
warn!("[ws_proxy] TOFU check FAILED for {} — certificate fingerprint mismatch", host);
|
||||
warn!(
|
||||
"[ws_proxy] TOFU check FAILED for {} — certificate fingerprint mismatch",
|
||||
host
|
||||
);
|
||||
debug!("[ws_proxy] TOFU detail: {}", msg);
|
||||
emit_cert_tofu(&app, serde_json::json!({
|
||||
"host": host,
|
||||
"fingerprint": fingerprint,
|
||||
"status": "mismatch",
|
||||
"message": msg,
|
||||
"storedFingerprint": stored,
|
||||
}));
|
||||
emit_cert_tofu(
|
||||
&app,
|
||||
serde_json::json!({
|
||||
"host": host,
|
||||
"fingerprint": fingerprint,
|
||||
"status": "mismatch",
|
||||
"message": msg,
|
||||
"storedFingerprint": stored,
|
||||
}),
|
||||
);
|
||||
// Reject the connection — do not proceed.
|
||||
return Err(msg);
|
||||
}
|
||||
}
|
||||
// ── End TOFU check ───────────────────────────────────────────────────
|
||||
|
||||
let (mut sink, mut stream) = ws_stream.split();
|
||||
|
||||
// Channel for JS → server messages (bounded for backpressure). The slot
|
||||
// gets the ONLY Sender: teardown ownership is proven by generation, so no
|
||||
// clone may outlive the slot — one would keep rx.recv() pending forever.
|
||||
let (tx, mut rx) = mpsc::channel::<String>(256);
|
||||
if !state.install_sender(my_generation, tx).await {
|
||||
info!("[ws_proxy] handshake superseded by a newer connect; dropping stale socket");
|
||||
return Err("superseded by a newer connection".into());
|
||||
}
|
||||
|
||||
info!("[ws_proxy] connected to {}", host);
|
||||
emit_ws_state(&app, "open");
|
||||
|
||||
let (mut sink, mut stream) = ws_stream.split();
|
||||
|
||||
// Channel for JS → server messages (bounded for backpressure)
|
||||
let (tx, mut rx) = mpsc::channel::<String>(256);
|
||||
{
|
||||
let mut tx_lock = state.tx.lock().await;
|
||||
*tx_lock = Some(tx);
|
||||
}
|
||||
|
||||
let app_read = app.clone();
|
||||
let app_state = app.clone();
|
||||
// Clone the Arc so the monitoring closure can clear tx on any exit path,
|
||||
// Clone the Arcs so the monitoring closure can clear tx on any exit path,
|
||||
// including worker task panics, without needing tauri::State.
|
||||
let tx_arc = Arc::clone(&state.tx);
|
||||
let generation_arc = Arc::clone(&state.generation);
|
||||
|
||||
// Single outer task owns a JoinSet containing read and write workers.
|
||||
// join_next() blocks until the first worker finishes (normally or via panic),
|
||||
@@ -242,14 +308,16 @@ pub async fn ws_connect<R: Runtime>(
|
||||
}
|
||||
|
||||
// Clear the sender so ws_send returns "not connected". This runs on
|
||||
// every exit path — normal close, graceful disconnect, and panic.
|
||||
{
|
||||
let mut tx_lock = tx_arc.lock().await;
|
||||
*tx_lock = None;
|
||||
// every exit path — normal close, graceful disconnect, and panic — but
|
||||
// only when this connection still owns the slot. Clearing
|
||||
// unconditionally would kill a newer connection's sender and tell JS
|
||||
// that the live connection had closed.
|
||||
if clear_sender_if_current(&tx_arc, &generation_arc, my_generation).await {
|
||||
// Always emit closed, even after a panic.
|
||||
emit_ws_state(&app_state, "closed");
|
||||
} else {
|
||||
debug!("[ws_proxy] superseded connection torn down; leaving live sender in place");
|
||||
}
|
||||
|
||||
// Always emit closed, even after a panic.
|
||||
emit_ws_state(&app_state, "closed");
|
||||
});
|
||||
|
||||
Ok(())
|
||||
@@ -257,10 +325,7 @@ pub async fn ws_connect<R: Runtime>(
|
||||
|
||||
/// Send a text message through the proxy WebSocket.
|
||||
#[tauri::command]
|
||||
pub async fn ws_send(
|
||||
state: tauri::State<'_, WsState>,
|
||||
message: String,
|
||||
) -> Result<(), String> {
|
||||
pub async fn ws_send(state: tauri::State<'_, WsState>, message: String) -> Result<(), String> {
|
||||
let tx_lock = state.tx.lock().await;
|
||||
if let Some(tx) = tx_lock.as_ref() {
|
||||
match tx.try_send(message) {
|
||||
@@ -281,8 +346,13 @@ pub async fn ws_send(
|
||||
/// Disconnect the proxy WebSocket.
|
||||
#[tauri::command]
|
||||
pub async fn ws_disconnect(state: tauri::State<'_, WsState>) -> Result<(), String> {
|
||||
let mut tx_lock = state.tx.lock().await;
|
||||
*tx_lock = None; // dropping the sender closes the channel → write task ends
|
||||
// begin_connection() both clears the sender slot (dropping it closes the
|
||||
// channel so the write task ends) AND bumps the generation counter, so a
|
||||
// handshake still pending from before this disconnect fails install_sender
|
||||
// instead of installing itself afterward — reusing the same invalidation
|
||||
// path a superseding connect() already has. The returned generation is
|
||||
// unused: nothing will ever install under it.
|
||||
state.begin_connection().await;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
@@ -336,8 +406,12 @@ pub fn accept_cert_fingerprint<R: Runtime>(
|
||||
// fingerprint would be trusted in-process even though it was never
|
||||
// persisted to certs.json.
|
||||
match old_value {
|
||||
Some(v) => { store.set(&host, v); }
|
||||
None => { let _ = store.delete(&host); }
|
||||
Some(v) => {
|
||||
store.set(&host, v);
|
||||
}
|
||||
None => {
|
||||
let _ = store.delete(&host);
|
||||
}
|
||||
}
|
||||
log::warn!("[ws_proxy] accept_cert_fingerprint: failed to persist pin for {host}: {e}");
|
||||
return Err(format!("failed to persist cert fingerprint: {e}"));
|
||||
@@ -427,4 +501,141 @@ mod tests {
|
||||
let bad = format!("é{}", &VALID[..93]);
|
||||
assert!(!is_valid_cert_fingerprint(&bad));
|
||||
}
|
||||
|
||||
// ── Connection-generation ownership of the shared sender slot ───────────
|
||||
//
|
||||
// A handshake pends up to CONNECT_TIMEOUT, and a profile switch starts a
|
||||
// second ws_connect without awaiting or cancelling the first, so two
|
||||
// attempts can be in flight over one slot. Mirrors the ptt.rs
|
||||
// ATOMICRACE-001 guard.
|
||||
|
||||
#[tokio::test]
|
||||
async fn superseded_connect_does_not_take_the_sender_slot() {
|
||||
let state = WsState::new();
|
||||
|
||||
// Connection A starts its handshake, then a profile switch starts B
|
||||
// while A is still pending.
|
||||
let gen_a = state.begin_connection().await;
|
||||
let gen_b = state.begin_connection().await;
|
||||
assert_ne!(gen_a, gen_b);
|
||||
|
||||
let (tx_b, _rx_b) = mpsc::channel::<String>(4);
|
||||
assert!(
|
||||
state.install_sender(gen_b, tx_b.clone()).await,
|
||||
"the current generation must be able to install"
|
||||
);
|
||||
|
||||
// A's handshake finally completes. Installing now would route the next
|
||||
// auth send to the stale host and drop B's sender, ending B's write task.
|
||||
let (tx_a, _rx_a) = mpsc::channel::<String>(4);
|
||||
assert!(
|
||||
!state.install_sender(gen_a, tx_a).await,
|
||||
"a superseded attempt must not take the slot"
|
||||
);
|
||||
|
||||
let slot = state.tx.lock().await;
|
||||
assert!(
|
||||
slot.as_ref().is_some_and(|t| t.same_channel(&tx_b)),
|
||||
"the live connection's sender must still be installed"
|
||||
);
|
||||
}
|
||||
|
||||
// ── Generation-owned teardown ───────────────────────────────────────────
|
||||
//
|
||||
// Teardown ownership must be provable WITHOUT holding a Sender clone: any
|
||||
// clone kept alive by the monitor task keeps the outbound channel open, so
|
||||
// after ws_disconnect drops the slot's sender the write task never sees
|
||||
// rx.recv() == None — writer, reader, and TLS socket all leak in a
|
||||
// circular wait (monitor waits on writer, writer waits on the monitor's
|
||||
// clone dropping).
|
||||
|
||||
#[tokio::test]
|
||||
async fn owning_teardown_clears_the_slot_by_generation() {
|
||||
let state = WsState::new();
|
||||
let my_generation = state.begin_connection().await;
|
||||
let (tx, _rx) = mpsc::channel::<String>(4);
|
||||
state.install_sender(my_generation, tx).await;
|
||||
|
||||
assert!(
|
||||
clear_sender_if_current(&state.tx, &state.generation, my_generation).await,
|
||||
"the owning connection must clear its slot without a Sender clone"
|
||||
);
|
||||
assert!(
|
||||
state.tx.lock().await.is_none(),
|
||||
"ws_send must report not-connected after a real close"
|
||||
);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn superseded_teardown_by_generation_leaves_the_live_sender() {
|
||||
let state = WsState::new();
|
||||
let gen_a = state.begin_connection().await;
|
||||
let (tx_a, _rx_a) = mpsc::channel::<String>(4);
|
||||
state.install_sender(gen_a, tx_a).await;
|
||||
|
||||
let gen_b = state.begin_connection().await;
|
||||
let (tx_b, _rx_b) = mpsc::channel::<String>(4);
|
||||
assert!(state.install_sender(gen_b, tx_b.clone()).await);
|
||||
|
||||
// A's monitor task tears down after B is live. Clearing here would
|
||||
// kill B's sender and emit "closed" while JS believes B is connected.
|
||||
assert!(
|
||||
!clear_sender_if_current(&state.tx, &state.generation, gen_a).await,
|
||||
"a superseded teardown must not clear the slot or announce a close"
|
||||
);
|
||||
let slot = state.tx.lock().await;
|
||||
assert!(
|
||||
slot.as_ref().is_some_and(|t| t.same_channel(&tx_b)),
|
||||
"the live connection's sender must survive a superseded teardown"
|
||||
);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn disconnect_closes_the_outbound_channel() {
|
||||
// ws_disconnect's contract (the comment at its *tx_lock = None):
|
||||
// dropping the slot's sender closes the channel so the write task
|
||||
// ends. That holds only while install_sender receives the ONLY
|
||||
// Sender — no teardown-ownership clone may exist.
|
||||
let state = WsState::new();
|
||||
let generation = state.begin_connection().await;
|
||||
let (tx, mut rx) = mpsc::channel::<String>(4);
|
||||
state.install_sender(generation, tx).await;
|
||||
|
||||
*state.tx.lock().await = None; // ws_disconnect
|
||||
|
||||
let got = tokio::time::timeout(Duration::from_secs(1), rx.recv())
|
||||
.await
|
||||
.expect("write task would hang forever: channel still open after disconnect");
|
||||
assert_eq!(
|
||||
got, None,
|
||||
"rx.recv() must yield None so the write task exits"
|
||||
);
|
||||
}
|
||||
|
||||
// B4_conn_ipc-9: ws_disconnect must invalidate an in-flight ws_connect
|
||||
// attempt, not just null the sender slot. A handshake can pend for up to
|
||||
// CONNECT_TIMEOUT (10s) past a disconnect (JS calls connect fire-and-
|
||||
// forget — logout during "connecting" is a real interleaving), and
|
||||
// install_sender checks generation alone, so a manual `*tx_lock = None`
|
||||
// leaves a "cancelled" connection free to install itself afterward and
|
||||
// spawn its worker tasks against a socket JS believes closed.
|
||||
#[tokio::test]
|
||||
async fn disconnect_invalidates_an_in_flight_connect_attempt() {
|
||||
let state = WsState::new();
|
||||
// A's handshake is in flight: generation claimed, sender not yet
|
||||
// installed (mirrors the pending window before install_sender runs).
|
||||
let gen_a = state.begin_connection().await;
|
||||
|
||||
// ws_disconnect fires while A is still mid-handshake — this is
|
||||
// ws_disconnect's real body (state.begin_connection().await).
|
||||
state.begin_connection().await;
|
||||
|
||||
// A's handshake finally completes and tries to install its sender.
|
||||
// It must be rejected: JS already believes the connection is closed.
|
||||
let (tx_a, _rx_a) = mpsc::channel::<String>(4);
|
||||
assert!(
|
||||
!state.install_sender(gen_a, tx_a).await,
|
||||
"a handshake pending during disconnect must not be able to install after it"
|
||||
);
|
||||
}
|
||||
}
|
||||
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"productName": "OwnCord",
|
||||
"version": "1.2.0-alpha.1",
|
||||
"version": "1.2.0-alpha.4",
|
||||
"identifier": "com.owncord.client",
|
||||
"build": {
|
||||
"frontendDist": "../dist",
|
||||
@@ -19,28 +19,19 @@
|
||||
"decorations": true,
|
||||
"resizable": true,
|
||||
"center": true,
|
||||
"additionalBrowserArgs": "--autoplay-policy=no-user-gesture-required --use-fake-ui-for-media-stream"
|
||||
"additionalBrowserArgs": "--disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --autoplay-policy=no-user-gesture-required --use-fake-ui-for-media-stream"
|
||||
}
|
||||
],
|
||||
"withGlobalTauri": false,
|
||||
"security": {
|
||||
"csp": "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; connect-src 'self' http://ipc.localhost https: wss: http://localhost:* ws://localhost:* http://127.0.0.1:* ws://127.0.0.1:*; img-src 'self' https: data:; media-src 'self' blob:; font-src 'self'; object-src 'none'; base-uri 'self'; frame-src https://www.youtube.com https://youtube.com; worker-src 'self' blob:"
|
||||
"csp": "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; connect-src 'self' http://ipc.localhost https: wss: http://localhost:* ws://localhost:* http://127.0.0.1:* ws://127.0.0.1:*; img-src 'self' blob: https: data:; media-src 'self' blob:; font-src 'self'; object-src 'none'; base-uri 'self'; frame-src https://www.youtube.com https://youtube.com; worker-src 'self' blob:"
|
||||
}
|
||||
},
|
||||
"bundle": {
|
||||
"active": true,
|
||||
"createUpdaterArtifacts": "v1Compatible",
|
||||
"targets": [
|
||||
"nsis",
|
||||
"appimage",
|
||||
"deb"
|
||||
],
|
||||
"icon": [
|
||||
"icons/32x32.png",
|
||||
"icons/128x128.png",
|
||||
"icons/128x128@2x.png",
|
||||
"icons/icon.ico"
|
||||
],
|
||||
"targets": ["nsis", "appimage", "deb"],
|
||||
"icon": ["icons/32x32.png", "icons/128x128.png", "icons/128x128@2x.png", "icons/icon.ico"],
|
||||
"linux": {
|
||||
"deb": {
|
||||
"depends": [
|
||||
@@ -65,12 +56,6 @@
|
||||
}
|
||||
},
|
||||
"plugins": {
|
||||
"tauri-typegen": {
|
||||
"project_path": ".",
|
||||
"output_path": "../src/generated",
|
||||
"validation_library": "none",
|
||||
"verbose": false
|
||||
},
|
||||
"updater": {
|
||||
"pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IEJCQkQ0NzM1MjkxRTlGQTIKUldTaW54NHBOVWU5dTRqYW0yalI5VTJBd0NXOUZwM2UrcDM4YkhCSmlMZWJKWWVXaGJWdHBaSHgK",
|
||||
"endpoints": [],
|
||||
|
Before Width: | Height: | Size: 5.8 KiB After Width: | Height: | Size: 5.8 KiB |
+12
-3
@@ -231,6 +231,10 @@ export function createMemberContextMenu(options: MemberContextMenuOptions): Cont
|
||||
);
|
||||
|
||||
const roleSub = createElement("div", { class: "context-menu__submenu" });
|
||||
// One guard across every option: `currentRole` only updates when the
|
||||
// member_update echoes, so without it a double-click (or a second option
|
||||
// clicked while the first PATCH is in flight) fires twice.
|
||||
let roleChangeRunning = false;
|
||||
for (const role of options.availableRoles) {
|
||||
const cls =
|
||||
role === options.currentRole
|
||||
@@ -240,9 +244,14 @@ export function createMemberContextMenu(options: MemberContextMenuOptions): Cont
|
||||
role,
|
||||
cls,
|
||||
() => {
|
||||
if (role !== options.currentRole) {
|
||||
void options.onChangeRole(role);
|
||||
}
|
||||
if (roleChangeRunning || role === options.currentRole) return;
|
||||
roleChangeRunning = true;
|
||||
roleOption.classList.add("context-menu__item--pending");
|
||||
const done = (): void => {
|
||||
roleChangeRunning = false;
|
||||
roleOption.classList.remove("context-menu__item--pending");
|
||||
};
|
||||
options.onChangeRole(role).then(done, done);
|
||||
},
|
||||
ac.signal,
|
||||
);
|
||||
+74
-6
@@ -8,6 +8,7 @@
|
||||
|
||||
import { createElement, setText, appendChildren } from "@lib/dom";
|
||||
import { createIcon } from "@lib/icons";
|
||||
import { applyDialogSemantics, focusDialog, trapFocus } from "@lib/a11y";
|
||||
import type { MountableComponent } from "@lib/safe-render";
|
||||
|
||||
export interface CertMismatchModalOptions {
|
||||
@@ -21,17 +22,27 @@ export interface CertMismatchModalOptions {
|
||||
export function createCertMismatchModal(options: CertMismatchModalOptions): MountableComponent {
|
||||
const { host, storedFingerprint, newFingerprint, onAccept, onReject } = options;
|
||||
let overlay: HTMLDivElement | null = null;
|
||||
let restoreFocus: (() => void) | null = null;
|
||||
const ac = new AbortController();
|
||||
|
||||
function mount(container: Element): void {
|
||||
overlay = createElement("div", { class: "modal-overlay visible" });
|
||||
|
||||
const modal = createElement("div", { class: "modal" });
|
||||
// Ids are unique per factory, not per instance — these three trust prompts
|
||||
// never stack with each other in practice.
|
||||
applyDialogSemantics(modal, { labelledBy: "cert-mismatch-title" });
|
||||
trapFocus(modal, ac.signal);
|
||||
|
||||
// Header
|
||||
const header = createElement("div", { class: "modal-header" });
|
||||
const title = createElement("h3", {}, "Certificate Warning");
|
||||
const closeBtn = createElement("button", { class: "modal-close", type: "button" });
|
||||
const title = createElement("h3", { id: "cert-mismatch-title" }, "Certificate Warning");
|
||||
const closeBtn = createElement("button", {
|
||||
class: "modal-close",
|
||||
type: "button",
|
||||
// Icon-only control — the aria-label is its entire accessible name.
|
||||
"aria-label": "Close",
|
||||
});
|
||||
closeBtn.textContent = "";
|
||||
closeBtn.appendChild(createIcon("x", 14));
|
||||
closeBtn.addEventListener("click", onReject, { signal: ac.signal });
|
||||
@@ -94,7 +105,18 @@ export function createCertMismatchModal(options: CertMismatchModalOptions): Moun
|
||||
{ signal: ac.signal },
|
||||
);
|
||||
|
||||
// Escape maps to reject because that is the fail-closed safe default
|
||||
// (Disconnect) — dismissing a trust prompt must never grant trust.
|
||||
document.addEventListener(
|
||||
"keydown",
|
||||
(e: KeyboardEvent) => {
|
||||
if (e.key === "Escape" && overlay?.isConnected === true) onReject();
|
||||
},
|
||||
{ signal: ac.signal },
|
||||
);
|
||||
|
||||
container.appendChild(overlay);
|
||||
restoreFocus = focusDialog(modal);
|
||||
}
|
||||
|
||||
function destroy(): void {
|
||||
@@ -103,6 +125,8 @@ export function createCertMismatchModal(options: CertMismatchModalOptions): Moun
|
||||
overlay.remove();
|
||||
overlay = null;
|
||||
}
|
||||
restoreFocus?.();
|
||||
restoreFocus = null;
|
||||
}
|
||||
|
||||
return { mount, destroy };
|
||||
@@ -124,15 +148,24 @@ export interface CertFirstUseModalOptions {
|
||||
export function createCertFirstUseModal(options: CertFirstUseModalOptions): MountableComponent {
|
||||
const { host, fingerprint, onAccept, onReject } = options;
|
||||
let overlay: HTMLDivElement | null = null;
|
||||
let restoreFocus: (() => void) | null = null;
|
||||
const ac = new AbortController();
|
||||
|
||||
function mount(container: Element): void {
|
||||
overlay = createElement("div", { class: "modal-overlay visible" });
|
||||
const modal = createElement("div", { class: "modal" });
|
||||
// Unique per factory, not per instance — the three trust prompts never
|
||||
// stack with each other in practice.
|
||||
applyDialogSemantics(modal, { labelledBy: "cert-first-use-title" });
|
||||
trapFocus(modal, ac.signal);
|
||||
|
||||
const header = createElement("div", { class: "modal-header" });
|
||||
const title = createElement("h3", {}, "New Server Certificate");
|
||||
const closeBtn = createElement("button", { class: "modal-close", type: "button" });
|
||||
const title = createElement("h3", { id: "cert-first-use-title" }, "New Server Certificate");
|
||||
const closeBtn = createElement("button", {
|
||||
class: "modal-close",
|
||||
type: "button",
|
||||
"aria-label": "Close",
|
||||
});
|
||||
closeBtn.textContent = "";
|
||||
closeBtn.appendChild(createIcon("x", 14));
|
||||
closeBtn.addEventListener("click", onReject, { signal: ac.signal });
|
||||
@@ -187,7 +220,18 @@ export function createCertFirstUseModal(options: CertFirstUseModalOptions): Moun
|
||||
{ signal: ac.signal },
|
||||
);
|
||||
|
||||
// Escape rejects (Cancel) — the fail-closed default: never trust a
|
||||
// certificate because the prompt was dismissed.
|
||||
document.addEventListener(
|
||||
"keydown",
|
||||
(e: KeyboardEvent) => {
|
||||
if (e.key === "Escape" && overlay?.isConnected === true) onReject();
|
||||
},
|
||||
{ signal: ac.signal },
|
||||
);
|
||||
|
||||
container.appendChild(overlay);
|
||||
restoreFocus = focusDialog(modal);
|
||||
}
|
||||
|
||||
function destroy(): void {
|
||||
@@ -196,6 +240,8 @@ export function createCertFirstUseModal(options: CertFirstUseModalOptions): Moun
|
||||
overlay.remove();
|
||||
overlay = null;
|
||||
}
|
||||
restoreFocus?.();
|
||||
restoreFocus = null;
|
||||
}
|
||||
|
||||
return { mount, destroy };
|
||||
@@ -223,15 +269,24 @@ export function createIdentityMismatchModal(
|
||||
): MountableComponent {
|
||||
const { username, fingerprint, onAccept, onReject } = options;
|
||||
let overlay: HTMLDivElement | null = null;
|
||||
let restoreFocus: (() => void) | null = null;
|
||||
const ac = new AbortController();
|
||||
|
||||
function mount(container: Element): void {
|
||||
overlay = createElement("div", { class: "modal-overlay visible" });
|
||||
const modal = createElement("div", { class: "modal" });
|
||||
// Unique per factory, not per instance — the three trust prompts never
|
||||
// stack with each other in practice.
|
||||
applyDialogSemantics(modal, { labelledBy: "identity-mismatch-title" });
|
||||
trapFocus(modal, ac.signal);
|
||||
|
||||
const header = createElement("div", { class: "modal-header" });
|
||||
const title = createElement("h3", {}, "Identity Warning");
|
||||
const closeBtn = createElement("button", { class: "modal-close", type: "button" });
|
||||
const title = createElement("h3", { id: "identity-mismatch-title" }, "Identity Warning");
|
||||
const closeBtn = createElement("button", {
|
||||
class: "modal-close",
|
||||
type: "button",
|
||||
"aria-label": "Close",
|
||||
});
|
||||
closeBtn.textContent = "";
|
||||
closeBtn.appendChild(createIcon("x", 14));
|
||||
closeBtn.addEventListener("click", onReject, { signal: ac.signal });
|
||||
@@ -287,7 +342,18 @@ export function createIdentityMismatchModal(
|
||||
{ signal: ac.signal },
|
||||
);
|
||||
|
||||
// Escape rejects (Cancel) — the fail-closed default: dismissing the
|
||||
// prompt must never re-pin the new identity key.
|
||||
document.addEventListener(
|
||||
"keydown",
|
||||
(e: KeyboardEvent) => {
|
||||
if (e.key === "Escape" && overlay?.isConnected === true) onReject();
|
||||
},
|
||||
{ signal: ac.signal },
|
||||
);
|
||||
|
||||
container.appendChild(overlay);
|
||||
restoreFocus = focusDialog(modal);
|
||||
}
|
||||
|
||||
function destroy(): void {
|
||||
@@ -296,6 +362,8 @@ export function createIdentityMismatchModal(
|
||||
overlay.remove();
|
||||
overlay = null;
|
||||
}
|
||||
restoreFocus?.();
|
||||
restoreFocus = null;
|
||||
}
|
||||
|
||||
return { mount, destroy };
|
||||
+150
-22
@@ -22,11 +22,11 @@ import { attachStreamPreview, attachScrollCollapse } from "@lib/streamPreview";
|
||||
import { showUserVolumeMenu } from "./channel-sidebar/volume-menu";
|
||||
import type { VoiceModMenuOptions } from "./channel-sidebar/volume-menu";
|
||||
import { attachChannelContextMenu, CHANNEL_MUTE_CHANGED } from "./channel-sidebar/context-menu";
|
||||
import { attachDragHandlers, releaseGlobalDragListeners } from "./channel-sidebar/drag-reorder";
|
||||
import { attachDragHandlers } from "./channel-sidebar/drag-reorder";
|
||||
import { rePinPeerIdentity } from "@lib/livekitSession";
|
||||
import { createIdentityMismatchModal } from "./CertMismatchModal";
|
||||
import { createLogger } from "@lib/logger";
|
||||
import { membersStore } from "@stores/members.store";
|
||||
import { membersStore, memberDisplayName } from "@stores/members.store";
|
||||
import { roleHasPermission, canManageChannels } from "@lib/permissions";
|
||||
import { Permission } from "@lib/types";
|
||||
import { importIdentityPublicKey, computeKeyFingerprint } from "@lib/e2eeCrypto";
|
||||
@@ -34,10 +34,11 @@ import { importIdentityPublicKey, computeKeyFingerprint } from "@lib/e2eeCrypto"
|
||||
const log = createLogger("ChannelSidebar");
|
||||
|
||||
/** Icon, color, and tooltip for a peer's E2EE identity verification badge
|
||||
* (F3 TOFU). The three states mirror the voice store's PeerVerification:
|
||||
* (F3 TOFU). The states mirror the voice store's PeerVerification:
|
||||
* a green shield-check when the announce signature verified against the pinned
|
||||
* key, a muted shield when the peer published no key (legacy), and a red
|
||||
* shield-alert when the delivered key differs from the pinned one. */
|
||||
* key, a muted shield when the peer published no key (legacy), a red
|
||||
* shield-alert when the delivered key differs from the pinned one, and an
|
||||
* amber shield-question when the local pin store could not be read (DC-08). */
|
||||
function verifyPresentation(v: PeerVerification): {
|
||||
icon: IconName;
|
||||
color: string;
|
||||
@@ -60,11 +61,26 @@ function verifyPresentation(v: PeerVerification): {
|
||||
title: "Identity key changed — click to review and re-pin",
|
||||
};
|
||||
}
|
||||
if (v.status === "unknown") {
|
||||
return {
|
||||
icon: "shield-question",
|
||||
color: "var(--yellow, #f0b232)",
|
||||
title:
|
||||
"Could not check this participant's identity — key storage is unavailable, " +
|
||||
"so they are blocked for E2EE until it recovers",
|
||||
};
|
||||
}
|
||||
// "unverified" — the remaining status: peer published no identity key (legacy).
|
||||
// No identity key means no safety number; the per-call session fingerprint
|
||||
// is the only value that can be compared out of band (OC-0003).
|
||||
return {
|
||||
icon: "shield",
|
||||
color: "var(--text-muted, #949ba4)",
|
||||
title: "Identity not verified — this participant published no key",
|
||||
title:
|
||||
"Identity not verified — this participant published no key." +
|
||||
(v.sessionFingerprint !== null
|
||||
? ` Session fingerprint (changes every call — not an identity): ${v.sessionFingerprint}`
|
||||
: ""),
|
||||
};
|
||||
}
|
||||
|
||||
@@ -84,7 +100,7 @@ function closeIdentityModal(): void {
|
||||
async function openIdentityMismatchModal(
|
||||
userId: number,
|
||||
username: string,
|
||||
signal: AbortSignal,
|
||||
lifetimeSignal: AbortSignal,
|
||||
): Promise<void> {
|
||||
closeIdentityModal();
|
||||
// Compute the newly-delivered key's fingerprint so the user can verify it
|
||||
@@ -101,8 +117,14 @@ async function openIdentityMismatchModal(
|
||||
log.warn("E2EE: could not compute changed-key fingerprint for re-pin modal", err);
|
||||
}
|
||||
}
|
||||
// The sidebar (or a newer open) may have superseded us during the async compute.
|
||||
if (signal.aborted) return;
|
||||
// The SIDEBAR (or a newer open) may have superseded us during the async
|
||||
// compute — but NOT a mere re-render: `lifetimeSignal` is the sidebar's own
|
||||
// factory-lifetime signal (aborted only in destroy()), not the per-render
|
||||
// one that renderChannels() replaces on every redraw (OC-0281). Binding this
|
||||
// check to the render signal made an unrelated re-render landing mid-compute
|
||||
// (a message in another channel, a peer toggling mute) turn the click into a
|
||||
// silent no-op.
|
||||
if (lifetimeSignal.aborted) return;
|
||||
closeIdentityModal();
|
||||
const modal = createIdentityMismatchModal({
|
||||
username,
|
||||
@@ -132,8 +154,10 @@ async function openIdentityMismatchModal(
|
||||
});
|
||||
modal.mount(document.body);
|
||||
activeIdentityModal = modal;
|
||||
// Close if the owning sidebar is destroyed while the modal is still open.
|
||||
signal.addEventListener("abort", closeIdentityModal, { once: true });
|
||||
// Close if the owning sidebar is destroyed while the modal is still open —
|
||||
// NOT on a re-render, which is why this is `lifetimeSignal` and not the
|
||||
// render-scoped signal (OC-0281).
|
||||
lifetimeSignal.addEventListener("abort", closeIdentityModal, { once: true });
|
||||
}
|
||||
|
||||
export interface ChannelReorderData {
|
||||
@@ -316,6 +340,7 @@ function buildVoiceModOptions(
|
||||
function renderVoiceChannelItem(
|
||||
channel: Channel,
|
||||
signal: AbortSignal,
|
||||
lifetimeSignal: AbortSignal,
|
||||
onVoiceJoin: (channelId: number) => void,
|
||||
onVoiceLeave: () => void,
|
||||
onWatchStream?: (userId: number) => void,
|
||||
@@ -397,7 +422,14 @@ function renderVoiceChannelItem(
|
||||
avatar.style.background = pickAvatarColor(user.username);
|
||||
row.appendChild(avatar);
|
||||
|
||||
const nameEl = createElement("span", { class: "vu-name" }, user.username || "Unknown");
|
||||
// Render the same identity a rename shows everywhere else (member list,
|
||||
// message rows, DM sidebar) — memberDisplayName prefers the nickname,
|
||||
// falling back to the username. Security-sensitive surfaces (the E2EE
|
||||
// mismatch modal, the moderation menu below) intentionally keep
|
||||
// rendering user.username instead, since a nickname is user-settable.
|
||||
const member = membersStore.getState().members.get(user.userId);
|
||||
const label = (member !== undefined ? memberDisplayName(member) : user.username) || "Unknown";
|
||||
const nameEl = createElement("span", { class: "vu-name" }, label);
|
||||
row.appendChild(nameEl);
|
||||
|
||||
if (user.camera) {
|
||||
@@ -439,6 +471,19 @@ function renderVoiceChannelItem(
|
||||
row.appendChild(muteIcon);
|
||||
}
|
||||
|
||||
// The local user's own session fingerprint (OC-0003): what a peer who
|
||||
// sees us as unverified compares against, so show it where it can be
|
||||
// read out. The local user is never in peerVerifications.
|
||||
const currentUser = getCurrentUser();
|
||||
const ownFingerprint = voiceStore.select((st) => st.localSessionFingerprint ?? null);
|
||||
if (currentUser !== null && currentUser.id === user.userId && ownFingerprint !== null) {
|
||||
const own = createElement("span", { class: "vu-verify vu-session-fp" });
|
||||
own.style.color = "var(--text-muted, #949ba4)";
|
||||
own.title = `Your session fingerprint (changes every call — not an identity): ${ownFingerprint}`;
|
||||
own.appendChild(createIcon("shield", 14));
|
||||
row.appendChild(own);
|
||||
}
|
||||
|
||||
// E2EE identity verification badge (F3 TOFU). Absent until the peer's
|
||||
// announce resolves; the local user is never in peerVerifications.
|
||||
const verification = getPeerVerification(user.userId);
|
||||
@@ -458,7 +503,16 @@ function renderVoiceChannelItem(
|
||||
"click",
|
||||
(e) => {
|
||||
e.stopPropagation();
|
||||
void openIdentityMismatchModal(user.userId, user.username || "Unknown", signal);
|
||||
// lifetimeSignal (not the per-render `signal`): the modal must
|
||||
// survive an unrelated re-render, and must not be silently
|
||||
// skipped by one landing during the async fingerprint compute
|
||||
// (OC-0281). The click listener itself stays on the per-render
|
||||
// `signal` so it dies with this row (OC-0229).
|
||||
void openIdentityMismatchModal(
|
||||
user.userId,
|
||||
user.username || "Unknown",
|
||||
lifetimeSignal,
|
||||
);
|
||||
},
|
||||
{ signal },
|
||||
);
|
||||
@@ -467,7 +521,6 @@ function renderVoiceChannelItem(
|
||||
}
|
||||
|
||||
// Right-click for per-user volume (skip for own user)
|
||||
const currentUser = getCurrentUser();
|
||||
if (currentUser === null || currentUser.id !== user.userId) {
|
||||
row.addEventListener(
|
||||
"contextmenu",
|
||||
@@ -479,7 +532,10 @@ function renderVoiceChannelItem(
|
||||
user.username || "Unknown",
|
||||
e.clientX,
|
||||
e.clientY,
|
||||
signal,
|
||||
// lifetimeSignal (not the per-render `signal`): the menu is
|
||||
// mounted on document.body, independent of this row's render,
|
||||
// and must not be torn down by an unrelated re-render (OC-0282).
|
||||
lifetimeSignal,
|
||||
buildVoiceModOptions(channel.id, user, onVoiceModerate),
|
||||
);
|
||||
},
|
||||
@@ -495,6 +551,11 @@ function renderVoiceChannelItem(
|
||||
// Don't trigger if the right-click menu is open
|
||||
if (e.button !== 0) return;
|
||||
e.stopPropagation();
|
||||
// Watching a stream needs a live LiveKit room -- join first, same
|
||||
// as the hover/focus preview's placeholder click below.
|
||||
if (voiceStore.getState().currentChannelId !== channel.id) {
|
||||
onVoiceJoin(channel.id);
|
||||
}
|
||||
const tileId = user.screenshare
|
||||
? user.userId + SCREENSHARE_TILE_ID_OFFSET
|
||||
: user.userId;
|
||||
@@ -543,6 +604,7 @@ function renderChannelItem(
|
||||
channel: Channel,
|
||||
isActive: boolean,
|
||||
signal: AbortSignal,
|
||||
lifetimeSignal: AbortSignal,
|
||||
onVoiceJoin: (channelId: number) => void,
|
||||
onVoiceLeave: () => void,
|
||||
onEditChannel?: (channel: Channel) => void,
|
||||
@@ -559,6 +621,7 @@ function renderChannelItem(
|
||||
el = renderVoiceChannelItem(
|
||||
channel,
|
||||
signal,
|
||||
lifetimeSignal,
|
||||
onVoiceJoin,
|
||||
onVoiceLeave,
|
||||
onWatchStream,
|
||||
@@ -567,9 +630,25 @@ function renderChannelItem(
|
||||
} else {
|
||||
el = renderTextChannelItem(channel, isActive, signal);
|
||||
}
|
||||
attachChannelContextMenu(el, channel, signal, onEditChannel, onDeleteChannel, onPurgeChannel);
|
||||
attachChannelContextMenu(
|
||||
el,
|
||||
channel,
|
||||
signal,
|
||||
lifetimeSignal,
|
||||
onEditChannel,
|
||||
onDeleteChannel,
|
||||
onPurgeChannel,
|
||||
);
|
||||
if (containerEl !== undefined && channels !== undefined) {
|
||||
attachDragHandlers(el, channel, containerEl, channels, signal, onReorderChannel);
|
||||
attachDragHandlers(
|
||||
el,
|
||||
channel,
|
||||
containerEl,
|
||||
channels,
|
||||
signal,
|
||||
lifetimeSignal,
|
||||
onReorderChannel,
|
||||
);
|
||||
}
|
||||
return el;
|
||||
}
|
||||
@@ -579,6 +658,7 @@ function renderCategoryGroup(
|
||||
channels: readonly Channel[],
|
||||
activeChannelId: number | null,
|
||||
signal: AbortSignal,
|
||||
lifetimeSignal: AbortSignal,
|
||||
onVoiceJoin: (channelId: number) => void,
|
||||
onVoiceLeave: () => void,
|
||||
onCreateChannel?: (category: string) => void,
|
||||
@@ -649,6 +729,7 @@ function renderCategoryGroup(
|
||||
ch,
|
||||
ch.id === activeChannelId,
|
||||
signal,
|
||||
lifetimeSignal,
|
||||
onVoiceJoin,
|
||||
onVoiceLeave,
|
||||
onEditChannel,
|
||||
@@ -673,6 +754,7 @@ function renderCategoryGroup(
|
||||
ch,
|
||||
ch.id === activeChannelId,
|
||||
signal,
|
||||
lifetimeSignal,
|
||||
onVoiceJoin,
|
||||
onVoiceLeave,
|
||||
onEditChannel,
|
||||
@@ -705,6 +787,17 @@ export function createChannelSidebar(options: ChannelSidebarOptions): MountableC
|
||||
onPurgeChannel,
|
||||
} = options;
|
||||
const ac = new AbortController();
|
||||
// renderChannels() rebuilds every row from scratch on every channels-store
|
||||
// notification (unread count, active channel, role change, mute toggle,
|
||||
// ...). Per-row listeners (context menu, drag handlers) must NOT be
|
||||
// registered on the sidebar-lifetime `ac.signal`, which only aborts once,
|
||||
// at destroy() -- addEventListener({ signal }) keeps a detached row alive
|
||||
// via that signal's own retained "abort" listener list until it fires, so
|
||||
// every re-render would otherwise leak one full set of detached rows
|
||||
// (OC-0229). renderAc is aborted and replaced at the top of every
|
||||
// renderChannels() call, so only the CURRENT render's rows stay reachable;
|
||||
// header/root listeners registered once in mount() keep using `ac.signal`.
|
||||
let renderAc: AbortController | null = null;
|
||||
let root: HTMLDivElement | null = null;
|
||||
let channelList: HTMLDivElement | null = null;
|
||||
let serverNameEl: HTMLSpanElement | null = null;
|
||||
@@ -738,6 +831,12 @@ export function createChannelSidebar(options: ChannelSidebarOptions): MountableC
|
||||
if (channelList === null) {
|
||||
return;
|
||||
}
|
||||
// Abort the previous render's row-scoped listeners before the rows they
|
||||
// belong to are detached below, so a stale row can never outlive the
|
||||
// render that replaced it (OC-0229).
|
||||
renderAc?.abort();
|
||||
const currentRenderAc = new AbortController();
|
||||
renderAc = currentRenderAc;
|
||||
clearChildren(channelList);
|
||||
voiceRowByUserId.clear();
|
||||
|
||||
@@ -763,6 +862,11 @@ export function createChannelSidebar(options: ChannelSidebarOptions): MountableC
|
||||
category,
|
||||
channels,
|
||||
state.activeChannelId,
|
||||
currentRenderAc.signal,
|
||||
// Sidebar-lifetime signal (aborted only in destroy()) for anything
|
||||
// that owns DOM mounted outside this render's rows -- a menu or
|
||||
// modal on document.body must not be torn down by an unrelated
|
||||
// re-render (OC-0281, OC-0282).
|
||||
ac.signal,
|
||||
onVoiceJoin,
|
||||
onVoiceLeave,
|
||||
@@ -851,6 +955,24 @@ export function createChannelSidebar(options: ChannelSidebarOptions): MountableC
|
||||
);
|
||||
unsubscribers.push(unsubAuth);
|
||||
|
||||
// canManageChannels()/canModerateVoice() read authStore.user.role and
|
||||
// channelsStore.roles at render time, but nothing above re-renders when
|
||||
// either changes on its own — a MEMBER_UPDATE for the signed-in user
|
||||
// (dispatcher.ts's self-branch) or a ROLES_UPDATE permission-mask edit
|
||||
// would otherwise leave the category "+", the channel context menu and
|
||||
// the voice-moderation menu stale until an unrelated channel/voice event
|
||||
// happened to fire renderChannels() (OC-0142).
|
||||
const unsubRole = authStore.subscribeSelector(
|
||||
(s) => s.user?.role ?? "",
|
||||
() => renderChannels(),
|
||||
);
|
||||
unsubscribers.push(unsubRole);
|
||||
const unsubRoles = channelsStore.subscribeSelector(
|
||||
(s) => s.roles,
|
||||
() => renderChannels(),
|
||||
);
|
||||
unsubscribers.push(unsubRoles);
|
||||
|
||||
// Subscribe to UI store for category collapse changes
|
||||
const unsubUi = uiStore.subscribeSelector(
|
||||
(s) => s.collapsedCategories,
|
||||
@@ -875,14 +997,17 @@ export function createChannelSidebar(options: ChannelSidebarOptions): MountableC
|
||||
// kills hover) and never pays a per-user querySelector.
|
||||
const unsubVoiceStructure = voiceStore.subscribeSelector(
|
||||
(state) => {
|
||||
let structSig = String(state.currentChannelId ?? "");
|
||||
let structSig = `${state.currentChannelId ?? ""}#${state.localSessionFingerprint ?? ""}`;
|
||||
for (const [chId, users] of state.voiceUsers) {
|
||||
structSig += `|${chId}`;
|
||||
for (const [uid, u] of users) {
|
||||
// Include the E2EE verification status so a verified↔unverified↔mismatch
|
||||
// flip re-renders the badge (it lives outside voiceUsers, in peerVerifications).
|
||||
// Include the E2EE verification status, safety number, and session
|
||||
// fingerprint so a verified↔unverified↔mismatch flip *and* a
|
||||
// same-status fingerprint/safety-number change (e.g. a reconnect that
|
||||
// re-announces a fresh ephemeral key, OC-0208) both re-render the
|
||||
// badge (it lives outside voiceUsers, in peerVerifications).
|
||||
const verif = state.peerVerifications?.get(uid);
|
||||
structSig += `:${uid}${u.muted ? "m" : ""}${u.deafened ? "d" : ""}${u.camera ? "c" : ""}${u.screenshare ? "s" : ""}${u.serverMuted === true ? "M" : ""}${u.serverDeafened === true ? "D" : ""}${verif ? `@${verif.status}` : ""}`;
|
||||
structSig += `:${uid}${u.muted ? "m" : ""}${u.deafened ? "d" : ""}${u.camera ? "c" : ""}${u.screenshare ? "s" : ""}${u.serverMuted === true ? "M" : ""}${u.serverDeafened === true ? "D" : ""}${verif ? `@${verif.status}/${verif.safetyNumber ?? ""}/${verif.sessionFingerprint ?? ""}` : ""}`;
|
||||
}
|
||||
}
|
||||
return structSig;
|
||||
@@ -907,8 +1032,11 @@ export function createChannelSidebar(options: ChannelSidebarOptions): MountableC
|
||||
}
|
||||
|
||||
function destroy(): void {
|
||||
// ac.abort() also releases this sidebar's hold on the shared document-level
|
||||
// drag listeners (drag-reorder.ts tracks owners by signal).
|
||||
ac.abort();
|
||||
releaseGlobalDragListeners(channelList ?? undefined);
|
||||
renderAc?.abort();
|
||||
renderAc = null;
|
||||
for (const unsub of unsubscribers) {
|
||||
unsub();
|
||||
}
|
||||
+29
-1
@@ -11,6 +11,7 @@
|
||||
* under every category — the server agrees (it validates the type alone).
|
||||
*/
|
||||
|
||||
import { applyDialogSemantics, focusDialog, trapFocus } from "@lib/a11y";
|
||||
import { createElement, setText, appendChildren } from "@lib/dom";
|
||||
import { createIcon } from "@lib/icons";
|
||||
import type { MountableComponent } from "@lib/safe-render";
|
||||
@@ -44,6 +45,7 @@ export function createCreateChannelModal(options: CreateChannelModalOptions): Mo
|
||||
const { category, onCreate, onClose } = options;
|
||||
const ac = new AbortController();
|
||||
let overlay: HTMLDivElement | null = null;
|
||||
let restoreFocus: (() => void) | null = null;
|
||||
|
||||
function mount(container: Element): void {
|
||||
overlay = createElement("div", {
|
||||
@@ -52,13 +54,17 @@ export function createCreateChannelModal(options: CreateChannelModalOptions): Mo
|
||||
});
|
||||
|
||||
const modal = createElement("div", { class: "modal" });
|
||||
applyDialogSemantics(modal, { labelledBy: "create-channel-title" });
|
||||
trapFocus(modal, ac.signal);
|
||||
|
||||
// Header
|
||||
const header = createElement("div", { class: "modal-header" });
|
||||
const title = createElement("h3", {}, "Create Channel");
|
||||
const title = createElement("h3", { id: "create-channel-title" }, "Create Channel");
|
||||
// Icon-only button: without a label a screen reader announces just "button".
|
||||
const closeBtn = createElement("button", {
|
||||
class: "modal-close",
|
||||
type: "button",
|
||||
"aria-label": "Close",
|
||||
});
|
||||
closeBtn.textContent = "";
|
||||
closeBtn.appendChild(createIcon("x", 14));
|
||||
@@ -188,8 +194,25 @@ export function createCreateChannelModal(options: CreateChannelModalOptions): Mo
|
||||
{ signal: ac.signal },
|
||||
);
|
||||
|
||||
// Escape cancels — never creates. Document-level so it works wherever
|
||||
// focus sits; guarded on the overlay still being attached because the
|
||||
// listener lives until destroy() aborts it.
|
||||
document.addEventListener(
|
||||
"keydown",
|
||||
(e: KeyboardEvent) => {
|
||||
if (e.key === "Escape" && overlay?.isConnected === true) {
|
||||
onClose();
|
||||
}
|
||||
},
|
||||
{ signal: ac.signal },
|
||||
);
|
||||
|
||||
container.appendChild(overlay);
|
||||
|
||||
// Capture where focus came from before anything inside the dialog takes
|
||||
// it, so destroy() can hand it back to the opener.
|
||||
restoreFocus = focusDialog(modal);
|
||||
|
||||
// Focus the name input
|
||||
nameInput.focus();
|
||||
}
|
||||
@@ -200,6 +223,11 @@ export function createCreateChannelModal(options: CreateChannelModalOptions): Mo
|
||||
overlay.remove();
|
||||
overlay = null;
|
||||
}
|
||||
// Every close path (X, Cancel, backdrop, Escape) funnels through the
|
||||
// caller's onClose, which calls destroy() — the single place focus
|
||||
// returns to the opener.
|
||||
restoreFocus?.();
|
||||
restoreFocus = null;
|
||||
}
|
||||
|
||||
return { mount, destroy };
|
||||
+37
-3
@@ -3,6 +3,7 @@
|
||||
* Shows channel name and requires explicit confirmation.
|
||||
*/
|
||||
|
||||
import { applyDialogSemantics, focusDialog, trapFocus } from "@lib/a11y";
|
||||
import { createElement, setText, appendChildren } from "@lib/dom";
|
||||
import { createIcon } from "@lib/icons";
|
||||
import type { MountableComponent } from "@lib/safe-render";
|
||||
@@ -18,6 +19,7 @@ export function createDeleteChannelModal(options: DeleteChannelModalOptions): Mo
|
||||
const { channelName, onConfirm, onClose } = options;
|
||||
const ac = new AbortController();
|
||||
let overlay: HTMLDivElement | null = null;
|
||||
let restoreFocus: (() => void) | null = null;
|
||||
|
||||
function mount(container: Element): void {
|
||||
overlay = createElement("div", {
|
||||
@@ -26,13 +28,17 @@ export function createDeleteChannelModal(options: DeleteChannelModalOptions): Mo
|
||||
});
|
||||
|
||||
const modal = createElement("div", { class: "modal" });
|
||||
applyDialogSemantics(modal, { labelledBy: "delete-channel-title" });
|
||||
trapFocus(modal, ac.signal);
|
||||
|
||||
// Header
|
||||
const header = createElement("div", { class: "modal-header" });
|
||||
const title = createElement("h3", {}, "Delete Channel");
|
||||
const title = createElement("h3", { id: "delete-channel-title" }, "Delete Channel");
|
||||
// Icon-only button: without a label a screen reader announces just "button".
|
||||
const closeBtn = createElement("button", {
|
||||
class: "modal-close",
|
||||
type: "button",
|
||||
"aria-label": "Close",
|
||||
});
|
||||
closeBtn.textContent = "";
|
||||
closeBtn.appendChild(createIcon("x", 14));
|
||||
@@ -87,8 +93,14 @@ export function createDeleteChannelModal(options: DeleteChannelModalOptions): Mo
|
||||
} catch (err) {
|
||||
errorEl.style.display = "block";
|
||||
setText(errorEl, err instanceof Error ? err.message : "Failed to delete channel");
|
||||
deleteBtn.removeAttribute("disabled");
|
||||
setText(deleteBtn, "Delete Channel");
|
||||
} finally {
|
||||
// Re-arm the button whether the caller rejected or handled the
|
||||
// failure itself and resolved. A successful delete destroys the
|
||||
// modal inside onConfirm, so the overlay is gone and this no-ops.
|
||||
if (overlay?.isConnected === true) {
|
||||
deleteBtn.removeAttribute("disabled");
|
||||
setText(deleteBtn, "Delete Channel");
|
||||
}
|
||||
}
|
||||
},
|
||||
{ signal: ac.signal },
|
||||
@@ -109,7 +121,24 @@ export function createDeleteChannelModal(options: DeleteChannelModalOptions): Mo
|
||||
{ signal: ac.signal },
|
||||
);
|
||||
|
||||
// Escape cancels — it must never stand in for the destructive confirm.
|
||||
// Document-level so it works wherever focus sits; guarded on the overlay
|
||||
// still being attached because the listener lives until destroy() aborts it.
|
||||
document.addEventListener(
|
||||
"keydown",
|
||||
(e: KeyboardEvent) => {
|
||||
if (e.key === "Escape" && overlay?.isConnected === true) {
|
||||
onClose();
|
||||
}
|
||||
},
|
||||
{ signal: ac.signal },
|
||||
);
|
||||
|
||||
container.appendChild(overlay);
|
||||
|
||||
// Move focus in (lands on the header's close button, safely away from the
|
||||
// destructive confirm) and remember the opener for destroy() to restore.
|
||||
restoreFocus = focusDialog(modal);
|
||||
}
|
||||
|
||||
function destroy(): void {
|
||||
@@ -118,6 +147,11 @@ export function createDeleteChannelModal(options: DeleteChannelModalOptions): Mo
|
||||
overlay.remove();
|
||||
overlay = null;
|
||||
}
|
||||
// Every close path (X, Cancel, backdrop, Escape) funnels through the
|
||||
// caller's onClose, which calls destroy() — the single place focus
|
||||
// returns to the opener.
|
||||
restoreFocus?.();
|
||||
restoreFocus = null;
|
||||
}
|
||||
|
||||
return { mount, destroy };
|
||||
+127
-25
@@ -13,7 +13,8 @@
|
||||
import { createElement, appendChildren, setText } from "@lib/dom";
|
||||
import type { MountableComponent } from "@lib/safe-render";
|
||||
import type { UserStatus } from "@lib/types";
|
||||
import { isSafeUrl } from "./message-list/attachments";
|
||||
import { avatarInitial, isRenderableAvatar, resolveDisplayName } from "@lib/avatar";
|
||||
import { fetchImageAsDataUrl, resolveServerUrl } from "./message-list/attachments";
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Types
|
||||
@@ -22,6 +23,10 @@ import { isSafeUrl } from "./message-list/attachments";
|
||||
export interface DmProfileData {
|
||||
readonly id: number;
|
||||
readonly username: string;
|
||||
/** Nickname, when set. The DM header this panel opens from renders through
|
||||
* `dmDisplayName`, which prefers this over `username` -- without it here
|
||||
* the panel would show a different identity from the header just clicked. */
|
||||
readonly displayName?: string | null;
|
||||
readonly avatar: string | null;
|
||||
readonly status: UserStatus;
|
||||
readonly about?: string | null;
|
||||
@@ -31,10 +36,32 @@ export interface DmProfileData {
|
||||
export interface DmProfileSidebarOptions {
|
||||
readonly user: DmProfileData;
|
||||
readonly onClose: () => void;
|
||||
/**
|
||||
* The connected server's host, used to scope the note's localStorage key.
|
||||
* User ids are per-server, so without this a note about user 5 on one
|
||||
* server is shown for, and overwritten by, the unrelated user 5 on
|
||||
* another — real in the multi-profile client (see profiles.ts). Optional,
|
||||
* and falls back to the legacy unscoped key, so a caller that has not
|
||||
* been updated to pass it yet keeps today's single-profile behavior
|
||||
* exactly (including any note already saved under the old key).
|
||||
*/
|
||||
readonly host?: string;
|
||||
}
|
||||
|
||||
export type DmProfileSidebarComponent = MountableComponent & {
|
||||
readonly isOpen: () => boolean;
|
||||
/**
|
||||
* Repaint the name, avatar initial and status (dot + label, both the
|
||||
* avatar-corner one and the inline one) from a fresher `DmProfileData`,
|
||||
* in place -- without rebuilding the panel and losing the note textarea's
|
||||
* focus/selection. The panel itself has no subscription to any store (it
|
||||
* is intentionally presentational); the owner is expected to call this
|
||||
* when the underlying user's presence or identity changes while the panel
|
||||
* stays open, mirroring how ChannelController keeps the DM chat header
|
||||
* live across the same events (see ChannelController.ts's refreshDmHeader).
|
||||
* A no-op before mount() or after destroy().
|
||||
*/
|
||||
readonly update: (user: DmProfileData) => void;
|
||||
};
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
@@ -67,17 +94,34 @@ const STATUS_LABELS: Readonly<Record<UserStatus, string>> = {
|
||||
// Helpers
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
function loadNote(userId: number): string {
|
||||
/** The legacy unscoped key, from before per-server notes (or when the caller
|
||||
* has not yet been updated to pass a host). */
|
||||
function legacyNoteKey(userId: number): string {
|
||||
return NOTE_STORAGE_PREFIX + String(userId);
|
||||
}
|
||||
|
||||
function scopedNoteKey(userId: number, host: string): string {
|
||||
return `${NOTE_STORAGE_PREFIX}${host}:${userId}`;
|
||||
}
|
||||
|
||||
function loadNote(userId: number, host: string): string {
|
||||
try {
|
||||
return localStorage.getItem(NOTE_STORAGE_PREFIX + String(userId)) ?? "";
|
||||
if (host !== "") {
|
||||
const scoped = localStorage.getItem(scopedNoteKey(userId, host));
|
||||
if (scoped !== null) return scoped;
|
||||
}
|
||||
// Fall back to the legacy key so a note saved before per-server scoping
|
||||
// (or while the host was unknown) is not silently lost.
|
||||
return localStorage.getItem(legacyNoteKey(userId)) ?? "";
|
||||
} catch {
|
||||
return "";
|
||||
}
|
||||
}
|
||||
|
||||
function saveNote(userId: number, text: string): void {
|
||||
function saveNote(userId: number, host: string, text: string): void {
|
||||
try {
|
||||
localStorage.setItem(NOTE_STORAGE_PREFIX + String(userId), text);
|
||||
const key = host !== "" ? scopedNoteKey(userId, host) : legacyNoteKey(userId);
|
||||
localStorage.setItem(key, text);
|
||||
} catch {
|
||||
// localStorage may be unavailable or full -- silently ignore
|
||||
}
|
||||
@@ -92,11 +136,21 @@ export function createDmProfileSidebar(
|
||||
): DmProfileSidebarComponent {
|
||||
const ac = new AbortController();
|
||||
const { signal } = ac;
|
||||
const { user, onClose } = options;
|
||||
const { onClose, host = "" } = options;
|
||||
let user = options.user;
|
||||
|
||||
let panel: HTMLDivElement | null = null;
|
||||
let open = false;
|
||||
|
||||
// Live-updatable node refs, populated on mount() and cleared on destroy()
|
||||
// -- see the `update()` doc comment on DmProfileSidebarComponent for why
|
||||
// these are repainted in place instead of the whole panel being rebuilt.
|
||||
let nameNode: HTMLDivElement | null = null;
|
||||
let avatarLetterNode: HTMLSpanElement | null = null;
|
||||
let statusDotNode: HTMLDivElement | null = null;
|
||||
let statusDotInlineNode: HTMLSpanElement | null = null;
|
||||
let statusTextNode: HTMLSpanElement | null = null;
|
||||
|
||||
function isOpen(): boolean {
|
||||
return open;
|
||||
}
|
||||
@@ -119,22 +173,32 @@ export function createDmProfileSidebar(
|
||||
wrapper.style.position = "relative";
|
||||
wrapper.style.flexShrink = "0";
|
||||
|
||||
if (user.avatar !== null && user.avatar.length > 0 && isSafeUrl(user.avatar)) {
|
||||
wrapper.style.background = "transparent";
|
||||
const img = createElement("img", {
|
||||
src: user.avatar,
|
||||
alt: user.username,
|
||||
class: "dps-avatar-img",
|
||||
// The letter draws immediately; the picture (if any) is fetched through
|
||||
// the same cert-pinned, bearer-token path attachments use and swapped in
|
||||
// once the bytes arrive. `<img src>` cannot carry the auth header an
|
||||
// `/api/v1/files/{id}` avatar needs, so the URL is never assigned raw.
|
||||
wrapper.style.background = "var(--accent, #5865f2)";
|
||||
const initial = avatarInitial(user);
|
||||
const letter = createElement("span", {}, initial);
|
||||
avatarLetterNode = letter;
|
||||
wrapper.appendChild(letter);
|
||||
|
||||
if (isRenderableAvatar(user.avatar)) {
|
||||
const resolved = resolveServerUrl(user.avatar);
|
||||
void fetchImageAsDataUrl(resolved).then((dataUrl) => {
|
||||
if (dataUrl === null || !wrapper.isConnected) return;
|
||||
const img = createElement("img", {
|
||||
src: dataUrl,
|
||||
alt: resolveDisplayName(user),
|
||||
class: "dps-avatar-img",
|
||||
});
|
||||
img.style.width = "80px";
|
||||
img.style.height = "80px";
|
||||
img.style.borderRadius = "50%";
|
||||
letter.remove();
|
||||
wrapper.style.background = "transparent";
|
||||
wrapper.insertBefore(img, wrapper.firstChild);
|
||||
});
|
||||
img.style.width = "80px";
|
||||
img.style.height = "80px";
|
||||
img.style.borderRadius = "50%";
|
||||
wrapper.appendChild(img);
|
||||
} else {
|
||||
wrapper.style.background = "var(--accent, #5865f2)";
|
||||
const initial = user.username.charAt(0).toUpperCase() || "?";
|
||||
const text = createElement("span", {}, initial);
|
||||
wrapper.appendChild(text);
|
||||
}
|
||||
|
||||
// Status dot overlay
|
||||
@@ -148,6 +212,7 @@ export function createDmProfileSidebar(
|
||||
statusDot.style.border = "3px solid var(--bg-secondary, #111214)";
|
||||
statusDot.style.background = STATUS_COLORS[user.status] ?? STATUS_COLORS.offline;
|
||||
statusDot.title = STATUS_LABELS[user.status] ?? "Offline";
|
||||
statusDotNode = statusDot;
|
||||
wrapper.appendChild(statusDot);
|
||||
|
||||
return wrapper;
|
||||
@@ -224,7 +289,8 @@ export function createDmProfileSidebar(
|
||||
nameEl.style.fontWeight = "600";
|
||||
nameEl.style.color = "var(--text-primary, #f2f3f5)";
|
||||
nameEl.style.marginBottom = "4px";
|
||||
setText(nameEl, user.username);
|
||||
setText(nameEl, resolveDisplayName(user));
|
||||
nameNode = nameEl;
|
||||
|
||||
// Status line
|
||||
const statusLine = createElement("div", {
|
||||
@@ -245,8 +311,10 @@ export function createDmProfileSidebar(
|
||||
statusDotInline.style.borderRadius = "50%";
|
||||
statusDotInline.style.display = "inline-block";
|
||||
statusDotInline.style.background = STATUS_COLORS[user.status] ?? STATUS_COLORS.offline;
|
||||
statusDotInlineNode = statusDotInline;
|
||||
|
||||
const statusText = createElement("span", {}, STATUS_LABELS[user.status] ?? "Offline");
|
||||
statusTextNode = statusText;
|
||||
appendChildren(statusLine, statusDotInline, statusText);
|
||||
|
||||
appendChildren(content, nameEl, statusLine);
|
||||
@@ -328,12 +396,12 @@ export function createDmProfileSidebar(
|
||||
noteInput.style.fontSize = "13px";
|
||||
noteInput.style.padding = "8px";
|
||||
noteInput.style.fontFamily = "inherit";
|
||||
noteInput.value = loadNote(user.id);
|
||||
noteInput.value = loadNote(user.id, host);
|
||||
|
||||
noteInput.addEventListener(
|
||||
"input",
|
||||
() => {
|
||||
saveNote(user.id, noteInput.value);
|
||||
saveNote(user.id, host, noteInput.value);
|
||||
},
|
||||
{ signal },
|
||||
);
|
||||
@@ -372,7 +440,41 @@ export function createDmProfileSidebar(
|
||||
panel.remove();
|
||||
panel = null;
|
||||
}
|
||||
nameNode = null;
|
||||
avatarLetterNode = null;
|
||||
statusDotNode = null;
|
||||
statusDotInlineNode = null;
|
||||
statusTextNode = null;
|
||||
}
|
||||
|
||||
return { mount, destroy, isOpen };
|
||||
function update(nextUser: DmProfileData): void {
|
||||
user = nextUser;
|
||||
// Not mounted (or already torn down) -- nothing to repaint. mount() will
|
||||
// paint the fresh `user` from scratch if it is called afterwards.
|
||||
if (panel === null) return;
|
||||
|
||||
if (nameNode !== null) setText(nameNode, resolveDisplayName(user));
|
||||
|
||||
const color = STATUS_COLORS[user.status] ?? STATUS_COLORS.offline;
|
||||
const label = STATUS_LABELS[user.status] ?? "Offline";
|
||||
|
||||
if (statusDotNode !== null) {
|
||||
statusDotNode.style.background = color;
|
||||
statusDotNode.title = label;
|
||||
}
|
||||
if (statusDotInlineNode !== null) {
|
||||
statusDotInlineNode.style.background = color;
|
||||
}
|
||||
if (statusTextNode !== null) setText(statusTextNode, label);
|
||||
|
||||
// Only repaint the fallback letter if it is still showing -- once the
|
||||
// fetched avatar image swaps in, buildAvatar() removes the letter node
|
||||
// from the DOM (see above), and a stale identity's initial no longer
|
||||
// matters (or exists) to update.
|
||||
if (avatarLetterNode !== null && avatarLetterNode.isConnected) {
|
||||
setText(avatarLetterNode, avatarInitial(user));
|
||||
}
|
||||
}
|
||||
|
||||
return { mount, destroy, isOpen, update };
|
||||
}
|
||||
+33
-8
@@ -16,7 +16,8 @@ import { createElement, setText, appendChildren } from "@lib/dom";
|
||||
import { createIcon } from "@lib/icons";
|
||||
import { showContextMenu } from "@lib/context-menu";
|
||||
import type { MountableComponent } from "@lib/safe-render";
|
||||
import { isSafeUrl } from "./message-list/attachments";
|
||||
import { isRenderableAvatar } from "@lib/avatar";
|
||||
import { fetchImageAsDataUrl, resolveServerUrl } from "./message-list/attachments";
|
||||
|
||||
/** One member of a group DM, as far as the sidebar needs to draw them. */
|
||||
export interface DmParticipant {
|
||||
@@ -74,17 +75,29 @@ const STATUS_COLORS: Record<string, string> = {
|
||||
offline: "var(--text-micro)",
|
||||
};
|
||||
|
||||
/** Fill one avatar circle: the picture if it is safe to load, else the letter. */
|
||||
/**
|
||||
* Fill one avatar circle: the letter immediately, the picture swapped in once
|
||||
* fetched. `<img src>` cannot carry the bearer token an authenticated
|
||||
* `/api/v1/files/{id}` avatar needs, so the URL is always fetched through the
|
||||
* same cert-pinned path attachments and custom emoji use rather than assigned
|
||||
* directly.
|
||||
*/
|
||||
function paintAvatar(el: HTMLElement, avatar: string | null, label: string): void {
|
||||
if (avatar !== null && isSafeUrl(avatar)) {
|
||||
const img = createElement("img", { src: avatar, alt: label });
|
||||
// The letter lives in its own node so the swap below can remove just it —
|
||||
// anything else in the circle (the 1:1 presence dot) must survive the image.
|
||||
const letter = document.createTextNode(label.charAt(0).toUpperCase());
|
||||
el.appendChild(letter);
|
||||
if (!isRenderableAvatar(avatar)) return;
|
||||
const resolved = resolveServerUrl(avatar);
|
||||
void fetchImageAsDataUrl(resolved).then((dataUrl) => {
|
||||
if (dataUrl === null || !el.isConnected) return;
|
||||
const img = createElement("img", { src: dataUrl, alt: label });
|
||||
img.style.width = "100%";
|
||||
img.style.height = "100%";
|
||||
img.style.borderRadius = "50%";
|
||||
el.appendChild(img);
|
||||
return;
|
||||
}
|
||||
setText(el, label.charAt(0).toUpperCase());
|
||||
letter.remove();
|
||||
el.insertBefore(img, el.firstChild);
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -318,6 +331,18 @@ export function createDmSidebar(options: DmSidebarOptions): MountableComponent {
|
||||
|
||||
const items = sorted.map((convo) => renderDmItem(convo, options, ac.signal));
|
||||
|
||||
searchInput.addEventListener(
|
||||
"input",
|
||||
() => {
|
||||
const q = searchInput.value.trim().toLowerCase();
|
||||
items.forEach((el, i) => {
|
||||
const match = q === "" || sorted[i]!.username.toLowerCase().includes(q);
|
||||
el.style.display = match ? "" : "none";
|
||||
});
|
||||
},
|
||||
{ signal: ac.signal },
|
||||
);
|
||||
|
||||
appendChildren(root, header, sectionLabel, ...items);
|
||||
container.appendChild(root);
|
||||
}
|
||||
+30
-1
@@ -16,6 +16,7 @@
|
||||
* shown as its own option rather than being silently rounded to a neighbour.
|
||||
*/
|
||||
|
||||
import { applyDialogSemantics, focusDialog, trapFocus } from "@lib/a11y";
|
||||
import { createElement, setText, appendChildren } from "@lib/dom";
|
||||
import { createIcon } from "@lib/icons";
|
||||
import type { MountableComponent } from "@lib/safe-render";
|
||||
@@ -159,6 +160,7 @@ export function createEditChannelModal(options: EditChannelModalOptions): Mounta
|
||||
const isVoice = channelType === "voice";
|
||||
const ac = new AbortController();
|
||||
let overlay: HTMLDivElement | null = null;
|
||||
let restoreFocus: (() => void) | null = null;
|
||||
|
||||
function mount(container: Element): void {
|
||||
overlay = createElement("div", {
|
||||
@@ -167,13 +169,17 @@ export function createEditChannelModal(options: EditChannelModalOptions): Mounta
|
||||
});
|
||||
|
||||
const modal = createElement("div", { class: "modal" });
|
||||
applyDialogSemantics(modal, { labelledBy: "edit-channel-title" });
|
||||
trapFocus(modal, ac.signal);
|
||||
|
||||
// Header
|
||||
const header = createElement("div", { class: "modal-header" });
|
||||
const title = createElement("h3", {}, "Edit Channel");
|
||||
const title = createElement("h3", { id: "edit-channel-title" }, "Edit Channel");
|
||||
// Icon-only button: without a label a screen reader announces just "button".
|
||||
const closeBtn = createElement("button", {
|
||||
class: "modal-close",
|
||||
type: "button",
|
||||
"aria-label": "Close",
|
||||
});
|
||||
closeBtn.textContent = "";
|
||||
closeBtn.appendChild(createIcon("x", 14));
|
||||
@@ -395,7 +401,25 @@ export function createEditChannelModal(options: EditChannelModalOptions): Mounta
|
||||
{ signal: ac.signal },
|
||||
);
|
||||
|
||||
// Escape cancels — never saves. Document-level so it works wherever focus
|
||||
// sits; guarded on the overlay still being attached because the listener
|
||||
// lives until destroy() aborts it.
|
||||
document.addEventListener(
|
||||
"keydown",
|
||||
(e: KeyboardEvent) => {
|
||||
if (e.key === "Escape" && overlay?.isConnected === true) {
|
||||
onClose();
|
||||
}
|
||||
},
|
||||
{ signal: ac.signal },
|
||||
);
|
||||
|
||||
container.appendChild(overlay);
|
||||
|
||||
// Capture where focus came from before anything inside the dialog takes
|
||||
// it, so destroy() can hand it back to the opener.
|
||||
restoreFocus = focusDialog(modal);
|
||||
|
||||
nameInput.focus();
|
||||
nameInput.select();
|
||||
}
|
||||
@@ -406,6 +430,11 @@ export function createEditChannelModal(options: EditChannelModalOptions): Mounta
|
||||
overlay.remove();
|
||||
overlay = null;
|
||||
}
|
||||
// Every close path (X, Cancel, backdrop, Escape) funnels through the
|
||||
// caller's onClose, which calls destroy() — the single place focus
|
||||
// returns to the opener.
|
||||
restoreFocus?.();
|
||||
restoreFocus = null;
|
||||
}
|
||||
|
||||
return { mount, destroy };
|
||||
+6
@@ -50,6 +50,11 @@ export interface EmojiAutocompleteOptions {
|
||||
/** Called with the text to insert (`:wave:` or a unicode character). */
|
||||
readonly onSelect: (insert: string) => void;
|
||||
readonly onClose: () => void;
|
||||
/**
|
||||
* Composer textarea the popup completes for; carries combobox semantics and
|
||||
* aria-activedescendant while the popup is open (see inline-autocomplete).
|
||||
*/
|
||||
readonly comboboxInput?: HTMLElement;
|
||||
}
|
||||
|
||||
/** Same shape as the shared inline-autocomplete widget. */
|
||||
@@ -153,5 +158,6 @@ export function createEmojiAutocomplete(
|
||||
// MIN_EMOJI_QUERY, so there is nothing to prime on create.
|
||||
onSelect: options.onSelect,
|
||||
onClose: options.onClose,
|
||||
comboboxInput: options.comboboxInput,
|
||||
});
|
||||
}
|
||||
+53
-3
@@ -2,7 +2,9 @@
|
||||
// Uses @lib/dom helpers exclusively. Never sets innerHTML with user content.
|
||||
|
||||
import { createElement, setText, clearChildren } from "@lib/dom";
|
||||
import { enableRovingNavigation, setRovingTabindex } from "@lib/a11y";
|
||||
import { buildCustomEmojiNode } from "@components/message-list/custom-emoji";
|
||||
import { resolveEmoji } from "@stores/emoji.store";
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Types
|
||||
@@ -516,7 +518,19 @@ function getRecentEmoji(): string[] {
|
||||
if (!raw) return [];
|
||||
const parsed: unknown = JSON.parse(raw);
|
||||
if (!Array.isArray(parsed)) return [];
|
||||
return parsed.filter((e): e is string => typeof e === "string").slice(0, MAX_RECENT);
|
||||
return (
|
||||
parsed
|
||||
.filter((e): e is string => typeof e === "string")
|
||||
// A `:shortcode:`-shaped entry is only meaningful when it still
|
||||
// resolves on *this* server — the recent list is global (unscoped by
|
||||
// host), so a custom emoji clicked on one server would otherwise leak
|
||||
// as dead literal text into every other server's picker, and a
|
||||
// deleted emoji would do the same on its own server forever after.
|
||||
// Plain unicode entries (no colons) are never shortcode-shaped and
|
||||
// pass through untouched.
|
||||
.filter((e) => !(e.startsWith(":") && e.endsWith(":")) || resolveEmoji(e) !== null)
|
||||
.slice(0, MAX_RECENT)
|
||||
);
|
||||
} catch {
|
||||
return [];
|
||||
}
|
||||
@@ -559,11 +573,37 @@ export function createEmojiPicker(options: EmojiPickerOptions): {
|
||||
header.appendChild(searchInput);
|
||||
root.appendChild(header);
|
||||
|
||||
// Scrollable content area (holds category labels + grids)
|
||||
// Scrollable content area (holds category labels + grids). Announced as a
|
||||
// single flat listbox — the category grids are visual grouping only, and
|
||||
// roving tabindex (DC-13) treats every .ep-emoji cell as one list.
|
||||
const scrollArea = createElement("div", {
|
||||
style: "overflow-y: auto; max-height: 320px;",
|
||||
role: "listbox",
|
||||
"aria-label": "Emoji",
|
||||
});
|
||||
root.appendChild(scrollArea);
|
||||
enableRovingNavigation(scrollArea, ".ep-emoji", signal);
|
||||
|
||||
// Single delegated listener for the whole grid, registered once at mount
|
||||
// time. renderAllCategories() discards and rebuilds every cell on each
|
||||
// search keystroke (~250 cells per render); a listener bound directly to
|
||||
// each cell would register (and, since it lives on the picker-lifetime
|
||||
// `signal`, never release) one abort algorithm per discarded cell for the
|
||||
// rest of the picker's life — the same pattern SearchOverlay.ts's
|
||||
// handleResultsClick already fixes for its rows.
|
||||
scrollArea.addEventListener(
|
||||
"click",
|
||||
(e) => {
|
||||
const target = e.target;
|
||||
if (!(target instanceof Element)) return;
|
||||
const cell = target.closest<HTMLElement>(".ep-emoji");
|
||||
if (cell === null) return;
|
||||
const emoji = cell.dataset.emoji;
|
||||
if (emoji === undefined) return;
|
||||
handleEmojiClick(emoji);
|
||||
},
|
||||
{ signal },
|
||||
);
|
||||
|
||||
// Build categories with recent + custom
|
||||
function getAllCategories(): readonly EmojiCategory[] {
|
||||
@@ -596,6 +636,13 @@ export function createEmojiPicker(options: EmojiPickerOptions): {
|
||||
const span = createElement("span", {
|
||||
class: "ep-emoji",
|
||||
title: emoji,
|
||||
role: "option",
|
||||
// Mirrors the title (the character or :shortcode: token) — e2e specs
|
||||
// select cells by title, so the accessible name must never diverge.
|
||||
"aria-label": emoji,
|
||||
// Read by the delegated click handler on scrollArea (see mount-time
|
||||
// listener above) instead of a per-cell listener.
|
||||
"data-emoji": emoji,
|
||||
});
|
||||
// A `:shortcode:` entry shows its image; everything else is the character
|
||||
// itself. An unresolvable shortcode falls back to the text, which is what
|
||||
@@ -607,7 +654,6 @@ export function createEmojiPicker(options: EmojiPickerOptions): {
|
||||
} else {
|
||||
setText(span, emoji);
|
||||
}
|
||||
span.addEventListener("click", () => handleEmojiClick(emoji), { signal });
|
||||
return span;
|
||||
}
|
||||
|
||||
@@ -652,6 +698,10 @@ export function createEmojiPicker(options: EmojiPickerOptions): {
|
||||
);
|
||||
scrollArea.appendChild(empty);
|
||||
}
|
||||
|
||||
// Every render rebuilds the cell set, so the single Tab stop must be
|
||||
// re-established or filtering would leave zero tabbable cells.
|
||||
setRovingTabindex(scrollArea, ".ep-emoji");
|
||||
}
|
||||
|
||||
// Initial render
|
||||
+19
-3
@@ -3,6 +3,7 @@
|
||||
// innerHTML with user content.
|
||||
|
||||
import { createElement, setText, clearChildren } from "@lib/dom";
|
||||
import { enableRovingNavigation, setRovingTabindex } from "@lib/a11y";
|
||||
import { ApiClientError } from "@lib/api";
|
||||
import { searchGifs, getTrendingGifs } from "@lib/gifProvider";
|
||||
import type { GifApi, GifResult } from "@lib/gifProvider";
|
||||
@@ -67,9 +68,15 @@ export function createGifPicker(options: GifPickerOptions): {
|
||||
|
||||
root.appendChild(header);
|
||||
|
||||
// Grid area (scrollable)
|
||||
const gridArea = createElement("div", { class: "gp-grid-area" });
|
||||
// Grid area (scrollable). Announced as a flat listbox of GIF options with
|
||||
// roving tabindex (DC-13); the inner .gp-grid is layout only.
|
||||
const gridArea = createElement("div", {
|
||||
class: "gp-grid-area",
|
||||
role: "listbox",
|
||||
"aria-label": "GIFs",
|
||||
});
|
||||
root.appendChild(gridArea);
|
||||
enableRovingNavigation(gridArea, ".gp-item", signal);
|
||||
|
||||
// Loading indicator
|
||||
const loadingEl = createElement("div", { class: "gp-loading" });
|
||||
@@ -92,7 +99,13 @@ export function createGifPicker(options: GifPickerOptions): {
|
||||
const grid = createElement("div", { class: "gp-grid" });
|
||||
|
||||
for (const gif of gifs) {
|
||||
const item = createElement("div", { class: "gp-item" });
|
||||
const item = createElement("div", {
|
||||
class: "gp-item",
|
||||
role: "option",
|
||||
// Same fallback as the img alt below — an untitled GIF still needs a
|
||||
// pronounceable accessible name.
|
||||
"aria-label": gif.title || "GIF",
|
||||
});
|
||||
const img = createElement("img", {
|
||||
class: "gp-img",
|
||||
src: gif.url,
|
||||
@@ -114,6 +127,9 @@ export function createGifPicker(options: GifPickerOptions): {
|
||||
}
|
||||
|
||||
gridArea.appendChild(grid);
|
||||
|
||||
// Each render replaces the cell set, so re-establish the single Tab stop.
|
||||
setRovingTabindex(gridArea, ".gp-item");
|
||||
}
|
||||
|
||||
function showLoading(): void {
|
||||
+15
-2
@@ -3,6 +3,7 @@
|
||||
* Create, copy, and revoke invite codes.
|
||||
*/
|
||||
|
||||
import { applyDialogSemantics, focusDialog, trapFocus } from "@lib/a11y";
|
||||
import { createElement, appendChildren, clearChildren } from "@lib/dom";
|
||||
import { createIcon } from "@lib/icons";
|
||||
import type { MountableComponent } from "@lib/safe-render";
|
||||
@@ -56,6 +57,7 @@ export function createInviteManager(options: InviteManagerOptions): MountableCom
|
||||
let root: HTMLDivElement | null = null;
|
||||
let listEl: HTMLDivElement | null = null;
|
||||
let emptyEl: HTMLDivElement | null = null;
|
||||
let restoreFocus: (() => void) | null = null;
|
||||
let invites: readonly InviteItem[] = options.invites;
|
||||
|
||||
function renderList(): void {
|
||||
@@ -161,11 +163,14 @@ export function createInviteManager(options: InviteManagerOptions): MountableCom
|
||||
const modal = createElement("div", {
|
||||
class: "modal",
|
||||
});
|
||||
applyDialogSemantics(modal, { labelledBy: "invite-manager-title" });
|
||||
trapFocus(modal, ac.signal);
|
||||
|
||||
// Header
|
||||
const header = createElement("div", { class: "modal-header" });
|
||||
const title = createElement("h3", {}, "Server Invites");
|
||||
const closeBtn = createElement("button", { class: "modal-close" });
|
||||
const title = createElement("h3", { id: "invite-manager-title" }, "Server Invites");
|
||||
// Icon-only button: without a label a screen reader announces just "button".
|
||||
const closeBtn = createElement("button", { class: "modal-close", "aria-label": "Close" });
|
||||
closeBtn.appendChild(createIcon("x", 14));
|
||||
closeBtn.addEventListener("click", () => options.onClose(), { signal: ac.signal });
|
||||
appendChildren(header, title, closeBtn);
|
||||
@@ -236,6 +241,10 @@ export function createInviteManager(options: InviteManagerOptions): MountableCom
|
||||
renderList();
|
||||
|
||||
container.appendChild(root);
|
||||
|
||||
// Capture where focus came from before anything inside the dialog takes
|
||||
// it, so destroy() can hand it back to the opener.
|
||||
restoreFocus = focusDialog(modal);
|
||||
}
|
||||
|
||||
function destroy(): void {
|
||||
@@ -246,6 +255,10 @@ export function createInviteManager(options: InviteManagerOptions): MountableCom
|
||||
}
|
||||
listEl = null;
|
||||
emptyEl = null;
|
||||
// Every close path (X, backdrop, Escape) funnels through the caller's
|
||||
// onClose, which calls destroy() — the single place focus returns.
|
||||
restoreFocus?.();
|
||||
restoreFocus = null;
|
||||
}
|
||||
|
||||
return { mount, destroy };
|
||||
+41
-13
@@ -239,15 +239,20 @@ function createMemberItem(
|
||||
const currentUserId = authStore.getState().user?.id ?? 0;
|
||||
const isSelf = member.id === currentUserId;
|
||||
const onMessageUser = opts.onMessageUser;
|
||||
// `member` is the row's render-time snapshot; a presence-only update
|
||||
// (see patchPresence) recolors the dot in place without rebuilding the
|
||||
// row, so that snapshot's `status` can be stale. Re-resolve against the
|
||||
// live store so the popup always agrees with the dot it was opened from.
|
||||
const live = membersStore.getState().members.get(member.id) ?? member;
|
||||
activePopup = createUserProfilePopup({
|
||||
user: {
|
||||
id: member.id,
|
||||
username: member.username,
|
||||
avatar: member.avatar,
|
||||
role: member.role,
|
||||
status: member.status,
|
||||
displayName: member.displayName,
|
||||
customStatus: member.customStatus,
|
||||
id: live.id,
|
||||
username: live.username,
|
||||
avatar: live.avatar,
|
||||
role: live.role,
|
||||
status: live.status,
|
||||
displayName: live.displayName,
|
||||
customStatus: live.customStatus,
|
||||
},
|
||||
anchorX: e.clientX,
|
||||
anchorY: e.clientY,
|
||||
@@ -272,7 +277,11 @@ function createMemberItem(
|
||||
|
||||
// Moderation actions are permission-gated per item (a role name told us
|
||||
// nothing about what its bits allow); block/unblock is open to everyone.
|
||||
const gates = moderationGates(opts.currentUserRole);
|
||||
// The role name is read live from authStore, not the opts snapshot
|
||||
// taken once at mount -- dispatcher.ts keeps authStore.user.role
|
||||
// current on every self MEMBER_UPDATE precisely so gates like this one
|
||||
// see a promotion/demotion without waiting for the sidebar to rebuild.
|
||||
const gates = moderationGates(authStore.getState().user?.role ?? opts.currentUserRole);
|
||||
const showAdminActions = gates.canKick || gates.canBan || gates.canManageRoles;
|
||||
|
||||
closeActiveMenu();
|
||||
@@ -453,11 +462,30 @@ export function createMemberList(opts: MemberListOptions): MountableComponent {
|
||||
/** Rendered rows by user id \u2014 lets presence-only updates patch in place. */
|
||||
const rowsByUserId = new Map<number, HTMLDivElement>();
|
||||
let prevMembers: ReadonlyMap<number, Member> = new Map();
|
||||
// renderList() rebuilds every row from scratch on every non-presence-only
|
||||
// membersStore change and on every roles_update. Per-row listeners (click,
|
||||
// contextmenu) must NOT be registered on the component-lifetime
|
||||
// `disposable.signal`, which only aborts once, at destroy() --
|
||||
// addEventListener({ signal }) keeps a detached row alive via that signal's
|
||||
// own retained "abort" listener list until it fires, so every rebuild would
|
||||
// otherwise leak one full set of detached rows (OC-0295), exactly the
|
||||
// defect already fixed in ChannelSidebar (renderAc, OC-0229) and
|
||||
// MessageList (OC-0286). renderAc is aborted and replaced at the top of
|
||||
// every render, so only the CURRENT render's rows stay reachable.
|
||||
let renderAc: AbortController | null = null;
|
||||
|
||||
function render(): void {
|
||||
if (root === null) return;
|
||||
renderAc?.abort();
|
||||
const currentRenderAc = new AbortController();
|
||||
renderAc = currentRenderAc;
|
||||
renderList(root, opts, currentRenderAc.signal, rowsByUserId);
|
||||
}
|
||||
|
||||
function mount(container: Element): void {
|
||||
root = createElement("div", { class: "member-list", "data-testid": "member-list" });
|
||||
prevMembers = membersStore.getState().members;
|
||||
renderList(root, opts, disposable.signal, rowsByUserId);
|
||||
render();
|
||||
|
||||
disposable.onStoreChange<MembersState, ReadonlyMap<number, Member>>(
|
||||
membersStore,
|
||||
@@ -467,7 +495,7 @@ export function createMemberList(opts: MemberListOptions): MountableComponent {
|
||||
if (isPresenceOnlyChange(prevMembers, members)) {
|
||||
patchPresence(prevMembers, members, rowsByUserId);
|
||||
} else {
|
||||
renderList(root, opts, disposable.signal, rowsByUserId);
|
||||
render();
|
||||
}
|
||||
}
|
||||
prevMembers = members;
|
||||
@@ -482,9 +510,7 @@ export function createMemberList(opts: MemberListOptions): MountableComponent {
|
||||
channelsStore,
|
||||
(s) => s.roles,
|
||||
() => {
|
||||
if (root !== null) {
|
||||
renderList(root, opts, disposable.signal, rowsByUserId);
|
||||
}
|
||||
render();
|
||||
},
|
||||
);
|
||||
|
||||
@@ -496,6 +522,8 @@ export function createMemberList(opts: MemberListOptions): MountableComponent {
|
||||
closeActivePopup();
|
||||
document.removeEventListener("mousedown", handleOutsideClick);
|
||||
disposable.destroy();
|
||||
renderAc?.abort();
|
||||
renderAc = null;
|
||||
rowsByUserId.clear();
|
||||
if (root !== null) {
|
||||
root.remove();
|
||||
+10
@@ -32,6 +32,11 @@ export interface MentionAutocompleteOptions {
|
||||
/** Called with the token to insert (without the leading "@"). */
|
||||
readonly onSelect: (token: string) => void;
|
||||
readonly onClose: () => void;
|
||||
/**
|
||||
* Composer textarea the popup completes for; carries combobox semantics and
|
||||
* aria-activedescendant while the popup is open (see inline-autocomplete).
|
||||
*/
|
||||
readonly comboboxInput?: HTMLElement;
|
||||
}
|
||||
|
||||
/** Same shape as the shared inline-autocomplete widget. */
|
||||
@@ -55,6 +60,10 @@ export function filterMentionSuggestions(query: string): MentionSuggestion[] {
|
||||
const substring: MentionSuggestion[] = [];
|
||||
|
||||
for (const member of membersStore.getState().members.values()) {
|
||||
// Skip usernames the mention grammar cannot express (a space, an "@",
|
||||
// etc. truncate the token on insert) -- picking one would insert a dead
|
||||
// token that resolves to no mention and notifies nobody.
|
||||
if (!/^[\p{L}\p{N}_.-]{1,64}$/u.test(member.username)) continue;
|
||||
const lower = member.username.toLowerCase();
|
||||
if (q !== "" && !lower.includes(q)) continue;
|
||||
const entry: MentionSuggestion = {
|
||||
@@ -121,5 +130,6 @@ export function createMentionAutocomplete(
|
||||
primeOnCreate: true,
|
||||
onSelect: options.onSelect,
|
||||
onClose: options.onClose,
|
||||
comboboxInput: options.comboboxInput,
|
||||
});
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user