ciregenz
d9481eb4b6
[eric] macos: native mouse-clamp addon to dodge the off-window mouse-release RootView::UpdateCursor crash
2026-06-13 21:29:03 -07:00
ciregenz
e6a1a5f2a5
[eric] browser: measure whether the playbook cuts exploration turns, flag when it doesn't
2026-06-02 23:19:47 -07:00
ciregenz
2b2d5909a8
[eric] browser: instrument skill lifecycle, measure replay speedup, flag silent non-help
2026-06-02 18:03:43 -07:00
ciregenz
69c4546735
[eric] browser: refine ghost detector so read tasks need returned content, not state change
2026-06-02 12:35:12 -07:00
ciregenz
8a0cb4a6a0
[eric] browser: human-performance benchmark harness for rudimentary tasks
2026-06-02 12:29:59 -07:00
ciregenz
e2102afeab
[eric] browser: metrics analyzer with ghost-success detection
2026-06-02 12:13:59 -07:00
ciregenz
04faff315a
[eric] ci: fix mcp-bundles node path and whitelist wheel sboms in host-leakage
2026-06-01 15:01:13 -07:00
eric
6b145b7c88
[eric] fix: merge eric/youtube into eric/dev (bundle kirbah-mcp-youtube to skip npx on windows)
2026-05-31 17:18:24 -07:00
eric
1a80d7329c
[eric] fix: bundle @kirbah/mcp-youtube in build-app.sh so windows users dont need npx
2026-05-31 16:06:04 -07:00
eric
d0e03e4555
[eric] sync: merge v1.1.71 into main (take theirs on stale 1.1.43 hotfixes)
2026-05-31 15:56:09 -07:00
ciregenz
329e43ce2c
[eric] win: generate latest.yml for squirrel releases so existing NSIS clients can migrate
2026-05-31 13:06:06 -07:00
ciregenz
028984cb67
[eric] build: precompile python bytecode with unchecked-hash so installs stop recompiling every launch
2026-05-29 22:17:26 -07:00
ciregenz
e209c48f59
[eric] build: pass squirrelWindows.iconUrl in -Squirrel override (eb26 requires it)
2026-05-29 19:08:45 -07:00
ciregenz
7e8a5fa440
[eric] build: fix -Squirrel arg passing (array expansion not @ splat) so the target override reaches electron-builder
2026-05-29 19:02:00 -07:00
ciregenz
e7991f138b
[eric] ci: run signtool verify /pa unconditionally when authenticode status isnt Valid
2026-05-29 15:53:10 -07:00
ciregenz
af24590b5f
[eric] ci: verify-signature accepts Azure Trusted Signing via signtool /pa cross-check
2026-05-29 15:37:59 -07:00
Eric
2b4d90edaa
[eric] ci: parallelize + cache the e2e gate to cut push wall-clock under ~10 min
...
- split the single windows e2e job into parallel jobs: gate (pure-node
selftests, no build), verify (build + verify-all), playwright (build +
renderer suite). verify and playwright run concurrently so wall-clock is
max(verify, playwright), not their sum
- build the UNPACKED app on the gate path (electron-builder --dir via a new
-DirOnly switch in build-app-win.ps1), skipping the ~2min NSIS LZMA
compression. verify-all drives win-unpacked\OpenSwarm.exe; afterPack +
locale paks still run in the pack phase, and verify-update-feed skips
cleanly when no installer feed is present
- cache the heavy build inputs (bundled Python env, uv, MCP bundles) + npm
across runs, keyed on their source manifests; the build script already skips
any input already on disk, so warm builds are fast
- move the destructive installer cycle to its own job gated off routine pushes
(runs on PR-to-main / dispatch; release-windows.yml covers v* tags)
- apply the same caching to dogfood (shares cache keys, so the two warm each other)
2026-05-28 23:55:32 -07:00
Eric
99f1e56497
[eric] installer: skip Defender prewarm on silent installs to fix the install hang
...
- the customInstall macro runs `OpenSwarm.exe --prewarm` via nsExec::Exec,
which is synchronous with no upper time bound. On a clean box the silent
install launches the freshly-extracted, not-yet-signed binaries, provoking a
cold Windows Defender scan that stalls for minutes - this hung the CI
installer-verification step (no output for ~3m, then cancelled)
- both CI verification and production auto-updates run the installer with /S,
so this same stall could hang a real user's auto-update
- gate the prewarm behind ${If} ${Silent} ... ${Else}: interactive first-time
installs (where the cold-start win lands) still prewarm; silent installs skip
it and finish promptly
- verify-installer: keep the blocking spawnSync (it must wait for the registry
uninstall entry the gate checks) but add a 300s timeout so any future
synchronous stall fails the gate in minutes instead of hanging the job
2026-05-28 23:39:41 -07:00
Eric
77ad8333c9
[eric] ci: stop host-leakage flagging the generic CI runner account
...
- skip the bare /Users/runner and /home/runner homes and the literal
"runner" username: they collide with third-party embedded paths and the
english word "runner" everywhere, burying real leaks in noise
- the precise /Users/runner/work + D:\a\openswarm work-dir patterns still
catch a genuine leak from those accounts
2026-05-28 23:14:02 -07:00
Eric
d6e6f9e9e0
[eric] ci: drop macOS legs and gate the packaged-app build on artifact paths
...
- e2e + dogfood matrices are now windows-latest only: GitHub's scarce mac
runners left the macos legs perpetually queued/starved and they surfaced
mac-only failures untriageable from the Windows dev box, so the whole
matrix read red
- remove the now-dead macOS build steps; re-add macos-14/macos-13 (matrix
edit + workflow_dispatch) when a Mac maintainer can own them
- gate the expensive build on artifact-affecting paths only (electron,
frontend, backend, e2e, build+ci scripts) plus PRs to main + dispatch;
cheap hermetic gates still run on every push
- verify-release-readiness defaults to --require win32 so the removed darwin
leg does not block every v* tag forever
2026-05-28 23:14:01 -07:00
Eric
f1a3ec2598
[eric] electron: fix the electron 42 windows build - electronLanguages en to en-US so the renderer gets a non-empty --lang (electron 42 renamed en.pak to en-US.pak; empty locale crashed blink LCIDFromLocaleInternal with 0xC0000005), bump electron-builder 25.1.8 to 26.8.1 + migrate win.sign to signtoolOptions, after-pack hook restores the 9router node_modules eb26 drops from extraResources so the subscription service stops hanging, and verify-locale-paks + verify-router-deps gate both in verify-all
2026-05-28 21:41:01 -07:00
Eric
d8c4aeb137
[eric] e2e+ci: addInitScript in launchApp setting __OPENSWARM_E2E__=true before bundle.js parses so the production-build store-on-window gate fires for specs that drive Redux directly, plus chain selftest-pairwise into verify-all and the e2e workflow so the covering-array math is validated on every CI push
2026-05-28 09:35:27 -07:00
Eric
27b31c80f1
[eric] ci: add selftest-pairwise that vendors the pairwise generator and asserts every-pair-covered, deterministic, bounded, and isCovering correctly fails on incomplete row sets, catching a future regression that drops the all-pairs guarantee before any e2e spec runs
2026-05-28 09:35:15 -07:00
Eric
b0b3bff91d
[eric] ci: add dogfood-aggregator that walks the rolling manifest, computes per-platform per-check warn/fail rates, emits preflight-tunings.json with a demote list when a check exceeds 2x the false-positive tolerance, and writes a release-readiness block the v* gate reads; preflight.js loadTunings/applyTunings honors the demote list at runtime so a chronically-noisy check gets silently downgraded to warn on subsequent boots
2026-05-28 09:17:15 -07:00
Eric
db6419fe7e
[eric] ci: add verify-dogfood that launches the packaged app, parses the [preflight2] line, INDEPENDENTLY verifies boot evidence (provenance==HEAD, perf marks ordered, health 200, no renderer-gone), and fails red when verdict and reality disagree, recording every run to dogfood-manifest.jsonl for the aggregator
2026-05-28 09:17:07 -07:00
Eric
d5491ff15e
[eric] ci: add verify-packaging-parity that pulls every $STAGING_DIR/<x> from build-app.sh and every Join-Path $Staging '<x>' from build-app-win.ps1 then asserts both stage the same set of dirs and that every extraResources from in electron/package.json is staged by both, with webapp-template-node-modules as the one documented mac-only exception
2026-05-28 02:49:22 -07:00
Eric
c7a195198a
[eric] ci: extend selftest-gate with cross-gate preflight mutation tests so a regression that turns withTimeout into fail-on-hang or readCache into stale-version-passes makes the boot-pipeline gate selftest also go red
2026-05-28 02:49:16 -07:00
Eric
6fc7e23bbe
[eric] ci: chain the four new preflight verifiers (selftest, rigs, race, matrix) at the head of verify-all and add hostile-env legs to e2e.yml so network=blocked + appdata=readonly + lang=de-DE all run on every push
2026-05-28 02:13:21 -07:00
Eric
3faacf761c
[eric] ci: add verify-preflight Layer 5 matrix verifier that reads OPENSWARM_TEST_NETWORK/_APPDATA/_LANG and asserts the verdict matches the expected envelope per scenario, catching the false-positive class where network=blocked produces fail instead of warn
2026-05-28 02:13:09 -07:00
Eric
051ddf5cd7
[eric] ci: add verify-preflight-race Layer 4 that runs twenty parallel preflights asserting no cache contention, then writes a version-keyed token + corrupts it + asserts the next read returns null so mid-boot kill cannot poison a future boots cached verdict
2026-05-28 02:13:09 -07:00
Eric
ddcf2f08df
[eric] ci: add verify-preflight-rigs Layer 3 that spins up hanging http, 500 server, close-mid-handshake, EACCES writeFileSync, and a German pwsh stub then drives the WHOLE preflight against each rig asserting the failing-check name + no neighbor corruption + total runtime under budget
2026-05-28 02:13:00 -07:00
Eric
83182b0dfd
[eric] ci: add selftest-preflight Layer 1+2 with thirty-eight assertions covering happy paths plus every production failure branch (mips arch, German PowerShell output, statfs throws, dns module missing) and never-resolving fakes for hang fuzz
2026-05-28 02:13:00 -07:00
Eric
f9e596160c
[eric] ci: chain the five new gates (python-health, mcp-bundles, update-feed, 9router-functional, clean-profile) into verify-all so every leg now exercises bundled-python, mcp init handshake, update feed sha512, router functional routing, and the truly-empty-profile invariant
2026-05-28 01:25:14 -07:00
Eric
485ddaf86d
[eric] ci: extend selftest-gate with mutation tests for the new update-feed parser (good yaml passes, missing files[] returns zero) and confirm all twenty-eight discriminators still discriminate
2026-05-28 01:25:08 -07:00
Eric
739d73ac4c
[eric] ci: add verify-9router-functional that polls GET :20128/api/providers and asserts 200+JSON so a router that listens on the tcp port but 500s every real request fails red instead of being silently masked by the tcp-only probe in verify-network
2026-05-28 01:25:03 -07:00
Eric
f28c9afac9
[eric] ci: add verify-clean-profile (ci-only, gated on CI=true or OPENSWARM_E2E_WIPE=1) that wipes the user data dir, launches, and asserts the app boots+serves+populates backend.log/auth.token from a truly empty profile so first-time-user code paths cant assume prior state
2026-05-28 01:24:56 -07:00
Eric
806b4fba44
[eric] ci: add verify-artifact-manifest that sha256s every file in the packaged dist and either writes a baseline (--write) or diffs against the committed one, catching non-deterministic build steps that survive even fully-pinned dependencies
2026-05-28 01:24:51 -07:00
Eric
0b10fd9ba8
[eric] ci: add verify-update-feed that parses latest.yml/latest-mac*.yml without applying an update, asserts every advertised file exists on disk and its sha512+size match, so a release with a busted feed cant ship an update that bricks on apply
2026-05-28 01:24:45 -07:00
Eric
44233419e4
[eric] ci: add verify-mcp-bundles that spawns each vendored bundle (notion, reddit-buddy, softeria-ms365) under the bundled node and asserts an mcp initialize round-trip so a corrupted esbuild output cant ship green
2026-05-28 01:24:40 -07:00
Eric
41117d6185
[eric] ci: add verify-python-health that execs the bundled interpreter, asserts python 3.13+, and imports the heaviest backend deps so a missing vcredist dll or half-extracted python-env fails the build red instead of giving users a renderer-up-but-backend-dead boot
2026-05-28 01:24:35 -07:00
Eric
32fb3091be
[eric] ci: chain deps-pinned and host-leakage first in verify-all so the cheap pure-logic gates fail fast before the build-launch gates spend minutes booting an already-doomed artifact
2026-05-28 00:56:04 -07:00
Eric
c5bfc00540
[eric] ci: extend selftest-gate with mutation tests for the new deps-pinned and host-leakage gates so a future weakening of either guard is caught before the build leg runs
2026-05-28 00:55:59 -07:00
Eric
d7b7128c6e
[eric] ci: add verify-deps-pinned that fails when backend/requirements.txt has any bare-name, floor (>=), or compat (~=) entry since pip would otherwise resolve those to latest-matching and two builds from the same git sha would ship different bytes
2026-05-28 00:55:50 -07:00
Eric
19ca4d81ae
[eric] ci: add verify-host-leakage that string-scans the packaged artifact (text files + app.asar) for the build hosts username and home dir, with PEP 610 dist-info metadata auto-allowed since it does not affect runtime
2026-05-28 00:55:45 -07:00
Eric
852b3bb232
[eric] refactor: trim the verifier and mcp comments to one line each per the updated convention
2026-05-27 19:11:12 -07:00
Eric
bb6006a896
[eric] test: add a boot-beacon and preflight check and fold it into the run-everything command
2026-05-27 19:11:12 -07:00
Eric
aa9d6acb4b
[eric] test: add an installer check that observes a real install safely, refuses to clobber it, and has a clean-machine destructive cycle
2026-05-27 19:11:12 -07:00
Eric
92f48db79b
[eric] docs: write up the gate red-team - what has teeth and the one auth gap we closed
2026-05-27 19:11:12 -07:00
Eric
8d06c7b7a3
[eric] test: harden the auth check to reject a wrong token, not just a missing one
2026-05-27 19:11:12 -07:00
Eric
aa0ace4363
[eric] test: make the boot checks mutation-testable and prove every guard fires on a break
2026-05-27 19:11:11 -07:00
ciregenz