WEBDIENSTE/openswarm
1
0
Fork 0
mirror of https://github.com/openswarm-ai/openswarm.git synced 2026-08-25 05:52:22 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,910 Commits 90 Branches 124 Tags
df31e8d5d281aa2272f8a4191f6803d1899db864
Commit Graph
152 Commits
Author SHA1 Message Date
ciregenzandClaude Opus 5 18b83d9697 [eric] build: the signing preflight must not assume a keychain exists 
The pin added earlier read the local keychain unconditionally, which was right
for publish.sh and wrong for release-macos.yml: on CI the cert arrives as a
base64 .p12 in CSC_LINK and electron-builder imports it into a temporary
keychain LATER than this preflight runs, so the probe would have found nothing
and aborted every CI mac build before it started. Fixed by branching on where
the cert actually comes from -- keychain locally, the .p12 itself on CI -- and
running the profile check against whichever cert that resolves to, since both
sources can drift from the embedded profile.

Verified with controls on both paths: the .p12 reader returns the true SHA-1 of
a synthetic cert and returns nothing (rather than a bogus hash) under a wrong
password, and the local path still passes against the live cert and profile.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014wtspwSFzZmjCx9UNPAorQ
 2026-08-20 11:49:01 -07:00
ciregenzandClaude Opus 5 e15b0dc8a1 [eric] build: prove the signing identity before packing, not after 
find-identity reports five entries all named "Developer ID Application: Haik
Decie (Y26NUZH4NG)": one live cert and four copies of the one whose private key
died with the old Mac. The dead copies still report valid and only fail at the
moment they are asked to sign, so auto-discovery was a coin flip between a real
build and a crash forty minutes into packing a 4.8 GB .app. Pin by SHA-1, then
spend one scratch signature proving the key is actually usable.

The profile check is the same lesson applied to a quieter failure. entitlements
request keychain-access-groups, which macOS honors only when the embedded
profile lists the very cert that signed the app. A profile issued for the
previous cert signs without one complaint and then loses passkeys and Touch ID
at runtime: a green build that ships broken. Verified with both controls, the
old profile fails against the new cert and passes against its own.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014wtspwSFzZmjCx9UNPAorQ
 2026-08-20 11:36:34 -07:00
ciregenz 50c5544494 [eric] apps: the bundled python keeps ensurepip so app-backend venvs are real, and a hollow venv can never reach an app 2026-08-14 12:27:42 -07:00
ciregenz 9663f91879 [eric] smoke: assert Gatekeeper would actually LAUNCH the app, and surface an unsigned DMG wrapper 2026-08-13 06:28:21 -07:00
ciregenz 58656efe5f [eric] smoke: refuse to run when :8324 is already taken, or a stray backend answers for the app under test 2026-08-12 22:26:18 -07:00
ciregenz c7c71b6ea0 [eric] build: the cancel trap fires only on INT/TERM and walks the tree; the EXIT variant flipped a green build's exit code to 1 under set -e 2026-08-11 10:57:14 -07:00
ciregenz a7c1a8256e [eric] build: a cancelled build reaps its whole process tree, so a killed run no longer orphans a 7za holding a 300MB archive for hours (ENG-247) 2026-08-11 06:33:51 -07:00
ciregenz 09df1c2d17 [eric] build: the webapp-template node_modules archive skips when already built for the digest, so an interrupted build stops re-running the 22s npm install every restart 2026-08-09 17:04:58 -07:00
ciregenz a12047ae66 [eric] apps: the full tool-ui widget set is vendored into every app workspace behind an @toolui alias, deps exact-pinned to the host's locked versions 2026-08-08 01:22:43 -07:00
ciregenz c0c190987e [eric] qa: the perf gate measures main-thread blocking at mount, the class every other gate slept through 2026-08-07 13:19:13 -07:00
ciregenz 433a22d081 [eric] qa: a dead-control sweep clicks every control and fails when nothing happens 2026-08-07 11:55:44 -07:00
ciregenz 926a146d97 [eric] scripts: verifier forces overflow and both 401 shims, so silent recoveries show up in the ledger 2026-08-07 09:58:09 -07:00
ciregenz b7366cce49 [eric] scripts: the verifier drives the CDP proofs too, so dictation, INP and idle rAF land in the same scoreboard 2026-08-07 09:48:12 -07:00
ciregenz a565d5638c [eric] scripts: the 1.7.5 verifier forces two failure classes live and stops gating boot on a baseline that never reproduced 2026-08-07 09:39:29 -07:00
ciregenz 8888c6856c [eric] scripts: one command re-checks the 1.7.5 contract and prints a scoreboard 2026-08-07 09:08:04 -07:00
ciregenz 887a6a5531 [eric] bundles: youtube MCP drops the googleapis monolith for a one-API shim, 32.6M to 3.7M, handshake-verified 2026-08-06 11:20:53 -07:00
ciregenz 99d8ef8314 [eric] voice: fn-watcher compiles per-arch into build-staging and ships via extraResources 2026-08-05 21:12:15 -07:00
ciregenz 50d6010862 [eric] merge eric/browser-merged: browser hangs, wrong-surface sends, and measured latency 2026-08-03 12:22:10 -07:00
ciregenz 28f5ca29e6 [eric] release: the mac smoke ran the app off the read-only dmg, so the updater killed it mid-boot 2026-08-03 10:04:17 -07:00
ciregenz 2d93b899fa [eric] release: read the Authority line, --requirements never contains the signer name 2026-08-02 22:57:21 -07:00
ciregenz ae2f5e0f3d [eric] release: smoke the packaged Mac build, including whether it contains the fixes it claims 2026-08-02 21:51:52 -07:00
ciregenz 06a4d3f29a [eric] build: signup already prompts for the code, so stop asking twice 2026-08-02 19:08:22 -07:00
ciregenz 45e9c98826 [eric] build: one-time EVS setup so a Mac release stops stalling on missing Widevine creds 2026-08-02 19:01:28 -07:00
ciregenz fb3ec15105 [eric] merge: bring eric/dev onto the browser v3 branch (7 conflicts resolved, gates green) 2026-08-02 16:14:53 -07:00
ciregenz a7f1fbe62c [eric] browser: say which runs the latency report skipped and why 2026-08-01 00:58:53 -07:00
ciregenz abdf5d2fd7 [eric] browser: report where a run's time goes, so a speed change is judged on the part we own 2026-08-01 00:56:00 -07:00
ciregenz 955abfa69c [eric] canary: cleanup passes on the outcome (marker gone), not on which code path deleted it 2026-07-31 01:15:38 -07:00
ciregenz 0d826b5daa [eric] build: drop foreign-arch native prebuilds from the app, with a release gate to keep them out 2026-07-31 00:05:54 -07:00
ciregenz 3d5c287139 [eric] merge: bring eric/browser onto eric/dev (30 conflicts resolved, gates green) 2026-07-30 13:18:11 -07:00
ciregenz df0e4a2393 [eric] merge eric/onboarding into eric/dev; version 1.6.0 2026-07-28 22:20:34 -07:00
ciregenz 35a281f4ad [eric] voice: bundle per-arch whisper-server into the mac build (pinned v1.7.6, static + non-system-dylib gate; model stays the proven first-run download) 2026-07-28 17:27:05 -07:00
ciregenz bf49c2c528 [eric] win: sign the bundled claude.exe (AV-quarantine class) + require-signed gate + post-sign smoke 2026-07-28 15:49:59 -07:00
ciregenz fe29551d74 [eric] voice: native trackpad haptics addon (NSHapticFeedbackManager, mouseclamp pattern) taps on dictation start/stop 2026-07-28 15:01:59 -07:00
ciregenz b8122d5649 [eric] build: uv presence check requires a universal binary, a thin dev uv no longer kills the dual-arch cut mid-build 2026-07-26 21:36:48 -07:00
ciregenz 243207e9b9 [eric] build: per-arch bundled python-env; x64 DMG shipped arm64 python, bricking Intel Macs 2026-07-06 14:52:26 -07:00
ciregenz a0947fe13e [eric] build: VMP_REQUIRE_SIGN=0 override for cred-less local cuts (CI keeps the hard gate) 2026-07-05 16:53:00 -07:00
ciregenz 0680c873dd [eric] merge #117: VMP-sign packaged builds so Widevine playback works 2026-07-05 16:14:57 -07:00
ciregenz 9603912237 [eric] merge eric/app-ux: app builder UX + browser tab drag-out + CreateApp fold-in 2026-07-02 16:10:56 -07:00
ciregenz 01e70fdd40 [eric] apps: restart.sh lets the agent bounce its own runtime (sentinel watched by the harness) 2026-07-02 02:48:21 -07:00
ciregenz 85d77ca552 [eric] apps: multiple independent instances per app (own runtime + ports; alt-click or paste to open) 2026-07-02 01:24:22 -07:00
ciregenz 6c916e633d [eric] build: ship mac en.lproj locale pak + blocking verify gate (passkey suicide fix) 2026-07-02 00:45:27 -07:00
ciregenz f19284a456 [eric] apps: card Preview/Code/Terminal switcher, terminal hard-reload, agent-readable terminal.log 2026-07-02 00:35:13 -07:00
ciregenz 77ff2b79e9 [eric] debugger: swap vendored debugger/ for PyPI swarm-debug in app workspaces 2026-07-02 00:16:53 -07:00
abccodes fe52665193 [aidan] fix/spotify-drm: VMP-sign packaged builds so Widevine playback works 2026-07-01 18:28:53 -07:00
ciregenz a2b8a2c335 [eric] build: bundle npm with node so packaged apps can install custom deps (fixes imported backend apps not starting) 2026-06-26 05:14:04 -07:00
ciregenz 1767389cbb [eric] browser: leading-_ -> p_/P_/public for module functions+constants+state across browser subsystem; promote cross-file symbols public (detect_loop, BROWSER_HISTORY, TRUSTED, etc.), align analyze-browser-metrics.py + tests 2026-06-23 19:37:40 -07:00
Eric 1a559deadf [eric] perf: revert #9 items 1+3 build wiring (measured: no cold benefit) 
- zip-stdlib + pyc-only gave no cold improvement (cold is native-binary-scan-bound)

- keep build lean; scripts stay as drafts; cold lever is the opt-in defender exclusion (item 5)
 2026-06-17 01:50:18 -07:00
Eric b22f46be47 [eric] perf: enable #9 items 1+3 in the windows build (zip stdlib + pyc-only deps) 
- shrinks python-env 13554 -> 9287 files (~31%); validated: backend.main imports clean with both applied

- targets the python-env Defender scan that dominates the 22.5s cold start

- guarded (skips if python313.zip already present); non-fatal
 2026-06-17 01:08:00 -07:00
Eric 41f812f7d6 [eric] app-builder: ship webapp node_modules as .tar.gz, not pre-extracted (build perf) 
- pre-extracting ~30k files into resources blew the windows build past 50min (squirrel lzma on tiny files) + bloated the installer

- revert step 4b to a single node_modules.<digest>.tar.gz (mirrors mac); runtime extracts to warm cache in the background at startup (off the create path)

- runtime _bundled_extracted_modules() stays as a harmless fallback (returns None -> tar path)
 2026-06-16 23:44:21 -07:00
Eric 947a6c1db5 [eric] perf: draft opt-in defender exclusion helper for windows cold-start (#9 item 5) 
- scripts/add-defender-exclusion.ps1: dry-run default; -Apply/-Remove (admin); -Status

- excludes %LOCALAPPDATA%/%APPDATA%/~ openswarm dirs; kills defender cold-scan entirely

- security-sensitive: opt-in only, never silent; settings-toggle design documented, not auto-applied
 2026-06-16 22:23:11 -07:00