mirror of
https://github.com/NeuralNomadsAI/CodeNomad.git
synced 2026-11-01 11:30:33 +00:00
6 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Pascal André
|
dac236c8fd
|
feat(tauri): signed cross-platform updates with stable and preview feeds (#786)
Desktop Tauri builds now update themselves in place on Windows (signed NSIS), macOS x64/arm64 (signed .app.tar.gz) and Linux x64 (signed AppImage), and Linux gains AppImage distribution. The application no longer shells out to `winget upgrade`; WinGet remains a distribution channel. Updates follow the same two feeds as the server notifications: `stable` offers GitHub's latest final release when it is newer; `preview` (dev + release) offers the newest publication of any kind, ordered by publication because dev labels reuse their base version. The saved `server.updateFeed` selects the feed (otherwise the build label). Only releases carrying their signed `latest.json` are installable, so releases still building are never offered. Native code owns URLs, keys and installers: renderers pass only the feed and, after an explicit "Install and restart", the accepted version. The manifest must announce exactly the selected version and `requireSignedVersion` binds it to the signature. Full verification precedes shutdown; installation and restart are admitted atomically with an all-window flush; timeouts, cancellation and failed cleanup discard the installer without replay. Failures belong to the installing window, survive reloads and are reported once; concurrent checks report "busy". Menu actions reach only the focused local application document. The vendored tauri-plugin-updater 2.12.0 runs its Windows exit callback only after a successful installer launch. Publication stages four verified payloads (signed version required) and publishes each release's `latest.json` only after validating every receipt and uploaded digest; rebuilt tags drop a stale manifest first. The signing private key reaches only `tauri build` steps. Unsigned builds and PR runs publish nothing. Debian/RPM and unsupported formats use the release-page fallback. The Tauri CLI minimum is 2.11.5. Validated by eight rounds of independent review (zero findings on both native/CI and renderer/docs), 268 native tests, script and browser regressions, real signed update trials on Windows and Linux (from loopback endpoints, before feed selection), and published-package trials on Windows, Linux and macOS x64. A production-signed dev prerelease, macOS signed updates and draft restoration across an update remain to be exercised. |
||
|
Pascal André
|
c954841f09
|
revert(missions): undo PR #673 without dropping later dev changes
Revert merge
|
||
|
Pascal André
|
4d7408631d
|
feat(missions): bundle project coordination with the desktop runtime
Provision codenomad.missions through connected-daemon discovery and independent backend presence instead of requiring a source plugin in every project. Bundle the integration for Electron and Tauri, retain project-scoped mission journals across shutdown, and use the same secondary surface as Status. Complete the existing native actor execution work: persist explicit agent/model/variant choices, validate catalog selections and avoid switching busy actors. Admit assignment and report writes through the authenticated desktop bridge with durable-contract verification, session ownership, connection and worktree fences, and per-send profile environment synchronization. Advance the older source branch client/plugin pin to 2.0.11 and retain its bounded runtime metadata adaptation. The isolated 2.0.16 mission fixture passes native catalog, selection, busy queues, conflict, environment, reports, reconnect and idempotence checks. Server, UI and plugin typechecks, 31 mission tests, 10 lifecycle/transport tests and six resource-layout tests pass. |
||
|
Pascal André
|
f0a6e2e0dd
|
feat(browser): add autonomous native previews (#666)
## Summary
- Add autonomous native browser previews for Electron and Windows Tauri,
using the authenticated backend/native bridge already shared with
desktop inspection.
- Ship one bundled **`codenomad.automation`** V2 plugin for browser,
inspect, act and screenshot. All tools are available by backend
presence; ordinary desktop startup prepares the instrumentation. Remove
the Developer Mode toggle, marker-based activation and activation
restart requirement.
- Provision through native discovery using the **connected daemon's
authenticated `config.get` roots**, including WSL and reconnects. Share
installation/lease mechanics with pruning, preserve user-authored
entries and older backends' leases, and unwind stale or interrupted
preparation.
- Preserve session/location ownership, inspected-host pinning, browser
registration/navigation generations, local-window targeting and
authenticated transport. The OpenCode daemon remains externally owned.
## Gatekeeper review — September 18, 2026
Merged current `dev` at `
|
||
|
Pascal André
|
ea37f97bea
|
feat(pruning): restore opt-in selective deletion through native plugin RPC (#686)
## Summary Restore selective deletion of completed assistant tool/reasoning content after OpenCode removed `session.messageUpdate`, without forking OpenCode or opening a generic RPC proxy. The original draft's unconditional `maintenance_required` stub is replaced by a working **experimental, explicit opt-in** plugin path for the audited `0.0.0-beta-19419` runtime. The default remains read-only. Unknown runtimes/storage and active native execution fail closed. Nothing is installed or enabled on app startup. ## Implementation - Keep individual/message/group/session cleanup entry points. Send selected technical indices and a canonical SHA-256 revision, never arbitrary replacement content, SQL, database filenames or caller-selected locations. - Use an ownership-checked CodeNomad broker with a fixed RPC ID/method/location and worktree-deletion fence. Keep the removed PATCH and generic RPC routes blocked. - Bind the plugin's explicitly configured database connection to the actual daemon DB with a fresh `ctx.storage` challenge. Inside a synchronous SQLite write transaction, recheck directory/project/workspace ownership, native durable execution claim, staged revert/compaction state, event ownership and retained payloads. - Rely on the audited native **write-ahead execution claim before runner history reads**, not an `idle` check, plugin mutex or `BEGIN IMMEDIATE` alone. Never set or release the native claim ourselves. - CAS only the completed assistant's content array. Preserve IDs, ordering, text, snapshots, usage and metadata. Commit a content-free idempotency receipt atomically with the change; identical retries cannot delete a second shifted block. - Emit the custom invalidation after commit. Re-read via the native API, invalidate the SDK transcript and pending rotations, and fence late reads against newer invalidations. Add a public-API TUI cache companion and reconnect handling. - Correct native Windows path encoding; support more than 4,096 selected parts within explicit request/message budgets. - Provide an independently packable plugin with main and `./tui` entrypoints, deployment/safety docs, and a Windows/Linux/macOS native package CI matrix. Plugin installation remains manual and separately approved. ## Validation performed locally | Check | Result | |---|---| | Server/plugin/SQLite/broker/proxy tests | 72 passed | | UI actions, events, SDK projection and stale-read tests | 60 passed | | Plugin/SQLite/TUI-companion tests under Node 22 | 30 passed | | Server and UI TypeScript checks | Passed | | Production UI build | Passed; existing large-chunk warnings | | Official Windows x64 beta-19419 executable | Passed on a private daemon and generated DB | | Independently packed and installed plugin | Same native test passed, outside the checkout | The native integration test uses the real beta-19271 network client against the official beta-19419 runtime, with a local synthetic provider and no credentials. It verifies actual preview/prune RPC, refusal while a primary generation holds the native claim, both prompt/transaction orderings, idempotent retry, two event subscribers, native re-reading, the subsequent primary model payload, fork isolation, pre-compaction history without summary changes, and persistence after server restart. The new three-OS native CI matrix must pass on this head before merge. No CI result is inferred from the local Windows run. ## Boundaries and remaining validation - This is a reviewable opt-in implementation, **not general availability across OpenCode versions/providers/platforms**. Exact runtime gating is intentional; don't widen it without re-auditing/testing. - Interactive official TUI, two native CodeNomad windows/scroll behavior, WSL, provider-specific continuation state and budget/token estimates are not claimed as validated. TUI companion tests use its cache contract, not an interactive terminal. Two HTTP subscribers are not two GUI windows. - Existing bulk cleanup is per-message and reports failure counts; dedicated installation/capability and bulk progress/cancel UI are not added here. - Existing summaries/native checkpoints, fork copies and already assembled/sent requests are not retroactively scrubbed. Historical usage remains historical usage; mock token values are not a token-savings measurement. - This changes persisted V2 content, not only visibility. It frees reusable SQLite pages but does **not** promise a smaller physical file. No VACUUM, V1 cleanup, durable-event rewriting, automatic backup restoration or universal repair is included. - No active user DB was changed, no shared-daemon plugin installed, no shared OpenCode service stopped/upgraded, and no native desktop executable/profile rebuilt or replaced. Tests use isolated synthetic data only. ## Documentation - [Request flow and validation](dev-docs/SESSION_PRUNING_RPC.md) - [Audited safety boundary](dev-docs/SESSION_PRUNING_SAFETY.md) - [Explicit deployment and recovery](dev-docs/SESSION_PRUNING_DEPLOYMENT.md) References: anomalyco/opencode#44984, anomalyco/opencode#48043, anomalyco/opencode#48090 and the maintainer's plugin/RPC direction. No upstream API or distribution fork is introduced. |
||
|
Pascal André
|
52f0e62935
|
feat(opencode): migrate CodeNomad to native V2 (#647)
# OpenCode V2 Migration and Desktop Restructuring ## Summary This branch replaces CodeNomad's OpenCode V1 SDK, custom plugin, and per-workspace runtime architecture with the native OpenCode V2 client and one shared OpenCode service. It intentionally ships no V1 runtime fallback. The scope includes native location ownership, Forms and Shell resources, project-wide cursor pagination, bounded resident message windows, streaming reconciliation, duplicate-folder instances, multi-window Electron/Tauri behavior, content-addressed restore, worktree mutation fencing, and reproducible desktop packaging. The reviewed implementation head is `dea20996`. UI and server resolve `@opencode-ai/client@beta` to `beta-18999`; the runtime CLI is managed independently. The official comparison baseline remains `upstream/beta` at `eb1ac54d73`. Full details: [`MIGRATION_V2.md`](./MIGRATION_V2.md), [`DESKTOP_V2_COMPARISON.md`](./DESKTOP_V2_COMPARISON.md), and [`dev-docs/DEV_V2_CODE_REDUCTION.md`](./dev-docs/DEV_V2_CODE_REDUCTION.md). ## Stabilization Fixes - Preserve manual scroll escape across pagination, remote updates, capped-window shifts, tab changes, and desktop restore; only a local prompt submission forces the bottom. - Keep the timeline resident window capped at 200 messages. Ordered window slides use Virtua shift, while reorder, pagination, and non-aligned replacement remount with a fresh measurement epoch. - Finalize the temporary `200 -> 201 -> 200` transition in a generation-guarded microtask before paint and compensate followed content growth from a `ResizeObserver` attached to the mounted Virtua root. - Keep all pending inbox prompts after delivered transcript messages in native inbox admission order. - Add a persisted `steer`/`queue` follow-up preference; the alternate shortcut uses the inverse while idle sends remain `steer`. - Edit a pending prompt only after authoritative inbox cancellation succeeds, then restore its text, structured payload, files, and agent references to the composer. - Expose native `session.background` through the ownership-checked proxy, a prompt action, and `Ctrl/Cmd+B`. - Remove the duplicate model-selector "show all" action and make the favorites toggle label reflect its current action. - Restore permission/Form synchronization plus skill, reference, MCP-resource, and websearch-provider reads in the reviewed proxy allowlist. - Validate and preserve native location workspace identities for root/worktree requests, session moves/imports, cursors, and global Forms. ## Capability Decisions | Capability | Native V2 availability | CodeNomad `DEV-v2` decision | Revisit or complete when | | --- | --- | --- | --- | | Assistant content mutation | `session.messageUpdate` authoritatively replaces the text, reasoning, and tool content of a completed assistant message. There is still no generic deletion of a complete delivered message or mutation of user messages. | Restores individual tool/reasoning deletion through the native update route. Arbitrary whole-message deletion remains absent rather than locally simulated. | Add broader deletion only if V2 exposes an authoritative operation for the required message type. | | Bulk tool and reasoning cleanup | No native bulk operation, but `session.messageUpdate` can safely compose cleanup one assistant message at a time. | Restores selected-group and full-session technical-part cleanup through authoritative per-message updates. | A native bulk operation is only needed if per-message updates become a measured performance problem. | | Delete-to-boundary / undo | `session.revert.stage` and `session.revert.clear` use V2 staged-revert semantics instead of arbitrary deletion. | Command-palette Undo uses `revert.stage`; Redo clears the staged revert through `revert.clear`. | Revisit only if V2 adds broader authoritative transcript deletion. | | Compaction | Native checkpoint compaction summarizes the older head and retains a server-selected recent tail controlled by `compaction.keep.tokens`. | Uses `session.compact`; there is no message-level selective compaction. CodeNomad displays the partial summary through the same reactive streaming path as text and reasoning, then replaces it with the terminal summary. | Add scoped controls only if V2 defines scoped compaction semantics. | | Transcript pagination authority | Message pages expose only opaque previous/next cursors. They provide no transcript revision, total, absolute range, position, or random seek target. | Uses bounded cursor traversal and a 200-message resident window, with defensive reconciliation after destructive events. It cannot prove that pages loaded across compaction or revert belong to one snapshot. | V2 adds snapshot revision authority ([#43766](https://github.com/anomalyco/opencode/issues/43766)) and navigable position metadata ([#44660](https://github.com/anomalyco/opencode/issues/44660)). | | Full-session search | `session.list(search)` filters session titles only. There is no server transcript-search endpoint returning message identity, excerpt, navigable position, and transcript revision. | Retained through exhaustive message-cursor traversal while keeping only the 200-message resident window and collected matches. Large searches still fetch every page. | V2 exposes transcript search ([#45801](https://github.com/anomalyco/opencode/issues/45801)) with a target that composes with transcript revision and seek metadata. | | Queued prompt management | Native inbox list, cancel, steer, and queue operations cover authoritative follow-up delivery. The TUI's edit action cancels a queued prompt before restoring it to the composer; it is not an atomic inbox update. | Implements persisted primary `steer`/`queue` delivery, inverse alternate shortcut, delivery switching, cancellation, cancel-first composer restoration with structured payload retention, and native-order timeline projection. | Revisit atomic editing or reordering only if V2 adds an authoritative operation and a concrete product need is established. | | Background execution | Native `session.background` moves blocking tools out of the foreground; Shell resources separately support listing, bounded output, and removal. | Exposes `session.background` through the proxy and UI with `Ctrl/Cmd+B`, and replaces the custom process manager with native Shells. Unsupported controls such as rename remain removed. | Add controls only when the native session or Shell APIs support them. | | Service lifecycle | V2 uses one shared externally owned service rather than one runtime per workspace. | CodeNomad discovers or starts the service. Stop Workspace evicts the native location after its final logical owner is removed; application shutdown never stops the daemon. | No parity work planned unless V2 changes service ownership semantics. | ## Validation Migration gate (`878550ca`): - UI and server TypeScript typechecks. - 86 focused UI tests covering follow, pagination, queue ordering, bottom pinning, shortcuts, delivery resolution, and model visibility. - 64 focused server tests covering proxy ownership/location enforcement and shared-service workspace identity. - Production UI/server build. - Tauri `cargo check` and all 121 Rust tests. - `git diff --check`. Timeline stabilization (`dea20996`): - UI TypeScript typecheck and all 68 focused timeline, pagination, request-authority, and restore tests. - Tauri release build against the `beta-18999` lock. - Native Developer Mode validation: no remount or empty frame during capped shifts, same-cycle growth compensation, preserved manual escape, and inactive-tab anchor restore within 0.3125 px. ## Remaining Gaps - Active-session-location authority for MCP/plugin status. - Optional interactive PTY, session export, and reference/MCP-resource attachment UI. - Desktop release signing/notarization hardening. |