SaladDay
5360061bb6
fix(pi): reconcile native resources across directory moves
2026-08-03 02:08:44 +00:00
SaladDay
969cdaed5b
fix(pi): make catalog compensation conflict-safe
2026-08-03 02:08:38 +00:00
SaladDay
57ba6beb43
fix(pi): harden gateway runtime boundaries
2026-08-03 02:08:32 +00:00
SaladDay
93eddd5521
docs(pi): refresh final scope audit
2026-08-03 00:38:38 +00:00
SaladDay
9f910270ef
fix(pi): surface pending takeover state
2026-08-03 00:38:34 +00:00
SaladDay
9d0e75d56a
fix(pi): restore catalog and takeover authority boundaries
2026-08-03 00:38:29 +00:00
SaladDay
26447effa2
fix(pi): preserve skill ownership through install failures
2026-08-03 00:38:06 +00:00
SaladDay
cf978c1346
fix(pi): make shared file commits collision safe
2026-08-03 00:38:02 +00:00
SaladDay
6953f9fffd
fix(pi): harden gateway failover and command isolation
2026-08-03 00:37:57 +00:00
SaladDay
816a8b3928
docs(pi): record parity and pinned behavior evidence
2026-08-02 22:52:40 +00:00
SaladDay
a88a58b516
feat(pi): expose first-class desktop workflows
2026-08-02 22:52:35 +00:00
SaladDay
7609ff799e
feat(pi): add native catalog and gateway data plane
2026-08-02 22:52:26 +00:00
SaladDay
26a95aeb05
docs(pi): define main project contract
2026-08-02 17:05:14 +00:00
SaladDay
9fffc8853d
fix(pi): close native inspection review gaps
2026-08-02 16:40:45 +00:00
SaladDay
d2ad7995a3
fix(pi): fail closed on unrepresentable compat spread
2026-08-02 16:16:14 +00:00
SaladDay
bd3e2e54fc
docs(pi): adopt incremental review scope
2026-08-02 15:47:02 +00:00
SaladDay
2a0a8125eb
fix(pi): certify pinned native inspection semantics
2026-08-02 15:24:48 +00:00
SaladDay
15c735f040
fix(pi): mirror pinned native runtime semantics
2026-08-02 13:56:18 +00:00
SaladDay
2f856b0ffb
fix(pi): validate deferred headers after resolution
2026-08-02 12:05:25 +00:00
SaladDay
9b5a146323
refactor(pi): certify native inspection boundary
2026-08-02 10:12:00 +00:00
SaladDay
2533db035a
docs(database): close restore hardening prerequisite
2026-08-02 10:10:45 +00:00
SaladDay
3fa6b1f158
refactor(database): scope untrusted restore to N/N-1
2026-08-02 05:29:48 +00:00
SaladDay
ce6edf68a0
fix(database): reject hidden migration source columns
2026-08-01 19:56:17 +00:00
SaladDay
c036c6359e
refactor(database): construct untrusted migrations from source specs
2026-08-01 19:45:36 +00:00
SaladDay
29cccd5bd3
fix(database): fail closed across restore migrations
...
Classify every historical migration boundary, thread the restore context through the full chain, reject repair or synthesis for untrusted inputs, and add SQL/binary public-entry certification for damaged and valid legacy fixtures.
2026-08-01 17:04:54 +00:00
SaladDay
28530ff641
fix(database): enforce canonical restore trust boundaries
2026-08-01 16:01:00 +00:00
SaladDay
89961dff28
fix(database): close canonical restore review gaps
2026-08-01 14:12:08 +00:00
SaladDay
9a87512224
refactor(database): certify canonical restore boundary
2026-08-01 12:55:39 +00:00
SaladDay
2841811700
refactor(database): complete prerequisite B
2026-08-01 11:44:50 +00:00
SaladDay
22c010079a
fix(provider): enforce durable identity boundaries
2026-08-01 09:09:14 +00:00
SaladDay
37e78166c1
refactor(provider): complete prerequisite A ownership
2026-08-01 08:37:49 +00:00
SaladDay
2bc92e0f79
refactor(provider): certify typed write ownership
...
Freeze prerequisite A as a component-level certification unit. Add the immutable v5 certification suite, split create/update row DTOs, preserve immutable creation time, map strict-create races to AppError::Conflict, make aggregate compensation insert-or-restore, and enforce reconcile preconditions through a single-lock transaction primitive.
Old save_provider callsite classification remains exhaustively recorded in 4f78451405575158ff6562c7021c7f31f2860780; this checkpoint does not add or reclassify an omitted legacy callsite. It tightens the remaining reconciliation classifications there: default live import is [create]; OpenCode/OpenClaw/Hermes existing branches are [update] and absent branches are [create]; universal Claude/Codex/Gemini branches are [create/update] selected from an observed fingerprint. The sealed compensation helper remains the only [restore] path. The old reconcile_provider_record symbol is deleted.
Remaining update_provider_settings_config callsites are classified as [update]: codex_history_migration updates an already-read Codex row; proxy token synchronization updates already-read Claude, Codex, Gemini, and GrokBuild rows. Each now uses ProviderKey plus ProviderRowUpdate, explicitly removes hydrated endpoint projections, preserves endpoint authority, and fails on a missing row instead of silently succeeding.
2026-08-01 07:48:57 +00:00
SaladDay
10f2dacbe4
config(pi): execute pinned native schema and composer oracles
...
Evaluate raw Pi documents with the vendored upstream TypeBox schema and replay composer/transport expectations captured by actually executing Pi ab366ebe94cacd419d986be454f12b1b9913aaca.
Bind all 252 canonical fields to successful raw and own-layer composer evidence (70 provider, 92 model, 90 override), fail closed where pinned runtime context is unavailable, expose structured inspection, and enforce module/write/restore boundaries with negative fixtures.
2026-07-31 18:07:21 +00:00
SaladDay
4f78451405
storage(pi): isolate typed provider writes and canonical restore
...
Replace the generic Provider save/upsert surface with strict typed
create/update/rename/endpoint operations. Keep aggregate hydration read-only,
preserve nullable endpoint timestamps end to end, and make service create own
the initial endpoint set atomically.
Restore SQL and binary backups only through UntrustedScratch, migrate and copy
fixed data columns into a fresh CanonicalStage, validate the canonical result,
then publish through the Backup API. The imported schema is never eligible to
become the live schema.
Old save_provider callsite classification
==========================================
Inventory authority: abandoned 5a385fc8 tree. The old definition at
src-tauri/src/database/dao/providers.rs:180 is deleted and is not a callsite.
Production callsites:
- src-tauri/src/commands/provider.rs:253 [create] Claude Desktop import creates
one absent aggregate; it now strict-inserts the row and initial endpoints in
one transaction.
- src-tauri/src/database/dao/providers.rs:638 [create] official seed first
proves absence, then strict-creates; a racing insert is a conflict.
- src-tauri/src/database/dao/providers.rs:704 [create] on-demand seed first
proves absence, then strict-creates; it cannot overwrite an existing row.
- src-tauri/src/services/omo.rs:291 [create] OMO import constructs a new
aggregate and strict-creates it; OMO is not eligible for rename.
- src-tauri/src/services/provider/endpoints.rs:85 [update] endpoint last-used
is not a Provider-row save; it now calls the exact touch endpoint operation.
- src-tauri/src/services/provider/live.rs:1567 [create/update] default live
import is reconciliation: read first, then strict create or strict update.
- src-tauri/src/services/provider/live.rs:1743 [update] an existing OpenCode
live provider follows the strict row-update branch.
- src-tauri/src/services/provider/live.rs:1770 [create] a new OpenCode live
provider follows the strict aggregate-create branch.
- src-tauri/src/services/provider/live.rs:1825 [update] an existing OpenClaw
live provider follows the strict row-update branch.
- src-tauri/src/services/provider/live.rs:1858 [create] a new OpenClaw live
provider follows the strict aggregate-create branch.
- src-tauri/src/services/provider/live.rs:1900 [update] an existing Hermes live
provider follows the strict row-update branch.
- src-tauri/src/services/provider/live.rs:1926 [create] a new Hermes live
provider follows the strict aggregate-create branch.
- src-tauri/src/services/provider/mod.rs:2568 [create] ProviderService::add owns
strict aggregate creation and all initial endpoints.
- src-tauri/src/services/provider/mod.rs:2680 [rename] an additive DB-only key
change now uses the dedicated transactional rename after eligibility checks.
- src-tauri/src/services/provider/mod.rs:2711 [update] OMO edit updates exactly
the existing main row after its live-file coordination.
- src-tauri/src/services/provider/mod.rs:2740 [update] additive-provider edit
updates exactly the existing main row after resolving live ownership.
- src-tauri/src/services/provider/mod.rs:2750 [update] switch-mode edit updates
exactly the existing main row and never inserts.
- src-tauri/src/services/provider/mod.rs:2948 [update] remove-from-live changes
only the existing provider's live-managed marker.
- src-tauri/src/services/provider/mod.rs:3120 [update] switch backfill updates
only the existing current provider row.
- src-tauri/src/services/provider/mod.rs:3174 [update] successful additive
switch changes only the existing live-managed marker.
- src-tauri/src/services/provider/mod.rs:3315 [update] common-config migration
updates only each already-read existing row.
- src-tauri/src/services/provider/mod.rs:3895 [update] Gemini credential scrub
updates only each already-read existing row.
- src-tauri/src/services/provider/mod.rs:4082 [update] sort ordering is routed
to the dedicated sort-index state operation, not row replacement.
- src-tauri/src/services/provider/mod.rs:4636 [create/update] universal-to-
Claude reconciliation reads the target and selects strict create or update.
- src-tauri/src/services/provider/mod.rs:4651 [create/update] universal-to-
Codex reconciliation reads the target and selects strict create or update.
- src-tauri/src/services/provider/mod.rs:4665 [create/update] universal-to-
Gemini reconciliation reads the target and selects strict create or update.
Required indirect ownership paths:
- src-tauri/src/deeplink/provider.rs [create] the old indirect flow called
ProviderService::add and then appended endpoints one by one. It now supplies
every non-primary endpoint to one strict aggregate create, so hydration is
complete atomically and a duplicate is zero-side-effect.
- [restore] no old generic-save callsite is reclassified as restore. Exact
aggregate replacement exists only as the sealed
restore_provider_aggregate_on_tx compensation primitive.
Test-only callsites:
Every item below is classified [test]. Each is fixture setup, not a production
write authority, and is migrated to a real ProviderService entry where the
behavior is under test or to the cfg(test)-only typed fixture reconciler where
the test merely needs pre-existing rows.
- src-tauri/src/codex_history_migration.rs:1442 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:1452 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:2174 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:2176 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:2199 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:2219 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:2247 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:2267 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:2288 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:2320 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:2393 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:2449 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:2498 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:2555 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:2604 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:2625 [test] migration fixture setup.
- src-tauri/src/database/dao/providers.rs:754 [test] DAO fixture setup.
- src-tauri/src/proxy/provider_router.rs:351 [test] router fixture setup.
- src-tauri/src/proxy/provider_router.rs:352 [test] router fixture setup.
- src-tauri/src/proxy/provider_router.rs:377 [test] router fixture setup.
- src-tauri/src/proxy/provider_router.rs:378 [test] router fixture setup.
- src-tauri/src/proxy/provider_router.rs:410 [test] router fixture setup.
- src-tauri/src/proxy/provider_router.rs:411 [test] router fixture setup.
- src-tauri/src/proxy/provider_router.rs:447 [test] router fixture setup.
- src-tauri/src/proxy/provider_router.rs:448 [test] router fixture setup.
- src-tauri/src/proxy/provider_router.rs:488 [test] router fixture setup.
- src-tauri/src/services/provider/mod.rs:485 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:586 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:813 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:825 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:1472 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:1607 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:1737 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:1945 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:1952 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:1978 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:2006 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:2056 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:2130 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:2167 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:2207 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:2235 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:2270 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:2320 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:2362 [test] service fixture setup.
- src-tauri/src/services/proxy.rs:3762 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:3948 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:4034 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:4095 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:4114 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:4263 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:4341 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:4421 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:4533 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:4651 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:4787 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:5264 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:5320 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:5385 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:5387 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:5460 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:5462 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:5611 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:5613 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:5615 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:5698 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:5700 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:5998 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:6000 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:6173 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:6175 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:6417 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:6419 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:6553 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:6555 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:6635 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:6637 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:6919 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:7173 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:7175 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:7240 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:7242 [test] proxy fixture setup.
- src-tauri/tests/profile_roundtrip.rs:112 [test] profile fixture create.
- src-tauri/tests/profile_roundtrip.rs:116 [test] profile fixture create.
- src-tauri/tests/profile_roundtrip.rs:126 [test] profile fixture create.
- src-tauri/tests/profile_roundtrip.rs:133 [test] profile fixture create.
- src-tauri/tests/profile_roundtrip.rs:292 [test] profile fixture create.
- src-tauri/tests/profile_roundtrip.rs:501 [test] profile fixture create.
- src-tauri/tests/profile_roundtrip.rs:505 [test] profile fixture create.
- src-tauri/tests/profile_roundtrip.rs:670 [test] profile fixture create.
- src-tauri/tests/profile_roundtrip.rs:677 [test] profile fixture create.
- src-tauri/tests/profile_roundtrip.rs:762 [test] Linux Desktop fixture create.
- src-tauri/tests/profile_roundtrip.rs:769 [test] Linux Desktop fixture create.
- src-tauri/tests/provider_commands.rs:69 [test] command fixture create.
- src-tauri/tests/provider_service.rs:2927 [test] service fixture create.
2026-07-31 18:06:59 +00:00
SaladDay
3dc188313e
domain(pi): add managed model and capability contracts
2026-07-31 17:52:59 +00:00
SaladDay
119d795121
docs(pi): freeze support contracts and extension design
2026-07-31 17:52:24 +00:00
Komi
4bfb3fc30d
fix(usage): dedupe Claude Desktop proxy and session logs ( #5951 )
2026-07-31 15:00:18 +08:00
Thefool
c49cf96a16
fix(grokbuild): complete proxy and deep-link integrations ( #5677 )
...
* fix(grokbuild): complete proxy integration
* fix(deeplink): preview GrokBuild configs safely
* test(app): stabilize provider integration suite
* fix(grokbuild): address review feedback
* fix(grokbuild): resolve remaining review findings
* fix(grokbuild): use native sessions and harden previews
2026-07-31 14:56:42 +08:00
Leo
b884595a23
fix(i18n): prevent zh-TW tool management fallbacks ( #5943 )
...
Complete the Traditional Chinese strings for the About-page tool manager and align the install/update hint with the current supported tools. Add locale coverage that requires every tool-management label and preserves interpolation variables across all four translations.
Constraint: The About tool manager was extended across three commits without matching zh-TW entries.
Rejected: Rely on i18next fallback text | leaves the Traditional Chinese UI partially English and hides future locale drift.
Confidence: high
Scope-risk: narrow
Directive: Update toolManagementLocales.test.ts whenever the About tool manager adds a translatable label.
Tested: pnpm typecheck; pnpm format:check; 7 locale tests; 575 Vitest tests; zero missing zh-TW settings keys
Not-tested: Manual visual inspection of the About page
Related: e3df86587 , ea604a182 , 014c82d28
2026-07-31 12:23:36 +08:00
SaladDay
4317bd9981
refactor: remove redundant proxy query paths ( #5928 )
2026-07-31 08:52:22 +08:00
SaladDay
3c1154bed9
refactor: remove superseded dead code ( #5916 )
2026-07-30 22:32:10 +08:00
Jason
c0ff89b9b2
docs(changelog): sync 3.19.0 security section with the release notes
v3.19.0
2026-07-30 12:02:34 +08:00
Jason
3b9d059343
docs(release): add v3.19.0 release notes
2026-07-30 12:01:38 +08:00
Jason
6b13d01825
chore(release): v3.19.0
2026-07-30 09:29:54 +08:00
Jason
f5f4281d06
refactor(ui): always show icon-only app switcher, drop auto-compact
...
The toolbar app switcher used a ResizeObserver-based overflow detection
(useAutoCompact) to collapse app labels when space ran out. With the
number of managed apps growing, the labels are collapsed in practice
anyway, so remove the mechanism and render icons only. Buttons now carry
title/aria-label so app names remain discoverable via tooltip and
accessible to screen readers.
2026-07-30 08:52:48 +08:00
ayanamislover
56fb46c093
perf(codex): cache parent rollout timelines across fork cutoffs ( #5626 )
...
* perf(codex): cache parent rollout timelines
* fix(codex): harden parent timeline cache
* fix(codex): tighten replay cache invalidation
---------
Co-authored-by: Ayanami <ay@nami.ltd >
Co-authored-by: SaladDay <92240037+SaladDay@users.noreply.github.com >
2026-07-29 23:49:46 +08:00
Jason
30409878bd
chore(presets): add PackyCode backup endpoints
...
Add three fallback endpoints alongside the primary www.packyapi.ai across
the five preset files that support endpointCandidates:
https://cf.api.fan
https://slb-v1.api.fan
https://www.packyapi.com
The /v1 suffix follows each file's existing convention rather than the
literal values supplied: bare domains for the Anthropic-native presets
(Claude Code, Claude Desktop, Gemini), /v1 for Codex and Grok Build.
Candidates are consumed as complete base URLs by the endpoint picker and
the speed test, so they must sit at the same path level as the primary.
www.packyapi.com is the pre-b0482320 domain, kept here deliberately as a
fallback -- not a leftover of that migration.
OpenCode, OpenClaw and Hermes have no endpointCandidates field in their
interfaces and are untouched.
2026-07-29 17:09:29 +08:00
Jason
bfb767ae17
chore(presets): align Code0 and Qiniu Gemini defaults to 3.6 Flash
...
Both presets pinned gemini-3.1-pro-preview while the other Gemini presets
had moved to gemini-3.6-flash. Note this is a tier change rather than a
version bump: there is no 3.6 Pro release and 3.5 Pro is still limited to
partner testing, so the current baseline is a flash-tier model.
The gemini-3.1-pro-preview row in the built-in pricing seed is kept so
historical usage keeps its cost.
2026-07-29 16:40:31 +08:00
Jason
dbb265956e
feat(presets): add A6API sponsor preset across all supported apps
...
Add the A6API aggregator preset to Claude Code, Claude Desktop, Codex,
Gemini CLI, OpenCode, OpenClaw, Hermes and Grok Build, placed after
NekoCode in the sponsor ordering. Base URLs follow the per-client
convention: no /v1 suffix for the Anthropic-native and Gemini endpoints,
/v1 for the OpenAI-compatible ones. Model defaults mirror NekoCode.
Also add the four-locale promotion copy, the sponsor row in all four
READMEs and the icon index entry.
The supplied artwork was resized before landing: the icon was a 1024x1024
PNG base64-wrapped in an SVG shell (652K, the largest entry in iconUrls
and shipped in every build), now a 256x256 PNG at 60K; the banners were
16:9, the only ones deviating from the 2.406 project standard, now
cropped to 1280x532.
2026-07-29 16:40:23 +08:00
Jason
87b0e3fb85
fix(test): pin zip extraction temp dir instead of hijacking TMPDIR
...
The two cleanup-guard tests introduced in ff3bc242 set the process-global
TMPDIR to a scratch dir and asserted it ended up empty. serial_test only
serializes marked tests, so any concurrent test creating a tempdir inside
the hijacked window landed in scratch and randomly failed the emptiness
assertion on Ubuntu/macOS CI (Windows ignores TMPDIR).
Add an extract_local_zip_in(zip_path, base_dir) seam that takes the temp
base explicitly; the public function delegates with std::env::temp_dir().
Tests now pass their private scratch dir directly, dropping the TMPDIR
mutation and the serial markers — the race is impossible by construction.
2026-07-29 10:22:30 +08:00