* docs(changelog): add the missing release-note receipt for #5766
`scripts/release/check-feature-release-notes.sh` requires every issue-linked
`feat:` commit in the release range to leave a durable changelog receipt.
79ed88f377 ("feat(config): bind catalog and route resolution (#5766)")
landed without one, so `scripts/release/check-versions.sh` now exits 1 on
plain main:
$ git worktree add --detach wt origin/main # 6ea10032f9
$ ./scripts/release/check-versions.sh
::error::Feature commit 79ed88f377 references #5766, but no release-note
receipt exists in CHANGELOG.md docs/CHANGELOG_ARCHIVE.md.
exit=1
"Version drift" is a required status check, so this failed every pull request
opened or re-run against current main, not just the one that surfaced it.
The entry says plainly that #5766 is additive plumbing with no call-site or
user-visible change, rather than inventing a user-facing feature to satisfy
the gate. `crates/tui/CHANGELOG.md` is regenerated with
`./scripts/sync-changelog.sh` so the slice check passes too.
After this commit `./scripts/release/check-versions.sh` exits 0:
Feature release-note receipts OK: 47 linked issue reference(s) checked.
Version state OK: workspace=0.9.11, npm=0.9.11, npm-binary=0.9.11.
Signed-off-by: CodeWhale Bot <bot@codewhale.net>
* ci: stop repo-wide and history-wide audits from failing innocent PRs
A required per-PR check should assert a property of the change. Five of ours
assert a property of the whole repository or of already-merged history, so a
branch fails for debt it did not add and the fix is rebasing rather than
editing code. That is how the queue got stuck, and it trains people to read a
red check as noise.
Demoted to advisory on `pull_request` only, still blocking on pushes to main:
- Check dead-code budget (absolute #[allow(dead_code)] total)
- Check runtime-contract budget
- Check persistence-backlog budget
- Check harvested contributor credit
check-versions.sh keeps every tree-state check blocking everywhere. Only its
two range audits -- check 12 (feature release-note receipts) and check 7
(contributor credit), both scanning previous-tag..HEAD -- become advisory, and
only for the per-PR CI job, via a new --range-audit-advisory flag. Every
release path still runs them blocking: release-candidate.yml, auto-tag.yml,
release.yml, and prepare-release.sh. Combining the new flag with
--require-dated-release is refused outright so publication can never skip them.
Measured on the merge of origin/main + pr/5740, a tree with the real missing
#5766 receipt:
$ ./scripts/release/check-versions.sh # exit 1
::error::Feature commit 79ed88f377 references #5766, but no
release-note receipt exists in CHANGELOG.md docs/CHANGELOG_ARCHIVE.md.
$ ./scripts/release/check-versions.sh --range-audit-advisory # exit 0
::warning::Missing feature release-note receipt(s) above. Advisory here
because this audits already-merged commits in v0.9.10..HEAD, not this change.
Version state OK: workspace=0.9.11, npm=0.9.11, npm-binary=0.9.11.
actionlint is clean on the edited workflow.
Signed-off-by: CodeWhale Bot <bot@codewhale.net>
Entire-Checkpoint: 01M1D74JXS2F91WDY9DSKQ787E
* fix(tui): silence clippy::explicit_counter_loop in the startup mark
rust 1.98's clippy added `explicit_counter_loop` coverage for this shape, and
CI's `dtolnay/rust-toolchain@master` picked it up. `Lint` is a required check,
so main is currently red on it and every pull request inherits the failure:
error: the variable `x` is used as a loop counter
--> crates/tui/src/tui/mark.rs:182:9
|
182 | for glyph in line.chars() {
| help: consider using: `for (x, glyph) in (x0..).zip(line.chars())`
= note: `-D clippy::explicit-counter-loop` implied by `-D warnings`
error: could not compile `codewhale-tui` (lib) due to 1 previous error
Applied clippy's own suggestion. Behaviour is identical: `x` still starts at
`x0` and advances one cell per glyph, and the `x >= area.right()` break still
stops the row at the viewport edge -- `zip` only advances as far as
`line.chars()` yields, so the open-ended range cannot run away.
Signed-off-by: CodeWhale Bot <bot@codewhale.net>
Entire-Checkpoint: 01M1D7F82ZEN4JVYBN0W1YDPRX
---------
Signed-off-by: CodeWhale Bot <bot@codewhale.net>
Co-authored-by: CodeWhale Bot <bot@codewhale.net>
check-versions.sh resolves the previous release tag, fetching it if absent
with '|| true', then runs the feature release-note receipt check and the
contributor-credit check only if the tag resolves. If the fetch failed -- a
network blip is enough -- both checks were skipped in silence and the script
still exited 0.
A gate that silently no-ops is worse than no gate: it reports success and gets
read as evidence that the thing it guards was verified. Same failure shape as
an edge probe hardcoding a capability to true.
Now it reports which checks did not run and fails. CWC_ALLOW_MISSING_PREVIOUS_TAG=1
keeps the old behaviour for a genuinely tagless history, but says out loud that
the two checks are UNRUN.
Co-authored-by: CodeWhale Bot <bot@codewhale.net>
Promotes the fully gated non-benchmark candidate while preserving the benchmark tree exactly from the prior release-PR head.
Signed-off-by: CodeWhale Bot <bot@codewhale.net>
The zip already shipped codewhale.bat (where wt, then the exe). NSIS
only copied the exes, so a Start Menu launch still used the raw binary
(#1854). Install the same launcher into bin, pin a current-user
shortcut at it, and delete both on uninstall.
Verified: node --test scripts/release/assemble-release-assets.test.js
(7/7) and makensis compiled a test installer.
Use Node's bounded recursive-removal retries so delayed Windows handle release after concurrent wrapper downloads does not fail an otherwise successful smoke. Persistent cleanup errors still reject after the finite retry window.
No-Issue: owner-directed v0.9.9 Windows release-smoke hardening
Job-level reruns (gh run rerun --failed) bump the run-level run_started_at
past the asset upload timestamps, so every rerun of a failed downstream job
failed the freshness gate with 'asset set is stale' even though the assets
belong to that exact run and SHA (cost three attempts on the v0.9.8 publish).
findReleaseWorkflowRun now carries the successful release job's started_at
on the returned run record; assertReleaseAssetsFresh compares asset
updated_at against that job baseline, falling back to run_started_at /
created_at only when the job baseline is unavailable. The local
verify-release-assets.sh path delegates freshness to the same verifier, so
operator repairs after reruns are protected too.
Regression tests: rerun-shifted run_started_at with an unchanged job
started_at is judged fresh; assets older than the release job are still
rejected.
CodeWhale's release validator requires every workspace crate in the ordered
publication manifest. Register command-contract after codewhale-core, its
workspace dependency, and verify the package with cargo publish --dry-run.
Signed-off-by: Paulo Aboim Pinto <paulo.aboim.pinto@gmail.com>
The npm job runs the public-asset verifier before the overall workflow can be successful. Anchor freshness to the exact-SHA release job that published the assets, while keeping tag, inventory, checksum, and timestamp validation fail-closed.
Derive archive mtimes from the pinned source commit in release artifacts, retain reproducible archive bytes and executable modes, and cover metadata plus input validation.
`scripts/release/verify-workspace-version.sh` had zero references anywhere:
no workflow under `.github/workflows/`, no `.cnb.yml` job, no runbook
(`docs/RELEASE_RUNBOOK.md`, `docs/RELEASE_CHECKLIST.md`), no other script,
and no entry in the private ops repo. A repo-wide ripgrep across all file
types (hidden files included, `target/` excluded) matched only the file's
own path.
Its job is fully subsumed by two gates that are wired in:
- `require-release-tag-checkout.sh:9-30` refuses to publish unless HEAD is
exactly `refs/tags/v<workspace_version>` on a clean tree, which is the
tag-vs-workspace agreement this script re-derived from `GITHUB_REF`.
- `check-versions.sh` check #1 forbids literal per-crate `version =` values,
so `cargo metadata` versions cannot diverge from the workspace version in
the first place.
Proof: `bash scripts/release/check-versions.sh && bash scripts/release/require-release-tag-checkout.test.sh`
Result: pass — "Version state OK: workspace=0.9.6, npm=0.9.6, lockfile in
sync." then "Release checkout gate OK: clean v0.9.6 at 3815bd705." and
"require-release-tag-checkout tests passed" (exit 0).
Implemented with Claude Code agent assistance.
Keep provider-neutral auto selection in the provider-aware TUI and launch workflow lanes from the exact running executable. Repair CNB and installer alias contracts, refresh legacy website-installed TUI bytes during upgrades, and make account pull reject an unimplemented local import truthfully.\n\nVerified with focused CLI/config tests, strict Clippy, workflow contracts, shell syntax checks, and hermetic web installer tests.
The npm wrapper exposes codewhale and codew, while v0.9.5 keeps codewhale-tui only as legacy asset filenames for old updater compatibility. Stop npx from resolving a nonexistent codewhale-tui package during the release smoke and make the runbook describe the single compiled runtime accurately.
Verified with the full local npm wrapper smoke against the exact 0.9.5 release binary, node syntax checking, and the website documentation contract.
Release preparation now updates the runtime SDK and VS Code extension manifests and locks alongside the Rust and npm wrapper versions. The normal version gate checks the same records that the tag workflow requires, and the transactional fixture proves the expanded bump and rollback set.
Build codewhale once, expose the verified bytes as codew across release channels, and retain seven TUI-named release aliases solely so shipped v0.9.4 clients can discover and cross the transition. Current installers and containers expose only codewhale and codew.\n\nVerified with the npm asset suite, exact 34-asset assembly, workflow contract, Homebrew renderer, release-body, dogfood installer, and shell syntax tests.\n\nRefs #5259
Closes#5245 groundwork (issue stays open until the acceptance run is on
CI). Every local git commit invalidated codewhale-tui (620 files) and
codewhale-cli because their build scripts watched .git/HEAD and the branch
ref to keep the --version sha fresh — a ~14-minute fat-LTO rebuild per
commit with zero code changes.
The stamp is now environment-only: DEEPSEEK_BUILD_SHA (wins) or GITHUB_SHA
suffix the version and set CODEWHALE_BUILD_COMMIT; build scripts declare
only rerun-if-env-changed for those two variables and never touch .git. An
unstamped local build renders '0.9.4 (dev)'. Runtime git resolution was
rejected deliberately: the binary runs inside users' repositories, and a
stale binary reporting the checkout's current HEAD would break the
dogfood-receipt identity install-dogfood.sh verifies — the module doc
records this reasoning. CI is byte-identical (GITHUB_SHA was already set);
install-dogfood.sh now prints the stamped build command in both of its
refusal paths. declare_git_head_rerun and the git fallback are deleted;
CODEWHALE_RELEASE_BUILD_SHA semantics are untouched.
Verified: cargo test -p codewhale-build-support green (new env-only
contract test); cargo build -p codewhale-tui -p codewhale-cli, then
git commit --allow-empty + rebuild -> zero 'Compiling codewhale' lines,
Finished in 0.17s. All CODEWHALE_BUILD_COMMIT consumers already use
option_env!. Authored with agent assistance (Claude); spec by the owner's
build-time lane (#5245/#5249).
cmd's %* expansion strips the quotes rustc puts around link arguments that
contain spaces, so an SDK path like "D:\DevEco Studio\...\sysroot" arrived at
the clang launcher split on the space and the final Rust link failed. Walk the
arguments with %~1 and re-wrap each in quotes before forwarding to the
PowerShell wrapper, and extend the no-SDK release guard to keep the re-quoting
contract.
Assisted by Claude Code.
Signed-off-by: shenjackyuanjie <54507071+shenjackyuanjie@users.noreply.github.com>
(cherry picked from commit 6a3837cd48)
Pass CARGO_TARGET_DIR through the npm wrapper smoke asset preparation path so release validation consumes the exact binaries built in isolated target directories.
Add codewhale-paths to the crates.io dependency order before the crates that consume it. The v0.9.3 packaging dry-run correctly caught that the new workspace member was otherwise omitted.
Accept the current generic install documentation while continuing to validate and update legacy numeric snippets when present. Keep the root npm lock, remote-smoke default, and source-candidate facts in the same release transaction without changing published-release provenance.\n\nBack up every release-bearing file before mutation and restore the exact starting bytes if refresh or validation fails. Extend the fixture suite across generic docs, legacy forms, selective fact updates, and forced downstream rollback.
macOS ad-hoc signing may rewrite binary bytes after installation, so a fresh-shell hash cannot equal the pre-sign build hash. Require resolution from an explicit install destination, verify the embedded current HEAD, and record both source and installed hashes.
Build an HTTP/1.1 twin client and automatically retry stream opens when
H2 headers stall; update user-facing CODEWHALE_FORCE_HTTP1 copy. Dim and
lock unselectable models, explain on Enter, and hand off to provider
auth. Surface scout/fast routing as resolved-at-launch. Add cached git
status chrome and worktree data module. Expose sandbox_mode in settings
and ad-hoc re-sign self-built macOS dogfood installs after copy.
Accept the explicit unreleased-candidate heading during source CI while requiring a dated heading and tag compare link at publication time. Sync the packaged TUI changelog so it carries the same candidate wording and contributor credit as the root record.
Signed-off-by: Hunter B <hmbown@gmail.com>
Keep same-version release preparation on the canonical validation path, install and package the native codew shim, and make web and checksum verification reflect what operators actually run. Add focused release-helper, npm, and checksum contracts while leaving deploy and publication boundaries unchanged.
Signed-off-by: Hunter B <hmbown@gmail.com>
Repair the command escaping helper so future metacharacters cannot weaken the workflow contract, and remove the redundant installer path branch.
Signed-off-by: Hunter B <hmbown@gmail.com>
Fail before build work and again immediately before upload whenever a tag already owns GitHub Release assets. Disable the release action overwrite path and document that recovery requires a deliberate maintainer decision instead of silently replacing public bytes.
Signed-off-by: Hunter B <hmbown@gmail.com>
Restore the Unix executable contract after GitHub artifact transport normalizes files to 0644. Normalize archive metadata as well so identical inputs do not create packaging-only checksum drift, while retaining the separate public-asset immutability guard.
Signed-off-by: Hunter B <hmbown@gmail.com>
Factor the seven-target release build and 34-file asset assembly into a read-only reusable workflow shared by public releases and a manual non-publishing candidate path. Manual CI now validates the requested SHA and runs the full Linux, macOS, Windows, npm, mobile, workflow, Actions, and docs gates instead of light placeholders.
Add checksum/inventory contracts, archive fixtures, packaged-wrapper smoke against assembled assets, and an explicit publication stop line in the release runbook.
Signed-off-by: Hunter B <hmbown@gmail.com>
Build and smoke the complete Windows ARM64 binary family on GitHub native runners, wire npm, updater, bundle, website, and release inventory support, and preserve the originating contributor credit.
Move Linux ARM64 releases off the slower cross-link path, remove redundant matrix target installs, and update actionlint for the hosted ARM runner label.
Refs #4267.
Co-authored-by: w1w218 <6767665+w1w218@users.noreply.github.com>
Signed-off-by: Hunter B <hmbown@gmail.com>
Make the no-SDK contract check cover the normalized SDK path and both exit-code handoffs, from clang to PowerShell and from PowerShell to Cargo. Without these assertions the gate could stay green after breaking behavior that the HarmonyOS guide promises.
Signed-off-by: Hunter B <hmbown@gmail.com>
Point Cargo's Windows OHOS linker at a repository-local cmd launcher that delegates to the existing PowerShell clang wrapper. This keeps the target triple, SDK sysroot, and MUSL define on the final Rust link while preserving Cargo's arguments and the native linker exit status.
Extend the no-SDK release gate and documentation to protect the full linker and rquickjs bindgen contract. Follow-up evidence from @shenjackyuanjie's PR #4470 completes the Windows linker path alongside @shenyongqing's original bindgen approach in PR #4384.
Co-authored-by: shenjackyuanjie <54507071+shenjackyuanjie@users.noreply.github.com>
Signed-off-by: Hunter B <hmbown@gmail.com>
Extend check-ohos-deps.sh with a cargo-tree feature-graph assertion that
the OHOS target activates rquickjs's bindgen feature (forwarded to
rquickjs-sys) for codewhale-workflow-js — the only reason the crate
compiles for a target with no pre-generated QuickJS bindings. Pure
metadata: no SDK or target toolchain required. Positive path verified
against current main (bindgen landed in #4470); negative path verified
against a non-OHOS target.
Carried over from the #4459 review lane; the OHOS bindgen approach was
pioneered by @shenyongqing in #4384.
Signed-off-by: Hunter B <hmbown@gmail.com>
Allow the disposable bare remote to accept a tag from a depth-1 checkout. This keeps the release helper contract test hermetic under the Version drift job without requiring a full repository fetch.
Signed-off-by: Hunter B <hmbown@gmail.com>
Integrate the underwater TUI, message-first Operate, Fleet and Workflow reliability, expanded model/provider catalog, exact custom-route restoration, docs-first site, localization, packaging, and release metadata for the v0.9.0 candidate.
Harden endpoint-bound credential provenance, approval and goal UX, Fleet attempt fencing and crash recovery, large-workspace mention discovery, Kimi budgeting, and release asset/version gates. Include the stopship Fleet and Workflow fixtures used by release dogfood.
Verified with workspace fmt/check/clippy/tests on Rust 1.88, release-script and npm suites, 18-crate publish dry run, production web build, Docker build check, secret scan, dependency audit, and protected-state hash validation.
Keep the exact-tag safety fixture aligned with the workspace release version so it continues exercising clean checkout, branch-ahead, and moved-remote-tag failures after version bumps.
Treat the absence of version-pinned README install examples as a valid release state while continuing to update matching examples when present. Preflight every pinned README tag before any file writes so a stale example fails without leaving Cargo or npm metadata half-bumped.\n\nExercise the full helper in disposable fixtures for optional localized tags, matching-tag replacement, downstream completion, and atomic stale-tag rejection, and run that contract in CI.
Require exact-tag dispatches, immutable source checkouts, live tag revalidation before public writes, and stale-main-safe tag creation. Cargo and npm publication now fail closed unless the checkout is clean and matches the remote release tag, with moved-tag regression coverage and corrected operator sequencing.
Copy the codew shim into the GHCR image, smoke all three public binaries after push, and fail the GitHub Release if the container lane fails. Keep release copy on the canonical state volume and list the Android archive.
Move the final integration fixes into the dated release section, refresh the candidate ledger and crate inventory, and generate explicit community credits in the GitHub release body. Add a regression test for contributor-heading extraction.
Extract the Tasks, To-do, and worker ledger into an owned work-surface module with stable focus, scrolling, mouse actions, compact overflow, and safe cancellation. Keep Classic as the rollback shell while removing the migrated underwater strip from the legacy sidebar.
Make route billing distinguish metered API usage from OAuth, token-plan, and local routes; align direct startup, mode truth, slash-model performance, modal stack safety, hermetic tests, PTY gates, and atomic dogfood receipts.
