Skip to content

Release v1.14.2 — unpack pipeline hardening (codex review) #324

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sarthakagrawal927 merged 1 commit into from
Sep 22, 2026
Merged

Release v1.14.2 — unpack pipeline hardening (codex review) #324

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
92 changes: 0 additions & 92 deletions apps/landing-page-astro/src/data/unpack-reports.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91314,64 +91314,6 @@
"agent_handoff": {
"summary": "Agents should treat this as a layered contract compiler plus a runtime, not as a Next.js app. Start from Agents.md, the architecture overview, and architecture.config.json. Use pnpm on Node 24, rebuild before typecheck, and do not bypass lint:deps. Tests are written first and run with Vitest; name the Contract type at every JSON boundary; never use any, zod, or a bare cast. Skills and rules have one canonical directory each. The traps that waste a session are stale dist types, plane violations, fixture drift, warn-only marker checks, and editing a gitignored symlink tree.",
"claims": [
{
"claim": "Agents.md requires Node from the shell (engines.node in the root package.json; do not run nvm/fnm), pnpm instead of npm, and never npx. Build with pnpm build. Use the repo scripts pnpm typecheck and pnpm test rather than hand-rolled tsc or vitest. Use arktype, not zod. Never add extensions to TypeScript imports.",
"sources": [
"Agents.md",
"package.json#L6-L62",
"package.json#L101-L103"
],
"kind": "evidence"
},
{
"claim": "Type rules from Agents.md: never any; never @ts-expect-error outside negative type tests; never @ts-nocheck; never suppress biome lints; no bare as in production code. Use blindCast or castAs from @internal/utils/casts. as const and test files are exempt. pnpm lint:casts is the ratchet.",
"sources": [
"Agents.md",
"package.json#L36"
],
"kind": "evidence"
},
{
"claim": "Write tests before changing implementation. Omit the word should in test names. In sql-orm-client tests, assert the whole result shape with toEqual or a snapshot and an explicit select. Do not reexport from one file to another except under exports/ folders. Do not add backwards-compat exports unless asked. Do not branch on target; add an adapter.",
"sources": [
"Agents.md"
],
"kind": "evidence"
},
{
"claim": "Where JSON enters the runtime, name the contract.d.ts type: postgres<Contract>({ contractJson, url }) or validateSqlContractFully<Contract>(contractJson). Do not use a wide generic such as SqlContract<SqlStorage>. The postgres() overloads encode that split between a live contract object and contractJson.",
"sources": [
"Agents.md",
"packages/3-extensions/postgres/src/runtime/postgres.ts#L155-L170"
],
"kind": "evidence"
},
{
"claim": "After changing exported types in a package other packages consume, rebuild that package so dist/*.d.mts updates before downstream typecheck. Turbo already makes typecheck depend on build and ^build because self-imports of published subpaths read dist.",
"sources": [
"Agents.md",
"turbo.json#L35-L43"
],
"kind": "evidence"
},
{
"claim": "Safe command set for a small change: pnpm build for the touched package, pnpm test:packages or that package's vitest, pnpm typecheck:packages, and pnpm lint:deps if imports moved. Contract artifact edits need pnpm fixtures:check rather than a hand-rolled emit-and-diff. Integration behavior needs pnpm test:integration; CLI journeys need pnpm test:journeys.",
"sources": [
"package.json#L14-L23",
"package.json#L34",
"package.json#L57-L60",
"Agents.md"
],
"kind": "evidence"
},
{
"claim": "Edit skills at skills-contrib/<name>/SKILL.md and rules at .agents/rules/<name>.mdc. .claude, .cursor, and .agents skill/rule trees are presentation symlinks materialized by prepare (skills add and scripts/sync-agent-rules.mjs). A rule added only under .cursor/rules is gitignored and lost. pnpm rules:sync and pnpm lint:rules:symlinks check the trees.",
"sources": [
"Agents.md",
"package.json#L42-L69"
],
"kind": "evidence"
},
{
"claim": "New packages must be registered in architecture.config.json with plane-specific globs, broad to specific, including a migration glob for src/core/migrations/** even if the directory is empty. pnpm lint:deps fails the PR if a migration file imports a runtime package.",
"sources": [
Expand Down Expand Up @@ -108906,14 +108848,6 @@
],
"kind": "evidence"
},
{
"claim": "libs/hbb_common is a git submodule (url https://github.com/rustdesk/hbb_common) that supplies rendezvous_proto, message framing, socket_client, Config/LocalConfig/PeerConfig, tokio re-exports and sodiumoxide crypto; in this clone the directory is empty, so no code under it can be read or built from this checkout.",
"sources": [
".gitmodules",
"libs/hbb_common"
],
"kind": "evidence"
},
{
"claim": "crates-io is patched: `libxdo-sys` is replaced by libs/libxdo-sys-stub (so builds work without libxdo on Wayland-only systems), and `tungstenite`, `webrtc`, `webrtc-util`, `webrtc-sctp` are pinned by git rev to rustdesk-org forks carrying custom fixes (incremental ws read buffer, Windows IPv6 ICE, SCTP congestion-control off by default).",
"sources": [
Expand Down Expand Up @@ -109491,14 +109425,6 @@
],
"kind": "evidence"
},
{
"claim": "libs/hbb_common is empty in this clone — all wire protocol, Config, socket_client, and sodiumoxide usage is invisible to audit here; any build/test requires `git submodule update --init` first.",
"sources": [
".gitmodules",
"libs/hbb_common"
],
"kind": "evidence"
},
{
"claim": "Forked network stack risk: webrtc/webrtc-sctp/webrtc-util and tungstenite are pinned to rustdesk-org forks with custom congestion-control and parsing changes; upstream CVE fixes will not flow through cargo update and must be cherry-picked by rev.",
"sources": [
Expand Down Expand Up @@ -109635,15 +109561,6 @@
],
"kind": "evidence"
},
{
"claim": "Bootstrap trap: `git submodule update --init libs/hbb_common` is mandatory — the directory is empty in this clone and every protocol symbol (RendezvousMessage, Config, Stream, socket_client, tokio re-export) resolves from it; build also needs flutter_rust_bridge codegen for `bridge_generated.rs` when the `flutter` feature is on.",
"sources": [
".gitmodules",
"libs/hbb_common",
"src/lib.rs#L34-39"
],
"kind": "evidence"
},
{
"claim": "Toolchain pins: rust-version 1.75 (Cargo.toml), CI RUST_VERSION 1.75 / macOS 1.81, Flutter 3.24.5 (3.44.9 win-arm64), flutter_rust_bridge '=1.80'/1.80.1 — mismatched frb versions regenerate incompatible bindings.",
"sources": [
Expand Down Expand Up @@ -125817,15 +125734,6 @@
],
"kind": "evidence"
},
{
"claim": "Renderers are pluggable behind renderer/base's IRenderer: AtlasEngine (D2D/D3D, custom shaders) for the new terminal, a GDI engine under renderer/gdi for legacy conhost, plus renderer/uia and renderer/wddmcon variants.",
"sources": [
"src/renderer/atlas/AtlasEngine.cpp",
"src/renderer/base/Renderer.cpp",
"src/renderer/gdi"
],
"kind": "evidence"
},
{
"claim": "Settings layering is tag-based: ParsedSettings entries carry an OriginTag (InBox, User, Generated, Dynamic, Fragment) and SettingsLoader merges them in a fixed order — new settings sources plug in as additional origins without changing the merge engine.",
"sources": [
Expand Down
12 changes: 10 additions & 2 deletions apps/landing-page-astro/src/pages/unpack/[slug].astro
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,9 @@ const { report } = Astro.props;
<p class="meta">
Scanned commit <code>{report.commit.sha.slice(0, 10)}</code> dated {report.commit.date} —
last upstream commit. Generated by <code>{report.codevetterVersion}</code> on
{' '}{new Date(report.collectedAt).toISOString().slice(0, 10)}.
{' '}{Number.isNaN(Date.parse(report.collectedAt))
? report.collectedAt
: new Date(report.collectedAt).toISOString().slice(0, 10)}.
</p>
<p class="upstream">
<a href={`https://github.com/${report.repo}`}>github.com/{report.repo} ↗</a>
Expand Down Expand Up @@ -84,7 +86,13 @@ const { report } = Astro.props;
{c.kind === 'inference' && <span class="dim"> (inferred)</span>}
<div class="sources">
{(c.sources ?? []).map((s) => (
<a href={`https://github.com/${report.repo}/blob/${report.commit.sha}/${s.split('#')[0]}`}>
<a
href={`https://github.com/${report.repo}/blob/${report.commit.sha}/${s
.split('#')[0]
.split('/')
.map(encodeURIComponent)
.join('/')}${s.includes('#L') ? `#L${s.split('#L')[1]}` : ''}`}
>
{s}
</a>
))}
Expand Down
9 changes: 8 additions & 1 deletion apps/landing-page-astro/src/pages/unpack/[slug]/[section].astro
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ const { report, section, sectionKey, title } = Astro.props;
<Layout
title={`${title} — ${report.repo} codebase unpack`}
description={`${title} for ${report.repo}: claim-cited analysis at commit ${report.commit.sha.slice(0, 7)}, generated by CodeVetter Repo Unpack.`}
path={`/unpack/${report.slug}/${sectionKey}`}
>
<main class="report">
<a class="back" href={`/unpack/${report.slug}`}>← {report.repo}</a>
Expand Down Expand Up @@ -54,7 +55,13 @@ const { report, section, sectionKey, title } = Astro.props;
{c.kind === 'inference' && <span class="dim"> (inferred)</span>}
<div class="sources">
{(c.sources ?? []).map((s) => (
<a href={`https://github.com/${report.repo}/blob/${report.commit.sha}/${s.split('#')[0]}`}>
<a
href={`https://github.com/${report.repo}/blob/${report.commit.sha}/${s
.split('#')[0]
.split('/')
.map(encodeURIComponent)
.join('/')}${s.includes('#L') ? `#L${s.split('#L')[1]}` : ''}`}
>
{s}
</a>
))}
Expand Down
5 changes: 3 additions & 2 deletions apps/landing-page-astro/src/pages/unpack/compare/[pair].astro
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,11 +10,11 @@ export function getStaticPaths() {
.filter((p) => p.a && p.b)
.map(({ a, b, angle }) => ({
params: { pair: `${a.slug}-vs-${b.slug}` },
props: { a, b, angle },
props: { a, b, angle, pair: `${a.slug}-vs-${b.slug}` },
}));
}

const { a, b, angle } = Astro.props;
const { a, b, angle, pair } = Astro.props;
const rows = [
['Files scanned', a.stats.filesScanned, b.stats.filesScanned],
['Size', a.stats.size, b.stats.size],
Expand Down Expand Up @@ -45,6 +45,7 @@ const rows = [
<Layout
title={`${a.name} vs ${b.name} — codebase comparison`}
description={`Structural codebase comparison of ${a.repo} and ${b.repo}: architectures, entrypoints, and evidence — scanned at pinned commits by CodeVetter Repo Unpack.`}
path={`/unpack/compare/${pair}`}
>
<main class="report">
<a class="back" href="/unpack">← All unpacks</a>
Expand Down
4 changes: 2 additions & 2 deletions apps/macos/Config/Shared.xcconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,8 @@ EXECUTABLE_NAME = CodeVetterNative
// Debug stays isolated from user data; Release owns the production identity.
PRODUCT_BUNDLE_IDENTIFIER = com.codevetter.desktop
PRODUCT_BUNDLE_IDENTIFIER[config=Debug] = com.codevetter.desktop.native-preview
MARKETING_VERSION = 1.14.1
CURRENT_PROJECT_VERSION = 11401
MARKETING_VERSION = 1.14.2
CURRENT_PROJECT_VERSION = 11402

// ==========================================
// Platform Configuration
Expand Down
58 changes: 0 additions & 58 deletions benchmarks/repo-unpacks/prisma.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32410,64 +32410,6 @@
"agent_handoff": {
"summary": "Agents should treat this as a layered contract compiler plus a runtime, not as a Next.js app. Start from Agents.md, the architecture overview, and architecture.config.json. Use pnpm on Node 24, rebuild before typecheck, and do not bypass lint:deps. Tests are written first and run with Vitest; name the Contract type at every JSON boundary; never use any, zod, or a bare cast. Skills and rules have one canonical directory each. The traps that waste a session are stale dist types, plane violations, fixture drift, warn-only marker checks, and editing a gitignored symlink tree.",
"claims": [
{
"claim": "Agents.md requires Node from the shell (engines.node in the root package.json; do not run nvm/fnm), pnpm instead of npm, and never npx. Build with pnpm build. Use the repo scripts pnpm typecheck and pnpm test rather than hand-rolled tsc or vitest. Use arktype, not zod. Never add extensions to TypeScript imports.",
"sources": [
"Agents.md",
"package.json#L6-L62",
"package.json#L101-L103"
],
"kind": "evidence"
},
{
"claim": "Type rules from Agents.md: never any; never @ts-expect-error outside negative type tests; never @ts-nocheck; never suppress biome lints; no bare as in production code. Use blindCast or castAs from @internal/utils/casts. as const and test files are exempt. pnpm lint:casts is the ratchet.",
"sources": [
"Agents.md",
"package.json#L36"
],
"kind": "evidence"
},
{
"claim": "Write tests before changing implementation. Omit the word should in test names. In sql-orm-client tests, assert the whole result shape with toEqual or a snapshot and an explicit select. Do not reexport from one file to another except under exports/ folders. Do not add backwards-compat exports unless asked. Do not branch on target; add an adapter.",
"sources": [
"Agents.md"
],
"kind": "evidence"
},
{
"claim": "Where JSON enters the runtime, name the contract.d.ts type: postgres<Contract>({ contractJson, url }) or validateSqlContractFully<Contract>(contractJson). Do not use a wide generic such as SqlContract<SqlStorage>. The postgres() overloads encode that split between a live contract object and contractJson.",
"sources": [
"Agents.md",
"packages/3-extensions/postgres/src/runtime/postgres.ts#L155-L170"
],
"kind": "evidence"
},
{
"claim": "After changing exported types in a package other packages consume, rebuild that package so dist/*.d.mts updates before downstream typecheck. Turbo already makes typecheck depend on build and ^build because self-imports of published subpaths read dist.",
"sources": [
"Agents.md",
"turbo.json#L35-L43"
],
"kind": "evidence"
},
{
"claim": "Safe command set for a small change: pnpm build for the touched package, pnpm test:packages or that package's vitest, pnpm typecheck:packages, and pnpm lint:deps if imports moved. Contract artifact edits need pnpm fixtures:check rather than a hand-rolled emit-and-diff. Integration behavior needs pnpm test:integration; CLI journeys need pnpm test:journeys.",
"sources": [
"package.json#L14-L23",
"package.json#L34",
"package.json#L57-L60",
"Agents.md"
],
"kind": "evidence"
},
{
"claim": "Edit skills at skills-contrib/<name>/SKILL.md and rules at .agents/rules/<name>.mdc. .claude, .cursor, and .agents skill/rule trees are presentation symlinks materialized by prepare (skills add and scripts/sync-agent-rules.mjs). A rule added only under .cursor/rules is gitignored and lost. pnpm rules:sync and pnpm lint:rules:symlinks check the trees.",
"sources": [
"Agents.md",
"package.json#L42-L69"
],
"kind": "evidence"
},
{
"claim": "New packages must be registered in architecture.config.json with plane-specific globs, broad to specific, including a migration glob for src/core/migrations/** even if the directory is empty. pnpm lint:deps fails the PR if a migration file imports a runtime package.",
"sources": [
Expand Down
25 changes: 0 additions & 25 deletions benchmarks/repo-unpacks/rustdesk.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11139,14 +11139,6 @@
],
"kind": "evidence"
},
{
"claim": "libs/hbb_common is a git submodule (url https://github.com/rustdesk/hbb_common) that supplies rendezvous_proto, message framing, socket_client, Config/LocalConfig/PeerConfig, tokio re-exports and sodiumoxide crypto; in this clone the directory is empty, so no code under it can be read or built from this checkout.",
"sources": [
".gitmodules",
"libs/hbb_common"
],
"kind": "evidence"
},
{
"claim": "crates-io is patched: `libxdo-sys` is replaced by libs/libxdo-sys-stub (so builds work without libxdo on Wayland-only systems), and `tungstenite`, `webrtc`, `webrtc-util`, `webrtc-sctp` are pinned by git rev to rustdesk-org forks carrying custom fixes (incremental ws read buffer, Windows IPv6 ICE, SCTP congestion-control off by default).",
"sources": [
Expand Down Expand Up @@ -11724,14 +11716,6 @@
],
"kind": "evidence"
},
{
"claim": "libs/hbb_common is empty in this clone — all wire protocol, Config, socket_client, and sodiumoxide usage is invisible to audit here; any build/test requires `git submodule update --init` first.",
"sources": [
".gitmodules",
"libs/hbb_common"
],
"kind": "evidence"
},
{
"claim": "Forked network stack risk: webrtc/webrtc-sctp/webrtc-util and tungstenite are pinned to rustdesk-org forks with custom congestion-control and parsing changes; upstream CVE fixes will not flow through cargo update and must be cherry-picked by rev.",
"sources": [
Expand Down Expand Up @@ -11868,15 +11852,6 @@
],
"kind": "evidence"
},
{
"claim": "Bootstrap trap: `git submodule update --init libs/hbb_common` is mandatory — the directory is empty in this clone and every protocol symbol (RendezvousMessage, Config, Stream, socket_client, tokio re-export) resolves from it; build also needs flutter_rust_bridge codegen for `bridge_generated.rs` when the `flutter` feature is on.",
"sources": [
".gitmodules",
"libs/hbb_common",
"src/lib.rs#L34-39"
],
"kind": "evidence"
},
{
"claim": "Toolchain pins: rust-version 1.75 (Cargo.toml), CI RUST_VERSION 1.75 / macOS 1.81, Flutter 3.24.5 (3.44.9 win-arm64), flutter_rust_bridge '=1.80'/1.80.1 — mismatched frb versions regenerate incompatible bindings.",
"sources": [
Expand Down
9 changes: 0 additions & 9 deletions benchmarks/repo-unpacks/terminal.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11338,15 +11338,6 @@
],
"kind": "evidence"
},
{
"claim": "Renderers are pluggable behind renderer/base's IRenderer: AtlasEngine (D2D/D3D, custom shaders) for the new terminal, a GDI engine under renderer/gdi for legacy conhost, plus renderer/uia and renderer/wddmcon variants.",
"sources": [
"src/renderer/atlas/AtlasEngine.cpp",
"src/renderer/base/Renderer.cpp",
"src/renderer/gdi"
],
"kind": "evidence"
},
{
"claim": "Settings layering is tag-based: ParsedSettings entries carry an OriginTag (InBox, User, Generated, Dynamic, Fragment) and SettingsLoader merges them in a fixed order — new settings sources plug in as additional origins without changing the merge engine.",
"sources": [
Expand Down
Loading
Loading