| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
brand: retire the old traced marks, sync the canonical vector family The repo's brand/mark.svg + wordmark traces were an earlier lower-fidelity trace of the C-curl whale (black currentColor instead of the navy family), and crates/tui/src/runtime_web/codewhale-192.png was still the retired diving-whale tile served by the embedded runtime web client. - brand/ and web/public/brand/ now carry byte-identical copies of the canonical family (codewhale-apps/packages/brand/svg/), adding the missing mark-mono and mark-reversed variants. - extensions/vscode/media/codewhale.svg uses the family mono mark. - runtime_web/codewhale-192.png is the canonical 192 tile (same bytes as codewhale-apps apps/web/public/icons/codewhale-192.png). - opengraph-image.tsx reads mark-reversed.svg (the family's white-on-navy variant) instead of string-replacing currentColor, which the family mark.svg does not contain; wordmark aspect corrected to the family's 1024x160 viewBox. - Deleted brand/mark-navy.svg (duplicate of the family navy mark), brand/wordmark0901.png + wordmarkinverted.png (only consumer was the retired generator; founder rasters preserved in codewhale-apps/packages/brand/source/), and scripts/brand/trace-brand.py (regenerated the retired trace; not referenced by CI). The founder brand sheet brand/codewhalemarkfinal.png stays as scripts/brand/braille-mark.py's input. - PRODUCT.md and the public-auth-routes provenance comment updated to name the canonical family home. Checks: npx tsc --noEmit (web) exit 0. Asset swap + comments; runtime_web route tests reference the icon path, not bytes. (cherry picked from commit 116a57b8143167265e48a8c48b10d35828031cf3) | 13 天前 | |
fix(vscode): make the extension's send path work, and close the security holes The extension had never successfully started a turn. `startTurn` accepted only HTTP 200/202 while the runtime's `start_thread_turn` (crates/tui/src/runtime_api.rs:4613-4632) returns `StatusCode::CREATED` as its ONLY success path, so every send failed. `git log -- src/api.ts` is a single commit: this was never a regression, it shipped that way and was never run end to end. api.ts (send path): - Status handling now tests a RANGE (`isOk`: >= 200 && < 300) through one `ensureOk` helper routed through every call site, rather than enumerating codes at eleven of them. 201 is accepted because it is 2xx, not because it is special-cased — the same shape the embedded web client already used at crates/tui/src/runtime_web/app.mjs:873, which is why that client worked against the same runtime this one choked on. - The runtime's JSON `error.message` is surfaced on every route; previously only startTurn passed it through. - 409 is typed: a second send while a turn is live is "already running", and interrupting when nothing streams is "nothing to stop", not an error. Security (extension.ts, runtime.ts, secrets.ts): - SecretStorage now wins over the settings token, matching what secrets.ts, the manifest and the README all already promised. Previously a repo-local .vscode/settings.json could supply a bearer AND retarget `runtimeHost`, and the token rode every request — opening a repo was enough. - The runtime token is passed to the terminal via environment instead of `--auth-token` in argv, which was visible in shell history and `ps`. - status.ts nonce uses a CSPRNG, matching chat.ts. Chat correctness and accessibility (chat.ts, transcript.ts): - Transcript prefers `detail` over the 280-char `summary`, so reload shows the reply instead of a stub. - `operation_key` is reused on retry, so a timeout and resend no longer creates two turns; the dead SSE stream is cleared so reconnect can fire. - The composer keeps its text until the turn is accepted. - Tool paths are parsed out of `metadata.tool_input` and treated as untrusted. The durable fix is runtime-side and is NOT taken here. - Focus styling and roles/labels added; there were none. Chrome (package.json, extension.ts): - Chat is contributed to the secondary sidebar with an activity-bar fallback, gated on `codewhale.noSecondarySidebar`, which is set at activation from `vscode.version` (>= 1.106). One ChatView instance serves both view ids and `reveal()` focuses whichever resolved. - `engines.vscode` stays `^1.96.2` and the threshold is enforced at runtime, matching the shipping Codex extension; raising the floor would have cut off 1.90-1.105 users and made the fallback unreachable for nothing. CI and dev loop (ci.yml, .gitignore, .vscode/): - CI runs the extension tests. Nothing ran them before, which is how a send path that could not work stayed green. - launch.json/tasks.json give a working F5 host. The root `.gitignore`'s bare `.vscode/` silently swallowed them, so a negation was added — without it these files exist locally and vanish on commit. Gates: cd extensions/vscode && npx tsc --noEmit -> clean cd extensions/vscode && npm test -> tests 42, pass 42, fail 0 (baseline before this was 25) manifest/provider coherence: every declared view id has a provider; no provider lacks a manifest entry; context key set at activation. Not done, deliberately: the Runtime view still exists, so this is not yet a single-view Agents panel. Removing it spans extension.ts, status.ts and two commands; a half-removal is worse than either state. Gate item 5 — a human driving one real turn in an Extension Development Host — remains unproven. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D4rk4NXwyy6wmvii9Lp84P Signed-off-by: CodeWhale Bot <bot@codewhale.net> | 21 天前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 13 天前 | ||
| 21 天前 |
