main

文件	最后提交记录	最后更新时间
src	Merge branch 'fix/cli-telemetry-deadline-20260904' into integrate/backend-takeover-20260904 # Conflicts: # crates/tui/tests/integration/telemetry_contract.rs	11 天前
tests	feat(telemetry): count anonymous usage by default with durable opt-out Usage counting no longer waits for an accepted processor notice. A missing preference resolves on; a persisted `telemetry = false`, a decline recorded under the earlier opt-in notice, unreadable privacy state, and the environment/run kill switches all stay off. Schema 3 carries `notice_version` 5 in place of `consent_version`; the v1/v2 goldens are untouched and a new v3 golden pins the envelope. Disclosure is presentation, never acceptance: headless surfaces print one stderr line per policy revision and record only that it was shown; the TUI draws its localized toast (15 packs) and records the same display marker from the event loop instead of a stray stderr line. Display bookkeeping and Settings/CLI preference writes share a non-blocking fd lock so a stale disclosure write cannot erase a concurrent decline; corrupt state is never replaced with defaults. `config set telemetry false` durably disables and wipes; `config set telemetry true` deliberately re-enables through the same two-register Settings transition. `doctor` reports recorded opt-outs and unreadable privacy state instead of "consent_required". Gates on this exact tree (macOS, offline cargo): - cargo fmt --check: pass - workspace clippy --all-targets --all-features -D warnings: pass - nextest --workspace --all-features --profile ci: 14284 passed, 0 failed, 14 skipped (1 non-failing leak observation, hooks executor EOF test) - focused: config+telemetry libs 687/0/1; CLI/TUI telemetry+localization +doctor selection 229/0; real CLI process kill-switch dispatch 5/0; TUI integration telemetry_contract 15/0; credential handoff dispatch 3/0 - `npm test && npm run check:web` do not exist in this repository and were not run. No live ingest, PostHog delivery, hosted CI, install, or release is claimed. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bs5x11yXAg3sJ4giZf4krF	11 天前
Cargo.toml	chore(release): prepare v0.9.13 Version bumps across the workspace, npm packages, VS Code extension, and facts surfaces; CHANGELOG 0.9.13 section with the release narrative, the missing #5989 receipts (ACP schema, queue data loss, metrics, goal-loop), the truncated-tool-args fix, the paste regression fix, allow_insecure_http, the Computer Use 0.2.0 bundle refresh, an upgrade-notes subsection (re-trust Computer Use), and the 0.9.13 contributor ledger; derived web surfaces regenerated (changelog.generated, facts.generated, GT catalogs); contributor credits chain in parity (CHANGELOG ledger = website arrays = docs/CONTRIBUTORS.md band = facts requiredCandidateCredits); INSTALL.md and the trust/telemetry copy bumped to 0.9.13. Gates: web 407/407 (npm test); check:facts OK; check:locales OK; check-versions OK (workspace/npm/npm-binary/lockfile = 0.9.13); feature release-note receipts OK (15); prepare-release transaction completed. Signed-off-by: CodeWhale Bot <bot@codewhale.net>	8 天前
build.rs	feat(build): emit a release-only build sha `CODEWHALE_RELEASE_BUILD_SHA` is emitted only when `DEEPSEEK_BUILD_SHA` or `GITHUB_SHA` was in the build environment. For every locally built binary it is simply absent, `option_env!` yields `None`, and a telemetry payload carries `git_sha: null`. There is deliberately no fallback to the local checkout, and the "was this a published release" gate proposed earlier cannot be built as described. `codewhale_release::latest_release_tag_{async,blocking}` are network calls to `api.github.com` that return *tag names*, not shas, so the only available comparison is version-vs-version — and a maintainer running the release build this repo's own guidance prescribes, on a private tree at the shipping version, would compare equal and ship their private HEAD. Meanwhile `build_commit` already falls back to `git rev-parse`, which is why `CODEWHALE_BUILD_COMMIT` is the builder's own HEAD on every local build and is named here as a forbidden source. Build-time provenance is deterministic, network-free, and verifiable from the repository. The rule lives in `release_build_sha`, which takes the environment as a closure so it is tested against injected values rather than by mutating the process: absent, GitHub-only, Codewhale-wins-over-GitHub, a value that is not a full 40-hex sha, and `CODEWHALE_BUILD_COMMIT` offered as a decoy. The build script belongs to `crates/telemetry` rather than to a consumer because `option_env!` reads the environment of the crate being compiled — a `rustc-env` emitted by `crates/tui`'s build script is not visible to `crates/telemetry`. Its rerun conditions are the two SHA variables and nothing about `.git/HEAD`: watching HEAD would rebuild on every local commit for a value that is `None` on every local build by design.	1 个月前