| Files | Last commit | Last update |
|---|---|---|
Offer the Android app as an APK on openbot.run (#8404) * Offer the Android app as an APK on openbot.run Some users do not want Google Play, or have a phone with no Google Play. The site now offers the Android app as an APK for them. - The APK is the universal APK that Google Play makes from the store bundle, so it has the signature of the store app. After each upload, the Android release workflow saves it on a draft GitHub release `android-v<version>`, which is not public. - When a version is marked as available (`mobile-features-config.ts` on main), a workflow makes the draft public. The release is never the "latest" release, so desktop downloads and updates do not change. - `/download/android/latest` redirects to the APK of the newest Google Play version. The Android card of the home page has a "Get the APK" link, the download menu has an "Android · APK" entry, and the Android download page has a second button with install steps. - `ANDROID_APK_FIRST_VERSION` hides all of this until the first version with an APK is available: 1.4.9 has none. - On a phone with no Google Play, Update in the mobile app opens the download page. Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com> * Keep the staged Android APK private and off the desktop release path Fixes from the local review of the APK download change. - Stage the APK in one job with no workflow artifact. Each signed-in GitHub user can download the artifacts of a public repository, and the APK must not be public before its version is. - Make the Android release a GitHub prerelease. A prerelease cannot become the "latest" release, and the notes of the next desktop release do not start from it. - A second build of a version moves the tag of the draft to its commit. - A failed read of the "latest" release is not reported as a change. - The publish job has its own concurrency group. - A value of `ANDROID_APK_FIRST_VERSION` that is not a version hides the APK download. - The focus ring of the Android card has the radius of the card. Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5.2 <noreply@anthropic.com> | 1 day ago | |
Run CI steps in parallel and remove the package-store cache (#1652) * Run independent CI steps in parallel * Remove the Bun package-store cache from CI setup | 1 month ago | |
Remove unit tests and keep E2E and protected tests (#2051) * Remove unit tests and keep E2E and protected tests Delete 591 vitest unit test files and their test-only harnesses. Keep E2E and smoke scripts under scripts/, and keep vitest files only for migrations, schema parity, the renderer-to-main trust boundary, secret redaction, and check-rule fixtures. Remove the test runners that have no tests now (site-router, remote/api, contracts, brand, auth-api client), their CI jobs, and the transfer budget report. Remove code and dependencies that only the deleted tests used. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Set the E2E-only test policy and remove references to deleted tests AGENTS.md now permits vitest files only for migrations, the trust boundary, secret redaction and check-rule fixtures. All other behaviour gets an E2E script under scripts/. Remove references to deleted tests, harnesses and commands from docs, AGENTS.md files and skills. The release-upgrade-safety gates that ran a deleted test now use a manual check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Keep migration tests and fix CI checks after the test removal Move the migration cases out of the deleted mixed test files into three migration test files: the v15 agent usage upgrade and rollback, the read-state baseline from schema v2, and the remote control plane and permanent invitation D1 migrations. Keep error.agent.noStartingModel for the text that older hosts send, and let i18n-check accept it. Lower two type baseline entries. Correct comments and docs that named removed tests or test commands. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Remove the empty test patterns from the knip configuration Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Add E2E checks for Signal secrets, IPC input decoding and analytics redaction - scripts/signal-security-e2e.ts starts the real Signal service with throwaway secrets. It checks the Telegram secret header, the Slack signature, signed account events, remote and route tickets, webhook headers, and that no frame or log line holds the bot token. CI runs it in the new Signal E2E job. - scripts/ipc-input-e2e.ts sends malformed requests from a running dev app and checks that the main process decoders refuse them. - scripts/analytics-redaction-e2e.ts checks that no captured analytics or failure report request holds a seeded secret. For this, OPENBOT_ANALYTICS_CAPTURE_URL sends analytics to a loopback capture server. Only an unpackaged build reads it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Check the renderer analytics path and path traversal in the E2E scripts The analytics E2E now loads the window again and waits for the renderer event, so the renderer send path cannot pass with no request. The IPC input E2E now sends an attachment id and a shared file path that try to leave their folder. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Remove an unused optional parameter from the read-state migration test The parameter gave one exactOptionalPropertyTypes error, which the type ratchet refuses for a new file. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> | 30 days ago | |
Add a live provider test that runs by hand on the Mac mini runner (#8838) * Add a live provider test that runs by hand on the Mac mini runner One real turn on Codex, Claude, Gemini and OpenCode, each in its own desktop app, at the same time. The e2e framework drives each Electron window through the DevTools port. OPENBOT_DEV_HOST_EMAIL gives each development host its own throwaway account. * Run the live provider test on a push to its branch, until the merge * Use the newest Node 24 for the live provider test, because e2e needs 24.8.0 * Save a picture of the chat when a provider gives no answer * Remove OpenCode from the live provider test for now * Remove the temporary push trigger of the live provider test * Run the live provider test when the release preparation reaches main * Keep the app profiles in CI, and stop only the account service that the test started * Start the account service through the Bun path, so knip reports no api binary * Keep the app profiles of the live provider test outside the CI checkout * Start the live provider test from the release-upgrade-safety skill, before the merge and the tag | 7 hours ago | |
Make the three most active developers code owners (#4749) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> | 10 days ago | |
| 3 days ago | ||
Gate install scripts and new package versions (#856) * Gate install scripts and new package versions Set minimumReleaseAge to 3 days in bunfig.toml and a matching Dependabot cooldown. Add an explicit trustedDependencies list (electron-winstaller, esbuild, workerd). @shopify/react-native-skia stays untrusted; the root postinstall installs its binaries. * Record trustedDependencies in bun.lock | 1 month ago | |
ci(review): make NorbiAI reviews faster (#718) * docs: say which NorbiAI reviewer level a pull request needs The directives to change the reviewer were documented, but not when to use them, so agents left every pull request on the default. A table now maps the riskiest area in the diff to a model, and AGENTS.md points to it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * ci(review): give the NorbiAI reviewer the diff in its prompt Every review spent its first several turns paging through `git diff`, each turn a model round trip of 10-20 seconds. The diff now goes into the prompt under `## PR context`, with 40 lines of context so the reviewer does not reopen each file for the code around a hunk. When that is above 200 KB the default context is tried, and above that the reviewer reads the diff itself as before. The diff is untrusted, so its fence is longer than any backtick run in it and cannot be closed from inside. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * ci(review): hand the reviewer AGENTS.md from the base commit The reviewer read AGENTS.md from the checkout, which is the pull request's own copy, and read it again after every context compaction. The composer now appends the root and touched nested AGENTS.md files from the base commit, and the prompt tells the reviewer how to keep its context small. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * ci(review): review only new commits, pick a lighter model for docs - A push reviews the diff since the last successful review. The review comment records the full reviewed SHA. A first review, a rebase, a merge of the base branch and the `norbiai` label still read the whole PR. - Docs, stories, tests and message files default to chatgpt-web/medium. AGENTS.md, CLAUDE.md, .github and .agents keep the default. A directive still wins. - The runner's MCP servers are disabled for the review run when Codex accepts the override, which removes the sign-in turns at start-up. - The inline diff limit now counts the fence around the diff. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: use STE in all written text and add no agent attribution * ci(review): show review time and tokens, ask for one command per call * ci(review): one review per babysit round, shorter rebuttals and review text * ci(review): retry when the bridge is busy, log the MCP step * ci(review): treat an MCP server with no enabled field as enabled * ci(review): run the MCP list parser with the empty Bun config --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> | 1 month ago | |
Prepare the v0.70.0 release (#8892) * Prepare the v0.70.0 release Move 110 release-note fragments into CHANGELOG.md, set the version to 0.70.0, and add the What's new entry in 15 languages and the Discord announcement. * Add the release notes of #8886 and #8887 to v0.70.0 * Name the Server Settings Vault page in the v0.70.0 notes * Add the release notes of #8888 and #8893 to v0.70.0 | 9 hours ago |
| Files | Last commit | Last update |
|---|---|---|
| 1 day ago | ||
| 1 month ago | ||
| 30 days ago | ||
| 7 hours ago | ||
| 10 days ago | ||
| 3 days ago | ||
| 1 month ago | ||
| 1 month ago | ||
| 9 hours ago |