The Claude and Codex fetches now take their endpoint URLs as arguments,
with poll supplying the real ones, so tests can point them at the local
one-shot server. The tests pin the current behaviour: usage auth
failures stop before the Messages fallback, server errors and unparsable
bodies fall back to Messages, partial bodies get their reset times
merged, Messages auth failures and missing rate-limit headers are
reported, Codex 401 and 500 map to auth-required and bad-response, and
the account header is sent only when an account id is set.
A GUI app starts with its working directory at the home folder, / or
System32, and `codex exec .` refuses to run there because it is not a
trusted directory or repository. Both CLIs now start from the temp
directory so neither runs inside a project or loads its instructions and
hooks, and Codex runs with --skip-git-repo-check in a read-only sandbox.
The orchestrator takes its spawn step as an argument internally, so its
refreshed, timeout and missing-CLI outcomes are now tested with a fake
credential source, along with the locator's source order and the Claude
credential file signature.
Before building, compare the requested version with the tag /releases/latest returns and fail unless it sorts strictly after it. With no published release yet, any version passes.
ci.yml is now callable with a ref to test. The release workflow calls it on the prepared tag and both build jobs wait for it, so a tag whose sources fail tests, lint or the build publishes nothing. A called run gets its own concurrency group and is never cancelled. The release steps now push main and wait for green CI before pushing the tag.
The AppImage bundler downloads and runs unpinned linuxdeploy tools, so the updater signing key and its password no longer reach the bundle step. A separate step signs the renamed AppImage with tauri signer sign, as the Windows job signs the exe.
The Windows exe and the AppImage now read and write settings.json in
their own folder, so a copied or moved folder keeps its settings. A .deb
install still uses the user's config folder, because it lives in a
read-only system folder.
Rename the crate, binary, product name, identifier, settings folder, log
file, autostart entry, user agent, updater endpoint and release assets.
Legacy Win32 clients still update: they fall back to the first .exe asset,
and the legacy rollback workflow reads the package name from the ref it
builds. Upgraded installs start with default settings.
Git for Windows checks Cargo.lock out with CRLF endings on the windows-latest runner, so the whole-line sed and grep anchors matched nothing and the rollback build stopped at its own check. The patterns now allow a trailing CR and keep it, and the check runs on a CR-stripped copy.
The updater left an environment proxy to the plugin's reqwest, which was
built without SOCKS support, so a SOCKS ALL_PROXY broke updates and, on
Windows, displaced a working system proxy. Enable reqwest's socks feature
and pass the chosen environment or system proxy to the plugin explicitly.
The rename is decided, so it moves from ROADMAP.md to its own plan. The port
plan now marks phases whose code is done but await manual checks or user
actions as in-progress, and records the Windows autostart and update-apply
deviations.
The release build jobs run npm install scripts, so their checkouts no longer persist the token in .git/config. The legacy rollback sets the new version on the package's own Cargo.lock entry instead of running cargo update, so the --locked build resolves nothing and fails if the lockfile differs in anything else.
Clash and v2ray set ALL_PROXY=socks5h://..., which ureq reads before
HTTPS_PROXY. Enable the socks-proxy feature so that entry is used instead
of skipped, and cover a socks5h tunnel with a fake SOCKS5 server.
The signing key moves from job-level to step-level env, so npm install scripts, setup actions and crate build scripts never see it. Linux compiles without the key and signs in a separate tauri bundle step. The legacy rollback builds and signs under a read-only, unpersisted token with the locked Tauri CLI, and a separate job holds the write token to publish.
With TAURI_SIGNING_PRIVATE_KEY set, the build script now requires a
non-empty plugins.updater.pubkey (from tauri.conf.json or a --config
override). A release without it could never verify, and so never install,
a later update.
The plugin fetches latest.json and downloads the platform entry, verifying
its minisign signature. The suffix-ignoring version comparison moves to
core::version and drives the plugin comparator; a manifest without an entry
for this platform counts as up to date. The Windows portable exe swaps
itself in with self_replace, an AppImage goes through the plugin install,
and both relaunch with --updated-to. A package-manager install keeps
checking but greys the apply item.
The GitHub API lookup, the WinHTTP download and the --apply-update helper
are gone, along with the sha2 dependency they needed.
A 1.5 s thread asks the platform whether the foreground window is a
fullscreen window of another process and feeds the result through the
visibility state machine. Windows keeps the proven evaluation with an
own-process check in place of the bubble class check; Linux reads the
EWMH active window state over X11; native Wayland and macOS report false.
tiennm99