dev → master

.dockerignore

@@ -16,3 +16,4 @@ tmp
 *.sqlite
 *.sqlite-shm
 *.sqlite-wal
+**/._*

.env.example

@@ -13,3 +13,8 @@ JWT_SIGNING_KEY=change_me_64_hex_chars
 
 # Generate secrets with:
 #   openssl rand -hex 32
+
+# Optional: other public https origins of this deployment for controlled-node fallback, comma separated
+# (e.g. a proxy domain). Nodes send their credential to every listed origin they connect to: each must reach this same server,
+# with WebSocket upgrades and ?serverId= routing intact.
+# IMCODES_PUBLIC_URLS=https://proxy.example.com

.gitattributes

@@ -39,3 +39,23 @@ bin/* text eol=lf
 *.bat text eol=crlf
 *.vbs text eol=crlf
 *.ps1 text eol=crlf
+
+# ── Native sources and their spec fixtures: LF everywhere ──
+#
+# Why: the specs under test/spec read these files and the Windows CI runner's checkout (`core.autocrlf=true`, Git for Windows'
+# default) turned every LF into CRLF, so a multi-line marker such as `'UserDataFolder();\n  Log("window_shown"'` was "not found"
+# (job `aiDesk panel window host (Windows build)`, run 37785752309). The specs now read sources through test/helpers/read-source.ts,
+# which is the real fix; this keeps the C++/header/CMake sources themselves identical on every machine (MSVC, clang and cmake all
+# accept LF). No file of these kinds is stored with CRLF in the index, so nothing is renormalised.
+native/**/*.cc text eol=lf
+native/**/*.cpp text eol=lf
+native/**/*.h text eol=lf
+native/**/*.hpp text eol=lf
+native/**/*.mm text eol=lf
+native/**/*.m text eol=lf
+native/**/*.in text eol=lf
+native/**/*.cmake text eol=lf
+native/**/CMakeLists.txt text eol=lf
+native/**/*.manifest text eol=lf
+test/spec/*.cc text eol=lf
+test/spec/*.mm text eol=lf

.github/actions/build-aidesk-ui/action.yml

@@ -0,0 +1,51 @@
+name: Build, sign and describe the aiDesk panel window host
+description: >
+  Builds the Windows panel window host (aidesk-local-ui.exe, a WebView2 window: native/aidesk-panel-host-windows/build.ps1), signs it
+  with the release certificate, THEN describes it by a manifest the controlled node verifies before it ever launches it (see
+  scripts/aidesk-ui-artifact.mjs and src/node/aidesk-local-ui-artifact.ts). Output: dist-node-exe/aidesk-local-ui/win32-x64/. NOT wired
+  into the release workflows yet -- shipping it to installed nodes is the distribution round (see
+  test/spec/aidesk-local-ui-release-wiring.test.ts). Build time only: nothing is downloaded when the product runs.
+inputs:
+  version:
+    description: The controlled-node build version recorded in the manifest.
+    required: true
+  windows-signing-cert-thumbprint:
+    description: Thumbprint of the imported Windows release-signing certificate (Windows only).
+    required: false
+    default: ''
+  windows-signing-cert-sha256:
+    description: sha256 of the release-signing certificate; recorded as the manifest's signer (Windows only).
+    required: false
+    default: ''
+runs:
+  using: composite
+  steps:
+    - name: Build, sign and describe the panel window host (Windows)
+      if: runner.os == 'Windows'
+      shell: powershell
+      env:
+        AIDESK_VERSION: ${{ inputs.version }}
+        AIDESK_THUMBPRINT: ${{ inputs.windows-signing-cert-thumbprint }}
+        AIDESK_SIGNER_SHA256: ${{ inputs.windows-signing-cert-sha256 }}
+      run: |
+        $ErrorActionPreference = 'Stop'
+        if ([string]::IsNullOrWhiteSpace($env:AIDESK_THUMBPRINT) -or [string]::IsNullOrWhiteSpace($env:AIDESK_SIGNER_SHA256)) {
+          throw 'The Windows release-signing certificate must be imported before the panel window host is signed.'
+        }
+        $art = 'dist-node-exe\aidesk-local-ui\win32-x64'
+        & .\native\aidesk-panel-host-windows\build.ps1 -ArtifactRoot $art
+        if ($LASTEXITCODE -ne 0) { throw 'building the panel window host failed' }
+        $exe = Join-Path $art 'aidesk-local-ui.exe'
+        if (-not (Test-Path $exe)) { throw "The panel window host was not built at $exe." }
+        if (-not (Test-Path (Join-Path $art 'THIRD-PARTY-NOTICES.txt'))) { throw 'The panel window host third-party notices are missing.' }
+        & .\scripts\windows-sign-release-artifact.ps1 -Mode Sign -ArtifactPath $exe `
+          -CodeSigningCertificateThumbprint $env:AIDESK_THUMBPRINT -ExpectedSignerSha256 $env:AIDESK_SIGNER_SHA256 -TimestampUrl 'http://timestamp.digicert.com'
+        if ($LASTEXITCODE -ne 0) { throw 'signing the panel window host failed' }
+        & .\scripts\windows-sign-release-artifact.ps1 -Mode Verify -ArtifactPath $exe -ExpectedSignerSha256 $env:AIDESK_SIGNER_SHA256
+        if ($LASTEXITCODE -ne 0) { throw 'the panel window host does not verify against the release signer' }
+        # The manifest records the executable AS SIGNED.
+        node scripts/aidesk-ui-artifact.mjs write $art win32 x64 $env:AIDESK_VERSION $env:AIDESK_SIGNER_SHA256
+        if ($LASTEXITCODE -ne 0) { throw 'writing the panel window host manifest failed' }
+        node scripts/aidesk-ui-artifact.mjs verify $art win32 x64 $env:AIDESK_VERSION
+        if ($LASTEXITCODE -ne 0) { throw 'verifying the panel window host manifest failed' }
+        "aiDesk panel window host (win32-x64): $((Get-Item $exe).Length) bytes" | Out-File -FilePath $env:GITHUB_STEP_SUMMARY -Encoding utf8 -Append

.github/actions/build-controlled-node-compat/action.yml

@@ -0,0 +1,25 @@
+name: Build headless Linux compatibility executable
+description: Pinned community ABI runtime, same-runtime SEA, immutable manifest verification (no GUI or official-mirror fallback)
+inputs:
+  version:
+    description: Exact product version
+    required: true
+outputs:
+  artifact:
+    description: Canonical compatibility artifact filename
+    value: ${{ steps.profile.outputs.artifact }}
+runs:
+  using: composite
+  steps:
+    - name: Resolve canonical compatibility filename
+      id: profile
+      shell: bash
+      run: node -e "require('node:fs').appendFileSync(process.env.GITHUB_OUTPUT,'artifact='+require('./shared/controlled-node-abi-profiles.json').GLIBC217.fileName+'\\n')"
+    - name: Guard thin-node dependency boundary
+      shell: bash
+      run: npm run check:node-exe-deps
+    - name: Build and verify pinned headless compatibility executable
+      shell: bash
+      env:
+        IMCODES_BUILD_VERSION: ${{ inputs.version }}
+      run: node scripts/build-node-compat-exe.mjs