|
|
c03291e7f7
|
apple creative-assets: a live app without an editable version uses the live version (only approved assets are selected there; new ones upload and wait for a review of their own via --add-for-review); pitfall 76: placements read back ACTIVE live, a state the 4.5.1 spec does not list
|
2026-10-19 05:45:47 +07:00 |
|
|
|
183579449c
|
apple creative-assets: select Header and Search Results assets once processed (Prepare for Submission), not once approved: Apple reviews an asset only in a review submission, so 0.8.13 waited forever; upload and select in one run with a bounded processing wait; --add-for-review puts unreviewed assets into the draft review submission (never submits); --verify reads every slot back read-only (MCP apple_creative_assets_verify); a rejected file or one that failed processing twice is not re-uploaded, an archived copy is unarchived; fake commits library assets to PREPARE_FOR_SUBMISSION; pitfall 76 rewritten; apple-name check test only looks at name hints
|
2026-10-19 05:42:53 +07:00 |
|
|
|
3e4015b686
|
ci: the background acceptance jobs start after the Linux and Windows installer builds (0.8.13's Windows installer waited behind six acceptance jobs on the one Windows runner); release: an npm deprecation already set by an earlier npm-publish run (422) is not an error
|
2026-10-18 13:38:26 +07:00 |
|
|
|
d006f8d932
|
storebound 0.8.13: version in package.json and every copy, CHANGELOG 0.8.13 section
|
2026-10-18 13:13:16 +07:00 |
|
|
|
e5369090fa
|
apple creative-assets: App Store Header and Search Results (PRODUCT_PAGE_HEADER_ASSET, APP_STORE_SEARCH_RESULTS_ASSET) through the App Asset Library: local size / alpha / video checks, upload once by MD5, select only approved assets, replace on a changed file; check / validate note, MCP tool, gallery and desktop Art row, docs, pitfall 75
|
2026-10-18 13:10:20 +07:00 |
|
|
|
14ffe3545a
|
npx / bunx storebound always run the newest version: a copy started from the npx or bunx cache re-runs the command as storebound@<newest> when npm has a newer one (registry asked at most every 10 minutes, 1.5 s timeout; off with STOREBOUND_NO_UPDATE=1, in CI and offline); a project install gets a one-line note instead
|
2026-10-18 13:09:06 +07:00 |
|
|
|
3381673ae6
|
iPhone Duo screenshots (render, check, upload skip with console link while the API has no display type) and the medium display class as the required iPhone set, labels as in the console
|
2026-10-18 13:07:15 +07:00 |
|
|
|
0b32df57f0
|
desktop-release: tauri only signs; the app is notarized with notarytool directly (up to 3 tries, later ones without S3 acceleration) and stapled, because the upload inside tauri bundle was cut off twice for 0.8.12 with no retry
|
2026-10-18 02:43:59 +08:00 |
|
|
|
d2ae0fa765
|
release: one release at a time (a lock with the pid in ~/.storebound-releases/release.lock): two runs once built into the same target folder and both failed
|
2026-10-18 02:32:44 +08:00 |
|
|
|
ddb813576e
|
desktop-release: notarization retries go by notarytool's status, not its exit code (0.8.12's aborted upload exited without an error), up to 3 tries, the later ones with --no-s3-acceleration
|
2026-10-18 02:24:34 +08:00 |
|
|
|
88078f1d7e
|
desktop-release: a DMG notarization upload cut off before Apple had it (abortedUpload) is submitted once more
|
2026-10-18 02:11:54 +08:00 |
|
|
|
45b705ba85
|
tests: report fixtures use example.com subdomains and the zero uuid (the repo scrub flagged corp.invalid emails and a real-looking issuer id)
|
2026-10-18 01:46:36 +08:00 |
|
|
|
9bfc107415
|
release-candidate: the background test jobs (ci, acceptance) never gate a candidate; only the installer builds and the record count (0.8.12 stopped on a red ci job)
|
2026-10-18 01:45:37 +08:00 |
|
|
|
9909b3df73
|
storebound 0.8.12: version in package.json and every copy, CHANGELOG 0.8.12 section
|
2026-10-18 01:43:07 +08:00 |
|
|
|
af349b3db1
|
report: storebound report writes one shareable, self-contained readiness page (.storebound/reports/readiness-<date>.html; --md, --json, --no-open, --offline, --out) from scan, check and validate: a verdict per store (Ready to submit / N blockers / Not checked with the reason), findings per store by severity with guideline, evidence, fix and console button, the owner's compliance questions as a checklist, secrets masked; storebound.dev look, light / dark, print; desktop Checks > Report (same code path, opens through project_reveal) and its Markdown export on the same renderer; read-only MCP tool report
|
2026-10-18 01:42:03 +08:00 |
|
|
|
6d95ea00f5
|
agent rules: every check, rule, template line, message and desktop view covers both stores and every surface
|
2026-10-18 01:31:17 +08:00 |
|
|
|
5a266b952f
|
templates: the 2.3.1 example line says where the same goes on Google Play (no review-notes field: App access 'Any other information' with a sign-in, and the full description for what needs a subscription)
|
2026-10-18 01:29:36 +08:00 |
|
|
|
61cb3338e8
|
scan: remote config, feature flags and remote paywalls not told to review (App Review 2.3.1, Play Deceptive behavior): remote-features finding for both stores, medium, with deep links, unless the review notes mention them; check prints it as a warning, validate carries it; warn only, the templates get a commented example line; code obfuscators a low note, minify alone nothing; store-pitfalls 74
|
2026-10-18 01:26:32 +08:00 |
|
|
|
9ba97b7e29
|
release: candidate downloads go through Cloudflare first (the direct route to the origin was throttled per connection: one AppImage took 20+ min there, 3 MB/s through Cloudflare), the origin only as a fallback; a heartbeat logs the bytes every 30 s
|
2026-10-17 15:59:44 +08:00 |
|
|
|
37cda2a39a
|
storebound 0.8.11: version in package.json and every copy, CHANGELOG 0.8.11 section
|
2026-10-17 14:29:27 +08:00 |
|
|
|
824758179b
|
review access: guest-play apps rejected by Play as a login wall (empty name field, disabled Continue, a code link on the first screen): check warns for a Play app with a first-run gate or IAP and no reviewAccess.instructions; with guest steps the play-sign-in-details plan declares one entry without credentials, the dialog's required full-access box as the owner's step; store-pitfalls 73
|
2026-10-17 12:50:06 +08:00 |
|
|
|
d6070cc185
|
release: when the published version is still missing from the registry after 2 minutes, publish once more (0.8.10's publish answered 0 and left nothing)
|
2026-10-16 07:48:55 +08:00 |
|
|
|
9059b2b32a
|
background tests: ci.yml runs the CI and the acceptance matrix on every push again but nothing waits for them (the gate no longer waits for the parent's run, which a release's own bump push cancels; the record job needs only the installers); tools/ci-status.ts reports main's newest test run and release.ts prints a red one as a warning
|
2026-10-16 07:17:19 +08:00 |
|
|
|
b84538e4cb
|
storebound 0.8.10: version in package.json and every copy, CHANGELOG 0.8.10 section
|
2026-10-16 06:35:47 +08:00 |
|
|
|
b6c4beaada
|
release: the CHANGELOG cut is checked before any version copy changes, and in the dry run (an empty Unreleased left every copy bumped and the next run refused 'not newer')
|
2026-10-16 06:34:51 +08:00 |
|
|
|
1f47b10fa9
|
CHANGELOG: Unreleased for 0.8.10
|
2026-10-16 06:33:40 +08:00 |
|
|
|
6443a5c442
|
neutral names in docs, tests and comments (no real app or project names)
|
2026-10-16 06:14:02 +08:00 |
|
|
|
cba4660777
|
release-candidate: a candidate whose jobs were only cancelled (a newer push to main cancels the older run) says so and gives the tag move + --resume line instead of 'red: fix it'
|
2026-10-16 05:54:14 +08:00 |
|
|
|
8a84ab4089
|
play: changesNotSentForReview goes only on edits.commit (validate answers 400 "Unknown name changesNotSentForReview: Cannot bind query parameter", found by a game on 220e9bb's real run): a refused commit is committed again with the parameter, a dry run's refused validate only says how the real run commits; the fake Play refuses the parameter on validate and a test asserts validate never gets it
|
2026-10-16 05:53:18 +08:00 |
|
|
|
dcb553fd16
|
storebound 0.8.9: version in package.json and every copy, CHANGELOG 0.8.9 section
|
2026-10-16 05:51:05 +08:00 |
|
|
|
220e9bb072
|
play: an edit Play will not send for review (400 'set changesNotSentForReview to true', a game 1.0.1 (5) after a rejection) is validated and committed again on the same edit with changesNotSentForReview=true; dry runs validate that way and say so; prints the Publishing overview link (owner's button), records it in .storebound/ for play status; --not-sent-for-review on release / upload / rollout / listing / images and MCP / desktop; pitfall 72
|
2026-10-16 05:50:37 +08:00 |
|
|
|
dcca4e86e4
|
storebound 0.8.8: version in package.json and every copy, CHANGELOG 0.8.8 section
|
2026-10-16 00:09:06 +08:00 |
|
|
|
728b216dcc
|
tests: the rtdn email fixture keeps the user-data line out of the service-account comment's window
|
2026-10-15 22:51:31 +08:00 |
|
|
|
a1647e9552
|
scan: an email hit whose line or the 3 lines above (doc comment, enclosing interface) name a server / config identity is not user data (a game apps/server/src/iap/rtdn.ts: email: string | null under 'Push service account email')
|
2026-10-15 22:51:02 +08:00 |
|
|
|
9171cb1129
|
scan: the email detector skips server / config identities (a service account or OIDC email of a Pub/Sub push, SMTP / sender / admin addresses, values from the environment); a game's rtdn: { audience; email; token } in apps/server/src/config.ts was flagged as App Privacy Email Address
|
2026-10-15 22:49:35 +08:00 |
|
|
|
ead5da4ab3
|
release: npm publish + deprecate run by themselves with a granular access token from ~/.storebound-keys/npm-token (0600; npm reads it through a temporary userconfig, never argv, logs or the checkout); bun tools/release.ts npm-token saves it once from the clipboard, npm-publish publishes this checkout's version
|
2026-10-15 20:13:42 +08:00 |
|
|
|
9d41fcdc50
|
no CI, no acceptance runs (the owner's decision): Forgejo's ci and acceptance jobs are off (if: false), the record job needs only the Linux / Windows installers; release.ts skips ci:quick, the macOS acceptance matrix and its report (TESTS = false); build, signing, notarization, privacy scans and verify stay
|
2026-10-15 19:58:47 +08:00 |
|
|
|
e7e26db4aa
|
acceptance: a cell's timeout grows with the machine's load (like tools/ci.ts) and a cell that only timed out runs once more, marked; a release failed on two cells that take 3 s alone, at load 95 on 10 cores
|
2026-10-15 19:57:17 +08:00 |
|
|
|
e500e88e40
|
Console pages as absolute deep links: cli/lib/console-links.ts builds the URL of every App Store Connect / Play Console page from apple.appId, play.developerId and play.appId (app list / developer chooser when unknown); every plain 'App Store Connect > ...' / 'Play Console > ...' direction in cli/ and templates/ now carries it, validate / scan / declarations / release plan JSON carry url, the desktop shows an Open button; tests/console-links.test.ts guards it; AGENTS rule 11, pitfall 71
|
2026-10-15 19:55:37 +08:00 |
|
|
|
f898d642d0
|
desktop AI fix: kill only the agent's own process group with killpg (never pgid <= 1 or our own group) instead of the external kill command; a Forgejo ci run of bc85dab died of SIGTERM in the middle of these tests
|
2026-10-15 19:45:00 +08:00 |
|
|
|
bc85dabf90
|
storebound 0.8.7: version in package.json and every copy, CHANGELOG 0.8.7 section
|
2026-10-15 19:38:32 +08:00 |
|
|
|
b830a99a5f
|
First in-app purchases left out of a review are caught (pitfall 70): firstProductGaps in validate / release plan (blocker) and the apple submit plan (refuses to leave a never-approved first product out); apple status (WARN + firstProductGaps in --json), release status and the desktop checks warn while a version waits for or is in review without it; iap-review says 'ready, not submitted yet' instead of 'complete'
|
2026-10-15 19:31:26 +08:00 |
|
|
|
1c35a625e1
|
build-node: TypeScript's own script runs under Bun (node_modules/.bin/tsc is a .exe / .cmd shim on Windows: the Windows acceptance cell packed nothing on dc387f6)
|
2026-10-15 06:36:24 +08:00 |
|
|
|
dc387f6ffb
|
storebound 0.8.6: version in package.json and every copy, CHANGELOG 0.8.6 section
|
2026-10-15 06:33:52 +08:00 |
|
|
|
d72b199645
|
ci: the acceptance jobs run bun install before packing (prepack builds the package's declarations with the pinned TypeScript; without node_modules npm pack failed and every acceptance cell went red on 5ed787a); build-node names the missing install instead of a bare ENOENT
|
2026-10-15 06:33:01 +08:00 |
|
|
|
5ed787a8ca
|
desktop AI fix: a claude CLI without a sign-in ("Not logged in · Please run /login", seen in a real headless run) shows 'not signed in' with the copy-for-AI fallback instead of a bare failure; the flags were checked against a real claude run (it edited the file)
|
2026-10-15 06:28:52 +08:00 |
|
|
|
c95f2af8ff
|
desktop: Fix with AI on scan findings that need a code change (aiFix: true, AI_FIX_RULES). The host (src-tauri/src/ai_fix.rs) runs the owner's local Claude Code headless in the app folder with Read / Edit / Write / Grep / Glob only (Bash, web tools, sub-agents disallowed) and a prompt it builds from the finding's fields; it refuses while the folder has uncommitted files, streams progress, times out after 10 min with a heartbeat, kills the process group on Cancel or exit, and records the run's changed files so Undo restores exactly those; the window shows the diff with Keep / Undo and rescans. Without claude the button copies the prompt (Copy for AI). Only the claude binary, git and kill / taskkill are started there (tests/security.rs); tests/ai_fix.rs covers the prompt, dirty-tree refusal, undo scope, timeout and cancel
|
2026-10-15 06:26:29 +08:00 |
|
|
|
992f5bcc0e
|
desktop: a Fix button on scan and validate findings storebound can fix itself. Findings carry action { method, args } (cli/lib/fix-actions.ts); privacy-labels runs scan.write (scan --write-only, the dialog shows the config diff), Play listing gaps play.listing, a missing App Store localization or copyright apple.listing (editable version only), the App Review contact apple.review_details; each a dry run, the native dialog, then the confirmed run. --write-only is forbidden for MCP tools; tests pin the mapping, the round trip on a fixture and that no fix reaches a submit, release or publish
|
2026-10-15 06:14:49 +08:00 |
|
|
|
bd83d036ba
|
desktop: long findings wrap inside the Store readiness card (a build-folder path pushed the store chips out); the release timeline's rail no longer breaks after the current step; the rollout bar stays under its stage. scan: function words of the listing languages (German eine / der, French les, Turkish bir, ...) are not repeated keywords; the dev fixture has a long-path finding
|
2026-10-15 06:07:01 +08:00 |
|
|
|
04647c079e
|
package: CommonJS projects get their own declarations (dist/types-cjs; node16 / nodenext refused an ESM-only .d.ts from a CJS file, TS1541); the package-types test covers ES module and CommonJS projects under bundler / node16 / nodenext / node10 and loads the package with import() and require() under Node; pitfall 69
|
2026-10-15 06:01:33 +08:00 |
|
