CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions
624 commits 28 branches 80 tags 76 MiB
Commit graph

117 commits

Author SHA1 Message Date
CRT
6c91aad0e1 privacy-scan: a partial upstream path in a container's compressed bytes is left to the full check of the unpacked file 2026-10-11 06:09:49 +08:00
CRT
576e8a8f46 privacy-scan: allow GTK 3's upstream icon export paths (exact prefixes) that linuxdeploy bundles into the AppImage 2026-10-11 06:04:44 +08:00
CRT
466742207e privacy-scan: AppImage squashfs found at the end of the ELF runtime (the runtime contains the magic too); a generic home (/root) is not a term. tools test: 30s timeout (detectTools runs every version command) 2026-10-11 05:59:40 +08:00
CRT
94c542f95f Sidecar leak check: skip a generic build home (/root in a CI container is a substring of the bun runtime itself); privacy-scan still checks every home 2026-10-11 05:38:41 +08:00
CRT
fc538e1dde Desktop release: Developer ID gates on the exact artifacts (every binary inside out: Developer ID, hardened runtime, timestamp, no sandbox or get-task-allow; spctl exec/open and stapler on the app, the app in the DMG and in the updater bundle, the DMG); notarization key from ASC_KEY_ID / ASC_ISSUER_ID / ASC_P8 too 2026-10-11 05:18:41 +08:00
CRT
c0bae1ee31 Desktop release pipeline: privacy scan of every artifact, path-free builds, macOS universal app + DMG (Developer ID + notarization or an ad-hoc -unsigned preview) with self-tests of the exact artifacts, signed latest.json, Forgejo workflow for Linux and Windows, root-owned publish step for storebound.dev 2026-10-11 05:16:59 +08:00
CRT
1a8d817cb2 Desktop D5: one desktop version (package.json desktopVersion) checked in CI; updater public key; NSIS per user with the WebView2 bootstrapper 2026-10-11 05:16:59 +08:00
CRT
0ce0c51ff6 ci: build the host sidecar before the desktop Rust tests (clean checkouts) 2026-10-11 03:45:24 +08:00
CRT
2ef0769730 Desktop D2 UI: design system, portfolio, release timeline, catalog parity, listings, health, reviews, TestFlight, checks, command palette, toasts, first-run guide, en + tr with i18n check, 7:1 theme check, dev fixture mode and screenshot harness 2026-10-11 03:34:47 +08:00
CRT
95b7cf7ced Desktop host: offline read cache (SQLite), job ids for progress and cancel, parallel live portfolio, project init, verified ffmpeg / Chrome for Testing downloads into app data 2026-10-11 03:34:46 +08:00
CRT
0ace432e87 CLI for desktop D2: doctor, inspect --icon / --listings, reviews drafts / approve, init --dry from embedded templates, iOS phased release share, playwright as optional peer (sidecar bundles playwright-core) 2026-10-11 03:34:45 +08:00
CRT
61a1e832a0 Desktop app shell (apps/desktop): Tauri 2 + React 19 around the storebound sidecar 
- Rust host: spawns storebound serve --stdio with fixed args, hands over a per-session secret,
  mints confirm tokens only after a native dialog showing the summary and the dry run
- every app command re-checks window label and page origin; one capability (main window, app
  commands + event listen only, no plugin API in the webview); strict CSP; tests/security.rs pins it
- store keys picked in native dialogs, kept in the OS keychain, passed per call in memory only
- plugins: shell (Rust only), single-instance, deep-link storebound://, window-state, opener,
  dialog, notification, updater (placeholder endpoint and key until signing), process
- app-centric UI: Portfolio, App (Releases, Catalog, Listings, Health, Reviews, TestFlight),
  App folders, Accounts, Dependencies, Settings; light / dark with the storebound.dev tokens,
  reduced motion, home folder shown as ~
- macOS menu: Cmd+Q quits, Edit menu, Window menu keeps the main window; Linux DMABUF fix
- Bun workspace (npm files unchanged), ci runs desktop typecheck, build, cargo test and clippy;
  scrub covers home paths; docs/desktop.md (protocol, safety, dependency sources and licenses)
 2026-10-11 01:57:33 +08:00
CRT
d74d99bcc9 serve --stdio: desktop JSON-RPC profile on the MCP core, confirm tokens, --json results, sidecar builds 
- cli/serve.ts: session.hello with a per-session secret, typed methods per tool, project.inspect,
  portfolio.status over many project folders, progress notifications, cancellation
- cli/lib/confirm-token.ts: single-use HMAC tokens bound to method + canonical params + expiry;
  writes are dry runs without one; no submit / release / publish method exists
- cli/lib/runner.ts: shared child runner for mcp and serve, works from a compiled binary
- --json on check, testflight / ppo status, next-build, next-version-code, analytics compare,
  prices import; inspect command; confirm() always answers no under serve
- tools/build-sidecars.ts: bun build --compile for five targets, ad-hoc re-sign on macOS, path leak check
- tests/serve.test.ts: methods, token binding / expiry / replay, shared vector, stdio and compiled smoke
 2026-10-11 01:57:33 +08:00
CRT
c48eead0e0 0.5.0: mobile apps and games positioning (README, site, og image, skills, CLI, MCP, adapters), MCP tools for subscriptions and catalog diff, tests, changelog 2026-10-11 01:47:09 +08:00
CRT
79fea16016 0.4.0: changelog, version, README (journey, commands, skills, MCP, safety, FAQ, roadmap), agent rules, adapters 
Owner-only steps in docs/agents-core.md now include Beta App Review, tester invitations, review replies, price changes
and store experiments; personal data stays in .storebound/. README: live-game journey row, TestFlight and After launch
command tables, four new skills, MCP 2026-07-28, unverified list. SECURITY: new endpoints.
 2026-10-10 23:30:48 +08:00
CRT
74dbf8f5a6 0.3.1: README around the zero-to-Submit journey, journey diagram, new positioning in package and plugin descriptions 2026-10-10 22:49:27 +08:00
CRT
e0a284d678 Adapters for every AI tool from one source, tests and CI 
- tools/gen-adapters.ts writes the Claude Code plugin + .mcp.json, Codex plugin, Gemini CLI
  extension + GEMINI.md, AGENTS.md, Copilot instructions and a Cursor rule from skills/ and
  docs/agents-core.md; --check fails on stale files
- tests for adapters, MCP tools and JSON-RPC, validate rules, ASO, release notes, privacy
  manifest, release helpers, install merging, scrub
- bun run ci: adapters check, tests, typecheck, secrets / personal data scrub
- 0.2.0
 2026-10-10 21:03:10 +08:00