The slide deck runtimes for kami-deck and open-design-landing-deck
gate go() behind a 700ms `lock` so wheel/key/touch input bursts can't
overshoot the transform transition. But applying the same gate to the
host bridge's od:slide messages and the MutationObserver watching
`.slide.active` creates a startup race: go(0) at the end of init sets
lock=true, and any host-driven `.active` change inside that window
(notably restoreInitialSlide) fires the observer, which calls go(i),
which exits at the lock guard — leaving the visible deck on slide 1
while the host counter advances to N.
Split the actual state update into an unthrottled `applySlide(n)`
helper that updates transform, `.active`, dot nav, and the progress
bar. Keep `lock` only on the user-input path through `go()`. Route
the message listener, the MutationObserver, and the initial render
through `applySlide` directly so host-driven sync always reaches the
deck transform regardless of the throttle state.
Generated-By: looper 0.4.0 (runner=fixer, agent=claude-code)
Apply the same fix that landed in skills/kami-deck/example.html
(commits 96b255b, 8cbca30) to the open-design-landing-deck composer
runtime: the host bridge classifies this deck as class-driven because
go() toggles .slide.active, but the visible slide is moved by
deck.style.transform which the bridge can't drive. Add an od:slide
message listener that calls stopImmediatePropagation() and routes nav
through the local go(), plus a MutationObserver that pulls the deck
transform onto whichever slide carries .active so the bridge's direct
setActive calls (notably restoreInitialSlide) move the deck too.
Regenerates example.html via scripts/compose.ts; the regeneration also
picks up upstream nav-cta and brand-meta CSS additions in the sister
open-design-landing styles.css that the example had drifted from.
Generated-By: looper 0.4.0 (runner=fixer, agent=claude-code)
PR #434 (French localization) merged into main with French copy for the
old editorial-collage / editorial-collage-deck skill ids; this branch
renamed those to open-design-landing / open-design-landing-deck and
added kami-deck and kami-landing. Update content.fr.ts to track the
rename and add French copy for the new kami skills so the
LOCALIZED_CONTENT_IDS coverage test passes once main is merged.
Generated-By: looper 0.4.0 (runner=fixer, agent=claude-code)
The previous fix added a local od:slide listener but the host bridge in
apps/web/src/runtime/srcdoc.ts also listens for the same message and
calls setActive() (toggles .slide.active) without driving the deck
transform. Both listeners fired, the bridge re-read the just-toggled
active class, and overshot by one — and the bridge's restoreInitialSlide
path could move .active without a message at all, leaving the deck on
the original transform.
Stop the bridge from double-handling by calling stopImmediatePropagation
in the local listener (registered first because the bridge script is
appended to </body>), and add a MutationObserver that pulls the deck
transform onto whichever slide currently carries .active so the bridge's
direct setActive calls (notably the initial-slide restore) move the deck
too.
Generated-By: looper 0.4.0 (runner=fixer, agent=claude-code)
The host bridge classifies kami-deck as class-driven because go() toggles
.slide.active, but the visible slide is moved by deck.style.transform
which the bridge cannot drive. Listen for od:slide messages and dispatch
them through the local go() so toolbar next/prev and initialSlideIndex
restore actually shift the deck.
Generated-By: looper 0.4.0 (runner=fixer, agent=claude-code)
The PR renames the editorial-collage / editorial-collage-deck skills
to open-design-landing / open-design-landing-deck, but the daemon
persists exact skill_id strings on projects and resolves them via
listSkills().find((s) => s.id === storedId). After the rename, any
project saved against an old id silently composes without the intended
skill prompt because the listing no longer exposes that id.
Add a SKILL_ID_ALIASES map in skills.ts plus a findSkillById() helper
that rewrites deprecated ids to their current canonical form, then
route every server-side lookup (skill detail, example HTML, asset
proxy, system-prompt composer) through it. Cover the alias map, the
resolver, and end-to-end resolution against a temp skills directory
with a regression test.
Generated-By: looper 0.4.0 (runner=fixer, agent=claude-code)
Address P3 review notes on PR #428:
- Note the `data-github-version` wrapper invariant (version string only)
near the canonical URL block in `app/page.tsx`.
- Expand the `formatVersion` helper comment in `app/pages/index.astro`
with concrete `release.name` / `tag_name` example shapes for each
branch of the regex fallback.
- Tighten the `EditorialCollageDeckInputs` deprecation in
`skills/open-design-landing-deck/schema.ts` to a specific removal
version (v0.4.0) and add a "Migrating from editorial-collage-deck"
section to the skill README.
Generated-By: looper 0.4.0 (runner=fixer, agent=claude-code)
- Rename editorial-collage skills to open-design-landing and -deck; refresh examples and compose script layout
- Add kami-deck and kami-landing skills with HTML examples
- Landing page: og.astro, index wiring, and style tweaks; package.json bump
- Web i18n: German and Russian copy for renamed and new skills
- Daemon test: update skill-asset-rewrite expectations for new paths
- Design systems: README and atelier-zero doc touch-ups
- Cross-skill SKILL.md reference updates
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat(editorial-collage): introduce Atelier Zero style landing page assets and documentation
- Added new design system for Atelier Zero, including a detailed `DESIGN.md` file.
- Created an `editorial-collage` skill with associated assets for a magazine-grade landing page.
- Included example HTML and image assets for various sections (hero, about, capabilities, etc.).
- Updated README files to guide usage and customization of the new skill and design system.
- Introduced a new image generation prompt pack for consistent visual style across the landing page.
* fix(i18n): cover atelier-zero design system and editorial-collage skill in German content
Generated-By: looper 0.4.0 (runner=fixer, agent=claude-code)
* fix(editorial-collage): align manifest with shipped assets and address PR review
- Update image-manifest.json widths/heights/ratios to match the actual PNGs
on disk: hero/about/cap/testimonial/cta = 1024x1024 (1:1), method-1..4 =
816x816 (1:1), lab-1..5 and work-1..2 = 768x1024 (3:4). Mirror the new
dimensions in imagegen-prompts.md headings and in README.md.
- Mark testimonial.png as rekey_on_brand_change so the manifest agrees
with SKILL.md's "regenerate at minimum testimonial.png" guidance, and
add work-1/work-2 to the rekey list in SKILL.md and README.md.
- Add a Hero (I.) sec-rule and renumber every following section II..VIII
in example.html so the eight sections walk sequentially I -> VIII and
the page-of-008 counter starts at 001.
- Delete editorial-artifact-system/ (16 duplicate PNGs + index.html +
skills.md draft) — the canonical version is skills/editorial-collage/
and the duplicate had no consumer references.
- DESIGN.md: spell out which dimensions of each magazine reference
(Monocle/Apartamento/IDEA), document the rationale for single-accent
vs multi-accent, and extend the anti-pattern list with AI-image-gen
artifacts the system explicitly rejects.
- SKILL.md: add italic_words validation guidance (trim, cap at 4,
verb->noun rewrite, punctuation strip) and replace the broken-image
fallback with an inline SVG placeholder sized to the slot's
manifest aspect ratio.
Generated-By: looper 0.4.0 (runner=fixer, agent=claude-code)
* fix(daemon): serve skill example assets via stable API route
Skill example HTML such as `skills/editorial-collage/example.html`
references shipped images via `./assets/*.png`. The web app loads the
example into a sandboxed iframe via `srcdoc`, where relative URLs
resolve against `about:srcdoc` and the PNGs render as broken images in
the Examples preview.
Add a `GET /api/skills/:id/assets/*` route that serves files under the
skill's `assets/` directory with path-traversal guards, and rewrite
`src='./assets/<file>'` / `href='./assets/<file>'` in the example
response to point at that route. The disk preview keeps working
because the on-disk files are unchanged.
Generated-By: looper 0.4.0 (runner=fixer, agent=claude-code)
* feat(landing-page): add new static Next.js 16 site for Open Design marketing
- Introduced a new landing page application using Next.js 16, featuring a static export setup.
- Added essential files including `package.json`, `next.config.ts`, and TypeScript configuration.
- Implemented global styles in `globals.css` to match the Atelier Zero design system.
- Created a detailed `AGENTS.md` for module-level boundaries and purpose.
- Included various image assets for the landing page, ensuring a visually cohesive experience.
- Established a root layout and main page structure to support the marketing content.
* style(landing-page): enhance topbar layout and improve responsiveness
- Added nowrap styling to topbar elements to prevent text overflow.
- Introduced media query to hide mid text in the topbar for screen widths between 1200px and 1280px.
- Updated layout.tsx to suppress hydration warnings for better rendering consistency.
- Removed redundant "Compiled by Open Design" text from the page component.
* feat(landing-page): implement scroll-reveal animations for enhanced user experience
- Added a new `RevealRoot` component to manage scroll-triggered reveal animations.
- Updated `globals.css` with styles for elements using the `data-reveal` attribute, including opacity, translation, and scaling effects.
- Modified `layout.tsx` to include the `RevealRoot` component for managing animations.
- Enhanced `page.tsx` by adding `data-reveal` attributes to various elements for staggered reveal effects.
- Implemented reduced motion support to ensure accessibility for users with motion sensitivity.
* fix(landing-page): update import paths and enhance link styles
- Changed the import path in `next-env.d.ts` to reference the correct routes type definition.
- Enhanced `globals.css` with new styles for topbar links, work cards, and partner elements, improving hover effects and transitions.
- Updated `page.tsx` to include canonical project URLs and made various links point to these URLs for better navigation and accessibility.
* feat(landing-page): implement headroom-style sticky header with live GitHub star count
- Introduced a new `Header` component to manage sticky navigation behavior on scroll, enhancing user experience.
- Updated `globals.css` to style the sticky header, including transitions and visibility toggling based on scroll direction.
- Modified `page.tsx` to replace the static header with the new `Header` component, which fetches and displays the live GitHub star count.
- Ensured accessibility by providing a fallback for users who prefer reduced motion.
* feat(landing-page): enhance editorial landing page with global ticker and new styles
- Updated `next-env.d.ts` to reference the correct routes type definition for development.
- Enhanced `globals.css` with new styles for the global ticker, including responsive design and improved overflow handling.
- Introduced a new `WIRE_CITIES` and `WIRE_CONTRIBS` data structure in `page.tsx` to display a counter-scrolling marquee of cities and contributors.
- Added a ghost button style for the navigation call-to-action in the header.
- Updated various sections in `page.tsx` to integrate the new ticker and improve overall layout and accessibility.
* refactor(landing-page): update paper texture overlay and remove multica-ai link
- Enhanced comments in `globals.css` to clarify the purpose and behavior of the paper texture overlay.
- Adjusted z-index of the overlay to ensure proper layering with other elements.
- Removed the `multica-ai` partner link from `page.tsx` to streamline the partner section.
* feat(landing-page): implement dynamic contributor marquee with GitHub integration
- Added a new `Wire` component to display a counter-scrolling marquee of cities and contributors.
- The contributor list is fetched live from the GitHub API, ensuring up-to-date information.
- Updated `page.tsx` to integrate the `Wire` component, replacing the static contributor list with dynamic content.
- Enhanced comments for clarity regarding the functionality and purpose of the global wire.
* fix(i18n): add German display copy for editorial-collage-deck skill
The Validate workspace test asserts that GERMAN_CONTENT_IDS.skills covers
every curated skill on disk; the new editorial-collage-deck skill was
missing from DE_SKILL_COPY, causing src/i18n/content.test.ts to fail.
Generated-By: looper 0.4.0 (runner=fixer, agent=claude-code)
* feat(landing-page): migrate marketing site to Astro
* perf(landing-page): remove React client runtime
* perf(landing-page): serve images from Cloudflare resizing
* fix(pr): address landing page review feedback
---------
Co-authored-by: mrcfps <mrc@powerformer.com>
* feat(daemon): allow OD_MEDIA_CONFIG_DIR to relocate media-config.json
`media-config.ts:configFile()` always wrote to `<projectRoot>/.od/`,
which fails when the daemon runs from a read-only install (Nix store,
immutable image, etc.) — `PUT /api/media/config` then 500s with
ENOENT/EROFS on the mkdir.
Add an opt-in `OD_MEDIA_CONFIG_DIR` env var that, when set, redirects
the file to `<OD_MEDIA_CONFIG_DIR>/media-config.json`. Existing
workspace-local installs are unaffected — the default still resolves
to `<projectRoot>/.od/media-config.json`. The override is intended to
be pointed at the same writable directory as `OD_DATA_DIR`
(`~/.od`, `$XDG_CONFIG_HOME/open-design`, etc.) by the supervisor that
launches the daemon.
Adds a test pinning the override path so the fallback semantics don't
silently regress.
* fix(daemon): align OD_MEDIA_CONFIG_DIR with OD_DATA_DIR semantics + cover write path
Address PR review:
* The previous diff trimmed the env value but skipped path expansion,
so `~/.od` would land at literal `./~/.od/media-config.json` and
relatives anchored against process.cwd instead of <projectRoot>.
Mirror server.ts:resolveDataDir() — `~/` expands to homedir, relatives
resolve against projectRoot. Pinned with three new test cases
(absolute, `~/`, relative-against-projectRoot).
* The packaged daemon (apps/packaged/src/sidecars.ts) doesn't pass
OD_MEDIA_CONFIG_DIR through to the child and its allowlist won't
forward it, so packaged installs would still fail. Add a fallback
precedence: OD_MEDIA_CONFIG_DIR > OD_DATA_DIR > <projectRoot>/.od.
Packaged installs (which already set OD_DATA_DIR) and the Home
Manager / NixOS modules now route media-config there for free, no
separate plumbing required. Workspace-local installs are untouched.
* Add a write-path test that points OD_MEDIA_CONFIG_DIR at a not-yet-
existing nested directory, calls writeConfig, and asserts both file
creation and round-trip read. This reproduces the original PUT
/api/media/config failure mode.
* Document the precedence chain in AGENTS.md (single source of truth
for module-level concerns) and the storage row of README.md, plus
expand the file's header comment with a migration note for users
who already had a custom OD_DATA_DIR alongside a workspace
media-config.json.
* fix(daemon): strip ANTHROPIC_API_KEY when spawning Claude Code
Claude Code prefers ANTHROPIC_API_KEY over the user's logged-in
subscription auth when both are present, silently billing API usage
even though the daemon's "Local CLI" mode implies the user wants
their `claude login` credentials (Pro/Max plan) to be used. The
daemon inherited the launching shell's env, so anyone who ever
exported ANTHROPIC_API_KEY for SDK work or scripts hit this.
Strip ANTHROPIC_API_KEY from the env passed to spawn for the
claude adapter only, so Claude Code's own auth resolution applies.
Fixes#398
* fix(daemon): strip ANTHROPIC_API_KEY case-insensitively, extract helper, add tests
Address review feedback on #400:
- Extract spawnEnvForAgent helper in agents.ts so the strip is unit-
testable and lives next to the other agent-spawn primitives.
- Strip ANTHROPIC_API_KEY case-insensitively. Windows env-var names are
case-insensitive at the kernel level; spreading process.env into a
plain object loses Node's case-insensitive accessor, so a mixed-case
Anthropic_Api_Key would survive `delete env.ANTHROPIC_API_KEY` and
still reach Claude Code via the spawned env block on Windows.
- Add four tests covering: uppercase strip for claude, case-insensitive
strip for claude, preservation for non-claude adapters, and input
immutability.
---------
Co-authored-by: Sebastian Westberg <sebastianwestberg@Sebastians-MacBook-Pro.local>
The /api/projects/:id/files/:name route used a named Express param
that does not match path separators, so requests for files stored in
subdirectories (e.g. assets/logo-mark.svg, fonts/Aeroport.woff2)
returned 404.
Switch to a wildcard route and read req.params[0] so that any depth
of nesting is handled correctly. This fixes missing media and fonts
when opening an HTML project file as a standalone preview.
* Add French Quickstart
* Avoid hard-coded Design System count in French Quickstart
* Refresh French Quickstart skills overview
* Clarify French Quickstart live catalogs
* Broaden French Quickstart skill result wording
Adds provider-specific API proxy routes for Anthropic, OpenAI-compatible, Azure OpenAI, and Google Gemini; normalizes provider SSE streams; updates web provider clients/settings/docs/tests; and forwards Gemini token limits.
* Refactor RUNTIME_DATA_DIR resolution logic
Set OD_DATA_DIR=$HOME/.open-design #390
* Refactor resolveDataDir to accept projectRoot parameter
Add validation if the resolved path is not writable.
* fix(desktop): show window on macOS dock activate
On macOS, closing the Electron window via the red close button hides it
rather than destroying it. Without an app.on('activate') handler, clicking
the dock icon afterward does nothing — the window stays hidden indefinitely.
Add app.on('activate') in runDesktopMain that calls desktop.show(), and
add the corresponding show() method to DesktopRuntime / createDesktopRuntime
that calls window.show() + window.focus() when the window is not destroyed.
* fix(desktop): hide window on macOS close instead of destroying it
On macOS the red X should hide the window, not destroy it. Without this,
clicking close triggers window-all-closed → shutdown, so the activate
handler added in the previous commit can never show anything.
Intercept the close event on darwin and call event.preventDefault() +
window.hide() when the runtime has not been asked to stop. The stopped
flag is set to true before window.close() is called in the programmatic
shutdown path, so that path is unaffected.
---------
Co-authored-by: StotheC90 <StotheC90@users.noreply.github.com>
Fix web sidecar proxy requests so same-origin browser requests reach the daemon without tripping origin validation, while unrelated origins remain rejected. Fixes#388.
Part 1 of 2 for #368. The FileViewer's HTML preview previously fetched the
file plus every relative <link>/<script> and concatenated the bytes back
into a srcDoc string. That model breaks down for multi-file artifacts:
one bad fetch dark-frames the whole iframe, every script shows up as
"Inline Babel script (n)" with no source map, and the asset tree gets
re-fetched from scratch on every Open click.
Switch the default HTML preview to <iframe src=...> against the daemon's
raw-file endpoint — the same shape the existing Preview pane already
uses. The browser handles its own asset resolution, source maps work,
DevTools shows real filenames, and per-asset HTTP caching applies.
Decks and comment-mode keep the existing srcDoc path so the deck and
comment postMessage bridges (which must run before user scripts) stay
intact. Non-deck HTML that depends on the in-iframe localStorage shim
can opt back into the inline path with `?forceInline=1` on the host page.
The decision logic is extracted to file-viewer-render-mode.ts so it's
testable without a DOM harness; both helpers are covered by unit tests
and the FileViewer integration test asserts the URL-load vs srcDoc
markup for plain HTML, declared decks, and deck-shaped HTML.
Refs #368
Co-authored-by: DevForgeAI CI/CD Engineer <devforge-ai@development.ai>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(tools-pack): extend config types for linux platform
* feat(tools-pack): add linux resource files (icon, .desktop template)
* feat(tools-pack): export linuxResources paths
* feat(tools-pack): scaffold linux.ts module
* chore(tools-pack): add vitest devdep for linux lane unit tests
* feat(tools-pack): add buildDockerArgs helper for containerized linux builds
* chore: update pnpm lockfile after adding vitest dep
* feat(tools-pack): add renderDesktopTemplate helper
* fix(tools-pack): use @@ICON_PATH@@ token in linux .desktop template
Reviewer flagged the third .replace() in renderDesktopTemplate as dead code
because the template hardcoded Icon=open-design-@@NAMESPACE@@ instead of
using @@ICON_PATH@@. Switch the template to @@ICON_PATH@@ so install logic
controls the icon stem name independent of namespace, and move the
sanitizeNamespace assertion out of the renderDesktopTemplate describe block
into its own describe.
* feat(tools-pack): add matchesAppImageProcess helper
* test(tools-pack): cover matchesAppImageProcess missing APPIMAGE env case
Closes a coverage gap flagged by code review: a process whose executable
matches /tmp/.mount_*/AppRun but has no APPIMAGE env should be rejected.
The implementation already returned false for this case (undefined ===
installPath is false); this test pins the behavior explicitly.
* feat(tools-pack): implement packLinux native build path
* fix(tools-pack): packLinux extra resources, output pre-clear, publish never
Code review flagged three plan-level omissions in packLinux that mac.ts
handles correctly:
1. writeAssembledApp now writes packagedConfigPath (open-design-config.json)
with namespace, nodeCommandRelative, and namespaceBaseRoot. Without it
apps/packaged falls back to defaults at runtime and cannot find the
namespace runtime tree.
2. writeLinuxBuilderConfig now bundles the resource tree and packaged
config into the AppImage via extraResources. Without it the running
app cannot find skills/, design-systems/, craft/, frames/, or the
bundled bin/node.
3. runElectronBuilderLinux now pre-clears appBuilderOutputRoot and passes
--publish never to electron-builder, preventing stale-artifact bleed
between runs and accidental publish attempts in CI when env tokens
are present.
Also aligns appId with mac/win (io.open-design.desktop) and drops a
no-op productNameSafe template-literal.
* feat(tools-pack): implement containerized linux build via Docker
* feat(tools-pack): register linux CLI commands
* fix(tools-pack): align linux electron-builder config with mac.ts
Smoke testing the AppImage revealed the daemon sidecar was missing from
the bundled app.asar:
Cannot find module '@open-design/daemon/dist/sidecar/index.js'
Root cause: writeLinuxBuilderConfig was missing the 'files' field, so
electron-builder used defaults that excluded transitive workspace deps
from the asar. Plus several other mac.ts patterns that I dropped from
the plan: artifactName, executableName, extraMetadata.main/name/
productName/version, npmRebuild=false, nodeGypRebuild=false,
buildDependenciesFromSource=false, compression=maximum, top-level icon.
Switch asar:true → asar:false to match mac.ts (easier to debug missing
files; perf difference negligible for dev installs).
* feat(tools-pack): implement linux install
* feat(tools-pack): implement linux start with extract-and-run
The packaged sidecar's 35-second wait timeout is exceeded when the
AppImage runs from a FUSE-mounted SquashFS (Node module loads + daemon
init are slow through FUSE). Pass --appimage-extract-and-run as the
first arg so AppImage extracts to /tmp first; subsequent file reads
go through a real filesystem and daemon boot completes in time.
Wait for apps/packaged to write desktop-root.json (60s ceiling, generous
to cover AppImage extraction overhead), then fetch desktop status via
sidecar IPC, return the merged LinuxStartResult.
* fix(tools-pack): align linux start helper with mac.ts (log echo + write semantics)
Code review flagged two unjustified divergences from mac.ts in
startPackedLinuxApp:
1. Missing OD_DESKTOP_LOG_ECHO=0 in spawn extraEnv. Without it the
packaged logger echoes to the spawned process's stdout, which goes
nowhere (logFd: null). Added the suppression to match mac.ts.
2. The desktop log truncate writeFile() was wrapped in .catch(() =>
undefined), silently swallowing fs errors that would later surface as
confusing missing-log symptoms. Removed the .catch so errors
propagate per mac.ts.
Also added an inline comment explaining the 60s waitForMarker timeout
(vs mac's tighter ceiling) so the rationale is preserved at the
call site.
* feat(tools-pack): implement linux stop with marker validation
* fix(tools-pack): align linux stop with mac.ts (graceful shutdown + reason strings)
Code review flagged divergences from mac.ts in stopPackedLinuxApp:
1. No graceful IPC SHUTDOWN attempt before SIGTERM/SIGKILL. Mac's
pattern lets Electron renderers + sidecars flush state (SQLite WAL,
logs) first. `gracefulRequested: true` was hardcoded, lying to
callers about what actually happened. Now attempts SHUTDOWN with a
1500ms timeout and reports the actual outcome.
2. The dead-PID-but-marker-exists branch returned reason 'ok' (the
neutral placeholder from readDesktopRootIdentityMarker), which says
nothing useful. Override to 'marker-pid-not-running' to match mac.ts.
3. After a clean stop, remove the desktop-root.json marker so a
subsequent start has a fresh slate (mac.ts does this too).
* fix(tools-pack): clear stale desktop-root.json before linux start
Smoke-testing the install/start/stop loop revealed waitForMarker
returns instantly when a stale marker from a previous run still exists
on disk (e.g., the previous AppImage was killed without going through
'tools-pack linux stop'). The start function then reports success
without actually waiting for the new spawn to write its own marker.
Defensively remove the marker file before spawning. mac.ts removes it
in stop, so a clean stop->start sequence has nothing to remove here.
This only matters for crash-recovery.
* fix(tools-pack): linux stop validates extract-and-run AppImages
Smoke testing exposed a gap from Task 7: matchesAppImageProcess only
recognized FUSE-mode (/tmp/.mount_*/AppRun) but Task 13 launches with
--appimage-extract-and-run, which puts the live executable at
/tmp/appimage_extracted_<hex>/<binary>. Stop's cmdOk validation
returned false, marker validation failed, the running app was
classified as 'unmanaged' and stop refused to kill it.
Fix:
1. matchesAppImageProcess accepts both runner patterns. Extract-and-run
regex matches /^\/tmp\/appimage_extracted_[^/]+\/[^/]+$/.
2. stopPackedLinuxApp now passes paths.installAppImagePath (or the
built fallback) as the canonical install path, not marker.appPath
(which apps/packaged unhelpfully writes as '/' on Linux).
3. linux.test.ts gains 2 new tests covering the extract-and-run mode
(both positive and the wrong-APPIMAGE-env negative case).
* fix(tools-pack): resolve linux paths in stop (typecheck regression from previous commit)
* feat(tools-pack): implement linux logs
* feat(tools-pack): implement linux uninstall
* feat(tools-pack): implement linux cleanup
* docs(tools-pack): document linux lane in READMEs and AGENTS files
* ci(release): add linux x64 AppImage to release-beta and release-stable
Mirrors the existing build_mac/build_win pattern with a build_linux job
in both release workflows. Builds via `tools-pack linux build
--containerized --to appimage` so the AppImage is linked against the
electronuserland/builder glibc 2.27 baseline (portable across distros)
rather than the ubuntu-latest glibc 2.39.
The linux asset is uploaded to the immutable version release tag
alongside mac/win. The beta channel-feed release (latest-mac.yml,
latest.yml) is intentionally not extended with latest-linux.yml because
tools/pack/src/linux.ts has no electron-builder publish block wired,
so the auto-update feed would point users at a feed that never updates.
AppImage auto-update is a separate follow-on.
Linux is unsigned (no signing path in tools-pack yet), so the beta
asset uses the .unsigned suffix matching the windows convention; the
stable asset uses no suffix, matching the stable windows convention.
* fix(tools-pack): propagate --dir/--portable into containerized linux build
The inner `pnpm tools-pack linux build` invocation in `buildDockerArgs`
only forwarded `--to` and `--namespace`. Callers passing `--dir` (e.g.
the new release workflows using `--dir $RUNNER_TEMP/tools-pack`) had
their flag silently dropped: the container defaulted to writing under
/project/.tmp/tools-pack while the host's `findBuiltAppImage` looked at
the caller's chosen `--dir`, producing "expected AppImage not found"
on any non-default tool-pack root. Callers passing `--portable` had
the same drop, baking build-machine runtime roots into shipped artifacts.
Fix:
- Mount `${config.roots.toolPackRoot}:/tools-pack` (new third volume,
alongside the existing /project, /home/builder, and cache mounts).
- Forward `--dir /tools-pack` to the inner build so its output lands
inside the mounted host dir.
- Forward `--portable` when `config.portable` is true.
The mount overlaps harmlessly with /project when toolPackRoot lives
under workspaceRoot (default case): Docker exposes the same host inode
at both paths. The existing .docker-home and .docker-cache/* mounts
continue to shadow the parent at their specific /home/builder paths.
Document the shell-interpolation safety invariant on the inner command:
config.namespace is sanitized at config-time, config.to is enum-validated,
config.portable is boolean -- none can carry shell metacharacters.
Tests: add coverage for the new /tools-pack mount, --dir forwarding,
and --portable propagation (both true and false branches).
Resolves the P1 review feedback from the Codex bot on PR #369.
* docs(tools-pack): polish linux README based on PR review
Addresses non-blocking P2/P3 review feedback on PR #369:
- AppImage launch mode: name the test distros (Ubuntu 24.04, Arch Linux)
and frame the FUSE-vs-extract-and-run gap as an order-of-magnitude
improvement instead of an unspecified slowdown.
- Optional system tools: add a libfuse2 paragraph distinguishing FUSE
launch (needs libfuse2) from extract-and-run (does not), with the
Ubuntu-24-vs-pre-24 package name caveat.
- New section "Format choice: why AppImage first" anchoring the
AppImage-only decision against industry precedent (VS Code, Discord,
Slack, Cursor, Obsidian) so the rationale survives without a reviewer.
- Out of scope: convert the dense one-liner into a bulleted list, mark
AppImage signing as gated on GPG infra + verification flow design
(no ETA), explain the latest-linux.yml gap, and remove the now-stale
"release lane" entry since this PR adds it.
* fix(tools-pack): add --appimage-extract-and-run to installed .desktop launcher
The XDG .desktop file installed by `tools-pack linux install` invoked
the AppImage directly via `Exec=env OD_NAMESPACE=<ns> <exec> %U`. That
bypassed the extract-and-run flag that `tools-pack linux start` applies,
so menu launches and `od://` desktop activations could hit the FUSE
slow path that was already shown to make the daemon sidecar exceed
apps/packaged's 35-second startup timeout. CLI-spawned starts succeeded
while menu-launched starts could fail with the same artifact.
Add `--appimage-extract-and-run` to the template's `Exec=` line and
update the renderDesktopTemplate test expectation. New regression test
locks the flag into place so a future template edit can't silently
drop it.
Resolves a P1 review finding from mrcfps/Looper on PR #369.
* fix(tools-pack): treat signal-terminated container builds as failures
`runBuildInContainer` resolved the build promise on `code === null`,
which in Node's child-process `exit` event means the child was
terminated by a signal (SIGTERM, SIGKILL, OOM-killer, parent process
death). A killed Docker build could therefore make `packLinux` report
a containerized build as complete even though the artifact was
partial or missing.
Accept the `signal` argument on the exit handler. Resolve only when
`code === 0 && signal == null`. Otherwise reject with a message
naming either the non-zero code or the terminating signal so the
failure mode is visible in CI logs and `tools-pack linux build --json`
output.
Resolves a P1 review finding from mrcfps/Looper on PR #369.
* fix(tools-pack): tear down orphaned process tree on failed linux start
If `startPackedLinuxApp` spawned the AppImage but the post-spawn
readiness path then failed -- either because the 60s waitForMarker
ceiling elapsed without the daemon writing desktop-root.json, or
because fetchDesktopStatus threw -- the detached child was left
running. Because the marker is the only persistent identity source
used by `stopPackedLinuxApp`, future lifecycle commands could not
associate the orphan with the namespace, leaving stale Electron and
sidecar processes plus stale IPC sockets that would interfere with
subsequent starts.
Wrap the readiness wait + status fetch in try/catch. On failure,
collect the spawned child's process tree via listProcessSnapshots +
collectProcessTreePids and stopProcesses() it (the same path
stopPackedLinuxApp uses for its tree teardown), then rethrow the
original error. Cleanup errors are swallowed so the original failure
is preserved in the rejection.
Extract the tree-teardown helper as `teardownOrphanedStart` so the
intent is documented at the call site without inlining 4 imports of
implementation detail.
Resolves a P2 review finding from mrcfps/Looper on PR #369.
* fix(tools-pack): use `corepack pnpm` in containerized linux build
The inner command in `buildDockerArgs` started with `corepack enable`,
which writes pnpm/yarn/npm shims into the directory containing the
node binary. In `electronuserland/builder:base`, that directory is
owned by root, but the container runs as the host's non-root uid via
`--user` (so build artifacts come out owned by the caller, not root).
The `corepack enable` step therefore fails with EACCES before
`pnpm install` ever runs, blocking the new release `build_linux` job
from publishing the Linux AppImage.
Switch to `corepack pnpm install --frozen-lockfile && corepack pnpm
tools-pack linux build ...`, which resolves and runs the version of
pnpm pinned in package.json's `packageManager` field directly. No
shims, no global mutation, no root writes — corepack just dispatches
to the pinned binary as the unprivileged user.
Update the existing inner-command test to match the new corepack
invocation, and add a regression test that asserts the inner command
contains `corepack pnpm` and never `corepack enable` so a future edit
can't reintroduce the root-write requirement.
Resolves a P1 review finding from mrcfps/Looper on PR #369.
* fix(tools-pack): accept menu-launched processes in linux stop/uninstall
stopPackedLinuxApp validated the live process via matchesStampedProcess
against the process command line, requiring a SIDECAR_SOURCES.TOOLS_PACK
stamp. That worked for `tools-pack linux start` (which spawns with
createProcessStampArgs), but rejected menu launches: the installed
.desktop entry only sets OD_NAMESPACE and does not pass stamp args, so
apps/packaged falls back to a SIDECAR_SOURCES.PACKAGED stamp written
into desktop-root.json -- a perfectly valid identity, just not the one
the validator accepted.
Symptoms with the old behavior:
- `tools-pack linux stop` reported `unmanaged` for menu-launched apps
and refused to stop them.
- `tools-pack linux uninstall` would happily remove the AppImage,
.desktop entry, and icon while the packaged app was still running,
breaking handles to the AppImage's mounted/extracted contents.
Switch the validator to read marker.stamp directly (the file content
written by apps/packaged itself, not the process command) and accept
either TOOLS_PACK or PACKAGED. The expected app/mode/namespace/ipc
fields are still required to match. Mirrors the dual-source acceptance
pattern in mac.ts:709-714.
The matchesAppImageProcess (cmdOk) and namespaceRoot checks are
preserved -- the marker still has to point at our AppImage at a path
in our namespace's runtime root.
Drop the now-unused matchesStampedProcess import.
Resolves a P1 review finding from mrcfps/Looper on PR #369.
* fix(tools-pack): per-platform --to help text in CLI
addBuildOptions is shared across mac/win/linux but its --to help text
hard-coded the mac targets (all|app|dmg|zip), so:
- tools-pack linux --help advertised --to all|app|dmg|zip even
though resolveToolPackBuildOutput accepts only all|appimage|dir,
sending users at invalid targets and hiding the AppImage option.
- tools-pack win --help had the same problem (advertised mac
targets while accepting all|dir|nsis with default nsis).
Parameterize addBuildOptions(command, platform) and back it with a
TO_HELP_BY_PLATFORM table that mirrors the resolver's accepted targets
in config.ts. Update the three call sites.
Smoke verified by running --help for each platform:
linux: all|appimage|dir (default: all)
mac: all|app|dmg|zip (default: all)
win: all|dir|nsis (default: nsis)
The misleading "--signed: build a signed/notarized mac artifact" line
on win/linux is left alone -- out of scope for this fix and not part
of the review feedback.
Resolves a P3 review finding from mrcfps/Looper on PR #369.
* fix(tools-pack): use OD_PACKAGED_NAMESPACE in installed .desktop launcher
The installed .desktop entry's Exec= line set OD_NAMESPACE=<ns>, but
apps/packaged/src/config.ts:9 reads namespace overrides from
OD_PACKAGED_NAMESPACE, not OD_NAMESPACE. The env assignment was a
silent no-op for menu launches: the packaged app fell back to whatever
namespace was baked into open-design-config.json at install time,
ignoring the namespace advertised in the .desktop file.
Practical effect: a .desktop launcher created for namespace "foo"
could end up running as the namespace baked into the AppImage's
shipped config (typically "default"), so installs created across
multiple namespaces could collide silently from menu launches. CLI
launches via `tools-pack linux start` were unaffected because they
pass the namespace through createSidecarLaunchEnv which targets the
correct env var.
Switch the template to OD_PACKAGED_NAMESPACE. Update the existing
renderDesktopTemplate test fixture/expectation, and add a regression
test that asserts the Exec= line uses OD_PACKAGED_NAMESPACE and never
the wrong OD_NAMESPACE name.
Resolves a P1 review finding from mrcfps/Looper on PR #369.
* fix(tools-pack): gate linux uninstall + cleanup on stop status
uninstallPackedLinuxApp called stopPackedLinuxApp first, then deleted
the AppImage / .desktop entry / icon unconditionally. cleanupPackedLinux
Namespace did the same with the output and runtime namespace roots.
Both ignored stop.status -- so when stop returned "partial" (some
processes survived SIGTERM->SIGKILL) or "unmanaged" (the running PID
failed marker validation), uninstall would yank the install files out
from under a still-running packaged app, breaking handles to the
mounted/extracted AppImage contents and leaving an orphan with stale
SQLite WAL files / log handles / IPC sockets.
Extract a small `isSafeToRemoveInstallFiles(stop)` helper that returns
true only for "stopped" or "not-running". Both uninstall and cleanup
short-circuit when it returns false:
- uninstall reports "skipped-process-running" for each removal slot
and "skipped" for the post-install hooks. Existing "ok" / "already-
removed" / "ok"|"missing"|"failed" paths are unchanged.
- cleanup leaves both removed* booleans false and adds a new
`skipped: boolean` field set to true. Old consumers that only read
the booleans see the same "nothing was removed" signal they would
have seen for an already-clean namespace; new consumers can
distinguish "nothing to remove" from "refused to remove."
LinuxUninstallResult.removed.{appImage,desktop,icon} now also accepts
"skipped-process-running"; LinuxUninstallResult.postUninstall.* now
also accepts "skipped". LinuxCleanupResult gains the `skipped` field.
Workspace typecheck clean -- the only consumer is the CLI's printJson,
which doesn't constrain the wire shape.
Resolves a P1 review finding from mrcfps/Looper on PR #369.
The "Coming soon" pseudo-tip on .viewer-action / .viewer-toggle had
two bugs in the file viewer toolbar:
1. Hidden behind .ws-tabs-bar. The parent shell sets opacity: 0.55,
which creates a stacking context, so the ::after's z-index was
trapped locally and could not rise above the sticky tabs bar
(z-index: 4) in the root context. Pin the parent to z-index: 5.
2. Invisible in dark theme. background: var(--text-strong) becomes
off-white in dark mode against color: white. Switch to the same
fixed dark slate already used by .comment-target-tooltip
(rgba(17, 24, 39, 0.95)) so contrast holds in both themes.
* fix(security): bind daemon to localhost by default, add origin validation middleware
The daemon's Express server previously defaulted to binding 0.0.0.0,
exposing all 30+ API endpoints to the local network with zero
authentication. This included endpoints that spawn CLI agents, write
project files, and manage API keys.
Changes:
- Default bind address changed from 0.0.0.0 to 127.0.0.1 in both
server.ts and cli.ts. Users who need network access can still set
OD_BIND_HOST=0.0.0.0 explicitly.
- Added origin validation middleware on /api/* routes: requests with
an Origin header are only allowed from localhost/127.0.0.1/[::1]
on the daemon's own port. Non-browser clients (no Origin header)
are unaffected.
- 7 unit tests for the origin validation logic.
- Existing tests: 327/327 passing.
* fix: address PR review — fail-closed, OD_WEB_PORT, HTTPS, Origin: null
Address feedback from @lefarcen, @mrcfps, and Codex review:
P1: Fail-closed when resolvedPort is not yet set (returns 403
instead of passing through).
P2: Include OD_WEB_PORT in allowed origins for split-port proxy
setups (web port ≠ daemon port). Add HTTPS variants.
P3: Exempt Origin: null for sandboxed iframe preview fetches
(/api/projects/:id/raw/*) so artifact previews keep working.
P4: Update help text from 0.0.0.0 to 127.0.0.1.
Test coverage expanded to 13 tests including:
- OD_WEB_PORT split-port proxy scenario
- Origin: null iframe preview
- HTTPS origin variants
- Fail-closed before port resolution
- Cross-origin rejection with OD_WEB_PORT set
All 333 tests passing, TypeScript clean.
* fix: scope Origin: null bypass to raw-file previews only, support non-loopback bind host
Two issues found in second review round:
1. Origin: null was a global bypass for ALL /api routes, allowing
sandboxed iframes to reach state-changing endpoints (project
create/delete, agent runs). Now only GET requests to
/projects/:id/raw/* pass through with Origin: null — the original
intent for iframe file previews. POST/DELETE with Origin: null
are rejected.
2. Allowed origins only included loopback addresses. When daemon
binds to a non-loopback address (--host for Tailscale, LAN, or
0.0.0.0), browser requests from that address would get 403.
Now the bound host is included in allowed origins alongside
loopback, keeping the documented network-access escape hatch
working for browser clients.
Added negative tests for Origin: null on POST/DELETE/non-raw GET,
and positive tests for non-loopback bind host scenarios.
All 339 tests passing.
* fix: centralize origin policy, add spritesheet to Origin: null allowlist
Addresses @mrcfps's third review round:
1. isLocalSameOrigin() now uses the same policy as the global origin
middleware: HTTPS + HTTP, OD_WEB_PORT, and the explicit bind host
(OD_BIND_HOST). Previously it only accepted HTTP on loopback hosts,
so requests from https://127.0.0.1 or a Tailscale address could pass
the global guard but 403 on per-route checks.
2. /api/codex-pets/:id/spritesheet is a read-only route that sets
Access-Control-Allow-Origin: null for canvas drawing by sandboxed
iframes. Added to the Origin: null allowlist so the middleware
doesn't block it before the route handler runs.
3. buildAllowedOrigins() extracted as a closure so both the middleware
and isLocalSameOrigin() share identical logic.
340/340 tests passing.
* test: remove dead fail-closed test with unused 5th argument
The 'fails closed when port is 0' test called request() with an
extra argument the helper ignores, then never asserted on res.
Real coverage lives in the dedicated 'fail-closed before port
resolution' describe block.
* feat(skills): add taste-skill-derived web prototype and HTML PPT examples
Adds five skills distilling Leonxlnx/taste-skill into the project's
SKILL.md + example.html convention so authors can pick a deliverable
shape (web prototype / deck) and a design register (editorial / soft /
brutalist) without the LLM defaulting to Inter-on-white slop.
- web-prototype-taste-editorial: minimalist-skill applied (warm
monochrome, Instrument Serif x Inter Tight, hairline bento)
- web-prototype-taste-soft: soft-skill applied (silver canvas, ambient
mesh, double-bezel cards, button-in-button CTAs, spring motion)
- web-prototype-taste-brutalist: brutalist-skill Swiss-print mode
(newsprint, Archivo Black, viewport-bleeding numerals, hazard-red,
ASCII syntax)
- html-ppt-taste-editorial: 10-slide investor memo deck in the editorial
register, compatible with the existing html-ppt static-preview pattern
- html-ppt-taste-brutalist: 11-slide tactical-telemetry / CRT-terminal
incident debrief deck (scanline overlay, hazard-red alerts, audit log)
Each SKILL.md cites the upstream taste-skill source file and lists hard
rules, banned patterns, required components, and a pre-flight checklist.
* fix(i18n): register new taste skills in German content registry
Adds the five new taste-derived skills to DE_SKILL_IDS_WITH_EN_FALLBACK
so the German display content coverage test sees them.
Generated-By: looper 0.4.0 (runner=fixer, agent=claude-code)
* fix(skills): close stray </small> in html-ppt-taste-brutalist telemetry cell
The paged-engineers tcell's delta span on slide 04 closed with
`</small></span>`, leaving the example with invalid HTML that downstream
previews/validators can flag.
Generated-By: looper 0.4.0 (runner=fixer, agent=claude-code)
* fix(packaged): include nvm/fnm/mise agent CLI bins in packaged PATH
`resolvePackagedPathEnv` constructs the daemon PATH for packaged builds
(DMG/AppImage/NSIS), but it only includes hardcoded locations (.local/bin,
homebrew, etc.) and misses npm-global agent CLIs installed under a version
manager.
Add `collectNvmFnmBins()` to @open-design/platform that dynamically
discovers nvm (`~/.nvm/versions/node/*/bin`), fnm, and mise npm-global
bin directories. Wire it into `resolvePackagedPathEnv` alongside the
existing static candidates.
This complements the dev-mode fix in #346 (agents.ts: userToolchainDirs)
by covering the packaged launcher path as well.
* fix(packaged): move nvm/fnm bin discovery into packaged-runtime sidecars
Keep @open-design/platform focused on generic OS/process primitives by
moving the version-manager PATH discovery helpers (existingDirsUnder,
collectNvmFnmBins) into apps/packaged/src/sidecars.ts where they are
actually consumed by resolvePackagedPathEnv.
Closes#279.
Adds an `Export as Markdown` entry to the HTML / deck artifact share menu
in `FileViewer`. The entry downloads the artifact source verbatim with a
`.md` extension and `text/markdown; charset=utf-8` Content-Type — no
HTML→markdown conversion runs. The file body is byte-for-byte identical
to what the Source view shows.
The use case (per the issue thread): users want to pipe the artifact's
raw source into markdown-aware tooling — LLM context windows, vault
apps, etc. — that key off the `.md` extension. A lossy text-extraction
conversion (turndown / similar) was the first thing I tried, but it
loses the embedded styles + scripts that make the deck reproducible
and was rejected by the issue author in favor of pass-through. Keeping
the implementation byte-exact also leaves room for a future
"Convert to Markdown" entry to live alongside this one without
overlap.
Changes:
- `apps/web/src/runtime/exports.ts` — new `exportAsMd(source, title)`
helper; module-level comment updated to include MD in the export
family description.
- `apps/web/src/components/FileViewer.tsx` — new share menu entry,
positioned right after `Export as standalone HTML` and before the
`Save as template` divider so the file-format exports stay grouped
together.
- `apps/web/src/i18n/types.ts` + 14 locale files (`en`, `de`, `ja`,
`ko`, `zh-CN`, `zh-TW`, `es-ES`, `fa`, `pt-BR`, `ru`, `ar`, `pl`,
`tr`, `hu`) — `fileViewer.exportMd` key, mirroring the structure of
the existing `exportHtml` / `exportZip` entries.
- `apps/web/src/runtime/exports.test.ts` — three new cases under
`exportAsMd`: bytes-verbatim with the markdown content type, title
fallback when sanitization yields nothing, and UTF-8 round-trip.
The tests stub `URL.createObjectURL` + a minimal `document` so the
download path works under `environment: 'node'`.
No new dependencies. No daemon-side changes — all client-side.
Test plan:
- [x] `pnpm --filter @open-design/web test` — 23 files / 143 tests green
- [x] `pnpm --filter @open-design/web typecheck` — clean
- [x] `pnpm typecheck` (full repo) — clean
- [x] Manual browser test via `pnpm tools-dev run web`: clicked the
new menu entry on a 10-slide deck artifact; download blob was
`text/markdown; charset=utf-8`, 36,990 bytes, started with
`<!doctype html>...` matching the Source view byte-for-byte.
pftom