pi-webapp 0.1.23 → 0.1.25

package/docs/desktop-testing.md

@@ -0,0 +1,76 @@
+# macOS 小范围测试安装 / Small-group test installation
+
+适用于 **desktop build 7 起、采用新签名流程构建**的 macOS Apple Silicon / Intel 测试包。
+旧包不会因源码更新而自动修复；请安装新构建，不要覆盖发布过的同名安装包。
+
+## 这些测试包能保证什么？
+
+- 默认以 `codesign` 的 ad-hoc 临时签名封装完整应用、Electron helpers 和内置运行时，
+  无需 Developer ID 证书。打包和发布准备都要求通过 deep/strict 签名完整性检查。
+- **不是 Developer ID 发布者签名，没有 Apple 公证**。这不是面向公众“下载即打开”的发行版。
+  Gatekeeper 仍可能拦截；`spctl --assess` 拒绝此包是预期限制，不等于打包签名校验失败。
+- SHA-256 只核对发行文件；临时签名只检查包是否符合当前签名，不验证开发者身份，
+  二者都不能证明软件安全。只邀请明确知情、愿意信任项目的测试用户。
+- 当前主分支没有桌面自动更新器。测试包从 Release 下载、校验后手动安装。
+
+## 测试用户安装步骤
+
+1. 从项目官方 [GitHub Releases](https://github.com/chengzhiyi/pi-webapp/releases)
+   下载明确邀请测试的构建 DMG 和同一 Release 的 `SHA256SUMS`。
+   不要使用转发的未知安装包、源码 ZIP 或不匹配版本的校验文件。
+2. 在终端运行 `shasum -a 256 <下载的DMG路径>`，与 `SHA256SUMS` 中该 DMG 的一行比较。
+   不一致就停止，不要关闭系统保护。`SHA256SUMS` 含四平台安装包；只下载一个 DMG 时，
+   逐行比较该文件即可，不要因未下载其他平台文件而误判其校验结果。
+3. 退出旧桌面再替换应用。先完成所有聊天/终端任务；若旧桌面使用内置后台，
+   从其原入口停止该后台再替换。不要停止仍需使用的外部 Web 后台，也不要删除 `~/.pi`。
+   打开 DMG，把 **pi.app** 拖入“应用程序”。旧 **Pi Webapp.app** 不会自动被覆盖，
+   请更新 Dock 快捷方式以免打开旧版。
+4. 检查安装后的应用完整性：
+
+   ```bash
+   codesign --verify --deep --strict --verbose=2 "/Applications/pi.app"
+   ```
+
+   **失败就停止**，保存报错、构建号及 DMG 校验结果反馈给维护者。
+   不要自行重签，因为那会为可能被修改的内容建立新签名、掩盖原始问题。
+5. 尝试打开应用。如果被拦截，可在 macOS 提供该选项时使用
+   **系统设置 → 隐私与安全性 → 仍要打开**。
+   如果仍因下载隔离无法启动，且你已核对来源、校验和、签名，并明确愿意信任该测试包，
+   可以手动运行以下命令，**只针对此应用**移除下载隔离后重试：
+
+   ```bash
+   codesign --verify --deep --strict --verbose=2 "/Applications/pi.app" &&
+   xattr -dr com.apple.quarantine "/Applications/pi.app"
+   ```
+
+   这会跳过该应用的下载隔离检查，**不代表 Apple 已认证其安全**。
+   不要对来源不明的软件使用，不要全局关闭 Gatekeeper/SIP；遇到权限错误先反馈，
+   不要盲目追加 `sudo`。项目不会自动执行此操作。
+6. 在 **pi → 关于 pi** 确认版本、桌面构建号及应用位置，再配置模型并测试聊天和终端。
+   若启动失败，反馈系统版本、芯片、构建号及错误；不要上传 API 密钥、`auth.json` 或私钥。
+
+再次安装/更新未公证测试包时，可能需要重复信任步骤。不接受这些限制的用户可继续使用
+Web 版，或从可信源码构建运行，不必购买开发者会员。
+
+## Release operator / 维护者验收
+
+- 默认 `mac.identity` 为 `-`；证书自动发现保持关闭。
+  正式签名须由有权限的操作员显式配置 `CSC_NAME`，不得把 ad-hoc 宣称为发布者签名。
+- electron-builder 在生成 DMG **之前**，自内向外签署嵌套代码并做 strict 验证。
+  默认 hardened runtime 及 Electron 所需 JIT/library-validation entitlements 由固定版本
+  electron-builder 提供；不得在签名后改写应用资源。
+- `npm run desktop:package` 与发布准备均拒绝未封装资源或签名校验失败的应用。
+  `desktop-release.json` 的 `signing` 记录 `type` 和 `verified`；兼容字段 `unsigned: true`
+  表示**没有发布者身份**，即使 ad-hoc 完整性校验通过也保持为 true。
+- 打包命令还会只读挂载 DMG，自动校验其中实际应用的 deep/strict 签名。
+  当前主分支保持 DMG 分发，不为此引入 ZIP 更新包或自动更新器。
+  执行 packaged smoke（含 PTY/浏览器共享后台）。
+  这些检查不能替代“浏览器下载 → Finder 安装 → 用户明确同意”的隔离场景人工验收。
+- 每次交付递增 `desktop/release.json` 的构建号、重新生成校验和。
+  不覆盖已有公开 Release，不以移除隔离或本机可启动宣称通过 Gatekeeper。
+
+English summary: These are complete **ad-hoc signed**, **unnotarized** opt-in test builds,
+not publisher-authenticated releases. Verify the official DMG checksum and the installed app's
+`codesign --verify --deep --strict` result before trusting it. Stop on verification failure;
+do not re-sign a downloaded app to hide a failure. Any quarantine exception must be a conscious,
+manual, app-scoped tester choice. Never disable system security globally.

package/docs/desktop.md

@@ -88,13 +88,24 @@ These are two separate release responsibilities:
 - **Safe updates** verify an update's publisher/integrity and replace a compatible
   application/runtime without destroying user data.
 
-The installers remain **unsigned/unnotarized test builds**, with no certificate
-discovery or automatic desktop updater. A GitHub prerelease is a download channel,
-not a claim of formal signed-distribution readiness.
-macOS Gatekeeper / Windows SmartScreen may warn or block an unsigned download.
-Do not disable OS security globally to use it. Public distribution needs a
-separately configured, authorized signing/notarization workflow; local successful
-packaging is not proof of public-distribution readiness.
+Starting with desktop build 7, default macOS packages use **complete ad-hoc
+signatures, without publisher identity or notarization**, for opt-in small-group
+testing. No certificate is needed: `mac.identity` defaults to `-`; an authorized
+operator may explicitly select `CSC_NAME` for Developer ID signing. Certificate
+discovery stays disabled. Windows/Linux's unsigned release paths are unchanged.
+
+Electron-builder signs nested code before creating the DMG. Packaging verifies
+the app and the read-only mounted DMG; release preparation requires deep/strict
+verification and a complete resource seal on both macOS architectures. macOS
+receipts record `signing: { type: "ad-hoc" | "developer-id", verified: true }`;
+`unsigned: true` means **no publisher identity**, including valid ad-hoc signatures.
+
+**Ad-hoc is not Developer ID.** Gatekeeper can still block the download. Follow
+the [tester installation and trust instructions](desktop-testing.md): verify the
+checksum and signature, stop on verification failure, and only use a conscious,
+manual, app-scoped trust exception for a known test build. Never disable OS
+security globally. Public distribution needs authorized signing/notarization;
+local packaging success is not proof of downloaded first-launch acceptance.
 
 For now, install a newer desktop package to upgrade; if replacing a running
 desktop-owned runtime, first finish tasks and stop that owned service. A desktop
@@ -158,8 +169,9 @@ The candidate build-6 pipeline adds four **native** targets:
 
 Each uses locked dependencies, standalone Node/Pi, full unit tests and actual
 installer-payload desktop/browser/PTY smoke. The smoke reads the installed Pi
-package and requires the same pinned version. Signing discovery and Sentry are
-disabled. ARM Windows/Linux and other targets are not implicitly supported.
+package and requires the same pinned version. Certificate discovery and Sentry
+are disabled; macOS ad-hoc signing and strict integrity checks are required from
+build 7. ARM Windows/Linux and other targets are not implicitly supported.
 
 A read-only aggregation job requires **all four** verified receipts from the
 same source/version/build/Pi pair. It collects four installers, SHA256SUMS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-webapp",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "type": "module",
   "description": "A browser interface for Pi with live chat, workspaces, models, and attachments",
   "repository": {
@@ -15,7 +15,7 @@
     "pi-webapp": "./bin/pi-webapp.mjs"
   },
   "pi": {
-    "image": "https://cdn.jsdelivr.net/npm/pi-webapp@0.1.23/assets/cover-webapp.png",
+    "image": "https://cdn.jsdelivr.net/npm/pi-webapp@0.1.25/assets/cover-webapp.png",
     "extensions": [
       "./dist/extension.js"
     ]
@@ -32,6 +32,7 @@
     "docs/sentry.md",
     "docs/sentry-triage.md",
     "docs/desktop.md",
+    "docs/desktop-testing.md",
     "scripts/prepare-terminal.mjs"
   ],
   "scripts": {

package/web/dist/.vite/manifest.json

@@ -122,13 +122,13 @@
     "isDynamicEntry": true
   },
   "../../node_modules/@shikijs/langs/dist/graphql.mjs": {
-    "file": "assets/graphql-R1M_bSpj.js",
+    "file": "assets/graphql-DCmL4QvK.js",
     "name": "graphql",
     "src": "../../node_modules/@shikijs/langs/dist/graphql.mjs",
     "isDynamicEntry": true,
     "imports": [
       "_javascript-D_ijBMSX.js",
-      "_app-C-H5rHq5.js",
+      "_app-DQXe2TPf.js",
       "index.html"
     ]
   },
@@ -161,12 +161,12 @@
     ]
   },
   "../../node_modules/@shikijs/langs/dist/http.mjs": {
-    "file": "assets/http-L5EnyzVP.js",
+    "file": "assets/http-D1RjONju.js",
     "name": "http",
     "src": "../../node_modules/@shikijs/langs/dist/http.mjs",
     "isDynamicEntry": true,
     "imports": [
-      "_app-C-H5rHq5.js",
+      "_app-DQXe2TPf.js",
       "../../node_modules/@shikijs/langs/dist/xml.mjs",
       "../../node_modules/@shikijs/langs/dist/graphql.mjs",
       "index.html",
@@ -275,7 +275,7 @@
     ]
   },
   "../../node_modules/@shikijs/langs/dist/php.mjs": {
-    "file": "assets/php-xdHBwAuB.js",
+    "file": "assets/php-D_vc4Tu2.js",
     "name": "php",
     "src": "../../node_modules/@shikijs/langs/dist/php.mjs",
     "isDynamicEntry": true,
@@ -284,7 +284,7 @@
       "../../node_modules/@shikijs/langs/dist/xml.mjs",
       "../../node_modules/@shikijs/langs/dist/sql.mjs",
       "_javascript-D_ijBMSX.js",
-      "_app-C-H5rHq5.js",
+      "_app-DQXe2TPf.js",
       "../../node_modules/@shikijs/langs/dist/css.mjs",
       "../../node_modules/@shikijs/langs/dist/java.mjs",
       "index.html"
@@ -315,7 +315,7 @@
     "isDynamicEntry": true
   },
   "../../node_modules/@shikijs/langs/dist/rst.mjs": {
-    "file": "assets/rst-D5vBXrc7.js",
+    "file": "assets/rst-CXMoyibL.js",
     "name": "rst",
     "src": "../../node_modules/@shikijs/langs/dist/rst.mjs",
     "isDynamicEntry": true,
@@ -324,7 +324,7 @@
       "../../node_modules/@shikijs/langs/dist/cpp.mjs",
       "../../node_modules/@shikijs/langs/dist/python.mjs",
       "_javascript-D_ijBMSX.js",
-      "_app-C-H5rHq5.js",
+      "_app-DQXe2TPf.js",
       "../../node_modules/@shikijs/langs/dist/yaml.mjs",
       "../../node_modules/@shikijs/langs/dist/cmake.mjs",
       "../../node_modules/@shikijs/langs/dist/ruby.mjs",
@@ -340,7 +340,7 @@
     ]
   },
   "../../node_modules/@shikijs/langs/dist/ruby.mjs": {
-    "file": "assets/ruby-CB8CtpFl.js",
+    "file": "assets/ruby-B2ZFKb7W.js",
     "name": "ruby",
     "src": "../../node_modules/@shikijs/langs/dist/ruby.mjs",
     "isDynamicEntry": true,
@@ -353,7 +353,7 @@
       "../../node_modules/@shikijs/langs/dist/graphql.mjs",
       "../../node_modules/@shikijs/langs/dist/cpp.mjs",
       "../../node_modules/@shikijs/langs/dist/c.mjs",
-      "_app-C-H5rHq5.js",
+      "_app-DQXe2TPf.js",
       "../../node_modules/@shikijs/langs/dist/lua.mjs",
       "../../node_modules/@shikijs/langs/dist/yaml.mjs",
       "../../node_modules/@shikijs/langs/dist/java.mjs",
@@ -388,13 +388,13 @@
     "isDynamicEntry": true
   },
   "../../node_modules/@shikijs/langs/dist/svelte.mjs": {
-    "file": "assets/svelte-qWxX2efJ.js",
+    "file": "assets/svelte-Or6lhjBs.js",
     "name": "svelte",
     "src": "../../node_modules/@shikijs/langs/dist/svelte.mjs",
     "isDynamicEntry": true,
     "imports": [
       "_javascript-D_ijBMSX.js",
-      "_app-C-H5rHq5.js",
+      "_app-DQXe2TPf.js",
       "../../node_modules/@shikijs/langs/dist/css.mjs",
       "index.html"
     ]
@@ -430,14 +430,14 @@
     "isDynamicEntry": true
   },
   "../../node_modules/@shikijs/langs/dist/vue.mjs": {
-    "file": "assets/vue-CTcHoOmv.js",
+    "file": "assets/vue-Di6p925N.js",
     "name": "vue",
     "src": "../../node_modules/@shikijs/langs/dist/vue.mjs",
     "isDynamicEntry": true,
     "imports": [
       "../../node_modules/@shikijs/langs/dist/css.mjs",
       "_javascript-D_ijBMSX.js",
-      "_app-C-H5rHq5.js",
+      "_app-DQXe2TPf.js",
       "../../node_modules/@shikijs/langs/dist/html.mjs",
       "_html-derivative-C2Epw9Yg.js",
       "index.html"
@@ -704,37 +704,37 @@
     ]
   },
   "../../src/plugins/builtin/files/client/plugin.tsx": {
-    "file": "assets/plugin-DtJl1c8o.js",
+    "file": "assets/plugin-DNLljKtT.js",
     "name": "plugin",
     "src": "../../src/plugins/builtin/files/client/plugin.tsx",
     "isDynamicEntry": true,
     "imports": [
-      "_app-C-H5rHq5.js",
+      "_app-DQXe2TPf.js",
       "index.html"
     ]
   },
   "../../src/plugins/builtin/git/client/plugin.tsx": {
-    "file": "assets/plugin-DCamQdiP.js",
+    "file": "assets/plugin-Dt1cBQ6m.js",
     "name": "plugin",
     "src": "../../src/plugins/builtin/git/client/plugin.tsx",
     "isDynamicEntry": true,
     "imports": [
-      "_app-C-H5rHq5.js",
+      "_app-DQXe2TPf.js",
       "index.html"
     ]
   },
   "../../src/plugins/builtin/terminal/client/plugin.tsx": {
-    "file": "assets/plugin-CYps5zpH.js",
+    "file": "assets/plugin-Bjpcuu8G.js",
     "name": "plugin",
     "src": "../../src/plugins/builtin/terminal/client/plugin.tsx",
     "isDynamicEntry": true,
     "imports": [
-      "_app-C-H5rHq5.js",
+      "_app-DQXe2TPf.js",
       "index.html"
     ]
   },
-  "_app-C-H5rHq5.js": {
-    "file": "assets/app-C-H5rHq5.js",
+  "_app-DQXe2TPf.js": {
+    "file": "assets/app-DQXe2TPf.js",
     "name": "app",
     "isDynamicEntry": true,
     "imports": [
@@ -882,7 +882,7 @@
     "isEntry": true,
     "dynamicImports": [
       "../../src/host/client/telemetry-client.ts",
-      "_app-C-H5rHq5.js"
+      "_app-DQXe2TPf.js"
     ]
   },
   "style.css": {