ShadowCode 2.1: ARM64, APT repo, installer rollback, Flatpak allow-list, window size, model history

[ShadowfetchStudio]

The next version's upgrades, plus a macOS port estimate. Each feature has a CHANGELOG.md entry under 2.1.0 (unreleased).

CI: every check passes on both x86_64 and aarch64, including the full verify jobs: build, Rust suite, native window and endurance, managed llama.cpp runtime, both packages, offline clean-host install, installer and packaged-app checks.

Features

• ARM64 (aarch64) builds, signed and published.
  • Builds: AppImage, .deb (arm64), Flatpak, the AppImage runtime and llama.cpp are built natively on aarch64. x86_64 names and contents are unchanged. Native CI runs on ubuntu-24.04 and ubuntu-24.04-arm.
  • Release workflow: build-aarch64 hands off unsigned like build. sign signs each target separately, and publish stages both into one release (14 assets).
  • Signature file names: aarch64 uses RELEASE-AUTH-aarch64, RELEASE-AUTH-aarch64.sig, RELEASE-MANIFEST-aarch64.json and SHA256SUMS-aarch64. x86_64 keeps the historical names, so existing installers are unaffected.
  • Verification: the requested package selects which names the Node and shell verifiers read, and the envelope found there must name that target. Verified stages and installer receipts keep the historical names.
  • Release gates: gate scripts are built per architecture (gatesFor), so the x86_64 signer checks aarch64 receipts against the aarch64 scripts. The x86_64 scripts and their digests are byte-identical.
  • Trust: release/trust/policy trusts both targets, and the installer only accepts the AppImage for the machine's architecture.
  • App: on ARM64, the in-app update notice names the aarch64 files.
• Packaging checks on pull requests (ci.yml). A Flatpak build (GNOME 50 SDK, CPU-only llama.cpp) and the packaging test suites run on both architectures for PRs that touch packaging, scripts, the app or workflows.
• Signed APT repository. scripts/build-apt-repo.mjs and an apt-repository release job:
  • check the amd64 and arm64 .deb against their publisher signatures;
  • index them and sign InRelease/Release.gpg with a dedicated key;
  • publish to gh-pages.
• Installer first-window check and database rollback.
  • Before updating, the installer copies the database with VACUUM INTO.
  • It then starts the new version and waits for it to report its first window.
  • If it hangs, crashes or reports the wrong version, the AppImage, runtime, launchers and database are all restored.
  • The highest-accepted-release record is not lowered.
• Hostname allow-list mode in the Flatpak.
  • Host bubblewrap gets --unshare-net.
  • A small static relay forwards loopback traffic to the app's filtering proxy over a Unix socket.
  • If that can't be set up, the command is refused rather than run unrestricted.
• Window size memory on Wayland.
  • The content size is saved in logical pixels and versioned; decorations are measured and subtracted.
  • The saved size is fitted to the screen as before.
• Model history in the picker (schema 27→28).
  • Each finished task records time, tokens, the vendor-reported cost (never estimated) and observed verification, per model and project.
  • An opt-in suggestion offers the cheapest model that passed in this project; it never switches models by itself.
• macOS port estimate (docs/MACOS_PORT_ESTIMATE.md): 17–36 engineer-weeks, with a phased plan.

CI fixes included

• main has been failing verify because Alpine replaced pinned packages. This PR pins python3 to 3.12.15-r0 and zlib to 1.3.2-r1.
• aarch64:
  • The GLib variant test links through LTO, since GNU ld can't link bitcode-only rlibs.
  • llama.cpp is built with GCC 14 when the default compiler can't target the Armv9.2 SME CPU variant (Ubuntu 24.04 ships GCC 13).
  • xdg-utils is installed for the AppImage bundler.
  • The clean-host Dockerfile no longer defaults TARGETARCH, which had selected the amd64 image.
• The installer tests pin the host to x86_64 via a uname shim.
• A worktree cleanup test that depended on directory order now sets up its intended starting state explicitly, with all assertions kept.
• The Flatpak smoke run uses dbus-run-session.
• routing.suggest_from_history now has its default (false) and is documented in config.example.yaml.

Verified locally (in addition to CI)

• Node release suites, run on x86_64 and again with Node simulating an arm64 host. New tests cover signing and publishing both targets into one release, and envelopes filed under the wrong target's names.
• Installer auth and shell suites, run as a non-root user on x86_64 and on a fully simulated aarch64 host, including an aarch64 handoff signed on x86_64 and then installed.
• The full Rust core suite, src-tauri tests, cargo +1.95.0 clippy -D warnings and fmt --check.
• UI: typecheck and 724 vitest tests.
• actionlint on all workflows.

Before tagging 2.1.0

• APT key: NATIVE_APT_SIGNING_KEY (secret) and NATIVE_APT_SIGNING_FINGERPRINT (variable, 1BC07B5ECFDB514673A296FB021CAB3F2F7A1F61) are set in the release-signing environment, and release/trust/APT-SIGNING-KEY records the public key (227ff15). A local dry run built and gpgv-verified a repository from the signed 1.0.1 .deb with it.
• Pages: enable it from gh-pages after the first release run creates that branch.
• Key version cap: key 1 in release/trust/policy now covers 0.33.0–2.1.0 (6d88efb).
• Tooling pin: set NATIVE_RELEASE_TOOLING_COMMIT to the tagged 2.1.0 release commit (it must contain this multi-target signer). An older pin refuses the aarch64 signing call, so the release fails rather than shipping x86_64 alone.
• Signing tag rule: the release-signing environment must allow v2.1.0.
• Not run end to end yet: the release workflow only runs on a tag.

Also fixed: scripts/test-install-auth.mjs clears DISPLAY/WAYLAND_DISPLAY, so the installer's first-window check no longer fails 25 tests on a desktop machine (82dd25a).

🤖 Generated with Claude Code

https://claude.ai/code/session_01Fn7NbipAkYG7cYZxHk8xRu

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[ShadowfetchStudio]

The verify check in Native desktop failed. This PR didn't cause it: the head commit only adds a docs file, and the same workflow has failed on main for its last four runs, starting at 71e358b.

The failing test is actual isolated D-Bus activation and external wrapper exit without a display (scripts/test-native-test-session.mjs:324). The D-Bus test service (org.shadowcode.NativeFixture) received SIGTERM during activation. The same test passes locally. No fix exists yet; I'll look into it and add a fix to this PR if I find one.

---

Generated by Claude Code

[ShadowfetchStudio]

My earlier comment needs a correction. main is red in verify for a different reason: Alpine 3.21 replaced the pinned python3 3.12.14-r0 and zlib 1.3.2-r0 packages, so building the native runtime fails during apk add. A pin bump is being added to this PR, the same kind of fix as e923e5e.

The D-Bus test failure on this PR did not happen on main, and it can't be reproduced locally after 40 runs. I've re-run the failed job once to check whether it's a flake. A change is also coming so a failure in this test prints the wrapper's full report.

---

Generated by Claude Code