ShadowCode 2.1: ARM64, APT repo, installer rollback, Flatpak allow-list, window size, model history

.github/workflows/ci.yml

@@ -42,6 +42,8 @@ jobs:
           node --test scripts/test-check-secrets.mjs
       - name: Verify publisher authentication and private release snapshots
         run: node --test scripts/test-native-release-auth.mjs
+      - name: Signed APT repository builder
+        run: node --test scripts/test-build-apt-repo.mjs
       - name: Managed llama.cpp packaging (pins, notices, relative links, deb repack)
         run: node --test scripts/test-llama-runtime.mjs scripts/test-llama-build-inputs.mjs
       - name: Packaging PATH ignores host node hijacks
@@ -52,3 +54,124 @@ jobs:
         run: |
           node --test --test-reporter=tap scripts/test-install-auth.mjs
           bash scripts/test-install-appimage.sh
+  # Pull requests that touch packaging inputs also run the packaging checks on
+  # both architectures and build the Flatpak. Change detection uses Git only,
+  # so no third-party path-filter action has to be trusted.
+  packaging-changes:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    outputs:
+      packaging: ${{ steps.diff.outputs.packaging }}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - id: diff
+        name: Detect packaging, scripts, desktop, core or workflow changes
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          changed=$(git diff --name-only "$BASE_SHA...$HEAD_SHA")
+          printf '%s\n' "$changed"
+          if printf '%s\n' "$changed" | grep -Eq '^(packaging|scripts|src-tauri|native|\.github/workflows)/'; then
+            echo packaging=true >> "$GITHUB_OUTPUT"
+          else
+            echo packaging=false >> "$GITHUB_OUTPUT"
+          fi
+  packaging-dry-run:
+    needs: packaging-changes
+    if: needs.packaging-changes.outputs.packaging == 'true'
+    name: packaging dry run (${{ matrix.arch }})
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: x86_64
+            runner: ubuntu-24.04
+          - arch: aarch64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: '22'
+      - name: Debian packaging tools
+        run: sudo apt-get update && sudo apt-get install -y lintian desktop-file-utils appstream
+      - name: Architecture names, release authentication and signed targets
+        run: node --test scripts/test-native-arch.mjs scripts/test-native-release-auth.mjs
+      - name: Debian package assembly, runtime repack and desktop metadata
+        run: node --test scripts/test-native-deb.mjs scripts/test-llama-runtime.mjs scripts/test-native-desktop-metadata.mjs scripts/test-native-app-run.mjs
+      - name: Packaging PATH and pinned sources
+        run: node --test scripts/test-native-packaging-env.mjs scripts/test-native-source-fetch.mjs
+      - name: Installer on this architecture
+        run: |
+          node --test --test-reporter=tap scripts/test-install-auth.mjs
+          bash scripts/test-install-appimage.sh
+      - name: Shell syntax of packaging scripts
+        run: |
+          for script in packaging/native-app-run.sh packaging/native-runtime/build.sh packaging/flatpak/build-in-sdk.sh scripts/*.sh; do
+            bash -n "$script"
+          done
+          python3 -m py_compile scripts/build-flatpak.py
+  flatpak:
+    needs: packaging-changes
+    if: needs.packaging-changes.outputs.packaging == 'true'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 150
+    env:
+      RUSTUP_TOOLCHAIN: '1.95.0'
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: '22'
+      - name: Install the pinned Rust toolchain
+        run: rustup toolchain install 1.95.0 --profile minimal
+      - name: Flatpak tools and Flathub
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y flatpak flatpak-builder dbus-daemon
+          # flatpak-builder's bubblewrap needs unprivileged user namespaces,
+          # which Ubuntu 24.04 restricts through AppArmor by default.
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+          flatpak remote-add --user --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
+      - name: Restore the flatpak-builder and SDK build caches
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.flatpak-builder
+            target/flatpak/sdk-cargo-cache
+            target/flatpak/sdk-native-cache
+          key: flatpak-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('Cargo.lock', 'ui/package-lock.json', 'tools/llama.cpp.pin', 'packaging/flatpak/**', 'scripts/build-flatpak.py') }}
+          restore-keys: |
+            flatpak-${{ runner.os }}-${{ runner.arch }}-
+      - name: Build the Flatpak with the GNOME 50 SDK (CPU-only llama.cpp)
+        # Releases also build the Vulkan module; it is skipped here for time.
+        run: python3 scripts/build-flatpak.py --cpu-only-llama --install-deps-from=flathub --state-dir ~/.flatpak-builder
+      - name: Install and start the bundle
+        run: |
+          flatpak install --user --noninteractive target/flatpak/ShadowCode_*_x86_64.flatpak
+          # `flatpak run` needs a session bus; the runner has no desktop session.
+          dbus-run-session -- flatpak run com.shadowfetch.shadowcode --version
+          dbus-run-session -- flatpak run --command=/app/lib/shadowcode/llama-server com.shadowfetch.shadowcode --version
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        if: always()
+        with:
+          name: flatpak-pr-build
+          retention-days: 7
+          if-no-files-found: ignore
+          path: |
+            target/flatpak/*.flatpak
+            target/flatpak/SHA256SUMS
+            target/flatpak/SOURCE-INPUTS.json
+            target/flatpak/com.shadowfetch.shadowcode.json

.github/workflows/native.yml

@@ -8,7 +8,24 @@ permissions:
   contents: read
 jobs:
   verify:
-    runs-on: ubuntu-24.04
+    # x86_64 and aarch64 (GitHub's Arm runners) build and qualify natively.
+    # The x86_64 leg keeps its historical artifact names (empty suffix).
+    name: verify (${{ matrix.arch }})
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: x86_64
+            runner: ubuntu-24.04
+            appimage: amd64
+            deb: amd64
+            suffix: ''
+          - arch: aarch64
+            runner: ubuntu-24.04-arm
+            appimage: aarch64
+            deb: arm64
+            suffix: '-aarch64'
+    runs-on: ${{ matrix.runner }}
     timeout-minutes: 120
     env:
       RUSTUP_TOOLCHAIN: '1.95.0'
@@ -23,15 +40,15 @@ jobs:
           cache: npm
           cache-dependency-path: ui/package-lock.json
       - name: Native window dependencies
-        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.1-dev libgtk-3-dev librsvg2-dev libayatana-appindicator3-dev libasound2-dev patchelf webkit2gtk-driver xvfb appstream dbus-daemon dbus-bin lintian desktop-file-utils
+        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.1-dev libgtk-3-dev librsvg2-dev libayatana-appindicator3-dev libasound2-dev patchelf webkit2gtk-driver xvfb appstream dbus-daemon dbus-bin lintian desktop-file-utils xdg-utils
       - name: Test release staging and immutable retry behavior
-        run: node --test scripts/test-native-release.mjs scripts/test-native-release-verification.mjs scripts/test-publisher-auth.mjs scripts/test-native-release-signing.mjs scripts/test-native-test-session.mjs scripts/test-clean-host-mcp-receipt.mjs scripts/test-clean-host-container.mjs scripts/test-native-app-run.mjs scripts/test-llama-build-inputs.mjs && node scripts/test-native-process-ownership.mjs
+        run: node --test scripts/test-native-release.mjs scripts/test-native-release-verification.mjs scripts/test-publisher-auth.mjs scripts/test-native-release-signing.mjs scripts/test-native-test-session.mjs scripts/test-clean-host-mcp-receipt.mjs scripts/test-clean-host-container.mjs scripts/test-native-app-run.mjs scripts/test-llama-build-inputs.mjs scripts/test-native-arch.mjs && node scripts/test-native-process-ownership.mjs
       - name: Verify publisher authentication and private release snapshots
         run: node --test scripts/test-native-release-auth.mjs scripts/test-check-secrets.mjs
       - name: Package version
         run: echo "VERSION=$(node -p "require('./src-tauri/tauri.conf.json').version")" >> "$GITHUB_ENV"
       - name: Managed llama.cpp build dependencies
-        run: sudo apt-get install -y cmake ninja-build libssl-dev libvulkan-dev glslc spirv-headers
+        run: sudo apt-get install -y cmake ninja-build libssl-dev libvulkan-dev glslc spirv-headers gcc-14 g++-14
       - run: npm --prefix ui ci && npm --prefix ui run build && npm --prefix ui test
       - name: Install pinned Rust toolchain
         run: rustup toolchain install 1.95.0 --profile minimal --component rustfmt --component clippy
@@ -50,7 +67,7 @@ jobs:
         if: always()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
-          name: built-project-cleanup-diagnostics
+          name: built-project-cleanup-diagnostics${{ matrix.suffix }}
           path: artifacts/built-project-cleanup
       - name: Exercise the native CLI without a display
         run: node scripts/test-native-cli.mjs
@@ -59,7 +76,7 @@ jobs:
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: always()
         with:
-          name: native-stress-diagnostics
+          name: native-stress-diagnostics${{ matrix.suffix }}
           path: artifacts/native-stress
       - name: Exercise the native terminal through a real PTY
         run: node scripts/test-native-tui.mjs
@@ -74,14 +91,14 @@ jobs:
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: always()
         with:
-          name: native-mcp-server-diagnostics
+          name: native-mcp-server-diagnostics${{ matrix.suffix }}
           path: |
             artifacts/native-mcp-server*
             artifacts/native-mcp-peer
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: always()
         with:
-          name: native-cli-diagnostics
+          name: native-cli-diagnostics${{ matrix.suffix }}
           path: |
             artifacts/native-cli
             artifacts/native-tui
@@ -95,7 +112,7 @@ jobs:
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: always()
         with:
-          name: native-window-diagnostics
+          name: native-window-diagnostics${{ matrix.suffix }}
           path: |
             artifacts/native
             artifacts/native-markdown
@@ -113,19 +130,19 @@ jobs:
             tools/llama.cpp
             tools/spirv-headers
             tools/spirv-headers-prefix
-          key: llama-cpp-${{ runner.os }}-${{ hashFiles('tools/llama.cpp.pin', 'scripts/build-llama.cpp.sh') }}
+          key: llama-cpp-${{ runner.os }}${{ matrix.suffix }}-${{ hashFiles('tools/llama.cpp.pin', 'scripts/build-llama.cpp.sh') }}
       - name: Build the managed llama.cpp runtime (Vulkan + all CPU variants)
         run: bash scripts/build-llama.cpp.sh --no-user-install
       - name: Check the managed runtime packaging steps
         run: node --test scripts/test-llama-runtime.mjs scripts/test-native-desktop-metadata.mjs
       - name: Build native development packages with dependency notices
         run: node scripts/build-native.mjs
       - name: Inspect both packages
-        run: node scripts/check-native-package.mjs "target/release/bundle/appimage/ShadowCode_${VERSION}_amd64.AppImage" "target/release/bundle/deb/ShadowCode_${VERSION}_amd64.deb"
+        run: node scripts/check-native-package.mjs "target/release/bundle/appimage/ShadowCode_${VERSION}_${{ matrix.appimage }}.AppImage" "target/release/bundle/deb/ShadowCode_${VERSION}_${{ matrix.deb }}.deb"
       - name: Build runtime-only clean-host qualification image
-        run: docker build -f scripts/clean-host-runtime.Dockerfile -t shadowcode-clean-runtime:ci scripts
+        run: docker build --build-arg TARGETARCH="$(dpkg --print-architecture)" -f scripts/clean-host-runtime.Dockerfile -t shadowcode-clean-runtime:ci scripts
       - name: Install and first-launch both packages in an offline clean host
-        run: node scripts/test-clean-host-packages.mjs "target/release/bundle/appimage/ShadowCode_${VERSION}_amd64.AppImage" "target/release/bundle/deb/ShadowCode_${VERSION}_amd64.deb" artifacts/native-package/SHA256SUMS
+        run: node scripts/test-clean-host-packages.mjs "target/release/bundle/appimage/ShadowCode_${VERSION}_${{ matrix.appimage }}.AppImage" "target/release/bundle/deb/ShadowCode_${VERSION}_${{ matrix.deb }}.deb" artifacts/native-package/SHA256SUMS
       - name: Reject AppImage extraction writes that fail
         run: node scripts/test-native-runtime-write-errors.mjs
       - name: Rebuild the shipped runtime sources without network access
@@ -138,58 +155,58 @@ jobs:
           bash scripts/test-install-appimage.sh
       - name: Exercise the packaged CLI without a display
         env:
-          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_amd64.AppImage
+          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_${{ matrix.appimage }}.AppImage
           SHADOW_CLI_ARGS: '["--appimage-extract-and-run"]'
           SHADOW_CLI_ARTIFACTS: artifacts/native-package/cli
         run: node scripts/test-native-cli.mjs
       - name: Exercise the packaged native terminal
         env:
-          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_amd64.AppImage
+          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_${{ matrix.appimage }}.AppImage
           SHADOW_CLI_ARGS: '["--appimage-extract-and-run"]'
           SHADOW_TUI_ARTIFACTS: artifacts/native-package/tui
         run: node scripts/test-native-tui.mjs
       - name: Exercise the packaged native window
         env:
-          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_amd64.AppImage
+          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_${{ matrix.appimage }}.AppImage
           SHADOW_DESKTOP_ARGS: '["--appimage-extract-and-run","ui"]'
           SHADOW_NATIVE_DEFAULT_PROFILE: '1'
           SHADOW_NATIVE_ARTIFACTS: artifacts/native-package/window
         run: node scripts/run-native-x11.mjs node scripts/test-native-desktop.mjs
       - name: Exercise the packaged Markdown worker under its native security policy
         env:
-          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_amd64.AppImage
+          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_${{ matrix.appimage }}.AppImage
           SHADOW_DESKTOP_ARGS: '["--appimage-extract-and-run"]'
           SHADOW_NATIVE_ARTIFACTS: artifacts/native-package/markdown
         run: node scripts/run-native-x11.mjs node scripts/test-native-markdown.mjs
       - name: Exercise the packaged native MCP server
         env:
-          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_amd64.AppImage
+          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_${{ matrix.appimage }}.AppImage
           SHADOW_CLI_ARGS: '["--appimage-extract-and-run"]'
           SHADOW_MCP_ARTIFACTS: artifacts/native-package/mcp-server
         run: node scripts/test-native-mcp-server.mjs
       - name: Exercise the packaged native MCP HTTP server
         env:
-          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_amd64.AppImage
+          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_${{ matrix.appimage }}.AppImage
           SHADOW_CLI_ARGS: '["--appimage-extract-and-run"]'
           SHADOW_MCP_ARTIFACTS: artifacts/native-package/mcp-server-http
           SHADOW_MCP_TRANSPORT: http
         run: node scripts/test-native-mcp-server.mjs
       - name: Verify packaged MCP interoperability with official TypeScript clients
         env:
-          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_amd64.AppImage
+          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_${{ matrix.appimage }}.AppImage
           SHADOW_CLI_ARGS: '["--appimage-extract-and-run"]'
           SHADOW_MCP_PEER_ARTIFACTS: artifacts/native-package/mcp-peer
         run: node scripts/test-native-mcp-peer.mjs
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: always()
         with:
-          name: native-package-diagnostics
+          name: native-package-diagnostics${{ matrix.suffix }}
           path: |
             artifacts/native-package
             artifacts/native-x11
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
-          name: native-linux-development
+          name: native-linux-development${{ matrix.suffix }}
           retention-days: 14
           path: |
             target/release/bundle/appimage/*.AppImage